opendevbrowser 0.0.27 → 0.0.28

package/dist/{chunk-MWBDO2L5.js → chunk-I5ZCOZZV.js}

@@ -47,7 +47,7 @@ import {
   runResearchWorkflow,
   runShoppingWorkflow,
   toSnippet
-} from "./chunk-V5DJUSPV.js";
+} from "./chunk-T3VVHJTK.js";
 import {
   ProviderRuntimeError
 } from "./chunk-FUSXMW3G.js";
@@ -3199,6 +3199,19 @@ var isExplicitShoppingExtensionRequest = (request) => {
   const preferredModes = request.runtimePolicy?.browser.preferredModes ?? request.preferredModes;
   return request.source === "shopping" && preferredModes?.length === 1 && preferredModes[0] === "extension";
 };
+var isExplicitSocialExtensionRequest = (request) => {
+  const preferredModes = request.runtimePolicy?.browser.preferredModes ?? request.preferredModes;
+  return request.source === "social" && request.runtimePolicy?.browser.forceTransport === true && preferredModes?.length === 1 && preferredModes[0] === "extension";
+};
+var shouldVerifyExtensionRequestUrl = (request) => isExplicitShoppingExtensionRequest(request) || isExplicitSocialExtensionRequest(request);
+var isRequiredExtensionSessionRequest = (request, runtimePolicy, preferredMode) => {
+  if (preferredMode !== "extension") {
+    return false;
+  }
+  const preferredModes = request.runtimePolicy?.browser.preferredModes ?? request.preferredModes;
+  return runtimePolicy.browser.forceTransport === true || runtimePolicy.cookies.policy === "required" || preferredModes?.length === 1 && preferredModes[0] === "extension";
+};
+var requiresAuthenticatedExtensionSession = (runtimePolicy) => runtimePolicy.cookies.policy === "required";
 var shouldAttachExtensionStartUrl = (request) => request.source === "social" || request.source === "shopping";
 var SOCIAL_EXTENSION_MODE_ATTEMPTS = 3;
 var resolveSocialExtensionModeAttempts = (request, preferredMode) => preferredMode === "extension" && request.source === "social" ? SOCIAL_EXTENSION_MODE_ATTEMPTS : 1;
@@ -3301,6 +3314,29 @@ var fallbackFailure = (reasonCode, message, cookieDiagnostics, challengeOrchestr
     ...options.details ? options.details : {}
   }
 });
+var extensionSessionRequiredFailure = (message, cookieDiagnostics, runtimePolicy, details) => {
+  const reasonMessage = `Logged-in extension session required: ${message}`;
+  cookieDiagnostics.reasonCode = "auth_required";
+  cookieDiagnostics.message = reasonMessage;
+  return fallbackFailure("auth_required", reasonMessage, cookieDiagnostics, void 0, runtimePolicy, {
+    mode: "extension",
+    details: {
+      ...details ?? {},
+      extensionSessionRequired: true
+    }
+  });
+};
+var extensionTransportUnavailableFailure = (message, cookieDiagnostics, runtimePolicy, details) => {
+  cookieDiagnostics.reasonCode = "env_limited";
+  cookieDiagnostics.message = message;
+  return fallbackFailure("env_limited", message, cookieDiagnostics, void 0, runtimePolicy, {
+    mode: "extension",
+    details: {
+      ...details ?? {},
+      extensionTransportRequired: true
+    }
+  });
+};
 var toJsonValue = (value) => {
   if (value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
     return value;
@@ -3364,7 +3400,7 @@ var buildFallbackChallengeOrchestration = (args2) => {
     mode: policy.mode,
     source: policy.source,
     ...policy.standDownReason ? { standDownReason: policy.standDownReason } : {},
-    helperEligibility: resolveFallbackHelperEligibility({
+    helperEligibility: args2.helperEligibility ?? resolveFallbackHelperEligibility({
       mode: policy.mode,
       helperBridgeEnabled: args2.helperBridgeEnabled
     }),
@@ -3372,6 +3408,11 @@ var buildFallbackChallengeOrchestration = (args2) => {
     reason: args2.reason
   });
 };
+var NO_ACTIVE_CHALLENGE_HELPER_ELIGIBILITY = {
+  allowed: false,
+  reason: "No active auth or challenge blocker was detected after capture.",
+  standDownReason: "helper_no_active_challenge"
+};
 var isPreserveEligibleBlocker = (blocker) => {
   return blocker?.type === "auth_required" || blocker?.type === "anti_bot_challenge";
 };
@@ -3771,16 +3812,20 @@ var createBrowserFallbackPort = (manager, cookieDefaults = {}, transportDefaults
             ensureNotAborted("mode_start");
             if (preferredMode === "extension") {
               if (!transportDefaults.extensionWsEndpoint) {
-                lastFailure = fallbackFailure("env_limited", "Extension fallback requires a relay endpoint.", cookieDiagnostics, void 0, runtimePolicyRecord);
+                lastFailure = isRequiredExtensionSessionRequest(request, runtimePolicy, preferredMode) ? extensionTransportUnavailableFailure(
+                  "Extension fallback requires a relay endpoint.",
+                  cookieDiagnostics,
+                  runtimePolicyRecord
+                ) : fallbackFailure("env_limited", "Extension fallback requires a relay endpoint.", cookieDiagnostics, void 0, runtimePolicyRecord);
                 continue;
               }
               const attachOptions = shouldAttachExtensionStartUrl(request) ? { startUrl: requestUrl } : void 0;
               const attached = await manager.connectRelay(transportDefaults.extensionWsEndpoint, attachOptions);
               sessionId = attached.sessionId;
-              if (isExplicitShoppingExtensionRequest(request)) {
+              if (shouldVerifyExtensionRequestUrl(request)) {
                 attachedUrl = (await manager.status(sessionId)).url;
                 navigatedDuringAttach = didExtensionAttachReachRequestUrl(requestUrl, attachedUrl);
-                if (isRestrictedExtensionAttachUrl(attachedUrl)) {
+                if (request.source === "shopping" && isRestrictedExtensionAttachUrl(attachedUrl)) {
                   const recovered = await reconnectExplicitShoppingExtensionSession({
                     manager,
                     sessionId,
@@ -3874,23 +3919,24 @@ var createBrowserFallbackPort = (manager, cookieDefaults = {}, transportDefaults
                 "settle"
               )
