pi-agent-browser-native 0.6.7 → 0.6.9

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.6.9 - 2026-09-08
+
+### Fixed
+
+- Include redacted stdout/stderr tails in failed Electron startup diagnostics and visible errors (#128). Capture uses private regular files inside the isolated profile, with the last 4096 bytes read per stream; this is not a lifetime disk limit. Preserve the profile and logs when failed-startup process cleanup cannot finish, without changing normal quit cleanup.
+
+- Restore ordinary browser access to a tracked Electron app after Pi reload or resume by checking its live debug endpoint and the named upstream connection. Keep the app, profile, and session intact; unrelated or replaced connections still fail verification.
+
+### Validation
+
+- Verified startup output, reload continuity and quit cleanup with genuine Electron through the official Pi SDK on native macOS and Ubuntu. Native Windows was waived and not run; permanent release gates are unchanged.
+
+## 0.6.8 - 2026-09-07
+
+### Fixed
+
+- Add session- and namespace-aware `inspect-overlay-state` recovery for direct, semantic, raw `find` (including `nth` and default-click), and batched/job clicks that upstream rejects because another element covers the target's click point. These failures remain `upstream-error`; the wrapper recommends refreshing refs for inspection without retrying the blocked click or guessing a dismiss control. Thanks to @MDGChamomile for #147.
+
+- Replace Windows PowerShell argument forwarding with `cross-spawn` at the shared process boundary, preserving empty operands, literal doublequotes, the selected `PATH` shim and upstream architecture selection. Remove command reordering and the old empty-argument/namespace workarounds; POSIX keeps native Node `spawn`. Thanks to @MaartenDMT (#109) and @dagve11 (#134) for their reports and proposed fixes.
+
+### Documentation
+
+- Clarify that recording destinations are reserved within one Pi process; concurrent processes must use unique paths because different sessions can overwrite the same file (#110).
+
+### Validation
+
+- Retain runnable Windows argv and failure/lifecycle contracts in the local and platform-target gates. Native macOS and Ubuntu validate the POSIX process path; PowerShell Legacy diagnostics reproduced both old corruptions but do not validate the replacement Windows transport. Native Windows/`cmd.exe` was unavailable and was not run under the task-specific waiver; permanent release requirements remain intact.
+
 ## 0.6.7 - 2026-09-07
 
 ### Fixed

package/README.md

@@ -135,6 +135,8 @@ Then install this Pi package:
 pi install npm:pi-agent-browser-native
 ```
 
+After updating `pi-agent-browser-native`, fully quit and restart Pi before using the updated tools. `/reload` can retain previously loaded compiled JavaScript even after `dist/` is rebuilt, so it is not a reliable way to pick up package updates.
+
 Start Pi and ask for a browser action:
 
 ```text
@@ -449,7 +451,7 @@ Typical pitfalls:
 - If the failure is `selector-not-found`, the wrapper may take one fresh snapshot and add `Current snapshot ref fallback` when that snapshot has exact visible role/name matches for the failed `find` / `semanticAction` target. Non-fill targets can include direct `try-current-visible-ref*` next actions, and semantic click misses can still add bounded `Agent-browser candidate fallbacks` such as `button`/`link` role retries for `text` clicks. `semanticAction` does not expose `uncheck` while upstream `find ... uncheck` is not runtime-supported; use raw `args: ["uncheck", <selector-or-ref>]` after a stable selector or fresh snapshot ref. For semantic `fill` misses on desktop or host-controlled rich inputs, prefer `details.richInputRecovery`: refresh refs, choose the current editable `@ref`, focus or click it, then use `keyboard type` for framework-controlled editors that require real key events. `keyboard inserttext` is paste-like and can change a DOM value without updating application state, so use it only with separate application-state verification. Direct contenteditable fills are verified with `get text` when snapshot metadata proves the target is contenteditable; if replacement did not happen, `details.fillVerification` warns before any submit step. Those recovery nextActions do not copy the fill text and do not press `Enter` or submit; only submit when the user flow explicitly calls for it (same contract link).
 - A successful upstream `click` is not proof that the web app handled the event or changed state. For top-level non-Electron direct clicks on `xpath=` targets and eligible current `@e…` refs, the wrapper may fail the tool with `details.clickDispatch` and a `Click dispatch diagnostic` line when upstream reported success but no trusted DOM event reached the resolved target. Raw `find … click` locator calls are not probed because the wrapper has no concrete element before upstream resolves the locator, and document-level probes can falsely fail frame-scoped clicks. `@e…` ref click probes are limited to current snapshot refs with accessible role `button`, `checkbox`, `menuitem`, `radio`, `switch`, or `tab`, with a unique role/name in both the saved snapshot and the live candidates. Duplicate-name refs remain upstream-owned; snapshot order is not target identity. Use the suggested `inspect-click-dispatch-miss` / `retry-click-after-dispatch-miss` next actions instead of assuming the click mutated the page; when `details.clickDispatch.scrollContainer` is present, use `scroll-target-into-view-after-dispatch-miss` first. When the task depends on a mutation, follow `inspect-after-mutation` / `pageChangeSummary` evidence with a wait, URL/text check, or fresh snapshot before trusting the result; if the target still did not change, retry with a current visible ref or stable selector and report the workflow issue instead of silently continuing. For static local fixtures where the user only needs to exercise app code, an explicit `eval --stdin` programmatic click such as `document.querySelector("#demo").click()` can be a diagnostic workaround, but treat it as an untrusted scripted activation rather than proof a real user click works, and never use it to bypass user instructions. Respect explicit user stop boundaries yourself: if the user says to stop before order/post/purchase/submit, gather evidence on that page and do not click the final action. The wrapper does not parse broad prompt text into business-intent action blocks; `details.promptGuard` is reserved for concrete artifact-before-close checks.
 - A successful upstream `click` can deliver no input at all on some sites. Reproduced against `https://www.saucedemo.com/` with upstream `agent-browser` 0.34.0 and no wrapper involved: when every CLI invocation in the flow is spaced ~0.6s apart, the React add-to-cart click reports success while **zero** DOM events reach a capture-phase listener and the cart badge never updates (0/5 runs succeeded, versus 4/5 with no spacing). A single idle gap is harmless (5/5); only sustained spacing across the flow triggers it. In that state a scripted `document.querySelector(...).click()` still works and updates the badge, so the page and its handlers are fine and the input never arrives; retries, `scrollintoview`, headed mode, and re-navigation do not recover it. This looks site-specific — React TodoMVC and react.dev were unaffected under the same pacing and command count. Wrapper calls do more per-command work than raw CLI calls, so they sit in the slow regime more often. Running the interaction steps as one `batch` keeps them inside a single upstream process and succeeded 5/5; prefer `batch` for consecutive real-app click flows, and treat a click whose `pageChangeSummary`/`navigationSummary` shows no change as unproven. When a `wait --url` or `assertUrl` times out after a suspected missed click, use the `fresh-session-after-url-wait-timeout` next action (`sessionMode: "fresh"` + `open about:blank`): replace about:blank with the target URL and replay the flow as one batch in a fresh session instead of retrying the wait.
