pi-agent-browser-native 0.3.0 → 0.6.5

package/dist/extensions/agent-browser/lib/orchestration/script-mode.js

@@ -0,0 +1,299 @@
+import { open } from "node:fs/promises";
+import { AGENT_BROWSER_SCRIPT_FINAL_OUTPUT_MAX_BYTES, AGENT_BROWSER_SCRIPT_IPC_MESSAGE_MAX_BYTES, AGENT_BROWSER_SCRIPT_SPILL_MAX_BYTES, createAgentBrowserScriptCloseArgs, isAgentBrowserScriptSessionName, validateAgentBrowserScriptBrowserParams, } from "../input-modes/script.js";
+import { isRecord } from "../parsing.js";
+import { parseCommandInfo, redactSensitiveText } from "../runtime.js";
+import { isSessionArtifactManifest } from "../results/artifact-manifest.js";
+import { redactPresentationData } from "../results/presentation/diagnostics.js";
+import { truncateText } from "../results/text.js";
+const SCRIPT_SESSION_ENTRY_TYPE = "agent-browser-script-session";
+const SCRIPT_BROWSER_SUMMARY_MAX_CHARS = 1_024;
+const SCRIPT_BROWSER_TEXT_MAX_CHARS = 8_192;
+export function getScriptSessionLeasesFromBranch(branch) {
+    const leases = new Map();
+    for (const entry of branch) {
+        if (!isRecord(entry) || entry.type !== "custom" || entry.customType !== SCRIPT_SESSION_ENTRY_TYPE || !isRecord(entry.data))
+            continue;
+        const { cleanup, closeCommandArgs, launchAttempted, sessionName } = entry.data;
+        if (!isAgentBrowserScriptSessionName(sessionName))
+            continue;
+        const expectedCloseCommandArgs = createAgentBrowserScriptCloseArgs(sessionName);
+        if ((cleanup !== "active" && cleanup !== "closed" && cleanup !== "failed")
+            || launchAttempted !== true
+            || !Array.isArray(closeCommandArgs)
+            || closeCommandArgs.length !== expectedCloseCommandArgs.length
+            || !closeCommandArgs.every((token, index) => token === expectedCloseCommandArgs[index]))
+            continue;
+        leases.set(sessionName, { cleanup, closeCommandArgs: expectedCloseCommandArgs, launchAttempted: true, sessionName });
+    }
+    return leases;
+}
+export function appendScriptSessionLease(pi, sessionName, cleanup) {
+    pi.appendEntry(SCRIPT_SESSION_ENTRY_TYPE, {
+        cleanup,
+        closeCommandArgs: createAgentBrowserScriptCloseArgs(sessionName),
+        launchAttempted: true,
+        sessionName,
+    });
+}
+async function readVerifiedScriptSpill(result) {
+    const details = isRecord(result.details) ? result.details : undefined;
+    const path = typeof details?.fullOutputPath === "string" ? details.fullOutputPath : undefined;
+    const manifest = isSessionArtifactManifest(details?.artifactManifest) ? details.artifactManifest : undefined;
+    if (!path || !manifest?.entries.some((entry) => entry.kind === "spill"
+        && (entry.path === path || entry.absolutePath === path)
+        && (entry.storageScope === "persistent-session" || entry.storageScope === "process-temp")
+        && (entry.retentionState === "live" || entry.retentionState === "ephemeral")))
+        return undefined;
+    let handle;
+    try {
+        handle = await open(path, "r");
+        const stats = await handle.stat();
+        if (!stats.isFile() || stats.size < 0 || stats.size > AGENT_BROWSER_SCRIPT_SPILL_MAX_BYTES)
+            return undefined;
+        const buffer = Buffer.alloc(stats.size);
+        let offset = 0;
+        while (offset < buffer.length) {
+            const { bytesRead } = await handle.read(buffer, offset, buffer.length - offset, offset);
+            if (bytesRead === 0)
+                break;
+            offset += bytesRead;
+        }
+        const text = buffer.subarray(0, offset).toString("utf8");
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
+}
+function getToolResultText(result) {
+    return result.content
+        .filter((item) => item.type === "text")
+        .map((item) => item.text)
+        .join("\n\n");
+}
+function stripOwnedScriptSessionArgs(args, sessionName) {
+    if (!isAgentBrowserScriptSessionName(sessionName))
+        return args;
+    if (args[0] === "--namespace" && args[1] === "" && args[2] === "--session" && args[3] === sessionName)
+        return args.slice(4);
+    return args[0] === "--session" && args[1] === sessionName ? args.slice(2) : args;
+}
+function getScriptCompatibleNextActions(value, sessionName) {
+    if (!Array.isArray(value))