             );
-            if (preferredMode === "extension" && isExplicitShoppingExtensionRequest(request)) {
+            if (preferredMode === "extension" && shouldVerifyExtensionRequestUrl(request)) {
               const resolvedAttachStatus = await runWithinFallbackDeadline("status", async () => manager.status(activeSessionId));
               const observedUrl = normalizeExtensionAttachUrl(resolvedAttachStatus.url);
               if (!didExtensionAttachReachRequestUrl(requestUrl, resolvedAttachStatus.url)) {
-                lastFailure = fallbackFailure(
-                  "env_limited",
-                  "Extension fallback did not reach the requested shopping URL.",
+                const details = {
+                  requestedUrl: requestUrl,
+                  ...observedUrl ? { observedUrl } : {}
+                };
+                lastFailure = requiresAuthenticatedExtensionSession(runtimePolicy) ? extensionSessionRequiredFailure(
+                  "Extension fallback did not reach the requested provider URL.",
                   cookieDiagnostics,
-                  void 0,
                   runtimePolicyRecord,
-                  {
-                    mode: "extension",
-                    details: {
-                      requestedUrl: requestUrl,
-                      ...observedUrl ? { observedUrl } : {}
-                    }
-                  }
+                  details
+                ) : extensionTransportUnavailableFailure(
+                  "Extension fallback did not reach the requested provider URL.",
+                  cookieDiagnostics,
+                  runtimePolicyRecord,
+                  details
                 );
                 continue;
               }
@@ -4069,8 +4115,25 @@ var createBrowserFallbackPort = (manager, cookieDefaults = {}, transportDefaults
               runtimePolicy,
               helperBridgeEnabled,
               invoked: false,
-              reason: "Fallback capture cleared without an auth or challenge blocker, so challenge orchestration was not invoked."
+              reason: "Fallback capture cleared without an auth or challenge blocker, so challenge orchestration was not invoked.",
+              helperEligibility: NO_ACTIVE_CHALLENGE_HELPER_ELIGIBILITY
             });
+            if (html.trim().length === 0) {
+              lastFailure = fallbackFailure(
+                request.reasonCode,
+                `Browser fallback captured no HTML content at ${resolvedUrl}.`,
+                cookieDiagnostics,
+                challengeOrchestrationRecord,
+                runtimePolicyRecord,
+                {
+                  mode: toFallbackMode(status.mode),
+                  details: {
+                    captureDiagnostics
+                  }
+                }
+              );
+              continue;
+            }
             return {
               ok: true,
               reasonCode: request.reasonCode,
@@ -4107,7 +4170,7 @@ var createBrowserFallbackPort = (manager, cookieDefaults = {}, transportDefaults
             } : void 0;
             retryModeAttempt = preferredMode === "extension" && request.source === "social" && modeAttempt < maxModeAttempts;
             if (!retryModeAttempt) {
-              lastFailure = fallbackFailure(
+              lastFailure = isRequiredExtensionSessionRequest(request, runtimePolicy, preferredMode) ? extensionTransportUnavailableFailure(message, cookieDiagnostics, runtimePolicyRecord, timeoutDetails) : fallbackFailure(
                 "env_limited",
                 message,
                 cookieDiagnostics,
@@ -4212,7 +4275,7 @@ var createConfiguredProviderRuntime = (args2) => {
 
 // src/providers/runtime-bundle.ts
 var runtimeChallengeConfigFingerprints = /* @__PURE__ */ new WeakMap();
-var fallbackPortChallengeConfigFingerprints = /* @__PURE__ */ new WeakMap();
+var fallbackPortFingerprints = /* @__PURE__ */ new WeakMap();
 var canReuseRuntime = (runtime, challengeFingerprint, hasInitOverride, hasExplicitChallengeConfig) => {
   if (!runtime || hasInitOverride) {
     return false;
@@ -4223,37 +4286,47 @@ var canReuseRuntime = (runtime, challengeFingerprint, hasInitOverride, hasExplic
   }
   return fingerprint === challengeFingerprint;
 };
-var canReuseFallbackPort = (fallbackPort, challengeFingerprint) => {
+var canReuseFallbackPort = (fallbackPort, fingerprint) => {
   if (!fallbackPort) {
     return false;
   }
-  const fingerprint = fallbackPortChallengeConfigFingerprints.get(fallbackPort);
-  return fingerprint === void 0 || fingerprint === challengeFingerprint;
+  const currentFingerprint = fallbackPortFingerprints.get(fallbackPort);
+  if (currentFingerprint === void 0) {
+    return !fingerprint.includes('"extensionWsEndpoint":"ws://');
+  }
+  return currentFingerprint === fingerprint;
 };
 var resolveFallbackTransportConfig = (config) => config && typeof config.relayPort === "number" && config.relayPort > 0 && config.relayToken !== false ? { extensionWsEndpoint: `ws://127.0.0.1:${config.relayPort}` } : {};
+var fallbackPortFingerprint = (challengeFingerprint, transportConfig) => JSON.stringify({
+  challengeFingerprint,
+  extensionWsEndpoint: transportConfig.extensionWsEndpoint ?? null
+});
 var createProviderRuntimeBundle = (args2) => {
   const challengeConfig = resolveEffectiveChallengeConfig(args2.config, args2.challengeConfig);
   const challengeFingerprint = challengeConfig ? JSON.stringify(challengeConfig) : null;
-  const browserFallbackPort = canReuseFallbackPort(args2.browserFallbackPort, challengeFingerprint) ? args2.browserFallbackPort : createBrowserFallbackPort(
+  const transportConfig = resolveFallbackTransportConfig(args2.config);
+  const fallbackFingerprint = fallbackPortFingerprint(challengeFingerprint, transportConfig);
+  const challengeOrchestrator = args2.challengeOrchestrator ?? (challengeConfig ? new ChallengeOrchestrator(challengeConfig) : void 0);
