pi-agent-browser-native 0.2.72 → 0.2.75

package/dist/extensions/agent-browser/lib/process.js

@@ -1,21 +1,28 @@
 /**
  * Purpose: Execute the upstream agent-browser binary for the pi-agent-browser extension.
- * Responsibilities: Spawn the agent-browser subprocess, forward parent environment variables plus wrapper overrides, stream optional stdin, bound in-memory output buffering, spill oversized stdout safely to a private temp file under a disk budget, and honor abort signals.
+ * Responsibilities: Validate POSIX socket storage, spawn the agent-browser subprocess, forward parent environment variables plus wrapper overrides, stream optional stdin, bound in-memory output buffering, spill oversized stdout safely to a private temp file under a disk budget, and honor abort signals.
  * Scope: Process execution only; argument planning, output formatting, and pi tool registration live elsewhere.
  * Usage: Called by the extension tool after argument validation and session planning are complete.
  * Invariants/Assumptions: The binary name is always `agent-browser`; Windows routes through PowerShell to invoke npm launchers with escaped argv; callers handle semantic success/error interpretation.
  */
 import { spawn } from "node:child_process";
-import { chmod, mkdir } from "node:fs/promises";
+import { lstat, mkdir, readdir } from "node:fs/promises";
+import { dirname, isAbsolute, join } from "node:path";
 import { env as processEnv, platform as processPlatform } from "node:process";
-import { GLOBAL_BOOLEAN_FLAGS_WITH_OPTIONAL_VALUES, GLOBAL_VALUE_FLAGS, getFlagName } from "./argv-grammar.js";
-import { getImplicitSessionIdleTimeoutMs } from "./runtime.js";
+import { parseArgvDescriptor } from "./argv-descriptor.js";
+import { needsManagedSession } from "./command-policy.js";
+import { isKnownCommandToken } from "./command-taxonomy.js";
+import { getFlagName, GLOBAL_BOOLEAN_FLAGS_WITH_OPTIONAL_VALUES, GLOBAL_VALUE_FLAGS, optionalGlobalValueFlagConsumesNext, } from "./argv-grammar.js";
+import { canonicalizeOwnedManagedSessionCloseArgs, commitManagedSessionRestoreSuppression, getManagedSessionRestoreConfigEnv, getManagedSessionRestoreEnv, getManagedSessionRestoreProtectedEnv, getOwnedManagedSessionCompatibilityEnv, getOwnedManagedSessionNamespaceEnv, isOwnedManagedSessionTarget, shouldOmitOwnedManagedSessionRestoreEnv, validateManagedSessionRestoreContextForSpawn, } from "./managed-session-restore.js";
+import { getManagedSessionStateAccessValidationError, getManagedSessionTargetAccessValidationError, } from "./managed-session-state-policy.js";
+import { getImplicitSessionIdleTimeoutMs, isPlainTextInspectionArgs } from "./runtime.js";
 import { openSecureTempFile, writeSecureTempChunk } from "./temp.js";
 const MAX_BUFFERED_STDOUT_BYTES = 512 * 1_024;
 const MAX_BUFFERED_STDERR_CHARS = 32_000;
 const MAX_BUFFERED_STDOUT_TAIL_CHARS = 32_000;
 const PROCESS_STDOUT_SPILL_FILE_PREFIX = "process-stdout";
 const AGENT_BROWSER_SOCKET_DIR_ENV = "AGENT_BROWSER_SOCKET_DIR";
+const AGENT_BROWSER_ARGS_ENV = "AGENT_BROWSER_ARGS";
 const AGENT_BROWSER_DEFAULT_TIMEOUT_ENV = "AGENT_BROWSER_DEFAULT_TIMEOUT";
 const AGENT_BROWSER_IDLE_TIMEOUT_ENV = "AGENT_BROWSER_IDLE_TIMEOUT_MS";
 const PI_AGENT_BROWSER_PROCESS_TIMEOUT_ENV = "PI_AGENT_BROWSER_PROCESS_TIMEOUT_MS";
@@ -24,6 +31,7 @@ export const SAFE_AGENT_BROWSER_OPERATION_TIMEOUT_MS = 25_000;
 const DEFAULT_AGENT_BROWSER_PROCESS_TIMEOUT_MS = 35_000;
 /** Grace period after `exit` before resolving when `close` is delayed by inherited stdio handles. */
 const EXIT_STDIO_GRACE_MS = 100;
+const WINDOWS_AGENT_BROWSER_MISSING_MARKER = "PI_AGENT_BROWSER_COMMAND_NOT_FOUND:agent-browser.cmd";
 function appendTail(text, addition, maxChars) {
     const combined = text + addition;
     return combined.length <= maxChars ? combined : combined.slice(combined.length - maxChars);
@@ -31,37 +39,90 @@ function appendTail(text, addition, maxChars) {
 function quoteWindowsPowerShellArg(value) {
     return `'${value.replace(/'/g, "''")}'`;
 }
-const WINDOWS_LEADING_GLOBAL_VALUE_FLAGS = new Set(GLOBAL_VALUE_FLAGS);
 /** Exported for unit tests that lock Windows launcher argv ordering. */
 export function reorderWindowsLeadingGlobalArgs(args) {
     const leadingGlobals = [];
-    let index = 0;
-    while (index < args.length && args[index]?.startsWith("-")) {
