scalix 1.5.1 → 1.5.2

package/dist/project-index.js

@@ -205,42 +205,65 @@ async function extractSymbols(filePath, relativePath) {
     }
 }
 // Import patterns for dependency tracking
-const IMPORT_PATTERNS = [
-    // JS/TS: import { x } from './y' or import x from './y' or require('./y')
-    { ext: new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']),
-        pattern: /(?:import\s+(?:{([^}]+)}\s+from\s+|(\w+)\s+from\s+)?['"]([^'"]+)['"]|require\s*\(\s*['"]([^'"]+)['"]\s*\))/g },
-    // Python: from x import y or import x
-    { ext: new Set(['.py']),
-        pattern: /(?:from\s+([\w.]+)\s+import\s+([\w,\s*]+)|import\s+([\w.]+))/g },
-    // Go: import "x" or import ( "x" )
-    { ext: new Set(['.go']),
-        pattern: /import\s+(?:(?:\w+\s+)?"([^"]+)"|[\s\S]*?"([^"]+)")/g },
-    // Rust: use x::y
-    { ext: new Set(['.rs']),
-        pattern: /use\s+([\w:]+(?:::\{[^}]+\})?)/g },
-];
+const JS_TS_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
 function extractImports(content, relativePath, ext) {
     const imports = [];
-    for (const { ext: exts, pattern } of IMPORT_PATTERNS) {
-        if (!exts.has(ext))
-            continue;
-        const regex = new RegExp(pattern.source, pattern.flags);
+    if (JS_TS_EXTS.has(ext)) {
+        // Matches: import ... from '...'; import '...'; export ... from '...'; require('...')
+        const jsPattern = /(?:(?:import|export)\s+(?:type\s+)?(?:(?:\*\s+as\s+\w+|{([\s\S]*?)}|[\w\s,]+)\s+from\s+)?['"]([^'"]+)['"]|require\s*\(\s*['"]([^'"]+)['"]\s*\))/g;
         let match;
-        while ((match = regex.exec(content)) !== null) {
-            const modulePath = match[3] || match[4] || match[1] || match[5] || match[6] || '';
+        while ((match = jsPattern.exec(content)) !== null) {
+            const modulePath = match[2] || match[3] || '';
             if (!modulePath)
                 continue;
-            // Only track local imports (starting with . or relative paths)
             const isLocal = modulePath.startsWith('.') || modulePath.startsWith('/');
             if (!isLocal)
                 continue;
-            const importedSymbols = (match[1] || match[2] || '').split(',').map((s) => s.trim().split(/\s+as\s+/)[0]).filter(Boolean);
+            const symbolsRaw = match[1] || '';
+            const symbols = symbolsRaw
+                ? symbolsRaw.split(',').map((s) => s.trim().replace(/^type\s+/, '').split(/\s+as\s+/)[0].trim()).filter(Boolean)
+                : [];
             imports.push({
                 from: relativePath,
                 to: modulePath,
-                symbols: importedSymbols,
+                symbols,
             });
         }
+        return imports;
+    }
+    if (ext === '.py') {
+        const pyPattern = /(?:from\s+([\w.]+)\s+import\s+([\w,\s*]+)|import\s+([\w.]+))/g;
+        let match;
+        while ((match = pyPattern.exec(content)) !== null) {
+            const modulePath = match[1] || match[3] || '';
+            if (!modulePath || !modulePath.startsWith('.'))
+                continue;
+            const symbols = (match[2] || '').split(',').map((s) => s.trim()).filter(Boolean);
+            imports.push({ from: relativePath, to: modulePath, symbols });
+        }
+        return imports;
+    }
+    if (ext === '.go') {
+        const goPattern = /import\s+(?:(?:\w+\s+)?"([^"]+)"|[\s\S]*?"([^"]+)")/g;
+        let match;
+        while ((match = goPattern.exec(content)) !== null) {
+            const modulePath = match[1] || match[2] || '';
+            if (!modulePath || (!modulePath.startsWith('.') && !modulePath.startsWith('/')))
+                continue;
+            imports.push({ from: relativePath, to: modulePath, symbols: [] });
+        }
+        return imports;
+    }
+    if (ext === '.rs') {
+        const rsPattern = /use\s+((?:crate|super|self)::[\w:]+(?:::\{[^}]+\})?)/g;
+        let match;
+        while ((match = rsPattern.exec(content)) !== null) {
+            const modulePath = match[1] || '';
+            if (!modulePath)
+                continue;
+            imports.push({ from: relativePath, to: modulePath, symbols: [] });
+        }
+        return imports;
     }
     return imports;
 }

