pi-chrome 0.15.53 → 0.15.55

package/extensions/chrome-profile-bridge/index.ts

@@ -1,7 +1,8 @@
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 import { existsSync, readFileSync, statSync } from "node:fs";
-import { mkdir, writeFile } from "node:fs/promises";
+import { mkdir, readdir, unlink, writeFile } from "node:fs/promises";
 import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
 import { dirname, join, resolve } from "node:path";
 
@@ -236,6 +237,58 @@ function formatCdpResult(method: string, value: unknown): ToolTextResult {
 	return { content: [{ type: "text", text: truncateText(text) }], details: { value } };
 }
 
+// chrome_screenshot writes a timestamped file per capture (plus -tileN files and a .json manifest for
+// full-page captures) into .pi/chrome-screenshots. Prune that folder at capture time so it stays
+// bounded. Only files matching the tool's own naming are eligible; the newest `keep` captures are always
+// kept, and nothing inside the retention window is removed. Best-effort: errors never fail a capture.
+const SCREENSHOT_NAME_RE = /^(\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z)(?:-tile\d+)?\.(?:png|jpeg)(?:\.json)?$/;
+const SCREENSHOT_KEEP_NEWEST = 20;
+const SCREENSHOT_RETENTION_DAYS = 7;
+
+function screenshotCaptureTime(stamp: string): number {
+	const iso = stamp.replace(/^(\d{4}-\d{2}-\d{2}T\d{2})-(\d{2})-(\d{2})-(\d{3})Z$/, "$1:$2:$3.$4Z");
+	return Date.parse(iso);
+}
+
+function screenshotFilesToPrune(names: string[], now: number, retentionDays = SCREENSHOT_RETENTION_DAYS, keep = SCREENSHOT_KEEP_NEWEST): string[] {
+	if (!(retentionDays > 0)) return [];
+	const captures = new Map<string, string[]>();
+	for (const name of names) {
+		const match = SCREENSHOT_NAME_RE.exec(name);
+		if (!match) continue;
+		const files = captures.get(match[1]) ?? [];
+		files.push(name);
+		captures.set(match[1], files);
+	}
+	const cutoff = now - retentionDays * 24 * 60 * 60 * 1000;
+	const newestFirst = [...captures.keys()].sort().reverse();
+	const prune: string[] = [];
+	for (const stamp of newestFirst.slice(keep)) {
+		const takenAt = screenshotCaptureTime(stamp);
+		if (Number.isFinite(takenAt) && takenAt < cutoff) prune.push(...(captures.get(stamp) ?? []));
+	}
+	return prune;
+}
+
+async function pruneScreenshotDir(dir: string, retentionDays?: number): Promise<number> {
+	try {
+		const names = await readdir(dir);
+		let removed = 0;
+		for (const name of screenshotFilesToPrune(names, Date.now(), retentionDays)) {
+			try {
+				await unlink(join(dir, name));
+				removed++;
+			} catch {
+				// Locked or already gone: keep going.
+			}
+		}
+		return removed;
+	} catch {
+		return 0;
+	}
+}
+// End screenshot pruning.
+
 function formatChromeInspect(inspect: any): string {
 	if (!inspect || typeof inspect !== "object") return safeJson(inspect);
 	const t = inspect.target || {};
@@ -749,6 +802,14 @@ const CHROME_TOOL_NAMES = [
 	"chrome_cdp_targets",
 ] as const;
 const CHROME_TOOL_NAME_SET = new Set<string>(CHROME_TOOL_NAMES);
+const CHROME_TOOL_CHANGE_ENTRY = "pi-chrome-tool-change";
+type ChromeToolChangeEntry = {
+	content: string;
+	action: "authorized" | "reauthorized" | "revoked" | "expired";
+	tools: string[];
+	authorizedUntil?: number | "indefinite";
+	at: number;
+};
 
