pi-agent-browser-native 0.6.12 → 0.6.14

package/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 ## Unreleased
 
+## 0.6.14 - 2026-09-17
+
+### Changed
+
+- Recommend `agent-browser` 0.38.1 while retaining the stable 0.35.0 minimum and separate upstream installation.
+- Support native delta snapshots and persistent refs without treating partial revisions as empty pages; keep native delta baselines upstream-owned.
+- Preserve conditional screenshot options and skipped-image results without inventing files or attaching old images.
+- Parse session pointer modes and recording cursor/contact-sheet options, verify contact-sheet images, and surface native WebMCP catalog updates. Document stateful auth login and native recording timing fixes.
+
+### Fixed
+
+- Give automatic managed-session cleanup the normal 35-second command budget, rather than aborting during native Chrome's five-second shutdown grace. Explicit cleanup-timeout overrides remain supported. Report cleanup deadlines with the phase and elapsed time instead of incorrectly reporting caller cancellation.
+
+## 0.6.13 - 2026-09-14
+
+### Fixed
+
+- Suppress Chrome's extra startup window using stock `--no-startup-window`, preserving headless defaults and composing caller launch arguments. URL-less `open` now uses native lazy URL reads so active pages keep their browser, profile, and URL across direct, batch, and script calls. External engines and attachments remain unchanged.
+
+### Changed
+
+- Give ordinary browser calls a native session and restore key per root Pi session. Parent/descendant groups share one browser without a global queue or child-exit teardown. Scope named Chrome profile bootstrap to automatic roots; preserve explicit browsers, script, and Electron isolation.
+
+### Validation
+
+- Start managed-lifecycle release checks explicitly in fresh mode; retain root-session ownership without leaving test browsers open.
+
 ## 0.6.12 - 2026-09-13
 
 ### Fixed

package/README.md

@@ -85,7 +85,7 @@ The result is optimized for agent work:
 | Dashboard scroll commands can look successful while nothing moves | Handles standard `scroll <dir> [px]` against the document first (including pages whose smooth-scroll CSS defeats upstream wheel timing), falls back upstream when the document cannot move, and samples viewport/containers around the fallback; unchanged positions fail as `upstream-error` with `details.scrollNoop`, visible recovery guidance, and exact snapshot/screenshot checks. Unsupported `scrollintoview text=...` fails before dispatch, including inside effective batch rows, and shows exact native `find text ... hover` and snapshot/ref recovery payloads; help remains native pass-through. | [`docs/TOOL_CONTRACT.md`](docs/TOOL_CONTRACT.md#details), [`docs/COMMAND_REFERENCE.md`](docs/COMMAND_REFERENCE.md#core-page-and-element-commands), `test/agent-browser.extension-validation.test.ts` |
 | Dropdown/combobox clicks can focus or hit native option box-model errors | Adds first-class `select <selector> <value...>` paths through raw `args`, `job`, and `semanticAction`; semantic role/name or label select resolves exactly one current visible combobox/listbox ref before action. Custom combobox clicks still detect focused controls with explicit `aria-expanded` state but no visible options and return `details.comboboxFocus` plus exact recovery `nextActions` | [`docs/TOOL_CONTRACT.md`](docs/TOOL_CONTRACT.md#details), [`docs/COMMAND_REFERENCE.md`](docs/COMMAND_REFERENCE.md#core-page-and-element-commands), `extensions/agent-browser/lib/input-modes/semantic-action.ts`, `test/agent-browser.extension-input-modes.test.ts`, `test/agent-browser.extension-validation.test.ts` |
 | Recording workflows fail late when `ffmpeg` is missing or report stale lifecycle state | After successful `record start` / `record restart`, reports `successCategory: "artifact-pending"`, returns an exact `stop-pending-recording` action, warns when older natives report pending output without `ffmpeg`, and conservatively invalidates prior page-scoped `@e…` refs on every executed start attempt and URL-bearing restart to protect older supported natives. This is not evidence of a page change: 0.37 records the active page unless a URL is supplied; FPS-only calls keep the intended tab; an unbounded transcript-backed namespace/session index reserves active destinations across aliases, serializes artifact lifecycle and explicit wait/output writes, persists cross-branch close tombstones, retires every successful close path (including every matching namespace owner for `close --all`), rejects missing/stale restart output, coalesces terminal batch state, keeps only the newest pending path per identity, rejects recording starts after a nested close, folds Unicode path aliases, and retains exact cleanup actions with visible guidance on any later same-session failure | [`docs/TOOL_CONTRACT.md`](docs/TOOL_CONTRACT.md#details), [`docs/COMMAND_REFERENCE.md`](docs/COMMAND_REFERENCE.md#diff-debug-and-streaming), `test/agent-browser.extension-validation.test.ts`, `test/agent-browser.presentation-artifacts-batch.test.ts` |
-| Upstream CLI drift can silently invalidate wrapper behavior | Publishes a repo-readable command reference, verifies it against the recommended 0.37.0 target, and probes browser-backed calls once per cwd/PATH so stable versions below the 0.35.0 floor fail before browser launch with installed/expected version evidence | `npm run verify` |
+| Upstream CLI drift can silently invalidate wrapper behavior | Publishes a repo-readable command reference, verifies it against the recommended 0.38.1 target, and probes browser-backed calls once per cwd/PATH so stable versions below the 0.35.0 floor fail before browser launch with installed/expected version evidence | `npm run verify` |
 | Pages can expose structured workflows through experimental WebMCP | Shows native positive WebMCP availability in navigation summaries and passes through `webmcp list`, `invoke`, detached `result` / `cancel`, params/frame/timeout options, and the bundled `webmcp-gen` skill; treats `--no-webmcp` as launch-scoped, keeps pending or unsuccessfully settled targets unverified with an actionable `get url` follow-up, invalidates stale refs after page tools run, and budgets effective raw or stdin batch timeouts | [`docs/COMMAND_REFERENCE.md`](docs/COMMAND_REFERENCE.md#webmcp-page-tools), `test/agent-browser.extension-ref-guards.test.ts`, `test/agent-browser.wait-timeouts.test.ts`, `test/agent-browser.real-upstream-contract.test.ts` |
 | Desktop Electron apps need discovery, CDP attach, and safe teardown | Top-level `electron` runs host `list` / isolated `launch` (temp profile, OS-chosen debug port) / `status` / `probe` / `cleanup`, merges `launchId` plus managed `sessionName`, supports `handoff` `snapshot` / `tabs` / `connect`, and surfaces mismatch and post-command health guidance; wrapper cleanup applies only to launches it created | `extensions/agent-browser/lib/electron/discovery.ts`, `launch.ts`, `cleanup.ts`, [`docs/TOOL_CONTRACT.md`](docs/TOOL_CONTRACT.md#electron), [`docs/COMMAND_REFERENCE.md`](docs/COMMAND_REFERENCE.md#electron-desktop-apps) |
 | Agents need bundled `skills` text and local setup/status commands without touching the live session | Treats `skills list/get/path`, local auth/profile/setup commands, `session list`, and local state lifecycle commands as sessionless reads/actions when upstream does not need a live page. Session/state rows and targets remain visible, and supported upstream state/config/path operations pass through unchanged. Browser-backed workflows still receive an implicit session only when the caller did not choose one. | [`docs/COMMAND_REFERENCE.md`](docs/COMMAND_REFERENCE.md#built-in-skills), `extensions/agent-browser/lib/command-policy.ts`, `extensions/agent-browser/lib/runtime.ts` |
@@ -108,7 +108,9 @@ Optional external tools unlock the full command surface:
 | `agent-browser` | All browser automation through this extension | See upstream install docs |
 | `ffmpeg` | Recording WebM (libvpx) or MP4 (libx264); install before `record start` / `record restart` | `brew install ffmpeg` or `brew install ffmpeg-full` |
 