package/dist/sandbox.js

@@ -15,8 +15,15 @@ function normalizeSep(p) {
     return process.platform === 'win32' ? p.replace(/\//g, '\\') : p;
 }
 export function isWithinRoot(p, root) {
-    const np = normalizeSep(p).toLowerCase();
-    const nr = normalizeSep(root).toLowerCase();
+    // Case-fold only where the filesystem does. Folding on Linux made
+    // `/srv/Secret/x` test as inside `/srv/secret` — two genuinely different
+    // directories — which is an escape, not a convenience. macOS is usually
+    // case-insensitive but can be formatted otherwise; comparing exactly there
+    // can only reject a path that is really inside the root, which fails closed,
+    // and callers realpath first so the on-disk casing already agrees.
+    const fold = (s) => (IS_WINDOWS ? s.toLowerCase() : s);
+    const np = fold(normalizeSep(p));
+    const nr = fold(normalizeSep(root));
     return np === nr || np.startsWith(nr + path.sep);
 }
 // Resolve symlinks on the longest existing prefix of `resolved` synchronously.
@@ -83,24 +90,44 @@ export function sandboxPath(filePath) {
     }
     return real;
 }
+// Async twin of realpathLongestExistingPrefix.
+async function realpathLongestExistingPrefixAsync(resolved) {
+    let existing = resolved;
+    const remainder = [];
+    while (true) {
+        try {
+            // fs/promises has no realpath.native, so strip the prefix defensively.
+            const real = stripExtendedLengthPrefix(await fs.realpath(existing));
+            return remainder.length > 0 ? path.join(real, ...remainder) : real;
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                throw err;
+            const parent = path.dirname(existing);
+            if (parent === existing)
+                return resolved;
+            remainder.unshift(path.basename(existing));
+            existing = parent;
+        }
+    }
+}
 export async function sandboxPathAsync(filePath) {
     const root = getSandboxRoot();
     const resolved = path.resolve(root, filePath);
     if (!isWithinRoot(resolved, root)) {
         throw new Error(`Path traversal blocked: "${filePath}" resolves outside working directory`);
     }
-    try {
-        const real = await fs.realpath(resolved);
-        if (!isWithinRoot(real, realSandboxRoot(root))) {
-            throw new Error(`Symlink traversal blocked: "${filePath}" resolves to "${real}" outside working directory`);
-        }
-        return real;
-    }
-    catch (err) {
-        if (err.code === 'ENOENT')
-            return resolved;
-        throw err;
+    // The path usually does NOT exist yet — every write of a new file lands here.
+    // Returning `resolved` unchecked on ENOENT was the hole: only the leaf has to
+    // be missing for the check to be skipped, so `<root>/link/new.txt`, where
+    // `link` is a symlink to /etc, wrote straight out of the sandbox. Resolve the
+    // longest ancestor that does exist and verify containment on that, exactly as
+    // the sync path already does.
+    const real = await realpathLongestExistingPrefixAsync(resolved);
+    if (!isWithinRoot(real, realSandboxRoot(root))) {
+        throw new Error(`Symlink traversal blocked: "${filePath}" resolves to "${real}" outside working directory`);
     }
+    return real;
 }
 let _scopedRules = [];
 export function setScopedPermissionRules(rules) {
@@ -115,6 +142,12 @@ function parseScopedToolSpec(spec) {
         return { tool: match[1], prefix: match[2].replace(/\*$/, '') };
