pi-agent-browser-native 0.8.3 → 0.9.0

package/CHANGELOG.md

@@ -1,6 +1,18 @@
 # Changelog
 
-## Unreleased
+## 0.9.0 - 2026-10-01
+
+### Breaking changes
+
+- Require Pi 1.0.0 or newer; Node 24.21.0 and separately installed upstream `agent-browser` requirements are unchanged. Pin the official development graph to 1.0.0 while retaining host-owned wildcard optional peers.
+- Remove Browser integration with dropped checkpoint and fork metadata/revision APIs. Keep stopped-copy legacy journal conversion, native save-on-close, browser/session replay and ownership-aware cleanup.
+
+### Changed
+
+- Use native `defaultActive: false` for the five advanced direct tools, retaining additive loader activation, explicit/defaultTools selections and the narrow official-1.0 initial-resume fallback.
+- Return canonical native `isError` and prose failure notices directly, without a result-repair hook; preserve explicit parseable JSON. Add native namespace/output-schema metadata and bounded redacted structured observations, loader inventory and normalized search results without exposing internal replay state or replacing the Browser code VM.
+- Skip irrelevant tool-event policy work; keep raw latest-user policy fresh through message completion and native content replacement. Reuse validated capture-local admission prefixes and one queued replay/launch-configuration fold, preserving publication checks and captured-leaf correctness. Skip unchanged per-row TUI formatting and text updates.
+- Replace the fork-only checkpoint CI gate with portable Native lifecycle Linux SDK qualification. Official/fork qualification remains independent; while the fork's `main` is below the supported Pi floor its lane emits a truthful unattempted-below-floor receipt and skips the fork build instead of resurrecting dropped APIs. Windows remains owner-waived, not passed.
 
 ## 0.8.3 - 2026-10-01
 

package/README.md

@@ -6,9 +6,9 @@ It is for Pi users who want agents to browse sites, inspect pages, click through
 
 ## Pi release qualification
 
-Development host dependencies are pinned to official Pi **0.99.2**, with wildcard runtime peers. `npm run check:compat` checks the installed candidate SDK/CLI identity, typechecks, runs the existing offline tests (including the native Pi pipeline with a controlled provider and fake browser), and tests a packed runtime-only installation through both the SDK and the actual bundled RPC CLI. The fork lane additionally requires the native idle checkpoint hook. It does not substitute a fork SDK while leaving official types or child CLI installed.
+Development host dependencies are pinned to official Pi **1.0.0**, with wildcard runtime peers. `npm run check:compat` checks the installed candidate SDK/CLI identity, typechecks, runs the existing offline tests (including the native Pi pipeline with a controlled provider and fake browser), and tests a packed runtime-only installation through both the SDK and the actual bundled RPC CLI. It does not substitute a fork SDK while leaving official types or child CLI installed.
 
-Run in an empty HOME with a **short** TMPDIR outside your real home. Long temporary paths can exceed macOS's 103-byte Unix socket limit; keep the fixture's socket safety checks intact. Real-browser/checkpoint controls, live upstream help sampling, lifecycle dogfood, and platform qualification remain the separate gates documented below. A Pi-only compatibility run uses no live browser profiles, credentials, or agent-browser fork, and does not certify those external integrations.
+Run in an empty HOME with a **short** TMPDIR outside your real home. Long temporary paths can exceed macOS's 103-byte Unix socket limit; keep the fixture's socket safety checks intact. Native lifecycle controls, live upstream help sampling, lifecycle dogfood, and platform qualification remain the separate gates documented below. A Pi-only compatibility run uses no live browser profiles, credentials, or agent-browser fork, and does not certify those external integrations.
 
 For the 0.6.16 compatibility rollout, the owner explicitly waived Windows qualification on 2026-09-21. Windows diagnostics and failures remain visible but nonblocking; this is **not** a Windows full-suite pass. Linux/macOS, declared Node floors, official/fork host and consumer-artifact checks remain required. Known Windows failures and follow-up are tracked in [#191](https://github.com/fitchmultz/pi-agent-browser-native/issues/191); see the [current support evidence](docs/SUPPORT_MATRIX.md#current-0616-rollout).
 
