visionclaw 0.1.192-dev.feat-virtual-card-phase2.2 → 0.1.193-beta.0

package/dist/agent/applied-credential-signature.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Applied-credential signature manifest.
+ *
+ * Persisted alongside materialised tunnel credentials at
+ * `<profileTunnelDir>/.applied-signature.json`. Records the signature
+ * the server handed us with the last bundle we successfully applied.
+ *
+ * The manifest is the *only* piece of state the agent has to remember
+ * across process restarts about credential bundles — everything else
+ * (creds JSON, config.yml) is reconstructable from a fresh server
+ * delivery. The signature is opaque to us; we just echo it back on the
+ * next heartbeat so the server can decide whether to re-ship the body.
+ *
+ * Self-healing properties (intentional):
+ *   - Manifest missing on disk → no signature sent → server sends
+ *     bundle → we re-apply and rewrite the manifest. Recovers any
+ *     install where the manifest was deleted but credentials weren't,
+ *     or vice versa.
+ *   - Manifest present but probe says no live tunnel files → we treat
+ *     the manifest as unusable (return null from `loadIfValid`), the
+ *     next heartbeat goes signature-free, the server re-ships the
+ *     bundle, and we land back in a coherent state.
+ *   - Process restart with everything intact → manifest signature is
+ *     sent on the startup heartbeat, server replies with no
+ *     `credentialBundle`, no disk writes, no tunnel restart.
+ */
+/**
+ * Read the persisted signature, if any. Returns `null` when the file
+ * does not exist, fails to parse, has the wrong shape, or refers to a
+ * tunnel state that no longer matches what's on disk.
+ *
+ * The on-disk-coherence check (`probeLocalTunnelCredential()`) is what
+ * gives us self-healing: a stranded manifest from a wiped tunnel dir
+ * gets ignored, forcing a fresh bundle on the next heartbeat.
+ */
+export declare function loadAppliedSignatureIfValid(): string | null;
+/**
+ * Persist the signature for the most recently applied bundle. Best-
+ * effort: a write failure is logged but does not throw, since the
+ * worst case is just an extra full-bundle delivery on the next
+ * heartbeat.
+ *
+ * The file is written with 0o600 to match the credentials sitting next
+ * to it; the directory itself is already 0o700 from
+ * `runtime-credentials.ts`.
+ */
+export declare function writeAppliedSignature(signature: string): void;
+/**
+ * Forget the persisted signature. Used by tests; production code never
+ * needs to delete it explicitly because writes overwrite in place.
+ */
+export declare function __clearAppliedSignatureForTests(): void;
+//# sourceMappingURL=applied-credential-signature.d.ts.map

package/dist/agent/applied-credential-signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applied-credential-signature.d.ts","sourceRoot":"","sources":["../../src/agent/applied-credential-signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAwBH;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,GAAG,IAAI,CA2C3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAgC7D;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,IAAI,IAAI,CAMtD"}

