fix(vom): add new texts and fix bugs

.github/workflows/ci.yml

@@ -38,7 +38,7 @@ jobs:
         run: cargo test --workspace --locked
 
   windows-daemon:
-    name: Windows daemon, installer and cancellation regression tests
+    name: Windows daemon and update regression tests
     runs-on: windows-latest
 
     steps:
@@ -55,16 +55,8 @@ jobs:
       - name: Run Windows update tests
         run: cargo test -p bsk --lib --locked cli::update::tests
 
-      - name: Run Windows update and cancellation process tests
-        run: cargo test -p bsk --test windows_update --test windows_parent_cancel --locked
-
-      - name: Run installer tests (Windows PowerShell 5.1)
-        shell: powershell
-        run: ./scripts/install-windows.test.ps1
-
-      - name: Run installer tests (PowerShell 7)
-        shell: pwsh
-        run: ./scripts/install-windows.test.ps1
+      - name: Run Windows update process tests
+        run: cargo test -p bsk --test windows_update --locked
 
   frontend:
     name: Frontend lint, typecheck, tests, build

CHANGELOG.md

@@ -7,30 +7,6 @@ Starting from 0.2.0, CLI / Extension / DSH Plugin share the same version number.
 
 ## [Unreleased]
 
-### Added
-
-- [Scroll-to element primitive](docs/scroll-to.md) across CLI, Extension and DSH Plugin,
-  with ancestor-clipped visible bounds, iframe support and cooperative cancellation
-
-## [0.2.1] - 2026-09-09
-
-### Changed
-- DSH Plugin: clarified installation, configuration, profile restart, and upgrade instructions
-
-### Fixed
-- CLI: reliable Windows self-updates, including executable replacement and daemon restart
-- CLI: Windows named-pipe connection continuity and stale daemon process detection
-- Windows installer: PowerShell 5.1 compatibility, path quoting, and staged executable replacement
-- CLI / DSH Plugin: cancellation propagation and upload/download cleanup when the parent process exits
-- Extension: tab ownership and session cleanup when agent tabs fail to open or borrowed tabs are returned or closed
-- Extension: navigation recovery when other extensions restrict Chrome DevTools Protocol access
-- Extension: background input filling, automatic append behavior, and verification of field values before reporting success
-- Extension: match observed form state to the correct element after page changes
-- Extension: UUID generation fallback for recording and overlays on insecure origins
-- Browser locale matching for regional language variants
-- DSH Plugin: observation state synchronization, thumbnail capture lifecycle, and stale preview cleanup
-- DSH Plugin: removed the obsolete client runtime host dependency
-
 ## [0.2.0] - 2026-09-02
 
 ### Added

Cargo.lock

@@ -134,7 +134,7 @@ dependencies = [
 
 [[package]]
 name = "bsk"
-version = "0.2.1"
+version = "0.2.0"
 dependencies = [
  "anyhow",
  "base64",
@@ -169,7 +169,7 @@ dependencies = [
 
 [[package]]
 name = "bsk-protocol"
-version = "0.2.1"
+version = "0.2.0"
 dependencies = [
  "schemars",
  "semver",

Cargo.toml

@@ -7,7 +7,7 @@ members = [
 default-members = ["crates/bsk-cli"]
 
 [workspace.package]
-version = "0.2.1"
+version = "0.2.0"
 edition = "2024"
 rust-version = "1.85"
 license = "MIT"
@@ -43,7 +43,7 @@ rand = "0.8"
 uuid = { version = "1", features = ["v4", "serde"] }
 
 # Workspace crates (version required for `cargo publish` of dependents)
-bsk-protocol = { version = "0.2.1", path = "crates/bsk-protocol" }
+bsk-protocol = { version = "0.2.0", path = "crates/bsk-protocol" }
 
 [profile.release]
 strip = "symbols"

README.md

@@ -147,26 +147,20 @@ Start a new Agent session and write a prompt that needs the browser, for example
 Using [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (`dsh`)?
 BrowserSkill ships a first-class dsh plugin on npm as
 [`@wxg-prc-cpg/browser-skill-dsh-plugin`](https://www.npmjs.com/package/@wxg-prc-cpg/browser-skill-dsh-plugin).
-It gives the agent native `browser_*` tools and a live view of its browser sessions
-in the Web UI. The plugin runs `bsk` on the agent's behalf.
+It injects native `browser_*` tools (no shelling out to `bsk`) and a live Web UI
+overlay of each Agent Window.
 
-Install the `bsk` CLI and connect the browser extension first. Then add the plugin
-to a dsh profile and start it (replace `web` with your profile name):
+Add it to a dsh profile, then start that profile:
 
 ```sh
 dsh plugin --profile web add @wxg-prc-cpg/browser-skill-dsh-plugin
 dsh --profile web
 ```
 
-The plugin includes the `browser-skill` skill, so `bsk install-skill` is not needed
-for dsh. Installed plugins do not update automatically. To upgrade this plugin:
-
-```sh
-dsh plugin --profile web update @wxg-prc-cpg/browser-skill-dsh-plugin --latest
-```
-
-Restart the profile after upgrading. See the
-[plugin README](packages/dsh-plugin-browserskill/README.md) for usage and configuration.
+The plugin carries its own copy of the skill, so `bsk install-skill` is not needed
+for dsh — but the `bsk` CLI and the browser extension are still prerequisites. See
+the [plugin README](packages/dsh-plugin-browserskill/README.md) for the tool list,
+configuration, and the observation overlay.
 
 ## How It Works
 
@@ -207,9 +201,6 @@ through the [plugin](#deepseek-harness-plugin): the agent calls injected
 
 ## For Developers
 
-The [scroll-to primitive reference](docs/scroll-to.md) covers its CLI, protocol
-and plugin entry points, visible bounds and interruption behavior.
-
 The repository is a Cargo + pnpm workspace:
 
 - `crates/bsk-cli` — `bsk` CLI and local daemon

README.zh-CN.md

@@ -125,22 +125,16 @@ bsk install-skill
 
 ## DeepSeek Harness 插件
 
-在用 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)（`dsh`）？BrowserSkill 提供了官方 dsh 插件，已发布到 npm：[`@wxg-prc-cpg/browser-skill-dsh-plugin`](https://www.npmjs.com/package/@wxg-prc-cpg/browser-skill-dsh-plugin)。它为 Agent 提供原生 `browser_*` 工具，由插件代为调用 `bsk`，并在 Web UI 中实时展示浏览器会话。
+在用 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)（`dsh`）？BrowserSkill 提供了官方 dsh 插件，已发布到 npm：[`@wxg-prc-cpg/browser-skill-dsh-plugin`](https://www.npmjs.com/package/@wxg-prc-cpg/browser-skill-dsh-plugin)。它会注入原生 `browser_*` 工具（无需再通过 Shell 调用 `bsk`），并在 Web UI 中实时观察每个 Agent Window。
 
-先安装 `bsk` CLI 并连接浏览器扩展，再将插件装进 dsh profile 并启动（将 `web` 替换为你的 profile 名称）：
+把它装进某个 dsh profile，然后启动该 profile：
 
 ```sh
 dsh plugin --profile web add @wxg-prc-cpg/browser-skill-dsh-plugin
 dsh --profile web
 ```
 
-插件自带 `browser-skill` skill，所以在 dsh 下无需执行 `bsk install-skill`。已安装的插件不会自动更新；升级此插件请运行：
-
-```sh
-dsh plugin --profile web update @wxg-prc-cpg/browser-skill-dsh-plugin --latest
-```
-
-升级后重启该 profile。用法与配置见[插件 README](packages/dsh-plugin-browserskill/README.md)。
+插件自带 skill，所以在 dsh 下无需执行 `bsk install-skill`；但 `bsk` CLI 和浏览器扩展仍是前置条件。工具清单、配置项与观察浮层见[插件 README](packages/dsh-plugin-browserskill/README.md)。
 
 ## 工作原理
 
@@ -177,8 +171,6 @@ Agent 不直接与浏览器通信。它通过 `bsk` CLI 下发浏览器任务；
 
 ## 面向开发者
 
-[scroll-to 原语说明](docs/scroll-to.md)介绍 CLI、协议和插件入口，以及可见区域、错误和中断语义。
-
 本仓库是 Cargo + pnpm workspace：
 
 - `crates/bsk-cli` — `bsk` CLI 与本地 daemon

apps/extension/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@browser-skill/extension",
-  "version": "0.2.1",
+  "version": "0.2.0",
   "private": true,
   "type": "module",
   "scripts": {

apps/extension/src/browser-driver/__tests__/chromium-cdp.test.ts

@@ -29,24 +29,6 @@ function fakeApi() {
 }
 
 describe("ChromiumCdp", () => {
-  it("changes attachment identity only across real debugger attachments", async () => {
-    const { api, onEvent, onDetach } = fakeApi();
-    const cdp = new ChromiumCdp(api);
-    expect(cdp.getAttachmentId(4)).toBeUndefined();
-    await cdp.ensureAttached(4);
-    const first = cdp.getAttachmentId(4);
-    expect(first).toBeTruthy();
-    await cdp.ensureAttached(4);
-    onEvent.fire({ tabId: 4 }, "Target.attachedToTarget", { sessionId: "child" });
-    expect(cdp.getAttachmentId(4)).toBe(first);
-    onDetach.fire({ tabId: 4 }, "target_closed");
-    expect(cdp.getAttachmentId(4)).toBeUndefined();
-    await cdp.ensureAttached(4);
-    expect(cdp.getAttachmentId(4)).not.toBe(first);
-    await cdp.detach(4);
-    expect(cdp.getAttachmentId(4)).toBeUndefined();
-  });
-
   it("discovers multiple iframe targets and recursively routes nested OOPIF commands", async () => {
     const { api, onEvent } = fakeApi();
     (api.sendCommand as ReturnType<typeof vi.fn>).mockImplementation(

apps/extension/src/browser-driver/chromium-cdp.ts

@@ -164,7 +164,6 @@ async function settleBeforeDeadline(promises: Promise<void>[], deadline: number)
 export class ChromiumCdp {
   private readonly api: CdpDebuggerApi;
   private readonly attachedTabs = new Set<number>();
-  private readonly attachmentIds = new Map<number, string>();
   private readonly attachInFlight = new Map<number, Promise<void>>();
   private readonly detachInFlight = new Map<number, Promise<void>>();
   private readonly tabOwners = new Map<number, Set<string>>();
@@ -199,11 +198,6 @@ export class ChromiumCdp {
     this.bindFrameTargetHandler();
   }
 
-  /** Identity of this actual debugger attachment, independent of frame topology. */
-  getAttachmentId(tabId: number): string | undefined {
-    return this.attachmentIds.get(tabId);
-  }
-
   /** Attach to `tabId` if we haven't already in this driver. */
   async ensureAttached(tabId: number): Promise<void> {
     // Returning a tab clears the cache before Chrome finishes detaching.
@@ -223,7 +217,6 @@ export class ChromiumCdp {
         await this.enableConsoleDomains(tabId);
         await this.enableNetworkDomainBestEffort(tabId);
         this.attachedTabs.add(tabId);
-        this.attachmentIds.set(tabId, crypto.randomUUID());
         await this.enableFrameDiscovery({ tabId }).catch((err) => {
           console.debug("[bsk cdp] frame discovery unavailable", { tabId, err });
         });
@@ -451,7 +444,6 @@ export class ChromiumCdp {
     this.attachInFlight.delete(tabId);
     if (!this.attachedTabs.has(tabId)) return;
     this.attachedTabs.delete(tabId);
-    this.attachmentIds.delete(tabId);
     this.clearDialogState(tabId);
     this.clearConsoleState(tabId);
     this.clearNetworkState(tabId);
@@ -510,7 +502,6 @@ export class ChromiumCdp {
     this.attachInFlight.clear();
     this.tabOwners.clear();
     this.attachedTabs.clear();
-    this.attachmentIds.clear();
     this.dialogBuffers.clear();
     this.dialogSequences.clear();
     this.consoleBuffers.clear();
@@ -857,7 +848,6 @@ export class ChromiumCdp {
     const listener = (source: chrome.debugger.Debuggee, _reason: string) => {
       if (typeof source.tabId === "number") {
         this.attachedTabs.delete(source.tabId);
-        this.attachmentIds.delete(source.tabId);
         this.attachInFlight.delete(source.tabId);
         this.tabOwners.delete(source.tabId);
         this.clearDialogState(source.tabId);

apps/extension/src/session-manager/__tests__/ref-store.test.ts

@@ -13,6 +13,8 @@ describe("RefStore", () => {
       backendNodeId: 42,
       tabId: 7,
       generation: 0,
+      kind: "dom",
+      capabilities: ["interact", "screenshot"],
     });
     expect(s.size()).toBe(1);
     expect(s.isEmpty()).toBe(false);
@@ -48,4 +50,41 @@ describe("RefStore", () => {
       cdpSessionId: "child-session",
     });
   });
+
+  it("preserves explicit capabilities for visual surface refs", () => {
+    const s = new RefStore();
+    s.set("e1", 42, {
+      tabId: 7,
+      kind: "surface",
+      capabilities: ["screenshot"],
+    });
+
+    expect(s.resolveEntry("e1")).toMatchObject({
+      kind: "surface",
+      capabilities: ["screenshot"],
+    });
+  });
+
+  it("never grants ordinary interaction to a surface through defaults or caller input", () => {
+    const s = new RefStore();
+    s.set("e1", 42, { tabId: 7, kind: "surface" });
+    s.set("e2", 43, {
+      tabId: 7,
+      kind: "surface",
+      capabilities: ["interact", "screenshot"],
+    });
+
+    expect(s.resolveEntry("e1")?.capabilities).toEqual(["screenshot"]);
+    expect(s.resolveEntry("e2")?.capabilities).toEqual(["screenshot"]);
+  });
+
+  it("copies caller-owned capability arrays", () => {
+    const s = new RefStore();
+    const capabilities: Array<"interact" | "screenshot"> = ["screenshot"];
+    s.set("e1", 42, { tabId: 7, capabilities });
+
+    capabilities.push("interact");
+
+    expect(s.resolveEntry("e1")?.capabilities).toEqual(["screenshot"]);
+  });
 });

apps/extension/src/session-manager/ref-store.ts

@@ -1,3 +1,5 @@
+import type { Rect } from "@browser-skill/vom";
+
 /**
  * Per-session map from `@e<N>` snapshot refs to a CDP node address.
  *
@@ -12,12 +14,17 @@
  * inside the `SessionContext`.
  */
 export type BackendNodeId = number;
+export type RefCapability = "interact" | "screenshot";
+export type RefTargetKind = "dom" | "surface";
 
 export interface RefEntry {
   backendNodeId: BackendNodeId;
   tabId: number | null;
   frameId?: string;
   cdpSessionId?: string;
+  visibleRect?: Rect;
+  kind: RefTargetKind;
+  capabilities: RefCapability[];
   generation: number;
 }
 
@@ -28,8 +35,19 @@ export type RefInput =
       tabId: number;
       frameId?: string;
       cdpSessionId?: string;
+      visibleRect?: Rect;
+      kind?: RefTargetKind;
+      capabilities?: RefCapability[];
     };
 
+function capabilitiesFor(
+  kind: RefTargetKind,
+  capabilities: RefCapability[] | undefined,
+): RefCapability[] {
+  if (kind === "surface") return ["screenshot"];
+  return capabilities ? [...capabilities] : ["interact", "screenshot"];
+}
+
 export class RefStore {
   private readonly map = new Map<string, RefEntry>();
   private generation = 0;
@@ -70,13 +88,20 @@ export class RefStore {
       tabId?: number;
       frameId?: string;
       cdpSessionId?: string;
+      visibleRect?: Rect;
+      kind?: RefTargetKind;
+      capabilities?: RefCapability[];
     } = {},
   ): void {
+    const kind = opts.kind ?? "dom";
     this.map.set(normaliseRef(ref), {
       backendNodeId: id,
       tabId: opts.tabId ?? null,
       ...(opts.frameId ? { frameId: opts.frameId } : {}),
       ...(opts.cdpSessionId ? { cdpSessionId: opts.cdpSessionId } : {}),
+      ...(opts.visibleRect ? { visibleRect: opts.visibleRect } : {}),
+      kind,
+      capabilities: capabilitiesFor(kind, opts.capabilities),
       generation: this.generation,
     });
   }
@@ -94,14 +119,20 @@ export class RefStore {
       return {
         backendNodeId: input,
         tabId: null,
+        kind: "dom",
+        capabilities: ["interact", "screenshot"],
         generation: this.generation,
       };
     }
+    const kind = input.kind ?? "dom";
     return {
       backendNodeId: input.backendNodeId,
       tabId: input.tabId,
       ...(input.frameId ? { frameId: input.frameId } : {}),
       ...(input.cdpSessionId ? { cdpSessionId: input.cdpSessionId } : {}),
+      ...(input.visibleRect ? { visibleRect: input.visibleRect } : {}),
+      kind,
+      capabilities: capabilitiesFor(kind, input.capabilities),
       generation: this.generation,
     };
   }

apps/extension/src/tools/__tests__/dispatcher.test.ts

@@ -599,79 +599,6 @@ describe("ToolDispatcher", () => {
     expect(onSessionsChanged).toHaveBeenCalledTimes(2);
   });
 
-  it.each([
-    "focus",
-    "blur",
-    "scroll_to",
-  ] as const)("routes %s with hover cleanup and cooperative cancellation", async (action) => {
-    const tab = { id: 7, windowId: 4242, active: true };
-    vi.stubGlobal("chrome", {
-      tabs: {
-        get: vi.fn(async () => tab),
-        query: vi.fn(async () => [tab]),
-        sendMessage: vi.fn(async () => undefined),
-      },
-    });
-    const sessions = new SessionManager({
-      agentWindow: {
-        create: async () => 4242,
-        remove: async () => {},
-        ensureActiveTab: async () => 7,
-      },
-    });
-    const ctx = await sessions.start("aa11");
-    ctx.refStore.set("e1", 12, { tabId: 7 });
-    const { transport, sent, deliver } = fakeTransport();
-    const onBrowserControlResumed = vi.fn();
-    let resolveNode: ((value: object) => void) | undefined;
-    const cdp = {
-      send: vi.fn(async (_tabId: number, method: string) => {
-        if (method === "DOM.resolveNode")
-          return new Promise((resolve) => {
-            resolveNode = resolve;
-          });
-        if (method === "Runtime.callFunctionOn") return { result: { value: true } };
-        return {};
-      }),
-    } as unknown as TestDispatcherCdp;
-    const dispatcher = new ToolDispatcher({ transport, sessions, cdp, onBrowserControlResumed });
-    const hover = dispatcher as unknown as {
-      rememberHover: (sessionId: string, result: object) => void;
-      setHoverBypass: (sessionId: string, tabId: number, enabled: boolean) => Promise<void>;
-    };
-    hover.rememberHover("aa11", { tab_id: 7, x: 10, y: 20 });
-    await hover.setHoverBypass("aa11", 7, true);
-    dispatcher.start();
-    deliver(makeRequest(`tool.${action}`, { session_id: "aa11", ref: "e1" }));
-    await vi.waitFor(() => expect(resolveNode).toBeDefined());
-    expect(onBrowserControlResumed).toHaveBeenCalledWith("aa11");
-    deliver({ id: "cancel-focus", method: "cancel", params: { rpc_id: "r-1" } });
-    resolveNode!({ object: { objectId: "focus-target" } });
-    await vi.waitFor(() => expect(sent).toHaveLength(2));
-    expect(sent).toContainEqual({ id: "cancel-focus", result: { cancelled: true } });
-    expect(sent).toContainEqual({
-      id: "r-1",
-      error: expect.objectContaining({ code: "cancelled" }),
-    });
-    expect(cdp.send).not.toHaveBeenCalledWith(7, "DOM.focus", expect.anything());
-    expect(cdp.send).not.toHaveBeenCalledWith(7, "Runtime.callFunctionOn", expect.anything());
-    if (action === "scroll_to") {
-      expect(cdp.send).toHaveBeenCalledWith(7, "Runtime.releaseObjectGroup", {
-        objectGroup: expect.any(String),
-      });
-    } else {
-      expect(cdp.send).toHaveBeenCalledWith(7, "Runtime.releaseObject", {
-        objectId: "focus-target",
-      });
-    }
-    expect(chrome.tabs.sendMessage).toHaveBeenCalledWith(
-      7,
-      expect.objectContaining({ enabled: false }),
-    );
-    expect(dispatcher.inflightAbortControllers.size).toBe(0);
-    dispatcher.stop();
-  });
-
   it("invokes onBrowserControlResumed for browser-control tools but not passive reads", async () => {
     vi.stubGlobal("chrome", {
       tabs: {

apps/extension/src/tools/__tests__/file-transfer.test.ts

@@ -436,8 +436,6 @@ describe("file transfer tools", () => {
         if (method === "DOM.getContentQuads") {
           return { quads: [[10, 20, 210, 20, 210, 120, 10, 120]] };
         }
-        if (method === "Runtime.evaluate")
-          return { result: { value: { width: 400, height: 300 } } };
         if (method === "Page.getLayoutMetrics") {
           return { cssLayoutViewport: { clientWidth: 400, clientHeight: 300 } };
         }

apps/extension/src/tools/__tests__/focus.browser.test.ts

@@ -1,166 +0,0 @@
-// @vitest-environment node
-// Opt in with BSK_FOCUS_CHROME=/path/to/chrome; each test owns its browser/profile.
-import { describe, expect, it } from "vitest";
-import { SessionManager } from "@/session-manager/manager";
-import { handleBlur, handleFocus } from "../interaction";
-import type { CdpRunner } from "../shared";
-
-type Send = <T = Record<string, unknown>>(
-  method: string,
-  params?: object,
-  sessionId?: string,
-) => Promise<T>;
-
-async function withFocusBrowser(
-  run: (h: {
-    evaluate: (expression: string) => Promise<unknown>;
-    ref: () => Promise<void>;
-    focus: (signal?: AbortSignal) => ReturnType<typeof handleFocus>;
-    blur: (signal?: AbortSignal) => ReturnType<typeof handleBlur>;
-    calls: string[];
-    afterCommand: { current: (method: string) => void };
-  }) => Promise<void>,
-) {
-  // Reuse the existing isolated Chrome launcher; no new browser dependency.
-  const { withChrome } = await import(
-    new URL(
-      "../../../../../evals/browser/cases/regression/snapshot-coordinates/chrome.mjs",
-      import.meta.url,
-    ).href
-  );
-  await withChrome(
-    { executable: process.env.BSK_FOCUS_CHROME, deviceScale: 1, zoom: 1 },
-    async (send: Send) => {
-      const { targetId } = await send<{ targetId: string }>("Target.createTarget", {
-        url: "about:blank",
-      });
-      const { sessionId } = await send<{ sessionId: string }>("Target.attachToTarget", {
-        targetId,
-        flatten: true,
-      });
-      await send("Page.bringToFront", {}, sessionId);
-      const evaluate = async (expression: string) => {
-        const reply = await send<{ result: { value: unknown }; exceptionDetails?: unknown }>(
-          "Runtime.evaluate",
-          { expression, returnByValue: true },
-          sessionId,
-        );
-        expect(reply.exceptionDetails).toBeUndefined();
-        return reply.result.value;
-      };
-      await evaluate(
-        `document.body.innerHTML = '<input id="target"><input id="other">'; window.probe = document.querySelector('#target');`,
-      );
-      const manager = new SessionManager({
-        agentWindow: {
-          create: async () => 100,
-          remove: async () => {},
-          ensureActiveTab: async () => 4,
-        },
-      });
-      const ctx = await manager.start("aa11");
-      const calls: string[] = [];
-      const afterCommand = { current: (_method: string) => {} };
-      const cdp: CdpRunner = {
-        send: async (_tabId, method, params) => {
-          calls.push(method);
-          const result = await send(method, params, sessionId);
-          afterCommand.current(method);
-          return result as never;
-        },
-      };
-      const deps = {
-        cdp,
-        tabsApi: {
-          get: async (id: number) => ({ id, windowId: 100, active: true }) as chrome.tabs.Tab,
-          query: async () => [{ id: 4, windowId: 100, active: true } as chrome.tabs.Tab],
-        },
-      };
-      await run({
-        evaluate,
-        calls,
-        afterCommand,
-        ref: async () => {
-          const { result } = await send<{ result: { objectId: string } }>(
-            "Runtime.evaluate",
-            { expression: "window.probe" },
-            sessionId,
-          );
-          const { node } = await send<{ node: { backendNodeId: number } }>(
-            "DOM.describeNode",
-            { objectId: result.objectId },
-            sessionId,
-          );
-          await send("Runtime.releaseObject", { objectId: result.objectId }, sessionId);
-          ctx.refStore.set("e1", node.backendNodeId, { tabId: 4 });
-        },
-        focus: (signal) =>
-          handleFocus(manager, { session_id: "aa11", ref: "e1" }, { ...deps, signal }),
-        blur: (signal) =>
-          handleBlur(manager, { session_id: "aa11", ref: "e1" }, { ...deps, signal }),
-      });
-    },
-  );
-}
-
-describe.skipIf(!process.env.BSK_FOCUS_CHROME)("real browser focus and blur", () => {
-  it.each(["light", "open", "closed"])("verifies focus and blur in %s DOM", async (mode) => {
-    await withFocusBrowser(async (h) => {
-      if (mode !== "light")
-        await h.evaluate(`(() => {
-        const host = document.createElement('div'); document.body.append(host);
-        const nested = document.createElement('div'); host.attachShadow({mode:'${mode}'}).append(nested);
-        const input = document.createElement('input'); nested.attachShadow({mode:'${mode}'}).append(input);
-        window.probe = input;
-      })()`);
-      await h.ref();
-      expect(await h.focus()).toMatchObject({ focused: true });
-      expect(await h.evaluate("window.probe.matches(':focus')")).toBe(true);
-      expect(await h.blur()).toMatchObject({ was_focused: true, focused: false });
-      expect(await h.evaluate("window.probe.matches(':focus')")).toBe(false);
-      expect(h.calls.filter((method) => method === "Runtime.releaseObject")).toHaveLength(2);
-    });
-  });
-
-  it("detects focus changes from event-handler microtasks", async () => {
-    await withFocusBrowser(async (h) => {
-      await h.ref();
-      await h.evaluate(
-        "window.probe.addEventListener('focus', () => queueMicrotask(() => document.querySelector('#other').focus()), {once:true})",
-      );
-      expect(await h.focus()).toMatchObject({ code: "cdp_failed" });
-      expect(await h.focus()).toMatchObject({ focused: true });
-      await h.evaluate(
-        "window.probe.addEventListener('blur', () => queueMicrotask(() => window.probe.focus()), {once:true})",
-      );
-      expect(await h.blur()).toMatchObject({ code: "cdp_failed" });
-      expect(await h.evaluate("window.probe.matches(':focus')")).toBe(true);
-    });
-  });
-
-  it("cancels before blur while still releasing the resolved object", async () => {
-    await withFocusBrowser(async (h) => {
-      await h.ref();
-      await h.focus();
-      const abort = new AbortController();
-      h.afterCommand.current = (method) => {
-        if (method === "DOM.resolveNode") abort.abort();
-      };
-      expect(await h.blur(abort.signal)).toMatchObject({ code: "cancelled" });
-      expect(await h.evaluate("window.probe.matches(':focus')")).toBe(true);
-      expect(h.calls.at(-1)).toBe("Runtime.releaseObject");
-    });
-  });
-
-  it("reports a page exception with its cause", async () => {
-    await withFocusBrowser(async (h) => {
-      await h.ref();
-      await h.evaluate("window.probe.blur = () => { throw new Error('page blur failed'); }");
-      expect(await h.blur()).toMatchObject({
-        code: "cdp_failed",
-        message: expect.stringContaining("page blur failed"),
-      });
-      expect(h.calls.at(-1)).toBe("Runtime.releaseObject");
-    });
-  });
-});

apps/extension/src/tools/__tests__/focus.test.ts

@@ -1,293 +0,0 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
-import type { CdpTarget } from "@/browser-driver/frame-graph";
-import { SessionManager } from "@/session-manager/manager";
-import { handleBlur, handleFocus } from "../interaction";
-import type { CdpRunner } from "../shared";
-
-interface ScriptParams {
-  functionDeclaration: string;
-}
-interface Call {
-  target: CdpTarget;
-  method: string;
-}
-
-async function setup(element?: HTMLElement, childSession = false) {
-  if (!element) {
-    document.body.innerHTML = '<input id="target"><input id="other">';
-    element = document.querySelector<HTMLInputElement>("#target")!;
-  }
-  const targetElement = element;
-  const manager = new SessionManager({
-    agentWindow: {
-      create: async () => 100,
-      remove: async () => {},
-      ensureActiveTab: async () => 4,
-    },
-  });
-  const ctx = await manager.start("aa11");
-  ctx.refStore.set("e1", 12, {
-    tabId: 4,
-    ...(childSession ? { frameId: "child", cdpSessionId: "child-session" } : {}),
-  });
-  const calls: Call[] = [];
-  const afterCommand = vi.fn<(call: Call) => void>();
-  const script = vi.fn(async (params: ScriptParams) => {
-    try {
-      const fn = new Function(`return (${params.functionDeclaration})`)();
-      return { result: { value: await fn.call(targetElement) } };
-    } catch (error) {
-      return { exceptionDetails: { text: "Uncaught", exception: { description: String(error) } } };
-    }
-  });
-  const focus = vi.fn(() => targetElement.focus());
-  const release = vi.fn(async () => ({}));
-  const send = async (target: CdpTarget, method: string, params?: object) => {
-    const call = { target, method };
-    calls.push(call);
-    try {
-      switch (method) {
-        case "DOM.getDocument":
-          return { root: { nodeId: 1 } };
-        case "DOM.querySelector":
-          return { nodeId: 2 };
-        case "DOM.describeNode":
-          return { node: { backendNodeId: 12 } };
-        case "DOM.scrollIntoViewIfNeeded":
-          return {};
-        case "DOM.resolveNode":
-          return { object: { objectId: "focus-target" } };
-        case "DOM.focus":
-          focus();
-          return {};
-        case "Runtime.callFunctionOn":
-          return await script(params as ScriptParams);
-        case "Runtime.releaseObject":
-          return await release();
-        default:
-          throw new Error(`unexpected ${method}`);
-      }
-    } finally {
-      afterCommand(call);
-    }
-  };
-  const cdp: CdpRunner = {
-    send: (tabId, method, params) => send({ tabId }, method, params) as never,
-    sendToTarget: send as CdpRunner["sendToTarget"],
-    getFrameGraph: vi.fn(async () => ({
-      rootFrameId: "main",
-      frames: [
-        { frameId: "main", target: { tabId: 4 } },
-        ...(childSession
-          ? [
-              {
-                frameId: "child",
-                parentFrameId: "main",
-                ownerBackendNodeId: 99,
-                target: { tabId: 4, sessionId: "child-session" },
-              },
-            ]
-          : []),
-      ],
-    })),
-  };
-  const tabsApi = {
-    get: vi.fn(async (id: number) => ({ id, windowId: 100, active: true }) as chrome.tabs.Tab),
-    query: vi.fn(async () => [{ id: 4, windowId: 100, active: true } as chrome.tabs.Tab]),
-  };
-  return {
-    element: targetElement,
-    calls,
-    afterCommand,
-    script,
-    focus,
-    release,
-    cdp,
-    tabsApi,
-    run: (
-      action: "focus" | "blur",
-      signal?: AbortSignal,
-      params: { ref?: string; selector?: string; tab_id?: number } = { ref: "e1" },
-    ) =>
-      (action === "focus" ? handleFocus : handleBlur)(
-        manager,
-        { session_id: "aa11", ...params },
-        { cdp, tabsApi, signal },
-      ),
-  };
-}
-
-afterEach(() => {
-  vi.restoreAllMocks();
-  document.body.innerHTML = "";
-});
-
-describe("focus and blur state verification", () => {
-  it.each(["open", "closed"] as const)("handles nested %s shadow roots", async (mode) => {
-    const host = document.createElement("div");
-    document.body.append(host);
-    const outer = host.attachShadow({ mode });
-    const innerHost = document.createElement("div");
-    outer.append(innerHost);
-    const inner = innerHost.attachShadow({ mode });
-    const element = document.createElement("input");
-    inner.append(element);
-    const h = await setup(element);
-    expect(await h.run("focus")).toMatchObject({ focused: true });
-    expect(inner.activeElement).toBe(element);
-    expect(await h.run("blur")).toMatchObject({ was_focused: true, focused: false });
-    expect(inner.activeElement).toBeNull();
-    expect(h.release).toHaveBeenCalledTimes(2);
-  });
-
-  it("keeps DOM focus usable when the document is in the background", async () => {
-    const h = await setup();
-    vi.spyOn(document, "hasFocus").mockReturnValue(false);
-    expect(await h.run("focus")).toMatchObject({ focused: true });
-    expect(await h.run("blur")).toMatchObject({ was_focused: true, focused: false });
-  });
-
-  it("blurring an unfocused target preserves the other element's focus", async () => {
-    const h = await setup();
-    const other = document.querySelector<HTMLInputElement>("#other")!;
-    other.focus();
-    expect(await h.run("blur")).toMatchObject({ was_focused: false, focused: false });
-    expect(document.activeElement).toBe(other);
-  });
-
-  it("detects focus redirected by a focus handler's microtask", async () => {
-    const h = await setup();
-    h.element.addEventListener("focus", () =>
-      queueMicrotask(() => document.querySelector<HTMLInputElement>("#other")!.focus()),
-    );
-    expect(await h.run("focus")).toMatchObject({
-      code: "cdp_failed",
-      message: "target element did not become focused",
-    });
-    expect(h.release).toHaveBeenCalledOnce();
-  });
-
-  it("does not report blur success when a microtask restores focus", async () => {
-    const h = await setup();
-    h.element.focus();
-    h.element.addEventListener("blur", () => queueMicrotask(() => h.element.focus()));
-    expect(await h.run("blur")).toMatchObject({
-      code: "cdp_failed",
-      message: "target element remained focused after blur()",
-    });
-    expect(document.activeElement).toBe(h.element);
-    expect(h.release).toHaveBeenCalledOnce();
-  });
-
-  it.each(["focus", "blur"] as const)("rejects a detached %s target", async (action) => {
-    const h = await setup();
-    h.element.remove();
-    expect(await h.run(action)).toMatchObject({ code: "cdp_failed" });
-    expect(h.release).toHaveBeenCalledOnce();
-  });
-
-  it("preserves a script exception's cause", async () => {
-    const h = await setup();
-    vi.spyOn(h.element, "blur").mockImplementation(() => {
-      throw new Error("page blur failed");
-    });
-    expect(await h.run("blur")).toMatchObject({
-      code: "cdp_failed",
-      message: expect.stringContaining("page blur failed"),
-    });
-    expect(h.release).toHaveBeenCalledOnce();
-  });
-
-  it.each(["focus", "blur"] as const)("rejects malformed %s script results", async (action) => {
-    const h = await setup();
-    h.script.mockResolvedValueOnce({ result: { value: null } });
-    expect(await h.run(action)).toMatchObject({
-      code: "cdp_failed",
-      message: expect.stringContaining("unexpected result"),
-    });
-    expect(h.release).toHaveBeenCalledOnce();
-  });
-
-  it.each([
-    "focus",
-    "blur",
-  ] as const)("keeps %s, verification and cleanup in the OOPIF session", async (action) => {
-    const h = await setup(undefined, true);
-    if (action === "blur") h.element.focus();
-    expect(await h.run(action)).toMatchObject({ focused: action === "focus" });
-    const targetCalls = h.calls.filter((call) => call.method !== "DOM.scrollIntoViewIfNeeded");
-    expect(targetCalls.every((call) => call.target.sessionId === "child-session")).toBe(true);
-    expect(targetCalls.at(-1)?.method).toBe("Runtime.releaseObject");
-  });
-
-  it.each(["focus", "blur"] as const)("rejects %s on a user tab before CDP", async (action) => {
-    const h = await setup();
-    h.tabsApi.get.mockResolvedValue({ id: 9, windowId: 200, active: true } as chrome.tabs.Tab);
-    expect(await h.run(action, undefined, { ref: "e1", tab_id: 9 })).toMatchObject({
-      code: "permission_denied",
-    });
-    expect(h.calls).toEqual([]);
-  });
-
-  it("does not replace a successful result when navigation disposed the remote object", async () => {
-    const h = await setup();
-    h.release.mockRejectedValue(new Error("Cannot find context"));
-    expect(await h.run("focus")).toMatchObject({ focused: true });
-  });
-});
-
-describe("focus and blur cancellation", () => {
-  const boundaries = [
-    "DOM.getDocument",
-    "DOM.querySelector",
-    "DOM.describeNode",
-    "DOM.resolveNode",
-    "Runtime.callFunctionOn",
-  ];
-  for (const action of ["focus", "blur"] as const) {
-    it.each(
-      action === "focus" ? [...boundaries, "DOM.scrollIntoViewIfNeeded", "DOM.focus"] : boundaries,
-    )(`${action} stops after cancellation during %s`, async (method) => {
-      const h = await setup();
-      const abort = new AbortController();
-      let cancelledAfter = 0;
-      h.afterCommand.mockImplementation((call) => {
-        if (call.method === method && !abort.signal.aborted) {
-          cancelledAfter = h.calls.length;
-          abort.abort();
-        }
-      });
-      expect(await h.run(action, abort.signal, { selector: "#target" })).toMatchObject({
-        code: "cancelled",
-      });
-      expect(abort.signal.aborted).toBe(true);
-      expect(
-        h.calls.slice(cancelledAfter).every((call) => call.method === "Runtime.releaseObject"),
-      ).toBe(true);
-      if (h.calls.some((call) => call.method === "DOM.resolveNode"))
-        expect(h.release).toHaveBeenCalledOnce();
-    });
-
-    it(`${action} stops if cancellation arrives while resolving the tab`, async () => {
-      const h = await setup();
-      const abort = new AbortController();
-      h.tabsApi.query.mockImplementation(async () => {
-        abort.abort();
-        return [{ id: 4, windowId: 100, active: true } as chrome.tabs.Tab];
-      });
-      expect(await h.run(action, abort.signal)).toMatchObject({ code: "cancelled" });
-      expect(h.calls).toEqual([]);
-    });
-  }
-
-  it("does not scroll frame owners after cancellation in an OOPIF", async () => {
-    const h = await setup(undefined, true);
-    const abort = new AbortController();
-    h.afterCommand.mockImplementation((call) => {
-      if (call.method === "DOM.scrollIntoViewIfNeeded") abort.abort();
-    });
-    expect(await h.run("focus", abort.signal)).toMatchObject({ code: "cancelled" });
-    expect(h.calls.filter((call) => call.method === "DOM.scrollIntoViewIfNeeded")).toHaveLength(1);
-    expect(h.focus).not.toHaveBeenCalled();
-  });
-});

apps/extension/src/tools/__tests__/frame-geometry.test.ts

@@ -1,5 +1,9 @@
 import { describe, expect, it, vi } from "vitest";
-import { resolveNodeGeometry } from "../frame-geometry";
+import {
+  createFrameGeometryContext,
+  resolveFrameProjection,
+  resolveNodeGeometry,
+} from "../frame-geometry";
 import {
   clipPolygon,
   polygonArea,
@@ -10,141 +14,9 @@ import {
   rectPolygon,
   regionBounds,
 } from "../geometry";
-import { GeometryContext } from "../geometry/frame-context";
 import type { CdpRunner } from "../shared";
 
-function scrollbarDriver(
-  visible = { width: 185, height: 89 },
-  frameSize: unknown = { width: 200, height: 100 },
-) {
-  const send = vi.fn(async (target: { sessionId?: string }, method: string) => {
-    if (method === "Runtime.evaluate") return { result: { value: frameSize } };
-    if (method === "Page.getLayoutMetrics")
-      return {
-        cssLayoutViewport: {
-          clientWidth: target.sessionId ? visible.width : 800,
-          clientHeight: target.sessionId ? visible.height : 600,
-        },
-      };
-    if (method === "DOM.getBoxModel")
-      return {
-        model: {
-          content: target.sessionId
-            ? [0, 0, 200, 0, 200, 100, 0, 100]
-            : [100, 100, 500, 100, 500, 300, 100, 300],
-        },
-      };
-    if (method === "DOM.getContentQuads")
-      return { quads: [[180, 80, 230, 80, 230, 120, 180, 120]] };
-    throw new Error(`unexpected ${method}`);
-  });
-  const cdp: CdpRunner = {
-    send: (tabId, method) => send({ tabId } as never, method) as never,
-    sendToTarget: send as CdpRunner["sendToTarget"],
-    getFrameGraph: async () => ({
-      rootFrameId: "main",
-      frames: [
-        { frameId: "main", target: { tabId: 4 } },
-        {
-          frameId: "child",
-          parentFrameId: "main",
-          ownerBackendNodeId: 10,
-          target: { tabId: 4, sessionId: "child" },
-        },
-        {
-          frameId: "same-child",
-          parentFrameId: "child",
-          ownerBackendNodeId: 20,
-          target: { tabId: 4, sessionId: "child" },
-        },
-      ],
-    }),
-  };
-  return { cdp, send };
-}
-
 describe("frame geometry projection", () => {
-  it.each([
-    { width: 200, height: 100 },
-    { width: 185, height: 100 },
-    { width: 200, height: 89 },
-    { width: 185, height: 89 },
-  ])("preserves scale and clips scrollbar strips for visible viewport $width × $height", async (visible) => {
-    const { cdp, send } = scrollbarDriver(visible);
-    const geometry = await resolveNodeGeometry(cdp, 4, {
-      target: { tabId: 4, sessionId: "child" },
-      frameId: "child",
-      backendNodeId: 101,
-    });
-    expect(geometry).toMatchObject({
-      topBounds: {
-        x: 460,
-        y: 260,
-        width: (visible.width - 180) * 2,
-        height: (visible.height - 80) * 2,
-      },
-      actionPoint: { x: 460 + visible.width - 180, y: 260 + visible.height - 80 },
-      targetActionPoint: { x: (180 + visible.width) / 2, y: (80 + visible.height) / 2 },
-    });
-    expect(send.mock.calls.filter(([, method]) => method === "Runtime.evaluate")).toHaveLength(1);
-    expect(send.mock.calls.filter(([, method]) => method === "Page.getLayoutMetrics")).toHaveLength(
-      2,
-    );
-  });
-
-  it("shares the full viewport read across same-target frames, and refreshes it next operation", async () => {
-    const { cdp, send } = scrollbarDriver();
-    const context = new GeometryContext(cdp, 4);
-    await Promise.all([context.targetProjection("child"), context.targetProjection("same-child")]);
-    expect(send.mock.calls.filter(([, method]) => method === "Runtime.evaluate")).toHaveLength(1);
-    await new GeometryContext(cdp, 4).targetProjection("child");
-    expect(send.mock.calls.filter(([, method]) => method === "Runtime.evaluate")).toHaveLength(2);
-  });
-
-  it.each([
-    null,
-    {},
-    { width: 0, height: 100 },
-    { width: 200, height: NaN },
-  ])("rejects unavailable full viewport dimensions: %j", async (size) => {
-    const { cdp } = scrollbarDriver(undefined, size);
-    expect(await new GeometryContext(cdp, 4).targetProjection("child")).toBeNull();
-  });
-
-  it("clips an inner OOPIF against an intermediate OOPIF's occupied scrollbar strips", async () => {
-    const { cdp } = scrollbarDriver();
-    const outer = cdp.sendToTarget!;
-    cdp.sendToTarget = async (target, method, params) => {
-      if (method === "DOM.getBoxModel")
-        return { model: { content: [150, 60, 250, 60, 250, 120, 150, 120] } } as never;
-      if (target.sessionId !== "inner") return outer(target, method, params);
-      if (method === "Runtime.evaluate")
-        return { result: { value: { width: 100, height: 60 } } } as never;
-      if (method === "Page.getLayoutMetrics")
-        return { cssLayoutViewport: { clientWidth: 90, clientHeight: 50 } } as never;
-      if (method === "DOM.getContentQuads")
-        return { quads: [[0, 0, 100, 0, 100, 60, 0, 60]] } as never;
-      throw new Error(`unexpected ${method}`);
-    };
-    const graph = await cdp.getFrameGraph!(4);
-    graph.frames[2] = {
-      frameId: "inner",
-      parentFrameId: "child",
-      ownerBackendNodeId: 20,
-      target: { tabId: 4, sessionId: "inner" },
-    };
-    cdp.getFrameGraph = async () => graph;
-    expect(
-      await resolveNodeGeometry(cdp, 4, {
-        target: { tabId: 4, sessionId: "inner" },
-        frameId: "inner",
-        backendNodeId: 101,
-      }),
-    ).toMatchObject({
-      topBounds: { x: 400, y: 220, width: 70, height: 58 },
-    });
-  });
-
   it("keeps region bounds separate from polygon area", () => {
     const region = [
       rectPolygon({ x: 0, y: 0, w: 10, h: 10 }),
@@ -169,6 +41,53 @@ describe("frame geometry projection", () => {
     expect(polygonBounds(projected.flat())).toEqual({ x: 224, y: 346, width: 200, height: 80 });
   });
 
