feat: add bsk network read-only command

Add `bsk network` as a sibling of the `console` command from #7,
reading the buffered network responses / failures for a tab. Fills the
remaining half of the request in #2 (console landed in #7; network did
not).

Mirrors the console command's conventions exactly:

  bsk network --session <id> [--tab-id N] [--since C]
                             [--limit N] [--max-text-chars N]

The extension enables `Network` on attach (best-effort) and buffers
`responseReceived` / `loadingFailed` events per tab with a monotonic
sequence, correlating them to `requestWillBeSent` for method/URL. Reads
are cursor-paginated (`since` -> `next_since`) and bounded (`limit`,
`max_text_chars`) for agent-context safety, same as console. Entries
carry the real HTTP status code (response) or the CDP failure reason
(failure) — things `performance.getEntriesByType('resource')` can't
give.

Classified read-only (pass-through under the pending-interrupt gate);
defaults to the Agent Window's active tab.

Wires bsk-protocol (Method + params/result/entry structs + schema),
bsk-cli (network subcommand + daemon dispatch allow-list) and the
extension (handler + dispatcher route), with unit / parse / IPC tests
paralleling the console command.

Refs #2.

crates/bsk-cli/src/cli/mod.rs

@@ -18,6 +18,7 @@ pub mod install_skill;
 pub mod interaction;
 pub mod logs;
 pub mod navigate;
+pub mod network;
 pub mod render_error;
 pub mod screenshot;
 pub mod session;
@@ -37,6 +38,7 @@ use crate::cli::human_loop::RequestHelpArgs;
 use crate::cli::install_skill::InstallSkillArgs;
 use crate::cli::interaction::{ClickArgs, FillArgs, PressArgs, SelectArgs};
 use crate::cli::navigate::{NavigateCommand, NavigateHistoryArgs, ReloadArgs};
+use crate::cli::network::NetworkArgs;
 use crate::cli::screenshot::ScreenshotArgs;
 use crate::cli::session::SessionCmd;
 use crate::cli::snapshot::SnapshotArgs;
@@ -120,6 +122,9 @@ pub enum Command {
     /// Read buffered console/log/exception messages.
     Console(ConsoleArgs),
 
+    /// Read buffered network responses / failures.
+    Network(NetworkArgs),
+
     /// Dump raw HTML for a tab or a snapshot ref.
     #[command(name = "get-html")]
     GetHtml(GetHtmlArgs),