+    for (let index = 0; index < args.length; index += 1) {
         const token = args[index];
-        const flagName = getFlagName(token);
-        leadingGlobals.push(token);
-        index += 1;
-        if (WINDOWS_LEADING_GLOBAL_VALUE_FLAGS.has(flagName) && !token.includes("=") && index < args.length) {
-            leadingGlobals.push(args[index]);
-            index += 1;
+        if (isKnownCommandToken(token)) {
+            return index === 0 ? args : [token, ...leadingGlobals, ...args.slice(index + 1)];
+        }
+        if (!token.startsWith("-"))
+            return args;
+        if (token.startsWith("--restore=")) {
+            leadingGlobals.push(token);
+            continue;
+        }
+        if (token === "--restore") {
+            const value = args[index + 1];
+            if (optionalGlobalValueFlagConsumesNext(token, value)) {
+                leadingGlobals.push(`--restore=${value}`);
+                index += 1;
+            }
+            else {
+                leadingGlobals.push(token);
+            }
             continue;
         }
-        if (GLOBAL_BOOLEAN_FLAGS_WITH_OPTIONAL_VALUES.has(flagName) && ["true", "false"].includes(args[index] ?? "")) {
-            leadingGlobals.push(args[index]);
+        if (token.includes("="))
+            return args;
+        const flag = getFlagName(token);
+        if (GLOBAL_BOOLEAN_FLAGS_WITH_OPTIONAL_VALUES.has(flag)) {
+            leadingGlobals.push(token);
+            if (["true", "false"].includes(args[index + 1] ?? "")) {
+                leadingGlobals.push(args[index + 1]);
+                index += 1;
+            }
+            continue;
+        }
+        if (GLOBAL_VALUE_FLAGS.includes(flag)) {
+            const value = args[index + 1];
+            if (value === undefined)
+                return args;
+            leadingGlobals.push(token, value);
             index += 1;
+            continue;
         }
-    }
-    if (leadingGlobals.length === 0 || index >= args.length)
         return args;
-    return [args[index], ...leadingGlobals, ...args.slice(index + 1)];
+    }
+    return args;
+}
+export function pinAgentBrowserFileAccessDisabled(args) {
+    const filtered = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const token = args[index];
+        if (token.startsWith("--allow-file-access="))
+            continue;
+        if (token === "--allow-file-access") {
+            if (["false", "true"].includes(args[index + 1] ?? ""))
+                index += 1;
+            continue;
+        }
+        filtered.push(token);
+    }
+    return ["--args", "", "--allow-file-access", "false", ...filtered];
 }
 export function buildAgentBrowserSpawnCommand(args, platform = processPlatform) {
     if (platform !== "win32") {
         return { command: "agent-browser", args };
     }
-    const commandLine = ["&", "agent-browser.cmd", ...reorderWindowsLeadingGlobalArgs(args).map(quoteWindowsPowerShellArg)].join(" ");
+    const invocationArgs = reorderWindowsLeadingGlobalArgs(args).map(quoteWindowsPowerShellArg).join(" ");
+    const commandLine = [
+        "$agentBrowser = Get-Command agent-browser.cmd -ErrorAction SilentlyContinue;",
+        `if (-not $agentBrowser) { [Console]::Error.WriteLine('${WINDOWS_AGENT_BROWSER_MISSING_MARKER}'); exit 127 };`,
+        `& $agentBrowser.Source ${invocationArgs}`.trimEnd(),
+    ].join(" ");
     return { command: "powershell.exe", args: ["-NoLogo", "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", commandLine] };
 }
+export function isWindowsAgentBrowserCommandMissing(stderr) {
+    const normalized = stderr.toLowerCase();
+    return normalized.includes(WINDOWS_AGENT_BROWSER_MISSING_MARKER.toLowerCase()) || (normalized.includes("agent-browser.cmd") && (normalized.includes("commandnotfoundexception") ||
+        normalized.includes("not recognized as the name of a cmdlet") ||
+        normalized.includes("not recognized as an internal or external command")));
+}
+export function shouldCommitManagedRestoreAfterWindowsProcess(input) {
+    return !input.spawnError && !(input.exitCode !== 0 && isWindowsAgentBrowserCommandMissing(input.stderr));
+}
 function terminateSpawnedChild(child, signal) {
     if (processPlatform === "win32" && child.pid) {
         const killer = spawn("taskkill.exe", ["/PID", String(child.pid), "/T", "/F"], { stdio: "ignore" });