+  it("projects nested same-target frame-local bounds through authoritative content quads", async () => {
+    const boxCalls: number[] = [];
+    const cdp: CdpRunner = {
+      send: vi.fn(async (_tabId, method, params) => {
+        if (method === "Page.getLayoutMetrics") {
+          return { cssLayoutViewport: { clientWidth: 1_000, clientHeight: 800 } };
+        }
+        if (method === "Page.createIsolatedWorld") return { executionContextId: 91 };
+        if (method === "Runtime.evaluate") {
+          return { result: { value: { width: 100, height: 80 } } };
+        }
+        if (method === "DOM.getBoxModel") {
+          const backendNodeId = (params as { backendNodeId?: number }).backendNodeId ?? 0;
+          boxCalls.push(backendNodeId);
+          return backendNodeId === 10
+            ? { model: { content: [30, 100.5, 330, 100.5, 330, 300.5, 30, 300.5] } }
+            : { model: { content: [45, 120.5, 145, 120.5, 145, 200.5, 45, 200.5] } };
+        }
+        throw new Error(`unexpected ${method}`);
+      }) as CdpRunner["send"],
+    };
+    const geometry = createFrameGeometryContext(cdp, {
+      rootFrameId: "main",
+      frames: [
+        { frameId: "main", target: { tabId: 4 } },
+        {
+          frameId: "child",
+          parentFrameId: "main",
+          ownerBackendNodeId: 10,
+          target: { tabId: 4 },
+        },
+        {
+          frameId: "nested",
+          parentFrameId: "child",
+          ownerBackendNodeId: 20,
+          target: { tabId: 4 },
+        },
+      ],
+    });
+
+    await expect(
+      geometry.projectFrameLocalRect("nested", { x: 12, y: 12, w: 40, h: 20 }),
+    ).resolves.toEqual({ x: 57, y: 132.5, width: 40, height: 20 });
+    await geometry.projectFrameLocalRect("nested", { x: 1, y: 1, w: 2, h: 2 });
+    expect(boxCalls.sort()).toEqual([10, 20]);
+  });
+
   it("uses a projective mapping for perspective-transformed iframe quads", () => {
     const quad: Quad = [
       { x: 0, y: 0 },
@@ -208,32 +127,34 @@ describe("frame geometry projection", () => {
     const cdp: CdpRunner = {
       send: send as CdpRunner["send"],
       sendToTarget: vi.fn(async (_target, method) => {
-        if (method === "Runtime.evaluate")
-          return { result: { value: { width: 200, height: 100 } } };
         if (method === "Page.getLayoutMetrics") {
           return { cssLayoutViewport: { clientWidth: 200, clientHeight: 100 } };
         }
         throw new Error(`unexpected child command ${method}`);
       }) as CdpRunner["sendToTarget"],
     };
-    const projection = await new GeometryContext(cdp, 4, {
-      rootFrameId: "main",
-      frames: [
-        { frameId: "main", target: { tabId: 4 } },
-        {
-          frameId: "same-process-parent",
-          parentFrameId: "main",
-          ownerBackendNodeId: 10,
-          target: { tabId: 4 },
-        },
-        {
-          frameId: "oopif",
-          parentFrameId: "same-process-parent",
-          ownerBackendNodeId: 20,
-          target: { tabId: 4, sessionId: "oopif-session" },
-        },
-      ],
-    }).targetProjection("oopif");
+    const projection = await resolveFrameProjection(
+      cdp,
+      {
+        rootFrameId: "main",
+        frames: [
+          { frameId: "main", target: { tabId: 4 } },
+          {
+            frameId: "same-process-parent",
+            parentFrameId: "main",
+            ownerBackendNodeId: 10,
+            target: { tabId: 4 },
+          },
+          {
+            frameId: "oopif",
+            parentFrameId: "same-process-parent",
+            ownerBackendNodeId: 20,
+            target: { tabId: 4, sessionId: "oopif-session" },
+          },
+        ],
+      },
+      "oopif",
+    );
 
     expect(projection?.edges).toEqual([
       {
@@ -268,8 +189,6 @@ describe("frame geometry projection", () => {
         throw new Error(`unexpected root command ${method}`);
       }) as CdpRunner["send"],
       sendToTarget: vi.fn(async (_target, method) => {
-        if (method === "Runtime.evaluate")
-          return { result: { value: { width: 200, height: 100 } } };
         if (method === "Page.getLayoutMetrics") {
           return { cssLayoutViewport: { clientWidth: 200, clientHeight: 100 } };
         }
@@ -331,8 +250,6 @@ describe("frame geometry projection", () => {
       }) as CdpRunner["send"],
       sendToTarget: vi.fn(async (_target, method) => {
         if (method === "DOM.scrollIntoViewIfNeeded") return {};
-        if (method === "Runtime.evaluate")
-          return { result: { value: { width: 200, height: 100 } } };
         if (method === "Page.getLayoutMetrics") {
           return { cssLayoutViewport: { clientWidth: 200, clientHeight: 100 } };
         }

apps/extension/src/tools/__tests__/geometry-context.test.ts

@@ -1,464 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import type { CdpFrameGraph } from "@/browser-driver/frame-graph";
-import { resolveNodeGeometry } from "../frame-geometry";
-import { rectPolygon } from "../geometry";
-import {
-  projectSnapshotRect,
-  screenshotPageRect,
-  snapshotCoordinates,
-  snapshotViewportRect,
-} from "../geometry/coordinate-types";
-import { GeometryContext, snapshotLayoutScale } from "../geometry/frame-context";
-import type { CdpRunner } from "../shared";
-
-const target = { tabId: 4 };
-const graph: CdpFrameGraph = {
-  rootFrameId: "main",
-  frames: [
-    { frameId: "main", target },
-    { frameId: "child", parentFrameId: "main", ownerBackendNodeId: 10, target },
-  ],
-};
-
-function driver() {
-  const send = vi.fn(async (_tab: number, method: string): Promise<object> => {
-    if (method === "Page.getLayoutMetrics")
-      return {
-        visualViewport: { clientWidth: 1000 },
-        cssVisualViewport: { clientWidth: 1000 },
-        cssLayoutViewport: { clientWidth: 1000, clientHeight: 1000 },
-      };
-    if (method === "DOM.getBoxModel")
-      return { model: { content: [52.5, 612.5, 427.5, 612.5, 427.5, 862.5, 52.5, 862.5] } };
-    if (method === "DOM.resolveNode") return { object: { objectId: "owner" } };
-    if (method === "Runtime.callFunctionOn")
-      return { result: { value: { width: 300, height: 200 } } };
-    if (method === "Runtime.releaseObject") return {};
-    throw new Error(method);
-  });
-  return { send: send as CdpRunner["send"], getFrameGraph: vi.fn(async () => graph), calls: send };
-}
-
-describe("measurement geometry context", () => {
-  it.each([0.8, 1, 1.25, 2])("normalizes snapshot layout units at scale %s", (scale) => {
-    const measured = snapshotLayoutScale({
-      visualViewport: { clientWidth: 997.25, zoom: 1.1 },
-      cssVisualViewport: { clientWidth: 997.25 / scale, zoom: 1.1 },
-      // Rounded layout dimensions must not supply the scale.
-      layoutViewport: { clientWidth: 997 },
-      cssLayoutViewport: { clientWidth: Math.floor(997.25 / scale) },
-    });
-    expect(measured).toBeCloseTo(scale, 12);
-    const coordinates = snapshotCoordinates(
-      { scrollOffsetX: 80 * scale, scrollOffsetY: 200 * scale },
-      measured,
-      { x: 999, y: 999 },
-    );
-    expect(
-      snapshotViewportRect(
-        [160 * scale, 320 * scale, 120 * scale, 40 * scale],
-        { target },
-        coordinates,
-      )?.rect,
-    ).toEqual({ x: 80, y: 120, width: 120, height: 40 });
-  });
-
-  it("uses CSS root scroll only for missing snapshot offsets, without scaling it twice", () => {
-    const coordinates = snapshotCoordinates({ scrollOffsetX: 80 }, 2, { x: 999, y: 100 });
-    expect(snapshotViewportRect([200, 800, 240, 80], { target }, coordinates)?.rect).toEqual({
-      x: 60,
-      y: 300,
-      width: 120,
-      height: 40,
-    });
-    expect(snapshotCoordinates({ scrollOffsetX: 0 }, 2)).toBeNull();
-    expect(
-      snapshotCoordinates({ scrollOffsetX: NaN, scrollOffsetY: 0 }, 2, { x: 0, y: 0 }),
-    ).toBeNull();
-  });
-
-  it("does not infer snapshot units from missing, invalid, or CSS-only metrics", () => {
-    expect(snapshotLayoutScale({ cssLayoutViewport: { clientWidth: 800 } })).toBeNull();
-    for (const raw of [0, -1, NaN, Infinity]) {
-      expect(
-        snapshotLayoutScale({
-          visualViewport: { clientWidth: raw },
-          cssVisualViewport: { clientWidth: 800 },
-        }),
-      ).toBeNull();
-    }
-    expect(
-      snapshotLayoutScale({
-        visualViewport: { clientWidth: 0, clientHeight: 600 },
-        cssVisualViewport: { clientWidth: 0, clientHeight: 300 },
-      }),
-    ).toBe(2);
-    expect(snapshotCoordinates({ scrollOffsetX: 0, scrollOffsetY: 0 }, null)).toBeNull();
-    expect(snapshotViewportRect([10, 20, 120, 40], { target }, null)).toBeNull();
-  });
-
-  it("shares in-flight frame measurements, but never shares them with the next context", async () => {
-    const cdp = driver();
-    const context = new GeometryContext(cdp, 4);
-    const results = await Promise.all(
-      Array.from({ length: 20 }, () => context.targetProjection("child")),
-    );
-    expect(results.every((value) => value === results[0])).toBe(true);
-    expect(cdp.getFrameGraph).toHaveBeenCalledTimes(1);
-    expect(cdp.calls.mock.calls.map(([, method]) => method)).toEqual([
-      "Page.getLayoutMetrics",
-      "DOM.getBoxModel",
-    ]);
-    await new GeometryContext(cdp, 4).targetProjection("child");
-    expect(cdp.getFrameGraph).toHaveBeenCalledTimes(2);
-    expect(cdp.calls.mock.calls).toHaveLength(4);
-  });
-
-  it("projects frame-local snapshot CSS bounds through the scaled owner content quad", async () => {
-    const cdp = driver();
-    const context = new GeometryContext(cdp, 4);
-    const source = { target, frameId: "child" };
-    const projection = await context.snapshotProjection(source, 10, [], {
-      width: 1000,
-      height: 1000,
-    });
-    if (projection.status !== "available") throw new Error("expected available projection");
-    const input = snapshotViewportRect([17, 23, 120, 40], source, {
-      layoutUnitsPerCssPixel: 1,
-      scrollCss: { x: 0, y: 0 },
-    });
-    expect(projectSnapshotRect(input!, projection.projection)).toEqual({
-      x: 73.75,
-      y: 641.25,
-      width: 150,
-      height: 50,
-    });
-    const scrolled = snapshotViewportRect([17, 23, 120, 40], source, {
-      layoutUnitsPerCssPixel: 1,
-      scrollCss: { x: 0, y: 10 },
-    });
-    expect(projectSnapshotRect(scrolled!, projection.projection)?.y).toBe(628.75);
-    await context.snapshotProjection(source, 10, [], { width: 1000, height: 1000 });
-    expect(cdp.calls.mock.calls.filter(([, method]) => method === "DOM.resolveNode")).toHaveLength(
-      1,
-    );
-    expect(
-      cdp.calls.mock.calls.filter(([, method]) => method === "Runtime.releaseObject"),
-    ).toHaveLength(1);
-  });
-
-  it("falls back only for missing or invalid batch entries and does not reuse sizes across contexts", async () => {
-    const cdp = driver();
-    const original = cdp.send;
-    const calls: string[] = [];
-    cdp.send = async (tabId, method, params) => {
-      calls.push(method);
-      if (method === "Runtime.evaluate")
-        return {
-          result: {
-            deepSerializedValue: {
-              type: "array",
-              value: [
-                {
-                  type: "array",
-                  value: [
-                    { type: "node", value: { backendNodeId: 10 } },
-                    { type: "string", value: '{"width":300,"height":200}' },
-                  ],
-                },
-                {
-                  type: "array",
-                  value: [
-                    { type: "node", value: { backendNodeId: 11 } },
-                    { type: "string", value: '{"width":0,"height":200}' },
-                  ],
-                },
-              ],
-            },
-          },
-        } as never;
-      if (method === "Runtime.releaseObjectGroup") return {} as never;
-      return original(tabId, method, params);
-    };
-    const context = new GeometryContext(cdp, 4);
-    context.registerSnapshotOwners(target, new Set([10, 11]));
-    const values = await Promise.all(
-      [10, 11].map((id) =>
-        context.snapshotProjection({ target, frameId: String(id) }, id, [], {
-          width: 1000,
-          height: 1000,
-        }),
-      ),
-    );
-    expect(values.every((value) => value.status === "available")).toBe(true);
-    expect(calls.filter((method) => method === "DOM.resolveNode")).toHaveLength(1);
-    expect(calls.filter((method) => method === "Runtime.evaluate")).toHaveLength(1);
-    await new GeometryContext(cdp, 4).snapshotProjection({ target, frameId: "child" }, 10, [], {
-      width: 1000,
-      height: 1000,
-    });
-    expect(calls.filter((method) => method === "DOM.resolveNode")).toHaveLength(2);
-  });
-
-  it("waits for batch object cleanup and propagates cancellation", async () => {
-    const cdp = driver();
-    const original = cdp.send;
-    const controller = new AbortController();
-    let release!: () => void;
-    let cleanup!: () => void;
-    const started = new Promise<void>((resolve) => {
-      cleanup = resolve;
-    });
-    cdp.send = async (tabId, method, params) => {
-      if (method === "Runtime.evaluate") return {} as never;
-      if (method === "Runtime.releaseObjectGroup") {
-        cleanup();
-        await new Promise<void>((resolve) => {
-          release = resolve;
-        });
-        return {} as never;
-      }
-      return original(tabId, method, params);
-    };
-    const context = new GeometryContext(cdp, 4, undefined, controller.signal);
-    context.registerSnapshotOwners(target, new Set([10, 11]));
-    let settled = false;
-    const operation = context
-      .snapshotProjection({ target, frameId: "child" }, 10, [], { width: 1000, height: 1000 })
-      .finally(() => {
-        settled = true;
-      });
-    const rejected = expect(operation).rejects.toMatchObject({ name: "AbortError" });
-    await started;
-    controller.abort();
-    expect(settled).toBe(false);
-    release();
-    await rejected;
-    expect(cdp.calls.mock.calls.some(([, method]) => method === "DOM.resolveNode")).toBe(false);
-  });
-
-  it("rejects owner mismatches and invalid numeric bounds", () => {
-    const input = snapshotViewportRect(
-      [30, 50, 120, 40],
-      { target, frameId: "main" },
-      { layoutUnitsPerCssPixel: 1, scrollCss: { x: 10, y: 20 } },
-    )!;
-    const projection = {
-      source: { target, frameId: "main" },
-      geometry: { sourceClips: [], edges: [], topViewport: { width: 800, height: 600 } },
-    };
-    expect(projectSnapshotRect(input, projection)).toEqual({
-      x: 20,
-      y: 30,
-      width: 120,
-      height: 40,
-    });
-    expect(
-      projectSnapshotRect(input, { ...projection, source: { target, frameId: "other" } }),
-    ).toBeNull();
-    expect(
-      projectSnapshotRect(input, {
-        ...projection,
-        source: { target: { tabId: 5 }, frameId: "main" },
-      }),
-    ).toBeNull();
-    expect(
-      snapshotViewportRect(
-        [0, 0, NaN, 40],
-        { target },
-        { layoutUnitsPerCssPixel: 1, scrollCss: { x: 0, y: 0 } },
-      ),
-    ).toBeNull();
-    expect(
-      snapshotViewportRect(
-        [0, 0, 10, 40],
-        { target },
-        { layoutUnitsPerCssPixel: 1, scrollCss: { x: Infinity, y: 0 } },
-      ),
-    ).toBeNull();
-  });
-
-  it("does not turn a border quad or a failed owner read into a content projection", async () => {
-    const cdp: CdpRunner = {
-      send: vi.fn(async () => ({
-        model: { border: [0, 0, 100, 0, 100, 100, 0, 100] },
-      })) as CdpRunner["send"],
-    };
-    expect(
-      await new GeometryContext(cdp, 4).snapshotProjection({ target, frameId: "child" }, 10, [], {
-        width: 100,
-        height: 100,
-      }),
-    ).toEqual({
-      status: "unavailable",
-      source: { target, frameId: "child" },
-      ownerBackendNodeId: 10,
-    });
-  });
-
-  it("keeps ancestor clips in target coordinates instead of applying nested offsets twice", async () => {
-    const cdp = driver();
-    const projection = await new GeometryContext(cdp, 4).snapshotProjection(
-      { target, frameId: "nested" },
-      10,
-      [rectPolygon({ x: 60, y: 620, w: 100, h: 100 })],
-      { width: 1000, height: 1000 },
-    );
-    if (projection.status !== "available") throw new Error("expected available projection");
-    const input = snapshotViewportRect(
-      [0, 0, 300, 200],
-      { target, frameId: "nested" },
-      { layoutUnitsPerCssPixel: 1, scrollCss: { x: 0, y: 0 } },
-    );
-    expect(projectSnapshotRect(input!, projection.projection)).toEqual({
-      x: 60,
-      y: 620,
-      width: 100,
-      height: 100,
-    });
-  });
-
-  it("rejects malformed frame ancestry without looping", async () => {
-    const cdp = driver();
-    const cycle: CdpFrameGraph = {
-      rootFrameId: "a",
-      frames: [
-        { frameId: "a", parentFrameId: "b", target },
-        { frameId: "b", parentFrameId: "a", target },
-      ],
-    };
-    expect(await new GeometryContext(cdp, 4, cycle).targetProjection("a")).toBeNull();
-    expect(cdp.calls).not.toHaveBeenCalled();
-    const orphan: CdpFrameGraph = {
-      rootFrameId: "a",
-      frames: [{ frameId: "a", parentFrameId: "missing", target }],
-    };
-    expect(await new GeometryContext(cdp, 4, orphan).targetProjection("a")).toBeNull();
-  });
-
-  it("rejects a live node whose frame belongs to another target before any DOM input", async () => {
-    const cdp = driver();
-    expect(
-      await resolveNodeGeometry(
-        cdp,
-        4,
-        { target: { tabId: 4, sessionId: "wrong" }, frameId: "child", backendNodeId: 20 },
-        { scrollIntoView: true },
-      ),
-    ).toMatchObject({ code: "cdp_failed" });
-    expect(cdp.calls).not.toHaveBeenCalled();
-  });
-
-  it("bounds concurrent measurements and does not dispatch queued reads after cancellation", async () => {
-    let active = 0;
-    let peak = 0;
-    const release: Array<() => void> = [];
-    const send = vi.fn(async () => {
-      active++;
-      peak = Math.max(peak, active);
-      await new Promise<void>((resolve) => release.push(resolve));
-      active--;
-      return {
-        visualViewport: { clientWidth: 1000 },
-        cssVisualViewport: { clientWidth: 1000 },
-        cssLayoutViewport: { clientWidth: 100, clientHeight: 100 },
-      };
-    });
-    const controller = new AbortController();
-    const context = new GeometryContext(
-      { send: send as CdpRunner["send"] },
-      4,
-      undefined,
-      controller.signal,
-    );
-    const tasks = Array.from({ length: 8 }, (_, index) =>
-      context.viewport({ tabId: 4, sessionId: String(index) }),
-    );
-    const settled = Promise.allSettled(tasks);
-    expect(send).toHaveBeenCalledTimes(4);
-    controller.abort();
-    for (const done of release) done();
-    const results = await settled;
-    expect(peak).toBe(4);
-    expect(send).toHaveBeenCalledTimes(4);
-    expect(results.filter((item) => item.status === "rejected")).toHaveLength(4);
-  });
-
-  it("releases an owner object even when cancellation arrives before its viewport read", async () => {
-    const controller = new AbortController();
-    const cdp = driver();
-    const original = cdp.calls.getMockImplementation()!;
-    cdp.calls.mockImplementation(async (tab, method) => {
-      const result = await original(tab, method);
-      if (method === "DOM.resolveNode") controller.abort();
-      return result;
-    });
-    const context = new GeometryContext(cdp, 4, undefined, controller.signal);
-    await expect(
-      context.snapshotProjection({ target, frameId: "child" }, 10, [], {
-        width: 1000,
-        height: 1000,
-      }),
-    ).rejects.toMatchObject({ name: "AbortError" });
-    expect(cdp.calls.mock.calls.map(([, method]) => method)).toEqual([
-      "DOM.getBoxModel",
-      "DOM.resolveNode",
-      "Runtime.releaseObject",
-    ]);
-  });
-
-  it("reads live owner geometry only after scrolling", async () => {
-    const cdp = driver();
-    const original = cdp.calls.getMockImplementation()!;
-    let scrolled = false;
-    cdp.calls.mockImplementation(async (tab, method) => {
-      if (method === "DOM.scrollIntoViewIfNeeded") {
-        scrolled = true;
-        return {};
-      }
-      if (method === "DOM.getContentQuads") {
-        expect(scrolled).toBe(true);
-        return { quads: [[60, 620, 100, 620, 100, 640, 60, 640]] };
-      }
-      if (method === "DOM.getBoxModel") expect(scrolled).toBe(true);
-      return original(tab, method);
-    });
-    expect(
-      await resolveNodeGeometry(
-        cdp,
-        4,
-        { target, frameId: "child", backendNodeId: 20 },
-        { scrollIntoView: true },
-      ),
-    ).toMatchObject({ topBounds: { x: 60, y: 620, width: 40, height: 20 } });
-    expect(cdp.getFrameGraph).toHaveBeenCalledTimes(1);
-    expect(cdp.calls.mock.calls.filter(([, method]) => method === "DOM.getBoxModel")).toHaveLength(
-      1,
-    );
-  });
-
-  it("adapts viewport CSS bounds to page DIP with scroll and browser zoom, never raster DPR", () => {
-    const viewport = { width: 1600, height: 1000, scrollX: 10, scrollY: 100, cssToDip: 0.9 };
-    const clip = screenshotPageRect({ x: 20, y: 30, width: 120, height: 40 }, viewport);
-    expect(clip).toEqual({ space: "page-dip", rect: { x: 27, y: 117, width: 108, height: 36 } });
-    expect(
-      screenshotPageRect({ x: 20, y: 30, width: 120, height: 40 }, { ...viewport, cssToDip: NaN }),
-    ).toBeNull();
-    expect(
-      screenshotPageRect({ x: 20, y: 30, width: 120, height: 40 }, { ...viewport, cssToDip: 0 }),
-    ).toBeNull();
-  });
-
-  it("retries a rejected measurement only in a new operation", async () => {
-    const cdp = driver();
-    cdp.calls.mockRejectedValueOnce(new Error("unavailable"));
-    const context = new GeometryContext(cdp, 4);
-    await expect(context.viewport(target)).rejects.toThrow("unavailable");
-    await expect(context.viewport(target)).rejects.toThrow("unavailable");
-    expect(cdp.calls).toHaveBeenCalledTimes(1);
-    expect(await new GeometryContext(cdp, 4).viewport(target)).toEqual({
-      width: 1000,
-      height: 1000,
-    });
-  });
-});

apps/extension/src/tools/__tests__/human-loop.test.ts

@@ -433,7 +433,6 @@ describe("handleRequestHelp", () => {
       if (method === "DOM.getContentQuads") {
         return { quads: [[10, 20, 110, 20, 110, 60, 10, 60]] };
       }
-      if (method === "Runtime.evaluate") return { result: { value: { width: 200, height: 100 } } };
       if (method === "Page.getLayoutMetrics") {
         return { cssLayoutViewport: { clientWidth: 200, clientHeight: 100 } };
       }

apps/extension/src/tools/__tests__/interaction.test.ts

@@ -2,10 +2,8 @@ import { describe, expect, it, vi } from "vitest";
 import { SessionManager } from "@/session-manager/manager";
 import type { CdpRunner } from "@/tools/shared";
 import {
-  handleBlur,
   handleClick,
   handleFill,
-  handleFocus,
   handleHover,
   handlePress,
   handleSelect,
@@ -125,6 +123,29 @@ describe("handleClick", () => {
     expect(fake.cdp.send).not.toHaveBeenCalled();
   });
 
+  it("rejects screenshot-only visual surface refs before issuing CDP calls", async () => {
+    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
+    const ctx = await sm.start("aa11");
+    ctx.refStore.set("e3", 1234, {
+      tabId: 4,
+      kind: "surface",
+      capabilities: ["screenshot"],
+    });
+    const fake = makeFakeCdp({});
+
+    const res = await handleClick(
+      sm,
+      { session_id: "aa11", ref: "@e3" },
+      { cdp: fake.cdp, tabsApi: fake.tabsApi },
+    );
+
+    expect(res).toMatchObject({
+      code: "permission_denied",
+      data: { reason: "ref_capability_denied", required_capability: "interact" },
+    });
+    expect(fake.cdp.send).not.toHaveBeenCalled();
+  });
+
   it("clicks by ref, computes the quad centre, dispatches three mouse events", async () => {
     const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
     const ctx = await sm.start("aa11");
@@ -203,7 +224,6 @@ describe("handleClick", () => {
       if (method === "DOM.getContentQuads") {
         return { quads: [[10, 20, 110, 20, 110, 60, 10, 60]] };
       }
-      if (method === "Runtime.evaluate") return { result: { value: { width: 200, height: 100 } } };
       if (method === "Page.getLayoutMetrics") {
         return { cssLayoutViewport: { clientWidth: 200, clientHeight: 100 } };
       }
@@ -223,7 +243,6 @@ describe("handleClick", () => {
       { sessionId: "child-session", method: "DOM.scrollIntoViewIfNeeded" },
       { sessionId: "child-session", method: "DOM.getContentQuads" },
       { sessionId: "child-session", method: "Page.getLayoutMetrics" },
-      { sessionId: "child-session", method: "Runtime.evaluate" },
     ]);
     expect(fake.sent.filter((call) => call.method === "Input.dispatchMouseEvent")).toHaveLength(3);
   });
@@ -544,161 +563,6 @@ describe("handleHover", () => {
   });
 });
 
-describe("handleFocus and handleBlur", () => {
-  it("focuses a ref and verifies the deep active element", async () => {
-    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
-    const ctx = await sm.start("aa11");
-    ctx.refStore.set("e3", 1234, { tabId: 4 });
-    const fake = makeFakeCdp({
-      "DOM.scrollIntoViewIfNeeded": () => ({}),
-      "DOM.focus": () => ({}),
-      "DOM.resolveNode": () => ({ object: { objectId: "focus-target" } }),
-      "Runtime.callFunctionOn": () => ({ result: { value: true } }),
-    });
-
-    const res = await handleFocus(
-      sm,
-      { session_id: "aa11", ref: "@e3" },
-      { cdp: fake.cdp, tabsApi: fake.tabsApi },
-    );
-
-    if ("code" in res) throw new Error(`unexpected error: ${JSON.stringify(res)}`);
-    expect(res).toMatchObject({ tab_id: 4, used_ref: "e3", focused: true });
-    expect(fake.sent.map((call) => call.method)).toEqual([
-      "DOM.scrollIntoViewIfNeeded",
-      "DOM.resolveNode",
-      "DOM.focus",
-      "Runtime.callFunctionOn",
-      "Runtime.releaseObject",
-    ]);
-  });
-
-  it("focuses an OOPIF ref in its CDP session", async () => {
-    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
-    const ctx = await sm.start("aa11");
-    ctx.refStore.set("e3", 1234, {
-      tabId: 4,
-      frameId: "child-frame",
-      cdpSessionId: "child-session",
-    });
-    const fake = makeFakeCdp({
-      "DOM.scrollIntoViewIfNeeded": () => ({}),
-    });
-    fake.cdp.getFrameGraph = vi.fn(async () => ({
-      rootFrameId: "main",
-      frames: [
-        { frameId: "main", target: { tabId: 4 } },
-        {
-          frameId: "child-frame",
-          parentFrameId: "main",
-          ownerBackendNodeId: 99,
-          target: { tabId: 4, sessionId: "child-session" },
-        },
-      ],
-    }));
-    const targetCalls: Array<{ sessionId?: string; method: string }> = [];
-    fake.cdp.sendToTarget = vi.fn(async (target, method) => {
-      targetCalls.push({ sessionId: target.sessionId, method });
-      if (method === "DOM.scrollIntoViewIfNeeded") return {};
-      if (method === "DOM.focus" || method === "Runtime.releaseObject") return {};
-      if (method === "DOM.resolveNode") return { object: { objectId: "focus-target" } };
-      if (method === "Runtime.callFunctionOn") return { result: { value: true } };
-      throw new Error(`unexpected child CDP call ${method}`);
-    }) as CdpRunner["sendToTarget"];
-
-    const res = await handleFocus(
-      sm,
-      { session_id: "aa11", ref: "@e3" },
-      { cdp: fake.cdp, tabsApi: fake.tabsApi },
-    );
-
-    if ("code" in res) throw new Error(`unexpected error: ${JSON.stringify(res)}`);
-    expect(res.focused).toBe(true);
-    expect(targetCalls).toEqual([
-      { sessionId: "child-session", method: "DOM.scrollIntoViewIfNeeded" },
-      { sessionId: "child-session", method: "DOM.resolveNode" },
-      { sessionId: "child-session", method: "DOM.focus" },
-      { sessionId: "child-session", method: "Runtime.callFunctionOn" },
-      { sessionId: "child-session", method: "Runtime.releaseObject" },
-    ]);
-  });
-
-  it("does not focus after cancellation during scrolling", async () => {
-    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
-    const ctx = await sm.start("aa11");
-    ctx.refStore.set("e3", 1234, { tabId: 4 });
-    const abort = new AbortController();
-    const fake = makeFakeCdp({
-      "DOM.scrollIntoViewIfNeeded": () => {
-        abort.abort();
-        return {};
-      },
-    });
-
-    const res = await handleFocus(
-      sm,
-      { session_id: "aa11", ref: "@e3" },
-      { cdp: fake.cdp, tabsApi: fake.tabsApi, signal: abort.signal },
-    );
-
-    expect(res).toMatchObject({ code: "cancelled" });
-    expect(fake.sent.some((call) => call.method === "DOM.focus")).toBe(false);
-  });
-
-  it("blurs a ref and returns its previous focus state", async () => {
-    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
-    const ctx = await sm.start("aa11");
-    ctx.refStore.set("e3", 1234, { tabId: 4 });
-    const fake = makeFakeCdp({
-      "DOM.resolveNode": () => ({ object: { objectId: "focus-target" } }),
-      "Runtime.callFunctionOn": vi
-        .fn()
-        .mockResolvedValueOnce({ result: { value: { ok: true, was_focused: true } } })
-        .mockResolvedValueOnce({ result: { value: false } }),
-    });
-
-    const res = await handleBlur(
-      sm,
-      { session_id: "aa11", ref: "@e3" },
-      { cdp: fake.cdp, tabsApi: fake.tabsApi },
-    );
-
-    if ("code" in res) throw new Error(`unexpected error: ${JSON.stringify(res)}`);
-    expect(res).toMatchObject({
-      tab_id: 4,
-      used_ref: "e3",
-      was_focused: true,
-      focused: false,
-    });
-    expect(fake.sent.map((call) => call.method)).toEqual([
-      "DOM.resolveNode",
-      "Runtime.callFunctionOn",
-      "Runtime.callFunctionOn",
-      "Runtime.releaseObject",
-    ]);
-  });
-
-  it("rejects a target that does not implement blur", async () => {
-    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
-    const ctx = await sm.start("aa11");
-    ctx.refStore.set("e3", 1234, { tabId: 4 });
-    const fake = makeFakeCdp({
-      "DOM.resolveNode": () => ({ object: { objectId: "focus-target" } }),
-      "Runtime.callFunctionOn": () => ({
-        result: { value: { ok: false, was_focused: false, focused: false } },
-      }),
-    });
-
-    const res = await handleBlur(
-      sm,
-      { session_id: "aa11", ref: "@e3" },
-      { cdp: fake.cdp, tabsApi: fake.tabsApi },
-    );
-
-    expect(res).toMatchObject({ code: "invalid_params", message: /does not support blur/ });
-  });
-});
-
 function successfulFillScript(params: unknown) {
   const script = params as { arguments?: Array<{ value: unknown }>; functionDeclaration: string };
   const args = script.arguments ?? [];

apps/extension/src/tools/__tests__/scroll.browser.test.ts

@@ -1,348 +0,0 @@
-// @vitest-environment node
-// Opt in with BSK_SCROLL_CHROME=/path/to/chrome. Uses an isolated browser/profile.
-import { describe, expect, it } from "vitest";
-import type { CdpFrame, CdpFrameGraph, CdpTarget } from "@/browser-driver/frame-graph";
-import { SessionManager } from "@/session-manager/manager";
-import type { ViewportRect } from "../geometry";
-import { handleScrollTo } from "../scroll";
-import type { CdpRunner } from "../shared";
-
-type Send = <T = Record<string, unknown>>(
-  method: string,
-  params?: object,
-  sessionId?: string,
-) => Promise<T>;
-type Tree = { frame: { id: string; parentId?: string; name?: string }; childFrames?: Tree[] };
-
-async function withBrowser(
-  run: (h: Awaited<ReturnType<typeof harness>>) => Promise<void>,
-  zoom = 1,
-) {
-  const { withChrome } = await import(
-    new URL(
-      "../../../../../evals/browser/cases/regression/snapshot-coordinates/chrome.mjs",
-      import.meta.url,
-    ).href
-  );
-  await withChrome(
-    { executable: process.env.BSK_SCROLL_CHROME, deviceScale: 1, zoom },
-    async (send: Send) => run(await harness(send)),
-  );
-}
-
-async function harness(send: Send) {
-  const { targetId } = await send<{ targetId: string }>("Target.createTarget", {
-    url: "about:blank",
-  });
-  const { sessionId: rootSession } = await send<{ sessionId: string }>("Target.attachToTarget", {
-    targetId,
-    flatten: true,
-  });
-  await send("Page.bringToFront", {}, rootSession);
-  const manager = new SessionManager({
-    agentWindow: {
-      create: async () => 100,
-      remove: async () => {},
-      ensureActiveTab: async () => 4,
-    },
-  });
-  const ctx = await manager.start("aa11");
-  const calls: { method: string; sessionId?: string }[] = [];
-  const after = { command: (_method: string) => {} };
-  const sessionFor = (target: CdpTarget) => target.sessionId ?? rootSession;
-  const forward = async <T>(target: CdpTarget, method: string, params?: object): Promise<T> => {
-    calls.push({ method, sessionId: target.sessionId });
-    const result = await send<T>(method, params, sessionFor(target));
-    after.command(method);
-    return result;
-  };
-  const cdp: CdpRunner = {
-    send: (_tab, method, params) => forward({ tabId: 4 }, method, params),
-    sendToTarget: forward,
-  };
-  const evaluate = async <T>(expression: string, frame?: CdpFrame): Promise<T> => {
-    const session = frame ? sessionFor(frame.target) : rootSession;
-    const world = frame
-      ? await send<{ executionContextId: number }>(
-          "Page.createIsolatedWorld",
-          {
-            frameId: frame.frameId,
-            worldName: "scroll-oracle",
-          },
-          session,
-        )
-      : undefined;
-    const reply = await send<{ result: { value: T }; exceptionDetails?: unknown }>(
-      "Runtime.evaluate",
-      {
-        expression,
-        contextId: world?.executionContextId,
-        returnByValue: true,
-        awaitPromise: true,
-      },
-      session,
-    );
-    expect(reply.exceptionDetails).toBeUndefined();
-    return reply.result.value;
-  };
-  const rememberRef = (frame: CdpFrame, backendNodeId: number) =>
-    ctx.refStore.set("e1", backendNodeId, {
-      tabId: 4,
-      frameId: frame.frameId,
-      cdpSessionId: frame.target.sessionId,
-    });
-  const ref = async (frame: CdpFrame, selector = "#probe") => {
-    const { executionContextId } = await send<{ executionContextId: number }>(
-      "Page.createIsolatedWorld",
-      {
-        frameId: frame.frameId,
-        worldName: "scroll-oracle",
-      },
-      sessionFor(frame.target),
-    );
-    const { result } = await send<{ result: { objectId: string } }>(
-      "Runtime.evaluate",
-      {
-        expression: `document.querySelector(${JSON.stringify(selector)})`,
-        contextId: executionContextId,
-      },
-      sessionFor(frame.target),
-    );
-    const { node } = await send<{ node: { backendNodeId: number } }>(
-      "DOM.describeNode",
-      { objectId: result.objectId },
-      sessionFor(frame.target),
-    );
-    await send("Runtime.releaseObject", { objectId: result.objectId }, sessionFor(frame.target));
-    rememberRef(frame, node.backendNodeId);
-  };
-  const scroll = (target: { selector: string } | { ref: string }, signal?: AbortSignal) =>
-    handleScrollTo(
-      manager,
-      { session_id: "aa11", ...target },
-      {
-        cdp,
-        signal,
-        tabsApi: {
-          get: async (id) => ({ id, windowId: 100, active: true }) as chrome.tabs.Tab,
-          query: async () => [{ id: 4, windowId: 100, active: true } as chrome.tabs.Tab],
-        },
-      },
-    );
-  const loadFrames = async () => {
-    const { targetInfos } = await send<{ targetInfos: { targetId: string; type: string }[] }>(
-      "Target.getTargets",
-    );
-    const sessions = [rootSession];
-    for (const target of targetInfos.filter((t) => t.type === "iframe")) {
-      const { sessionId } = await send<{ sessionId: string }>("Target.attachToTarget", {
-        targetId: target.targetId,
-        flatten: true,
-      });
-      sessions.push(sessionId);
-    }
-    const frames: (CdpFrame & { name: string })[] = [];
-    for (const session of sessions) {
-      const { frameTree } = await send<{ frameTree: Tree }>("Page.getFrameTree", {}, session);
-      const target = { tabId: 4, ...(session !== rootSession ? { sessionId: session } : {}) };
-      const visit = (tree: Tree, parentFrameId = tree.frame.parentId) => {
-        frames.push({ frameId: tree.frame.id, parentFrameId, target, name: tree.frame.name ?? "" });
-        for (const child of tree.childFrames ?? []) visit(child, tree.frame.id);
-      };
-      visit(frameTree);
-    }
-    for (const frame of frames) {
-      if (!frame.parentFrameId) continue;
-      const parent = frames.find((f) => f.frameId === frame.parentFrameId)!;
-      const owner = await send<{ backendNodeId: number }>(
-        "DOM.getFrameOwner",
-        { frameId: frame.frameId },
-        sessionFor(parent.target),
-      );
-      frame.ownerBackendNodeId = owner.backendNodeId;
-    }
-    const graph: CdpFrameGraph = { rootFrameId: frames[0].frameId, frames };
-    cdp.getFrameGraph = async () => graph;
-    return frames;
-  };
-  return { send, rootSession, evaluate, ref, rememberRef, scroll, loadFrames, calls, after };
-}
-
-function intersection(a: ViewportRect, b: ViewportRect): ViewportRect | null {
-  const x = Math.max(a.x, b.x),
-    y = Math.max(a.y, b.y);
-  const right = Math.min(a.x + a.width, b.x + b.width),
-    bottom = Math.min(a.y + a.height, b.y + b.height);
-  return right > x && bottom > y ? { x, y, width: right - x, height: bottom - y } : null;
-}
-
-function expectRect(actual: unknown, expected: ViewportRect) {
-  expect(actual).not.toHaveProperty("code");
-  for (const key of ["x", "y", "width", "height"] as const)
-    expect(Math.abs((actual as ViewportRect)[key] - expected[key]), key).toBeLessThan(2);
-}
-
-describe.skipIf(!process.env.BSK_SCROLL_CHROME)("real browser scroll-to", () => {
-  it("scrolls ordinary elements and reports the clipped portion of nested scrollers", async () => {
-    await withBrowser(async (h) => {
-      for (const html of [
-        '<div style="height:2200px"></div><div id="target" style="width:100px;height:40px"></div>',
-        '<div style="height:200px"></div><div id="clip" style="height:80px;width:200px;overflow:auto"><div id="target" style="width:100px;height:400px"></div></div>',
-        '<div style="height:200px"></div><div id="clip" style="height:80px;width:200px;overflow:auto;transform:scale(1.25);transform-origin:0 0"><div id="target" style="width:100px;height:400px"></div></div>',
-      ]) {
-        await h.evaluate(`document.body.innerHTML = ${JSON.stringify(html)}`);
-        const result = await h.scroll({ selector: "#target" });
-        const oracle = await h.evaluate<{ rect: ViewportRect; clip?: ViewportRect }>(`({
-          rect: document.querySelector('#target').getBoundingClientRect().toJSON(),
-          clip: document.querySelector('#clip')?.getBoundingClientRect().toJSON()
-        })`);
-        expectRect(result, oracle.clip ? intersection(oracle.rect, oracle.clip)! : oracle.rect);
-      }
-    });
-  });
-
-  it.each([
-    "visibility:hidden",
-    "opacity:0",
-    "display:none",
-    "content-visibility:hidden",
-  ])("rejects %s targets", async (style) => {
-    await withBrowser(async (h) => {
-      await h.evaluate(
-        `document.body.innerHTML = '<div style="${style}"><button id="target">Target</button></div>'`,
-      );
-      expect(await h.scroll({ selector: "#target" })).toMatchObject({
-        code: "permission_denied",
-        data: { reason: "element_not_visible" },
-      });
-    });
-  });
-
-  it("rejects targets fully outside an overflow:clip ancestor", async () => {
-    await withBrowser(async (h) => {
-      await h.evaluate(
-        `document.body.innerHTML = '<div style="height:80px;overflow:clip"><div style="height:150px"></div><button id="target">Target</button></div>'`,
-      );
-      expect(await h.scroll({ selector: "#target" })).toMatchObject({ code: "permission_denied" });
-    });
-  });
-
-  it.each(["open", "closed"])("clips %s shadow-root refs", async (mode) => {
-    await withBrowser(async (h) => {
-      await h.evaluate(`(() => {
-        const host = document.createElement('div'); document.body.append(host);
-        const root = host.attachShadow({mode:'${mode}'});
-        root.innerHTML = '<div style="height:60px;overflow:auto"><button id="probe" style="height:200px;width:100px">Target</button></div>';
-        window.probe = root.querySelector('#probe');
-      })()`);
-      const frames = await h.loadFrames();
-      const { result } = await h.send<{ result: { objectId: string } }>(
-        "Runtime.evaluate",
-        { expression: "window.probe" },
-        h.rootSession,
-      );
-      // Build the ref from the actual closed-root node, as an observation does.
-      const { node } = await h.send<{ node: { backendNodeId: number } }>(
-        "DOM.describeNode",
-        { objectId: result.objectId },
-        h.rootSession,
-      );
-      await h.send("Runtime.releaseObject", { objectId: result.objectId }, h.rootSession);
-      h.rememberRef(frames[0], node.backendNodeId);
-      expect(await h.scroll({ ref: "e1" })).toMatchObject({ height: 60 });
-    });
-  });
-
-  it("cancels after scrolling and releases the measurement object without follow-up reads", async () => {
-    await withBrowser(async (h) => {
-      await h.evaluate("document.body.innerHTML = '<button id=target>Target</button>'");
-      const abort = new AbortController();
-      h.after.command = (method) => {
-        if (method === "DOM.resolveNode") abort.abort();
-      };
-      expect(await h.scroll({ selector: "#target" }, abort.signal)).toMatchObject({
-        code: "cancelled",
-      });
-      expect(h.calls.at(-1)!.method).toBe("Runtime.releaseObjectGroup");
-      expect(h.calls.some((call) => call.method === "Runtime.callFunctionOn")).toBe(false);
-    });
-  });
-
-  it.each([
-    { fixture: "snapshot-coordinates", zoom: 1 },
-    { fixture: "snapshot-coordinates", zoom: 1.25 },
-    { fixture: "oopif-scrollbars", zoom: 1 },
-    { fixture: "oopif-scrollbars", zoom: 0.8 },
-  ])("scrolls nested frames: $fixture at zoom $zoom", async ({ fixture, zoom }) => {
-    const { createEvalServer } = await import(
-      new URL("../../../../../evals/browser/lib/server.mjs", import.meta.url).href
-    );
-    const server = createEvalServer();
-    const { baseUrl } = await server.start();
-    try {
-      await withBrowser(async (h) => {
-        await h.send("Page.navigate", { url: `${baseUrl}/${fixture}?run=scroll` }, h.rootSession);
-        await expect
-          .poll(
-            () =>
-              server
-                .snapshot("scroll")
-                .events.some(
-                  (e: { type: string; data: { root?: boolean } }) =>
-                    e.type === "geometry.ready" && e.data.root,
-                ),
-            { timeout: 10_000 },
-          )
-          .toBe(true);
-        const frames = await h.loadFrames();
-        expect(frames.length).toBe(fixture === "snapshot-coordinates" ? 5 : 3);
-        for (const frame of frames) {
-          await h.ref(frame);
-          const result = await h.scroll({ ref: "e1" });
-          // Independent DOM oracle: CSS border boxes plus this fixture's known
-          // axis-aligned iframe scales. Re-read after each scroll changes layout.
-          let rect = await h.evaluate<ViewportRect>(
-            "document.querySelector('#probe').getBoundingClientRect().toJSON()",
-            frame,
-          );
-          let current = frame;
-          while (true) {
-            const viewport = await h.evaluate<ViewportRect>(
-              "({ x:0, y:0, width:document.documentElement.clientWidth, height:document.documentElement.clientHeight })",
-              current,
-            );
-            rect = intersection(rect, viewport)!;
-            if (!current.parentFrameId) break;
-            const parent = frames.find((f) => f.frameId === current.parentFrameId)!;
-            const owner = await h.evaluate<{ x: number; y: number; scale: number }>(
-              `(() => {
-              const iframe = document.querySelector('iframe[name="${current.name}"]');
-              const r = iframe.getBoundingClientRect(); const s = getComputedStyle(iframe);
-              const scale = r.width / iframe.offsetWidth;
-              return { x:r.x + (iframe.clientLeft + parseFloat(s.paddingLeft))*scale,
-                y:r.y + (iframe.clientTop + parseFloat(s.paddingTop))*scale, scale };
-            })()`,
-              parent,
-            );
-            rect = {
-              x: owner.x + rect.x * owner.scale,
-              y: owner.y + rect.y * owner.scale,
-              width: rect.width * owner.scale,
-              height: rect.height * owner.scale,
-            };
-            current = parent;
-          }
-          expectRect(result, rect);
-        }
-        const child = frames.find((frame) => frame.parentFrameId === frames[0].frameId)!;
-        await h.ref(child);
-        await h.evaluate(
-          `document.querySelector('iframe[name="${child.name}"]').style.opacity = '0'`,
-        );
-        expect(await h.scroll({ ref: "e1" })).toMatchObject({ code: "permission_denied" });
-      }, zoom);
-    } finally {
-      await server.stop();
-    }
-  }, 30_000);
-});

