pi-chrome 0.15.54 → 0.15.56

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable user-facing changes to `pi-chrome`.
 
+## Unreleased
+
+## 0.15.56 — 2026-09-28
+
+- **Pi's automation tab stays in its own window.** Joining the session tab group called `chrome.tabs.group` without a window. Chrome then creates the group in the current window (yours) and moves the tab there, where it sits as an inactive, hidden tab and trusted input is refused. This happened on a session's first page action and is the main source of the hidden-tab errors. New groups are now created in the tab's own window.
+- **`chrome_fill` replaces all of a multi-line textarea.** Fill selected the old value with a triple-click, which in a textarea selects only the clicked line. The rest stayed, and the tool still reported success. Inputs and textareas now select the whole value with Chrome's `selectAll` editing command before deleting. Contenteditables are unchanged.
+- **Early capture covers a new tab's first page.** `chrome_tab new` could commit its first page before the tab was recorded as Pi's, so early console/network capture skipped that load. Early capture now waits for in-flight Pi tab creations before deciding.
+
+## 0.15.55 — 2026-09-26
+
+- **Console capture no longer breaks sites with DevTools detection (#9).** Some sites (BOSS Zhipin) log an object with a getter or custom `toString` and close the tab if anything reads it, since only open DevTools would. The console capture serialized every logged argument immediately, so it tripped the check. Captured arguments are now stored as-is, and `chrome_list_console_messages` serializes them without running page code: data properties only, accessors shown as `[getter]`, and DOM nodes, regexes, dates and errors described through Chrome's native getters.
+- **Early capture only in Pi's tabs.** The document-start console/network capture used to be injected into every page you opened. It now runs only in Pi's automation tab and in tabs tracked for a Pi session. Other tabs are not touched until a Pi tool acts on them.
+- **Prompt-cache-friendly primer.** The Chrome primer is now contributed as a structured `chrome-profile-bridge` prompt section instead of a forced `systemPrompt` override. Previously the `before_agent_start` handler returned `systemPrompt` on every run (even while locked), which made pi collapse all system messages into a freshly rendered leading prompt each run. That disabled pi's append-only prompt/tool deltas for the whole session and busted the provider prompt cache when `/chrome authorize`, revoke, or expiry toggled the primer. Pi now appends a small section delta instead. Older pi versions without structured sections keep the previous append behavior.
+- **Authorization log stays out of model context.** `pi-chrome-tool-change` records (authorize, reauthorize, revoke, expiry) are now session custom entries rendered in the transcript instead of model-facing custom messages. The model already sees the change through pi's tool and prompt-section delta, so the message was redundant context.
+- **Validation.** New `prompt-section` unit suite.
+
 ## 0.15.54 — 2026-09-26
 
 - **Hidden tabs report instead of silently dropping input.** Chrome ignores trusted input to hidden pages. A page is hidden when it is an inactive tab, its window is minimized, its window is fully covered by another window, or (on macOS) its window became a hidden window tab behind a full-screen window. In a hidden page, mouse presses and keys were dropped while the tool reported success, and mouse moves could hang until a timeout (the source of `Detached while handling command` in background runs). Input tools now check page visibility first. `chrome_type`, `chrome_key`, `chrome_hover`, `chrome_scroll`, `chrome_tap` and `chrome_drag` fail fast with the reason and the options (`background:false`, or `/chrome background off`). `chrome_click` and `chrome_fill` go straight to their existing DOM fallback and report the reason, or reject with `domFallback:false`. Hard background mode is unchanged: nothing is activated or focused.

package/extensions/chrome-profile-bridge/browser-extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Pi Chrome Connector",
-  "version": "0.15.54",
+  "version": "0.15.56",
   "description": "Lets Pi control tabs in Chrome via a local connector at 127.0.0.1.",
   "permissions": [
     "tabs",

