pi-agent-browser-native 0.9.4 → 0.9.5

package/dist/extensions/agent-browser/index.js

@@ -5122,18 +5122,26 @@ async function cleanupSecureTempArtifacts(options = {}) {
     });
   });
 }
-async function getSessionTempRoot() {
-  if (!sessionTempRootPromise) {
-    sessionTempRootPromise = (async () => {
-      const tempRoot2 = await mkdtemp(join3(tmpdir(), TEMP_ROOT_PREFIX));
-      await chmod2(tempRoot2, 448).catch(() => {
-      });
-      await writeSecureTempRootOwnershipMarker(tempRoot2);
-      ownedTempRoots.add(tempRoot2);
-      registerExitCleanup();
-      return tempRoot2;
-    })();
+async function allocateSessionTempRoot() {
+  const tempRoot = await mkdtemp(join3(tmpdir(), TEMP_ROOT_PREFIX));
+  try {
+    await chmod2(tempRoot, 448).catch(() => {
+    });
+    await writeSecureTempRootOwnershipMarker(tempRoot);
+    ownedTempRoots.add(tempRoot);
+    registerExitCleanup();
+    return tempRoot;
+  } catch (error) {
+    await rm2(tempRoot, { force: true, recursive: true }).catch(() => {
+    });
+    throw error;
   }
+}
+async function getSessionTempRoot() {
+  sessionTempRootPromise ??= allocateSessionTempRoot().catch((error) => {
+    sessionTempRootPromise = void 0;
+    throw error;
+  });
   const tempRoot = await sessionTempRootPromise;
   await refreshSecureTempRootLease(tempRoot).catch(() => {
   });
@@ -5237,7 +5245,10 @@ async function prunePersistentSessionArtifactsToBudget(sessionArtifactDir, addit
     if (protectedPaths.has(file.path)) {
       continue;
     }
-    await rm3(file.path, { force: true }).catch(() => void 0);
+    const removed = await rm3(file.path, { force: true }).then(() => true, () => false);
+    if (!removed) {
+      continue;
+    }
     evictedArtifacts.push({ mtimeMs: file.mtimeMs, path: file.path, sizeBytes: file.size });
     totalBytes -= file.size;
     if (totalBytes + additionalBytes <= maxBytes) {
@@ -8265,9 +8276,10 @@ function buildQaVisibleTextPredicate(text3) {
     if (style.display === "none" || style.visibility === "hidden" || Number(style.opacity) === 0) return false;
     return element.getClientRects().length > 0;
   };
-  const hasVisibleAncestors = (node) => {
+  const ancestorsAllowVisibility = (node) => {
     for (let element = node.parentElement; element; element = element.parentElement) {
-      if (!isVisibleElement(element)) return false;
+      const style = window.getComputedStyle(element);
+      if (style.display === "none" || Number(style.opacity) === 0) return false;
       if (element === root) break;
     }
     return true;
@@ -8275,14 +8287,16 @@ function buildQaVisibleTextPredicate(text3) {
   const textWalker = document.createTreeWalker(root, NodeFilter.SHOW_TEXT);
   let visitedText = 0;
   for (let node = textWalker.nextNode(); node && visitedText < 6000; node = textWalker.nextNode(), visitedText += 1) {
-    if (!hasVisibleAncestors(node)) continue;
+    const parent = node.parentElement;
+    if (!(parent instanceof HTMLElement) || skipTags.has(parent.tagName)) continue;
+    if (window.getComputedStyle(parent).visibility === "hidden" || !ancestorsAllowVisibility(node)) continue;
     if (normalize(node.nodeValue).includes(expected)) return true;
   }
   const elementWalker = document.createTreeWalker(root, NodeFilter.SHOW_ELEMENT);
   let visitedElements = 0;
   for (let node = elementWalker.nextNode(); node && visitedElements < 3000; node = elementWalker.nextNode(), visitedElements += 1) {
     const element = node;
-    if (!isVisibleElement(element) || !("value" in element)) continue;
+    if (!isVisibleElement(element) || !ancestorsAllowVisibility(element) || !("value" in element)) continue;
     if (normalize(element.value).includes(expected)) return true;
   }
   return false;
@@ -8862,7 +8876,17 @@ function getFailedNetworkRequests(data, queryText) {
       });
     }
   }
-  return failed;
+  const seenRequestIds = /* @__PURE__ */ new Set();
+  return failed.filter(({ requestId: id }) => {
+    if (id === void 0) {
+      return true;
+    }
+    if (seenRequestIds.has(id)) {
+      return false;
+    }
+    seenRequestIds.add(id);
+    return true;
+  });
 }
 function distinctNetworkCandidates(candidates) {
   const keys = /* @__PURE__ */ new Set();
@@ -8899,7 +8923,7 @@ function correlatesWithFailure(value, failedIds, failedUrls) {
   const url = typeof value.url === "string" ? value.url : void 0;
   return id !== void 0 && failedIds.has(id) || url !== void 0 && failedUrls.has(url);
 }
-function observeInitiatorCandidates(data, failedRequests) {
+function observeInitiatorCandidates(data, failedRequests, queryText) {
   const failedIds = new Set(failedRequests.map((request) => request.requestId).filter((value) => value !== void 0));
   const failedUrls = new Set(failedRequests.map((request) => request.url).filter((value) => value !== void 0));
   const candidates = [];
@@ -8910,7 +8934,8 @@ function observeInitiatorCandidates(data, failedRequests) {
       if (!isRecord(value)) {
         continue;
       }
-      if (correlatesWithFailure(value, failedIds, failedUrls) || isFailedNetworkRecord(value)) {
+      const url = typeof value.url === "string" ? value.url : void 0;
+      if (networkRequestMatchesQuery(url, queryText) && (correlatesWithFailure(value, failedIds, failedUrls) || isFailedNetworkRecord(value))) {
         candidates.push(...initiatorCandidates(value));
       }
     }
@@ -9132,8 +9157,9 @@ function networkSummary(status, failedCount, candidateCount) {
 async function analyzeNetworkSourceLookupResults(data, compiled, cwd) {
   const { distinctNetworkCandidates: distinctNetworkCandidates2, getFailedNetworkRequests: getFailedNetworkRequests2, observeInitiatorCandidates: observeInitiatorCandidates2 } = await Promise.resolve().then(() => (init_lookup_network_evidence(), lookup_network_evidence_exports));
   const { scanWorkspaceRequests: scanWorkspaceRequests2 } = await Promise.resolve().then(() => (init_lookup_workspace(), lookup_workspace_exports));
-  const failedRequests = getFailedNetworkRequests2(data, compiled.query.url ?? compiled.query.filter);
-  const observed = observeInitiatorCandidates2(data, failedRequests);
+  const queryText = compiled.query.filter ?? compiled.query.url;
+  const failedRequests = getFailedNetworkRequests2(data, queryText);
+  const observed = observeInitiatorCandidates2(data, failedRequests, queryText);
   const workspace = await scanWorkspaceRequests2(compiled.query, failedRequests, cwd);
   const candidates = distinctNetworkCandidates2([...observed, ...workspace.candidates]);
   const status = networkStatus(failedRequests.length, candidates.length);
@@ -11134,6 +11160,253 @@ var init_discovery_types = __esm({
   }
 });
 
+// dist/extensions/agent-browser/lib/results/presentation/diagnostic-storage.js
+function storageTextContainsSecret(text3) {
+  if (STORAGE_TOKEN_VALUE_PATTERN.test(text3) || STORAGE_SECRET_VALUE_WORD_PATTERN.test(text3) || STORAGE_EMAIL_VALUE_PATTERN.test(text3) || STORAGE_IDENTITY_VALUE_PATTERN.test(text3)) {
+    return true;
+  }
+  if (storageTextIsSensitiveUrl(text3) || redactSensitiveText(text3) !== text3) {
+    return true;
+  }
+  try {
+    const parsed = JSON.parse(text3);
+    return valueContainsStorageSecret(parsed);
+  } catch {
+    return false;
+  }
+}
+function storageTextIsSensitiveUrl(text3) {
+  try {
+    const url = new URL(text3);
+    return url.protocol === "http:" || url.protocol === "https:" || url.username.length > 0 || url.password.length > 0 || url.search.length > 0;
+  } catch {
+    return false;
+  }
+}
+function valueContainsStorageSecret(value) {
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    return trimmed.length > 0 && storageTextContainsSecret(trimmed);
+  }
+  if (Array.isArray(value)) {
+    return value.some((item) => valueContainsStorageSecret(item));
+  }
+  if (!isRecord(value)) {
+    return false;
+  }
+  return Object.entries(value).some(([key, entryValue]) => STORAGE_SECRET_KEY_PATTERN.test(key) || valueContainsStorageSecret(entryValue));
+}
+function shouldRevealStorageValue(key, value) {
+  if (key === void 0 || key.length === 0 || STORAGE_SECRET_KEY_PATTERN.test(key) || !STORAGE_BENIGN_KEY_PATTERN.test(key)) {
+    return false;
+  }
+  if (valueContainsStorageSecret(value)) {
+    return false;
+  }
+  if (typeof value === "string") {
+    return value.length <= STORAGE_VALUE_PREVIEW_MAX_CHARS;
+  }
+  return value === null || typeof value === "number" || typeof value === "boolean";
+}
+function formatStorageValue(key, value) {
+  if (!shouldRevealStorageValue(key, value)) {
+    return "[REDACTED]";
+  }
+  return typeof value === "string" ? redactModelFacingText(value) : stringifyModelFacing(value);
+}
+function storageRedactionReason(key) {
+  return key !== void 0 && key.length > 0 && STORAGE_SECRET_KEY_PATTERN.test(key) ? "sensitive-key" : "sensitive-value";
+}
+function redactStorageEntryValue(item) {
+  const key = getStringField(item, "key") ?? getStringField(item, "name");
+  if (!Object.hasOwn(item, "value") || shouldRevealStorageValue(key, item.value)) {
+    return redactSensitiveValue(item);
+  }
+  const redacted = redactSensitiveValue({ ...item, value: void 0 });
+  if (!isRecord(redacted)) {
+    throw new Error("Storage record redaction did not return a record");
+  }
+  return {
+    ...redacted,
+    value: "[REDACTED]",
+    valueRedacted: true,
+    valueRedactionReason: storageRedactionReason(key)
+  };
+}
+function redactStorageField(owner, key, value) {
+  if (key === "data" && isRecord(value)) {
+    return Object.fromEntries(Object.entries(value).map(([storageKey, storageValue]) => [
+      storageKey,
+      shouldRevealStorageValue(storageKey, storageValue) ? redactSensitiveValue(storageValue) : "[REDACTED]"
+    ]));
+  }
+  if ((key === "entries" || key === "items") && Array.isArray(value)) {
+    return value.map((item) => isRecord(item) ? redactStorageEntryValue(item) : redactSensitiveValue(item));
+  }
+  if (key === "value") {
+    const itemKey = getStringField(owner, "key") ?? getStringField(owner, "name");
+    return shouldRevealStorageValue(itemKey, value) ? redactSensitiveValue(value) : "[REDACTED]";
+  }
+  return redactSensitiveValue(value);
+}
+function redactStorageData(value) {
+  if (Array.isArray(value)) {
+    return value.map((item) => redactStorageData(item));
+  }
+  if (!isRecord(value)) {
+    return redactSensitiveValue(value);
+  }
+  const entries = Object.fromEntries(Object.entries(value).map(([key2, entryValue]) => [
+    key2,
+    redactStorageField(value, key2, entryValue)
+  ]));
+  const key = getStringField(value, "key") ?? getStringField(value, "name");
+  if (Object.hasOwn(value, "value") && !shouldRevealStorageValue(key, value.value)) {
+    entries.valueRedacted = true;
+    entries.valueRedactionReason = storageRedactionReason(key);
+  }
+  return entries;
+}
+function formatStorageEntry(item, index) {
+  if (!isRecord(item)) {
+    return `${index + 1}. [REDACTED]`;
+  }
+  const rawKey = getStringField(item, "key") ?? getStringField(item, "name") ?? `(entry ${index + 1})`;
+  const key = redactModelFacingText(rawKey);
+  return Object.hasOwn(item, "value") ? `${key}: ${formatStorageValue(rawKey, item.value)}` : key;
+}
+function formatStorageMutationText(data, type) {
+  const key = getStringField(data, "key");
+  if (key !== void 0 && Object.hasOwn(data, "value")) {
+    return `${type} ${redactModelFacingText(key)}: ${formatStorageValue(key, data.value)}`;
+  }
+  if (key !== void 0 && data.set === true) {
+    return `${type} set: ${redactModelFacingText(key)}`;
+  }
+  return data.cleared === true || data.clear === true ? `${type} cleared.` : void 0;
+}
+function formatStorageText(data) {
+  const type = getStringField(data, "type") ?? getStringField(data, "storage") ?? "storage";
+  if (isRecord(data.data)) {
+    const text3 = Object.entries(data.data).map(([key, value]) => `${redactModelFacingText(key)}: ${formatStorageValue(key, value)}`).join("\n");
+    return text3.length > 0 ? text3 : `${type}: no entries.`;
+  }
+  const entries = getArrayField(data, "entries") ?? getArrayField(data, "items");
+  if (entries) {
+    return entries.length === 0 ? `${type}: no entries.` : entries.map(formatStorageEntry).join("\n");
+  }
+  return formatStorageMutationText(data, type);
+}
+function formatCookieRecordText(item, fallbackName) {
+  const name = redactModelFacingText(getStringField(item, "name") ?? fallbackName);
+  const domain = getStringField(item, "domain");
+  const path = getStringField(item, "path");
+  const flags = [
+    item.httpOnly === true ? "httpOnly" : void 0,
+    item.secure === true ? "secure" : void 0
+  ].filter(Boolean).join(", ");
+  const location = [domain, path].filter(Boolean).join("");
+  return [
+    name,
+    location.length > 0 ? `(${redactModelFacingText(location)})` : void 0,
+    flags.length > 0 ? `[${flags}]` : void 0
+  ].filter(Boolean).join(" ");
+}
+function formatCookiesText(data) {
+  const cookies = getArrayField(data, "cookies");
+  if (cookies) {
+    return cookies.length === 0 ? "No cookies." : cookies.map((item, index) => isRecord(item) ? formatCookieRecordText(item, `(cookie ${index + 1})`) : `${index + 1}. [REDACTED]`).join("\n");
+  }
+  if (getStringField(data, "name") !== void 0 || getStringField(data, "domain") !== void 0 || getStringField(data, "path") !== void 0 || Object.hasOwn(data, "value")) {
+    return formatCookieRecordText(data, "cookie");
+  }
+  if (data.set === true) {
+    return "Cookie set.";
+  }
+  return data.cleared === true || data.clear === true ? "Cookies cleared." : void 0;
+}
+var STORAGE_VALUE_PREVIEW_MAX_CHARS, STORAGE_SECRET_KEY_PATTERN, STORAGE_BENIGN_KEY_PATTERN, STORAGE_TOKEN_VALUE_PATTERN, STORAGE_SECRET_VALUE_WORD_PATTERN, STORAGE_EMAIL_VALUE_PATTERN, STORAGE_IDENTITY_VALUE_PATTERN;
+var init_diagnostic_storage = __esm({
+  "dist/extensions/agent-browser/lib/results/presentation/diagnostic-storage.js"() {
+    "use strict";
+    init_parsing();
+    init_runtime();
+    init_common();
+    STORAGE_VALUE_PREVIEW_MAX_CHARS = 160;
+    STORAGE_SECRET_KEY_PATTERN = /(?:access(?:_|-)?token|account|api(?:_|-)?key|auth(?:orization)?|bearer|client(?:_|-)?secret|cookie|credential|csrf|email|id(?:_|-)?token|jwt|pass(?:word)?|private(?:_|-)?key|profile|refresh(?:_|-)?token|secret|session|sid|sig(?:nature)?|token|user(?:name)?|x(?:_|-)?api(?:_|-)?key|xsrf)/i;
+    STORAGE_BENIGN_KEY_PATTERN = /^(?:color(?:scheme)?|debug|dev|experiment|feature(?:flag)?|flag|language|layout|locale|mode|onboarding|sort|tab|theme|timezone|tour|variant|view)$/i;
+    STORAGE_TOKEN_VALUE_PATTERN = /(?:\bBearer\s+[A-Za-z0-9._~-]+|\bBasic\s+[A-Za-z0-9+/=]+|^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$|(?=.*[A-Za-z])(?=.*\d)[A-Za-z0-9_~+/=-]{32,})/;
+    STORAGE_SECRET_VALUE_WORD_PATTERN = /(?:secret|token|password|passwd|bearer|credential|authorization|cookie|session[-_ ]?id)/i;
+    STORAGE_EMAIL_VALUE_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    STORAGE_IDENTITY_VALUE_PATTERN = /(?:^|[\s:=/_-])(?:account|profile|session|sid|user(?:id|name)?)(?:[\s:=/_-]|$)/i;
+  }
+});
+
+// dist/extensions/agent-browser/lib/results/presentation/diagnostic-redaction.js
+function redactStatefulValues(value) {
+  if (Array.isArray(value)) {
+    return value.map((item) => redactStatefulValues(item));
+  }
+  if (!isRecord(value)) {
+    return redactSensitiveValue(value);
+  }
+  return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => [
+    key,
+    key.toLowerCase() === "value" ? "[REDACTED]" : redactStatefulValues(entryValue)
+  ]));
+}
+function storageTextKey(command) {
+  const operation = command.commandTokens?.[2];
+  if (operation === "get") {
+    return command.commandTokens?.[3];
+  }
+  return operation === "set" || operation === "clear" ? void 0 : operation;
+}
+function redactStorageText(command, text3) {
+  const key = storageTextKey(command);
+  if (key !== void 0 && text3.startsWith(`${key}: `)) {
+    const suffix = text3.endsWith("\n") ? "\n" : "";
+    const value = text3.slice(key.length + 2, suffix.length > 0 ? -1 : void 0);
+    return `${key}: ${formatStorageValue(key, value)}${suffix}`;
+  }
+  return text3.replace(/^([^\r\n]*?): ([^\r\n]*)/gm, (_line, entryKey, value) => `${entryKey}: ${formatStorageValue(entryKey, value)}`);
+}
+function redactNativeContextText(command, text3, stdin) {
+  if (command.command === "batch") {
+    const steps = getUpstreamEffectiveBatchSteps(command.commandTokens ?? ["batch"], stdin);
+    const cookieRedacted = steps.some((step) => step[0] === "cookies") ? redactNativeContextText({ command: "cookies" }, text3) : text3;
+    return steps.some((step) => step[0] === "storage") ? redactNativeContextText({ command: "storage" }, cookieRedacted) : cookieRedacted;
+  }
+  if (command.command === "cookies") {
+    return text3.replace(/^([^=\r\n]*)=([^\r\n]*)/gm, "$1=[REDACTED]");
+  }
+  return command.command === "storage" ? redactStorageText(command, text3) : text3;
+}
+function redactPresentationData(command, data, stdin) {
+  if (typeof data === "string") {
+    return redactSensitiveText(redactNativeContextText(command, data, stdin));
+  }
+  if (command.command === "cookies") {
+    return redactStatefulValues(data);
+  }
+  if (command.command === "storage") {
+    return redactStorageData(data);
+  }
+  if (command.command === "state" && command.subcommand === "show") {
+    return redactStatefulValues(data);
+  }
+  return redactSensitiveValue(data);
+}
+var init_diagnostic_redaction = __esm({
+  "dist/extensions/agent-browser/lib/results/presentation/diagnostic-redaction.js"() {
+    "use strict";
+    init_parsing();
+    init_batch_stdin();
+    init_runtime();
+    init_diagnostic_storage();
+  }
+});
+
 // dist/extensions/agent-browser/lib/results/next-actions.js
 function withOptionalNamespaceArgs(namespace, args) {
   return namespace !== void 0 && args[0] !== "--namespace" ? ["--namespace", namespace, ...args] : args;
@@ -11552,7 +11825,7 @@ function isSafeSameSnapshotFormBatchStep(step, refSnapshot) {
       return false;
   }
 }
-function getBatchRefInvalidationMessage(commandTokens, stdin, refSnapshot) {
+function getBatchRefInvalidationFailure(commandTokens, stdin, refSnapshot) {
   if (commandTokens[0] !== "batch") {
     return;
   }
@@ -11563,7 +11836,11 @@ function getBatchRefInvalidationMessage(commandTokens, stdin, refSnapshot) {
     }
     const refIds = collectRefsFromTokens(step);
     if (refIds.length > 0 && isRefGuardedCommand(step[0]) && priorStepInvalidatesRefs) {
-      return `Batch step ${step[0]} uses page-scoped ref ${refIds.map((refId) => `@${refId}`).join(", ")} after an earlier batch step can navigate or mutate the page. Split the batch, run snapshot -i after the page-changing step, then retry with current refs.`;
+      return {
+        message: `Batch step ${step[0]} uses page-scoped ref ${refIds.map((refId) => `@${refId}`).join(", ")} after an earlier batch step can navigate or mutate the page. Split the batch, run snapshot -i after the page-changing step, then retry with current refs.`,
+        refIds,
+        snapshot: refSnapshot
+      };
     }
     if (isRefInvalidatingBatchCommand(step) && !isSafeSameSnapshotFormBatchStep(step, refSnapshot)) {
       priorStepInvalidatesRefs = true;
@@ -11608,13 +11885,9 @@ function buildStaleRefPreflight(facts) {
       includeRefsAfterBatchSnapshot: true
     }))
   ] : guardedRefIds;
-  const batchInvalidationMessage = getBatchRefInvalidationMessage(facts.commandTokens, facts.stdin, facts.refSnapshot);
-  if (batchInvalidationMessage !== void 0 && batchInvalidationMessage.length > 0 && guardedRefIds.length > 0) {
-    return {
-      message: batchInvalidationMessage,
-      refIds: guardedRefIds,
-      snapshot: facts.refSnapshot
-    };
+  const batchInvalidationFailure = getBatchRefInvalidationFailure(facts.commandTokens, facts.stdin, facts.refSnapshot);
+  if (batchInvalidationFailure) {
+    return batchInvalidationFailure;
   }
   if (usedRefIds.length === 0) {
     return;
@@ -14004,6 +14277,364 @@ var init_action_recommendations = __esm({
   }
 });
 