@@ -89,7 +89,7 @@ The result is optimized for agent work:
 | Auth/profile workflows can leak secrets | Supports `auth save --password-stdin`, redacts sensitive args, SAML/OAuth-bearing URLs, stdout/stderr, details, and snapshot spills, and discards malformed oversized stdout instead of persisting a parse-failure spill | `test/agent-browser.extension-security-redaction.test.ts` |
 | Stateful cookies/storage/auth output bloats or leaks context | Presentation layer redacts `details.data` for cookies and credential-like storage values while keeping low-risk local QA values such as `theme: dark` readable; recursively scrubs other structured upstream JSON (network, diff, trace/profiler, stream, dashboard, chat, auth, dialog, frame, state, and similar) using sensitive key names plus string heuristics; masks sensitive argv flags and positionals, including raw batch rows and ordered code journals; scrubs secrets from failed batch step errors; and exposes a compact redacted `batch` matrix on top-level `details.data` | `extensions/agent-browser/lib/results/presentation.ts`, `extensions/agent-browser/lib/results/presentation/diagnostics.ts`, `extensions/agent-browser/lib/runtime.ts`, `test/agent-browser.presentation-diagnostics.test.ts` |
 | Stale `@eN` refs fail mysteriously | Defines full per-session refs once in the native journal, exposes them on dedicated captures, rejects mismatched URLs / unknown refs / unsafe `batch` stdin ordering before spawn, adds recovery guidance to rerun `snapshot -i` or use stable `find` locators | `extensions/agent-browser/index.ts`, `extensions/agent-browser/lib/session-page-state.ts`, `test/agent-browser.session-page-state.test.ts`, `test/agent-browser.results.test.ts`, `test/agent-browser.extension-ref-guards.test.ts`, `test/agent-browser.extension-semantic-recovery.test.ts` |
-| Agents need stable success/failure buckets | Exposes bounded `resultCategory`, `successCategory`, and `failureCategory` on tool `details` for branching without parsing prose; a `tool_result` hook also aligns real Pi `isError` semantics, naming `Pi tool isError: true` in prose output while preserving parseable caller-requested `--json` output | [`docs/TOOL_CONTRACT.md`](docs/TOOL_CONTRACT.md#details), `extensions/agent-browser/lib/results/categories.ts`, `extensions/agent-browser/index.ts`, `extensions/agent-browser/lib/pi-tool-rendering.ts`, `test/agent-browser.results.test.ts`, `test/agent-browser.extension-validation.test.ts`, `test/agent-browser.pi-pipeline.test.ts` |
+| Agents need stable success/failure buckets | Exposes bounded `resultCategory`, `successCategory`, and `failureCategory` on tool `details` for branching without parsing prose; final results return native `isError` and a visible prose failure notice while preserving parseable caller-requested `--json` output. Native structured results expose the same bounded, redacted observations, not internal replay metadata | [`docs/TOOL_CONTRACT.md`](docs/TOOL_CONTRACT.md#details), `extensions/agent-browser/lib/results/categories.ts`, `extensions/agent-browser/index.ts`, `extensions/agent-browser/lib/pi-tool-rendering.ts`, `test/agent-browser.results.test.ts`, `test/agent-browser.extension-validation.test.ts`, `test/agent-browser.pi-pipeline.test.ts` |
 | Clicks can report success without the page receiving the event | Top-level non-Electron direct `click` calls on `xpath=` targets or role-gated current `@e…` refs (`button`, `checkbox`, `menuitem`, `radio`, `switch`, `tab`) install a bounded target-specific DOM-event probe; eligible `@e…` refs require a unique role/name in both the latest snapshot and the live candidates. A per-probe temporary DOM marker must be read back by native `get attr <original-selector> <marker>` before the candidate can verify dispatch, including XPath scope. Missing or mismatched identity cleans up the probe and leaves the native click unverified, not failed. Duplicate-name refs pass through without a probe: their old ordinal cannot prove which element received the click. If upstream reports success but no trusted event reaches the resolved target, the wrapper fails the tool, exposes `details.clickDispatch`, and suggests explicit retry/inspect next actions (no in-page replay), including a nested-scroll `scrollintoview` action when the probe sees the target outside a scroll container or viewport. Unresolved locator clicks such as raw `find … click` are left upstream-owned to avoid false failures for frame-scoped targets. Other click results still expose `details.pageChangeSummary`; `observed: false` explicitly marks dispatch-only mutation summaries and adds a visible `Action dispatched; application change unverified` warning. Unchanged-URL clicks can surface evidence-backed `details.overlayBlockers` candidates. | [`docs/TOOL_CONTRACT.md`](docs/TOOL_CONTRACT.md#details), `extensions/agent-browser/lib/orchestration/browser-run/click-dispatch.ts`, `extensions/agent-browser/lib/results/presentation/navigation.ts`, `test/agent-browser.presentation.test.ts`, `test/agent-browser.extension-click-dispatch.test.ts` |
 | Dashboard scroll commands can look successful while nothing moves | Handles standard `scroll <dir> [px]` against the document first (including pages whose smooth-scroll CSS defeats upstream wheel timing), falls back upstream when the document cannot move, and samples viewport/containers around the fallback; explicit CSS-container scrolling uses instant movement so smooth-scroll CSS cannot cause a premature no-movement failure; unchanged positions fail as `upstream-error` with `details.scrollNoop`, visible recovery guidance, and exact snapshot/screenshot checks. Unsupported `scrollintoview text=...` fails before dispatch, including inside effective batch rows, and shows exact native `find text ... hover` and snapshot/ref recovery payloads; help remains native pass-through. | [`docs/TOOL_CONTRACT.md`](docs/TOOL_CONTRACT.md#details), [`docs/COMMAND_REFERENCE.md`](docs/COMMAND_REFERENCE.md#core-page-and-element-commands), `test/agent-browser.extension-validation.test.ts` |
 | Dropdown/combobox clicks can focus or hit native option box-model errors | Adds first-class `select <selector> <value...>` paths through native `args` and `agent_browser_action`; semantic role/name or label select resolves exactly one current visible combobox/listbox ref before action. Custom combobox clicks still detect focused controls with explicit `aria-expanded` state but no visible options and return `details.comboboxFocus` plus exact recovery `nextActions` | [`docs/TOOL_CONTRACT.md`](docs/TOOL_CONTRACT.md#details), [`docs/COMMAND_REFERENCE.md`](docs/COMMAND_REFERENCE.md#core-page-and-element-commands), `extensions/agent-browser/lib/input-modes/semantic-action.ts`, `test/agent-browser.extension-input-modes.test.ts`, `test/agent-browser.extension-validation.test.ts` |
@@ -103,7 +103,7 @@ Artifact results show known requested paths separately from reported/resolved lo
 
 ## Fastest way to try it
 
-Use Node 24.21.0 or newer and Pi 0.87.0 or newer. This package keeps optional Pi core imports as wildcard `peerDependencies` because Pi package docs require the host Pi install to provide those packages, pins its direct Pi validation dependencies to 0.99.2, and makes Pi hosts below 0.87.0 a setup failure through `pi-agent-browser-doctor`. There are no compatibility shims for older Pi releases.
+Use Node 24.21.0 or newer and Pi 1.0.0 or newer. This package keeps optional Pi core imports as wildcard `peerDependencies` because Pi package docs require the host Pi install to provide those packages, pins its direct Pi validation dependencies to 1.0.0, and makes Pi hosts below 1.0.0 a setup failure through `pi-agent-browser-doctor`. There are no compatibility shims for older Pi releases.
 
 Install upstream `agent-browser` first and make sure it is on `PATH`:
 
@@ -172,7 +172,7 @@ pi --no-extensions -e npm:pi-agent-browser-native
 
 `--no-extensions` disables automatic extension loading, not Pi settings, configured package resolution, skills, prompts, themes, or context files.
 
-Pi 0.84.0+ may ask whether to trust projects with trust-gated settings or resources. This extension follows Pi's trust decision when loading its project-local config. `--no-approve` skips that config and Pi's trust-gated project resources; context files such as `AGENTS.md` still load unless context loading is separately disabled.
+Pi may ask whether to trust projects with trust-gated settings or resources. This extension follows Pi's trust decision when loading its project-local config. `--no-approve` skips that config and Pi's trust-gated project resources; context files such as `AGENTS.md` still load unless context loading is separately disabled.
 
