pi-agent-browser-native 0.9.1 → 0.9.3

package/dist/extensions/agent-browser/lib/orchestration/electron-host/index.js

@@ -6,6 +6,7 @@ import { getPageTargetValidationError } from "../../page-target-validation.js";
 import { isRecord } from "../../parsing.js";
 import { getBrowserResultMessage } from "../../browser-transcript.js";
 import { withAttachedBrowserSessionContext } from "../../process.js";
+import { getAgentBrowserProcessEnvironment, withAgentBrowserProcessEnvironment } from "../../process-environment.js";
 import { buildAgentBrowserNextActions } from "../../results/action-recommendations.js";
 import { buildAgentBrowserResultCategoryDetails } from "../../results/categories.js";
 import { appendUniqueAgentBrowserNextActions } from "../../results/next-actions.js";
@@ -397,37 +398,39 @@ function getElectronProbeSummary(probe) {
 class ElectronManagedSessionPolicyError extends Error {
 }
 async function withOwnedElectronManagedSessionPolicy(options, run) {
-    const autosavePolicyChangeError = getRunningHeadedAutosavePolicyChangeError(options.headedManagedAutosaveInterval);
-    if (autosavePolicyChangeError)
-        throw new ElectronManagedSessionPolicyError(autosavePolicyChangeError);
-    const context = buildOwnedManagedSessionRestoreContext({
-        args: ["--namespace", options.namespace ?? "", "--session", options.sessionName, ...options.args],
-        cwd: options.cwd,
-        headedManagedAutosaveDisabled: options.headedManagedAutosaveDisabled,
-        headedManagedAutosaveInterval: options.headedManagedAutosaveInterval,
-        managedSessionName: options.sessionName,
-        namespace: options.namespace,
-        restoreState: options.restoreState,
+    return withAgentBrowserProcessEnvironment({ AGENT_BROWSER_CONFIRM_ACTIONS: options.confirmActions }, async () => {
+        const autosavePolicyChangeError = getRunningHeadedAutosavePolicyChangeError(options.headedManagedAutosaveInterval);
+        if (autosavePolicyChangeError)
+            throw new ElectronManagedSessionPolicyError(autosavePolicyChangeError);
+        const context = buildOwnedManagedSessionRestoreContext({
+            args: ["--namespace", options.namespace ?? "", "--session", options.sessionName, ...options.args],
+            cwd: options.cwd,
+            headedManagedAutosaveDisabled: options.headedManagedAutosaveDisabled,
+            headedManagedAutosaveInterval: options.headedManagedAutosaveInterval,
+            managedSessionName: options.sessionName,
+            namespace: options.namespace,
+            restoreState: options.restoreState,
+        });
+        if (!context)
+            throw new ElectronManagedSessionPolicyError("Electron helper could not establish wrapper ownership for its managed session.");
+        let policy;
+        try {
+            policy = await acquireOwnedManagedSessionDaemonPolicy({ context, electronLaunchRecord: options.electronLaunchRecord, electronVerificationTimeoutMs: options.timeoutMs, signal: options.signal });
+        }
+        catch (error) {
+            throw new ElectronManagedSessionPolicyError(error instanceof Error ? error.message : String(error), { cause: error });
+        }
+        try {
+            if (policy.error)
+                throw new ElectronManagedSessionPolicyError(policy.error);
+            if (!policy.lock)
+                throw new ElectronManagedSessionPolicyError(options.signal?.aborted ? "Electron helper was aborted." : "Electron helper could not acquire managed-session policy coordination.");
+            return await withOwnedManagedSessionContext(context, run);
+        }
+        finally {
+            await policy.lock?.release();
+        }
     });
-    if (!context)
-        throw new ElectronManagedSessionPolicyError("Electron helper could not establish wrapper ownership for its managed session.");
-    let policy;
-    try {
-        policy = await acquireOwnedManagedSessionDaemonPolicy({ context, electronLaunchRecord: options.electronLaunchRecord, electronVerificationTimeoutMs: options.timeoutMs, signal: options.signal });
-    }
-    catch (error) {
-        throw new ElectronManagedSessionPolicyError(error instanceof Error ? error.message : String(error), { cause: error });
-    }
-    try {
-        if (policy.error)
-            throw new ElectronManagedSessionPolicyError(policy.error);
-        if (!policy.lock)
-            throw new ElectronManagedSessionPolicyError(options.signal?.aborted ? "Electron helper was aborted." : "Electron helper could not acquire managed-session policy coordination.");
-        return await withOwnedManagedSessionContext(context, run);
-    }
-    finally {
-        await policy.lock?.release();
-    }
 }
 async function collectOwnedElectronManagedSessionTarget(options) {
     try {
@@ -603,7 +606,7 @@ export async function cleanupTrackedElectronHostLaunches(options) {
         const sessionKey = getSessionPageStateKey(record.sessionName, record.namespace) ?? record.sessionName;
         const managedSessionOwner = sessionKey ? options.ownedManagedSessions.get(sessionKey) : undefined;
         const managedSessionCloseError = record.sessionName
-            ? await closeManagedSession({ cwd: options.cwd, headedManagedAutosaveInterval: managedSessionOwner?.headedManagedAutosaveInterval, namespace: record.namespace, preserveAttachedBrowserSession: options.attachedSessionKeys.has(sessionKey ?? record.sessionName), restoreState: options.managedSessionRestoreState, sessionName: record.sessionName, socketDir: managedSessionOwner?.socketDir, timeoutMs: options.timeoutMs })
+            ? await closeManagedSession({ confirmActions: options.sessionPageState.get(sessionKey ?? record.sessionName).confirmActions ?? process.env.AGENT_BROWSER_CONFIRM_ACTIONS, cwd: options.cwd, headedManagedAutosaveInterval: managedSessionOwner?.headedManagedAutosaveInterval, namespace: record.namespace, preserveAttachedBrowserSession: options.attachedSessionKeys.has(sessionKey ?? record.sessionName), restoreState: options.managedSessionRestoreState, sessionName: record.sessionName, socketDir: managedSessionOwner?.socketDir, timeoutMs: options.timeoutMs })
             : undefined;
         const managedSessionStep = record.sessionName
             ? managedSessionCloseError
@@ -673,6 +676,7 @@ async function handleElectronHostInputInContext(options) {
             .map((record) => {
             const sessionKey = getSessionPageStateKey(record.sessionName, record.namespace) ?? record.sessionName;
             return collectOwnedElectronManagedSessionTarget({
+                confirmActions: sessionPageState.get(sessionKey).confirmActions ?? getAgentBrowserProcessEnvironment().AGENT_BROWSER_CONFIRM_ACTIONS,
                 cwd,
                 electronLaunchRecord: record,
                 headedManagedAutosaveDisabled: ownedManagedSessions.get(sessionKey)?.headedManagedAutosaveDisabled,
@@ -749,6 +753,7 @@ async function handleElectronHostInputInContext(options) {
             const headedManagedAutosaveInterval = managedSessionOwner?.headedManagedAutosaveInterval;
             const probe = await withOwnedElectronManagedSessionPolicy({
                 args: ["snapshot", "-i"],
+                confirmActions: currentPageState.confirmActions ?? getAgentBrowserProcessEnvironment().AGENT_BROWSER_CONFIRM_ACTIONS,
                 cwd,
                 electronLaunchRecord: launchRecord,
                 headedManagedAutosaveDisabled,
@@ -821,7 +826,7 @@ async function handleElectronHostInputInContext(options) {
         const selection = selectElectronRecords(compiledElectron, electronLaunchRecords);
         if (selection.error)
             return buildElectronHostFailureResult({ compiledElectron: redactedCompiledElectron ?? compiledElectron, errorText: selection.error, failureCategory: "validation-error" });
-        const cleanupResults = await cleanupTrackedElectronHostLaunches({ attachedSessionKeys, cwd, electronChildProcesses, electronLaunchRecords, managedSessionRestoreState, ownedManagedSessions, records: selection.records ?? [], timeoutMs: compiledElectron.timeoutMs ?? implicitSessionCloseTimeoutMs });
+        const cleanupResults = await cleanupTrackedElectronHostLaunches({ attachedSessionKeys, cwd, electronChildProcesses, electronLaunchRecords, managedSessionRestoreState, ownedManagedSessions, sessionPageState, records: selection.records ?? [], timeoutMs: compiledElectron.timeoutMs ?? implicitSessionCloseTimeoutMs });
         return buildElectronCleanupResult(redactedCompiledElectron ?? compiledElectron, cleanupResults);
     }
     return undefined;

