pi-agent-browser-native 0.6.15 → 0.6.17

package/dist/extensions/agent-browser/lib/command-taxonomy.js

@@ -316,9 +316,9 @@ export function isSessionTabPinningExcludedCommand(command) {
 export function isSessionTabPostCommandCorrectionExcludedCommand(command) {
     return hasCommandCapability(command, "excludedFromPostCommandCorrection");
 }
-export function getRecordCommandOperands(tokens) {
+export function getRecordCommandOperandIndices(tokens) {
     if (tokens[0] !== "record" || !["start", "restart"].includes(tokens[1] ?? ""))
-        return {};
+        return [];
     const operands = [];
     for (let index = 2; index < tokens.length && operands.length < 2; index += 1) {
         // Native validates the range; bare/non-numeric --fps keeps its old literal meaning.
@@ -329,9 +329,13 @@ export function getRecordCommandOperands(tokens) {
         else if (tokens[index] === "--contact-sheet-threshold" && tokens[index + 1] !== undefined)
             index += 1;
         else
-            operands.push(tokens[index]);
+            operands.push(index);
     }
-    return operands.length > 0 ? { path: operands[0], url: operands[1] } : { path: tokens[2], url: tokens[3] };
+    return operands.length > 0 ? operands : [2, 3];
+}
+export function getRecordCommandOperands(tokens) {
+    const [path, url] = getRecordCommandOperandIndices(tokens);
+    return path === undefined ? {} : { path: tokens[path], url: url === undefined ? undefined : tokens[url] };
 }
 /** Starts conservatively invalidate refs because older supported natives replace the page, even on failure. Restarts invalidate only when they have a URL. */
 export function isRecordPageTransitionCommand(tokens) {

package/dist/extensions/agent-browser/lib/electron/cleanup.js

@@ -1,5 +1,6 @@
 import { execFile } from "node:child_process";
 import { lstat, rm } from "node:fs/promises";
+import { win32 } from "node:path";
 import { promisify } from "node:util";
 import { fetchCdpJson, parseCdpTargets, parseCdpVersion } from "./cdp.js";
 import { ELECTRON_PROFILE_DIR_PREFIX } from "./launch.js";
@@ -53,21 +54,35 @@ export async function inspectElectronLaunchStatus(record, signal) {
         version: cdp.version,
     };
 }
+function hasProcessExited(child, pid) {
+    // A Windows PID probe can report ESRCH during termination, before the
+    // tracked process has exited and released its executable/resources.
+    return child ? child.exitCode !== null || child.signalCode !== null : isPidAlive(pid) === false;
+}
 async function waitForProcessExit(child, pid, deadlineMs) {
     while (Date.now() <= deadlineMs) {
-        if (child && (child.exitCode !== null || child.signalCode !== null))
-            return true;
-        if (isPidAlive(pid) === false)
+        if (hasProcessExited(child, pid))
             return true;
         await sleep(ELECTRON_CLEANUP_POLL_INTERVAL_MS);
     }
-    return isPidAlive(pid) === false;
+    return hasProcessExited(child, pid);
 }
 async function readPidCommandLine(pid) {
     if (!pid || !Number.isSafeInteger(pid) || pid <= 0)
         return undefined;
     try {
-        const { stdout } = await execFileAsync("ps", ["-ww", "-p", String(pid), "-o", "command="], {
+        // Win32_Process.CommandLine is the native ownership evidence; process
+        // start time (used by daemon-policy locks) cannot prove profile ownership.
+        const systemRoot = process.env.SystemRoot;
+        const windowsRoot = systemRoot && win32.isAbsolute(systemRoot) ? systemRoot : "C:\\Windows";
+        const file = process.platform === "win32"
+            ? win32.join(windowsRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe")
+            : "ps";
+        const args = process.platform === "win32"
+            ? ["-NoProfile", "-NonInteractive", "-Command",
+                `[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new(); $p = [wmi]"Win32_Process.Handle='${pid}'"; [Console]::WriteLine($p.CommandLine)`]
+            : ["-ww", "-p", String(pid), "-o", "command="];
+        const { stdout } = await execFileAsync(file, args, {
             timeout: RESTORED_PROCESS_COMMAND_TIMEOUT_MS,
         });
         return stdout.trim() || undefined;
@@ -117,7 +132,7 @@ function signalRestoredLaunchProcess(record, signal) {
 async function cleanupProcess(record, child, deadlineMs) {
     if (!record.pid)
         return { resource: "process", state: "skipped" };
-    if (isPidAlive(record.pid) === false)
+    if (hasProcessExited(child, record.pid))
         return { resource: "process", state: "already-gone" };
     if (!child) {
         const verificationError = await getRestoredProcessVerificationError(record);