 For a specific published version:
 
@@ -286,7 +286,7 @@ printf '%s' "$EXA_API_KEY" | npm exec --yes --package pi-agent-browser-native@la
 npm exec --yes --package pi-agent-browser-native@latest -- pi-agent-browser-config web-search set-command "op read 'op://Private/Brave Search/API Key'" --provider brave --global
 ```
 
-Config merges in this order: global → project → `PI_AGENT_BROWSER_CONFIG` override. Under Pi 0.84.0+, the globally installed or CLI-loaded extension still loads project-local `.pi/config/pi-agent-browser-native/config.json` when Pi trust allows that project layer; it skips that project layer when Pi reports the project is untrusted or when Pi is launched with `--no-approve`. `webSearch.enabled` is evaluated after the loaded layers merge. Use `web-search disable --global` for a user default, `web-search disable --project` for one repo, and a `PI_AGENT_BROWSER_CONFIG` override with `{ "webSearch": { "enabled": false } }` when web search must stay off even if project config exists. Loaded config may use plaintext, custom environment aliases, interpolation literals, malformed-or-late-bound `$` values, and `!command` credential sources; the resolved secret is passed to the provider request while tool content, details, status output, and docs examples stay redacted. `web-search set-key`, `set-command`, and `clear` require `--provider`; `set-env` infers Exa/Brave from `EXA_API_KEY` or `BRAVE_API_KEY` unless you pass `--provider`.
+Config merges in this order: global → project → `PI_AGENT_BROWSER_CONFIG` override. The globally installed or CLI-loaded extension still loads project-local `.pi/config/pi-agent-browser-native/config.json` when Pi trust allows that project layer; it skips that project layer when Pi reports the project is untrusted or when Pi is launched with `--no-approve`. `webSearch.enabled` is evaluated after the loaded layers merge. Use `web-search disable --global` for a user default, `web-search disable --project` for one repo, and a `PI_AGENT_BROWSER_CONFIG` override with `{ "webSearch": { "enabled": false } }` when web search must stay off even if project config exists. Loaded config may use plaintext, custom environment aliases, interpolation literals, malformed-or-late-bound `$` values, and `!command` credential sources; the resolved secret is passed to the provider request while tool content, details, status output, and docs examples stay redacted. `web-search set-key`, `set-command`, and `clear` require `--provider`; `set-env` infers Exa/Brave from `EXA_API_KEY` or `BRAVE_API_KEY` unless you pass `--provider`.
 
 For Exa, the effective mode is the per-call `searchType`, then `webSearch.defaultSearchType`, then `auto`. A research-heavy coding workflow should set the config default to `deep-lite`; callers can still override it per search. Users who do not opt in keep the existing `auto` latency.
 
@@ -550,9 +550,9 @@ Policy-required URL reads keep the two-call read → confirm/deny flow. Returned
 
 Full live identity, browser-independent native reads/confirmations and detailed recording receipts require the companion upstream fixes; the current recommended release does not yet supply all of them. Older supported versions remain accepted with unavailable evidence marked unknown. The extension does not upgrade or restart your installed browser to obtain these fields.
 
-### Native working-session checkpoints
+### Lifecycle and cleanup
 
-On Pi hosts with `session_checkpoint`, an unused or cleanly closed browser integration can qualify for sleep. Live browsers, attachments, active code calls, unfinished recordings/legacy cleanup leases, and dirty recording persistence keep compute alive. Pi core owns native journal flush/repair and strict restore; an ongoing journal I/O failure rejects checkpoint acquisition. Checkpointing never closes browsers or changes cleanup ownership. Native save-on-close and per-root restore remain the persistence path; page JavaScript, unsaved forms, and live recordings are not serialized. See [checkpoint boundaries](docs/ARCHITECTURE.md#native-checkpoint-boundary).
+Shared root and caller-owned browsers survive Pi quit; managed/fresh browsers and wrapper-launched Electron resources retain ownership-aware cleanup. Close or clean up owned resources explicitly before disabling or removing the extension. Reload after extension removal has no browser handover guarantee. Native save-on-close and per-root restore remain the persistence path; page JavaScript, unsaved forms, and live recordings are not serialized. See [session ownership](docs/ARCHITECTURE.md#session-model).
 
 ### Profile selection
 
@@ -702,7 +702,7 @@ npm run verify -- release
 `pi-agent-browser-native` is intentionally thin:
 
 1. Pi loads the compiled `dist/extensions/agent-browser/index.js` entrypoint from the package manifest; TypeScript under `extensions/` remains the source of truth and `npm run build` regenerates `dist/` before packing.
-2. The extension registers compact direct/code tools, an advanced-tool loader with five initially inactive specialized tools, and the optional credential-backed `agent_browser_web_search` companion.
+2. The extension registers compact direct/code tools, an advanced-tool loader with five native default-inactive specialized tools (unless selected by the host), and the optional credential-backed `agent_browser_web_search` companion.
 3. Tool calls are translated into upstream `agent-browser` CLI invocations with controlled args, stdin, environment, timeout, and session planning.
 4. Upstream JSON/plain-text output is parsed into model-friendly content and structured details.
 5. Screenshots, downloads, recordings, traces, profiles, and spill files are normalized as Pi-visible artifacts where possible.
@@ -729,7 +729,7 @@ Install upstream `agent-browser`, then install dependencies:
 npm install
 ```
 
-Use the npm version declared in `package.json` `packageManager` when refreshing `package-lock.json` (for example `npx -y npm@12.1.0 install`) so optional-platform lockfile metadata does not drift. Use Node 24.21.0 and Pi 0.87.0 or newer for lifecycle and interactive browser smokes; the pinned Pi 0.99.2 devDependencies are validation fixtures, not an exact-version requirement for the host CLI. See [Environment and automation pitfalls](docs/RELEASE.md#environment-and-automation-pitfalls) in `docs/RELEASE.md`.
+Use the npm version declared in `package.json` `packageManager` when refreshing `package-lock.json` (for example `npx -y npm@12.1.0 install`) so optional-platform lockfile metadata does not drift. Use Node 24.21.0 and Pi 1.0.0 or newer for lifecycle and interactive browser smokes; the pinned Pi 1.0.0 devDependencies are validation fixtures, not an exact-version requirement for the host CLI. See [Environment and automation pitfalls](docs/RELEASE.md#environment-and-automation-pitfalls) in `docs/RELEASE.md`.
 
 Checkout-only extension smoke test:
 