package/dist/extensions/agent-browser/lib/orchestration/native-session-defaults.js

@@ -48,7 +48,7 @@ async function readNativeIdentity(path, cwd, signal, rootFallback, browserComman
         return {};
     const rootLaunchConfig = browserCommand && (hasLocalLaunchDefaults(config, {}) || ["cdp", "autoConnect", "provider"].some((key) => config[key] !== undefined))
         || rootFallback && ["restore", "sessionName", "state", "allowedDomains", "profile", "executablePath"].some((key) => config[key] !== undefined);
-    if (!rootLaunchConfig && typeof config.session !== "string" && typeof config.namespace !== "string")
+    if (!rootLaunchConfig && config.confirmActions === undefined && typeof config.session !== "string" && typeof config.namespace !== "string")
         return {};
     const result = await runAgentBrowserProcess({ args: ["--config", path, "--json", "session"], cwd, signal, timeoutMs: 5_000 });
     try {
@@ -73,9 +73,7 @@ async function readNativeIdentity(path, cwd, signal, rootFallback, browserComman
     }
 }
 export async function withNativeSessionDefaults(input, cwd, signal, run, root) {
-    if (input.kind === "electron" && input.compiledElectron.action === "launch")
-        return withAgentBrowserProcessEnvironment({ AGENT_BROWSER_SESSION: undefined }, () => run(input));
-    if (input.kind === "electron" || isPlainTextInspectionArgs(input.toolArgs))
+    if (isPlainTextInspectionArgs(input.toolArgs))
         return run(input);
     const env = getAgentBrowserProcessEnvironment();
     const configArg = scanUpstreamGlobalFlagOccurrences(input.toolArgs, "--config")[0];
@@ -85,12 +83,19 @@ export async function withNativeSessionDefaults(input, cwd, signal, run, root) {
         : [join(homedir(), ".agent-browser", "config.json"), join(cwd, "agent-browser.json")];
     const rootName = root && rootBrowserSessionName(root.id);
     const explicitSession = extractExplicitSessionName(input.toolArgs);
+    const browserCommand = input.kind !== "electron" && needsManagedSession(parseArgvDescriptor(input.toolArgs), input.toolStdin);
     const rootFallback = root !== undefined && env.AGENT_BROWSER_SESSION === undefined && (explicitSession === undefined || explicitSession === rootName)
-        && needsManagedSession(parseArgvDescriptor(input.toolArgs), input.toolStdin);
+        && browserCommand;
     let identity = {};
-    const browserCommand = needsManagedSession(parseArgvDescriptor(input.toolArgs), input.toolStdin);
     for (const path of paths)
         identity = { ...identity, ...await readNativeIdentity(path, cwd, signal, rootFallback, browserCommand) };
+    if (input.kind === "electron") {
+        const nativeConfirmActions = env.AGENT_BROWSER_CONFIRM_ACTIONS ?? (typeof identity.confirmActions === "string" ? identity.confirmActions : undefined);
+        return withAgentBrowserProcessEnvironment({
+            ...(input.compiledElectron.action === "launch" ? { AGENT_BROWSER_SESSION: undefined } : {}),
+            ...(configPath !== undefined ? { AGENT_BROWSER_CONFIG: resolve(cwd, configPath) } : {}),
+        }, () => run({ ...input, nativeConfirmActions }));
+    }
     // Native ORs environment/config booleans; only CLI false overrides configured auto-connect.
     const autoConnect = getBooleanFlagValue(input.toolArgs, "--auto-connect")
         ?? (isUpstreamEnvFlagEnabled(env.AGENT_BROWSER_AUTO_CONNECT) || identity.autoConnect === true);
@@ -100,11 +105,12 @@ export async function withNativeSessionDefaults(input, cwd, signal, run, root) {
     const configuredSession = env.AGENT_BROWSER_SESSION ?? identity.session;
     const launchArgs = scanUpstreamGlobalFlagOccurrences(input.toolArgs, "--args").at(-1)?.value ?? env.AGENT_BROWSER_ARGS ?? identity.args;
     const engine = scanUpstreamGlobalFlagOccurrences(input.toolArgs, "--engine").at(-1)?.value ?? env.AGENT_BROWSER_ENGINE ?? identity.engine;
+    const chromeEngine = engine === undefined || engine === "chrome";
     const provider = scanUpstreamGlobalFlagOccurrences(input.toolArgs, "--provider").at(-1)?.value ?? scanUpstreamGlobalFlagOccurrences(input.toolArgs, "-p").at(-1)?.value ?? env.AGENT_BROWSER_PROVIDER ?? identity.provider;
     const tokens = parseArgvDescriptor(input.toolArgs).upstreamCommandTokens;
     const batchAttaches = requestsConnection(tokens, input.toolStdin);
     const localChrome = browserCommand && !attachment && !batchAttaches && provider === undefined
-        && (engine === undefined || engine === "chrome");
+        && chromeEngine;
     const chromeStartupArgs = localChrome ? ["--no-startup-window", ...(typeof launchArgs === "string" ? [launchArgs] : [])].join(",") : undefined;
     const persistentChromeArgs = hasLocalLaunchDefaults(identity, env) ? chromeStartupArgs : undefined;
     const configuredChromeLaunch = persistentChromeArgs !== undefined || [...LOCAL_VALUE_DEFAULTS, ...LOCAL_BOOLEAN_DEFAULTS, ...LOCAL_ARRAY_DEFAULTS, "hideScrollbars", "clearCaCert"].some(key => {
@@ -122,12 +128,22 @@ export async function withNativeSessionDefaults(input, cwd, signal, run, root) {
     if (session !== undefined && extractExplicitSessionName(args) === undefined)
         args = ["--session", session, ...args];