-- A successful `snapshot -i` can surface `Possible overlay blockers` immediately when refs already contain strong dialog/alertdialog evidence plus close/dismiss controls. If a **top-level** `@e…`/`ref=` click succeeds (unified command `click`, not a `batch` step), upstream reports `data.clicked`, and `details.navigationSummary.url` stays on the same tab URL under the same normalization as ref preflight (fragment-insensitive), the wrapper may take one extra `snapshot -i` and add `Possible overlay blockers` with `details.overlayBlockers` (`candidates`, `summary`, optional `snapshot` refresh for refs) plus session-aware `inspect-overlay-state` / bounded `try-overlay-blocker-candidate-*` next actions when that snapshot shows strong modal context (`dialog` / `alertdialog`) and close/dismiss-like controls. Page-wide words like privacy, sign in, or banner alone do not trigger this diagnostic. The unchanged-URL check compares the prior pinned tab target with `details.navigationSummary.url`; CSS selector clicks do not run this overlay probe. Also skipped when tab correction or about-blank recovery already ran on that result.
+- A successful `snapshot -i` can surface `Possible overlay blockers` immediately when refs already contain strong dialog/alertdialog evidence plus close/dismiss controls. If a **top-level** `@e…`/`ref=` click succeeds (unified command `click`, not a `batch` step), upstream reports `data.clicked`, and `details.navigationSummary.url` stays on the same tab URL under the same normalization as ref preflight (fragment-insensitive), the wrapper may take one extra `snapshot -i` and add `Possible overlay blockers` with `details.overlayBlockers` (`candidates`, `summary`, optional `snapshot` refresh for refs) plus session-aware `inspect-overlay-state` / bounded `try-overlay-blocker-candidate-*` next actions when that snapshot shows strong modal context (`dialog` / `alertdialog`) and close/dismiss-like controls. Page-wide words like privacy, sign in, or banner alone do not trigger this diagnostic. The unchanged-URL check compares the prior pinned tab target with `details.navigationSummary.url`; CSS selector clicks do not run this overlay probe. Also skipped when tab correction or about-blank recovery already ran on that result. Separately, when upstream rejects a click because another element covers the target's click point (`is covered by` … `at its click point`), the wrapper keeps `failureCategory: "upstream-error"` and adds only the session-aware `inspect-overlay-state` snapshot action; it does not retry the blocked click or guess a dismiss control without fresh snapshot evidence. This covers direct `click`, `semanticAction` click, raw `find` clicks (including `nth` and an omitted action that defaults to click), and failed `batch`/`job` rows; it does not diagnose silent input-dispatch failures.
 - If `get text <selector>` reads a non-ref, non-simple-id CSS selector with multiple matches or a hidden first match while visible matches exist, including successful `batch` steps, the wrapper may add `Selector text visibility warning`, `details.selectorTextVisibility` (plus `selectorTextVisibilityAll` for multiple batched warnings), and `inspect-visible-text-candidates` next actions; the warning names the matching `details.nextActions` id. Prefer a visible `@ref`, a scoped selector, or a targeted `eval --stdin` over hidden tab content.
 - In wrapper-tracked attached Electron sessions, broad selectors such as `body`, `html`, `main`, or `[role=application]` may read the whole app shell. The wrapper may add `Broad Electron get text selector warning`, `details.electronGetTextScopeWarning`, and `snapshot-for-electron-text-scope`; ordinary browser pages do not qualify without Electron launch provenance. Prefer `snapshot -i`, a current `@ref`, or a narrower panel selector.
 
@@ -505,7 +507,7 @@ For desktop Electron apps, use top-level `electron` to avoid hand-building the d
 { "electron": { "action": "cleanup", "launchId": "electron-…" } }
 ```
 
-`electron.list` has no configurable timeout. Other Electron actions accept nested `electron.timeoutMs`; `electron.probe.timeoutMs` bounds each underlying read subprocess when dense desktop apps need a shorter or longer probe budget (omit for the normal tool subprocess default). `electron.cleanup.timeoutMs` applies separately to upstream `close` and the initial process-exit wait, not the whole teardown, and defaults to the implicit session close budget unless overridden; if the managed-session close step succeeds but host cleanup is partial, later default browser calls still rotate away from that closed wrapper-managed session. `electron.status.timeoutMs` only tightens managed-session title/url reads used for mismatch checks. Pass `electron.probe.launchId` when you want the probe tied to a wrapper-tracked launch instead of only the current managed session. Launch/status/probe results show both `launchId` (for status/cleanup/probe) and `sessionName` (for browser `snapshot`/`tab` commands); if the managed session drifts to `about:blank` while wrapper status still sees a live renderer, Electron-specific mismatch warnings and `status`/`probe`/`reattach`/`snapshot` next actions replace generic tab guidance. `/reload` preserves the current branch-visible active Electron launch and its isolated temp `userDataDir` for continuity, and cleans off-branch owned Electron launches; if cleanup is partial and skips or fails profile removal, the generic temp sweep preserves that `userDataDir` across reload, quit, later temp cleanup, process exit, and stale temp-root pruning after restart. If the app process/debug port dies after a successful-looking mutation, the wrapper reports `details.electronPostCommandHealth` and fails with `tab-drift` instead of quietly continuing on `about:blank`. Launch timeouts expose `details.electron.failure.diagnostics` for PID, profile, DevToolsActivePort, and timing evidence.
