pi-agent-browser-native 0.2.71 → 0.2.74

package/dist/extensions/agent-browser/lib/results/presentation/managed-list-filter.js

@@ -0,0 +1,42 @@
+/**
+ * Purpose: Remove wrapper-owned managed session and state capabilities from caller-visible list results.
+ * Responsibilities: Recognize managed list rows recursively and preserve the surrounding upstream result shape.
+ * Scope: Presentation filtering only; command authorization lives in managed-session-state-policy.ts.
+ */
+import { containsManagedSessionRestoreKey, isWrapperManagedSessionName } from "../../managed-session-capabilities.js";
+import { isRecord } from "../../parsing.js";
+function isWrapperManagedSessionListItem(item) {
+    if (typeof item === "string")
+        return isWrapperManagedSessionName(item);
+    if (!isRecord(item))
+        return false;
+    return ["name", "session", "id"].some((key) => isWrapperManagedSessionName(typeof item[key] === "string" ? item[key] : undefined));
+}
+function containsManagedStateCapability(value) {
+    if (typeof value === "string")
+        return containsManagedSessionRestoreKey(value);
+    if (Array.isArray(value))
+        return value.some(containsManagedStateCapability);
+    return isRecord(value) && Object.values(value).some(containsManagedStateCapability);
+}
+export function filterCallerOwnedSessionListItems(items) {
+    return items.filter((item) => !isWrapperManagedSessionListItem(item));
+}
+export function filterCallerOwnedStateListItems(items) {
+    return items.filter((item) => !containsManagedStateCapability(item));
+}
+export function filterManagedSessionListRows(data) {
+    if (!isRecord(data) || !Array.isArray(data.sessions))
+        return data;
+    return { ...data, sessions: filterCallerOwnedSessionListItems(data.sessions) };
+}
+export function filterManagedStateListRows(data) {
+    if (!isRecord(data))
+        return data;
+    return Object.fromEntries(Object.entries(data).map(([key, value]) => [
+        key,
+        (key === "states" || key === "files") && Array.isArray(value)
+            ? filterCallerOwnedStateListItems(value)
+            : value,
+    ]));
+}

package/dist/extensions/agent-browser/lib/results/recovery-actions.js

@@ -8,6 +8,7 @@
 import { buildNextToolAction, withOptionalSessionArgs } from "./next-actions.js";
 export const AGENT_BROWSER_RECOVERY_NEXT_ACTION_IDS = {
     aboutBlankListTabs: "list-tabs-for-about-blank-recovery",
+    connectedSessionGetUrl: "verify-connected-session-url",
     connectedSessionListTabs: "list-connected-session-tabs",
     genericTabDriftListTabs: "list-tabs-for-recovery",
     noActivePageListTabs: "list-tabs-after-no-active-page",
@@ -60,6 +61,12 @@ export function buildRecoveryNextActions(recovery) {
     const sessionArgs = (args) => withOptionalSessionArgs(recovery.sessionName, args);
     if (recovery.kind === "connected-session") {
         return [
+            buildNextToolAction({
+                args: sessionArgs(["get", "url"]),
+                id: AGENT_BROWSER_RECOVERY_NEXT_ACTION_IDS.connectedSessionGetUrl,
+                reason: "Verify the attached page URL before any page-content inspection.",
+                safety: "Read-only URL lookup. The wrapper keeps page inspection blocked if the active target is a local file page or the URL cannot be verified.",
+            }),
             buildNextToolAction({
                 args: sessionArgs(["tab", "list"]),
                 id: AGENT_BROWSER_RECOVERY_NEXT_ACTION_IDS.connectedSessionListTabs,

package/dist/extensions/agent-browser/lib/runtime.js

@@ -1,19 +1,21 @@
 /**
  * Purpose: Build safe, deterministic agent-browser invocations and persisted session state for the pi-agent-browser extension.
  * Responsibilities: Validate raw tool arguments, derive extension-managed session names from the pi session identity, restore managed-session state from persisted tool details, redact sensitive invocation text, classify browser-oriented prompts, and build the effective CLI argument list passed to the upstream agent-browser binary.
- * Scope: Pure runtime-planning helpers only; no subprocess execution or filesystem access lives here.
+ * Scope: Runtime-planning helpers only; no subprocess execution or filesystem access.
  * Usage: Imported by the extension entrypoint and unit tests before spawning the upstream CLI.
  * Invariants/Assumptions: The wrapper stays thin, preserves upstream command vocabulary, keeps plain-text inspection stateless,
- * and only injects wrapper-owned flags: `--json`, an extension-managed `--session` when appropriate, and the narrow
+ * and only injects wrapper-owned flags: `--json`, an extension-managed `--session` when appropriate, the narrow
  * OpenAI/ChatGPT headless compatibility `--user-agent` when that workaround applies.