package/dist/agent/applied-credential-signature.js

@@ -0,0 +1,137 @@
+/**
+ * Applied-credential signature manifest.
+ *
+ * Persisted alongside materialised tunnel credentials at
+ * `<profileTunnelDir>/.applied-signature.json`. Records the signature
+ * the server handed us with the last bundle we successfully applied.
+ *
+ * The manifest is the *only* piece of state the agent has to remember
+ * across process restarts about credential bundles — everything else
+ * (creds JSON, config.yml) is reconstructable from a fresh server
+ * delivery. The signature is opaque to us; we just echo it back on the
+ * next heartbeat so the server can decide whether to re-ship the body.
+ *
+ * Self-healing properties (intentional):
+ *   - Manifest missing on disk → no signature sent → server sends
+ *     bundle → we re-apply and rewrite the manifest. Recovers any
+ *     install where the manifest was deleted but credentials weren't,
+ *     or vice versa.
+ *   - Manifest present but probe says no live tunnel files → we treat
+ *     the manifest as unusable (return null from `loadIfValid`), the
+ *     next heartbeat goes signature-free, the server re-ships the
+ *     bundle, and we land back in a coherent state.
+ *   - Process restart with everything intact → manifest signature is
+ *     sent on the startup heartbeat, server replies with no
+ *     `credentialBundle`, no disk writes, no tunnel restart.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { getProfileTunnelDir } from "../config/index.js";
+import { probeLocalTunnelCredential } from "./runtime-credentials.js";
+import { logger } from "../logger.js";
+const MANIFEST_FILENAME = ".applied-signature.json";
+const MANIFEST_VERSION = 1;
+function getManifestPath() {
+    return path.join(getProfileTunnelDir(), MANIFEST_FILENAME);
+}
+/**
+ * Read the persisted signature, if any. Returns `null` when the file
+ * does not exist, fails to parse, has the wrong shape, or refers to a
+ * tunnel state that no longer matches what's on disk.
+ *
+ * The on-disk-coherence check (`probeLocalTunnelCredential()`) is what
+ * gives us self-healing: a stranded manifest from a wiped tunnel dir
+ * gets ignored, forcing a fresh bundle on the next heartbeat.
+ */
+export function loadAppliedSignatureIfValid() {
+    const manifestPath = getManifestPath();
+    if (!fs.existsSync(manifestPath))
+        return null;
+    let raw;
+    try {
+        raw = fs.readFileSync(manifestPath, "utf-8");
+    }
+    catch (err) {
+        logger.warn(`Applied-signature manifest unreadable: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        logger.warn(`Applied-signature manifest malformed; ignoring`);
+        return null;
+    }
+    if (!parsed ||
+        typeof parsed !== "object" ||
+        !("signature" in parsed) ||
+        typeof parsed.signature !== "string" ||
+        parsed.signature.trim() === "") {
+        return null;
+    }
+    const signature = parsed.signature.trim();
+    // Coherence: a manifest is only meaningful when the credentials it
+    // refers to actually still exist on disk. If the tunnel files were
+    // wiped (e.g. operator deleted `~/.visionclaw/profiles/default/tunnel`)
+    // the stored signature lies about our state, so pretend we have none
+    // and let the server reissue the bundle.
+    if (probeLocalTunnelCredential() === null) {
+        return null;
+    }
+    return signature;
+}
+/**
+ * Persist the signature for the most recently applied bundle. Best-
+ * effort: a write failure is logged but does not throw, since the
+ * worst case is just an extra full-bundle delivery on the next
+ * heartbeat.
+ *
+ * The file is written with 0o600 to match the credentials sitting next
+ * to it; the directory itself is already 0o700 from
+ * `runtime-credentials.ts`.
+ */
+export function writeAppliedSignature(signature) {
+    if (typeof signature !== "string" || signature.trim() === "")
+        return;
+    const manifestPath = getManifestPath();
+    const dir = path.dirname(manifestPath);
+    try {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    catch {
+        // best-effort; the credential apply path will have created it
+    }
+    const payload = {
+        version: MANIFEST_VERSION,
+        signature: signature.trim(),
+        appliedAt: new Date().toISOString(),
+    };
+    try {
+        fs.writeFileSync(manifestPath, JSON.stringify(payload, null, 2), "utf-8");
+        if (process.platform !== "win32") {
+            try {
+                fs.chmodSync(manifestPath, 0o600);
+            }
+            catch {
+                // best-effort; directory perms still protect
+            }
+        }
+    }
+    catch (err) {
+        logger.warn(`Failed to persist applied-signature manifest: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/**
+ * Forget the persisted signature. Used by tests; production code never
+ * needs to delete it explicitly because writes overwrite in place.
+ */
+export function __clearAppliedSignatureForTests() {
+    try {
+        fs.rmSync(getManifestPath(), { force: true });
+    }
+    catch {
+        // ignore
+    }
+}
+//# sourceMappingURL=applied-credential-signature.js.map

package/dist/agent/applied-credential-signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"applied-credential-signature.js","sourceRoot":"","sources":["../../src/agent/applied-credential-signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AACpD,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAW3B,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,iBAAiB,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,0CAA0C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC7F,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IACE,CAAC,MAAM;QACP,OAAO,MAAM,KAAK,QAAQ;QAC1B,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC;QACxB,OAAQ,MAAiC,CAAC,SAAS,KAAK,QAAQ;QAC/D,MAAgC,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EACzD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAI,MAAgC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAErE,mEAAmE;IACnE,mEAAmE;IACnE,wEAAwE;IACxE,qEAAqE;IACrE,yCAAyC;IACzC,IAAI,0BAA0B,EAAE,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO;IAErE,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAEvC,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;IAED,MAAM,OAAO,GAAsB;QACjC,OAAO,EAAE,gBAAgB;QACzB,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE;QAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,6CAA6C;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,iDAAiD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B;IAC7C,IAAI,CAAC;QACH,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;AACH,CAAC"}