package/dist/extensions/agent-browser/lib/execution-cwd.js

@@ -0,0 +1,64 @@
+import { readFileSync, statSync } from "node:fs";
+import { dirname, isAbsolute, join } from "node:path";
+import { isRecord } from "./parsing.js";
+import { getAgentBrowserSessionIdentityKey } from "./argv-grammar.js";
+function isDirectoryOwner(source) {
+    if (/^(?:npm:pi-change-working-dir|git:github\.com\/fitchmultz\/pi-change-working-dir(?:\.git)?)(?:@.+)?$/.test(source.source))
+        return true;
+    const directories = [source.baseDir, isAbsolute(source.path) ? dirname(source.path) : undefined];
+    return directories.some(directory => {
+        if (!directory || !isAbsolute(directory))
+            return false;
+        try {
+            return JSON.parse(readFileSync(join(directory, "package.json"), "utf8")).name === "pi-change-working-dir";
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/** The synchronous owner reply is captured before any browser policy, queue, or child await. */
+export function resolveExecutionCwd(pi, ctx) {
+    const request = { sessionManager: ctx.sessionManager };
+    pi.events.emit("pi-change-working-dir:resolve-execution-cwd", request);
+    const result = request.result;
+    if (result !== undefined) {
+        const invalid = "pi-change-working-dir returned an invalid execution directory. Update the extension and restart Pi.";
+        if (!isRecord(result) || Array.isArray(result))
+            throw new Error(invalid);
+        if (result.error !== undefined)
+            throw new Error(typeof result.error === "string" && result.error.length > 0 ? result.error : invalid);
+        if (typeof result.cwd !== "string" || !isAbsolute(result.cwd) || result.cwd.includes("\0"))
+            throw new Error(invalid);
+        return result.cwd;
+    }
+    if (pi.getAllTools().some(tool => tool.name === "change_dir" && isDirectoryOwner(tool.sourceInfo))
+        || pi.getCommands().some(command => /^cwd(?::\d+)?$/.test(command.name) && isDirectoryOwner(command.sourceInfo))) {
+        throw new Error("Update pi-change-working-dir and restart Pi to use agent_browser with the selected working directory.");
+    }
+    return ctx.cwd;
+}
+export function getBrowserCwdError(cwd) {
+    try {
+        if (statSync(cwd).isDirectory())
+            return undefined;
+    }
+    catch (error) {
+        if (!["ENOENT", "ENOTDIR"].includes(error.code ?? ""))
+            throw error;
+    }
+    return `Browser launch directory is unavailable: ${cwd}. Restore that directory, or explicitly use sessionMode: "fresh" without --session, or --config from the selected execution directory. The existing browser was left untouched.`;
+}
+export function restoreManagedSessionCwd(branch, sessionName, namespace, fallback) {
+    const key = getAgentBrowserSessionIdentityKey(sessionName, namespace);
+    for (const entry of [...branch].reverse()) {
+        if (!isRecord(entry) || entry.type !== "message" || !isRecord(entry.message) || entry.message.toolName !== "agent_browser")
+            continue;
+        const details = entry.message.details;
+        if (!isRecord(details) || typeof details.sessionName !== "string" || typeof details.managedSessionCwd !== "string" || !isAbsolute(details.managedSessionCwd))
+            continue;
+        if (getAgentBrowserSessionIdentityKey(details.sessionName, typeof details.namespace === "string" ? details.namespace : undefined) === key)
+            return details.managedSessionCwd;
+    }
+    return fallback;
+}

package/dist/extensions/agent-browser/lib/input-modes/lookups.js

@@ -232,7 +232,7 @@ export async function analyzeSourceLookupResults(data, compiled, cwd, context) {
     const electronContext = status === "no-candidates" ? context?.electronContext : undefined;
     const workspaceRoot = context?.workspaceRoot ?? cwd;
     if (electronContext) {
-        limitations.push(`Workspace source scan is limited to the Pi tool session cwd: ${workspaceRoot}.`, "Packaged Electron app code may live inside installed app resources or app.asar outside the workspace; the wrapper does not unpack asar files or scan app bundle resources.");
+        limitations.push(`Workspace source scan is limited to the captured execution directory: ${workspaceRoot}.`, "Packaged Electron app code may live inside installed app resources or app.asar outside the workspace; the wrapper does not unpack asar files or scan app bundle resources.");
     }
     return {
         candidates,

