pi-agent-browser-native 0.9.2 → 0.9.3

package/dist/extensions/agent-browser/lib/orchestration/electron-host/index.js

@@ -6,6 +6,7 @@ import { getPageTargetValidationError } from "../../page-target-validation.js";
 import { isRecord } from "../../parsing.js";
 import { getBrowserResultMessage } from "../../browser-transcript.js";
 import { withAttachedBrowserSessionContext } from "../../process.js";
+import { getAgentBrowserProcessEnvironment, withAgentBrowserProcessEnvironment } from "../../process-environment.js";
 import { buildAgentBrowserNextActions } from "../../results/action-recommendations.js";
 import { buildAgentBrowserResultCategoryDetails } from "../../results/categories.js";
 import { appendUniqueAgentBrowserNextActions } from "../../results/next-actions.js";
@@ -397,37 +398,39 @@ function getElectronProbeSummary(probe) {
 class ElectronManagedSessionPolicyError extends Error {
 }
 async function withOwnedElectronManagedSessionPolicy(options, run) {
-    const autosavePolicyChangeError = getRunningHeadedAutosavePolicyChangeError(options.headedManagedAutosaveInterval);
-    if (autosavePolicyChangeError)
-        throw new ElectronManagedSessionPolicyError(autosavePolicyChangeError);
-    const context = buildOwnedManagedSessionRestoreContext({
-        args: ["--namespace", options.namespace ?? "", "--session", options.sessionName, ...options.args],
-        cwd: options.cwd,
-        headedManagedAutosaveDisabled: options.headedManagedAutosaveDisabled,
-        headedManagedAutosaveInterval: options.headedManagedAutosaveInterval,
-        managedSessionName: options.sessionName,
-        namespace: options.namespace,
-        restoreState: options.restoreState,
+    return withAgentBrowserProcessEnvironment({ AGENT_BROWSER_CONFIRM_ACTIONS: options.confirmActions }, async () => {
+        const autosavePolicyChangeError = getRunningHeadedAutosavePolicyChangeError(options.headedManagedAutosaveInterval);
+        if (autosavePolicyChangeError)
+            throw new ElectronManagedSessionPolicyError(autosavePolicyChangeError);
+        const context = buildOwnedManagedSessionRestoreContext({
+            args: ["--namespace", options.namespace ?? "", "--session", options.sessionName, ...options.args],
+            cwd: options.cwd,
+            headedManagedAutosaveDisabled: options.headedManagedAutosaveDisabled,
+            headedManagedAutosaveInterval: options.headedManagedAutosaveInterval,
+            managedSessionName: options.sessionName,
+            namespace: options.namespace,
+            restoreState: options.restoreState,
+        });
+        if (!context)
+            throw new ElectronManagedSessionPolicyError("Electron helper could not establish wrapper ownership for its managed session.");
+        let policy;
+        try {
+            policy = await acquireOwnedManagedSessionDaemonPolicy({ context, electronLaunchRecord: options.electronLaunchRecord, electronVerificationTimeoutMs: options.timeoutMs, signal: options.signal });
+        }
+        catch (error) {
+            throw new ElectronManagedSessionPolicyError(error instanceof Error ? error.message : String(error), { cause: error });
+        }
+        try {
+            if (policy.error)
+                throw new ElectronManagedSessionPolicyError(policy.error);
+            if (!policy.lock)
+                throw new ElectronManagedSessionPolicyError(options.signal?.aborted ? "Electron helper was aborted." : "Electron helper could not acquire managed-session policy coordination.");
+            return await withOwnedManagedSessionContext(context, run);
+        }
+        finally {
+            await policy.lock?.release();
+        }
     });
-    if (!context)
-        throw new ElectronManagedSessionPolicyError("Electron helper could not establish wrapper ownership for its managed session.");
-    let policy;
-    try {
-        policy = await acquireOwnedManagedSessionDaemonPolicy({ context, electronLaunchRecord: options.electronLaunchRecord, electronVerificationTimeoutMs: options.timeoutMs, signal: options.signal });
-    }
-    catch (error) {
-        throw new ElectronManagedSessionPolicyError(error instanceof Error ? error.message : String(error), { cause: error });
-    }
-    try {
-        if (policy.error)
-            throw new ElectronManagedSessionPolicyError(policy.error);
-        if (!policy.lock)
-            throw new ElectronManagedSessionPolicyError(options.signal?.aborted ? "Electron helper was aborted." : "Electron helper could not acquire managed-session policy coordination.");
-        return await withOwnedManagedSessionContext(context, run);
-    }
-    finally {
-        await policy.lock?.release();
-    }
 }
 async function collectOwnedElectronManagedSessionTarget(options) {
     try {
@@ -603,7 +606,7 @@ export async function cleanupTrackedElectronHostLaunches(options) {
         const sessionKey = getSessionPageStateKey(record.sessionName, record.namespace) ?? record.sessionName;
         const managedSessionOwner = sessionKey ? options.ownedManagedSessions.get(sessionKey) : undefined;
         const managedSessionCloseError = record.sessionName
-            ? await closeManagedSession({ cwd: options.cwd, headedManagedAutosaveInterval: managedSessionOwner?.headedManagedAutosaveInterval, namespace: record.namespace, preserveAttachedBrowserSession: options.attachedSessionKeys.has(sessionKey ?? record.sessionName), restoreState: options.managedSessionRestoreState, sessionName: record.sessionName, socketDir: managedSessionOwner?.socketDir, timeoutMs: options.timeoutMs })
+            ? await closeManagedSession({ confirmActions: options.sessionPageState.get(sessionKey ?? record.sessionName).confirmActions ?? process.env.AGENT_BROWSER_CONFIRM_ACTIONS, cwd: options.cwd, headedManagedAutosaveInterval: managedSessionOwner?.headedManagedAutosaveInterval, namespace: record.namespace, preserveAttachedBrowserSession: options.attachedSessionKeys.has(sessionKey ?? record.sessionName), restoreState: options.managedSessionRestoreState, sessionName: record.sessionName, socketDir: managedSessionOwner?.socketDir, timeoutMs: options.timeoutMs })
             : undefined;
         const managedSessionStep = record.sessionName
             ? managedSessionCloseError
@@ -673,6 +676,7 @@ async function handleElectronHostInputInContext(options) {
             .map((record) => {
             const sessionKey = getSessionPageStateKey(record.sessionName, record.namespace) ?? record.sessionName;
             return collectOwnedElectronManagedSessionTarget({
+                confirmActions: sessionPageState.get(sessionKey).confirmActions ?? getAgentBrowserProcessEnvironment().AGENT_BROWSER_CONFIRM_ACTIONS,
                 cwd,
                 electronLaunchRecord: record,
                 headedManagedAutosaveDisabled: ownedManagedSessions.get(sessionKey)?.headedManagedAutosaveDisabled,
@@ -749,6 +753,7 @@ async function handleElectronHostInputInContext(options) {
             const headedManagedAutosaveInterval = managedSessionOwner?.headedManagedAutosaveInterval;
             const probe = await withOwnedElectronManagedSessionPolicy({
                 args: ["snapshot", "-i"],
+                confirmActions: currentPageState.confirmActions ?? getAgentBrowserProcessEnvironment().AGENT_BROWSER_CONFIRM_ACTIONS,
                 cwd,
                 electronLaunchRecord: launchRecord,
                 headedManagedAutosaveDisabled,
@@ -821,7 +826,7 @@ async function handleElectronHostInputInContext(options) {
         const selection = selectElectronRecords(compiledElectron, electronLaunchRecords);
         if (selection.error)
             return buildElectronHostFailureResult({ compiledElectron: redactedCompiledElectron ?? compiledElectron, errorText: selection.error, failureCategory: "validation-error" });
-        const cleanupResults = await cleanupTrackedElectronHostLaunches({ attachedSessionKeys, cwd, electronChildProcesses, electronLaunchRecords, managedSessionRestoreState, ownedManagedSessions, records: selection.records ?? [], timeoutMs: compiledElectron.timeoutMs ?? implicitSessionCloseTimeoutMs });
+        const cleanupResults = await cleanupTrackedElectronHostLaunches({ attachedSessionKeys, cwd, electronChildProcesses, electronLaunchRecords, managedSessionRestoreState, ownedManagedSessions, sessionPageState, records: selection.records ?? [], timeoutMs: compiledElectron.timeoutMs ?? implicitSessionCloseTimeoutMs });
         return buildElectronCleanupResult(redactedCompiledElectron ?? compiledElectron, cleanupResults);
     }
     return undefined;