apps/extension/src/tools/__tests__/scroll.test.ts

@@ -1,310 +0,0 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
-import type { CdpFrameGraph, CdpTarget } from "@/browser-driver/frame-graph";
-import { SessionManager } from "@/session-manager/manager";
-import type { JavaScriptDialogInfo, ScrollToParams } from "@/transport/types";
-import type { ViewportRect } from "../geometry";
-import { handleScrollTo } from "../scroll";
-import type { CdpRunner } from "../shared";
-
-interface Call {
-  target: CdpTarget;
-  method: string;
-  params?: Record<string, unknown>;
-  aborted: boolean;
-}
-
-async function fixture(frame: "top" | "same-target" | "oopif" = "top") {
-  const manager = new SessionManager({
-    agentWindow: {
-      create: async () => 100,
-      remove: async () => {},
-      ensureActiveTab: async () => 4,
-    },
-  });
-  const ctx = await manager.start("aa11");
-  ctx.refStore.set("e3", 1234, {
-    tabId: 4,
-    ...(frame !== "top" ? { frameId: "child" } : {}),
-    ...(frame === "oopif" ? { cdpSessionId: "child-session" } : {}),
-  });
-  const abort = new AbortController();
-  const graph: CdpFrameGraph = {
-    rootFrameId: "main",
-    frames: [
-      { frameId: "main", target: { tabId: 4 } },
-      {
-        frameId: "child",
-        parentFrameId: "main",
-        ownerBackendNodeId: 99,
-        target: { tabId: 4, ...(frame === "oopif" ? { sessionId: "child-session" } : {}) },
-      },
-    ],
-  };
-  const rectangles = new Map<number, ViewportRect | null>([
-    [1234, { x: 10, y: 20, width: 100, height: 40 }],
-    [99, { x: 204, y: 306, width: 400, height: 200 }],
-  ]);
-  const calls: Call[] = [];
-  const hooks = {
-    after: (_call: Call) => {},
-    reply: (_call: Call): object | undefined => undefined,
-  };
-  const send = async <T>(target: CdpTarget, method: string, params?: object): Promise<T> => {
-    const call = {
-      target,
-      method,
-      params: params as Call["params"],
-      aborted: abort.signal.aborted,
-    };
-    calls.push(call);
-    const override = hooks.reply(call);
-    hooks.after(call);
-    if (override) return override as T;
-    const args = call.params ?? {};
-    const replies: Record<string, unknown> = {
-      "DOM.getDocument": { root: { nodeId: 1 } },
-      "DOM.querySelector": { nodeId: 2 },
-      "DOM.describeNode": { node: { backendNodeId: 1234 } },
-      "DOM.scrollIntoViewIfNeeded": {},
-      "DOM.resolveNode": { object: { objectId: String(args.backendNodeId) } },
-      "Runtime.callFunctionOn": {
-        result: {
-          value: String(args.functionDeclaration).includes("IntersectionObserver")
-            ? rectangles.get(Number(args.objectId))
-            : { width: 200, height: 100 },
-        },
-      },
-      "Runtime.releaseObject": {},
-      "Runtime.releaseObjectGroup": {},
-      "Runtime.evaluate": { result: { value: { width: 200, height: 100 } } },
-      "Page.getLayoutMetrics": {
-        cssLayoutViewport: {
-          clientWidth: target.sessionId ? 185 : 1280,
-          clientHeight: target.sessionId ? 89 : 720,
-        },
-      },
-      "DOM.getBoxModel": { model: { content: [204, 306, 604, 306, 604, 506, 204, 506] } },
-    };
-    if (!(method in replies)) throw new Error(`unexpected CDP call ${method}`);
-    return replies[method] as T;
-  };
-  const cdp: CdpRunner = {
-    send: (tabId, method, params) => send({ tabId }, method, params),
-    sendToTarget: send,
-    getFrameGraph: vi.fn(async () => {
-      hooks.after({ target: { tabId: 4 }, method: "getFrameGraph", aborted: abort.signal.aborted });
-      return graph;
-    }),
-    trackSessionTab: vi.fn(),
-  };
-  const tabsApi = {
-    get: vi.fn(async (id: number) => ({ id, windowId: 100, active: true }) as chrome.tabs.Tab),
-    query: vi.fn(async () => [{ id: 4, windowId: 100, active: true } as chrome.tabs.Tab]),
-  };
-  const run = (params: Partial<ScrollToParams> = {}) =>
-    handleScrollTo(
-      manager,
-      { session_id: "aa11", ref: "@e3", ...params },
-      { cdp, tabsApi, signal: abort.signal },
-    );
-  return { ctx, cdp, graph, rectangles, calls, hooks, abort, tabsApi, run };
-}
-
-afterEach(() => vi.restoreAllMocks());
-
-describe("handleScrollTo", () => {
-  it("scrolls a ref and returns renderer-clipped bounds", async () => {
-    const f = await fixture();
-    expect(await f.run()).toMatchObject({
-      tab_id: 4,
-      used_ref: "e3",
-      x: 10,
-      y: 20,
-      width: 100,
-      height: 40,
-    });
-    expect(f.calls[0]).toMatchObject({
-      method: "DOM.scrollIntoViewIfNeeded",
-      params: { backendNodeId: 1234 },
-    });
-    const group = f.calls.find((call) => call.method === "DOM.resolveNode")!.params!.objectGroup;
-    expect(f.calls.at(-1)).toMatchObject({
-      method: "Runtime.releaseObjectGroup",
-      params: { objectGroup: group },
-    });
-  });
-
-  it("resolves a selector and tracks the attached tab even when it is missing", async () => {
-    const f = await fixture();
-    expect(await f.run({ ref: undefined, selector: "#target" })).toMatchObject({
-      used_selector: "#target",
-    });
-    f.hooks.reply = ({ method }) => (method === "DOM.querySelector" ? { nodeId: 0 } : undefined);
-    expect(await f.run({ ref: undefined, selector: "#missing" })).toMatchObject({
-      code: "not_found",
-      data: { reason: "selector_not_found" },
-    });
-    expect(f.cdp.trackSessionTab).toHaveBeenCalledWith("aa11", 4);
-  });
-
-  it.each([
-    "same-target",
-    "oopif",
-  ] as const)("projects %s refs and scrolls their owners", async (frame) => {
-    const f = await fixture(frame);
-    expect(await f.run()).toMatchObject({ x: 224, y: 346, width: 200, height: 80 });
-    expect(
-      f.calls
-        .filter((call) => call.method === "DOM.scrollIntoViewIfNeeded")
-        .map((call) => call.params!.backendNodeId),
-    ).toEqual([99, 1234]);
-    expect(f.cdp.getFrameGraph).toHaveBeenCalledTimes(1);
-    if (frame === "oopif")
-      expect(f.calls.find((call) => call.params?.backendNodeId === 1234)!.target.sessionId).toBe(
-        "child-session",
-      );
-  });
-
-  it("clips OOPIF bounds to occupied scrollbars without changing the frame scale", async () => {
-    const f = await fixture("oopif");
-    f.rectangles.set(1234, { x: 180, y: 80, width: 5, height: 9 });
-    expect(await f.run()).toMatchObject({ x: 564, y: 466, width: 10, height: 18 });
-  });
-
-  it("clips against the iframe owner's ordinary DOM ancestors", async () => {
-    const f = await fixture("oopif");
-    f.rectangles.set(99, { x: 204, y: 306, width: 400, height: 80 });
-    expect(await f.run()).toMatchObject({ x: 224, y: 346, width: 200, height: 40 });
-  });
-
-  it.each([1234, 99])("rejects a hidden or fully clipped node %i", async (node) => {
-    const f = await fixture("oopif");
-    f.rectangles.set(node, null);
-    expect(await f.run()).toMatchObject({
-      code: "permission_denied",
-      data: { reason: "element_not_visible" },
-    });
-    expect(f.calls.at(-1)!.method).toBe("Runtime.releaseObjectGroup");
-  });
-
-  it.each([
-    { ref: undefined },
-    { selector: "#target" },
-    { timeout_ms: 0 },
-  ])("rejects invalid params %j", async (params) => {
-    const f = await fixture();
-    expect(await f.run(params)).toMatchObject({ code: "invalid_params" });
-    expect(f.calls).toEqual([]);
-  });
-
-  it.each(["stale", "other-tab"])("rejects %s refs before scrolling", async (mode) => {
-    const f = await fixture();
-    if (mode === "stale") f.ctx.refStore.clear();
-    else f.ctx.refStore.set("e3", 1234, { tabId: 8 });
-    expect(await f.run()).toMatchObject({ code: "not_found", data: { reason: "ref_not_found" } });
-    expect(f.calls).toEqual([]);
-  });
-
-  it("enforces the Agent Window boundary", async () => {
-    const f = await fixture();
-    f.tabsApi.query.mockResolvedValue([{ id: 4, windowId: 200, active: true } as chrome.tabs.Tab]);
-    f.tabsApi.get.mockResolvedValue({ id: 4, windowId: 200, active: true } as chrome.tabs.Tab);
-    expect(await f.run({ tab_id: 4 })).toMatchObject({ code: "permission_denied" });
-    expect(f.calls).toEqual([]);
-  });
-
-  it.each([
-    "getFrameGraph",
-    "DOM.scrollIntoViewIfNeeded",
-    "DOM.resolveNode",
-    "Runtime.callFunctionOn",
-    "Page.getLayoutMetrics",
-    "Runtime.evaluate",
-    "DOM.getBoxModel",
-  ])("honors cancellation during %s and only cleans up afterwards", async (method) => {
-    const f = await fixture("oopif");
-    f.hooks.after = (call) => {
-      if (call.method === method) f.abort.abort();
-    };
-    expect(await f.run()).toMatchObject({ code: "cancelled" });
-    expect(
-      f.calls.filter((call) => call.aborted && call.method !== "Runtime.releaseObjectGroup"),
-    ).toEqual([]);
-  });
-
-  it.each([
-    "DOM.getDocument",
-    "DOM.querySelector",
-    "DOM.describeNode",
-  ])("cancels selector resolution during %s", async (method) => {
-    const f = await fixture();
-    f.hooks.after = (call) => {
-      if (call.method === method) f.abort.abort();
-    };
-    expect(await f.run({ ref: undefined, selector: "#target" })).toMatchObject({
-      code: "cancelled",
-    });
-    expect(f.calls.filter((call) => call.aborted)).toEqual([]);
-  });
-
-  it("does not start after early cancellation", async () => {
-    const f = await fixture();
-    f.abort.abort();
-    expect(await f.run()).toMatchObject({ code: "cancelled" });
-    expect(f.calls).toEqual([]);
-    expect(f.tabsApi.query).not.toHaveBeenCalled();
-  });
-
-  it("does not issue fallback scrolling after cancellation", async () => {
-    const f = await fixture();
-    f.hooks.reply = ({ method }) => {
-      if (method === "DOM.scrollIntoViewIfNeeded") {
-        f.abort.abort();
-        throw new Error("scroll failed");
-      }
-      return undefined;
-    };
-    expect(await f.run()).toMatchObject({ code: "cancelled" });
-    expect(f.calls.map((call) => call.method)).toEqual(["DOM.scrollIntoViewIfNeeded"]);
-  });
-
-  it("stops target scrolling after a deadline expires while scrolling its owner", async () => {
-    const f = await fixture("oopif");
-    const now = vi.spyOn(Date, "now").mockReturnValue(100);
-    f.hooks.after = ({ method }) => {
-      if (method === "DOM.scrollIntoViewIfNeeded") now.mockReturnValue(201);
-    };
-    expect(await f.run({ timeout_ms: 100 })).toMatchObject({ code: "timeout" });
-    expect(f.calls.filter((call) => call.method === "DOM.scrollIntoViewIfNeeded")).toHaveLength(1);
-  });
-
-  it("reports measurement exceptions and releases objects even if cleanup fails", async () => {
-    const f = await fixture();
-    f.hooks.reply = ({ method }) => {
-      if (method === "Runtime.callFunctionOn")
-        return { exceptionDetails: { text: "measurement failed" } };
-      if (method === "Runtime.releaseObjectGroup") throw new Error("target closed");
-      return undefined;
-    };
-    expect(await f.run()).toMatchObject({ code: "cdp_failed", message: "measurement failed" });
-    expect(f.calls.at(-1)!.method).toBe("Runtime.releaseObjectGroup");
-  });
-
-  it("attaches dialogs observed during scrolling", async () => {
-    const f = await fixture();
-    f.cdp.dialogCursor = () => 5;
-    const dialogs: JavaScriptDialogInfo[] = [
-      {
-        sequence: 6,
-        tab_id: 4,
-        type: "alert",
-        message: "scrolled",
-        handled: "accepted",
-        url: "https://example.test",
-      },
-    ];
-    f.cdp.dialogsSince = vi.fn(() => dialogs);
-    expect(await f.run()).toHaveProperty("dialogs", dialogs);
-    expect(f.cdp.dialogsSince).toHaveBeenCalledWith(4, 5);
-  });
-});

apps/extension/src/tools/__tests__/snapshot-coordinates.browser.test.ts

@@ -1,355 +0,0 @@
-// @vitest-environment node
-import { describe, expect, it } from "vitest";
-import type { CdpFrame, CdpFrameGraph, CdpTarget } from "@/browser-driver/frame-graph";
-import { resolveNodeGeometry } from "../frame-geometry";
-import type { CdpRunner } from "../shared";
-import { captureObservationFacts } from "../vom/capture-coordinator";
-
-type Send = <T = Record<string, unknown>>(
-  method: string,
-  params?: object,
-  sessionId?: string,
-) => Promise<T>;
-type Tree = { frame: { id: string; parentId?: string; name?: string }; childFrames?: Tree[] };
-type Rect = { x: number; y: number; w: number; h: number };
-type Oracle = {
-  probes: Record<string, Rect>;
-  viewport: { width: number; height: number };
-  owners: Record<string, { x: number; y: number; scale: number }>;
-};
-
-function clip(rect: Rect, viewport: Oracle["viewport"]): Rect | null {
-  const x = Math.max(0, rect.x),
-    y = Math.max(0, rect.y);
-  const right = Math.min(viewport.width, rect.x + rect.w);
-  const bottom = Math.min(viewport.height, rect.y + rect.h);
-  return right > x && bottom > y ? { x, y, w: right - x, h: bottom - y } : null;
-}
-
-// The independent oracle uses DOM border boxes and this fixture's axis-aligned
-// iframe transforms. No production snapshot conversion/projection builds expectations.
-const oracleExpression = `(() => {
-  const probes = {};
-  for (const node of document.querySelectorAll('[data-geometry-probe]')) {
-    const box = node.getBoundingClientRect();
-    probes[node.id] = { x: box.x, y: box.y, w: box.width, h: box.height };
-  }
-  const owners = {};
-  for (const frame of document.querySelectorAll('iframe')) {
-    const rect = frame.getBoundingClientRect();
-    const style = getComputedStyle(frame);
-    const scale = rect.width / frame.offsetWidth;
-    owners[frame.name] = {
-      x: rect.x + (frame.clientLeft + parseFloat(style.paddingLeft)) * scale,
-      y: rect.y + (frame.clientTop + parseFloat(style.paddingTop)) * scale,
-      scale,
-    };
-  }
-  return { probes, viewport: { width: document.documentElement.clientWidth, height: document.documentElement.clientHeight }, owners };
-})()`;
-
-describe.skipIf(!process.env.BSK_GEOMETRY_CHROME)("real DOMSnapshot coordinate contract", () => {
-  it.each(
-    [
-      { deviceScale: 1, zoom: 1 },
-      { deviceScale: 0.8, zoom: 1 },
-      { deviceScale: 1, zoom: 1.25 },
-      { deviceScale: 2, zoom: 1 },
-      { deviceScale: 2, zoom: 0.8 },
-    ]
-      .flatMap((configuration) => [
-        { ...configuration, fixture: "snapshot-coordinates", scrollbars: "none" },
-        { ...configuration, fixture: "oopif-scrollbars", scrollbars: "both" },
-      ])
-      .concat(
-        ["vertical", "horizontal", "none"].map((scrollbars) => ({
-          deviceScale: 1,
-          zoom: 1,
-          fixture: "oopif-scrollbars",
-          scrollbars,
-        })),
-      ),
-  )("$fixture: device scale $deviceScale, zoom $zoom, scrollbars $scrollbars", async (configuration) => {
-    const evalRoot = new URL("../../../../../evals/browser/", import.meta.url);
-    const { createEvalServer } = await import(new URL("lib/server.mjs", evalRoot).href);
-    const { withChrome } = await import(
-      new URL("cases/regression/snapshot-coordinates/chrome.mjs", evalRoot).href
-    );
-    const server = createEvalServer();
-    const { baseUrl } = await server.start();
-    try {
-      await withChrome(
-        { executable: process.env.BSK_GEOMETRY_CHROME, ...configuration },
-        async (send: Send) => {
-          const { targetId } = await send<{ targetId: string }>("Target.createTarget", {
-            url: "about:blank",
-          });
-          const { sessionId: rootSession } = await send<{ sessionId: string }>(
-            "Target.attachToTarget",
-            { targetId, flatten: true },
-          );
-          await send(
-            "Page.navigate",
-            {
-              url: `${baseUrl}/${configuration.fixture}?run=coordinates&scrollbars=${configuration.scrollbars}`,
-            },
-            rootSession,
-          );
-          await expect
-            .poll(
-              () =>
-                server
-                  .snapshot("coordinates")
-                  .events.some(
-                    (event: { type: string; data: { root?: boolean } }) =>
-                      event.type === "geometry.ready" && event.data.root,
-                  ),
-              { timeout: 10_000 },
-            )
-            .toBe(true);
-
-          const targets = await send<{ targetInfos: { targetId: string; type: string }[] }>(
-            "Target.getTargets",
-          );
-          const sessions = [rootSession];
-          for (const target of targets.targetInfos.filter((target) => target.type === "iframe")) {
-            const { sessionId } = await send<{ sessionId: string }>("Target.attachToTarget", {
-              targetId: target.targetId,
-              flatten: true,
-            });
-            sessions.push(sessionId);
-          }
-          expect(sessions.length).toBe(configuration.fixture === "oopif-scrollbars" ? 3 : 2);
-          const frames: CdpFrame[] = [];
-          const names = new Map<string, string>();
-          const sessionFor = (target: CdpTarget) => target.sessionId ?? rootSession;
-          for (const sessionId of sessions) {
-            const { frameTree } = await send<{ frameTree: Tree }>(
-              "Page.getFrameTree",
-              {},
-              sessionId,
-            );
-            const target: CdpTarget = {
-              tabId: 1,
-              ...(sessionId === rootSession ? {} : { sessionId }),
-            };
-            const visit = (tree: Tree, parentFrameId = tree.frame.parentId) => {
-              frames.push({ frameId: tree.frame.id, parentFrameId, target });
-              names.set(tree.frame.id, tree.frame.name ?? "");
-              for (const child of tree.childFrames ?? []) visit(child, tree.frame.id);
-            };
-            visit(frameTree);
-          }
-          expect(frames).toHaveLength(configuration.fixture === "oopif-scrollbars" ? 3 : 5);
-          for (const frame of frames) {
-            if (!frame.parentFrameId) continue;
-            const parent = frames.find((item) => item.frameId === frame.parentFrameId)!;
-            const owner = await send<{ backendNodeId: number }>(
-              "DOM.getFrameOwner",
-              { frameId: frame.frameId },
-              sessionFor(parent.target),
-            );
-            frame.ownerBackendNodeId = owner.backendNodeId;
-          }
-          const graph: CdpFrameGraph = { rootFrameId: frames[0].frameId, frames };
-          const calls: string[] = [];
-          const cdp: CdpRunner = {
-            send: (tabId, method, params) => {
-              calls.push(`${tabId}:${method}`);
-              return send(method, params, rootSession);
-            },
-            sendToTarget: (target, method, params) => {
-              calls.push(`${target.sessionId ?? target.tabId}:${method}`);
-              if (
-                method === "Runtime.evaluate" &&
-                (params as { expression?: string })?.expression?.includes("window.innerWidth")
-              )
-                calls.push(`${target.sessionId ?? target.tabId}:viewport-size`);
-              return send(method, params, sessionFor(target));
-            },
-            getFrameGraph: async () => graph,
-            getAttachmentId: () => rootSession,
-          };
-          const oracles = new Map<string, Oracle>();
-          for (const frame of frames) {
-            const session = sessionFor(frame.target);
-            const { executionContextId } = await send<{ executionContextId: number }>(
-              "Page.createIsolatedWorld",
-              { frameId: frame.frameId, worldName: "coordinate-oracle" },
-              session,
-            );
-            await expect
-              .poll(
-                async () => {
-                  const ready = await send<{ result: { value: boolean } }>(
-                    "Runtime.evaluate",
-                    {
-                      expression: 'document.documentElement.dataset.geometryReady === "true"',
-                      contextId: executionContextId,
-                      returnByValue: true,
-                    },
-                    session,
-                  );
-                  return ready.result.value;
-                },
-                { timeout: 5_000 },
-              )
-              .toBe(true);
-            // Establish scroll after cross-process target creation/layout settles.
-            const scroll = frame.parentFrameId
-              ? names.get(frame.frameId) === "nested"
-                ? [10, 20]
-                : [40, 100]
-              : [80, 240];
-            await send(
-              "Runtime.evaluate",
-              {
-                expression: `(async () => { scrollTo(${scroll.join(",")}); await new Promise(resolve => requestAnimationFrame(() => requestAnimationFrame(resolve))); })()`,
-                contextId: executionContextId,
-                awaitPromise: true,
-              },
-              session,
-            );
-            const reply = await send<{ result: { value: Oracle } }>(
-              "Runtime.evaluate",
-              { expression: oracleExpression, contextId: executionContextId, returnByValue: true },
-              session,
-            );
-            oracles.set(frame.frameId, reply.result.value);
-          }
-          const childViewport = await send<{
-            result: {
-              value: { width: number; height: number; clientWidth: number; clientHeight: number };
-            };
-          }>(
-            "Runtime.evaluate",
-            {
-              expression:
-                "({ width: innerWidth, height: innerHeight, clientWidth: document.documentElement.clientWidth, clientHeight: document.documentElement.clientHeight })",
-              returnByValue: true,
-            },
-            sessions[1],
-          );
-          for (const dimension of ["Width", "Height"] as const) {
-            const occupied =
-              childViewport.result.value[dimension === "Width" ? "width" : "height"] -
-              childViewport.result.value[`client${dimension}`];
-            if (
-              configuration.scrollbars === "both" ||
-              configuration.scrollbars === (dimension === "Width" ? "vertical" : "horizontal")
-            )
-              expect(occupied).toBeGreaterThan(0);
-            else expect(occupied).toBe(0);
-          }
-          const facts = await captureObservationFacts(cdp, 1);
-          expect(facts.issues).toEqual([]);
-          expect(calls.filter((call) => call.endsWith(":Page.getLayoutMetrics"))).toHaveLength(
-            sessions.length,
-          );
-          // Identity verification also uses Runtime.evaluate; count the full viewport reads separately.
-          const viewportReadsBeforeLive = calls.filter((call) => call.endsWith(":viewport-size"));
-          expect(new Set(viewportReadsBeforeLive).size).toBe(viewportReadsBeforeLive.length);
-          expect(viewportReadsBeforeLive.length).toBeLessThanOrEqual(sessions.length - 1);
-          for (const frame of frames) {
-            for (const [id, local] of Object.entries(oracles.get(frame.frameId)!.probes)) {
-              const node = facts.documents
-                .find((doc) => doc.frame.frameId === frame.frameId)
-                ?.domNodes.find((node) => node.attrs.id === id);
-              expect(node, `missing ${id} in ${names.get(frame.frameId) || "root"}`).toBeDefined();
-              let top = clip(local, oracles.get(frame.frameId)!.viewport);
-              let current = frame;
-              while (top && current.parentFrameId) {
-                const parentOracle = oracles.get(current.parentFrameId)!;
-                const owner = parentOracle.owners[names.get(current.frameId)!];
-                top = clip(
-                  {
-                    x: owner.x + top.x * owner.scale,
-                    y: owner.y + top.y * owner.scale,
-                    w: top.w * owner.scale,
-                    h: top.h * owner.scale,
-                  },
-                  parentOracle.viewport,
-                );
-                current = frames.find((item) => item.frameId === current.parentFrameId)!;
-              }
-              for (const key of ["x", "y", "w", "h"] as const)
-                expect(
-                  Math.abs(node!.localRect![key] - local[key]),
-                  `${names.get(frame.frameId)} ${id} local ${key}`,
-                ).toBeLessThan(2);
-              if (!top) {
-                expect(node!.rect, `${id} must be clipped out`).toBeNull();
-                if (configuration.fixture === "oopif-scrollbars")
-                  expect(
-                    await resolveNodeGeometry(cdp, 1, {
-                      target: frame.target,
-                      frameId: frame.frameId,
-                      backendNodeId: node!.backendNodeId,
-                    }),
-                  ).toMatchObject({ code: "permission_denied" });
-                continue;
-              }
-              expect(node!.rect).not.toBeNull();
-              for (const key of ["x", "y", "w", "h"] as const)
-                expect(
-                  Math.abs(node!.rect![key] - top[key]),
-                  `${names.get(frame.frameId)} ${id} top ${key}`,
-                ).toBeLessThan(2);
-              if (configuration.fixture !== "oopif-scrollbars") continue;
-              const live = await resolveNodeGeometry(cdp, 1, {
-                target: frame.target,
-                frameId: frame.frameId,
-                backendNodeId: node!.backendNodeId,
-              });
-              if ("code" in live) throw new Error(live.message);
-              for (const [key, liveKey] of [
-                ["x", "x"],
-                ["y", "y"],
-                ["w", "width"],
-                ["h", "height"],
-              ] as const)
-                expect(
-                  Math.abs(live.topBounds[liveKey] - top[key]),
-                  `${id} live ${key}`,
-                ).toBeLessThan(2);
-              const before = server.snapshot("coordinates").events.length;
-              for (const type of ["mousePressed", "mouseReleased"])
-                await send(
-                  "Input.dispatchMouseEvent",
-                  { type, ...live.actionPoint, button: "left", clickCount: 1 },
-                  rootSession,
-                );
-              await expect
-                .poll(
-                  () =>
-                    server
-                      .snapshot("coordinates")
-                      .events.slice(before)
-                      .some(
-                        (event: { type: string; path: string; data: { probe?: string } }) =>
-                          event.type === "geometry.clicked" &&
-                          event.data.probe === id &&
-                          event.path ===
-                            (frame.parentFrameId
-                              ? names.get(frame.frameId) === "nested"
-                                ? "/oopif-scrollbars/nested"
-                                : "/oopif-scrollbars/frame"
-                              : "/oopif-scrollbars"),
-                      ),
-                  { timeout: 3000 },
-                )
-                .toBe(true);
-            }
-          }
-          const metrics = await send<{
-            cssVisualViewport: { zoom: number };
-            visualViewport: { clientWidth: number };
-          }>("Page.getLayoutMetrics", {}, rootSession);
-          expect(metrics.cssVisualViewport.zoom).toBeCloseTo(configuration.zoom, 4);
-        },
-      );
-    } finally {
-      await server.stop();
-    }
-  }, 30_000);
-});

apps/extension/src/tools/__tests__/snapshot-ref.test.ts

@@ -24,10 +24,14 @@ describe("lookupSnapshotRef", () => {
     expect(lookupSnapshotRef(ctx, "@e3", 4)).toEqual({
       backendNodeId: 1234,
       refKey: "e3",
+      kind: "dom",
+      capabilities: ["interact", "screenshot"],
     });
     expect(lookupSnapshotRef(ctx, "e3", 4)).toEqual({
       backendNodeId: 1234,
       refKey: "e3",
+      kind: "dom",
+      capabilities: ["interact", "screenshot"],
     });
   });
 
@@ -53,6 +57,8 @@ describe("resolveSnapshotRef", () => {
       tabId: 4,
       frameId: "child-frame",
       cdpSessionId: "child-session",
+      kind: "dom",
+      capabilities: ["interact", "screenshot"],
     });
 
     const expected = {
@@ -60,6 +66,8 @@ describe("resolveSnapshotRef", () => {
       refKey: "e3",
       frameId: "child-frame",
       cdpSessionId: "child-session",
+      kind: "dom" as const,
+      capabilities: ["interact", "screenshot"] as const,
     };
     expect(lookupSnapshotRef(ctx, "@e3", 4)).toEqual(expected);
     expect(resolveSnapshotRef(ctx, "@e3", 4)).toEqual(expected);
@@ -105,6 +113,28 @@ describe("resolveSnapshotRef", () => {
     expect(resolveSnapshotRef(ctx, "@e3", 4)).toEqual({
       backendNodeId: 1234,
       refKey: "e3",
+      kind: "dom",
+      capabilities: ["interact", "screenshot"],
+    });
+  });
+
+  it("rejects an operation outside the ref's declared capabilities", async () => {
+    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
+    const ctx = await sm.start("aa11");
+    ctx.refStore.set("e3", 1234, {
+      tabId: 4,
+      kind: "surface",
+      capabilities: ["screenshot"],
+    });
+
+    expect(resolveSnapshotRef(ctx, "@e3", 4, "interact")).toMatchObject({
+      code: "permission_denied",
+      message: "ref @e3 does not support interact",
+      data: {
+        reason: "ref_capability_denied",
+        required_capability: "interact",
+        kind: "surface",
+      },
     });
   });
 });

apps/extension/src/tools/__tests__/visual-screenshot-plan.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it } from "vitest";
+import {
+  correctedVisualScreenshotScale,
+  planVisualScreenshot,
+  screenshotFitsPixelBudget,
+} from "../visual-screenshot-plan";
+
+const budget = { maxEdge: 2_048, maxPixels: 4_000_000 };
+
+describe("visual screenshot pixel planning", () => {
+  it.each([1, 1.25, 1.5, 2, 3])("accounts for raster scale %s", (rasterScaleEstimate) => {
+    const plan = planVisualScreenshot({
+      cssRect: { width: 2_000, height: 1_000 },
+      rasterScaleEstimate,
+      budget,
+    });
+    const width = 2_000 * rasterScaleEstimate * plan.clipScale;
+    const height = 1_000 * rasterScaleEstimate * plan.clipScale;
+
+    expect(Math.max(width, height)).toBeLessThanOrEqual(budget.maxEdge);
+    expect(width * height).toBeLessThanOrEqual(budget.maxPixels);
+  });
+
+  it("corrects a scale from actual PNG dimensions", () => {
+    const corrected = correctedVisualScreenshotScale({
+      previousClipScale: 1,
+      actualWidth: 4_000,
+      actualHeight: 2_000,
+      budget,
+    });
+
+    expect(corrected).not.toBeNull();
+    expect(corrected as number).toBeLessThan(2_048 / 4_000);
+    expect(screenshotFitsPixelBudget({ width: 2_000, height: 1_000 }, budget)).toBe(true);
+    expect(screenshotFitsPixelBudget({ width: 4_000, height: 2_000 }, budget)).toBe(false);
+  });
+});

apps/extension/src/tools/dispatcher.ts

@@ -2,14 +2,12 @@ import { OVERLAY_AUTOMATION_BYPASS } from "@/lib/overlay-bridge";
 import type { SessionManager } from "@/session-manager/manager";
 import type { Transport } from "@/transport/transport";
 import type {
-  BlurParams,
   ClickParams,
   ConsoleParams,
   DownloadParams,
   EmulateParams,
   EvaluateParams,
   FillParams,
-  FocusParams,
   GetHtmlParams,
   HoverParams,
   HoverResult,
@@ -29,7 +27,6 @@ import type {
   ResponseFrame,
   RpcError,
   ScreenshotParams,
-  ScrollToParams,
   SelectParams,
   SnapshotParams,
   UploadParams,
@@ -42,15 +39,7 @@ import { type EmulateCdpRunner, handleEmulate } from "./emulate";
 import { classifyCdpError } from "./errors";
 import { handleEvaluate } from "./evaluate";
 import { handleRequestHelp } from "./human-loop";
-import {
-  handleBlur,
-  handleClick,
-  handleFill,
-  handleFocus,
-  handleHover,
-  handlePress,
-  handleSelect,
-} from "./interaction";
+import { handleClick, handleFill, handleHover, handlePress, handleSelect } from "./interaction";
 import {
   handleNavigate,
   handleNavigateBack,
@@ -72,7 +61,6 @@ import {
   handleRecordStop,
   type RecordRuntimeDeps,
 } from "./record";
-import { handleScrollTo } from "./scroll";
 import {
   handleSessionStart,
   handleSessionStop,
@@ -527,39 +515,6 @@ export class ToolDispatcher {
         );
         return this.rememberHover((req.params as HoverParams).session_id, result);
       }
-      case "tool.scroll_to":
-        return this.withHoverReleaseForRequest(
-          req.params as ScrollToParams,
-          () =>
-            handleScrollTo(
-              this.sessions,
-              req.params as ScrollToParams,
-              this.cdp ? { cdp: this.cdp, tabsApi: chromeTabsApi, signal } : undefined,
-            ),
-          signal,
-        );
-      case "tool.focus":
-        return this.withHoverReleaseForRequest(
-          req.params as FocusParams,
-          () =>
-            handleFocus(
-              this.sessions,
-              req.params as FocusParams,
-              this.cdp ? { cdp: this.cdp, tabsApi: chromeTabsApi, signal } : undefined,
-            ),
-          signal,
-        );
-      case "tool.blur":
-        return this.withHoverReleaseForRequest(
-          req.params as BlurParams,
-          () =>
-            handleBlur(
-              this.sessions,
-              req.params as BlurParams,
-              this.cdp ? { cdp: this.cdp, tabsApi: chromeTabsApi, signal } : undefined,
-            ),
-          signal,
-        );
       case "tool.fill":
         return this.withHoverReleaseForRequest(
           req.params as FillParams,
@@ -830,9 +785,6 @@ function sessionIdForBrowserControlMethod(req: RequestFrame): string | null {
     case "tool.reload":
     case "tool.click":
     case "tool.hover":
-    case "tool.scroll_to":
-    case "tool.focus":
-    case "tool.blur":
     case "tool.fill":
     case "tool.press":
     case "tool.select":

apps/extension/src/tools/frame-geometry.ts

@@ -1,21 +1,30 @@
-import { type CdpTarget, cdpTargetKey } from "@/browser-driver/frame-graph";
+import {
+  type CdpFrame,
+  type CdpFrameGraph,
+  type CdpTarget,
+  cdpTargetKey,
+} from "@/browser-driver/frame-graph";
 import type { RpcError } from "@/transport/types";
 import { nodeContentRegion, scrollNodeIntoView } from "./element-geometry";
 import {
   clipPolygon,
+  type GeometryProjection,
   type Point,
   type Polygon,
+  type ProjectiveEdge,
+  parseCdpQuad,
   polygonArea,
   polygonCentroid,
+  projectRectToViewport,
   projectRegionToViewport,
+  type Quad,
   type Region,
   rectPolygon,
   regionBounds,
+  type Size,
   type ViewportRect,
 } from "./geometry";
-import type { CssViewport } from "./geometry/coordinate-types";
-import { cssViewport, GeometryContext } from "./geometry/frame-context";
-import { type CdpRunner, cdpRunnerForTarget, isRpcError } from "./shared";
+import { type CdpRunner, cdpRunnerForTarget, isRpcError, sendToCdpTarget } from "./shared";
 
 export interface NodeAddress {
   target: CdpTarget;
@@ -24,8 +33,6 @@ export interface NodeAddress {
 }
 
 export interface ResolvedNodeGeometry {
-  /** The same top-level measurement used by projection, for screenshot coordinate adaptation. */
-  topViewport: CssViewport;
   topVisibleRegions: Region;
   topBounds: ViewportRect;
   /** Point in the top-level tab viewport, used by root-target input events. */
@@ -38,16 +45,275 @@ function geometryError(message: string): RpcError {
   return { code: "cdp_failed", message };
 }
 