package/dist/extensions/agent-browser/lib/managed-session-policy-lock.js

@@ -164,16 +164,29 @@ async function ownerAlive(owner) {
     const current = await readProcessStartIdentity(owner.pid);
     return current === undefined ? undefined : processStartIdentitiesMatch(owner.startIdentity, current);
 }
-async function removeClaimOwnedBy(path, token) {
-    const current = await readClaim(path);
-    if (current?.owner.token !== token)
-        return false;
+async function removeClaimOwnedBy(path, token, deadline = 0) {
     const movedPath = join(dirname(path), `.pi-agent-browser-policy-remove-${token}-${randomUUID()}`);
-    try {
-        await rename(path, movedPath);
-    }
-    catch (error) {
-        return error.code === "ENOENT";
+    while (true) {
+        const current = await readClaim(path);
+        if (current?.owner.token !== token)
+            return false;
+        try {
+            await rename(path, movedPath);
+            break;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === "ENOENT")
+                return true;
+            // Windows may refuse a directory move while a contender reads its
+            // metadata. Revalidate before retrying. Owned-claim cleanup gets
+            // its own bounded window, independent of the acquisition wait.
+            if (process.platform !== "win32" || code !== "EPERM" || Date.now() >= deadline)
+                return false;
+            await waitForRetry();
+            if (Date.now() >= deadline)
+                return false;
+        }
     }
     const moved = await readClaim(movedPath);
     if (moved?.owner.token !== token) {
@@ -209,6 +222,12 @@ function claimPrecedes(left, right) {
         return false;
     return left.ticket < right.ticket || (left.ticket === right.ticket && left.owner.token < right.owner.token);
 }
+async function hasPublishedLaterTicket(claim, ownClaim) {
+    if (claim.ticket !== null)
+        return false;
+    const current = await readClaim(claim.path);
+    return current?.owner.token === claim.owner.token && !claimPrecedes(current, ownClaim);
+}
 function waitForRetry(signal) {
     return new Promise((resolve) => {
         if (signal?.aborted)
@@ -266,18 +285,35 @@ export async function acquireManagedSessionPolicyLock(options) {
             for (const claim of claims) {
                 if (claim.owner.token === token || !claimPrecedes(claim, ownClaim))
                     continue;
+                // Choosing is transient: a later published ticket must not make
+                // its predecessor wait on it using an earlier null snapshot.
+                if (await hasPublishedLaterTicket(claim, ownClaim))
+                    continue;
                 const alive = await ownerAlive(claim.owner);
                 if (alive === false) {
                     await removeClaimOwnedBy(claim.path, claim.owner.token);
                     continue;
                 }
+                // A native identity query can outlive the owner's entire critical
+                // section. Its result (including unknown after exit) does not make
+                // an already released immutable claim a current blocker.
+                try {
+                    await lstat(claim.path);
+                }
+                catch (error) {
+                    if (error.code === "ENOENT")
+                        continue;
+                }
+                // Publication can also complete during the native identity query.
+                if (await hasPublishedLaterTicket(claim, ownClaim))
+                    continue;
                 blocked = true;
                 break;
             }
             if (!blocked) {
                 await cleanDeadPolicyArtifacts(directory);
                 lockAcquired = true;
-                return { release: async () => { await removeClaimOwnedBy(claimPath, token); } };
+                return { release: async () => { await removeClaimOwnedBy(claimPath, token, Date.now() + POLICY_LOCK_WAIT_MS); } };
             }
             if (Date.now() >= deadline)
                 return undefined;
@@ -291,6 +327,6 @@ export async function acquireManagedSessionPolicyLock(options) {
     finally {
         await rm(candidatePath, { force: true, recursive: true }).catch(() => undefined);
         if (claimPublished && !lockAcquired)
-            await removeClaimOwnedBy(claimPath, token);
+            await removeClaimOwnedBy(claimPath, token, Date.now() + POLICY_LOCK_WAIT_MS);
     }
 }

package/dist/extensions/agent-browser/lib/orchestration/browser-run/artifact-paths.js