+`electron.list` has no configurable timeout. Other Electron actions accept nested `electron.timeoutMs`; `electron.probe.timeoutMs` bounds each underlying read subprocess when dense desktop apps need a shorter or longer probe budget (omit for the normal tool subprocess default). `electron.cleanup.timeoutMs` applies separately to upstream `close` and the initial process-exit wait, not the whole teardown, and defaults to the implicit session close budget unless overridden; if the managed-session close step succeeds but host cleanup is partial, later default browser calls still rotate away from that closed wrapper-managed session. `electron.status.timeoutMs` applies to managed-session title/URL reads and any `get cdp-url` read needed to verify a restored connection. Pass `electron.probe.launchId` when you want the probe tied to a wrapper-tracked launch instead of only the current managed session. Launch/status/probe results show both `launchId` (for status/cleanup/probe) and `sessionName` (for browser `snapshot`/`tab` commands); if the managed session drifts to `about:blank` while wrapper status still sees a live renderer, Electron-specific mismatch warnings and `status`/`probe`/`reattach`/`snapshot` next actions replace generic tab guidance. `/reload` preserves the current branch-visible active Electron launch and its isolated temp `userDataDir` for continuity, and cleans off-branch owned Electron launches. First reuse after reload/resume checks the live app's saved debug endpoint and the exact named upstream connection without reconnecting or resetting page refs; if cleanup is partial and skips or fails profile removal, the generic temp sweep preserves that `userDataDir` across reload, quit, later temp cleanup, process exit, and stale temp-root pruning after restart. If the app process/debug port dies after a successful-looking mutation, the wrapper reports `details.electronPostCommandHealth` and fails with `tab-drift` instead of quietly continuing on `about:blank`. Failed startups expose redacted stdout/stderr tails in visible errors and `details.electron.failure.diagnostics`, alongside PID, profile, DevToolsActivePort, and timing evidence. Each tail reads at most 4096 source bytes; private capture files follow the profile lifecycle, not a lifetime disk cap. See [`docs/ELECTRON.md`](docs/ELECTRON.md#failure-categories-and-recovery).
 
 Explicit-ID `electron.status` labels historical cleaned launch records; default and `all: true` selection exclude them. Current PID/port liveness stays independent of cleanup history. `details.electron.statuses[].userDataDirState` freshly measures only the tracked profile path: `present` (including dangling symlinks), `absent` (ENOENT), or `unknown` (other `lstat` errors), not whether all app residue is gone.
 

package/dist/extensions/agent-browser/lib/electron/cleanup.js

@@ -24,15 +24,15 @@ function isPidAlive(pid) {
         return code === "EPERM" ? true : false;
     }
 }
-async function isPortAlive(port) {
-    const version = parseCdpVersion(await fetchCdpJson(`http://127.0.0.1:${port}/json/version`));
+async function isPortAlive(port, signal) {
+    const version = parseCdpVersion(await fetchCdpJson(`http://127.0.0.1:${port}/json/version`, signal));
     if (!version)
         return { targets: [] };
-    const targets = parseCdpTargets(await fetchCdpJson(`http://127.0.0.1:${port}/json/list`));
+    const targets = parseCdpTargets(await fetchCdpJson(`http://127.0.0.1:${port}/json/list`, signal));
     return { targets, version };
 }
-export async function inspectElectronLaunchStatus(record) {
-    const cdp = await isPortAlive(record.port);
+export async function inspectElectronLaunchStatus(record, signal) {
+    const cdp = await isPortAlive(record.port, signal);
     let userDataDirState;
     try {
         await lstat(record.userDataDir);

package/dist/extensions/agent-browser/lib/electron/launch.js

@@ -1,10 +1,10 @@
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { readFile, rm } from "node:fs/promises";
-import { dirname } from "node:path";
+import { open, readFile, rm } from "node:fs/promises";
+import { dirname, join } from "node:path";
 import { fetchCdpJson, parseCdpTargets, parseCdpVersion, } from "./cdp.js";
 import { discoverElectronApps, inspectElectronAppPath, inspectElectronExecutablePath, } from "./discovery.js";
-import { createSecureTempDirectory } from "../temp.js";
+import { createSecureTempDirectory, preserveSecureTempDirectory } from "../temp.js";
 export const ELECTRON_LAUNCH_RECORD_VERSION = 1;
 export const ELECTRON_LAUNCH_DEFAULT_TIMEOUT_MS = 15_000;
 export const ELECTRON_LAUNCH_MAX_TIMEOUT_MS = 120_000;
@@ -12,6 +12,8 @@ const DEVTOOLS_ACTIVE_PORT_FILE = "DevToolsActivePort";
 export const ELECTRON_PROFILE_DIR_PREFIX = "electron-profile-";
 const ELECTRON_DEFAULT_APP_ARGS = ["--disable-extensions", "--no-first-run", "--no-default-browser-check"];
 const ELECTRON_DEVTOOLS_POLL_INTERVAL_MS = 100;
+// ponytail: bound failure reads, not lifetime log growth; noisy long-lived apps need rotation if that becomes a problem.
+const ELECTRON_OUTPUT_TAIL_BYTES = 4096;
 function normalizeTimeoutMs(timeoutMs) {
     if (!Number.isSafeInteger(timeoutMs) || (timeoutMs ?? 0) <= 0)
         return ELECTRON_LAUNCH_DEFAULT_TIMEOUT_MS;
@@ -284,40 +286,90 @@ export async function launchElectronApp(options) {
     let exitCode = null;
     let exitSignal = null;
     const args = buildLaunchArgs(userDataDir, appArgs);
-    const child = spawn(target.executablePath, args, {
-        cwd: dirname(target.executablePath),
-        detached: process.platform !== "win32",
-        stdio: "ignore",
-    });
-    child.once("error", (error) => {
-        spawnError = error;
-    });
-    child.once("exit", (code, signal) => {
-        exitCode = code;
-        exitSignal = signal;
-    });
-    child.unref();
+    let child;
+    let outputCaptured = false;
+    const outputFiles = [];
+    try {
+        for (const stream of ["stdout", "stderr"])
+            outputFiles.push(await open(join(userDataDir, `${stream}.log`), "wx", 0o600));
+        options.signal?.throwIfAborted();
+        child = spawn(target.executablePath, args, {
+            cwd: dirname(target.executablePath),
+            detached: process.platform !== "win32",
+            stdio: ["ignore", outputFiles[0].fd, outputFiles[1].fd],
+        });
+        outputCaptured = true;
+        child.once("error", (error) => {
+            spawnError = error;
+        });
+        child.once("exit", (code, signal) => {
+            exitCode = code;
+            exitSignal = signal;
+        });
+        child.unref();
+    }
+    catch (error) {
+        spawnError = error instanceof Error ? error : new Error(String(error));
+    }
+    finally {
+        for (const file of outputFiles) {
+            await file.close().catch((error) => {
+                cleanupError = [cleanupError, `Output handle close failed: ${error instanceof Error ? error.message : String(error)}`].filter(Boolean).join("; ");
+            });
+        }
+    }
     const buildFailureDiagnostics = (options = {}) => ({
         cdpVersionReached: options.cdpVersionReached,
         devToolsActivePort: options.devToolsActivePort,
         elapsedMs: Math.max(0, Date.now() - startedAtMs),