+function frameMap(graph: CdpFrameGraph): Map<string, CdpFrame> {
+  return new Map(graph.frames.map((frame) => [frame.frameId, frame]));
+}
+
+function targetRootFrame(byId: Map<string, CdpFrame>, frame: CdpFrame): CdpFrame | null {
+  const seen = new Set<string>();
+  let current = frame;
+  while (current.parentFrameId) {
+    if (seen.has(current.frameId)) return null;
+    seen.add(current.frameId);
+    const parent = byId.get(current.parentFrameId);
+    if (!parent || parent.target.sessionId !== current.target.sessionId) break;
+    current = parent;
+  }
+  return current;
+}
+
+function frameAncestry(graph: CdpFrameGraph, frameId: string): CdpFrame[] | null {
+  const byId = frameMap(graph);
+  const path: CdpFrame[] = [];
+  const seen = new Set<string>();
+  let current = byId.get(frameId);
+  if (!current) return null;
+  while (current.parentFrameId) {
+    if (seen.has(current.frameId)) return null;
+    seen.add(current.frameId);
+    path.push(current);
+    const parent = byId.get(current.parentFrameId);
+    if (!parent) return null;
+    current = parent;
+  }
+  return path;
+}
+
+async function targetViewport(cdp: CdpRunner, target: CdpTarget): Promise<Size | null> {
+  const metrics = await sendToCdpTarget<{
+    cssLayoutViewport?: { clientWidth?: number; clientHeight?: number };
+    layoutViewport?: { clientWidth?: number; clientHeight?: number };
+  }>(cdp, target, "Page.getLayoutMetrics", {});
+  const viewport = metrics.cssLayoutViewport ?? metrics.layoutViewport ?? {};
+  const width = viewport.clientWidth ?? 0;
+  const height = viewport.clientHeight ?? 0;
+  return width > 0 && height > 0 ? { width, height } : null;
+}
+
+async function sameTargetFrameViewport(cdp: CdpRunner, frame: CdpFrame): Promise<Size | null> {
+  const world = await sendToCdpTarget<{ executionContextId?: number }>(
+    cdp,
+    frame.target,
+    "Page.createIsolatedWorld",
+    {
+      frameId: frame.frameId,
+      worldName: "bsk-frame-geometry",
+      grantUniveralAccess: false,
+    },
+  );
+  if (world.executionContextId === undefined) return null;
+  const result = await sendToCdpTarget<{ result?: { value?: unknown } }>(
+    cdp,
+    frame.target,
+    "Runtime.evaluate",
+    {
+      expression: "({width:window.innerWidth,height:window.innerHeight})",
+      contextId: world.executionContextId,
+      returnByValue: true,
+    },
+  );
+  const value = result.result?.value as { width?: unknown; height?: unknown } | undefined;
+  const width = value?.width;
+  const height = value?.height;
+  return typeof width === "number" &&
+    Number.isFinite(width) &&
+    width > 0 &&
+    typeof height === "number" &&
+    Number.isFinite(height) &&
+    height > 0
+    ? { width, height }
+    : null;
+}
+
+async function ownerContentQuad(
+  cdp: CdpRunner,
+  parent: CdpFrame,
+  ownerBackendNodeId: number,
+): Promise<Quad | null> {
+  const result = await sendToCdpTarget<{ model?: { content?: number[] } }>(
+    cdp,
+    parent.target,
+    "DOM.getBoxModel",
+    { backendNodeId: ownerBackendNodeId },
+  );
+  return parseCdpQuad(result.model?.content);
+}
+
+export interface FrameGeometryContext {
+  resolveFrameProjection(frameId: string): Promise<GeometryProjection | null>;
+  projectFrameLocalRect(
+    frameId: string,
+    rect: { x: number; y: number; w: number; h: number },
+  ): Promise<ViewportRect | null>;
+}
+
+export function createFrameGeometryContext(
+  cdp: CdpRunner,
+  graph: CdpFrameGraph,
+): FrameGeometryContext {
+  const byId = frameMap(graph);
+  const targetViewports = new Map<string, Promise<Size | null>>();
+  const frameViewports = new Map<string, Promise<Size | null>>();
+  const ownerQuads = new Map<string, Promise<Quad | null>>();
+  const projections = new Map<string, Promise<GeometryProjection | null>>();
+  const localProjections = new Map<string, Promise<GeometryProjection | null>>();
+
+  const cachedTargetViewport = (target: CdpTarget): Promise<Size | null> => {
+    const key = cdpTargetKey(target);
+    let value = targetViewports.get(key);
+    if (!value) {
+      value = targetViewport(cdp, target);
+      targetViewports.set(key, value);
+    }
+    return value;
+  };
+  const cachedFrameViewport = (frame: CdpFrame): Promise<Size | null> => {
+    let value = frameViewports.get(frame.frameId);
+    if (!value) {
+      const root = targetRootFrame(byId, frame);
+      value =
+        root?.frameId === frame.frameId
+          ? cachedTargetViewport(frame.target)
+          : sameTargetFrameViewport(cdp, frame);
+      frameViewports.set(frame.frameId, value);
+    }
+    return value;
+  };
+  const cachedOwnerQuad = (parent: CdpFrame, backendNodeId: number): Promise<Quad | null> => {
+    const key = `${cdpTargetKey(parent.target)}:${backendNodeId}`;
+    let value = ownerQuads.get(key);
+    if (!value) {
+      value = ownerContentQuad(cdp, parent, backendNodeId);
+      ownerQuads.set(key, value);
+    }
+    return value;
+  };
+  const cachedSameTargetClips = async (
+    frame: CdpFrame,
+    root: CdpFrame,
+  ): Promise<Polygon[] | null> => {
+    const clips: Polygon[] = [];
+    let current = frame;
+    const seen = new Set<string>();
+    while (current.frameId !== root.frameId) {
+      if (seen.has(current.frameId) || !current.parentFrameId) return null;
+      seen.add(current.frameId);
+      const parent = byId.get(current.parentFrameId);
+      if (!parent || current.ownerBackendNodeId === undefined) return null;
+      const clip = await cachedOwnerQuad(parent, current.ownerBackendNodeId);
+      if (!clip) return null;
+      clips.push(clip);
+      current = parent;
+    }
+    return clips;
+  };
+
+  const buildTargetProjection = async (frameId: string): Promise<GeometryProjection | null> => {
+    const frame = byId.get(frameId);
+    if (!frame) return null;
+    let root = targetRootFrame(byId, frame);
+    if (!root) return null;
+    const sourceViewport = await cachedTargetViewport(root.target);
+    if (!sourceViewport) return null;
+    const sourceClips = await cachedSameTargetClips(frame, root);
+    if (!sourceClips) return null;
+    const edges: ProjectiveEdge[] = [];
+    while (root.parentFrameId) {
+      const parent = byId.get(root.parentFrameId);
+      if (!parent || root.ownerBackendNodeId === undefined) return null;
+      const destinationQuad = await cachedOwnerQuad(parent, root.ownerBackendNodeId);
+      if (!destinationQuad) return null;
+      const source = await cachedTargetViewport(root.target);
+      if (!source) return null;
+      const parentRoot = targetRootFrame(byId, parent);
+      if (!parentRoot) return null;
+      const destinationClips = await cachedSameTargetClips(parent, parentRoot);
+      if (!destinationClips) return null;
+      edges.push({ sourceViewport: source, destinationQuad, destinationClips });
+      root = parentRoot;
+    }
+    const topViewport = await cachedTargetViewport(root.target);
+    return topViewport ? { sourceClips, edges, topViewport } : null;
+  };
+
+  const resolveFrameProjectionCached = (frameId: string): Promise<GeometryProjection | null> => {
+    let value = projections.get(frameId);
+    if (!value) {
+      value = buildTargetProjection(frameId);
+      projections.set(frameId, value);
+    }
+    return value;
+  };
+
+  const buildLocalProjection = async (frameId: string): Promise<GeometryProjection | null> => {
+    const frame = byId.get(frameId);
+    if (!frame) return null;
+    const root = targetRootFrame(byId, frame);
+    if (!root) return null;
+    const targetProjection = await resolveFrameProjectionCached(root.frameId);
+    if (!targetProjection) return null;
+    if (root.frameId === frame.frameId) return targetProjection;
+    if (!frame.parentFrameId || frame.ownerBackendNodeId === undefined) return null;
+    const parent = byId.get(frame.parentFrameId);
+    if (!parent) return null;
+    const sourceViewport = await cachedFrameViewport(frame);
+    const destinationQuad = await cachedOwnerQuad(parent, frame.ownerBackendNodeId);
+    const destinationClips = await cachedSameTargetClips(frame, root);
+    if (!sourceViewport || !destinationQuad || !destinationClips) return null;
+    return {
+      sourceClips: [],
+      edges: [{ sourceViewport, destinationQuad, destinationClips }, ...targetProjection.edges],
+      topViewport: targetProjection.topViewport,
+    };
+  };
+
+  const localProjection = (frameId: string): Promise<GeometryProjection | null> => {
+    let value = localProjections.get(frameId);
+    if (!value) {
+      value = buildLocalProjection(frameId);
+      localProjections.set(frameId, value);
+    }
+    return value;
+  };
+
+  return {
+    resolveFrameProjection: resolveFrameProjectionCached,
+    async projectFrameLocalRect(frameId, rect) {
+      const projection = await localProjection(frameId);
+      return projection ? projectRectToViewport(rect, projection) : null;
+    },
+  };
+}
+
+export async function resolveFrameProjection(
+  cdp: CdpRunner,
+  graph: CdpFrameGraph,
+  frameId: string,
+): Promise<GeometryProjection | null> {
+  return createFrameGeometryContext(cdp, graph).resolveFrameProjection(frameId);
+}
+
+async function loadFrameGraph(cdp: CdpRunner, tabId: number): Promise<CdpFrameGraph | null> {
+  if (!cdp.getFrameGraph) return null;
+  try {
+    return await cdp.getFrameGraph(tabId);
+  } catch (error) {
+    console.debug("[bsk frame-geometry] frame graph resolution failed", error);
+    return null;
+  }
+}
+
 async function scrollFrameOwners(
   cdp: CdpRunner,
   tabId: number,
-  context: GeometryContext,
+  graph: CdpFrameGraph,
   frameId: string,
 ): Promise<RpcError | null> {
-  const ancestry = await context.ancestry(frameId);
+  const byId = frameMap(graph);
+  const ancestry = frameAncestry(graph, frameId);
   if (!ancestry) return geometryError(`could not resolve frame ancestry for ${frameId}`);
   for (const child of [...ancestry].reverse()) {
-    const parent = child.parentFrameId ? await context.frame(child.parentFrameId) : undefined;
+    const parent = child.parentFrameId ? byId.get(child.parentFrameId) : undefined;
     if (!parent || child.ownerBackendNodeId === undefined) {
       return geometryError(`could not resolve frame owner for ${child.frameId}`);
     }
@@ -61,20 +327,17 @@ async function scrollFrameOwners(
   return null;
 }
 
-async function scrollElementWithContext(
+async function scrollElementWithFrameGraph(
   cdp: CdpRunner,
   tabId: number,
   target: CdpTarget,
   backendNodeId: number,
   frameId: string | undefined,
-  context: GeometryContext,
+  graph: CdpFrameGraph | null,
 ): Promise<RpcError | null> {
   if (frameId) {
-    const frame = await context.frame(frameId);
-    if (!frame || cdpTargetKey(frame.target) !== cdpTargetKey(target)) {
-      return geometryError("node frame does not belong to its target");
-    }
-    const error = await scrollFrameOwners(cdp, tabId, context, frameId);
+    if (!graph) return geometryError(`could not resolve frame graph for ${frameId}`);
+    const error = await scrollFrameOwners(cdp, tabId, graph, frameId);
     if (error) return error;
   } else if (target.sessionId) {
     return geometryError("an OOPIF node address requires frameId");
@@ -89,15 +352,8 @@ export async function scrollElementAndFramesIntoView(
   backendNodeId: number,
   frameId?: string,
 ): Promise<RpcError | null> {
-  if (target.tabId !== tabId) return geometryError("node target belongs to another tab");
-  return scrollElementWithContext(
-    cdp,
-    tabId,
-    target,
-    backendNodeId,
-    frameId,
-    new GeometryContext(cdp, tabId),
-  );
+  const graph = frameId ? await loadFrameGraph(cdp, tabId) : null;
+  return scrollElementWithFrameGraph(cdp, tabId, target, backendNodeId, frameId, graph);
 }
 
 function largestRegion(regions: Region): Polygon | null {
@@ -120,32 +376,23 @@ export async function resolveNodeGeometry(
     if (address.target.sessionId && !address.frameId) {
       return geometryError("an OOPIF node address requires frameId");
     }
-    if (address.target.tabId !== tabId) return geometryError("node target belongs to another tab");
-    const context = new GeometryContext(cdp, tabId);
-    const graph = address.frameId ? await context.graph() : null;
-    if (address.frameId && graph) {
-      const frame = await context.frame(address.frameId);
-      if (!frame || cdpTargetKey(frame.target) !== cdpTargetKey(address.target)) {
-        return geometryError("node frame does not belong to its target");
-      }
-    }
+    const graph = address.frameId ? await loadFrameGraph(cdp, tabId) : null;
     if (address.frameId && !graph) {
       return geometryError(`could not resolve frame graph for ${address.frameId}`);
     }
 
     if (options.scrollIntoView) {
-      const scrollError = await scrollElementWithContext(
+      const scrollError = await scrollElementWithFrameGraph(
         cdp,
         tabId,
         address.target,
         address.backendNodeId,
         address.frameId,
-        context,
+        graph,
       );
       if (scrollError) return scrollError;
     }
 
-    // Only topology was read above. Begin live measurements after scrolling.
     const localRegion = await nodeContentRegion(
       cdpRunnerForTarget(cdp, address.target),
       tabId,
@@ -156,13 +403,12 @@ export async function resolveNodeGeometry(
     let topVisibleRegions: Region;
     let targetActionPoint: Point | null = null;
     if (address.frameId && graph) {
-      const projection = await context.targetProjection(address.frameId);
+      const projection = await resolveFrameProjection(cdp, graph, address.frameId);
       if (!projection)
         return geometryError(`could not resolve frame geometry for ${address.frameId}`);
       topVisibleRegions = projectRegionToViewport(localRegion, projection);
       if (address.target.sessionId) {
-        const localViewport = await context.viewport(address.target);
-        if (!localViewport) return geometryError("could not resolve target viewport geometry");
+        const localViewport = projection.edges[0]?.sourceViewport ?? projection.topViewport;
         const localVisibleRegions = localRegion
           .map((polygon) =>
             clipPolygon(
@@ -180,7 +426,7 @@ export async function resolveNodeGeometry(
         targetActionPoint = localActionRegion ? polygonCentroid(localActionRegion) : null;
       }
     } else {
-      const viewport = await context.viewport(address.target);
+      const viewport = await targetViewport(cdp, address.target);
       if (!viewport) return geometryError("could not resolve top viewport geometry");
       topVisibleRegions = localRegion
         .map((polygon) =>
@@ -199,13 +445,7 @@ export async function resolveNodeGeometry(
       return { code: "permission_denied", message: "element not visible in its target" };
     }
     targetActionPoint ??= actionPoint;
-    return {
-      topVisibleRegions,
-      topBounds,
-      actionPoint,
-      targetActionPoint,
-      topViewport: cssViewport(await context.layoutMetrics({ tabId })),
-    };
+    return { topVisibleRegions, topBounds, actionPoint, targetActionPoint };
   } catch (error) {
     return geometryError(error instanceof Error ? error.message : String(error));
   }

apps/extension/src/tools/geometry/coordinate-types.ts

@@ -1,157 +0,0 @@
-import { type CdpTarget, cdpTargetKey } from "@/browser-driver/frame-graph";
-import type { GeometryProjection, ViewportRect } from "../geometry";
-import { projectRectToViewport } from "../geometry";
-
-export interface CoordinateOwner {
-  target: CdpTarget;
-  frameId?: string;
-}
-
-export interface FrameViewportRect {
-  space: "frame-viewport-css";
-  owner: CoordinateOwner;
-  rect: ViewportRect;
-}
-
-export interface SnapshotProjection {
-  source: CoordinateOwner;
-  geometry: GeometryProjection;
-}
-
-/** A failed owner read is different from a successfully projected, clipped-out rect. */
-export interface UnavailableFrameProjection {
-  status: "unavailable";
-  source: CoordinateOwner;
-  ownerBackendNodeId: number;
-}
-
-export interface UnavailableSnapshotCoordinates {
-  status: "unavailable";
-  source: CoordinateOwner;
-  reason: "snapshot-coordinates-unavailable";
-}
-
-export type SnapshotProjectionResult =
-  | { status: "available"; projection: SnapshotProjection }
-  | UnavailableFrameProjection;
-
-/** Descendants inherit the failed boundary without attempting another owner read. */
-export type FrameProjectionIssue =
-  | UnavailableFrameProjection
-  | UnavailableSnapshotCoordinates
-  | {
-      status: "blocked";
-      source: CoordinateOwner;
-      cause: UnavailableFrameProjection | UnavailableSnapshotCoordinates;
-    };
-
-export type FrameProjectionState = SnapshotProjectionResult | FrameProjectionIssue;
-
-export interface SnapshotCoordinates {
-  layoutUnitsPerCssPixel: number;
-  scrollCss: { x: number; y: number };
-}
-
-/** Snapshot scroll offsets share the raw layout units of its bounds. Only a
- * target's root document may fall back to that target's CSS layout viewport. */
-export function snapshotCoordinates(
-  document: { scrollOffsetX?: number; scrollOffsetY?: number },
-  layoutUnitsPerCssPixel: number | null,
-  rootScrollCss?: { x?: number; y?: number },
-): SnapshotCoordinates | null {
-  if (
-    layoutUnitsPerCssPixel === null ||
-    !Number.isFinite(layoutUnitsPerCssPixel) ||
-    layoutUnitsPerCssPixel <= 0
-  )
-    return null;
-  const x =
-    document.scrollOffsetX === undefined
-      ? rootScrollCss?.x
-      : document.scrollOffsetX / layoutUnitsPerCssPixel;
-  const y =
-    document.scrollOffsetY === undefined
-      ? rootScrollCss?.y
-      : document.scrollOffsetY / layoutUnitsPerCssPixel;
-  if (x === undefined || y === undefined || !Number.isFinite(x) || !Number.isFinite(y)) return null;
-  return { layoutUnitsPerCssPixel, scrollCss: { x, y } };
-}
-
-/** Convert raw document-relative Blink layout units exactly once, before any
- * CSS viewport clipping or frame projection. This scale is not screenshot zoom. */
-export function snapshotViewportRect(
-  bounds: number[],
-  owner: CoordinateOwner,
-  coordinates: SnapshotCoordinates | null,
-): FrameViewportRect | null {
-  if (!coordinates || bounds.length < 4 || !bounds.slice(0, 4).every(Number.isFinite)) return null;
-  const { layoutUnitsPerCssPixel: scale, scrollCss: scroll } = coordinates;
-  const [x, y, width, height] = bounds;
-  if (
-    !Number.isFinite(scale) ||
-    scale <= 0 ||
-    width <= 0 ||
-    height <= 0 ||
-    !Number.isFinite(scroll.x) ||
-    !Number.isFinite(scroll.y)
-  ) {
-    return null;
-  }
-  return {
-    space: "frame-viewport-css",
-    owner,
-    rect: {
-      x: x / scale - scroll.x,
-      y: y / scale - scroll.y,
-      width: width / scale,
-      height: height / scale,
-    },
-  };
-}
-
-export function projectSnapshotRect(
-  input: FrameViewportRect,
-  projection: SnapshotProjection,
-): ViewportRect | null {
-  if (
-    input.owner.frameId !== projection.source.frameId ||
-    cdpTargetKey(input.owner.target) !== cdpTargetKey(projection.source.target)
-  ) {
-    return null;
-  }
-  const { x, y, width: w, height: h } = input.rect;
-  return projectRectToViewport({ x, y, w, h }, projection.geometry);
-}
-
-/** CSS viewport metadata; browser zoom is distinct from raster devicePixelRatio. */
-export interface CssViewport {
-  width: number;
-  height: number;
-  scrollX: number;
-  scrollY: number;
-  cssToDip: number;
-}
-
-/** Page.captureScreenshot takes page-relative DIP, not viewport-relative CSS pixels. */
-export function screenshotPageRect(
-  rect: ViewportRect,
-  viewport: CssViewport,
-): { space: "page-dip"; rect: ViewportRect } | null {
-  const { cssToDip, scrollX, scrollY } = viewport;
-  if (
-    ![rect.x, rect.y, rect.width, rect.height, cssToDip, scrollX, scrollY].every(Number.isFinite) ||
-    cssToDip <= 0 ||
-    rect.width <= 0 ||
-    rect.height <= 0
-  )
-    return null;
-  return {
-    space: "page-dip",
-    rect: {
-      x: (rect.x + scrollX) * cssToDip,
-      y: (rect.y + scrollY) * cssToDip,
-      width: rect.width * cssToDip,
-      height: rect.height * cssToDip,
-    },
-  };
-}

apps/extension/src/tools/geometry/frame-context.ts

@@ -1,395 +0,0 @@
-import {
-  type CdpFrame,
-  type CdpFrameGraph,
-  type CdpTarget,
-  cdpTargetKey,
-} from "@/browser-driver/frame-graph";
-import {
-  type GeometryProjection,
-  type Polygon,
-  type ProjectiveEdge,
-  parseCdpQuad,
-  projectPolygon,
-  type Quad,
-  type Size,
-  viewportPolygon,
-} from "../geometry";
-import { type CdpRunner, sendToCdpTarget } from "../shared";
-import type { CoordinateOwner, CssViewport, SnapshotProjectionResult } from "./coordinate-types";
-
-import { readSnapshotOwnerSizes } from "./snapshot-owner-sizes";
-
-export interface LayoutMetrics {
-  cssVisualViewport?: { zoom?: number; clientWidth?: number; clientHeight?: number };
-  visualViewport?: { zoom?: number; clientWidth?: number; clientHeight?: number };
-  cssLayoutViewport?: {
-    clientWidth?: number;
-    clientHeight?: number;
-    pageX?: number;
-    pageY?: number;
-  };
-  layoutViewport?: { clientWidth?: number; clientHeight?: number; pageX?: number; pageY?: number };
-}
-
-/** Chromium emits these paired floating-point dimensions before/after dividing
- * by LayoutZoomFactor. Integer layout viewport dimensions lose precision at
- * fractional zoom. Neither visualViewport.scale nor .zoom is this conversion.
- * See InspectorPageAgent::getLayoutMetrics in Chromium. */
-export function snapshotLayoutScale(metrics: LayoutMetrics): number | null {
-  for (const dimension of ["clientWidth", "clientHeight"] as const) {
-    const raw = metrics.visualViewport?.[dimension];
-    const css = metrics.cssVisualViewport?.[dimension];
-    if (
-      raw !== undefined &&
-      css !== undefined &&
-      Number.isFinite(raw) &&
-      Number.isFinite(css) &&
-      raw > 0 &&
-      css > 0
-    ) {
-      const scale = raw / css;
-      if (Number.isFinite(scale) && scale > 0) return scale;
-    }
-  }
-  return null;
-}
-
-/** The legacy field is a compatibility fallback, never a source of raster DPR. */
-export function cssViewport(metrics: LayoutMetrics): CssViewport {
-  const value = metrics.cssLayoutViewport ?? metrics.layoutViewport;
-  return {
-    width: value?.clientWidth ?? 0,
-    height: value?.clientHeight ?? 0,
-    scrollX: value?.pageX ?? 0,
-    scrollY: value?.pageY ?? 0,
-    cssToDip: metrics.cssVisualViewport?.zoom ?? metrics.visualViewport?.zoom ?? 1,
-  };
-}
-
-/** One read-only measurement phase. Discard after scrolling or any later operation. */
-export class GeometryContext {
-  private readonly metrics = new Map<string, Promise<LayoutMetrics>>();
-  private readonly frameViewports = new Map<string, Promise<Size | null>>();
-  private readonly owners = new Map<string, Promise<Quad | null>>();
-  private readonly projections = new Map<string, Promise<GeometryProjection | null>>();
-  private readonly snapshotOwners = new Map<string, Promise<{ quad: Quad; size: Size } | null>>();
-  private readonly sizeBatches = new Map<string, () => Promise<Map<number, Size>>>();
-  private active = 0;
-  private readonly waiting: Array<() => void> = [];
-  private graphPromise?: Promise<CdpFrameGraph | null>;
-  private framesPromise?: Promise<Map<string, CdpFrame>>;
-
-  constructor(
-    private readonly cdp: CdpRunner,
-    private readonly tabId: number,
-    graph?: CdpFrameGraph,
-    private readonly signal?: AbortSignal,
-  ) {
-    if (graph) this.graphPromise = Promise.resolve(graph);
-  }
-
-  private async request<T>(
-    target: CdpTarget,
-    method: string,
-    params: object,
-    cleanup = false,
-  ): Promise<T> {
-    if (!cleanup && this.signal?.aborted) throw new DOMException("geometry aborted", "AbortError");
-    if (this.active >= 4) await new Promise<void>((resolve) => this.waiting.push(resolve));
-    else this.active++;
-    try {
-      if (!cleanup && this.signal?.aborted)
-        throw new DOMException("geometry aborted", "AbortError");
-      return await sendToCdpTarget<T>(this.cdp, target, method, params);
-    } finally {
-      const next = this.waiting.shift();
-      if (next) next();
-      else this.active--;
-    }
-  }
-
-  graph(): Promise<CdpFrameGraph | null> {
-    this.graphPromise ??=
-      this.cdp.getFrameGraph?.(this.tabId).catch(() => null) ?? Promise.resolve(null);
-    return this.graphPromise;
-  }
-
-  private frames(): Promise<Map<string, CdpFrame>> {
-    this.framesPromise ??= this.graph().then(
-      (graph) => new Map(graph?.frames.map((frame) => [frame.frameId, frame]) ?? []),
-    );
-    return this.framesPromise;
-  }
-
-  async frame(frameId: string): Promise<CdpFrame | undefined> {
-    return (await this.frames()).get(frameId);
-  }
-
-  /** Topology only: safe to resolve before the caller scrolls frame owners. */
-  async ancestry(frameId: string): Promise<CdpFrame[] | null> {
-    const frames = await this.frames();
-    const path: CdpFrame[] = [];
-    const seen = new Set<string>();
-    let current = frames.get(frameId);
-    if (!current) return null;
-    while (current.parentFrameId) {
-      if (seen.has(current.frameId)) return null;
-      seen.add(current.frameId);
-      path.push(current);
-      const parent = frames.get(current.parentFrameId);
-      if (!parent) return null;
-      current = parent;
-    }
-    return path;
-  }
-
-  layoutMetrics(target: CdpTarget): Promise<LayoutMetrics> {
-    const key = cdpTargetKey(target);
-    let promise = this.metrics.get(key);
-    if (!promise) {
-      promise = this.request<LayoutMetrics>(target, "Page.getLayoutMetrics", {});
-      this.metrics.set(key, promise);
-    }
-    return promise;
-  }
-
-  async viewport(target: CdpTarget): Promise<Size | null> {
-    const { width, height } = cssViewport(await this.layoutMetrics(target));
-    return Number.isFinite(width) && Number.isFinite(height) && width > 0 && height > 0
-      ? { width, height }
-      : null;
-  }
-
-  /** The full OOPIF viewport maps to its owner's content quad. Layout metrics
-   * exclude occupied scrollbars and remain the clipping boundary, not the scale. */
-  private frameViewport(target: CdpTarget): Promise<Size | null> {
-    const key = cdpTargetKey(target);
-    let promise = this.frameViewports.get(key);
-    if (!promise) {
-      promise = this.request<{ result?: { value?: Size }; exceptionDetails?: unknown }>(
-        target,
-        "Runtime.evaluate",
-        {
-          expression: "({ width: window.innerWidth, height: window.innerHeight })",
-          returnByValue: true,
-        },
-      ).then(({ result, exceptionDetails }) => {
-        const size = result?.value;
-        return !exceptionDetails &&
-          size &&
-          Number.isFinite(size.width) &&
-          Number.isFinite(size.height) &&
-          size.width > 0 &&
-          size.height > 0
-          ? size
-          : null;
-      });
-      this.frameViewports.set(key, promise);
-    }
-    return promise;
-  }
-
-  ownerContent(target: CdpTarget, backendNodeId: number): Promise<Quad | null> {
-    const key = `${cdpTargetKey(target)}:${backendNodeId}`;
-    let promise = this.owners.get(key);
-    if (!promise) {
-      promise = this.request<{ model?: { content?: number[] } }>(target, "DOM.getBoxModel", {
-        backendNodeId,
-      }).then((reply) => parseCdpQuad(reply.model?.content));
-      this.owners.set(key, promise);
-    }
-    return promise;
-  }
-
-  /** Same-target owner quads are already target-relative, including nested owners. */
-  async snapshotProjection(
-    source: CoordinateOwner,
-    ownerBackendNodeId: number,
-    ancestorClips: Polygon[],
-    viewport: Size,
-  ): Promise<SnapshotProjectionResult> {
-    const key = `${cdpTargetKey(source.target)}:${ownerBackendNodeId}`;
-    let promise = this.snapshotOwners.get(key);
-    if (!promise) {
-      promise = this.snapshotOwner(source.target, ownerBackendNodeId);
-      this.snapshotOwners.set(key, promise);
-    }
-    let owner: { quad: Quad; size: Size } | null;
-    try {
-      owner = await promise;
-    } catch (error) {
-      if (error && typeof error === "object" && "name" in error && error.name === "AbortError")
-        throw error;
-      console.debug("[bsk geometry] frame owner unavailable", error);
-      owner = null;
-    }
-    return owner
-      ? {
-          status: "available",
-          projection: {
-            source,
-            geometry: {
-              sourceClips: [],
-              edges: [
-                {
-                  sourceViewport: owner.size,
-                  destinationQuad: owner.quad,
-                  destinationClips: ancestorClips,
-                },
-              ],
-              topViewport: viewport,
-            },
-          },
-        }
-      : { status: "unavailable", source, ownerBackendNodeId };
-  }
-
-  /** Register one target's snapshot owners; the batch starts only when a
-   * projection actually needs a size. Single owners keep the cheaper old path. */
-  registerSnapshotOwners(target: CdpTarget, owners: ReadonlySet<number>): void {
-    const key = cdpTargetKey(target);
-    if (owners.size < 2 || this.sizeBatches.has(key)) return;
-    let pending: Promise<Map<number, Size>> | undefined;
-    this.sizeBatches.set(key, () => {
-      pending ??= readSnapshotOwnerSizes(
-        (method, params, cleanup) => this.request(target, method, params, cleanup),
-        owners,
-      ).catch((error) => {
-        if (error && typeof error === "object" && "name" in error && error.name === "AbortError")
-          throw error;
-        return new Map<number, Size>();
-      });
-      return pending;
-    });
-  }
-
-  private async snapshotOwner(
-    target: CdpTarget,
-    backendNodeId: number,
-  ): Promise<{ quad: Quad; size: Size } | null> {
-    const quad = await this.ownerContent(target, backendNodeId);
-    if (!quad) return null;
-    const batchSize = (await this.sizeBatches.get(cdpTargetKey(target))?.())?.get(backendNodeId);
-    if (this.signal?.aborted) throw new DOMException("geometry aborted", "AbortError");
-    if (batchSize) return { quad, size: batchSize };
-    const resolved = await this.request<{ object?: { objectId?: string } }>(
-      target,
-      "DOM.resolveNode",
-      { backendNodeId },
-    );
-    const objectId = resolved.object?.objectId;
-    if (!objectId) return null;
-    try {
-      const reply = await this.request<{ result?: { value?: Size }; exceptionDetails?: unknown }>(
-        target,
-        "Runtime.callFunctionOn",
-        {
-          objectId,
-          functionDeclaration: `function() {
-          if (!this.isConnected) return null;
-          const style = getComputedStyle(this);
-          return {
-            width: this.clientWidth - parseFloat(style.paddingLeft) - parseFloat(style.paddingRight),
-            height: this.clientHeight - parseFloat(style.paddingTop) - parseFloat(style.paddingBottom)
-          };
-        }`,
-          returnByValue: true,
-        },
-      );
-      const size = reply.result?.value;
-      return !reply.exceptionDetails &&
-        size &&
-        Number.isFinite(size.width) &&
-        Number.isFinite(size.height) &&
-        size.width > 0 &&
-        size.height > 0
-        ? { quad, size }
-        : null;
-    } finally {
-      // Cleanup must still run if cancellation arrived after resolving the object.
-      await this.request(target, "Runtime.releaseObject", { objectId }, true).catch(() => {});
-    }
-  }
-
-  private targetRoot(frames: Map<string, CdpFrame>, frame: CdpFrame): CdpFrame | null {
-    const seen = new Set<string>();
-    let current = frame;
-    while (current.parentFrameId) {
-      if (seen.has(current.frameId)) return null;
-      seen.add(current.frameId);
-      const parent = frames.get(current.parentFrameId);
-      if (!parent) return null;
-      if (cdpTargetKey(parent.target) !== cdpTargetKey(current.target)) break;
-      current = parent;
-    }
-    return current;
-  }
-
-  private async clips(
-    frames: Map<string, CdpFrame>,
-    frame: CdpFrame,
-    root: CdpFrame,
-  ): Promise<Polygon[] | null> {
-    const clips: Polygon[] = [];
-    let current = frame;
-    const seen = new Set<string>();
-    while (current.frameId !== root.frameId) {
-      if (seen.has(current.frameId) || !current.parentFrameId) return null;
-      seen.add(current.frameId);
-      const parent = frames.get(current.parentFrameId);
-      if (!parent || current.ownerBackendNodeId === undefined) return null;
-      const quad = await this.ownerContent(parent.target, current.ownerBackendNodeId);
-      if (!quad) return null;
-      clips.push(quad);
-      current = parent;
-    }
-    return clips;
-  }
-
-  /** Input is already in the frame's CDP target viewport, not its local viewport. */
-  targetProjection(frameId: string): Promise<GeometryProjection | null> {
-    let promise = this.projections.get(frameId);
-    if (!promise) {
-      promise = this.buildTargetProjection(frameId);
-      this.projections.set(frameId, promise);
-    }
-    return promise;
-  }
-
-  private async buildTargetProjection(frameId: string): Promise<GeometryProjection | null> {
-    const frames = await this.frames();
-    const frame = frames.get(frameId);
-    if (!frame) return null;
-    let root = this.targetRoot(frames, frame);
-    if (!root) return null;
-    const sourceViewport = await this.viewport(root.target);
-    if (!sourceViewport) return null;
-    const sourceClips = await this.clips(frames, frame, root);
-    if (!sourceClips) return null;
-    const edges: ProjectiveEdge[] = [];
-    const seen = new Set<string>();
-    while (root.parentFrameId) {
-      if (seen.has(root.frameId)) return null;
-      seen.add(root.frameId);
-      const parent = frames.get(root.parentFrameId);
-      if (!parent || root.ownerBackendNodeId === undefined) return null;
-      const destinationQuad = await this.ownerContent(parent.target, root.ownerBackendNodeId);
-      if (!destinationQuad) return null;
-      const source = await this.frameViewport(root.target);
-      const visible = await this.viewport(root.target);
-      const parentRoot = this.targetRoot(frames, parent);
-      if (!source || !visible || !parentRoot) return null;
-      const destinationClips = await this.clips(frames, parent, parentRoot);
-      if (!destinationClips) return null;
-      const edge = { sourceViewport: source, destinationQuad, destinationClips };
-      // Keep scrollbar strips clipped at every target boundary, including
-      // intermediate OOPIFs. Project the clip with the same full-viewport scale.
-      if (source.width !== visible.width || source.height !== visible.height)
-        destinationClips.push(projectPolygon(viewportPolygon(visible), edge));
-      edges.push(edge);
-      root = parentRoot;
-    }
-    const topViewport = await this.viewport(root.target);
-    return topViewport ? { sourceClips, edges, topViewport } : null;
-  }
-}

apps/extension/src/tools/geometry/snapshot-owner-sizes.ts

@@ -1,74 +0,0 @@
-import type { Size } from "../geometry";
-
-interface SerializedValue {
-  type: string;
-  value?: unknown;
-}
-
-type Send = <T>(method: string, params: object, cleanup?: boolean) => Promise<T>;
-
-/** Batch only accessible frame owners. Missing/shadow/cross-origin owners keep
- * the existing node-scoped read; no page-wide style columns are requested. */
-export async function readSnapshotOwnerSizes(
-  send: Send,
-  owners: ReadonlySet<number>,
-): Promise<Map<number, Size>> {
-  const sizes = new Map<number, Size>();
-  const objectGroup = `bsk-frame-sizes-${crypto.randomUUID()}`;
-  try {
-    const reply = await send<{ result?: { deepSerializedValue?: SerializedValue } }>(
-      "Runtime.evaluate",
-      {
-        expression: `(() => {
-          const result = [];
-          const documents = [document];
-          for (let i = 0; i < documents.length && result.length < ${owners.size}; i++) {
-            for (const owner of documents[i].querySelectorAll('iframe,frame')) {
-              if (result.length >= ${owners.size}) break;
-              if (!owner.isConnected) continue;
-              const style = getComputedStyle(owner);
-              result.push([owner, JSON.stringify({
-                width: owner.clientWidth - parseFloat(style.paddingLeft) - parseFloat(style.paddingRight),
-                height: owner.clientHeight - parseFloat(style.paddingTop) - parseFloat(style.paddingBottom)
-              })]);
-              try { if (owner.contentDocument) documents.push(owner.contentDocument); } catch {}
-            }
-          }
-          return result;
-        })()`,
-        objectGroup,
-        serializationOptions: {
-          serialization: "deep",
-          maxDepth: 3,
-          additionalParameters: { maxNodeDepth: 0, includeShadowTree: "none" },
-        },
-      },
-    );
-    const result = reply.result?.deepSerializedValue;
-    if (result?.type !== "array" || !Array.isArray(result.value)) return sizes;
-    for (const entry of result.value as SerializedValue[]) {
-      if (entry.type !== "array" || !Array.isArray(entry.value)) continue;
-      const [node, data] = entry.value as SerializedValue[];
-      if (node?.type !== "node" || data?.type !== "string" || typeof data.value !== "string")
-        continue;
-      const id = (node.value as { backendNodeId?: number } | undefined)?.backendNodeId;
-      if (id === undefined || !owners.has(id)) continue;
-      try {
-        const size = JSON.parse(data.value) as Size;
-        if (
-          size &&
-          Number.isFinite(size.width) &&
-          Number.isFinite(size.height) &&
-          size.width > 0 &&
-          size.height > 0
-        )
-          sizes.set(id, size);
-      } catch {
-        /* An invalid entry uses the existing individual read. */
-      }
-    }
-  } finally {
-    await send("Runtime.releaseObjectGroup", { objectGroup }, true).catch(() => {});
-  }
-  return sizes;
-}

apps/extension/src/tools/interaction.ts

@@ -1,4 +1,5 @@
-// DOM interaction tools — click, hover, focus/blur, fill, press, and select.
+// DOM interaction tools — `tool.click`, `tool.fill`, `tool.press`, and
+// `tool.select`.
 //
 // All interaction tools:
 // 1. Resolve target tab (sandbox: must be inside Agent Window).
@@ -13,14 +14,10 @@ import { ChromiumCdp } from "@/browser-driver/chromium-cdp";
 import type { CdpTarget } from "@/browser-driver/frame-graph";
 import type { SessionContext, SessionManager } from "@/session-manager/manager";
 import type {
-  BlurParams,
-  BlurResult,
   ClickParams,
   ClickResult,
   FillParams,
   FillResult,
-  FocusParams,
-  FocusResult,
   HoverParams,
   HoverResult,
   KeyModifier,
@@ -172,7 +169,7 @@ export async function resolveBackendNode(
     };
   }
   if (hasRef) {
-    const resolved = resolveSnapshotRef(ctx, params.ref as string, target.tabId);
+    const resolved = resolveSnapshotRef(ctx, params.ref as string, target.tabId, "interact");
     if (isRpcError(resolved)) return resolved;
     return {
       backendNodeId: resolved.backendNodeId,
@@ -230,207 +227,6 @@ export async function resolveBackendNode(
   }
 }
 
-// Check the target's own root, then its hosts: closed shadow roots are not
-// reachable via host.shadowRoot. DOM focus remains meaningful in background tabs.
-const FOCUS_CHECK = `function() {
-  if (!this.isConnected) return false;
-  let element = this;
-  while (element) {
-    const root = element.getRootNode();
-    if (root.activeElement !== element) return false;
-    element = root.host;
-  }
-  return true;
-}`;
-
-const BLUR_TARGET = `function() {
-  if (!this.isConnected) throw new Error('blur target is detached');
-  const wasFocused = (${FOCUS_CHECK}).call(this);
-  if (typeof this.blur !== 'function') return { ok: false, was_focused: wasFocused };
-  this.blur();
-  return { ok: true, was_focused: wasFocused };
-}`;
-
-interface FocusScriptReply<T> {
-  result?: { value?: T };
-  exceptionDetails?: { text?: string; exception?: { description?: string } };
-}
-
-function checkFocusAbort(signal: AbortSignal | undefined): void {
-  if (signal?.aborted) throw new DOMException("interaction aborted", "AbortError");
-}
-
-// Only focus/blur use this view. Guard every CDP boundary, including commands
-// inside selector resolution and frame scrolling, without changing other tools.
-function focusCdp(cdp: CdpRunner, signal: AbortSignal | undefined): CdpRunner {
-  const send = <T = unknown>(target: CdpTarget, method: string, params?: object): Promise<T> => {
-    checkFocusAbort(signal);
-    return cdpRunnerForTarget(cdp, target).send<T>(target.tabId, method, params);
-  };
-  return {
-    send: (tabId, method, params) => send({ tabId }, method, params),
-    sendToTarget: send,
-    trackSessionTab: cdp.trackSessionTab?.bind(cdp),
-    getFrameGraph: cdp.getFrameGraph
-      ? (tabId) => {
-          checkFocusAbort(signal);
-          return cdp.getFrameGraph!(tabId);
-        }
-      : undefined,
-  };
-}
-
-// ---------------------------------------------------------------------------
-// tool.focus / tool.blur
-// ---------------------------------------------------------------------------
-
-export function handleFocus(
-  manager: SessionManager,
-  params: FocusParams,
-  deps: InteractionDeps = getDefaultDeps(),
-): Promise<FocusResult | RpcError> {
-  return changeFocus(manager, params, deps, "focus");
-}
-
-export function handleBlur(
-  manager: SessionManager,
-  params: BlurParams,
-  deps: InteractionDeps = getDefaultDeps(),
-): Promise<BlurResult | RpcError> {
-  return changeFocus(manager, params, deps, "blur");
-}
-
-function changeFocus(
-  manager: SessionManager,
-  params: FocusParams,
-  deps: InteractionDeps,
-  action: "focus",
-): Promise<FocusResult | RpcError>;
-function changeFocus(
-  manager: SessionManager,
-  params: BlurParams,
-  deps: InteractionDeps,
-  action: "blur",
-): Promise<BlurResult | RpcError>;
-async function changeFocus(
-  manager: SessionManager,
-  params: FocusParams | BlurParams,
-  deps: InteractionDeps,
-  action: "focus" | "blur",
-): Promise<FocusResult | BlurResult | RpcError> {
-  const ctx = lookupSession(manager, params, action);
-  if (isRpcError(ctx)) return ctx;
-  const cdp = focusCdp(deps.cdp, deps.signal);
-  let objectId: string | undefined;
-  let cleanupCdp: CdpRunner | undefined;
-  let tabId: number | undefined;
-  try {
-    checkFocusAbort(deps.signal);
-    const target = await resolveTargetTab(manager, ctx, params.tab_id, deps.tabsApi);
-    checkFocusAbort(deps.signal);
-    if (isRpcError(target)) return target;
-    const denied = enforceAgentWindow(ctx, target, action);
-    if (denied) return denied;
-    tabId = target.tabId;
-    const dialogCursor = markDialogCursor(deps.cdp, tabId);
-    const node = await resolveBackendNode(cdp, ctx, target, params, action);
-    checkFocusAbort(deps.signal);
-    if (isRpcError(node)) return node;
-    const nodeCdp = cdpRunnerForTarget(cdp, node.cdpTarget);
-    cleanupCdp = cdpRunnerForTarget(deps.cdp, node.cdpTarget);
-    deps.cdp.trackSessionTab?.(ctx.sessionId, tabId);
-
-    if (action === "focus") {
-      const scrollErr = await scrollElementAndFramesIntoView(
-        cdp,
-        tabId,
-        node.cdpTarget,
-        node.backendNodeId,
-        node.frameId,
-      );
-      checkFocusAbort(deps.signal);
-      if (scrollErr) return scrollErr;
-    }
-    const resolved = await backendNodeToObject(nodeCdp, tabId, node.backendNodeId);
-    // Keep the handle before checking cancellation so finally can release it.
-    if (!isRpcError(resolved)) objectId = resolved;
-    checkFocusAbort(deps.signal);
-    if (isRpcError(resolved)) return resolved;
-
-    const runScript = async <T>(functionDeclaration: string): Promise<T | undefined> => {
-      const reply = await nodeCdp.send<FocusScriptReply<T>>(
-        target.tabId,
-        "Runtime.callFunctionOn",
-        {
-          objectId,
-          functionDeclaration,
-          returnByValue: true,
-        },
-      );
-      checkFocusAbort(deps.signal);
-      if (reply.exceptionDetails) {
-        const details = reply.exceptionDetails;
-        throw new Error(
-          `${action} script failed: ${details.exception?.description ?? details.text ?? "unknown exception"}`,
-        );
-      }
-      return reply.result?.value;
-    };
-
-    let wasFocused: boolean | undefined;
-    if (action === "focus") {
-      await nodeCdp.send(tabId, "DOM.focus", { backendNodeId: node.backendNodeId });
-      checkFocusAbort(deps.signal);
-    } else {
-      const mutation = await runScript<{ ok: boolean; was_focused: boolean }>(BLUR_TARGET);
-      if (typeof mutation?.ok !== "boolean" || typeof mutation.was_focused !== "boolean") {
-        throw new Error("blur script returned an unexpected result");
-      }
-      if (!mutation.ok) {
-        return { code: "invalid_params", message: "target element does not support blur()" };
-      }
-      wasFocused = mutation.was_focused;
-    }
-    // Use a separate call so microtasks from focus/blur handlers finish before
-    // we report success. In particular, a blur handler can restore focus.
-    const focused = await runScript<boolean>(FOCUS_CHECK);
-    if (typeof focused !== "boolean") {
-      throw new Error(`${action} verification returned an unexpected result`);
-    }
-    if (focused !== (action === "focus")) {
-      throw new Error(
-        action === "focus"
-          ? "target element did not become focused"
-          : "target element remained focused after blur()",
-      );
-    }
-    return attachDialogs(deps.cdp, tabId, dialogCursor, {
-      tab_id: tabId,
-      used_ref: node.usedRef,
-      used_selector: node.usedSelector,
-      focused,
-      ...(action === "blur" ? { was_focused: wasFocused! } : {}),
-    });
-  } catch (err) {
-    return (
-      throwIfAborted(deps.signal) ?? {
-        code: "cdp_failed",
-        message: err instanceof Error ? err.message : String(err),
-      }
-    );
-  } finally {
-    if (objectId !== undefined && cleanupCdp && tabId !== undefined) {
-      // Cleanup must also run after cancellation. Navigation may have already
-      // disposed the object, which must not replace the operation's result.
-      try {
-        await cleanupCdp.send(tabId, "Runtime.releaseObject", { objectId });
-      } catch {
-        // The target or execution context may no longer exist.
-      }
-    }
-  }
-}
-
 export async function resolveActionTarget(
   cdp: CdpRunner,
   ctx: SessionContext,

apps/extension/src/tools/observation.ts

@@ -1,4 +1,3 @@
-import type { CapturedSceneInput } from "./vom/facts";
 // Observation handlers — `tool.snapshot`, `tool.get_html`, `tool.screenshot`,
 // and semantic `tool.observe` (design §7). Each handler resolves the target
 // tab (defaulting to the Agent Window's active tab when omitted) and
@@ -9,6 +8,7 @@ import {
   applyVomInteractionRecovery,
   type CondSurface,
   isVomReferenceNode,
+  type Rect,
   renderVom,
   type VomNode,
   type VomOptions,
@@ -35,7 +35,6 @@ import type {
 import { attachDialogs, markDialogCursor } from "./dialogs";
 import { rpcError } from "./errors";
 import { resolveNodeGeometry } from "./frame-geometry";
-import { screenshotPageRect } from "./geometry/coordinate-types";
 import {
   type ChromeTabsApi,
   enforceToolTargetScope,
@@ -49,15 +48,33 @@ import {
   type ToolEffect,
 } from "./shared";
 import { resolveSnapshotRef } from "./snapshot-ref";
-import { type CapturedNode, type CapturedSurfaceProbe, probeHoverSurfaces } from "./vom/capture";
-import { captureObservationFacts, semanticCapture } from "./vom/capture-coordinator";
-import type { FrameDocument as CapturedFrameDocument } from "./vom/frame-document";
+import { topLevelScreenshotRasterScale } from "./viewport-metrics";
+import {
+  correctedVisualScreenshotScale,
+  planVisualScreenshot,
+  type ScreenshotPixelBudget,
+  screenshotFitsPixelBudget,
+} from "./visual-screenshot-plan";
+import {
+  type CapturedNode,
+  type CapturedSurfaceProbe,
+  type CapturedViewModel,
+  captureViewModel,
+  collectOverlayExcludedBackendIds,
+  probeHoverSurfaces,
+} from "./vom/capture";
+import { type CapturedFrameDocument, captureFrameData } from "./vom/frame-capture";
 import { withOverlayBypass } from "./vom/hover-perception";
 import { probeTooltipNames } from "./vom/name-enrichment";
 import {
   type CaptureVomObservationResult,
   projectRecordSafeObservation,
 } from "./vom/record-safe-observation";
+import {
+  clusterRenderedSurfaces,
+  discoverRenderedSurfaces,
+  projectRenderedSurfaces,
+} from "./vom/rendered-surfaces";
 import {
   buildSemanticGraph,
   buildSemanticVomScene,
@@ -89,6 +106,13 @@ export const normaliseRef = sharedNormaliseRef;
 // screenshot — `tool.screenshot`
 // ---------------------------------------------------------------------------
 