package/dist/extensions/agent-browser/lib/orchestration/native-session-defaults.js

@@ -48,7 +48,7 @@ async function readNativeIdentity(path, cwd, signal, rootFallback, browserComman
         return {};
     const rootLaunchConfig = browserCommand && (hasLocalLaunchDefaults(config, {}) || ["cdp", "autoConnect", "provider"].some((key) => config[key] !== undefined))
         || rootFallback && ["restore", "sessionName", "state", "allowedDomains", "profile", "executablePath"].some((key) => config[key] !== undefined);
-    if (!rootLaunchConfig && typeof config.session !== "string" && typeof config.namespace !== "string")
+    if (!rootLaunchConfig && config.confirmActions === undefined && typeof config.session !== "string" && typeof config.namespace !== "string")
         return {};
     const result = await runAgentBrowserProcess({ args: ["--config", path, "--json", "session"], cwd, signal, timeoutMs: 5_000 });
     try {
@@ -73,9 +73,7 @@ async function readNativeIdentity(path, cwd, signal, rootFallback, browserComman
     }
 }
 export async function withNativeSessionDefaults(input, cwd, signal, run, root) {
-    if (input.kind === "electron" && input.compiledElectron.action === "launch")
-        return withAgentBrowserProcessEnvironment({ AGENT_BROWSER_SESSION: undefined }, () => run(input));
-    if (input.kind === "electron" || isPlainTextInspectionArgs(input.toolArgs))
+    if (isPlainTextInspectionArgs(input.toolArgs))
         return run(input);
     const env = getAgentBrowserProcessEnvironment();
     const configArg = scanUpstreamGlobalFlagOccurrences(input.toolArgs, "--config")[0];
@@ -85,12 +83,19 @@ export async function withNativeSessionDefaults(input, cwd, signal, run, root) {
         : [join(homedir(), ".agent-browser", "config.json"), join(cwd, "agent-browser.json")];
     const rootName = root && rootBrowserSessionName(root.id);
     const explicitSession = extractExplicitSessionName(input.toolArgs);
+    const browserCommand = input.kind !== "electron" && needsManagedSession(parseArgvDescriptor(input.toolArgs), input.toolStdin);
     const rootFallback = root !== undefined && env.AGENT_BROWSER_SESSION === undefined && (explicitSession === undefined || explicitSession === rootName)
-        && needsManagedSession(parseArgvDescriptor(input.toolArgs), input.toolStdin);
+        && browserCommand;
     let identity = {};
-    const browserCommand = needsManagedSession(parseArgvDescriptor(input.toolArgs), input.toolStdin);
     for (const path of paths)
         identity = { ...identity, ...await readNativeIdentity(path, cwd, signal, rootFallback, browserCommand) };
+    if (input.kind === "electron") {
+        const nativeConfirmActions = env.AGENT_BROWSER_CONFIRM_ACTIONS ?? (typeof identity.confirmActions === "string" ? identity.confirmActions : undefined);
+        return withAgentBrowserProcessEnvironment({
+            ...(input.compiledElectron.action === "launch" ? { AGENT_BROWSER_SESSION: undefined } : {}),
+            ...(configPath !== undefined ? { AGENT_BROWSER_CONFIG: resolve(cwd, configPath) } : {}),
+        }, () => run({ ...input, nativeConfirmActions }));
+    }
     // Native ORs environment/config booleans; only CLI false overrides configured auto-connect.
     const autoConnect = getBooleanFlagValue(input.toolArgs, "--auto-connect")
         ?? (isUpstreamEnvFlagEnabled(env.AGENT_BROWSER_AUTO_CONNECT) || identity.autoConnect === true);
@@ -123,12 +128,22 @@ export async function withNativeSessionDefaults(input, cwd, signal, run, root) {
     if (session !== undefined && extractExplicitSessionName(args) === undefined)
         args = ["--session", session, ...args];
     const idleTimeout = scanUpstreamGlobalFlagOccurrences(args, "--idle-timeout").at(-1)?.value;
+    const actionPolicy = scanUpstreamGlobalFlagOccurrences(args, "--action-policy").at(-1)?.value;
+    const confirmActions = scanUpstreamGlobalFlagOccurrences(args, "--confirm-actions").at(-1)?.value;
+    const nativeConfirmActions = confirmActions ?? env.AGENT_BROWSER_CONFIRM_ACTIONS
+        ?? (typeof identity.confirmActions === "string" ? identity.confirmActions : undefined);
+    const debug = getBooleanFlagValue(args, "--debug");
+    const noAutoDialog = getBooleanFlagValue(args, "--no-auto-dialog");
     return withAgentBrowserProcessEnvironment({
         ...(idleTimeout !== undefined ? { AGENT_BROWSER_IDLE_TIMEOUT_MS: idleTimeout } : {}),
+        ...(actionPolicy !== undefined ? { AGENT_BROWSER_ACTION_POLICY: actionPolicy } : {}),
+        ...(confirmActions !== undefined ? { AGENT_BROWSER_CONFIRM_ACTIONS: confirmActions } : {}),
+        ...(debug !== undefined ? { AGENT_BROWSER_DEBUG: debug ? "1" : undefined } : {}),
+        ...(noAutoDialog !== undefined ? { AGENT_BROWSER_NO_AUTO_DIALOG: noAutoDialog ? "1" : "0" } : {}),
         ...(configPath !== undefined ? { AGENT_BROWSER_CONFIG: resolve(cwd, configPath) } : {}),
         ...(session !== undefined ? { AGENT_BROWSER_SESSION: session } : {}),
         ...(namespace !== undefined ? { AGENT_BROWSER_NAMESPACE: namespace } : {}),
-    }, () => run({ ...input, toolArgs: args, chromeStartupArgs, persistentChromeArgs, configuredChromeLaunch }, !rootDefault ? undefined : async (browserRun, launchSignal = signal) => {
+    }, () => run({ ...input, toolArgs: args, nativeConfirmActions, chromeStartupArgs, persistentChromeArgs, configuredChromeLaunch }, !rootDefault ? undefined : async (browserRun, launchSignal = signal) => {
         const daemon = await inspectManagedSessionDaemon({ cwd, signal: launchSignal, sessionName: rootDefault,
             namespace: scanUpstreamGlobalFlagOccurrences(args, "--namespace").at(-1)?.value ?? namespace, timeoutMs: 5_000 });
         if (daemon.status === "missing-binary")
@@ -156,5 +171,8 @@ export async function withNativeSessionDefaults(input, cwd, signal, run, root) {
             ...(profile !== undefined ? { AGENT_BROWSER_PROFILE: profile } : {}),
             ...(executablePath !== undefined ? { AGENT_BROWSER_EXECUTABLE_PATH: executablePath } : {}),
         }, () => withChromeStartupArgs(bootstrap || configuredChromeLaunch ? chromeStartupArgs : undefined, () => browserRun(bootstrap)));
-    }));
+    }), [
+        ...(debug !== undefined ? [["--debug", String(debug)]] : []),
+        ...(noAutoDialog !== undefined ? [["--no-auto-dialog", String(noAutoDialog)]] : []),
+    ]); // Native ORs env/config booleans; helpers need CLI false to override true config.
 }