         exitCode,
         exitSignal,
-        outputCaptured: false,
-        pid: child.pid,
-        pidAlive: isLaunchChildPidAlive(child),
+        outputCaptured,
+        pid: child?.pid,
+        pidAlive: child ? isLaunchChildPidAlive(child) : undefined,
         port: options.port ?? options.devToolsActivePort?.port,
         timeoutMs,
         userDataDir,
     });
     const fail = async (reason, detail, diagnosticOptions) => {
         const diagnostics = buildFailureDiagnostics(diagnosticOptions);
-        const processCleanupError = await terminateLaunchChild(child);
+        const processCleanupError = child ? await terminateLaunchChild(child) : undefined;
+        const outputLines = [];
+        if (outputCaptured) {
+            for (const stream of ["stdout", "stderr"]) {
+                let file;
+                try {
+                    file = await open(join(userDataDir, `${stream}.log`), "r");
+                    const { size } = await file.stat();
+                    const buffer = Buffer.alloc(Math.min(size, ELECTRON_OUTPUT_TAIL_BYTES));
+                    const { bytesRead } = await file.read(buffer, 0, buffer.length, Math.max(0, size - buffer.length));
+                    diagnostics[`${stream}Tail`] = buffer.subarray(0, bytesRead).toString("utf8");
+                    diagnostics[`${stream}Truncated`] = size > buffer.length;
+                }
+                catch (error) {
+                    diagnostics[`${stream}Error`] = error instanceof Error ? error.message : String(error);
+                }
+                finally {
+                    await file?.close().catch((error) => {
+                        diagnostics[`${stream}Error`] = [diagnostics[`${stream}Error`], `Output reader close failed: ${error instanceof Error ? error.message : String(error)}`].filter(Boolean).join("; ");
+                    });
+                }
+                const tail = diagnostics[`${stream}Tail`];
+                if (tail !== undefined)
+                    outputLines.push(`App ${stream}${diagnostics[`${stream}Truncated`] ? ` (last ${ELECTRON_OUTPUT_TAIL_BYTES} bytes)` : ""}: ${tail || "(empty)"}`);
+                if (diagnostics[`${stream}Error`])
+                    outputLines.push(`App ${stream} capture error: ${diagnostics[`${stream}Error`]}`);
+            }
+        }
         try {
-            await rm(userDataDir, { force: true, recursive: true });
+            if (processCleanupError)
+                await preserveSecureTempDirectory(userDataDir);
+            else
+                await rm(userDataDir, { force: true, recursive: true });
         }
         catch (error) {
-            cleanupError = error instanceof Error ? error.message : String(error);
+            const message = error instanceof Error ? error.message : String(error);
+            cleanupError = [cleanupError, processCleanupError ? `Profile preservation failed: ${message}` : message].filter(Boolean).join("; ");
         }
         cleanupError = [processCleanupError, cleanupError].filter((value) => value !== undefined).join("; ") || undefined;
         return {
@@ -326,13 +378,15 @@ export async function launchElectronApp(options) {
                 appArgs,
                 cleanupError,
                 diagnostics,
-                error: launchFailureMessage(reason, target, detail),
+                error: [launchFailureMessage(reason, target, detail), ...outputLines].join("\n"),
                 reason,
                 target,
                 userDataDir,
             },
         };
     };
+    if (!child)
+        return fail(options.signal?.aborted ? "aborted" : "spawn-error", spawnError?.message);
     const portResult = await pollDevToolsActivePort({
         deadlineMs,
         getChildExit: () => ({ code: exitCode, signal: exitSignal }),

package/dist/extensions/agent-browser/lib/orchestration/browser-run/diagnostics.js

@@ -4,7 +4,7 @@ import { isCloseCommand, isOpenNavigationCommand } from "../../command-taxonomy.
 import { boundElectronProbeString } from "../../electron/cdp.js";
 import { executableExistsOnPath } from "../../executable-path.js";
 import { formatSessionArtifactRetentionSummary } from "../../results/artifact-manifest.js";
-import { buildNextToolAction, withOptionalSessionArgs } from "../../results/next-actions.js";
+import { buildInspectOverlayStateAction, buildNextToolAction, withOptionalSessionArgs } from "../../results/next-actions.js";
 import { buildVisibleRefFallbackDiagnosticFromSnapshot, getVisibleRefFallbackTarget } from "../../results/selector-recovery.js";
 import { extractRefSnapshotFromData, isAboutBlankUrl, normalizeComparableUrl } from "../../session-page-state.js";
 import { extractUpstreamCommandTokens, parseWaitCommandTokens, redactInvocationArgs, redactSensitiveText } from "../../runtime.js";
@@ -266,7 +266,7 @@ export function formatOverlayBlockerText(diagnostic) {
     return ["Possible overlay blockers:", ...diagnostic.candidates.map((candidate) => `- ${candidate.ref}${candidate.role ? ` ${candidate.role}` : ""}${candidate.name ? ` ${JSON.stringify(candidate.name)}` : ""}: ${candidate.reason}`)].join("\n");
 }
 export function buildOverlayBlockerNextActions(options) {
-    return [{ id: "inspect-overlay-state", params: { args: withOptionalSessionArgs(options.sessionName, ["snapshot", "-i"]) }, reason: "Refresh interactive refs and inspect whether an overlay, banner, modal, or dialog is blocking the intended click.", safety: "Read-only inspection; use current refs from this snapshot before interacting.", tool: "agent_browser" }, ...options.diagnostic.candidates.map((candidate, index) => ({ id: `try-overlay-blocker-candidate-${index + 1}`, params: { args: withOptionalSessionArgs(options.sessionName, candidate.args) }, reason: candidate.reason, safety: "Only click this if the candidate is clearly a close/dismiss control for an overlay that blocks the intended workflow.", tool: "agent_browser" }))];
+    return [buildInspectOverlayStateAction(options.sessionName), ...options.diagnostic.candidates.map((candidate, index) => ({ id: `try-overlay-blocker-candidate-${index + 1}`, params: { args: withOptionalSessionArgs(options.sessionName, candidate.args) }, reason: candidate.reason, safety: "Only click this if the candidate is clearly a close/dismiss control for an overlay that blocks the intended workflow.", tool: "agent_browser" }))];
 }
 export function collectSnapshotOverlayBlockerDiagnostic(data) {
     const candidates = getOverlayBlockerCandidates(data);

package/dist/extensions/agent-browser/lib/orchestration/browser-run/managed-session-daemon-policy.js

@@ -1,12 +1,15 @@
 import { rm } from "node:fs/promises";
+import { getAgentBrowserSessionIdentityKey } from "../../argv-grammar.js";
+import { inspectElectronLaunchStatus } from "../../electron/cleanup.js";
 import { acquireManagedSessionPolicyLock } from "../../managed-session-policy-lock.js";
-import { pruneOwnedManagedSessionRestoreSnapshots, resolveExplicitAutosaveInterval, } from "../../managed-session-restore.js";
+import { pruneOwnedManagedSessionRestoreSnapshots, resolveExplicitAutosaveInterval, withOwnedManagedSessionContext, } from "../../managed-session-restore.js";
 import { isManagedSessionRestoreKey } from "../../managed-session-storage.js";
