pi-agent-browser-native 0.9.3 → 0.9.4

package/dist/extensions/agent-browser/lib/managed-session-restore.js

@@ -1,344 +1,212 @@
-import { AsyncLocalStorage } from "node:async_hooks";
-import { extractUpstreamCommandTokens, parseCommandInfo } from "./argv-descriptor.js";
-import { canonicalizeAgentBrowserNamespace, extractExplicitNamespace, extractExplicitSessionName, extractRequestedRestoreKey, getAgentBrowserSessionIdentityKey, isUpstreamEnvFlagEnabled, resolveAgentBrowserNamespace, scanUpstreamGlobalFlagOccurrences, } from "./argv-grammar.js";
-import { hasLaunchScopedFlagToken, MANAGED_RESTORE_INCOMPATIBLE_BOOLEAN_ENVS, MANAGED_RESTORE_INCOMPATIBLE_ENVS, MANAGED_RESTORE_INCOMPATIBLE_FLAGS, } from "./launch-scoped-flags.js";
-import { createManagedSessionRestoreKey, ensureManagedSessionRestoreStorageIsSecure, getManagedSessionRestoreScope, getManagedSessionRestoreProtectedStorageEnv, hasManagedSessionRestoreProjectIdentity, resolveManagedSessionRestoreHome, } from "./managed-session-storage.js";
-import { parseUserBatchStdin } from "./orchestration/batch-stdin.js";
-import { isRecord } from "./parsing.js";
+import { isUpstreamEnvFlagEnabled } from "./argv-grammar.js";
+import { MANAGED_RESTORE_INCOMPATIBLE_BOOLEAN_ENVS, MANAGED_RESTORE_INCOMPATIBLE_ENVS, } from "./launch-scoped-flags.js";
+import { createManagedSessionRestoreKey, ensureManagedSessionRestoreStorageIsSecure, getManagedSessionRestoreScope, getManagedSessionRestoreProtectedStorageEnv, hasManagedSessionRestoreProjectIdentity, } from "./managed-session-storage.js";
 import { getAgentBrowserProcessEnvironment } from "./process-environment.js";
-export { createManagedSessionRestoreKey, ensureManagedSessionRestoreStorageIsSecure, getManagedSessionRestoreScope } from "./managed-session-storage.js";
+import { AGENT_BROWSER_CONFIG_ENV, AGENT_BROWSER_RESTORE_ENV, MANAGED_SESSION_RESTORE_ENV, agentBrowserExplicitConfigIsPresent, closesBrowserSession, isDisabledEnvFlag, hasUpstreamEnvValue, isManagedSessionRestoreIncompatible, managedSessionRestoreOptedOut, resolveExplicitAutosaveInterval, resolveManagedSessionRestorePolicy, } from "./managed-session-restore-policy.js";
+export { agentBrowserConfigBlocksManagedRestore, resolveExplicitAutosaveInterval, } from "./managed-session-restore-policy.js";
+export { createManagedSessionRestoreKey, ensureManagedSessionRestoreStorageIsSecure, getManagedSessionRestoreScope, } from "./managed-session-storage.js";
 export { pruneOwnedManagedSessionRestoreSnapshots } from "./managed-session-snapshots.js";
-const AGENT_BROWSER_CONFIG_ENV = "AGENT_BROWSER_CONFIG";
-const AGENT_BROWSER_RESTORE_ENV = "AGENT_BROWSER_RESTORE";
-const MANAGED_SESSION_RESTORE_ENV = "PI_AGENT_BROWSER_MANAGED_SESSION_RESTORE";
+export { ManagedSessionRestoreState, } from "./managed-session-restore-state.js";
+export { withOwnedManagedSessionContext, resolveOwnedManagedSessionContext, isOwnedManagedSessionTarget, } from "./owned-managed-session-context.js";
+export { buildOwnedManagedSessionRestoreContext } from "./managed-session-restore-context.js";
 export const MANAGED_SESSION_NAME_PREFIX = "piab-";
-const MANAGED_SESSION_RESTORE_SPAWN_PINNED_ENVS = new Set([AGENT_BROWSER_CONFIG_ENV, AGENT_BROWSER_RESTORE_ENV]);
-function isDisabledEnvFlag(value) {
-    if (value === undefined)
-        return false;
-    return ["0", "false", "no", "off"].includes(value.trim().toLowerCase());
+const SPAWN_PINNED_ENVS = new Set([AGENT_BROWSER_CONFIG_ENV, AGENT_BROWSER_RESTORE_ENV]);
+export function getOwnedManagedSessionNamespaceEnv(options) {
+    const { namespace, owned, ownedContext } = resolveManagedSessionRestorePolicy(options);
+    return owned ? { AGENT_BROWSER_NAMESPACE: ownedContext?.namespace ?? namespace ?? "" } : {};
 }
-function hasUpstreamEnvValue(env, name) {
-    return env?.[name] !== undefined;
+function compatibilityForReuse(context, env, args, explicit) {
