pi-agent-browser-native 0.2.71 → 0.2.74

package/dist/extensions/agent-browser/lib/process.js

@@ -1,21 +1,28 @@
 /**
  * Purpose: Execute the upstream agent-browser binary for the pi-agent-browser extension.
- * Responsibilities: Spawn the agent-browser subprocess, forward parent environment variables plus wrapper overrides, stream optional stdin, bound in-memory output buffering, spill oversized stdout safely to a private temp file under a disk budget, and honor abort signals.
+ * Responsibilities: Validate POSIX socket storage, spawn the agent-browser subprocess, forward parent environment variables plus wrapper overrides, stream optional stdin, bound in-memory output buffering, spill oversized stdout safely to a private temp file under a disk budget, and honor abort signals.
  * Scope: Process execution only; argument planning, output formatting, and pi tool registration live elsewhere.
  * Usage: Called by the extension tool after argument validation and session planning are complete.
  * Invariants/Assumptions: The binary name is always `agent-browser`; Windows routes through PowerShell to invoke npm launchers with escaped argv; callers handle semantic success/error interpretation.
  */
 import { spawn } from "node:child_process";
-import { chmod, mkdir } from "node:fs/promises";
+import { lstat, mkdir, readdir } from "node:fs/promises";
+import { dirname, isAbsolute, join } from "node:path";
 import { env as processEnv, platform as processPlatform } from "node:process";
-import { GLOBAL_BOOLEAN_FLAGS_WITH_OPTIONAL_VALUES, GLOBAL_VALUE_FLAGS, getFlagName } from "./argv-grammar.js";
-import { getImplicitSessionIdleTimeoutMs } from "./runtime.js";
+import { parseArgvDescriptor } from "./argv-descriptor.js";
+import { needsManagedSession } from "./command-policy.js";
+import { isKnownCommandToken } from "./command-taxonomy.js";
+import { getFlagName, GLOBAL_BOOLEAN_FLAGS_WITH_OPTIONAL_VALUES, GLOBAL_VALUE_FLAGS, optionalGlobalValueFlagConsumesNext, } from "./argv-grammar.js";
+import { canonicalizeOwnedManagedSessionCloseArgs, commitManagedSessionRestoreSuppression, getManagedSessionRestoreConfigEnv, getManagedSessionRestoreEnv, getManagedSessionRestoreProtectedEnv, getOwnedManagedSessionNamespaceEnv, isOwnedManagedSessionTarget, shouldOmitOwnedManagedSessionRestoreEnv, validateManagedSessionRestoreContextForSpawn, } from "./managed-session-restore.js";
+import { getManagedSessionStateAccessValidationError, getManagedSessionTargetAccessValidationError, } from "./managed-session-state-policy.js";
+import { getImplicitSessionIdleTimeoutMs, isPlainTextInspectionArgs } from "./runtime.js";
 import { openSecureTempFile, writeSecureTempChunk } from "./temp.js";
 const MAX_BUFFERED_STDOUT_BYTES = 512 * 1_024;
 const MAX_BUFFERED_STDERR_CHARS = 32_000;
 const MAX_BUFFERED_STDOUT_TAIL_CHARS = 32_000;
 const PROCESS_STDOUT_SPILL_FILE_PREFIX = "process-stdout";
 const AGENT_BROWSER_SOCKET_DIR_ENV = "AGENT_BROWSER_SOCKET_DIR";
+const AGENT_BROWSER_ARGS_ENV = "AGENT_BROWSER_ARGS";
 const AGENT_BROWSER_DEFAULT_TIMEOUT_ENV = "AGENT_BROWSER_DEFAULT_TIMEOUT";
 const AGENT_BROWSER_IDLE_TIMEOUT_ENV = "AGENT_BROWSER_IDLE_TIMEOUT_MS";
 const PI_AGENT_BROWSER_PROCESS_TIMEOUT_ENV = "PI_AGENT_BROWSER_PROCESS_TIMEOUT_MS";
@@ -24,6 +31,7 @@ export const SAFE_AGENT_BROWSER_OPERATION_TIMEOUT_MS = 25_000;
 const DEFAULT_AGENT_BROWSER_PROCESS_TIMEOUT_MS = 35_000;
 /** Grace period after `exit` before resolving when `close` is delayed by inherited stdio handles. */
 const EXIT_STDIO_GRACE_MS = 100;
+const WINDOWS_AGENT_BROWSER_MISSING_MARKER = "PI_AGENT_BROWSER_COMMAND_NOT_FOUND:agent-browser.cmd";
 function appendTail(text, addition, maxChars) {
     const combined = text + addition;
     return combined.length <= maxChars ? combined : combined.slice(combined.length - maxChars);
@@ -31,37 +39,90 @@ function appendTail(text, addition, maxChars) {
 function quoteWindowsPowerShellArg(value) {
     return `'${value.replace(/'/g, "''")}'`;
 }
-const WINDOWS_LEADING_GLOBAL_VALUE_FLAGS = new Set(GLOBAL_VALUE_FLAGS);
 /** Exported for unit tests that lock Windows launcher argv ordering. */
 export function reorderWindowsLeadingGlobalArgs(args) {
     const leadingGlobals = [];
-    let index = 0;
-    while (index < args.length && args[index]?.startsWith("-")) {
+    for (let index = 0; index < args.length; index += 1) {
         const token = args[index];
-        const flagName = getFlagName(token);
-        leadingGlobals.push(token);
-        index += 1;
-        if (WINDOWS_LEADING_GLOBAL_VALUE_FLAGS.has(flagName) && !token.includes("=") && index < args.length) {
-            leadingGlobals.push(args[index]);
-            index += 1;
+        if (isKnownCommandToken(token)) {