package/extensions/chrome-profile-bridge/browser-extension/service_worker.js

@@ -1232,11 +1232,16 @@ async function chromeInputFill(params) {
       await cdp(tab.id, "Input.dispatchMouseEvent", { type: "mouseReleased", x: point.x, y: point.y, button: "left", buttons: 0, clickCount: i, pointerType: "mouse" });
       await sleep(rng(20, 60));
     }
-    await contentEditableInTab(tab.id, params);
-    // Delete selection.
-    await cdp(tab.id, "Input.dispatchKeyEvent", { type: "keyDown", key: "Delete", code: "Delete", windowsVirtualKeyCode: 46 });
-    await cdp(tab.id, "Input.dispatchKeyEvent", { type: "keyUp", key: "Delete", code: "Delete", windowsVirtualKeyCode: 46 });
-    await sleep(rng(20, 60));
+    if (await contentEditableInTab(tab.id, params)) {
+      // The requested editor's whole contents are already selected; delete the selection.
+      await cdp(tab.id, "Input.dispatchKeyEvent", { type: "keyDown", key: "Delete", code: "Delete", windowsVirtualKeyCode: 46 });
+      await cdp(tab.id, "Input.dispatchKeyEvent", { type: "keyUp", key: "Delete", code: "Delete", windowsVirtualKeyCode: 46 });
+      await sleep(rng(20, 60));
+    } else {
+      // A triple-click selects only one line of a multi-line textarea. Select the whole value with
+      // Chrome's selectAll editing command before deleting.
+      await selectAllAndDelete(tab.id);
+    }
     const text = String(params.text || "");
     const typing = await typeTextInTab(tab.id, text, params.perCharacter);
     if (params.submit) await chromeInputKey({ ...params, targetId: tab.id, key: "Enter" });
@@ -1706,10 +1711,14 @@ async function groupTab(tab, title, color) {
   const groupTitle = cleanGroupTitle(title);
   let groupId = tab.groupId;
   if (typeof groupId !== "number" || groupId < 0) {
-    const existing = await findGroupByTitle(tab.windowId, groupTitle);
+    // Some browsers omit windowId on freshly created tabs; read it back instead of guessing.
+    const windowId = typeof tab.windowId === "number" ? tab.windowId : (await chrome.tabs.get(tab.id).catch(() => null))?.windowId;
+    const existing = await findGroupByTitle(windowId, groupTitle);
+    // Without createProperties.windowId Chrome creates the group in the *current* (user's) window
+    // and moves the tab there, pulling Pi's automation tab out of its own window as a hidden tab.
     groupId = existing !== null
       ? await chrome.tabs.group({ groupId: existing, tabIds: [tab.id] })
-      : await chrome.tabs.group({ tabIds: [tab.id] });
+      : await chrome.tabs.group(typeof windowId === "number" ? { tabIds: [tab.id], createProperties: { windowId } } : { tabIds: [tab.id] });
   }
   await chrome.tabGroups.update(groupId, { title: groupTitle, color: cleanGroupColor(color), collapsed: false });
   const grouped = await chrome.tabs.get(tab.id);
@@ -1743,8 +1752,20 @@ async function dispatch(action, params) {
       const existingGroup = await findGroupRecordByTitle(groupTitle);
       const createParams = { url: params.url || "about:blank", active: foregroundRequested(params) };
       if (existingGroup && typeof existingGroup.windowId === "number") createParams.windowId = existingGroup.windowId;
-      const tab = await chrome.tabs.create(createParams);
-      await trackSessionTab(sessionKeyOf(params), tab.id, true);
+      // Register the creation as in flight until the tab is tracked, so early capture (which only
+      // runs in tracked tabs) waits for it instead of skipping the new tab's first page load.
+      const creation = (async () => {
+        const created = await chrome.tabs.create(createParams);
+        await trackSessionTab(sessionKeyOf(params), created.id, true);
+        return created;
+      })();
+      pendingTabCreations.add(creation);
+      let tab;
+      try {
+        tab = await creation;
+      } finally {
+        pendingTabCreations.delete(creation);
+      }
       try {
         await bringToFront(tab, params);
         const grouped = await groupTab(tab, groupTitle, params.groupColor);
@@ -2293,14 +2314,26 @@ async function unregisterInitScript(tabId) {
   await cdp(tabId, "Page.removeScriptToEvaluateOnNewDocument", { identifier }).catch(() => undefined);
 }
 