package/dist/extensions/agent-browser/lib/orchestration/output-file.js

@@ -1,6 +1,7 @@
 import { mkdir, readFile, realpath, stat, writeFile } from "node:fs/promises";
 import { dirname, extname, isAbsolute, resolve } from "node:path";
 import { isRecord } from "../parsing.js";
+import { getBooleanFlagValue } from "../argv-grammar.js";
 import { isSessionArtifactManifest } from "../results/artifact-manifest.js";
 import { parseCommandInfo, redactSensitiveValue } from "../runtime.js";
 export function normalizeRequestedOutputPath(path) {
@@ -80,8 +81,9 @@ function serializeOutputPayload(value) {
 function appendOutputFileNotice(result, message, failed = false) {
     const content = [...(result.content ?? [])];
     if (content[0]?.type === "text") {
+        const nativeText = isRecord(result.details) && Array.isArray(result.details.args) && getBooleanFlagValue(result.details.args, "--json") === false;
         try {
-            const json = JSON.parse(content[0].text);
+            const json = nativeText ? undefined : JSON.parse(content[0].text);
             if (isRecord(json) && typeof json.success === "boolean") {
                 content[0] = { type: "text", text: JSON.stringify({ ...json, ...(failed ? { success: false, error: message } : {}), outputFileNotice: message }, null, 2) };
                 return content;

package/dist/extensions/agent-browser/lib/page-target-validation.js

@@ -2,6 +2,8 @@ import { parseArgvDescriptor } from "./argv-descriptor.js";
 import { GLOBAL_BOOLEAN_FLAGS_WITH_OPTIONAL_VALUES, VALUE_FLAGS, } from "./argv-grammar.js";
 import { isBrowserIndependentRead, needsManagedSession } from "./command-policy.js";
 import { isUnverifiedPageTransitionCommand } from "./command-taxonomy.js";
+import { isRecord } from "./parsing.js";
+import { detectConfirmationRequired } from "./results/confirmation.js";
 import { parseBatchCommandArgument, parseUserBatchStdin } from "./orchestration/batch-stdin.js";
 const UNVERIFIED_PAGE_MESSAGE = "The active page became unverified after a tab, attachment, history, script, or state-load transition. Run get url or navigate explicitly before page-content inspection.";
 const BATCH_UNVERIFIED_PAGE_MESSAGE = `${UNVERIFIED_PAGE_MESSAGE} In a batch, put get url after the transition before later content steps, or split the batch at that boundary.`;
@@ -31,7 +33,7 @@ function getPositionalOperands(commandTokens) {
     }
     return values;
 }
-function getExplicitNavigationTarget(args) {
+export function getExplicitNavigationTarget(args) {
     const descriptor = parseArgvDescriptor(args);
     const positionals = getPositionalOperands(descriptor.upstreamCommandTokens);
     if (EXPLICIT_NAVIGATION_COMMANDS.has(descriptor.commandInfo.command ?? ""))
@@ -85,6 +87,8 @@ function getBatchCommandSteps(args, stdin) {
     if (parsedStdin.error)
         return { error: parsedStdin.error, steps: [] };
     for (const step of parsedStdin.steps ?? []) {
+        if (step.length === 0)
+            continue;
         if (parseArgvDescriptor(step).commandInfo.command === "batch")
             return { error: NESTED_BATCH_ARGUMENT_MESSAGE, steps: [] };
         steps.push(step);
@@ -153,7 +157,10 @@ export function getResultingPageTargetState(options) {
             || isUnverifiedPageTransitionCommand(descriptor.commandInfo.command, descriptor.commandInfo.subcommand);
         return { ...getResultingPageState({ ...state, args: options.args, trustedBatchTabSelection: false }), pageTargetMayHaveChanged };
     }
-    for (const step of options.executedBatchSteps) {
+    for (const [index, step] of options.executedBatchSteps.entries()) {
+        const row = Array.isArray(options.batchResults) ? options.batchResults[index] : undefined;
+        if (isRecord(row) && detectConfirmationRequired(row.result))
+            continue;
         const stepDescriptor = parseArgvDescriptor(step);
         pageTargetMayHaveChanged ||= getExplicitNavigationTarget(step) !== undefined
             || isUnverifiedPageTransitionCommand(stepDescriptor.commandInfo.command, stepDescriptor.commandInfo.subcommand);
@@ -211,7 +218,7 @@ export function getPageTargetValidationError(options) {
             let directError;
             let failedNavigationHazard = false;
             for (const state of possibleStates) {
-                const error = getUnverifiedPageError({
+                const error = options.allowFirstBatchConfirmation === true && index === 0 ? undefined : getUnverifiedPageError({
                     allowUnverifiedPageTransitions: options.allowUnverifiedPageTransitions,
                     args: step,
                     pageUrlUnknown: state.pageUrlUnknown,

