pi-agent-browser-native 0.9.6 → 0.9.7

package/dist/packaged/lib/browser-session-conversion.js

@@ -11,6 +11,11 @@ function isRecord(value) {
 
 // dist/extensions/agent-browser/lib/browser-journal-projection.js
 var ENVELOPE_MAX_BYTES = 16 * 1024 * 1024;
+var MAX_NESTING = 1024;
+var RESERVE_PER_BYTE = 16;
+var NATIVE_RECORD_BYTES = ENVELOPE_MAX_BYTES / RESERVE_PER_BYTE;
+var NATIVE_STRUCTURE_LIMIT = 64 * 1024;
+var JOURNAL_CHUNK_BYTES = 64 * 1024;
 function matches(field, key) {
   return field === key || field === "*" && typeof key === "number";
 }
@@ -149,7 +154,7 @@ var JsonProjection = class {
     }
   }
   startContainer(name) {
-    if (this.stack.length >= 1024) {
+    if (this.stack.length >= MAX_NESTING) {
       throw new Error("Journal JSON nesting exceeds 1024 levels.");
     }
     const currentPath = this.excluded() ? [] : this.path();
@@ -214,14 +219,110 @@ async function projectJson(input, fields, maxBytes = ENVELOPE_MAX_BYTES) {
   consume(chain.none);
   return projection.result();
 }
+function stringEnd(bytes, open2) {
+  for (let quote = bytes.indexOf(34, open2 + 1); quote !== -1; quote = bytes.indexOf(34, quote + 1)) {
+    let escapes = 0;
+    while (bytes[quote - 1 - escapes] === 92) {
+      escapes++;
+    }
+    if (escapes % 2 === 0) {
+      return quote;
+    }
+  }
+  return -1;
+}
+var DEPTH_STEP = new Int8Array(256);
+var STRUCTURE_STEP = new Uint8Array(256);
+for (const byte of [91, 123]) {
+  DEPTH_STEP[byte] = 1;
+  STRUCTURE_STEP[byte] = 1;
+}
+for (const byte of [93, 125]) {
+  DEPTH_STEP[byte] = -1;
+}
+for (const byte of [44, 58]) {
+  STRUCTURE_STEP[byte] = 1;
+}
+function fitsNativeParse(bytes) {
+  let depth = 0;
+  let structure = 0;
+  for (let index = 0; index < bytes.length; index++) {
+    const byte = bytes[index];
+    if (byte === 34) {
+      index = stringEnd(bytes, index);
+      if (index === -1) {
+        return false;
+      }
+      continue;
+    }
+    depth += DEPTH_STEP[byte];
+    structure += STRUCTURE_STEP[byte];
+    if (depth > MAX_NESTING || structure > NATIVE_STRUCTURE_LIMIT) {
+      return false;
+    }
+  }
+  return true;
+}
+function selectValue(value, path, fields) {
+  if (typeof value !== "object" || value === null || fields.some((field) => field.every((key, index) => matches(key, path[index])))) {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    const selected2 = [];
+    for (const [index, item] of value.entries()) {
+      const itemPath = [...path, index];
+      if (selectedPath(itemPath, fields)) {
+        selected2[index] = selectValue(item, itemPath, fields);
+      }
+    }
+    return selected2;
+  }
+  const selected = {};
+  for (const [key, item] of Object.entries(value)) {
+    const itemPath = [...path, key];
+    if (selectedPath(itemPath, fields)) {
+      Object.defineProperty(selected, key, {
+        value: selectValue(item, itemPath, fields),
+        writable: true,
+        enumerable: true,
+        configurable: true
+      });
+    }
+  }
+  return selected;
+}
+function nativeProjection(bytes, fields) {
+  if (!fitsNativeParse(bytes)) {
+    return void 0;
+  }
+  let value;
+  try {
+    value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch {
+    return void 0;
+  }
+  if (!isRecord(value)) {
+    return void 0;
+  }
+  const selected = selectValue(value, [], fields);
+  return isRecord(selected) ? selected : void 0;
+}
+async function* chunks(bytes) {
+  for (let start = 0; start < bytes.length; start += JOURNAL_CHUNK_BYTES) {
+    yield bytes.subarray(start, start + JOURNAL_CHUNK_BYTES);
+  }
+}
+async function projectJsonBytes(bytes, fields, maxBytes = ENVELOPE_MAX_BYTES) {
+  const native = bytes.length * RESERVE_PER_BYTE <= maxBytes ? nativeProjection(bytes, fields) : void 0;
+  return native ?? projectJson(chunks(bytes), fields, maxBytes);
+}
 
 // dist/extensions/agent-browser/lib/browser-journal-reader.js
-var CHUNK_BYTES = 64 * 1024;
 async function* readRange(file, range) {
   let position = range.offset;
   const end = range.offset + range.length;
   while (position < end) {
-    const buffer = Buffer.allocUnsafe(Math.min(CHUNK_BYTES, end - position));
+    const buffer = Buffer.allocUnsafe(Math.min(JOURNAL_CHUNK_BYTES, end - position));
     const { bytesRead } = await file.read(buffer, 0, buffer.length, position);
     if (bytesRead === 0) {
       throw new Error("Journal changed or truncated during read.");
@@ -230,35 +331,69 @@ async function* readRange(file, range) {
     yield buffer.subarray(0, bytesRead);
   }
 }
+function hasContent(buffer, start, end) {
+  for (let index = start; index < end; index++) {
+    const byte = buffer[index];
+    if (byte !== 9 && byte !== 13 && byte !== 32) {
+      return true;
+    }
+  }
+  return false;
+}
 var JournalLineFramer = class {