-// Always inject early console/network capture at document_start on every navigation.
-// Catches console messages, errors, and network requests that fire during page load,
-// before chrome_snapshot or chrome_evaluate install the instrumentation normally.
-// The function installEarlyCapture sets __piChromeWrapped flags so the post-hoc
-// installPiChromeInstrumentation() call is idempotent.
+// Inject early console/network capture at document_start, but only into tabs Pi owns or has used
+// (its automation tab and tabs tracked for a session). Your other tabs are never patched. Catches
+// console messages, errors, and network requests that fire during page load, before chrome_snapshot
+// or chrome_evaluate install the instrumentation normally. installEarlyCapture sets __piChromeWrapped
+// flags so the post-hoc installPiChromeInstrumentation() call is idempotent.
+const pendingTabCreations = new Set(); // in-flight Pi tab creations, resolved once tracked
+
+async function isPiTrackedTab(tabId) {
+  await Promise.all([hydrateAutomationTargets(), hydrateSessionTabs()]);
+  // A tab Pi is creating right now can commit its first page before tab.new has tracked it.
+  if (pendingTabCreations.size) await Promise.allSettled([...pendingTabCreations]);
+  if (isPiChromeOwnedTarget(tabId)) return true;
+  for (const tabs of sessionTabs.values()) if (tabs.has(tabId)) return true;
+  return false;
+}
+
 if (chrome.webNavigation && chrome.webNavigation.onCommitted) {
-  chrome.webNavigation.onCommitted.addListener((details) => {
+  chrome.webNavigation.onCommitted.addListener(async (details) => {
     if (details.frameId !== 0) return;
+    if (!(await isPiTrackedTab(details.tabId).catch(() => false))) return;
     chrome.scripting.executeScript({
       target: { tabId: details.tabId, frameIds: [0] },
       world: "MAIN",
@@ -2592,15 +2625,9 @@ function installPiChromeInstrumentation() {
       level,
       timestamp: Date.now(),
       url: location.href,
-      args: Array.from(args).map((arg) => {
-        try {
-          if (typeof arg === "string") return arg;
-          if (arg instanceof Error) return { name: arg.name, message: arg.message, stack: arg.stack };
-          return JSON.parse(JSON.stringify(arg));
-        } catch {
-          return String(arg);
-        }
-      }),
+      // Keep the raw values and serialize only when Pi lists messages. Serializing here reads every
+      // logged object (getters, toString), which is exactly what anti-DevTools checks watch for.
+      args: Array.from(args),
     });
     if (state.console.length > 500) state.console.splice(0, state.console.length - 500);
   };
@@ -2715,15 +2742,7 @@ function installEarlyCapture() {
       level: level,
       timestamp: Date.now(),
       url: location.href,
-      args: Array.from(args).map(function(arg) {
-        try {
-          if (typeof arg === "string") return arg;
-          if (arg instanceof Error) return { name: arg.name, message: arg.message, stack: arg.stack };
-          return JSON.parse(JSON.stringify(arg));
-        } catch (e) {
-          return String(arg);
-        }
-      }),
+      args: Array.from(args), // raw; serialized on read (see listConsoleMessages)
     });
     if (state.console.length > 500) state.console.splice(0, state.console.length - 500);
   }
@@ -2917,7 +2936,7 @@ async function clickPage(selector, uid, x, y) {
       // Inspect recent console errors for activation-gate rejections.
       const recent = (state.console || []).slice(-8);
       const hit = recent.find((e) => /NotAllowedError|Document is not focused|requires transient activation|gesture is required/.test(
-        (e.args || []).map((a) => typeof a === "string" ? a : (a && a.message) || JSON.stringify(a)).join(" ")
+        (e.args || []).map((a) => typeof a === "string" ? a : a instanceof Error ? a.message : "").join(" ")
       ));
       if (hit) { suggestChromeInput = true; suggestReason = "recent console error indicates user-activation gate"; }
     }
@@ -3285,7 +3304,85 @@ async function pressKeyInPage(key) {
 function listConsoleMessages(clear) {
   installPiChromeInstrumentation();
   const state = getPiChromeState();
-  const messages = state.console.slice();
+  // Serialize without running page code. Anti-DevTools checks log objects with getters or a custom
+  // toString and treat any call as "DevTools is open" (issue #9). Copy data properties only, report
+  // accessors as "[getter]" without calling them, and describe built-ins through native getters.
+  const nativeSource = Function.prototype.toString;
+  const isNative = (fn) => { try { return typeof fn === "function" && nativeSource.call(fn).includes("[native code]"); } catch { return false; } };
+  const protoGetter = (proto, key) => { try { return Object.getOwnPropertyDescriptor(proto, key)?.get; } catch { return undefined; } };
+  const callGetter = (proto, key, value) => { const get = protoGetter(proto, key); return get ? get.call(value) : undefined; };
+  const dataProp = (value, key) => {
+    for (let obj = value, hops = 0; obj && hops < 20; obj = Object.getPrototypeOf(obj), hops++) {
+      const desc = Object.getOwnPropertyDescriptor(obj, key);
+      if (!desc) continue;
+      if ("value" in desc) return { ok: true, value: desc.value };
+      return isNative(desc.get) ? { ok: true, value: desc.get.call(value) } : { ok: false };
+    }
+    return { ok: true, value: undefined };
+  };
+  const serialize = (value, depth = 0, seen = new Set()) => {
+    try {
+      const type = typeof value;
+      if (value === null || type === "string" || type === "boolean") return value;
+      if (type === "number") return Number.isFinite(value) ? value : String(value);
+      if (type === "undefined") return "undefined";
+      if (type === "bigint") return `${BigInt.prototype.toString.call(value)}n`;
+      if (type === "symbol") return Symbol.prototype.toString.call(value);
+      if (type === "function") {
+        const name = dataProp(value, "name");
+        return `[function ${name.ok && typeof name.value === "string" && name.value ? name.value : "anonymous"}]`;
+      }
+      if (seen.has(value)) return "[circular]";
+      if (value instanceof Error) {
+        const out = {};
+        for (const key of ["name", "message"]) {
+          const prop = dataProp(value, key);
+          out[key] = prop.ok ? (typeof prop.value === "string" ? prop.value : serialize(prop.value, depth + 1, seen)) : "[getter]";
+        }
+        // V8 formats `stack` lazily from name/message, so only read it when both are plain data.
+        const stack = out.name !== "[getter]" && out.message !== "[getter]" ? dataProp(value, "stack") : { ok: false };
+        out.stack = stack.ok ? (typeof stack.value === "string" ? stack.value : undefined) : "[getter]";
+        return out;
+      }
+      if (value instanceof Date) return Date.prototype.toISOString.call(value);
+      if (value instanceof RegExp) return `/${callGetter(RegExp.prototype, "source", value)}/${callGetter(RegExp.prototype, "flags", value)}`;
+      if (typeof Node !== "undefined" && value instanceof Node) {
+        const name = String(callGetter(Node.prototype, "nodeName", value) || "node").toLowerCase();
+        if (typeof Element === "undefined" || !(value instanceof Element)) return `<${name}>`;
+        const id = callGetter(Element.prototype, "id", value);
+        const cls = String(callGetter(Element.prototype, "className", value) || "").trim().split(/\s+/).filter(Boolean).slice(0, 3);
+        return `<${name}${id ? `#${id}` : ""}${cls.map((c) => `.${c}`).join("")}>`;
+      }
+      if (value instanceof Map) return `[Map(${callGetter(Map.prototype, "size", value)})]`;
+      if (value instanceof Set) return `[Set(${callGetter(Set.prototype, "size", value)})]`;
+      if (depth >= 4) return Array.isArray(value) ? "[array]" : "[object]";
+      seen.add(value);
+      if (Array.isArray(value)) {
+        const length = dataProp(value, "length");
+        const n = length.ok ? Math.min(Number(length.value) || 0, 50) : 0;
+        const out = [];
+        for (let i = 0; i < n; i++) {
+          const item = dataProp(value, String(i));
+          out.push(item.ok ? serialize(item.value, depth + 1, seen) : "[getter]");
+        }
+        if (length.ok && length.value > 50) out.push(`[${length.value - 50} more]`);
+        seen.delete(value);
+        return out;
+      }
+      const out = {};
+      const keys = Object.keys(value);
+      for (const key of keys.slice(0, 50)) {
+        const desc = Object.getOwnPropertyDescriptor(value, key);
+        out[key] = desc && "value" in desc ? serialize(desc.value, depth + 1, seen) : "[getter]";
+      }
+      if (keys.length > 50) out["…"] = `${keys.length - 50} more keys`;
+      seen.delete(value);
+      return out;
+    } catch {
+      return "[unserializable]";
+    }
+  };
+  const messages = state.console.map((entry) => ({ ...entry, args: Array.from(entry.args || [], (arg) => serialize(arg)) }));
   if (clear) state.console = [];
   return { messages, count: messages.length };
 }