package/dist/extensions/agent-browser/lib/pi-tool-rendering.js

@@ -5,6 +5,7 @@ import { compileAgentBrowserNetworkSourceLookup, compileAgentBrowserSourceLookup
 import { compileAgentBrowserSemanticAction } from "./input-modes/semantic-action.js";
 import { isRecord } from "./parsing.js";
 import { redactInvocationArgs } from "./runtime.js";
+import { isBooleanFlagEnabled } from "./argv-grammar.js";
 const TUI_INVOCATION_PREVIEW_MAX_CHARS = 160;
 const TUI_COLLAPSED_OUTPUT_MAX_LINES = 12;
 const ANSI_CONTROL_SEQUENCE_PATTERN = /\x1B(?:\][^\x07\x1B\r\n\u2028\u2029]*(?:\x07|\x1B\\)|\[[0-?]*[ -/]*[@-~]|P[^\x1B\r\n\u2028\u2029]*(?:\x1B\\)|_[^\x1B\r\n\u2028\u2029]*(?:\x1B\\)|\^[^\x1B\r\n\u2028\u2029]*(?:\x1B\\)|[@-Z\\-_])/g;
@@ -188,7 +189,7 @@ function agentBrowserToolResultRequestedJson(result, input) {
     const details = isRecord(result.details) ? result.details : undefined;
     const detailArgs = Array.isArray(details?.args) ? details.args : undefined;
     const inputArgs = isRecord(input) && Array.isArray(input.args) ? input.args : undefined;
-    return detailArgs?.includes("--json") === true || inputArgs?.includes("--json") === true;
+    return isBooleanFlagEnabled(detailArgs ?? [], "--json") || isBooleanFlagEnabled(inputArgs ?? [], "--json");
 }
 function agentBrowserToolResultHasParseableJsonContent(content) {
     return content.some((item) => {