+    return explicit === undefined &&
+        context.headedManagedAutosaveInterval !== undefined &&
+        !agentBrowserExplicitConfigIsPresent(env, args)
+        ? { AGENT_BROWSER_AUTOSAVE_INTERVAL_MS: context.headedManagedAutosaveInterval }
+        : {};
 }
-export class ManagedSessionRestoreState {
-    #daemonRestoreKeys = new Map();
-    #disabled = new Set();
-    clear(sessionName, namespace) {
-        if (sessionName) {
-            const identity = getAgentBrowserSessionIdentityKey(sessionName, namespace);
-            this.#daemonRestoreKeys.delete(identity);
-            this.#disabled.delete(identity);
-        }
-        else {
-            this.#daemonRestoreKeys.clear();
-            this.#disabled.clear();
-        }
-    }
-    disable(sessionName, namespace) {
-        if (sessionName)
-            this.#disabled.add(getAgentBrowserSessionIdentityKey(sessionName, namespace));
-    }
-    getDaemonRestoreKey(sessionName, namespace) {
-        return typeof sessionName === "string" ? this.#daemonRestoreKeys.get(getAgentBrowserSessionIdentityKey(sessionName, namespace))?.restoreKey : undefined;
-    }
-    hasDaemonRestoreKey(sessionName, namespace) {
-        return typeof sessionName === "string" && this.#daemonRestoreKeys.get(getAgentBrowserSessionIdentityKey(sessionName, namespace))?.restored !== true
-            && this.#daemonRestoreKeys.has(getAgentBrowserSessionIdentityKey(sessionName, namespace));
-    }
-    forgetDaemonRestoreKey(sessionName, namespace) {
-        if (sessionName)
-            this.#daemonRestoreKeys.delete(getAgentBrowserSessionIdentityKey(sessionName, namespace));
+function explicitAutosaveInterval(options) {
+    const parent = options.parentEnv ?? getAgentBrowserProcessEnvironment();
+    const env = options.env ?? {};
+    return Object.hasOwn(env, "AGENT_BROWSER_AUTOSAVE_INTERVAL_MS")
+        ? env.AGENT_BROWSER_AUTOSAVE_INTERVAL_MS
+        : parent.AGENT_BROWSER_AUTOSAVE_INTERVAL_MS;
+}
+export function getOwnedManagedSessionCompatibilityEnv(options) {
+    const { owned, ownedContext } = resolveManagedSessionRestorePolicy(options);
+    if (!owned || !ownedContext) {
+        return {};
     }
-    isDisabled(sessionName, namespace) {
-        return typeof sessionName === "string" && this.#disabled.has(getAgentBrowserSessionIdentityKey(sessionName, namespace));
+    const parentEnv = options.parentEnv ?? getAgentBrowserProcessEnvironment();
+    const callEnv = options.env ?? {};
+    const explicit = explicitAutosaveInterval(options);
+    if (ownedContext.reuseOnly === true) {
+        return compatibilityForReuse(ownedContext, { ...parentEnv, ...callEnv }, options.args, explicit);
     }
-    recordDaemonRestoreKey(sessionName, namespace, restoreKey, generation) {
-        if (sessionName) {
-            const key = getAgentBrowserSessionIdentityKey(sessionName, namespace);
-            const previous = this.#daemonRestoreKeys.get(key);
-            this.#daemonRestoreKeys.set(key, { restoreKey, generation: generation ?? (previous?.restoreKey === restoreKey ? previous.generation : undefined) });
-        }
+    const env = {};
+    if (ownedContext.compatibilityUserAgent !== undefined &&
+        ownedContext.compatibilityUserAgent.length > 0) {
+        env.AGENT_BROWSER_USER_AGENT = ownedContext.compatibilityUserAgent;
     }
-    getDaemonReceipt(sessionName, namespace) {
-        const receipt = sessionName ? this.#daemonRestoreKeys.get(getAgentBrowserSessionIdentityKey(sessionName, namespace)) : undefined;
-        return receipt?.generation ? { restoreKey: receipt.restoreKey, generation: receipt.generation } : undefined;
+    if (ownedContext.headedManagedAutosaveInterval !== undefined &&
+        resolveExplicitAutosaveInterval(explicit) !== ownedContext.headedManagedAutosaveInterval) {