  */
 import { createHash, randomUUID } from "node:crypto";
 import { basename } from "node:path";
 import { findCommandStartIndex, parseArgvDescriptor, parseCommandInfo, } from "./argv-descriptor.js";
-import { GLOBAL_VALUE_FLAGS_ALLOWING_DASH_VALUE, PREVALIDATED_VALUE_FLAGS, optionalGlobalValueFlagConsumesNext, } from "./argv-grammar.js";
+import { canonicalizeAgentBrowserNamespace, extractExplicitNamespace, extractExplicitSessionName, getAgentBrowserSessionIdentityKey, GLOBAL_VALUE_FLAGS_ALLOWING_DASH_VALUE, isBooleanFlagEnabled, PREVALIDATED_VALUE_FLAGS, resolveAgentBrowserNamespace, scanUpstreamGlobalFlagOccurrences, } from "./argv-grammar.js";
 import { needsManagedSession } from "./command-policy.js";
+import { isWrapperManagedSessionName, redactManagedSessionRestoreKeys } from "./managed-session-capabilities.js";
 import { isCloseCommand, isOpenNavigationCommand } from "./command-taxonomy.js";
-import { LAUNCH_SCOPED_FLAG_DEFINITIONS, LAUNCH_SCOPED_FLAG_LABEL } from "./launch-scoped-flags.js";
+import { hasLaunchScopedFlagToken, LAUNCH_SCOPED_FLAG_DEFINITIONS, LAUNCH_SCOPED_FLAG_LABEL, } from "./launch-scoped-flags.js";
+import { MANAGED_SESSION_NAME_PREFIX, } from "./managed-session-restore.js";
 export { extractCommandTokens, findCommandStartIndex, parseArgvDescriptor, parseCommandInfo } from "./argv-descriptor.js";
 import { isRecord } from "./parsing.js";
 const OPENAI_HEADLESS_COMPAT_HOSTS = new Set(["chat.com", "chat.openai.com", "chatgpt.com"]);
@@ -228,7 +230,7 @@ function redactEnvSecretAssignments(text) {
     });
 }
 export function redactSensitiveText(text) {
-    return redactEmbeddedStructuredText(redactEnvSecretAssignments(redactStandaloneBasicCredential(redactBearerCredentials(redactLooseUrlUserinfo(redactLooseUrlMatches(text)))
+    return redactEmbeddedStructuredText(redactEnvSecretAssignments(redactStandaloneBasicCredential(redactBearerCredentials(redactLooseUrlUserinfo(redactLooseUrlMatches(redactManagedSessionRestoreKeys(text))))
         .replace(/\b(Authorization\s*:\s*Basic)\s+[^\s",]+/gi, "$1 [REDACTED]")
         .replace(/\b(Cookie|Set-Cookie)\s*:\s*[^\n\r"]+/gi, "$1: [REDACTED]"))));
 }
@@ -322,11 +324,30 @@ export function getImplicitSessionIdleTimeoutMs(env = process.env) {
         parseTimeoutMs(env[AGENT_BROWSER_IDLE_TIMEOUT_ENV], 0) ??
         DEFAULT_IMPLICIT_SESSION_IDLE_TIMEOUT_MS;
 }
+function countExplicitGlobalFlags(args, targetFlag) {
+    return scanUpstreamGlobalFlagOccurrences(args, targetFlag).length;
+}
+function getUnsupportedLeadingIdentityAssignment(args) {
+    const commandStartIndex = findCommandStartIndex(args) ?? args.length;
+    for (let index = 0; index < commandStartIndex; index += 1) {
+        const token = args[index];
+        if (token.startsWith("--session="))
+            return "--session";
+        if (token.startsWith("--namespace="))
+            return "--namespace";
+        const flag = token.split("=", 1)[0] ?? token;
+        if (!token.includes("=") && PREVALIDATED_VALUE_FLAGS.has(flag))
+            index += 1;
+    }
+    return undefined;
+}
 export function getImplicitSessionCloseTimeoutMs(env = process.env) {
     return parseTimeoutMs(env[IMPLICIT_SESSION_CLOSE_TIMEOUT_ENV], 0) ?? DEFAULT_IMPLICIT_SESSION_CLOSE_TIMEOUT_MS;
 }
 export function resolveManagedSessionState(options) {
-    const { command, managedSessionName, managedSessionNamespace, priorActive, priorNamespace, priorSessionName, succeeded } = options;
+    const { command, managedSessionName, priorActive, priorSessionName, succeeded } = options;
+    const managedSessionNamespace = canonicalizeAgentBrowserNamespace(options.managedSessionNamespace);
+    const priorNamespace = canonicalizeAgentBrowserNamespace(options.priorNamespace);
     if (!managedSessionName) {
         return { active: priorActive, ...(priorNamespace ? { namespace: priorNamespace } : {}), sessionName: priorSessionName };
     }
@@ -391,6 +412,7 @@ function getElectronCleanupClosedManagedSessionNames(details, fallbackSessionNam
     return [...closedSessionNames];
 }
 export function restoreManagedSessionStateFromBranch(branch, fallbackSessionName) {
+    const restoreDisabledIdentities = new Map();
     let restoredState = {
         active: false,
         sessionName: fallbackSessionName,
@@ -400,6 +422,7 @@ export function restoreManagedSessionStateFromBranch(branch, fallbackSessionName
     let freshSessionOrdinal = 0;
     const freshSessionRanks = new Map();
     const applyManagedClose = (sessionName, namespace) => {
+        namespace = canonicalizeAgentBrowserNamespace(namespace);
         const restoreRank = getManagedSessionRestoreRank({
             fallbackSessionName,