package/dist/extensions/agent-browser/lib/playbook.js

@@ -73,7 +73,7 @@ export const SHARED_BROWSER_PLAYBOOK_GUIDELINES = [
     "For non-core families, pass current upstream commands through the native tool directly: network requests, network route <url>, network har start/stop [path], diff snapshot, diff screenshot --baseline <file>, diff url <u1> <u2>, trace start, trace stop [path], profiler start, profiler stop [path], record start <path>, record stop, console/errors [--clear], highlight <selector>, inspect, clipboard read, clipboard write <text>, clipboard copy/paste, stream enable/disable/status, dashboard start/stop, device list for iOS simulator inventory, and chat <message>. For compact network requests output, prefer details.nextActions for request detail, route-mock diagnostics, actionable failed-request agent_browser_network_source, filtering, clearing the aggregate buffer before repro, or HAR capture follow-ups instead of guessing request-id syntax. Artifact-producing commands report details.artifacts and verification state; long-running starts such as stream, dashboard, trace/profiler, and record should be paired with the matching stop/disable command when the task is done; stream enable already-enabled outcomes are treated as idempotent success with status/disable follow-ups.",
     "For Electron desktop apps, enable agent_browser_electron through agent_browser_tools for wrapper-owned discovery, isolated launch, status, compact probe, and cleanup: list first, treat likely-sensitive annotations as hints rather than enforcement, launch with the default snapshot handoff unless handoff: \"tabs\" is the safer diagnostic starting point, use agent_browser_electron probe or snapshot -i/agent_browser_qa attached:true for current-session state, and always cleanup the returned launchId when done. agent_browser_electron launch uses an isolated temporary profile; it does not reuse the app's normal signed-in profile or attach to an already-running authenticated app. For signed-in local app state, host-launch the normal app with --remote-debugging-port when appropriate, then use raw args connect <port|url>; after connect, run get url to verify the active target before page-content reads, inspect tab list, select the stable tab id such as tab t2, verify it again with get url, then run a condition wait or snapshot -i before using refs. close commands (`close`, `quit`, or `exit`) only close the browser/CDP session; leave manually launched app shutdown, profile cleanup, and explicit artifacts to the host owner.",
     "For provider or specialized app workflows, load version-matched upstream guidance with skills get agentcore|electron|slack|dogfood|vercel-sandbox|derive-client through the native tool; add --full when you need references/templates, and use skills get --all only for broad skill audits. Use derive-client when recording HAR traffic to generate a standalone API client; prefer network har start (text bodies by default) or network har start --content all|none before multi-step capture. For accessibility audits use a11y or a11y --tags wcag2a,wcag2aa (CDP browsers only). Hosted sandbox workflows should use upstream @agent-browser/sandbox helpers outside this wrapper. Provider launches such as -p ios, --provider browserbase/kernel/browseruse/browserless/agentcore, and iOS --device are upstream-owned setup paths; use sessionMode fresh when switching providers and expect external credentials or local Appium/Xcode setup to be required.",
-    "For dialogs and frames, use dialog status/accept/dismiss and frame <selector|main> through native args; dialog commands and eval snippets that look like alert/confirm/prompt/dialog triggers are shorter-bounded than normal browser calls, and timed-out dialog-like interactions may add inspect-dialog-after-timeout, dismiss-dialog-after-timeout, or recover-fresh-session-after-dialog-timeout nextActions. When --confirm-actions produces a pending confirmation, use details.nextActions or exact confirm <id> / deny <id> calls instead of inventing ids.",
+    "For dialogs and frames, use dialog status/accept/dismiss and frame <selector|main> through native args; dialog commands and eval snippets that look like alert/confirm/prompt/dialog triggers are shorter-bounded than normal browser calls, and timed-out dialog-like interactions may add inspect-dialog-after-timeout, dismiss-dialog-after-timeout, or recover-fresh-session-after-dialog-timeout nextActions. Set --confirm-actions on the session's first command; selected strings, including an explicit empty string, follow same-identity helpers and resumed follow-ups until successful close. Native unset keeps ordinary native defaults. Changing a running daemon's policy can discard pending confirmations. When it produces a pending confirmation, including a cold-reopen helper, follow the exact details.nextActions or confirm <id> / deny <id> calls without repeating the policy or inventing ids. Matching native guarded controls avoid page helpers that could replace the pending action; this is not native ID-validation proof or browser independence. In native batch, only a matching first effective decision gets that helper suppression; later page/ref checks remain. Nested decisions remain pending; failed inner actions fail, and completed browser actions reconcile their page state. A pending tab_new transport may show a validated after_confirmation open request and conditional guidance: follow it in the same session and new tab only after successful tab approval, never after denial. The extension does not execute that continuation. Confirmed full snapshots install returned refs; a final confirmed capture supplies the next same-identity call's freshness sample once, including semantic role click/check/fill and unique accessible select resolution, with target/membership/invalidation checks intact. On this one use, live verification compares the complete capture URL, including fragments, and rejects refs when it changes—including wrapper-owned managed sessions and warm sessions without resume. Ordinary ref/tab URL comparisons remain fragment-insensitive. Pending snapshots display confirmation required, not an empty page. Intervening calls or later rows consume it; DOM-only renames on the same page after that sample are not resampled on this one use.",
     "If a session lands on the wrong page or tab, an interaction changes origin unexpectedly, or an open call returns blocked, blank, or otherwise unexpected results, use tab list / tab <tab-id-or-label> / snapshot -i to recover state before retrying different URLs or fallback strategies. For headed demos, put --headed on the first launch with sessionMode=fresh and verify with screenshot/tab/get-url evidence because tool success cannot prove the OS window is visible to the user. For desktop readiness, prefer real conditions first: wait --text, wait --url, wait --fn, wait --load <state>, wait --download, or agent_browser_qa attached:true; for disappearance checks, use wait --fn predicates instead of stale upstream-help examples like wait <selector> --state hidden. Use agent_browser_electron probe/status for wrapper-owned launch health or target mismatch. Fixed waits are a last resort: their duration is positional (wait <ms>, not wait --time <ms>). Use explicit --timeout or top-level timeoutMs for legitimately slow waits, and treat a successful payload like \"waited\":\"timeout\" as elapsed time only—verify completion with an observed condition, fresh snapshot, or screenshot.",
     "For feed, timeline, or inbox reading tasks, focus on the main timeline/list region and read the first item there rather than unrelated composer or sidebar content.",
     "For read-only browsing tasks, use read <url> for documentation or other unstructured text without requiring a Chrome page, or read with no URL for rendered active-tab DOM. Prefer the current snapshot, structured ref labels, getters, or scoped eval --stdin when you need interactive structure or targeted page state. Only click into media viewers, detail routes, or new pages when the current view does not contain the needed information.",
@@ -81,7 +81,7 @@ export const SHARED_BROWSER_PLAYBOOK_GUIDELINES = [
     "On dashboards with nested scroll containers, verify scroll with a screenshot or fresh snapshot -i; if the viewport did not move, details.data.scrolled may be false/noMovement true and you should prefer scrollintoview <@ref> or target the actual scrollable region with scroll <selector> <dir> [px|percent]. For native selects, use select <selector> <value...> (or agent_browser_action select) instead of clicking option refs; for custom comboboxes, a click/agent_browser_action may only focus the field, so re-snapshot and use keyboard type <text> for focused input, press ArrowDown or press Enter, or visible option refs. Raw type requires both <selector> and <text>.",
     "When using eval --stdin, scope checks and actions to the target element or route whenever possible instead of relying on broad page-wide text heuristics.",
     "When using eval --stdin for extraction, pass the JavaScript through the native tool stdin field, not as an extra args token after --stdin, and return the value you want instead of relying on console.log as the primary result channel. Prefer plain expressions like ({ title: document.title }) or explicitly invoked functions like (() => ({ title: document.title }))(); use outputPath when the eval/get/snapshot data should be saved as a durable local file, but never reuse a screenshot, download, recording, or other browser artifact destination as outputPath. If a function-shaped snippet returns {}, details.evalStdinHint may warn that the function was serialized instead of called. Local file pages and caller-selected output paths are supported when upstream allows them. If get text on a broad CSS selector surfaces details.selectorTextVisibility or selectorTextVisibilityAll, prefer a visible @ref, a more specific selector, or the inspect-visible-text-candidates nextAction over hidden tab content.",
-    "When details.pageChangeSummary is present, use changeType and summary as a compact signal for navigation, DOM mutation, confirmations, or artifacts; when nextActionIds is set, match those ids to entries in details.nextActions (or per-step nextActions inside batch) for concrete follow-up payloads instead of inferring from prose alone. Click-dispatch probes require native get attr readback of a temporary marker on the candidate target; unproven ref or XPath identity leaves the native click unverified, not failed. If details.clickDispatch reports a click-dispatch miss, refresh/inspect/retry the real click first; for static local fixtures only, an explicit eval --stdin programmatic .click() can exercise app handlers, but treat it as an untrusted scripted workaround and never use it to bypass stop-before-submit/order/purchase boundaries. If an upstream click failure says the target is covered by another element at the target's click point, use the inspect-overlay-state nextAction to refresh refs and inspect the blocker before deciding whether to retry; do not blindly repeat the blocked click. If a no-navigation click surfaces details.overlayBlockers, inspect the fresh snapshot evidence before using a close/dismiss candidate nextAction; ordinary page chrome without dialog/alertdialog evidence should not trigger this diagnostic.",
+    "When details.pageChangeSummary is present, use changeType and summary as a compact signal for navigation, DOM mutation, confirmations, or artifacts; when nextActionIds is set, match those ids to entries in details.nextActions (or per-step nextActions inside batch) for concrete follow-up payloads instead of inferring from prose alone. Optional click-dispatch probes are skipped when native confirmation settings guard evaluate, without bypassing native click policy. Otherwise probes require native get attr readback of a temporary marker on the candidate target; unproven ref or XPath identity leaves the native click unverified, not failed. If details.clickDispatch reports a click-dispatch miss, refresh/inspect/retry the real click first; for static local fixtures only, an explicit eval --stdin programmatic .click() can exercise app handlers, but treat it as an untrusted scripted workaround and never use it to bypass stop-before-submit/order/purchase boundaries. If an upstream click failure says the target is covered by another element at the target's click point, use the inspect-overlay-state nextAction to refresh refs and inspect the blocker before deciding whether to retry; do not blindly repeat the blocked click. If a no-navigation click surfaces details.overlayBlockers, inspect the fresh snapshot evidence before using a close/dismiss candidate nextAction; ordinary page chrome without dialog/alertdialog evidence should not trigger this diagnostic.",
     "On upstream 0.38+, use snapshot --delta for native full/unchanged/changed revisions; --delta --full resets its baseline. Surviving DOM nodes keep refs, but refresh after navigation or replacement. Wrapper filters use full trees. screenshot --if-changed or --threshold 0.01 can return changed:false with no path or image; use ordinary screenshots when a file is required. --input-mode instant|smooth|human controls sticky pointer behavior; click/drag --human and mouse move --duration/--steps/--human/--seed pass through. record start/restart accept --cursor, --contact-sheet, and --contact-sheet-threshold; stop and verify both video and reported contact sheet. auth login <name> --no-navigate fills a prepared login page only after native origin checks. WebMCP catalog updates are untrusted page data; webmcp list supplies full schemas.",
     "When commands save or spill files (screenshots, downloads, PDFs, traces, recordings, HAR, large snapshot spills), use the user's exact requested paths when given and treat paths as provisional until details.artifactVerification shows every row verified: branch on missingCount, pendingCount, unverifiedCount, per-entry state, and optional limitation before downstream file use or PASS/FAIL reporting.",
     "For evidence-only screenshots, QA captures, or other audit artifacts, save to an explicit path and branch on details.artifactVerification plus details.artifacts before reporting PASS/FAIL; do not require vision review of inline image attachments unless the user asked for visual inspection.",