+const VISUAL_SURFACE_SCREENSHOT_MAX_EDGE = 2_048;
+const VISUAL_SURFACE_SCREENSHOT_MAX_PIXELS = 4_000_000;
+const VISUAL_SURFACE_SCREENSHOT_BUDGET: ScreenshotPixelBudget = {
+  maxEdge: VISUAL_SURFACE_SCREENSHOT_MAX_EDGE,
+  maxPixels: VISUAL_SURFACE_SCREENSHOT_MAX_PIXELS,
+};
+
 /**
  * Strip the `data:image/...;base64,` prefix from a Chrome
  * `captureVisibleTab` dataURL and return the raw base64 payload.
@@ -103,8 +127,8 @@ export function stripDataUrlPrefix(dataUrl: string): string {
 
 /**
  * Parse a PNG's IHDR chunk and return `(width, height)`. Returns
- * `null` on any malformed input so callers fall back to `0/0` instead
- * of throwing.
+ * `null` on malformed input so callers can reject dimensions that are
+ * not authoritative instead of guessing from a CSS-space rectangle.
  *
  * PNG layout: 8-byte signature, then a 4-byte length, 4-byte type
  * ("IHDR"), then the chunk data — width is bytes 16-19 BE, height is
@@ -116,9 +140,9 @@ export function parsePngDimensions(base64: string): { width: number; height: num
     const head = base64.length > 64 ? base64.slice(0, 64) : base64;
     const bin = atob(head);
     if (bin.length < 24) return null;
-    if (bin.charCodeAt(0) !== 0x89 || bin.charCodeAt(1) !== 0x50 || bin.charCodeAt(2) !== 0x4e) {
-      return null;
-    }
+    const expectedSignature = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a];
+    if (expectedSignature.some((byte, index) => bin.charCodeAt(index) !== byte)) return null;
+    if (bin.slice(12, 16) !== "IHDR") return null;
     const u32 = (off: number) =>
       (bin.charCodeAt(off) << 24) |
       (bin.charCodeAt(off + 1) << 16) |
@@ -181,6 +205,8 @@ async function captureElementScreenshot(
   target: CdpTarget,
   backendNodeId: number,
   frameId?: string,
+  visualSurface = false,
+  observedVisibleRect?: Rect,
   signal?: AbortSignal,
 ): Promise<{ image_base64: string; width: number; height: number } | RpcError> {
   if (signal?.aborted) return cancelled("screenshot");
@@ -188,32 +214,74 @@ async function captureElementScreenshot(
     cdp,
     tabId,
     { target, backendNodeId, ...(frameId ? { frameId } : {}) },
-    { scrollIntoView: true },
+    { scrollIntoView: !visualSurface },
   );
   if (isRpcError(geometry)) return geometry;
   if (signal?.aborted) return cancelled("screenshot");
-  const rect = geometry.topBounds;
-  const clip = screenshotPageRect(rect, geometry.topViewport);
-  if (!clip) return { code: "cdp_failed", message: "invalid screenshot coordinate space" };
+  const liveRect = geometry.topBounds;
+  const rect =
+    visualSurface && observedVisibleRect
+      ? (() => {
+          const x = Math.max(liveRect.x, observedVisibleRect.x);
+          const y = Math.max(liveRect.y, observedVisibleRect.y);
+          const right = Math.min(
+            liveRect.x + liveRect.width,
+            observedVisibleRect.x + observedVisibleRect.w,
+          );
+          const bottom = Math.min(
+            liveRect.y + liveRect.height,
+            observedVisibleRect.y + observedVisibleRect.h,
+          );
+          return right > x && bottom > y ? { x, y, width: right - x, height: bottom - y } : null;
+        })()
+      : liveRect;
+  if (!rect) return { code: "permission_denied", message: "surface is no longer visible" };
+  const rasterScaleEstimate = visualSurface ? await topLevelScreenshotRasterScale(cdp, tabId) : 1;
+  let scale = visualSurface
+    ? planVisualScreenshot({
+        cssRect: rect,
+        rasterScaleEstimate,
+        budget: VISUAL_SURFACE_SCREENSHOT_BUDGET,
+      }).clipScale
+    : 1;
 
   try {
-    const shot = await cdp.send<{ data?: string }>(tabId, "Page.captureScreenshot", {
-      format: "png",
-      clip: {
-        ...clip.rect,
-        scale: 1,
-      },
-    });
-    if (signal?.aborted) return cancelled("screenshot");
-    const image_base64 = shot.data ?? "";
-    if (!image_base64) {
-      return { code: "cdp_failed", message: "Page.captureScreenshot returned no data" };
+    for (let attempt = 0; attempt < (visualSurface ? 2 : 1); attempt += 1) {
+      const shot = await cdp.send<{ data?: string }>(tabId, "Page.captureScreenshot", {
+        format: "png",
+        clip: {
+          x: rect.x,
+          y: rect.y,
+          width: rect.width,
+          height: rect.height,
+          scale,
+        },
+      });
+      if (signal?.aborted) return cancelled("screenshot");
+      const image_base64 = shot.data ?? "";
+      if (!image_base64) {
+        return { code: "cdp_failed", message: "Page.captureScreenshot returned no data" };
+      }
+      const dims = parsePngDimensions(image_base64);
+      if (!dims) {
+        return { code: "cdp_failed", message: "Page.captureScreenshot returned invalid PNG data" };
+      }
+      if (!visualSurface || screenshotFitsPixelBudget(dims, VISUAL_SURFACE_SCREENSHOT_BUDGET)) {
+        return { image_base64, width: dims.width, height: dims.height };
+      }
+      const corrected = correctedVisualScreenshotScale({
+        previousClipScale: scale,
+        actualWidth: dims.width,
+        actualHeight: dims.height,
+        budget: VISUAL_SURFACE_SCREENSHOT_BUDGET,
+      });
+      if (attempt === 1 || corrected === null) break;
+      scale = corrected;
     }
-    const dims = parsePngDimensions(image_base64) ?? {
-      width: Math.round(rect.width),
-      height: Math.round(rect.height),
+    return {
+      code: "cdp_failed",
+      message: "Page.captureScreenshot exceeded the visual surface pixel budget",
     };
-    return { image_base64, width: dims.width, height: dims.height };
   } catch (err) {
     return {
       code: "cdp_failed",
@@ -308,8 +376,14 @@ export async function handleScreenshot(
     if (!deps.cdp) {
       return { code: "cdp_failed", message: "screenshot ref capture requires CDP" };
     }
-    const node = resolveSnapshotRef(ctx, ref, target.tabId);
+    const node = resolveSnapshotRef(ctx, ref, target.tabId, "screenshot");
     if (isRpcError(node)) return node;
+    if (node.kind === "surface" && !node.visibleRect) {
+      return {
+        code: "permission_denied",
+        message: `surface ref ${ref} has no observation-time visible bounds`,
+      };
+    }
     if (signal?.aborted) return cancelled("screenshot");
     deps.cdp.trackSessionTab?.(ctx.sessionId, target.tabId);
     await deps.cdp.ensureAttachedToUrl?.(target.tabId, target.url);
@@ -328,6 +402,8 @@ export async function handleScreenshot(
           nodeTarget,
           node.backendNodeId,
           node.frameId,
+          node.kind === "surface",
+          node.visibleRect,
           signal,
         ),
       deps.sendToTab,
@@ -359,7 +435,10 @@ export async function handleScreenshot(
   if (isRpcError(captured)) return captured;
   if (signal?.aborted) return cancelled("screenshot");
   const image_base64 = captured;
-  const dims = parsePngDimensions(image_base64) ?? { width: 0, height: 0 };
+  const dims = parsePngDimensions(image_base64);
+  if (!dims) {
+    return { code: "cdp_failed", message: "screenshot capture returned invalid PNG data" };
+  }
   return withShotDialogs({
     image_base64,
     width: dims.width,
@@ -525,7 +604,7 @@ function buildActiveScopeBlocks(nodes: VomNode[], signals: VomNodeDomSignals): A
 
 function buildConditionalSurfaces(
   nodes: VomNode[],
-  captured: CapturedSceneInput,
+  captured: CapturedViewModel,
   probes: CapturedSurfaceProbe[],
 ): CondSurface[] {
   if (probes.length === 0) return [];
@@ -655,9 +734,161 @@ export interface BuildVomSceneOptions {
 
 export type VomFrameDocument = CapturedFrameDocument<CdpAxNode>;
 
+function legacyFrameDocuments(
+  axNodes: CdpAxNode[],
+  captured: CapturedViewModel,
+  pageUrl?: string,
+  rootTarget: VomFrameDocument["target"] = { tabId: 0 },
+): VomFrameDocument[] {
+  const rootFrameId = captured.rootFrameId ?? "root";
+  const documents: VomFrameDocument[] = [
+    {
+      frameId: rootFrameId,
+      contextScopeId: rootFrameId,
+      target: rootTarget,
+      ...(pageUrl ? { url: pageUrl } : {}),
+      axNodes: [],
+      domNodes: captured.nodes.map((node) => ({ ...node, frameId: node.frameId ?? rootFrameId })),
+    },
+  ];
+  const pending = [...captured.iframeNodes.entries()];
+  let progress = true;
+  let nextSyntheticFrame = 1;
+  while (pending.length > 0 && progress) {
+    progress = false;
+    for (let index = pending.length - 1; index >= 0; index -= 1) {
+      const [ownerBackendNodeId, domNodes] = pending[index];
+      const parent = documents.find((document) =>
+        document.domNodes.some((node) => node.backendNodeId === ownerBackendNodeId),
+      );
+      if (!parent) continue;
+      const frameId =
+        domNodes.find((node) => node.frameId)?.frameId ?? `legacy-frame-${nextSyntheticFrame++}`;
+      documents.push({
+        frameId,
+        parentFrameId: parent.frameId,
+        ownerBackendNodeId,
+        contextScopeId: frameId,
+        target: parent.target,
+        axNodes: [],
+        domNodes: domNodes.map((node) => ({ ...node, frameId: node.frameId ?? frameId })),
+      });
+      pending.splice(index, 1);
+      progress = true;
+    }
+  }
+
+  const documentByFrameId = new Map(documents.map((document) => [document.frameId, document]));
+  const backendFrame = new Map<number, string>();
+  const childFrameByOwner = new Map<number, string>();
+  for (const document of documents) {
+    if (document.ownerBackendNodeId !== undefined) {
+      childFrameByOwner.set(document.ownerBackendNodeId, document.frameId);
+    }
+    for (const node of document.domNodes) backendFrame.set(node.backendNodeId, document.frameId);
+  }
+  const axById = new Map(axNodes.map((node) => [node.nodeId, node]));
+  const ownership = new Map<string, string>();
+  const resolving = new Set<string>();
+  const frameForAx = (node: CdpAxNode): string => {
+    const cached = ownership.get(node.nodeId);
+    if (cached) return cached;
+    let frameId: string | undefined;
+    if (node.frameId && documentByFrameId.has(node.frameId)) frameId = node.frameId;
+    if (!frameId && typeof node.backendDOMNodeId === "number") {
+      frameId = backendFrame.get(node.backendDOMNodeId);
+    }
+    if (!frameId && node.parentId && !resolving.has(node.nodeId)) {
+      const parent = axById.get(node.parentId);
+      if (parent) {
+        frameId =
+          typeof parent.backendDOMNodeId === "number"
+            ? childFrameByOwner.get(parent.backendDOMNodeId)
+            : undefined;
+        if (!frameId) {
+          resolving.add(node.nodeId);
+          frameId = frameForAx(parent);
+          resolving.delete(node.nodeId);
+        }
+      }
+    }
+    frameId ??= rootFrameId;
+    ownership.set(node.nodeId, frameId);
+    return frameId;
+  };
+  for (const node of axNodes) frameForAx(node);
+  for (const node of axNodes) {
+    const frameId = ownership.get(node.nodeId) ?? rootFrameId;
+    const document = documentByFrameId.get(frameId) ?? documents[0];
+    document.axNodes.push({
+      ...node,
+      frameId,
+      ...(node.parentId && ownership.get(node.parentId) === frameId
+        ? { parentId: node.parentId }
+        : { parentId: undefined }),
+      ...(node.childIds
+        ? { childIds: node.childIds.filter((childId) => ownership.get(childId) === frameId) }
+        : {}),
+    });
+  }
+  return documents;
+}
+
+function withLegacyBackendIds(scene: VomScene): VomScene {
+  const used = new Set<number>();
+  const idMap = new Map<number, number>();
+  let nextVirtualId = -1;
+  for (const node of scene.nodes) {
+    const preferred = node.backendNodeId;
+    const id = preferred !== undefined && !used.has(preferred) ? preferred : nextVirtualId--;
+    used.add(id);
+    idMap.set(node.id, id);
+  }
+  return {
+    ...scene,
+    nodes: scene.nodes.map((node) => ({
+      ...node,
+      id: idMap.get(node.id) as number,
+      parentId: node.parentId === null ? null : (idMap.get(node.parentId) ?? null),
+      ...(node.domParentId !== undefined
+        ? { domParentId: node.domParentId === null ? null : (idMap.get(node.domParentId) ?? null) }
+        : {}),
+      ...(node.domAncestorIds
+        ? { domAncestorIds: node.domAncestorIds.flatMap((id) => idMap.get(id) ?? []) }
+        : {}),
+    })),
+    ...(scene.surfaces
+      ? {
+          surfaces: scene.surfaces.map((surface) => ({
+            ...surface,
+            triggerId: idMap.get(surface.triggerId) ?? surface.triggerId,
+          })),
+        }
+      : {}),
+    ...(scene.activeScopeBlocks
+      ? {
+          activeScopeBlocks: scene.activeScopeBlocks.map((block) => ({
+            ...block,
+            triggerId: idMap.get(block.triggerId) ?? block.triggerId,
+          })),
+        }
+      : {}),
+  };
+}
+
+export function buildVomScene(
+  axNodes: CdpAxNode[],
+  captured: CapturedViewModel,
+  options: BuildVomSceneOptions = {},
+): VomScene {
+  return withLegacyBackendIds(
+    buildFrameVomScene(legacyFrameDocuments(axNodes, captured, options.pageUrl), captured, options),
+  );
+}
+
 export function buildFrameVomScene(
   documents: VomFrameDocument[],
-  captured: CapturedSceneInput,
+  captured: CapturedViewModel,
   options: BuildVomSceneOptions = {},
 ): VomScene {
   const scene = buildSemanticVomScene({
@@ -673,7 +904,7 @@ export function buildFrameVomScene(
 function attachCapturedSceneAnnotations(
   scene: VomScene,
   documents: VomFrameDocument[],
-  captured: CapturedSceneInput,
+  captured: CapturedViewModel,
   surfaceProbes: CapturedSurfaceProbe[],
 ): VomScene {
   const rootDocument = documents.find((document) => document.frameId === scene.rootFrameId);
@@ -823,6 +1054,51 @@ export async function handleGetHtml(
   }
 }
 
+function emptyCapturedViewModel(viewport = { width: 0, height: 0 }): CapturedViewModel {
+  return { viewport, nodes: [], iframeNodes: new Map(), excludedBackendNodeIds: new Set() };
+}
+
+interface LayoutMetricsViewportReply {
+  cssLayoutViewport?: { clientWidth?: number; clientHeight?: number };
+  layoutViewport?: { clientWidth?: number; clientHeight?: number };
+}
+
+async function fallbackCapturedViewModel(
+  cdp: CdpRunner,
+  tabId: number,
+  signal?: AbortSignal,
+): Promise<CapturedViewModel> {
+  throwIfAborted(signal, "observation");
+  let viewport = { width: 0, height: 0 };
+  try {
+    const metrics = await cdp.send<LayoutMetricsViewportReply>(tabId, "Page.getLayoutMetrics", {});
+    throwIfAborted(signal, "observation");
+    const source = metrics.cssLayoutViewport ?? metrics.layoutViewport ?? {};
+    viewport = {
+      width: source.clientWidth ?? 0,
+      height: source.clientHeight ?? 0,
+    };
+  } catch (error) {
+    if (isAbortError(error)) throw error;
+  }
+  const excludedBackendNodeIds = await collectOverlayExcludedBackendIds(cdp, tabId, signal);
+  throwIfAborted(signal, "observation");
+  return { ...emptyCapturedViewModel(viewport), excludedBackendNodeIds };
+}
+
+async function captureForVom(
+  cdp: CdpRunner,
+  tabId: number,
+  options: CaptureVomObservationOptions,
+): Promise<CapturedViewModel> {
+  try {
+    return await captureViewModel(cdp, tabId, { signal: options.signal });
+  } catch (error) {
+    if (isAbortError(error)) throw error;
+    return fallbackCapturedViewModel(cdp, tabId, options.signal);
+  }
+}
+
 export interface HoverProbeOutcome {
   /** Whether any active hover was dispatched during this observation. */
   performed: boolean;
@@ -855,7 +1131,7 @@ const NO_HOVER_PROBES: HoverProbeOutcome = {
 async function runHoverProbes(
   cdp: CdpRunner,
   tabId: number,
-  captured: CapturedSceneInput,
+  captured: CapturedViewModel,
   documents: VomFrameDocument[],
   staticSemantics: ReturnType<typeof resolveSemanticGraph>,
   options: CaptureVomObservationOptions,
@@ -881,6 +1157,7 @@ async function runHoverProbes(
 
 export interface CaptureVomObservationOptions extends VomOptions {
   conditionalSurfaceProbe?: boolean;
+  renderedSurfaceDiscovery?: boolean;
   hoverProbeBypassOverlay?: (tabId: number, enabled: boolean) => Promise<void>;
   signal?: AbortSignal;
 }
@@ -894,9 +1171,14 @@ export async function captureVomObservation(
   throwIfAborted(options.signal, "observation");
   await cdp.ensureAttachedToUrl?.(tabId, url);
   throwIfAborted(options.signal, "observation");
-  const facts = await captureObservationFacts<CdpAxNode>(cdp, tabId, options.signal, url);
-  const { captured, documents: normalizedDocuments } = semanticCapture(facts);
+  const captured = await captureForVom(cdp, tabId, options);
   throwIfAborted(options.signal, "observation");
+  const documents = await captureFrameData<CdpAxNode>(cdp, tabId, captured, options.signal);
+  throwIfAborted(options.signal, "observation");
+  const normalizedDocuments =
+    documents.length === 1 && captured.iframeNodes.size > 0
+      ? legacyFrameDocuments(documents[0].axNodes, captured, url, documents[0].target)
+      : documents;
   const semanticGraph = buildSemanticGraph({
     documents: normalizedDocuments,
     viewport: captured.viewport,
@@ -924,43 +1206,25 @@ export async function captureVomObservation(
     captured,
     hoverProbes.surfaceProbes,
   );
-  // Reserve space using the renderer's character-based token estimate. Like VOM
-  // headers, this integrity notice remains visible even under a tiny token budget.
-  const notices: string[] = [];
-  if (facts.issues.some((issue) => issue.stage === "geometry"))
-    notices.push(
-      "@warning geometry incomplete: some page or frame content has no top-level coordinates.",
-    );
-  const incompleteStages = ["dom", "ax", "forms", "ownership"].filter((stage) =>
-    facts.issues.some((issue) => issue.stage === stage),
-  );
-  if (incompleteStages.length)
-    notices.push(
-      `@warning observation incomplete: some ${incompleteStages.join(", ")} data is unavailable or omitted.`,
-    );
-  if (
-    facts.issues.some(
-      (issue) => issue.stage === "identity" && issue.reason !== "identity-unverified",
-    )
-  )
-    notices.push(
-      "@warning observation incomplete: some documents were omitted because their identity changed or could not be revalidated.",
-    );
-  if (facts.issues.some((issue) => issue.reason === "identity-unverified"))
-    notices.push(
-      "@warning document identity unverified: some retained documents could not be checked for changes during capture.",
-    );
-  const captureNotice = notices.join("\n");
-  const rendered = renderVom(decoratedScene, {
+  const observedScene = options.renderedSurfaceDiscovery
+    ? projectRenderedSurfaces(
+        decoratedScene,
+        normalizedDocuments,
+        clusterRenderedSurfaces(
+          discoverRenderedSurfaces(
+            normalizedDocuments,
+            captured.viewport,
+            captured.excludedBackendNodeIds,
+          ),
+        ),
+      )
+    : decoratedScene;
+  const rendered = renderVom(observedScene, {
     maxDepth: options.maxDepth,
-    maxTokens:
-      !captureNotice || options.maxTokens === undefined
-        ? options.maxTokens
-        : Math.max(0, options.maxTokens - Math.ceil((captureNotice.length + 1) / 4)),
+    maxTokens: options.maxTokens,
     redactValues: options.redactValues,
     activeRegionPolicy: options.activeRegionPolicy,
   });
-  if (captureNotice) rendered.text += `\n${captureNotice}`;
   throwIfAborted(options.signal, "observation");
   return projectRecordSafeObservation({
     rootFrameId: captured.rootFrameId ?? normalizedDocuments[0]?.frameId ?? "root",
@@ -1010,6 +1274,7 @@ async function handleVomObservation(
       maxTokens: params.max_tokens,
       activeRegionPolicy: true,
       conditionalSurfaceProbe: effectiveConditionalSurfaceProbe,
+      renderedSurfaceDiscovery: toolName === "observe",
       hoverProbeBypassOverlay: deps.hoverProbeBypassOverlay,
       signal,
     });
@@ -1027,6 +1292,9 @@ async function handleVomObservation(
             tabId: target.tabId,
             ...(ref.frameId ? { frameId: ref.frameId } : {}),
             ...(refTarget?.sessionId ? { cdpSessionId: refTarget.sessionId } : {}),
+            ...(ref.visibleRect ? { visibleRect: ref.visibleRect } : {}),
+            ...(ref.kind ? { kind: ref.kind } : {}),
+            ...(ref.capabilities ? { capabilities: ref.capabilities } : {}),
           },
         ] as const;
       }),

apps/extension/src/tools/scroll-visibility.ts

@@ -1,142 +0,0 @@
-import { cdpTargetKey } from "@/browser-driver/frame-graph";
-import type { NodeAddress } from "./frame-geometry";
-import {
-  clipPolygon,
-  projectRegionToViewport,
-  type Region,
-  rectPolygon,
-  regionBounds,
-  type ViewportRect,
-} from "./geometry";
-import { GeometryContext } from "./geometry/frame-context";
-import { type CdpRunner, sendToCdpTarget } from "./shared";
-
-// Ask the renderer to apply containing-block clips (including shadow DOM),
-// instead of treating layout quads as visible pixels. Each document is measured
-// locally; the existing frame projections supply the top-viewport coordinates.
-// IntersectionObserver reports a bounding rectangle, not an occlusion/hit test.
-const VISIBLE_RECT = `function(timeoutMs) {
-  const element = this;
-  const visible = () => element.isConnected && element.checkVisibility({
-    checkOpacity: true, checkVisibilityCSS: true, contentVisibilityAuto: true
-  });
-  if (typeof element.checkVisibility !== 'function' || !visible()) return null;
-  return new Promise((resolve, reject) => {
-    const observer = new IntersectionObserver(([entry]) => {
-      clearTimeout(timer);
-      observer.disconnect();
-      const rect = entry.intersectionRect;
-      resolve(visible() && entry.isIntersecting && rect.width > 0 && rect.height > 0
-        ? { x: rect.x, y: rect.y, width: rect.width, height: rect.height }
-        : null);
-    }, { root: element.ownerDocument });
-    const timer = setTimeout(() => {
-      observer.disconnect();
-      reject(new Error('scroll-to visibility measurement timed out'));
-    }, timeoutMs);
-    observer.observe(element);
-  });
-}`;
-
-async function visibleRect(
-  cdp: CdpRunner,
-  address: NodeAddress,
-  deadline: number,
-): Promise<ViewportRect | null> {
-  const resolved = await sendToCdpTarget<{ object?: { objectId?: string } }>(
-    cdp,
-    address.target,
-    "DOM.resolveNode",
-    { backendNodeId: address.backendNodeId },
-  );
-  if (!resolved.object?.objectId) throw new Error("scroll-to could not resolve the target element");
-  const reply = await sendToCdpTarget<{
-    result?: { value?: ViewportRect | null };
-    exceptionDetails?: { text?: string; exception?: { description?: string } };
-  }>(cdp, address.target, "Runtime.callFunctionOn", {
-    objectId: resolved.object.objectId,
-    functionDeclaration: VISIBLE_RECT,
-    // Bound this read even if a background document stops rendering. Its
-    // observer always disconnects; cancellation cannot leave a live observer.
-    arguments: [{ value: Math.max(1, Math.min(1_000, deadline - Date.now())) }],
-    awaitPromise: true,
-    returnByValue: true,
-  });
-  if (reply.exceptionDetails) {
-    const details = reply.exceptionDetails;
-    throw new Error(details.exception?.description ?? details.text ?? "visibility script failed");
-  }
-  const rect = reply.result?.value;
-  if (rect === null) return null;
-  if (
-    !rect ||
-    ![rect.x, rect.y, rect.width, rect.height].every(Number.isFinite) ||
-    rect.width <= 0 ||
-    rect.height <= 0
-  ) {
-    throw new Error("scroll-to visibility measurement returned invalid bounds");
-  }
-  return rect;
-}
-
-async function projectRect(
-  context: GeometryContext,
-  address: NodeAddress,
-  rect: ViewportRect,
-): Promise<Region> {
-  let region: Region = [rectPolygon({ x: rect.x, y: rect.y, w: rect.width, h: rect.height })];
-  if (!address.frameId) return region;
-  const frame = await context.frame(address.frameId);
-  if (!frame || cdpTargetKey(frame.target) !== cdpTargetKey(address.target)) {
-    throw new Error("scroll-to frame no longer belongs to its target");
-  }
-  const parent = frame.parentFrameId ? await context.frame(frame.parentFrameId) : undefined;
-  if (parent && cdpTargetKey(parent.target) === cdpTargetKey(frame.target)) {
-    // DOM rectangles are document-local. Same-target iframe quads are already
-    // target-local, so cross this one boundary before the target projection.
-    const viewport = await context.viewport(frame.target);
-    if (frame.ownerBackendNodeId === undefined || !viewport) {
-      throw new Error("scroll-to could not resolve the frame viewport");
-    }
-    const local = await context.snapshotProjection(address, frame.ownerBackendNodeId, [], viewport);
-    if (local.status !== "available") throw new Error("scroll-to could not project the frame");
-    region = projectRegionToViewport(region, local.projection.geometry);
-  }
-  const projection = await context.targetProjection(frame.frameId);
-  if (!projection) throw new Error("scroll-to could not project the target viewport");
-  return projectRegionToViewport(region, projection);
-}
-
-/** Only scroll-to needs renderer-clipped bounds; other interaction geometry is unchanged. */
-export async function scrollVisibleBounds(
-  cdp: CdpRunner,
-  tabId: number,
-  address: NodeAddress,
-  deadline: number,
-): Promise<ViewportRect | null> {
-  const context = new GeometryContext(cdp, tabId);
-  const rect = await visibleRect(cdp, address, deadline);
-  if (!rect) return null;
-  let region = await projectRect(context, address, rect);
-  if (address.frameId) {
-    const ancestry = await context.ancestry(address.frameId);
-    if (!ancestry) throw new Error("scroll-to could not resolve the frame ancestry");
-    for (const child of ancestry) {
-      const parent = child.parentFrameId ? await context.frame(child.parentFrameId) : undefined;
-      if (!parent || child.ownerBackendNodeId === undefined) {
-        throw new Error("scroll-to could not resolve the frame owner");
-      }
-      const owner = {
-        target: parent.target,
-        frameId: parent.frameId,
-        backendNodeId: child.ownerBackendNodeId,
-      };
-      // A visible child document can still have a hidden or clipped iframe.
-      const ownerRect = await visibleRect(cdp, owner, deadline);
-      if (!ownerRect) return null;
-      const clips = await projectRect(context, owner, ownerRect);
-      region = region.flatMap((polygon) => clips.map((clip) => clipPolygon(polygon, clip)));
-    }
-  }
-  return regionBounds(region);
-}

apps/extension/src/tools/scroll.ts

@@ -1,137 +0,0 @@
-import { ChromiumCdp } from "@/browser-driver/chromium-cdp";
-import { type CdpTarget, cdpTargetKey } from "@/browser-driver/frame-graph";
-import type { SessionManager } from "@/session-manager/manager";
-import type { RpcError, ScrollToParams, ScrollToResult } from "@/transport/types";
-import { attachDialogs, markDialogCursor } from "./dialogs";
-import { cdpError, rpcError } from "./errors";
-import { scrollElementAndFramesIntoView } from "./frame-geometry";
-import { resolveBackendNode } from "./interaction";
-import { scrollVisibleBounds } from "./scroll-visibility";
-import {
-  type CdpRunner,
-  type ChromeTabsApi,
-  chromeTabsApi,
-  enforceAgentWindow,
-  isRpcError,
-  lookupSession,
-  resolveTargetTab,
-  sendToCdpTarget,
-} from "./shared";
-
-export interface ScrollToDeps {
-  cdp: CdpRunner;
-  tabsApi: ChromeTabsApi;
-  signal?: AbortSignal;
-}
-
-let defaultDeps: { cdp: ChromiumCdp; tabsApi: ChromeTabsApi } | null = null;
-function getDefaultDeps(): { cdp: ChromiumCdp; tabsApi: ChromeTabsApi } {
-  if (!defaultDeps) defaultDeps = { cdp: new ChromiumCdp(), tabsApi: chromeTabsApi };
-  return defaultDeps;
-}
-
-export async function handleScrollTo(
-  manager: SessionManager,
-  params: ScrollToParams,
-  deps: ScrollToDeps = getDefaultDeps(),
-): Promise<ScrollToResult | RpcError> {
-  const ctxOrErr = lookupSession(manager, params, "scroll-to");
-  if (isRpcError(ctxOrErr)) return ctxOrErr;
-  const ctx = ctxOrErr;
-  const timeout = params.timeout_ms ?? 30_000;
-  if (!Number.isInteger(timeout) || timeout <= 0) {
-    return { code: "invalid_params", message: "timeout_ms must be a positive integer" };
-  }
-  const deadline = Date.now() + timeout;
-  const checkActive = () => {
-    if (deps.signal?.aborted) throw new DOMException("scroll-to aborted", "AbortError");
-    if (Date.now() >= deadline) throw new DOMException("scroll-to timed out", "TimeoutError");
-  };
-  const objectGroup = `bsk-scroll-${crypto.randomUUID()}`;
-  const objectTargets = new Map<string, CdpTarget>();
-  const send = async <T>(target: CdpTarget, method: string, args?: object): Promise<T> => {
-    checkActive();
-    // Also own objects allocated by the shared scroll fallback. Record the
-    // target before awaiting so cancellation cannot skip their cleanup.
-    if (method === "DOM.resolveNode") objectTargets.set(cdpTargetKey(target), target);
-    const result = await sendToCdpTarget<T>(
-      deps.cdp,
-      target,
-      method,
-      method === "DOM.resolveNode" ? { ...args, objectGroup } : args,
-    );
-    checkActive();
-    return result;
-  };
-  let graph: ReturnType<NonNullable<CdpRunner["getFrameGraph"]>> | undefined;
-  const cdp: CdpRunner = {
-    send: (tabId, method, args) => send({ tabId }, method, args),
-    sendToTarget: send,
-    trackSessionTab: deps.cdp.trackSessionTab?.bind(deps.cdp),
-    getFrameGraph: deps.cdp.getFrameGraph
-      ? async (tabId) => {
-          checkActive();
-          graph ??= deps.cdp.getFrameGraph!(tabId);
-          const result = await graph;
-          checkActive();
-          return result;
-        }
-      : undefined,
-  };
-  try {
-    checkActive();
-    const target = await resolveTargetTab(manager, ctx, params.tab_id, deps.tabsApi);
-    checkActive();
-    if (isRpcError(target)) return target;
-    const denied = enforceAgentWindow(ctx, target, "scroll-to");
-    if (denied) return denied;
-    const dialogCursor = markDialogCursor(deps.cdp, target.tabId);
-    const node = await resolveBackendNode(cdp, ctx, target, params, "scroll-to");
-    checkActive();
-    if (isRpcError(node)) return node;
-    deps.cdp.trackSessionTab?.(ctx.sessionId, target.tabId);
-    const scrollError = await scrollElementAndFramesIntoView(
-      cdp,
-      target.tabId,
-      node.cdpTarget,
-      node.backendNodeId,
-      node.frameId,
-    );
-    checkActive();
-    if (scrollError) return scrollError;
-    const bounds = await scrollVisibleBounds(
-      cdp,
-      target.tabId,
-      {
-        target: node.cdpTarget,
-        backendNodeId: node.backendNodeId,
-        frameId: node.frameId,
-      },
-      deadline,
-    );
-    checkActive();
-    if (!bounds)
-      return rpcError(
-        "permission_denied",
-        "element_not_visible",
-        "scroll-to target has no visible area",
-      );
-    return attachDialogs(deps.cdp, target.tabId, dialogCursor, {
-      tab_id: target.tabId,
-      used_ref: node.usedRef,
-      used_selector: node.usedSelector,
-      ...bounds,
-    });
-  } catch (error) {
-    if (deps.signal?.aborted) return { code: "cancelled", message: "scroll-to aborted" };
-    if (Date.now() >= deadline) return { code: "timeout", message: "scroll-to timed out" };
-    return cdpError(error);
-  } finally {
-    // Cleanup bypasses the cancellation guard and cannot replace the result.
-    for (const target of objectTargets.values()) {
-      await sendToCdpTarget(deps.cdp, target, "Runtime.releaseObjectGroup", { objectGroup }).catch(
-        () => {},
-      );
-    }
-  }
-}

apps/extension/src/tools/shared.ts

@@ -55,7 +55,6 @@ export interface CdpRunner {
   sendToTarget?<T = unknown>(target: CdpTarget, method: string, params?: object): Promise<T>;
   detach?(tabId: number): Promise<void>;
   getFrameGraph?(tabId: number): Promise<CdpFrameGraph>;
-  getAttachmentId?(tabId: number): string | undefined;
   ensureAttachedToUrl?(tabId: number, expectedUrl: string | undefined): Promise<void>;
   trackSessionTab?(sessionId: string, tabId: number): void;
   releaseSessionTab?(sessionId: string, tabId: number): Promise<void>;

apps/extension/src/tools/snapshot-ref.ts

@@ -2,8 +2,9 @@
 // compound CDP node identity via the session RefStore, and build stable
 // `ref_not_found` errors for hard-failure tool paths.
 
+import type { Rect } from "@browser-skill/vom";
 import type { SessionContext } from "@/session-manager/manager";
-import { normaliseRef } from "@/session-manager/ref-store";
+import { normaliseRef, type RefCapability, type RefTargetKind } from "@/session-manager/ref-store";
 import type { RpcError } from "@/transport/types";
 import { rpcError } from "./errors";
 
@@ -12,6 +13,9 @@ export interface SnapshotRefLookup {
   refKey: string;
   frameId?: string;
   cdpSessionId?: string;
+  visibleRect?: Rect;
+  kind: RefTargetKind;
+  capabilities: RefCapability[];
 }
 
 function refEntryForTab(ctx: SessionContext, refKey: string, tabId: number) {
@@ -37,6 +41,9 @@ export function lookupSnapshotRef(
     refKey,
     ...(entry.frameId ? { frameId: entry.frameId } : {}),
     ...(entry.cdpSessionId ? { cdpSessionId: entry.cdpSessionId } : {}),
+    ...(entry.visibleRect ? { visibleRect: entry.visibleRect } : {}),
+    kind: entry.kind,
+    capabilities: entry.capabilities,
   };
 }
 
@@ -49,6 +56,7 @@ export function resolveSnapshotRef(
   ctx: SessionContext,
   ref: string,
   tabId: number,
+  requiredCapability?: RefCapability,
 ): SnapshotRefLookup | RpcError {
   const looked = lookupSnapshotRef(ctx, ref, tabId);
   if (looked === null) {
@@ -58,5 +66,13 @@ export function resolveSnapshotRef(
       `ref ${ref} unknown for tab ${tabId} in session ${ctx.sessionId}`,
     );
   }
+  if (requiredCapability && !looked.capabilities.includes(requiredCapability)) {
+    return rpcError(
+      "permission_denied",
+      "ref_capability_denied",
+      `ref ${ref} does not support ${requiredCapability}`,
+      { ref: looked.refKey, required_capability: requiredCapability, kind: looked.kind },
+    );
+  }
   return looked;
 }

apps/extension/src/tools/viewport-metrics.ts

@@ -0,0 +1,18 @@
+import type { CdpRunner } from "./shared";
+
+/** Estimate the raster/CSS ratio used by top-level Page.captureScreenshot. */
+export async function topLevelScreenshotRasterScale(
+  cdp: CdpRunner,
+  tabId: number,
+): Promise<number> {
+  try {
+    const reply = await cdp.send<{ result?: { value?: unknown } }>(tabId, "Runtime.evaluate", {
+      expression: "window.devicePixelRatio",
+      returnByValue: true,
+    });
+    const value = reply.result?.value;
+    return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : 1;
+  } catch {
+    return 1;
+  }
+}

apps/extension/src/tools/visual-screenshot-plan.ts

@@ -0,0 +1,52 @@
+export interface ScreenshotPixelBudget {
+  maxEdge: number;
+  maxPixels: number;
+}
+
+export interface VisualScreenshotPlan {
+  clipScale: number;
+}
+
+export function planVisualScreenshot(input: {
+  cssRect: { width: number; height: number };
+  rasterScaleEstimate: number;
+  budget: ScreenshotPixelBudget;
+}): VisualScreenshotPlan {
+  const rasterScale =
+    Number.isFinite(input.rasterScaleEstimate) && input.rasterScaleEstimate > 0
+      ? input.rasterScaleEstimate
+      : 1;
+  const { width, height } = input.cssRect;
+  const scale = Math.min(
+    1,
+    input.budget.maxEdge / (width * rasterScale),
+    input.budget.maxEdge / (height * rasterScale),
+    Math.sqrt(input.budget.maxPixels / (width * height * rasterScale * rasterScale)),
+  );
+  return { clipScale: Math.max(Number.EPSILON, scale) };
+}
+
+export function correctedVisualScreenshotScale(input: {
+  previousClipScale: number;
+  actualWidth: number;
+  actualHeight: number;
+  budget: ScreenshotPixelBudget;
+}): number | null {
+  const correction = Math.min(
+    input.budget.maxEdge / input.actualWidth,
+    input.budget.maxEdge / input.actualHeight,
+    Math.sqrt(input.budget.maxPixels / (input.actualWidth * input.actualHeight)),
+  );
+  if (!Number.isFinite(correction) || correction >= 1 || correction <= 0) return null;
+  return Math.max(Number.EPSILON, input.previousClipScale * correction * 0.999);
+}
+
+export function screenshotFitsPixelBudget(
+  dimensions: { width: number; height: number },
+  budget: ScreenshotPixelBudget,
+): boolean {
+  return (
+    Math.max(dimensions.width, dimensions.height) <= budget.maxEdge &&
+    dimensions.width * dimensions.height <= budget.maxPixels
+  );
+}

apps/extension/src/tools/vom/__tests__/capture.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it, vi } from "vitest";
 import { OVERLAY_HOST_MARKER_ATTR, OVERLAY_HOST_NAME } from "../../../lib/overlay-bridge";
-import { collectOverlayExcludedBackendIds, probeHoverSurfaces } from "../capture";
-import { captureObservationFacts, semanticCapture } from "../capture-coordinator";
+import { captureViewModel, collectOverlayExcludedBackendIds, probeHoverSurfaces } from "../capture";
+import { discoverRenderedSurfaces } from "../rendered-surfaces";
 
 // Minimal but format-accurate captureSnapshot reply: a body with one
 // fixed full-screen overlay div carrying a password input.
@@ -27,7 +27,6 @@ function fakeSnapshotReply() {
     strings: S,
     documents: [
       {
-        frameId: "root",
         nodes: {
           parentIndex: [-1, 0, 1, 2],
           nodeType: [1, 1, 1, 1],
@@ -75,7 +74,6 @@ function hoverTriggerSnapshotReply() {
     strings: S,
     documents: [
       {
-        frameId: "root",
         nodes: {
           parentIndex: [-1, 0, 1],
           nodeType: [1, 1, 1],
@@ -120,7 +118,6 @@ function twoHoverTriggerSnapshotReply() {
     strings: S,
     documents: [
       {
-        frameId: "root",
         nodes: {
           parentIndex: [-1, 0, 1, 1],
           nodeType: [1, 1, 1, 1],
@@ -174,7 +171,6 @@ function nestedHoverTriggerSnapshotReply() {
     strings: S,
     documents: [
       {
-        frameId: "root",
         nodes: {
           parentIndex: [-1, 0, 1, 2, 3],
           nodeType: [1, 1, 1, 1, 1],
@@ -215,11 +211,7 @@ function makeCdp(snapshot: unknown) {
       if (method === "DOMSnapshot.enable") return {};
       if (method === "DOMSnapshot.captureSnapshot") return snapshot;
       if (method === "Page.getLayoutMetrics") {
-        return {
-          visualViewport: { clientWidth: 1000 },
-          cssVisualViewport: { clientWidth: 1000 },
-          cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
-        };
+        return { cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 } };
       }
       if (method === "Runtime.evaluate") {
         return {
@@ -252,11 +244,13 @@ function makeCdp(snapshot: unknown) {
   };
 }
 