     const idleTimeout = scanUpstreamGlobalFlagOccurrences(args, "--idle-timeout").at(-1)?.value;
+    const actionPolicy = scanUpstreamGlobalFlagOccurrences(args, "--action-policy").at(-1)?.value;
+    const confirmActions = scanUpstreamGlobalFlagOccurrences(args, "--confirm-actions").at(-1)?.value;
+    const nativeConfirmActions = confirmActions ?? env.AGENT_BROWSER_CONFIRM_ACTIONS
+        ?? (typeof identity.confirmActions === "string" ? identity.confirmActions : undefined);
+    const debug = getBooleanFlagValue(args, "--debug");
+    const noAutoDialog = getBooleanFlagValue(args, "--no-auto-dialog");
     return withAgentBrowserProcessEnvironment({
         ...(idleTimeout !== undefined ? { AGENT_BROWSER_IDLE_TIMEOUT_MS: idleTimeout } : {}),
+        ...(actionPolicy !== undefined ? { AGENT_BROWSER_ACTION_POLICY: actionPolicy } : {}),
+        ...(confirmActions !== undefined ? { AGENT_BROWSER_CONFIRM_ACTIONS: confirmActions } : {}),
+        ...(debug !== undefined ? { AGENT_BROWSER_DEBUG: debug ? "1" : undefined } : {}),
+        ...(noAutoDialog !== undefined ? { AGENT_BROWSER_NO_AUTO_DIALOG: noAutoDialog ? "1" : "0" } : {}),
         ...(configPath !== undefined ? { AGENT_BROWSER_CONFIG: resolve(cwd, configPath) } : {}),
         ...(session !== undefined ? { AGENT_BROWSER_SESSION: session } : {}),
         ...(namespace !== undefined ? { AGENT_BROWSER_NAMESPACE: namespace } : {}),
-    }, () => run({ ...input, toolArgs: args, chromeStartupArgs, persistentChromeArgs, configuredChromeLaunch }, !rootDefault ? undefined : async (browserRun, launchSignal = signal) => {
+    }, () => run({ ...input, toolArgs: args, nativeConfirmActions, chromeStartupArgs, persistentChromeArgs, configuredChromeLaunch }, !rootDefault ? undefined : async (browserRun, launchSignal = signal) => {
         const daemon = await inspectManagedSessionDaemon({ cwd, signal: launchSignal, sessionName: rootDefault,
             namespace: scanUpstreamGlobalFlagOccurrences(args, "--namespace").at(-1)?.value ?? namespace, timeoutMs: 5_000 });
         if (daemon.status === "missing-binary")
@@ -147,13 +163,16 @@ export async function withNativeSessionDefaults(input, cwd, signal, run, root) {
         if (restoreEligible && bootstrap)
             restore = rootDefault;
         const profile = scanUpstreamGlobalFlagOccurrences(args, "--profile").at(-1)?.value
-            ?? (bootstrap && restoreEligible && identity.profile === undefined && env.AGENT_BROWSER_PROFILE === undefined ? root?.profile : undefined);
+            ?? (bootstrap && chromeEngine && restoreEligible && identity.profile === undefined && env.AGENT_BROWSER_PROFILE === undefined ? root?.profile : undefined);
         const executablePath = scanUpstreamGlobalFlagOccurrences(args, "--executable-path").at(-1)?.value
-            ?? (bootstrap && identity.executablePath === undefined && env.AGENT_BROWSER_EXECUTABLE_PATH === undefined ? root?.executablePath : undefined);
+            ?? (bootstrap && chromeEngine && identity.executablePath === undefined && env.AGENT_BROWSER_EXECUTABLE_PATH === undefined ? root?.executablePath : undefined);
         return withAgentBrowserProcessEnvironment({
             ...(restore !== undefined ? { AGENT_BROWSER_RESTORE: restore } : {}),
             ...(profile !== undefined ? { AGENT_BROWSER_PROFILE: profile } : {}),
             ...(executablePath !== undefined ? { AGENT_BROWSER_EXECUTABLE_PATH: executablePath } : {}),
         }, () => withChromeStartupArgs(bootstrap || configuredChromeLaunch ? chromeStartupArgs : undefined, () => browserRun(bootstrap)));
-    }));
+    }), [
+        ...(debug !== undefined ? [["--debug", String(debug)]] : []),
+        ...(noAutoDialog !== undefined ? [["--no-auto-dialog", String(noAutoDialog)]] : []),
+    ]); // Native ORs env/config booleans; helpers need CLI false to override true config.
 }

package/dist/extensions/agent-browser/lib/orchestration/output-file.js

@@ -1,6 +1,7 @@
 import { mkdir, readFile, realpath, stat, writeFile } from "node:fs/promises";
 import { dirname, extname, isAbsolute, resolve } from "node:path";
 import { isRecord } from "../parsing.js";
+import { getBooleanFlagValue } from "../argv-grammar.js";
 import { isSessionArtifactManifest } from "../results/artifact-manifest.js";
 import { parseCommandInfo, redactSensitiveValue } from "../runtime.js";
 export function normalizeRequestedOutputPath(path) {
@@ -80,8 +81,9 @@ function serializeOutputPayload(value) {
 function appendOutputFileNotice(result, message, failed = false) {
     const content = [...(result.content ?? [])];
     if (content[0]?.type === "text") {
+        const nativeText = isRecord(result.details) && Array.isArray(result.details.args) && getBooleanFlagValue(result.details.args, "--json") === false;
         try {
-            const json = JSON.parse(content[0].text);
+            const json = nativeText ? undefined : JSON.parse(content[0].text);
             if (isRecord(json) && typeof json.success === "boolean") {
                 content[0] = { type: "text", text: JSON.stringify({ ...json, ...(failed ? { success: false, error: message } : {}), outputFileNotice: message }, null, 2) };
                 return content;