-Keep both binaries on `PATH`. This package recommends `agent-browser 0.37.0` and accepts stable versions at or above the 0.35.0 floor; browser-backed calls fail fast below that floor while local inspection/setup commands remain available for diagnosis. Native 0.37 validates `ffmpeg`, the output extension and FPS before recording; older supported natives may defer failures until stop. Use `record start <path.webm|path.mp4> [url] [--fps <n>]` (1–60 fps, default 30), then verify the completed file after `record stop`. Native `doctor` checks the recording dependency and encoders.
+Keep both binaries on `PATH`. This package recommends `agent-browser 0.38.1` and accepts stable versions at or above the 0.35.0 floor; browser-backed calls fail fast below that floor while local inspection/setup commands remain available for diagnosis. Native 0.37 validates `ffmpeg`, the output extension and FPS before recording; older supported natives may defer failures until stop. Use `record start <path.webm|path.mp4> [url] [--fps <n>]` (1–60 fps, default 30), then verify the completed file after `record stop`. Native `doctor` checks the recording dependency and encoders.
+
+On 0.38.1, use `snapshot --delta` for native full/unchanged/changed revisions and `snapshot --delta --full` to reset its baseline. Surviving DOM nodes keep their refs, but navigation/replaced nodes still require fresh refs. The wrapper preserves native revisions and refreshes complete refs internally for partial results. `screenshot --if-changed` (or `--threshold 0.01`) skips unchanged images without creating an artifact. `--input-mode instant|smooth|human` controls native session pointer movement; `click ... --human`, `drag ... --human`, and timed `mouse move` remain ordinary `args`. Recordings accept `--cursor` and `--contact-sheet`; the latter produces a timestamped PNG verified after stop. `auth login <name> --no-navigate` fills a prepared login page after upstream checks its origin. See the [command reference](docs/COMMAND_REFERENCE.md#upstream-0381-rebaseline) for examples and limits.
 
 ### Android / Termux
 
@@ -188,7 +190,7 @@ npm run doctor
 The doctor checks:
 
 - upstream `agent-browser` exists on `PATH`
-- the installed upstream is a stable version at or above the supported 0.35.0 floor; 0.37.0 remains the recommended baseline
+- the installed upstream is a stable version at or above the supported 0.35.0 floor; 0.38.1 remains the recommended baseline
 - `pi --version` meets the minimum Pi runtime floor for this release; older Pi versions are setup failures
 - Pi settings do not point at multiple active `pi-agent-browser-native` sources
 
@@ -317,6 +319,10 @@ Open a page and inspect it (first-call recipe: open → snapshot -i → interact
 
 Chromium launch switches belong in the value of `--args`, for example `{ "args": ["--args", "--no-sandbox", "open", "https://example.com"], "sessionMode": "fresh" }` when that switch is needed. A bare `--no-sandbox` in the command slot is an unknown command; in an `open` / `goto` / `navigate` option position, upstream ignores it. The wrapper diagnoses those forms without rejecting literal text, select values or paths in other commands. For batches, put `--args` in top-level `args` before `batch`, not inside a row.
 
+Local Chrome startup uses the stock binary's `--args --no-startup-window` capability to suppress Chrome's extra startup window. Headless remains the default. Caller launch arguments keep native CLI → environment → config precedence and follow this default; browsers started before this change with custom arguments may restart once when their native launch configuration changes. Ordinary follow-ups do not resend bootstrap settings. CDP, providers, Electron, and Lightpanda remain native-owned; no tabs are deleted or profiles edited by this behavior.
+
+`open` without a URL uses native `get url`: it launches when needed and otherwise preserves the current page. This also applies to effective batch rows and script calls. `details.args` preserves the request, while `effectiveArgs`, command, URL data, and lifecycle describe the actual native operation. Use `open about:blank` only when you intend to navigate there. Help/version requests remain unchanged.
+
 Watch a browser window during a demo, QA run, or user-completed login by adding upstream's global `--headed` flag on the first launch. Use `sessionMode: "fresh"` if a managed session may already exist, because headed/headless state is launch-scoped. A successful first/fresh local wrapper-managed headed launch, including a launch inside `batch`, returns `details.browserWindow = { mode: "headed", ownership: "wrapper-managed", sessionName, visibility: "unverified" }` and one visible handoff sentence; CDP, auto-connect, provider, and Electron attachments do not. This proves that the wrapper requested and upstream launched headed mode, not that the OS window is visible on the user's display; remote, container, or virtual-display setups can still hide it. After the user finishes in the window, continue with `sessionMode: "auto"`.
 
 ```json
@@ -608,33 +614,31 @@ After a successful unnamed fresh launch, later default `sessionMode: "auto"` cal
 
 ### Shared browser defaults
 
-To reuse one signed-in browser across Pi sessions, configure native `agent-browser` defaults in `~/.agent-browser/config.json`:
+Ordinary browser calls use one native named browser per **root Pi session**. A parent and its subagents share that browser; unrelated roots get different names and can browse concurrently. `pi-subagents` supplies `PI_SUBAGENT_ROOT_SESSION_ID` through its existing launch records, including detached runs, delegated forks, grandchildren, and revived children. Ordinary Pi new/fork/clone sessions get their own root identity; resuming the same root or changing its cwd keeps its browser name.
+
+Coordinate multi-call navigation within the group using existing subagent/intercom tools. Native commands are serialized by each browser daemon; wrapper helper queues are process-local. There is no global focus queue. Parent or child exit does not close the group browser. Native idle policy applies; explicitly close only your group's browser when the group is finished.
+
+To bootstrap new root browsers from an authenticated normal Chrome profile, set the existing **Pi package** config in `~/.pi/config/pi-agent-browser-native/config.json`:
 