@@ -2,7 +2,7 @@ import { lstatSync, readlinkSync, realpathSync, statSync } from "node:fs";
 import { basename, dirname, extname, join, resolve } from "node:path";
 import { foldAgentBrowserFilesystemIdentity } from "../../argv-grammar.js";
 import { parseWaitCommandTokens } from "../../argv-descriptor.js";
-import { getRecordCommandOperands } from "../../command-taxonomy.js";
+import { getRecordCommandOperandIndices, getRecordCommandOperands } from "../../command-taxonomy.js";
 const SCREENSHOT_IMAGE_EXTENSIONS = [".jpeg", ".jpg", ".png", ".webp"];
 function isSingleScreenshotPathToken(token) {
     const explicitlyRelative = token.startsWith("./") || token.startsWith("../");
@@ -38,20 +38,25 @@ export function getScreenshotPathTokenIndex(commandTokens) {
     return undefined;
 }
 const DIFF_SCREENSHOT_VALUE_FLAGS = new Set(["-b", "--baseline", "-o", "--output", "-s", "--selector", "-t", "--threshold"]);
-function getDiffScreenshotOutputPath(commandTokens) {
-    let outputPath;
+export function getDiffFilePathIndices(commandTokens) {
+    if (commandTokens[0] !== "diff" || !["snapshot", "screenshot"].includes(commandTokens[1]))
+        return {};
+    const valueFlags = commandTokens[1] === "screenshot" ? DIFF_SCREENSHOT_VALUE_FLAGS : new Set(["-b", "--baseline", "-s", "--selector", "-d", "--depth"]);
+    const paths = {};
     for (let index = 2; index < commandTokens.length; index += 1) {
         const token = commandTokens[index];
-        if (!DIFF_SCREENSHOT_VALUE_FLAGS.has(token))
+        if (!valueFlags.has(token))
             continue;
         const value = commandTokens[index + 1];
         if (value === undefined)
-            return undefined;
+            return {};
         if (token === "-o" || token === "--output")
-            outputPath = value;
+            paths.output = index + 1;
+        if (token === "-b" || token === "--baseline")
+            paths.baseline = index + 1;
         index += 1;
     }
-    return outputPath;
+    return paths;
 }
 function canonicalizeArtifactPath(absolutePath, platform, seenSymlinks) {
     let cursor = absolutePath;
@@ -102,28 +107,30 @@ export function getRecordContactSheetDestination(commandTokens) {
     const extension = extname(path);
     return extension ? `${path.slice(0, -extension.length)}.contact-sheet.png` : undefined;
 }
-export function getExplicitArtifactDestination(commandTokens) {
+export function getExplicitArtifactDestinationIndex(commandTokens) {
     const command = commandTokens[0];
     const subcommand = commandTokens[1];
-    if (command === "screenshot") {
-        const index = getScreenshotPathTokenIndex(commandTokens);
-        return index === undefined ? undefined : commandTokens[index];
-    }
+    if (command === "screenshot")
+        return getScreenshotPathTokenIndex(commandTokens);
     if (command === "download")
-        return commandTokens[2];
+        return 2;
     if (command === "pdf")
-        return commandTokens[1];
+        return 1;
     if (command === "wait")
-        return parseWaitCommandTokens(commandTokens).downloadPath;
+        return parseWaitCommandTokens(commandTokens).downloadPathIndex;
     if (command === "state" && subcommand === "save")
-        return commandTokens[2];
+        return 2;
     if (command === "diff" && subcommand === "screenshot")
-        return getDiffScreenshotOutputPath(commandTokens);
+        return getDiffFilePathIndices(commandTokens).output;
     if (command === "network" && subcommand === "har" && commandTokens[2] === "stop")
-        return commandTokens[3];
+        return 3;
     if ((command === "trace" || command === "profiler") && subcommand === "stop")
-        return commandTokens[2];
+        return 2;
     if (command === "record")
-        return getRecordCommandOperands(commandTokens).path;
+        return getRecordCommandOperandIndices(commandTokens)[0];
     return undefined;
 }
+export function getExplicitArtifactDestination(commandTokens) {
+    const index = getExplicitArtifactDestinationIndex(commandTokens);
+    return index === undefined ? undefined : commandTokens[index];
+}

package/dist/extensions/agent-browser/lib/orchestration/browser-run/diagnostics.js

@@ -863,7 +863,7 @@ export async function collectTimeoutPartialProgress(options) {
     if ((options.commandTokens[0] === "session" && options.commandTokens[1] === "info") || isBrowserIndependentRead(options.commandTokens, options.stdin))
         return undefined;
     const rawSteps = getTimeoutProgressSteps(options.compiledJob, options.commandTokens, options.stdin);
-    const artifacts = await collectTimeoutArtifactEvidence(options.cwd, rawSteps);
+    const artifacts = await collectTimeoutArtifactEvidence(options.operationCwd ?? options.cwd, rawSteps);
     const urlData = await runSessionCommandData({ args: ["get", "url"], cwd: options.cwd, namespace: options.namespace, sessionName: options.sessionName });
     const recoveredUrl = extractStringResultField(urlData, "result") ?? extractStringResultField(urlData, "url");
     const titleData = recoveredUrl

package/dist/extensions/agent-browser/lib/orchestration/browser-run/process-output.js