+        env.AGENT_BROWSER_AUTOSAVE_INTERVAL_MS = ownedContext.headedManagedAutosaveInterval;
     }
-    restoreDaemonReceipt(sessionName, namespace, receipt) {
-        if (isRecord(receipt) && typeof receipt.generation === "string" && receipt.generation.length > 0
-            && (receipt.restoreKey === null || typeof receipt.restoreKey === "string")) {
-            this.#daemonRestoreKeys.set(getAgentBrowserSessionIdentityKey(sessionName, namespace), { restoreKey: receipt.restoreKey, generation: receipt.generation, restored: true });
-        }
+    return env;
+}
+export function getManagedSessionRestoreProtectedEnv(options, restoreEnv) {
+    const { ownedContext } = resolveManagedSessionRestorePolicy(options);
+    if (restoreEnv[AGENT_BROWSER_RESTORE_ENV] === undefined) {
+        return {};
     }
-    replace(identities = [], options = {}) {
-        if (!options.preserveDaemonRestoreKeys)
-            this.#daemonRestoreKeys.clear();
-        this.#disabled.clear();
-        for (const identity of identities)
-            this.disable(identity.sessionName, identity.namespace);
+    if (ownedContext?.protectedStorageEnv) {
+        return { ...ownedContext.protectedStorageEnv };
     }
+    return getManagedSessionRestoreProtectedStorageEnv(true, {
+        ...(options.parentEnv ?? getAgentBrowserProcessEnvironment()),
+        ...options.env,
+    });
 }
-const ownedManagedSessionStorage = new AsyncLocalStorage();
-export async function withOwnedManagedSessionContext(context, run) {
-    return await ownedManagedSessionStorage.run(context, run);
+function validRestoreIdentity(context, cwd) {
+    if (context.restoreKey === undefined ||
+        context.restoreKey.length === 0 ||
+        context.restoreScope === undefined ||
+        context.restoreScope.length === 0) {
+        return false;
+    }
+    return (createManagedSessionRestoreKey(cwd, context.restoreScope) === context.restoreKey &&
+        hasManagedSessionRestoreProjectIdentity(cwd));
 }
-export function resolveOwnedManagedSessionContext(options) {
-    const namespace = canonicalizeAgentBrowserNamespace(options.namespace);
-    const currentNamespace = canonicalizeAgentBrowserNamespace(options.currentManagedSessionNamespace);
-    const recordedNamespace = canonicalizeAgentBrowserNamespace(options.recordedOwnedSession?.namespace);
-    if (options.recordedOwnedSession
-        && options.sessionName === options.recordedOwnedSession.sessionName
-        && namespace === recordedNamespace) {
-        return { cwd: options.recordedOwnedSession.cwd, namespace, restoreState: options.restoreState, sessionName: options.sessionName };
+function validLaunchEnvironment(options, context, env) {
+    if (context.reuseOnly === true) {
+        return true;
     }
-    if (options.managedSessionName)
-        return { cwd: options.cwd, namespace, restoreState: options.restoreState, sessionName: options.managedSessionName };
-    if (options.sessionName && options.sessionName === options.currentManagedSessionName && namespace === currentNamespace) {
-        return { cwd: options.cwd, namespace, restoreState: options.restoreState, sessionName: options.sessionName };
+    if (isDisabledEnvFlag(env[MANAGED_SESSION_RESTORE_ENV])) {
+        return false;
     }
-    return undefined;
-}
-function ownedContextMatches(sessionName, args) {
-    const owned = ownedManagedSessionStorage.getStore();
-    return owned && sessionName === owned.sessionName
-        && canonicalizeAgentBrowserNamespace(resolveAgentBrowserNamespace(args, owned.namespace)) === owned.namespace ? owned : undefined;
-}
-export function isOwnedManagedSessionTarget(args) {
-    return ownedContextMatches(extractExplicitSessionName(args), args) !== undefined;
-}
-function hasExplicitConfigArg(args) {
-    return scanUpstreamGlobalFlagOccurrences(args, "--config").length > 0;
-}