 ```json
 {
-  "session": "shared-work",
-  "namespace": "",
-  "profile": "/absolute/path/to/persistent-browser-profile",
-  "headed": true
+  "browser": {
+    "defaultProfile": { "name": "Default", "policy": "always" },
+    "executablePath": "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
+  }
 }
 ```
 
-Use a dedicated full profile directory path, not a copied Chrome profile name. Add native `executablePath` if needed. Ordinary `args`, `semanticAction`, `job`, `qa`, and lookup calls then select that same caller-owned browser without repeating flags. This is separate from the advisory Pi package `browser.defaultProfile` setting. Existing native project config, environment and per-call flags keep their precedence; `--config` or `AGENT_BROWSER_CONFIG` replaces user/project config discovery.
-
-Pi quit does not close a caller-owned shared browser or impose its implicit 15-minute idle timeout. Native idle policy applies, including its default headed-browser exemption; explicit `--idle-timeout` applies to every helper in that call too. Keep native idle settings consistent between calls because changing them can restart the daemon. `AGENT_BROWSER_SOCKET_DIR` is honored for caller-owned sessions; the wrapper-specific socket override still takes priority.
+For inactive automatic roots, global/override `always` profile **names** and the configured executable bootstrap native launch through a scoped subprocess environment shared with helpers. Active roots retain native launch settings instead of resending defaults that could replace an explicitly profiled browser; their existing restore key is preserved, including follow-ups naming the same root browser. Native Chrome profile names use independent temporary copies, not the source profile's lock. Profile paths and other profile policies remain advisory; project guidance does not change a root's launch settings when a child changes cwd. Explicit unrelated sessions, native launch/config/environment choices, isolated `script`, and Electron launches do not receive the root bootstrap defaults. Do not set a global native profile merely to enable this feature: it can change the launch configuration of existing unrelated browsers.
 
-A configured native session, like explicit `--session`, takes precedence over `sessionMode: "fresh"`. To select a different browser, override the native session **and** profile/config as appropriate; changing only the name can contend for the same profile. Without a configured session, implicit ownership and fresh rotation are unchanged. `script` remains disposable: its helpers and cleanup use an empty temporary native config, never your user/project profile defaults. Electron launch retains its own isolated app lifecycle and generated session, even with a native session environment default. With a shared native default configured, target Electron's returned `sessionName` explicitly for browser follow-ups.
+Each automatic root has its own stable native restore key. Native save/restore preserves cookies, localStorage, and sessionStorage across normal close/restart; it does not merge auth between roots or save new IndexedDB-only credentials, service workers, or page-memory grants. Named profile copies can bootstrap existing IndexedDB, but are discarded on close and never write back to the communal profile. Verify the actual application after restart, not just a successful restore receipt. If an application needs unsupported state, use a supported persistent **per-root** profile and collect required sign-ins together; never point concurrent roots at one writable profile directory. Sites can expire sessions or require a fresh human challenge.
 
-Use `{ "args": ["session", "info"] }` for one read-only preflight of the selected native session (or add `--namespace` / `--session` explicitly). It separates daemon activity/PID from verified browser liveness, Chrome PID, exact profile, tabs and native launched/attached ownership. Pi cleanup ownership is separate: a caller-owned shared browser is not closed by Pi, while an explicit name can still identify a wrapper-owned browser. Missing native fields remain unknown, never inferred from config or a live daemon.
+Explicit native `session` defaults (config or `AGENT_BROWSER_SESSION`) still override automatic root selection, including `sessionMode: "fresh"`. They intentionally share whichever browser the caller selected. Per-call session/namespace flags retain precedence. Ordinary launch options such as `--profile` or `--executable-path` still use the root-group name. Repeat explicit options when deliberately relaunching a persistent per-root profile after close. Explicit `fresh` and attachment choices retain their existing managed-session lifecycle; later auto calls follow that selected managed session. Use `session info` with the reported `sessionName` for read-only native daemon/browser evidence. Unknown native fields remain unknown.
 
 Policy-required URL reads keep the two-call read → confirm/deny flow. Returned actions name the actual native namespace/session, including `default`; routing survives transcript resume and branch changes. Only explicit-read provenance plus native `capabilities.readRequiresConfirmation: true` permits matching confirm/deny without page helpers. This capability includes native confirmation-ID checking. Legacy prompts retain correct routing but normal page checks; DOM or content-shaped prompts never receive the exemption.
 
 Full live identity, browser-independent native reads/confirmations and detailed recording receipts require the companion upstream fixes; the current recommended release does not yet supply all of them. Older supported versions remain accepted with unavailable evidence marked unknown. The extension does not upgrade or restart your installed browser to obtain these fields.
 
-Coordinate tabs/navigation between agents sharing a browser; the wrapper's per-session queue is local to one Pi process. Persistent profile storage preserves browser data, not a promise of permanent website login: sites can expire or revoke sessions and require a new human challenge. Standing permission avoids repeated permission requests, but cannot change those site policies.
-
-Before enabling global native profile defaults, update and fully restart every participating Pi runtime. Older loaded wrappers can still let disposable `script` launches read HOME config; editing this source or running `/reload` does not replace their cached code. Coordinate the browser cutover too: moving an existing daemon from the old wrapper's explicit 15-minute idle timeout to native idle policy changes its launch fingerprint and can restart it. Do not change that policy while another agent is using the browser.
-
 ### Profile selection
 
 The wrapper does not clone profiles or hide what upstream Chrome/Chromium profile or executable you chose. Passing `--profile` or `--executable-path` is an explicit upstream `agent-browser` choice. Visible page content from real profiles is model-visible and may persist in transcripts or saved artifacts; redaction protects credential-like cookie/storage/auth values, not ordinary page text you asked the browser to read. Redactions use `[REDACTED]` (URL-encoded in parsed URLs); ordinary technical phrases such as `bearer token` stay intact. URL redaction includes `code`, `authorization_session_id`, and auth-context `state` / `nonce` across visible text, details, spills, and `outputPath` exports. URLs needing no redaction keep their original spelling.
@@ -756,7 +760,7 @@ The opt-in real-upstream suite is separate because it drives a real browser inst
 npm run verify -- real-upstream
 ```
 