package/extensions/chrome-profile-bridge/browser-extension/snapshot_injected.js

@@ -125,15 +125,7 @@
         level,
         timestamp: Date.now(),
         url: location.href,
-        args: Array.from(args).map((arg) => {
-          try {
-            if (typeof arg === "string") return arg;
-            if (arg instanceof Error) return { name: arg.name, message: arg.message, stack: arg.stack };
-            return JSON.parse(JSON.stringify(arg));
-          } catch {
-            return String(arg);
-          }
-        }),
+        args: Array.from(args), // raw; serialized on read by listConsoleMessages
       });
       if (state.console.length > 500) state.console.splice(0, state.console.length - 500);
     };

package/extensions/chrome-profile-bridge/index.ts

@@ -1,4 +1,5 @@
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { mkdir, readdir, unlink, writeFile } from "node:fs/promises";
@@ -801,6 +802,14 @@ const CHROME_TOOL_NAMES = [
 	"chrome_cdp_targets",
 ] as const;
 const CHROME_TOOL_NAME_SET = new Set<string>(CHROME_TOOL_NAMES);
+const CHROME_TOOL_CHANGE_ENTRY = "pi-chrome-tool-change";
+type ChromeToolChangeEntry = {
+	content: string;
+	action: "authorized" | "reauthorized" | "revoked" | "expired";
+	tools: string[];
+	authorizedUntil?: number | "indefinite";
+	at: number;
+};
 
 function StringEnum<T extends readonly [string, ...string[]]>(values: T) {
 	return Type.Union(values.map((value) => Type.Literal(value)) as [ReturnType<typeof Type.Literal>, ...ReturnType<typeof Type.Literal>[]]);
@@ -890,17 +899,15 @@ export default function (pi: ExtensionAPI): void {
 				: action === "expired"
 					? "Chrome tools disabled because /chrome authorize grant expired."
 					: "Chrome tools disabled by /chrome revoke.";
-		pi.sendMessage({
-			customType: "pi-chrome-tool-change",
+		// Session-history log only (custom entry, not sent to the model). The model already learns about
+		// the change from pi's tool/prompt-section delta, so a model-facing message would be redundant.
+		pi.appendEntry<ChromeToolChangeEntry>(CHROME_TOOL_CHANGE_ENTRY, {
 			content,
-			display: true,
-			details: {
-				action,
-				tools: [...CHROME_TOOL_NAMES],
-				authorizedUntil: options.authorizedUntil,
-				at: Date.now(),
-			},
-		}, { triggerTurn: false });
+			action,
+			tools: [...CHROME_TOOL_NAMES],
+			authorizedUntil: options.authorizedUntil,
+			at: Date.now(),
+		});
 	};
 
 	// Bound the entire request, including shared-owner forwarding/takeover. Revoke can launch
@@ -1088,6 +1095,12 @@ export default function (pi: ExtensionAPI): void {
 		updateChromeStatus(ctx);
 	});
 