-describe("snapshot capture and hover", () => {
+describe("captureViewModel", () => {
   it("parses nodes, attrs, rects, paint order and styles", async () => {
-    const { nodes, viewport } = semanticCapture(
-      await captureObservationFacts(makeCdp(fakeSnapshotReply()), 4),
-    ).captured;
+    const { nodes, viewport, iframeNodes } = await captureViewModel(
+      makeCdp(fakeSnapshotReply()),
+      4,
+    );
+    expect(iframeNodes.size).toBe(0);
     expect(viewport).toEqual({ width: 1000, height: 800 });
     const div = nodes.find((n) => n.backendNodeId === 12);
     expect(div).toMatchObject({ tag: "div", position: "fixed", parentBackendNodeId: 11 });
@@ -268,11 +262,35 @@ describe("snapshot capture and hover", () => {
 
   it("never hovers the page while capturing", async () => {
     const cdp = makeCdp(fakeSnapshotReply());
-    semanticCapture(await captureObservationFacts(cdp, 4)).captured;
+    await captureViewModel(cdp, 4);
 
     expect(cdp.send).not.toHaveBeenCalledWith(4, "Input.dispatchMouseEvent", expect.anything());
   });
 
+  it("batch-enriches form controls without per-node object resolution", async () => {
+    const cdp = makeCdp(fakeSnapshotReply());
+    const result = await captureViewModel(cdp, 4);
+    const input = result.nodes.find((node) => node.backendNodeId === 13);
+
+    expect(input).toMatchObject({
+      formState: "filled",
+      formPlaceholder: "secret",
+      attrs: { type: "password" },
+    });
+    expect(input?.formValue).toBeUndefined();
+    expect(input?.formDefaultValue).toBeUndefined();
+    expect(cdp.send).toHaveBeenCalledWith(
+      4,
+      "Runtime.evaluate",
+      expect.objectContaining({
+        serializationOptions: expect.objectContaining({ serialization: "deep" }),
+      }),
+    );
+    expect(cdp.send).toHaveBeenCalledWith(4, "Runtime.releaseObjectGroup", expect.anything());
+    expect(cdp.send).not.toHaveBeenCalledWith(4, "DOM.resolveNode", expect.anything());
+    expect(cdp.send).not.toHaveBeenCalledWith(4, "Runtime.callFunctionOn", expect.anything());
+  });
+
   it("runs hover surface probes when explicitly enabled", async () => {
     let hoverStateCalls = 0;
     const cdp = {
@@ -281,8 +299,6 @@ describe("snapshot capture and hover", () => {
         if (method === "DOMSnapshot.captureSnapshot") return hoverTriggerSnapshotReply();
         if (method === "Page.getLayoutMetrics") {
           return {
-            visualViewport: { clientWidth: 1000 },
-            cssVisualViewport: { clientWidth: 1000 },
             cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
           };
         }
@@ -314,7 +330,7 @@ describe("snapshot capture and hover", () => {
       }) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
     };
 
-    const captured = semanticCapture(await captureObservationFacts(cdp, 4)).captured;
+    const captured = await captureViewModel(cdp, 4);
     const surfaceProbes = await probeHoverSurfaces(cdp, 4, captured.nodes);
 
     expect(surfaceProbes).toEqual([
@@ -346,8 +362,6 @@ describe("snapshot capture and hover", () => {
         if (method === "DOMSnapshot.captureSnapshot") return twoHoverTriggerSnapshotReply();
         if (method === "Page.getLayoutMetrics") {
           return {
-            visualViewport: { clientWidth: 1000 },
-            cssVisualViewport: { clientWidth: 1000 },
             cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
           };
         }
@@ -376,7 +390,7 @@ describe("snapshot capture and hover", () => {
       }) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
     };
 
-    const captured = semanticCapture(await captureObservationFacts(cdp, 4)).captured;
+    const captured = await captureViewModel(cdp, 4);
     const surfaceProbes = await probeHoverSurfaces(cdp, 4, captured.nodes);
 
     expect(surfaceProbes).toEqual([
@@ -396,8 +410,6 @@ describe("snapshot capture and hover", () => {
         if (method === "DOMSnapshot.captureSnapshot") return nestedHoverTriggerSnapshotReply();
         if (method === "Page.getLayoutMetrics") {
           return {
-            visualViewport: { clientWidth: 1000 },
-            cssVisualViewport: { clientWidth: 1000 },
             cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
           };
         }
@@ -423,7 +435,7 @@ describe("snapshot capture and hover", () => {
       }) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
     };
 
-    const captured = semanticCapture(await captureObservationFacts(cdp, 4)).captured;
+    const captured = await captureViewModel(cdp, 4);
     await probeHoverSurfaces(cdp, 4, captured.nodes);
 
     expect(hoverMoves).toBe(1);
@@ -455,7 +467,6 @@ describe("snapshot capture and hover", () => {
       strings: S,
       documents: [
         {
-          frameId: "root",
           nodes: {
             parentIndex: [-1, 0, 1, 0, 3, 4],
             nodeName: [i("html"), i("body"), i("div"), i(OVERLAY_HOST_NAME), i("div"), i("button")],
@@ -486,7 +497,7 @@ describe("snapshot capture and hover", () => {
       ],
     };
 
-    const { nodes } = semanticCapture(await captureObservationFacts(makeCdp(snapshot), 4)).captured;
+    const { nodes } = await captureViewModel(makeCdp(snapshot), 4);
     const ids = nodes.map((n) => n.backendNodeId);
     // Real page nodes survive.
     expect(ids).toContain(12);
@@ -517,7 +528,6 @@ describe("snapshot capture and hover", () => {
       strings: S,
       documents: [
         {
-          frameId: "root",
           nodes: {
             parentIndex: [-1, 0, 1, 0, 3, 4],
             nodeName: [i("html"), i("body"), i("div"), i(OVERLAY_HOST_NAME), i("div"), i("button")],
@@ -548,9 +558,7 @@ describe("snapshot capture and hover", () => {
       ],
     };
 
-    const { excludedBackendNodeIds } = semanticCapture(
-      await captureObservationFacts(makeCdp(snapshot), 4),
-    ).captured;
+    const { excludedBackendNodeIds } = await captureViewModel(makeCdp(snapshot), 4);
     expect(excludedBackendNodeIds).toEqual(new Set([13, 14, 15]));
   });
 
@@ -571,7 +579,6 @@ describe("snapshot capture and hover", () => {
       strings: S,
       documents: [
         {
-          frameId: "root",
           nodes: {
             parentIndex: [-1, 0, 1],
             nodeName: [i("html"), i("body"), i(OVERLAY_HOST_NAME)],
@@ -594,9 +601,7 @@ describe("snapshot capture and hover", () => {
       ],
     };
 
-    const { nodes, excludedBackendNodeIds } = semanticCapture(
-      await captureObservationFacts(makeCdp(snapshot), 4),
-    ).captured;
+    const { nodes, excludedBackendNodeIds } = await captureViewModel(makeCdp(snapshot), 4);
     expect(nodes.map((n) => n.backendNodeId)).not.toContain(13);
     expect(excludedBackendNodeIds).toEqual(new Set([13]));
   });
@@ -619,7 +624,6 @@ describe("snapshot capture and hover", () => {
       strings: S,
       documents: [
         {
-          frameId: "root",
           nodes: {
             parentIndex: [-1, 0, 1],
             nodeName: [i("html"), i("body"), i("div")],
@@ -642,9 +646,7 @@ describe("snapshot capture and hover", () => {
       ],
     };
 
-    const { nodes, excludedBackendNodeIds } = semanticCapture(
-      await captureObservationFacts(makeCdp(snapshot), 4),
-    ).captured;
+    const { nodes, excludedBackendNodeIds } = await captureViewModel(makeCdp(snapshot), 4);
     expect(nodes.map((n) => n.backendNodeId)).not.toContain(13);
     expect(excludedBackendNodeIds).toEqual(new Set([13]));
   });
@@ -667,7 +669,6 @@ describe("snapshot capture and hover", () => {
       strings: S,
       documents: [
         {
-          frameId: "root",
           nodes: {
             parentIndex: [-1, 0, 1],
             nodeName: [i("html"), i("body"), i("div")],
@@ -690,7 +691,7 @@ describe("snapshot capture and hover", () => {
         },
       ],
     };
-    const { nodes } = semanticCapture(await captureObservationFacts(makeCdp(snapshot), 4)).captured;
+    const { nodes } = await captureViewModel(makeCdp(snapshot), 4);
     expect(nodes.find((n) => n.backendNodeId === 12)?.cursor).toBe("pointer");
     expect(nodes.find((n) => n.backendNodeId === 11)?.cursor).toBe("auto");
   });
@@ -702,7 +703,6 @@ describe("snapshot capture and hover", () => {
       strings: S,
       documents: [
         {
-          frameId: "root",
           nodes: {
             parentIndex: [-1, 0, 1, 1, 1],
             nodeName: [i("html"), i("body"), i("button"), i("button"), i("button")],
@@ -729,13 +729,51 @@ describe("snapshot capture and hover", () => {
       ],
     };
 
-    const { nodes } = semanticCapture(await captureObservationFacts(makeCdp(snapshot), 4)).captured;
+    const { nodes } = await captureViewModel(makeCdp(snapshot), 4);
 
     expect(nodes.find((node) => node.backendNodeId === 12)?.rendered).toBe(true);
     expect(nodes.find((node) => node.backendNodeId === 13)?.rendered).toBe(false);
     expect(nodes.find((node) => node.backendNodeId === 14)?.rendered).toBe(false);
   });
 
+  it("propagates fully transparent ancestor suppression to painted descendants", async () => {
+    const S = ["html", "body", "div", "canvas", "static", "auto", "visible", "1", "0"];
+    const i = (value: string) => S.indexOf(value);
+    const snapshot = {
+      strings: S,
+      documents: [
+        {
+          nodes: {
+            parentIndex: [-1, 0, 1, 2],
+            nodeName: [i("html"), i("body"), i("div"), i("canvas")],
+            backendNodeId: [10, 11, 12, 13],
+            attributes: [[], [], [], []],
+          },
+          layout: {
+            nodeIndex: [1, 2, 3],
+            styles: [
+              [i("static"), i("auto"), i("auto"), i("visible"), i("1")],
+              [i("static"), i("auto"), i("auto"), i("visible"), i("0")],
+              [i("static"), i("auto"), i("auto"), i("visible"), i("1")],
+            ],
+            bounds: [
+              [0, 0, 1000, 800],
+              [10, 10, 200, 100],
+              [10, 10, 200, 100],
+            ],
+            paintOrders: [0, 1, 2],
+          },
+        },
+      ],
+    };
+
+    const { nodes } = await captureViewModel(makeCdp(snapshot), 4);
+    const canvas = nodes.find((node) => node.backendNodeId === 13);
+
+    expect(canvas?.rendered).toBe(true);
+    expect(canvas?.visuallySuppressed).toBe(true);
+  });
+
   it("subtracts scroll offset to make rects viewport-relative", async () => {
     const cdp = {
       send: vi.fn(async (_t: number, method: string) => {
@@ -743,28 +781,25 @@ describe("snapshot capture and hover", () => {
         if (method === "DOMSnapshot.captureSnapshot") return fakeSnapshotReply();
         if (method === "Page.getLayoutMetrics") {
           return {
-            visualViewport: { clientWidth: 1000 },
-            cssVisualViewport: { clientWidth: 1000 },
             cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 200 },
           };
         }
         throw new Error(method);
       }) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
     };
-    const { nodes } = semanticCapture(await captureObservationFacts(cdp, 4)).captured;
+    const { nodes } = await captureViewModel(cdp, 4);
     const div = nodes.find((n) => n.backendNodeId === 12);
     expect(div?.localRect?.y).toBe(-200);
     expect(div?.rect).toMatchObject({ y: 0, h: 600 });
   });
 
-  it("normalizes raw snapshot bounds before viewport clipping", async () => {
+  it("normalizes device-pixel bounds by devicePixelRatio", async () => {
     const S = ["html", "body", "div", "position", "fixed", "static", "pointer-events", "auto"];
     const i = (s: string) => S.indexOf(s);
     const snapshot = {
       strings: S,
       documents: [
         {
-          frameId: "root",
           nodes: {
             parentIndex: [-1, 0, 1],
             nodeName: [i("html"), i("body"), i("div")],
@@ -792,8 +827,6 @@ describe("snapshot capture and hover", () => {
         if (method === "DOMSnapshot.captureSnapshot") return snapshot;
         if (method === "Page.getLayoutMetrics") {
           return {
-            visualViewport: { clientWidth: 2000 },
-            cssVisualViewport: { clientWidth: 1000 },
             cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
             layoutViewport: { clientWidth: 2000, clientHeight: 1600 },
           };
@@ -801,19 +834,13 @@ describe("snapshot capture and hover", () => {
         throw new Error(method);
       }) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
     };
-    const { nodes } = semanticCapture(await captureObservationFacts(cdp, 4)).captured;
+    const { nodes } = await captureViewModel(cdp, 4);
     expect(nodes.find((n) => n.backendNodeId === 12)?.rect).toEqual({
       x: 0,
       y: 0,
       w: 1000,
       h: 800,
     });
-    expect(nodes.find((n) => n.backendNodeId === 12)?.localRect).toEqual({
-      x: 0,
-      y: 0,
-      w: 1000,
-      h: 800,
-    });
   });
 
   it("extracts textContent from #text child nodes via nodeValue", async () => {
@@ -837,7 +864,6 @@ describe("snapshot capture and hover", () => {
       strings: S,
       documents: [
         {
-          frameId: "root",
           scrollOffsetX: 0,
           scrollOffsetY: 0,
           nodes: {
@@ -870,15 +896,13 @@ describe("snapshot capture and hover", () => {
         if (method === "DOMSnapshot.captureSnapshot") return snapshot;
         if (method === "Page.getLayoutMetrics") {
           return {
-            visualViewport: { clientWidth: 1000 },
-            cssVisualViewport: { clientWidth: 1000 },
             cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
           };
         }
         throw new Error(method);
       }) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
     };
-    const { nodes } = semanticCapture(await captureObservationFacts(cdp, 4)).captured;
+    const { nodes } = await captureViewModel(cdp, 4);
     const btn = nodes.find((n) => n.backendNodeId === 12);
     expect(btn?.textContent).toBe("登录");
     const link = nodes.find((n) => n.backendNodeId === 14);
@@ -888,7 +912,7 @@ describe("snapshot capture and hover", () => {
     expect(body?.textContent).toBeUndefined();
   });
 
-  it("retains explicit iframe document ownership and projected nodes", async () => {
+  it("parses iframe sub-documents and returns iframeNodes keyed by iframe backendNodeId", async () => {
     const S = [
       "html",
       "body",
@@ -962,38 +986,39 @@ describe("snapshot capture and hover", () => {
         if (method === "DOMSnapshot.captureSnapshot") return snapshot;
         if (method === "Page.getLayoutMetrics") {
           return {
-            visualViewport: { clientWidth: 1000 },
-            cssVisualViewport: { clientWidth: 1000 },
             cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
           };
         }
-        if (method === "DOM.getBoxModel")
-          return { model: { content: [100, 300, 900, 300, 900, 700, 100, 700] } };
-        if (method === "DOM.resolveNode") return { object: { objectId: "owner" } };
-        if (method === "Runtime.callFunctionOn")
-          return { result: { value: { width: 800, height: 400 } } };
-        if (method === "Runtime.releaseObject") return {};
         throw new Error(method);
       }) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
     };
-    const facts = await captureObservationFacts(cdp, 4);
-    const root = facts.documents.find((doc) => doc.frame.frameId === "main-frame")!;
-    const child = facts.documents.find((doc) => doc.frame.frameId === "child-frame")!;
-    expect(facts.documents).toHaveLength(2);
-    expect(root.domNodes.find((n) => n.backendNodeId === 13)?.tag).toBe("iframe");
-    const subNodes = child.domNodes;
+    const {
+      nodes,
+      iframeNodes,
+      frameNodes,
+      frameOwnerBackendNodeIds,
+      frameParentIds,
+      rootFrameId,
+    } = await captureViewModel(cdp, 4);
+    // Main frame has 4 nodes; iframe is included
+    expect(nodes.find((n) => n.backendNodeId === 13)?.tag).toBe("iframe");
+    // iframeNodes keyed by the <iframe> element's backendNodeId=13
+    expect(iframeNodes.size).toBe(1);
+    expect(iframeNodes.has(13)).toBe(true);
+    const subNodes = iframeNodes.get(13)!;
     const input = subNodes.find((n) => n.backendNodeId === 101);
     expect(input?.tag).toBe("input");
     expect(input?.attrs.type).toBe("text");
     expect(input?.ownerFrameBackendNodeId).toBe(13);
     expect(input?.localRect).toEqual({ x: 0, y: 0, w: 200, h: 40 });
-    expect(input?.rect).toEqual({ x: 100, y: 300, w: 200, h: 40 });
-    expect(facts.rootFrameId).toBe("main-frame");
-    expect(child.frame.ownerBackendNodeId).toBe(13);
-    expect(child.frame.parentFrameId).toBe("main-frame");
+    expect(input?.rect).toBeNull();
+    expect(rootFrameId).toBe("main-frame");
+    expect(frameNodes?.get("child-frame")).toBe(subNodes);
+    expect(frameOwnerBackendNodeIds?.get("child-frame")).toBe(13);
+    expect(frameParentIds?.get("child-frame")).toBe("main-frame");
   });
 
-  it("projects iframe documents independently of owner snapshot geometry", async () => {
+  it("captures iframe documents without requiring owner-frame geometry", async () => {
     const S = [
       "html",
       "body",
@@ -1011,7 +1036,6 @@ describe("snapshot capture and hover", () => {
       strings: S,
       documents: [
         {
-          frameId: "root",
           scrollOffsetX: 0,
           scrollOffsetY: 0,
           nodes: {
@@ -1029,7 +1053,6 @@ describe("snapshot capture and hover", () => {
           },
         },
         {
-          frameId: "child",
           scrollOffsetX: 0,
           scrollOffsetY: 0,
           nodes: {
@@ -1053,28 +1076,18 @@ describe("snapshot capture and hover", () => {
         if (method === "DOMSnapshot.captureSnapshot") return snapshot;
         if (method === "Page.getLayoutMetrics") {
           return {
-            visualViewport: { clientWidth: 1000 },
-            cssVisualViewport: { clientWidth: 1000 },
             cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
           };
         }
-        if (method === "DOM.getBoxModel")
-          return { model: { content: [100, 300, 900, 300, 900, 700, 100, 700] } };
-        if (method === "DOM.resolveNode") return { object: { objectId: "owner" } };
-        if (method === "Runtime.callFunctionOn")
-          return { result: { value: { width: 800, height: 400 } } };
-        if (method === "Runtime.releaseObject") return {};
         throw new Error(method);
       }) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
     };
 
-    const { documents } = await captureObservationFacts(cdp, 4);
-    const input = documents
-      .find((doc) => doc.frame.frameId === "child")
-      ?.domNodes?.find((n) => n.backendNodeId === 101);
+    const { iframeNodes } = await captureViewModel(cdp, 4);
+    const input = iframeNodes.get(13)?.find((n) => n.backendNodeId === 101);
 
     expect(input?.localRect).toEqual({ x: 20, y: 20, w: 120, h: 60 });
-    expect(input?.rect).toEqual({ x: 120, y: 320, w: 120, h: 60 });
+    expect(input?.rect).toBeNull();
   });
 
   it("recursively normalizes nested iframe sub-documents", async () => {
@@ -1095,7 +1108,6 @@ describe("snapshot capture and hover", () => {
       strings: S,
       documents: [
         {
-          frameId: "root",
           nodes: {
             parentIndex: [-1, 0, 1],
             nodeName: [i("html"), i("body"), i("iframe")],
@@ -1117,9 +1129,6 @@ describe("snapshot capture and hover", () => {
           },
         },
         {
-          scrollOffsetX: 0,
-          scrollOffsetY: 0,
-          frameId: "child",
           nodes: {
             parentIndex: [-1, 0, 1],
             nodeName: [i("html"), i("body"), i("iframe")],
@@ -1141,9 +1150,6 @@ describe("snapshot capture and hover", () => {
           },
         },
         {
-          scrollOffsetX: 0,
-          scrollOffsetY: 0,
-          frameId: "nested",
           nodes: {
             parentIndex: [-1, 0],
             nodeName: [i("body"), i("input")],
@@ -1160,70 +1166,121 @@ describe("snapshot capture and hover", () => {
       ],
     };
     const cdp = {
-      send: vi.fn(
-        async (
-          _t: number,
-          method: string,
-          params?: { backendNodeId?: number; objectId?: string },
-        ) => {
+      send: vi.fn(async (_t: number, method: string) => {
+        if (method === "DOMSnapshot.enable") return {};
+        if (method === "DOMSnapshot.captureSnapshot") return snapshot;
+        if (method === "Page.getLayoutMetrics") {
+          return {
+            cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
+          };
+        }
+        throw new Error(method);
+      }) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
+    };
+
+    const { iframeNodes } = await captureViewModel(cdp, 4);
+    const nestedIframe = iframeNodes.get(13)?.find((n) => n.backendNodeId === 23);
+    const input = iframeNodes.get(23)?.find((n) => n.backendNodeId === 31);
+
+    expect(nestedIframe?.localRect).toEqual({ x: 5, y: 6, w: 100, h: 80 });
+    expect(nestedIframe?.rect).toBeNull();
+    expect(input?.ownerFrameBackendNodeId).toBe(23);
+    expect(input?.localRect).toEqual({ x: 1, y: 2, w: 40, h: 20 });
+    expect(input?.rect).toBeNull();
+  });
+
+  it("keeps same-origin iframe canvas frame-local until frame geometry is resolved", async () => {
+    const captureAtDpr = async (dpr: number) => {
+      const S = ["html", "body", "iframe", "canvas", "static", "auto"];
+      const i = (s: string) => S.indexOf(s);
+      const scale = (values: number[]) => values.map((value) => value * dpr);
+      const snapshot = {
+        strings: S,
+        documents: [
+          {
+            frameId: "main",
+            nodes: {
+              parentIndex: [-1, 0, 1],
+              nodeName: [i("html"), i("body"), i("iframe")],
+              backendNodeId: [10, 11, 13],
+              attributes: [[], [], []],
+              contentDocumentIndex: { index: [2], value: [1] },
+            },
+            layout: {
+              nodeIndex: [1, 2],
+              styles: [
+                [i("static"), i("auto")],
+                [i("static"), i("auto")],
+              ],
+              bounds: [scale([0, 0, 1000, 800]), scale([100, 150, 300, 200])],
+              paintOrders: [0, 1],
+            },
+          },
+          {
+            frameId: "child",
+            nodes: {
+              parentIndex: [-1, 0],
+              nodeName: [i("body"), i("canvas")],
+              backendNodeId: [20, 21],
+              attributes: [[], []],
+            },
+            layout: {
+              nodeIndex: [0, 1],
+              styles: [
+                [i("static"), i("auto")],
+                [i("static"), i("auto")],
+              ],
+              bounds: [scale([0, 0, 300, 200]), scale([20, 30, 120, 60])],
+              paintOrders: [0, 1],
+            },
+          },
+        ],
+      };
+      const cdp = {
+        send: vi.fn(async (_tabId: number, method: string) => {
           if (method === "DOMSnapshot.enable") return {};
           if (method === "DOMSnapshot.captureSnapshot") return snapshot;
           if (method === "Page.getLayoutMetrics") {
             return {
-              visualViewport: { clientWidth: 1000 },
-              cssVisualViewport: { clientWidth: 1000 },
               cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 0 },
+              layoutViewport: { clientWidth: 1000 * dpr, clientHeight: 800 * dpr },
             };
           }
-          if (method === "DOM.getBoxModel")
-            return {
-              model: {
-                content:
-                  params?.backendNodeId === 13
-                    ? [10, 20, 310, 20, 310, 220, 10, 220]
-                    : [15, 26, 115, 26, 115, 106, 15, 106],
-              },
-            };
-          if (method === "DOM.resolveNode")
-            return { object: { objectId: String(params?.backendNodeId) } };
-          if (method === "Runtime.callFunctionOn")
-            return {
-              result: {
-                value:
-                  params?.objectId === "13"
-                    ? { width: 300, height: 200 }
-                    : { width: 100, height: 80 },
-              },
-            };
-          if (method === "Runtime.releaseObject") return {};
           throw new Error(method);
-        },
-      ) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
+        }) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
+      };
+      const captured = await captureViewModel(cdp, 4);
+      const childNodes = captured.frameNodes?.get("child") ?? [];
+      return discoverRenderedSurfaces(
+        [
+          {
+            frameId: "child",
+            contextScopeId: "child",
+            parentFrameId: "main",
+            ownerBackendNodeId: 13,
+            target: { tabId: 4 },
+            domNodes: childNodes,
+            axNodes: [],
+          },
+        ],
+        captured.viewport,
+      );
     };
 
-    const { documents } = await captureObservationFacts(cdp, 4);
-    const nestedIframe = documents
-      .find((doc) => doc.frame.frameId === "child")
-      ?.domNodes?.find((n) => n.backendNodeId === 23);
-    const input = documents
-      .find((doc) => doc.frame.frameId === "nested")
-      ?.domNodes?.find((n) => n.backendNodeId === 31);
+    const atDpr1 = await captureAtDpr(1);
+    const atDpr2 = await captureAtDpr(2);
 
-    expect(nestedIframe?.localRect).toEqual({ x: 5, y: 6, w: 100, h: 80 });
-    expect(nestedIframe?.rect).toEqual({ x: 15, y: 26, w: 100, h: 80 });
-    expect(input?.ownerFrameBackendNodeId).toBe(23);
-    expect(input?.localRect).toEqual({ x: 1, y: 2, w: 40, h: 20 });
-    expect(input?.rect).toEqual({ x: 16, y: 28, w: 40, h: 20 });
+    expect(atDpr1).toEqual([]);
+    expect(atDpr2).toEqual(atDpr1);
   });
 
-  it("subtracts CSS scroll once without dividing snapshot bounds by a metrics ratio", async () => {
+  it("normalizes bounds then subtracts CSS scroll at dpr>1", async () => {
     const S = ["html", "body", "div", "position", "fixed", "static", "pointer-events", "auto"];
     const i = (s: string) => S.indexOf(s);
     const snapshot = {
       strings: S,
       documents: [
         {
-          frameId: "root",
           nodes: {
             parentIndex: [-1, 0, 1],
             nodeName: [i("html"), i("body"), i("div")],
@@ -1251,8 +1308,6 @@ describe("snapshot capture and hover", () => {
         if (method === "DOMSnapshot.captureSnapshot") return snapshot;
         if (method === "Page.getLayoutMetrics") {
           return {
-            visualViewport: { clientWidth: 2000 },
-            cssVisualViewport: { clientWidth: 1000 },
             cssLayoutViewport: { clientWidth: 1000, clientHeight: 800, pageX: 0, pageY: 100 },
             layoutViewport: { clientWidth: 2000, clientHeight: 1600 },
           };
@@ -1260,7 +1315,7 @@ describe("snapshot capture and hover", () => {
         throw new Error(method);
       }) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
     };
-    const { nodes } = semanticCapture(await captureObservationFacts(cdp, 4)).captured;
+    const { nodes } = await captureViewModel(cdp, 4);
     expect(nodes.find((n) => n.backendNodeId === 12)?.rect?.y).toBe(400 / 2 - 100);
   });
 

apps/extension/src/tools/vom/__tests__/facts.test.ts

@@ -1,127 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import { OVERLAY_HOST_MARKER_ATTR } from "@/lib/overlay-bridge";
-import { createCaptureCheckpoint } from "../capture-abort";
-import { buildDocumentIndex, type DecodedNode } from "../facts";
-import { decodeDocument, REQUESTED_STYLES } from "../snapshot";
-
-function node(id: number, parent: number | null): DecodedNode {
-  return {
-    backendNodeId: id,
-    parentBackendNodeId: parent,
-    tag: "div",
-    attrs: {},
-    paintOrder: 0,
-    position: "static",
-    pointerEvents: "auto",
-  };
-}
-
-describe("document facts", () => {
-  it.each([
-    1_000, 10_000, 100_000,
-  ])("indexes deep and wide inputs of %i without copying ancestors", async (count) => {
-    for (const wide of [false, true]) {
-      let reads = 0;
-      const input = Array.from({ length: count }, (_, i) => {
-        const item = node(i, i ? (wide ? 0 : i - 1) : null);
-        if (i === 0) item.attrs[OVERLAY_HOST_MARKER_ATTR] = "";
-        Object.defineProperty(item, "parentBackendNodeId", {
-          get: () => {
-            reads++;
-            return i ? (wide ? 0 : i - 1) : null;
-          },
-        });
-        return item;
-      }).reverse(); // parent need not precede child
-      const index = await buildDocumentIndex(input);
-      expect(index.nodes.size).toBe(count);
-      expect(index.excludedBackendNodeIds.size).toBe(count);
-      expect(reads).toBeLessThanOrEqual(count * 8);
-      expect(index.nodes.get(count - 1)).toBe(input[0]);
-    }
-  });
-
-  it("handles cycles and orphans and propagates overlay through shadow roots", async () => {
-    const host = { ...node(1, null), attrs: { [OVERLAY_HOST_MARKER_ATTR]: "" } };
-    const input = [
-      node(3, 2),
-      { ...node(2, 1), tag: "#document-fragment" },
-      host,
-      node(4, 99),
-      node(5, 6),
-      node(6, 5),
-      node(7, 6),
-    ];
-    const index = await buildDocumentIndex(input);
-    expect([...index.excludedBackendNodeIds].sort()).toEqual([1, 2, 3]);
-    expect(index.nodes.size).toBe(input.length);
-  });
-
-  it("does not propagate a descendant overlay backwards into a cycle", async () => {
-    const overlay = { ...node(3, 1), attrs: { [OVERLAY_HOST_MARKER_ATTR]: "" } };
-    const index = await buildDocumentIndex([overlay, node(1, 2), node(2, 1)]);
-    expect([...index.excludedBackendNodeIds]).toEqual([3]);
-  });
-
-  it("decodes current observation bounds, styles and attributes without projecting coordinates", async () => {
-    const strings = ["div", "aria-hidden", "true", "inert", "", "visible", "0", "static", "auto"];
-    const styles = REQUESTED_STYLES.map((style) =>
-      style === "visibility" ? 5 : style === "opacity" ? 6 : style === "position" ? 7 : 8,
-    );
-    const { nodes } = await decodeDocument(
-      {
-        nodes: { backendNodeId: [1], parentIndex: [-1], nodeName: [0], attributes: [[1, 2, 3, 4]] },
-        layout: { nodeIndex: [0], bounds: [[10, 20, 120, 40]], styles: [styles] },
-      },
-      strings,
-    );
-    expect(nodes[0].attrs).toEqual({ "aria-hidden": "true", inert: "" });
-    expect(nodes[0].layout).toEqual({
-      boundsSpace: "snapshot-document-layout",
-      bounds: [10, 20, 120, 40],
-      styles: {
-        position: "static",
-        "pointer-events": "auto",
-        cursor: "auto",
-        visibility: "visible",
-        opacity: "0",
-      },
-    });
-    expect(nodes[0]).not.toHaveProperty("rect");
-    expect(nodes[0]).not.toHaveProperty("excluded");
-  });
-
-  it("keeps short blocks synchronous and checks cancellation after yielding", async () => {
-    const clock = vi.spyOn(performance, "now").mockReturnValue(0);
-    try {
-      const controller = new AbortController();
-      const checkpoint = createCaptureCheckpoint(controller.signal);
-      for (let i = 0; i < 20; i++) expect(checkpoint()).toBeUndefined();
-      clock.mockReturnValue(9);
-      const pending = checkpoint();
-      expect(pending).toBeInstanceOf(Promise);
-      controller.abort();
-      await expect(pending).rejects.toMatchObject({ name: "AbortError" });
-    } finally {
-      clock.mockRestore();
-    }
-  });
-
-  it("checks cancellation at bounded indexing blocks", async () => {
-    const controller = new AbortController();
-    const input = Array.from({ length: 100_000 }, (_, i) => node(i, i ? i - 1 : null));
-    let reads = 0;
-    for (const item of input)
-      Object.defineProperty(item, "attrs", {
-        get: () => {
-          reads++;
-          if (reads === 100) controller.abort();
-          return {};
-        },
-      });
-    await expect(buildDocumentIndex(input, controller.signal)).rejects.toMatchObject({
-      name: "AbortError",
-    });
-    expect(reads).toBeLessThanOrEqual(356);
-  });
-});

apps/extension/src/tools/vom/__tests__/form-state.test.ts

@@ -1,7 +1,6 @@
 import { describe, expect, it, vi } from "vitest";
 import { type CdpRunner, cdpRunnerForTarget } from "../../shared";
-import { enrichFormControlStates } from "../form-capture";
-import { decodeDocument } from "../snapshot";
+import { captureViewModel } from "../capture";
 
 interface Control {
   id: number;
@@ -78,32 +77,21 @@ function reply(entries: Array<[number, unknown]>) {
   };
 }
 
-async function fakeCdp(
-  groups: Control[][],
-  evaluate: (params: Record<string, unknown>) => unknown,
-) {
+function fakeCdp(groups: Control[][], evaluate: (params: Record<string, unknown>) => unknown) {
   const snap = snapshot(groups);
   const send = vi.fn(async (_tabId: number, method: string, params?: object) => {
+    if (method === "DOMSnapshot.captureSnapshot") return snap;
     if (method === "Runtime.evaluate") return evaluate(params as Record<string, unknown>);
     return {};
   });
-  const nodes = await decodeControls(snap);
-  return { send, cdp: { send: send as CdpRunner["send"] }, nodes };
-}
-
-async function decodeControls(snap: ReturnType<typeof snapshot>) {
-  return Promise.all(
-    snap.documents.map(async (doc) =>
-      (await decodeDocument(doc, snap.strings)).nodes.map((node) => ({ ...node, rect: null })),
-    ),
-  );
+  return { send, cdp: { send: send as CdpRunner["send"] } };
 }
 
 describe("form state identity", () => {
   it("matches reordered controls by identity and preserves controls missing from the batch", async () => {
     // The snapshot includes a shadow input. The runtime query skips it,
     // encounters a new input, and sees the remaining inputs in a new order.
-    const { cdp, nodes } = await fakeCdp(
+    const { cdp } = fakeCdp(
       [
         [
           { id: 10, value: "" },
@@ -118,21 +106,21 @@ describe("form state identity", () => {
           [11, state("alice@example.com")],
         ]),
     );
-    await enrichFormControlStates(cdp, 7, nodes);
-    expect(nodes[0].find((n) => n.backendNodeId === 10)).toMatchObject({
+    const captured = await captureViewModel(cdp, 7);
+    expect(captured.nodes.find((n) => n.backendNodeId === 10)).toMatchObject({
       formValue: "",
       formState: "empty",
       formPlaceholder: "snapshot placeholder",
     });
-    expect(nodes[0].find((n) => n.backendNodeId === 11)).toMatchObject({
+    expect(captured.nodes.find((n) => n.backendNodeId === 11)).toMatchObject({
       formValue: "alice@example.com",
     });
-    expect(nodes[0].find((n) => n.backendNodeId === 12)).toMatchObject({ formValue: "上海" });
-    expect(nodes[0].some((n) => n.backendNodeId === 99)).toBe(false);
+    expect(captured.nodes.find((n) => n.backendNodeId === 12)).toMatchObject({ formValue: "上海" });
+    expect(captured.nodes.some((n) => n.backendNodeId === 99)).toBe(false);
   });
 
   it("does not shift state between frames when one frame is absent from the runtime batch", async () => {
-    const { cdp, nodes } = await fakeCdp(
+    const { cdp } = fakeCdp(
       [
         [],
         [{ id: 11, value: "inaccessible frame" }],
@@ -145,8 +133,8 @@ describe("form state identity", () => {
           [21, state("second frame")],
         ]),
     );
-    await enrichFormControlStates(cdp, 7, nodes);
-    const controls = nodes.slice(1).flat();
+    const captured = await captureViewModel(cdp, 7);
+    const controls = [...captured.iframeNodes.values()].flat();
     expect(controls.find((n) => n.backendNodeId === 11)?.formValue).toBe("inaccessible frame");
     expect(controls.find((n) => n.backendNodeId === 21)?.formValue).toBe("second frame");
     expect(controls.find((n) => n.backendNodeId === 31)?.formValue).toBe("third frame");
@@ -154,6 +142,7 @@ describe("form state identity", () => {
 
   it("keeps identical backend ids in different OOPIF targets separate", async () => {
     const sendToTarget = vi.fn(async (target, method) => {
+      if (method === "DOMSnapshot.captureSnapshot") return snapshot([[{ id: 11, value: "old" }]]);
       if (method === "Runtime.evaluate") return reply([[11, state(target.sessionId)]]);
       return {};
     });
@@ -162,9 +151,8 @@ describe("form state identity", () => {
     });
     const cdp = { send, sendToTarget } as unknown as CdpRunner;
     for (const sessionId of ["left-frame", "right-frame"]) {
-      const nodes = await decodeControls(snapshot([[{ id: 11, value: "old" }]]));
-      await enrichFormControlStates(cdpRunnerForTarget(cdp, { tabId: 7, sessionId }), 7, nodes);
-      expect(nodes[0].find((n) => n.backendNodeId === 11)?.formValue).toBe(sessionId);
+      const captured = await captureViewModel(cdpRunnerForTarget(cdp, { tabId: 7, sessionId }), 7);
+      expect(captured.nodes.find((n) => n.backendNodeId === 11)?.formValue).toBe(sessionId);
       expect(sendToTarget).toHaveBeenCalledWith(
         { tabId: 7, sessionId },
         "Runtime.releaseObjectGroup",
@@ -180,7 +168,7 @@ describe("form state identity", () => {
     "malformed",
     "invalid-state",
   ])("preserves snapshot data when enrichment is %s", async (mode) => {
-    const { cdp, send, nodes } = await fakeCdp([[{ id: 11, value: "snapshot value" }]], () => {
+    const { cdp, send } = fakeCdp([[{ id: 11, value: "snapshot value" }]], () => {
       if (mode === "unsupported") throw new Error("serialization unsupported");
       if (mode === "legacy") return { result: { value: { controls: [state("wrong value")] } } };
       const result = reply([
@@ -190,8 +178,8 @@ describe("form state identity", () => {
         result.result.deepSerializedValue.value[0].value[1].value = "not json";
       return result;
     });
-    expect(await enrichFormControlStates(cdp, 7, nodes)).toBe(mode !== "unsupported");
-    expect(nodes[0].find((n) => n.backendNodeId === 11)).toMatchObject({
+    const captured = await captureViewModel(cdp, 7);
+    expect(captured.nodes.find((n) => n.backendNodeId === 11)).toMatchObject({
       formValue: "snapshot value",
       formPlaceholder: "snapshot placeholder",
     });
@@ -200,34 +188,18 @@ describe("form state identity", () => {
 
   it("releases the batch's remote objects when capture is cancelled", async () => {
     const controller = new AbortController();
-    const { cdp, send, nodes } = await fakeCdp([[{ id: 11, value: "old" }]], () => {
+    const { cdp, send } = fakeCdp([[{ id: 11, value: "old" }]], () => {
       controller.abort();
       return reply([[11, state("new")]]);
     });
-    await expect(enrichFormControlStates(cdp, 7, nodes, controller.signal)).rejects.toMatchObject({
+    await expect(captureViewModel(cdp, 7, { signal: controller.signal })).rejects.toMatchObject({
       name: "AbortError",
     });
     expect(send).toHaveBeenCalledWith(7, "Runtime.releaseObjectGroup", expect.anything());
   });
 