 function StringEnum<T extends readonly [string, ...string[]]>(values: T) {
 	return Type.Union(values.map((value) => Type.Literal(value)) as [ReturnType<typeof Type.Literal>, ...ReturnType<typeof Type.Literal>[]]);
@@ -838,17 +899,15 @@ export default function (pi: ExtensionAPI): void {
 				: action === "expired"
 					? "Chrome tools disabled because /chrome authorize grant expired."
 					: "Chrome tools disabled by /chrome revoke.";
-		pi.sendMessage({
-			customType: "pi-chrome-tool-change",
+		// Session-history log only (custom entry, not sent to the model). The model already learns about
+		// the change from pi's tool/prompt-section delta, so a model-facing message would be redundant.
+		pi.appendEntry<ChromeToolChangeEntry>(CHROME_TOOL_CHANGE_ENTRY, {
 			content,
-			display: true,
-			details: {
-				action,
-				tools: [...CHROME_TOOL_NAMES],
-				authorizedUntil: options.authorizedUntil,
-				at: Date.now(),
-			},
-		}, { triggerTurn: false });
+			action,
+			tools: [...CHROME_TOOL_NAMES],
+			authorizedUntil: options.authorizedUntil,
+			at: Date.now(),
+		});
 	};
 
 	// Bound the entire request, including shared-owner forwarding/takeover. Revoke can launch
@@ -1036,6 +1095,12 @@ export default function (pi: ExtensionAPI): void {
 		updateChromeStatus(ctx);
 	});
 
+	// Render authorization log entries in the transcript. Custom entries never reach the model.
+	pi.registerEntryRenderer?.<ChromeToolChangeEntry>(CHROME_TOOL_CHANGE_ENTRY, (entry, _options, theme) => {
+		const content = entry.data?.content ?? "Chrome authorization changed.";
+		return new Text(theme.fg("dim", `[pi-chrome] ${content}`), 1, 0);
+	});
+
 	pi.on("session_shutdown", async (event) => {
 		clearAuthExpiryTimer();
 		clearCountdownInterval();
@@ -1048,13 +1113,26 @@ export default function (pi: ExtensionAPI): void {
 		}
 	});
 
+	// Contribute the primer as a named prompt section instead of returning `systemPrompt`.
+	// Returning `systemPrompt` forces a whole-prompt override, which makes pi collapse every system
+	// message into a new leading prompt each run (busting the provider prompt cache and disabling
+	// pi's append-only section/tool deltas for all extensions). Mutating `systemPromptOptions.sections`
+	// lets pi diff the section and append a small system-message delta when it appears/disappears.
 	pi.on("before_agent_start", (event) => {
-		if (!chromeToolsRegistered || !chromeControlAuthorized()) {
-			return { systemPrompt: event.systemPrompt };
+		const active = chromeToolsRegistered && chromeControlAuthorized();
+		const sections = (event as { systemPromptOptions?: { sections?: Record<string, string> } }).systemPromptOptions?.sections;
+		if (sections) {
+			if (active) sections[CHROME_PRIMER_SECTION] = CHROME_PRIMER;
+			else delete sections[CHROME_PRIMER_SECTION];
+			return undefined;
 		}
-		const primer = `
-<chrome-profile-bridge>
-Chrome control is available through the chrome_* tools via a companion Chrome extension installed in the user's normal Chrome profile. Tools target the existing signed-in profile: no remote-debug port, no throwaway profile.
+		// Legacy pi without structured prompt sections: append the primer to the rendered prompt.
+		if (!active) return undefined;
+		return { systemPrompt: `${event.systemPrompt}\n<${CHROME_PRIMER_SECTION}>\n${CHROME_PRIMER}\n</${CHROME_PRIMER_SECTION}>` };
+	});
+
+	const CHROME_PRIMER_SECTION = "chrome-profile-bridge";
+	const CHROME_PRIMER = `Chrome control is available through the chrome_* tools via a companion Chrome extension installed in the user's normal Chrome profile. Tools target the existing signed-in profile: no remote-debug port, no throwaway profile.
 