+            return index === 0 ? args : [token, ...leadingGlobals, ...args.slice(index + 1)];
+        }
+        if (!token.startsWith("-"))
+            return args;
+        if (token.startsWith("--restore=")) {
+            leadingGlobals.push(token);
+            continue;
+        }
+        if (token === "--restore") {
+            const value = args[index + 1];
+            if (optionalGlobalValueFlagConsumesNext(token, value)) {
+                leadingGlobals.push(`--restore=${value}`);
+                index += 1;
+            }
+            else {
+                leadingGlobals.push(token);
+            }
             continue;
         }
-        if (GLOBAL_BOOLEAN_FLAGS_WITH_OPTIONAL_VALUES.has(flagName) && ["true", "false"].includes(args[index] ?? "")) {
-            leadingGlobals.push(args[index]);
+        if (token.includes("="))
+            return args;
+        const flag = getFlagName(token);
+        if (GLOBAL_BOOLEAN_FLAGS_WITH_OPTIONAL_VALUES.has(flag)) {
+            leadingGlobals.push(token);
+            if (["true", "false"].includes(args[index + 1] ?? "")) {
+                leadingGlobals.push(args[index + 1]);
+                index += 1;
+            }
+            continue;
+        }
+        if (GLOBAL_VALUE_FLAGS.includes(flag)) {
+            const value = args[index + 1];
+            if (value === undefined)
+                return args;
+            leadingGlobals.push(token, value);
             index += 1;
+            continue;
         }
-    }
-    if (leadingGlobals.length === 0 || index >= args.length)
         return args;
-    return [args[index], ...leadingGlobals, ...args.slice(index + 1)];
+    }
+    return args;
+}
+export function pinAgentBrowserFileAccessDisabled(args) {
+    const filtered = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const token = args[index];
+        if (token.startsWith("--allow-file-access="))
+            continue;
+        if (token === "--allow-file-access") {
+            if (["false", "true"].includes(args[index + 1] ?? ""))
+                index += 1;
+            continue;
+        }
+        filtered.push(token);
+    }
+    return ["--args", "", "--allow-file-access", "false", ...filtered];
 }
 export function buildAgentBrowserSpawnCommand(args, platform = processPlatform) {
     if (platform !== "win32") {
         return { command: "agent-browser", args };
     }
-    const commandLine = ["&", "agent-browser.cmd", ...reorderWindowsLeadingGlobalArgs(args).map(quoteWindowsPowerShellArg)].join(" ");
+    const invocationArgs = reorderWindowsLeadingGlobalArgs(args).map(quoteWindowsPowerShellArg).join(" ");
+    const commandLine = [
+        "$agentBrowser = Get-Command agent-browser.cmd -ErrorAction SilentlyContinue;",
+        `if (-not $agentBrowser) { [Console]::Error.WriteLine('${WINDOWS_AGENT_BROWSER_MISSING_MARKER}'); exit 127 };`,
+        `& $agentBrowser.Source ${invocationArgs}`.trimEnd(),
+    ].join(" ");
     return { command: "powershell.exe", args: ["-NoLogo", "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", commandLine] };
 }
+export function isWindowsAgentBrowserCommandMissing(stderr) {
+    const normalized = stderr.toLowerCase();
+    return normalized.includes(WINDOWS_AGENT_BROWSER_MISSING_MARKER.toLowerCase()) || (normalized.includes("agent-browser.cmd") && (normalized.includes("commandnotfoundexception") ||
+        normalized.includes("not recognized as the name of a cmdlet") ||
+        normalized.includes("not recognized as an internal or external command")));
+}
+export function shouldCommitManagedRestoreAfterWindowsProcess(input) {
+    return !input.spawnError && !(input.exitCode !== 0 && isWindowsAgentBrowserCommandMissing(input.stderr));
+}
 function terminateSpawnedChild(child, signal) {
     if (processPlatform === "win32" && child.pid) {
         const killer = spawn("taskkill.exe", ["/PID", String(child.pid), "/T", "/F"], { stdio: "ignore" });
@@ -154,13 +215,76 @@ export function getAgentBrowserSocketDir(platform = processPlatform, uid = typeo
     if (platform === "win32") {
         return undefined;
     }
-    return `${DEFAULT_AGENT_BROWSER_SOCKET_DIR_PREFIX}${typeof uid === "number" ? `-${uid}` : ""}`;
+    const prefix = platform === "darwin" ? "/private/tmp/piab" : DEFAULT_AGENT_BROWSER_SOCKET_DIR_PREFIX;
+    return `${prefix}${typeof uid === "number" ? `-${uid}` : ""}`;
 }
-async function ensureAgentBrowserSocketDir(socketDir) {
+async function hasTrustedSocketDirAncestry(socketDir, uid) {
+    for (let current = dirname(socketDir);;) {
+        const metadata = await lstat(current);
+        if (metadata.isSymbolicLink()) {
+            if (metadata.uid !== 0)