-function closesBrowserSession(args) {
-    return ["close", "exit", "quit"].includes(parseCommandInfo(args).command ?? "");
-}
-function agentBrowserExplicitConfigIsPresent(parentEnv = getAgentBrowserProcessEnvironment(), args = []) {
-    return hasExplicitConfigArg(args) || hasUpstreamEnvValue(parentEnv, AGENT_BROWSER_CONFIG_ENV);
-}
-/** Caller-selected upstream config disables the wrapper's automatic restore injection without blocking that config. */
-export function agentBrowserConfigBlocksManagedRestore(parentEnv = getAgentBrowserProcessEnvironment(), args = [], platform = process.platform) {
-    return !resolveManagedSessionRestoreHome(parentEnv, platform) || agentBrowserExplicitConfigIsPresent(parentEnv, args);
-}
-function omitWrapperInjectedUserAgent(args, enabled) {
-    if (!enabled)
-        return args;
-    const index = args.indexOf("--user-agent");
-    return index < 0 ? args : [...args.slice(0, index), ...args.slice(index + 2)];
-}
-function batchHasManagedSessionRestoreConflict(args, stdin) {
-    const [command, ...commandArgs] = extractUpstreamCommandTokens(args);
-    if (command !== "batch")
+    if (MANAGED_RESTORE_INCOMPATIBLE_ENVS.some((name) => !SPAWN_PINNED_ENVS.has(name) && hasUpstreamEnvValue(env, name))) {
         return false;
-    if (commandArgs.some((token) => token !== "--bail"))
-        return true;
-    const parsed = parseUserBatchStdin(stdin);
-    if (parsed.error || !parsed.steps)
+    }
+    if (MANAGED_RESTORE_INCOMPATIBLE_BOOLEAN_ENVS.some((name) => isUpstreamEnvFlagEnabled(env[name]))) {
         return false;
-    return parsed.steps.some((step) => ["connect", "batch"].includes(parseCommandInfo(step).command ?? ""));
-}
-function hasManagedSessionRestoreLaunchConflict(options) {
-    const parentEnv = options.parentEnv ?? getAgentBrowserProcessEnvironment();
-    const effectiveEnv = { ...parentEnv, ...options.env };
-    const args = omitWrapperInjectedUserAgent(options.args, options.wrapperInjectedUserAgent);
-    if (MANAGED_RESTORE_INCOMPATIBLE_ENVS.some((name) => hasUpstreamEnvValue(effectiveEnv, name)))
-        return true;
-    if (MANAGED_RESTORE_INCOMPATIBLE_BOOLEAN_ENVS.some((name) => isUpstreamEnvFlagEnabled(effectiveEnv[name])))
-        return true;
-    if (MANAGED_RESTORE_INCOMPATIBLE_FLAGS.some((flag) => hasLaunchScopedFlagToken(args, flag)))
-        return true;
-    if (parseCommandInfo(args).command === "connect" || batchHasManagedSessionRestoreConflict(args, options.stdin))
-        return true;
-    return hasExplicitConfigArg(args) || hasUpstreamEnvValue({ ...parentEnv, ...options.env }, AGENT_BROWSER_CONFIG_ENV);
-}
-function managedSessionRestoreOptedOut(options) {
-    const effectiveEnv = { ...(options.parentEnv ?? getAgentBrowserProcessEnvironment()), ...options.env };
-    return isDisabledEnvFlag(effectiveEnv[MANAGED_SESSION_RESTORE_ENV]);
+    }
+    return (options.env?.[AGENT_BROWSER_RESTORE_ENV] === undefined ||
+        options.env[AGENT_BROWSER_RESTORE_ENV] === context.restoreKey);
 }
-function isManagedSessionRestoreIncompatible(options, namespace = extractExplicitNamespace(options.args)) {
-    if (hasManagedSessionRestoreLaunchConflict(options))
+export function validateManagedSessionRestoreContextForSpawn(options) {
+    const { namespace, ownedContext, parentEnv } = resolveManagedSessionRestorePolicy(options);
+    if (closesBrowserSession(options.args) ||
+        ownedContext?.restoreDecision !== "enabled" ||
+        (ownedContext.reuseOnly === true && ownedContext.restoreSuppressed === true)) {
         return true;
-    if (managedSessionRestoreOptedOut(options))
+    }
+    if (!validRestoreIdentity(ownedContext, ownedContext.cwd ?? options.cwd)) {
         return false;
-    const effectiveEnv = { ...(options.parentEnv ?? getAgentBrowserProcessEnvironment()), ...options.env };