 Tab/window isolation (important):
 - pi-chrome owns a dedicated automation window/tab. When a chrome_* tool runs with no explicit target, it acts on that pi-chrome-owned target — it never reuses or overwrites the user's currently active tab. The dedicated target is created on first use and reused afterward.
@@ -1066,7 +1144,8 @@ Capability model (important):
 - Input bypasses page CSP because it is injected at browser input layer, not page JavaScript. Chrome may show the “Pi Chrome Connector started debugging this browser” banner while attached.
 - \`chrome_evaluate\` and \`chrome_snapshot\` run in MAIN world via **CDP \`Runtime.evaluate\`**, which is not subject to the page's Content-Security-Policy. They work even on strict-CSP pages (e.g. github.com, many bank/SaaS apps) that block \`'unsafe-eval'\`. \`chrome_navigate initScript\` likewise injects at document_start via CDP and bypasses CSP. \`chrome_screenshot\`, \`chrome_tab\`, and Chrome input also work under any CSP.
 - Input tools return structured details and support \`includeSnapshot=true\` on click/type/fill/key. Use the fresh snapshot to verify state instead of repeating blindly. If the action started a navigation, the snapshot waits (up to 5s) for the new page.
-- \`chrome_type\` inserts at the caret and never replaces; check its before/after report. Use \`chrome_fill\` to replace a field.
+- \`chrome_type\` never replaces: with a uid/selector it appends at the end of the field; without one it types at the current caret. Check its before/after report. Use \`chrome_fill\` to replace a field.
+- Chrome ignores real input to hidden pages (inactive tabs, minimized windows, windows behind a macOS full-screen window). Input tools report this instead of silently doing nothing; retry with background:false only when bringing the tab forward is acceptable.
 - \`chrome_cdp\` runs any raw CDP method on a tab (emulation, cookies, PDF, accessibility tree, etc.) when no dedicated chrome_* tool fits; \`chrome_cdp_targets\` diagnoses debugger/overlay conflicts.
 
 Usage rules:
@@ -1077,10 +1156,7 @@ Usage rules:
 5. \`chrome_navigate\` supports an optional \`initScript\` that runs at document_start in MAIN world for the next navigation (good for seeding localStorage or stubbing Date.now).
 6. /chrome background on (default) is a hard policy: per-call \`background=false\` cannot override it, new tabs stay inactive, and \`chrome_tab activate\` is blocked. Ask the user to run /chrome background off when they want foreground/watch mode. With background off, per-call \`background=true\` still avoids explicit focus/tab activation. Screenshots use CDP without activating background tabs; debugger failures never fall back to tab activation. Page scripts, trusted input, native prompts, and Chrome/OS behavior can still affect focus.
 7. If you hit a native file-picker or privileged browser prompt gate, tell the user; generic clicks/typing/CSP gates are handled by Chrome input.
-8. Run /chrome doctor when in doubt about connectivity or capabilities.
-</chrome-profile-bridge>`;
-		return { systemPrompt: event.systemPrompt + primer };
-	});
+8. Run /chrome doctor when in doubt about connectivity or capabilities.`;
 