package/dist/agent/engines/claude/cli-resolver.d.ts

@@ -0,0 +1,16 @@
+export type ClaudeCliResolution = {
+    kind: "native";
+    path: string;
+} | {
+    kind: "legacy-cli-js";
+    path: string;
+} | {
+    kind: "sdk-default";
+};
+export declare function resolveClaudeCliExecutable(): ClaudeCliResolution;
+/** Convenience wrapper — return just the path, or `undefined` when we should
+ *  leave the option unset and let the SDK do its own lookup. */
+export declare function getClaudeExecutablePath(): string | undefined;
+/** For tests. */
+export declare function _resetClaudeCliResolverCache(): void;
+//# sourceMappingURL=cli-resolver.d.ts.map

package/dist/agent/engines/claude/cli-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-resolver.d.ts","sourceRoot":"","sources":["../../../../src/agent/engines/claude/cli-resolver.ts"],"names":[],"mappings":"AA8BA,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC;AAQ5B,wBAAgB,0BAA0B,IAAI,mBAAmB,CAIhE;AAED;gEACgE;AAChE,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,SAAS,CAG5D;AAsCD,iBAAiB;AACjB,wBAAgB,4BAA4B,IAAI,IAAI,CAEnD"}

package/dist/agent/engines/claude/cli-resolver.js

@@ -0,0 +1,83 @@
+/**
+ * Resolve the executable path that `@anthropic-ai/claude-agent-sdk` should
+ * spawn as its "Claude Code" subprocess.
+ *
+ * Why we need this:
+ *   - In 0.2.108–0.2.112 the SDK shipped a `cli.js` alongside `sdk.mjs`, and
+ *     the intended way to pin it from a bundled app was to pass
+ *     `pathToClaudeCodeExecutable` pointing at that file.
+ *   - Starting with 0.2.113 (published 2026-04-14) the SDK tarball dropped
+ *     `cli.js` entirely and switched to a platform-specific native binary
+ *     shipped via an optional peer package
+ *     `@anthropic-ai/claude-agent-sdk-<platform>-<arch>`.
+ *   - Our previous implementation hard-coded `cli.js`, so a stock
+ *     `pnpm install` that pulled the newer SDK caused the child process to
+ *     fail with `MODULE_NOT_FOUND`, which in turn surfaced as an async EPIPE
+ *     in the parent.
+ *
+ * Resolution order:
+ *   1. The native binary from `claude-agent-sdk-<platform>-<arch>/claude`
+ *      (the forward-compatible choice for 0.2.113+).
+ *   2. A legacy `cli.js` next to `sdk.mjs` (still valid for 0.2.112 and older).
+ *   3. `null`, meaning: let the SDK resolve the executable itself. Recent SDK
+ *      versions implement the same fallback chain internally and throw a
+ *      clear `ReferenceError` if nothing is found, which is much easier to
+ *      diagnose than a silent EPIPE.
+ */
+import { createRequire } from "module";
+import fs from "fs";
+import path from "path";
+/**
+ * Resolve once per process — filesystem lookups here are cheap but the result
+ * never changes for a given installation.
+ */
+let cached;
+export function resolveClaudeCliExecutable() {
+    if (cached)
+        return cached;
+    cached = doResolve();
+    return cached;
+}
+/** Convenience wrapper — return just the path, or `undefined` when we should
+ *  leave the option unset and let the SDK do its own lookup. */
+export function getClaudeExecutablePath() {
+    const r = resolveClaudeCliExecutable();
+    return r.kind === "sdk-default" ? undefined : r.path;
+}
+function doResolve() {
+    const _require = createRequire(import.meta.url);
+    // 1. Modern native binary (claude-agent-sdk >= 0.2.113).
+    const nativePkg = `@anthropic-ai/claude-agent-sdk-${process.platform}-${process.arch}`;
+    try {
+        const pkgJsonPath = _require.resolve(`${nativePkg}/package.json`);
+        const pkgDir = path.dirname(pkgJsonPath);
+        // The package ships a single executable named `claude`.
+        const candidate = path.join(pkgDir, "claude");
+        if (fs.existsSync(candidate)) {
+            return { kind: "native", path: candidate };
+        }
+    }
+    catch {
+        // Optional dep not installed — fall through to legacy cli.js.
+    }
+    // 2. Legacy JS entry (claude-agent-sdk <= 0.2.112).
+    try {
+        const sdkDir = path.dirname(_require.resolve("@anthropic-ai/claude-agent-sdk"));
+        const candidate = path.join(sdkDir, "cli.js");
+        if (fs.existsSync(candidate)) {
+            return { kind: "legacy-cli-js", path: candidate };
+        }
+    }
+    catch {
+        // No SDK at all — let the caller's catch handle this.
+    }
+    // 3. Give up and let the SDK resolve on its own. Newer versions still have
+    //    a reasonable internal lookup and will throw a clear error if nothing
+    //    works, rather than silently spawning a missing module.
+    return { kind: "sdk-default" };
+}
+/** For tests. */
+export function _resetClaudeCliResolverCache() {
+    cached = undefined;
+}
+//# sourceMappingURL=cli-resolver.js.map