@@ -147,6 +147,7 @@ function applyBatchNetworkRouteState(options) {
 }
 export async function processBrowserOutput(input) {
     const { ctx, cwd, electronPostCommandStatusSettleMs, implicitSessionCloseTimeoutMs, sessionPageStateUpdate, signal, state } = input;
+    const operationCwd = input.operationCwd ?? cwd;
     const { prepared, processResult } = input;
     const { electronChildProcesses, electronLaunchRecords, sessionPageState, traceOwners } = state;
     let artifactManifest = state.artifactManifest;
@@ -395,7 +396,7 @@ export async function processBrowserOutput(input) {
         let fillVerificationDiagnostic;
         let selectorTextVisibilityDiagnostics = [];
         let electronBroadGetTextScopeDiagnostics = [];
-        const timeoutPartialProgress = processResult.timedOut && !recordingStopRecovery && !prepared.readConfirmation ? await collectTimeoutPartialProgress({ commandTokens: prepared.commandTokens, compiledJob: prepared.compiledJob, cwd, namespace: prepared.executionPlan.namespace, sessionName: prepared.executionPlan.sessionName, stdin: prepared.runtimeToolStdin }) : undefined;
+        const timeoutPartialProgress = processResult.timedOut && !recordingStopRecovery && !prepared.readConfirmation ? await collectTimeoutPartialProgress({ commandTokens: prepared.commandTokens, compiledJob: prepared.compiledJob, cwd, operationCwd: input.operationCwd, namespace: prepared.executionPlan.namespace, sessionName: prepared.executionPlan.sessionName, stdin: prepared.runtimeToolStdin }) : undefined;
         if (!currentSessionTabTarget && timeoutPartialProgress?.currentPage?.source === "live") {
             currentSessionTabTarget = normalizeSessionTabTarget(timeoutPartialProgress.currentPage);
         }
@@ -574,7 +575,8 @@ export async function processBrowserOutput(input) {
         }
         let managedSessionOutcome = buildManagedSessionOutcome({ activeAfter: managedSessionActive, activeBefore: priorManagedSessionActive, attemptedSessionName: managedCloseSessionName, command: commandClosesSession ? "close" : prepared.executionPlan.commandInfo.command, currentSessionName: managedSessionName, currentSessionNamespace: managedSessionNamespace, previousSessionName: priorManagedSessionName, replacedSessionName: replacedManagedSessionName, replacedSessionNamespace: priorManagedSessionNamespace, sessionMode: prepared.sessionMode, succeeded: managedTransitionSucceeded });
         if (prepared.executionPlan.managedSessionName && managedTransitionSucceeded && managedSessionActive) {
-            managedSessionCwd = cwd;
+            if (!priorManagedSessionActive || replacedManagedSessionName)
+                managedSessionCwd = cwd;
             managedSessionNamespace = prepared.executionPlan.namespace;
         }
         if (sessionStateKey && succeeded) {
@@ -681,7 +683,7 @@ export async function processBrowserOutput(input) {
         }
         if (plainTextUpgrade && errorText)
             presentationEnvelope = { ...presentationEnvelope, success: false, error: errorText };
-        let presentation = plainTextInspection ? { artifacts: undefined, batchFailure: undefined, batchSteps: undefined, content: [{ type: "text", text: inspectionText ?? "" }], data: undefined, fullOutputPath: undefined, fullOutputPaths: undefined, imagePath: undefined, imagePaths: undefined, savedFile: undefined, savedFilePath: undefined, summary: `${prepared.redactedArgs.join(" ")} completed` } : recordingStopRecovery && !recordingStopRecovery.batch ? recordingStopRecovery.presentation : await buildToolPresentation({ args: prepared.redactedProcessArgs, artifactManifest, artifactMaxUpdatedAtMs: Date.now(), artifactMinUpdatedAtMs: input.artifactRunStartedAtMs, artifactRequest: screenshotArtifactRequest, batchArtifactRequests: batchScreenshotArtifactRequests, commandInfo: prepared.executionPlan.commandInfo, compiledSemanticAction: prepared.compiledSemanticAction, cwd, envelope: presentationEnvelope, errorText, namespace: prepared.executionPlan.namespace, networkRouteDiagnostics, networkRoutes: activeNetworkRoutes, persistentArtifactStore, previousRecordingContactSheetPath: sessionStateKey ? state.activeRecordingReservations?.get(sessionStateKey)?.contactSheetPath : undefined, piCleanupOwnership: sessionStateKey && (state.ownedManagedSessions.has(sessionStateKey) || prepared.executionPlan.managedSessionName !== undefined) ? "wrapper-managed" : "caller-owned", sessionName: prepared.executionPlan.sessionName });
+        let presentation = plainTextInspection ? { artifacts: undefined, batchFailure: undefined, batchSteps: undefined, content: [{ type: "text", text: inspectionText ?? "" }], data: undefined, fullOutputPath: undefined, fullOutputPaths: undefined, imagePath: undefined, imagePaths: undefined, savedFile: undefined, savedFilePath: undefined, summary: `${prepared.redactedArgs.join(" ")} completed` } : recordingStopRecovery && !recordingStopRecovery.batch ? recordingStopRecovery.presentation : await buildToolPresentation({ args: prepared.redactedProcessArgs, artifactManifest, artifactMaxUpdatedAtMs: Date.now(), artifactMinUpdatedAtMs: input.artifactRunStartedAtMs, artifactRequest: screenshotArtifactRequest, batchArtifactRequests: batchScreenshotArtifactRequests, commandInfo: prepared.executionPlan.commandInfo, compiledSemanticAction: prepared.compiledSemanticAction, cwd: operationCwd, envelope: presentationEnvelope, errorText, namespace: prepared.executionPlan.namespace, networkRouteDiagnostics, networkRoutes: activeNetworkRoutes, persistentArtifactStore, previousRecordingContactSheetPath: sessionStateKey ? state.activeRecordingReservations?.get(sessionStateKey)?.contactSheetPath : undefined, piCleanupOwnership: sessionStateKey && (state.ownedManagedSessions.has(sessionStateKey) || prepared.executionPlan.managedSessionName !== undefined) ? "wrapper-managed" : "caller-owned", sessionName: prepared.executionPlan.sessionName });
         if (recordingStopRecovery)
             presentation = mergeRecordingRecoveryPresentation(presentation, recordingStopRecovery);
         const confirmation = readConfirmationEvent ?? prepared.readConfirmation;
@@ -745,8 +747,8 @@ export async function processBrowserOutput(input) {
             ? await collectQaAttachedTarget({ currentTarget: currentSessionTabTarget ?? prepared.priorSessionTabTarget, cwd, namespace: prepared.executionPlan.namespace, sessionName: prepared.executionPlan.sessionName, signal })
             : undefined;
         const sourceLookupElectronContext = prepared.compiledSourceLookup ? getSourceLookupElectronContext({ currentTarget: currentSessionTabTarget, electronLaunchRecords, namespace: prepared.executionPlan.namespace, priorTarget: prepared.priorSessionTabTarget, sessionName: prepared.executionPlan.sessionName }) : undefined;
-        const sourceLookup = prepared.compiledSourceLookup ? await analyzeSourceLookupResults(presentationEnvelope?.data, prepared.compiledSourceLookup, cwd, { electronContext: sourceLookupElectronContext, workspaceRoot: cwd }) : undefined;
-        const networkSourceLookup = prepared.compiledNetworkSourceLookup ? redactNetworkSourceLookupAnalysis(await analyzeNetworkSourceLookupResults(presentationEnvelope?.data, prepared.compiledNetworkSourceLookup, cwd)) : undefined;
+        const sourceLookup = prepared.compiledSourceLookup ? await analyzeSourceLookupResults(presentationEnvelope?.data, prepared.compiledSourceLookup, operationCwd, { electronContext: sourceLookupElectronContext, workspaceRoot: operationCwd }) : undefined;
+        const networkSourceLookup = prepared.compiledNetworkSourceLookup ? redactNetworkSourceLookupAnalysis(await analyzeNetworkSourceLookupResults(presentationEnvelope?.data, prepared.compiledNetworkSourceLookup, operationCwd)) : undefined;
         if (networkSourceLookup && presentation.content[0]?.type === "text")
             presentation.content[0] = { ...presentation.content[0], text: `${networkSourceLookup.summary}\n\n${presentation.content[0].text}` };
         else if (networkSourceLookup)