 	// Shared handlers, dispatched by the unified /chrome command below.
 	const doctorHandler = async (ctx: ExtensionContext) => {
@@ -1630,7 +1706,7 @@ Usage rules:
 			selector: Type.Optional(Type.String({ description: "CSS selector to click. Prefer uid from chrome_snapshot when available." })),
 			x: Type.Optional(Type.Number({ description: "Viewport x coordinate if uid/selector is omitted." })),
 			y: Type.Optional(Type.Number({ description: "Viewport y coordinate if uid/selector is omitted." })),
-			domFallback: Type.Optional(Type.Boolean({ description: "If true (default), fall back to DOM-dispatched click if Chrome's CDP input path is blocked by another extension overlay or debugger failure." })),
+			domFallback: Type.Optional(Type.Boolean({ description: "If true (default), fall back to DOM-dispatched click if Chrome's CDP input path is blocked (extension overlay, debugger failure, or a hidden tab that ignores trusted input)." })),
 			includeSnapshot: Type.Optional(Type.Boolean({ description: "If true, include a fresh chrome_snapshot result after the click." })),
 			maxElements: Type.Optional(Type.Number({ default: MAX_ELEMENTS, description: "Max elements in the included snapshot." })),
 			targetId: Type.Optional(Type.String()),
@@ -1654,8 +1730,8 @@ Usage rules:
 		name: "chrome_type",
 		label: "Chrome Type",
 		description:
-			"Focus an optional snapshot uid or CSS selector, then type at the caret using Chrome's real input. It does NOT replace existing text: in a non-empty field the text is inserted wherever the caret lands after the focus click. Use chrome_fill (or replace=true) to replace a field's value. Contenteditables use one native text insertion; other fields use key events. Set perCharacter=true for editors needing individual keydown events. The result reports the field value before/after and insertedAt (empty|caret-end|caret-middle|replaced-selection|replaced-all), with a warning when text was spliced into existing content. Pass includeSnapshot=true to verify after typing; if the action starts a navigation, the snapshot waits (up to 5s) for it to load.",
-		promptSnippet: "Type text at the caret in Chrome (does not replace existing text; use chrome_fill or replace=true).",
+			"Type using Chrome's real input. With a snapshot uid or CSS selector, chrome_type clicks the field and moves the caret to the end, so text is appended to existing content; without one it types at the current caret of the focused element. It does NOT replace existing text. Use chrome_fill (or replace=true) to replace a field's value. Contenteditables use one native text insertion; other fields use key events. Set perCharacter=true for editors needing individual keydown events. The result reports the field value before/after and insertedAt (empty|caret-end|caret-middle|replaced-selection|replaced-all), with a warning when text was spliced into existing content. Pass includeSnapshot=true to verify after typing; if the action starts a navigation, the snapshot waits (up to 5s) for it to load.",
+		promptSnippet: "Type text in Chrome; a uid/selector target appends at the end (does not replace existing text; use chrome_fill or replace=true).",
 		parameters: Type.Object({
 			text: Type.String(),
 			uid: Type.Optional(Type.String({ description: "Stable element uid from chrome_snapshot." })),
@@ -1695,7 +1771,7 @@ Usage rules:
 			selector: Type.Optional(Type.String({ description: "CSS selector to fill if uid is omitted." })),
 			perCharacter: Type.Optional(Type.Boolean({ default: false, description: "Send individual key events even in contenteditables. Default: one native text insertion for contenteditables; key events for other fields." })),
 			submit: Type.Optional(Type.Boolean({ description: "If true, press Enter after filling." })),
-			domFallback: Type.Optional(Type.Boolean({ description: "If true (default), fall back to DOM value-setting if Chrome's CDP input path is blocked by another extension overlay or debugger failure." })),
+			domFallback: Type.Optional(Type.Boolean({ description: "If true (default), fall back to DOM value-setting if Chrome's CDP input path is blocked (extension overlay, debugger failure, or a hidden tab that ignores trusted input)." })),
 			includeSnapshot: Type.Optional(Type.Boolean({ description: "If true, include a fresh chrome_snapshot result after filling." })),
 			maxElements: Type.Optional(Type.Number({ default: MAX_ELEMENTS, description: "Max elements in the included snapshot." })),
 			targetId: Type.Optional(Type.String()),
@@ -1845,6 +1921,7 @@ Usage rules:
 			format: Type.Optional(StringEnum(imageFormatValues)),
 			quality: Type.Optional(Type.Number({ minimum: 0, maximum: 100, description: "JPEG quality 0-100." })),
 			fullPage: Type.Optional(Type.Boolean({ description: "Capture full-page tiles plus a JSON manifest. Temporarily scrolls the target page; does not activate background tabs." })),