crates/bsk-cli/src/cli/network.rs

@@ -0,0 +1,105 @@
+//! `bsk network` — read buffered page network responses / failures.
+
+use std::path::PathBuf;
+
+use anyhow::Context;
+use bsk_protocol::Method;
+use bsk_protocol::tools::{NetworkEntry, NetworkParams, NetworkResult};
+use clap::Args;
+
+use crate::cli::TOOL_IPC_TIMEOUT;
+use crate::cli::ensure_daemon::ensure_daemon;
+use crate::cli::error::{CliError, Format};
+
+#[derive(Debug, Clone, Args)]
+pub struct NetworkArgs {
+    /// Session id (must be active).
+    #[arg(long)]
+    pub session: String,
+
+    /// Target tab. Defaults to the Agent Window's active tab.
+    #[arg(long = "tab-id")]
+    pub tab_id: Option<i64>,
+
+    /// Return entries with sequence greater than this cursor.
+    #[arg(long)]
+    pub since: Option<u64>,
+
+    /// Maximum number of entries to return. Defaults to 50; extension caps at 200.
+    #[arg(long, value_parser = clap::value_parser!(u32).range(1..))]
+    pub limit: Option<u32>,
+
+    /// Maximum characters per URL / error text. Defaults to 1000; extension caps at 4096.
+    #[arg(long = "max-text-chars", value_parser = clap::value_parser!(u32).range(1..))]
+    pub max_text_chars: Option<u32>,
+}
+
+pub fn dispatch(args: NetworkArgs, format: Format) -> Result<(), CliError> {
+    let info = ensure_daemon().context("ensure daemon is running")?;
+    run(info.sock_path, args, format)
+}
+
+fn run(sock: PathBuf, args: NetworkArgs, format: Format) -> Result<(), CliError> {
+    let params = NetworkParams {
+        session_id: args.session,
+        tab_id: args.tab_id,
+        since: args.since,
+        limit: args.limit,
+        max_text_chars: args.max_text_chars,
+    };
+    let reply: NetworkResult = call(sock, params)?;
+    render(&reply, format)
+}
+
+fn call(sock: PathBuf, params: NetworkParams) -> Result<NetworkResult, CliError> {
+    crate::cli::business_rpc::call::<NetworkParams, NetworkResult>(
+        sock,
+        "network",
+        Method::ToolNetwork,
+        Some(params),
+        TOOL_IPC_TIMEOUT,
+    )
+}
+
+fn render(reply: &NetworkResult, format: Format) -> Result<(), CliError> {
+    match format {
+        Format::Json => {
+            let json = serde_json::to_string_pretty(reply)
+                .map_err(|e| CliError::Local(anyhow::anyhow!(e)))?;
+            println!("{json}");
+        }
+        Format::Human => {
+            if reply.entries.is_empty() {
+                println!("(no network activity captured)");
+            } else {
+                for entry in &reply.entries {
+                    println!("{}", render_entry(entry));
+                }
+            }
+            if reply.truncated {
+                eprintln!(
+                    "warning: network output truncated (next_since={}). Use --since / --limit / --max-text-chars to request a different slice.",
+                    reply.next_since
+                );
+            }
+        }
+    }
+    Ok(())
+}
+
+fn render_entry(entry: &NetworkEntry) -> String {
+    let method = entry.method.as_deref().unwrap_or("?");
+    match entry.kind {
+        bsk_protocol::tools::NetworkEntryKind::Failure => {
+            let err = entry.error_text.as_deref().unwrap_or("failed");
+            format!("#{} FAILED {method} {} — {err}", entry.sequence, entry.url)
+        }
+        bsk_protocol::tools::NetworkEntryKind::Response => {
+            let status = entry
+                .status
+                .map(|s| s.to_string())
+                .unwrap_or_else(|| "?".to_string());
+            format!("#{} {status} {method} {}", entry.sequence, entry.url)
+        }
+    }
+}

crates/bsk-cli/src/daemon/ipc.rs

@@ -229,6 +229,7 @@ pub fn full_handler(status: DaemonStatus, state: Arc<DaemonState>) -> RpcHandler
                 | Method::ToolTabReturn
                 | Method::ToolScreenshot
                 | Method::ToolConsole
+                | Method::ToolNetwork
                 | Method::ToolSnapshot
                 | Method::ToolGetHtml
                 | Method::ToolNavigate

crates/bsk-cli/src/main.rs

@@ -83,6 +83,7 @@ fn dispatch(cli: Cli, format: Format) -> Result<(), CliError> {
         Command::Screenshot(args) => cli::screenshot::dispatch(args, format),
         Command::Snapshot(args) => cli::snapshot::dispatch(args, format),
         Command::Console(args) => cli::console::dispatch(args, format),
+        Command::Network(args) => cli::network::dispatch(args, format),
         Command::GetHtml(args) => cli::get_html::dispatch(args, format),
         Command::Navigate(args) => cli::navigate::dispatch_navigate_command(args, format),
         Command::NavigateBack(args) => cli::navigate::dispatch_navigate_back(args, format),