   start;
   nonblank = false;
+  parts = [];
+  held = 0;
   constructor(offset) {
     this.start = offset;
   }
   *accept(buffer, position) {
-    for (let index = 0; index < buffer.length; index++) {
-      const byte = buffer[index];
-      if (byte === 10) {
-        if (this.nonblank) {
-          yield { offset: this.start, length: position + index + 1 - this.start };
-        }
-        this.start = position + index + 1;
-        this.nonblank = false;
-      } else if (![9, 13, 32].includes(byte)) {
-        this.nonblank = true;
+    let index = 0;
+    while (index < buffer.length) {
+      const newline = buffer.indexOf(10, index);
+      const end = newline === -1 ? buffer.length : newline;
+      this.nonblank ||= hasContent(buffer, index, end);
+      this.hold(buffer.subarray(index, newline === -1 ? end : end + 1));
+      if (newline === -1) {
+        return;
+      }
+      const record = this.take(position + newline + 1);
+      if (record) {
+        yield record;
       }
+      index = newline + 1;
     }
   }
   final(end, sealed) {
-    return this.nonblank && sealed ? { offset: this.start, length: end - this.start } : void 0;
+    return sealed ? this.take(end) : void 0;
+  }
+  hold(part) {
+    this.held += part.length;
+    if (this.held > NATIVE_RECORD_BYTES) {
+      this.parts = void 0;
+    } else {
+      this.parts?.push(part);
+    }
+  }
+  take(next) {
+    let record;
+    if (this.nonblank) {
+      const range = { offset: this.start, length: next - this.start };
+      record = this.parts ? { ...range, bytes: Buffer.concat(this.parts) } : range;
+    }
+    this.start = next;
+    this.nonblank = false;
+    this.parts = [];
+    this.held = 0;
+    return record;
   }
 };
 async function* journalRanges(file, end, sealed = false, offset = 0) {
   let position = offset;
   const framer = new JournalLineFramer(offset);
   while (position < end) {
-    const buffer = Buffer.allocUnsafe(Math.min(CHUNK_BYTES, end - position));
+    const buffer = Buffer.allocUnsafe(Math.min(JOURNAL_CHUNK_BYTES, end - position));
     const { bytesRead } = await file.read(buffer, 0, buffer.length, position);
     if (bytesRead === 0) {
       throw new Error("Journal truncated during read.");
@@ -286,14 +421,14 @@ var STRUCTURAL_FIELDS = [
   ["message", "details", "artifactManifest", "version"],
   ["message", "details", "electron", "action"]
 ];
-async function scanJournalMetadata(file, end, sealed = false) {
+async function scanJournalMetadata(file, end, sealed = false, offset = 0) {
   const entries = [];
-  for await (const range of journalRanges(file, end, sealed)) {
-    const value = await projectJson(readRange(file, range), STRUCTURAL_FIELDS);
+  for await (const range of journalRanges(file, end, sealed, offset)) {
+    const value = range.bytes ? await projectJsonBytes(range.bytes, STRUCTURAL_FIELDS) : await projectJson(readRange(file, range), STRUCTURAL_FIELDS);
     if (!value) {
       throw new Error(`Expected a journal object at byte ${range.offset}.`);
     }
-    entries.push({ ...range, value });
+    entries.push({ offset: range.offset, length: range.length, value });
   }
   return entries;
 }
@@ -866,6 +1001,7 @@ var GLOBAL_BOOLEAN_FLAGS_WITH_OPTIONAL_VALUES = /* @__PURE__ */ new Set([
   "-q",
   "--verbose",
   "-v",
+  "--use-system-ca",
   "--webgpu"
 ]);
 function optionalGlobalValueFlagConsumesNext(flag, nextToken) {
@@ -2562,8 +2698,8 @@ async function sourceChecksum(file, size) {
   }
   return hash.digest("hex");
 }
-async function writeBytes(file, chunks) {
-  for await (const chunk of chunks) {
+async function writeBytes(file, chunks2) {
+  for await (const chunk of chunks2) {
     const buffer = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
     let offset = 0;
     while (offset < buffer.length) {

package/dist/packaged/lib/playbook.js

@@ -531,6 +531,39 @@ var LAUNCH_SCOPED_FLAG_DEFINITIONS = [
 ];
 var LAUNCH_SCOPED_FLAGS = LAUNCH_SCOPED_FLAG_DEFINITIONS.map((definition) => definition.flag);
 var LAUNCH_SCOPED_FLAG_LABEL = LAUNCH_SCOPED_FLAGS.join(", ");
+var MANAGED_RESTORE_INCOMPATIBLE_FLAGS = [
+  "--restore",
+  "--restore-save",
+  "--restore-check-url",
+  "--restore-check-text",
+  "--restore-check-fn",
+  "--allowed-domains",
+  "--profile",
+  "--state",
+  "--cdp",
+  "--auto-connect",
+  "--session-name",
+  "--provider",
+  "-p",
+  "--executable-path",
+  "--extension",
+  "--init-script",
+  "--enable",
+  "--args",
+  "--user-agent",
+  "--proxy",
+  "--proxy-bypass",
+  "--ca-cert",
+  "--ignore-https-errors",
+  "--allow-file-access",
+  "--webgpu",
+  "--device",
+  "--engine"
+];
+var HELPER_INHERITED_LAUNCH_FLAGS = /* @__PURE__ */ new Set(["--namespace", "--idle-timeout"]);
+var BROWSER_LAUNCH_FLAGS = [