@@ -154,13 +215,76 @@ export function getAgentBrowserSocketDir(platform = processPlatform, uid = typeo
     if (platform === "win32") {
         return undefined;
     }
-    return `${DEFAULT_AGENT_BROWSER_SOCKET_DIR_PREFIX}${typeof uid === "number" ? `-${uid}` : ""}`;
+    const prefix = platform === "darwin" ? "/private/tmp/piab" : DEFAULT_AGENT_BROWSER_SOCKET_DIR_PREFIX;
+    return `${prefix}${typeof uid === "number" ? `-${uid}` : ""}`;
 }
-async function ensureAgentBrowserSocketDir(socketDir) {
+async function hasTrustedSocketDirAncestry(socketDir, uid) {
+    for (let current = dirname(socketDir);;) {
+        const metadata = await lstat(current);
+        if (metadata.isSymbolicLink()) {
+            if (metadata.uid !== 0)
+                return false;
+        }
+        else if (!metadata.isDirectory()) {
+            return false;
+        }
+        if (!metadata.isSymbolicLink()) {
+            const mode = metadata.mode & 0o7777;
+            if (metadata.uid === uid) {
+                if ((mode & 0o022) !== 0)
+                    return false;
+            }
+            else if (metadata.uid !== 0 || ((mode & 0o022) !== 0 && (mode & 0o1000) === 0)) {
+                return false;
+            }
+        }
+        const parent = dirname(current);
+        if (parent === current)
+            return true;
+        current = parent;
+    }
+}
+async function socketDirEntriesAreOwned(socketDir, uid, visited = { count: 0 }) {
+    for (const name of await readdir(socketDir)) {
+        if ((visited.count += 1) > 16_384)
+            return false;
+        try {
+            const path = join(socketDir, name);
+            const metadata = await lstat(path);
+            if (metadata.uid !== uid || metadata.isSymbolicLink())
+                return false;
+            if (metadata.isDirectory()) {
+                if (!await socketDirEntriesAreOwned(path, uid, visited))
+                    return false;
+            }
+            else if (!metadata.isFile() && !metadata.isSocket()) {
+                return false;
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                return false;
+        }
+    }
+    return true;
+}
+export async function ensureAgentBrowserSocketDir(socketDir, uid = typeof process.getuid === "function" ? process.getuid() : undefined) {
+    if (!isAbsolute(socketDir) || typeof uid !== "number")
+        return false;
     try {
-        await mkdir(socketDir, { recursive: true, mode: 0o700 });
-        await chmod(socketDir, 0o700).catch(() => undefined);
-        return true;
+        if (!await hasTrustedSocketDirAncestry(socketDir, uid))
+            return false;
+        try {
+            await mkdir(socketDir, { mode: 0o700 });
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                return false;
+        }
+        const metadata = await lstat(socketDir);
+        if (!metadata.isDirectory() || metadata.isSymbolicLink() || metadata.uid !== uid || (metadata.mode & 0o777) !== 0o700)
+            return false;
+        return await hasTrustedSocketDirAncestry(socketDir, uid) && await socketDirEntriesAreOwned(socketDir, uid);
     }
     catch {
         return false;
@@ -183,21 +307,115 @@ export function buildAgentBrowserProcessEnv(baseEnv = processEnv, overrides = un
     clampUpstreamDefaultTimeout(childEnv);
     return childEnv;
 }
+function getManagedPreSpawnPolicyError(options, effectiveEnv, allowManagedSessionTarget = false, currentPageUrl, pageUrlUnknown = false, trustedFirstBatchTabSelection = false, trustedPinnedEmptyConfig = false) {
+    const policyEnv = effectiveEnv ?? { ...(options.parentEnv ?? processEnv), ...options.env };
+    const managedSessionTargetError = getManagedSessionTargetAccessValidationError(options.args, allowManagedSessionTarget || options.ownedManagedSession === true || isOwnedManagedSessionTarget(options.args), policyEnv);
+    if (managedSessionTargetError)
+        return managedSessionTargetError;
+    if (!validateManagedSessionRestoreContextForSpawn(options)) {
+        return "Managed session restore policy, storage, or checkout identity changed after planning; refusing to start agent-browser.";
+    }
+    return getManagedSessionStateAccessValidationError({
+        args: options.args,
+        currentPageUrl,
+        cwd: options.cwd,