 import { isRecord } from "../../parsing.js";
 import { getAgentBrowserProcessEnvironment } from "../../process-environment.js";
-import { runAgentBrowserProcess } from "../../process.js";
+import { runAgentBrowserProcess, withAttachedBrowserSessionContext } from "../../process.js";
 import { getAgentBrowserErrorText, parseAgentBrowserEnvelope } from "../../results/envelope.js";
 import { redactInvocationArgs } from "../../runtime.js";
+import { runSessionCommandData } from "./session-state.js";
 const MANAGED_SESSION_DAEMON_INSPECTION_TIMEOUT_MS = 35_000;
 const RUNNING_HEADED_AUTOSAVE_POLICY_CHANGE_ERROR = "AGENT_BROWSER_AUTOSAVE_INTERVAL_MS cannot change a running wrapper-owned headed session's launch-time periodic autosave interval. Close that session first, then retry with sessionMode: \"fresh\" so the new daemon starts with the requested interval.";
 export function getRunningHeadedAutosavePolicyChangeError(recordedInterval, closeCommand = false) {
@@ -49,6 +52,23 @@ export async function inspectManagedSessionDaemon(options) {
             await rm(processResult.stdoutSpillPath, { force: true }).catch(() => undefined);
     }
 }
+async function verifyRestoredElectronAttachment(context, record, signal, timeoutMs) {
+    const cwd = context.cwd;
+    if (!cwd || !record?.webSocketDebuggerUrl || !record.sessionName || record.cleanupState === "cleaned"
+        || getAgentBrowserSessionIdentityKey(record.sessionName, record.namespace) !== getAgentBrowserSessionIdentityKey(context.sessionName, context.namespace))
+        return false;
+    const status = await inspectElectronLaunchStatus(record, signal);
+    if (signal?.aborted || status.pidAlive !== true || status.userDataDirState !== "present"
+        || status.version?.webSocketDebuggerUrl !== record.webSocketDebuggerUrl)
+        return false;
+    // This metadata probe must not grant daemon provenance just by spawning.
+    const connection = await withAttachedBrowserSessionContext(true, () => withOwnedManagedSessionContext(undefined, () => runSessionCommandData({
+        args: ["get", "cdp-url"], cwd, env: getHeadedManagedAutosaveEnv(context.headedManagedAutosaveInterval), namespace: context.namespace, pinNamespace: true,
+        sessionName: context.sessionName, signal, timeoutMs,
+    })));
+    return !signal?.aborted && isRecord(connection) && typeof connection.cdpUrl === "string"
+        && (connection.cdpUrl === record.webSocketDebuggerUrl || status.targets.some((target) => target.webSocketDebuggerUrl === connection.cdpUrl));
+}
 export async function acquireOwnedManagedSessionDaemonPolicy(options) {
     const { context, signal } = options;
     if (!context.cwd)
@@ -81,7 +101,7 @@ export async function acquireOwnedManagedSessionDaemonPolicy(options) {
             return { daemonStatus: daemon.status, lock };
         }
         const stickyDisabled = context.restoreState.isDisabled(context.sessionName, context.namespace);
-        const hasKnownDaemonRestoreKey = context.restoreState.hasDaemonRestoreKey(context.sessionName, context.namespace);
+        let hasKnownDaemonRestoreKey = context.restoreState.hasDaemonRestoreKey(context.sessionName, context.namespace);
         const knownDaemonRestoreKey = context.restoreState.getDaemonRestoreKey(context.sessionName, context.namespace);
         const requestedDaemonRestoreKey = context.restoreDecision === "enabled" && stickyDisabled
             ? knownDaemonRestoreKey ?? null
@@ -93,6 +113,9 @@ export async function acquireOwnedManagedSessionDaemonPolicy(options) {
             };
         }
         const restoreDisabledPolicyNeedsProvenance = stickyDisabled || context.restoreDecision !== "enabled";
+        if (daemon.status === "active" && restoreDisabledPolicyNeedsProvenance && !hasKnownDaemonRestoreKey && daemon.restoreKey === requestedDaemonRestoreKey) {
+            hasKnownDaemonRestoreKey = await verifyRestoredElectronAttachment(context, options.electronLaunchRecord, signal, options.electronVerificationTimeoutMs);
+        }
         const activePolicyMatches = daemon.status === "active"
             && (!restoreDisabledPolicyNeedsProvenance || hasKnownDaemonRestoreKey)
             && daemon.restoreKey === requestedDaemonRestoreKey;

package/dist/extensions/agent-browser/lib/orchestration/browser-run/prepare.js

@@ -22,7 +22,7 @@ import { buildOwnedManagedSessionRestoreContext, resolveExplicitAutosaveInterval
 import { getAgentBrowserProcessEnvironment } from "../../process-environment.js";
 import { getExplicitSessionPageVerificationRequirement, getPageTargetValidationError, } from "../../page-target-validation.js";
 import { acquireOwnedManagedSessionDaemonPolicy, getRunningHeadedAutosavePolicyChangeError } from "./managed-session-daemon-policy.js";
-import { buildManagedSessionOutcome, buildSessionDetailFields, buildStaleRefPreflight, getSessionContextKey, extractStringResultField, ensureSessionTabTarget, getGuardedRefUsage, getTraceOwnerGuardMessage, runSessionCommandData, shouldPinSessionTabForCommand, } from "./session-state.js";
+import { buildManagedSessionOutcome, buildSessionDetailFields, buildStaleRefPreflight, getSessionContextKey, findElectronLaunchRecordForSession, extractStringResultField, ensureSessionTabTarget, getGuardedRefUsage, getTraceOwnerGuardMessage, runSessionCommandData, shouldPinSessionTabForCommand, } from "./session-state.js";
 import { getUpstreamEffectiveBatchSteps, parseBatchStdinJsonArray } from "../batch-stdin.js";
 import { buildElectronHostFailureResult, formatAgentBrowserNextActionsText, getElectronLaunchFailureCategory, redactRecoveryHint } from "./final-result.js";
 import { prepareClickDispatchProbe } from "./click-dispatch.js";
@@ -508,6 +508,8 @@ export async function prepareBrowserRun(options) {
             const closeCommand = isCloseCommand(executionPlan.commandInfo.command);
             const policy = await acquireOwnedManagedSessionDaemonPolicy({
                 context: ownedManagedSession,
+                electronLaunchRecord: findElectronLaunchRecordForSession(executionPlan.sessionName, state.electronLaunchRecords, executionPlan.namespace),
+                electronVerificationTimeoutMs: params.timeoutMs,
                 mode: closeCommand ? "close" : "reuse",
                 signal,
             });

package/dist/extensions/agent-browser/lib/orchestration/browser-run/process-output.js

@@ -12,7 +12,7 @@ import { analyzeQaPresetResults, analyzeQaPresetTimeout, buildQaCompactFailureTe
 import { applyNetworkRouteRecords, buildNetworkRouteDiagnostics } from "../../results/network-routes.js";
 import { buildToolPresentation } from "../../results/presentation.js";
 import { compactLargePresentationOutput } from "../../results/presentation/large-output.js";
-import { getAgentBrowserErrorText, parseAgentBrowserEnvelope } from "../../results/envelope.js";
+import { extractEnvelopeErrorText, getAgentBrowserErrorText, parseAgentBrowserEnvelope } from "../../results/envelope.js";
 import { omitUpstreamLifecycle } from "../../results/presentation/common.js";
 import { getClipboardWritePayloadCandidates, redactClipboardPermissionEcho, redactClipboardPermissionErrorValue } from "../../results/presentation/errors.js";