+        return undefined;
+    const actions = value.flatMap((action) => {
+        if (!isRecord(action))
+            return [];
+        if (!isRecord(action.params))
+            return typeof action.artifactPath === "string" ? [action] : [];
+        if (Object.keys(action.params).some((key) => key !== "args" && key !== "stdin"))
+            return [];
+        if (!Array.isArray(action.params.args) || action.params.args.some((token) => typeof token !== "string"))
+            return [];
+        if (action.params.stdin !== undefined && typeof action.params.stdin !== "string")
+            return [];
+        const normalizedParams = {
+            args: stripOwnedScriptSessionArgs(action.params.args, sessionName),
+            ...(typeof action.params.stdin === "string" ? { stdin: action.params.stdin } : {}),
+        };
+        if (!validateAgentBrowserScriptBrowserParams(normalizedParams).params)
+            return [];
+        return [{ ...action, params: normalizedParams }];
+    });
+    return actions.length > 0 ? actions : undefined;
+}
+function scriptBrowserEnvelopeFitsIpc(envelope) {
+    try {
+        return Buffer.byteLength(JSON.stringify({ envelope, id: Number.MAX_SAFE_INTEGER, type: "response" }), "utf8") + 1 <= AGENT_BROWSER_SCRIPT_IPC_MESSAGE_MAX_BYTES;
+    }
+    catch {
+        return false;
+    }
+}
+function buildOversizedScriptBrowserEnvelope() {
+    const text = "Browser result exceeds the script IPC response limit; narrow the inner browser call output.";
+    return {
+        data: null,
+        details: { failureCategory: "upstream-error", resultCategory: "failure" },
+        error: text,
+        failureCategory: "upstream-error",
+        ok: false,
+        resultCategory: "failure",
+        summary: text,
+        text,
+    };
+}
+export async function buildScriptBrowserEnvelope(result, args, scriptSessionName) {
+    const details = isRecord(result.details) ? result.details : undefined;
+    const fullData = await readVerifiedScriptSpill(result);
+    const commandInfo = parseCommandInfo(args);
+    const data = redactPresentationData(commandInfo, fullData ?? details?.data ?? null);
+    const resultCategory = details?.resultCategory === "failure" || result.isError === true ? "failure" : "success";
+    const text = truncateText(redactSensitiveText(getToolResultText(result)), SCRIPT_BROWSER_TEXT_MAX_CHARS);
+    const summary = truncateText(redactSensitiveText(typeof details?.summary === "string" ? details.summary : text.split("\n", 1)[0] || "Browser call completed."), SCRIPT_BROWSER_SUMMARY_MAX_CHARS);
+    const compatibleNextActions = getScriptCompatibleNextActions(details?.nextActions, scriptSessionName);
+    const redactedNextActions = getScriptCompatibleNextActions(redactPresentationData(commandInfo, compatibleNextActions), undefined);
+    const failureCategory = resultCategory === "failure" && typeof details?.failureCategory === "string"
+        ? details.failureCategory
+        : undefined;
+    const successCategory = resultCategory === "success" && typeof details?.successCategory === "string"
+        ? details.successCategory
+        : undefined;
+    const envelopeDetails = redactPresentationData(commandInfo, {
+        artifactVerification: details?.artifactVerification,
+        artifacts: details?.artifacts,
+        failureCategory,
+        pageChangeSummary: details?.pageChangeSummary,
+        resultCategory,
+        successCategory,
+    });
+    const envelope = {
+        data,
+        details: isRecord(envelopeDetails) ? envelopeDetails : { resultCategory },
+        error: resultCategory === "failure" ? summary : undefined,
+        failureCategory,
+        nextActions: Array.isArray(redactedNextActions) ? redactedNextActions : undefined,
+        ok: resultCategory === "success",
+        resultCategory,
+        successCategory,
+        summary,
+        text,
+    };
+    return scriptBrowserEnvelopeFitsIpc(envelope) ? envelope : buildOversizedScriptBrowserEnvelope();
+}
+function collectUniqueArtifacts(results) {
+    const records = results.flatMap((result) => {
+        const details = isRecord(result.details) ? result.details : undefined;
+        return Array.isArray(details?.artifacts) ? details.artifacts.filter(isRecord) : [];