-    const args = omitWrapperInjectedUserAgent(options.args, options.wrapperInjectedUserAgent);
-    if (options.cwd && !hasManagedSessionRestoreProjectIdentity(options.cwd))
-        return true;
-    if (options.cwd && agentBrowserConfigBlocksManagedRestore(effectiveEnv, args))
-        return true;
-    return !ensureManagedSessionRestoreStorageIsSecure(effectiveEnv, process.platform, namespace);
-}
-function resolveManagedSessionRestorePolicy(options) {
-    const parentEnv = options.parentEnv ?? getAgentBrowserProcessEnvironment();
-    const sessionName = extractExplicitSessionName(options.args);
-    const ownedContext = ownedContextMatches(sessionName, options.args);
-    const namespace = ownedContext ? ownedContext.namespace : extractExplicitNamespace(options.args);
-    const restoreState = ownedContext?.restoreState ?? options.restoreState;
-    const owned = (options.ownedManagedSession || ownedContext !== undefined) && restoreState !== undefined;
-    return { namespace, owned, ownedContext, parentEnv, restoreState, sessionName };
-}
-export function getOwnedManagedSessionNamespaceEnv(options) {
-    const { namespace, owned, ownedContext } = resolveManagedSessionRestorePolicy(options);
-    return owned ? { AGENT_BROWSER_NAMESPACE: ownedContext?.namespace ?? namespace ?? "" } : {};
-}
-const DEFAULT_AUTOSAVE_INTERVAL_MS = "30000";
-const MAX_U64 = 18446744073709551615n;
-export function resolveExplicitAutosaveInterval(value) {
-    if (value === undefined)
-        return undefined;
-    if (!/^\+?\d+$/.test(value))
-        return DEFAULT_AUTOSAVE_INTERVAL_MS;
-    try {
-        const parsed = BigInt(value);
-        return parsed <= MAX_U64 ? parsed.toString() : DEFAULT_AUTOSAVE_INTERVAL_MS;
     }
-    catch {
-        return DEFAULT_AUTOSAVE_INTERVAL_MS;
+    const env = { ...parentEnv, ...options.env };
+    return (validLaunchEnvironment(options, ownedContext, env) &&
+        ensureManagedSessionRestoreStorageIsSecure({ ...env, ...ownedContext.protectedStorageEnv }, process.platform, namespace));
+}
+function reuseRestoreEnv(options, context) {
+    return context.restoreKey !== undefined &&
+        context.restoreKey.length > 0 &&
+        context.restoreSuppressed !== true &&
+        validateManagedSessionRestoreContextForSpawn(options)
+        ? { [AGENT_BROWSER_RESTORE_ENV]: context.restoreKey }
+        : {};
+}
+function disabledByPolicy(options, context, namespace) {
+    return (managedSessionRestoreOptedOut(options) ||
+        context?.restoreSuppressed === true ||
+        isManagedSessionRestoreIncompatible(options, namespace));
+}
+function configuredRestoreEnv(options, context, policy) {
+    if (context.restoreDecision !== "enabled" ||
+        !policy.restoreState ||
+        policy.restoreState.isDisabled(policy.sessionName, policy.namespace)) {
+        return {};
+    }
+    if (policy.sessionName === undefined ||
+        policy.sessionName.length === 0 ||
+        context.restoreKey === undefined ||
+        context.restoreKey.length === 0 ||
+        !validateManagedSessionRestoreContextForSpawn(options)) {
+        return {};
     }
+    return { [AGENT_BROWSER_RESTORE_ENV]: context.restoreKey };
 }
-export function getOwnedManagedSessionCompatibilityEnv(options) {
-    const { owned, ownedContext } = resolveManagedSessionRestorePolicy(options);
-    if (!owned || !ownedContext)
+function automaticRestoreEnv(options, policy) {
+    if (disabledByPolicy({ ...options, parentEnv: policy.parentEnv }, policy.ownedContext, policy.namespace)) {
+        return {};
+    }
+    if (!policy.restoreState ||
+        policy.restoreState.isDisabled(policy.sessionName, policy.namespace) ||
+        policy.sessionName === undefined ||
+        policy.sessionName.length === 0) {
         return {};
-    const parentEnv = options.parentEnv ?? getAgentBrowserProcessEnvironment();
-    const callEnv = options.env ?? {};