+                return false;
+        }
+        else if (!metadata.isDirectory()) {
+            return false;
+        }
+        if (!metadata.isSymbolicLink()) {
+            const mode = metadata.mode & 0o7777;
+            if (metadata.uid === uid) {
+                if ((mode & 0o022) !== 0)
+                    return false;
+            }
+            else if (metadata.uid !== 0 || ((mode & 0o022) !== 0 && (mode & 0o1000) === 0)) {
+                return false;
+            }
+        }
+        const parent = dirname(current);
+        if (parent === current)
+            return true;
+        current = parent;
+    }
+}
+async function socketDirEntriesAreOwned(socketDir, uid, visited = { count: 0 }) {
+    for (const name of await readdir(socketDir)) {
+        if ((visited.count += 1) > 16_384)
+            return false;
+        try {
+            const path = join(socketDir, name);
+            const metadata = await lstat(path);
+            if (metadata.uid !== uid || metadata.isSymbolicLink())
+                return false;
+            if (metadata.isDirectory()) {
+                if (!await socketDirEntriesAreOwned(path, uid, visited))
+                    return false;
+            }
+            else if (!metadata.isFile() && !metadata.isSocket()) {
+                return false;
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                return false;
+        }
+    }
+    return true;
+}
+export async function ensureAgentBrowserSocketDir(socketDir, uid = typeof process.getuid === "function" ? process.getuid() : undefined) {
+    if (!isAbsolute(socketDir) || typeof uid !== "number")
+        return false;
     try {
-        await mkdir(socketDir, { recursive: true, mode: 0o700 });
-        await chmod(socketDir, 0o700).catch(() => undefined);
-        return true;
+        if (!await hasTrustedSocketDirAncestry(socketDir, uid))
+            return false;
+        try {
+            await mkdir(socketDir, { mode: 0o700 });
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                return false;
+        }
+        const metadata = await lstat(socketDir);
+        if (!metadata.isDirectory() || metadata.isSymbolicLink() || metadata.uid !== uid || (metadata.mode & 0o777) !== 0o700)
+            return false;
+        return await hasTrustedSocketDirAncestry(socketDir, uid) && await socketDirEntriesAreOwned(socketDir, uid);
     }
     catch {
         return false;
@@ -183,21 +307,114 @@ export function buildAgentBrowserProcessEnv(baseEnv = processEnv, overrides = un
     clampUpstreamDefaultTimeout(childEnv);
     return childEnv;
 }
+function getManagedPreSpawnPolicyError(options, effectiveEnv, allowManagedSessionTarget = false, currentPageUrl, pageUrlUnknown = false, trustedFirstBatchTabSelection = false, trustedPinnedEmptyConfig = false) {
+    const policyEnv = effectiveEnv ?? { ...(options.parentEnv ?? processEnv), ...options.env };
+    const managedSessionTargetError = getManagedSessionTargetAccessValidationError(options.args, allowManagedSessionTarget || options.ownedManagedSession === true || isOwnedManagedSessionTarget(options.args), policyEnv);
+    if (managedSessionTargetError)
+        return managedSessionTargetError;
+    if (!validateManagedSessionRestoreContextForSpawn(options)) {
+        return "Managed session restore policy, storage, or checkout identity changed after planning; refusing to start agent-browser.";
+    }
+    return getManagedSessionStateAccessValidationError({
+        args: options.args,
+        currentPageUrl,
+        cwd: options.cwd,
+        env: effectiveEnv ?? options.env,
+        pageUrlUnknown,
+        parentEnv: effectiveEnv ? {} : options.parentEnv ?? processEnv,
+        stdin: options.stdin,
+        trustedFirstBatchTabSelection,
+        trustedPinnedEmptyConfig,
+    });
+}
 export async function runAgentBrowserProcess(options) {
-    const { args, cwd, env, signal, stdin } = options;
+    const { allowManagedSessionTarget, cwd, env, managedSessionRestoreState, managedStateCurrentPageUrl, managedStatePageUrlUnknown, signal, stdin, trustedFirstBatchTabSelection } = options;
+    const ownedManagedSession = options.ownedManagedSession === true || isOwnedManagedSessionTarget(options.args);
+    const args = canonicalizeOwnedManagedSessionCloseArgs({
+        args: options.args,
+        cwd,
+        env,
+        ownedManagedSession,
+        restoreState: managedSessionRestoreState,
+        stdin,
+    });
     const timeoutMs = options.timeoutMs ?? getAgentBrowserProcessTimeoutMs();
+    if (signal?.aborted) {
+        return { aborted: true, agentBrowserStarted: false, exitCode: 1, stderr: "", stdout: "", timedOut: false };
+    }