+	// Render authorization log entries in the transcript. Custom entries never reach the model.
+	pi.registerEntryRenderer?.<ChromeToolChangeEntry>(CHROME_TOOL_CHANGE_ENTRY, (entry, _options, theme) => {
+		const content = entry.data?.content ?? "Chrome authorization changed.";
+		return new Text(theme.fg("dim", `[pi-chrome] ${content}`), 1, 0);
+	});
+
 	pi.on("session_shutdown", async (event) => {
 		clearAuthExpiryTimer();
 		clearCountdownInterval();
@@ -1100,13 +1113,26 @@ export default function (pi: ExtensionAPI): void {
 		}
 	});
 
+	// Contribute the primer as a named prompt section instead of returning `systemPrompt`.
+	// Returning `systemPrompt` forces a whole-prompt override, which makes pi collapse every system
+	// message into a new leading prompt each run (busting the provider prompt cache and disabling
+	// pi's append-only section/tool deltas for all extensions). Mutating `systemPromptOptions.sections`
+	// lets pi diff the section and append a small system-message delta when it appears/disappears.
 	pi.on("before_agent_start", (event) => {
-		if (!chromeToolsRegistered || !chromeControlAuthorized()) {
-			return { systemPrompt: event.systemPrompt };
+		const active = chromeToolsRegistered && chromeControlAuthorized();
+		const sections = (event as { systemPromptOptions?: { sections?: Record<string, string> } }).systemPromptOptions?.sections;
+		if (sections) {
+			if (active) sections[CHROME_PRIMER_SECTION] = CHROME_PRIMER;
+			else delete sections[CHROME_PRIMER_SECTION];
+			return undefined;
 		}
-		const primer = `
-<chrome-profile-bridge>
-Chrome control is available through the chrome_* tools via a companion Chrome extension installed in the user's normal Chrome profile. Tools target the existing signed-in profile: no remote-debug port, no throwaway profile.
+		// Legacy pi without structured prompt sections: append the primer to the rendered prompt.
+		if (!active) return undefined;
+		return { systemPrompt: `${event.systemPrompt}\n<${CHROME_PRIMER_SECTION}>\n${CHROME_PRIMER}\n</${CHROME_PRIMER_SECTION}>` };
+	});
+
+	const CHROME_PRIMER_SECTION = "chrome-profile-bridge";
+	const CHROME_PRIMER = `Chrome control is available through the chrome_* tools via a companion Chrome extension installed in the user's normal Chrome profile. Tools target the existing signed-in profile: no remote-debug port, no throwaway profile.
 
 Tab/window isolation (important):
 - pi-chrome owns a dedicated automation window/tab. When a chrome_* tool runs with no explicit target, it acts on that pi-chrome-owned target — it never reuses or overwrites the user's currently active tab. The dedicated target is created on first use and reused afterward.
@@ -1130,10 +1156,7 @@ Usage rules:
 5. \`chrome_navigate\` supports an optional \`initScript\` that runs at document_start in MAIN world for the next navigation (good for seeding localStorage or stubbing Date.now).
 6. /chrome background on (default) is a hard policy: per-call \`background=false\` cannot override it, new tabs stay inactive, and \`chrome_tab activate\` is blocked. Ask the user to run /chrome background off when they want foreground/watch mode. With background off, per-call \`background=true\` still avoids explicit focus/tab activation. Screenshots use CDP without activating background tabs; debugger failures never fall back to tab activation. Page scripts, trusted input, native prompts, and Chrome/OS behavior can still affect focus.
 7. If you hit a native file-picker or privileged browser prompt gate, tell the user; generic clicks/typing/CSP gates are handled by Chrome input.
-8. Run /chrome doctor when in doubt about connectivity or capabilities.
-</chrome-profile-bridge>`;
-		return { systemPrompt: event.systemPrompt + primer };
-	});
+8. Run /chrome doctor when in doubt about connectivity or capabilities.`;
 
 	// Shared handlers, dispatched by the unified /chrome command below.
 	const doctorHandler = async (ctx: ExtensionContext) => {

package/package.json

@@ -1,8 +1,8 @@
 {
 	"name": "pi-chrome",
-	"version": "0.15.54",
+	"version": "0.15.56",
 	"scripts": {
-		"test": "node test-suite/unit/csp-eval.test.mjs && node test-suite/unit/automation-target.test.mjs && node test-suite/unit/session-cleanup.test.mjs && node test-suite/unit/background-policy.test.mjs && node test-suite/unit/input-reliability.test.mjs && node test-suite/unit/chrome-command.test.mjs && node test-suite/unit/bridge-resilience.test.mjs && node test-suite/unit/cdp-passthrough.test.mjs && node test-suite/unit/type-evidence.test.mjs && node test-suite/unit/hidden-input.test.mjs",
+		"test": "node test-suite/unit/csp-eval.test.mjs && node test-suite/unit/automation-target.test.mjs && node test-suite/unit/session-cleanup.test.mjs && node test-suite/unit/background-policy.test.mjs && node test-suite/unit/input-reliability.test.mjs && node test-suite/unit/chrome-command.test.mjs && node test-suite/unit/bridge-resilience.test.mjs && node test-suite/unit/cdp-passthrough.test.mjs && node test-suite/unit/type-evidence.test.mjs && node test-suite/unit/hidden-input.test.mjs && node test-suite/unit/console-capture.test.mjs && node test-suite/unit/prompt-section.test.mjs",
 		"version": "node scripts/sync-manifest-version.js",
 		"prepublishOnly": "node scripts/sync-manifest-version.js"
 	},
@@ -67,12 +67,16 @@
 	},
 	"peerDependencies": {
 		"@earendil-works/pi-coding-agent": "*",
+		"@earendil-works/pi-tui": "*",
 		"typebox": "*"
 	},
 	"peerDependenciesMeta": {
 		"@earendil-works/pi-coding-agent": {
 			"optional": true
 		},
+		"@earendil-works/pi-tui": {
+			"optional": true
+		},
 		"typebox": {
 			"optional": true
 		}