+// dist/extensions/agent-browser/lib/electron/cdp.js
+function asString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value : void 0;
+}
+function parseCdpVersion(value) {
+  if (!isRecord(value)) {
+    return void 0;
+  }
+  const browser = asString(value.Browser) ?? asString(value.browser);
+  if (browser === void 0) {
+    return void 0;
+  }
+  return {
+    browser,
+    protocolVersion: asString(value["Protocol-Version"]) ?? asString(value.protocolVersion),
+    userAgent: asString(value["User-Agent"]) ?? asString(value.userAgent),
+    v8Version: asString(value["V8-Version"]) ?? asString(value.v8Version),
+    webKitVersion: asString(value["WebKit-Version"]) ?? asString(value.webKitVersion),
+    webSocketDebuggerUrl: asString(value.webSocketDebuggerUrl)
+  };
+}
+function parseCdpTargets(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.filter(isRecord).map((target) => ({
+    id: asString(target.id),
+    title: asString(target.title),
+    type: asString(target.type),
+    url: asString(target.url),
+    webSocketDebuggerUrl: asString(target.webSocketDebuggerUrl)
+  }));
+}
+async function fetchCdpJson(url, signal) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), ELECTRON_CDP_FETCH_TIMEOUT_MS);
+  try {
+    const response = await fetch(url, {
+      signal: signal ? AbortSignal.any([signal, controller.signal]) : controller.signal
+    });
+    if (!response.ok) {
+      return void 0;
+    }
+    return await response.json();
+  } catch {
+    return void 0;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function boundElectronProbeString(value, maxLength = 240) {
+  const trimmed = value?.trim();
+  if (trimmed === void 0 || trimmed.length === 0) {
+    return void 0;
+  }
+  return trimmed.length > maxLength ? `${trimmed.slice(0, Math.max(0, maxLength - 3))}...` : trimmed;
+}
+var ELECTRON_CDP_FETCH_TIMEOUT_MS;
+var init_cdp = __esm({
+  "dist/extensions/agent-browser/lib/electron/cdp.js"() {
+    "use strict";
+    init_parsing();
+    ELECTRON_CDP_FETCH_TIMEOUT_MS = 1e3;
+  }
+});
+
+// dist/extensions/agent-browser/lib/orchestration/browser-run/final-result-redaction.js
+function redactExactSensitiveText(text3, sensitiveValues) {
+  let redacted = text3;
+  for (const value of sensitiveValues) {
+    redacted = redacted.split(value).join("[REDACTED]");
+  }
+  return redacted;
+}
+function redactExactSensitiveValue(value, sensitiveValues) {
+  if (sensitiveValues.length === 0) {
+    return value;
+  }
+  if (typeof value === "string") {
+    return redactExactSensitiveText(value, sensitiveValues);
+  }
+  if (Array.isArray(value)) {
+    const entries = value;
+    return entries.map((item) => redactExactSensitiveValue(item, sensitiveValues));
+  }
+  if (!isRecord(value)) {
+    return value;
+  }
+  return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => [
+    key,
+    redactExactSensitiveValue(entryValue, sensitiveValues)
+  ]));
+}
+function redactToolDetails(details, sensitiveValues) {
+  const redacted = redactSensitiveValue(redactExactSensitiveValue(details, sensitiveValues));
+  if (!isRecord(redacted)) {
+    throw new Error("Browser result details must remain an object after redaction.");
+  }
+  return redacted;
+}
+function redactRecoveryHint(recoveryHint) {
+  if (!recoveryHint) {
+    return void 0;
+  }
+  const exampleArgs = redactInvocationArgs(recoveryHint.exampleArgs);
+  return {
+    ...recoveryHint,
+    exampleArgs,
+    exampleParams: { ...recoveryHint.exampleParams, args: exampleArgs }
+  };
+}
+function buildJsonVisibleContent(options) {
+  const { error, presentation, succeeded, warnings } = options;
+  const payload = projectAgentBrowserObservation({
+    ...presentation,
+    ...options.details,
+    error,
+    warnings: warnings !== void 0 && warnings.length > 0 ? warnings : void 0
+  }, succeeded);
+  const images = presentation.content.filter((item) => item.type === "image");
+  return [{ type: "text", text: JSON.stringify(payload, null, 2) }, ...images];
+}
+function warningLines(text3) {
+  return text3 === void 0 || text3.length === 0 ? void 0 : [text3];
+}
+function contentWithWarnings(options) {
+  if (options.userRequestedJson && !options.plainTextInspection) {
+    return buildJsonVisibleContent({
+      error: options.presentationEnvelope?.error,
+      presentation: options.presentation,
+      succeeded: options.succeeded,
+      warnings: warningLines(options.warningText)
+    });
+  }
+  const content = [...options.presentation.content];
+  if (options.warningText === void 0 || options.warningText.length === 0 || options.userRequestedJson) {
+    return content;
+  }
+  if (content[0]?.type === "text") {
+    content[0] = { ...content[0], text: `${options.warningText}
+
+${content[0].text}` };
+  } else {
+    content.unshift({ type: "text", text: options.warningText });
+  }
+  return content;
+}
+function buildRedactedPresentationContent(options) {
+  return contentWithWarnings(options).map((item) => {
+    if (item.type !== "text") {
+      return item;
+    }
+    const text3 = options.userRequestedJson && !options.plainTextInspection ? JSON.stringify(redactExactSensitiveValue(JSON.parse(item.text), options.exactSensitiveValues), null, 2) : redactSensitiveText(redactExactSensitiveText(item.text, options.exactSensitiveValues));
+    return { type: "text", text: text3 };
+  });
+}
+function readJsonWarnings(content) {
+  if (content[0]?.type !== "text") {
+    return void 0;
+  }
+  const prior = JSON.parse(content[0].text);
+  if (!isRecord(prior) || !Array.isArray(prior.warnings)) {
+    return void 0;
+  }
+  const warnings = prior.warnings;
+  return warnings;
+}
+var init_final_result_redaction = __esm({
+  "dist/extensions/agent-browser/lib/orchestration/browser-run/final-result-redaction.js"() {
+    "use strict";
+    init_parsing();
+    init_runtime_redaction();
+    init_content();
+  }
+});
+
+// dist/extensions/agent-browser/lib/orchestration/browser-run/final-result-electron.js
+function presentElectronManagedSessionTarget(target) {
+  return {
+    ...target,
+    title: boundElectronProbeString(target.title, 160),
+    url: boundElectronProbeString(target.url, 300)
+  };
+}
+function getElectronLaunchFailureCategory(failure) {
+  switch (failure.reason) {
+    case "aborted":
+      return "aborted";
+    case "policy-blocked":
+      return "policy-blocked";
+    case "timeout":
+      return "timeout";
+    case "non-electron-target":
+      return "validation-error";
+    case "port-not-found":
+    case "single-instance-conflict":
+    case "spawn-error":
+      return "upstream-error";
+  }
+}
+function pidState(pidAlive) {
+  if (pidAlive === void 0) {
+    return "state unknown";
+  }
+  return pidAlive ? "alive before cleanup" : "not alive before cleanup";
+}
+function formatProcessDiagnostics(diagnostics) {
+  const lines = [];
+  if (diagnostics.pid !== void 0) {
+    lines.push(`- PID: ${diagnostics.pid} (${pidState(diagnostics.pidAlive)}).`);
+  }
+  if (diagnostics.exitCode !== void 0 || diagnostics.exitSignal !== void 0) {
+    const exitParts = [
+      diagnostics.exitCode !== void 0 ? `code ${String(diagnostics.exitCode)}` : void 0,
+      diagnostics.exitSignal !== void 0 && diagnostics.exitSignal !== null && diagnostics.exitSignal.length > 0 ? `signal ${diagnostics.exitSignal}` : void 0
+    ].filter(Boolean).join(", ");
+    lines.push(`- Process exit: ${exitParts.length > 0 ? exitParts : "not observed before cleanup"}.`);
+  }
+  return lines;
+}
+function formatActivePort(activePort) {
+  const error = activePort.error !== void 0 && activePort.error.length > 0 ? ` (${activePort.error})` : "";
+  let state;
+  if (activePort.port !== void 0 && activePort.port !== 0) {
+    state = `found port ${activePort.port}`;
+  } else {
+    state = activePort.found ? `found but invalid${error}` : `missing${error}`;
+  }
+  return `- DevToolsActivePort: ${state} at ${activePort.path}.`;
+}
+function formatConnectionDiagnostics(diagnostics) {
+  const lines = [];
+  if (diagnostics.userDataDir !== void 0 && diagnostics.userDataDir.length > 0) {
+    lines.push(`- Wrapper profile: ${diagnostics.userDataDir}`);
+  }
+  if (diagnostics.devToolsActivePort) {
+    lines.push(formatActivePort(diagnostics.devToolsActivePort));
+  }
+  if (diagnostics.cdpVersionReached === false) {
+    lines.push("- CDP /json/version: did not return a valid payload before timeout.");
+  }
+  if (diagnostics.timeoutMs !== void 0 || diagnostics.elapsedMs !== void 0) {
+    lines.push(`- Timing: ${diagnostics.elapsedMs ?? "unknown"}ms elapsed${diagnostics.timeoutMs !== void 0 ? ` of ${diagnostics.timeoutMs}ms timeout` : ""}.`);
+  }
+  if (!diagnostics.outputCaptured) {
+    lines.push("- App stdout/stderr: not captured by this wrapper launch path.");
+  }
+  return lines;
+}
+function formatElectronLaunchFailureDiagnostics(failure) {
+  const diagnostics = failure?.diagnostics;
+  if (!diagnostics) {
+    return void 0;
+  }
+  const lines = [
+    "Electron launch diagnostics:",
+    ...formatProcessDiagnostics(diagnostics),
+    ...formatConnectionDiagnostics(diagnostics)
+  ];
+  if (failure.reason !== "aborted") {
+    lines.push("Retry guidance: increase electron.timeoutMs, try targetType:'any', pass an explicit appPath/executablePath, quit any already-running singleton instance, then retry launch.");
+  }
+  return lines.join("\n");
+}
+function buildElectronHostFailureResult(options) {
+  const text3 = [
+    options.errorText,
+    formatElectronLaunchFailureDiagnostics(options.launchFailure),
+    options.launchFailure?.cleanupError !== void 0 && options.launchFailure.cleanupError.length > 0 ? `Electron launch cleanup warning: ${options.launchFailure.cleanupError}` : void 0
+  ].filter((item) => item !== void 0 && item.length > 0).join("\n");
+  const details = {
+    args: [],
+    compiledElectron: options.compiledElectron,
+    electron: {
+      action: options.compiledElectron.action,
+      error: options.errorText,
+      failure: options.launchFailure,
+      status: options.status ?? "failed"
+    },
+    managedSessionOutcome: options.managedSessionOutcome,
+    ...buildAgentBrowserResultCategoryDetails({
+      args: [],
+      errorText: options.errorText,
+      failureCategory: options.failureCategory,
+      succeeded: false,
+      timedOut: options.failureCategory === "timeout"
+    }),
+    summary: options.errorText
+  };
+  return {
+    content: [{ type: "text", text: redactSensitiveText(text3) }],
+    details: redactToolDetails(details, []),
+    isError: true
+  };
+}
+function formatElectronTargetLines(targets, limit = 8) {
+  const shownTargets = targets.slice(0, limit);
+  const lines = shownTargets.map((target) => {
+    const typeTitle = [target.type, target.title].filter(Boolean).join(" ");
+    const fallback = target.id === void 0 || target.id.length === 0 ? "target" : target.id;
+    const label = typeTitle.length > 0 ? typeTitle : fallback;
+    return `- ${label}${target.url !== void 0 && target.url.length > 0 ? ` \u2014 ${target.url}` : ""}`;
+  });
+  if (targets.length > shownTargets.length) {
+    lines.push(`- ... ${targets.length - shownTargets.length} more target(s) omitted`);
+  }
+  return lines;
+}
+function formatSnapshotHandoff(handoff) {
+  if (handoff.refSnapshot && handoff.refSnapshot.refIds.length > 0) {
+    const retries = handoff.snapshotRetryCount;
+    return `Snapshot handoff: ${handoff.refSnapshot.refIds.length} interactive ref(s)${retries !== void 0 && retries !== 0 ? ` after ${retries} retry attempt(s)` : ""}.`;
+  }
+  return "Snapshot handoff: no interactive refs returned after a short readiness retry; run snapshot -i once more before assuming the Electron UI is unusable.";
+}
+function formatHandoffText(handoff) {
+  switch (handoff?.handoff) {
+    case "snapshot":
+      return formatSnapshotHandoff(handoff);
+    case "tabs":
+      return "Tabs handoff completed: safer diagnostic starting point; no interactive refs were captured.";
+    case "connect":
+      return "Connect handoff completed: run snapshot -i before using interactive refs.";
+    case void 0:
+      return void 0;
+  }
+}
+function formatElectronLaunchText(options) {
+  const lines = [
+    `Electron launch: ${options.record.appName} attached as ${options.record.sessionName ?? "managed session"} (launchId ${options.record.launchId}, port ${options.record.port}).`,
+    `Identifiers: launchId ${options.record.launchId} for electron.status/electron.cleanup/electron.probe; sessionName ${options.record.sessionName ?? "not attached"} for browser snapshot/tab commands.`,
+    "Profile note: electron.launch starts an isolated temporary profile; it does not reuse the app's normal signed-in profile or attach to an already-running authenticated app.",
+    "For already-authenticated desktop app content, do not stop here: if host tools are allowed and the app is not running, launch the normal app with --remote-debugging-port=<port>, verify the port, then run agent_browser connect <port>; if it is already running without a debug port, ask before relaunching it.",
+    ...formatElectronTargetLines(options.targets)
+  ];
+  const handoffText = formatHandoffText(options.handoff);
+  if (handoffText !== void 0) {
+    lines.push(handoffText);
+  }
+  lines.push(`Cleanup: use details.nextActions cleanup-electron-launch or call electron.cleanup with launchId ${options.record.launchId} when finished.`);
+  if (options.handoff?.error !== void 0 && options.handoff.error.length > 0) {
+    lines.push(`Handoff warning: ${options.handoff.error}`);
+  }
+  if (options.upstreamText.trim().length > 0) {
+    lines.push("", options.upstreamText.trim());
+  }
+  return lines.join("\n");
+}
+var init_final_result_electron = __esm({
+  "dist/extensions/agent-browser/lib/orchestration/browser-run/final-result-electron.js"() {
+    "use strict";
+    init_cdp();
+    init_categories();
+    init_runtime_redaction();
+    init_final_result_redaction();
+  }
+});
+
 // dist/extensions/agent-browser/lib/orchestration/browser-run/session-state-electron.js
 function isLiveElectronRendererTarget(target) {
   const normalizedUrl = normalizeComparableUrl(target.url);
@@ -14099,15 +14730,16 @@ function buildElectronSessionMismatch(options) {
     return;
   }
   const nextActions = buildElectronMismatchNextActions(options.record, liveTarget);
+  const managedSession = presentElectronManagedSessionTarget(options.managedSession);
   return {
     launchId: options.record.launchId,
     liveTarget,
-    managedSession: options.managedSession,
+    managedSession,
     nextActionIds: nextActions.map((action) => action.id),
     reason,
     sessionName: options.record.sessionName,
     statusTargets: options.statusTargets,
-    summary: describeElectronMismatch(options.managedSession, options.record, liveTarget, reason)
+    summary: describeElectronMismatch(managedSession, options.record, liveTarget, reason)
   };
 }
 function formatElectronSessionMismatchText(mismatch) {
@@ -14209,6 +14841,7 @@ var init_session_state_electron = __esm({
     init_action_recommendations();
     init_session_page_state();
     init_session_state_refs();
+    init_final_result_electron();
   }
 });
 