+    const managedSessionRestoreOptions = {
+        args,
+        cwd,
+        env,
+        ownedManagedSession,
+        restoreState: managedSessionRestoreState,
+        stdin,
+    };
+    const planningPolicyError = getManagedPreSpawnPolicyError(managedSessionRestoreOptions, undefined, allowManagedSessionTarget, managedStateCurrentPageUrl, managedStatePageUrlUnknown, trustedFirstBatchTabSelection);
+    if (planningPolicyError) {
+        return {
+            aborted: false,
+            agentBrowserStarted: false,
+            exitCode: 1,
+            spawnError: new Error(planningPolicyError),
+            stderr: "",
+            stdout: "",
+            timedOut: false,
+        };
+    }
+    const managedSessionRestoreEnv = getManagedSessionRestoreEnv(managedSessionRestoreOptions);
+    const ownedManagedSessionClose = shouldOmitOwnedManagedSessionRestoreEnv(managedSessionRestoreOptions);
+    const browserConfigPinRequired = !isPlainTextInspectionArgs(args) && needsManagedSession(parseArgvDescriptor(args));
+    const managedSessionRestoreConfigEnv = await getManagedSessionRestoreConfigEnv(managedSessionRestoreEnv, ownedManagedSessionClose || browserConfigPinRequired);
+    if (managedSessionRestoreConfigEnv === undefined) {
+        return {
+            aborted: false,
+            agentBrowserStarted: false,
+            exitCode: 1,
+            spawnError: new Error("Browser-backed agent-browser commands require a protected empty config, but secure temp storage was unavailable."),
+            stderr: "",
+            stdout: "",
+            timedOut: false,
+        };
+    }
     const processOverrides = {
         [AGENT_BROWSER_IDLE_TIMEOUT_ENV]: String(getImplicitSessionIdleTimeoutMs()),
+        ...managedSessionRestoreEnv,
         ...env,
+        ...managedSessionRestoreConfigEnv,
+        ...getManagedSessionRestoreProtectedEnv(managedSessionRestoreOptions, managedSessionRestoreEnv),
+        ...getOwnedManagedSessionNamespaceEnv(managedSessionRestoreOptions),
+        [AGENT_BROWSER_ARGS_ENV]: undefined,
     };
     const explicitSocketDir = processOverrides[AGENT_BROWSER_SOCKET_DIR_ENV];
     let effectiveEnv = explicitSocketDir === undefined ? { ...processOverrides, [AGENT_BROWSER_SOCKET_DIR_ENV]: undefined } : processOverrides;
+    if (ownedManagedSessionClose)
+        effectiveEnv = { ...effectiveEnv, AGENT_BROWSER_RESTORE: undefined };
     const requestedSocketDir = explicitSocketDir ?? getAgentBrowserSocketDir();
-    if (requestedSocketDir && (await ensureAgentBrowserSocketDir(requestedSocketDir))) {
+    if (requestedSocketDir !== undefined) {
+        const socketDirIsSecure = requestedSocketDir.length > 0 && await ensureAgentBrowserSocketDir(requestedSocketDir);
+        if (signal?.aborted) {
+            return { aborted: true, agentBrowserStarted: false, exitCode: 1, stderr: "", stdout: "", timedOut: false };
+        }
+        if (!socketDirIsSecure) {
+            return {
+                aborted: false,
+                agentBrowserStarted: false,
+                exitCode: 1,
+                spawnError: new Error("Agent-browser socket storage must be an absolute, non-symlink directory owned by the current user with mode 0700."),
+                stderr: "",
+                stdout: "",
+                timedOut: false,
+            };
+        }
         effectiveEnv = { ...effectiveEnv, [AGENT_BROWSER_SOCKET_DIR_ENV]: requestedSocketDir };
     }
+    if (signal?.aborted) {
+        return { aborted: true, agentBrowserStarted: false, exitCode: 1, stderr: "", stdout: "", timedOut: false };
+    }
     return await new Promise((resolve) => {
         let aborted = false;
+        let agentBrowserStarted = false;
         let settled = false;
         let spawnError;
         let stderr = "";
@@ -268,6 +485,15 @@ export async function runAgentBrowserProcess(options) {
                 if (stdoutSpillHandle) {
                     await stdoutSpillHandle.close().catch(() => undefined);
                 }
+                const windowsMissingBinary = processPlatform === "win32" && exitCode !== 0 && isWindowsAgentBrowserCommandMissing(stderr);
+                if (processPlatform === "win32" && !windowsMissingBinary && !spawnError)
+                    agentBrowserStarted = true;
+                if (windowsMissingBinary && !spawnError) {
+                    spawnError = Object.assign(new Error("spawn agent-browser ENOENT"), { code: "ENOENT" });
+                }
+                else if (processPlatform === "win32" && shouldCommitManagedRestoreAfterWindowsProcess({ exitCode, spawnError, stderr })) {
+                    commitManagedSessionRestoreSuppression(managedSessionRestoreOptions);