 import { shouldCaptureSemanticActionNavigationSummary } from "../../results/presentation/semantic-action.js";
@@ -637,6 +637,8 @@ export async function processBrowserOutput(input) {
             }
         }
         let errorText = getAgentBrowserErrorText({ aborted: processResult.aborted, command: prepared.executionPlan.commandInfo.command, effectiveArgs: prepared.redactedProcessArgs, envelope: presentationEnvelope, exitCode: processResult.exitCode, parseError, plainTextInspection, staleRefArgs: getStaleRefArgs(prepared.commandTokens, prepared.runtimeToolStdin), spawnError: processResult.spawnError, stderr: processResult.stderr, timedOut: processResult.timedOut, timeoutMs: processResult.timeoutMs, wrapperRecoveryHint: buildWrapperRecoveryHint({ sessionTabCorrection }) });
+        if (errorText && presentationEnvelope?.success === false && extractEnvelopeErrorText(presentationEnvelope.error) === undefined)
+            presentationEnvelope = { ...presentationEnvelope, error: errorText };
         if (errorText) {
             const clipboardWritePayloadCandidates = getClipboardWritePayloadCandidates(prepared.commandTokens);
             errorText = redactClipboardPermissionEcho(prepared.executionPlan.commandInfo, errorText);

package/dist/extensions/agent-browser/lib/orchestration/browser-run/session-state.js

@@ -483,12 +483,13 @@ function selectAnySessionTargetTab(options) {
     return selection ? { ...selection, ...(targetTitle ? { targetTitle } : {}), targetUrl } : undefined;
 }
 export async function runSessionCommandData(options) {
-    const { args, cwd, namespace, pinNamespace, sessionName, signal, stdin, throwOnFailure, timeoutMs } = options;
+    const { args, cwd, env, namespace, pinNamespace, sessionName, signal, stdin, throwOnFailure, timeoutMs } = options;
     if (!sessionName)
         return undefined;
     const processResult = await runAgentBrowserProcess({
         args: ["--json", ...(namespace !== undefined || pinNamespace ? ["--namespace", namespace ?? ""] : []), "--session", sessionName, ...args],
         cwd,
+        env,
         signal,
         stdin,
         timeoutMs,

package/dist/extensions/agent-browser/lib/orchestration/electron-host/index.js

@@ -414,7 +414,7 @@ async function withOwnedElectronManagedSessionPolicy(options, run) {
         throw new ElectronManagedSessionPolicyError("Electron helper could not establish wrapper ownership for its managed session.");
     let policy;
     try {
-        policy = await acquireOwnedManagedSessionDaemonPolicy({ context, signal: options.signal });
+        policy = await acquireOwnedManagedSessionDaemonPolicy({ context, electronLaunchRecord: options.electronLaunchRecord, electronVerificationTimeoutMs: options.timeoutMs, signal: options.signal });
     }
     catch (error) {
         throw new ElectronManagedSessionPolicyError(error instanceof Error ? error.message : String(error), { cause: error });
@@ -675,6 +675,7 @@ async function handleElectronHostInputInContext(options) {
             const sessionKey = getSessionPageStateKey(record.sessionName, record.namespace) ?? record.sessionName;
             return collectOwnedElectronManagedSessionTarget({
                 cwd,
+                electronLaunchRecord: record,
                 headedManagedAutosaveDisabled: ownedManagedSessions.get(sessionKey)?.headedManagedAutosaveDisabled,
                 headedManagedAutosaveInterval: ownedManagedSessions.get(sessionKey)?.headedManagedAutosaveInterval,
                 namespace: record.namespace,
@@ -750,12 +751,14 @@ async function handleElectronHostInputInContext(options) {
             const probe = await withOwnedElectronManagedSessionPolicy({
                 args: ["snapshot", "-i"],
                 cwd,
+                electronLaunchRecord: launchRecord,
                 headedManagedAutosaveDisabled,
                 headedManagedAutosaveInterval,
                 namespace: probeNamespace,
                 restoreState: managedSessionRestoreState,
                 sessionName: probeSessionName,
                 signal,
+                timeoutMs: compiledElectron.timeoutMs,
             }, async () => await collectElectronProbe({ cwd, namespace: probeNamespace, sessionName: probeSessionName, signal, timeoutMs: compiledElectron.timeoutMs }));
             const managedSession = {
                 sessionName: probe.sessionName,

package/dist/extensions/agent-browser/lib/playbook.js

@@ -53,7 +53,7 @@ export const SHARED_BROWSER_PLAYBOOK_GUIDELINES = [
     "On dashboards with nested scroll containers, verify scroll with a screenshot or fresh snapshot -i; if the viewport did not move, details.data.scrolled may be false/noMovement true and you should prefer scrollintoview <@ref> or target the actual scrollable region with scroll <selector> <dir> [px|percent]. For native selects, use select <selector> <value...> (or semanticAction/job select) instead of clicking option refs; for custom comboboxes, a click/semanticAction may only focus the field, so re-snapshot and use keyboard type <text> for focused input, press ArrowDown or press Enter, or visible option refs. Raw type requires both <selector> and <text>.",
     "When using eval --stdin, scope checks and actions to the target element or route whenever possible instead of relying on broad page-wide text heuristics.",
     "When using eval --stdin for extraction, pass the JavaScript through the native tool stdin field, not as an extra args token after --stdin, and return the value you want instead of relying on console.log as the primary result channel. Prefer plain expressions like ({ title: document.title }) or explicitly invoked functions like (() => ({ title: document.title }))(); use outputPath when the eval/get/snapshot data should be saved as a durable local file, but never reuse a screenshot, download, recording, or other browser artifact destination as outputPath. If a function-shaped snippet returns {}, details.evalStdinHint may warn that the function was serialized instead of called. Local file pages and caller-selected output paths are supported when upstream allows them. If get text on a broad CSS selector surfaces details.selectorTextVisibility or selectorTextVisibilityAll, prefer a visible @ref, a more specific selector, or the inspect-visible-text-candidates nextAction over hidden tab content.",
-    "When details.pageChangeSummary is present, use changeType and summary as a compact signal for navigation, DOM mutation, confirmations, or artifacts; when nextActionIds is set, match those ids to entries in details.nextActions (or per-step nextActions inside batch) for concrete follow-up payloads instead of inferring from prose alone. If details.clickDispatch reports a click-dispatch miss, refresh/inspect/retry the real click first; for static local fixtures only, an explicit eval --stdin programmatic .click() can exercise app handlers, but treat it as an untrusted scripted workaround and never use it to bypass stop-before-submit/order/purchase boundaries. If a no-navigation click surfaces details.overlayBlockers, inspect the fresh snapshot evidence before using a close/dismiss candidate nextAction; ordinary page chrome without dialog/alertdialog evidence should not trigger this diagnostic.",