+    });
+    const unique = new Map(records.map((record) => [String(record.absolutePath ?? record.path ?? JSON.stringify(record)), record]));
+    return unique.size > 0 ? [...unique.values()] : undefined;
+}
+function collectScriptArtifactVerification(results) {
+    const entries = results.flatMap((result) => {
+        const details = isRecord(result.details) ? result.details : undefined;
+        const verification = isRecord(details?.artifactVerification) ? details.artifactVerification : undefined;
+        return Array.isArray(verification?.artifacts) ? verification.artifacts.filter(isRecord) : [];
+    });
+    const unique = [...new Map(entries.map((entry) => [String(entry.absolutePath ?? entry.path ?? JSON.stringify(entry)), entry])).values()];
+    if (unique.length === 0)
+        return undefined;
+    const count = (state) => unique.filter((entry) => entry.state === state).length;
+    return {
+        artifacts: unique,
+        missingCount: count("missing"),
+        pendingCount: count("pending"),
+        unverifiedCount: count("unverified"),
+        verified: unique.every((entry) => entry.state === "verified"),
+        verifiedCount: count("verified"),
+    };
+}
+function getLatestScriptResultDetail(results, key) {
+    for (let index = results.length - 1; index >= 0; index -= 1) {
+        const rawDetails = results[index]?.details;
+        const details = isRecord(rawDetails) ? rawDetails : undefined;
+        if (details?.[key] !== undefined)
+            return details[key];
+    }
+    return undefined;
+}
+function buildScriptCloseNextAction(sessionName) {
+    return {
+        id: "close-script-session-after-cleanup-failure",
+        params: { args: createAgentBrowserScriptCloseArgs(sessionName) },
+        reason: "Retry closing the isolated wrapper-owned script session after automatic cleanup failed.",
+        safety: "Use these exact args; do not add profile, state, restore, namespace, or connection flags.",
+        tool: "agent_browser",
+    };
+}
+export function buildScriptToolResult(options) {
+    let data;
+    let serializedData;
+    let outputError;
+    try {
+        data = redactPresentationData({ command: "script" }, options.run.data);
+        serializedData = data === undefined ? undefined : JSON.stringify(data);
+        if (data !== undefined && serializedData === undefined)
+            throw new TypeError("Script output is not JSON-serializable.");
+        if (serializedData !== undefined && Buffer.byteLength(serializedData, "utf8") > AGENT_BROWSER_SCRIPT_FINAL_OUTPUT_MAX_BYTES) {
+            throw new RangeError(`Redacted script output exceeds ${AGENT_BROWSER_SCRIPT_FINAL_OUTPUT_MAX_BYTES} bytes.`);
+        }
+    }
+    catch {
+        data = undefined;
+        serializedData = undefined;
+        outputError = "Final script output could not be safely rendered as bounded JSON.";
+    }
+    const steps = options.run.steps.map((step) => ({ ...step, summary: redactSensitiveText(step.summary) }));
+    const rejectedFailureCategory = steps.find((step) => step.failureCategory === "policy-blocked")?.failureCategory
+        ?? (options.run.rejectedCallCount > 0 ? "validation-error" : undefined);
+    const failureCategory = options.cleanupError
+        ? "cleanup-failed"
+        : outputError ? "validation-error" : options.run.failureCategory ?? rejectedFailureCategory;
+    const failed = failureCategory !== undefined || !options.run.ok;
+    const failedStepCount = steps.filter((step) => !step.ok).length;
+    const failedCallCount = Math.max(0, failedStepCount - options.run.rejectedCallCount);
+    const successfulCallCount = steps.filter((step) => step.ok).length;
+    const cleanupSuffix = options.sessionName && !options.cleanupError ? " Isolated script session closed." : "";
+    const summary = `${options.cleanupError
+        ? `Script completed, but isolated session cleanup failed: ${redactSensitiveText(options.cleanupError)}`
+        : outputError
+            ? `Script failed: ${outputError}`
+            : options.run.ok
+                ? rejectedFailureCategory
+                    ? `Script failed: ${options.run.rejectedCallCount} browser call${options.run.rejectedCallCount === 1 ? " was" : "s were"} rejected before dispatch.`