+                }
                 if (!spawnError && stdoutSpillError) {
                     spawnError = stdoutSpillError;
                 }
@@ -275,6 +501,7 @@ export async function runAgentBrowserProcess(options) {
                 destroySpawnedChildStreams(child);
                 resolve({
                     aborted,
+                    agentBrowserStarted,
                     exitCode,
                     spawnError,
                     stderr,
@@ -285,12 +512,24 @@ export async function runAgentBrowserProcess(options) {
                 });
             });
         };
-        const spawnCommand = buildAgentBrowserSpawnCommand(args);
+        const childEnv = buildAgentBrowserProcessEnv(processEnv, effectiveEnv);
+        const spawnPolicyError = getManagedPreSpawnPolicyError(managedSessionRestoreOptions, childEnv, allowManagedSessionTarget, managedStateCurrentPageUrl, managedStatePageUrlUnknown, trustedFirstBatchTabSelection, managedSessionRestoreConfigEnv.AGENT_BROWSER_CONFIG !== undefined);
+        if (spawnPolicyError) {
+            resolve({ aborted: false, agentBrowserStarted: false, exitCode: 1, spawnError: new Error(spawnPolicyError), stderr: "", stdout: "", timedOut: false });
+            return;
+        }
+        const spawnCommand = buildAgentBrowserSpawnCommand(pinAgentBrowserFileAccessDisabled(args));
         const child = spawn(spawnCommand.command, spawnCommand.args, {
             cwd,
-            env: buildAgentBrowserProcessEnv(processEnv, effectiveEnv),
+            env: childEnv,
             stdio: ["pipe", "pipe", "pipe"],
         });
+        if (processPlatform !== "win32") {
+            child.once("spawn", () => {
+                agentBrowserStarted = true;
+                commitManagedSessionRestoreSuppression(managedSessionRestoreOptions);
+            });
+        }
         const terminateChild = (reason) => {
             if (settled)
                 return;
@@ -356,13 +595,10 @@ export async function runAgentBrowserProcess(options) {
             timeoutTimer.unref?.();
         }
         if (signal) {
-            if (signal.aborted) {
+            abortListener = () => terminateChild("abort");
+            signal.addEventListener("abort", abortListener, { once: true });
+            if (signal.aborted)
                 terminateChild("abort");
-            }
-            else {
-                abortListener = () => terminateChild("abort");
-                signal.addEventListener("abort", abortListener, { once: true });
-            }
         }
         writeChildStdin();
     });

package/dist/extensions/agent-browser/lib/results/artifact-manifest.js

@@ -73,16 +73,18 @@ export function formatSessionArtifactRetentionSummary(manifest) {
         parts.push(`${missingCount} missing`);
     return `Session artifacts: ${parts.join(", ")} (${manifest.entries.length}/${manifest.maxEntries} recent).`;
 }
+export function getSessionArtifactManifestEntryKey(entry) {
+    return entry.storageScope === "explicit-path" && entry.absolutePath ? `${entry.storageScope}:${entry.absolutePath}` : `${entry.storageScope}:${entry.path}`;
+}
 export function mergeSessionArtifactManifest(options) {
     const nowMs = options.nowMs ?? Date.now();
     const maxEntries = getSessionArtifactManifestMaxEntries();
-    const getEntryKey = (entry) => entry.storageScope === "explicit-path" && entry.absolutePath ? `${entry.storageScope}:${entry.absolutePath}` : `${entry.storageScope}:${entry.path}`;
     const byPath = new Map();
     for (const entry of options.base?.entries ?? []) {
-        byPath.set(getEntryKey(entry), entry);
+        byPath.set(getSessionArtifactManifestEntryKey(entry), entry);
     }
     for (const entry of options.entries ?? []) {
-        const key = getEntryKey(entry);
+        const key = getSessionArtifactManifestEntryKey(entry);
         const existing = byPath.get(key);
         byPath.set(key, {
             ...existing,

package/dist/extensions/agent-browser/lib/results/categories.js

@@ -22,10 +22,29 @@ export function classifyAgentBrowserFailureCategory(options) {
     const text = [options.errorText, options.validationError, options.parseError, options.spawnError, options.stderr].filter(Boolean).join("\n");
     const command = options.command ?? "";
     const usedRef = options.args?.some((arg) => /^@e\d+\b/.test(arg)) ?? false;
-    if (options.confirmationRequired || /confirmation required|pending confirmation|requires confirmation/i.test(text))
+    // Explicit confirmation flag wins. Text-derived confirmation phrases come after locator-miss detection so a
+    // missed control named "Confirmation required" still gets selector recovery.