             freshSessionRanks,
@@ -431,7 +454,7 @@ export function restoreManagedSessionStateFromBranch(branch, fallbackSessionName
         }
         const explicitSessionName = extractExplicitSessionName(args);
         const sessionName = typeof details.sessionName === "string" ? details.sessionName : undefined;
-        const namespace = typeof details.namespace === "string" ? details.namespace : undefined;
+        const namespace = canonicalizeAgentBrowserNamespace(typeof details.namespace === "string" ? details.namespace : undefined);
         const sessionMode = details.sessionMode === "fresh" || details.sessionMode === "auto" ? details.sessionMode : undefined;
         const usedImplicitSession = details.usedImplicitSession === true;
         const command = typeof details.command === "string" ? details.command : parseCommandInfo(args).command;
@@ -447,6 +470,11 @@ export function restoreManagedSessionStateFromBranch(branch, fallbackSessionName
         const explicitCloseSessionName = commandClosesSession && explicitSessionName && restorableDetailSessionName === explicitSessionName
             ? restorableDetailSessionName
             : undefined;
+        // Sticky restore policy is session-identity state and must apply even for explicit
+        // `--session <current-managed>` rows that are not used for managed-session lifecycle replay.
+        if (details.managedSessionRestoreDisabled === true && typeof sessionName === "string") {
+            restoreDisabledIdentities.set(getAgentBrowserSessionIdentityKey(sessionName, namespace), { namespace, sessionName });
+        }
         const managedSessionName = !explicitSessionName &&
             restorableDetailSessionName &&
             (usedImplicitSession || sessionMode === "fresh")
@@ -472,8 +500,10 @@ export function restoreManagedSessionStateFromBranch(branch, fallbackSessionName
         const outcomeRepresentsActiveCurrentSession = outcomeActiveAfter && outcomeCurrentSessionName === managedSessionName && (outcomeStatus === "created" || outcomeStatus === "replaced" || outcomeStatus === "unchanged");
         const succeeded = outcomeRepresentsActiveCurrentSession ? true : messageIsError === undefined ? exitCode === undefined || exitCode === 0 : !messageIsError;
         if (commandClosesSession) {
-            if (succeeded)
+            if (succeeded) {
+                restoreDisabledIdentities.delete(getAgentBrowserSessionIdentityKey(managedSessionName, namespace));
                 applyManagedClose(managedSessionName, namespace);
+            }
             continue;
         }
         const staleCompletion = succeeded && restoreRank < activeRestoreRank;
@@ -498,6 +528,7 @@ export function restoreManagedSessionStateFromBranch(branch, fallbackSessionName
         ...restoredState,
         ...(closedSessionName ? { closedSessionName } : {}),
         freshSessionOrdinal,
+        managedSessionRestoreDisabledIdentities: [...restoreDisabledIdentities.values()],
     };
 }
 export function createEphemeralSessionSeed() {
@@ -515,13 +546,13 @@ export function createImplicitSessionName(sessionId, cwd, ephemeralSeed) {
     const cwdHash = createCwdHash(cwd);
     const stableSessionId = sessionId?.replace(/-/g, "").slice(0, SESSION_NAME_SESSION_ID_LENGTH);
     if (stableSessionId && stableSessionId.length > 0) {
-        return `piab-${slug}-${stableSessionId}-${cwdHash}`;
+        return `${MANAGED_SESSION_NAME_PREFIX}${slug}-${stableSessionId}-${cwdHash}`;
     }
     const digest = createHash("sha256")
         .update(`ephemeral:${cwd}:${ephemeralSeed}`)
         .digest("hex")
         .slice(0, SESSION_NAME_SESSION_ID_LENGTH);
-    return `piab-${slug}-${digest}-${cwdHash}`;
+    return `${MANAGED_SESSION_NAME_PREFIX}${slug}-${digest}-${cwdHash}`;
 }
 export function createFreshSessionName(baseSessionName, ephemeralSeed, ordinal) {
     const suffix = createHash("sha256")
@@ -623,21 +654,6 @@ function getFlagValue(args, flag) {
     }
     return undefined;
 }
-function isBooleanFlagEnabled(args, flag) {
-    for (const [index, token] of args.entries()) {
-        if (token === flag) {
-            const nextToken = args[index + 1]?.trim().toLowerCase();
-            if (nextToken === "false") {
-                return false;
-            }
-            return true;
-        }
-        if (token.startsWith(`${flag}=`)) {
-            return token.slice(flag.length + 1).trim().toLowerCase() !== "false";
-        }
-    }
-    return false;
-}
 function normalizeComparableUrl(url) {
     const normalizedUrl = url.trim();
     if (normalizedUrl.length === 0) {
@@ -716,57 +732,13 @@ function getCompatibilityWorkaround(args, commandInfo) {