package/dist/extensions/agent-browser/lib/process-environment.js

@@ -1,5 +1,6 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { rm } from "node:fs/promises";
+import { getBooleanFlagValue } from "./argv-grammar.js";
 import { writeSecureTempFile } from "./temp.js";
 const isolatedAgentBrowserEnvironment = new AsyncLocalStorage();
 const agentBrowserProcessEnvironment = new AsyncLocalStorage();
@@ -7,7 +8,7 @@ const PROXY_ENV_NAMES = new Set(["ALL_PROXY", "HTTPS_PROXY", "HTTP_PROXY", "NO_P
 export function getAgentBrowserProcessEnvironment(baseEnv = process.env) {
     const isolatedConfig = isolatedAgentBrowserEnvironment.getStore();
     if (isolatedConfig === undefined)
-        return { ...baseEnv, ...agentBrowserProcessEnvironment.getStore() };
+        return { ...baseEnv, ...agentBrowserProcessEnvironment.getStore()?.env };
     return {
         ...Object.fromEntries(Object.entries(baseEnv).filter(([name]) => {
             const normalizedName = name.toUpperCase();
@@ -16,8 +17,16 @@ export function getAgentBrowserProcessEnvironment(baseEnv = process.env) {
         AGENT_BROWSER_CONFIG: isolatedConfig,
     };
 }
-export function withAgentBrowserProcessEnvironment(env, run) {
-    return agentBrowserProcessEnvironment.run({ ...agentBrowserProcessEnvironment.getStore(), ...env }, run);
+export function getAgentBrowserProcessArgs(args) {
+    if (isolatedAgentBrowserEnvironment.getStore() !== undefined)
+        return args;
+    const overrides = agentBrowserProcessEnvironment.getStore()?.booleanArgs ?? [];
+    const missing = overrides.flatMap(([flag, value]) => getBooleanFlagValue(args, flag) === undefined ? [flag, value] : []);
+    return missing.length ? [...missing, ...args] : args;
+}
+export function withAgentBrowserProcessEnvironment(env, run, booleanArgs) {
+    const parent = agentBrowserProcessEnvironment.getStore();
+    return agentBrowserProcessEnvironment.run({ env: { ...parent?.env, ...env }, booleanArgs: booleanArgs ?? parent?.booleanArgs ?? [] }, run);
 }
 export async function withIsolatedAgentBrowserEnvironment(run) {
     if (isolatedAgentBrowserEnvironment.getStore() !== undefined)

package/dist/extensions/agent-browser/lib/process.js

@@ -9,7 +9,7 @@ import { extractExplicitSessionName, resolveAgentBrowserNamespace, scanUpstreamG
 import { commitManagedSessionRestoreSuppression, getManagedSessionRestoreEnv, getManagedSessionRestoreProtectedEnv, getOwnedManagedSessionCompatibilityEnv, getOwnedManagedSessionNamespaceEnv, isOwnedManagedSessionTarget, validateManagedSessionRestoreContextForSpawn, } from "./managed-session-restore.js";
 import { getPageTargetValidationError, } from "./page-target-validation.js";
 import { getImplicitSessionIdleTimeoutMs } from "./runtime.js";
-import { getAgentBrowserProcessEnvironment } from "./process-environment.js";
+import { getAgentBrowserProcessArgs, getAgentBrowserProcessEnvironment } from "./process-environment.js";
 import { openSecureTempFile, writeSecureTempChunk } from "./temp.js";
 import { resolveWindowsStockLauncher } from "./windows-stock-launcher.js";
 const MAX_BUFFERED_STDOUT_BYTES = 512 * 1_024;
@@ -328,11 +328,11 @@ export function buildAgentBrowserProcessEnv(baseEnv = processEnv, overrides = un
     clampUpstreamDefaultTimeout(childEnv);
     return childEnv;
 }
-function getManagedPreSpawnPolicyError(options, currentPageUrl, pageUrlUnknown = false, browserIndependentReadConfirmation = false) {
+function getManagedPreSpawnPolicyError(options, currentPageUrl, pageUrlUnknown = false, nativeConfirmationDecision = false) {
     if (!validateManagedSessionRestoreContextForSpawn(options)) {
         return "Managed session restore policy, storage, or checkout identity changed after planning; refusing to start agent-browser.";
     }
-    if (browserIndependentReadConfirmation)
+    if (nativeConfirmationDecision)
         return undefined;
     return getPageTargetValidationError({
         args: options.args,
@@ -361,7 +361,7 @@ export async function runAgentBrowserProcess(options) {
         restoreState: managedSessionRestoreState,
         stdin,
     };
-    const planningPolicyError = getManagedPreSpawnPolicyError(managedSessionRestoreOptions, managedStateCurrentPageUrl, managedStatePageUrlUnknown, options.browserIndependentReadConfirmation);
+    const planningPolicyError = getManagedPreSpawnPolicyError(managedSessionRestoreOptions, managedStateCurrentPageUrl, managedStatePageUrlUnknown, options.nativeConfirmationDecision);
     if (planningPolicyError) {
         return {
             aborted: false,
@@ -509,13 +509,13 @@ export async function runAgentBrowserProcess(options) {
                 });
             });
         };
-        const spawnPolicyError = getManagedPreSpawnPolicyError(managedSessionRestoreOptions, managedStateCurrentPageUrl, managedStatePageUrlUnknown, options.browserIndependentReadConfirmation);
+        const spawnPolicyError = getManagedPreSpawnPolicyError(managedSessionRestoreOptions, managedStateCurrentPageUrl, managedStatePageUrlUnknown, options.nativeConfirmationDecision);
         if (spawnPolicyError) {
             resolve({ aborted: false, agentBrowserStarted: false, exitCode: 1, spawnError: new Error(spawnPolicyError), stderr: "", stdout: "", timedOut: false });
             return;
         }
         const spawnBrowser = processPlatform === "win32" && !stockLauncher ? crossSpawn : spawn;
-        const child = spawnBrowser(stockLauncher ?? "agent-browser", prepareAgentBrowserSpawnArgs(args, ownedManagedSessionCompatibilityEnv.AGENT_BROWSER_USER_AGENT, preserveAttachedBrowserSession, chromeStartupArgsContext.getStore()), {
+        const child = spawnBrowser(stockLauncher ?? "agent-browser", prepareAgentBrowserSpawnArgs(getAgentBrowserProcessArgs(args), ownedManagedSessionCompatibilityEnv.AGENT_BROWSER_USER_AGENT, preserveAttachedBrowserSession, chromeStartupArgsContext.getStore()), {
             cwd,
             env: childEnv,
             stdio: ["pipe", "pipe", "pipe"],