+    if (options.confirmationRequired)
         return "confirmation-required";
-    if (options.timedOut || /timeout|timed out|watchdog|IPC read timeout|must stay under its 30s IPC read timeout/i.test(text))
+    // Upstream 0.32.4+ locator misses keep detail and may echo getByRole/getByText or Names seen lists.
+    // Evaluate before text-derived timeout/confirmation so accessible-name substrings cannot suppress recovery.
+    const isUpstreamLocatorMiss = /\bNo element found:\s*(?:getBy[A-Za-z]+|role=|text=|label=|placeholder=|alt=|title=|testid=)/i.test(text) ||
+        // No trailing \b after ":" — colon is non-word, so "Element not found: text=…" would not match.
+        (/\bElement not found:/i.test(text) && /\bVerify the selector, role, or name\b/i.test(text)) ||
+        /\bnone match name\b/i.test(text) ||
+        // Scope Names seen to role/name miss context (or find) so unrelated prose cannot trip selector-not-found.
+        (/\bNames seen:/i.test(text) && (command === "find" || /\belement has role\b|\bnone match name\b|\bgetByRole\b/i.test(text))) ||
+        /\belement has role\b[\s\S]*\bnone match\b/i.test(text);
+    if (isUpstreamLocatorMiss)
+        return "selector-not-found";
+    if (/confirmation required|pending confirmation|requires confirmation/i.test(text))
+        return "confirmation-required";
+    // Match real timeout phrasing only. Do not treat bare "timeout" as a hit — accessible names can include that word,
+    // and `timed?\s*out` would also match the substring "timeout" as time+out.
+    if (options.timedOut ||
+        /\b(?:timed\s+out|timeout exceeded|watchdog|IPC read timeout)\b|must stay under its 30s IPC read timeout|Operation timed out/i.test(text)) {
         return "timeout";
+    }
     if (/ENOENT|not found on PATH|could not find.*agent-browser|agent-browser is required but was not found/i.test(text))
         return "missing-binary";
     if (options.parseError || /invalid JSON|missing boolean success|success field must be boolean|returned no JSON output/i.test(text))

package/dist/extensions/agent-browser/lib/results/presentation/common.js

@@ -3,6 +3,7 @@
  * Responsibilities: Normalize scalar fields, stringify model-facing values, and apply sensitive-text redaction.
  * Scope: Leaf helpers only; command-family formatting lives in sibling modules.