package/test-suite/unit/automation-target.test.mjs

@@ -87,14 +87,17 @@ function makeChrome(state, { withWindows = true, withStorage = true, withTabGrou
         // Chrome closes a window automatically when its final tab is removed.
         if (tab && ![...tabs.values()].some((other) => other.windowId === tab.windowId)) windows.delete(tab.windowId);
       },
-      group: async ({ groupId, tabIds = [] } = {}) => {
+      // Like Chrome: a new group goes into createProperties.windowId, else the *current* window
+      // (the user's), and grouped tabs move into the group's window.
+      group: async ({ groupId, tabIds = [], createProperties } = {}) => {
         let gid = groupId;
         if (typeof gid !== "number") {
           gid = alloc.group();
-          const firstTab = tabs.get(tabIds[0]);
-          groups.set(gid, { id: gid, title: "", color: "grey", collapsed: false, windowId: firstTab ? firstTab.windowId : userWindowId });
+          const windowId = typeof createProperties?.windowId === "number" ? createProperties.windowId : userWindowId;
+          groups.set(gid, { id: gid, title: "", color: "grey", collapsed: false, windowId });
         }
-        for (const tid of tabIds) { const t = tabs.get(tid); if (t) t.groupId = gid; }
+        const groupWindow = groups.get(gid).windowId;
+        for (const tid of tabIds) { const t = tabs.get(tid); if (t) { t.groupId = gid; t.windowId = groupWindow; } }
         return gid;
       },
       ungroup: async (id) => { const ids = Array.isArray(id) ? id : [id]; for (const tid of ids) { const t = tabs.get(tid); if (t) t.groupId = -1; } },