@@ -14307,68 +14940,6 @@ var init_session_state = __esm({
   }
 });
 
-// dist/extensions/agent-browser/lib/electron/cdp.js
-function asString(value) {
-  return typeof value === "string" && value.trim().length > 0 ? value : void 0;
-}
-function parseCdpVersion(value) {
-  if (!isRecord(value)) {
-    return void 0;
-  }
-  return {
-    browser: asString(value.Browser) ?? asString(value.browser),
-    protocolVersion: asString(value["Protocol-Version"]) ?? asString(value.protocolVersion),
-    userAgent: asString(value["User-Agent"]) ?? asString(value.userAgent),
-    v8Version: asString(value["V8-Version"]) ?? asString(value.v8Version),
-    webKitVersion: asString(value["WebKit-Version"]) ?? asString(value.webKitVersion),
-    webSocketDebuggerUrl: asString(value.webSocketDebuggerUrl)
-  };
-}
-function parseCdpTargets(value) {
-  if (!Array.isArray(value)) {
-    return [];
-  }
-  return value.filter(isRecord).map((target) => ({
-    id: asString(target.id),
-    title: asString(target.title),
-    type: asString(target.type),
-    url: asString(target.url),
-    webSocketDebuggerUrl: asString(target.webSocketDebuggerUrl)
-  }));
-}
-async function fetchCdpJson(url, signal) {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), ELECTRON_CDP_FETCH_TIMEOUT_MS);
-  try {
-    const response = await fetch(url, {
-      signal: signal ? AbortSignal.any([signal, controller.signal]) : controller.signal
-    });
-    if (!response.ok) {
-      return void 0;
-    }
-    return await response.json();
-  } catch {
-    return void 0;
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-function boundElectronProbeString(value, maxLength = 240) {
-  const trimmed = value?.trim();
-  if (trimmed === void 0 || trimmed.length === 0) {
-    return void 0;
-  }
-  return trimmed.length > maxLength ? `${trimmed.slice(0, Math.max(0, maxLength - 3))}...` : trimmed;
-}
-var ELECTRON_CDP_FETCH_TIMEOUT_MS;
-var init_cdp = __esm({
-  "dist/extensions/agent-browser/lib/electron/cdp.js"() {
-    "use strict";
-    init_parsing();
-    ELECTRON_CDP_FETCH_TIMEOUT_MS = 1e3;
-  }
-});
-
 // dist/extensions/agent-browser/lib/electron/launch-types.js
 var ELECTRON_LAUNCH_RECORD_VERSION, ELECTRON_PROFILE_DIR_PREFIX;
 var init_launch_types = __esm({
@@ -14380,7 +14951,7 @@ var init_launch_types = __esm({
 });
 
 // dist/extensions/agent-browser/lib/fs-utils.js
-import { access, stat as stat9 } from "node:fs/promises";
+import { access } from "node:fs/promises";
 async function pathExists(path) {
   try {
     await access(path);
@@ -14396,10 +14967,7 @@ var init_fs_utils = __esm({
 });
 
 // dist/extensions/agent-browser/lib/electron/cleanup.js
-import { execFile as execFile2 } from "node:child_process";
 import { lstat as lstat2, rm as rm7 } from "node:fs/promises";
-import { win32 as win323 } from "node:path";
-import { promisify as promisify2 } from "node:util";
 function sleep(ms) {
   return new Promise((resolve19) => {
     setTimeout(resolve19, ms);
@@ -14457,39 +15025,16 @@ async function waitForProcessExit(child, pid, deadlineMs) {
   }
   return hasProcessExited(child, pid);
 }
-async function readPidCommandLine(pid) {
-  if (!Number.isSafeInteger(pid) || pid <= 0) {
-    return void 0;
-  }
-  try {
-    const systemRoot = process.env.SystemRoot;
-    const windowsRoot = systemRoot !== void 0 && systemRoot.length > 0 && win323.isAbsolute(systemRoot) ? systemRoot : "C:\\Windows";
-    const file = process.platform === "win32" ? win323.join(windowsRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe") : "ps";
-    const args = process.platform === "win32" ? [
-      "-NoProfile",
-      "-NonInteractive",
-      "-Command",
-      `[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new(); $p = [wmi]"Win32_Process.Handle='${pid}'"; [Console]::WriteLine($p.CommandLine)`
-    ] : ["-ww", "-p", String(pid), "-o", "command="];
-    const { stdout } = await execFileAsync(file, args, {
-      timeout: RESTORED_PROCESS_COMMAND_TIMEOUT_MS
-    });
-    const commandLine = stdout.trim();
-    return commandLine.length === 0 ? void 0 : commandLine;
-  } catch {
-    return void 0;
-  }
-}
-function restoredLaunchCommandMatchesRecord(record, commandLine) {
-  return commandLine?.includes(`--user-data-dir=${record.userDataDir}`) === true;
-}
 async function getRestoredProcessVerificationError(record) {
-  const commandLine = record.pid === void 0 ? void 0 : await readPidCommandLine(record.pid);
-  if (commandLine === void 0 || commandLine.length === 0) {
-    return `PID ${String(record.pid)} is alive, but this session has no tracked child handle and its command line could not be inspected; refusing to signal a restored PID that may have been reused.`;
+  if (record.startIdentity === void 0 || record.startIdentity.length === 0) {
+    return `PID ${String(record.pid)} is alive, but this session has no tracked child handle or recorded start identity; refusing to signal a restored PID that may have been reused.`;
   }
-  if (!restoredLaunchCommandMatchesRecord(record, commandLine)) {
-    return `PID ${String(record.pid)} is alive, but this session has no tracked child handle and its command line does not include wrapper-owned user data dir ${record.userDataDir}; refusing to signal a restored PID that may have been reused.`;
+  const currentIdentity = record.pid === void 0 ? void 0 : await readProcessStartIdentity(record.pid);
+  if (currentIdentity === void 0) {
+    return `PID ${String(record.pid)} is alive, but its current start identity could not be inspected; refusing to signal a restored PID that may have been reused.`;
+  }
+  if (!processStartIdentitiesMatch(record.startIdentity, currentIdentity)) {
+    return `PID ${String(record.pid)} is alive, but its start identity does not match the wrapper launch record; refusing to signal a restored PID that may have been reused.`;
   }
   return void 0;
 }
@@ -14542,6 +15087,10 @@ async function cleanupRestoredProcess(record, deadlineMs) {
   if (await waitForProcessExit(void 0, record.pid, deadlineMs)) {
     return { resource: "process", state: "removed" };
   }
+  const killVerificationError = await getRestoredProcessVerificationError(record);
+  if (killVerificationError !== void 0) {
+    return { error: killVerificationError, resource: "process", state: "failed" };
+  }
   signalRestoredLaunchProcess(record, "SIGKILL");
   if (await waitForProcessExit(void 0, record.pid, Date.now() + 1e3)) {
     return { resource: "process", state: "removed" };
@@ -14651,7 +15200,7 @@ async function cleanupElectronLaunchResources(options) {
     summary: summary.summary
   };
 }
-var ELECTRON_CLEANUP_DEFAULT_TIMEOUT_MS, ELECTRON_CLEANUP_POLL_INTERVAL_MS, RESTORED_PROCESS_COMMAND_TIMEOUT_MS, execFileAsync;
+var ELECTRON_CLEANUP_DEFAULT_TIMEOUT_MS, ELECTRON_CLEANUP_POLL_INTERVAL_MS;
 var init_cleanup = __esm({
   "dist/extensions/agent-browser/lib/electron/cleanup.js"() {
     "use strict";
@@ -14659,12 +15208,11 @@ var init_cleanup = __esm({
     init_launch_types();
     init_fs_utils();
     init_parsing();
+    init_process_identity();
     init_text();
     init_temp();
     ELECTRON_CLEANUP_DEFAULT_TIMEOUT_MS = 5e3;
     ELECTRON_CLEANUP_POLL_INTERVAL_MS = 100;
-    RESTORED_PROCESS_COMMAND_TIMEOUT_MS = 1e3;
-    execFileAsync = promisify2(execFile2);
   }
 });
 
@@ -15123,8 +15671,8 @@ async function publishTicket(claim) {
   await rename2(candidate, join20(claim.path, LOCK_TICKET_FILE));
   return ticket.ticket;
 }
-function acquisitionExpired(budget) {
-  return budget.signal?.aborted === true || budget.deadline !== void 0 && Date.now() >= budget.deadline;
+function acquisitionCancelled(budget) {
+  return budget.signal?.aborted === true;
 }
 async function waitForTurn(claim, ticket, budget, deadline) {
   while (budget.signal?.aborted !== true) {
@@ -15138,7 +15686,7 @@ async function waitForTurn(claim, ticket, budget, deadline) {
     }
     if (!await anyPredecessorBlocks(claims, own, budget)) {
       await cleanDeadPolicyArtifacts(claim.directory, budget);
-      return !acquisitionExpired(budget);
+      return !acquisitionCancelled(budget);
     }
     if (Date.now() >= deadline) {
       return false;
@@ -15755,290 +16303,6 @@ var init_managed_session_daemon_policy = __esm({
   }
 });
 