-    const explicitRawInterval = Object.hasOwn(callEnv, "AGENT_BROWSER_AUTOSAVE_INTERVAL_MS")
-        ? callEnv.AGENT_BROWSER_AUTOSAVE_INTERVAL_MS
-        : parentEnv.AGENT_BROWSER_AUTOSAVE_INTERVAL_MS;
-    if (ownedContext.reuseOnly) {
-        return explicitRawInterval === undefined && ownedContext.headedManagedAutosaveInterval !== undefined
-            && !agentBrowserExplicitConfigIsPresent({ ...parentEnv, ...callEnv }, options.args)
-            ? { AGENT_BROWSER_AUTOSAVE_INTERVAL_MS: ownedContext.headedManagedAutosaveInterval }
-            : {};
     }
-    const explicitIntervalMatches = resolveExplicitAutosaveInterval(explicitRawInterval) === ownedContext.headedManagedAutosaveInterval;
     return {
-        ...(ownedContext.compatibilityUserAgent ? { AGENT_BROWSER_USER_AGENT: ownedContext.compatibilityUserAgent } : {}),
-        ...(ownedContext.headedManagedAutosaveInterval !== undefined && !explicitIntervalMatches ? { AGENT_BROWSER_AUTOSAVE_INTERVAL_MS: ownedContext.headedManagedAutosaveInterval } : {}),
+        [AGENT_BROWSER_RESTORE_ENV]: createManagedSessionRestoreKey(options.cwd, getManagedSessionRestoreScope(policy.sessionName)),
     };
 }
-export function getManagedSessionRestoreProtectedEnv(options, restoreEnv) {
-    const { ownedContext } = resolveManagedSessionRestorePolicy(options);
-    if (restoreEnv[AGENT_BROWSER_RESTORE_ENV] === undefined)
+export function getManagedSessionRestoreEnv(options) {
+    const policy = resolveManagedSessionRestorePolicy(options);
+    if (!policy.owned || !policy.restoreState || closesBrowserSession(options.args)) {
         return {};
-    if (ownedContext?.protectedStorageEnv)
-        return { ...ownedContext.protectedStorageEnv };
-    const effectiveEnv = { ...(options.parentEnv ?? getAgentBrowserProcessEnvironment()), ...options.env };
-    return getManagedSessionRestoreProtectedStorageEnv(true, effectiveEnv);
+    }
+    const context = policy.ownedContext;
+    if (context?.reuseOnly === true) {
+        return reuseRestoreEnv(options, context);
+    }
+    if (context?.restoreDecision !== undefined) {
+        return configuredRestoreEnv(options, context, policy);
+    }
+    return automaticRestoreEnv(options, policy);
 }
-export function validateManagedSessionRestoreContextForSpawn(options) {
-    const { namespace, ownedContext, parentEnv } = resolveManagedSessionRestorePolicy(options);
-    if (closesBrowserSession(options.args) || ownedContext?.restoreDecision !== "enabled" || (ownedContext.reuseOnly && ownedContext.restoreSuppressed))
-        return true;
-    const ownedCwd = ownedContext.cwd ?? options.cwd;
-    if (!ownedContext.restoreKey || !ownedContext.restoreScope || createManagedSessionRestoreKey(ownedCwd, ownedContext.restoreScope) !== ownedContext.restoreKey || !hasManagedSessionRestoreProjectIdentity(ownedCwd))
-        return false;
-    const effectiveEnv = { ...parentEnv, ...options.env };
-    if (!ownedContext.reuseOnly) {
-        if (isDisabledEnvFlag(effectiveEnv[MANAGED_SESSION_RESTORE_ENV]))
-            return false;
-        if (MANAGED_RESTORE_INCOMPATIBLE_ENVS.some((name) => !MANAGED_SESSION_RESTORE_SPAWN_PINNED_ENVS.has(name) && hasUpstreamEnvValue(effectiveEnv, name)))
-            return false;
-        if (MANAGED_RESTORE_INCOMPATIBLE_BOOLEAN_ENVS.some((name) => isUpstreamEnvFlagEnabled(effectiveEnv[name])))
-            return false;
-        if (options.env?.[AGENT_BROWSER_RESTORE_ENV] !== undefined && options.env[AGENT_BROWSER_RESTORE_ENV] !== ownedContext.restoreKey)
-            return false;
+function recordEnabledDaemonKey(options, context) {
+    const { namespace, restoreState, sessionName } = resolveManagedSessionRestorePolicy(options);
+    if (options.ownedManagedSession !== true || !restoreState) {
+        return;
+    }
+    const disabled = restoreState.isDisabled(sessionName, namespace);