@@ -747,7 +747,7 @@ Configured-source lifecycle validation:
 npm run verify -- lifecycle
 ```
 
-The harness defaults to Pi model `zai/glm-5.2` and **180000 ms** per-step tmux waits; pass `--model <id>` and/or `--timeout-ms <ms>` after `lifecycle` when you need different settings (see [Configured-source lifecycle validation](docs/RELEASE.md#configured-source-lifecycle-validation) in `docs/RELEASE.md`). It launches the supported Pi runtime with `--approve` and a deterministic `--session-id`, drives `/reload`, closes Pi, relaunches the exact same session, asserts the JSONL header id, and checks managed-session continuity, compiled-entrypoint pickup after process restart, persisted spill reachability, and real Pi `tool_result` failure-patch behavior.
+The harness defaults to Pi model `zai/glm-5.2` and **180000 ms** per-step tmux waits; pass `--model <id>` and/or `--timeout-ms <ms>` after `lifecycle` when you need different settings (see [Configured-source lifecycle validation](docs/RELEASE.md#configured-source-lifecycle-validation) in `docs/RELEASE.md`). It launches the supported Pi runtime with `--approve` and a deterministic `--session-id`, drives `/reload`, closes Pi, relaunches the exact same session, asserts the JSONL header id, and checks managed-session continuity, compiled-entrypoint pickup after process restart, persisted spill reachability, and native returned failure status and JSON preservation.
 
 Use lifecycle validation when testing `/reload`, exact-session relaunch, `/resume`, managed-session continuity, or persisted artifact behavior. Branch-backed state and `session_tree` cleanup ownership are covered by focused extension harness tests. Maintainers must run the lifecycle harness before every publish; see [Pre-release checks](docs/RELEASE.md#pre-release-checks).
 

package/dist/extensions/agent-browser/index.js

@@ -1,7 +1,7 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { dirname, isAbsolute, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Text } from "@earendil-works/pi-tui";
 import { batchHasSuccessfulCloseAll, getSuccessfulBatchCloseLifecycle } from "./lib/batch-lifecycle.js";
@@ -13,17 +13,17 @@ import { buildExecutionPlan, canUseHeadlessCompatibilityUserAgent, createEphemer
 import { deleteIdentityKeysInNamespace, extractExplicitNamespace, extractExplicitSessionName, getAgentBrowserSessionIdentityKey, isAgentBrowserSessionIdentityKeyInNamespace, isUpstreamEnvFlagEnabled, resolveAgentBrowserNamespace, scanUpstreamGlobalFlagOccurrences } from "./lib/argv-grammar.js";
 import { parseArgvDescriptor } from "./lib/argv-descriptor.js";
 import { needsManagedSession } from "./lib/command-policy.js";
-import { ManagedSessionRestoreState, resolveOwnedManagedSessionContext, withOwnedManagedSessionContext } from "./lib/managed-session-restore.js";
+import { ManagedSessionRestoreState } from "./lib/managed-session-restore.js";
 import { isRecord } from "./lib/parsing.js";
 import { getAgentBrowserProcessTimeoutMs, resolveAgentBrowserSocketDir, runAgentBrowserProcess } from "./lib/process.js";
 import { getCommandAwareProcessTimeoutMs } from "./lib/orchestration/browser-run/prepare/wait-timeouts.js";
 import { getAgentBrowserProcessEnvironment, withAgentBrowserProcessEnvironment, withIsolatedAgentBrowserEnvironment } from "./lib/process-environment.js";
 import { withNativeSessionDefaults } from "./lib/orchestration/native-session-defaults.js";
-import { getBrowserCwdError, resolveExecutionCwd, restoreManagedSessionCwd } from "./lib/execution-cwd.js";
+import { getBrowserCwdError, resolveExecutionCwd } from "./lib/execution-cwd.js";
 import { resolveOperationPaths } from "./lib/orchestration/operation-paths.js";
 import { closeManagedSession, inspectManagedSessionDaemon } from "./lib/orchestration/browser-run/managed-session-daemon-policy.js";
 import { MINIMUM_AGENT_BROWSER_VERSION, SUPPORTED_AGENT_BROWSER_VERSION_LABEL, TARGET_AGENT_BROWSER_VERSION, getAgentBrowserVersionValidationError, parseAgentBrowserVersionOutput, } from "./lib/upstream-version.js";
-import { buildPromptPolicy, getLatestUserPrompt } from "./lib/prompt-policy.js";
+import { buildPromptPolicy, getLatestUserMessage, getMessageText } from "./lib/prompt-policy.js";
 import { isCloseAllCommand, isCloseCommand } from "./lib/command-taxonomy.js";
 import { hasLaunchScopedFlagToken } from "./lib/launch-scoped-flags.js";
 import { cleanupSecureTempArtifacts } from "./lib/temp.js";
@@ -44,7 +44,7 @@ import { appendRecordingReservationTransition, applyRecordingArtifactsToReservat
 import { createAgentBrowserWebSearchTool } from "./lib/web-search.js";
 import { scopeReadConfirmationArgs } from "./lib/read-confirmation.js";
 import { isDirectAgentBrowserBashAllowed, isHarmlessAgentBrowserInspectionCommand, looksLikeDirectAgentBrowserBash, } from "./lib/bash-guard.js";
-import { AgentBrowserResultComponent, buildAgentBrowserToolResultPatch, formatAgentBrowserRenderCall, formatAgentBrowserRenderResult, } from "./lib/pi-tool-rendering.js";
+import { AgentBrowserResultComponent, formatAgentBrowserRenderCall, } from "./lib/pi-tool-rendering.js";
 function browserExecutionFailure(error, signal, fallbackCategory = "upstream-error") {
     const timeout = error instanceof Error && error.name === "TimeoutError";
     const summary = redactSensitiveText(error instanceof Error ? error.message : String(error));
@@ -230,84 +230,6 @@ function getRecognizedCompatibilityWorkaround(value) {
         ? { id: workaround.id, reason: workaround.reason }
         : undefined;
 }
-function restoreManagedSessionCompatibilityWorkaroundFromBranch(branch, sessionName, namespace) {
-    let restored;
-    const targetKey = getSessionContextKey(sessionName, namespace);
-    for (const entry of branch) {
-        const message = getBrowserResultMessage(entry);
-        if (!message)
-            continue;
-        const details = isRecord(message.details) ? message.details : undefined;
-        if (!details)
-            continue;
-        if (getSessionContextKey(typeof details.sessionName === "string" ? details.sessionName : undefined, typeof details.namespace === "string" ? details.namespace : undefined) !== targetKey)
-            continue;
-        const recognizedWorkaround = getRecognizedCompatibilityWorkaround(details.compatibilityWorkaround);
-        const succeeded = getSuccessfulToolResult(details, message);
-        const outcome = getManagedSessionOutcome(details);
-        const activeAfterFailure = recognizedWorkaround
-            && outcome?.activeAfter === true
-            && typeof outcome.currentSessionName === "string"
-            && getSessionContextKey(outcome.currentSessionName, typeof outcome.currentSessionNamespace === "string" ? outcome.currentSessionNamespace : undefined) === targetKey
-            && (outcome.status === "created" || outcome.status === "replaced" || outcome.status === "unchanged");
-        if (!succeeded && !activeAfterFailure)
-            continue;
-        if (recognizedWorkaround) {
-            restored = recognizedWorkaround;
-        }
-        else if (!canUseHeadlessCompatibilityUserAgent(getToolResultArgs(details))) {
-            restored = undefined;
-        }
-    }
-    return restored;
-}
-function restoreManagedSessionHeadedAutosaveDisabledFromBranch(branch, sessionName, namespace) {