package/dist/extensions/agent-browser/lib/page-target-validation.js

@@ -2,6 +2,8 @@ import { parseArgvDescriptor } from "./argv-descriptor.js";
 import { GLOBAL_BOOLEAN_FLAGS_WITH_OPTIONAL_VALUES, VALUE_FLAGS, } from "./argv-grammar.js";
 import { isBrowserIndependentRead, needsManagedSession } from "./command-policy.js";
 import { isUnverifiedPageTransitionCommand } from "./command-taxonomy.js";
+import { isRecord } from "./parsing.js";
+import { detectConfirmationRequired } from "./results/confirmation.js";
 import { parseBatchCommandArgument, parseUserBatchStdin } from "./orchestration/batch-stdin.js";
 const UNVERIFIED_PAGE_MESSAGE = "The active page became unverified after a tab, attachment, history, script, or state-load transition. Run get url or navigate explicitly before page-content inspection.";
 const BATCH_UNVERIFIED_PAGE_MESSAGE = `${UNVERIFIED_PAGE_MESSAGE} In a batch, put get url after the transition before later content steps, or split the batch at that boundary.`;
@@ -31,7 +33,7 @@ function getPositionalOperands(commandTokens) {
     }
     return values;
 }
-function getExplicitNavigationTarget(args) {
+export function getExplicitNavigationTarget(args) {
     const descriptor = parseArgvDescriptor(args);
     const positionals = getPositionalOperands(descriptor.upstreamCommandTokens);
     if (EXPLICIT_NAVIGATION_COMMANDS.has(descriptor.commandInfo.command ?? ""))
@@ -85,6 +87,8 @@ function getBatchCommandSteps(args, stdin) {
     if (parsedStdin.error)
         return { error: parsedStdin.error, steps: [] };
     for (const step of parsedStdin.steps ?? []) {
+        if (step.length === 0)
+            continue;
         if (parseArgvDescriptor(step).commandInfo.command === "batch")
             return { error: NESTED_BATCH_ARGUMENT_MESSAGE, steps: [] };
         steps.push(step);
@@ -153,7 +157,10 @@ export function getResultingPageTargetState(options) {
             || isUnverifiedPageTransitionCommand(descriptor.commandInfo.command, descriptor.commandInfo.subcommand);
         return { ...getResultingPageState({ ...state, args: options.args, trustedBatchTabSelection: false }), pageTargetMayHaveChanged };
     }
-    for (const step of options.executedBatchSteps) {
+    for (const [index, step] of options.executedBatchSteps.entries()) {
+        const row = Array.isArray(options.batchResults) ? options.batchResults[index] : undefined;
+        if (isRecord(row) && detectConfirmationRequired(row.result))
+            continue;
         const stepDescriptor = parseArgvDescriptor(step);
         pageTargetMayHaveChanged ||= getExplicitNavigationTarget(step) !== undefined
             || isUnverifiedPageTransitionCommand(stepDescriptor.commandInfo.command, stepDescriptor.commandInfo.subcommand);
@@ -211,7 +218,7 @@ export function getPageTargetValidationError(options) {
             let directError;
             let failedNavigationHazard = false;
             for (const state of possibleStates) {
-                const error = getUnverifiedPageError({
+                const error = options.allowFirstBatchConfirmation === true && index === 0 ? undefined : getUnverifiedPageError({
                     allowUnverifiedPageTransitions: options.allowUnverifiedPageTransitions,
                     args: step,
                     pageUrlUnknown: state.pageUrlUnknown,

package/dist/extensions/agent-browser/lib/pi-tool-rendering.js

@@ -5,6 +5,7 @@ import { compileAgentBrowserNetworkSourceLookup, compileAgentBrowserSourceLookup
 import { compileAgentBrowserSemanticAction } from "./input-modes/semantic-action.js";
 import { isRecord } from "./parsing.js";
 import { redactInvocationArgs } from "./runtime.js";
+import { isBooleanFlagEnabled } from "./argv-grammar.js";
 const TUI_INVOCATION_PREVIEW_MAX_CHARS = 160;
 const TUI_COLLAPSED_OUTPUT_MAX_LINES = 12;
 const ANSI_CONTROL_SEQUENCE_PATTERN = /\x1B(?:\][^\x07\x1B\r\n\u2028\u2029]*(?:\x07|\x1B\\)|\[[0-?]*[ -/]*[@-~]|P[^\x1B\r\n\u2028\u2029]*(?:\x1B\\)|_[^\x1B\r\n\u2028\u2029]*(?:\x1B\\)|\^[^\x1B\r\n\u2028\u2029]*(?:\x1B\\)|[@-Z\\-_])/g;
@@ -188,7 +189,7 @@ function agentBrowserToolResultRequestedJson(result, input) {
     const details = isRecord(result.details) ? result.details : undefined;
     const detailArgs = Array.isArray(details?.args) ? details.args : undefined;
     const inputArgs = isRecord(input) && Array.isArray(input.args) ? input.args : undefined;
-    return detailArgs?.includes("--json") === true || inputArgs?.includes("--json") === true;
+    return isBooleanFlagEnabled(detailArgs ?? [], "--json") || isBooleanFlagEnabled(inputArgs ?? [], "--json");
 }
 function agentBrowserToolResultHasParseableJsonContent(content) {
     return content.some((item) => {