+    if (!disabled && context.restoreKey !== undefined && context.restoreKey.length > 0) {
+        restoreState.recordDaemonRestoreKey(sessionName, namespace, context.restoreKey);
+    }
+    else if (disabled && !restoreState.hasDaemonRestoreKey(sessionName, namespace)) {
+        restoreState.recordDaemonRestoreKey(sessionName, namespace, null);
     }
-    return ensureManagedSessionRestoreStorageIsSecure({ ...effectiveEnv, ...ownedContext.protectedStorageEnv }, process.platform, namespace);
 }
-export function getManagedSessionRestoreEnv(options) {
-    const { namespace, owned, ownedContext, parentEnv, restoreState, sessionName } = resolveManagedSessionRestorePolicy(options);
-    if (!owned || !restoreState || closesBrowserSession(options.args))
-        return {};
-    if (ownedContext?.reuseOnly) {
-        return ownedContext.restoreKey && !ownedContext.restoreSuppressed && validateManagedSessionRestoreContextForSpawn(options)
-            ? { [AGENT_BROWSER_RESTORE_ENV]: ownedContext.restoreKey }
-            : {};
+function commitPlannedDecision(options, context, policy) {
+    if (context.restoreDecision === "enabled") {
+        recordEnabledDaemonKey(options, context);
+        return;
+    }
+    if (!policy.restoreState) {
+        return;
     }
-    if (ownedContext?.restoreDecision) {
-        if (ownedContext.restoreDecision !== "enabled" || restoreState.isDisabled(sessionName, namespace) || !sessionName || !ownedContext.restoreKey || !validateManagedSessionRestoreContextForSpawn(options))
-            return {};
-        return { [AGENT_BROWSER_RESTORE_ENV]: ownedContext.restoreKey };
+    if (options.ownedManagedSession === true) {
+        policy.restoreState.recordDaemonRestoreKey(policy.sessionName, policy.namespace, context.expectedDaemonRestoreKey ?? null);
     }
-    const policyOptions = { ...options, parentEnv };
-    if (managedSessionRestoreOptedOut(policyOptions) || ownedContext?.restoreSuppressed || isManagedSessionRestoreIncompatible(policyOptions, namespace))
-        return {};
-    if (restoreState.isDisabled(sessionName, namespace) || !sessionName)
-        return {};
-    return { [AGENT_BROWSER_RESTORE_ENV]: createManagedSessionRestoreKey(options.cwd, getManagedSessionRestoreScope(sessionName)) };
+    policy.restoreState.disable(policy.sessionName, policy.namespace);
 }
 /** Commit sticky suppression only after an owned-context subprocess has actually started. */
 export function commitManagedSessionRestoreSuppression(options) {
     const { namespace, owned, ownedContext, parentEnv, restoreState, sessionName } = resolveManagedSessionRestorePolicy(options);
-    if (!owned || !restoreState || ownedContext?.reuseOnly || closesBrowserSession(options.args))
+    if (!owned ||
+        !restoreState ||
+        ownedContext?.reuseOnly === true ||
+        closesBrowserSession(options.args)) {
         return;
-    if (ownedContext?.restoreDecision) {
-        const alreadyDisabled = restoreState.isDisabled(sessionName, namespace);
-        if (ownedContext.restoreDecision === "enabled") {
-            if (options.ownedManagedSession && !alreadyDisabled && ownedContext.restoreKey) {
-                restoreState.recordDaemonRestoreKey(sessionName, namespace, ownedContext.restoreKey);
-            }
-            else if (options.ownedManagedSession && alreadyDisabled && !restoreState.hasDaemonRestoreKey(sessionName, namespace)) {
-                restoreState.recordDaemonRestoreKey(sessionName, namespace, null);
-            }
-        }
-        else {
-            if (options.ownedManagedSession)
-                restoreState.recordDaemonRestoreKey(sessionName, namespace, ownedContext.expectedDaemonRestoreKey ?? null);
-            restoreState.disable(sessionName, namespace);
-        }
+    }
+    if (ownedContext?.restoreDecision !== undefined) {