         reason: "OpenAI web properties currently challenge the default headless Chrome user agent; inject a normal Chrome user agent to preserve the default headless workflow without requiring headed mode or auto-connect.",
     };
 }
-export function extractExplicitSessionName(args) {
-    for (const [index, token] of args.entries()) {
-        if (token === "--session") {
-            return args[index + 1];
-        }
-        if (token.startsWith("--session=")) {
-            return token.slice("--session=".length);
-        }
-    }
-    return undefined;
-}
-export function extractExplicitNamespace(args) {
-    for (const [index, token] of args.entries()) {
-        if (token === "--namespace") {
-            return args[index + 1];
-        }
-        if (token.startsWith("--namespace=")) {
-            return token.slice("--namespace=".length);
-        }
-    }
-    return undefined;
-}
 function stripExplicitNamespaceArgs(args) {
-    const stripped = [];
-    for (let index = 0; index < args.length; index += 1) {
-        const token = args[index];
-        if (token === "--namespace") {
-            index += 1;
-            continue;
-        }
-        if (token.startsWith("--namespace="))
-            continue;
-        stripped.push(token);
+    const namespaceTokenIndexes = new Set();
+    for (const occurrence of scanUpstreamGlobalFlagOccurrences(args, "--namespace")) {
+        namespaceTokenIndexes.add(occurrence.index);
+        namespaceTokenIndexes.add(occurrence.index + 1);
     }
-    return stripped;
-}
-function hasLaunchScopedFlagToken(args, flag) {
-    const commandStartIndex = findCommandStartIndex(args);
-    const command = commandStartIndex === undefined ? undefined : args[commandStartIndex];
-    return args.some((token, index) => {
-        if (token !== flag && !token.startsWith(`${flag}=`))
-            return false;
-        if (flag === "--auto-connect")
-            return isBooleanFlagEnabled(args, flag);
-        if (flag === "--restore" && token === "--restore" && optionalGlobalValueFlagConsumesNext(flag, args[index + 1]))
-            return true;
-        if (flag === "--state" && command === "wait" && commandStartIndex !== undefined && index > commandStartIndex) {
-            return false;
-        }
-        return true;
-    });
+    return args.filter((_token, index) => !namespaceTokenIndexes.has(index));
 }
 export function getStartupScopedFlags(args) {
     return LAUNCH_SCOPED_FLAG_DEFINITIONS
@@ -775,14 +747,27 @@ export function getStartupScopedFlags(args) {
 }
 export function buildExecutionPlan(args, options) {
     const invalidValueFlag = getInvalidValueFlagDetails(args);
+    const unsupportedIdentityAssignment = getUnsupportedLeadingIdentityAssignment(args);
+    const explicitNamespacePresent = scanUpstreamGlobalFlagOccurrences(args, "--namespace").length > 0;
     const explicitNamespace = extractExplicitNamespace(args);
-    const startupScopedFlags = getStartupScopedFlags(args).filter((flag) => !(flag === "--namespace" && explicitNamespace === options.managedSessionNamespace));
+    const managedSessionNamespace = canonicalizeAgentBrowserNamespace(options.managedSessionNamespace);
+    const startupScopedFlags = getStartupScopedFlags(args).filter((flag) => !(flag === "--namespace" && explicitNamespacePresent && explicitNamespace === managedSessionNamespace));
     const plainTextInspection = isPlainTextInspectionArgs(args);
     const argvDescriptor = parseArgvDescriptor(args);
     const commandInfo = argvDescriptor.commandInfo;
     const commandNeedsManagedSession = !plainTextInspection && needsManagedSession(argvDescriptor);
     const effectiveArgs = plainTextInspection ? [...args] : args.includes("--json") ? [] : ["--json"];
     let namespace = explicitNamespace;
+    if (plainTextInspection) {
+        return {
+            commandInfo,
+            effectiveArgs,
+            namespace,
+            plainTextInspection,
+            startupScopedFlags,
+            usedImplicitSession: false,
+        };
+    }
     if (invalidValueFlag) {
         return {
             commandInfo: {},
@@ -794,22 +779,37 @@ export function buildExecutionPlan(args, options) {
             validationError: formatInvalidValueFlagError(invalidValueFlag),
         };
     }
-    if (plainTextInspection) {
+    if (unsupportedIdentityAssignment) {
         return {
-            commandInfo,
+            commandInfo: {},
             effectiveArgs,
-            namespace,
-            plainTextInspection,
-            startupScopedFlags,
+            plainTextInspection: false,
+            startupScopedFlags: [],