package/dist/extensions/agent-browser/lib/playbook.js

@@ -14,7 +14,7 @@ export const QUICK_START_GUIDELINES = [
     "Example agent_browser_code: { code: 'const result = await browser({args:[\"get\",\"title\"]}); if (!result.success) { emit(result); } else { emit({title:result.data}); }' }. Native batch still avoids extra CLI processes for fixed segments inside code. Explicit session/namespace controls select the browser for this cell without changing the default browser.",
     "Call agent_browser_tools with no fields for inventory, or { enable: [\"action\", \"qa\", \"electron\", \"source\", \"network\"] } for advanced native tools. It adds agent_browser_action, agent_browser_qa, agent_browser_electron, agent_browser_source, and agent_browser_network_source without disabling other tools. The browser instructions cover these capabilities; activation reveals their selected tool declarations.",
     "Use read <url> for readable web text; get title/url, get text/html/value/count <selector>, or get attr <selector> <name> for targeted state. For eval --stdin, put JavaScript in stdin and return the desired value. outputPath saves result data and must differ from screenshot/download/recording paths. Use --json only when JSON text is needed.",
-    "For artifacts, verify artifactVerification and artifacts before reporting success. A pending recording is not verified output; install ffmpeg before starting and pair start with stop. Native download owns the click and saves Blob/redirect downloads. Close keeps explicitly saved files. Save promptGuard-required paths before close. Screenshot pixels are not browser CSS coordinates: use imageObservations geometry (dimensions, viewport, crop/origin, scroll and DPR) before any visual-coordinate action; full-page and element captures are not current-viewport coordinates, and Pi resizing only maps sent pixels to original image pixels.",
+    "For artifacts, verify artifactVerification and artifacts before reporting success. A pending recording is not verified output; install ffmpeg before starting and pair start with stop. Native download owns the click and saves Blob/redirect downloads. Close keeps explicitly saved files. Save promptGuard-required paths before close. Screenshot pixels are not browser CSS coordinates: use imageObservations geometry (dimensions, viewport, crop/origin, scroll and DPR) before any visual-coordinate action; full-page and element captures are not current-viewport coordinates, and Pi resizing only maps sent pixels to original image pixels. Lightpanda images are text-rendered, not graphical layout; rendering:text never supports CSS/mouse-coordinate input.",
     "Follow model-visible nextActions when present, including identity and stdin, instead of guessing commands. Treat native pending confirmations and unknown mutation outcomes as inspection boundaries. For dense snapshots, inspect Omitted high-value controls before reading a full spill.",
 ];
 export const ADVANCED_TOOL_PROMPT_GUIDELINES = {
@@ -61,6 +61,7 @@ export const SHARED_BROWSER_PLAYBOOK_GUIDELINES = [
     "Cooperating Pi processes serialize each complete browser operation and code cell by native socket context, namespace, and session, including target/ref helpers and state updates. Different identities remain concurrent; namespace-wide close waits for matching operations. All participating Pi instances must load this release; humans, third-party clients, and older extensions are outside that coordination. It is not a transaction or rollback. For raw batches whose later content depends on navigation, use exact batch --bail or split the calls.",
     "After a successful `connect`, `--cdp`, or enabled `--auto-connect` call, verify with get url and keep using the resulting session without repeating the attach flag. The wrapper remembers that attachment across active-branch reload/resume and live-checks the URL before later page reads/interactions because an attached browser can drift externally; caller config, file access, launch arguments, and environment pass through unchanged. A successful close clears the marker. When several named sessions share one Chrome, pass --pin-tab once (AGENT_BROWSER_PIN_TAB) so a closed bound tab fails as tab_gone instead of acting on a neighbor; recover with tab new or tab list. --no-pin-tab turns the sticky pin off. tab list includes each tab's CDP targetId, accepted as a tab ref.",
     `If you already used the implicit session and now need launch-scoped flags (${LAUNCH_SCOPED_FLAG_LABEL}), retry with top-level sessionMode set to fresh or pass an explicit --session for the new launch; never pass --session-mode inside args. After a successful unnamed fresh launch, later auto calls follow that new session.`,
+    "Chrome is the default. Use separately installed Lightpanda only when explicitly selected with --engine lightpanda, environment or native config; --engine is launch-scoped, so use sessionMode:fresh to change a managed browser. Lightpanda text-rendered screenshots do not prove graphical layout/visibility or mouse coordinates. Chrome profiles, headed mode, multi-tab, WebGPU and native WebMCP are not parity capabilities; choose Chrome explicitly when needed, never assume automatic fallback.",
     "For WebGPU pages, use args [\"--webgpu\", \"open\", \"<url>\"] on a fresh local browser launch; use doctor --webgpu (or --headed on Linux/Windows capture paths) to prove rendering before trusting a non-black screenshot. WebGPU cannot be combined with --cdp, --auto-connect, or provider launches unless --webgpu false overrides an enabled config/environment default.",
     "For experimental WebMCP page tools, use webmcp list, then webmcp invoke <tool> with --params and optional --frame/--detach/--timeout; use webmcp result or cancel for detached calls. Locally managed Chrome enables WebMCP by default; a positive navigation hint means the page has tools to list. --no-webmcp is launch-scoped and requires a fresh session; invoke/result/cancel can mutate or navigate, so refresh snapshot refs afterward.",
     "For --allowed-domains, use a fresh local Chrome context. Upstream rejects CDP/auto-connect, profiles, restore/state replay, direct-page providers, iOS/Safari, and startup/profile Chrome args because they cannot guarantee containment; Chromium also disables RTCPeerConnection while the allowlist is active.",
@@ -72,7 +73,7 @@ export const SHARED_BROWSER_PLAYBOOK_GUIDELINES = [
     "For non-core families, pass current upstream commands through the native tool directly: network requests, network route <url>, network har start/stop [path], diff snapshot, diff screenshot --baseline <file>, diff url <u1> <u2>, trace start, trace stop [path], profiler start, profiler stop [path], record start <path>, record stop, console/errors [--clear], highlight <selector>, inspect, clipboard read, clipboard write <text>, clipboard copy/paste, stream enable/disable/status, dashboard start/stop, device list for iOS simulator inventory, and chat <message>. For compact network requests output, prefer details.nextActions for request detail, route-mock diagnostics, actionable failed-request agent_browser_network_source, filtering, clearing the aggregate buffer before repro, or HAR capture follow-ups instead of guessing request-id syntax. Artifact-producing commands report details.artifacts and verification state; long-running starts such as stream, dashboard, trace/profiler, and record should be paired with the matching stop/disable command when the task is done; stream enable already-enabled outcomes are treated as idempotent success with status/disable follow-ups.",
     "For Electron desktop apps, enable agent_browser_electron through agent_browser_tools for wrapper-owned discovery, isolated launch, status, compact probe, and cleanup: list first, treat likely-sensitive annotations as hints rather than enforcement, launch with the default snapshot handoff unless handoff: \"tabs\" is the safer diagnostic starting point, use agent_browser_electron probe or snapshot -i/agent_browser_qa attached:true for current-session state, and always cleanup the returned launchId when done. agent_browser_electron launch uses an isolated temporary profile; it does not reuse the app's normal signed-in profile or attach to an already-running authenticated app. For signed-in local app state, host-launch the normal app with --remote-debugging-port when appropriate, then use raw args connect <port|url>; after connect, run get url to verify the active target before page-content reads, inspect tab list, select the stable tab id such as tab t2, verify it again with get url, then run a condition wait or snapshot -i before using refs. close commands (`close`, `quit`, or `exit`) only close the browser/CDP session; leave manually launched app shutdown, profile cleanup, and explicit artifacts to the host owner.",