+    "When details.pageChangeSummary is present, use changeType and summary as a compact signal for navigation, DOM mutation, confirmations, or artifacts; when nextActionIds is set, match those ids to entries in details.nextActions (or per-step nextActions inside batch) for concrete follow-up payloads instead of inferring from prose alone. If details.clickDispatch reports a click-dispatch miss, refresh/inspect/retry the real click first; for static local fixtures only, an explicit eval --stdin programmatic .click() can exercise app handlers, but treat it as an untrusted scripted workaround and never use it to bypass stop-before-submit/order/purchase boundaries. If an upstream click failure says the target is covered by another element at the target's click point, use the inspect-overlay-state nextAction to refresh refs and inspect the blocker before deciding whether to retry; do not blindly repeat the blocked click. If a no-navigation click surfaces details.overlayBlockers, inspect the fresh snapshot evidence before using a close/dismiss candidate nextAction; ordinary page chrome without dialog/alertdialog evidence should not trigger this diagnostic.",
     "When commands save or spill files (screenshots, downloads, PDFs, traces, recordings, HAR, large snapshot spills), use the user's exact requested paths when given and treat paths as provisional until details.artifactVerification shows every row verified: branch on missingCount, pendingCount, unverifiedCount, per-entry state, and optional limitation before downstream file use or PASS/FAIL reporting.",
     "For evidence-only screenshots, QA captures, or other audit artifacts, save to an explicit path and branch on details.artifactVerification plus details.artifacts before reporting PASS/FAIL; do not require vision review of inline image attachments unless the user asked for visual inspection.",
     "Respect explicit user stop boundaries yourself. When the surrounding authenticated employee or automation context is explicitly unattended/auto-approved, ordinary non-destructive form submissions within the requested flow may proceed without separate confirmation. Still require explicit authorization for purchases, production-control actions, destructive or irreversible actions, and account, security, or privacy changes. The wrapper does not infer broad business intent from prompt text; details.promptGuard is reserved for concrete artifact-before-close checks.",

package/dist/extensions/agent-browser/lib/process.js

@@ -3,9 +3,9 @@ import { spawn } from "node:child_process";
 import { lstat, mkdir, readdir, readlink, stat } from "node:fs/promises";
 import { dirname, isAbsolute, join } from "node:path";
 import { env as processEnv, platform as processPlatform } from "node:process";
+import { spawn as crossSpawn } from "cross-spawn";
 import { parseArgvDescriptor } from "./argv-descriptor.js";
-import { isKnownCommandToken } from "./command-taxonomy.js";
-import { extractExplicitSessionName, getFlagName, GLOBAL_BOOLEAN_FLAGS_WITH_OPTIONAL_VALUES, GLOBAL_VALUE_FLAGS, optionalGlobalValueFlagConsumesNext, resolveAgentBrowserNamespace, } from "./argv-grammar.js";
+import { extractExplicitSessionName, resolveAgentBrowserNamespace } from "./argv-grammar.js";
 import { commitManagedSessionRestoreSuppression, getManagedSessionRestoreEnv, getManagedSessionRestoreProtectedEnv, getOwnedManagedSessionCompatibilityEnv, getOwnedManagedSessionNamespaceEnv, isOwnedManagedSessionTarget, validateManagedSessionRestoreContextForSpawn, } from "./managed-session-restore.js";
 import { getPageTargetValidationError, } from "./page-target-validation.js";
 import { getImplicitSessionIdleTimeoutMs } from "./runtime.js";
@@ -26,114 +26,19 @@ export const SAFE_AGENT_BROWSER_OPERATION_TIMEOUT_MS = 25_000;
 const DEFAULT_AGENT_BROWSER_PROCESS_TIMEOUT_MS = 35_000;
 /** Grace period after `exit` before resolving when `close` is delayed by inherited stdio handles. */
 const EXIT_STDIO_GRACE_MS = 100;
-const WINDOWS_AGENT_BROWSER_MISSING_MARKER = "PI_AGENT_BROWSER_COMMAND_NOT_FOUND:agent-browser.cmd";
 const attachedBrowserSessionContext = new AsyncLocalStorage();
-const WINDOWS_COMMANDS_WITH_ADJACENT_SUBCOMMAND = new Set([
-    "auth", "clipboard", "cookies", "dashboard", "device", "dialog", "diff", "find", "get", "is", "keyboard",
-    "mouse", "network", "plugin", "profiler", "react", "record", "session", "set", "skills", "state", "storage",
-    "stream", "tab", "trace", "webmcp", "window",
-]);
 export function withAttachedBrowserSessionContext(preserve, run) {
     return attachedBrowserSessionContext.run(preserve || attachedBrowserSessionContext.getStore() === true, run);
 }
-export function getWindowsExplicitDefaultNamespaceEnv(args, parentNamespace, platform = processPlatform) {
-    return platform === "win32" && resolveAgentBrowserNamespace(args, parentNamespace) === ""
-        ? { AGENT_BROWSER_NAMESPACE: "" }
-        : {};
-}
 function appendTail(text, addition, maxChars) {
     const combined = text + addition;
     return combined.length <= maxChars ? combined : combined.slice(combined.length - maxChars);
 }
-function quoteWindowsPowerShellArg(value) {
-    return `'${value.replace(/'/g, "''")}'`;
-}
-/** Exported for unit tests that lock Windows launcher argv ordering. */
-export function reorderWindowsLeadingGlobalArgs(args) {
-    const leadingGlobals = [];
-    for (let index = 0; index < args.length; index += 1) {
-        const token = args[index];
-        if (isKnownCommandToken(token)) {
-            if (index === 0)
-                return args;
-            const firstPositional = args[index + 1];
-            return WINDOWS_COMMANDS_WITH_ADJACENT_SUBCOMMAND.has(token) && firstPositional && !firstPositional.startsWith("-")
-                ? [token, firstPositional, ...leadingGlobals, ...args.slice(index + 2)]
-                : [token, ...leadingGlobals, ...args.slice(index + 1)];
-        }
-        if (!token.startsWith("-"))
-            return args;
-        if (token.startsWith("--restore=")) {
-            leadingGlobals.push(token);
-            continue;
-        }
-        if (token === "--restore") {
-            const value = args[index + 1];
-            if (optionalGlobalValueFlagConsumesNext(token, value)) {
-                leadingGlobals.push(`--restore=${value}`);
-                index += 1;
-            }
-            else {
-                leadingGlobals.push(token);
-            }
-            continue;
-        }
-        if (token.includes("="))
-            return args;
-        const flag = getFlagName(token);
-        if (GLOBAL_BOOLEAN_FLAGS_WITH_OPTIONAL_VALUES.has(flag)) {
-            leadingGlobals.push(token);
-            if (["true", "false"].includes(args[index + 1] ?? "")) {
-                leadingGlobals.push(args[index + 1]);
-                index += 1;
-            }
-            continue;
-        }
-        if (GLOBAL_VALUE_FLAGS.includes(flag)) {
-            const value = args[index + 1];
-            if (value === undefined)
-                return args;
-            // PowerShell -> .cmd drops empty argv values. Planning rejects empty
-            // caller --args; keep this defensive skip so an unexpected empty value
-            // cannot turn the next flag into its accidental value on native Windows.