             usedImplicitSession: false,
+            validationError: `${unsupportedIdentityAssignment}=... is not supported by agent-browser 0.33.2. Pass ${unsupportedIdentityAssignment} and its value as separate arguments.`,
+        };
+    }
+    for (const flag of ["--session", "--namespace"]) {
+        if (countExplicitGlobalFlags(args, flag) <= 1)
+            continue;
+        return {
+            commandInfo: {},
+            effectiveArgs,
+            plainTextInspection: false,
+            startupScopedFlags: [],
+            usedImplicitSession: false,
+            validationError: `Multiple ${flag} flags are not supported. Pass a single ${flag} value; upstream uses the last occurrence while this wrapper would otherwise mis-attribute managed-session ownership.`,
         };
     }
     const explicitSessionName = extractExplicitSessionName(args);
+    if (explicitSessionName && !isWrapperManagedSessionName(explicitSessionName)) {
+        namespace = resolveAgentBrowserNamespace(args, process.env.AGENT_BROWSER_NAMESPACE);
+    }
     const shouldCreateFreshManagedSession = !explicitSessionName && options.sessionMode === "fresh" && commandInfo.command !== undefined && !isCloseCommand(commandInfo.command);
     let argsToAppend = args;
     const compatibilityWorkaround = getCompatibilityWorkaround(args, commandInfo);
-    if (explicitSessionName && explicitNamespace) {
-        effectiveArgs.push("--namespace", explicitNamespace);
+    if (explicitSessionName && explicitNamespacePresent) {
+        effectiveArgs.push("--namespace", explicitNamespace ?? "");
         argsToAppend = stripExplicitNamespaceArgs(args);
     }
     let managedSessionName;
@@ -831,11 +831,11 @@ export function buildExecutionPlan(args, options) {
             ].join(" ");
         }
         else {
-            namespace = explicitNamespace ?? options.managedSessionNamespace;
+            namespace = explicitNamespacePresent ? explicitNamespace : managedSessionNamespace;
             if (namespace)
                 effectiveArgs.push("--namespace", namespace);
             effectiveArgs.push("--session", options.managedSessionName);
-            if (explicitNamespace)
+            if (explicitNamespacePresent)
                 argsToAppend = stripExplicitNamespaceArgs(args);
             managedSessionName = options.managedSessionName;
             sessionName = options.managedSessionName;
@@ -846,7 +846,7 @@ export function buildExecutionPlan(args, options) {
         if (namespace)
             effectiveArgs.push("--namespace", namespace);
         effectiveArgs.push("--session", options.freshSessionName);
-        if (explicitNamespace)
+        if (explicitNamespacePresent)
             argsToAppend = stripExplicitNamespaceArgs(args);
         managedSessionName = options.freshSessionName;
         sessionName = options.freshSessionName;

package/dist/extensions/agent-browser/lib/session-page-state.js

@@ -5,7 +5,8 @@
  * Usage: `index.ts` creates one store per Pi session lifecycle and records observations through update tokens.
  * Invariants/Assumptions: One tool-call update token must govern all page-state observations from that invocation; stale overlapping updates must not overwrite newer state.
  */
-import { isCloseCommand, isReadOnlyDiagnosticSessionTargetCommand } from "./command-taxonomy.js";
+import { getAgentBrowserSessionIdentityKey } from "./argv-grammar.js";
+import { isCloseCommand, isReadOnlyDiagnosticSessionTargetCommand, isUnverifiedPageTransitionCommand } from "./command-taxonomy.js";
 import { isRecord } from "./parsing.js";
 import { getEditableRefEvidence } from "./results/editable-ref-evidence.js";
 import { enrichSnapshotRefEntries, getSnapshotRefEntries } from "./results/snapshot-refs.js";
@@ -82,6 +83,9 @@ function extractBatchResultCommand(item) {
 }
 export function extractSessionTabTargetFromCommandData(commandTokens, data) {
     const [command, subcommand] = commandTokens;
+    if (command === "get" && subcommand === "url") {
+        return normalizeSessionTabTarget({ url: extractStringResultField(data, "url") ?? extractStringResultField(data, "result") });
+    }
     return isReadOnlyDiagnosticSessionTargetCommand(command, subcommand) ? undefined : extractSessionTabTargetFromData(data);
 }
 export function extractSessionTabTargetFromBatchResults(data) {
@@ -124,10 +128,12 @@ export function deriveSessionTabTarget(options) {
     const commandDataTarget = isReadOnlyDiagnosticSessionTargetCommand(options.command, options.subcommand)
         ? undefined
         : extractSessionTabTargetFromData(options.data);
-    return (normalizeSessionTabTarget(options.navigationSummary) ??