package/dist/extensions/agent-browser/lib/read-confirmation.js

@@ -2,21 +2,40 @@ import { extractUpstreamCommandTokens } from "./argv-descriptor.js";
 import { extractExplicitSessionName, getAgentBrowserSessionIdentityKey, resolveAgentBrowserNamespace, scanUpstreamGlobalFlagOccurrences } from "./argv-grammar.js";
 import { getExplicitReadUrl } from "./command-policy.js";
 import { isCloseCommand } from "./command-taxonomy.js";
+import { getExplicitNavigationTarget } from "./page-target-validation.js";
 import { isRecord } from "./parsing.js";
+import { getUpstreamEffectiveBatchSteps } from "./orchestration/batch-stdin.js";
 export function parseReadConfirmation(value) {
-    if (!isRecord(value) || value.source !== "native-explicit-url-read" || (value.state !== "pending" && value.state !== "cleared"))
+    if (!isRecord(value) || (value.source !== "native-explicit-url-read" && value.source !== "native-guarded-action") || (value.state !== "pending" && value.state !== "cleared"))
         return undefined;
     if (typeof value.id !== "string" || !value.id || typeof value.sessionName !== "string" || !value.sessionName || (value.namespace !== undefined && typeof value.namespace !== "string"))
         return undefined;
-    return { ...(isRecord(value.capabilities) && value.capabilities.readRequiresConfirmation === true ? { capabilities: { readRequiresConfirmation: true } } : {}), id: value.id, sessionName: value.sessionName, namespace: value.namespace, source: "native-explicit-url-read", state: value.state };
+    if (value.source === "native-guarded-action" && (typeof value.command !== "string" || !value.command || typeof value.action !== "string" || !value.action))
+        return undefined;
+    return { ...(value.source === "native-explicit-url-read" && isRecord(value.capabilities) && value.capabilities.readRequiresConfirmation === true ? { capabilities: { readRequiresConfirmation: true } } : {}), id: value.id, sessionName: value.sessionName, namespace: value.namespace, source: value.source, state: value.state,
+        ...(value.source === "native-guarded-action" ? { command: typeof value.command === "string" ? value.command : undefined, action: typeof value.action === "string" ? value.action : undefined } : {}),
+        ...(value.source === "native-guarded-action" && value.state === "cleared" && value.command === "snapshot" && value.action === "snapshot" && value.refSnapshotFresh === true ? { refSnapshotFresh: true } : {}) };
+}
+export function isBrowserIndependentConfirmation(value) {
+    return value?.source === "native-explicit-url-read" && value.capabilities?.readRequiresConfirmation === true;
+}
+export function suppressConfirmationPageHelpers(value) {
+    return value?.state === "pending" && (value.source === "native-guarded-action" || isBrowserIndependentConfirmation(value));
 }
-export function findReadConfirmation(args, confirmations, namespace) {
-    const tokens = extractUpstreamCommandTokens(args);
+export function isSuccessfulNativeConfirmedClose(commandTokens, data) {
+    return commandTokens[0] === "confirm" && commandTokens.length === 2 && isRecord(data) && data.confirmed === true
+        && data.action === "close" && isRecord(data.result) && data.result.success === true
+        && isRecord(data.result.data) && data.result.data.closed === true;
+}
+export function findReadConfirmation(args, confirmations, namespace, stdin) {
+    const command = extractUpstreamCommandTokens(args);
+    const tokens = command[0] === "batch" ? getUpstreamEffectiveBatchSteps(command, stdin)[0] ?? [] : command;
     if (tokens.length !== 2 || !["confirm", "deny"].includes(tokens[0]))
         return undefined;
     const sessionName = extractExplicitSessionName(args);
     const effectiveNamespace = resolveAgentBrowserNamespace(args, namespace);
     const matches = [...confirmations].filter(value => value.state === "pending" && value.id === tokens[1]
+        && (command[0] !== "batch" || value.source === "native-guarded-action")
         && (sessionName === undefined || getAgentBrowserSessionIdentityKey(sessionName, value.namespace) === getAgentBrowserSessionIdentityKey(value.sessionName, value.namespace))
         && (effectiveNamespace === undefined || getAgentBrowserSessionIdentityKey(value.sessionName, effectiveNamespace) === getAgentBrowserSessionIdentityKey(value.sessionName, value.namespace)));
     return matches.length === 1 ? matches[0] : undefined;
@@ -28,32 +47,53 @@ export function scopeReadConfirmationArgs(args, confirmation) {
         ...args,
     ];
 }
+export function getNativeTabContinuationGuidance(commandTokens, data) {
+    if (commandTokens[0] !== "tab" || commandTokens[1] !== "new" || !isRecord(data)
+        || data.confirmation_required !== true || typeof data.confirmation_id !== "string" || !data.confirmation_id || data.action !== "tab_new"
+        || !Object.keys(data).every(key => ["confirmation_required", "confirmation_id", "action", "capabilities", "after_confirmation", "guidance"].includes(key))
+        || !Array.isArray(data.after_confirmation) || data.after_confirmation.length !== 2 || data.after_confirmation[0] !== "open"
+        || typeof data.after_confirmation[1] !== "string" || !data.after_confirmation[1]
+        || data.after_confirmation[1] !== getExplicitNavigationTarget(commandTokens)
+        || typeof data.guidance !== "string" || !data.guidance.trim())
+        return undefined;
+    // Transport prose only: approval creates the tab; the continuation is never stored or executed.
+    return data.guidance;
+}
 export function nextReadConfirmation(options) {
     const { commandTokens: tokens, current } = options;
-    const settlesRead = current?.state === "pending" && tokens.length === 2 && ["confirm", "deny"].includes(tokens[0]) && tokens[1] === current.id;
-    const confirmedResult = settlesRead && tokens[0] === "confirm" && isRecord(options.data) && options.data.confirmed === true && options.data.action === "read" && isRecord(options.data.result)
-        ? options.data.result.data : options.data;
-    // Native control fields only. Never parse response content, snapshot text or nested page JSON as provenance.
-    if (isRecord(confirmedResult) && confirmedResult.confirmation_required === true && typeof confirmedResult.confirmation_id === "string" && confirmedResult.confirmation_id && !("content" in confirmedResult)) {
-        if (confirmedResult.action === "read" && (typeof getExplicitReadUrl(tokens) === "string" || settlesRead)) {
-            return { ...(isRecord(confirmedResult.capabilities) && confirmedResult.capabilities.readRequiresConfirmation === true ? { capabilities: { readRequiresConfirmation: true } } : {}), id: confirmedResult.confirmation_id, namespace: options.namespace, sessionName: options.sessionName, source: "native-explicit-url-read", state: "pending" };
+    const settles = current?.state === "pending" && tokens.length === 2 && ["confirm", "deny"].includes(tokens[0]) && tokens[1] === current.id;
+    const confirmed = settles && tokens[0] === "confirm" && isRecord(options.data) && options.data.confirmed === true
+        && options.data.action === (current.source === "native-explicit-url-read" ? "read" : current.action) && isRecord(options.data.result);
+    const control = confirmed && isRecord(options.data) && isRecord(options.data.result) ? options.data.result.data : options.data;
+    // Only native control fields and a validated tab transport continuation. Page output is never provenance.
+    if (options.succeeded && isRecord(control) && !Array.isArray(control) && control.confirmation_required === true
+        && typeof control.confirmation_id === "string" && control.confirmation_id && typeof control.action === "string" && control.action
+        && (Object.keys(control).every(key => ["confirmation_required", "confirmation_id", "action", "capabilities"].includes(key))
+            || getNativeTabContinuationGuidance(tokens, control) !== undefined)) {
+        const explicitRead = control.action === "read" && (typeof getExplicitReadUrl(tokens) === "string" || confirmed && current.source === "native-explicit-url-read");
+        if (explicitRead)
+            return { ...(isRecord(control.capabilities) && control.capabilities.readRequiresConfirmation === true ? { capabilities: { readRequiresConfirmation: true } } : {}), id: control.confirmation_id, namespace: options.namespace, sessionName: options.sessionName, source: "native-explicit-url-read", state: "pending" };
+        if (tokens[0] && !["confirm", "deny"].includes(tokens[0]) || confirmed && current.source === "native-guarded-action") {
+            return { id: control.confirmation_id, namespace: options.namespace, sessionName: options.sessionName, source: "native-guarded-action", command: confirmed ? current.command : tokens[0], action: control.action, state: "pending" };
         }
         if (current?.state === "pending")
             return { ...current, state: "cleared" };
     }
-    return options.succeeded && current?.state === "pending" && (settlesRead || isCloseCommand(tokens[0])) ? { ...current, state: "cleared" } : undefined;
+    return options.succeeded && current?.state === "pending" && (settles || isCloseCommand(tokens[0])) ? { ...current, state: "cleared" } : undefined;
 }
 export function buildReadConfirmationNextActions(confirmation, pendingResponse) {
     if (confirmation.state === "cleared")
         return [];
     const prefix = ["--namespace", confirmation.namespace ?? "", "--session", confirmation.sessionName];
     if (!pendingResponse)
-        return [{ id: "inspect-read-confirmation-session", tool: "agent_browser", params: { args: [...prefix, "session", "info"] }, reason: "Inspect the exact native session after the read confirmation failed; rerun the original URL read if its ID expired.", safety: "Read-only status, without browser launch or tab changes. Do not substitute a different pending confirmation ID." }];
+        return [{ id: "inspect-read-confirmation-session", tool: "agent_browser", params: { args: [...prefix, "session", "info"] }, reason: "Inspect the exact native session after the confirmation failed; rerun the original command if its ID expired.", safety: "Read-only status, without browser launch or tab changes. Do not substitute a different pending confirmation ID." }];
     return ["confirm", "deny"].map(command => ({
         id: command === "confirm" ? "approve-confirmation" : "deny-confirmation", tool: "agent_browser", params: { args: [...prefix, command, confirmation.id] },
-        reason: `${command === "confirm" ? "Approve" : "Deny"} the native confirmation for this explicit URL read.`,
-        safety: confirmation.capabilities?.readRequiresConfirmation === true
+        reason: `${command === "confirm" ? "Approve" : "Deny"} the native confirmation for ${confirmation.source === "native-explicit-url-read" ? "this explicit URL read" : `${confirmation.command} (${confirmation.action})`}.`,
+        safety: isBrowserIndependentConfirmation(confirmation)
             ? "Review the requested read first. The native capability proves ID matching; no DOM confirmation is implied."
-            : "Native ID matching/browser independence is unproven. The exact native session is preserved, but this confirmation retains normal page checks.",
+            : confirmation.source === "native-guarded-action"
+                ? "Review the original guarded action. Exact wrapper observation preserves its session and avoids overwriting helpers; native ID validation is not implied."
+                : "Native ID matching/browser independence is unproven. The exact native session is preserved, but this confirmation retains normal page checks.",
     }));
 }