-That mode sets `PI_AGENT_BROWSER_REAL_UPSTREAM=1` and runs `test/agent-browser.real-upstream-contract.test.ts` against the real `agent-browser` on `PATH` (the stable version must meet the 0.35.0 floor; current command-reference validation targets the recommended 0.37.0 capability baseline). It covers inspection, skills, experimental WebMCP list/invoke/result/cancel plus `--no-webmcp`, and a broad core interaction and navigation matrix on localhost fixtures (including off-viewport click, frame-scoped selector/wait/click behavior, form command fixes, `batch` stdin, and `pushstate`), plus `vitals`, network route/requests/HAR, diff snapshot/screenshot/url, trace/profiler, console/errors/highlight, stream enable/status/disable, `cookies set --curl`, a `react tree` missing-renderer path, and `wait --download` with the on-disk caveat documented in release notes. The harness uses a throwaway temp `HOME` and dedicated socket/screenshot directories so the run does not touch your normal browser profile paths. Browser-opening or credential-dependent families such as `inspect`, `dashboard`, `chat`, provider clouds, and OS clipboard flows stay in fake-upstream or manual validation unless a safe deterministic fixture is added. For prerequisites, isolation details, and troubleshooting, see [`docs/RELEASE.md`](docs/RELEASE.md#real-upstream-contract-validation).
+That mode sets `PI_AGENT_BROWSER_REAL_UPSTREAM=1` and runs `test/agent-browser.real-upstream-contract.test.ts` against the real `agent-browser` on `PATH` (the stable version must meet the 0.35.0 floor; current command-reference validation targets the recommended 0.38.1 capability baseline). It covers inspection, skills, experimental WebMCP list/invoke/result/cancel plus `--no-webmcp`, and a broad core interaction and navigation matrix on localhost fixtures (including off-viewport click, frame-scoped selector/wait/click behavior, form command fixes, `batch` stdin, and `pushstate`), plus `vitals`, network route/requests/HAR, diff snapshot/screenshot/url, trace/profiler, console/errors/highlight, stream enable/status/disable, `cookies set --curl`, a `react tree` missing-renderer path, and `wait --download` with the on-disk caveat documented in release notes. The harness uses a throwaway temp `HOME` and dedicated socket/screenshot directories so the run does not touch your normal browser profile paths. Browser-opening or credential-dependent families such as `inspect`, `dashboard`, `chat`, provider clouds, and OS clipboard flows stay in fake-upstream or manual validation unless a safe deterministic fixture is added. For prerequisites, isolation details, and troubleshooting, see [`docs/RELEASE.md`](docs/RELEASE.md#real-upstream-contract-validation).
 
 A deterministic host-only live-browser wrapper smoke is available without an LLM choosing tool calls:
 
@@ -789,12 +793,12 @@ npm run verify -- release
 5. Screenshots, downloads, recordings, traces, profiles, and spill files are normalized as Pi-visible artifacts where possible.
 6. Generated playbook text in docs and tool metadata stays aligned with `extensions/agent-browser/lib/playbook.ts`.
 
-The upstream browser engine remains [`agent-browser`](https://agent-browser.dev/). This package does not bundle it. The recommended baseline is 0.37.0 and the stable runtime floor is 0.35.0; newer stable versions are accepted without version-specific compatibility shims.
+The upstream browser engine remains [`agent-browser`](https://agent-browser.dev/). This package does not bundle it. The recommended baseline is 0.38.1 and the stable runtime floor is 0.35.0; newer stable versions are accepted without version-specific compatibility shims.
 
 ## Current limits
 
 - Published pre-1.0 package.
-- Recommends upstream `agent-browser` 0.37.0 and accepts stable runtimes at or above 0.35.0.
+- Recommends upstream `agent-browser` 0.38.1 and accepts stable runtimes at or above 0.35.0.
 - Does not bundle `agent-browser`; users install it separately.
 - Does not provide a human browser UI inside Pi; the primary UX is agent-invoked tool calls. `--headed` asks upstream to show a browser window, but the wrapper cannot yet prove that the window is visible on the user's desktop.
 - Localhost means the browser host's loopback, not necessarily the shell/Pi host. If `http://localhost:<port>` or `http://127.0.0.1:<port>` fails with errors such as `ERR_EMPTY_RESPONSE`, use an environment-specific host-reachable HTTP(S) address. A `file://` fixture is supported when upstream browser launch settings allow it; use HTTP(S) only when the browser environment cannot reach the local file.