-        extractSessionTabTargetFromBatchResults(options.data) ??
-        commandDataTarget ??
-        options.previousTarget);
+    const observedTarget = normalizeSessionTabTarget(options.navigationSummary)
+        ?? extractSessionTabTargetFromBatchResults(options.data)
+        ?? commandDataTarget;
+    if (observedTarget || !isUnverifiedPageTransitionCommand(options.command, options.subcommand))
+        return observedTarget ?? options.previousTarget;
+    return undefined;
 }
 function batchContainsOnlyReadOnlyDiagnosticTargets(data) {
     if (!Array.isArray(data) || data.length === 0) {
@@ -263,11 +269,12 @@ function getRestoredRefSnapshot(details) {
             : undefined,
     };
 }
-function getLatestTabTargetOrder(targets) {
+function getLatestTabTargetOrder(targets, unknownTargets) {
     let latestOrder = 0;
-    for (const target of targets.values()) {
+    for (const target of targets.values())
         latestOrder = Math.max(latestOrder, target.order);
-    }
+    for (const order of unknownTargets.values())
+        latestOrder = Math.max(latestOrder, order);
     return latestOrder;
 }
 function getLatestRefStateOrder(snapshots, invalidations) {
@@ -278,8 +285,8 @@ function getLatestRefStateOrder(snapshots, invalidations) {
         latestOrder = Math.max(latestOrder, invalidation.order);
     return latestOrder;
 }
-function shouldApplyTabTargetUpdate(current, updateOrder) {
-    return !current || updateOrder >= current.order;
+function shouldApplyTabTargetUpdate(current, unknownOrder, updateOrder) {
+    return updateOrder >= Math.max(current?.order ?? 0, unknownOrder ?? 0);
 }
 function shouldApplyRefStateUpdate(options) {
     const currentOrder = Math.max(options.currentSnapshot?.order ?? 0, options.currentInvalidation?.order ?? 0);
@@ -292,14 +299,13 @@ function stripRefSnapshotInvalidationOrder(invalidation) {
     return invalidation ? { reason: invalidation.reason, summary: invalidation.summary } : undefined;
 }
 export function getSessionPageStateKey(sessionName, namespace) {
-    if (!sessionName)
-        return undefined;
-    return namespace ? `${namespace}\u0000${sessionName}` : sessionName;
+    return sessionName ? getAgentBrowserSessionIdentityKey(sessionName, namespace) : undefined;
 }
 export class SessionPageState {
     refSnapshotInvalidations = new Map();
     refSnapshots = new Map();
     tabPinningReasons = new Map();
+    tabTargetUnknownOrders = new Map();
     tabTargets = new Map();
     updateOrder = 0;
     static fromBranch(branch) {
@@ -327,13 +333,23 @@ export class SessionPageState {
                 continue;
             }
             const tabTarget = getRestoredSessionTabTarget(details, command, subcommand);
+            const tabTargetUnknown = details.sessionTabTargetUnknown === true;
             const refSnapshotInvalidation = getRestoredRefSnapshotInvalidation(details, command);
             const refSnapshot = refSnapshotInvalidation ? undefined : getRestoredRefSnapshot(details);
-            if (!tabTarget && !refSnapshotInvalidation && !refSnapshot)
+            if (!tabTarget && !tabTargetUnknown && !refSnapshotInvalidation && !refSnapshot)
                 continue;
             restoredOrder += 1;
-            if (tabTarget)
+            if (tabTargetUnknown) {
+                state.refSnapshotInvalidations.delete(sessionKey);
+                state.refSnapshots.delete(sessionKey);
+                state.tabTargets.delete(sessionKey);
+                state.tabTargetUnknownOrders.set(sessionKey, restoredOrder);
+                continue;
+            }
+            if (tabTarget) {
+                state.tabTargetUnknownOrders.delete(sessionKey);
                 state.tabTargets.set(sessionKey, { order: restoredOrder, target: tabTarget });
+            }
             if (refSnapshotInvalidation) {
                 state.refSnapshots.delete(sessionKey);
                 state.refSnapshotInvalidations.set(sessionKey, { ...refSnapshotInvalidation, order: restoredOrder });