     "For provider or specialized app workflows, load version-matched upstream guidance with skills get agentcore|electron|slack|dogfood|vercel-sandbox|derive-client through the native tool; add --full when you need references/templates, and use skills get --all only for broad skill audits. Use derive-client when recording HAR traffic to generate a standalone API client; prefer network har start (text bodies by default) or network har start --content all|none before multi-step capture. For accessibility audits use a11y or a11y --tags wcag2a,wcag2aa (CDP browsers only). Hosted sandbox workflows should use upstream @agent-browser/sandbox helpers outside this wrapper. Provider launches such as -p ios, --provider browserbase/kernel/browseruse/browserless/agentcore, and iOS --device are upstream-owned setup paths; use sessionMode fresh when switching providers and expect external credentials or local Appium/Xcode setup to be required.",
-    "For dialogs and frames, use dialog status/accept/dismiss and frame <selector|main> through native args; dialog commands and eval snippets that look like alert/confirm/prompt/dialog triggers are shorter-bounded than normal browser calls, and timed-out dialog-like interactions may add inspect-dialog-after-timeout, dismiss-dialog-after-timeout, or recover-fresh-session-after-dialog-timeout nextActions. When --confirm-actions produces a pending confirmation, use details.nextActions or exact confirm <id> / deny <id> calls instead of inventing ids.",
+    "For dialogs and frames, use dialog status/accept/dismiss and frame <selector|main> through native args; dialog commands and eval snippets that look like alert/confirm/prompt/dialog triggers are shorter-bounded than normal browser calls, and timed-out dialog-like interactions may add inspect-dialog-after-timeout, dismiss-dialog-after-timeout, or recover-fresh-session-after-dialog-timeout nextActions. Set --confirm-actions on the session's first command; selected strings, including an explicit empty string, follow same-identity helpers and resumed follow-ups until successful close. Native unset keeps ordinary native defaults. Changing a running daemon's policy can discard pending confirmations. When it produces a pending confirmation, including a cold-reopen helper, follow the exact details.nextActions or confirm <id> / deny <id> calls without repeating the policy or inventing ids. Matching native guarded controls avoid page helpers that could replace the pending action; this is not native ID-validation proof or browser independence. In native batch, only a matching first effective decision gets that helper suppression; later page/ref checks remain. Nested decisions remain pending; failed inner actions fail, and completed browser actions reconcile their page state. A pending tab_new transport may show a validated after_confirmation open request and conditional guidance: follow it in the same session and new tab only after successful tab approval, never after denial. The extension does not execute that continuation. Confirmed full snapshots install returned refs; a final confirmed capture supplies the next same-identity call's freshness sample once, including semantic role click/check/fill and unique accessible select resolution, with target/membership/invalidation checks intact. On this one use, live verification compares the complete capture URL, including fragments, and rejects refs when it changes—including wrapper-owned managed sessions and warm sessions without resume. Ordinary ref/tab URL comparisons remain fragment-insensitive. Pending snapshots display confirmation required, not an empty page. Intervening calls or later rows consume it; DOM-only renames on the same page after that sample are not resampled on this one use.",
     "If a session lands on the wrong page or tab, an interaction changes origin unexpectedly, or an open call returns blocked, blank, or otherwise unexpected results, use tab list / tab <tab-id-or-label> / snapshot -i to recover state before retrying different URLs or fallback strategies. For headed demos, put --headed on the first launch with sessionMode=fresh and verify with screenshot/tab/get-url evidence because tool success cannot prove the OS window is visible to the user. For desktop readiness, prefer real conditions first: wait --text, wait --url, wait --fn, wait --load <state>, wait --download, or agent_browser_qa attached:true; for disappearance checks, use wait --fn predicates instead of stale upstream-help examples like wait <selector> --state hidden. Use agent_browser_electron probe/status for wrapper-owned launch health or target mismatch. Fixed waits are a last resort: their duration is positional (wait <ms>, not wait --time <ms>). Use explicit --timeout or top-level timeoutMs for legitimately slow waits, and treat a successful payload like \"waited\":\"timeout\" as elapsed time only—verify completion with an observed condition, fresh snapshot, or screenshot.",
     "For feed, timeline, or inbox reading tasks, focus on the main timeline/list region and read the first item there rather than unrelated composer or sidebar content.",
     "For read-only browsing tasks, use read <url> for documentation or other unstructured text without requiring a Chrome page, or read with no URL for rendered active-tab DOM. Prefer the current snapshot, structured ref labels, getters, or scoped eval --stdin when you need interactive structure or targeted page state. Only click into media viewers, detail routes, or new pages when the current view does not contain the needed information.",
@@ -80,7 +81,7 @@ export const SHARED_BROWSER_PLAYBOOK_GUIDELINES = [
     "On dashboards with nested scroll containers, verify scroll with a screenshot or fresh snapshot -i; if the viewport did not move, details.data.scrolled may be false/noMovement true and you should prefer scrollintoview <@ref> or target the actual scrollable region with scroll <selector> <dir> [px|percent]. For native selects, use select <selector> <value...> (or agent_browser_action select) instead of clicking option refs; for custom comboboxes, a click/agent_browser_action may only focus the field, so re-snapshot and use keyboard type <text> for focused input, press ArrowDown or press Enter, or visible option refs. Raw type requires both <selector> and <text>.",
     "When using eval --stdin, scope checks and actions to the target element or route whenever possible instead of relying on broad page-wide text heuristics.",
     "When using eval --stdin for extraction, pass the JavaScript through the native tool stdin field, not as an extra args token after --stdin, and return the value you want instead of relying on console.log as the primary result channel. Prefer plain expressions like ({ title: document.title }) or explicitly invoked functions like (() => ({ title: document.title }))(); use outputPath when the eval/get/snapshot data should be saved as a durable local file, but never reuse a screenshot, download, recording, or other browser artifact destination as outputPath. If a function-shaped snippet returns {}, details.evalStdinHint may warn that the function was serialized instead of called. Local file pages and caller-selected output paths are supported when upstream allows them. If get text on a broad CSS selector surfaces details.selectorTextVisibility or selectorTextVisibilityAll, prefer a visible @ref, a more specific selector, or the inspect-visible-text-candidates nextAction over hidden tab content.",
-    "When details.pageChangeSummary is present, use changeType and summary as a compact signal for navigation, DOM mutation, confirmations, or artifacts; when nextActionIds is set, match those ids to entries in details.nextActions (or per-step nextActions inside batch) for concrete follow-up payloads instead of inferring from prose alone. Click-dispatch probes require native get attr readback of a temporary marker on the candidate target; unproven ref or XPath identity leaves the native click unverified, not failed. If details.clickDispatch reports a click-dispatch miss, refresh/inspect/retry the real click first; for static local fixtures only, an explicit eval --stdin programmatic .click() can exercise app handlers, but treat it as an untrusted scripted workaround and never use it to bypass stop-before-submit/order/purchase boundaries. If an upstream click failure says the target is covered by another element at the target's click point, use the inspect-overlay-state nextAction to refresh refs and inspect the blocker before deciding whether to retry; do not blindly repeat the blocked click. If a no-navigation click surfaces details.overlayBlockers, inspect the fresh snapshot evidence before using a close/dismiss candidate nextAction; ordinary page chrome without dialog/alertdialog evidence should not trigger this diagnostic.",