-// dist/extensions/agent-browser/lib/orchestration/browser-run/final-result-redaction.js
-function redactExactSensitiveText(text3, sensitiveValues) {
-  let redacted = text3;
-  for (const value of sensitiveValues) {
-    redacted = redacted.split(value).join("[REDACTED]");
-  }
-  return redacted;
-}
-function redactExactSensitiveValue(value, sensitiveValues) {
-  if (sensitiveValues.length === 0) {
-    return value;
-  }
-  if (typeof value === "string") {
-    return redactExactSensitiveText(value, sensitiveValues);
-  }
-  if (Array.isArray(value)) {
-    const entries = value;
-    return entries.map((item) => redactExactSensitiveValue(item, sensitiveValues));
-  }
-  if (!isRecord(value)) {
-    return value;
-  }
-  return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => [
-    key,
-    redactExactSensitiveValue(entryValue, sensitiveValues)
-  ]));
-}
-function redactToolDetails(details, sensitiveValues) {
-  const redacted = redactSensitiveValue(redactExactSensitiveValue(details, sensitiveValues));
-  if (!isRecord(redacted)) {
-    throw new Error("Browser result details must remain an object after redaction.");
-  }
-  return redacted;
-}
-function redactRecoveryHint(recoveryHint) {
-  if (!recoveryHint) {
-    return void 0;
-  }
-  const exampleArgs = redactInvocationArgs(recoveryHint.exampleArgs);
-  return {
-    ...recoveryHint,
-    exampleArgs,
-    exampleParams: { ...recoveryHint.exampleParams, args: exampleArgs }
-  };
-}
-function buildJsonVisibleContent(options) {
-  const { error, presentation, succeeded, warnings } = options;
-  const payload = projectAgentBrowserObservation({
-    ...presentation,
-    ...options.details,
-    error,
-    warnings: warnings !== void 0 && warnings.length > 0 ? warnings : void 0
-  }, succeeded);
-  const images = presentation.content.filter((item) => item.type === "image");
-  return [{ type: "text", text: JSON.stringify(payload, null, 2) }, ...images];
-}
-function warningLines(text3) {
-  return text3 === void 0 || text3.length === 0 ? void 0 : [text3];
-}
-function contentWithWarnings(options) {
-  if (options.userRequestedJson && !options.plainTextInspection) {
-    return buildJsonVisibleContent({
-      error: options.presentationEnvelope?.error,
-      presentation: options.presentation,
-      succeeded: options.succeeded,
-      warnings: warningLines(options.warningText)
-    });
-  }
-  const content = [...options.presentation.content];
-  if (options.warningText === void 0 || options.warningText.length === 0 || options.userRequestedJson) {
-    return content;
-  }
-  if (content[0]?.type === "text") {
-    content[0] = { ...content[0], text: `${options.warningText}
-
-${content[0].text}` };
-  } else {
-    content.unshift({ type: "text", text: options.warningText });
-  }
-  return content;
-}
-function buildRedactedPresentationContent(options) {
-  return contentWithWarnings(options).map((item) => {
-    if (item.type !== "text") {
-      return item;
-    }
-    const text3 = options.userRequestedJson && !options.plainTextInspection ? JSON.stringify(redactExactSensitiveValue(JSON.parse(item.text), options.exactSensitiveValues), null, 2) : redactSensitiveText(redactExactSensitiveText(item.text, options.exactSensitiveValues));
-    return { type: "text", text: text3 };
-  });
-}
-function readJsonWarnings(content) {
-  if (content[0]?.type !== "text") {
-    return void 0;
-  }
-  const prior = JSON.parse(content[0].text);
-  if (!isRecord(prior) || !Array.isArray(prior.warnings)) {
-    return void 0;
-  }
-  const warnings = prior.warnings;
-  return warnings;
-}
-var init_final_result_redaction = __esm({
-  "dist/extensions/agent-browser/lib/orchestration/browser-run/final-result-redaction.js"() {
-    "use strict";
-    init_parsing();
-    init_runtime_redaction();
-    init_content();
-  }
-});
-
-// dist/extensions/agent-browser/lib/orchestration/browser-run/final-result-electron.js
-function getElectronLaunchFailureCategory(failure) {
-  switch (failure.reason) {
-    case "aborted":
-      return "aborted";
-    case "policy-blocked":
-      return "policy-blocked";
-    case "timeout":
-      return "timeout";
-    case "non-electron-target":
-      return "validation-error";
-    case "port-not-found":
-    case "single-instance-conflict":
-    case "spawn-error":
-      return "upstream-error";
-  }
-}
-function pidState(pidAlive) {
-  if (pidAlive === void 0) {
-    return "state unknown";
-  }
-  return pidAlive ? "alive before cleanup" : "not alive before cleanup";
-}
-function formatProcessDiagnostics(diagnostics) {
-  const lines = [];
-  if (diagnostics.pid !== void 0) {
-    lines.push(`- PID: ${diagnostics.pid} (${pidState(diagnostics.pidAlive)}).`);
-  }
-  if (diagnostics.exitCode !== void 0 || diagnostics.exitSignal !== void 0) {
-    const exitParts = [
-      diagnostics.exitCode !== void 0 ? `code ${String(diagnostics.exitCode)}` : void 0,
-      diagnostics.exitSignal !== void 0 && diagnostics.exitSignal !== null && diagnostics.exitSignal.length > 0 ? `signal ${diagnostics.exitSignal}` : void 0
-    ].filter(Boolean).join(", ");
-    lines.push(`- Process exit: ${exitParts.length > 0 ? exitParts : "not observed before cleanup"}.`);
-  }
-  return lines;
-}
-function formatActivePort(activePort) {
-  const error = activePort.error !== void 0 && activePort.error.length > 0 ? ` (${activePort.error})` : "";
-  let state;
-  if (activePort.port !== void 0 && activePort.port !== 0) {
-    state = `found port ${activePort.port}`;
-  } else {
-    state = activePort.found ? `found but invalid${error}` : `missing${error}`;
-  }
-  return `- DevToolsActivePort: ${state} at ${activePort.path}.`;
-}
-function formatConnectionDiagnostics(diagnostics) {
-  const lines = [];
-  if (diagnostics.userDataDir !== void 0 && diagnostics.userDataDir.length > 0) {
-    lines.push(`- Wrapper profile: ${diagnostics.userDataDir}`);
-  }
-  if (diagnostics.devToolsActivePort) {
-    lines.push(formatActivePort(diagnostics.devToolsActivePort));
-  }
-  if (diagnostics.cdpVersionReached === false) {
-    lines.push("- CDP /json/version: did not return a valid payload before timeout.");
-  }
-  if (diagnostics.timeoutMs !== void 0 || diagnostics.elapsedMs !== void 0) {
-    lines.push(`- Timing: ${diagnostics.elapsedMs ?? "unknown"}ms elapsed${diagnostics.timeoutMs !== void 0 ? ` of ${diagnostics.timeoutMs}ms timeout` : ""}.`);
-  }
-  if (!diagnostics.outputCaptured) {
-    lines.push("- App stdout/stderr: not captured by this wrapper launch path.");
-  }
-  return lines;
-}
-function formatElectronLaunchFailureDiagnostics(failure) {
-  const diagnostics = failure?.diagnostics;
-  if (!diagnostics) {
-    return void 0;
-  }
-  const lines = [
-    "Electron launch diagnostics:",
-    ...formatProcessDiagnostics(diagnostics),
-    ...formatConnectionDiagnostics(diagnostics)
-  ];
-  if (failure.reason !== "aborted") {
-    lines.push("Retry guidance: increase electron.timeoutMs, try targetType:'any', pass an explicit appPath/executablePath, quit any already-running singleton instance, then retry launch.");
-  }
-  return lines.join("\n");
-}
-function buildElectronHostFailureResult(options) {
-  const text3 = [
-    options.errorText,
-    formatElectronLaunchFailureDiagnostics(options.launchFailure),
-    options.launchFailure?.cleanupError !== void 0 && options.launchFailure.cleanupError.length > 0 ? `Electron launch cleanup warning: ${options.launchFailure.cleanupError}` : void 0
-  ].filter((item) => item !== void 0 && item.length > 0).join("\n");
-  const details = {
-    args: [],
-    compiledElectron: options.compiledElectron,
-    electron: {
-      action: options.compiledElectron.action,
-      error: options.errorText,
-      failure: options.launchFailure,
-      status: options.status ?? "failed"
-    },
-    managedSessionOutcome: options.managedSessionOutcome,
-    ...buildAgentBrowserResultCategoryDetails({
-      args: [],
-      errorText: options.errorText,
-      failureCategory: options.failureCategory,
-      succeeded: false,
-      timedOut: options.failureCategory === "timeout"
-    }),
-    summary: options.errorText
-  };
-  return {
-    content: [{ type: "text", text: redactSensitiveText(text3) }],
-    details: redactToolDetails(details, []),
-    isError: true
-  };
-}
-function formatElectronTargetLines(targets, limit = 8) {
-  const shownTargets = targets.slice(0, limit);
-  const lines = shownTargets.map((target) => {
-    const typeTitle = [target.type, target.title].filter(Boolean).join(" ");
-    const fallback = target.id === void 0 || target.id.length === 0 ? "target" : target.id;
-    const label = typeTitle.length > 0 ? typeTitle : fallback;
-    return `- ${label}${target.url !== void 0 && target.url.length > 0 ? ` \u2014 ${target.url}` : ""}`;
-  });
-  if (targets.length > shownTargets.length) {
-    lines.push(`- ... ${targets.length - shownTargets.length} more target(s) omitted`);
-  }
-  return lines;
-}
-function formatSnapshotHandoff(handoff) {
-  if (handoff.refSnapshot && handoff.refSnapshot.refIds.length > 0) {
-    const retries = handoff.snapshotRetryCount;
-    return `Snapshot handoff: ${handoff.refSnapshot.refIds.length} interactive ref(s)${retries !== void 0 && retries !== 0 ? ` after ${retries} retry attempt(s)` : ""}.`;
-  }
-  return "Snapshot handoff: no interactive refs returned after a short readiness retry; run snapshot -i once more before assuming the Electron UI is unusable.";
-}
-function formatHandoffText(handoff) {
-  switch (handoff?.handoff) {
-    case "snapshot":
-      return formatSnapshotHandoff(handoff);
-    case "tabs":
-      return "Tabs handoff completed: safer diagnostic starting point; no interactive refs were captured.";
-    case "connect":
-      return "Connect handoff completed: run snapshot -i before using interactive refs.";
-    case void 0:
-      return void 0;
-  }
-}
-function formatElectronLaunchText(options) {
-  const lines = [
-    `Electron launch: ${options.record.appName} attached as ${options.record.sessionName ?? "managed session"} (launchId ${options.record.launchId}, port ${options.record.port}).`,
-    `Identifiers: launchId ${options.record.launchId} for electron.status/electron.cleanup/electron.probe; sessionName ${options.record.sessionName ?? "not attached"} for browser snapshot/tab commands.`,
-    "Profile note: electron.launch starts an isolated temporary profile; it does not reuse the app's normal signed-in profile or attach to an already-running authenticated app.",
-    "For already-authenticated desktop app content, do not stop here: if host tools are allowed and the app is not running, launch the normal app with --remote-debugging-port=<port>, verify the port, then run agent_browser connect <port>; if it is already running without a debug port, ask before relaunching it.",
-    ...formatElectronTargetLines(options.targets)
-  ];
-  const handoffText = formatHandoffText(options.handoff);
-  if (handoffText !== void 0) {
-    lines.push(handoffText);
-  }
-  lines.push(`Cleanup: use details.nextActions cleanup-electron-launch or call electron.cleanup with launchId ${options.record.launchId} when finished.`);
-  if (options.handoff?.error !== void 0 && options.handoff.error.length > 0) {
-    lines.push(`Handoff warning: ${options.handoff.error}`);
-  }
-  if (options.upstreamText.trim().length > 0) {
-    lines.push("", options.upstreamText.trim());
-  }
-  return lines.join("\n");
-}
-var init_final_result_electron = __esm({
-  "dist/extensions/agent-browser/lib/orchestration/browser-run/final-result-electron.js"() {
-    "use strict";
-    init_categories();
-    init_runtime_redaction();
-    init_final_result_redaction();
-  }
-});
-
 // dist/extensions/agent-browser/lib/orchestration/electron-host/branch.js
 function isLaunchIdentity(value) {
   return value.version === 1 && value.launchedByWrapper === true && typeof value.launchId === "string" && typeof value.appName === "string" && typeof value.executablePath === "string" && typeof value.userDataDir === "string" && typeof value.port === "number" && typeof value.createdAtMs === "number";
@@ -16053,6 +16317,7 @@ function hasValidOptionalFields(value) {
     "packageSource",
     "platform",
     "sessionName",
+    "startIdentity",
     "webSocketDebuggerUrl"
   ];
   return strings.every((field) => value[field] === void 0 || typeof value[field] === "string") && ["pid", "processGroupId"].every((field) => value[field] === void 0 || typeof value[field] === "number");
@@ -16128,25 +16393,25 @@ var init_branch = __esm({
 
 // dist/extensions/agent-browser/lib/electron/discovery-evidence.js
 import { constants as fsConstants } from "node:fs";
-import { access as access2, readdir as readdir7, realpath as realpath2, stat as stat10 } from "node:fs/promises";
+import { access as access2, readdir as readdir7, realpath as realpath2, stat as stat9 } from "node:fs/promises";
 import { basename as basename6, dirname as dirname12, extname as extname4, join as join21 } from "node:path";
 async function isDirectory(path) {
   try {
-    return (await stat10(path)).isDirectory();
+    return (await stat9(path)).isDirectory();
   } catch {
     return false;
   }
 }
 async function isFile(path) {
   try {
-    return (await stat10(path)).isFile();
+    return (await stat9(path)).isFile();
   } catch {
     return false;
   }
 }
 async function isExecutableFile(path) {
   try {
-    if (!(await stat10(path)).isFile()) {
+    if (!(await stat9(path)).isFile()) {
       return false;
     }
     await access2(path, fsConstants.X_OK);
@@ -16171,7 +16436,7 @@ async function directoryContainsChromePak(directory) {
   }
 }
 async function hasElectronAppPayload(resourcesDirectory) {
-  return await pathExists(join21(resourcesDirectory, "app.asar")) || await isDirectory(join21(resourcesDirectory, "app"));
+  return await pathExists(join21(resourcesDirectory, "app.asar")) || await pathExists(join21(resourcesDirectory, "default_app.asar")) || await isDirectory(join21(resourcesDirectory, "app"));
 }
 async function hasLinuxElectronEvidence(executablePath) {
   const resolved = await resolveRealPath(executablePath);
@@ -18936,7 +19201,7 @@ var init_final_result_actions = __esm({
 });
 
 // dist/extensions/agent-browser/lib/orchestration/browser-run/timeout-diagnostics.js
-import { stat as stat11 } from "node:fs/promises";
+import { stat as stat10 } from "node:fs/promises";
 import { isAbsolute as isAbsolute8, resolve as resolve11 } from "node:path";
 import { setTimeout as sleepMs } from "node:timers/promises";
 function getTimeoutProgressSteps(options) {
@@ -18971,7 +19236,7 @@ function getTimeoutStepArtifactPath(commandTokens) {
 async function statTimeoutArtifactPath(absolutePath) {
   for (let attempt = 0; attempt < 3; attempt += 1) {
     try {
-      const stats = await stat11(absolutePath);
+      const stats = await stat10(absolutePath);
       return { exists: true, sizeBytes: stats.size };
     } catch {
       if (attempt < 2) {
@@ -19180,12 +19445,12 @@ var init_timeout_diagnostics = __esm({
 
 // dist/extensions/agent-browser/lib/executable-path.js
 import { constants as fsConstants2 } from "node:fs";
-import { access as access3, stat as stat12 } from "node:fs/promises";
+import { access as access3, stat as stat11 } from "node:fs/promises";
 import { delimiter, join as join26 } from "node:path";
 async function isExecutableFile2(candidate) {
   try {
     await access3(candidate, fsConstants2.X_OK);
-    return (await stat12(candidate)).isFile();
+    return (await stat11(candidate)).isFile();
   } catch {
     return false;
   }
@@ -19208,8 +19473,8 @@ var init_executable_path = __esm({
 