+                    : failedCallCount > 0
+                        ? `Script completed (${options.run.callCount} browser call${options.run.callCount === 1 ? "" : "s"}; ${failedCallCount} returned failure for script handling).`
+                        : `Script completed (${options.run.callCount} browser call${options.run.callCount === 1 ? "" : "s"}).`
+                : `Script failed: ${redactSensitiveText(options.run.error ?? "sandbox execution failed")}`}${cleanupSuffix}`;
+    const dataText = serializedData === undefined ? "" : `\n\n${serializedData}`;
+    const cleanupActionText = options.cleanupError && options.sessionName
+        ? `\n\nNext action: ${JSON.stringify({ args: createAgentBrowserScriptCloseArgs(options.sessionName) })}`
+        : "";
+    const artifactManifest = getLatestScriptResultDetail(options.innerResults, "artifactManifest");
+    const artifactRetentionSummary = getLatestScriptResultDetail(options.innerResults, "artifactRetentionSummary");
+    const artifacts = collectUniqueArtifacts(options.innerResults);
+    const artifactVerification = collectScriptArtifactVerification(options.innerResults);
+    const nextActions = options.cleanupError && options.sessionName ? [buildScriptCloseNextAction(options.sessionName)] : undefined;
+    return {
+        content: [{ type: "text", text: `${summary}${dataText}${cleanupActionText}` }],
+        details: {
+            artifactManifest,
+            artifactRetentionSummary,
+            artifacts,
+            artifactVerification,
+            data,
+            failureCategory,
+            nextActions,
+            resultCategory: failed ? "failure" : "success",
+            scriptRun: {
+                aborted: options.run.aborted,
+                callCount: options.run.callCount,
+                emitCount: options.run.emitCount,
+                failedCallCount,
+                preDispatchRejectedCallCount: options.run.rejectedCallCount,
+                successfulCallCount,
+                timedOut: options.run.timedOut,
+            },
+            scriptSession: options.sessionName ? {
+                cleanup: options.cleanupError ? "failed" : "closed",
+                closeCommandArgs: createAgentBrowserScriptCloseArgs(options.sessionName),
+                ...(options.cleanupError ? { error: redactSensitiveText(options.cleanupError) } : {}),
+                launchAttempted: true,
+                sessionName: options.sessionName,
+            } : undefined,
+            scriptSteps: steps,
+            successCategory: failed ? undefined : "completed",
+            summary,
+        },
+        isError: failed,
+    };
+}

package/dist/extensions/agent-browser/lib/page-target-validation.js

@@ -0,0 +1,270 @@
+import { parseArgvDescriptor } from "./argv-descriptor.js";
+import { GLOBAL_BOOLEAN_FLAGS_WITH_OPTIONAL_VALUES, VALUE_FLAGS, } from "./argv-grammar.js";
+import { needsManagedSession } from "./command-policy.js";
+import { isUnverifiedPageTransitionCommand } from "./command-taxonomy.js";
+import { parseBatchCommandArgument, parseUserBatchStdin } from "./orchestration/batch-stdin.js";
+const UNVERIFIED_PAGE_MESSAGE = "The active page became unverified after a tab, attachment, history, script, or state-load transition. Run get url or navigate explicitly before page-content inspection.";
+const BATCH_UNVERIFIED_PAGE_MESSAGE = `${UNVERIFIED_PAGE_MESSAGE} In a batch, put get url after the transition before later content steps, or split the batch at that boundary.`;
+const UNSAFE_BATCH_ARGUMENT_MESSAGE = "Batch command arguments could not be inspected. Use batch stdin JSON command arrays instead.";
+const NESTED_BATCH_ARGUMENT_MESSAGE = "Nested batch commands are not supported. Flatten the batch steps instead.";
+const NON_BAIL_BATCH_NAVIGATION_MESSAGE = "Batches that change or re-verify the page target before page-content access must use exact batch --bail so a failed step cannot act on an unverified or prior page.";
+const MAX_NON_BAIL_BATCH_PAGE_STATES = 64;
+const EXPLICIT_NAVIGATION_COMMANDS = new Set(["a11y", "goto", "navigate", "open", "pushstate", "visit", "vitals", "web-vitals"]);
+const POSITIONAL_VALUE_FLAGS = new Set([...VALUE_FLAGS, "--llms"]);
+function getPositionalOperands(commandTokens) {
+    const values = [];