  */
+import { containsManagedSessionRestoreKey } from "../../managed-session-capabilities.js";
 import { redactSensitiveText, redactSensitiveValue } from "../../runtime.js";
 import { stringifyUnknown, truncateText } from "../text.js";
 export function stringifyModelFacing(value) {
@@ -27,7 +28,7 @@ export function redactModelFacingText(text) {
     return redactSensitiveText(text);
 }
 export function redactModelFacingTextIfSensitive(text) {
-    return /(?:@|\b(?:access[_-]?key|api[_-]?key|auth|authorization|basic|bearer|connection[_-]?string|cookie|database[_-]?url|db[_-]?url|mongo(?:db)?[_-]?uri|pass(?:word)?|private[_-]?key|redis[_-]?url|secret|session[_-]?id|token)\b)/i.test(text)
+    return containsManagedSessionRestoreKey(text) || /(?:@|\b(?:access[_-]?key|api[_-]?key|auth|authorization|basic|bearer|connection[_-]?string|cookie|database[_-]?url|db[_-]?url|mongo(?:db)?[_-]?uri|pass(?:word)?|private[_-]?key|redis[_-]?url|secret|session[_-]?id|token)\b)/i.test(text)
         ? redactModelFacingText(text)
         : text;
 }

package/dist/extensions/agent-browser/lib/results/presentation/diagnostics.js

@@ -9,6 +9,7 @@ import { classifyNetworkRequestFailure, isApiLikeNetworkRequest, isNetworkArtifa
 import { withOptionalSessionArgs } from "../next-actions.js";
 import { stringifyUnknown, truncateText } from "../text.js";
 import { firstLine, formatCount, getArrayField, getStringField, parseJsonPreviewString, redactModelFacingText, redactModelFacingTextIfSensitive, stringifyModelFacing, } from "./common.js";
+import { filterCallerOwnedSessionListItems, filterCallerOwnedStateListItems, filterManagedSessionListRows, filterManagedStateListRows, } from "./managed-list-filter.js";
 const DIAGNOSTIC_REQUEST_PREVIEW_LIMIT = 40;
 const DIAGNOSTIC_LOG_PREVIEW_LIMIT = 80;
 const NETWORK_BODY_PREVIEW_MAX_CHARS = 280;
@@ -114,7 +115,7 @@ export function formatDiagnosticSummary(commandInfo, data) {
     if (commandInfo.command === "session") {
         const sessions = getArrayField(data, "sessions");
         if (sessions)
-            return `Sessions: ${sessions.length}`;
+            return `Sessions: ${filterCallerOwnedSessionListItems(sessions).length}`;
         const session = getStringField(data, "session");
         if (session)
             return `Session: ${session}`;
@@ -172,11 +173,13 @@ export function formatDiagnosticSummary(commandInfo, data) {
     }
     if (commandInfo.command === "state") {
         const states = getArrayField(data, "states") ?? getArrayField(data, "files");
-        if (states)
-            return `States: ${states.length}`;
+        if (states) {
+            const visibleStates = commandInfo.subcommand === "list" ? filterCallerOwnedStateListItems(states) : states;
+            return `States: ${visibleStates.length}`;
+        }
         if (commandInfo.subcommand === "load")
             return undefined;
-        const stateName = getStringField(data, "name") ?? getStringField(data, "file") ?? getStringField(data, "path") ?? commandInfo.subcommand;
+        const stateName = getStringField(data, "name") ?? getStringField(data, "file") ?? getStringField(data, "filename") ?? getStringField(data, "path") ?? commandInfo.subcommand;
         if (stateName)
             return `State ${commandInfo.subcommand ?? "result"}: ${stateName}`;
     }
@@ -261,9 +264,10 @@ export function formatDiagnosticSummary(commandInfo, data) {
 function formatSessionText(data) {
     const sessions = getArrayField(data, "sessions");
     if (sessions) {
-        if (sessions.length === 0)
-            return "No active sessions.";
-        return sessions
+        const visibleSessions = filterCallerOwnedSessionListItems(sessions);
+        if (visibleSessions.length === 0)
+            return sessions.length === 0 ? "No active sessions." : "No caller-owned active sessions.";
+        return visibleSessions
             .map((item, index) => {
             if (!isRecord(item))
                 return `${index + 1}. ${stringifyModelFacing(item)}`;
@@ -617,6 +621,49 @@ function formatConsoleText(data, commandInfo) {
     }
     return shown.join("\n");
 }
+function formatA11yText(data) {
+    const counts = isRecord(data.counts) ? data.counts : undefined;
+    const violations = getArrayField(data, "violations") ?? [];
+    const incomplete = getArrayField(data, "incomplete") ?? [];
+    if (!counts && violations.length === 0 && incomplete.length === 0)
+        return undefined;
+    const lines = [];
+    const axeVersion = getStringField(data, "axeVersion");
+    if (axeVersion)
+        lines.push(`axe-core ${redactModelFacingText(axeVersion)}`);
+    const url = getStringField(data, "url");
+    if (url)
+        lines.push(`URL: ${redactModelFacingText(url)}`);
+    const violationCount = typeof counts?.violations === "number" ? counts.violations : violations.length;
+    const incompleteCount = typeof counts?.incomplete === "number" ? counts.incomplete : incomplete.length;
+    const passCount = typeof counts?.passes === "number" ? counts.passes : undefined;
+    const inapplicableCount = typeof counts?.inapplicable === "number" ? counts.inapplicable : undefined;