 // dist/extensions/agent-browser/lib/orchestration/browser-run/electron-observation.js
 import { setTimeout as sleepMs2 } from "node:timers/promises";
-function boundedSessionResult(data, field, limit) {
-  return boundElectronProbeString(extractStringResultField2(data, "result") ?? extractStringResultField2(data, field), limit);
+function sessionResult(data, field) {
+  return extractStringResultField2(data, "result") ?? extractStringResultField2(data, field);
 }
 async function collectManagedSessionCommandData(options) {
   try {
@@ -19220,7 +19485,7 @@ async function collectManagedSessionCommandData(options) {
 }
 async function collectElectronManagedSessionUrl(options) {
   const urlResult = await collectManagedSessionCommandData({ ...options, args: ["get", "url"] });
-  const url = boundElectronProbeString(extractStringResultField2(urlResult.data, "result") ?? extractStringResultField2(urlResult.data, "url"), 300);
+  const url = sessionResult(urlResult.data, "url");
   return urlResult.error !== void 0 && urlResult.error !== "" ? { error: urlResult.error } : { url };
 }
 async function collectElectronManagedSessionTarget(options) {
@@ -19229,8 +19494,8 @@ async function collectElectronManagedSessionTarget(options) {
   }
   const request = { ...options, sessionName: options.sessionName };
   const urlResult = await collectManagedSessionCommandData({ ...request, args: ["get", "url"] });
-  const url = boundedSessionResult(urlResult.data, "url", 300);
-  if ((urlResult.error ?? "") !== "" || url === void 0 || url === "") {
+  const url = sessionResult(urlResult.data, "url");
+  if ((urlResult.error ?? "") !== "" || url === void 0 || url.trim() === "") {
     return {
       error: urlResult.error ?? "get url returned no active page URL.",
       sessionName: options.sessionName
@@ -19240,7 +19505,7 @@ async function collectElectronManagedSessionTarget(options) {
     ...request,
     args: ["get", "title"]
   });
-  const title = boundedSessionResult(titleResult.data, "title", 160);
+  const title = boundElectronProbeString(sessionResult(titleResult.data, "title"), 160);
   return {
     sessionName: options.sessionName,
     title,
@@ -19260,12 +19525,13 @@ async function collectQaAttachedTarget(options) {
       url: target.url
     };
   }
-  return collectElectronManagedSessionTarget({
+  const observed = await collectElectronManagedSessionTarget({
     cwd: options.cwd,
     namespace: options.namespace,
     sessionName: options.sessionName,
     signal: options.signal
   });
+  return observed ? presentElectronManagedSessionTarget(observed) : void 0;
 }
 function formatQaAttachedTargetText(target) {
   return target ? ["QA attached target:", target.sessionName, target.title, target.url].filter((part) => typeof part === "string" && part.length > 0).join(" \u2014 ") : void 0;
@@ -19394,11 +19660,12 @@ var init_electron_observation = __esm({
     init_session_page_state();
     init_session_state();
     init_diagnostic_values();
+    init_final_result_electron();
   }
 });
 
 // dist/extensions/agent-browser/lib/orchestration/browser-run/diagnostics.js
-import { stat as stat13 } from "node:fs/promises";
+import { stat as stat12 } from "node:fs/promises";
 import { setTimeout as sleepMs3 } from "node:timers/promises";
 import { isAbsolute as isAbsolute9, resolve as resolve12 } from "node:path";
 function comparePriorNavigationUrl(priorUrl, url) {
@@ -19541,7 +19808,7 @@ async function collectExistingExplicitArtifactPaths(entries, cwd) {
     }
     const absolutePath = entry.absolutePath ?? (isAbsolute9(entry.path) ? entry.path : resolve12(cwd, entry.path));
     try {
-      await stat13(absolutePath);
+      await stat12(absolutePath);
     } catch {
       continue;
     }
@@ -20312,6 +20579,7 @@ function statusNextActions(options) {
 }
 function buildElectronStatusResult(options) {
   const nextActions = statusNextActions(options);
+  const managedSessions = options.managedSessions.map(presentElectronManagedSessionTarget);
   const soleRecord = options.records.length === 1 ? options.records[0] : void 0;
   const details = {
     args: [],
@@ -20321,8 +20589,8 @@ function buildElectronStatusResult(options) {
       identifierList: options.records.length > 1 ? options.records.map(buildElectronIdentifiers) : void 0,
       identifiers: soleRecord ? buildElectronIdentifiers(soleRecord) : void 0,
       launches: options.records,
-      managedSession: options.managedSessions.length === 1 ? options.managedSessions[0] : void 0,
-      managedSessions: options.managedSessions.length > 0 ? options.managedSessions : void 0,
+      managedSession: managedSessions.length === 1 ? managedSessions[0] : void 0,
+      managedSessions: managedSessions.length > 0 ? managedSessions : void 0,
       sessionMismatch: options.mismatches.length === 1 ? options.mismatches[0] : void 0,
       sessionMismatches: options.mismatches.length > 1 ? options.mismatches : void 0,
       status: "succeeded",
@@ -20405,6 +20673,7 @@ var init_status = __esm({
     init_session_state();
     init_branch();
     init_policy();
+    init_final_result_electron();
   }
 });
 
@@ -20459,7 +20728,7 @@ function extractElectronProbeTabs(data) {
     tabId: getTrimmedString(tab.tabId) ?? getTrimmedString(tab.id),
     title: getTrimmedString(tab.title) ?? getTrimmedString(tab.label),
     type: getTrimmedString(tab.type),
-    url: getTrimmedString(tab.url)
+    url: typeof tab.url === "string" ? tab.url : void 0
   }));
   if (allTabs.length === 0) {
     return {};
@@ -20521,7 +20790,7 @@ function summarizeElectronProbeSnapshot(data) {
 function getElectronProbeSummary(probe) {
   const parts = [
     probe.title !== void 0 && probe.title.length > 0 ? `title "${probe.title}"` : void 0,
-    probe.url !== void 0 && probe.url.length > 0 ? `url ${probe.url}` : void 0,
+    probe.url !== void 0 && probe.url.length > 0 ? `url ${boundElectronProbeString(probe.url, 300) ?? ""}` : void 0,
     probe.focusedElement ? "focused element" : void 0,
     probe.tabs ? `${probe.tabs.total} tab(s)` : void 0,
     probe.snapshot ? `${probe.snapshot.refCount} ref(s)` : void 0
@@ -20588,17 +20857,14 @@ async function runElectronProbeCommandData(options) {
 function probeCommandError(result, label) {
   return result.error !== void 0 && result.error.length > 0 ? `${label}: ${result.error}` : void 0;
 }
-function probeString(data, field, limit) {
-  return boundElectronProbeString(extractStringResultField2(data, "result") ?? extractStringResultField2(data, field), limit);
-}
 async function collectElectronProbe(options) {
   const urlResult = await runElectronProbeCommandData({ ...options, args: ["get", "url"] });
   const urlError = probeCommandError(urlResult, "get url");
   if (urlError !== void 0) {
     throw new Error(urlError);
   }
-  const url = probeString(urlResult.data, "url", 300);
-  if (url === void 0 || url.length === 0) {
+  const url = extractStringResultField2(urlResult.data, "result") ?? extractStringResultField2(urlResult.data, "url");
+  if (url === void 0 || url.trim().length === 0) {
     throw new Error("get url returned no active page URL.");
   }
   const titleResult = await runElectronProbeCommandData({ ...options, args: ["get", "title"] });
@@ -20629,7 +20895,7 @@ async function collectElectronProbe(options) {
     snapshot,
     status: errors.length === 0 ? "succeeded" : "partial",
     tabs,
-    title: probeString(titleResult.data, "title", 160),
+    title: boundElectronProbeString(extractStringResultField2(titleResult.data, "result") ?? extractStringResultField2(titleResult.data, "title"), 160),
     url
   };
   return { ...probe, summary: getElectronProbeSummary(probe) };
@@ -20645,6 +20911,17 @@ var init_probe_collection = __esm({
 });
 
 // dist/extensions/agent-browser/lib/orchestration/electron-host/probe-presentation.js
+function presentProbeTab(tab) {
+  return { ...tab, url: boundElectronProbeString(tab.url) };
+}
+function presentProbe(probe) {
+  return {
+    ...probe,
+    activeTab: probe.activeTab ? presentProbeTab(probe.activeTab) : void 0,
+    tabs: probe.tabs ? { ...probe.tabs, shown: probe.tabs.shown.map(presentProbeTab) } : void 0,
+    url: boundElectronProbeString(probe.url, 300)
+  };
+}
 function presentStrings(values) {
   return values.filter((value) => value !== void 0 && value.length > 0);
 }
@@ -20757,7 +21034,8 @@ function probeNextActions(options) {
   return options.mismatch ? appendUniqueAgentBrowserNextActions([...mismatch], base) : appendUniqueAgentBrowserNextActions([...base], mismatch);
 }
 function buildElectronProbeResult(options) {
-  const { refSnapshot: _refSnapshot, ...boundedProbe } = options.probe;
+  const probe = presentProbe(options.probe);
+  const { refSnapshot: _refSnapshot, ...boundedProbe } = probe;
   const nextActions = probeNextActions(options);
   const details = {
     args: [],
@@ -20784,7 +21062,12 @@ function buildElectronProbeResult(options) {
     usedImplicitSession: options.probeContext.mode === "current-managed-session"
   };
   return {
-    content: [{ type: "text", text: redactSensitiveText(formatElectronProbeVisibleText(options)) }],
+    content: [
+      {
+        type: "text",
+        text: redactSensitiveText(formatElectronProbeVisibleText({ ...options, probe }))
+      }
+    ],
     details: redactToolDetails(details, []),
     isError: false
   };
@@ -20792,6 +21075,7 @@ function buildElectronProbeResult(options) {
 var init_probe_presentation = __esm({
   "dist/extensions/agent-browser/lib/orchestration/electron-host/probe-presentation.js"() {
     "use strict";
+    init_cdp();
     init_action_recommendations();
     init_categories();
     init_next_actions();
@@ -20967,253 +21251,6 @@ var init_probe = __esm({
   }
 });
 
-// dist/extensions/agent-browser/lib/results/presentation/diagnostic-storage.js
-function storageTextContainsSecret(text3) {
-  if (STORAGE_TOKEN_VALUE_PATTERN.test(text3) || STORAGE_SECRET_VALUE_WORD_PATTERN.test(text3) || STORAGE_EMAIL_VALUE_PATTERN.test(text3) || STORAGE_IDENTITY_VALUE_PATTERN.test(text3)) {
-    return true;
-  }
-  if (storageTextIsSensitiveUrl(text3) || redactSensitiveText(text3) !== text3) {
-    return true;
-  }
-  try {
-    const parsed = JSON.parse(text3);
-    return valueContainsStorageSecret(parsed);
-  } catch {
-    return false;
-  }
-}
-function storageTextIsSensitiveUrl(text3) {
-  try {
-    const url = new URL(text3);
-    return url.protocol === "http:" || url.protocol === "https:" || url.username.length > 0 || url.password.length > 0 || url.search.length > 0;
-  } catch {
-    return false;
-  }
-}
-function valueContainsStorageSecret(value) {
-  if (typeof value === "string") {
-    const trimmed = value.trim();
-    return trimmed.length > 0 && storageTextContainsSecret(trimmed);
-  }
-  if (Array.isArray(value)) {
-    return value.some((item) => valueContainsStorageSecret(item));
-  }
-  if (!isRecord(value)) {
-    return false;
-  }
-  return Object.entries(value).some(([key, entryValue]) => STORAGE_SECRET_KEY_PATTERN.test(key) || valueContainsStorageSecret(entryValue));
-}
-function shouldRevealStorageValue(key, value) {
-  if (key === void 0 || key.length === 0 || STORAGE_SECRET_KEY_PATTERN.test(key) || !STORAGE_BENIGN_KEY_PATTERN.test(key)) {
-    return false;
-  }
-  if (valueContainsStorageSecret(value)) {
-    return false;
-  }
-  if (typeof value === "string") {
-    return value.length <= STORAGE_VALUE_PREVIEW_MAX_CHARS;
-  }
-  return value === null || typeof value === "number" || typeof value === "boolean";
-}
-function formatStorageValue(key, value) {
-  if (!shouldRevealStorageValue(key, value)) {
-    return "[REDACTED]";
-  }
-  return typeof value === "string" ? redactModelFacingText(value) : stringifyModelFacing(value);
-}
-function storageRedactionReason(key) {
-  return key !== void 0 && key.length > 0 && STORAGE_SECRET_KEY_PATTERN.test(key) ? "sensitive-key" : "sensitive-value";
-}
-function redactStorageEntryValue(item) {
-  const key = getStringField(item, "key") ?? getStringField(item, "name");
-  if (!Object.hasOwn(item, "value") || shouldRevealStorageValue(key, item.value)) {
-    return redactSensitiveValue(item);
-  }
-  const redacted = redactSensitiveValue({ ...item, value: void 0 });
-  if (!isRecord(redacted)) {
-    throw new Error("Storage record redaction did not return a record");
-  }
-  return {
-    ...redacted,
-    value: "[REDACTED]",
-    valueRedacted: true,
-    valueRedactionReason: storageRedactionReason(key)
-  };
-}
-function redactStorageField(owner, key, value) {
-  if (key === "data" && isRecord(value)) {
-    return Object.fromEntries(Object.entries(value).map(([storageKey, storageValue]) => [
-      storageKey,
-      shouldRevealStorageValue(storageKey, storageValue) ? redactSensitiveValue(storageValue) : "[REDACTED]"
-    ]));
-  }
-  if ((key === "entries" || key === "items") && Array.isArray(value)) {
-    return value.map((item) => isRecord(item) ? redactStorageEntryValue(item) : redactSensitiveValue(item));
-  }
-  if (key === "value") {
-    const itemKey = getStringField(owner, "key") ?? getStringField(owner, "name");
-    return shouldRevealStorageValue(itemKey, value) ? redactSensitiveValue(value) : "[REDACTED]";
-  }
-  return redactSensitiveValue(value);
-}
-function redactStorageData(value) {
-  if (Array.isArray(value)) {
-    return value.map((item) => redactStorageData(item));
-  }
-  if (!isRecord(value)) {
-    return redactSensitiveValue(value);
-  }
-  const entries = Object.fromEntries(Object.entries(value).map(([key2, entryValue]) => [
-    key2,
-    redactStorageField(value, key2, entryValue)
-  ]));
-  const key = getStringField(value, "key") ?? getStringField(value, "name");
-  if (Object.hasOwn(value, "value") && !shouldRevealStorageValue(key, value.value)) {
-    entries.valueRedacted = true;
-    entries.valueRedactionReason = storageRedactionReason(key);
-  }
-  return entries;
-}
-function formatStorageEntry(item, index) {
-  if (!isRecord(item)) {
-    return `${index + 1}. [REDACTED]`;
-  }
-  const rawKey = getStringField(item, "key") ?? getStringField(item, "name") ?? `(entry ${index + 1})`;
-  const key = redactModelFacingText(rawKey);
-  return Object.hasOwn(item, "value") ? `${key}: ${formatStorageValue(rawKey, item.value)}` : key;
-}
-function formatStorageMutationText(data, type) {
-  const key = getStringField(data, "key");
-  if (key !== void 0 && Object.hasOwn(data, "value")) {
-    return `${type} ${redactModelFacingText(key)}: ${formatStorageValue(key, data.value)}`;
-  }
-  if (key !== void 0 && data.set === true) {
-    return `${type} set: ${redactModelFacingText(key)}`;
-  }
-  return data.cleared === true || data.clear === true ? `${type} cleared.` : void 0;
-}
-function formatStorageText(data) {
-  const type = getStringField(data, "type") ?? getStringField(data, "storage") ?? "storage";
-  if (isRecord(data.data)) {
-    const text3 = Object.entries(data.data).map(([key, value]) => `${redactModelFacingText(key)}: ${formatStorageValue(key, value)}`).join("\n");
-    return text3.length > 0 ? text3 : `${type}: no entries.`;
-  }
-  const entries = getArrayField(data, "entries") ?? getArrayField(data, "items");
-  if (entries) {
-    return entries.length === 0 ? `${type}: no entries.` : entries.map(formatStorageEntry).join("\n");
-  }
-  return formatStorageMutationText(data, type);
-}
-function formatCookieRecordText(item, fallbackName) {
-  const name = redactModelFacingText(getStringField(item, "name") ?? fallbackName);
-  const domain = getStringField(item, "domain");
-  const path = getStringField(item, "path");
-  const flags = [
-    item.httpOnly === true ? "httpOnly" : void 0,
-    item.secure === true ? "secure" : void 0
-  ].filter(Boolean).join(", ");
-  const location = [domain, path].filter(Boolean).join("");
-  return [
-    name,
-    location.length > 0 ? `(${redactModelFacingText(location)})` : void 0,
-    flags.length > 0 ? `[${flags}]` : void 0
-  ].filter(Boolean).join(" ");
-}
-function formatCookiesText(data) {
-  const cookies = getArrayField(data, "cookies");
-  if (cookies) {
-    return cookies.length === 0 ? "No cookies." : cookies.map((item, index) => isRecord(item) ? formatCookieRecordText(item, `(cookie ${index + 1})`) : `${index + 1}. [REDACTED]`).join("\n");
-  }
-  if (getStringField(data, "name") !== void 0 || getStringField(data, "domain") !== void 0 || getStringField(data, "path") !== void 0 || Object.hasOwn(data, "value")) {
-    return formatCookieRecordText(data, "cookie");
-  }
-  if (data.set === true) {
-    return "Cookie set.";
-  }
-  return data.cleared === true || data.clear === true ? "Cookies cleared." : void 0;
-}
-var STORAGE_VALUE_PREVIEW_MAX_CHARS, STORAGE_SECRET_KEY_PATTERN, STORAGE_BENIGN_KEY_PATTERN, STORAGE_TOKEN_VALUE_PATTERN, STORAGE_SECRET_VALUE_WORD_PATTERN, STORAGE_EMAIL_VALUE_PATTERN, STORAGE_IDENTITY_VALUE_PATTERN;
-var init_diagnostic_storage = __esm({
-  "dist/extensions/agent-browser/lib/results/presentation/diagnostic-storage.js"() {
-    "use strict";
-    init_parsing();
-    init_runtime();
-    init_common();
-    STORAGE_VALUE_PREVIEW_MAX_CHARS = 160;
-    STORAGE_SECRET_KEY_PATTERN = /(?:access(?:_|-)?token|account|api(?:_|-)?key|auth(?:orization)?|bearer|client(?:_|-)?secret|cookie|credential|csrf|email|id(?:_|-)?token|jwt|pass(?:word)?|private(?:_|-)?key|profile|refresh(?:_|-)?token|secret|session|sid|sig(?:nature)?|token|user(?:name)?|x(?:_|-)?api(?:_|-)?key|xsrf)/i;
-    STORAGE_BENIGN_KEY_PATTERN = /^(?:color(?:scheme)?|debug|dev|experiment|feature(?:flag)?|flag|language|layout|locale|mode|onboarding|sort|tab|theme|timezone|tour|variant|view)$/i;
-    STORAGE_TOKEN_VALUE_PATTERN = /(?:\bBearer\s+[A-Za-z0-9._~-]+|\bBasic\s+[A-Za-z0-9+/=]+|^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$|(?=.*[A-Za-z])(?=.*\d)[A-Za-z0-9_~+/=-]{32,})/;
-    STORAGE_SECRET_VALUE_WORD_PATTERN = /(?:secret|token|password|passwd|bearer|credential|authorization|cookie|session[-_ ]?id)/i;
-    STORAGE_EMAIL_VALUE_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-    STORAGE_IDENTITY_VALUE_PATTERN = /(?:^|[\s:=/_-])(?:account|profile|session|sid|user(?:id|name)?)(?:[\s:=/_-]|$)/i;
-  }
-});
-
-// dist/extensions/agent-browser/lib/results/presentation/diagnostic-redaction.js
-function redactStatefulValues(value) {
-  if (Array.isArray(value)) {
-    return value.map((item) => redactStatefulValues(item));
-  }
-  if (!isRecord(value)) {
-    return redactSensitiveValue(value);
-  }
-  return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => [
-    key,
-    key.toLowerCase() === "value" ? "[REDACTED]" : redactStatefulValues(entryValue)
-  ]));
-}
-function storageTextKey(command) {
-  const operation = command.commandTokens?.[2];
-  if (operation === "get") {
-    return command.commandTokens?.[3];
-  }
-  return operation === "set" || operation === "clear" ? void 0 : operation;
-}
-function redactStorageText(command, text3) {
-  const key = storageTextKey(command);
-  if (key !== void 0 && text3.startsWith(`${key}: `)) {
-    const suffix = text3.endsWith("\n") ? "\n" : "";
-    const value = text3.slice(key.length + 2, suffix.length > 0 ? -1 : void 0);
-    return `${key}: ${formatStorageValue(key, value)}${suffix}`;
-  }
-  return text3.replace(/^([^\r\n]*?): ([^\r\n]*)/gm, (_line, entryKey, value) => `${entryKey}: ${formatStorageValue(entryKey, value)}`);
-}
-function redactNativeContextText(command, text3, stdin) {
-  if (command.command === "batch") {
-    const steps = getUpstreamEffectiveBatchSteps(command.commandTokens ?? ["batch"], stdin);
-    const cookieRedacted = steps.some((step) => step[0] === "cookies") ? redactNativeContextText({ command: "cookies" }, text3) : text3;
-    return steps.some((step) => step[0] === "storage") ? redactNativeContextText({ command: "storage" }, cookieRedacted) : cookieRedacted;
-  }
-  if (command.command === "cookies") {
-    return text3.replace(/^([^=\r\n]*)=([^\r\n]*)/gm, "$1=[REDACTED]");
-  }
-  return command.command === "storage" ? redactStorageText(command, text3) : text3;
-}
-function redactPresentationData(command, data, stdin) {
-  if (typeof data === "string") {
-    return redactSensitiveText(redactNativeContextText(command, data, stdin));
-  }
-  if (command.command === "cookies") {
-    return redactStatefulValues(data);
-  }
-  if (command.command === "storage") {
-    return redactStorageData(data);
-  }
-  if (command.command === "state" && command.subcommand === "show") {
-    return redactStatefulValues(data);
-  }
-  return redactSensitiveValue(data);
-}
-var init_diagnostic_redaction = __esm({
-  "dist/extensions/agent-browser/lib/results/presentation/diagnostic-redaction.js"() {
-    "use strict";
-    init_parsing();
-    init_batch_stdin();
-    init_runtime();
-    init_diagnostic_storage();
-  }
-});
-
 // dist/extensions/agent-browser/lib/orchestration/browser-run/screenshot-capture.js
 function getScreenshotCapture(command) {
   if (command[0] !== "screenshot") {
@@ -22904,11 +22941,11 @@ var init_batch_step = __esm({
 });
 