+  .../* @__PURE__ */ new Set([...LAUNCH_SCOPED_FLAGS, ...MANAGED_RESTORE_INCOMPATIBLE_FLAGS])
+].filter((flag) => !HELPER_INHERITED_LAUNCH_FLAGS.has(flag));
 
 // dist/extensions/agent-browser/lib/playbook.js
 var PROJECT_RULE_PROMPT = "Project rule: when browser automation is needed, prefer the native `agent_browser` tool. Do not run direct `agent-browser` bash commands unless the user explicitly asks for a bash-oriented workflow or browser-integration debugging.";
@@ -542,14 +575,14 @@ function buildInstalledDocsGuideline(paths) {
 }
 var QUICK_START_GUIDELINES = [
   "Choose agent_browser for one native command, native batch --bail with JSON-array stdin for a known fixed sequence, or agent_browser_code for loops, branches, and aggregation. Return to the model when a fresh observation needs judgment. Neither tool is a named recipe registry.",
-  'agent_browser takes args (argv after the binary), optional stdin, outputPath, timeoutMs, and sessionMode. Start with { args: ["open", "<url>"] }, then { args: ["snapshot", "-i"] }; act on current @refs and re-snapshot after navigation or DOM changes. Native commands, providers, plugins, profiles, auth, file access, and caller paths remain available through args.',
+  'agent_browser takes args (argv after the binary), optional stdin, outputPath, timeoutMs, and sessionMode; sessionMode:fresh intentionally launches a separate managed browser. Start with { args: ["open", "<url>"] }, then { args: ["snapshot", "-i"] }; act on current @refs and re-snapshot after navigation or DOM changes. Native commands, providers, plugins, profiles, auth, file access, and caller paths remain available through args; native config and environment pass through. Use requested/configured profiles and verify authentication after restart.',
   'Use { args: ["batch", "--bail"], stdin: "[[\\"fill\\",\\"@e1\\",\\"text\\"],[\\"click\\",\\"@e2\\"]]" } for same-snapshot form fields followed by submit. Split if a fill rerenders later fields. Add native condition waits after navigation-prone actions; a click alone does not prove the destination loaded. Avoid blind mutation retries after timeout.',
   "agent_browser_code takes { code, session?, namespace?, timeoutMs?, outputPath? }. JavaScript globals are fresh for every call; the selected browser persists and is shared with agent_browser. Use await browser({ args, stdin?, timeoutMs? }), inspect result.success, and emit selected JSON instead of whole envelopes. Use emitImage(result.imageObservations[0]) only when image inspection is needed; image handles belong to the current code call. No imports or host filesystem/network/process APIs are exposed.",
   `Example agent_browser_code: { code: 'const result = await browser({args:["get","title"]}); if (!result.success) { emit(result); } else { emit({title:result.data}); }' }. Native batch still avoids extra CLI processes for fixed segments inside code. Explicit session/namespace controls select the browser for this cell without changing the default browser.`,
   'Call agent_browser_tools with no fields for inventory, or { enable: ["action", "qa", "electron", "source", "network"] } for advanced native tools. It adds agent_browser_action, agent_browser_qa, agent_browser_electron, agent_browser_source, and agent_browser_network_source without disabling other tools. The browser instructions cover these capabilities; activation reveals their selected tool declarations.',
   "Use read <url> for readable web text; get title/url, get text/html/value/count <selector>, or get attr <selector> <name> for targeted state. For eval --stdin, put JavaScript in stdin and return the desired value. outputPath saves result data and must differ from screenshot/download/recording paths. Use --json only when JSON text is needed.",
-  "For artifacts, verify artifactVerification and artifacts before reporting success. A pending recording is not verified output; install ffmpeg before starting and pair start with stop. Native download owns the click and saves Blob/redirect downloads. Close keeps explicitly saved files. Save promptGuard-required paths before close. Screenshot pixels are not browser CSS coordinates: use imageObservations geometry (dimensions, viewport, crop/origin, scroll and DPR) before any visual-coordinate action; full-page and element captures are not current-viewport coordinates, and Pi resizing only maps sent pixels to original image pixels. Lightpanda images are text-rendered, not graphical layout; rendering:text never supports CSS/mouse-coordinate input.",
-  "Follow model-visible nextActions when present, including identity and stdin, instead of guessing commands. Treat native pending confirmations and unknown mutation outcomes as inspection boundaries. For dense snapshots, inspect Omitted high-value controls before reading a full spill."