-    let restored = false;
-    const targetKey = getSessionContextKey(sessionName, namespace);
-    for (const entry of branch) {
-        const message = getBrowserResultMessage(entry);
-        if (!message)
-            continue;
-        const details = isRecord(message.details) ? message.details : undefined;
-        if (!details)
-            continue;
-        if (getSessionContextKey(typeof details.sessionName === "string" ? details.sessionName : undefined, typeof details.namespace === "string" ? details.namespace : undefined) !== targetKey)
-            continue;
-        const outcome = getManagedSessionOutcome(details);
-        const activeAfterFailure = outcome?.activeAfter === true
-            && typeof outcome.currentSessionName === "string"
-            && getSessionContextKey(outcome.currentSessionName, typeof outcome.currentSessionNamespace === "string" ? outcome.currentSessionNamespace : undefined) === targetKey;
-        if ((getSuccessfulToolResult(details, message) || activeAfterFailure) && typeof details.managedSessionHeadedAutosaveDisabled === "boolean") {
-            restored = details.managedSessionHeadedAutosaveDisabled;
-        }
-    }
-    return restored;
-}
-function restoreManagedSessionHeadedAutosaveIntervalFromBranch(branch, sessionName, namespace) {
-    let restored;
-    const targetKey = getSessionContextKey(sessionName, namespace);
-    for (const entry of branch) {
-        const message = getBrowserResultMessage(entry);
-        if (!message)
-            continue;
-        const details = isRecord(message.details) ? message.details : undefined;
-        if (!details)
-            continue;
-        if (getSessionContextKey(typeof details.sessionName === "string" ? details.sessionName : undefined, typeof details.namespace === "string" ? details.namespace : undefined) !== targetKey)
-            continue;
-        const outcome = getManagedSessionOutcome(details);
-        const activeAfterFailure = outcome?.activeAfter === true
-            && typeof outcome.currentSessionName === "string"
-            && getSessionContextKey(outcome.currentSessionName, typeof outcome.currentSessionNamespace === "string" ? outcome.currentSessionNamespace : undefined) === targetKey;
-        if (!getSuccessfulToolResult(details, message) && !activeAfterFailure)
-            continue;
-        if (typeof details.managedSessionHeadedAutosaveInterval === "string")
-            restored = details.managedSessionHeadedAutosaveInterval;
-        else if (details.managedSessionHeadedAutosaveDisabled === true)
-            restored = "0";
-    }
-    return restored;
-}
 function getToolResultArgs(details) {
     if (Array.isArray(details.args) && details.args.every((arg) => typeof arg === "string"))
         return details.args;
@@ -385,18 +307,6 @@ function trackOwnedManagedSession(sessions, sessionName, cwd, options = {}) {
     const headedManagedAutosaveInterval = options.headedManagedAutosaveInterval ?? existing?.headedManagedAutosaveInterval;
     sessions.set(key, { branchOwned, compatibilityWorkaround, cwd, headedManagedAutosaveDisabled, headedManagedAutosaveInterval, namespace: options.namespace, sessionName, socketDir: options.socketDir ?? existing?.socketDir });
 }
-function restoreManagedSessionSocketDir(branch, sessionName, namespace) {
-    const key = getAgentBrowserSessionIdentityKey(sessionName, namespace);
-    for (let index = branch.length - 1; index >= 0; index -= 1) {
-        const details = getBrowserResultMessage(branch[index])?.details;
-        if (!isRecord(details) || typeof details.sessionName !== "string")
-            continue;
-        if (getAgentBrowserSessionIdentityKey(details.sessionName, typeof details.namespace === "string" ? details.namespace : undefined) === key
-            && typeof details.managedSessionSocketDir === "string")
-            return details.managedSessionSocketDir;
-    }
-    return undefined;
-}
 function untrackOwnedManagedSession(sessions, sessionName, namespace) {
     if (!sessionName)
         return;
@@ -590,6 +500,7 @@ function collectBranchManagedResourceEvents(branch) {
         managedSessionActiveIdentities: new Map(),
         managedSessionActiveRanks: new Map(),
         managedSessionCloseRanks: new Map(),
+        managedSessionLaunchState: new Map(),
     };
     let eventRank = 0;
     for (const entry of branch) {
@@ -611,6 +522,32 @@ function collectBranchManagedResourceEvents(branch) {
         const batchCloseLifecycle = getSuccessfulBatchCloseLifecycle(details.batchSteps);
         const closeAllApplied = detailsReportCloseAllApplied(details, succeeded);
         const outcome = getManagedSessionOutcome(details);
+        if (sessionName) {
+            const key = getSessionContextKey(sessionName, namespace) ?? sessionName;
+            const launch = events.managedSessionLaunchState.get(key) ?? { compatibilityWorkaround: undefined, headedManagedAutosaveDisabled: false };
+            if (typeof details.managedSessionCwd === "string" && isAbsolute(details.managedSessionCwd))
+                launch.cwd = details.managedSessionCwd;
+            if (typeof details.managedSessionSocketDir === "string")
+                launch.socketDir = details.managedSessionSocketDir;
+            const retainedAfterFailure = outcome?.activeAfter === true && typeof outcome.currentSessionName === "string"
+                && getSessionContextKey(outcome.currentSessionName, typeof outcome.currentSessionNamespace === "string" ? outcome.currentSessionNamespace : undefined) === key;
+            const workaround = getRecognizedCompatibilityWorkaround(details.compatibilityWorkaround);
+            if (succeeded || workaround && retainedAfterFailure && ["created", "replaced", "unchanged"].includes(String(outcome?.status))) {
+                if (workaround)
+                    launch.compatibilityWorkaround = workaround;
+                else if (!canUseHeadlessCompatibilityUserAgent(getToolResultArgs(details)))
+                    launch.compatibilityWorkaround = undefined;
+            }
+            if (succeeded || retainedAfterFailure) {
+                if (typeof details.managedSessionHeadedAutosaveDisabled === "boolean")
+                    launch.headedManagedAutosaveDisabled = details.managedSessionHeadedAutosaveDisabled;
+                if (typeof details.managedSessionHeadedAutosaveInterval === "string")
+                    launch.headedManagedAutosaveInterval = details.managedSessionHeadedAutosaveInterval;
+                else if (details.managedSessionHeadedAutosaveDisabled === true)
+                    launch.headedManagedAutosaveInterval = "0";
+            }
+            events.managedSessionLaunchState.set(key, launch);
+        }
         const outcomeSucceeded = outcome?.succeeded === true;
         const outcomeStatus = typeof outcome?.status === "string" ? outcome.status : undefined;
         const outcomeCurrentSessionName = typeof outcome?.currentSessionName === "string" ? outcome.currentSessionName : undefined;
@@ -858,7 +795,7 @@ function hasArgvFlag(argv, longFlag, shortFlag) {
 function shouldIncludeProjectConfig(ctx, argv = process.argv) {
     if (hasArgvFlag(argv, "--no-approve", "-na"))
         return false;