+    "When details.pageChangeSummary is present, use changeType and summary as a compact signal for navigation, DOM mutation, confirmations, or artifacts; when nextActionIds is set, match those ids to entries in details.nextActions (or per-step nextActions inside batch) for concrete follow-up payloads instead of inferring from prose alone. Optional click-dispatch probes are skipped when native confirmation settings guard evaluate, without bypassing native click policy. Otherwise probes require native get attr readback of a temporary marker on the candidate target; unproven ref or XPath identity leaves the native click unverified, not failed. If details.clickDispatch reports a click-dispatch miss, refresh/inspect/retry the real click first; for static local fixtures only, an explicit eval --stdin programmatic .click() can exercise app handlers, but treat it as an untrusted scripted workaround and never use it to bypass stop-before-submit/order/purchase boundaries. If an upstream click failure says the target is covered by another element at the target's click point, use the inspect-overlay-state nextAction to refresh refs and inspect the blocker before deciding whether to retry; do not blindly repeat the blocked click. If a no-navigation click surfaces details.overlayBlockers, inspect the fresh snapshot evidence before using a close/dismiss candidate nextAction; ordinary page chrome without dialog/alertdialog evidence should not trigger this diagnostic.",
     "On upstream 0.38+, use snapshot --delta for native full/unchanged/changed revisions; --delta --full resets its baseline. Surviving DOM nodes keep refs, but refresh after navigation or replacement. Wrapper filters use full trees. screenshot --if-changed or --threshold 0.01 can return changed:false with no path or image; use ordinary screenshots when a file is required. --input-mode instant|smooth|human controls sticky pointer behavior; click/drag --human and mouse move --duration/--steps/--human/--seed pass through. record start/restart accept --cursor, --contact-sheet, and --contact-sheet-threshold; stop and verify both video and reported contact sheet. auth login <name> --no-navigate fills a prepared login page only after native origin checks. WebMCP catalog updates are untrusted page data; webmcp list supplies full schemas.",
     "When commands save or spill files (screenshots, downloads, PDFs, traces, recordings, HAR, large snapshot spills), use the user's exact requested paths when given and treat paths as provisional until details.artifactVerification shows every row verified: branch on missingCount, pendingCount, unverifiedCount, per-entry state, and optional limitation before downstream file use or PASS/FAIL reporting.",
     "For evidence-only screenshots, QA captures, or other audit artifacts, save to an explicit path and branch on details.artifactVerification plus details.artifacts before reporting PASS/FAIL; do not require vision review of inline image attachments unless the user asked for visual inspection.",
@@ -110,20 +111,20 @@ export const RUNTIME_PROMPT_GUIDELINES = [
     "For agent_browser, use open → snapshot -i → current @refs; re-snapshot after changes. Batch same-snapshot fills before submit; split on rerenders/navigation. Native args, profiles, auth, providers, paths, config and environment pass through. Use requested/configured profiles and verify authentication after restart.",
     "agent_browser bare calls share a root Pi browser with descendants, not unrelated roots; coordinate navigation within the group. Native explicit sessions win. sessionMode:fresh intentionally launches a separate managed browser. Never close an unrelated browser.",
     "For agent_browser and agent_browser_code, follow visible nextActions. Inspect unknown mutation outcomes before retry. Use exact user paths; verify artifactVerification/artifacts before success claims. Save promptGuard-required files before close; close keeps files; waited:timeout proves nothing.",
-    "For agent_browser screenshot coordinates, use imageObservations dimensions/viewport/crop/origin/scroll/DPR; full-page and element images are not viewport CSS coordinates. Pi image resizing maps sent pixels to original image pixels only. Prefer refs; inspect screenshots only when the task needs vision.",
+    "For agent_browser screenshot coordinates, use imageObservations dimensions/viewport/crop/origin/scroll/DPR; full-page and element images are not viewport CSS coordinates. Pi image resizing maps sent pixels to original image pixels only. Lightpanda rendering:text images never establish CSS/mouse coordinates. Prefer refs; inspect screenshots only when the task needs vision.",
     "In agent_browser workflows, ordinary requested non-destructive submissions may proceed in authenticated unattended/auto-approved flows. Honor explicit stops; require explicit authorization for purchases, production-control, destructive/irreversible, or account/security/privacy changes.",
     "agent_browser: read <url> for text, get title/url, get text/html/value/count <selector>, get attr <selector> <name>; heed visibility warnings and Omitted high-value controls. Verify nested scrolling via snapshot/screenshot. Use --json only for JSON text; recording needs ffmpeg before start and a verified stop.",
 ];
 export function buildBrowserExecutablePathGuideline(executablePath) {
     if (!executablePath)
         return undefined;
-    return `agent_browser config sets browser.executablePath to ${JSON.stringify(executablePath)}. Global/override values bootstrap inactive automatic root browsers; bare calls preserve active native launch settings. Project-only values remain guidance for explicit --executable-path launches. Use sessionMode:fresh only for an intentionally separate managed browser, not routine root-group browsing. Upstream profiles lists Chrome profiles only; use a supported explicit profile path for other Chromium browsers.`;
+    return `agent_browser config sets browser.executablePath to ${JSON.stringify(executablePath)}. Global/override values bootstrap inactive automatic root Chrome browsers, not Lightpanda; bare calls preserve active native launch settings. Project-only values remain guidance for explicit --executable-path launches. Use sessionMode:fresh only for an intentionally separate managed browser, not routine root-group browsing. Upstream profiles lists Chrome profiles only; use a supported explicit profile path for other Chromium browsers.`;
 }
 export function buildBrowserDefaultProfileGuideline(profile) {
     if (!profile || profile.policy === "explicit-only")
         return undefined;
     if (profile.policy === "always") {
-        return `agent_browser config sets browser.defaultProfile.name to ${JSON.stringify(profile.name)} with policy always. Global/override Chrome profile names bootstrap automatic root browsers through independent native copies with per-root restore; bare calls and helpers preserve the active native launch settings without resending bootstrap options. Paths and project-only settings stay advisory. Explicit unrelated sessions are unchanged. Verify actual app auth after restart: native JSON restore omits new IndexedDB and memory-only credentials; use a supported per-root persistent profile if needed. Profile content is model-visible user data.`;
+        return `agent_browser config sets browser.defaultProfile.name to ${JSON.stringify(profile.name)} with policy always. Global/override Chrome profile names bootstrap automatic root Chrome browsers, not Lightpanda, through independent native copies with per-root restore; bare calls and helpers preserve the active native launch settings without resending bootstrap options. Paths and project-only settings stay advisory. Explicit unrelated sessions are unchanged. Verify actual app auth after restart: native JSON restore omits new IndexedDB and memory-only credentials; use a supported per-root persistent profile if needed. Profile content is model-visible user data.`;
     }
     return `agent_browser config sets browser.defaultProfile.name to ${JSON.stringify(profile.name)}; for signed-in/account-specific browser tasks, reuse a configured native shared session with bare calls, otherwise start with --profile ${JSON.stringify(profile.name)} plus sessionMode:fresh unless the user asks for a different profile.`;
 }