@@ -343,7 +359,7 @@ export class SessionPageState {
                 state.refSnapshots.set(sessionKey, { ...refSnapshot, order: restoredOrder });
             }
         }
-        state.updateOrder = Math.max(restoredOrder, getLatestTabTargetOrder(state.tabTargets), getLatestRefStateOrder(state.refSnapshots, state.refSnapshotInvalidations));
+        state.updateOrder = Math.max(restoredOrder, getLatestTabTargetOrder(state.tabTargets, state.tabTargetUnknownOrders), getLatestRefStateOrder(state.refSnapshots, state.refSnapshotInvalidations));
         state.tabPinningReasons = new Map([...state.tabTargets.keys()].map((sessionName) => [sessionName, "restore"]));
         return state;
     }
@@ -355,6 +371,7 @@ export class SessionPageState {
         this.refSnapshotInvalidations = new Map();
         this.refSnapshots = new Map();
         this.tabPinningReasons = new Map();
+        this.tabTargetUnknownOrders = new Map();
         this.tabTargets = new Map();
         this.updateOrder = 0;
     }
@@ -365,14 +382,16 @@ export class SessionPageState {
             pinningReason: this.tabPinningReasons.get(sessionName),
             refSnapshot: stripRefSnapshotOrder(this.refSnapshots.get(sessionName)),
             refSnapshotInvalidation: stripRefSnapshotInvalidationOrder(this.refSnapshotInvalidations.get(sessionName)),
+            ...(this.tabTargetUnknownOrders.has(sessionName) ? { tabTargetUnknown: true } : {}),
             tabTarget: this.tabTargets.get(sessionName)?.target,
         };
     }
     applyTabTarget(options) {
         const current = this.tabTargets.get(options.sessionName);
-        if (!shouldApplyTabTargetUpdate(current, options.update)) {
+        if (!shouldApplyTabTargetUpdate(current, this.tabTargetUnknownOrders.get(options.sessionName), options.update)) {
             return { ...this.get(options.sessionName), applied: false, stale: true };
         }
+        this.tabTargetUnknownOrders.delete(options.sessionName);
         this.tabTargets.set(options.sessionName, { order: options.update, target: options.target });
         return { ...this.get(options.sessionName), applied: true };
     }
@@ -401,10 +420,22 @@ export class SessionPageState {
         this.refSnapshotInvalidations.set(options.sessionName, { ...options.invalidation, order: options.update });
         return { ...this.get(options.sessionName), applied: true };
     }
+    markTabTargetUnknown(options) {
+        const current = this.tabTargets.get(options.sessionName);
+        if (!shouldApplyTabTargetUpdate(current, this.tabTargetUnknownOrders.get(options.sessionName), options.update))
+            return { ...this.get(options.sessionName), applied: false, stale: true };
+        this.refSnapshotInvalidations.delete(options.sessionName);
+        this.refSnapshots.delete(options.sessionName);
+        this.tabPinningReasons.delete(options.sessionName);
+        this.tabTargets.delete(options.sessionName);
+        this.tabTargetUnknownOrders.set(options.sessionName, options.update);
+        return { ...this.get(options.sessionName), applied: true };
+    }
     clearSession(sessionName) {
         this.refSnapshotInvalidations.delete(sessionName);
         this.refSnapshots.delete(sessionName);
         this.tabPinningReasons.delete(sessionName);
+        this.tabTargetUnknownOrders.delete(sessionName);
         this.tabTargets.delete(sessionName);
     }
     markPinning(sessionName, reason) {

package/dist/extensions/agent-browser/lib/temp.js

@@ -5,26 +5,24 @@
  * Usage: Imported by result/process helpers when they need secure spill files instead of world-readable shared tmp paths.
  * Invariants/Assumptions: Temp artifacts live under the OS temp directory, each active run uses a dedicated 0700 directory, files are created with exclusive 0600 permissions, session-scoped persisted artifacts stay under the pi session directory, and stale pruning only touches roots with an explicit pi-agent-browser ownership marker.