 // dist/extensions/agent-browser/lib/results/presentation/batch-recording.js
-import { stat as stat16 } from "node:fs/promises";
+import { stat as stat15 } from "node:fs/promises";
 async function unverifiedRecordingArtifact(artifact, subcommand) {
   const { recordingState: _recordingState, willExistOnStop: _willExistOnStop, ...terminal } = artifact;
   try {
-    const file = await stat16(artifact.absolutePath);
+    const file = await stat15(artifact.absolutePath);
     return {
       ...terminal,
       exists: file.isFile(),
@@ -24712,6 +24749,7 @@ var init_skills = __esm({
     SkillShellWords = class {
       words = [];
       current = "";
+      wordStarted = false;
       quote;
       index = 0;
       input;
@@ -24719,9 +24757,10 @@ var init_skills = __esm({
         this.input = input;
       }
       flush() {
-        if (this.current.length > 0) {
+        if (this.wordStarted) {
           this.words.push(this.current);
           this.current = "";
+          this.wordStarted = false;
         }
       }
       appendEscape() {
@@ -24744,14 +24783,17 @@ var init_skills = __esm({
       }
       consumeUnquoted(char) {
         if (char === "'" || char === '"') {
+          this.wordStarted = true;
           this.quote = char === "'" ? "single" : "double";
         } else if (char === "\\") {
+          this.wordStarted = true;
           this.appendEscape();
-        } else if (char === "#" && this.current.length === 0) {
+        } else if (char === "#" && !this.wordStarted) {
           return false;
         } else if (/\s/.test(char)) {
           this.flush();
         } else {
+          this.wordStarted = true;
           this.current += char;
         }
         return true;
@@ -26048,7 +26090,7 @@ function launchFailureMessage(reason, target, detail) {
     case "aborted":
       return `Electron launch was aborted${target ? ` before ${label} finished starting` : " before the app started"}.`;
     case "non-electron-target":
-      return `Electron launch rejected: ${label} does not have Electron framework evidence.`;
+      return `Electron launch rejected: ${label} does not have the required Electron runtime and app payload evidence.`;
     case "policy-blocked":
       return detail ?? `Electron launch blocked by caller policy for ${label}.`;
     case "single-instance-conflict":
@@ -26138,6 +26180,7 @@ var init_launch = __esm({
     init_discovery();
     init_temp();
     init_text();
+    init_process_identity();
     init_launch_monitor();
     init_launch_process();
     init_launch_types();
@@ -26154,6 +26197,7 @@ var init_launch = __esm({
       timeoutMs;
       deadlineMs;
       appArgs;
+      startIdentity;
       constructor(options, target, userDataDir, timing) {
         this.options = options;
         this.target = target;
@@ -26228,6 +26272,7 @@ var init_launch = __esm({
           platform: this.target.platform,
           port,
           processGroupId: process.platform === "win32" ? void 0 : pid,
+          startIdentity: this.startIdentity,
           targetType: this.options.targetType,
           userDataDir: this.userDataDir,
           version: ELECTRON_LAUNCH_RECORD_VERSION,
@@ -26245,6 +26290,11 @@ var init_launch = __esm({
         if (this.process.child === void 0) {
           return this.fail(isElectronLaunchAborted(this.options.signal) ? "aborted" : "spawn-error", this.process.spawnError?.message);
         }
+        const pid = this.process.child.pid;
+        this.startIdentity = pid === void 0 ? void 0 : await readProcessStartIdentity(pid, process.platform, {
+          deadline: this.deadlineMs,
+          signal: this.options.signal
+        });
         const portResult = await pollDevToolsActivePort({
           deadlineMs: this.deadlineMs,
           getChildExit: this.process.childExit,
@@ -28020,6 +28070,13 @@ async function collectSnapshotEvidence(options, request) {
   const fullSnapshot = extractRefSnapshotFromData(snapshotData);
   const diff = request.diff ? buildSnapshotDiff(options.previousRefSnapshot, fullSnapshot) : void 0;
   if (fullSnapshot) {
+    if (fullSnapshot.target) {
+      options.sessionPageState.applyTabTarget({
+        sessionName: options.sessionStateKey ?? options.sessionName,
+        target: fullSnapshot.target,
+        update: options.sessionPageStateUpdate
+      });
+    }
     options.sessionPageState.applyRefSnapshot({
       sessionName: options.sessionStateKey ?? options.sessionName,
       snapshot: fullSnapshot,
@@ -28092,6 +28149,7 @@ function snapshotToolResult(options, request, evidence, presentation) {
       fullOutputPaths: presentation.fullOutputPaths,
       refSnapshot: evidence.fullSnapshot,
       sessionMode: options.sessionMode,
+      sessionTabTarget: options.sessionPageState.get(options.sessionStateKey ?? options.sessionName).tabTarget,
       snapshotDiff: evidence.diff,
       snapshotFilter: snapshotFilterDetails(request, evidence),
       snapshotViewport: evidence.viewport,
@@ -28332,7 +28390,7 @@ var init_network_page_filter = __esm({
 