+  "For artifacts, verify artifactVerification and artifacts before reporting success. A pending recording is not verified output; install ffmpeg before starting and pair start with stop. Native download owns the click and saves Blob/redirect downloads. Close keeps explicitly saved files. Save promptGuard-required paths before close. Screenshot pixels are not browser CSS coordinates: use imageObservations geometry (dimensions, viewport, crop/origin, scroll and DPR) before any visual-coordinate action; full-page and element captures are not current-viewport coordinates, and Pi resizing only maps sent pixels to original image pixels. Lightpanda images are text-rendered, not graphical layout; rendering:text never supports CSS/mouse-coordinate input. Prefer refs; inspect screenshots only when the task needs vision.",
+  "Follow model-visible nextActions when present, including identity and stdin, instead of guessing commands. Treat native pending confirmations and unknown mutation outcomes as inspection boundaries. Native outcome_unknown means a command may have run and was not retried; inspect before any repeat. For dense snapshots, inspect Omitted high-value controls before reading a full spill."
 ];
 var ADVANCED_TOOL_PROMPT_GUIDELINES = {
   action: [
@@ -591,11 +624,11 @@ var SHARED_BROWSER_PLAYBOOK_GUIDELINES = [
   "Do not assume Playwright selector dialects such as text=Close or button:has-text('Close') are supported wrapper syntax unless current upstream agent-browser behavior has been verified.",
   "For authenticated or user-specific content explicitly requested by the user, such as feeds, inboxes, account pages, or private dashboards, use a real profile only when the user/config asks for it or profiles have been inspected; do not assume --profile Default exists on every machine. Do not use a real profile for public pages just because they are dashboards. Treat visible page content from real profiles as model-visible transcript data. On macOS, copied Chrome profiles may omit encrypted cookies, so profile selection alone is not proof of authentication; verify the target page and use a user-approved headed login once when needed. Use --auto-connect only if profile-based reuse is unavailable or the task is specifically about attaching to a running debug-enabled browser. If profile/user-data-dir resolution fails, stop retrying opens, run profiles and/or doctor through agent_browser, then report what the user needs to configure.",
   "Ordinary bare calls share one native browser within your root Pi parent/subagent group; unrelated roots browse independently. Coordinate multi-call navigation inside your group with existing subagent/intercom tools. Explicit native session defaults still win. Pi quit does not close group browsers; never close an unrelated browser.",
-  `When using launch-scoped flags (${LAUNCH_SCOPED_FLAG_LABEL}), put them on the first command for that session. If you intentionally use an explicit --session, keep using that same explicit session for follow-ups.`,
+  `When using launch-scoped flags (${LAUNCH_SCOPED_FLAG_LABEL}), put them on the first command for that session. If you intentionally use an explicit --session, keep using that same explicit session for follow-ups. If you already used the implicit session and now need launch-scoped flags, retry with top-level sessionMode set to fresh or pass an explicit --session for the new launch; never pass --session-mode inside args. After a successful unnamed fresh launch, later auto calls follow that new session.`,
   "Cooperating Pi processes serialize each complete browser operation and code cell by native socket context, namespace, and session, including target/ref helpers and state updates. Different identities remain concurrent; namespace-wide close waits for matching operations. All participating Pi instances must load this release; humans, third-party clients, and older extensions are outside that coordination. It is not a transaction or rollback. For raw batches whose later content depends on navigation, use exact batch --bail or split the calls.",
   "After a successful `connect`, `--cdp`, or enabled `--auto-connect` call, verify with get url and keep using the resulting session without repeating the attach flag. The wrapper remembers that attachment across active-branch reload/resume and live-checks the URL before later page reads/interactions because an attached browser can drift externally; caller config, file access, launch arguments, and environment pass through unchanged. A successful close clears the marker. When several named sessions share one Chrome, pass --pin-tab once (AGENT_BROWSER_PIN_TAB) so a closed bound tab fails as tab_gone instead of acting on a neighbor; recover with tab new or tab list. --no-pin-tab turns the sticky pin off. tab list includes each tab's CDP targetId, accepted as a tab ref.",
-  `If you already used the implicit session and now need launch-scoped flags (${LAUNCH_SCOPED_FLAG_LABEL}), retry with top-level sessionMode set to fresh or pass an explicit --session for the new launch; never pass --session-mode inside args. After a successful unnamed fresh launch, later auto calls follow that new session.`,