+			retentionDays: Type.Optional(Type.Number({ minimum: 0, description: "Default-folder captures older than this many days are pruned (the newest 20 are always kept). Default 7; 0 disables pruning. Explicit paths are never pruned." })),
 			targetId: Type.Optional(Type.String()),
 			urlIncludes: Type.Optional(Type.String()),
 			titleIncludes: Type.Optional(Type.String()),
@@ -1855,8 +1932,10 @@ Usage rules:
 		async execute(_id, params, signal, _onUpdate, ctx: ExtensionContext): Promise<ToolTextResult> {
 			const format = params.format ?? "png";
 			const cwd = workspaceCwd(ctx);
-			const defaultPath = join(cwd, ".pi", "chrome-screenshots", `${new Date().toISOString().replace(/[:.]/g, "-")}.${format}`);
+			const screenshotDir = join(cwd, ".pi", "chrome-screenshots");
+			const defaultPath = join(screenshotDir, `${new Date().toISOString().replace(/[:.]/g, "-")}.${format}`);
 			const outputPath = params.path ? resolve(cwd, params.path) : defaultPath;
+			const prune = () => (params.path ? Promise.resolve(0) : pruneScreenshotDir(screenshotDir, params.retentionDays));
 			const result = (await authorizedBridgeSend("page.screenshot", params, params.fullPage ? 120_000 : DEFAULT_TIMEOUT_MS, signal)) as {
 				dataUrl?: string;
 				method?: string;
@@ -1880,6 +1959,7 @@ Usage rules:
 					manifest.push({ path: tilePath, y: tile.y });
 				}
 				await writeFile(outputPath + ".json", JSON.stringify({ width, height, viewportHeight, dpr, tiles: manifest }, null, 2));
+				await prune();
 				return {
 					content: [{ type: "text", text: `Saved ${result.tiles.length} full-page tile(s) for ${width}×${height}px page. Manifest: ${outputPath}.json` }],
 					details: { manifest: outputPath + ".json", tiles: manifest, dimensions: result.dimensions, tab: result.tab, method: result.method } as unknown as Record<string, unknown>,
@@ -1888,6 +1968,7 @@ Usage rules:
 			if (!result.dataUrl) throw new Error("Screenshot returned no dataUrl");
 			const base64 = result.dataUrl.replace(/^data:image\/(?:png|jpeg);base64,/, "");
 			await writeFile(outputPath, Buffer.from(base64, "base64"));
+			await prune();
 			return { content: [{ type: "text", text: `Saved Chrome screenshot to ${outputPath}` }], details: { path: outputPath, format, tab: result.tab, method: result.method } };
 		},
 	});
@@ -1987,12 +2068,13 @@ Usage rules:
 	pi.registerTool({
 		name: "chrome_upload_file",
 		label: "Chrome Upload File",
-		description: "Attach local files to an <input type=file> element using Chrome DevTools file-input control. Does NOT open the native file picker; works with React/Vue/Angular controlled inputs.",
+		description: "Attach local files using Chrome DevTools file-input control without opening a native file picker. Target the <input type=file>, a label/wrapper containing one, or an upload button that opens the picker (the chooser is intercepted). Selectors also search same-origin iframes. Works with React/Vue/Angular controlled inputs.",
 		promptSnippet: "Attach local files to a Chrome <input type=file> without opening the native file picker.",
 		parameters: Type.Object({
 			uid: Type.Optional(Type.String()),
 			selector: Type.Optional(Type.String()),
 			paths: Type.Array(Type.String(), { description: "Local absolute file paths to upload." }),
+			domFallback: Type.Optional(Type.Boolean({ description: "Upload buttons need a click to open the (intercepted) file chooser. If true (default) and the tab is hidden, use a page-level element.click() with a user gesture instead of trusted input. Set false to require trusted input." })),
 			targetId: Type.Optional(Type.String()),
 			urlIncludes: Type.Optional(Type.String()),
 			titleIncludes: Type.Optional(Type.String()),
@@ -2001,8 +2083,12 @@ Usage rules:
 		async execute(_id, params, signal, _onUpdate, ctx): Promise<ToolTextResult> {
 			const cwd = workspaceCwd(ctx);
 			const paths = params.paths.map((p) => resolve(cwd, p));
-			const result = await authorizedBridgeSend("page.upload", { ...params, paths }, DEFAULT_TIMEOUT_MS, signal);
-			return { content: [{ type: "text", text: `Uploaded ${paths.length} file(s) to ${params.uid ?? params.selector}` }], details: { result: result as Json } };
+			const result = (await authorizedBridgeSend("page.upload", { ...params, paths }, DEFAULT_TIMEOUT_MS, signal)) as { mode?: string; trigger?: string; inFrame?: boolean } | undefined;
+			const via = result?.mode === "file-chooser"
+				? ` via intercepted file chooser (${result.trigger === "activation-click" ? "page-level click because the tab is hidden" : "trusted click"})`
+				: "";
+			const frame = result?.inFrame ? " inside an iframe" : "";
+			return { content: [{ type: "text", text: `Uploaded ${paths.length} file(s) to ${params.uid ?? params.selector}${frame}${via}` }], details: { result: result as Json } };
 		},
 	});
 