+  const browserFallbackPort = canReuseFallbackPort(args2.browserFallbackPort, fallbackFingerprint) ? args2.browserFallbackPort : createBrowserFallbackPort(
     args2.manager,
     {
       policy: args2.config?.providers?.cookiePolicy,
       source: args2.config?.providers?.cookieSource
     },
-    resolveFallbackTransportConfig(args2.config),
-    args2.challengeOrchestrator,
+    transportConfig,
+    challengeOrchestrator,
     challengeConfig?.mode ?? "browser_with_helper",
     challengeConfig?.optionalComputerUseBridge.enabled ?? true
   );
   if (browserFallbackPort && browserFallbackPort !== args2.browserFallbackPort) {
-    fallbackPortChallengeConfigFingerprints.set(browserFallbackPort, challengeFingerprint);
+    fallbackPortFingerprints.set(browserFallbackPort, fallbackFingerprint);
   }
   const providerRuntime = createConfiguredProviderRuntime({
     config: args2.config,
     manager: args2.manager,
     browserFallbackPort,
     challengeConfig,
-    challengeOrchestrator: args2.challengeOrchestrator,
+    challengeOrchestrator,
     init: args2.init
   });
   runtimeChallengeConfigFingerprints.set(
@@ -21733,6 +21806,7 @@ var APPROVED_LIBRARY_ENTRIES = {
   motion: new Set(PROJECT_DEFAULT_LIBRARY_POLICY.motion),
   threeD: new Set(PROJECT_DEFAULT_LIBRARY_POLICY.threeD)
 };
+var UNSUPPORTED_RUNTIME_LIBRARY_POLICY_KEYS = ["motion", "threeD"];
 var PROJECT_DEFAULT_RUNTIME_BUDGETS = {
   defaultLivePreviewLimit: 2,
   maxPinnedFullPreviewExtra: 1,
@@ -23170,6 +23244,8 @@ function buildGovernanceBlockStates(document2) {
     if (isNonEmptyRecord(block)) {
       if (key === "generationPlan") {
         status = assessGenerationPlan(block).status === "invalid" ? "invalid" : "present";
+      } else if (key === "libraryPolicy" && hasUnsupportedRuntimeLanePolicy(document2)) {
+        status = "invalid";
       } else {
         const inheritedDefault = OPTIONAL_INHERITED_KEYS.has(key) ? inheritedDefaultForGovernanceKey(key) : null;
         status = inheritedDefault && stableStringify(block) === stableStringify(inheritedDefault) ? "inherited" : "present";
@@ -23254,7 +23330,13 @@ function evaluateCanvasWarnings(document2, options = {}) {
     warnings.push(buildWarning("responsive-mismatch", "Viewport coverage is incomplete for desktop, tablet, and mobile previews.", { auditId: "CANVAS-02" }));
   }
   if (hasDisallowedLibrary(document2)) {
-    warnings.push(buildWarning("library-policy-violation", "Library policy references a non-approved canvas library.", { auditId: "CANVAS-04", severity: "error" }));
+    const runtimeLaneViolations = runtimeLanePolicyViolations(resolveCanvasLibraryPolicy(document2));
+    const details = runtimeLaneViolations.length > 0 ? { runtimeLaneViolations } : void 0;
+    warnings.push(buildWarning("library-policy-violation", "Library policy references a non-approved canvas library.", {
+      auditId: "CANVAS-04",
+      severity: "error",
+      ...details ? { details } : {}
+    }));
   }
   if (hasIconPolicyViolation(document2)) {
     warnings.push(buildWarning("icon-policy-violation", "Icon policy references a non-approved icon family.", { auditId: "CANVAS-04", severity: "error" }));
@@ -23315,7 +23397,12 @@ function evaluateCanvasWarnings(document2, options = {}) {
 }
 function missingRequiredSaveBlocks(document2) {
   const states = buildGovernanceBlockStates(document2);
-  return REQUIRED_BEFORE_SAVE_KEYS.filter((key) => key === "generationPlan" ? states[key].status === "missing" || states[key].status === "invalid" : states[key].status === "missing");
+  return REQUIRED_BEFORE_SAVE_KEYS.filter((key) => {
+    if (key === "generationPlan" || key === "libraryPolicy") {
+      return states[key].status === "missing" || states[key].status === "invalid";
+    }
+    return states[key].status === "missing";
+  });
 }
 function validateCanvasSave(document2) {
   const missingBlocks = missingRequiredSaveBlocks(document2);
@@ -23351,6 +23438,20 @@ function hasDisallowedLibrary(document2) {
   const policy = resolveCanvasLibraryPolicy(document2);
   return Object.entries(policy).some(([category, entries]) => entries.some((entry) => !APPROVED_LIBRARY_ENTRIES[category].has(entry)));
 }
+function runtimeLanePolicyViolations(policy) {
+  return UNSUPPORTED_RUNTIME_LIBRARY_POLICY_KEYS.map((category) => ({ category, entries: policy[category] })).filter((violation) => violation.entries.length > 0);
+}
+function hasUnsupportedRuntimeLanePolicy(document2) {
+  return runtimeLanePolicyViolations(resolveCanvasLibraryPolicy(document2)).length > 0;
+}
+function assertNoUnsupportedRuntimeLanePolicy(document2) {
+  const violations = runtimeLanePolicyViolations(resolveCanvasLibraryPolicy(document2));
+  if (violations.length === 0) {
+    return;
+  }
+  const paths = violations.map(({ category }) => `libraryPolicy.${category}`).join(", ");
+  throw new Error(`${paths} must stay empty. Put shader, WebGL, Spline, and advanced motion cues in motionSystem or generationPlan.designVectors as advisory metadata only.`);
+}
 function hasIconPolicyViolation(document2) {
   const iconRoles = readCanvasIconRoles(document2);
   return Object.values(iconRoles).filter((entry) => Boolean(entry)).some((entry) => !APPROVED_LIBRARY_ENTRIES.icons.has(entry));
@@ -23681,6 +23782,7 @@ var CanvasDocumentStore = class {
   }
   replaceDocument(document2, revision, origin) {
     const nextDocument = normalizeCanvasDocument(document2);
+    assertNoUnsupportedRuntimeLanePolicy(nextDocument);
     nextDocument.updatedAt = nowIso();
     this.ydoc.transact(() => {
       clearYMap(this.root);
@@ -30183,7 +30285,7 @@ function optionalString4(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
 }
 
-// src/browser/canvas-manager.ts
+// src/canvas/guidance.ts
 var PREPLAN_CANVAS_GUIDANCE = {
   recommendedNextCommands: ["canvas.plan.set"],
   reason: "Handshake is complete. Submit a complete generationPlan before mutation."