+    for (let index = 1; index < commandTokens.length; index += 1) {
+        const token = commandTokens[index];
+        if (!token || (token.includes("=") && token.startsWith("-")))
+            continue;
+        if (POSITIONAL_VALUE_FLAGS.has(token)) {
+            index += 1;
+            continue;
+        }
+        if (GLOBAL_BOOLEAN_FLAGS_WITH_OPTIONAL_VALUES.has(token)) {
+            if (["true", "false"].includes(commandTokens[index + 1] ?? ""))
+                index += 1;
+            continue;
+        }
+        if (!token.startsWith("-") || token.includes("/") || token.includes("\\"))
+            values.push(token);
+    }
+    return values;
+}
+function getExplicitNavigationTarget(args) {
+    const descriptor = parseArgvDescriptor(args);
+    const positionals = getPositionalOperands(descriptor.upstreamCommandTokens);
+    if (EXPLICIT_NAVIGATION_COMMANDS.has(descriptor.commandInfo.command ?? ""))
+        return positionals[0];
+    if (descriptor.commandInfo.command === "tab" && descriptor.commandInfo.subcommand === "new")
+        return positionals[1];
+    return undefined;
+}
+function getResultingExplicitNavigationTarget(args, currentPageUrl) {
+    const target = getExplicitNavigationTarget(args);
+    if (target === undefined)
+        return undefined;
+    if (parseArgvDescriptor(args).commandInfo.command !== "pushstate")
+        return target;
+    try {
+        return new URL(target).href;
+    }
+    catch {
+        if (!currentPageUrl)
+            return undefined;
+        try {
+            return new URL(target, currentPageUrl).href;
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+function getBatchCommandSteps(args, stdin) {
+    const descriptor = parseArgvDescriptor(args);
+    if (descriptor.commandInfo.command !== "batch")
+        return { steps: [] };
+    const argumentCommands = descriptor.upstreamCommandTokens.slice(1).filter((command) => command !== "--bail");
+    const steps = [];
+    if (argumentCommands.length > 0) {
+        for (const command of argumentCommands) {
+            const parsed = parseBatchCommandArgument(command);
+            if (parsed.error || parsed.step === undefined)
+                return { error: parsed.error ?? UNSAFE_BATCH_ARGUMENT_MESSAGE, steps: [] };
+            if (parseArgvDescriptor(parsed.step).commandInfo.command === "batch")
+                return { error: NESTED_BATCH_ARGUMENT_MESSAGE, steps: [] };
+            steps.push(parsed.step);
+        }
+        return { steps };
+    }
+    const parsedStdin = parseUserBatchStdin(stdin);
+    if (parsedStdin.error)
+        return { error: parsedStdin.error, steps: [] };
+    for (const step of parsedStdin.steps ?? []) {
+        if (parseArgvDescriptor(step).commandInfo.command === "batch")
+            return { error: NESTED_BATCH_ARGUMENT_MESSAGE, steps: [] };
+        steps.push(step);
+    }
+    return { steps };
+}
+function batchBailsOnFirstError(args) {
+    const descriptor = parseArgvDescriptor(args);
+    return descriptor.commandInfo.command === "batch" && descriptor.upstreamCommandTokens.slice(1).includes("--bail");
+}
+function commandMayChangePageTarget(args, trustedBatchTabSelection) {
+    const descriptor = parseArgvDescriptor(args);
+    return getExplicitNavigationTarget(args) !== undefined
+        || (isUnverifiedPageTransitionCommand(descriptor.commandInfo.command, descriptor.commandInfo.subcommand)
+            && !(trustedBatchTabSelection && descriptor.commandInfo.command === "tab"));
+}
+function commandVerifiesPageTarget(args) {
+    const { command, subcommand } = parseArgvDescriptor(args).commandInfo;
+    return command === "get" && subcommand === "url";
+}
+function deduplicatePossibleBatchPageStates(states) {
+    const deduplicated = new Map();
+    for (const state of states) {
+        const key = `${state.pageUrlUnknown ? "unknown" : "known"}\0${state.currentPageUrl ?? ""}`;
+        const existing = deduplicated.get(key);
+        if (!existing)
+            deduplicated.set(key, state);
+        else
+            existing.retainedAfterFailedNavigation ||= state.retainedAfterFailedNavigation;
+    }
+    return [...deduplicated.values()];
+}
+export function commandRequiresLivePageVerification(args, stdin) {
+    const descriptor = parseArgvDescriptor(args);