package/package.json

@@ -1,8 +1,8 @@
 {
 	"name": "pi-chrome",
-	"version": "0.15.53",
+	"version": "0.15.55",
 	"scripts": {
-		"test": "node test-suite/unit/csp-eval.test.mjs && node test-suite/unit/automation-target.test.mjs && node test-suite/unit/session-cleanup.test.mjs && node test-suite/unit/background-policy.test.mjs && node test-suite/unit/input-reliability.test.mjs && node test-suite/unit/chrome-command.test.mjs && node test-suite/unit/bridge-resilience.test.mjs && node test-suite/unit/cdp-passthrough.test.mjs && node test-suite/unit/type-evidence.test.mjs",
+		"test": "node test-suite/unit/csp-eval.test.mjs && node test-suite/unit/automation-target.test.mjs && node test-suite/unit/session-cleanup.test.mjs && node test-suite/unit/background-policy.test.mjs && node test-suite/unit/input-reliability.test.mjs && node test-suite/unit/chrome-command.test.mjs && node test-suite/unit/bridge-resilience.test.mjs && node test-suite/unit/cdp-passthrough.test.mjs && node test-suite/unit/type-evidence.test.mjs && node test-suite/unit/hidden-input.test.mjs && node test-suite/unit/console-capture.test.mjs && node test-suite/unit/prompt-section.test.mjs",
 		"version": "node scripts/sync-manifest-version.js",
 		"prepublishOnly": "node scripts/sync-manifest-version.js"
 	},
@@ -67,12 +67,16 @@
 	},
 	"peerDependencies": {
 		"@earendil-works/pi-coding-agent": "*",
+		"@earendil-works/pi-tui": "*",
 		"typebox": "*"
 	},
 	"peerDependenciesMeta": {
 		"@earendil-works/pi-coding-agent": {
 			"optional": true
 		},
+		"@earendil-works/pi-tui": {
+			"optional": true
+		},
 		"typebox": {
 			"optional": true
 		}

package/test-suite/unit/background-policy.test.mjs

@@ -50,7 +50,7 @@ function piHarness({ session = "alpha", send } = {}) {
     formatChromeInspect: JSON.stringify, summarizeActionResult: () => "", formatIncludedSnapshotText: (_r, text) => text,
     describeTypeEvidence: () => [], formatCdpResult: (_method, value) => ({ content: [{ type: "text", text: JSON.stringify(value) }], details: { value } }),
     workspaceCwd: () => ctx.cwd, ...path,
-    mkdir: async () => {}, writeFile: async (...args) => writes.push(args),
+    mkdir: async () => {}, writeFile: async (...args) => writes.push(args), pruneScreenshotDir: async () => 0,
   };
   const registrations = indexSource.slice(indexSource.indexOf("function registerChromeTools(pi:"), indexSource.lastIndexOf("\n}"));
   vm.runInNewContext(stripTypeScriptTypes([
@@ -292,6 +292,7 @@ function workerHarness({ withWindows = true } = {}) {
     w, chrome, calls, tabs, focusedWindow: () => focusedWindow,
     cdpResult: (method) => method === "Page.captureScreenshot" ? { data: "c2NyZWVuc2hvdA==" }
       : method === "DOM.requestNode" ? { nodeId: 1 }
+      : method === "Runtime.callFunctionOn" ? { result: { type: "object", value: { tag: "INPUT", isFile: true } } }
       : { result: { type: "boolean", value: true, objectId: "file-input" } },
   };
   return h;