package/dist/extensions/agent-browser/index.js

@@ -22,7 +22,7 @@ import { cleanupSecureTempArtifacts } from "./lib/temp.js";
 import { AGENT_BROWSER_PARAMS } from "./lib/input-modes/params.js";
 import { AGENT_BROWSER_SCRIPT_DEFAULT_TIMEOUT_MS, AGENT_BROWSER_SCRIPT_NAMESPACE, createAgentBrowserScriptSessionName, isAgentBrowserScriptSessionName, runAgentBrowserScript, } from "./lib/input-modes/script.js";
 import { closeManagedSession, getSessionContextKey, runAgentBrowserTool } from "./lib/orchestration/browser-run/index.js";
-import { canonicalizeExplicitArtifactDestination, getExplicitArtifactDestination } from "./lib/orchestration/browser-run/artifact-paths.js";
+import { canonicalizeExplicitArtifactDestination, getExplicitArtifactDestination, getRecordContactSheetDestination } from "./lib/orchestration/browser-run/artifact-paths.js";
 import { findElectronLaunchRecordForSession, getActiveElectronRecords } from "./lib/orchestration/browser-run/session-state.js";
 import { parseBatchCommandArgument, parseUserBatchStdin } from "./lib/orchestration/batch-stdin.js";
 import { ELECTRON_POST_COMMAND_STATUS_SETTLE_MS, ELECTRON_PROFILE_ISOLATION_DETAILS, cleanupActiveElectronHostLaunches, handleElectronHostInput, restoreElectronLaunchRecordsFromBranch, } from "./lib/orchestration/electron-host/index.js";
@@ -75,6 +75,8 @@ function getArtifactPreflightValidationError(options) {
     for (const reservation of options.activeRecordingReservations ?? []) {
         try {
             activeRecordingDestinations.add(canonicalizeExplicitArtifactDestination(reservation.cwd, reservation.absolutePath));
+            if (reservation.contactSheetPath)
+                activeRecordingDestinations.add(canonicalizeExplicitArtifactDestination(reservation.cwd, reservation.contactSheetPath));
         }
         catch (canonicalizationError) {
             if (!cleanupOnly)
@@ -106,8 +108,9 @@ function getArtifactPreflightValidationError(options) {
             if (isCloseCommand(commandStep[0]))
                 sawBatchClose = true;
         }
-        const artifactDestination = getExplicitArtifactDestination(commandStep);
-        if (artifactDestination) {
+        for (const artifactDestination of [getExplicitArtifactDestination(commandStep), getRecordContactSheetDestination(commandStep)]) {
+            if (!artifactDestination)
+                continue;
             let canonicalDestination;
             try {
                 canonicalDestination = canonicalizeExplicitArtifactDestination(options.cwd, artifactDestination);
@@ -1126,7 +1129,7 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
         }
         for (const [key, reservation] of activeRecordingReservations) {
             const restored = restoredRecordingState.active.get(key);
-            if (restored?.absolutePath !== reservation.absolutePath || restored.cwd !== reservation.cwd || restored.recordingId !== reservation.recordingId || restored.startedAtMs !== reservation.startedAtMs)
+            if (restored?.absolutePath !== reservation.absolutePath || restored.cwd !== reservation.cwd || restored.recordingId !== reservation.recordingId || restored.startedAtMs !== reservation.startedAtMs || restored.contactSheetPath !== reservation.contactSheetPath)
                 recordingReservationsDirty = true;
             restoredRecordingState.active.set(key, reservation);
         }
@@ -1370,7 +1373,12 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
             }
             if (resolvedInput.kind !== "script")
                 await beforeExecute?.(nativeToolCallId, { ...ctx, signal });
-            return withNativeSessionDefaults(resolvedInput, ctx.cwd, signal, async (resolvedInput) => {
+            const runtimeBrowserConfig = loadAgentBrowserConfigSync({ cwd: ctx.cwd, includeProjectConfig: shouldIncludeProjectConfig(ctx) });
+            const rootProfile = runtimeBrowserConfig.trustedBrowserDefaultProfile;
+            const pendingReadConfirmation = sessionPageState.findReadConfirmation(resolvedInput.toolArgs, resolveAgentBrowserNamespace(resolvedInput.toolArgs, getAgentBrowserProcessEnvironment().AGENT_BROWSER_NAMESPACE));
+            const rootSessionId = process.env.PI_SUBAGENT_CHILD === "1" && process.env.PI_SUBAGENT_ROOT_SESSION_ID
+                ? process.env.PI_SUBAGENT_ROOT_SESSION_ID : ctx.sessionManager.getSessionId();
+            return withNativeSessionDefaults(resolvedInput, ctx.cwd, signal, async (resolvedInput, withLaunchDefaults) => {
                 const readConfirmation = sessionPageState.findReadConfirmation(resolvedInput.toolArgs, resolveAgentBrowserNamespace(resolvedInput.toolArgs, getAgentBrowserProcessEnvironment().AGENT_BROWSER_NAMESPACE));
                 if (readConfirmation)
                     resolvedInput = { ...resolvedInput, toolArgs: scopeReadConfirmationArgs(resolvedInput.toolArgs, readConfirmation) };
@@ -1614,7 +1622,7 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
                 const callerOwnedSessionQueueKey = !serializeBrowserCommand && explicitSessionName
                     ? getSessionContextKey(explicitSessionName, callerOwnedSessionNamespace) ?? explicitSessionName
                     : undefined;
-                const runBrowserCommand = async () => {
+                const runBrowserCommand = async (daemonInactive) => {
                     flushRecordingReservations();
                     const branchRestoreGenerationAtStart = branchRestoreGeneration;
                     const generationAtStart = branchStateGeneration;
@@ -1664,6 +1672,7 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
                             ?? getSessionContextKey(browserRunState.managedSessionName, browserRunState.managedSessionNamespace);
                     const attachedSessionKnown = reusableSessionKey !== undefined && attachedSessionKeys.has(reusableSessionKey);
                     let result = await runAgentBrowserTool({
+                        daemonInactive,
                         ctx,
                         cwd: ctx.cwd,
                         electronPostCommandStatusSettleMs: ELECTRON_POST_COMMAND_STATUS_SETTLE_MS,
@@ -1771,6 +1780,7 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
                     return applyAgentBrowserOutputPath({ cwd: ctx.cwd, outputPath, preserveTextContent: Array.isArray(params.args) && params.args.includes("--json"), result: warnRecordingPersistence(result) });
                 };
                 const closesAllSessions = commandClosesAllSessions(toolArgs, resolvedInput.toolStdin);
+                const runWithLaunchDefaults = () => withLaunchDefaults ? withLaunchDefaults(runBrowserCommand) : runBrowserCommand();
                 const runWithinSessionQueue = () => {
                     if (closesAllSessions)
                         return managedSessionExecutionQueue.run(() => {
@@ -1783,13 +1793,13 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
                                 sessionMode: params.sessionMode ?? "auto",
                                 stdin: resolvedInput.toolStdin,
                             });
-                            return callerOwnedSessionExecutionQueues.runExclusive(plan.namespace, runBrowserCommand);
+                            return callerOwnedSessionExecutionQueues.runExclusive(plan.namespace, runWithLaunchDefaults);
                         });
                     if (serializeBrowserCommand)
-                        return managedSessionExecutionQueue.run(runBrowserCommand);
+                        return managedSessionExecutionQueue.run(runWithLaunchDefaults);
                     return callerOwnedSessionQueueKey
-                        ? callerOwnedSessionExecutionQueues.run(callerOwnedSessionQueueKey, callerOwnedSessionNamespace, runBrowserCommand)
-                        : runBrowserCommand();
+                        ? callerOwnedSessionExecutionQueues.run(callerOwnedSessionQueueKey, callerOwnedSessionNamespace, runWithLaunchDefaults)
+                        : runWithLaunchDefaults();
                 };
                 if (!commandTouchesArtifactLifecycle(toolArgs, resolvedInput.toolStdin, outputPath))
                     return runWithinSessionQueue();
@@ -1814,6 +1824,10 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
                         validationError: artifactValidationError,
                     }));
                 });
+            }, managedSessionActive || freshSessionOrdinal > 0 || params.sessionMode === "fresh" || pendingReadConfirmation ? undefined : {
+                id: rootSessionId,
+                profile: rootProfile?.policy === "always" && !/[\\/~]/.test(rootProfile.name) ? rootProfile.name : undefined,
+                executablePath: runtimeBrowserConfig.trustedBrowserExecutablePath,
             });
         },
     };

package/dist/extensions/agent-browser/lib/argv-grammar.js

@@ -36,6 +36,7 @@ export const GLOBAL_VALUE_FLAGS = [
     "--max-output",
     "--model",
     "--idle-timeout",
+    "--input-mode",
 ];
 export const COMMAND_VALUE_FLAGS = [
     "--allowed-origins",