 // dist/extensions/agent-browser/lib/orchestration/browser-run/prepare/scroll-shims.js
 function getContainerScrollRequest(commandTokens) {
-  if (commandTokens[0] !== "scroll" || commandTokens.length < 3) {
+  if (commandTokens[0] !== "scroll" || commandTokens.length < 3 || commandTokens.length > 4) {
     return void 0;
   }
   const selector = commandTokens[1];
@@ -28456,7 +28514,7 @@ function getPageScrollToRequest(commandTokens) {
     return void 0;
   }
   if (commandTokens[1]?.toLowerCase() === "to") {
-    return getPageScrollTarget(commandTokens.at(2));
+    return commandTokens.length === 3 ? getPageScrollTarget(commandTokens.at(2)) : void 0;
   }
   const direction = commandTokens[1]?.toLowerCase();
   if (!isPageScrollDirection(direction) || commandTokens.length > 3) {
@@ -33164,7 +33222,7 @@ var KeyedAsyncExecutionQueue = class {
   async run(key, namespace, work, signal) {
     const entry = this.entries.get(key) ?? { queue: new AsyncExecutionQueue(), users: 0 };
     if (entry.queue.isCurrent()) {
-      return work();
+      return entry.queue.run(work, signal);
     }
     const barrier = this.barriers.get(getAgentBrowserSessionIdentityKey("", namespace)) ?? Promise.resolve();
     entry.users += 1;
@@ -34331,133 +34389,133 @@ function StringEnum(values, options) {
 init_discovery_types();
 init_types();
 var AGENT_BROWSER_ADVANCED_TOOLS = ["action", "qa", "electron", "source", "network"];
-function outputProperties(Type) {
+function outputProperties() {
   return {
-    outputPath: Type.Optional(Type.String({
+    outputPath: JsonSchema.Optional(JsonSchema.String({
       description: "Result-data path, separate from browser artifact paths.",
       minLength: 1
     })),
-    timeoutMs: Type.Optional(Type.Integer({ description: "Timeout in ms; exceed explicit waits.", minimum: 1 }))
+    timeoutMs: JsonSchema.Optional(JsonSchema.Integer({ description: "Timeout in ms; exceed explicit waits.", minimum: 1 }))
   };
 }
-function sessionModeProperty(Type, StringEnum2) {
-  return Type.Optional(StringEnum2(["auto", "fresh"], {
+function sessionModeProperty() {
+  return JsonSchema.Optional(StringEnum(["auto", "fresh"], {
     description: "Native configured sessions win; auto reuses the browser, fresh intentionally launches a separate managed browser.",
     default: DEFAULT_SESSION_MODE
   }));
 }
-function createAgentBrowserParamsSchema(Type = JsonSchema, StringEnum2 = StringEnum) {
-  return Type.Unsafe(Type.Object({
-    args: Type.Array(Type.String(), {
+function createAgentBrowserParamsSchema() {
+  return JsonSchema.Unsafe(JsonSchema.Object({
+    args: JsonSchema.Array(JsonSchema.String(), {
       description: "Native agent-browser argv without the binary or shell syntax. Fixed sequences: batch --bail with JSON-array stdin.",
       minItems: 1
     }),
-    stdin: Type.Optional(Type.String({
+    stdin: JsonSchema.Optional(JsonSchema.String({
       description: "Native batch JSON, eval --stdin source, or auth save --password-stdin text."
     })),
-    ...outputProperties(Type),
-    sessionMode: sessionModeProperty(Type, StringEnum2)
+    ...outputProperties(),
+    sessionMode: sessionModeProperty()
   }, { additionalProperties: false }));
 }
-function createAgentBrowserCodeParamsSchema(Type = JsonSchema) {
-  return Type.Unsafe(Type.Object({
-    code: Type.String({
+function createAgentBrowserCodeParamsSchema() {
+  return JsonSchema.Unsafe(JsonSchema.Object({
+    code: JsonSchema.String({
       description: "JavaScript with await browser({args, stdin?, timeoutMs?}), emit(JSON), and emitImage(image handle). Fresh JS context; persistent browser.",
       minLength: 1,
       maxLength: 65536
     }),
-    session: Type.Optional(Type.String({
+    session: JsonSchema.Optional(JsonSchema.String({
       description: "Explicit native session; omitted uses the ordinary default browser.",
       minLength: 1
     })),
-    namespace: Type.Optional(Type.String({
+    namespace: JsonSchema.Optional(JsonSchema.String({
       description: "Native namespace; empty string selects the default namespace."
     })),
-    ...outputProperties(Type),
-    timeoutMs: Type.Optional(Type.Integer({ minimum: 1, maximum: AGENT_BROWSER_CODE_MAX_TIMEOUT_MS }))
+    ...outputProperties(),
+    timeoutMs: JsonSchema.Optional(JsonSchema.Integer({ minimum: 1, maximum: AGENT_BROWSER_CODE_MAX_TIMEOUT_MS }))
   }, { additionalProperties: false }));
 }
-function createAgentBrowserActionParamsSchema(Type = JsonSchema, StringEnum2 = StringEnum) {
-  return Type.Unsafe(Type.Object({
-    action: StringEnum2(AGENT_BROWSER_SEMANTIC_ACTIONS),
-    locator: Type.Optional(StringEnum2(AGENT_BROWSER_SEMANTIC_LOCATORS, {
+function createAgentBrowserActionParamsSchema() {
+  return JsonSchema.Unsafe(JsonSchema.Object({
+    action: StringEnum(AGENT_BROWSER_SEMANTIC_ACTIONS),
+    locator: JsonSchema.Optional(StringEnum(AGENT_BROWSER_SEMANTIC_LOCATORS, {
       description: "Select supports role or label."
     })),
-    value: Type.Optional(Type.String({
+    value: JsonSchema.Optional(JsonSchema.String({
       description: "Locator value or select option; label text for select by label."
     })),
-    values: Type.Optional(Type.Array(Type.String(), {
+    values: JsonSchema.Optional(JsonSchema.Array(JsonSchema.String(), {
       description: "Select options; required for select by label.",
       minItems: 1
     })),
-    selector: Type.Optional(Type.String({ description: "Direct selector or current @ref." })),
-    text: Type.Optional(Type.String({ description: "Fill text." })),
-    role: Type.Optional(Type.String({ description: "Role locator; select needs combobox or listbox." })),
-    name: Type.Optional(Type.String({ description: "Accessible name." })),
-    session: Type.Optional(Type.String({ description: "Upstream session name." })),
-    ...outputProperties(Type)
+    selector: JsonSchema.Optional(JsonSchema.String({ description: "Direct selector or current @ref." })),
+    text: JsonSchema.Optional(JsonSchema.String({ description: "Fill text." })),
+    role: JsonSchema.Optional(JsonSchema.String({ description: "Role locator; select needs combobox or listbox." })),
+    name: JsonSchema.Optional(JsonSchema.String({ description: "Accessible name." })),
+    session: JsonSchema.Optional(JsonSchema.String({ description: "Upstream session name." })),
+    ...outputProperties()
   }, {
     additionalProperties: false,
     // Top-level properties let Pi normalize optional nulls before validating branches.
     anyOf: [
-      Type.Object({
-        action: StringEnum2(["select"]),
-        locator: Type.Optional(StringEnum2(["role", "label"]))
+      JsonSchema.Object({
+        action: StringEnum(["select"]),
+        locator: JsonSchema.Optional(StringEnum(["role", "label"]))
       }, { not: { required: ["text"] } }),
-      Type.Object({ action: StringEnum2(["check", "click", "fill"]) }, { not: { required: ["values"] } })
+      JsonSchema.Object({ action: StringEnum(["check", "click", "fill"]) }, { not: { required: ["values"] } })
     ]
   }));
 }
-function createAgentBrowserQaParamsSchema(Type = JsonSchema, StringEnum2 = StringEnum) {
-  return Type.Unsafe(Type.Object({
-    url: Type.Optional(Type.String()),
-    attached: Type.Optional(Type.Boolean()),
-    expectedText: Type.Optional(Type.Union([Type.String(), Type.Array(Type.String())])),
-    expectedSelector: Type.Optional(Type.String()),
-    screenshotPath: Type.Optional(Type.String()),
-    checkConsole: Type.Optional(Type.Boolean()),
-    checkErrors: Type.Optional(Type.Boolean()),
-    checkNetwork: Type.Optional(Type.Boolean()),
-    loadState: Type.Optional(StringEnum2(AGENT_BROWSER_QA_LOAD_STATES)),
-    ...outputProperties(Type),
-    sessionMode: sessionModeProperty(Type, StringEnum2)
+function createAgentBrowserQaParamsSchema() {
+  return JsonSchema.Unsafe(JsonSchema.Object({
+    url: JsonSchema.Optional(JsonSchema.String()),
+    attached: JsonSchema.Optional(JsonSchema.Boolean()),
+    expectedText: JsonSchema.Optional(JsonSchema.Union([JsonSchema.String(), JsonSchema.Array(JsonSchema.String())])),
+    expectedSelector: JsonSchema.Optional(JsonSchema.String()),
+    screenshotPath: JsonSchema.Optional(JsonSchema.String()),
+    checkConsole: JsonSchema.Optional(JsonSchema.Boolean()),
+    checkErrors: JsonSchema.Optional(JsonSchema.Boolean()),
+    checkNetwork: JsonSchema.Optional(JsonSchema.Boolean()),
+    loadState: JsonSchema.Optional(StringEnum(AGENT_BROWSER_QA_LOAD_STATES)),
+    ...outputProperties(),
+    sessionMode: sessionModeProperty()
   }, {
     additionalProperties: false,
     anyOf: [
-      Type.Object({
-        attached: Type.Literal(true),
-        sessionMode: Type.Optional(StringEnum2(["auto"]))
+      JsonSchema.Object({
+        attached: JsonSchema.Literal(true),
+        sessionMode: JsonSchema.Optional(StringEnum(["auto"]))
       }, { not: { required: ["url"] } }),
-      Type.Object({ url: Type.String(), attached: Type.Optional(Type.Literal(false)) })
+      JsonSchema.Object({ url: JsonSchema.String(), attached: JsonSchema.Optional(JsonSchema.Literal(false)) })
     ]
   }));
 }
-function createAgentBrowserElectronParamsSchema(Type = JsonSchema, StringEnum2 = StringEnum) {
-  const common = { outputPath: outputProperties(Type).outputPath };
-  const timeoutMs = Type.Optional(Type.Integer({ minimum: 1 }));
+function createAgentBrowserElectronParamsSchema() {
+  const common = { outputPath: outputProperties().outputPath };
+  const timeoutMs = JsonSchema.Optional(JsonSchema.Integer({ minimum: 1 }));
   const list = {
-    query: Type.Optional(Type.String({ description: "Case-insensitive app filter.", minLength: 1 })),
-    maxResults: Type.Optional(Type.Integer({
+    query: JsonSchema.Optional(JsonSchema.String({ description: "Case-insensitive app filter.", minLength: 1 })),
+    maxResults: JsonSchema.Optional(JsonSchema.Integer({
       description: `Result cap; default ${ELECTRON_DISCOVERY_DEFAULT_MAX_RESULTS}, clamped to ${ELECTRON_DISCOVERY_MAX_RESULTS}.`,
       minimum: 1
     }))
   };
   const launch = {
-    appPath: Type.Optional(Type.String({ description: "macOS .app path.", minLength: 1 })),
-    appName: Type.Optional(Type.String({ description: "Name from agent_browser_electron list.", minLength: 1 })),
-    bundleId: Type.Optional(Type.String({ minLength: 1 })),
-    executablePath: Type.Optional(Type.String({ minLength: 1 })),
-    appArgs: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
-    handoff: Type.Optional(StringEnum2(AGENT_BROWSER_ELECTRON_HANDOFFS)),
-    targetType: Type.Optional(StringEnum2(AGENT_BROWSER_ELECTRON_TARGET_TYPES)),
+    appPath: JsonSchema.Optional(JsonSchema.String({ description: "macOS .app path.", minLength: 1 })),
+    appName: JsonSchema.Optional(JsonSchema.String({ description: "Name from agent_browser_electron list.", minLength: 1 })),
+    bundleId: JsonSchema.Optional(JsonSchema.String({ minLength: 1 })),
+    executablePath: JsonSchema.Optional(JsonSchema.String({ minLength: 1 })),
+    appArgs: JsonSchema.Optional(JsonSchema.Array(JsonSchema.String({ minLength: 1 }))),
+    handoff: JsonSchema.Optional(StringEnum(AGENT_BROWSER_ELECTRON_HANDOFFS)),
+    targetType: JsonSchema.Optional(StringEnum(AGENT_BROWSER_ELECTRON_TARGET_TYPES)),
     timeoutMs,
-    allow: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
-    deny: Type.Optional(Type.Array(Type.String({ minLength: 1 })))
+    allow: JsonSchema.Optional(JsonSchema.Array(JsonSchema.String({ minLength: 1 }))),
+    deny: JsonSchema.Optional(JsonSchema.Array(JsonSchema.String({ minLength: 1 })))
   };
-  const probe = { launchId: Type.Optional(Type.String({ minLength: 1 })), timeoutMs };
-  const lifecycle = { ...probe, all: Type.Optional(Type.Literal(true)) };
-  return Type.Unsafe(Type.Object({
-    action: StringEnum2(["list", "launch", "status", "cleanup", "probe"]),
+  const probe = { launchId: JsonSchema.Optional(JsonSchema.String({ minLength: 1 })), timeoutMs };
+  const lifecycle = { ...probe, all: JsonSchema.Optional(JsonSchema.Literal(true)) };
+  return JsonSchema.Unsafe(JsonSchema.Object({
+    action: StringEnum(["list", "launch", "status", "cleanup", "probe"]),
     ...list,
     ...launch,
     ...lifecycle,
@@ -34465,47 +34523,47 @@ function createAgentBrowserElectronParamsSchema(Type = JsonSchema, StringEnum2 =
   }, {
     additionalProperties: false,
     anyOf: [
-      Type.Object({ action: StringEnum2(["list"]), ...list, ...common }, { additionalProperties: false }),
-      Type.Object({ action: StringEnum2(["launch"]), ...launch, ...common }, { additionalProperties: false }),
-      Type.Object({ action: StringEnum2(["status", "cleanup"]), ...lifecycle, ...common }, { additionalProperties: false, not: { required: ["launchId", "all"] } }),
-      Type.Object({ action: StringEnum2(["probe"]), ...probe, ...common }, { additionalProperties: false })
+      JsonSchema.Object({ action: StringEnum(["list"]), ...list, ...common }, { additionalProperties: false }),
+      JsonSchema.Object({ action: StringEnum(["launch"]), ...launch, ...common }, { additionalProperties: false }),
+      JsonSchema.Object({ action: StringEnum(["status", "cleanup"]), ...lifecycle, ...common }, { additionalProperties: false, not: { required: ["launchId", "all"] } }),
+      JsonSchema.Object({ action: StringEnum(["probe"]), ...probe, ...common }, { additionalProperties: false })
     ]
   }));
 }
-function createAgentBrowserSourceParamsSchema(Type = JsonSchema, StringEnum2 = StringEnum) {
-  return Type.Unsafe(Type.Object({
-    selector: Type.Optional(Type.String({ description: "Visible selector or @ref." })),
-    reactFiberId: Type.Optional(Type.String({ description: "React fiber id; requires --enable react-devtools." })),
-    componentName: Type.Optional(Type.String({ description: "Component for local source search." })),
-    includeDomHints: Type.Optional(Type.Boolean({ description: "Inspect DOM hints; default true." })),
-    maxWorkspaceFiles: Type.Optional(Type.Integer({
+function createAgentBrowserSourceParamsSchema() {
+  return JsonSchema.Unsafe(JsonSchema.Object({
+    selector: JsonSchema.Optional(JsonSchema.String({ description: "Visible selector or @ref." })),
+    reactFiberId: JsonSchema.Optional(JsonSchema.String({ description: "React fiber id; requires --enable react-devtools." })),
+    componentName: JsonSchema.Optional(JsonSchema.String({ description: "Component for local source search." })),
+    includeDomHints: JsonSchema.Optional(JsonSchema.Boolean({ description: "Inspect DOM hints; default true." })),
+    maxWorkspaceFiles: JsonSchema.Optional(JsonSchema.Integer({
       description: "Source scan cap; default 2000.",
       minimum: 1,
       maximum: SOURCE_LOOKUP_MAX_WORKSPACE_FILES
     })),
-    ...outputProperties(Type),
-    sessionMode: sessionModeProperty(Type, StringEnum2)
+    ...outputProperties(),
+    sessionMode: sessionModeProperty()
   }, { additionalProperties: false }));
 }
-function createAgentBrowserNetworkSourceParamsSchema(Type = JsonSchema, StringEnum2 = StringEnum) {
-  return Type.Unsafe(Type.Object({
-    filter: Type.Optional(Type.String({ description: "Network request filter." })),
-    namespace: Type.Optional(Type.String()),
-    requestId: Type.Optional(Type.String({ description: "Request id to inspect." })),
-    session: Type.Optional(Type.String()),
-    url: Type.Optional(Type.String({ description: "Failed URL or fragment." })),
-    maxWorkspaceFiles: Type.Optional(Type.Integer({
+function createAgentBrowserNetworkSourceParamsSchema() {
+  return JsonSchema.Unsafe(JsonSchema.Object({
+    filter: JsonSchema.Optional(JsonSchema.String({ description: "Network request filter." })),
+    namespace: JsonSchema.Optional(JsonSchema.String()),
+    requestId: JsonSchema.Optional(JsonSchema.String({ description: "Request id to inspect." })),
+    session: JsonSchema.Optional(JsonSchema.String()),
+    url: JsonSchema.Optional(JsonSchema.String({ description: "Failed URL or fragment." })),
+    maxWorkspaceFiles: JsonSchema.Optional(JsonSchema.Integer({
       description: "Source scan cap; default 2000.",
       minimum: 1,
       maximum: SOURCE_LOOKUP_MAX_WORKSPACE_FILES
     })),
-    ...outputProperties(Type),
-    sessionMode: sessionModeProperty(Type, StringEnum2)
+    ...outputProperties(),
+    sessionMode: sessionModeProperty()
   }, { additionalProperties: false }));
 }
-function createAgentBrowserToolsParamsSchema(Type = JsonSchema, StringEnum2 = StringEnum) {
-  return Type.Unsafe(Type.Object({
-    enable: Type.Optional(Type.Array(StringEnum2(AGENT_BROWSER_ADVANCED_TOOLS), {
+function createAgentBrowserToolsParamsSchema() {
+  return JsonSchema.Unsafe(JsonSchema.Object({
+    enable: JsonSchema.Optional(JsonSchema.Array(StringEnum(AGENT_BROWSER_ADVANCED_TOOLS), {
       description: "Add capabilities to active tools; omit to list inventory."
     }))
   }, { additionalProperties: false }));
@@ -34934,15 +34992,24 @@ function validateAgentBrowserConfig(value, path, errors, warnings) {
     ...browser !== void 0 ? { browser } : {}
   };
 }
-function parseAgentBrowserConfigLayer(raw, path, scope, errors, warnings) {
-  let parsed;
+function parseAgentBrowserConfigJson(raw) {
   try {
-    parsed = JSON.parse(raw);
+    return { ok: true, value: JSON.parse(raw) };
   } catch (error) {
-    errors.push(`Could not parse ${scope} config ${path}: ${error instanceof Error ? error.message : describeUnknownError(error)}`);
+    const location = error instanceof Error ? error.message.match(/at position \d+(?: \(line \d+ column \d+\))?/)?.[0] : void 0;
+    return {
+      ok: false,
+      error: location === void 0 ? "Invalid JSON." : `Invalid JSON ${location}.`
+    };
+  }
+}
+function parseAgentBrowserConfigLayer(raw, path, scope, errors, warnings) {
+  const parsed = parseAgentBrowserConfigJson(raw);
+  if (!parsed.ok) {
+    errors.push(`Could not parse ${scope} config ${path}: ${parsed.error}`);
     return;
   }
-  const config = validateAgentBrowserConfig(parsed, path, errors, warnings);
+  const config = validateAgentBrowserConfig(parsed.value, path, errors, warnings);
   return config ? { config, path, scope } : void 0;
 }
 function describeUnknownError(value) {
@@ -35313,6 +35380,9 @@ async function resolvePreferredWebSearchCredential(state, options = {}) {
 
 // dist/extensions/agent-browser/lib/web-search.js
 init_runtime();
+init_parsing();
+init_content();
+init_diagnostic_redaction();
 