     return { tool: spec };
 }
+// A prefix rule describes the command it names, not everything that can be
+// stapled onto it. `run_command(git *)` was matching `git status; curl x | sh`
+// with a plain startsWith, so one allow rule for a read-only command handed
+// over arbitrary execution. Anything here means the text after the prefix is no
+// longer the command the rule was written about.
+const SHELL_CHAINING_RE = /[;&|<>\n\r`]|\$\(/;
 export function checkScopedPermission(toolName, args) {
     if (_scopedRules.length === 0)
         return null;
@@ -125,17 +158,40 @@ export function checkScopedPermission(toolName, args) {
             continue;
         if (parsed.tool !== toolName)
             continue;
-        if (!parsed.prefix)
-            return rule.action;
-        if (argStr && argStr.startsWith(parsed.prefix))
-            return rule.action;
+        const deny = rule.action === 'deny';
+        // deny is an OR over its conditions, allow is an AND. Both directions round
+        // toward refusing: a deny rule fires if anything it names matches, and an
+        // allow rule fires only if everything it names matches. Previously both
+        // were an OR that `prefix`-less rules short-circuited past entirely, so
+        // `{tool:'run_command', regex:'^git status$', action:'allow'}` allowed
+        // every command the tool could run — the regex was never consulted.
+        let prefixHit = null;
+        if (parsed.prefix) {
+            prefixHit = !!argStr && argStr.startsWith(parsed.prefix);
+            // Only allow rules need the chaining check; a deny that matched should
+            // keep matching however the command continues.
+            if (prefixHit && !deny && toolName === 'run_command'
+                && SHELL_CHAINING_RE.test(argStr.slice(parsed.prefix.length))) {
+                prefixHit = false;
+            }
+        }
+        let regexHit = null;
         if (rule.regex) {
             try {
-                if (new RegExp(rule.regex).test(argStr || ''))
-                    return rule.action;
+                regexHit = new RegExp(rule.regex).test(argStr || '');
+            }
+            catch {
+                // An unparseable pattern is a config error. Honouring it as a match on
+                // a deny rule over-blocks; ignoring it on an allow rule under-permits.
+                regexHit = deny;
             }
-            catch { }
         }
+        const conditions = [prefixHit, regexHit].filter((c) => c !== null);
+        const matched = conditions.length === 0
+            ? true // bare `run_command` — the whole tool
+            : deny ? conditions.some(Boolean) : conditions.every(Boolean);
+        if (matched)
+            return rule.action;
     }
     return null;
 }
@@ -264,11 +320,16 @@ export function getToolPermission(toolName, mode) {
 }
 export function getToolPermissionWithArgs(toolName, mode, args) {
     const scoped = checkScopedPermission(toolName, args);
-    if (scoped === 'allow')
-        return 'allow';
     if (scoped === 'deny')
         return 'block';
-    return getToolPermission(toolName, mode);
+    const base = getToolPermission(toolName, mode);
+    // A scoped allow skips the confirmation prompt; it does not widen the mode.
+    // Returning 'allow' unconditionally let a saved `run_command(...)` rule run
+    // commands in plan mode — the one mode whose entire promise is that nothing