-  it("does not report success when cancelled during object cleanup", async () => {
-    const controller = new AbortController();
-    const nodes = await decodeControls(snapshot([[{ id: 11, value: "old" }]]));
-    const cdp: CdpRunner = {
-      send: vi.fn(async (_tabId, method) => {
-        if (method === "Runtime.evaluate") return reply([[11, state("new")]]);
-        if (method === "Runtime.releaseObjectGroup") controller.abort();
-        return {};
-      }) as CdpRunner["send"],
-    };
-    await expect(enrichFormControlStates(cdp, 7, nodes, controller.signal)).rejects.toMatchObject({
-      name: "AbortError",
-    });
-    expect(cdp.send).toHaveBeenCalledWith(7, "Runtime.releaseObjectGroup", expect.anything());
-  });
-
   it("skips entries without node identity while still applying valid entries", async () => {
-    const { cdp, nodes } = await fakeCdp(
+    const { cdp } = fakeCdp(
       [
         [
           { id: 11, value: "snapshot value" },
@@ -244,20 +216,20 @@ describe("form state identity", () => {
         return result;
       },
     );
-    await enrichFormControlStates(cdp, 7, nodes);
-    expect(nodes[0].find((n) => n.backendNodeId === 11)?.formValue).toBe("snapshot value");
-    expect(nodes[0].find((n) => n.backendNodeId === 12)?.formValue).toBe("live value");
+    const captured = await captureViewModel(cdp, 7);
+    expect(captured.nodes.find((n) => n.backendNodeId === 11)?.formValue).toBe("snapshot value");
+    expect(captured.nodes.find((n) => n.backendNodeId === 12)?.formValue).toBe("live value");
   });
 
   it.each([
     "password",
     "text",
   ])("redacts a sensitive %s control after identity matching", async (type) => {
-    const { cdp, nodes } = await fakeCdp([[{ id: 11, value: "secret", type }]], () =>
+    const { cdp } = fakeCdp([[{ id: 11, value: "secret", type }]], () =>
       reply([[11, { ...state("secret"), sensitive: true }]]),
     );
-    await enrichFormControlStates(cdp, 7, nodes);
-    const control = nodes[0].find((n) => n.backendNodeId === 11);
+    const captured = await captureViewModel(cdp, 7);
+    const control = captured.nodes.find((n) => n.backendNodeId === 11);
     expect(control?.formState).toBe("filled");
     expect(control?.formValue).toBeUndefined();
     expect(control?.formDefaultValue).toBeUndefined();
@@ -274,7 +246,7 @@ describe("form state identity", () => {
       defaultValue: "",
       placeholder: "",
     }));
-    const { cdp, send, nodes } = await fakeCdp([controls], (params) => {
+    const { cdp, send } = fakeCdp([controls], (params) => {
       const doc = {
         querySelectorAll: (selector: string) =>
           selector === "input,textarea,select" ? elements : [],
@@ -285,9 +257,9 @@ describe("form state identity", () => {
       expect(entries).toHaveLength(250);
       return reply(entries.map(([element, json]) => [element.backendNodeId, JSON.parse(json)]));
     });
-    await enrichFormControlStates(cdp, 7, nodes);
-    expect(nodes[0].find((n) => n.backendNodeId === 250)?.formValue).toBe("live 250");
-    expect(nodes[0].find((n) => n.backendNodeId === 251)?.formValue).toBe("old");
+    const captured = await captureViewModel(cdp, 7);
+    expect(captured.nodes.find((n) => n.backendNodeId === 250)?.formValue).toBe("live 250");
+    expect(captured.nodes.find((n) => n.backendNodeId === 251)?.formValue).toBe("old");
     expect(send.mock.calls.filter(([, method]) => method === "Runtime.evaluate")).toHaveLength(1);
     expect(
       send.mock.calls.filter(([, method]) => method === "Runtime.releaseObjectGroup"),

apps/extension/src/tools/vom/__tests__/frame-capture.test.ts

@@ -0,0 +1,378 @@
+import { describe, expect, it, vi } from "vitest";
+import type { CdpRunner } from "../../shared";
+import type { CapturedNode, CapturedViewModel } from "../capture";
+import { captureFrameData } from "../frame-capture";
+
+function ownerNode(backendNodeId: number, x: number): CapturedNode {
+  return {
+    backendNodeId,
+    parentBackendNodeId: 1,
+    frameId: "main",
+    ownerFrameBackendNodeId: null,
+    tag: "iframe",
+    attrs: {},
+    rect: { x, y: 100, w: 300, h: 200 },
+    localRect: { x, y: 100, w: 300, h: 200 },
+    paintOrder: 1,
+    position: "static",
+    pointerEvents: "auto",
+  };
+}
+
+function childSnapshot(frameId: string, backendNodeId: number) {
+  const strings = [frameId, "body", "button", "static", "auto", "pointer"];
+  return {
+    strings,
+    documents: [
+      {
+        frameId,
+        nodes: {
+          parentIndex: [-1, 0],
+          nodeName: [1, 2],
+          backendNodeId: [backendNodeId - 1, backendNodeId],
+          attributes: [[], []],
+        },
+        layout: {
+          nodeIndex: [0, 1],
+          styles: [
+            [3, 4, 4],
+            [3, 4, 5],
+          ],
+          bounds: [
+            [0, 0, 300, 200],
+            [10, 20, 100, 40],
+          ],
+          paintOrders: [0, 1],
+        },
+      },
+    ],
+  };
+}
+
+describe("captureFrameData", () => {
+  it("does not request frame geometry for a root-only page", async () => {
+    const root = { ...ownerNode(1, 0), tag: "body" };
+    const captured: CapturedViewModel = {
+      nodes: [root],
+      viewport: { width: 1000, height: 800 },
+      iframeNodes: new Map(),
+      frameNodes: new Map([["main", [root]]]),
+      rootFrameId: "main",
+      excludedBackendNodeIds: new Set(),
+    };
+    const send = vi.fn(async (_tabId, method) => {
+      if (method === "Accessibility.enable") return {};
+      if (method === "Accessibility.getFullAXTree") return { nodes: [] };
+      throw new Error(`unexpected ${method}`);
+    });
+    const cdp: CdpRunner = {
+      send: send as CdpRunner["send"],
+      getFrameGraph: vi.fn(async () => ({
+        rootFrameId: "main",
+        frames: [{ frameId: "main", target: { tabId: 4 } }],
+      })),
+    };
+
+    await captureFrameData(cdp, 4, captured);
+
+    expect(send.mock.calls.some(([, method]) => method === "Page.createIsolatedWorld")).toBe(false);
+    expect(send.mock.calls.some(([, method]) => method === "DOM.getBoxModel")).toBe(false);
+    expect(send.mock.calls.some(([, method]) => method === "Page.getLayoutMetrics")).toBe(false);
+  });
+
+  it("projects same-origin frame-local rects through the iframe content box", async () => {
+    const owner = ownerNode(10, 50);
+    const canvas: CapturedNode = {
+      backendNodeId: 101,
+      parentBackendNodeId: 100,
+      frameId: "child",
+      ownerFrameBackendNodeId: 10,
+      tag: "canvas",
+      attrs: {},
+      rect: null,
+      localRect: { x: 12, y: 12, w: 224, h: 94 },
+      paintOrder: 1,
+      position: "static",
+      pointerEvents: "auto",
+    };
+    const captured: CapturedViewModel = {
+      nodes: [owner],
+      viewport: { width: 1000, height: 800 },
+      iframeNodes: new Map([[10, [canvas]]]),
+      frameNodes: new Map([
+        ["main", [owner]],
+        ["child", [canvas]],
+      ]),
+      frameOwnerBackendNodeIds: new Map([["child", 10]]),
+      frameParentIds: new Map([["child", "main"]]),
+      rootFrameId: "main",
+      excludedBackendNodeIds: new Set(),
+    };
+    const cdp: CdpRunner = {
+      send: vi.fn(async (_tabId, method) => {
+        if (method === "Accessibility.enable") return {};
+        if (method === "Accessibility.getFullAXTree") return { nodes: [] };
+        if (method === "Page.getLayoutMetrics") {
+          return { cssLayoutViewport: { clientWidth: 1000, clientHeight: 800 } };
+        }
+        if (method === "DOM.getBoxModel") {
+          return { model: { content: [52, 102, 352, 102, 352, 302, 52, 302] } };
+        }
+        if (method === "Page.createIsolatedWorld") return { executionContextId: 91 };
+        if (method === "Runtime.evaluate") {
+          return { result: { value: { width: 300, height: 200 } } };
+        }
+        throw new Error(`unexpected ${method}`);
+      }) as CdpRunner["send"],
+      getFrameGraph: vi.fn(async () => ({
+        rootFrameId: "main",
+        frames: [
+          { frameId: "main", target: { tabId: 4 } },
+          {
+            frameId: "child",
+            parentFrameId: "main",
+            ownerBackendNodeId: 10,
+            target: { tabId: 4 },
+          },
+        ],
+      })),
+    };
+
+    await captureFrameData(cdp, 4, captured);
+
+    expect(captured.frameNodes?.get("child")?.[0]?.rect).toEqual({
+      x: 64,
+      y: 114,
+      w: 224,
+      h: 94,
+    });
+    expect(captured.iframeNodes.get(10)?.[0]?.rect).toEqual({ x: 64, y: 114, w: 224, h: 94 });
+  });
+
+  it("captures and positions multiple OOPIF documents missing from the root snapshot", async () => {
+    const leftOwner = ownerNode(10, 50);
+    const rightOwner = ownerNode(20, 500);
+    const captured: CapturedViewModel = {
+      nodes: [leftOwner, rightOwner],
+      viewport: { width: 1000, height: 800 },
+      iframeNodes: new Map(),
+      frameNodes: new Map([["main", [leftOwner, rightOwner]]]),
+      frameOwnerBackendNodeIds: new Map(),
+      rootFrameId: "main",
+      excludedBackendNodeIds: new Set(),
+    };
+    const sendToTarget = vi.fn(async (target, method) => {
+      if (method === "Page.getLayoutMetrics") {
+        return { cssLayoutViewport: { clientWidth: 300, clientHeight: 200, pageX: 0, pageY: 0 } };
+      }
+      if (method === "DOMSnapshot.enable" || method === "Accessibility.enable") return {};
+      if (method === "DOMSnapshot.captureSnapshot") {
+        return target.sessionId === "left-session"
+          ? childSnapshot("left", 101)
+          : childSnapshot("right", 201);
+      }
+      if (method === "Accessibility.getFullAXTree") return { nodes: [] };
+      throw new Error(`unexpected ${method}`);
+    });
+    const cdp: CdpRunner = {
+      send: vi.fn(async (_tabId, method, params) => {
+        if (method === "Accessibility.enable") return {};
+        if (method === "Accessibility.getFullAXTree") return { nodes: [] };
+        if (method === "DOM.getBoxModel") {
+          const backendNodeId = (params as { backendNodeId?: number })?.backendNodeId;
+          const x = backendNodeId === 10 ? 50 : 500;
+          return { model: { content: [x, 100, x + 300, 100, x + 300, 300, x, 300] } };
+        }
+        if (method === "Page.getLayoutMetrics") {
+          return { cssLayoutViewport: { clientWidth: 1000, clientHeight: 800 } };
+        }
+        throw new Error(`unexpected root ${method}`);
+      }) as CdpRunner["send"],
+      sendToTarget: sendToTarget as unknown as NonNullable<CdpRunner["sendToTarget"]>,
+      getFrameGraph: vi.fn(async () => ({
+        rootFrameId: "main",
+        frames: [
+          { frameId: "main", target: { tabId: 4 } },
+          {
+            frameId: "left",
+            parentFrameId: "main",
+            ownerBackendNodeId: 10,
+            target: { tabId: 4, sessionId: "left-session" },
+          },
+          {
+            frameId: "right",
+            parentFrameId: "main",
+            ownerBackendNodeId: 20,
+            target: { tabId: 4, sessionId: "right-session" },
+          },
+        ],
+      })),
+    };
+
+    const trees = await captureFrameData(cdp, 4, captured);
+
+    expect(trees.map((tree) => tree.frameId)).toEqual(["main", "left", "right"]);
+    expect(
+      captured.frameNodes?.get("left")?.find((node) => node.backendNodeId === 101)?.rect,
+    ).toEqual({ x: 60, y: 120, w: 100, h: 40 });
+    expect(
+      captured.frameNodes?.get("right")?.find((node) => node.backendNodeId === 201)?.rect,
+    ).toEqual({ x: 510, y: 120, w: 100, h: 40 });
+    expect(captured.frameOwnerBackendNodeIds).toEqual(
+      new Map([
+        ["left", 10],
+        ["right", 20],
+      ]),
+    );
+    expect(captured.frameParentIds).toEqual(
+      new Map([
+        ["left", "main"],
+        ["right", "main"],
+      ]),
+    );
+  });
+
+  it("bounds concurrent same-target frame geometry resolution", async () => {
+    const owners = Array.from({ length: 8 }, (_, index) => ownerNode(10 + index, index * 40));
+    const childFrames = owners.map((owner, index) => {
+      const frameId = `child-${index}`;
+      const node: CapturedNode = {
+        backendNodeId: 100 + index,
+        parentBackendNodeId: null,
+        frameId,
+        ownerFrameBackendNodeId: owner.backendNodeId,
+        tag: "canvas",
+        attrs: {},
+        rect: null,
+        localRect: { x: 1, y: 2, w: 20, h: 10 },
+        paintOrder: 1,
+        position: "static",
+        pointerEvents: "auto",
+      };
+      return { frameId, owner, node };
+    });
+    const captured: CapturedViewModel = {
+      nodes: owners,
+      viewport: { width: 1000, height: 800 },
+      iframeNodes: new Map(childFrames.map(({ owner, node }) => [owner.backendNodeId, [node]])),
+      frameNodes: new Map([
+        ["main", owners],
+        ...childFrames.map(({ frameId, node }): [string, CapturedNode[]] => [frameId, [node]]),
+      ]),
+      frameOwnerBackendNodeIds: new Map(
+        childFrames.map(({ frameId, owner }) => [frameId, owner.backendNodeId]),
+      ),
+      rootFrameId: "main",
+      excludedBackendNodeIds: new Set(),
+    };
+    let activeWorlds = 0;
+    let maxActiveWorlds = 0;
+    const cdp: CdpRunner = {
+      send: vi.fn(async (_tabId, method, params) => {
+        if (method === "Page.getLayoutMetrics") {
+          return { cssLayoutViewport: { clientWidth: 1000, clientHeight: 800 } };
+        }
+        if (method === "DOM.getBoxModel") {
+          const backendNodeId = (params as { backendNodeId?: number }).backendNodeId ?? 10;
+          const x = (backendNodeId - 10) * 40;
+          return { model: { content: [x, 100, x + 30, 100, x + 30, 120, x, 120] } };
+        }
+        if (method === "Page.createIsolatedWorld") {
+          activeWorlds += 1;
+          maxActiveWorlds = Math.max(maxActiveWorlds, activeWorlds);
+          await new Promise((resolve) => setTimeout(resolve, 5));
+          activeWorlds -= 1;
+          return { executionContextId: 90 };
+        }
+        if (method === "Runtime.evaluate") {
+          return { result: { value: { width: 30, height: 20 } } };
+        }
+        if (method === "Accessibility.enable") return {};
+        if (method === "Accessibility.getFullAXTree") return { nodes: [] };
+        throw new Error(`unexpected ${method}`);
+      }) as CdpRunner["send"],
+      getFrameGraph: vi.fn(async () => ({
+        rootFrameId: "main",
+        frames: [
+          { frameId: "main", target: { tabId: 4 } },
+          ...childFrames.map(({ frameId, owner }) => ({
+            frameId,
+            parentFrameId: "main",
+            ownerBackendNodeId: owner.backendNodeId,
+            target: { tabId: 4 },
+          })),
+        ],
+      })),
+    };
+
+    await captureFrameData(cdp, 4, captured);
+
+    expect(maxActiveWorlds).toBe(4);
+    expect(childFrames.every(({ frameId }) => captured.frameNodes?.get(frameId)?.[0]?.rect)).toBe(
+      true,
+    );
+  });
+
+  it("keeps OOPIF semantics when viewport projection is unavailable", async () => {
+    const owner = { ...ownerNode(10, 50), rect: null, localRect: null };
+    const captured: CapturedViewModel = {
+      nodes: [owner],
+      viewport: { width: 1000, height: 800 },
+      iframeNodes: new Map(),
+      frameNodes: new Map([["main", [owner]]]),
+      rootFrameId: "main",
+      excludedBackendNodeIds: new Set(),
+    };
+    const cdp: CdpRunner = {
+      send: vi.fn(async (_tabId, method) => {
+        if (method === "Accessibility.enable") return {};
+        if (method === "Accessibility.getFullAXTree") return { nodes: [] };
+        if (method === "DOM.getBoxModel") throw new Error("owner geometry unavailable");
+        if (method === "Page.getLayoutMetrics") {
+          return { cssLayoutViewport: { clientWidth: 1000, clientHeight: 800 } };
+        }
+        throw new Error(`unexpected root ${method}`);
+      }) as CdpRunner["send"],
+      sendToTarget: vi.fn(async (_target, method) => {
+        if (method === "Page.getLayoutMetrics") throw new Error("viewport unavailable");
+        if (method === "DOMSnapshot.enable" || method === "Accessibility.enable") return {};
+        if (method === "DOMSnapshot.captureSnapshot") return childSnapshot("child", 101);
+        if (method === "Accessibility.getFullAXTree") {
+          return {
+            nodes: [
+              {
+                nodeId: "button",
+                backendDOMNodeId: 101,
+                role: { type: "role", value: "button" },
+                name: { type: "computedString", value: "Continue" },
+              },
+            ],
+          };
+        }
+        throw new Error(`unexpected ${method}`);
+      }) as unknown as NonNullable<CdpRunner["sendToTarget"]>,
+      getFrameGraph: vi.fn(async () => ({
+        rootFrameId: "main",
+        frames: [
+          { frameId: "main", target: { tabId: 4 } },
+          {
+            frameId: "child",
+            parentFrameId: "main",
+            ownerBackendNodeId: 10,
+            target: { tabId: 4, sessionId: "child-session" },
+          },
+        ],
+      })),
+    };
+
+    const documents = await captureFrameData(cdp, 4, captured);
+    const childDocument = documents.find((document) => document.frameId === "child");
+
+    expect(childDocument?.axNodes).toEqual([
+      expect.objectContaining({ backendDOMNodeId: 101, frameId: "child" }),
+    ]);
+    expect(childDocument?.domNodes.find((node) => node.backendNodeId === 101)).toEqual(
+      expect.objectContaining({ rect: null, localRect: { x: 10, y: 20, w: 100, h: 40 } }),
+    );
+  });
+});

apps/extension/src/tools/vom/__tests__/frame-document.test.ts

@@ -1,12 +1,7 @@
-import { describe, expect, it, vi } from "vitest";
+import { describe, expect, it } from "vitest";
 import type { CdpFrameGraph } from "@/browser-driver/frame-graph";
-import type { CapturedNode } from "../capture";
-import {
-  buildFrameDocuments,
-  type FrameAxBatch,
-  type FrameDomInput,
-  type FrameOwnedAxNode,
-} from "../frame-document";
+import type { CapturedNode, CapturedViewModel } from "../capture";
+import { buildFrameDocuments, type FrameAxBatch, type FrameOwnedAxNode } from "../frame-document";
 
 function domNode(frameId: string, backendNodeId: number): CapturedNode {
   return {
@@ -22,16 +17,19 @@ function domNode(frameId: string, backendNodeId: number): CapturedNode {
   };
 }
 
-function captured(frameNodes: Map<string, CapturedNode[]>): FrameDomInput {
+function captured(frameNodes: Map<string, CapturedNode[]>): CapturedViewModel {
   return {
     nodes: frameNodes.get("main") ?? [],
+    viewport: { width: 800, height: 600 },
+    iframeNodes: new Map(),
     frameNodes,
     rootFrameId: "main",
+    excludedBackendNodeIds: new Set(),
   };
 }
 
 describe("buildFrameDocuments", () => {
-  it("partitions mixed AX results by node ownership and cuts cross-frame parent edges", async () => {
+  it("partitions mixed AX results by node ownership and cuts cross-frame parent edges", () => {
     const graph: CdpFrameGraph = {
       rootFrameId: "main",
       frames: [
@@ -56,7 +54,7 @@ describe("buildFrameDocuments", () => {
       },
     ];
 
-    const documents = await buildFrameDocuments(
+    const documents = buildFrameDocuments(
       graph,
       batches,
       captured(
@@ -74,7 +72,7 @@ describe("buildFrameDocuments", () => {
     expect(childNodes.find((node) => node.nodeId === "virtual")?.frameId).toBe("child");
   });
 
-  it("deduplicates overlapping same-target AX results using the strongest ownership", async () => {
+  it("deduplicates overlapping same-target AX results using the strongest ownership", () => {
     const graph: CdpFrameGraph = {
       rootFrameId: "main",
       frames: [
@@ -94,7 +92,7 @@ describe("buildFrameDocuments", () => {
       },
     ];
 
-    const documents = await buildFrameDocuments(
+    const documents = buildFrameDocuments(
       graph,
       batches,
       captured(
@@ -109,7 +107,7 @@ describe("buildFrameDocuments", () => {
     expect(documents.find((document) => document.frameId === "child")?.axNodes).toHaveLength(1);
   });
 
-  it("uses target-scoped backend ownership when OOPIF backend ids collide", async () => {
+  it("uses target-scoped backend ownership when OOPIF backend ids collide", () => {
     const graph: CdpFrameGraph = {
       rootFrameId: "main",
       frames: [
@@ -131,7 +129,7 @@ describe("buildFrameDocuments", () => {
       nodes: [{ nodeId: `${frame.frameId}-node`, backendDOMNodeId: 7 }],
     }));
 
-    const documents = await buildFrameDocuments(
+    const documents = buildFrameDocuments(
       graph,
       batches,
       captured(
@@ -151,7 +149,7 @@ describe("buildFrameDocuments", () => {
     );
   });
 
-  it("uses captured frame parent identity instead of guessing from backend ids", async () => {
+  it("uses captured frame parent identity instead of guessing from backend ids", () => {
     const frameNodes = new Map([
       ["main", [domNode("main", 1)]],
       ["left", [domNode("left", 7)]],
@@ -159,51 +157,18 @@ describe("buildFrameDocuments", () => {
       ["child", [domNode("child", 9)]],
     ]);
     const capture = captured(frameNodes);
+    capture.frameOwnerBackendNodeIds = new Map([["child", 7]]);
+    capture.frameParentIds = new Map([["child", "left"]]);
     const frames = ["main", "left", "right", "child"].map((frameId) => ({
-      frame: {
-        frameId,
-        target: { tabId: 4 },
-        ...(frameId === "child" ? { parentFrameId: "left", ownerBackendNodeId: 7 } : {}),
-      },
+      frame: { frameId, target: { tabId: 4 } },
       nodes: [],
     }));
 
-    const documents = await buildFrameDocuments(null, frames, capture);
+    const documents = buildFrameDocuments(null, frames, capture);
 
     expect(documents.find((document) => document.frameId === "child")).toMatchObject({
       parentFrameId: "left",
       ownerBackendNodeId: 7,
     });
   });
-  it("rejects explicit AX frame ownership in a different target", async () => {
-    const frames = [
-      { frameId: "main", target: { tabId: 4 } },
-      { frameId: "remote", target: { tabId: 4, sessionId: "remote" } },
-    ];
-    const unresolved = vi.fn();
-    const documents = await buildFrameDocuments(
-      { rootFrameId: "main", frames },
-      [{ frame: frames[0], nodes: [{ nodeId: "wrong", frameId: "remote" }] }],
-      captured(new Map()),
-      undefined,
-      unresolved,
-    );
-    expect(documents.every((doc) => doc.axNodes.length === 0)).toBe(true);
-    expect(unresolved).toHaveBeenCalledOnce();
-  });
-
-  it("resolves a reverse-ordered deep AX parent chain without recursion", async () => {
-    const frame = { frameId: "main", target: { tabId: 4 } };
-    const nodes: FrameOwnedAxNode[] = Array.from({ length: 10000 }, (_, i) => ({
-      nodeId: String(i),
-      ...(i ? { parentId: String(i - 1) } : { frameId: "main" }),
-    })).reverse();
-    const documents = await buildFrameDocuments(
-      { rootFrameId: "main", frames: [frame] },
-      [{ frame, nodes }],
-      captured(new Map()),
-    );
-    expect(documents[0].axNodes).toHaveLength(10000);
-    expect(documents[0].axNodes[0].frameId).toBe("main");
-  });
 });

apps/extension/src/tools/vom/__tests__/rendered-surfaces.test.ts

@@ -0,0 +1,386 @@
+import type { VomScene } from "@browser-skill/vom";
+import { describe, expect, it } from "vitest";
+import type { CapturedNode } from "../capture";
+import type { CapturedFrameDocument } from "../frame-capture";
+import {
+  clusterRenderedSurfaces,
+  discoverRenderedSurfaces,
+  projectRenderedSurfaces,
+} from "../rendered-surfaces";
+import type { SemanticAxNode } from "../semantic-graph";
+
+function domNode(backendNodeId: number, overrides: Partial<CapturedNode> = {}): CapturedNode {
+  return {
+    backendNodeId,
+    parentBackendNodeId: null,
+    frameId: "main",
+    ownerFrameBackendNodeId: null,
+    tag: "canvas",
+    attrs: {},
+    rect: { x: 10, y: 20, w: 800, h: 500 },
+    localRect: { x: 10, y: 20, w: 800, h: 500 },
+    paintOrder: 1,
+    position: "static",
+    pointerEvents: "auto",
+    rendered: true,
+    ...overrides,
+  };
+}
+
+function document(
+  domNodes: CapturedNode[],
+  axNodes: SemanticAxNode[] = [],
+): CapturedFrameDocument<SemanticAxNode> {
+  return {
+    frameId: domNodes[0]?.frameId ?? "main",
+    contextScopeId: domNodes[0]?.frameId ?? "main",
+    target: { tabId: 4 },
+    domNodes,
+    axNodes,
+  };
+}
+
+describe("rendered surface discovery", () => {
+  it("finds prominent rendered canvases and excludes hidden descendants", () => {
+    const visible = domNode(2, { parentBackendNodeId: 1 });
+    const hidden = domNode(3, { parentBackendNodeId: 4 });
+    const surfaces = discoverRenderedSurfaces(
+      [
+        document([
+          domNode(1, { tag: "main", rect: null, localRect: null }),
+          visible,
+          domNode(4, { tag: "section", attrs: { "aria-hidden": "true" }, rect: null }),
+          hidden,
+        ]),
+      ],
+      { width: 1280, height: 720 },
+    );
+
+    expect(surfaces).toHaveLength(1);
+    expect(surfaces[0]).toMatchObject({ backendNodeId: 2 });
+  });
+
+  it("keeps tiny canvases as individually addressable exact discoveries", () => {
+    const surfaces = discoverRenderedSurfaces(
+      [document([domNode(2, { rect: { x: 1, y: 1, w: 8, h: 8 } })])],
+      { width: 1280, height: 720 },
+    );
+    expect(surfaces).toEqual([expect.objectContaining({ backendNodeId: 2 })]);
+  });
+
+  it("keeps a surface when the canvas only has partial native accessibility content", () => {
+    const axNodes = [
+      {
+        nodeId: "canvas",
+        backendDOMNodeId: 2,
+        role: { type: "role", value: "presentation" },
+        childIds: ["button"],
+        frameId: "main",
+      },
+      {
+        nodeId: "button",
+        backendDOMNodeId: 3,
+        role: { type: "role", value: "button" },
+        frameId: "main",
+      },
+    ] as SemanticAxNode[];
+    expect(
+      discoverRenderedSurfaces([document([domNode(2)], axNodes)], { width: 1280, height: 720 }),
+    ).toEqual([expect.objectContaining({ backendNodeId: 2 })]);
+  });
+
+  it("discovers unnamed canvases without guessing labels from engineering attributes", () => {
+    const canvas = domNode(2, {
+      attrs: {
+        id: "must-not-be-a-label",
+        class: "must-not-be-a-label",
+        "data-testid": "must-not-be-a-label",
+      },
+    });
+
+    expect(discoverRenderedSurfaces([document([canvas])], { width: 1280, height: 720 })).toEqual([
+      expect.not.objectContaining({
+        label: expect.anything(),
+      }),
+    ]);
+  });
+
+  it("treats blank explicit Canvas names as unnamed", () => {
+    expect(
+      discoverRenderedSurfaces(
+        [document([domNode(2, { attrs: { "aria-label": "   ", title: "\n\t" } })])],
+        { width: 1280, height: 720 },
+      ),
+    ).toEqual([expect.not.objectContaining({ label: expect.anything() })]);
+  });
+
+  it("excludes canvases inside BrowserSkill-owned DOM subtrees", () => {
+    const owner = domNode(1, { tag: "div", rect: null, localRect: null });
+    const canvas = domNode(2, { parentBackendNodeId: 1 });
+
+    expect(
+      discoverRenderedSurfaces(
+        [document([owner, canvas])],
+        { width: 1280, height: 720 },
+        new Set([1]),
+      ),
+    ).toEqual([]);
+  });
+
+  it("excludes canvases suppressed by a fully transparent ancestor", () => {
+    const owner = domNode(1, {
+      tag: "div",
+      rect: { x: 0, y: 0, w: 900, h: 600 },
+      visuallySuppressed: true,
+    });
+    const canvas = domNode(2, { parentBackendNodeId: 1 });
+
+    expect(
+      discoverRenderedSurfaces([document([owner, canvas])], { width: 1280, height: 720 }),
+    ).toEqual([]);
+  });
+
+  it("clips canvases to overflow ancestors and drops fully clipped canvases", () => {
+    const owner = domNode(1, {
+      tag: "div",
+      rect: { x: 10, y: 20, w: 100, h: 70 },
+      overflowX: "hidden",
+      overflowY: "hidden",
+    });
+    const partial = domNode(2, {
+      parentBackendNodeId: 1,
+      rect: { x: 55, y: 30, w: 140, h: 60 },
+    });
+    const fullyClipped = domNode(3, {
+      parentBackendNodeId: 1,
+      rect: { x: 140, y: 30, w: 80, h: 50 },
+    });
+
+    expect(
+      discoverRenderedSurfaces([document([owner, partial, fullyClipped])], {
+        width: 1280,
+        height: 720,
+      }),
+    ).toEqual([
+      expect.objectContaining({
+        backendNodeId: 2,
+        visibleRect: { x: 55, y: 30, w: 55, h: 60 },
+      }),
+    ]);
+  });
+});
+
+describe("rendered surface clustering and projection", () => {
+  it("collapses overlapping canvas layers and attaches them to the nearest retained parent", () => {
+    const body = domNode(1, { tag: "body", rect: null, localRect: null });
+    const surfaces = discoverRenderedSurfaces(
+      [
+        document([
+          body,
+          domNode(2, { parentBackendNodeId: 1, paintOrder: 1 }),
+          domNode(3, { parentBackendNodeId: 1, paintOrder: 2 }),
+        ]),
+      ],
+      { width: 1280, height: 720 },
+    );
+    const clustered = clusterRenderedSurfaces(surfaces);
+    const scene: VomScene = {
+      viewport: { width: 1280, height: 720 },
+      nodes: [
+        {
+          id: 10,
+          parentId: null,
+          backendNodeId: 1,
+          frameId: "main",
+          tag: "body",
+          role: "RootWebArea",
+          rect: null,
+          paintOrder: 0,
+          position: "static",
+          pointerEvents: "auto",
+        },
+      ],
+    };
+
+    expect(clustered.groups).toHaveLength(1);
+    expect(clustered.groups[0]?.memberCount).toBe(2);
+    expect(clustered.groups[0]?.label).toBeUndefined();
+    expect(
+      projectRenderedSurfaces(
+        scene,
+        [document([body, ...surfaces.map((s) => domNode(s.backendNodeId))])],
+        clustered,
+      ),
+    ).toMatchObject({
+      visualSurfaces: [expect.objectContaining({ parentId: 10, backendNodeId: 3, memberCount: 2 })],
+    });
+  });
+
+  it("does not merge a contained canvas with a larger independent canvas", () => {
+    const clustered = clusterRenderedSurfaces([
+      ...discoverRenderedSurfaces(
+        [
+          document([
+            domNode(1, { tag: "main", rect: null, localRect: null }),
+            domNode(2, { parentBackendNodeId: 1 }),
+            domNode(3, {
+              parentBackendNodeId: 1,
+              rect: { x: 30, y: 40, w: 200, h: 100 },
+            }),
+          ]),
+        ],
+        { width: 1280, height: 720 },
+      ),
+    ]);
+
+    expect(clustered.groups).toHaveLength(2);
+  });
+
+  it("keeps the existing inclusive 90 percent stack threshold", () => {
+    const clustered = clusterRenderedSurfaces([
+      {
+        renderingKind: "canvas",
+        frameId: "main",
+        backendNodeId: 2,
+        parentBackendNodeId: 1,
+        visibleRect: { x: 0, y: 0, w: 100, h: 100 },
+        paintOrder: 1,
+      },
+      {
+        renderingKind: "canvas",
+        frameId: "main",
+        backendNodeId: 3,
+        parentBackendNodeId: 1,
+        visibleRect: { x: 5, y: 0, w: 90, h: 100 },
+        paintOrder: 2,
+      },
+    ]);
+
+    expect(clustered.groups).toEqual([expect.objectContaining({ memberCount: 2 })]);
+  });
+
+  it("does not merge coincident canvases owned by different containers", () => {
+    const clustered = clusterRenderedSurfaces(
+      discoverRenderedSurfaces(
+        [
+          document([
+            domNode(1, { tag: "section", rect: null, localRect: null }),
+            domNode(2, { tag: "section", rect: null, localRect: null }),
+            domNode(3, { parentBackendNodeId: 1 }),
+            domNode(4, { parentBackendNodeId: 2 }),
+          ]),
+        ],
+        { width: 1280, height: 720 },
+      ),
+    );
+
+    expect(clustered.groups).toHaveLength(2);
+  });
+
+  it("keeps adjacent map tiles and twenty sparklines as independent surfaces", () => {
+    const surfaces = Array.from({ length: 20 }, (_, index) =>
+      domNode(100 + index, {
+        parentBackendNodeId: 1,
+        rect: { x: index * 12, y: 20, w: 10, h: 8 },
+      }),
+    );
+    const clustered = clusterRenderedSurfaces(
+      discoverRenderedSurfaces(
+        [document([domNode(1, { tag: "main", rect: null, localRect: null }), ...surfaces])],
+        { width: 1280, height: 720 },
+      ),
+    );
+
+    expect(clustered.groups).toHaveLength(20);
+    expect(clustered.groups.every((group) => group.memberCount === 1)).toBe(true);
+    expect(clustered.truncated).toBe(false);
+  });
+
+  it("clusters a large coincident stack without retaining every member", () => {
+    const surfaces = Array.from({ length: 10_000 }, (_, index) => ({
+      renderingKind: "canvas" as const,
+      frameId: "main",
+      backendNodeId: index + 1,
+      parentBackendNodeId: 1,
+      visibleRect: { x: 10, y: 20, w: 800, h: 500 },
+      paintOrder: index,
+    }));
+
+    const clustered = clusterRenderedSurfaces(surfaces);
+
+    expect(clustered.groups).toEqual([
+      expect.objectContaining({ memberCount: 10_000, representative: surfaces[9_999] }),
+    ]);
+    expect(clustered.truncated).toBe(false);
+  });
+
+  it("keeps large non-overlapping surface sets linear and independent", () => {
+    const surfaces = Array.from({ length: 10_000 }, (_, index) => ({
+      renderingKind: "canvas" as const,
+      frameId: "main",
+      backendNodeId: index + 1,
+      parentBackendNodeId: 1,
+      visibleRect: { x: index * 20, y: 0, w: 10, h: 10 },
+      paintOrder: index,
+    }));
+
+    const clustered = clusterRenderedSurfaces(surfaces);
+
+    expect(clustered.groups).toHaveLength(10_000);
+    expect(clustered.groups.every((group) => group.memberCount === 1)).toBe(true);
+    expect(clustered.truncated).toBe(false);
+  });
+
+  it("keeps the highest-priority surfaces when the computation guard truncates input", () => {
+    const surfaces = [
+      {
+        renderingKind: "canvas" as const,
+        frameId: "main",
+        backendNodeId: 1,
+        parentBackendNodeId: 10,
+        visibleRect: { x: 0, y: 0, w: 10, h: 10 },
+        paintOrder: 1,
+      },
+      {
+        renderingKind: "canvas" as const,
+        frameId: "main",
+        backendNodeId: 2,
+        parentBackendNodeId: 10,
+        visibleRect: { x: 20, y: 0, w: 100, h: 100 },
+        paintOrder: 1,
+      },
+      {
+        renderingKind: "canvas" as const,
+        frameId: "main",
+        backendNodeId: 3,
+        parentBackendNodeId: 10,
+        visibleRect: { x: 140, y: 0, w: 8, h: 8 },
+        paintOrder: 1,
+        label: "Important status",
+      },
+    ];
+
+    const clustered = clusterRenderedSurfaces(surfaces, { maxSurfaces: 2 });
+
+    expect(clustered.groups.map((group) => group.representative.backendNodeId).sort()).toEqual([
+      2, 3,
+    ]);
+    expect(clustered).toMatchObject({ truncated: true, omittedCount: 1 });
+  });
+
+  it("stops at the comparison budget without dropping already completed groups", () => {
+    const surfaces = Array.from({ length: 3 }, (_, index) => ({
+      renderingKind: "canvas" as const,
+      frameId: "main",
+      backendNodeId: index + 1,
+      parentBackendNodeId: 10,
+      visibleRect: { x: 0, y: 0, w: 100, h: 100 },
+      paintOrder: index + 1,
+    }));
+
+    const clustered = clusterRenderedSurfaces(surfaces, { maxComparisons: 1 });
+
+    expect(clustered.groups).toEqual([expect.objectContaining({ memberCount: 2 })]);
+    expect(clustered).toMatchObject({ truncated: true, omittedCount: 1 });
+  });
+});

apps/extension/src/tools/vom/capture-abort.ts

@@ -1,40 +0,0 @@
-function captureAbortError(): Error {
-  const error = new Error("observation aborted");
-  error.name = "AbortError";
-  return error;
-}
-
-export function isAbortError(error: unknown): boolean {
-  return (
-    typeof error === "object" &&
-    error !== null &&
-    (error as { name?: string }).name === "AbortError"
-  );
-}
-
-export function throwIfAborted(signal: AbortSignal | undefined): void {
-  if (signal?.aborted) throw captureAbortError();
-}
-
-/** Check at bounded work blocks; yield only after a processing slice is spent.
- * Each caller owns its deadline, so unrelated captures do not share state. */
-export function createCaptureCheckpoint(signal?: AbortSignal): () => Promise<void> | undefined {
-  throwIfAborted(signal);
-  let deadline = performance.now() + 8;
-  return () => {
-    throwIfAborted(signal);
-    if (performance.now() < deadline) return;
-    return new Promise<void>((resolve) => {
-      const channel = new MessageChannel();
-      channel.port1.onmessage = () => {
-        channel.port1.close();
-        channel.port2.close();
-        resolve();
-      };
-      channel.port2.postMessage(null);
-    }).then(() => {
-      throwIfAborted(signal);
-      deadline = performance.now() + 8;
-    });
-  };
-}

apps/extension/src/tools/vom/capture-coordinator.ts

@@ -1,413 +0,0 @@
-import {
-  type CdpFrame,
-  type CdpFrameGraph,
-  type CdpTarget,
-  cdpTargetKey,
-} from "@/browser-driver/frame-graph";
-import { cssViewport, GeometryContext } from "../geometry/frame-context";
-import { type CdpRunner, cdpRunnerForTarget } from "../shared";
-import { collectOverlayExcludedBackendIds } from "./capture";
-import {
-  isAbortError as isCaptureAbort,
-  throwIfAborted as throwCaptureAborted,
-} from "./capture-abort";
-import { verifyDocumentIdentity } from "./document-identity";
-import type { CapturedSceneInput, DocumentIdentity } from "./facts";
-import { buildDocumentIndex, type CaptureIssue, type ObservationFacts } from "./facts";
-import { enrichFormControlStates } from "./form-capture";
-import {
-  buildFrameDocuments,
-  type FrameAxBatch,
-  type FrameDocument,
-  type FrameOwnedAxNode,
-} from "./frame-document";
-import { type NormalizedFrameDocument, normalizeSnapshot } from "./normalize";
-import { describeSnapshotFrames, REQUESTED_STYLES, type SnapshotReply } from "./snapshot";
-
-interface TargetBatch<T extends FrameOwnedAxNode> {
-  target: CdpTarget;
-  frames: CdpFrame[];
-  snapshotAttachmentId?: string;
-  documents: NormalizedFrameDocument[];
-  ax: FrameAxBatch<T>[];
-  fallbackExcluded: Set<number>;
-  snapshotFrameIds?: Set<string>;
-  rootFrameId?: string;
-}
-
-/** A fixed worker pool scoped to one capture; each worker issues at most one
- * collection request at a time. Geometry has its own measurement-phase bound. */
-async function collectTasks<T>(
-  items: readonly T[],
-  collect: (item: T) => Promise<void>,
-  signal?: AbortSignal,
-): Promise<void> {
-  let cursor = 0;
-  let failed = false;
-  let failure: unknown;
-  await Promise.all(
-    Array.from({ length: Math.min(4, items.length) }, async () => {
-      try {
-        while (cursor < items.length && !failed && !signal?.aborted) {
-          const item = items[cursor++];
-          await collect(item);
-        }
-      } catch (error) {
-        if (!failed) failure = error;
-        failed = true;
-      }
-    }),
-  );
-  // A worker's rejection must not let the capture outlive its own task scope.
-  // In-flight reads and their finally blocks settle before cancellation/failure.
-  throwCaptureAborted(signal);
-  if (failed) throw failure;
-}
-
-export async function captureObservationFacts<T extends FrameOwnedAxNode>(
-  cdp: CdpRunner,
-  tabId: number,
-  signal?: AbortSignal,
-  pageUrl?: string,
-): Promise<ObservationFacts<T>> {
-  const startedAt = Date.now();
-  throwCaptureAborted(signal);
-  let graph: CdpFrameGraph | undefined;
-  try {
-    graph = await cdp.getFrameGraph?.(tabId);
-  } catch (error) {
-    if (isCaptureAbort(error)) throw error;
-  }
-  throwCaptureAborted(signal);
-  const geometry = new GeometryContext(cdp, tabId, graph, signal);
-  const issues: CaptureIssue[] = [];
-  const graphFrames = new Map(graph?.frames.map((frame) => [frame.frameId, frame]) ?? []);
-  const groups = new Map<string, TargetBatch<T>>();
-  for (const frame of graph?.frames ?? []) {
-    const key = cdpTargetKey(frame.target);
-    let group = groups.get(key);
-    if (!group) {
-      group = {
-        target: frame.target,
-        frames: [],
-        documents: [],
-        ax: [],
-        fallbackExcluded: new Set(),
-      };
-      groups.set(key, group);
-    }
-    group.frames.push(
-      !frame.target.sessionId && frame.frameId === graph?.rootFrameId && !frame.url && pageUrl
-        ? { ...frame, url: pageUrl }
-        : frame,
-    );
-  }
-  if (!groups.has(cdpTargetKey({ tabId })))
-    groups.set(cdpTargetKey({ tabId }), {
-      target: { tabId },
-      frames: [],
-      documents: [],
-      ax: [],
-      fallbackExcluded: new Set(),
-    });
-  const batches = [...groups.values()];
-  const unavailable = (batch: TargetBatch<T>, stage: CaptureIssue["stage"], frameId?: string) =>
-    issues.push({ target: batch.target, frameId, stage, reason: "capture-unavailable" });
-  let firstFailure: unknown;
-  const axReady = new Set<TargetBatch<T>>();
-  await collectTasks(
-    batches,
-    async (batch) => {
-      const scoped = cdpRunnerForTarget(cdp, batch.target);
-      try {
-        throwCaptureAborted(signal);
-        await scoped.send(tabId, "DOMSnapshot.enable", {});
-        throwCaptureAborted(signal);
-        batch.snapshotAttachmentId = cdp.getAttachmentId?.(tabId);
-        const snapshot = await scoped.send<SnapshotReply>(tabId, "DOMSnapshot.captureSnapshot", {
-          computedStyles: REQUESTED_STYLES,
-          includePaintOrder: true,
-          includeDOMRects: true,
-        });
-        throwCaptureAborted(signal);
-        const observed = describeSnapshotFrames(snapshot, batch.target, graphFrames, pageUrl);
-        batch.snapshotFrameIds = observed.ids;
-        batch.rootFrameId = observed.rootFrameId;
-        // Keep graph-only frames for AX fallback, never in preference to observed membership.
-        batch.frames = [
-          ...observed.frames,
-          ...batch.frames.filter((frame) => !observed.ids.has(frame.frameId)),
-        ];
-        batch.documents = await normalizeSnapshot(
-          snapshot,
-          batch.target,
-          batch.frames.filter((frame) => observed.ids.has(frame.frameId)),
-          geometry,
-          issues,
-          signal,
-          observed.rootFrameId,
-        );
-        const formsAvailable = await enrichFormControlStates(
-          scoped,
-          tabId,
-          batch.documents.map((doc) => doc.nodes),
-          signal,
-        );
-        throwCaptureAborted(signal);
-        if (!formsAvailable) unavailable(batch, "forms");
-        const present = new Set(batch.documents.map((doc) => doc.frame.frameId));
-        for (const frame of batch.frames)
-          if (!present.has(frame.frameId)) unavailable(batch, "dom", frame.frameId);
-      } catch (error) {
-        throwCaptureAborted(signal);
-        if (isCaptureAbort(error)) throw error;
-        firstFailure ??= error;
-        unavailable(batch, "dom");
-        batch.fallbackExcluded = await collectOverlayExcludedBackendIds(scoped, tabId, signal);
-      }
-      if (!batch.frames.length && !graph)
-        batch.frames = [
-          {
-            frameId: "root",
-            target: batch.target,
-            ...(!batch.target.sessionId && pageUrl ? { url: pageUrl } : {}),
-          },
-        ];
-      try {
-        throwCaptureAborted(signal);
-        await scoped.send(tabId, "Accessibility.enable", {});
-      } catch (error) {
-        throwCaptureAborted(signal);
-        if (isCaptureAbort(error)) throw error;
-        firstFailure ??= error;
-        unavailable(batch, "ax");
-        return;
-      }
-      axReady.add(batch);
-    },
-    signal,
-  );
-
-  // Schedule AX by frame across all ready targets, rather than nesting pools.
-  // Keep result slots in source order even when CDP replies arrive out of order.
-  const axTasks: { batch: TargetBatch<T>; frame: CdpFrame; result?: FrameAxBatch<T> }[] =
-    batches.flatMap((batch) =>
-      axReady.has(batch) ? batch.frames.map((frame) => ({ batch, frame })) : [],
-    );
-  await collectTasks(
-    axTasks,
-    async (task) => {
-      const { batch, frame } = task;
-      try {
-        throwCaptureAborted(signal);
-        const result = await cdpRunnerForTarget(cdp, batch.target).send<{ nodes?: T[] }>(
-          tabId,
-          "Accessibility.getFullAXTree",
-          frame.frameId === "root" ? {} : { frameId: frame.frameId },
-        );
-        throwCaptureAborted(signal);
-        task.result = { frame, nodes: result.nodes ?? [] };
-      } catch (error) {
-        throwCaptureAborted(signal);
-        if (isCaptureAbort(error)) throw error;
-        firstFailure ??= error;
-        unavailable(batch, "ax", frame.frameId);
-      }
-    },
-    signal,
-  );
-  for (const task of axTasks) if (task.result) task.batch.ax.push(task.result);
-
-  let viewport = { width: 0, height: 0 };
-  try {
-    const measured = cssViewport(await geometry.layoutMetrics({ tabId }));
-    viewport = { width: measured.width, height: measured.height };
-  } catch (error) {
-    if (isCaptureAbort(error)) throw error;
-  }
-
-  // A snapshot claim outranks an old graph hint. Conflicting actual claims
-  // cannot be resolved by completion order or by overwriting a frameId map.
-  const claims = new Map<string, string>();
-  const invalid = new Set<string>();
-  for (const batch of batches) {
-    const targetKey = cdpTargetKey(batch.target);
-    for (const id of batch.snapshotFrameIds ?? []) {
-      const previous = claims.get(id);
-      if (previous !== undefined && previous !== targetKey) invalid.add(id);
-      claims.set(id, targetKey);
-    }
-    const accepted = new Set(batch.frames.map((frame) => frame.frameId));
-    for (const id of batch.snapshotFrameIds ?? []) if (!accepted.has(id)) invalid.add(id);
-  }
-  const currentFrames = batches.flatMap((batch) =>
-    batch.frames.filter(
-      (frame) =>
-        !claims.has(frame.frameId) || claims.get(frame.frameId) === cdpTargetKey(batch.target),
-    ),
-  );
-  const rootBatch = batches.find((batch) => !batch.target.sessionId);
-  const rootFrameId =
-    rootBatch?.rootFrameId ?? graph?.rootFrameId ?? rootBatch?.frames[0]?.frameId ?? "root";
-  const ownershipInvalid = new Set(invalid);
-  const identities = new Map<string, DocumentIdentity>();
-  const selected = new Map(currentFrames.map((frame) => [frame.frameId, frame]));
-  const checks = batches.flatMap((batch) => {
-    const docs = new Map(batch.documents.map((doc) => [doc.frame.frameId, doc]));
-    return batch.frames
-      .filter(
-        (frame) =>
-          !invalid.has(frame.frameId) &&
-          cdpTargetKey(selected.get(frame.frameId)!.target) === cdpTargetKey(batch.target),
-      )
-      .map((frame) => ({ batch, frame, doc: docs.get(frame.frameId) }));
-  });
-  await collectTasks(
-    checks,
-    async ({ batch, frame, doc }) => {
-      throwCaptureAborted(signal);
-      if (!batch.snapshotAttachmentId || doc?.documentElementBackendNodeId === undefined) {
-        issues.push({
-          target: frame.target,
-          frameId: frame.frameId,
-          stage: "identity",
-          reason: "identity-unverified",
-        });
-        return;
-      }
-      const identity: DocumentIdentity = {
-        attachmentId: batch.snapshotAttachmentId,
-        target: frame.target,
-        frameId: frame.frameId,
-        documentElementBackendNodeId: doc.documentElementBackendNodeId,
-      };
-      const verified = await verifyDocumentIdentity(cdp, identity, signal);
-      const status = cdp.getAttachmentId?.(tabId) === identity.attachmentId ? verified : "changed";
-      if (status === "current") identities.set(frame.frameId, identity);
-      else {
-        invalid.add(frame.frameId);
-        issues.push({
-          target: frame.target,
-          frameId: frame.frameId,
-          stage: "identity",
-          reason: status === "changed" ? "document-changed" : "identity-unavailable",
-        });
-      }
-    },
-    signal,
-  );
-  const children = new Map<string, string[]>();
-  for (const frame of currentFrames) {
-    if (!frame.parentFrameId) continue;
-    const siblings = children.get(frame.parentFrameId);
-    if (siblings) siblings.push(frame.frameId);
-    else children.set(frame.parentFrameId, [frame.frameId]);
-  }
-  const blocked = [...invalid];
-  for (let i = 0; i < blocked.length; i++) {
-    for (const child of children.get(blocked[i]) ?? []) {
-      if (!invalid.has(child)) {
-        invalid.add(child);
-        blocked.push(child);
-      }
-    }
-  }
-  for (const frame of currentFrames) {
-    if (ownershipInvalid.has(frame.frameId))
-      issues.push({
-        target: frame.target,
-        frameId: frame.frameId,
-        stage: "ownership",
-        reason: "frame-ownership-unresolved",
-      });
-  }
-  if (invalid.has(rootFrameId))
-    throw new Error(
-      ownershipInvalid.has(rootFrameId)
-        ? "observation root document ownership is ambiguous"
-        : "observation document identity changed or could not be verified; observe again",
-    );
-  const frames = currentFrames.filter((frame) => !invalid.has(frame.frameId));
-  const frameById = new Map(frames.map((frame) => [frame.frameId, frame]));
-  const belongs = (frame: CdpFrame) => {
-    const current = frameById.get(frame.frameId);
-    return current && cdpTargetKey(current.target) === cdpTargetKey(frame.target);
-  };
-  const decoded = new Map(
-    batches
-      .flatMap((batch) => batch.documents)
-      .filter((doc) => belongs(doc.frame))
-      .map((doc) => [doc.frame.frameId, doc]),
-  );
-  const ax = batches.flatMap((batch) => batch.ax).filter((batch) => belongs(batch.frame));
-  const documents = await buildFrameDocuments(
-    { rootFrameId, frames },
-    ax,
-    {
-      nodes: [],
-      rootFrameId,
-      frameNodes: new Map([...decoded].map(([id, doc]) => [id, doc.nodes])),
-      frameExcludedBackendNodeIds: new Map(
-        [...decoded].map(([id, doc]) => [id, doc.index.excludedBackendNodeIds]),
-      ),
-    },
-    signal,
-    (frame) =>
-      issues.push({
-        target: frame.target,
-        frameId: frame.frameId,
-        stage: "ownership",
-        reason: "frame-ownership-unresolved",
-      }),
-  );
-  const facts: ObservationFacts<T>["documents"][number][] = [];
-  for (const document of documents) {
-    const doc = decoded.get(document.frameId);
-    const index = doc?.index ?? (await buildDocumentIndex([], signal));
-    const fallback = groups.get(cdpTargetKey(document.target))?.fallbackExcluded;
-    const {
-      domNodes,
-      axNodes,
-      contextScopeId: _scope,
-      excludedBackendNodeIds: _excluded,
-      ...frame
-    } = document;
-    facts.push({
-      frame,
-      identity: identities.get(document.frameId),
-      index: fallback?.size ? { ...index, excludedBackendNodeIds: fallback } : index,
-      domNodes,
-      axNodes,
-    });
-  }
-  throwCaptureAborted(signal);
-  if (firstFailure && facts.every((doc) => !doc.domNodes.length && !doc.axNodes.length))
-    throw firstFailure;
-  return { rootFrameId, viewport, documents: facts, issues, startedAt, finishedAt: Date.now() };
-}
-
-/** Existing semantic consumers get a narrow view; no raw snapshot
- * data can leak through recording's allowlisted output DTO. */
-export function semanticCapture<T extends FrameOwnedAxNode>(
-  facts: ObservationFacts<T>,
-): { captured: CapturedSceneInput; documents: FrameDocument<T>[] } {
-  const documents = facts.documents.map((doc) => ({
-    ...doc.frame,
-    contextScopeId: doc.frame.frameId,
-    domNodes: doc.domNodes.filter(
-      (node) => !doc.index.excludedBackendNodeIds.has(node.backendNodeId),
-    ),
-    axNodes: doc.axNodes,
-    excludedBackendNodeIds: doc.index.excludedBackendNodeIds,
-  }));
-  const root = documents.find((doc) => doc.frameId === facts.rootFrameId);
-  return {
-    documents,
-    captured: {
-      nodes: root?.domNodes ?? [],
-      viewport: facts.viewport,
-      rootFrameId: facts.rootFrameId,
-      excludedBackendNodeIds: root?.excludedBackendNodeIds ?? new Set(),
-    },
-  };
-}