@@ -30224,6 +30326,30 @@ var CANVAS_GUIDANCE_BY_COMMAND = {
   "canvas.document.save": PERSISTED_CANVAS_GUIDANCE,
   "canvas.document.export": EXPORTED_CANVAS_GUIDANCE
 };
+var CANVAS_REQUIRED_COMMANDS_BY_BLOCKER = {
+  plan_required: ["canvas.plan.set"],
+  generation_plan_invalid: ["canvas.plan.set", "canvas.plan.get"],
+  revision_conflict: ["canvas.document.load"],
+  policy_violation: ["canvas.plan.get", "canvas.document.load"],
+  unsupported_target: ["canvas.session.status"],
+  lease_reclaim_required: ["canvas.session.status"]
+};
+var cloneCanvasGuidance = (guidance) => ({
+  recommendedNextCommands: [...guidance.recommendedNextCommands],
+  reason: guidance.reason
+});
+var buildCanvasCommandGuidance = (input) => {
+  if (input.planStatus === "invalid") {
+    return cloneCanvasGuidance(INVALID_PLAN_CANVAS_GUIDANCE);
+  }
+  if (input.planStatus !== "accepted") {
+    return cloneCanvasGuidance(PREPLAN_CANVAS_GUIDANCE);
+  }
+  return cloneCanvasGuidance(CANVAS_GUIDANCE_BY_COMMAND[input.command] ?? PLAN_ACCEPTED_CANVAS_GUIDANCE);
+};
+var getCanvasRequiredNextCommands = (code) => [...CANVAS_REQUIRED_COMMANDS_BY_BLOCKER[code]];
+
+// src/browser/canvas-manager.ts
 function resolveGenerationPlanState(plan) {
   const assessment = assessGenerationPlan(plan);
   if (assessment.status === "accepted") {
@@ -32170,14 +32296,10 @@ var CanvasManager = class {
     };
   }
   buildCanvasGuidance(session, command) {
-    if (session.planStatus === "invalid") {
-      return cloneCanvasGuidance(INVALID_PLAN_CANVAS_GUIDANCE);
-    }
-    if (session.planStatus !== "accepted") {
-      return cloneCanvasGuidance(PREPLAN_CANVAS_GUIDANCE);
-    }
-    const guidance = CANVAS_GUIDANCE_BY_COMMAND[command] ?? PLAN_ACCEPTED_CANVAS_GUIDANCE;
-    return cloneCanvasGuidance(guidance);
+    return buildCanvasCommandGuidance({
+      planStatus: session.planStatus,
+      command
+    });
   }
   buildSessionSummary(session) {
     const document2 = session.store.getDocument();
@@ -32408,7 +32530,7 @@ var CanvasManager = class {
     const blocker = {
       code: "plan_required",
       blockingCommand: command,
-      requiredNextCommands: ["canvas.plan.set"],
+      requiredNextCommands: getCanvasRequiredNextCommands("plan_required"),
       latestRevision: session.store.getRevision(),
       message: "generationPlan must be accepted before mutation."
     };
@@ -32418,7 +32540,7 @@ var CanvasManager = class {
     const blocker = {
       code: "generation_plan_invalid",
       blockingCommand: command,
-      requiredNextCommands: ["canvas.plan.set", "canvas.plan.get"],
+      requiredNextCommands: getCanvasRequiredNextCommands("generation_plan_invalid"),
       latestRevision: session.store.getRevision(),
       message: this.describeGenerationPlanFailure(missingFields, issues)
     };
@@ -32436,7 +32558,7 @@ var CanvasManager = class {
     const blocker = {
       code: "revision_conflict",
       blockingCommand: command,
-      requiredNextCommands: ["canvas.document.load"],
+      requiredNextCommands: getCanvasRequiredNextCommands("revision_conflict"),
       latestRevision: session.store.getRevision(),
       message: "The canvas document revision changed before this patch batch was applied."