+        env: effectiveEnv ?? options.env,
+        pageUrlUnknown,
+        parentEnv: effectiveEnv ? {} : options.parentEnv ?? processEnv,
+        stdin: options.stdin,
+        trustedFirstBatchTabSelection,
+        trustedPinnedEmptyConfig,
+    });
+}
 export async function runAgentBrowserProcess(options) {
-    const { args, cwd, env, signal, stdin } = options;
+    const { allowManagedSessionTarget, cwd, env, managedSessionRestoreState, managedStateCurrentPageUrl, managedStatePageUrlUnknown, signal, stdin, trustedFirstBatchTabSelection } = options;
+    const ownedManagedSession = options.ownedManagedSession === true || isOwnedManagedSessionTarget(options.args);
+    const args = canonicalizeOwnedManagedSessionCloseArgs({
+        args: options.args,
+        cwd,
+        env,
+        ownedManagedSession,
+        restoreState: managedSessionRestoreState,
+        stdin,
+    });
     const timeoutMs = options.timeoutMs ?? getAgentBrowserProcessTimeoutMs();
+    if (signal?.aborted) {
+        return { aborted: true, agentBrowserStarted: false, exitCode: 1, stderr: "", stdout: "", timedOut: false };
+    }
+    const managedSessionRestoreOptions = {
+        args,
+        cwd,
+        env,
+        ownedManagedSession,
+        restoreState: managedSessionRestoreState,
+        stdin,
+    };
+    const planningPolicyError = getManagedPreSpawnPolicyError(managedSessionRestoreOptions, undefined, allowManagedSessionTarget, managedStateCurrentPageUrl, managedStatePageUrlUnknown, trustedFirstBatchTabSelection);
+    if (planningPolicyError) {
+        return {
+            aborted: false,
+            agentBrowserStarted: false,
+            exitCode: 1,
+            spawnError: new Error(planningPolicyError),
+            stderr: "",
+            stdout: "",
+            timedOut: false,
+        };
+    }
+    const managedSessionRestoreEnv = getManagedSessionRestoreEnv(managedSessionRestoreOptions);
+    const ownedManagedSessionClose = shouldOmitOwnedManagedSessionRestoreEnv(managedSessionRestoreOptions);
+    const browserConfigPinRequired = !isPlainTextInspectionArgs(args) && needsManagedSession(parseArgvDescriptor(args));
+    const managedSessionRestoreConfigEnv = await getManagedSessionRestoreConfigEnv(managedSessionRestoreEnv, ownedManagedSessionClose || browserConfigPinRequired);
+    if (managedSessionRestoreConfigEnv === undefined) {
+        return {
+            aborted: false,
+            agentBrowserStarted: false,
+            exitCode: 1,
+            spawnError: new Error("Browser-backed agent-browser commands require a protected empty config, but secure temp storage was unavailable."),
+            stderr: "",
+            stdout: "",
+            timedOut: false,
+        };
+    }
     const processOverrides = {
         [AGENT_BROWSER_IDLE_TIMEOUT_ENV]: String(getImplicitSessionIdleTimeoutMs()),
+        ...managedSessionRestoreEnv,
         ...env,
+        ...managedSessionRestoreConfigEnv,
+        ...getManagedSessionRestoreProtectedEnv(managedSessionRestoreOptions, managedSessionRestoreEnv),
+        ...getOwnedManagedSessionNamespaceEnv(managedSessionRestoreOptions),
+        ...getOwnedManagedSessionCompatibilityEnv(managedSessionRestoreOptions),
+        [AGENT_BROWSER_ARGS_ENV]: undefined,
     };
     const explicitSocketDir = processOverrides[AGENT_BROWSER_SOCKET_DIR_ENV];
     let effectiveEnv = explicitSocketDir === undefined ? { ...processOverrides, [AGENT_BROWSER_SOCKET_DIR_ENV]: undefined } : processOverrides;
+    if (ownedManagedSessionClose)
+        effectiveEnv = { ...effectiveEnv, AGENT_BROWSER_RESTORE: undefined };
     const requestedSocketDir = explicitSocketDir ?? getAgentBrowserSocketDir();
-    if (requestedSocketDir && (await ensureAgentBrowserSocketDir(requestedSocketDir))) {
+    if (requestedSocketDir !== undefined) {
+        const socketDirIsSecure = requestedSocketDir.length > 0 && await ensureAgentBrowserSocketDir(requestedSocketDir);
+        if (signal?.aborted) {
+            return { aborted: true, agentBrowserStarted: false, exitCode: 1, stderr: "", stdout: "", timedOut: false };
+        }
+        if (!socketDirIsSecure) {
+            return {
+                aborted: false,
+                agentBrowserStarted: false,
+                exitCode: 1,