package/dist/agent/engines/claude/cli-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-resolver.js","sourceRoot":"","sources":["../../../../src/agent/engines/claude/cli-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAOxB;;;GAGG;AACH,IAAI,MAAuC,CAAC;AAE5C,MAAM,UAAU,0BAA0B;IACxC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,GAAG,SAAS,EAAE,CAAC;IACrB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;gEACgE;AAChE,MAAM,UAAU,uBAAuB;IACrC,MAAM,CAAC,GAAG,0BAA0B,EAAE,CAAC;IACvC,OAAO,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEhD,yDAAyD;IACzD,MAAM,SAAS,GAAG,kCAAkC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IACvF,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,SAAS,eAAe,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACzC,wDAAwD;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;IAED,oDAAoD;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CACzB,QAAQ,CAAC,OAAO,CAAC,gCAAgC,CAAC,CACnD,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,4DAA4D;IAC5D,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AACjC,CAAC;AAED,iBAAiB;AACjB,MAAM,UAAU,4BAA4B;IAC1C,MAAM,GAAG,SAAS,CAAC;AACrB,CAAC"}

package/dist/agent/engines/claude/session-browser-policy.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Ensure Chrome is running (Playwriter mode). On the first Playwriter tool call
+ * of each turn we force a clean restart to reset stale extension connections;
+ * later calls in the same turn only ensure Chrome is up.
+ *
+ * Returns true when a connection reset was performed for this turn.
+ */
+export declare function ensurePlaywriterChrome(didResetConnectionsThisTurn: boolean): boolean;
+//# sourceMappingURL=session-browser-policy.d.ts.map

package/dist/agent/engines/claude/session-browser-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-browser-policy.d.ts","sourceRoot":"","sources":["../../../../src/agent/engines/claude/session-browser-policy.ts"],"names":[],"mappings":"AAsBA;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,2BAA2B,EAAE,OAAO,GACnC,OAAO,CAmBT"}

package/dist/agent/engines/claude/session-browser-policy.js

@@ -0,0 +1,49 @@
+import { execSync } from "node:child_process";
+import { logger } from "../../../logger.js";
+/**
+ * Force Chrome to restart once per turn before the first Playwriter tool call.
+ * This clears stale extension relay connections from earlier sessions so the
+ * Playwriter MCP sees a single fresh extension connection.
+ */
+function restartChromeForPlaywriter() {
+    try {
+        execSync("pkill -x 'Google Chrome'", { stdio: "ignore" });
+    }
+    catch {
+        // pkill exits non-zero when Chrome is not running — expected.
+    }
+    try {
+        execSync('open -a "Google Chrome"', { stdio: "ignore" });
+    }
+    catch (err) {
+        logger.warn(`Failed to restart Chrome for Playwriter: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/**
+ * Ensure Chrome is running (Playwriter mode). On the first Playwriter tool call
+ * of each turn we force a clean restart to reset stale extension connections;
+ * later calls in the same turn only ensure Chrome is up.
+ *
+ * Returns true when a connection reset was performed for this turn.
+ */
+export function ensurePlaywriterChrome(didResetConnectionsThisTurn) {
+    if (!didResetConnectionsThisTurn) {
+        logger.system("Resetting Chrome before Playwriter session");
+        restartChromeForPlaywriter();
+        return true;
+    }
+    try {
+        execSync("pgrep -x 'Google Chrome'", { stdio: "ignore" });
+    }
+    catch {
+        logger.system("Chrome not running — launching for Playwriter extension");
+        try {
+            execSync('open -a "Google Chrome"', { stdio: "ignore" });
+        }
+        catch (err) {
+            logger.warn(`Failed to launch Chrome: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=session-browser-policy.js.map

package/dist/agent/engines/claude/session-browser-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-browser-policy.js","sourceRoot":"","sources":["../../../../src/agent/engines/claude/session-browser-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C;;;;GAIG;AACH,SAAS,0BAA0B;IACjC,IAAI,CAAC;QACH,QAAQ,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;IAED,IAAI,CAAC;QACH,QAAQ,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,4CAA4C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,2BAAoC;IAEpC,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,4CAA4C,CAAC,CAAC;QAC5D,0BAA0B,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,QAAQ,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,MAAM,CAAC,yDAAyD,CAAC,CAAC;QACzE,IAAI,CAAC;YACH,QAAQ,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}