+    if (descriptor.commandInfo.command === "eval")
+        return true;
+    if (descriptor.commandInfo.command !== "batch")
+        return false;
+    const batch = getBatchCommandSteps(args, stdin);
+    return batch.error === undefined && batch.steps.some((step) => commandRequiresLivePageVerification(step));
+}
+function getResultingPageState(options) {
+    const descriptor = parseArgvDescriptor(options.args);
+    if (descriptor.commandInfo.command === "get" && descriptor.commandInfo.subcommand === "url") {
+        return { currentPageUrl: options.currentPageUrl, pageUrlUnknown: false };
+    }
+    const rawExplicitTarget = getExplicitNavigationTarget(options.args);
+    const explicitTarget = getResultingExplicitNavigationTarget(options.args, options.currentPageUrl);
+    if (explicitTarget !== undefined)
+        return { currentPageUrl: explicitTarget, pageUrlUnknown: false };
+    if (rawExplicitTarget !== undefined)
+        return { pageUrlUnknown: true };
+    if (isUnverifiedPageTransitionCommand(descriptor.commandInfo.command, descriptor.commandInfo.subcommand)) {
+        return options.trustedBatchTabSelection && descriptor.commandInfo.command === "tab"
+            ? { currentPageUrl: options.currentPageUrl, pageUrlUnknown: options.pageUrlUnknown }
+            : { pageUrlUnknown: true };
+    }
+    return { currentPageUrl: options.currentPageUrl, pageUrlUnknown: options.pageUrlUnknown };
+}
+export function getResultingPageTargetState(options) {
+    const descriptor = parseArgvDescriptor(options.args);
+    let state = { currentPageUrl: options.currentPageUrl, pageUrlUnknown: options.pageUrlUnknown ?? false };
+    let pageTargetMayHaveChanged = false;
+    if (descriptor.commandInfo.command !== "batch") {
+        pageTargetMayHaveChanged = getExplicitNavigationTarget(options.args) !== undefined
+            || isUnverifiedPageTransitionCommand(descriptor.commandInfo.command, descriptor.commandInfo.subcommand);
+        return { ...getResultingPageState({ ...state, args: options.args, trustedBatchTabSelection: false }), pageTargetMayHaveChanged };
+    }
+    const batch = getBatchCommandSteps(options.args, options.stdin);
+    if (batch.error)
+        return { pageTargetMayHaveChanged: true, pageUrlUnknown: true };
+    for (let index = 0; index < batch.steps.length; index += 1) {
+        const step = batch.steps[index];
+        const trustedBatchTabSelection = options.trustedFirstBatchTabSelection === true && index === 0;
+        const stepDescriptor = parseArgvDescriptor(step);
+        pageTargetMayHaveChanged ||= getExplicitNavigationTarget(step) !== undefined
+            || (isUnverifiedPageTransitionCommand(stepDescriptor.commandInfo.command, stepDescriptor.commandInfo.subcommand)
+                && !(trustedBatchTabSelection && stepDescriptor.commandInfo.command === "tab"));
+        state = getResultingPageState({ ...state, args: step, trustedBatchTabSelection });
+    }
+    return { ...state, pageTargetMayHaveChanged };
+}
+function isRecoveringPageTransitionCommand(command, subcommand) {
+    return command !== "eval"
+        && !(command === "webmcp" && subcommand === "invoke")
+        && isUnverifiedPageTransitionCommand(command, subcommand);
+}
+function getUnverifiedPageError(options) {
+    if (!options.pageUrlUnknown)
+        return undefined;
+    const { command, subcommand } = parseArgvDescriptor(options.args).commandInfo;
+    const closesPage = ["close", "exit", "quit"].includes(command ?? "") || (command === "tab" && subcommand === "close");
+    const inspectsTarget = (command === "tab" && subcommand === "list") || (command === "get" && subcommand === "url");
+    const selectsTab = command === "tab" && subcommand !== undefined && !["close", "list", "new"].includes(subcommand);
+    const settlesPendingWebMcp = command === "webmcp" && ["result", "cancel"].includes(subcommand ?? "");
+    const handlesBlockingDialog = command === "dialog" && ["status", "accept", "dismiss"].includes(subcommand ?? "");
+    const transitionsPage = options.allowUnverifiedPageTransitions === true && isRecoveringPageTransitionCommand(command, subcommand);
+    const navigatesExplicitly = getExplicitNavigationTarget(options.args) !== undefined;