-    return ctx?.isProjectTrusted?.() ?? true;
+    return ctx.isProjectTrusted();
 }
 export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
     const ephemeralSessionSeed = createEphemeralSessionSeed();
@@ -868,6 +805,21 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
     });
     const implicitSessionIdleTimeoutMs = String(getImplicitSessionIdleTimeoutMs());
     const implicitSessionCloseTimeoutMs = getImplicitSessionCloseTimeoutMs();
+    let promptState;
+    const restorePromptState = (ctx) => {
+        return promptState = { sessionId: ctx.sessionManager.getSessionId(), message: getLatestUserMessage(ctx.sessionManager) };
+    };
+    const getPromptPolicy = (ctx) => {
+        const state = promptState?.sessionId === ctx.sessionManager.getSessionId() ? promptState : restorePromptState(ctx);
+        // Native message_end precedes later transforms/persistence; retain the message
+        // reference so replacement user text cannot leave policy on the earlier text.
+        const text = getMessageText(state.message?.content);
+        if (!state.policy || state.text !== text) {
+            state.text = text;
+            state.policy = buildPromptPolicy(text);
+        }
+        return state.policy;
+    };
     let webSearchToolRegistered = false;
     let managedSessionActive = false;
     let managedSessionBaseName = createImplicitSessionName(undefined, process.cwd(), ephemeralSessionSeed);
@@ -1121,11 +1073,11 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
         clearSessionScopedBrowserState(sessionName, AGENT_BROWSER_SCRIPT_NAMESPACE);
         return undefined;
     };
-    const recoverScriptSessionLeasesWithinQueue = async (ctx) => {
+    const recoverScriptSessionLeasesWithinQueue = async (ctx, branch) => {
         const pendingSessionNames = new Set([...ownedManagedSessions.values()]
             .map((session) => session.sessionName)
             .filter(isAgentBrowserScriptSessionName));
-        for (const lease of getScriptSessionLeasesFromBranch(await readBrowserEntries(ctx.sessionManager), ctx.sessionManager.getSessionId()).values()) {
+        for (const lease of getScriptSessionLeasesFromBranch(branch, ctx.sessionManager.getSessionId()).values()) {
             if (lease.cleanup !== "closed")
                 pendingSessionNames.add(lease.sessionName);
         }
@@ -1138,6 +1090,7 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
     const restoreBranchBackedState = async (ctx, options) => {
         branchRestoreGeneration += 1;
         branchStateGeneration += 1;
+        restorePromptState(ctx);
         const previousManagedSessionActive = managedSessionActive;
         const previousManagedSessionName = managedSessionName;
         const previousFreshSessionOrdinal = freshSessionOrdinal;
@@ -1179,15 +1132,11 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
                 : createFreshSessionName(managedSessionBaseName, ephemeralSessionSeed, nextFreshSessionOrdinal)
             : restoredState.sessionName;
         managedSessionNamespace = shouldReservePostCloseSession ? undefined : restoredState.namespace;
-        managedSessionCompatibilityWorkaround = managedSessionActive
-            ? restoreManagedSessionCompatibilityWorkaroundFromBranch(branch, managedSessionName, managedSessionNamespace)
-            : undefined;
-        managedSessionHeadedAutosaveDisabled = managedSessionActive
-            && restoreManagedSessionHeadedAutosaveDisabledFromBranch(branch, managedSessionName, managedSessionNamespace);
-        managedSessionHeadedAutosaveInterval = managedSessionActive
-            ? restoreManagedSessionHeadedAutosaveIntervalFromBranch(branch, managedSessionName, managedSessionNamespace)
-            : undefined;
-        managedSessionCwd = restoreManagedSessionCwd(branch, managedSessionName, managedSessionNamespace, ctx.cwd);
+        const currentLaunch = branchResourceEvents.managedSessionLaunchState.get(getSessionContextKey(managedSessionName, managedSessionNamespace) ?? managedSessionName);
+        managedSessionCompatibilityWorkaround = managedSessionActive ? currentLaunch?.compatibilityWorkaround : undefined;
+        managedSessionHeadedAutosaveDisabled = managedSessionActive && currentLaunch?.headedManagedAutosaveDisabled === true;
+        managedSessionHeadedAutosaveInterval = managedSessionActive ? currentLaunch?.headedManagedAutosaveInterval : undefined;
+        managedSessionCwd = currentLaunch?.cwd ?? ctx.cwd;
         freshSessionOrdinal = nextFreshSessionOrdinal;
         sessionPageState = SessionPageState.fromBranch(branch);
         traceOwners = new Map();
@@ -1238,13 +1187,14 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
                 continue;
             if (!isRestorableManagedSessionName(identity.sessionName, managedSessionBaseName))
                 continue;
-            trackOwnedManagedSession(ownedManagedSessions, identity.sessionName, restoreManagedSessionCwd(branch, identity.sessionName, identity.namespace, ctx.cwd), {
+            const launch = branchResourceEvents.managedSessionLaunchState.get(sessionKey);
+            trackOwnedManagedSession(ownedManagedSessions, identity.sessionName, launch?.cwd ?? ctx.cwd, {
                 branchOwned: true,
-                compatibilityWorkaround: restoreManagedSessionCompatibilityWorkaroundFromBranch(branch, identity.sessionName, identity.namespace),
-                headedManagedAutosaveDisabled: restoreManagedSessionHeadedAutosaveDisabledFromBranch(branch, identity.sessionName, identity.namespace),
-                headedManagedAutosaveInterval: restoreManagedSessionHeadedAutosaveIntervalFromBranch(branch, identity.sessionName, identity.namespace),
+                compatibilityWorkaround: launch?.compatibilityWorkaround,
+                headedManagedAutosaveDisabled: launch?.headedManagedAutosaveDisabled ?? false,
+                headedManagedAutosaveInterval: launch?.headedManagedAutosaveInterval,
                 namespace: identity.namespace,
-                socketDir: restoreManagedSessionSocketDir(branch, identity.sessionName, identity.namespace),
+                socketDir: launch?.socketDir,
             });
         }
         if (restoredState.active) {
@@ -1254,7 +1204,7 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
                 headedManagedAutosaveDisabled: managedSessionHeadedAutosaveDisabled,
                 headedManagedAutosaveInterval: managedSessionHeadedAutosaveInterval,
                 namespace: restoredState.namespace,
-                socketDir: restoreManagedSessionSocketDir(branch, restoredState.sessionName, restoredState.namespace),
+                socketDir: currentLaunch?.socketDir,
             });
         }
         const pendingOwnedBegins = new Map();
@@ -1290,11 +1240,12 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
             const closeRank = branchResourceEvents.managedSessionCloseRanks.get(sessionKey);
             if (activeRank === undefined || (closeRank !== undefined && closeRank >= activeRank))
                 continue;
-            trackOwnedManagedSession(ownedManagedSessions, record.sessionName, restoreManagedSessionCwd(branch, record.sessionName, undefined, ctx.cwd), {