     };
@@ -32446,7 +32568,7 @@ var CanvasManager = class {
     const blocker = {
       code: "policy_violation",
       blockingCommand: command,
-      requiredNextCommands: ["canvas.plan.get", "canvas.document.load"],
+      requiredNextCommands: getCanvasRequiredNextCommands("policy_violation"),
       latestRevision: session.store.getRevision(),
       message: `Required save governance blocks are missing: ${missingBlocks.join(", ")}.`
     };
@@ -32464,7 +32586,7 @@ var CanvasManager = class {
     const blocker = {
       code: "unsupported_target",
       blockingCommand: command,
-      requiredNextCommands: ["canvas.session.status"],
+      requiredNextCommands: getCanvasRequiredNextCommands("unsupported_target"),
       latestRevision: session.store.getRevision(),
       message: `Canvas target is unavailable: ${targetId}.`
     };
@@ -32481,7 +32603,7 @@ var CanvasManager = class {
     const blocker = {
       code: "lease_reclaim_required",
       blockingCommand: "canvas.session.status",
-      requiredNextCommands: ["canvas.session.status"],
+      requiredNextCommands: getCanvasRequiredNextCommands("lease_reclaim_required"),
       latestRevision: session.store.getRevision(),
       message: "The canvas lease was reclaimed or replaced."
     };
@@ -32535,13 +32657,13 @@ var CanvasManager = class {
     const blocker = session.planStatus === "invalid" ? {
       code: "generation_plan_invalid",
       blockingCommand: "canvas.feedback.poll",
-      requiredNextCommands: ["canvas.plan.set", "canvas.plan.get"],
+      requiredNextCommands: getCanvasRequiredNextCommands("generation_plan_invalid"),
       latestRevision: session.store.getRevision(),
       message: this.describeGenerationPlanFailure([], session.planIssues)
     } : {
       code: "plan_required",
       blockingCommand: "canvas.feedback.poll",
-      requiredNextCommands: ["canvas.plan.set"],
+      requiredNextCommands: getCanvasRequiredNextCommands("plan_required"),
       latestRevision: session.store.getRevision(),
       message: "generationPlan must be accepted before the live design loop is ready."
     };
@@ -34289,12 +34411,6 @@ function attachDetails(error, details) {
   Object.assign(error, details);
   return error;
 }
-function cloneCanvasGuidance(guidance) {
-  return {
-    recommendedNextCommands: [...guidance.recommendedNextCommands],
-    reason: guidance.reason
-  };
-}
 
 // src/relay/relay-server.ts
 import { createServer } from "http";
@@ -36752,6 +36868,10 @@ var readTargetedSocialPlatform = (providerId) => {
       return "bluesky";
     case "social/reddit":
       return "reddit";
+    case "social/facebook":
+      return "facebook";
+    case "social/threads":
+      return "threads";
     default:
       return null;
   }
@@ -36902,7 +37022,8 @@ var buildRunOptions = (resolution, overrides) => {
   return {
     source,
     ...providerId ? { providerIds: [providerId] } : {},
-    ...overrides?.challengeAutomationMode ? { challengeAutomationMode: overrides.challengeAutomationMode } : {}
+    ...overrides?.challengeAutomationMode ? { challengeAutomationMode: overrides.challengeAutomationMode } : {},
+    ...overrides?.browserMode ? { runtimePolicy: { browserMode: overrides.browserMode } } : {}
   };
 };
 var executeMacroResolution = async (resolution, runtime, overrides) => {
@@ -36990,7 +37111,10 @@ var executeMacroWithRuntime = async (args2) => {
     await executeMacroResolution(
       args2.resolution,
       runtime,
-      args2.challengeAutomationMode ? { challengeAutomationMode: args2.challengeAutomationMode } : void 0
+      args2.challengeAutomationMode || args2.browserMode ? {
+        ...args2.browserMode ? { browserMode: args2.browserMode } : {},
+        ...args2.challengeAutomationMode ? { challengeAutomationMode: args2.challengeAutomationMode } : {}
+      } : void 0
     )
   );
 };
@@ -38035,21 +38159,32 @@ async function handleDaemonCommand(core, request) {
             count: cookies.length
           };
         }
-        case "macro.resolve":
+        case "macro.resolve": {
+          const execute = optionalBoolean2(params2.execute) ?? false;
+          const browserMode = optionalWorkflowBrowserMode(params2.browserMode);
+          const challengeAutomationMode = optionalChallengeAutomationMode(params2.challengeAutomationMode);
+          if (!execute && browserMode) {
+            throw new Error("browserMode requires execute=true for macro resolution");
+          }
+          if (!execute && challengeAutomationMode) {
+            throw new Error("challengeAutomationMode requires execute=true for macro resolution");
+          }
           return resolveMacroExpression(
             {
               expression: requireString3(params2.expression, "expression"),
               defaultProvider: optionalString6(params2.defaultProvider),
               includeCatalog: optionalBoolean2(params2.includeCatalog) ?? false,
-              execute: optionalBoolean2(params2.execute) ?? false,
+              execute,
               timeoutMs: optionalNumber(params2.timeoutMs, "timeoutMs"),
-              challengeAutomationMode: optionalChallengeAutomationMode(params2.challengeAutomationMode)
+              browserMode,
+              challengeAutomationMode
             },
             core.config,
             core.manager,
             core.browserFallbackPort,
             core.providerRuntime
           );
+        }
         case "research.run":
           return runResearchWorkflow(
             createDaemonWorkflowRuntime(core),
@@ -38066,6 +38201,7 @@ async function handleDaemonCommand(core, request) {
               timeoutMs: optionalNumber(params2.timeoutMs, "timeoutMs"),
               outputDir: optionalString6(params2.outputDir),
               ttlHours: optionalNumber(params2.ttlHours, "ttlHours"),
+              browserMode: optionalWorkflowBrowserMode(params2.browserMode),