package/dist/extensions/agent-browser/lib/command-taxonomy.js

@@ -324,6 +324,10 @@ export function getRecordCommandOperands(tokens) {
         // Native validates the range; bare/non-numeric --fps keeps its old literal meaning.
         if (tokens[index] === "--fps" && /^\+?\d+$/.test(tokens[index + 1] ?? ""))
             index += 1;
+        else if (tokens[index] === "--cursor" || tokens[index] === "--contact-sheet")
+            continue;
+        else if (tokens[index] === "--contact-sheet-threshold" && tokens[index + 1] !== undefined)
+            index += 1;
         else
             operands.push(tokens[index]);
     }

package/dist/extensions/agent-browser/lib/orchestration/batch-stdin.js

@@ -1,3 +1,35 @@
+import { projectUpstreamGlobalFlags } from "../argv-grammar.js";
+/** Bare open's native launch action drops prior launch options. URL reads lazily launch without navigating. */
+export function normalizeUrlLessOpen(args, stdin, batchStep = false) {
+    const { tokens, indices } = batchStep ? { tokens: args, indices: args.map((_, index) => index) } : projectUpstreamGlobalFlags(args);
+    if (tokens[0] === "open" && !tokens.slice(1).some(token => !token.startsWith("--"))) {
+        const index = indices[0];
+        return { args: [...args.slice(0, index), "get", "url", ...args.slice(index + 1)], stdin };
+    }
+    if (tokens[0] !== "batch")
+        return { args, stdin };
+    const rawSteps = tokens.slice(1).flatMap((token, offset) => {
+        const step = token === "--bail" ? undefined : parseBatchCommandArgument(token).step;
+        return step ? [{ index: indices[offset + 1], step }] : [];
+    });
+    if (tokens.slice(1).some(token => token !== "--bail")) {
+        let normalized = args;
+        for (const { index, step } of rawSteps) {
+            const row = normalizeUrlLessOpen(step, undefined, true).args;
+            if (row === step)
+                continue;
+            if (normalized === args)
+                normalized = [...args];
+            normalized[index] = row.map(token => `'${token.replaceAll("'", "'\\''")}'`).join(" ");
+        }
+        return { args: normalized, stdin };
+    }
+    const steps = parseUserBatchStdin(stdin).steps;
+    if (!steps?.length)
+        return { args, stdin };
+    const normalized = steps.map(step => normalizeUrlLessOpen(step, undefined, true).args);
+    return { args, stdin: normalized.some((step, index) => step !== steps[index]) ? JSON.stringify(normalized) : stdin };
+}
 const BATCH_STDIN_EXAMPLE = ' Example: { "args": ["batch"], "stdin": "[[\\"get\\",\\"title\\"],[\\"get\\",\\"url\\"]]" }';
 // Mirror upstream commands::shell_words_split so policy inspection sees the same argv.
 export function parseBatchCommandArgument(command) {

package/dist/extensions/agent-browser/lib/orchestration/browser-run/artifact-paths.js

@@ -1,5 +1,5 @@
 import { lstatSync, readlinkSync, realpathSync, statSync } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename, dirname, extname, join, resolve } from "node:path";
 import { foldAgentBrowserFilesystemIdentity } from "../../argv-grammar.js";
 import { parseWaitCommandTokens } from "../../argv-descriptor.js";
 import { getRecordCommandOperands } from "../../command-taxonomy.js";
@@ -10,14 +10,18 @@ function isSingleScreenshotPathToken(token) {
         return false;
     return explicitlyRelative || token.includes("/") || SCREENSHOT_IMAGE_EXTENSIONS.some((extension) => token.endsWith(extension));
 }
-function getScreenshotPositionalIndices(commandTokens) {
+export function getScreenshotPositionalIndices(commandTokens) {
     if (commandTokens[0] !== "screenshot")
         return [];
     const positionalIndices = [];
     for (let index = 1; index < commandTokens.length; index += 1) {
         const token = commandTokens[index];
-        if (token === "--full" || token === "-f")
+        if (token === "--full" || token === "-f" || token === "--if-changed")
             continue;
+        if (token === "--threshold") {
+            index += 1;
+            continue;
+        }
         positionalIndices.push(index);
     }
     return positionalIndices;
@@ -91,6 +95,13 @@ function canonicalizeArtifactPath(absolutePath, platform, seenSymlinks) {
 export function canonicalizeExplicitArtifactDestination(cwd, destination, platform = process.platform) {
     return canonicalizeArtifactPath(resolve(cwd, destination), platform, new Set());
 }
+export function getRecordContactSheetDestination(commandTokens) {
+    const path = getRecordCommandOperands(commandTokens).path;
+    if (!path || !commandTokens.some((token) => token === "--contact-sheet" || token === "--contact-sheet-threshold"))
+        return undefined;
+    const extension = extname(path);
+    return extension ? `${path.slice(0, -extension.length)}.contact-sheet.png` : undefined;
+}
 export function getExplicitArtifactDestination(commandTokens) {
     const command = commandTokens[0];
     const subcommand = commandTokens[1];

package/dist/extensions/agent-browser/lib/orchestration/browser-run/click-dispatch.js

@@ -11,7 +11,7 @@ function normalizeAccessibleName(name) {
 function getClickDispatchProbeTarget(commandTokens, refSnapshot) {
     if (commandTokens[0] !== "click" || commandTokens.includes("--new-tab"))
         return undefined;
-    const selector = commandTokens[1];
+    const selector = commandTokens.slice(1).find((token) => token !== "--human");
     if (!selector || selector.startsWith("-"))
         return undefined;
     const refId = parseRefId(selector);