+            const launch = branchResourceEvents.managedSessionLaunchState.get(sessionKey);
+            trackOwnedManagedSession(ownedManagedSessions, record.sessionName, launch?.cwd ?? ctx.cwd, {
                 branchOwned: true,
-                headedManagedAutosaveDisabled: restoreManagedSessionHeadedAutosaveDisabledFromBranch(branch, record.sessionName),
-                headedManagedAutosaveInterval: restoreManagedSessionHeadedAutosaveIntervalFromBranch(branch, record.sessionName),
-                socketDir: restoreManagedSessionSocketDir(branch, record.sessionName),
+                headedManagedAutosaveDisabled: launch?.headedManagedAutosaveDisabled ?? false,
+                headedManagedAutosaveInterval: launch?.headedManagedAutosaveInterval,
+                socketDir: launch?.socketDir,
             });
         }
         mergeActiveElectronLaunchRecords(ownedElectronLaunchRecords, new Map([...electronLaunchRecords].filter(([, record]) => record.ownerSessionId === browserOwnerSessionId)), {
@@ -1323,6 +1274,7 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
                     attachedSessionKeys.add(sessionKey);
             }
         }
+        return branch;
     };
     const registerWebSearchToolIfAvailable = (configState) => {
         if (webSearchToolRegistered || !canRegisterWebSearchTool(configState))
@@ -1339,15 +1291,19 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
         });
         webSearchToolRegistered = true;
     };
+    pi.on("message_end", (event, ctx) => {
+        if (event.message.role === "user")
+            promptState = { sessionId: ctx.sessionManager.getSessionId(), message: event.message };
+    });
     pi.on("session_start", async (_event, ctx) => {
-        await restoreBranchBackedState(ctx, { resetRuntimeOwnership: true });
-        electronChildProcesses = new Map();
-        registerWebSearchToolIfAvailable(loadAgentBrowserConfigSync({
-            cwd: ctx.cwd,
-            includeProjectConfig: shouldIncludeProjectConfig(ctx),
-        }));
         await managedSessionExecutionQueue.run(() => artifactExecutionQueue.run(async () => {
-            await recoverScriptSessionLeasesWithinQueue(ctx);
+            const branch = await restoreBranchBackedState(ctx, { resetRuntimeOwnership: true });
+            electronChildProcesses = new Map();
+            registerWebSearchToolIfAvailable(loadAgentBrowserConfigSync({
+                cwd: ctx.cwd,
+                includeProjectConfig: shouldIncludeProjectConfig(ctx),
+            }));
+            await recoverScriptSessionLeasesWithinQueue(ctx, branch);
             flushRecordingReservations();
             notifyRecordingPersistence(ctx);
         }));
@@ -1358,87 +1314,12 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
             controller.abort();
         await Promise.allSettled([...activeScriptExecutions]);
         await managedSessionExecutionQueue.run(() => artifactExecutionQueue.run(async () => {
-            await restoreBranchBackedState(ctx, { resetRuntimeOwnership: false });
-            await recoverScriptSessionLeasesWithinQueue(ctx);
+            const branch = await restoreBranchBackedState(ctx, { resetRuntimeOwnership: false });
+            await recoverScriptSessionLeasesWithinQueue(ctx, branch);
             flushRecordingReservations();
             notifyRecordingPersistence(ctx);
         }));
     });
-    // Fork-only checkpoint event; official Pi validation types do not declare it.
-    // Pi owns awaited tools/events (including their execution queues). Detached code
-    // children and retained browser/recording resources still need extension-side checks.
-    const checkpointPi = pi;
-    checkpointPi.on("session_checkpoint", async (event, ctx) => {
-        const blocked = (reason) => ({ sleepReady: false, reason });
-        if (browserReplayError)
-            return blocked(browserReplayError);
-        if (activeScriptControllers.size || activeScriptExecutions.size)
-            return blocked("Browser code execution is pending");
-        flushRecordingReservations();
-        if (recordingReservationsDirty)
-            return blocked("Browser recording journal persistence is dirty");
-        if (activeRecordingReservations.size)
-            return blocked("Browser recording is pending; finish it explicitly before sleep");
-        const entries = await readBrowserEntries(ctx.sessionManager, true);
-        if ([...getScriptSessionLeasesFromBranch(entries).values()].some(lease => lease.cleanup !== "closed")
-            || [...ownedManagedSessions.values()].some(owner => isAgentBrowserScriptSessionName(owner.sessionName))) {
-            return blocked("Browser script cleanup lease is unresolved");
-        }
-        if (getActiveElectronRecords(ownedElectronLaunchRecords).length || getActiveElectronRecords(electronLaunchRecords).length
-            || [...electronChildProcesses.values()].some(child => child.exitCode === null && child.signalCode === null)) {
-            return blocked("Electron launch is still active");
-        }
-        if (attachedSessionKeys.size || restoreAttachedSessionKeysFromBranch(entries).size)
-            return blocked("Attached browser state is caller-owned and not checkpointed");
-        if (traceOwners.size || [...networkRoutesBySession.values()].some(routes => routes.length))
-            return blocked("Browser trace or network routes are still active");
-        // Include off-branch and caller-owned/root identities, without acquiring
-        // cleanup ownership. Transcript page/ref details do not serialize a browser.
-        const historicalResources = collectBranchManagedResourceEvents(entries);
-        const sessions = new Map(ownedManagedSessions);
-        if (managedSessionActive)
-            trackOwnedManagedSession(sessions, managedSessionName, managedSessionCwd, { namespace: managedSessionNamespace });
-        for (const entry of entries) {
-            const message = getBrowserResultMessage(entry);
-            if (!message)
-                continue;
-            const details = isRecord(message.details) ? message.details : undefined;
-            // Helpers can launch before a main-process failure. Conversely, native
-            // launch flags on sessionless reads can open the unnamed default browser.
-            const sessionName = typeof details?.sessionName === "string" ? details.sessionName
-                : details?.agentBrowserStarted === true ? "default" : undefined;
-            if (!sessionName)
-                continue;
-            const namespace = typeof details?.namespace === "string" ? details.namespace : undefined;
-            const key = getSessionContextKey(sessionName, namespace) ?? sessionName;
-            if (!sessions.has(key))
-                trackOwnedManagedSession(sessions, sessionName, ctx.cwd, { namespace });
-        }
-        for (const [key, owner] of sessions) {
-            event.signal.throwIfAborted();
-            // An abnormal restart can leave a wrapper-created browser only off-branch.
-            // Reuse native ownership events for inspection, never cleanup ownership.
-            // A later close can refer to the same identity in a different socket root.