 // dist/extensions/agent-browser/lib/web-search-schema.js
 var DEFAULT_SEARCH_RESULT_COUNT = 5;
@@ -35328,67 +35398,67 @@ var EXA_SEARCH_CATEGORIES = [
 ];
 var MAX_EXA_DOMAIN_FILTERS = 20;
 var MAX_EXA_ADDITIONAL_QUERIES = 10;
-function createExaFilterProperties(Type, StringEnum2) {
+function createExaFilterProperties() {
   return {
-    includeDomains: Type.Optional(Type.Array(Type.String({ minLength: 1 }), {
+    includeDomains: JsonSchema.Optional(JsonSchema.Array(JsonSchema.String({ minLength: 1 }), {
       minItems: 1,
       maxItems: MAX_EXA_DOMAIN_FILTERS,
       description: `Exa only. Limit results to 1\u2013${MAX_EXA_DOMAIN_FILTERS} hostnames, path prefixes (exa.ai/docs), or wildcard subdomains (*.substack.com).`
     })),
-    excludeDomains: Type.Optional(Type.Array(Type.String({ minLength: 1 }), {
+    excludeDomains: JsonSchema.Optional(JsonSchema.Array(JsonSchema.String({ minLength: 1 }), {
       minItems: 1,
       maxItems: MAX_EXA_DOMAIN_FILTERS,
       description: `Exa only. Exclude 1\u2013${MAX_EXA_DOMAIN_FILTERS} hostnames, path prefixes, or wildcard subdomains. Not compatible with category company or people.`
     })),
-    category: Type.Optional(StringEnum2(EXA_SEARCH_CATEGORIES, {
+    category: JsonSchema.Optional(StringEnum(EXA_SEARCH_CATEGORIES, {
       description: "Exa-only result category. company and people cannot be combined with freshness or excludeDomains."
     })),
-    additionalQueries: Type.Optional(Type.Array(Type.String({ minLength: 1 }), {
+    additionalQueries: JsonSchema.Optional(JsonSchema.Array(JsonSchema.String({ minLength: 1 }), {
       minItems: 1,
       maxItems: MAX_EXA_ADDITIONAL_QUERIES,
       description: `Exa only. Add 1\u2013${MAX_EXA_ADDITIONAL_QUERIES} query variations when the effective searchType is deep-lite, deep, or deep-reasoning.`
     })),
-    highlightsDynamic: Type.Optional(Type.Boolean({
+    highlightsDynamic: JsonSchema.Optional(JsonSchema.Boolean({
       description: "Exa-only research preview. Allocate one highlight budget across all results; the wrapper sends the required Exa-Beta header. Regular per-page highlights remain the default."
     }))
   };
 }
-function createAgentBrowserWebSearchParamsSchema(Type = JsonSchema, StringEnum2 = StringEnum) {
-  return Type.Object({
-    query: Type.String({
+function createAgentBrowserWebSearchParamsSchema() {
+  return JsonSchema.Object({
+    query: JsonSchema.String({
       minLength: 1,
       description: "Search query to run with the configured Exa or Brave web search provider."
     }),
-    provider: Type.Optional(StringEnum2(WEB_SEARCH_PROVIDER_PARAM_VALUES, {
+    provider: JsonSchema.Optional(StringEnum(WEB_SEARCH_PROVIDER_PARAM_VALUES, {
       description: `Optional provider override. auto uses configured keys and preferredProvider; when both Exa and Brave are available, the default preferred provider is ${DEFAULT_WEB_SEARCH_PROVIDER}.`
     })),
-    searchType: Type.Optional(StringEnum2(EXA_SEARCH_TYPES, {
+    searchType: JsonSchema.Optional(StringEnum(EXA_SEARCH_TYPES, {
       description: "Exa mode; omitted uses webSearch.defaultSearchType, then auto. instant (~250ms) is only for trivial lookups; fast (~450ms) favors latency; auto (~1s) is balanced. Pass searchType: deep-lite (~4s) for research before implementation unless config already defaults it; do not assume auto is deep enough. deep (4\u201315s) handles hard multi-source research; deep-reasoning (12\u201340s) is only for the hardest work. Brave ignores this field."
     })),
-    ...createExaFilterProperties(Type, StringEnum2),
-    count: Type.Optional(Type.Integer({
+    ...createExaFilterProperties(),
+    count: JsonSchema.Optional(JsonSchema.Integer({
       minimum: 1,
       maximum: MAX_SEARCH_RESULT_COUNT,
       description: `Number of web results to return. Defaults to ${DEFAULT_SEARCH_RESULT_COUNT}; max ${MAX_SEARCH_RESULT_COUNT}.`
     })),
-    offset: Type.Optional(Type.Integer({
+    offset: JsonSchema.Optional(JsonSchema.Integer({
       minimum: 0,
       maximum: 9,
       description: "Zero-based result offset for pagination. Defaults to 0."
     })),
-    country: Type.Optional(Type.String({
+    country: JsonSchema.Optional(JsonSchema.String({
       pattern: "^[A-Za-z]{2}$",
       description: "Optional 2-letter country code, such as US or GB."
     })),
-    searchLang: Type.Optional(Type.String({
+    searchLang: JsonSchema.Optional(JsonSchema.String({
       minLength: 2,
       maxLength: 8,
       description: "Optional Brave search language code, such as en or en-US."
     })),
-    safesearch: Type.Optional(StringEnum2(["off", "moderate", "strict"], {
+    safesearch: JsonSchema.Optional(StringEnum(["off", "moderate", "strict"], {
       description: "Optional search safety setting. Brave forwards this as safesearch; Exa maps moderate/strict to moderation=true."
     })),
-    freshness: Type.Optional(StringEnum2(["pd", "pw", "pm", "py"], {
+    freshness: JsonSchema.Optional(StringEnum(["pd", "pw", "pm", "py"], {
       description: "Optional freshness window: pd=past day, pw=past week, pm=past month, py=past year."
     }))
   }, { additionalProperties: false });
@@ -35685,25 +35755,19 @@ function sleepWithAbort(ms, signal) {
   });
 }
 var WebSearchRequestGate = class {
-  now;
-  sleep;
   lastRequestStartedAt = 0;
   tail = Promise.resolve();
-  constructor(now = Date.now, sleep2 = sleepWithAbort) {
-    this.now = now;
-    this.sleep = sleep2;
-  }
   run(signal, task) {
     const runTask = async () => {
-      const elapsedMs = this.lastRequestStartedAt === 0 ? WEB_SEARCH_MIN_REQUEST_INTERVAL_MS : this.now() - this.lastRequestStartedAt;
+      const elapsedMs = this.lastRequestStartedAt === 0 ? WEB_SEARCH_MIN_REQUEST_INTERVAL_MS : Date.now() - this.lastRequestStartedAt;
       const waitMs = Math.max(0, WEB_SEARCH_MIN_REQUEST_INTERVAL_MS - elapsedMs);
       if (waitMs > 0) {
-        await this.sleep(waitMs, signal);
+        await sleepWithAbort(waitMs, signal);
       }
       if (signal?.aborted === true) {
         signal.throwIfAborted();
       }
-      this.lastRequestStartedAt = this.now();
+      this.lastRequestStartedAt = Date.now();
       return task();
     };
     const result = this.tail.then(runTask, runTask);
@@ -35712,18 +35776,19 @@ var WebSearchRequestGate = class {
     return result;
   }
 };
-function redactSearchSecret(text3, apiKey) {
-  return apiKey.length > 0 ? text3.split(apiKey).join("[REDACTED]") : text3;
-}
 function formatSearchHttpError(options) {
-  const { provider, status, statusText, body, apiKey } = options;
+  const { provider, status } = options;
   const providerLabel = getProviderLabel(provider);
-  const errorPreview = cleanSearchText(redactSearchSecret(body, apiKey), 300);
   if (status === 429) {
-    const preview = errorPreview !== void 0 ? ` Upstream details: ${redactSearchSecret(errorPreview, apiKey)}` : "";
-    return `${providerLabel} search rate limit exceeded (HTTP 429). Do not issue parallel or repeated agent_browser_web_search calls; use one high-signal query, inspect those results, then wait before retrying or ask the user to adjust their ${providerLabel} API plan/limits.${preview}`;
+    return `${providerLabel} search rate limit exceeded (HTTP 429). Do not issue parallel or repeated agent_browser_web_search calls; use one high-signal query, inspect those results, then wait before retrying or ask the user to adjust their ${providerLabel} API plan/limits.`;
+  }
+  if (status === 401 || status === 403) {
+    return `${providerLabel} search failed with HTTP ${status}: Check your API credential and permissions.`;
   }
-  return `${providerLabel} search failed with HTTP ${status}: ${errorPreview !== void 0 ? redactSearchSecret(errorPreview, apiKey) : statusText}`;
+  if (status >= 500) {
+    return `${providerLabel} search failed with HTTP ${status}: Provider unavailable; retry later.`;
+  }
+  return `${providerLabel} search failed with HTTP ${status}: Request rejected; check the search parameters.`;
 }
 async function fetchSearchJson(options) {
   if (options.signal?.aborted === true) {
@@ -35735,20 +35800,19 @@ async function fetchSearchJson(options) {
   options.signal?.addEventListener("abort", abort, { once: true });
   try {
     const response = await fetch(options.request, { ...options.init, signal: controller.signal });
-    const text3 = await response.text();
     if (!response.ok) {
+      await response.body?.cancel().catch(() => {
+      });
       throw new Error(formatSearchHttpError({
         provider: options.provider,
-        status: response.status,
-        statusText: response.statusText,
-        body: text3,
-        apiKey: options.apiKey
+        status: response.status
       }));
     }
+    const text3 = await response.text();
     try {
       return JSON.parse(text3);
-    } catch (error) {
-      throw new Error(`${options.invalidJsonMessage}: ${error instanceof Error ? error.message : "Unknown JSON parse failure"}`, { cause: error });
+    } catch {
+      throw new Error(options.invalidJsonMessage);
     }
   } finally {
     clearTimeout(timeout);
@@ -35827,7 +35891,6 @@ function buildExaSearchRequestBody(params, now = () => /* @__PURE__ */ new Date(
 }
 async function fetchBraveSearchJson(url, apiKey, signal) {
   const data = await fetchSearchJson({
-    apiKey,
     cancelMessage: "Brave search cancelled",
     init: { headers: { Accept: "application/json", "X-Subscription-Token": apiKey } },
     invalidJsonMessage: "Brave search returned invalid JSON",
@@ -35860,7 +35923,6 @@ function usesDynamicHighlights(body) {
 }
 async function fetchExaSearchJson(body, apiKey, signal, timeoutMs = SEARCH_REQUEST_TIMEOUT_MS) {
   const data = await fetchSearchJson({
-    apiKey,
     cancelMessage: "Exa search cancelled",
     init: {
       body: JSON.stringify(body),
@@ -35916,34 +35978,6 @@ var EXA_WEB_SEARCH_ADAPTER = {
     };
   }
 };
-var WEB_SEARCH_PROVIDER_ADAPTERS = {
-  brave: {
-    provider: "brave",
-    buildRequest: BRAVE_WEB_SEARCH_ADAPTER.buildRequest,
-    fetchJson(request, apiKey, signal) {
-      if (!(request instanceof URL)) {
-        throw new Error("Brave search request must be a URL");
-      }
-      return BRAVE_WEB_SEARCH_ADAPTER.fetchJson(request, apiKey, signal);
-    },
-    normalizeResponse(response, params) {
-      return BRAVE_WEB_SEARCH_ADAPTER.normalizeResponse(parseBraveSearchResponse(response), params);
-    }
-  },
-  exa: {
-    provider: "exa",
-    buildRequest: EXA_WEB_SEARCH_ADAPTER.buildRequest,
-    fetchJson(request, apiKey, signal) {
-      if (!isRecord(request) || !isRecord(request.body) || typeof request.timeoutMs !== "number") {
-        throw new Error("Exa search request must contain a body and timeout");
-      }
-      return fetchExaSearchJson(request.body, apiKey, signal, request.timeoutMs);
-    },
-    normalizeResponse(response, params) {
-      return EXA_WEB_SEARCH_ADAPTER.normalizeResponse(parseExaSearchResponse(response), params);
-    }
-  }
-};
 function prepareWebSearchRequest(provider, params, apiKey, signal) {
   if (provider === "exa") {
     const request2 = EXA_WEB_SEARCH_ADAPTER.buildRequest(params);
@@ -36041,8 +36075,12 @@ async function runWebSearch(state, params, gate, signal) {
     duplicatesRemoved: duplicatesRemoved > 0 ? duplicatesRemoved : void 0
   };
 }
-async function presentSearchSuccess(details, params) {
-  const duplicateNotice = details.duplicatesRemoved !== void 0 ? `
+async function presentSearchSuccess(rawDetails, params) {
+  const details = redactPresentationData({ command: "web-search" }, rawDetails);
+  if (!isRecord(details) || !isWebSearchProvider(details.provider) || typeof details.returnedQuery !== "string" || !Array.isArray(details.results) || !details.results.every(isNormalizedSearchResult)) {
+    throw new Error("Web search presentation has invalid result structure.");
+  }
+  const duplicateNotice = typeof details.duplicatesRemoved === "number" ? `
 
 Duplicate URLs removed: ${details.duplicatesRemoved}.` : "";
   const result = await finalizeAgentBrowserNativeResult({
@@ -36057,6 +36095,12 @@ Duplicate URLs removed: ${details.duplicatesRemoved}.` : "";
   const finalizedManifest = result.details.artifactManifest;
   return finalizedManifest === void 0 ? { ...result, details } : { ...result, details: { ...details, artifactManifest: finalizedManifest } };
 }
+function isNormalizedSearchResult(value) {
+  if (!isRecord(value) || typeof value.title !== "string" || typeof value.url !== "string") {
+    return false;
+  }
+  return ["description", "source", "age", "pageDate", "language"].every((field) => value[field] === void 0 || typeof value[field] === "string") && (value.highlights === void 0 || isStringArray2(value.highlights));
+}
 function failureCategory(error, signal) {
   if (signal?.aborted === true) {
     return "aborted";
@@ -38370,7 +38414,7 @@ async function runAgentBrowserScript(options) {
 }
 
 // dist/extensions/agent-browser/lib/orchestration/script-mode.js
-import { stat as stat14 } from "node:fs/promises";
+import { stat as stat13 } from "node:fs/promises";
 import { randomUUID as randomUUID7 } from "node:crypto";
 init_parsing();
 init_browser_transcript();
@@ -38621,7 +38665,7 @@ var BrowserCodeOutput = class {
       if (image === void 0) {
         throw new Error("Browser capture returned invalid image observation geometry.");
       }
-      const file = await stat14(image.path);
+      const file = await stat13(image.path);
       const id = `image-${this.images.size + 1}`;
       this.images.set(id, { observation: image, size: file.size, mtime: file.mtimeMs });
       return { ...image, id };
@@ -38644,7 +38688,7 @@ var BrowserCodeOutput = class {
     if (this.selected.size >= 8 || this.selectedBytes + image.size > 20 * 1024 * 1024) {
       throw new Error("Selected images exceed the code output limit (8 images / 20 MiB). Emit fewer images.");
     }
-    const file = await stat14(image.observation.path);
+    const file = await stat13(image.observation.path);
     if (!file.isFile() || file.size !== image.size || file.mtimeMs !== image.mtime) {
       throw new Error("The selected image changed since capture. Capture it again before emitting it.");
     }
@@ -40379,7 +40423,7 @@ init_argv_grammar();
 init_artifact_manifest();
 init_runtime();
 init_text();
-import { mkdir as mkdir5, readFile as readFile10, realpath as realpath3, stat as stat15, writeFile as writeFile3 } from "node:fs/promises";
+import { mkdir as mkdir5, readFile as readFile10, realpath as realpath3, stat as stat14, writeFile as writeFile3 } from "node:fs/promises";
 import { dirname as dirname15, extname as extname7, isAbsolute as isAbsolute12, resolve as resolve14 } from "node:path";
 function normalizeRequestedOutputPath(path) {
   return path.startsWith("@") ? path.slice(1) : path;
@@ -40537,7 +40581,7 @@ async function pathsReferToSameFile(left, right) {
   } catch {
   }
   try {
-    const [leftStat, rightStat] = await Promise.all([stat15(left), stat15(right)]);
+    const [leftStat, rightStat] = await Promise.all([stat14(left), stat14(right)]);
     return leftStat.dev === rightStat.dev && leftStat.ino === rightStat.ino;
   } catch {
     return false;