package/dist/extensions/agent-browser/lib/orchestration/operation-paths.js

@@ -0,0 +1,76 @@
+import { isAbsolute, resolve } from "node:path";
+import { projectUpstreamGlobalFlags, scanUpstreamGlobalFlagOccurrences } from "../argv-grammar.js";
+import { getDiffFilePathIndices, getExplicitArtifactDestinationIndex } from "./browser-run/artifact-paths.js";
+import { parseBatchCommandArgument, parseUserBatchStdin } from "./batch-stdin.js";
+/** Bind caller file operands without moving the native process/config or interpreting literal form data. */
+export function resolveOperationPaths(args, stdin, cwd, batchStep = false) {
+    let resolved = args;
+    const setPath = (index, prefix = "") => {
+        const path = index === undefined ? undefined : args[index]?.slice(prefix.length);
+        if (index === undefined || !path || isAbsolute(path))
+            return;
+        if (resolved === args)
+            resolved = [...args];
+        resolved[index] = prefix + resolve(cwd, path);
+    };
+    const { tokens, indices } = batchStep ? { tokens: args, indices: args.map((_, index) => index) } : projectUpstreamGlobalFlags(args);
+    if (!batchStep) {
+        for (const flag of ["--config", "--ca-cert", "--executable-path", "--extension", "--init-script", "--download-path", "--screenshot-dir", "--action-policy", "--state"]) {
+            for (const occurrence of scanUpstreamGlobalFlagOccurrences(args, flag)) {
+                if (flag === "--state" && tokens[0] === "wait" && occurrence.index > indices[0])
+                    continue;
+                setPath(occurrence.index + 1);
+            }
+        }
+        for (const occurrence of scanUpstreamGlobalFlagOccurrences(args, "--profile")) {
+            // Native Chrome profile names are identities, not workspace file paths.
+            if (occurrence.value && /[\\/]/.test(occurrence.value) && !occurrence.value.startsWith("~"))
+                setPath(occurrence.index + 1);
+        }
+    }
+    if (tokens[0] === "batch") {
+        if (tokens.slice(1).some(token => token !== "--bail")) {
+            for (let index = 1; index < tokens.length; index++) {
+                if (tokens[index] === "--bail")
+                    continue;
+                const row = parseBatchCommandArgument(tokens[index]).step;
+                if (!row)
+                    continue;
+                const bound = resolveOperationPaths(row, undefined, cwd, true).args;
+                if (bound === row)
+                    continue;
+                if (resolved === args)
+                    resolved = [...args];
+                resolved[indices[index]] = bound.map(token => `'${token.replaceAll("'", "'\\''")}'`).join(" ");
+            }
+            return { args: resolved, stdin }; // Native ignores stdin when raw rows exist.
+        }
+        const rows = parseUserBatchStdin(stdin).steps;
+        if (!rows?.length)
+            return { args: resolved, stdin };
+        const bound = rows.map(row => resolveOperationPaths(row, undefined, cwd, true).args);
+        return { args: resolved, stdin: bound.some((row, index) => row !== rows[index]) ? JSON.stringify(bound) : stdin };
+    }
+    setPath(indices[getExplicitArtifactDestinationIndex(tokens) ?? -1]);
+    if (tokens[0] === "upload")
+        for (let index = 2; index < tokens.length; index++)
+            setPath(indices[index]);
+    if (tokens[0] === "state" && tokens[1] === "load")
+        setPath(indices[2]);
+    setPath(indices[getDiffFilePathIndices(tokens).baseline ?? -1]);
+    if (tokens[0] === "cookies" && tokens[1] === "set") {
+        const index = tokens.indexOf("--curl");
+        if (index >= 0)
+            setPath(indices[index + 1]);
+    }
+    if (tokens[0] === "webmcp" && tokens[1] === "invoke") {
+        for (let index = 3; index < tokens.length; index++) {
+            if (!["--params", "--frame", "--timeout"].includes(tokens[index]))
+                continue;
+            if (tokens[index] === "--params" && tokens[index + 1]?.startsWith("@"))
+                setPath(indices[index + 1], "@");
+            index++;
+        }
+    }
+    return { args: resolved, stdin };
+}