-  "Chrome is the default. Use separately installed Lightpanda only when explicitly selected with --engine lightpanda, environment or native config; --engine is launch-scoped, so use sessionMode:fresh to change a managed browser. Lightpanda text-rendered screenshots do not prove graphical layout/visibility or mouse coordinates. Chrome profiles, headed mode, multi-tab, WebGPU and native WebMCP are not parity capabilities; choose Chrome explicitly when needed, never assume automatic fallback.",
+  "Chrome is the default. Select separately installed Lightpanda or experimental Obscura explicitly with --engine lightpanda|obscura, environment or native config; use sessionMode:fresh to change a managed engine. Lightpanda text-rendered screenshots never establish graphical layout or mouse coordinates. Obscura has accessibility, iframe and screenshot gaps; read its command-reference limits first. Profiles, headed mode, multi-tab, WebGPU and WebMCP are not parity capabilities; choose Chrome when needed, never assume automatic fallback.",
+  "For CLI HTTPS trust on read/install/upgrade/doctor, use --ca-cert <path> or --use-system-ca; --use-system-ca false disables OS roots and SSL_CERT_FILE is a fallback. These do not disable certificate verification or configure remote CDP trust. Browser CA trust remains Linux-Chromium-only and launch-scoped.",
   'For WebGPU pages, use args ["--webgpu", "open", "<url>"] on a fresh local browser launch; use doctor --webgpu (or --headed on Linux/Windows capture paths) to prove rendering before trusting a non-black screenshot. WebGPU cannot be combined with --cdp, --auto-connect, or provider launches unless --webgpu false overrides an enabled config/environment default.',
   "For experimental WebMCP page tools, use webmcp list, then webmcp invoke <tool> with --params and optional --frame/--detach/--timeout; use webmcp result or cancel for detached calls. Locally managed Chrome enables WebMCP by default; a positive navigation hint means the page has tools to list. --no-webmcp is launch-scoped and requires a fresh session; invoke/result/cancel can mutate or navigate, so refresh snapshot refs afterward.",
   "For --allowed-domains, use a fresh local Chrome context. Upstream rejects CDP/auto-connect, profiles, restore/state replay, direct-page providers, iOS/Safari, and startup/profile Chrome args because they cannot guarantee containment; Chromium also disables RTCPeerConnection while the allowlist is active.",
@@ -603,7 +636,7 @@ var SHARED_BROWSER_PLAYBOOK_GUIDELINES = [
   "For first-navigation setup, use open without a URL plus network route --resource-type <csv>, cookies set --curl <file>, or --init-script/--enable before navigate/opening the target page.",
   "For stateful browser context work, use auth save --password-stdin with the tool stdin field for credentials, auth list/show/delete/remove for local auth-profile maintenance, auth login when you need the browser to fill a saved profile, and state save/load/list/show/rename/clear/clean for upstream saved-state lifecycle. State paths, restore identifiers, wrapper-prefixed sessions, and all upstream list rows remain available; credential values inside cookie/storage/auth payloads are still redacted from presentation.",
   "Upstream restore sessions periodically autosave cookies and localStorage while the browser stays open, including page-driven background changes; AGENT_BROWSER_AUTOSAVE_INTERVAL_MS controls the interval (30000 by default; 0 disables periodic saves but keeps save-on-close), while the never value for --restore-save disables automatic saves for that restore session. For wrapper-owned headed launches, the wrapper defaults the interval to 0 because upstream 0.33.2 collects multi-origin storage through visible temporary tabs, then records and reapplies the effective launch-time value to helpers and follow-ups so daemon configuration remains stable. Native close still saves, but direct window close can lose newer state because upstream exempts headed browsers from idle shutdown; set AGENT_BROWSER_AUTOSAVE_INTERVAL_MS before launch when periodic preservation matters, because changing it on a running wrapper-owned headed session requires close plus a fresh launch.",
-  "For batch chains that touch cookies, storage, auth, or other secret-bearing commands, use details.batchSteps for per-step artifacts, categories, spill paths, and full structured errors; top-level details.data on batch is only a compact redacted step matrix (success, argv-redacted command, redacted result or scrubbed error text) built from the same presentation rules as standalone calls.",
+  "For batch chains that touch cookies, storage, auth, or other secret-bearing commands, use details.batchSteps for per-step artifacts, categories, spill paths, and full structured errors; top-level details.data on batch is only a compact redacted step matrix (success, argv-redacted command or native --omit-command index, redacted result or scrubbed error text) built from the same presentation rules as standalone calls. Indexed receipts preserve original input positions, including skipped empty rows, without echoing commands.",