+    return closesPage || handlesBlockingDialog || inspectsTarget || selectsTab || settlesPendingWebMcp || transitionsPage || navigatesExplicitly || (options.trustedBatchTabSelection && command === "tab")
+        ? undefined
+        : UNVERIFIED_PAGE_MESSAGE;
+}
+export function getPageTargetValidationError(options) {
+    const descriptor = parseArgvDescriptor(options.args);
+    const command = descriptor.commandInfo.command;
+    if (["close", "exit", "quit"].includes(command ?? ""))
+        return undefined;
+    if (command === "batch") {
+        const batch = getBatchCommandSteps(options.args, options.stdin);
+        if (batch.error)
+            return batch.error.startsWith("agent_browser batch stdin") || batch.error === NESTED_BATCH_ARGUMENT_MESSAGE
+                ? batch.error
+                : UNSAFE_BATCH_ARGUMENT_MESSAGE;
+        const bailOnFirstError = batchBailsOnFirstError(options.args);
+        let possibleStates = [{
+                currentPageUrl: options.currentPageUrl,
+                pageUrlUnknown: options.pageUrlUnknown ?? false,
+                retainedAfterFailedNavigation: false,
+            }];
+        for (let index = 0; index < batch.steps.length; index += 1) {
+            const step = batch.steps[index];
+            const trustedBatchTabSelection = options.trustedFirstBatchTabSelection === true && index === 0;
+            let directError;
+            let failedNavigationHazard = false;
+            for (const state of possibleStates) {
+                const error = getUnverifiedPageError({
+                    allowUnverifiedPageTransitions: options.allowUnverifiedPageTransitions,
+                    args: step,
+                    pageUrlUnknown: state.pageUrlUnknown,
+                    trustedBatchTabSelection,
+                });
+                if (!error)
+                    continue;
+                if (state.retainedAfterFailedNavigation)
+                    failedNavigationHazard = true;
+                else
+                    directError ??= error;
+            }
+            if (directError)
+                return BATCH_UNVERIFIED_PAGE_MESSAGE;
+            if (failedNavigationHazard)
+                return NON_BAIL_BATCH_NAVIGATION_MESSAGE;
+            const mayChangePageTarget = commandMayChangePageTarget(step, trustedBatchTabSelection);
+            const verifiesPageTarget = commandVerifiesPageTarget(step);
+            const nextStates = [];
+            for (const state of possibleStates) {
+                const successState = getResultingPageState({
+                    args: step,
+                    currentPageUrl: state.currentPageUrl,
+                    pageUrlUnknown: state.pageUrlUnknown,
+                    trustedBatchTabSelection,
+                });
+                if (nextStates.length >= MAX_NON_BAIL_BATCH_PAGE_STATES)
+                    return NON_BAIL_BATCH_NAVIGATION_MESSAGE;
+                nextStates.push({ ...successState, retainedAfterFailedNavigation: mayChangePageTarget || verifiesPageTarget ? false : state.retainedAfterFailedNavigation });
+                if (!bailOnFirstError && (mayChangePageTarget || (verifiesPageTarget && state.pageUrlUnknown))) {
+                    nextStates.push({ ...state, retainedAfterFailedNavigation: true });
+                }
+            }
+            possibleStates = deduplicatePossibleBatchPageStates(nextStates);
+        }
+        return undefined;
+    }
+    return getUnverifiedPageError({
+        allowUnverifiedPageTransitions: options.allowUnverifiedPageTransitions,
+        args: options.args,
+        pageUrlUnknown: options.pageUrlUnknown,
+        trustedBatchTabSelection: options.trustedFirstBatchTabSelection,
+    });
+}
+export function getExplicitSessionPageVerificationRequirement(options) {
+    const descriptor = parseArgvDescriptor(options.args);
+    if (!needsManagedSession(descriptor))
+        return undefined;
+    if (isRecoveringPageTransitionCommand(descriptor.commandInfo.command, descriptor.commandInfo.subcommand))
+        return undefined;
+    const validationError = getPageTargetValidationError({
+        args: options.args,
+        pageUrlUnknown: true,
+        stdin: options.stdin,
+        allowUnverifiedPageTransitions: true,
+        trustedFirstBatchTabSelection: options.trustedFirstBatchTabSelection,