package/dist/extensions/agent-browser/lib/orchestration/browser-run/index.js

@@ -1,5 +1,8 @@
-import { runAgentBrowserProcess, withAttachedBrowserSessionContext } from "../../process.js";
+import { runAgentBrowserProcess, withAttachedBrowserSessionContext, withChromeStartupArgs } from "../../process.js";
 import { isRecord } from "../../parsing.js";
+import { collectNativeWebMcp, getNativeWebMcpCatalog } from "../../webmcp-observation.js";
+import { redactSensitiveValue } from "../../runtime.js";
+import { formatWebMcpCatalogUpdate } from "../../results/presentation/common.js";
 import { withOwnedManagedSessionContext } from "../../managed-session-restore.js";
 import { cleanupClickDispatchProbe } from "./click-dispatch.js";
 import { applyBrowserRunStatePatch, getSessionContextKey } from "./session-state.js";
@@ -9,8 +12,21 @@ import { processBrowserOutput } from "./process-output.js";
 export { closeManagedSession } from "./managed-session-daemon-policy.js";
 export { getSessionContextKey } from "./session-state.js";
 export async function runAgentBrowserTool(options) {
-    const result = await withAttachedBrowserSessionContext(options.preserveAttachedBrowserSession === true, () => runAgentBrowserToolInContext(options));
-    const details = isRecord(result.details) ? result.details : undefined;
+    const observed = await collectNativeWebMcp(() => withChromeStartupArgs(options.input.persistentChromeArgs, () => withAttachedBrowserSessionContext(options.preserveAttachedBrowserSession === true, () => runAgentBrowserToolInContext(options))));
+    const result = observed.result;
+    let details = isRecord(result.details) ? result.details : undefined;
+    if (observed.catalog) {
+        const catalog = redactSensitiveValue(observed.catalog);
+        details = { ...details, webMcpCatalog: catalog };
+        result.details = details;
+        if (!options.input.toolArgs.includes("--json") && JSON.stringify(getNativeWebMcpCatalog(details.data)) !== JSON.stringify(catalog)) {
+            const notice = formatWebMcpCatalogUpdate(catalog);
+            if (result.content[0]?.type === "text")
+                result.content[0] = { ...result.content[0], text: `${result.content[0].text}\n\n${notice}` };
+            else
+                result.content.push({ type: "text", text: notice });
+        }
+    }
     const sessionKey = getSessionContextKey(typeof details?.sessionName === "string" ? details.sessionName : undefined, typeof details?.namespace === "string" ? details.namespace : undefined);
     const page = options.state.sessionPageState.get(sessionKey);
     return page.tabReopenPending === undefined ? result : {
@@ -29,7 +45,7 @@ async function runAgentBrowserToolInContext(options) {
     return await withOwnedManagedSessionContext(ownedManagedSession, async () => {
         try {
             const artifactRunStartedAtMs = Date.now();
-            const processResult = await runAgentBrowserProcess({
+            const processResult = await withChromeStartupArgs(prepared.chromeStartupArgs, () => runAgentBrowserProcess({
                 args: prepared.processArgs,
                 browserIndependentReadConfirmation: prepared.readConfirmation !== undefined,
                 cwd: options.cwd,
@@ -43,7 +59,7 @@ async function runAgentBrowserToolInContext(options) {
                 signal: options.signal,
                 stdin: prepared.processStdin,
                 timeoutMs: prepared.processTimeoutMs,
-            });
+            }));
             const missingBinaryResult = await buildMissingBinaryFailureResult({
                 compatibilityWorkaround: prepared.compatibilityWorkaround,
                 electronLaunch: prepared.electronLaunch,

package/dist/extensions/agent-browser/lib/orchestration/browser-run/managed-session-daemon-policy.js

@@ -142,7 +142,13 @@ export async function acquireOwnedManagedSessionDaemonPolicy(options) {
 }
 export async function closeManagedSession(options) {
     const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), options.timeoutMs);
+    let phase = "policy coordination";
+    let phaseStartedAt = Date.now();
+    let timeoutError;
+    const timer = setTimeout(() => {
+        timeoutError = `Managed-session cleanup timed out after ${options.timeoutMs} ms during ${phase} (${Date.now() - phaseStartedAt} ms in this phase).`;
+        controller.abort();
+    }, options.timeoutMs);
     let stdoutSpillPath;
     const closeArgs = [...(options.namespace !== undefined ? ["--namespace", options.namespace] : []), "--session", options.sessionName, "close"];
     const policyLock = options.policyLock ?? await acquireManagedSessionPolicyLock({
@@ -153,9 +159,11 @@ export async function closeManagedSession(options) {
     });
     if (!policyLock) {
         clearTimeout(timer);
-        return "Managed-session policy coordination is unavailable or busy; cleanup did not run. Retry after the current operation finishes or repair the private policy-lock directory.";
+        return timeoutError ?? "Managed-session policy coordination is unavailable or busy; cleanup did not run. Retry after the current operation finishes or repair the private policy-lock directory.";
     }
     try {
+        phase = "daemon inspection";
+        phaseStartedAt = Date.now();
         const daemon = await inspectManagedSessionDaemon({
             cwd: options.cwd,
             headedManagedAutosaveInterval: options.headedManagedAutosaveInterval,
@@ -170,6 +178,8 @@ export async function closeManagedSession(options) {
         const daemonRestoreKey = options.restoreState.getDaemonRestoreKey(options.sessionName, options.namespace);
         const ownedRestoreKey = !options.restoreState.isDisabled(options.sessionName, options.namespace)
             && isManagedSessionRestoreKey(daemonRestoreKey) ? daemonRestoreKey : null;
+        phase = "native close";
+        phaseStartedAt = Date.now();
         const processResult = await runAgentBrowserProcess({
             args: closeArgs,
             cwd: options.cwd,
@@ -179,6 +189,7 @@ export async function closeManagedSession(options) {
             preserveAttachedBrowserSession: options.preserveAttachedBrowserSession,
             signal: controller.signal,
         });
+        clearTimeout(timer);
         stdoutSpillPath = processResult.stdoutSpillPath;
         if (!processResult.aborted && !processResult.spawnError && processResult.exitCode === 0) {
             const parsed = await parseAgentBrowserEnvelope({ stdout: processResult.stdout, stdoutPath: processResult.stdoutSpillPath });
@@ -191,7 +202,7 @@ export async function closeManagedSession(options) {
                 statePath: typeof data?.statePath === "string" ? data.statePath : undefined,
             });
         }
-        return getAgentBrowserErrorText({
+        return timeoutError ?? getAgentBrowserErrorText({
             aborted: processResult.aborted,
             command: "close",
             effectiveArgs: redactInvocationArgs(closeArgs),
@@ -204,7 +215,7 @@ export async function closeManagedSession(options) {
         });
     }
     catch (error) {
-        return error instanceof Error ? error.message : String(error);
+        return timeoutError ?? (error instanceof Error ? error.message : String(error));
     }
     finally {
         clearTimeout(timer);

package/dist/extensions/agent-browser/lib/orchestration/browser-run/prepare/snapshot-filter.js