+    // executes. Rules earn 'ask' → 'allow', never 'block' → 'allow'.
+    if (scoped === 'allow')
+        return base === 'block' ? 'block' : 'allow';
+    return base;
 }
 export function isDangerousTool(toolName) {
     const sets = getEffectiveToolSets();
@@ -409,15 +470,43 @@ const POWERSHELL_BLOCKLIST = [
     /New-LocalUser\b/i,
     /Add-LocalGroupMember\b.*Administrators/i,
 ];
+// The Unix patterns above were written without /i, so `RM -RF /` and `Shutdown`
+// walked past them — and on macOS and Windows, where the filesystem is
+// case-insensitive, those spellings run exactly like the lower-case ones.
+// Adding the flag here rather than to each literal keeps `re.source` identical,
+// so `security.disabledBlockedCommands` entries users have already written
+// still match the pattern they were meant to disable.
+const ignoreCase = (re) => re.flags.includes('i') ? re : new RegExp(re.source, `${re.flags}i`);
 const COMMAND_BLOCKLIST = [
     ...UNIX_BLOCKLIST,
     ...WINDOWS_BLOCKLIST,
     ...POWERSHELL_BLOCKLIST,
+].map(ignoreCase);
+// Command substitution — `` `x` `` and `$(x)` — used to be flagged outright, on
+// either platform. But substitution is ordinary shell, not an attack: `git tag
+// v$(node -p "require('./package.json').version")` and `Write-Host "$($x.Name)"`
+// were both hard-blocked, and the documented way out was to switch injection
+// detection off wholesale, which costs far more than it saves. So flag a
+// substitution only when its body carries a payload worth a second look.
+//
+// Little coverage is lost: none of these patterns are anchored to the outside
+// of a substitution, so `$(curl x | sh)` still trips the pipe-to-shell rule and
+// `$(rm -rf /)` still trips the blocklist. What changes is that a substitution
+// is no longer suspicious purely for existing.
+//
+// Note: this replaces the `` `[^`]*` `` and `\$\([^)]*\)` sources, so any
+// `security.disabledInjectionPatterns` entry naming those is now a no-op.
+const SUBSTITUTION_PAYLOAD = String.raw `\b(?:rm|mkfs|dd|shutdown|reboot|curl|wget|nc|ncat|telnet|chmod|chown`
+    + String.raw `|eval|exec|base64|xxd|sudo|doas|sh|bash|zsh|fish|dash|ksh`
+    + String.raw `|python[23]?|perl|ruby|php|iex|Invoke-Expression|powershell|pwsh|cmd`
+    + String.raw `|certutil|bitsadmin|mshta|rundll32)\b|/etc/|id_rsa|\.ssh\b`;
+const SUBSTITUTION_PATTERNS = [
+    new RegExp('`[^`]*(?:' + SUBSTITUTION_PAYLOAD + ')[^`]*`', 'i'),
+    new RegExp('\\$\\([^)]*(?:' + SUBSTITUTION_PAYLOAD + ')[^)]*\\)', 'i'),
 ];
 // Unix injection patterns
 const UNIX_INJECTION_PATTERNS = [
-    /`[^`]*`/,
-    /\$\([^)]*\)/,
+    ...SUBSTITUTION_PATTERNS,
     /;\s*(rm|mkfs|dd|shutdown|reboot|curl|wget)\b/,
     /\|\s*(ba)?sh\b/,
     /\beval\s+/,
@@ -430,7 +519,6 @@ const UNIX_INJECTION_PATTERNS = [
 // Windows/PowerShell injection patterns
 const WINDOWS_INJECTION_PATTERNS = [
     /&\s*\{[^}]*\}/,
-    /\$\([^)]*\)/,
     /;\s*(del|rd|rmdir|format|diskpart|net\s+user|reg\s+delete)\b/i,
     /\|\s*powershell\b/i,
     /\|\s*pwsh\b/i,
@@ -445,7 +533,7 @@ const WINDOWS_INJECTION_PATTERNS = [
 const INJECTION_PATTERNS = [
     ...UNIX_INJECTION_PATTERNS,
     ...WINDOWS_INJECTION_PATTERNS,
-];
+].map(ignoreCase);
 const SENSITIVE_ENV_PATTERNS = [
     /API_KEY/i, /SECRET/i, /TOKEN/i, /PASSWORD/i, /CREDENTIAL/i, /AUTH/i, /PRIVATE/i,
     // Broad substrings that commonly carry secrets or connection strings.