package/test-suite/unit/console-capture.test.mjs

@@ -0,0 +1,122 @@
+// Console capture must not trip anti-DevTools checks (issue #9) and must only touch Pi's tabs.
+// Sites detect DevTools by logging an object whose getter/toString fires when something inspects
+// it. Closed DevTools never does; our capture used to serialize every argument immediately.
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import vm from "node:vm";
+import { test } from "node:test";
+
+const workerSource = fs.readFileSync(new URL("../../extensions/chrome-profile-bridge/browser-extension/service_worker.js", import.meta.url), "utf8");
+const snapshotSource = fs.readFileSync(new URL("../../extensions/chrome-profile-bridge/browser-extension/snapshot_injected.js", import.meta.url), "utf8");
+
+function loadWorker() {
+  const navListeners = [];
+  const injected = [];
+  const noop = { addListener() {}, removeListener() {} };
+  const chrome = {
+    runtime: { id: "test", getManifest: () => ({ version: "0.0.0" }), onInstalled: noop, onStartup: noop },
+    alarms: { create() {}, onAlarm: noop }, action: { onClicked: noop },
+    webNavigation: { onCommitted: { addListener: (fn) => navListeners.push(fn) } },
+    debugger: { onDetach: noop, onEvent: noop },
+    storage: { session: { get: async () => ({}), set: async () => {} } },
+    scripting: { executeScript: async (options) => { injected.push(options); return []; } },
+    tabs: { get: async () => null },
+  };
+  const w = { chrome, console, setTimeout, clearTimeout, setInterval: () => 0, navigator: { userAgent: "unit-test" }, fetch: async () => { throw new Error("offline"); } };
+  w.self = w;
+  vm.runInNewContext(workerSource, w);
+  const commit = async (tabId, frameId = 0) => {
+    for (const fn of navListeners) await fn({ tabId, frameId, url: "https://site.test/" });
+  };
+  return { w, injected, commit };
+}
+
+// A page world whose console records native calls and a DevTools trap object.
+function pageWorld() {
+  const nativeCalls = [];
+  const trap = { tripped: 0 };
+  const page = vm.createContext({
+    console: Object.fromEntries(["debug", "log", "info", "warn", "error"].map((l) => [l, (...a) => nativeCalls.push([l, ...a])])),
+    location: { href: "https://site.test/" },
+    addEventListener() {},
+    fetch: undefined, XMLHttpRequest: undefined,
+  });
+  page.window = page;
+  page.trip = () => { trap.tripped++; };
+  vm.runInContext(`
+    var bait = { name: "bait" };
+    Object.defineProperty(bait, "id", { enumerable: true, get() { trip(); return "x"; } });
+    bait.toString = function toString() { trip(); return "bait"; };
+    var trapError = new Error("trap");
+    Object.defineProperty(trapError, "message", { get() { trip(); return "m"; } });
+    var trapRegex = /a+/g;
+    trapRegex.toString = function () { trip(); return "re"; };
+    Object.defineProperty(trapRegex, "source", { get() { trip(); return "x"; } });
+    var trapDate = new Date(0);
+    trapDate.toString = function () { trip(); return "d"; };
+  `, page);
+  return { page, trap, nativeCalls };
+}
+
+const fnSource = (name) => {
+  const start = workerSource.indexOf(`function ${name}(`);
+  let depth = 0;
+  for (let i = workerSource.indexOf("{", start); i < workerSource.length; i++) {
+    if (workerSource[i] === "{") depth++;
+    else if (workerSource[i] === "}" && --depth === 0) return workerSource.slice(start, i + 1);
+  }
+  throw new Error(`missing ${name}`);
+};
+
+for (const [label, install] of [