   "For non-core families, pass current upstream commands through the native tool directly: network requests, network route <url>, network har start/stop [path], diff snapshot, diff screenshot --baseline <file>, diff url <u1> <u2>, trace start, trace stop [path], profiler start, profiler stop [path], record start <path>, record stop, console/errors [--clear], highlight <selector>, inspect, clipboard read, clipboard write <text>, clipboard copy/paste, stream enable/disable/status, dashboard start/stop, device list for iOS simulator inventory, and chat <message>. For compact network requests output, prefer details.nextActions for request detail, route-mock diagnostics, actionable failed-request agent_browser_network_source, filtering, clearing the aggregate buffer before repro, or HAR capture follow-ups instead of guessing request-id syntax. Artifact-producing commands report details.artifacts and verification state; long-running starts such as stream, dashboard, trace/profiler, and record should be paired with the matching stop/disable command when the task is done; stream enable already-enabled outcomes are treated as idempotent success with status/disable follow-ups.",
   'For Electron desktop apps, enable agent_browser_electron through agent_browser_tools for wrapper-owned discovery, isolated launch, status, compact probe, and cleanup: list first, treat likely-sensitive annotations as hints rather than enforcement, launch with the default snapshot handoff unless handoff: "tabs" is the safer diagnostic starting point, use agent_browser_electron probe or snapshot -i/agent_browser_qa attached:true for current-session state, and always cleanup the returned launchId when done. agent_browser_electron launch uses an isolated temporary profile; it does not reuse the app\'s normal signed-in profile or attach to an already-running authenticated app. For signed-in local app state, host-launch the normal app with --remote-debugging-port when appropriate, then use raw args connect <port|url>; after connect, run get url to verify the active target before page-content reads, inspect tab list, select the stable tab id such as tab t2, verify it again with get url, then run a condition wait or snapshot -i before using refs. close commands (`close`, `quit`, or `exit`) only close the browser/CDP session; leave manually launched app shutdown, profile cleanup, and explicit artifacts to the host owner.',
   "For provider or specialized app workflows, load version-matched upstream guidance with skills get agentcore|electron|slack|dogfood|vercel-sandbox|derive-client through the native tool; add --full when you need references/templates, and use skills get --all only for broad skill audits. Use derive-client when recording HAR traffic to generate a standalone API client; prefer network har start (text bodies by default) or network har start --content all|none before multi-step capture. For accessibility audits use a11y or a11y --tags wcag2a,wcag2aa (CDP browsers only). Hosted sandbox workflows should use upstream @agent-browser/sandbox helpers outside this wrapper. Provider launches such as -p ios, --provider browserbase/kernel/browseruse/browserless/agentcore, and iOS --device are upstream-owned setup paths; use sessionMode fresh when switching providers and expect external credentials or local Appium/Xcode setup to be required.",
@@ -621,6 +654,7 @@ var SHARED_BROWSER_PLAYBOOK_GUIDELINES = [
   "For evidence-only screenshots, QA captures, or other audit artifacts, save to an explicit path and branch on details.artifactVerification plus details.artifacts before reporting PASS/FAIL; do not require vision review of inline image attachments unless the user asked for visual inspection.",
   "Respect explicit user stop boundaries yourself. When the surrounding authenticated employee or automation context is explicitly unattended/auto-approved, ordinary non-destructive form submissions within the requested flow may proceed without separate confirmation. Still require explicit authorization for purchases, production-control actions, destructive or irreversible actions, and account, security, or privacy changes. The wrapper does not infer broad business intent from prompt text; details.promptGuard is reserved for concrete artifact-before-close checks.",
   "Recording needs ffmpeg on PATH before start. Current upstream checks it at startup; older natives may defer failure. A pending recording is not verified output.",
+  "Native 0.41 mcp call and stdin-driven MCP can finish normally, but this wrapper currently rejects all non-help mcp invocations. Session/namespace coordination and credential/image presentation are not integrated; use ordinary agent_browser commands.",
   "Do not call --help or other exploratory inspection commands unless the user explicitly asks for them or debugging the browser integration is necessary."
 ];
 var TOOL_PROMPT_GUIDELINES_SUFFIX = [
@@ -669,7 +703,7 @@ function buildToolPromptGuidelines(options) {
   return [
     ...options.includeWebSearch ? ["Prefer agent_browser_web_search for facts; agent_browser for pages."] : TOOL_PROMPT_GUIDELINES_PREFIX,
     ...options.docs ? [buildInstalledDocsGuideline(options.docs)] : [],
-    ...RUNTIME_PROMPT_GUIDELINES,
+    ...options.compact ? RUNTIME_PROMPT_GUIDELINES : [],
     ...browserExecutablePathGuideline !== void 0 ? [browserExecutablePathGuideline] : [],
     ...browserDefaultProfileGuideline !== void 0 ? [browserDefaultProfileGuideline] : [],