package/dist/sessions.js

@@ -92,6 +92,18 @@ export async function listSessions() {
     }
     return sessions.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
 }
+export async function renameSession(id, newName) {
+    const session = await loadSession(id);
+    const trimmed = newName.trim();
+    if (trimmed) {
+        session.meta.name = trimmed;
+        session.meta.updatedAt = new Date().toISOString();
+    }
+    const tmpPath = path.join(SESSIONS_DIR, `scalix-session-${id}-${Date.now()}-${randomUUID().slice(0, 8)}.tmp`);
+    await fs.writeFile(tmpPath, JSON.stringify(session, null, 2), { encoding: 'utf-8', mode: 0o600 });
+    await fs.rename(tmpPath, sessionPath(id));
+    return session.meta;
+}
 export async function deleteSession(id) {
     try {
         await fs.unlink(sessionPath(id));

package/dist/slash-commands.js

@@ -16,16 +16,19 @@ export const SLASH_COMMANDS = [
     { cmd: '/mode', desc: 'Permission mode (plan/default/auto/yolo)' },
     { cmd: '/thinking', desc: 'Thinking mode (off/low/medium/high)' },
     { cmd: '/plan', desc: 'Enter plan mode (read-only)' },
+    { cmd: '/preset', desc: 'Set agent preset (persona)' },
     { cmd: '/compact', desc: 'Compress conversation context' },
     { cmd: '/context', desc: 'Show context usage & token count' },
     { cmd: '/cost', desc: 'Show token usage & cost' },
     { cmd: '/diff', desc: 'Show uncommitted changes' },
     { cmd: '/copy', desc: 'Copy last response to clipboard' },
     { cmd: '/save', desc: 'Save current session' },
+    { cmd: '/rename', desc: 'Rename current chat session' },
     { cmd: '/load', desc: 'Resume a saved session' },
     { cmd: '/resume', desc: 'Resume from crash recovery or saved session' },
     { cmd: '/fork', desc: 'Fork conversation from a point in history' },
     { cmd: '/export', desc: 'Export conversation as text' },
+    { cmd: '/feedback', desc: 'Submit user feedback & ratings' },
     { cmd: '/index', desc: 'Scan & index project files' },
     { cmd: '/init', desc: 'Initialize project config (SCALIX.md)' },
     { cmd: '/git', desc: 'Show git context' },
@@ -69,6 +72,7 @@ export const HELP_LINES = [
     '  /shortcuts    \u2014 keyboard shortcuts',
     '  /clear        \u2014 reset conversation',
     '  /save [name]  \u2014 save current session',
+    '  /rename [name]\u2014 rename current session',
     '  /load         \u2014 resume a saved session',
     '  /resume       \u2014 resume from crash recovery or saved session',
     '  /fork         \u2014 fork conversation from a point in history',
@@ -81,6 +85,7 @@ export const HELP_LINES = [
     '  /mode [m]     \u2014 permission mode (plan/default/auto/yolo)',
     '  /thinking [m] \u2014 thinking mode (off/low/medium/high)',
     '  /plan         \u2014 enter plan mode (read-only)',
+    '  /preset [p]   \u2014 set agent preset (cloud-architect/dba/devops/full-access)',
     '',
     'Context & Cost:',
     '  /compact      \u2014 compress conversation context',
@@ -109,6 +114,7 @@ export const HELP_LINES = [
     '',
     'Tools & Config:',
     '  /copy         \u2014 copy last response to clipboard',
+    '  /feedback [m] \u2014 submit user feedback',
     '  /cloud        \u2014 Scalix Cloud status (/cloud tools, /cloud refresh)',
     '  /login        \u2014 link your Scalix account (API key)',
     '  /status       \u2014 show version, model & connection info',

package/dist/sub-agent.js

@@ -1,6 +1,7 @@
 import { createAgent } from './agent.js';
 import { defaultTools } from './tools.js';
 import { extraTools } from './tools-extra.js';
+import { memoryTools } from './tools-memory.js';
 import { webTools } from './tools-web.js';
 import { advancedTools } from './tools-advanced.js';
 import { logger } from './logger.js';
@@ -15,10 +16,10 @@ import { createWorktree, removeWorktree, mergeWorktree } from './worktree.js';
 const READ_ONLY_TOOL_NAMES = new Set([
     'get_current_time', 'calculate', 'read_file', 'read_file_lines',
     'list_files', 'search_files', 'find_files', 'tree',
-    'git_status', 'git_diff', 'web_search', 'monitor',
+    'git_status', 'git_diff', 'web_search', 'monitor', 'get_memory',
 ]);
 function selectTools(level, allowAgentTool = false) {
-    const all = [...defaultTools, ...extraTools, ...webTools, ...advancedTools]
+    const all = [...defaultTools, ...extraTools, ...memoryTools, ...webTools, ...advancedTools]
         .filter((t) => {
         const name = t.function?.name || t.name;
         if (name === 'agent' && !allowAgentTool)