+    const countParts = [`${violationCount} violation${violationCount === 1 ? "" : "s"}`, `${incompleteCount} incomplete`];
+    if (passCount !== undefined)
+        countParts.push(`${passCount} passes`);
+    if (inapplicableCount !== undefined)
+        countParts.push(`${inapplicableCount} inapplicable`);
+    lines.push(`A11y audit: ${countParts.join(", ")}.`);
+    const previewLimit = Math.min(10, DIAGNOSTIC_LOG_PREVIEW_LIMIT);
+    const preview = violations.slice(0, previewLimit).map((item, index) => {
+        if (!isRecord(item))
+            return `${index + 1}. ${stringifyModelFacing(item)}`;
+        const id = redactModelFacingText(getStringField(item, "id") ?? "rule");
+        const impact = redactModelFacingText(getStringField(item, "impact") ?? "unknown");
+        const help = firstLine(redactModelFacingText(getStringField(item, "help") ?? "").replace(/\s+/g, " ").trim(), 160);
+        const nodeCount = typeof item.nodeCount === "number" ? item.nodeCount : getArrayField(item, "nodes")?.length;
+        const nodePart = typeof nodeCount === "number" ? `, ${nodeCount} node${nodeCount === 1 ? "" : "s"}` : "";
+        return `${index + 1}. [${impact}] ${id}${nodePart}${help ? ` — ${help}` : ""}`;
+    });
+    lines.push(...preview);
+    if (violations.length > preview.length) {
+        lines.push(`... (${violations.length - preview.length} additional violations omitted from preview)`);
+    }
+    if (incompleteCount > 0) {
+        lines.push(`${incompleteCount} incomplete check${incompleteCount === 1 ? "" : "s"} need manual review (see details.data.incomplete).`);
+    }
+    return lines.join("\n");
+}
 function formatErrorsText(data, commandInfo) {
     const errors = getArrayField(data, "errors");
     if (!errors)
@@ -869,12 +916,25 @@ function formatFrameText(data) {
     const lines = [frame ? `Frame: ${redactModelFacingText(frame)}` : undefined, title ? `Title: ${redactModelFacingText(title)}` : undefined, url ? `URL: ${redactModelFacingTextIfSensitive(url)}` : undefined].filter(Boolean);
     return lines.length > 0 ? lines.join("\n") : undefined;
 }
-function formatStateText(data) {
+function formatStateText(data, subcommand) {
+    if (subcommand === "show") {
+        const filename = getStringField(data, "filename") ?? getStringField(data, "name") ?? "saved state";
+        const summary = getStringField(data, "summary");
+        const lines = [`Saved state: ${redactModelFacingText(filename)}`];
+        if (summary)
+            lines.push(`Summary: ${redactModelFacingText(summary)}`);
+        if (typeof data.encrypted === "boolean")
+            lines.push(`Encrypted: ${data.encrypted ? "yes" : "no"}`);
+        if (typeof data.size === "number")
+            lines.push(`Size: ${data.size} bytes`);
+        return lines.join("\n");
+    }
     const states = getArrayField(data, "states") ?? getArrayField(data, "files");
     if (states) {
-        if (states.length === 0)
-            return "No saved states.";
-        return states
+        const visibleStates = filterCallerOwnedStateListItems(states);
+        if (visibleStates.length === 0)
+            return "No caller-owned saved states.";
+        return visibleStates
             .map((item, index) => {
             if (!isRecord(item))
                 return `${index + 1}. ${redactModelFacingTextIfSensitive(stringifyModelFacing(item))}`;
@@ -917,6 +977,12 @@ export function redactPresentationData(commandInfo, data) {
         return redactStatefulValues(data, new Set(["value"]));
     if (commandInfo.command === "storage")
         return redactStorageData(data);
+    if (commandInfo.command === "session" && commandInfo.subcommand === "list")
+        return redactStructuredPresentationValue(filterManagedSessionListRows(data));
+    if (commandInfo.command === "state" && commandInfo.subcommand === "list")
+        return redactStructuredPresentationValue(filterManagedStateListRows(data));
+    if (commandInfo.command === "state" && commandInfo.subcommand === "show")
+        return redactStatefulValues(data, new Set(["value"]));
     return redactStructuredPresentationValue(data);
 }
 export function formatDiagnosticText(commandInfo, data) {
@@ -943,7 +1009,7 @@ export function formatDiagnosticText(commandInfo, data) {
     if (commandInfo.command === "frame")
         return formatFrameText(data);
     if (commandInfo.command === "state")
-        return formatStateText(data);
+        return formatStateText(data, commandInfo.subcommand);
     if (commandInfo.command === "network" && commandInfo.subcommand === "requests")
         return formatNetworkRequestsText(data, commandInfo);
     if (commandInfo.command === "network" && commandInfo.subcommand === "request")
@@ -966,6 +1032,8 @@ export function formatDiagnosticText(commandInfo, data) {
         return formatConsoleText(data, commandInfo);
     if (commandInfo.command === "errors")
         return formatErrorsText(data, commandInfo);
+    if (commandInfo.command === "a11y")
+        return formatA11yText(data);
     if (commandInfo.command === "dashboard")
         return formatDashboardText(data);
     if (commandInfo.command === "doctor")