     TOOL_PROMPT_GUIDELINES_SUFFIX[0]

package/dist/packaged/lib/results/snapshot.js

@@ -1912,17 +1912,77 @@ import { tmpdir } from "node:os";
 import { dirname as dirname3, join as join3, resolve as resolve2 } from "node:path";
 
 // dist/extensions/agent-browser/lib/temp-root-ownership.js
-import { chmod, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
+import { chmod, readFile as readFile2, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname as dirname2, join as join2, resolve } from "node:path";
 
 // dist/extensions/agent-browser/lib/process-identity.js
 import { execFile } from "node:child_process";
+import { readFile } from "node:fs/promises";
 import { dirname, join, win32 } from "node:path";
+
+// dist/extensions/agent-browser/lib/browser-execution-policy-debug.js
+import { AsyncLocalStorage } from "node:async_hooks";
+import { debuglog } from "node:util";
+var debug = debuglog("pi-agent-browser-policy");
+var policyDebugEnabled = debug.enabled;
+var attempts = policyDebugEnabled ? new AsyncLocalStorage() : void 0;
+var syscalls = /* @__PURE__ */ new Set([
+  "mkdir",
+  "lstat",
+  "stat",
+  "scandir",
+  "open",
+  "read",
+  "write",
+  "rename",
+  "rmdir",
+  "unlink",
+  "rm",
+  "kill",
+  "spawn",
+  "connect",
+  "listen"
+]);
+function debugPolicyFailure(stage, reason, error) {
+  if (!policyDebugEnabled) {
+    return;
+  }
+  const context = attempts?.getStore();
+  const code = nativeField(error, "code");
+  const syscall = nativeField(error, "syscall");
+  const exit = isRecord(error) && typeof error.code === "number" && Number.isSafeInteger(error.code) ? error.code : "-";
+  debug("attempt=%s phase=%s stage=%s reason=%s code=%s syscall=%s exit=%s", context?.attempt ?? 0, context?.phase ?? "standalone", stage, reason, code, syscall, exit);
+}
+function nativeField(error, field) {
+  const value = isRecord(error) ? error[field] : void 0;
+  if (typeof value !== "string") {
+    return "-";
+  }
+  if (field === "code") {
+    return /^(?:E[A-Z0-9]{1,24}|ABORT_ERR|ERR_[A-Z_]{1,48})$/.test(value) ? value : "unknown";
+  }
+  if (value.startsWith("spawn ")) {
+    return "spawn";
+  }
+  return syscalls.has(value) ? value : "unknown";
+}
+
+// dist/extensions/agent-browser/lib/process-identity.js
 var WINDOWS_PROCESS_START_IDENTITY_PREFIX = "win32-powershell-ticks-v1:";
+var POSIX_PROCESS_START_IDENTITY_PREFIX = "posix-ps-utc-v1:";
+var LINUX_PROCESS_START_IDENTITY_PREFIX = "linux-proc-boot-ticks-v1:";
+var PROCESS_START_IDENTITY_FORMATS = [
+  WINDOWS_PROCESS_START_IDENTITY_PREFIX,
+  POSIX_PROCESS_START_IDENTITY_PREFIX,
+  LINUX_PROCESS_START_IDENTITY_PREFIX
+];
 var PROCESS_START_IDENTITY_TIMEOUT_MS = process.platform === "win32" ? 1e4 : 5e3;
 var DEFAULT_WINDOWS_SYSTEM_ROOT = "C:\\Windows";
+var LINUX_BOOT_ID_PATH = "/proc/sys/kernel/random/boot_id";
+var LINUX_BOOT_ID_PATTERN = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i;
+var LINUX_STAT_START_TICKS_INDEX = 22 - 3;
 function buildProcessStartIdentityCommand(pid, platform = process.platform) {
-  if (!Number.isSafeInteger(pid) || pid <= 0) {
+  if (!Number.isSafeInteger(pid) || pid <= 0 || platform === "linux") {
     return void 0;
   }
   const configuredSystemRoot = process.env.SystemRoot;
@@ -1932,11 +1992,12 @@ function buildProcessStartIdentityCommand(pid, platform = process.platform) {
       "-NoProfile",
       "-NonInteractive",
       "-Command",
-      `$p = Get-Process -Id ${pid} -ErrorAction Stop; Write-Output ("${WINDOWS_PROCESS_START_IDENTITY_PREFIX}" + $p.StartTime.ToUniversalTime().Ticks)`
+      `$ErrorActionPreference = 'Stop'; $p = $null; try { $p = [System.Diagnostics.Process]::GetProcessById(${pid}); [long]$ticks = $p.StartTime.ToUniversalTime().Ticks; if ($ticks -le 0) { throw 'Process start ticks unavailable' }; [Console]::Out.WriteLine("${WINDOWS_PROCESS_START_IDENTITY_PREFIX}" + $ticks.ToString([Globalization.CultureInfo]::InvariantCulture)) } finally { if ($null -ne $p) { $p.Dispose() } }`
     ],
     file: win32.join(windowsSystemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe")
   } : {
     args: ["-p", String(pid), "-o", "lstart="],
+    env: { ...process.env, TZ: "UTC0", LC_ALL: "C" },
     file: platform === "android" ? join(dirname(process.execPath), "ps") : "/bin/ps"
   };
 }
@@ -1965,14 +2026,22 @@ function normalizeProcessStartIdentity(stdout) {
 }
 var currentProcessStartIdentityPromise;
 var currentProcessStartIdentity;
+function debugIdentityBudget(budget) {
+  debugPolicyFailure("probe.budget", budget?.signal?.aborted === true ? "cancelled" : "deadline");
+}
 async function executeProcessStartIdentityCommand(command, budget = {}) {
-  if (budget.signal?.aborted === true || budget.deadline !== void 0 && Date.now() >= budget.deadline) {
+  if (budget.signal?.aborted === true || budget.deadline !== void 0 && performance.now() >= budget.deadline) {
+    debugIdentityBudget(budget);
     return void 0;
   }
-  const timeout = Math.max(1, Math.min(PROCESS_START_IDENTITY_TIMEOUT_MS, (budget.deadline ?? Infinity) - Date.now()));
+  const timeout = Math.max(1, Math.ceil(Math.min(PROCESS_START_IDENTITY_TIMEOUT_MS, (budget.deadline ?? Infinity) - performance.now())));
   return await new Promise((resolve3) => {