package/dist/tools-browser.js

@@ -4,9 +4,11 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { sandboxPath, getSandboxRoot } from './sandbox.js';
 import { isPrivateHost } from './constants.js';
+import { checkLocalAccess, isLocalOriginApproved } from './browser-access.js';
 import { encodeImageToDataUrl } from './tools-vision.js';
-// Validate a navigation target before handing it to Playwright: http/https only
-// and never a localhost/private-network host (defeats browser-based SSRF).
+// Validate a navigation target's shape before handing it to Playwright:
+// http/https only. Whether a *local* target is reachable is a separate,
+// user-answerable question — see checkLocalAccess in browser-access.ts.
 // Returns an error string when the URL must be rejected, otherwise null.
 function validateNavigationUrl(rawUrl) {
     let parsed;
@@ -19,18 +21,17 @@ function validateNavigationUrl(rawUrl) {
     if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
         return `Blocked: only http/https URLs are allowed (got ${parsed.protocol})`;
     }
-    if (isPrivateHost(parsed.hostname)) {
-        return 'Blocked: navigation to localhost and private networks is not allowed';
-    }
     return null;
 }
 // Re-check the URL a page actually landed on (post-redirect) and reject when it
-// resolved to a private host.
+// resolved to a private host the user has not cleared. A redirect is not a
+// moment to interrupt with a prompt, so an unapproved local origin is simply
+// refused here — the model can navigate to it directly and be asked properly.
 function validateResolvedUrl(rawUrl) {
     try {
         const parsed = new URL(rawUrl);
         if (parsed.protocol === 'http:' || parsed.protocol === 'https:') {
-            if (isPrivateHost(parsed.hostname)) {
+            if (isPrivateHost(parsed.hostname) && !isLocalOriginApproved(rawUrl)) {
                 return 'Blocked: navigation redirected to a private network address';
             }
         }
@@ -40,6 +41,27 @@ function validateResolvedUrl(rawUrl) {
     }
     return null;
 }
+let frameSink = null;
+/** Front ends that can display the agent's browser register here. */
+export function setBrowserFrameSink(fn) {
+    frameSink = fn;
+}
+// Capture is best-effort and must never turn a working action into a failed
+// one: a page that navigated away mid-shot is a missing frame, not an error.
+async function emitFrame(page, action) {
+    if (!frameSink)
+        return;
+    try {
+        const buf = await page.screenshot({ type: 'jpeg', quality: 55 });
+        frameSink({
+            action,
+            url: page.url(),
+            title: await page.title().catch(() => ''),
+            dataUrl: `data:image/jpeg;base64,${buf.toString('base64')}`,
+        });
+    }
+    catch { }
+}
 let browserInstance = null;
 let browserContext = null;
 let browserPage = null;
@@ -76,12 +98,30 @@ async function ensureBrowser() {
             browserPage = null;
         }
     }
-    browserInstance = await pw.chromium.launch({ headless: true });
-    browserContext = await browserInstance.newContext({
-        viewport: { width: 1280, height: 720 },
-    });
-    browserPage = await browserContext.newPage();
-    return { browser: browserInstance, page: browserPage };
+    try {
+        browserInstance = await pw.chromium.launch({ headless: true });
+        browserContext = await browserInstance.newContext({
+            viewport: { width: 1280, height: 720 },
+        });
+        browserPage = await browserContext.newPage();
+        return { browser: browserInstance, page: browserPage };
+    }
+    catch (err) {
+        if (browserInstance) {
+            try {
+                await browserInstance.close();
+            }
+            catch { }
+            browserInstance = null;
+        }
+        browserContext = null;
+        browserPage = null;
+        const msg = err?.message || String(err);
+        if (msg.includes('Executable doesn\'t exist') || msg.includes('playwright install') || msg.includes('chromium')) {
+            throw new Error(`Playwright browser binaries not found. Run 'npx playwright install chromium' to enable browser automation.`);
+        }
+        throw err;
+    }
 }
 export async function closeBrowser() {
     if (browserContext) {
@@ -111,6 +151,11 @@ export const browserNavigateTool = tool({
         const preCheck = validateNavigationUrl(url);
         if (preCheck)
             return { error: preCheck };
+        // localhost and the LAN need the user's say-so, once per origin per
+        // project. This is what lets the agent open the dev server it just edited.
+        const localGate = await checkLocalAccess(url);
+        if (localGate)
+            return { error: localGate };
         const session = await ensureBrowser();
         if (!session) {
             return { error: 'Playwright not available. Install it: npm install playwright && npx playwright install chromium' };
@@ -130,6 +175,7 @@ export const browserNavigateTool = tool({
                 return { error: postCheck, url: currentUrl };
             }
             const title = await session.page.title();
+            await emitFrame(session.page, `navigate ${currentUrl}`);
             return {
                 url: currentUrl,
                 title,
@@ -228,7 +274,7 @@ export const browserScreenshotTool = tool({