package/test-suite/unit/console-capture.test.mjs

@@ -0,0 +1,141 @@
+// Console capture must not trip anti-DevTools checks (issue #9) and must only touch Pi's tabs.
+// Sites detect DevTools by logging an object whose getter/toString fires when something inspects
+// it. Closed DevTools never does; our capture used to serialize every argument immediately.
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import vm from "node:vm";
+import { test } from "node:test";
+
+const workerSource = fs.readFileSync(new URL("../../extensions/chrome-profile-bridge/browser-extension/service_worker.js", import.meta.url), "utf8");
+const snapshotSource = fs.readFileSync(new URL("../../extensions/chrome-profile-bridge/browser-extension/snapshot_injected.js", import.meta.url), "utf8");
+
+function loadWorker() {
+  const navListeners = [];
+  const injected = [];
+  const noop = { addListener() {}, removeListener() {} };
+  const chrome = {
+    runtime: { id: "test", getManifest: () => ({ version: "0.0.0" }), onInstalled: noop, onStartup: noop },
+    alarms: { create() {}, onAlarm: noop }, action: { onClicked: noop },
+    webNavigation: { onCommitted: { addListener: (fn) => navListeners.push(fn) } },
+    debugger: { onDetach: noop, onEvent: noop },
+    storage: { session: { get: async () => ({}), set: async () => {} } },
+    scripting: { executeScript: async (options) => { injected.push(options); return []; } },
+    tabs: { get: async () => null, create: async () => { throw new Error("not mocked"); } },
+    tabGroups: { query: async () => [] },
+  };
+  const w = { chrome, console, setTimeout, clearTimeout, setInterval: () => 0, navigator: { userAgent: "unit-test" }, fetch: async () => { throw new Error("offline"); } };
+  w.self = w;
+  vm.runInNewContext(workerSource, w);
+  const commit = async (tabId, frameId = 0) => {
+    for (const fn of navListeners) await fn({ tabId, frameId, url: "https://site.test/" });
+  };
+  return { w, injected, commit };
+}
+
+// A page world whose console records native calls and a DevTools trap object.
+function pageWorld() {
+  const nativeCalls = [];
+  const trap = { tripped: 0 };
+  const page = vm.createContext({
+    console: Object.fromEntries(["debug", "log", "info", "warn", "error"].map((l) => [l, (...a) => nativeCalls.push([l, ...a])])),
+    location: { href: "https://site.test/" },
+    addEventListener() {},
+    fetch: undefined, XMLHttpRequest: undefined,
+  });
+  page.window = page;
+  page.trip = () => { trap.tripped++; };
+  vm.runInContext(`
+    var bait = { name: "bait" };
+    Object.defineProperty(bait, "id", { enumerable: true, get() { trip(); return "x"; } });
+    bait.toString = function toString() { trip(); return "bait"; };
+    var trapError = new Error("trap");
+    Object.defineProperty(trapError, "message", { get() { trip(); return "m"; } });
+    var trapRegex = /a+/g;
+    trapRegex.toString = function () { trip(); return "re"; };
+    Object.defineProperty(trapRegex, "source", { get() { trip(); return "x"; } });
+    var trapDate = new Date(0);
+    trapDate.toString = function () { trip(); return "d"; };
+  `, page);
+  return { page, trap, nativeCalls };
+}
+
+const fnSource = (name) => {
+  const start = workerSource.indexOf(`function ${name}(`);
+  let depth = 0;
+  for (let i = workerSource.indexOf("{", start); i < workerSource.length; i++) {
+    if (workerSource[i] === "{") depth++;
+    else if (workerSource[i] === "}" && --depth === 0) return workerSource.slice(start, i + 1);
+  }
+  throw new Error(`missing ${name}`);
+};
+
+for (const [label, install] of [
+  ["early capture", (page) => vm.runInContext(`(${fnSource("installEarlyCapture")})()`, page)],
+  ["post-hoc instrumentation", (page) => vm.runInContext(`${fnSource("getPiChromeState")}\n(${fnSource("installPiChromeInstrumentation")})()`, page)],
+  ["snapshot_injected instrumentation", (page) => { vm.runInContext(snapshotSource, page); }],
+]) {
+  test(`${label}: logging an object does not read it until Pi lists messages`, () => {
+    const { page, trap, nativeCalls } = pageWorld();
+    install(page);
+    if (label.startsWith("snapshot")) {
+      // snapshot_injected installs lazily through its snapshot entry point; force the install.
+      assert.equal(typeof page.__piChromeSnapshotPage, "function");
+      try { page.__piChromeSnapshotPage({}); } catch {}
+    }
+    vm.runInContext("console.log('hello', bait); console.error(new Error('boom')); console.log(trapError, trapRegex, trapDate)", page);
+    assert.equal(trap.tripped, 0, "no getter/toString fired while the page runs");
+    assert.equal(nativeCalls.length, 3, "native console still receives the calls");
+    const listed = vm.runInContext(`${fnSource("getPiChromeState")}\n${fnSource("installPiChromeInstrumentation")}\n(${fnSource("listConsoleMessages")})(false)`, page);
+    assert.equal(trap.tripped, 0, "listing does not fire page getters or toString either");
+    assert.equal(listed.count, 3);
+    assert.equal(listed.messages[0].args[0], "hello");
+    assert.deepEqual(JSON.parse(JSON.stringify(listed.messages[0].args[1])), { name: "bait", id: "[getter]", toString: "[function toString]" });
+    assert.equal(listed.messages[1].args[0].message, "boom");
+    assert.match(listed.messages[1].args[0].stack, /boom/);
+    const [err, re, date] = listed.messages[2].args;
+    assert.equal(err.message, "[getter]");
+    assert.equal(re, "/a+/g", "regex described through native getters");
+    assert.equal(date, "1970-01-01T00:00:00.000Z");
+  });
+}
+
+test("listing survives values that cannot be serialized", () => {
+  const { page } = pageWorld();
+  vm.runInContext(`(${fnSource("installEarlyCapture")})()`, page);
+  vm.runInContext("const loop = { a: [1, 2n, undefined, Symbol('s')] }; loop.self = loop; console.log(loop); console.log(new Proxy({}, { ownKeys() { throw new Error('no'); } }), new Map([[1, 2]]), function named() {})", page);
+  const listed = vm.runInContext(`${fnSource("getPiChromeState")}\n${fnSource("installPiChromeInstrumentation")}\n(${fnSource("listConsoleMessages")})(true)`, page);
+  assert.equal(listed.count, 2);
+  assert.deepEqual(JSON.parse(JSON.stringify(listed.messages[0].args[0])), { a: [1, "2n", "undefined", "Symbol(s)"], self: "[circular]" });
+  assert.deepEqual(JSON.parse(JSON.stringify(listed.messages[1].args)), ["[unserializable]", "[Map(1)]", "[function named]"]);
+  assert.equal(vm.runInContext("window.__PI_CHROME_STATE__.console.length", page), 0, "clear still empties the buffer");
+});
+
+test("early capture is injected only into tabs Pi owns or tracks", async () => {
+  const h = loadWorker();
+  await h.commit(10);
+  assert.equal(h.injected.length, 0, "a user tab is never patched");
+  vm.runInContext("automationTargets.set('s', { tabId: 11 }); sessionTabs.set('s', new Map([[12, { created: true }]]));", h.w);
+  await h.commit(11);
+  await h.commit(12);
+  await h.commit(11, 3); // subframe
+  assert.deepEqual(h.injected.map((o) => o.target.tabId), [11, 12]);
+  assert.ok(h.injected.every((o) => o.func.name === "installEarlyCapture" && o.injectImmediately === true));
+});
+
+test("a Pi tab whose first page commits before tab.new tracks it still gets early capture", async () => {
+  const h = loadWorker();
+  let commit;
+  h.w.chrome.tabs.create = async (props) => {
+    // Chrome can commit the first document while tab.new is still recording ownership.
+    commit = h.commit(21);
+    return { id: 21, windowId: 1, url: props.url, status: "loading" };
+  };
+  h.w.groupTab = async (tab) => ({ tab: { id: tab.id }, group: { title: "Pi" } });
+  h.w.waitForTabSettled = async () => true;
+  h.w.formatTab = async (tab) => tab;
+  await h.w.dispatch("tab.new", { url: "https://site.test/", background: true, sessionKey: "s" });
+  await commit;
+  assert.deepEqual(h.injected.map((o) => o.target.tabId), [21]);
+  await h.commit(22);
+  assert.deepEqual(h.injected.map((o) => o.target.tabId), [21], "unrelated tabs stay untouched");
+});

