pi-lean-portal 0.2.4 → 0.3.1

package/README.md

@@ -61,7 +61,7 @@ The browser tools are **enabled by default**. You can:
 
 ## Extending it
 
-Beyond the toggle, two surfaces are user-extensible rather than hardcoded:
+Beyond the toggle, three surfaces are extensible or shared rather than hardcoded:
 
 - **Navigation guides** — `web-learn` saves site-specific playbooks that
   auto-match by domain and resurface in later sessions. See
@@ -71,6 +71,14 @@ Beyond the toggle, two surfaces are user-extensible rather than hardcoded:
   and drive a patched engine like [Camoufox](https://github.com/daijro/camoufox)
   yourself. The full flow lives in [Backend Architecture](#backend-architecture)
   and [`contributed/README.md`](./contributed/README.md).
+- **Toolset toggles** — the `/web` toggle is powered by the shared
+  [`pi-tool-masking`](https://github.com/coreyryanhanson/pi-tool-masking/) peer dep,
+  which handles active-set masking, sibling-tool union math, and the
+  `TOOLSET_EVENTS` protocol that keeps the `browser`/`search` status-bar
+  glyphs in sync across extensions. It's published as a general toggle
+  mechanism — any extension that hides/shows its own tools can build on the
+  same scheme so masking and glyph events stay consistent across the whole
+  agent, rather than each toggle reinventing its own.
 
 ---
 
@@ -265,6 +273,28 @@ HTML to Markdown. It does **not** create a browser session.
 | `pagination` | On-demand | Next buttons, infinite scroll, pages |
 | `search` | On-demand | Search boxes, comboboxes, result lists |
 
+### Overriding Built-in Guides
+
+A same-named `.md` file in `~/.pi/agent/pi-lean-portal/web-guides/` (e.g.
+`bot-detection.md`) **shadows the builtin entirely** — the whole guide is
+replaced, not field-merged. To keep a pattern guide firing, include
+`trigger.signal: botDetected` (or `dialogDetected`) in the frontmatter;
+omitting it disables the trigger.
+
+```yaml
+---
+category: pattern
+trigger.signal: botDetected
+icon: 🤖
+shortName: my bot guide
+---
+Custom guidance text for bot challenges.
+```
+
+Site guides and pattern guides live in **disjoint namespaces** — a site guide
+for `www.botdetection.com` does not collide with the `bot-detection` pattern
+guide; both fire when applicable.
+
 ### Viewing Guides
 
 ```text
@@ -661,12 +691,10 @@ When creating navigation guides with `web-learn`:
 
 ### Security
 
-- URLs are validated against private IP ranges (10.x, 172.16-31.x,
-  192.168.x, 127.x, 169.254.169.254) — localhost and internal networks
-  are blocked by default
-- Dangerous URL schemes are blocked: `file:`, `ftp:`, `data:`,
-  `javascript:`, `vbscript:`
-- Secrets in URLs are detected heuristically
+- URLs are parsed with `new URL()` as input validation — malformed
+  URLs are rejected, but no SSRF boundary is enforced (a coding agent
+  already has filesystem and shell access, so blocking localhost or
+  private IPs would be theater)
 - Profile state is stored with restricted file permissions (0700 dirs,
   0600 files)
 

package/backends/playwright-base/playwright-plugin.ts

@@ -491,7 +491,7 @@ export abstract class PlaywrightPluginBase implements BrowserPlugin {
 			);
 			// checkPage handles all three: title (challenge phrases),
 			// body (challenge phrases + CDN patterns), and HTML (CAPTCHA embeds).
-			return checkPage(title, bodyText, html).isBlocked;
+			return checkPage(title, bodyText, html);
 		} catch {
 			return false;
 		}

package/backends/python-adapter.ts

@@ -148,7 +148,7 @@ export interface QuirksDescriptor extends ResultBase {
 // ─── PythonPluginAdapter ──────────────────────────────────────────────
 
 /**
- * Adapts a Python browser backend (running the `BrowserBridge` protocol)
+ * Adapts a Python browser backend (running the `PlaywrightBridge` protocol)
  * to the TypeScript `BrowserPlugin` interface.
  */
 export class PythonPluginAdapter implements BrowserPlugin {
@@ -322,7 +322,7 @@ export class PythonPluginAdapter implements BrowserPlugin {
 					env: {
 						...process.env,
 						PYTHONUNBUFFERED: "1",
-						// Phase 0b: make the shared `pi_browser_bridge` library
+						// Make the shared `pi_browser_bridge` library
 						// importable from any venv the user points `pythonPath`
 						// at, without requiring a `pip install` of the bridge.
 						// Appended to any existing PYTHONPATH so user entries keep
@@ -418,7 +418,7 @@ export class PythonPluginAdapter implements BrowserPlugin {
 				try {
 					await this._directRpcCall("ping", {}, PING_TIMEOUT_MS);
 
-					// ── Forward plugin config to the bridge (Phase 0) ──
+					// ── Forward plugin config to the bridge ──
 					// Sent exactly once, immediately after the ping handshake and
 					// before any other RPC, so stealth subclasses can read launch
 					// options from `self.plugin_config.get("launch", {})` at

package/backends/python-base/pi_browser_bridge/__init__.py

@@ -1,10 +1,9 @@
 """
 pi_browser_bridge — Shared Python bridge library for pi-lean-portal.
-Provides BrowserBridge and PlaywrightBridge base classes for Python browser backends.
+Provides PlaywrightBridge base class for Python browser backends.
 """
 
-from .bridge import BrowserBridge, SessionNotFoundError, InvalidParamsError
-from .playwright_base import PlaywrightBridge
+from .playwright_base import PlaywrightBridge, SessionNotFoundError, InvalidParamsError
 from .accessibility import (
     AriaCachedNode,
     AriaParseResult,
@@ -16,7 +15,6 @@ from .accessibility import (
 from .bot_detection import check_bot_detection
 
 __all__ = [
-    "BrowserBridge",
     "PlaywrightBridge",
     "SessionNotFoundError",
     "InvalidParamsError",