+                spawnError: new Error("Agent-browser socket storage must be an absolute, non-symlink directory owned by the current user with mode 0700."),
+                stderr: "",
+                stdout: "",
+                timedOut: false,
+            };
+        }
         effectiveEnv = { ...effectiveEnv, [AGENT_BROWSER_SOCKET_DIR_ENV]: requestedSocketDir };
     }
+    if (signal?.aborted) {
+        return { aborted: true, agentBrowserStarted: false, exitCode: 1, stderr: "", stdout: "", timedOut: false };
+    }
     return await new Promise((resolve) => {
         let aborted = false;
+        let agentBrowserStarted = false;
         let settled = false;
         let spawnError;
         let stderr = "";
@@ -268,6 +486,15 @@ export async function runAgentBrowserProcess(options) {
                 if (stdoutSpillHandle) {
                     await stdoutSpillHandle.close().catch(() => undefined);
                 }
+                const windowsMissingBinary = processPlatform === "win32" && exitCode !== 0 && isWindowsAgentBrowserCommandMissing(stderr);
+                if (processPlatform === "win32" && !windowsMissingBinary && !spawnError)
+                    agentBrowserStarted = true;
+                if (windowsMissingBinary && !spawnError) {
+                    spawnError = Object.assign(new Error("spawn agent-browser ENOENT"), { code: "ENOENT" });
+                }
+                else if (processPlatform === "win32" && shouldCommitManagedRestoreAfterWindowsProcess({ exitCode, spawnError, stderr })) {
+                    commitManagedSessionRestoreSuppression(managedSessionRestoreOptions);
+                }
                 if (!spawnError && stdoutSpillError) {
                     spawnError = stdoutSpillError;
                 }
@@ -275,6 +502,7 @@ export async function runAgentBrowserProcess(options) {
                 destroySpawnedChildStreams(child);
                 resolve({
                     aborted,
+                    agentBrowserStarted,
                     exitCode,
                     spawnError,
                     stderr,
@@ -285,12 +513,24 @@ export async function runAgentBrowserProcess(options) {
                 });
             });
         };
-        const spawnCommand = buildAgentBrowserSpawnCommand(args);
+        const childEnv = buildAgentBrowserProcessEnv(processEnv, effectiveEnv);
+        const spawnPolicyError = getManagedPreSpawnPolicyError(managedSessionRestoreOptions, childEnv, allowManagedSessionTarget, managedStateCurrentPageUrl, managedStatePageUrlUnknown, trustedFirstBatchTabSelection, managedSessionRestoreConfigEnv.AGENT_BROWSER_CONFIG !== undefined);
+        if (spawnPolicyError) {
+            resolve({ aborted: false, agentBrowserStarted: false, exitCode: 1, spawnError: new Error(spawnPolicyError), stderr: "", stdout: "", timedOut: false });
+            return;
+        }
+        const spawnCommand = buildAgentBrowserSpawnCommand(pinAgentBrowserFileAccessDisabled(args));
         const child = spawn(spawnCommand.command, spawnCommand.args, {
             cwd,
-            env: buildAgentBrowserProcessEnv(processEnv, effectiveEnv),
+            env: childEnv,
             stdio: ["pipe", "pipe", "pipe"],
         });
+        if (processPlatform !== "win32") {
+            child.once("spawn", () => {
+                agentBrowserStarted = true;
+                commitManagedSessionRestoreSuppression(managedSessionRestoreOptions);
+            });
+        }
         const terminateChild = (reason) => {
             if (settled)
                 return;
@@ -356,13 +596,10 @@ export async function runAgentBrowserProcess(options) {
             timeoutTimer.unref?.();
         }
         if (signal) {
-            if (signal.aborted) {
+            abortListener = () => terminateChild("abort");
+            signal.addEventListener("abort", abortListener, { once: true });
+            if (signal.aborted)
                 terminateChild("abort");
-            }
-            else {
-                abortListener = () => terminateChild("abort");
-                signal.addEventListener("abort", abortListener, { once: true });
-            }
         }
         writeChildStdin();
     });

package/dist/extensions/agent-browser/lib/results/artifact-manifest.js

@@ -73,16 +73,18 @@ export function formatSessionArtifactRetentionSummary(manifest) {