                         overlay.remove();
                 });
             }
-            return {
+            const shot = {
                 url: session.page.url(),
                 title: await session.page.title(),
                 path: outputPath || undefined,
@@ -236,6 +282,11 @@ export const browserScreenshotTool = tool({
                 dataUrl,
                 annotations,
             };
+            // Reuse the shot the model is about to look at rather than taking a
+            // second one — the annotated overlay is exactly what is worth showing.
+            if (frameSink)
+                frameSink({ action: 'screenshot', url: shot.url, title: shot.title, dataUrl });
+            return shot;
         }
         catch (error) {
             return { error: `Screenshot failed: ${error.message}` };
@@ -273,6 +324,7 @@ export const browserClickTool = tool({
             }
             await session.page.waitForTimeout(500);
             const target = typeof x === 'number' ? `coords:(${x},${y})` : selector || `text:"${text}"`;
+            await emitFrame(session.page, `click ${target}`);
             return { clicked: target, url: session.page.url() };
         }
         catch (error) {
@@ -323,6 +375,7 @@ export const browserMouseTool = tool({
                     await session.page.waitForTimeout(300);
                     break;
             }
+            await emitFrame(session.page, `${action} (${x},${y})`);
             return { action, x, y, url: session.page.url() };
         }
         catch (error) {
@@ -355,6 +408,7 @@ export const browserTypeTool = tool({
                 await session.page.press(selector, 'Enter');
                 await session.page.waitForTimeout(500);
             }
+            await emitFrame(session.page, `type into ${selector}`);
             return { typed: text.length > 50 ? text.slice(0, 50) + '...' : text, selector, url: session.page.url() };
         }
         catch (error) {
@@ -489,7 +543,16 @@ export const browserSessionRestoreTool = tool({
                 browserPage = null;
             }
             if (!browserInstance) {
-                browserInstance = await pw.chromium.launch({ headless: true });
+                try {
+                    browserInstance = await pw.chromium.launch({ headless: true });
+                }
+                catch (err) {
+                    const msg = err?.message || String(err);
+                    if (msg.includes('Executable doesn\'t exist') || msg.includes('playwright install') || msg.includes('chromium')) {
+                        return { error: `Session restore failed: Playwright browser binaries not found. Run 'npx playwright install chromium' to enable browser automation.` };
+                    }
+                    return { error: `Session restore failed: ${msg}` };
+                }
             }
             browserContext = await browserInstance.newContext({
                 viewport: session.viewport,
@@ -497,7 +560,11 @@ export const browserSessionRestoreTool = tool({
             });
             browserPage = await browserContext.newPage();
             if (session.url && session.url !== 'about:blank') {
-                const preCheck = validateNavigationUrl(session.url);
+                const preCheck = validateNavigationUrl(session.url)
+                    // A saved session is a stored URL replayed without the model naming
+                    // it, so a local target still has to clear the same consent gate as
+                    // a fresh navigation.
+                    || await checkLocalAccess(session.url);
                 if (preCheck) {
                     return { error: `Session restore blocked: saved URL rejected — ${preCheck}` };
                 }
@@ -575,6 +642,10 @@ export const browserCloseTool = tool({
         }
         catch { }
         await closeBrowser();
+        // An empty frame means "the agent's browser is gone" — the viewer keeps the
+        // last picture but stops implying it is live.
+        if (frameSink)
+            frameSink({ action: 'closed', url: '', title: '', dataUrl: '' });
         return { status: 'closed', sessionSaved: saveSession || undefined };
     },
 });

package/dist/tools-extra.js

@@ -160,9 +160,21 @@ export const searchFilesTool = tool({
                 }
             }
             // Fallback: built-in search using fast-glob + regex
-            const globPattern = fileGlob || '**/*';
-            const files = await fg(globPattern, {
-                cwd,
+            let searchCwd = cwd;
+            let targetPattern = fileGlob || '**/*';
+            if (searchPath) {
+                const safeTarget = sandboxPath(searchPath);
+                const st = await fs.stat(safeTarget).catch(() => null);
+                if (st && !st.isDirectory()) {
+                    searchCwd = path.dirname(safeTarget);
+                    targetPattern = path.basename(safeTarget);
+                }
+                else {
+                    searchCwd = safeTarget;
+                }
+            }
+            const files = await fg(targetPattern, {
+                cwd: searchCwd,
                 ignore: ['node_modules/**', '.git/**', 'dist/**', 'coverage/**', '*.lock'],
                 absolute: true,
                 onlyFiles: true,