package/test-suite/unit/input-reliability.test.mjs

@@ -215,6 +215,18 @@ for (const perCharacter of [false, true]) {
   });
 }
 
+test("fill selects a textarea's whole value with the selectAll command, not just the clicked line", async () => {
+  const h = harness({ tag: "TEXTAREA", editable: false });
+  const result = await h.call("fill", { selector: "#target", text: "NEW", domFallback: false });
+  assert.equal(result.input, "chrome");
+  const keys = h.commands("Input.dispatchKeyEvent");
+  const selectAll = keys.findIndex((c) => (c.params.commands || []).includes("selectAll"));
+  const del = keys.findIndex((c) => c.params.key === "Delete" && c.params.type === "keyDown");
+  assert.ok(selectAll >= 0, "selectAll editing command sent");
+  assert.ok(del > selectAll, "delete follows select-all");
+  assert.equal(h.selected.length, 0, "no DOM range selection for value fields");
+});
+
 test("fill refuses to select an unrelated focused editor", async () => {
   const h = harness({ initial: "keep this" });
   h.page.document.activeElement = { isContentEditable: true, contains: () => false };

package/test-suite/unit/prompt-section.test.mjs

@@ -0,0 +1,52 @@
+// The Chrome primer must be a structured prompt section, never a forced `systemPrompt` override.
+// A forced override makes pi collapse all system messages into a new leading prompt every run,
+// which busts the provider prompt cache.
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import vm from "node:vm";
+import { stripTypeScriptTypes } from "node:module";
+import { test } from "node:test";
+
+const source = fs.readFileSync(new URL("../../extensions/chrome-profile-bridge/index.ts", import.meta.url), "utf8");
+const from = source.indexOf('pi.on("before_agent_start",');
+const to = source.indexOf("// Shared handlers,", from);
+assert.ok(from >= 0 && to > from, "Missing before_agent_start section");
+const handlerSource = stripTypeScriptTypes(source.slice(from, to));
+
+function load({ registered = true, authorized = true } = {}) {
+	let handler;
+	const pi = { on: (name, fn) => { if (name === "before_agent_start") handler = fn; } };
+	vm.runInNewContext(`${handlerSource}`, {
+		pi,
+		chromeToolsRegistered: registered,
+		chromeControlAuthorized: () => authorized,
+	});
+	return handler;
+}
+
+test("authorized: adds primer section and does not force systemPrompt", () => {
+	const event = { systemPrompt: "base", systemPromptOptions: { sections: {} } };
+	const result = load()(event);
+	assert.equal(result, undefined);
+	const primer = event.systemPromptOptions.sections["chrome-profile-bridge"];
+	assert.match(primer, /^Chrome control is available/);
+	assert.doesNotMatch(primer, /<\/?chrome-profile-bridge>/, "pi wraps sections in their tag");
+});
+
+test("locked: removes primer section and does not force systemPrompt", () => {
+	const event = { systemPrompt: "base", systemPromptOptions: { sections: { "chrome-profile-bridge": "stale", other: "keep" } } };
+	assert.equal(load({ authorized: false })(event), undefined);
+	assert.deepEqual(event.systemPromptOptions.sections, { other: "keep" });
+});
+
+test("tools not registered: no primer", () => {
+	const event = { systemPrompt: "base", systemPromptOptions: { sections: {} } };
+	assert.equal(load({ registered: false })(event), undefined);
+	assert.deepEqual(event.systemPromptOptions.sections, {});
+});
+
+test("legacy pi without sections: appends only when authorized", () => {
+	assert.equal(load({ authorized: false })({ systemPrompt: "base" }), undefined);
+	const result = load()({ systemPrompt: "base" });
+	assert.match(result.systemPrompt, /^base\n<chrome-profile-bridge>\nChrome control is available[\s\S]*<\/chrome-profile-bridge>$/);
+});