Add bounded Browser page runtime and agent control

[brsbl]

Summary

• add a general, bounded Browser-page script runtime targeting an explicit BB Browser tab
• run page scripts in an isolated world by default, with JSON-only inputs/results, cancellation, time and byte limits, and navigation invalidation
• broker exact client/window/tab requests between server-side agent tools and the selected desktop Browser view
• expose audited agent operations for tab discovery, DOM snapshots, click, type, keyboard, scroll, navigation, screenshots, and bounded ephemeral scripts
• preserve the plugin-owned experimental_browserAction entry point without retaining the discarded Browser-specific inspection schema
• keep the host external-link action rightmost and move excess plugin Browser actions into a keyboard-accessible overflow menu
• publish the additive Browser plugin surface as SDK 0.4.9 now that 0.4.8 is released

Security and lifecycle

• Browser scripts receive no Node, Electron, or BB app-shell objects
• target selection is explicit and epoch-bound; main-frame navigation, tab detach, window close, disconnect, timeout, and caller abort invalidate in-flight work
• AbortSignal remains renderer-local; cancellation crosses Electron IPC only as a bounded { tabId, requestId } message
• concurrent calls use independent request IDs and cleanup paths
• custom scripts remain inside the same bounded runtime and normal native agent-tool permission/audit flow
• a persisted manifest generated by the real 0.4.8 scaffold proves prior-release plugins continue loading under 0.4.9

Visual evidence

The runtime comparison uses the same 1280×900 desktop dev-app window, Browser runtime visual QA thread, Browser Core Test Lab fixture, Team members route, localhost URL, Browser panel width, and device scale. Before is the exact merge base fa9a15ba; after is the exact PR head dd66e0893.

Browser action: before

State: the localhost Team members page is open as a complete Browser page. The full http://127.0.0.1:43173/ URL is visible, and the merge base has no plugin Browser action.

Browser action: after

Action: select Inspect this Browser page in the Browser toolbar.

Result: the same complete localhost page remains visible while a compact, non-modal result reports the live heading, control counts, input count, and navigation epoch for that exact tab revision.

Overflow interaction sequence

These two captures are both from exact head dd66e0893 in the same 1280×900 window. The Browser panel is deliberately constrained so only actions 2–4 fit inline.

Step 1 — trigger in context: the overflow trigger appears immediately before the host external-link action, which remains rightmost. No hover-only state is required.

Step 2 — open menu: focus the overflow trigger and press Enter. The menu opens with ordered actions 5–8 while the trigger and external-link action remain visible in context.

Validation

• exact desktop Browser action returned Team members, 3 buttons, 1 input, and navigation epoch 1
• complete localhost page, tab title, and full URL were visually verified before and after the action
• constrained toolbar ordering, keyboard Enter activation, Escape dismissal, focus behavior, and five repeated open/close cycles passed
• exact agent bridge passed tab discovery, interactive snapshot, isolated custom script, type, click, scroll, and screenshot; readback was { filter: "Dara", activity: "Invite member clicked through the Browser runtime.", scrollY: 420 } with a 778×1336 capture
• focused app, desktop, server, desktop-contract, plugin SDK, template, and compatibility suites passed
• affected-package typecheck passed 10/10 tasks; git diff --check passed

Supersedes the Browser runtime portion of #1642 and #1643. Does not merge or ship the Browser Context consumer.

BB-Thread-ID: thr_p9qmfkggwm

AGENT GENERATED: by GPT-5.6-Sol

[bb-slop-cop]

🚨 SLOP COP 🚨 · review

I am SlopCop. I started parallel security, code quality, architecture, and performance reviews. I will also test the Browser workflow where possible. I will post one final review after I check the results.

[bb-slop-cop]

🚨 SLOP COP 🚨 · review

Plain English summary: This PR lets approved tools control one exact Browser tab. They can inspect, click, type, scroll, navigate, run bounded code, and capture images.

The server, web app, and desktop shell match each request to one page revision. Plugins also gain a compact Browser toolbar action.

I found six issues:

• High: One script timeout can terminate unrelated scripts and page code in the same tab.
• High: Normal navigation leaves a short window where a script can run against the page that the user is leaving.
• Medium: A large DOM snapshot can stop the page renderer and delay cancellation.
• Medium: Screenshot cancellation does not stop the native capture task.
• Medium: Backspace, Delete, and arrow-key actions report success without native browser behavior.
• Medium: Deep recursive response data can escape the invalid-message guard and leave the WebSocket open.

I found no earlier Browser runtime that this change should reuse. A tab operation manager can centralize navigation state, cancellation, and hard limits.

Validation passed for all six affected package typechecks. The full desktop suite passed 231 tests, and the two separate test runs passed.

The native end-to-end test loaded Example Domain. The page runtime returned its heading, and image capture returned the same navigation epoch.

I left line comments with the trigger and a testable fix for each issue.