package/dist/extensions/agent-browser/lib/process-environment.js

@@ -1,5 +1,6 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { rm } from "node:fs/promises";
+import { getBooleanFlagValue } from "./argv-grammar.js";
 import { writeSecureTempFile } from "./temp.js";
 const isolatedAgentBrowserEnvironment = new AsyncLocalStorage();
 const agentBrowserProcessEnvironment = new AsyncLocalStorage();
@@ -7,7 +8,7 @@ const PROXY_ENV_NAMES = new Set(["ALL_PROXY", "HTTPS_PROXY", "HTTP_PROXY", "NO_P
 export function getAgentBrowserProcessEnvironment(baseEnv = process.env) {
     const isolatedConfig = isolatedAgentBrowserEnvironment.getStore();
     if (isolatedConfig === undefined)
-        return { ...baseEnv, ...agentBrowserProcessEnvironment.getStore() };
+        return { ...baseEnv, ...agentBrowserProcessEnvironment.getStore()?.env };
     return {
         ...Object.fromEntries(Object.entries(baseEnv).filter(([name]) => {
             const normalizedName = name.toUpperCase();
@@ -16,8 +17,16 @@ export function getAgentBrowserProcessEnvironment(baseEnv = process.env) {
         AGENT_BROWSER_CONFIG: isolatedConfig,
     };
 }
-export function withAgentBrowserProcessEnvironment(env, run) {
-    return agentBrowserProcessEnvironment.run({ ...agentBrowserProcessEnvironment.getStore(), ...env }, run);
+export function getAgentBrowserProcessArgs(args) {
+    if (isolatedAgentBrowserEnvironment.getStore() !== undefined)
+        return args;
+    const overrides = agentBrowserProcessEnvironment.getStore()?.booleanArgs ?? [];
+    const missing = overrides.flatMap(([flag, value]) => getBooleanFlagValue(args, flag) === undefined ? [flag, value] : []);
+    return missing.length ? [...missing, ...args] : args;
+}
+export function withAgentBrowserProcessEnvironment(env, run, booleanArgs) {
+    const parent = agentBrowserProcessEnvironment.getStore();
+    return agentBrowserProcessEnvironment.run({ env: { ...parent?.env, ...env }, booleanArgs: booleanArgs ?? parent?.booleanArgs ?? [] }, run);
 }
 export async function withIsolatedAgentBrowserEnvironment(run) {
     if (isolatedAgentBrowserEnvironment.getStore() !== undefined)

package/dist/extensions/agent-browser/lib/process.js

@@ -9,7 +9,7 @@ import { extractExplicitSessionName, resolveAgentBrowserNamespace, scanUpstreamG
 import { commitManagedSessionRestoreSuppression, getManagedSessionRestoreEnv, getManagedSessionRestoreProtectedEnv, getOwnedManagedSessionCompatibilityEnv, getOwnedManagedSessionNamespaceEnv, isOwnedManagedSessionTarget, validateManagedSessionRestoreContextForSpawn, } from "./managed-session-restore.js";
 import { getPageTargetValidationError, } from "./page-target-validation.js";
 import { getImplicitSessionIdleTimeoutMs } from "./runtime.js";
-import { getAgentBrowserProcessEnvironment } from "./process-environment.js";
+import { getAgentBrowserProcessArgs, getAgentBrowserProcessEnvironment } from "./process-environment.js";
 import { openSecureTempFile, writeSecureTempChunk } from "./temp.js";
 import { resolveWindowsStockLauncher } from "./windows-stock-launcher.js";
 const MAX_BUFFERED_STDOUT_BYTES = 512 * 1_024;
@@ -328,11 +328,11 @@ export function buildAgentBrowserProcessEnv(baseEnv = processEnv, overrides = un
     clampUpstreamDefaultTimeout(childEnv);
     return childEnv;
 }
-function getManagedPreSpawnPolicyError(options, currentPageUrl, pageUrlUnknown = false, browserIndependentReadConfirmation = false) {
+function getManagedPreSpawnPolicyError(options, currentPageUrl, pageUrlUnknown = false, nativeConfirmationDecision = false) {
     if (!validateManagedSessionRestoreContextForSpawn(options)) {
         return "Managed session restore policy, storage, or checkout identity changed after planning; refusing to start agent-browser.";
     }
-    if (browserIndependentReadConfirmation)
+    if (nativeConfirmationDecision)
         return undefined;
     return getPageTargetValidationError({
         args: options.args,
@@ -361,7 +361,7 @@ export async function runAgentBrowserProcess(options) {
         restoreState: managedSessionRestoreState,
         stdin,
     };
-    const planningPolicyError = getManagedPreSpawnPolicyError(managedSessionRestoreOptions, managedStateCurrentPageUrl, managedStatePageUrlUnknown, options.browserIndependentReadConfirmation);
+    const planningPolicyError = getManagedPreSpawnPolicyError(managedSessionRestoreOptions, managedStateCurrentPageUrl, managedStatePageUrlUnknown, options.nativeConfirmationDecision);
     if (planningPolicyError) {
         return {
             aborted: false,
@@ -509,13 +509,13 @@ export async function runAgentBrowserProcess(options) {
                 });
             });
         };
-        const spawnPolicyError = getManagedPreSpawnPolicyError(managedSessionRestoreOptions, managedStateCurrentPageUrl, managedStatePageUrlUnknown, options.browserIndependentReadConfirmation);
+        const spawnPolicyError = getManagedPreSpawnPolicyError(managedSessionRestoreOptions, managedStateCurrentPageUrl, managedStatePageUrlUnknown, options.nativeConfirmationDecision);
         if (spawnPolicyError) {
             resolve({ aborted: false, agentBrowserStarted: false, exitCode: 1, spawnError: new Error(spawnPolicyError), stderr: "", stdout: "", timedOut: false });
             return;
         }
         const spawnBrowser = processPlatform === "win32" && !stockLauncher ? crossSpawn : spawn;
-        const child = spawnBrowser(stockLauncher ?? "agent-browser", prepareAgentBrowserSpawnArgs(args, ownedManagedSessionCompatibilityEnv.AGENT_BROWSER_USER_AGENT, preserveAttachedBrowserSession, chromeStartupArgsContext.getStore()), {
+        const child = spawnBrowser(stockLauncher ?? "agent-browser", prepareAgentBrowserSpawnArgs(getAgentBrowserProcessArgs(args), ownedManagedSessionCompatibilityEnv.AGENT_BROWSER_USER_AGENT, preserveAttachedBrowserSession, chromeStartupArgsContext.getStore()), {
             cwd,
             env: childEnv,
             stdio: ["pipe", "pipe", "pipe"],