               useCookies: optionalBoolean2(params2.useCookies),
               challengeAutomationMode: optionalChallengeAutomationMode(params2.challengeAutomationMode),
               cookiePolicyOverride: optionalCookiePolicy(params2.cookiePolicyOverride)
@@ -38103,6 +38239,7 @@ async function handleDaemonCommand(core, request) {
               timeoutMs: inspiredesignTimeoutMs,
               outputDir: optionalString6(params2.outputDir),
               ttlHours: optionalNumber(params2.ttlHours, "ttlHours"),
+              browserMode: optionalWorkflowBrowserMode(params2.browserMode),
               useCookies: optionalBoolean2(params2.useCookies),
               challengeAutomationMode: optionalChallengeAutomationMode(params2.challengeAutomationMode),
               cookiePolicyOverride: optionalCookiePolicy(params2.cookiePolicyOverride)
@@ -38129,6 +38266,7 @@ async function handleDaemonCommand(core, request) {
               output_dir: optionalString6(params2.output_dir),
               ttl_hours: optionalNumber(params2.ttl_hours, "ttl_hours"),
               timeoutMs: productVideoTimeoutMs,
+              browserMode: optionalWorkflowBrowserMode(params2.browserMode),
               useCookies: optionalBoolean2(params2.useCookies),
               challengeAutomationMode: optionalChallengeAutomationMode(params2.challengeAutomationMode),
               cookiePolicyOverride: optionalCookiePolicy(params2.cookiePolicyOverride)
@@ -39089,6 +39227,7 @@ async function resolveMacroExpression(options, config, manager, browserFallbackP
     manager,
     browserFallbackPort,
     timeoutMs: options.timeoutMs,
+    browserMode: options.browserMode,
     challengeAutomationMode: options.challengeAutomationMode
   });
   const handoff = buildMacroResolveSuccessHandoff({
@@ -40471,8 +40610,8 @@ var onboarding_metadata_default = {
     skillList: "opendevbrowser_skill_list",
     skillLoad: 'opendevbrowser_skill_load opendevbrowser-best-practices "quick start"',
     validatedLanes: 'opendevbrowser_skill_load opendevbrowser-best-practices "validated capability lanes"',
-    validatedResearch: 'npx opendevbrowser research run --topic "Chrome extension debugging workflows" --days 30 --source-selection auto --mode json --output-format json',
-    validatedShopping: 'npx opendevbrowser shopping run --query "wireless ergonomic mouse" --providers shopping/bestbuy,shopping/ebay --budget 150 --browser-mode managed --mode json --output-format json',
+    validatedResearch: 'npx opendevbrowser research run --topic "Chrome extension debugging workflows" --days 30 --source-selection auto --browser-mode managed --mode json --output-format json',
+    validatedShopping: 'npx opendevbrowser shopping run --query "wireless ergonomic mouse" --providers shopping/bestbuy,shopping/ebay --budget 150 --browser-mode managed --use-cookies --challenge-automation-mode browser_with_helper --mode json --output-format json',
     computerUseEntry: 'npx opendevbrowser research run --topic "account recovery flow" --source-selection auto --challenge-automation-mode browser --mode json --output-format json',
     happyPath: "npx opendevbrowser launch --no-extension --headless --start-url https://example.com --output-format json"
   },
@@ -40616,7 +40755,7 @@ var DEFAULT_WORKFLOW_TRANSPORT_TIMEOUT_MS = 12e4;
 // src/public-surface/generated-manifest.ts
 var PUBLIC_SURFACE_MANIFEST = {
   "schemaVersion": "2026-04-04",
-  "generatedAt": "2026-04-28T03:51:39.553Z",
+  "generatedAt": "2026-04-30T02:27:58.736Z",
   "cli": {
     "groups": [
       {
@@ -41042,7 +41181,7 @@ var PUBLIC_SURFACE_MANIFEST = {
           "--timeout-ms"
         ],
         "examples": [
-          "npx opendevbrowser status-capabilities --session-id s1 --target-id page-1 --challenge-automation-mode browser --timeout-ms 30000 --output-format json"
+          "npx opendevbrowser status-capabilities --session-id s1 --target-id page-1 --challenge-automation-mode browser_with_helper --timeout-ms 30000 --output-format json"
         ],
         "notes": [],
         "groupId": "session_lifecycle",
@@ -41086,7 +41225,7 @@ var PUBLIC_SURFACE_MANIFEST = {
       {
         "name": "research",
         "description": "Run research workflows",
-        "usage": "npx opendevbrowser research run --topic <text> [--days <n>|--from <date> --to <date>] [--source-selection <family>] [--sources <csv>] [--include-engagement] [--limit-per-source <n>] [--mode <mode>] [--timeout-ms <ms>] [--output-dir <path>] [--ttl-hours <n>] [--use-cookies[=<bool>]] [--challenge-automation-mode <mode>] [--cookie-policy-override <policy>]",
+        "usage": "npx opendevbrowser research run --topic <text> [--days <n>|--from <date> --to <date>] [--source-selection <family>] [--sources <csv>] [--include-engagement] [--limit-per-source <n>] [--browser-mode <mode>] [--mode <mode>] [--timeout-ms <ms>] [--output-dir <path>] [--ttl-hours <n>] [--use-cookies[=<bool>]] [--challenge-automation-mode <mode>] [--cookie-policy-override <policy>]",
         "flags": [
           "--topic",
           "--days",
@@ -41096,6 +41235,7 @@ var PUBLIC_SURFACE_MANIFEST = {
           "--sources",
           "--include-engagement",
           "--limit-per-source",
+          "--browser-mode",
           "--mode",
           "--timeout-ms",
           "--output-dir",
@@ -41106,7 +41246,7 @@ var PUBLIC_SURFACE_MANIFEST = {
           "--cookie-policy"
         ],
         "examples": [
-          'npx opendevbrowser research run --topic "Chrome extension debugging workflows" --days 30 --source-selection auto --mode json --output-format json'
+          'npx opendevbrowser research run --topic "Chrome extension debugging workflows" --days 30 --source-selection auto --browser-mode managed --mode json --output-format json'
         ],
         "notes": [
           "Generic topical research is currently safest with --source-selection auto; add shopping only for deliberate commercial comparison."