package/dist/extensions/agent-browser/lib/results/confirmation.js

@@ -34,6 +34,9 @@ function getNestedConfirmationRecord(data) {
     return undefined;
 }
 export function detectConfirmationRequired(data) {
+    // Native confirm can acknowledge one action while its original compound command remains pending.
+    if (isRecord(data) && data.confirmed === true && isRecord(data.result) && data.result.success === true)
+        data = data.result.data;
     if (!isRecord(data)) {
         return undefined;
     }

package/dist/extensions/agent-browser/lib/results/envelope.js

@@ -47,6 +47,10 @@ export async function parseAgentBrowserEnvelope(options) {
     catch (error) {
         return { parseError: error instanceof Error ? error.message : String(error) };
     }
+    // ponytail: native text has no machine receipts; use JSON mode for structured evidence.
+    // JSON-looking page text must never become an envelope, confirmation, or batch row.
+    if (typeof options !== "string" && options.textOutput)
+        return { envelope: { success: true, data: stdout } };
     const trimmed = stdout.trim();
     const plainText = typeof options !== "string" && options.plainText === true;
     if (trimmed.length === 0 && !plainText) {
@@ -150,7 +154,7 @@ export function getAgentBrowserErrorText(options) {
     if (spawnError)
         return spawnError.message;
     if (parseError)
-        return parseError;
+        return exitCode !== 0 && stderr.trim() ? stderr.trim() : parseError;
     if (envelope?.success === false) {
         const explicitErrorText = extractEnvelopeErrorText(envelope.error);
         if ((hasStructuredBatchStepFailure(envelope.data) || detectConfirmationRequired(envelope.data)) && explicitErrorText === undefined) {

package/dist/extensions/agent-browser/lib/results/presentation/artifacts.js

@@ -221,6 +221,9 @@ async function buildPreviousRestartRecordingArtifact(options) {
         const recording = getRecordingReceipt(options.data.previousRecording);
         return recording ? buildFileArtifactMetadata({ ...options, commandInfo: { command: "record", subcommand: "restart-previous" }, path: recording.path, recording }) : undefined;
     }
+    // A rejected or pending restart has not acknowledged replacement of the active take.
+    if (!isRecord(options.data) || options.data.restarted !== true)
+        return undefined;
     const sessionKey = options.sessionName ? getAgentBrowserSessionIdentityKey(options.sessionName, options.namespace) : undefined;
     const previousRecording = options.artifactManifest?.entries.find((entry) => (entry.command === "record" &&
         (entry.subcommand === "start" || entry.subcommand === "restart") &&