-    execFile(command.file, command.args, { timeout, signal: budget.signal }, (error, stdout) => {
-      resolve3(error ? void 0 : normalizeProcessStartIdentity(stdout));
+    execFile(command.file, command.args, { env: command.env, timeout, signal: budget.signal }, (error, stdout) => {
+      const identity = error ? void 0 : normalizeProcessStartIdentity(stdout);
+      if (identity === void 0) {
+        debugPolicyFailure("probe.execute", error ? "native-error" : "invalid-output", error);
+      }
+      resolve3(identity);
     });
   });
 }
@@ -1985,14 +2054,67 @@ async function resolveProcessStartIdentityFromCommands(commands, execute = execu
   }
   return void 0;
 }
+async function readLinuxProcfsText(path, budget) {
+  if (identityBudgetExpired(budget)) {
+    debugIdentityBudget(budget);
+    return void 0;
+  }
+  try {
+    return await readFile(path, { encoding: "latin1", signal: budget.signal });
+  } catch (error) {
+    debugPolicyFailure("probe.read", "native-error", error);
+    return void 0;
+  }
+}
+async function readLinuxBootId(budget) {
+  const bootId = (await readLinuxProcfsText(LINUX_BOOT_ID_PATH, budget))?.replace(/\n$/, "");
+  if (bootId === void 0 || !LINUX_BOOT_ID_PATTERN.test(bootId)) {
+    debugPolicyFailure("probe.boot-id", bootId === void 0 ? "unavailable" : "invalid-output");
+    return void 0;
+  }
+  return bootId;
+}
+function parseLinuxStartTicks(stat4, pid) {
+  const header = `${String(pid)} (`;
+  const commEnd = stat4.lastIndexOf(")");
+  if (!stat4.startsWith(header) || commEnd < header.length || stat4[commEnd + 1] !== " ") {
+    return void 0;
+  }
+  const ticks = stat4.slice(commEnd + 2).replace(/\n$/, "").split(" ").at(LINUX_STAT_START_TICKS_INDEX);
+  return ticks !== void 0 && /^[0-9]+$/.test(ticks) ? ticks : void 0;
+}
+async function readLinuxProcessStartIdentity(pid, budget = {}) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) {
+    return void 0;
+  }
+  const bootId = await readLinuxBootId(budget);
+  if (bootId === void 0) {
+    return void 0;
+  }
+  const stat4 = await readLinuxProcfsText(`/proc/${String(pid)}/stat`, budget);
+  if (stat4 === void 0) {
+    return void 0;
+  }
+  const ticks = parseLinuxStartTicks(stat4, pid);
+  if (ticks === void 0) {
+    debugPolicyFailure("probe.stat", "invalid-output");
+    return void 0;
+  }
+  return `${LINUX_PROCESS_START_IDENTITY_PREFIX}${bootId}:${ticks}`;
+}
 async function readUncachedProcessStartIdentity(pid, platform, budget) {
-  return await resolveProcessStartIdentityFromCommands(buildProcessStartIdentityCommands(pid, platform), (command) => executeProcessStartIdentityCommand(command, budget));
+  if (platform === "linux") {
+    return await readLinuxProcessStartIdentity(pid, budget);
+  }
+  const identity = await resolveProcessStartIdentityFromCommands(buildProcessStartIdentityCommands(pid, platform), (command) => executeProcessStartIdentityCommand(command, budget));
+  return identity === void 0 || platform === "win32" ? identity : `${POSIX_PROCESS_START_IDENTITY_PREFIX}${identity}`;
 }
 function identityBudgetExpired(budget) {
-  return budget?.signal?.aborted === true || budget?.deadline !== void 0 && Date.now() >= budget.deadline;
+  return budget?.signal?.aborted === true || budget?.deadline !== void 0 && performance.now() >= budget.deadline;
 }
 async function readProcessStartIdentity(pid, platform = process.platform, budget) {
   if (identityBudgetExpired(budget)) {
+    debugIdentityBudget(budget);
     return void 0;
   }
   if (pid !== process.pid || platform !== process.platform) {
@@ -2022,6 +2144,10 @@ async function readCachedProcessStartIdentity(pid, platform) {
   return await currentProcessStartIdentityPromise;
 }
 function processStartIdentitiesMatch(recorded, current) {
+  const format = PROCESS_START_IDENTITY_FORMATS.find((prefix) => current.startsWith(prefix));
+  if (format === void 0 || !recorded.startsWith(format)) {
+    return void 0;
+  }
   return recorded === current;
 }
 
@@ -2088,7 +2214,7 @@ function validOwnershipAndChildren(value) {
 }
 async function readTempRootOwnershipMarker(tempRoot) {
   try {
-    const markerText = await readFile(join2(tempRoot, TEMP_ROOT_MARKER_FILE_NAME), "utf8");
+    const markerText = await readFile2(join2(tempRoot, TEMP_ROOT_MARKER_FILE_NAME), "utf8");
     const parsed = JSON.parse(markerText);
     return isTempRootOwnershipRecord(parsed) ? parsed : void 0;
   } catch {
@@ -2172,7 +2298,7 @@ async function refreshSecureTempRootLease(tempRoot) {
   const currentProcessStartIdentity2 = await getProcessStartIdentity(process.pid);
   if (ownershipMarker.ownerProcessStartIdentity !== void 0 && currentProcessStartIdentity2 !== void 0) {
     const identitiesMatch = processStartIdentitiesMatch(ownershipMarker.ownerProcessStartIdentity, currentProcessStartIdentity2);
-    if (!identitiesMatch) {
+    if (identitiesMatch !== true) {
       return;
     }
   }
@@ -2207,6 +2333,9 @@ async function getMarkerOwnerLiveness(ownershipMarker) {
     return "unknown";
   }
   const identitiesMatch = processStartIdentitiesMatch(ownershipMarker.ownerProcessStartIdentity, currentProcessStartIdentity2);
+  if (identitiesMatch === void 0) {
+    return "unknown";
+  }
   return identitiesMatch ? "alive" : "dead";
 }