+  ["early capture", (page) => vm.runInContext(`(${fnSource("installEarlyCapture")})()`, page)],
+  ["post-hoc instrumentation", (page) => vm.runInContext(`${fnSource("getPiChromeState")}\n(${fnSource("installPiChromeInstrumentation")})()`, page)],
+  ["snapshot_injected instrumentation", (page) => { vm.runInContext(snapshotSource, page); }],
+]) {
+  test(`${label}: logging an object does not read it until Pi lists messages`, () => {
+    const { page, trap, nativeCalls } = pageWorld();
+    install(page);
+    if (label.startsWith("snapshot")) {
+      // snapshot_injected installs lazily through its snapshot entry point; force the install.
+      assert.equal(typeof page.__piChromeSnapshotPage, "function");
+      try { page.__piChromeSnapshotPage({}); } catch {}
+    }
+    vm.runInContext("console.log('hello', bait); console.error(new Error('boom')); console.log(trapError, trapRegex, trapDate)", page);
+    assert.equal(trap.tripped, 0, "no getter/toString fired while the page runs");
+    assert.equal(nativeCalls.length, 3, "native console still receives the calls");
+    const listed = vm.runInContext(`${fnSource("getPiChromeState")}\n${fnSource("installPiChromeInstrumentation")}\n(${fnSource("listConsoleMessages")})(false)`, page);
+    assert.equal(trap.tripped, 0, "listing does not fire page getters or toString either");
+    assert.equal(listed.count, 3);
+    assert.equal(listed.messages[0].args[0], "hello");
+    assert.deepEqual(JSON.parse(JSON.stringify(listed.messages[0].args[1])), { name: "bait", id: "[getter]", toString: "[function toString]" });
+    assert.equal(listed.messages[1].args[0].message, "boom");
+    assert.match(listed.messages[1].args[0].stack, /boom/);
+    const [err, re, date] = listed.messages[2].args;
+    assert.equal(err.message, "[getter]");
+    assert.equal(re, "/a+/g", "regex described through native getters");
+    assert.equal(date, "1970-01-01T00:00:00.000Z");
+  });
+}
+
+test("listing survives values that cannot be serialized", () => {
+  const { page } = pageWorld();
+  vm.runInContext(`(${fnSource("installEarlyCapture")})()`, page);
+  vm.runInContext("const loop = { a: [1, 2n, undefined, Symbol('s')] }; loop.self = loop; console.log(loop); console.log(new Proxy({}, { ownKeys() { throw new Error('no'); } }), new Map([[1, 2]]), function named() {})", page);
+  const listed = vm.runInContext(`${fnSource("getPiChromeState")}\n${fnSource("installPiChromeInstrumentation")}\n(${fnSource("listConsoleMessages")})(true)`, page);
+  assert.equal(listed.count, 2);
+  assert.deepEqual(JSON.parse(JSON.stringify(listed.messages[0].args[0])), { a: [1, "2n", "undefined", "Symbol(s)"], self: "[circular]" });
+  assert.deepEqual(JSON.parse(JSON.stringify(listed.messages[1].args)), ["[unserializable]", "[Map(1)]", "[function named]"]);
+  assert.equal(vm.runInContext("window.__PI_CHROME_STATE__.console.length", page), 0, "clear still empties the buffer");
+});
+
+test("early capture is injected only into tabs Pi owns or tracks", async () => {
+  const h = loadWorker();
+  await h.commit(10);
+  assert.equal(h.injected.length, 0, "a user tab is never patched");
+  vm.runInContext("automationTargets.set('s', { tabId: 11 }); sessionTabs.set('s', new Map([[12, { created: true }]]));", h.w);
+  await h.commit(11);
+  await h.commit(12);
+  await h.commit(11, 3); // subframe
+  assert.deepEqual(h.injected.map((o) => o.target.tabId), [11, 12]);
+  assert.ok(h.injected.every((o) => o.func.name === "installEarlyCapture" && o.injectImmediately === true));
+});