-            const historicalIdentity = historicalResources.managedSessionActiveIdentities.get(key);
-            const historicallyOwned = historicalIdentity && isRestorableManagedSessionName(historicalIdentity.sessionName, managedSessionBaseName);
-            const context = resolveOwnedManagedSessionContext({
-                ...owner,
-                currentManagedSessionName: managedSessionActive ? managedSessionName : undefined,
-                currentManagedSessionNamespace: managedSessionNamespace,
-                recordedOwnedSession: ownedManagedSessions.get(key) ?? (historicallyOwned ? { ...historicalIdentity, cwd: ctx.cwd } : undefined),
-                restoreState: managedSessionRestoreState,
-            });
-            // Owned routing must not mask an explicit caller's same-name ambient daemon.
-            for (const inspectionContext of context ? [{ ...context, reuseOnly: true }, undefined] : [undefined]) {
-                const daemon = await withAgentBrowserProcessEnvironment(inspectionContext && owner.socketDir ? { PI_AGENT_BROWSER_SOCKET_DIR: owner.socketDir } : {}, () => withOwnedManagedSessionContext(inspectionContext, () => inspectManagedSessionDaemon({ ...owner, signal: event.signal, timeoutMs: 2_000 })));
-                if (daemon.status !== "inactive")
-                    return blocked("Browser daemon is live or unverified; finish browser work explicitly before sleep");
-            }
-        }
-        // No detached writer remains to pause/resume. Native ingress stays held;
-        // checkpoint never closes a browser or changes ordinary shutdown ownership.
-        return { sleepReady: true };
-    });
     pi.on("session_shutdown", async (event, ctx) => {
         for (const controller of activeScriptControllers)
             controller.abort();
@@ -1548,11 +1429,11 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
             event.systemPromptOptions.sections.agent_browser = fullInstructions(ctx);
     });
     pi.on("tool_call", async (event, ctx) => {
-        const promptPolicy = buildPromptPolicy(getLatestUserPrompt(ctx.sessionManager.getBranch()));
-        if (isBashToolCallEvent(event) &&
-            !promptPolicy.allowLegacyAgentBrowserBash &&
-            looksLikeDirectAgentBrowserBash(event.input.command) &&
-            !isHarmlessAgentBrowserInspectionCommand(event.input.command) &&
+        if (!isBashToolCallEvent(event) || !looksLikeDirectAgentBrowserBash(event.input.command)
+            || isHarmlessAgentBrowserInspectionCommand(event.input.command))
+            return;
+        const promptPolicy = getPromptPolicy(ctx);
+        if (!promptPolicy.allowLegacyAgentBrowserBash &&
             !(await isDirectAgentBrowserBashAllowed(ctx.cwd))) {
             return {
                 block: true,
@@ -1560,7 +1441,6 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
             };
         }
     });
-    pi.on("tool_result", async (event) => buildAgentBrowserToolResultPatch(event));
     let emptyBrowserBranch;
     const captureCurrentBrowserBranch = (ctx) => {
         const generation = branchRestoreGeneration;
@@ -1583,7 +1463,7 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
             const component = context.lastComponent instanceof AgentBrowserResultComponent
                 ? context.lastComponent
                 : new AgentBrowserResultComponent();
-            component.setState(formatAgentBrowserRenderResult(result, options, theme, context.isError), options.expanded, theme);
+            component.setResult(result, options, theme, context.isError);
             return component;
         },
         async execute(toolCallId, params, signal, onUpdate, ctx, nativeToolCallId = toolCallId, capturedCwd, modelVisible = true, commandIndex, selectedBranch) {
@@ -1595,7 +1475,7 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
             catch (error) {
                 return buildValidationFailureResult({ kind: "invalid", status: "invalid", redactedArgs: [], toolArgs: [], validationError: error instanceof Error ? error.message : String(error) });
             }
-            const promptPolicy = buildPromptPolicy(getLatestUserPrompt(ctx.sessionManager.getBranch()));
+            const promptPolicy = getPromptPolicy(ctx);
             const outputPath = isRecord(params) && typeof params.outputPath === "string" ? params.outputPath : undefined;
             const admittedInput = resolveAgentBrowserInput({
                 getBatchPreflightValidationError: (args, stdin) => getArtifactPreflightValidationError({ args, cwd: operationCwd, outputPath, stdin }),
@@ -2266,10 +2146,10 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
             }) };
         const rendered = await renderAgentBrowserObservation(renderOptions);
         if (!priorManifest && !rendered.artifactManifest)
-            return { ...result, content: rendered.content, details: { ...details, browserEventVersion: 1 } };
+            return { ...result, content: rendered.content, structuredContent: rendered.structuredContent, details: { ...details, browserEventVersion: 1 } };
         return artifactExecutionQueue.run(async () => {
             if (!branch.isCurrent())
-                return { ...result, content: rendered.content, details: { ...details, browserEventVersion: 1, artifactManifest: rendered.artifactManifest } };
+                return { ...result, content: rendered.content, structuredContent: rendered.structuredContent, details: { ...details, browserEventVersion: 1, artifactManifest: rendered.artifactManifest } };
             const before = artifactManifest;
             const merged = mergeBrowserRunArtifactManifest(artifactManifest, priorManifest, rendered.artifactManifest);
             const changes = artifactChanges(before, merged);
@@ -2277,10 +2157,10 @@ export default function agentBrowserExtension(pi, { beforeExecute } = {}) {
                 const record = { event: { version: 1, phase: "state", operationId: randomUUID(), toolCallId: "observation", commandIndex: 0, isError: result.isError === true, state: {}, artifacts: changes } };
                 if (!await appendBrowserRecord(ctx.sessionManager, () => appendBrowserTransition(pi, record), record, branch)
                     || !branch.isCurrent())
-                    return { ...result, content: rendered.content, details: { ...details, browserEventVersion: 1, artifactManifest: rendered.artifactManifest } };
+                    return { ...result, content: rendered.content, structuredContent: rendered.structuredContent, details: { ...details, browserEventVersion: 1, artifactManifest: rendered.artifactManifest } };
             }
             artifactManifest = mergeBrowserRunArtifactManifest(artifactManifest, priorManifest, rendered.artifactManifest);
-            return { ...result, content: rendered.content, details: { ...details, browserEventVersion: 1, artifactManifest: invocationArtifactManifest(artifactManifest, before, details, priorManifest) } };
+            return { ...result, content: rendered.content, structuredContent: rendered.structuredContent, details: { ...details, browserEventVersion: 1, artifactManifest: invocationArtifactManifest(artifactManifest, before, details, priorManifest) } };
         });
     };
     registerAgentBrowserToolSurface(pi, {