@@ -41136,7 +41276,7 @@ var PUBLIC_SURFACE_MANIFEST = {
           "--cookie-policy"
         ],
         "examples": [
-          'npx opendevbrowser shopping run --query "wireless ergonomic mouse" --providers shopping/bestbuy,shopping/ebay --budget 150 --browser-mode managed --mode json --output-format json'
+          'npx opendevbrowser shopping run --query "wireless ergonomic mouse" --providers shopping/bestbuy,shopping/ebay --budget 150 --browser-mode managed --use-cookies --challenge-automation-mode browser_with_helper --mode json --output-format json'
         ],
         "notes": [
           "Treat --region as advisory unless the workflow output reports region_authoritative=true."
@@ -41148,7 +41288,7 @@ var PUBLIC_SURFACE_MANIFEST = {
       {
         "name": "product-video",
         "description": "Run product presentation asset workflows",
-        "usage": "npx opendevbrowser product-video run (--product-url <url> | --product-name <name>) [--provider-hint <provider>] [--include-screenshots <bool>] [--include-all-images <bool>] [--include-copy <bool>] [--timeout-ms <ms>] [--use-cookies[=<bool>]] [--challenge-automation-mode <mode>] [--cookie-policy-override <policy>] [--output-dir <path>] [--ttl-hours <n>]",
+        "usage": "npx opendevbrowser product-video run (--product-url <url> | --product-name <name>) [--provider-hint <provider>] [--include-screenshots[=<bool>]] [--include-all-images[=<bool>]] [--include-copy[=<bool>]] [--timeout-ms <ms>] [--browser-mode <mode>] [--use-cookies[=<bool>]] [--challenge-automation-mode <mode>] [--cookie-policy-override <policy>] [--output-dir <path>] [--ttl-hours <n>]",
         "flags": [
           "--product-url",
           "--product-name",
@@ -41157,6 +41297,7 @@ var PUBLIC_SURFACE_MANIFEST = {
           "--include-all-images",
           "--include-copy",
           "--timeout-ms",
+          "--browser-mode",
           "--use-cookies",
           "--challenge-automation-mode",
           "--cookie-policy-override",
@@ -41165,7 +41306,7 @@ var PUBLIC_SURFACE_MANIFEST = {
           "--ttl-hours"
         ],
         "examples": [
-          'npx opendevbrowser product-video run --product-url "https://example.com/p/1" --include-screenshots --output-format json'
+          'npx opendevbrowser product-video run --product-url "https://example.com/p/1" --browser-mode managed --use-cookies --challenge-automation-mode browser_with_helper --include-screenshots --output-format json'
         ],
         "notes": [
           "Confirm whether the returned pack is visual-ready or metadata-first before briefing production."
@@ -41177,7 +41318,7 @@ var PUBLIC_SURFACE_MANIFEST = {
       {
         "name": "inspiredesign",
         "description": "Run inspiredesign workflows",
-        "usage": "npx opendevbrowser inspiredesign run --brief <text> [--url <url>]... [--capture-mode <mode>] [--include-prototype-guidance[=<bool>]] [--mode <mode>] [--timeout-ms <ms>] [--output-dir <path>] [--ttl-hours <n>] [--use-cookies[=<bool>]] [--challenge-automation-mode <mode>] [--cookie-policy-override <policy>]",
+        "usage": "npx opendevbrowser inspiredesign run --brief <text> [--url <url>]... [--capture-mode <mode>] [--include-prototype-guidance[=<bool>]] [--mode <mode>] [--timeout-ms <ms>] [--output-dir <path>] [--ttl-hours <n>] [--browser-mode <mode>] [--use-cookies[=<bool>]] [--challenge-automation-mode <mode>] [--cookie-policy-override <policy>]",
         "flags": [
           "--brief",
           "--url",
@@ -41187,13 +41328,14 @@ var PUBLIC_SURFACE_MANIFEST = {
           "--timeout-ms",
           "--output-dir",
           "--ttl-hours",
+          "--browser-mode",
           "--use-cookies",
           "--challenge-automation-mode",
           "--cookie-policy-override",
           "--cookie-policy"
         ],
         "examples": [
-          'npx opendevbrowser inspiredesign run --brief "Extract a reusable dashboard design contract from live references" --url https://linear.app --include-prototype-guidance --output-dir /tmp/inspiredesign --output-format json'
+          'npx opendevbrowser inspiredesign run --brief "Extract a reusable dashboard design contract from live references" --url https://linear.app --browser-mode managed --use-cookies --challenge-automation-mode browser_with_helper --include-prototype-guidance --output-dir /tmp/inspiredesign --output-format json'
         ],
         "notes": [
           "Any inspiredesign --url forces deep capture for DOM/layout evidence; without URLs, --capture-mode defaults to off.",
@@ -41222,19 +41364,21 @@ var PUBLIC_SURFACE_MANIFEST = {
       {
         "name": "macro-resolve",
         "description": "Resolve or execute a macro expression via provider actions",
-        "usage": "npx opendevbrowser macro-resolve --expression <macro> [--default-provider <provider>] [--include-catalog] [--execute] [--timeout-ms <ms>] [--challenge-automation-mode <mode>]",
+        "usage": "npx opendevbrowser macro-resolve --expression <macro> [--default-provider <provider>] [--include-catalog] [--execute [--timeout-ms <ms>] [--browser-mode <mode>] [--challenge-automation-mode <mode>]]",
         "flags": [
           "--expression",
           "--default-provider",
           "--include-catalog",
           "--execute",
           "--timeout-ms",
+          "--browser-mode",
           "--challenge-automation-mode"
         ],
         "examples": [
-          `npx opendevbrowser macro-resolve --expression '@community.search("browser automation failures", 4)' --execute --challenge-automation-mode browser --output-format json`
+          `npx opendevbrowser macro-resolve --expression '@community.search("browser automation failures", 4)' --execute --browser-mode extension --challenge-automation-mode browser_with_helper --output-format json`
         ],
         "notes": [
+          "Use --browser-mode and --challenge-automation-mode only with --execute.",
           "When --execute is enabled, inspect execution.meta.blocker before trusting a blocked result as complete."