crates/bsk-cli/tests/cli_parse.rs

@@ -104,6 +104,41 @@ fn rejects_zero_console_bounds() {
     );
 }
 
+#[test]
+fn parses_network_command_with_context_safety_flags() {
+    let cli = parse(&[
+        "bsk",
+        "network",
+        "--session",
+        "s1",
+        "--tab-id",
+        "9",
+        "--since",
+        "12",
+        "--limit",
+        "75",
+        "--max-text-chars",
+        "2048",
+    ]);
+    let Command::Network(args) = cli.command else {
+        panic!("expected network command");
+    };
+    assert_eq!(args.session, "s1");
+    assert_eq!(args.tab_id, Some(9));
+    assert_eq!(args.since, Some(12));
+    assert_eq!(args.limit, Some(75));
+    assert_eq!(args.max_text_chars, Some(2048));
+}
+
+#[test]
+fn rejects_zero_network_bounds() {
+    assert!(Cli::try_parse_from(["bsk", "network", "--session", "s1", "--limit", "0"]).is_err());
+    assert!(
+        Cli::try_parse_from(["bsk", "network", "--session", "s1", "--max-text-chars", "0"])
+            .is_err()
+    );
+}
+
 #[test]
 fn parses_install_skill_subcommand() {
     let cli = parse(&["bsk", "install-skill", "--list"]);

crates/bsk-cli/tests/tools_ipc.rs

@@ -11,8 +11,9 @@ use bsk::ipc_client::IpcClient;
 use bsk_protocol::system::{HandshakeParams, HandshakeResult};
 use bsk_protocol::tools::{
     ConsoleEntry, ConsoleEntryKind, ConsoleParams, ConsoleResult, GetHtmlParams, GetHtmlResult,
-    ScreenshotParams, ScreenshotResult, SessionStartParams, SessionStartResult, SnapshotParams,
-    SnapshotResult, TabInfo, TabListParams, TabListResult, TabScope,
+    NetworkEntry, NetworkEntryKind, NetworkParams, NetworkResult, ScreenshotParams,
+    ScreenshotResult, SessionStartParams, SessionStartResult, SnapshotParams, SnapshotResult,
+    TabInfo, TabListParams, TabListResult, TabScope,
 };
 use bsk_protocol::{
     BrowserPeerInfo, ErrorCode, Frame, Method, RequestFrame, ResponseBody, ResponseFrame, RpcError,
@@ -365,6 +366,62 @@ async fn console_returns_buffered_entries() {
     handle.shutdown().await;
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn network_returns_buffered_entries() {
+    let (handle, sock) = spawn_daemon().await;
+    let mut ws = connect_ext(handle.ws_addr()).await;
+    let _ = do_handshake(&mut ws).await;
+
+    run_extension(ws, |req| {
+        assert_eq!(req.method, Method::ToolNetwork);
+        let params: NetworkParams = serde_json::from_value(req.params.clone().unwrap()).unwrap();
+        assert_eq!(params.tab_id, Some(7));
+        assert_eq!(params.since, Some(3));
+        assert_eq!(params.limit, Some(50));
+        assert_eq!(params.max_text_chars, Some(1000));
+        ResponseBody::Ok(
+            serde_json::to_value(NetworkResult {
+                tab_id: 7,
+                entries: vec![NetworkEntry {
+                    sequence: 4,
+                    kind: NetworkEntryKind::Response,
+                    method: Some("GET".into()),
+                    url: "https://example.test/api".into(),
+                    status: Some(404),
+                    status_text: Some("Not Found".into()),
+                    mime_type: Some("application/json".into()),
+                    resource_type: Some("Fetch".into()),
+                    error_text: None,
+                    timestamp: None,
+                    truncated: false,
+                }],
+                next_since: 4,
+                truncated: false,
+            })
+            .unwrap(),
+        )
+    });
+
+    let session_id = ipc_session_start(&sock).await;
+    let result: NetworkResult = ipc_tool_call(
+        &sock,
+        Method::ToolNetwork,
+        NetworkParams {
+            session_id,
+            tab_id: Some(7),
+            since: Some(3),
+            limit: Some(50),
+            max_text_chars: Some(1000),
+        },
+    )
+    .await
+    .expect("network ok");
+    assert_eq!(result.tab_id, 7);
+    assert_eq!(result.next_since, 4);
+    assert_eq!(result.entries[0].status, Some(404));
+    handle.shutdown().await;
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn snapshot_returns_text_and_ref_count() {
     let (handle, sock) = spawn_daemon().await;