  */
-import { execFile } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { existsSync, readdirSync, rmSync } from "node:fs";
 import { chmod, mkdir, mkdtemp, open, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
-import { promisify } from "node:util";
 import { isRecord, parsePositiveInteger } from "./parsing.js";
+import { processStartIdentitiesMatch, readProcessStartIdentity } from "./process-identity.js";
 const TEMP_ROOT_PREFIX = "pi-agent-browser-";
 const TEMP_ROOT_MARKER_FILE_NAME = ".pi-agent-browser-owner.json";
 const TEMP_ROOT_MARKER_KIND = "pi-agent-browser-temp-root";
-const TEMP_ROOT_MARKER_VERSION = 1;
+const TEMP_ROOT_LEGACY_MARKER_VERSION = 1;
+const TEMP_ROOT_MARKER_VERSION = 2;
 const STALE_TEMP_ROOT_MAX_AGE_MS = 24 * 60 * 60 * 1_000;
 const TEMP_ROOT_MAX_BYTES_ENV = "PI_AGENT_BROWSER_TEMP_ROOT_MAX_BYTES";
 const DEFAULT_TEMP_ROOT_MAX_BYTES = 32 * 1_024 * 1_024;
 const SESSION_ARTIFACT_MAX_BYTES_ENV = "PI_AGENT_BROWSER_SESSION_ARTIFACT_MAX_BYTES";
 const DEFAULT_SESSION_ARTIFACT_MAX_BYTES = 32 * 1_024 * 1_024;
 const SESSION_ARTIFACTS_ROOT_DIR_NAME = ".pi-agent-browser-artifacts";
-const PROCESS_START_IDENTITY_TIMEOUT_MS = 1_000;
-const execFileAsync = promisify(execFile);
 let sessionTempRootPromise;
 let exitCleanupRegistered = false;
 let tempMutationQueue = Promise.resolve();
@@ -48,7 +46,7 @@ function isProtectedTempChildName(value) {
 function isTempRootOwnershipRecord(value) {
     if (!isRecord(value))
         return false;
-    if (value.kind !== TEMP_ROOT_MARKER_KIND || value.version !== TEMP_ROOT_MARKER_VERSION)
+    if (value.kind !== TEMP_ROOT_MARKER_KIND || ![TEMP_ROOT_LEGACY_MARKER_VERSION, TEMP_ROOT_MARKER_VERSION].includes(value.version))
         return false;
     if (!isPositiveFiniteNumber(value.createdAtMs))
         return false;
@@ -153,6 +151,7 @@ async function persistProtectedTempChildren(tempRoot, protectedChildren) {
         ...ownershipMarker,
         leaseUpdatedAtMs: Date.now(),
         protectedChildNames: childNames,
+        version: TEMP_ROOT_MARKER_VERSION,
     });
 }
 async function getExistingProtectedChildren(tempRoot, protectedChildren) {
@@ -180,20 +179,7 @@ async function removeTempRootChildrenExcept(tempRoot, protectedChildren) {
     }));
 }
 async function getProcessStartIdentity(pid) {
-    if (pid === undefined)
-        return undefined;
-    if (!Number.isSafeInteger(pid) || pid <= 0)
-        return undefined;
-    try {
-        const { stdout } = await execFileAsync("ps", ["-p", String(pid), "-o", "lstart="], {
-            timeout: PROCESS_START_IDENTITY_TIMEOUT_MS,
-        });
-        const identity = stdout.trim().replace(/\s+/g, " ");
-        return identity || undefined;
-    }
-    catch {
-        return undefined;
-    }
+    return pid === undefined ? undefined : await readProcessStartIdentity(pid);
 }
 export async function writeSecureTempRootOwnershipMarker(tempRoot, options = {}) {
     const createdAtMs = options.createdAtMs ?? Date.now();
@@ -219,10 +205,10 @@ async function refreshSecureTempRootLease(tempRoot) {
     if (currentUid !== undefined && ownershipMarker.ownerUid !== undefined && ownershipMarker.ownerUid !== currentUid)
         return;
     const currentProcessStartIdentity = await getProcessStartIdentity(process.pid);
-    if (ownershipMarker.ownerProcessStartIdentity !== undefined &&
-        currentProcessStartIdentity !== undefined &&
-        ownershipMarker.ownerProcessStartIdentity !== currentProcessStartIdentity) {
-        return;
+    if (ownershipMarker.ownerProcessStartIdentity !== undefined && currentProcessStartIdentity !== undefined) {
+        const identitiesMatch = processStartIdentitiesMatch(ownershipMarker.ownerProcessStartIdentity, currentProcessStartIdentity);
+        if (identitiesMatch === false)
+            return;
     }
     const refreshedMarker = {
         ...ownershipMarker,
@@ -230,6 +216,7 @@ async function refreshSecureTempRootLease(tempRoot) {
         ownerPid: process.pid,
         ownerProcessStartIdentity: currentProcessStartIdentity ?? ownershipMarker.ownerProcessStartIdentity,
         ownerUid: currentUid,
+        version: TEMP_ROOT_MARKER_VERSION,
     };
     await writeTempRootOwnershipMarkerRecord(tempRoot, refreshedMarker);
 }
@@ -251,7 +238,8 @@ async function getMarkerOwnerLiveness(ownershipMarker) {
     if (ownershipMarker.ownerProcessStartIdentity === undefined || currentProcessStartIdentity === undefined) {
         return "unknown";
     }
-    return ownershipMarker.ownerProcessStartIdentity === currentProcessStartIdentity ? "alive" : "dead";
+    const identitiesMatch = processStartIdentitiesMatch(ownershipMarker.ownerProcessStartIdentity, currentProcessStartIdentity);
+    return identitiesMatch === undefined ? "unknown" : identitiesMatch ? "alive" : "dead";
 }
 async function pruneStaleTempRoots(currentTempRoot) {
     const entries = await readdir(tmpdir(), { withFileTypes: true }).catch(() => []);