         ],
         "groupId": "provider_workflows",
@@ -41900,7 +42044,7 @@ var PUBLIC_SURFACE_MANIFEST = {
           "--timeout-ms"
         ],
         "examples": [
-          "npx opendevbrowser session-inspector-plan --session-id s1 --target-id page-1 --challenge-automation-mode browser --output-format json"
+          "npx opendevbrowser session-inspector-plan --session-id s1 --target-id page-1 --challenge-automation-mode browser_with_helper --output-format json"
         ],
         "notes": [
           "Inspect browser-scoped challenge automation before enabling browser_with_helper on a live rerun."
@@ -42846,7 +42990,7 @@ var PUBLIC_SURFACE_MANIFEST = {
         "name": "opendevbrowser_status_capabilities",
         "description": "Inspect runtime capability discovery for the host and an optional session.",
         "cliEquivalent": "status-capabilities",
-        "example": "npx opendevbrowser status-capabilities --session-id s1 --target-id page-1 --challenge-automation-mode browser --timeout-ms 30000 --output-format json"
+        "example": "npx opendevbrowser status-capabilities --session-id s1 --target-id page-1 --challenge-automation-mode browser_with_helper --timeout-ms 30000 --output-format json"
       },
       {
         "name": "opendevbrowser_session_inspector",
@@ -42858,7 +43002,7 @@ var PUBLIC_SURFACE_MANIFEST = {
         "name": "opendevbrowser_session_inspector_plan",
         "description": "Inspect browser-scoped computer-use policy, eligibility, and safe suggested steps.",
         "cliEquivalent": "session-inspector-plan",
-        "example": "npx opendevbrowser session-inspector-plan --session-id s1 --target-id page-1 --challenge-automation-mode browser --output-format json"
+        "example": "npx opendevbrowser session-inspector-plan --session-id s1 --target-id page-1 --challenge-automation-mode browser_with_helper --output-format json"
       },
       {
         "name": "opendevbrowser_session_inspector_audit",
@@ -43112,31 +43256,31 @@ var PUBLIC_SURFACE_MANIFEST = {
         "name": "opendevbrowser_macro_resolve",
         "description": "Resolve or execute provider macro expressions.",
         "cliEquivalent": "macro-resolve",
-        "example": `npx opendevbrowser macro-resolve --expression '@community.search("browser automation failures", 4)' --execute --challenge-automation-mode browser --output-format json`
+        "example": `npx opendevbrowser macro-resolve --expression '@community.search("browser automation failures", 4)' --execute --browser-mode extension --challenge-automation-mode browser_with_helper --output-format json`
       },
       {
         "name": "opendevbrowser_research_run",
         "description": "Run the research workflow directly.",
         "cliEquivalent": "research",
-        "example": 'npx opendevbrowser research run --topic "Chrome extension debugging workflows" --days 30 --source-selection auto --mode json --output-format json'
+        "example": 'npx opendevbrowser research run --topic "Chrome extension debugging workflows" --days 30 --source-selection auto --browser-mode managed --mode json --output-format json'
       },
       {
         "name": "opendevbrowser_shopping_run",
         "description": "Run the shopping workflow directly.",
         "cliEquivalent": "shopping",
-        "example": 'npx opendevbrowser shopping run --query "wireless ergonomic mouse" --providers shopping/bestbuy,shopping/ebay --budget 150 --browser-mode managed --mode json --output-format json'
+        "example": 'npx opendevbrowser shopping run --query "wireless ergonomic mouse" --providers shopping/bestbuy,shopping/ebay --budget 150 --browser-mode managed --use-cookies --challenge-automation-mode browser_with_helper --mode json --output-format json'
       },
       {
         "name": "opendevbrowser_product_video_run",
         "description": "Run the product-video asset workflow directly.",
         "cliEquivalent": "product-video",
-        "example": 'npx opendevbrowser product-video run --product-url "https://example.com/p/1" --include-screenshots --output-format json'
+        "example": 'npx opendevbrowser product-video run --product-url "https://example.com/p/1" --browser-mode managed --use-cookies --challenge-automation-mode browser_with_helper --include-screenshots --output-format json'
       },
       {
         "name": "opendevbrowser_inspiredesign_run",
         "description": "Run the inspiredesign workflow directly.",
         "cliEquivalent": "inspiredesign",
-        "example": 'npx opendevbrowser inspiredesign run --brief "Extract a reusable dashboard design contract from live references" --url https://linear.app --include-prototype-guidance --output-dir /tmp/inspiredesign --output-format json'
+        "example": 'npx opendevbrowser inspiredesign run --brief "Extract a reusable dashboard design contract from live references" --url https://linear.app --browser-mode managed --use-cookies --challenge-automation-mode browser_with_helper --include-prototype-guidance --output-dir /tmp/inspiredesign --output-format json'
       },
       {
         "name": "opendevbrowser_canvas",
@@ -43622,4 +43766,4 @@ export {
   TOOL_SURFACE_ENTRIES
 };
 /* v8 ignore next -- @preserve */
-//# sourceMappingURL=chunk-MWBDO2L5.js.map
+//# sourceMappingURL=chunk-I5ZCOZZV.js.map