package/dist/extensions/agent-browser/lib/process-identity.js

@@ -1,7 +1,8 @@
 import { execFile } from "node:child_process";
 import { dirname, join, win32 } from "node:path";
 const WINDOWS_PROCESS_START_IDENTITY_PREFIX = "win32-powershell-ticks-v1:";
-const PROCESS_START_IDENTITY_TIMEOUT_MS = 5_000;
+// Native Windows PowerShell startup can exhaust the former five-second probe budget.
+const PROCESS_START_IDENTITY_TIMEOUT_MS = process.platform === "win32" ? 10_000 : 5_000;
 const DEFAULT_WINDOWS_SYSTEM_ROOT = "C:\\Windows";
 export function buildProcessStartIdentityCommand(pid, platform = process.platform) {
     if (!Number.isSafeInteger(pid) || pid <= 0)

package/dist/extensions/agent-browser/lib/process.js

@@ -11,6 +11,7 @@ import { getPageTargetValidationError, } from "./page-target-validation.js";
 import { getImplicitSessionIdleTimeoutMs } from "./runtime.js";
 import { getAgentBrowserProcessEnvironment } from "./process-environment.js";
 import { openSecureTempFile, writeSecureTempChunk } from "./temp.js";
+import { resolveWindowsStockLauncher } from "./windows-stock-launcher.js";
 const MAX_BUFFERED_STDOUT_BYTES = 512 * 1_024;
 const MAX_BUFFERED_STDERR_CHARS = 32_000;
 const MAX_BUFFERED_STDOUT_TAIL_CHARS = 32_000;
@@ -52,11 +53,17 @@ export function prepareAgentBrowserSpawnArgs(args, wrapperCompatibilityUserAgent
     normalized[occurrence.index + 1] = customArgs;
     return normalized;
 }
-function terminateSpawnedChild(child, signal) {
+async function terminateSpawnedChild(child, signal) {
     if (processPlatform === "win32" && child.pid) {
-        const killer = spawn("taskkill.exe", ["/PID", String(child.pid), "/T", "/F"], { stdio: "ignore" });
-        killer.on("error", () => undefined);
-        killer.unref();
+        // Keep the shell alive until taskkill has traversed its descendants, and
+        // observe the killer before allowing the browser call to finish.
+        const killed = await new Promise((resolve) => {
+            const killer = spawn("taskkill.exe", ["/PID", String(child.pid), "/T", "/F"], { stdio: "ignore" });
+            killer.once("error", () => resolve(false));
+            killer.once("close", (code) => resolve(code === 0));
+        });
+        if (killed)
+            return;
     }
     child.kill(signal);
 }
@@ -224,9 +231,29 @@ async function socketDirEntriesAreOwned(socketDir, uid, visited = { count: 0 })
     }
     return true;
 }
-export async function getAgentBrowserSocketDirValidationError(socketDir, uid = typeof process.getuid === "function" ? process.getuid() : undefined) {
+export async function getAgentBrowserSocketDirValidationError(socketDir, uid = typeof process.getuid === "function" ? process.getuid() : undefined, platform = processPlatform) {
     if (!isAbsolute(socketDir))
         return "the path is not absolute";
+    // Windows uses native ACLs and named pipes, not POSIX uid/mode metadata.
+    // Still require a real directory; never accept a file or a redirected root.
+    if (platform === "win32") {
+        try {
+            try {
+                await mkdir(socketDir);
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+            }
+            const metadata = await lstat(socketDir);
+            if (metadata.isSymbolicLink())
+                return "the directory is a symlink";
+            return metadata.isDirectory() ? undefined : "the path is not a directory";
+        }
+        catch (error) {
+            return `the directory could not be inspected (${error.code ?? "unknown error"})`;
+        }
+    }
     if (typeof uid !== "number")
         return "POSIX ownership metadata is unavailable";
     try {
@@ -378,6 +405,8 @@ export async function runAgentBrowserProcess(options) {
         }
         effectiveEnv = { ...effectiveEnv, [AGENT_BROWSER_SOCKET_DIR_ENV]: requestedSocketDir };
     }
+    const childEnv = buildAgentBrowserProcessEnv(parentEnv, effectiveEnv);
+    const stockLauncher = resolveWindowsStockLauncher(cwd, childEnv);
     if (signal?.aborted) {
         return { aborted: true, agentBrowserStarted: false, exitCode: 1, stderr: "", stdout: "", timedOut: false };
     }
@@ -395,6 +424,7 @@ export async function runAgentBrowserProcess(options) {