+        commitPlannedDecision(options, ownedContext, {
+            namespace,
+            owned,
+            ownedContext,
+            parentEnv,
+            restoreState,
+            sessionName,
+        });
         return;
     }
-    const policyOptions = { ...options, parentEnv };
-    if (managedSessionRestoreOptedOut(policyOptions) || ownedContext?.restoreSuppressed || isManagedSessionRestoreIncompatible(policyOptions, namespace))
+    if (disabledByPolicy({ ...options, parentEnv }, ownedContext, namespace)) {
         restoreState.disable(sessionName, namespace);
-}
-export function buildOwnedManagedSessionRestoreContext(options) {
-    const owned = resolveOwnedManagedSessionContext(options);
-    if (!owned)
-        return undefined;
-    const ownedCwd = owned.cwd ?? options.cwd;
-    if (options.reuseOnly) {
-        const env = { ...(options.parentEnv ?? getAgentBrowserProcessEnvironment()), ...options.env };
-        const enabled = !options.restoreState.isDisabled(owned.sessionName, owned.namespace);
-        const restoreScope = getManagedSessionRestoreScope(owned.sessionName);
-        const knownKey = options.restoreState.getDaemonRestoreKey(owned.sessionName, owned.namespace);
-        const restoreKey = knownKey === undefined && enabled && hasManagedSessionRestoreProjectIdentity(ownedCwd)
-            ? createManagedSessionRestoreKey(ownedCwd, restoreScope)
-            : knownKey;
-        return { ...owned, reuseOnly: true, restoreKey: restoreKey ?? undefined, restoreScope,
-            protectedStorageEnv: enabled ? getManagedSessionRestoreProtectedStorageEnv(true, env) : undefined,
-            restoreDecision: enabled ? "enabled" : undefined,
-            restoreSuppressed: managedSessionRestoreOptedOut(options) || agentBrowserExplicitConfigIsPresent(env, options.args)
-                || ["--restore", "--session-name"].some(flag => hasLaunchScopedFlagToken(options.args, flag))
-                || env.AGENT_BROWSER_RESTORE !== undefined || env.AGENT_BROWSER_SESSION_NAME !== undefined,
-            headedManagedAutosaveDisabled: options.headedManagedAutosaveDisabled,
-            headedManagedAutosaveInterval: options.headedManagedAutosaveInterval };
     }
-    const policyOptions = {
-        args: options.args,
-        cwd: ownedCwd,
-        env: options.env,
-        parentEnv: options.parentEnv,
-        stdin: options.stdin,
-        wrapperInjectedUserAgent: options.wrapperInjectedUserAgent,
-    };
-    const optedOut = managedSessionRestoreOptedOut(policyOptions);
-    const projectIdentityAvailable = !optedOut && hasManagedSessionRestoreProjectIdentity(ownedCwd);
-    const incompatible = !optedOut && isManagedSessionRestoreIncompatible(policyOptions, owned.namespace);
-    const enabled = !optedOut && !incompatible;
-    const effectiveEnv = { ...(options.parentEnv ?? getAgentBrowserProcessEnvironment()), ...options.env };
-    const restoreScope = getManagedSessionRestoreScope(owned.sessionName);
-    const restoreKey = projectIdentityAvailable ? createManagedSessionRestoreKey(ownedCwd, restoreScope) : undefined;
-    return {
-        ...owned,
-        compatibilityUserAgent: options.compatibilityUserAgent,
-        headedManagedAutosaveDisabled: options.headedManagedAutosaveDisabled,
-        headedManagedAutosaveInterval: options.headedManagedAutosaveInterval,
-        expectedDaemonRestoreKey: enabled ? restoreKey : extractRequestedRestoreKey(options.args, owned.sessionName, effectiveEnv[AGENT_BROWSER_RESTORE_ENV]),
-        protectedStorageEnv: enabled ? getManagedSessionRestoreProtectedStorageEnv(true, effectiveEnv) : undefined,
-        restoreDecision: optedOut ? "opted-out" : incompatible ? "incompatible" : "enabled",
-        restoreKey,
-        restoreScope,
-        restoreSuppressed: optedOut || incompatible,
-    };
 }