-            if (value === "" && (flag === "--args" || flag === "--namespace")) {
-                index += 1;
-                continue;
-            }
-            leadingGlobals.push(token, value);
-            index += 1;
-            continue;
-        }
-        return args;
-    }
-    return args;
-}
 export function prepareAgentBrowserSpawnArgs(args, wrapperCompatibilityUserAgent, preserveAttachedBrowserSession = false) {
     if (preserveAttachedBrowserSession || !wrapperCompatibilityUserAgent)
         return args;
     return ["--args", `--user-agent=${wrapperCompatibilityUserAgent.replaceAll(/[\r\n,]/g, "")}`, ...args];
 }
-export function buildAgentBrowserSpawnCommand(args, platform = processPlatform) {
-    if (platform !== "win32") {
-        return { command: "agent-browser", args };
-    }
-    const invocationArgs = reorderWindowsLeadingGlobalArgs(args).map(quoteWindowsPowerShellArg).join(" ");
-    const commandLine = [
-        "$agentBrowser = Get-Command agent-browser.cmd -ErrorAction SilentlyContinue;",
-        `if (-not $agentBrowser) { [Console]::Error.WriteLine('${WINDOWS_AGENT_BROWSER_MISSING_MARKER}'); exit 127 };`,
-        `& $agentBrowser.Source ${invocationArgs}`.trimEnd(),
-    ].join(" ");
-    return { command: "powershell.exe", args: ["-NoLogo", "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", commandLine] };
-}
-export function isWindowsAgentBrowserCommandMissing(stderr) {
-    const normalized = stderr.toLowerCase();
-    return normalized.includes(WINDOWS_AGENT_BROWSER_MISSING_MARKER.toLowerCase()) || (normalized.includes("agent-browser.cmd") && (normalized.includes("commandnotfoundexception") ||
-        normalized.includes("not recognized as the name of a cmdlet") ||
-        normalized.includes("not recognized as an internal or external command")));
-}
-export function shouldCommitManagedRestoreAfterWindowsProcess(input) {
-    return !input.spawnError && !(input.exitCode !== 0 && isWindowsAgentBrowserCommandMissing(input.stderr));
-}
 function terminateSpawnedChild(child, signal) {
     if (processPlatform === "win32" && child.pid) {
         const killer = spawn("taskkill.exe", ["/PID", String(child.pid), "/T", "/F"], { stdio: "ignore" });
@@ -431,7 +336,6 @@ export async function runAgentBrowserProcess(options) {
         ...env,
         ...getManagedSessionRestoreProtectedEnv(managedSessionRestoreOptions, managedSessionRestoreEnv),
         ...getOwnedManagedSessionNamespaceEnv(managedSessionRestoreOptions),
-        ...getWindowsExplicitDefaultNamespaceEnv(args, parentEnv.AGENT_BROWSER_NAMESPACE),
         ...ownedManagedSessionCompatibilityEnv,
     };
     const explicitSocketDir = processOverrides[AGENT_BROWSER_SOCKET_DIR_ENV];
@@ -536,13 +440,8 @@ export async function runAgentBrowserProcess(options) {
                 if (stdoutSpillHandle) {
                     await stdoutSpillHandle.close().catch(() => undefined);
                 }
-                const windowsMissingBinary = processPlatform === "win32" && exitCode !== 0 && isWindowsAgentBrowserCommandMissing(stderr);
-                if (processPlatform === "win32" && !windowsMissingBinary && !spawnError)
+                if (processPlatform === "win32" && !spawnError) {
                     agentBrowserStarted = true;
-                if (windowsMissingBinary && !spawnError) {
-                    spawnError = Object.assign(new Error("spawn agent-browser ENOENT"), { code: "ENOENT" });
-                }
-                else if (processPlatform === "win32" && shouldCommitManagedRestoreAfterWindowsProcess({ exitCode, spawnError, stderr })) {
                     commitManagedSessionRestoreSuppression(managedSessionRestoreOptions);
                 }
                 if (!spawnError && stdoutSpillError) {
@@ -569,8 +468,8 @@ export async function runAgentBrowserProcess(options) {
             resolve({ aborted: false, agentBrowserStarted: false, exitCode: 1, spawnError: new Error(spawnPolicyError), stderr: "", stdout: "", timedOut: false });
             return;
         }
-        const spawnCommand = buildAgentBrowserSpawnCommand(prepareAgentBrowserSpawnArgs(args, ownedManagedSessionCompatibilityEnv.AGENT_BROWSER_USER_AGENT, preserveAttachedBrowserSession));
-        const child = spawn(spawnCommand.command, spawnCommand.args, {
+        const spawnBrowser = processPlatform === "win32" ? crossSpawn : spawn;
+        const child = spawnBrowser("agent-browser", prepareAgentBrowserSpawnArgs(args, ownedManagedSessionCompatibilityEnv.AGENT_BROWSER_USER_AGENT, preserveAttachedBrowserSession), {
             cwd,
             env: childEnv,
             stdio: ["pipe", "pipe", "pipe"],