         parts.push(`${missingCount} missing`);
     return `Session artifacts: ${parts.join(", ")} (${manifest.entries.length}/${manifest.maxEntries} recent).`;
 }
+export function getSessionArtifactManifestEntryKey(entry) {
+    return entry.storageScope === "explicit-path" && entry.absolutePath ? `${entry.storageScope}:${entry.absolutePath}` : `${entry.storageScope}:${entry.path}`;
+}
 export function mergeSessionArtifactManifest(options) {
     const nowMs = options.nowMs ?? Date.now();
     const maxEntries = getSessionArtifactManifestMaxEntries();
-    const getEntryKey = (entry) => entry.storageScope === "explicit-path" && entry.absolutePath ? `${entry.storageScope}:${entry.absolutePath}` : `${entry.storageScope}:${entry.path}`;
     const byPath = new Map();
     for (const entry of options.base?.entries ?? []) {
-        byPath.set(getEntryKey(entry), entry);
+        byPath.set(getSessionArtifactManifestEntryKey(entry), entry);
     }
     for (const entry of options.entries ?? []) {
-        const key = getEntryKey(entry);
+        const key = getSessionArtifactManifestEntryKey(entry);
         const existing = byPath.get(key);
         byPath.set(key, {
             ...existing,

package/dist/extensions/agent-browser/lib/results/presentation/common.js

@@ -3,6 +3,7 @@
  * Responsibilities: Normalize scalar fields, stringify model-facing values, and apply sensitive-text redaction.
  * Scope: Leaf helpers only; command-family formatting lives in sibling modules.
  */
+import { containsManagedSessionRestoreKey } from "../../managed-session-capabilities.js";
 import { redactSensitiveText, redactSensitiveValue } from "../../runtime.js";
 import { stringifyUnknown, truncateText } from "../text.js";
 export function stringifyModelFacing(value) {
@@ -27,7 +28,7 @@ export function redactModelFacingText(text) {
     return redactSensitiveText(text);
 }
 export function redactModelFacingTextIfSensitive(text) {
-    return /(?:@|\b(?:access[_-]?key|api[_-]?key|auth|authorization|basic|bearer|connection[_-]?string|cookie|database[_-]?url|db[_-]?url|mongo(?:db)?[_-]?uri|pass(?:word)?|private[_-]?key|redis[_-]?url|secret|session[_-]?id|token)\b)/i.test(text)
+    return containsManagedSessionRestoreKey(text) || /(?:@|\b(?:access[_-]?key|api[_-]?key|auth|authorization|basic|bearer|connection[_-]?string|cookie|database[_-]?url|db[_-]?url|mongo(?:db)?[_-]?uri|pass(?:word)?|private[_-]?key|redis[_-]?url|secret|session[_-]?id|token)\b)/i.test(text)
         ? redactModelFacingText(text)
         : text;
 }

package/dist/extensions/agent-browser/lib/results/presentation/diagnostics.js

@@ -9,6 +9,7 @@ import { classifyNetworkRequestFailure, isApiLikeNetworkRequest, isNetworkArtifa
 import { withOptionalSessionArgs } from "../next-actions.js";
 import { stringifyUnknown, truncateText } from "../text.js";
 import { firstLine, formatCount, getArrayField, getStringField, parseJsonPreviewString, redactModelFacingText, redactModelFacingTextIfSensitive, stringifyModelFacing, } from "./common.js";
+import { filterCallerOwnedSessionListItems, filterCallerOwnedStateListItems, filterManagedSessionListRows, filterManagedStateListRows, } from "./managed-list-filter.js";
 const DIAGNOSTIC_REQUEST_PREVIEW_LIMIT = 40;
 const DIAGNOSTIC_LOG_PREVIEW_LIMIT = 80;
 const NETWORK_BODY_PREVIEW_MAX_CHARS = 280;
@@ -114,7 +115,7 @@ export function formatDiagnosticSummary(commandInfo, data) {
     if (commandInfo.command === "session") {
         const sessions = getArrayField(data, "sessions");
         if (sessions)
-            return `Sessions: ${sessions.length}`;
+            return `Sessions: ${filterCallerOwnedSessionListItems(sessions).length}`;
         const session = getStringField(data, "session");
         if (session)
             return `Session: ${session}`;
@@ -172,11 +173,13 @@ export function formatDiagnosticSummary(commandInfo, data) {
     }
     if (commandInfo.command === "state") {
         const states = getArrayField(data, "states") ?? getArrayField(data, "files");
-        if (states)
-            return `States: ${states.length}`;
+        if (states) {
+            const visibleStates = commandInfo.subcommand === "list" ? filterCallerOwnedStateListItems(states) : states;
+            return `States: ${visibleStates.length}`;
+        }
         if (commandInfo.subcommand === "load")