+    });
+    return validationError === UNVERIFIED_PAGE_MESSAGE || validationError === BATCH_UNVERIFIED_PAGE_MESSAGE || validationError === NON_BAIL_BATCH_NAVIGATION_MESSAGE
+        ? UNVERIFIED_PAGE_MESSAGE
+        : undefined;
+}

package/dist/extensions/agent-browser/lib/pi-tool-rendering.js

@@ -7,14 +7,20 @@ import { isRecord } from "./parsing.js";
 import { redactInvocationArgs } from "./runtime.js";
 const TUI_INVOCATION_PREVIEW_MAX_CHARS = 160;
 const TUI_COLLAPSED_OUTPUT_MAX_LINES = 12;
-const ANSI_CONTROL_SEQUENCE_PATTERN = /\x1B(?:\][^\x07\x1B]*(?:\x07|\x1B\\)|\[[0-?]*[ -/]*[@-~]|P[^\x1B]*(?:\x1B\\)|_[^\x1B]*(?:\x1B\\)|\^[^\x1B]*(?:\x1B\\)|[@-Z\\-_])/g;
+const ANSI_CONTROL_SEQUENCE_PATTERN = /\x1B(?:\][^\x07\x1B\r\n\u2028\u2029]*(?:\x07|\x1B\\)|\[[0-?]*[ -/]*[@-~]|P[^\x1B\r\n\u2028\u2029]*(?:\x1B\\)|_[^\x1B\r\n\u2028\u2029]*(?:\x1B\\)|\^[^\x1B\r\n\u2028\u2029]*(?:\x1B\\)|[@-Z\\-_])/g;
 const JSON_TOKEN_PATTERN = /"(?:\\.|[^"\\])*"(?=\s*:)|"(?:\\.|[^"\\])*"|-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null|[{}\[\],:]/g;
 const UNSAFE_DISPLAY_CONTROL_PATTERN = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F\x80-\x9F]/g;
-function sanitizeDisplayText(value) {
-    return value
-        .replace(ANSI_CONTROL_SEQUENCE_PATTERN, "")
-        .replace(/\r/g, "")
-        .replace(UNSAFE_DISPLAY_CONTROL_PATTERN, "�");
+const UNSAFE_DISPLAY_DIRECTIONAL_PATTERN = /[\u061C\u200E\u200F\u202A-\u202E\u2066-\u2069]/g;
+const UNSAFE_DISPLAY_ZERO_WIDTH_PATTERN = /[\u200B-\u200D\u2060\uFEFF]/g;
+function sanitizeDisplayText(value, markRemovedSequences = false) {
+    let sanitized = value
+        .replace(/\r\n?/g, "\n")
+        .replace(ANSI_CONTROL_SEQUENCE_PATTERN, markRemovedSequences ? "�" : "")
+        .replace(UNSAFE_DISPLAY_CONTROL_PATTERN, "�")
+        .replace(UNSAFE_DISPLAY_DIRECTIONAL_PATTERN, "�");
+    if (markRemovedSequences)
+        sanitized = sanitized.replace(/[\u2028\u2029]/g, "\n").replace(UNSAFE_DISPLAY_ZERO_WIDTH_PATTERN, "�");
+    return sanitized;
 }
 function replaceTabsForDisplay(value) {
     return value.replaceAll("\t", "    ");
@@ -89,6 +95,8 @@ function formatVisualTruncationNotice(remainingLines, totalLines, theme, width)
     return truncateToWidth(notice, Math.max(0, width));
 }
 function getStructuredModeInvocation(input) {
+    if (typeof input.script === "string")
+        return { mode: "script", rawArgs: [], scriptSource: input.script };
     if (Array.isArray(input.args))
         return { rawArgs: input.args.filter((value) => typeof value === "string") };
     if (input.semanticAction !== undefined)
@@ -114,14 +122,28 @@ function formatInvocationPreview(rawArgs) {
         ? `${invocation.slice(0, TUI_INVOCATION_PREVIEW_MAX_CHARS - 3)}...`
         : invocation;
 }
-export function formatAgentBrowserRenderCall(args, theme) {
+function formatScriptSourceForDisplay(source, expanded) {
+    const sanitizedSource = replaceTabsForDisplay(sanitizeDisplayText(source, true));
+    if (expanded)
+        return sanitizedSource;
+    const preview = sanitizedSource.replace(/\n/g, " ↵ ").replace(/\s+/g, " ").trim();
+    return preview.length > TUI_INVOCATION_PREVIEW_MAX_CHARS
+        ? `${preview.slice(0, TUI_INVOCATION_PREVIEW_MAX_CHARS - 3)}...`
+        : preview;
+}
+export function formatAgentBrowserRenderCall(args, theme, expanded = false) {
     const input = isRecord(args) ? args : {};
-    const { mode, rawArgs } = getStructuredModeInvocation(input);
-    const invocationPreview = formatInvocationPreview(rawArgs);
+    const { mode, rawArgs, scriptSource } = getStructuredModeInvocation(input);
+    const invocationPreview = scriptSource === undefined
+        ? formatInvocationPreview(rawArgs)
+        : formatScriptSourceForDisplay(scriptSource, expanded);
     let text = theme.fg("toolTitle", theme.bold("agent_browser"));
     if (mode) {
         text += ` ${theme.fg("accent", mode)}`;
-        if (invocationPreview.length > 0) {
+        if (scriptSource !== undefined && expanded) {
+            text += `\n${theme.fg("dim", "Source:")}\n${theme.fg("accent", invocationPreview)}`;
+        }
+        else if (invocationPreview.length > 0) {
             text += ` ${theme.fg("dim", "→")} ${theme.fg("accent", invocationPreview)}`;
         }
     }