@@ -13,6 +13,9 @@ function parseSnapshotFilterRequest(commandTokens) {
     let search;
     for (let index = 0; index < commandTokens.length; index += 1) {
         const token = commandTokens[index];
+        // Wrapper filters need a full native tree, not a revision-relative patch.
+        if (token === "--delta" || token === "--full")
+            continue;
         if (token === "--viewport")
             continue;
         if (token === "--diff")

package/dist/extensions/agent-browser/lib/orchestration/browser-run/prepare.js

@@ -2,7 +2,9 @@ import { copyFile, mkdir } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { extractExplicitSessionName, getBooleanFlagValue, isUpstreamEnvFlagEnabled, projectUpstreamGlobalFlags, resolveAgentBrowserNamespace } from "../../argv-grammar.js";
 import { isCloseCommand } from "../../command-taxonomy.js";
-import { isBrowserIndependentRead } from "../../command-policy.js";
+import { isBrowserIndependentRead, needsManagedSession } from "../../command-policy.js";
+import { parseArgvDescriptor } from "../../argv-descriptor.js";
+import { prepareAgentBrowserSpawnArgs, withChromeStartupArgs } from "../../process.js";
 import { cleanupElectronLaunchResources } from "../../electron/cleanup.js";
 import { launchElectronApp } from "../../electron/launch.js";
 import { pathExists } from "../../fs-utils.js";
@@ -22,7 +24,7 @@ import { buildExecutionPlan, canUseHeadlessCompatibilityUserAgent, createFreshSe
 import { buildOwnedManagedSessionRestoreContext, resolveExplicitAutosaveInterval, withOwnedManagedSessionContext, } from "../../managed-session-restore.js";
 import { getAgentBrowserProcessEnvironment } from "../../process-environment.js";
 import { getExplicitSessionPageVerificationRequirement, getPageTargetValidationError, } from "../../page-target-validation.js";
-import { acquireOwnedManagedSessionDaemonPolicy, getRunningHeadedAutosavePolicyChangeError } from "./managed-session-daemon-policy.js";
+import { acquireOwnedManagedSessionDaemonPolicy, getRunningHeadedAutosavePolicyChangeError, inspectManagedSessionDaemon } from "./managed-session-daemon-policy.js";
 import { buildManagedSessionOutcome, buildSessionDetailFields, buildStaleRefPreflight, getSessionContextKey, findElectronLaunchRecordForSession, extractStringResultField, ensureSessionTabTarget, getGuardedRefUsage, getTraceOwnerGuardMessage, runSessionCommandData, shouldPinSessionTabForCommand, } from "./session-state.js";
 import { getUpstreamEffectiveBatchSteps, parseBatchStdinJsonArray } from "../batch-stdin.js";
 import { buildElectronHostFailureResult, formatAgentBrowserNextActionsText, getElectronLaunchFailureCategory, redactRecoveryHint } from "./final-result.js";
@@ -170,6 +172,8 @@ export async function prepareAgentBrowserArgs(args, stdin, cwd) {
 }
 async function repairScreenshotData(options) {
     const { cwd, data, request } = options;
+    if (data.changed === false)
+        return { data };
     const reportedPath = typeof data.path === "string" ? data.path : undefined;
     const reportedAbsolutePath = reportedPath ? resolve(cwd, reportedPath) : undefined;
     let status = await pathExists(request.absolutePath) ? "saved" : "missing";
@@ -551,7 +555,16 @@ export async function prepareBrowserRun(options) {
                 };
             }
         }
-        return await withOwnedManagedSessionContext(ownedManagedSession, async () => {
+        let chromeStartupArgs;
+        if (options.input.chromeStartupArgs !== undefined && !options.preserveAttachedBrowserSession && !browserIndependent
+            && !executionPlan.validationError && !isCloseCommand(executionPlan.commandInfo.command)
+            && needsManagedSession(parseArgvDescriptor(preparedArgs.args), runtimeToolStdin)) {
+            const inactive = ownedManagedSession ? managedSessionDaemonInactive : options.daemonInactive
+                ?? (executionPlan.sessionName !== undefined && (await inspectManagedSessionDaemon({ cwd, signal, sessionName: executionPlan.sessionName, namespace: executionPlan.namespace })).status === "inactive");
+            if (inactive || options.input.configuredChromeLaunch)
+                chromeStartupArgs = options.input.chromeStartupArgs;
+        }
+        return await withChromeStartupArgs(chromeStartupArgs, () => withOwnedManagedSessionContext(ownedManagedSession, async () => {
             const managedSessionRestoreDisabled = () => state.managedSessionRestoreState.isDisabled(executionPlan.sessionName, executionPlan.namespace);
             const sessionStateKey = getSessionContextKey(executionPlan.sessionName, executionPlan.namespace);
             const priorSessionPageState = sessionPageState.get(sessionStateKey);
@@ -737,7 +750,7 @@ export async function prepareBrowserRun(options) {
                 requirement: livePageRequirement,
                 stdin: runtimeToolStdin,
             });
-            const redactedEffectiveArgs = redactInvocationArgs(executionPlan.effectiveArgs);
+            const redactedEffectiveArgs = redactInvocationArgs(prepareAgentBrowserSpawnArgs(executionPlan.effectiveArgs, undefined, options.preserveAttachedBrowserSession, chromeStartupArgs));
             const redactedRecoveryHint = redactRecoveryHint(executionPlan.recoveryHint);
             const compatibilityWorkaround = executionPlan.compatibilityWorkaround;
             const statePatch = executionPlan.managedSessionName === freshSessionName
@@ -1022,7 +1035,7 @@ export async function prepareBrowserRun(options) {
                 catch { }
             }
             const processTimeoutMs = options.params.timeoutMs ?? getDialogAwareProcessTimeoutMs(commandTokens, promptRefSnapshot, processStdin) ?? getCommandAwareProcessTimeoutMs(commandTokens, processStdin, readTimeoutPageUrl);
-            const redactedProcessArgs = redactInvocationArgs(processArgs);
+            const redactedProcessArgs = redactInvocationArgs(prepareAgentBrowserSpawnArgs(processArgs, ownedManagedSession?.compatibilityUserAgent, options.preserveAttachedBrowserSession, chromeStartupArgs));
             const scrollAmount = Number(commandTokens.find((token) => /^\d+(?:\.\d+)?$/.test(token)));
             const shouldProbeScrollNoop = executionPlan.commandInfo.command === "scroll" && executionPlan.startupScopedFlags.length === 0 && (state.managedSessionActive || sessionMode === "fresh") && (!Number.isFinite(scrollAmount) || scrollAmount >= 500);
             const scrollPositionBefore = shouldProbeScrollNoop
@@ -1043,6 +1056,7 @@ export async function prepareBrowserRun(options) {
             return {
                 kind: "ready",
                 prepared: {
+                    chromeStartupArgs,
                     commandTokens,
                     headedLaunch,
                     providerLaunch,
@@ -1091,7 +1105,7 @@ export async function prepareBrowserRun(options) {
                     userRequestedJson,
                 },
             };
-        });
+        }));
     }
     finally {
         if (!managedSessionPolicyLockTransferred)