             return undefined;
-        const stateName = getStringField(data, "name") ?? getStringField(data, "file") ?? getStringField(data, "path") ?? commandInfo.subcommand;
+        const stateName = getStringField(data, "name") ?? getStringField(data, "file") ?? getStringField(data, "filename") ?? getStringField(data, "path") ?? commandInfo.subcommand;
         if (stateName)
             return `State ${commandInfo.subcommand ?? "result"}: ${stateName}`;
     }
@@ -261,9 +264,10 @@ export function formatDiagnosticSummary(commandInfo, data) {
 function formatSessionText(data) {
     const sessions = getArrayField(data, "sessions");
     if (sessions) {
-        if (sessions.length === 0)
-            return "No active sessions.";
-        return sessions
+        const visibleSessions = filterCallerOwnedSessionListItems(sessions);
+        if (visibleSessions.length === 0)
+            return sessions.length === 0 ? "No active sessions." : "No caller-owned active sessions.";
+        return visibleSessions
             .map((item, index) => {
             if (!isRecord(item))
                 return `${index + 1}. ${stringifyModelFacing(item)}`;
@@ -912,12 +916,25 @@ function formatFrameText(data) {
     const lines = [frame ? `Frame: ${redactModelFacingText(frame)}` : undefined, title ? `Title: ${redactModelFacingText(title)}` : undefined, url ? `URL: ${redactModelFacingTextIfSensitive(url)}` : undefined].filter(Boolean);
     return lines.length > 0 ? lines.join("\n") : undefined;
 }
-function formatStateText(data) {
+function formatStateText(data, subcommand) {
+    if (subcommand === "show") {
+        const filename = getStringField(data, "filename") ?? getStringField(data, "name") ?? "saved state";
+        const summary = getStringField(data, "summary");
+        const lines = [`Saved state: ${redactModelFacingText(filename)}`];
+        if (summary)
+            lines.push(`Summary: ${redactModelFacingText(summary)}`);
+        if (typeof data.encrypted === "boolean")
+            lines.push(`Encrypted: ${data.encrypted ? "yes" : "no"}`);
+        if (typeof data.size === "number")
+            lines.push(`Size: ${data.size} bytes`);
+        return lines.join("\n");
+    }
     const states = getArrayField(data, "states") ?? getArrayField(data, "files");
     if (states) {
-        if (states.length === 0)
-            return "No saved states.";
-        return states
+        const visibleStates = filterCallerOwnedStateListItems(states);
+        if (visibleStates.length === 0)
+            return "No caller-owned saved states.";
+        return visibleStates
             .map((item, index) => {
             if (!isRecord(item))
                 return `${index + 1}. ${redactModelFacingTextIfSensitive(stringifyModelFacing(item))}`;
@@ -960,6 +977,12 @@ export function redactPresentationData(commandInfo, data) {
         return redactStatefulValues(data, new Set(["value"]));
     if (commandInfo.command === "storage")
         return redactStorageData(data);
+    if (commandInfo.command === "session" && commandInfo.subcommand === "list")
+        return redactStructuredPresentationValue(filterManagedSessionListRows(data));
+    if (commandInfo.command === "state" && commandInfo.subcommand === "list")
+        return redactStructuredPresentationValue(filterManagedStateListRows(data));
+    if (commandInfo.command === "state" && commandInfo.subcommand === "show")
+        return redactStatefulValues(data, new Set(["value"]));
     return redactStructuredPresentationValue(data);
 }
 export function formatDiagnosticText(commandInfo, data) {
@@ -986,7 +1009,7 @@ export function formatDiagnosticText(commandInfo, data) {
     if (commandInfo.command === "frame")
         return formatFrameText(data);
     if (commandInfo.command === "state")
-        return formatStateText(data);
+        return formatStateText(data, commandInfo.subcommand);
     if (commandInfo.command === "network" && commandInfo.subcommand === "requests")
         return formatNetworkRequestsText(data, commandInfo);
     if (commandInfo.command === "network" && commandInfo.subcommand === "request")

package/dist/extensions/agent-browser/lib/results/presentation/managed-list-filter.js

@@ -0,0 +1,42 @@
+/**
+ * Purpose: Remove wrapper-owned managed session and state capabilities from caller-visible list results.