         let stdoutSpillPending = false;
         let pendingStdoutWrite = Promise.resolve();
         let stdoutSpillError;
+        let pendingTermination;
         let killTimer;
         let timeoutTimer;
         let abortListener;
@@ -444,15 +474,16 @@ export async function runAgentBrowserProcess(options) {
             if (settled)
                 return;
             settled = true;
+            removeAbortListener();
+            if (killTimer) {
+                clearTimeout(killTimer);
+            }
+            if (timeoutTimer) {
+                clearTimeout(timeoutTimer);
+            }
+            completionWatcher?.clear();
             void pendingStdoutWrite.finally(async () => {
-                removeAbortListener();
-                if (killTimer) {
-                    clearTimeout(killTimer);
-                }
-                if (timeoutTimer) {
-                    clearTimeout(timeoutTimer);
-                }
-                completionWatcher?.clear();
+                await pendingTermination;
                 if (stdoutSpillHandle) {
                     await stdoutSpillHandle.close().catch(() => undefined);
                 }
@@ -478,14 +509,13 @@ export async function runAgentBrowserProcess(options) {
                 });
             });
         };
-        const childEnv = buildAgentBrowserProcessEnv(parentEnv, effectiveEnv);
         const spawnPolicyError = getManagedPreSpawnPolicyError(managedSessionRestoreOptions, managedStateCurrentPageUrl, managedStatePageUrlUnknown, options.browserIndependentReadConfirmation);
         if (spawnPolicyError) {
             resolve({ aborted: false, agentBrowserStarted: false, exitCode: 1, spawnError: new Error(spawnPolicyError), stderr: "", stdout: "", timedOut: false });
             return;
         }
-        const spawnBrowser = processPlatform === "win32" ? crossSpawn : spawn;
-        const child = spawnBrowser("agent-browser", prepareAgentBrowserSpawnArgs(args, ownedManagedSessionCompatibilityEnv.AGENT_BROWSER_USER_AGENT, preserveAttachedBrowserSession, chromeStartupArgsContext.getStore()), {
+        const spawnBrowser = processPlatform === "win32" && !stockLauncher ? crossSpawn : spawn;
+        const child = spawnBrowser(stockLauncher ?? "agent-browser", prepareAgentBrowserSpawnArgs(args, ownedManagedSessionCompatibilityEnv.AGENT_BROWSER_USER_AGENT, preserveAttachedBrowserSession, chromeStartupArgsContext.getStore()), {
             cwd,
             env: childEnv,
             stdio: ["pipe", "pipe", "pipe"],
@@ -505,10 +535,16 @@ export async function runAgentBrowserProcess(options) {
             else {
                 timedOut = true;
             }
-            terminateSpawnedChild(child, "SIGTERM");
-            killTimer = setTimeout(() => {
-                terminateSpawnedChild(child, "SIGKILL");
-            }, 2_000);
+            if (pendingTermination)
+                return;
+            pendingTermination = terminateSpawnedChild(child, "SIGTERM");
+            // Windows taskkill already forces the entire tree. A concurrent direct
+            // kill would remove its root before traversal finishes.
+            if (processPlatform !== "win32") {
+                killTimer = setTimeout(() => {
+                    pendingTermination = terminateSpawnedChild(child, "SIGKILL");
+                }, 2_000);
+            }
         };
         const recordStdinError = (error) => {
             const stdinError = error instanceof Error ? error : new Error(String(error));

package/dist/extensions/agent-browser/lib/runtime.js

@@ -251,7 +251,7 @@ function redactBearerCredentials(text) {
             return match;
         return formatRedactedCredential(label, credential, trailing);
     })
-        .replace(/\b(Bearer)\s+([^\s"',)\[\]]+)([),.]?)/gi, (match, label, credential, trailing) => {
+        .replace(/\b(Bearer)\s+([^\s\\"',)\[\]]+)([),.]?)/gi, (match, label, credential, trailing) => {
         // Without a credential field/header, require a bearer-token shape, not prose, HTML or a URL.
         const token = credential.slice(0, credential.length - credentialTrailingPunctuation(credential).length);
         if (!/^[A-Za-z0-9._~+/-]+=*$/.test(token) || !/[0-9._~+/=-]/.test(token))