+ * Responsibilities: Recognize managed list rows recursively and preserve the surrounding upstream result shape.
+ * Scope: Presentation filtering only; command authorization lives in managed-session-state-policy.ts.
+ */
+import { containsManagedSessionRestoreKey, isWrapperManagedSessionName } from "../../managed-session-capabilities.js";
+import { isRecord } from "../../parsing.js";
+function isWrapperManagedSessionListItem(item) {
+    if (typeof item === "string")
+        return isWrapperManagedSessionName(item);
+    if (!isRecord(item))
+        return false;
+    return ["name", "session", "id"].some((key) => isWrapperManagedSessionName(typeof item[key] === "string" ? item[key] : undefined));
+}
+function containsManagedStateCapability(value) {
+    if (typeof value === "string")
+        return containsManagedSessionRestoreKey(value);
+    if (Array.isArray(value))
+        return value.some(containsManagedStateCapability);
+    return isRecord(value) && Object.values(value).some(containsManagedStateCapability);
+}
+export function filterCallerOwnedSessionListItems(items) {
+    return items.filter((item) => !isWrapperManagedSessionListItem(item));
+}
+export function filterCallerOwnedStateListItems(items) {
+    return items.filter((item) => !containsManagedStateCapability(item));
+}
+export function filterManagedSessionListRows(data) {
+    if (!isRecord(data) || !Array.isArray(data.sessions))
+        return data;
+    return { ...data, sessions: filterCallerOwnedSessionListItems(data.sessions) };
+}
+export function filterManagedStateListRows(data) {
+    if (!isRecord(data))
+        return data;
+    return Object.fromEntries(Object.entries(data).map(([key, value]) => [
+        key,
+        (key === "states" || key === "files") && Array.isArray(value)
+            ? filterCallerOwnedStateListItems(value)
+            : value,
+    ]));
+}

package/dist/extensions/agent-browser/lib/results/recovery-actions.js

@@ -8,6 +8,7 @@
 import { buildNextToolAction, withOptionalSessionArgs } from "./next-actions.js";
 export const AGENT_BROWSER_RECOVERY_NEXT_ACTION_IDS = {
     aboutBlankListTabs: "list-tabs-for-about-blank-recovery",
+    connectedSessionGetUrl: "verify-connected-session-url",
     connectedSessionListTabs: "list-connected-session-tabs",
     genericTabDriftListTabs: "list-tabs-for-recovery",
     noActivePageListTabs: "list-tabs-after-no-active-page",
@@ -60,6 +61,12 @@ export function buildRecoveryNextActions(recovery) {
     const sessionArgs = (args) => withOptionalSessionArgs(recovery.sessionName, args);
     if (recovery.kind === "connected-session") {
         return [
+            buildNextToolAction({
+                args: sessionArgs(["get", "url"]),
+                id: AGENT_BROWSER_RECOVERY_NEXT_ACTION_IDS.connectedSessionGetUrl,
+                reason: "Verify the attached page URL before any page-content inspection.",
+                safety: "Read-only URL lookup. The wrapper keeps page inspection blocked if the active target is a local file page or the URL cannot be verified.",
+            }),
             buildNextToolAction({
                 args: sessionArgs(["tab", "list"]),
                 id: AGENT_BROWSER_RECOVERY_NEXT_ACTION_IDS.connectedSessionListTabs,