apps/extension/src/tools/vom/capture-types.ts

@@ -1,37 +0,0 @@
-import type { Rect } from "@browser-skill/vom";
-
-export interface CapturedNode {
-  backendNodeId: number;
-  parentBackendNodeId: number | null;
-  frameId?: string;
-  /** Owning iframe backend node id; `null` for the top-level document. */
-  ownerFrameBackendNodeId?: number | null;
-  tag: string;
-  attrs: Record<string, string>;
-  /** Top-level viewport-relative CSS px, clipped to the owning frame viewport. */
-  rect: Rect | null;
-  /** Frame-local viewport-relative CSS px before top-level projection. */
-  localRect?: Rect | null;
-  paintOrder: number;
-  position: string;
-  pointerEvents: string;
-  /**
-   * computed `cursor`. `cursor: pointer` is the strongest CDP-free signal
-   * that a non-semantic element (a `<div>`/`<span>` with a click handler)
-   * is actually an interactive control — used by the adapter to surface
-   * custom buttons/checkboxes the AX tree drops as `generic`. Optional like
-   * `textContent`: the live parser always sets it, hand-built fixtures may not.
-   */
-  cursor?: string;
-  /**
-   * Whether the live DOM snapshot provides a painted, non-hidden box for this
-   * node. Semantic resolution uses this only for DOM fallback nodes; AX-backed
-   * nodes remain authoritative even when they are outside the viewport.
-   */
-  rendered?: boolean;
-  textContent?: string;
-  formState?: "empty" | "filled" | "default";
-  formValue?: string;
-  formDefaultValue?: string;
-  formPlaceholder?: string;
-}

apps/extension/src/tools/vom/capture.ts

@@ -1,22 +1,344 @@
-// Browser-side hover probes and overlay exclusion fallback. Static collection
-// lives in capture-coordinator; snapshot decoding has no browser dependency.
+// CDP capture adapter: DOMSnapshot.captureSnapshot + Page.getLayoutMetrics
+// → CapturedNode[] + Viewport. This is the ONLY VOM module that touches
+// raw CDP. The captureSnapshot reply is columnar (parallel arrays + a
+// shared string table); requested computed styles are decoded through
+// STYLE_COL so capture and visibility policy share one explicit contract.
+
+import type { Rect, Viewport } from "@browser-skill/vom";
 import { evaluateHoverTrigger } from "@/lib/hover-trigger-policy";
-import { OVERLAY_HOST_SELECTOR } from "../../lib/overlay-bridge";
+import { isOverlayHostNode, OVERLAY_HOST_SELECTOR } from "../../lib/overlay-bridge";
+import { type GeometryProjection, projectRectToViewport } from "../geometry";
 import type { CdpRunner } from "../shared";
-import type { CapturedNode } from "./capture-types";
-import type { CapturedSurfaceProbe } from "./facts";
-
-export type {
-  CapturedNode,
-  CapturedSurfaceProbe,
-} from "./facts";
-
-import { isAbortError, throwIfAborted } from "./capture-abort";
 import { clearHover, ProbeBudget, waitForHover } from "./hover-perception";
 
+const REQUESTED_STYLES = [
+  "position",
+  "pointer-events",
+  "cursor",
+  "visibility",
+  "opacity",
+  "overflow-x",
+  "overflow-y",
+] as const;
+const STYLE_COL = Object.fromEntries(
+  REQUESTED_STYLES.map((name, index) => [name, index]),
+) as Record<(typeof REQUESTED_STYLES)[number], number>;
+
+export interface CapturedNode {
+  backendNodeId: number;
+  parentBackendNodeId: number | null;
+  frameId?: string;
+  /** Owning iframe backend node id; `null` for the top-level document. */
+  ownerFrameBackendNodeId?: number | null;
+  tag: string;
+  attrs: Record<string, string>;
+  /** Top-level viewport-relative CSS px, clipped to the owning frame viewport. */
+  rect: Rect | null;
+  /** Frame-local viewport-relative CSS px before top-level projection. */
+  localRect?: Rect | null;
+  paintOrder: number;
+  position: string;
+  pointerEvents: string;
+  /**
+   * computed `cursor`. `cursor: pointer` is the strongest CDP-free signal
+   * that a non-semantic element (a `<div>`/`<span>` with a click handler)
+   * is actually an interactive control — used by the adapter to surface
+   * custom buttons/checkboxes the AX tree drops as `generic`. Optional like
+   * `textContent`: the live parser always sets it, hand-built fixtures may not.
+   */
+  cursor?: string;
+  overflowX?: string;
+  overflowY?: string;
+  /** True when this node or one of its DOM ancestors makes the subtree fully transparent/hidden. */
+  visuallySuppressed?: boolean;
+  /**
+   * Whether the live DOM snapshot provides a painted, non-hidden box for this
+   * node. Semantic resolution uses this only for DOM fallback nodes; AX-backed
+   * nodes remain authoritative even when they are outside the viewport.
+   */
+  rendered?: boolean;
+  textContent?: string;
+  formState?: "empty" | "filled" | "default";
+  formValue?: string;
+  formDefaultValue?: string;
+  formPlaceholder?: string;
+}
+
+export type CapturedIframeNodes = Map<number, CapturedNode[]>;
+
+export interface CapturedSurfaceProbe {
+  triggerBackendNodeId: number;
+  triggerPoint?: { x: number; y: number };
+  triggerAction: "hover" | "focus" | string;
+  subItems: string[];
+  confidence?: "high" | "medium" | "low";
+}
+
+export interface CapturedViewModel {
+  nodes: CapturedNode[];
+  viewport: Viewport;
+  iframeNodes: CapturedIframeNodes;
+  frameNodes?: Map<string, CapturedNode[]>;
+  frameOwnerBackendNodeIds?: Map<string, number>;
+  /** Explicit DOMSnapshot frame ancestry; never inferred from backend node ids. */
+  frameParentIds?: Map<string, string>;
+  rootFrameId?: string;
+  /** Backend node ids belonging to the agent overlay host + its shadow subtree. */
+  excludedBackendNodeIds: Set<number>;
+}
+
+export interface CaptureViewModelOptions {
+  signal?: AbortSignal;
+}
+
+function captureAbortError(): Error {
+  const error = new Error("observation aborted");
+  error.name = "AbortError";
+  return error;
+}
+
+function isAbortError(error: unknown): boolean {
+  return (
+    typeof error === "object" &&
+    error !== null &&
+    (error as { name?: string }).name === "AbortError"
+  );
+}
+
+function throwIfAborted(signal: AbortSignal | undefined): void {
+  if (signal?.aborted) throw captureAbortError();
+}
+
+/** Sparse array format Chrome uses for infrequently-set per-node fields. */
+interface SparseArray {
+  index: number[];
+  value: number[];
+}
+
+interface RareBooleanData {
+  index: number[];
+}
+
+interface SnapshotDocument {
+  frameId?: string | number;
+  scrollOffsetX?: number;
+  scrollOffsetY?: number;
+  nodes?: {
+    parentIndex?: number[];
+    nodeName?: number[];
+    backendNodeId?: number[];
+    attributes?: number[][];
+    /**
+     * Per-node text value (index into strings), set for `#text` / CDATA nodes.
+     * Element nodes carry -1. Same length as `backendNodeId`.
+     */
+    nodeValue?: number[];
+    /** Maps node array index → index into `documents[]` for frame content. */
+    contentDocumentIndex?: SparseArray;
+    inputValue?: SparseArray;
+    textValue?: SparseArray;
+    inputChecked?: RareBooleanData;
+    optionSelected?: RareBooleanData;
+  };
+  layout?: {
+    nodeIndex?: number[];
+    styles?: number[][];
+    bounds?: number[][];
+    paintOrders?: number[];
+  };
+}
+
+function snapshotFrameId(document: SnapshotDocument, strings: string[]): string | undefined {
+  if (typeof document.frameId === "string") return document.frameId || undefined;
+  if (typeof document.frameId === "number") return str(strings, document.frameId) || undefined;
+  return undefined;
+}
+
+interface SnapshotReply {
+  strings?: string[];
+  documents?: SnapshotDocument[];
+}
+
+interface LayoutMetricsReply {
+  cssLayoutViewport?: {
+    clientWidth?: number;
+    clientHeight?: number;
+    pageX?: number;
+    pageY?: number;
+  };
+  layoutViewport?: { clientWidth?: number; clientHeight?: number; pageX?: number; pageY?: number };
+}
+
+function isFormControlTag(tag: string): boolean {
+  return tag === "input" || tag === "textarea" || tag === "select";
+}
+
+function isSensitiveFormControl(node: Pick<CapturedNode, "tag" | "attrs">): boolean {
+  return node.tag === "input" && (node.attrs.type ?? "").toLowerCase() === "password";
+}
+
+function snapshotFormState(
+  value: string | undefined,
+  defaultValue: string,
+  hasDefaultValue: boolean,
+  sensitive: boolean,
+): CapturedNode["formState"] {
+  if (sensitive) {
+    if (value === undefined && !hasDefaultValue) return undefined;
+    return (value ?? defaultValue) === "" ? "empty" : "filled";
+  }
+  if (value === undefined) return undefined;
+  if (value === "") return "empty";
+  return value === defaultValue ? "default" : "filled";
+}
+
+const MAX_FORM_ENRICH_CONTROLS = 250;
+
+interface CapturedFormState {
+  value?: string;
+  defaultValue?: string;
+  placeholder?: string;
+  state?: "empty" | "filled" | "default";
+  sensitive?: boolean;
+}
+
+interface DeepSerializedValue {
+  type: string;
+  value?: unknown;
+}
+
+function formStateBatchExpression(maxControls: number): string {
+  return `(() => {
+    const maxControls = ${JSON.stringify(maxControls)};
+    let remaining = maxControls;
+    const controlSelector = "input,textarea,select";
+    const controlState = (el) => {
+      const tag = el.tagName.toLowerCase();
+      const type = tag === "input" ? String(el.type || "text").toLowerCase() : tag;
+      const sensitive = type === "password" || type === "credit-card";
+      const rawValue = typeof el.value === "string" ? el.value : "";
+      const defaultValue = typeof el.defaultValue === "string" ? el.defaultValue : "";
+      const placeholder = typeof el.placeholder === "string" ? el.placeholder : "";
+      const state = rawValue === "" ? "empty" : rawValue === defaultValue ? "default" : "filled";
+      return {
+        state,
+        sensitive,
+        placeholder,
+        ...(sensitive ? {} : { value: rawValue, defaultValue }),
+      };
+    };
+    const controls = [];
+    const collect = (doc) => {
+      for (const el of Array.from(doc.querySelectorAll(controlSelector))) {
+        if (remaining <= 0) break;
+        // Deep serialization supplies the node's backend id. Keep the
+        // state as JSON so decoding needs no general-purpose V8 deserializer.
+        controls.push([el, JSON.stringify(controlState(el))]);
+        remaining -= 1;
+      }
+      for (const frame of Array.from(doc.querySelectorAll("iframe"))) {
+        if (remaining <= 0) break;
+        let childDoc = null;
+        try { childDoc = frame.contentDocument; } catch { childDoc = null; }
+        if (childDoc) collect(childDoc);
+      }
+    };
+    collect(document);
+    return controls;
+  })()`;
+}
+
+function formStatesByBackendId(result: RuntimeEvaluateReply): Map<number, CapturedFormState> {
+  const states = new Map<number, CapturedFormState>();
+  const serialized = result.result?.deepSerializedValue;
+  if (serialized?.type !== "array" || !Array.isArray(serialized.value)) return states;
+  for (const entry of serialized.value as DeepSerializedValue[]) {
+    if (entry?.type !== "array" || !Array.isArray(entry.value)) continue;
+    const [element, json] = entry.value as DeepSerializedValue[];
+    if (element?.type !== "node" || json?.type !== "string" || typeof json.value !== "string") {
+      continue;
+    }
+    const backendNodeId = (element.value as { backendNodeId?: number } | undefined)?.backendNodeId;
+    if (typeof backendNodeId !== "number" || !Number.isSafeInteger(backendNodeId)) continue;
+    try {
+      const state = JSON.parse(json.value) as CapturedFormState | null;
+      if (
+        !state ||
+        !["empty", "filled", "default"].includes(state.state ?? "") ||
+        typeof state.sensitive !== "boolean" ||
+        typeof state.placeholder !== "string" ||
+        (!state.sensitive &&
+          (typeof state.value !== "string" || typeof state.defaultValue !== "string"))
+      ) {
+        continue;
+      }
+      states.set(backendNodeId, state);
+    } catch {
+      // A malformed entry must not overwrite the snapshot's own state.
+    }
+  }
+  return states;
+}
+
+function applyFormStates(nodes: CapturedNode[], states: Map<number, CapturedFormState>): void {
+  for (const node of nodes) {
+    if (!isFormControlTag(node.tag)) continue;
+    const state = states.get(node.backendNodeId);
+    if (!state) continue;
+    node.formState = state.state;
+    node.formPlaceholder = state.placeholder ?? "";
+    if (state.sensitive || isSensitiveFormControl(node)) {
+      delete node.formValue;
+      delete node.formDefaultValue;
+      delete node.attrs.value;
+    } else {
+      node.formDefaultValue = state.defaultValue ?? "";
+      if (state.value !== undefined) node.formValue = state.value;
+    }
+  }
+}
+
+async function enrichFormControlStates(
+  cdp: CdpRunner,
+  tabId: number,
+  frameNodeGroups: CapturedNode[][],
+  signal?: AbortSignal,
+): Promise<void> {
+  const hasControls = frameNodeGroups.some((nodes) =>
+    nodes.some((node) => isFormControlTag(node.tag)),
+  );
+  if (!hasControls) return;
+  const objectGroup = `bsk-vom-forms-${crypto.randomUUID()}`;
+  try {
+    throwIfAborted(signal);
+    const result = await cdp.send<RuntimeEvaluateReply>(tabId, "Runtime.evaluate", {
+      expression: formStateBatchExpression(MAX_FORM_ENRICH_CONTROLS),
+      objectGroup,
+      serializationOptions: {
+        serialization: "deep",
+        maxDepth: 3,
+        additionalParameters: { maxNodeDepth: 0, includeShadowTree: "none" },
+      },
+    });
+    throwIfAborted(signal);
+    // Backend ids are scoped to this capture's CDP target. OOPIF targets
+    // use their own captureViewModel call and never share this lookup.
+    const states = formStatesByBackendId(result);
+    for (const nodes of frameNodeGroups) {
+      applyFormStates(nodes, states);
+    }
+  } catch (error) {
+    if (isAbortError(error)) throw error;
+    // Best-effort enrichment. DOMSnapshot/AX data still carries the nodes.
+  } finally {
+    await cdp.send(tabId, "Runtime.releaseObjectGroup", { objectGroup }).catch(() => undefined);
+  }
+}
+
 interface RuntimeEvaluateReply {
   result?: {
     value?: unknown;
+    deepSerializedValue?: DeepSerializedValue;
   };
 }
 
@@ -35,6 +357,44 @@ interface CdpDomNode {
   shadowRoots?: CdpDomNode[];
 }
 
+interface ParseDocumentResult {
+  nodes: CapturedNode[];
+  excludedBackendNodeIds: Set<number>;
+}
+
+interface FrameContext {
+  frameId?: string;
+  ownerFrameBackendNodeId: number | null;
+  projection: GeometryProjection | null;
+  scrollX: number;
+  scrollY: number;
+}
+
+function str(strings: string[], idx: number | undefined): string {
+  if (idx === undefined || idx < 0) return "";
+  return strings[idx] ?? "";
+}
+
+function devicePixelRatio(metrics: LayoutMetricsReply): number {
+  const layoutW = metrics.layoutViewport?.clientWidth ?? 0;
+  const cssW = metrics.cssLayoutViewport?.clientWidth ?? 0;
+  if (!layoutW || !cssW) return 1;
+  const dpr = layoutW / cssW;
+  if (!Number.isFinite(dpr) || dpr <= 0) return 1;
+  return dpr >= 1 ? dpr : 1;
+}
+
+function sparseIndexMap(sparse: SparseArray | undefined): Map<number, number> {
+  const out = new Map<number, number>();
+  if (!sparse?.index || !sparse.value) return out;
+  for (let i = 0; i < sparse.index.length; i++) {
+    const nodeIndex = sparse.index[i];
+    const docIndex = sparse.value[i];
+    if (nodeIndex !== undefined && docIndex !== undefined) out.set(nodeIndex, docIndex);
+  }
+  return out;
+}
+
 function collectBackendIdsFromDomNode(node: CdpDomNode | undefined, out: Set<number>): void {
   if (!node) return;
   if (typeof node.backendNodeId === "number") {
@@ -443,3 +803,371 @@ export async function collectOverlayExcludedBackendIds(
   }
   return excluded;
 }
+
+/**
+ * Parse one DOMSnapshot document into CapturedNode[].
+ *
+ * @param doc   - the raw DOMSnapshot document object
+ * @param strings - the shared string table for the whole snapshot
+ * @param dpr   - device-pixel-ratio from Page.getLayoutMetrics
+ * @param context - frame coordinate context; output rects are top viewport-relative
+ */
+function parseDocumentNodes(
+  doc: SnapshotDocument,
+  strings: string[],
+  dpr: number,
+  context: FrameContext,
+): ParseDocumentResult {
+  const dn = doc.nodes;
+  const dl = doc.layout;
+  if (!dn?.backendNodeId) {
+    return { nodes: [], excludedBackendNodeIds: new Set() };
+  }
+
+  const count = dn.backendNodeId.length;
+  const layoutByNode = new Map<number, number>();
+  (dl?.nodeIndex ?? []).forEach((nodeIdx, layoutIdx) => layoutByNode.set(nodeIdx, layoutIdx));
+
+  // The agent's own overlay (WXT shadow host, marked with OVERLAY_HOST_MARKER_ATTR)
+  // is injected into the page and its open shadow root
+  // is inlined by DOMSnapshot as descendants of the host. Its fixed
+  // full-viewport click-blocker would otherwise dominate occlusion detection
+  // and hide the real page, so mark the host + its whole subtree excluded.
+  // parentIndex always references an earlier node, so one forward pass suffices.
+  const excluded = new Array<boolean>(count).fill(false);
+  const excludedBackendNodeIds = new Set<number>();
+  for (let n = 0; n < count; n++) {
+    const parentIdx = dn.parentIndex?.[n] ?? -1;
+    const inherited = parentIdx >= 0 && excluded[parentIdx];
+    let isOverlayHost = inherited;
+    if (!isOverlayHost) {
+      const pairs = dn.attributes?.[n] ?? [];
+      const attrNames: string[] = [];
+      for (let a = 0; a + 1 < pairs.length; a += 2) {
+        attrNames.push(str(strings, pairs[a]));
+      }
+      isOverlayHost = isOverlayHostNode(str(strings, dn.nodeName?.[n]), attrNames);
+    }
+    if (!isOverlayHost) continue;
+    excluded[n] = true;
+    const backendNodeId = dn.backendNodeId[n];
+    if (backendNodeId !== undefined) {
+      excludedBackendNodeIds.add(backendNodeId);
+    }
+  }
+
+  const posCol = STYLE_COL.position;
+  const peCol = STYLE_COL["pointer-events"];
+  const cursorCol = STYLE_COL.cursor;
+  const visibilityCol = STYLE_COL.visibility;
+  const opacityCol = STYLE_COL.opacity;
+  const overflowXCol = STYLE_COL["overflow-x"];
+  const overflowYCol = STYLE_COL["overflow-y"];
+  const inputValues = sparseIndexMap(dn.inputValue);
+  const textValues = sparseIndexMap(dn.textValue);
+  const checkedInputs = new Set(dn.inputChecked?.index ?? []);
+  const selectedOptions = new Set(dn.optionSelected?.index ?? []);
+
+  // Collect visible text from #text child nodes so element CapturedNodes
+  // carry a textContent value usable as a button/link label fallback.
+  // nodeValue is a parallel array: string index for text nodes, -1 otherwise.
+  const nodeTextContent = new Map<number, string>();
+  if (dn.nodeValue) {
+    for (let n = 0; n < count; n++) {
+      const nvIdx = dn.nodeValue[n] ?? -1;
+      if (nvIdx < 0) continue;
+      const text = str(strings, nvIdx).trim();
+      if (!text) continue;
+      const parentIdx = dn.parentIndex?.[n] ?? -1;
+      if (parentIdx >= 0) {
+        const existing = nodeTextContent.get(parentIdx);
+        nodeTextContent.set(parentIdx, existing ? `${existing} ${text}` : text);
+      }
+    }
+  }
+
+  // Build CapturedNodes.
+  const nodes: CapturedNode[] = [];
+  const visuallySuppressedByNodeIndex = new Array<boolean>(count).fill(false);
+  for (let n = 0; n < count; n++) {
+    if (excluded[n]) continue;
+    const backendNodeId = dn.backendNodeId[n];
+    const parentIdx = dn.parentIndex?.[n] ?? -1;
+    const parentBackendNodeId = parentIdx >= 0 ? (dn.backendNodeId[parentIdx] ?? null) : null;
+    const tag = str(strings, dn.nodeName?.[n]).toLowerCase();
+
+    const attrs: Record<string, string> = {};
+    const pairs = dn.attributes?.[n] ?? [];
+    for (let a = 0; a + 1 < pairs.length; a += 2) {
+      attrs[str(strings, pairs[a]).toLowerCase()] = str(strings, pairs[a + 1]);
+    }
+
+    let rect: Rect | null = null;
+    let localRect: Rect | null = null;
+    let paintOrder = 0;
+    let position = "static";
+    let pointerEvents = "auto";
+    let cursor = "auto";
+    let overflowX = "visible";
+    let overflowY = "visible";
+    let rendered = false;
+    let visuallySuppressed =
+      parentIdx >= 0 ? visuallySuppressedByNodeIndex[parentIdx] === true : false;
+    const li = layoutByNode.get(n);
+    if (li !== undefined) {
+      const b = dl?.bounds?.[li];
+      if (b && b.length >= 4 && b[2] > 0 && b[3] > 0) {
+        localRect = {
+          x: b[0] / dpr - context.scrollX,
+          y: b[1] / dpr - context.scrollY,
+          w: b[2] / dpr,
+          h: b[3] / dpr,
+        };
+        const bounds = context.projection
+          ? projectRectToViewport(localRect, context.projection)
+          : null;
+        rect = bounds ? { x: bounds.x, y: bounds.y, w: bounds.width, h: bounds.height } : null;
+      }
+      paintOrder = dl?.paintOrders?.[li] ?? 0;
+      const styleRow = dl?.styles?.[li] ?? [];
+      position = str(strings, styleRow[posCol]) || "static";
+      pointerEvents = str(strings, styleRow[peCol]) || "auto";
+      cursor = str(strings, styleRow[cursorCol]) || "auto";
+      const visibility = str(strings, styleRow[visibilityCol]) || "visible";
+      const opacity = str(strings, styleRow[opacityCol]) || "1";
+      overflowX = str(strings, styleRow[overflowXCol]) || "visible";
+      overflowY = str(strings, styleRow[overflowYCol]) || "visible";
+      visuallySuppressed ||=
+        visibility === "hidden" ||
+        visibility === "collapse" ||
+        (Number.parseFloat(opacity) || 0) <= 0;
+      rendered =
+        localRect !== null &&
+        visibility !== "hidden" &&
+        visibility !== "collapse" &&
+        (Number.parseFloat(opacity) || 0) > 0;
+    }
+    visuallySuppressedByNodeIndex[n] = visuallySuppressed;
+
+    // Skip non-element nodes (#text, #cdata-section, etc.) — they carry no
+    // geometry and are never queried by callers.
+    if (tag.startsWith("#")) continue;
+
+    const textContent = nodeTextContent.get(n);
+
+    const rawFormValueIndex = tag === "textarea" ? textValues.get(n) : inputValues.get(n);
+    const rawFormValue =
+      rawFormValueIndex !== undefined ? str(strings, rawFormValueIndex) : undefined;
+    const sensitive = isSensitiveFormControl({ tag, attrs });
+    const formDefaultValue = attrs.value ?? "";
+    const formValue = sensitive ? undefined : rawFormValue;
+    const formState = snapshotFormState(
+      rawFormValue,
+      formDefaultValue,
+      Object.prototype.hasOwnProperty.call(attrs, "value"),
+      sensitive,
+    );
+    if (sensitive) delete attrs.value;
+
+    nodes.push({
+      backendNodeId,
+      parentBackendNodeId,
+      ...(context.frameId ? { frameId: context.frameId } : {}),
+      ownerFrameBackendNodeId: context.ownerFrameBackendNodeId,
+      tag,
+      attrs,
+      rect,
+      localRect,
+      paintOrder,
+      position,
+      pointerEvents,
+      cursor,
+      overflowX,
+      overflowY,
+      visuallySuppressed,
+      rendered,
+      textContent,
+      ...(formValue !== undefined ? { formValue } : {}),
+      ...(tag === "input" || tag === "textarea"
+        ? {
+            formPlaceholder: attrs.placeholder ?? "",
+            ...(!sensitive ? { formDefaultValue } : {}),
+            ...(formState ? { formState } : {}),
+          }
+        : {}),
+      ...(checkedInputs.has(n) ? { formValue: "true", formState: "filled" } : {}),
+      ...(selectedOptions.has(n) ? { formValue: attrs.value ?? textContent ?? "" } : {}),
+    });
+  }
+  return { nodes, excludedBackendNodeIds };
+}
+
+interface ParseFrameDocumentsResult {
+  iframeNodes: CapturedIframeNodes;
+  frameOwnerBackendNodeIds: Map<string, number>;
+  frameParentIds: Map<string, string>;
+  excludedBackendNodeIds: Set<number>;
+}
+
+function parseChildFrameDocuments(
+  documents: SnapshotDocument[],
+  strings: string[],
+  dpr: number,
+  parentDocIndex: number,
+  parentContext: FrameContext,
+  visited = new Set<number>(),
+): ParseFrameDocumentsResult {
+  const iframeNodes: CapturedIframeNodes = new Map();
+  const frameOwnerBackendNodeIds = new Map<string, number>();
+  const frameParentIds = new Map<string, string>();
+  const excludedBackendNodeIds = new Set<number>();
+  const parentDoc = documents[parentDocIndex];
+  const cdi = sparseIndexMap(parentDoc?.nodes?.contentDocumentIndex);
+  if (cdi.size === 0) {
+    return { iframeNodes, frameOwnerBackendNodeIds, frameParentIds, excludedBackendNodeIds };
+  }
+
+  const parentBackendIds = parentDoc?.nodes?.backendNodeId ?? [];
+  for (const [nodeArrayIdx, childDocIndex] of cdi) {
+    if (visited.has(childDocIndex)) continue;
+    const childDoc = documents[childDocIndex];
+    if (!childDoc) continue;
+    const iframeBackendId = parentBackendIds[nodeArrayIdx];
+    if (iframeBackendId === undefined) continue;
+    // DOMSnapshot reports the iframe owner's border-box bounds, but child
+    // document coordinates start at the content-box origin. Preserve the
+    // frame-local rectangles here and let frame-capture normalize them with
+    // authoritative content quads once the frame graph is available.
+    const projection = null;
+
+    const childContext: FrameContext = {
+      frameId: snapshotFrameId(childDoc, strings),
+      ownerFrameBackendNodeId: iframeBackendId,
+      projection,
+      scrollX: childDoc.scrollOffsetX ?? 0,
+      scrollY: childDoc.scrollOffsetY ?? 0,
+    };
+    const nextVisited = new Set(visited);
+    nextVisited.add(childDocIndex);
+    const parsed = parseDocumentNodes(childDoc, strings, dpr, childContext);
+    iframeNodes.set(iframeBackendId, parsed.nodes);
+    if (childContext.frameId) {
+      frameOwnerBackendNodeIds.set(childContext.frameId, iframeBackendId);
+      if (parentContext.frameId) frameParentIds.set(childContext.frameId, parentContext.frameId);
+    }
+    for (const id of parsed.excludedBackendNodeIds) excludedBackendNodeIds.add(id);
+
+    const nested = parseChildFrameDocuments(
+      documents,
+      strings,
+      dpr,
+      childDocIndex,
+      childContext,
+      nextVisited,
+    );
+    for (const [nestedFrameId, nestedNodes] of nested.iframeNodes) {
+      iframeNodes.set(nestedFrameId, nestedNodes);
+    }
+    for (const [frameId, ownerBackendNodeId] of nested.frameOwnerBackendNodeIds) {
+      frameOwnerBackendNodeIds.set(frameId, ownerBackendNodeId);
+    }
+    for (const [frameId, parentFrameId] of nested.frameParentIds) {
+      frameParentIds.set(frameId, parentFrameId);
+    }
+    for (const id of nested.excludedBackendNodeIds) excludedBackendNodeIds.add(id);
+  }
+
+  return { iframeNodes, frameOwnerBackendNodeIds, frameParentIds, excludedBackendNodeIds };
+}
+
+export async function captureViewModel(
+  cdp: CdpRunner,
+  tabId: number,
+  options: CaptureViewModelOptions = {},
+): Promise<CapturedViewModel> {
+  throwIfAborted(options.signal);
+  let metrics: LayoutMetricsReply = {};
+  try {
+    metrics = await cdp.send<LayoutMetricsReply>(tabId, "Page.getLayoutMetrics", {});
+  } catch (error) {
+    if (isAbortError(error)) throw error;
+    console.debug("[bsk capture] layout metrics unavailable", error);
+  }
+  throwIfAborted(options.signal);
+  const dpr = devicePixelRatio(metrics);
+  const vpSrc = metrics.cssLayoutViewport ?? metrics.layoutViewport ?? {};
+  const viewport: Viewport = {
+    width: vpSrc.clientWidth ?? 0,
+    height: vpSrc.clientHeight ?? 0,
+  };
+  const scrollX = vpSrc.pageX ?? 0;
+  const scrollY = vpSrc.pageY ?? 0;
+
+  await cdp.send(tabId, "DOMSnapshot.enable", {});
+  throwIfAborted(options.signal);
+  const snap = await cdp.send<SnapshotReply>(tabId, "DOMSnapshot.captureSnapshot", {
+    computedStyles: REQUESTED_STYLES,
+    includePaintOrder: true,
+    includeDOMRects: true,
+  });
+  throwIfAborted(options.signal);
+
+  const strings = snap.strings ?? [];
+  const documents = snap.documents ?? [];
+  const doc0 = documents[0];
+  if (!doc0?.nodes?.backendNodeId) {
+    return {
+      nodes: [],
+      viewport,
+      iframeNodes: new Map(),
+      excludedBackendNodeIds: new Set(),
+    };
+  }
+
+  const topContext: FrameContext = {
+    frameId: snapshotFrameId(doc0, strings),
+    ownerFrameBackendNodeId: null,
+    projection: {
+      sourceClips: [],
+      edges: [],
+      topViewport: viewport,
+    },
+    scrollX,
+    scrollY,
+  };
+  const mainParsed = parseDocumentNodes(doc0, strings, dpr, topContext);
+  const nodes = mainParsed.nodes;
+  const excludedBackendNodeIds = new Set(mainParsed.excludedBackendNodeIds);
+
+  const frameParsed = parseChildFrameDocuments(documents, strings, dpr, 0, topContext);
+  const iframeNodes = frameParsed.iframeNodes;
+  for (const id of frameParsed.excludedBackendNodeIds) {
+    excludedBackendNodeIds.add(id);
+  }
+
+  await enrichFormControlStates(cdp, tabId, [nodes, ...iframeNodes.values()], options.signal);
+  throwIfAborted(options.signal);
+
+  const frameNodes = new Map<string, CapturedNode[]>();
+  if (topContext.frameId) frameNodes.set(topContext.frameId, nodes);
+  for (const iframeFrameNodes of iframeNodes.values()) {
+    const frameId = iframeFrameNodes.find((node) => node.frameId)?.frameId;
+    if (frameId) frameNodes.set(frameId, iframeFrameNodes);
+  }
+  for (const [frameId, ownerBackendNodeId] of frameParsed.frameOwnerBackendNodeIds) {
+    if (!frameNodes.has(frameId)) {
+      frameNodes.set(frameId, iframeNodes.get(ownerBackendNodeId) ?? []);
+    }
+  }
+
+  return {
+    nodes,
+    viewport,
+    iframeNodes,
+    frameNodes,
+    frameOwnerBackendNodeIds: frameParsed.frameOwnerBackendNodeIds,
+    frameParentIds: frameParsed.frameParentIds,
+    ...(topContext.frameId ? { rootFrameId: topContext.frameId } : {}),
+    excludedBackendNodeIds,
+  };
+}

apps/extension/src/tools/vom/document-identity.ts

@@ -1,53 +0,0 @@
-import type { CdpRunner } from "../shared";
-import { sendToCdpTarget } from "../shared";
-import { isAbortError, throwIfAborted } from "./capture-abort";
-import type { DocumentIdentity } from "./facts";
-
-/** Compare the snapshot root with the current root in that exact frame.
- * Deep serialization supplies the backend ID without a separate describeNode. */
-export async function verifyDocumentIdentity(
-  cdp: CdpRunner,
-  identity: DocumentIdentity,
-  signal?: AbortSignal,
-): Promise<"current" | "changed" | "unavailable"> {
-  const attached = () => cdp.getAttachmentId?.(identity.target.tabId) === identity.attachmentId;
-  throwIfAborted(signal);
-  if (!attached()) return "changed";
-  const objectGroup = `bsk-document-identity-${crypto.randomUUID()}`;
-  const send = <T>(method: string, params: object) => {
-    throwIfAborted(signal);
-    return sendToCdpTarget<T>(cdp, identity.target, method, params);
-  };
-  try {
-    const world = await send<{ executionContextId: number }>("Page.createIsolatedWorld", {
-      frameId: identity.frameId,
-      worldName: "bsk-document-identity",
-    });
-    const reply = await send<{
-      result?: { deepSerializedValue?: { type: string; value?: { backendNodeId?: number } } };
-    }>("Runtime.evaluate", {
-      expression: "document.documentElement",
-      contextId: world.executionContextId,
-      objectGroup,
-      serializationOptions: {
-        serialization: "deep",
-        additionalParameters: { maxNodeDepth: 0, includeShadowTree: "none" },
-      },
-    });
-    if (!attached()) return "changed";
-    const root = reply.result?.deepSerializedValue;
-    if (root?.type === "null") return "changed";
-    const id = root?.type === "node" ? root.value?.backendNodeId : undefined;
-    if (id === undefined) return "unavailable";
-    return id === identity.documentElementBackendNodeId ? "current" : "changed";
-  } catch (error) {
-    throwIfAborted(signal);
-    if (isAbortError(error)) throw error;
-    return attached() ? "unavailable" : "changed";
-  } finally {
-    await sendToCdpTarget(cdp, identity.target, "Runtime.releaseObjectGroup", {
-      objectGroup,
-    }).catch(() => {});
-    throwIfAborted(signal);
-  }
-}

apps/extension/src/tools/vom/facts.ts

@@ -1,155 +0,0 @@
-import type { Viewport } from "@browser-skill/vom";
-import type { CdpFrame, CdpTarget } from "@/browser-driver/frame-graph";
-import { isOverlayHostNode } from "@/lib/overlay-bridge";
-import type { FrameProjectionIssue } from "../geometry/coordinate-types";
-import { createCaptureCheckpoint } from "./capture-abort";
-import type { CapturedNode } from "./capture-types";
-import type { FrameOwnedAxNode } from "./frame-document";
-
-/** Bounds retain their raw snapshot document layout units until normalization. */
-export interface SnapshotLayout {
-  readonly boundsSpace: "snapshot-document-layout";
-  bounds?: number[];
-  styles: Readonly<Record<string, string>>;
-}
-
-export interface DecodedNode extends Omit<CapturedNode, "rect" | "localRect" | "rendered"> {
-  nodeType?: number;
-  layout?: SnapshotLayout;
-}
-
-export interface NodeFacts extends CapturedNode {
-  nodeType?: number;
-  layout?: SnapshotLayout;
-}
-
-export interface DocumentIndex<T extends DecodedNode = NodeFacts> {
-  readonly nodes: ReadonlyMap<number, T>;
-  readonly excludedBackendNodeIds: ReadonlySet<number>;
-}
-
-export interface DecodedDocument {
-  nodes: DecodedNode[];
-}
-
-/** All snapshot nodes participate, including document and shadow roots. This
- * preserves overlay propagation when the semantic adapter omits those nodes. */
-export async function buildDocumentIndex<T extends DecodedNode>(
-  input: readonly T[],
-  signal?: AbortSignal,
-): Promise<DocumentIndex<T>> {
-  const checkpoint = createCaptureCheckpoint(signal);
-  const nodes = new Map<number, T>();
-  const overlayByNode = new Map<number, boolean>();
-  const excludedBackendNodeIds = new Set<number>();
-  for (let i = 0; i < input.length; i++) {
-    if (i % 256 === 0) {
-      const pending = checkpoint();
-      if (pending) await pending;
-    }
-    const node = input[i];
-    nodes.set(node.backendNodeId, node);
-  }
-  let work = 0;
-  for (const node of input) {
-    if (work++ % 256 === 0) {
-      const pending = checkpoint();
-      if (pending) await pending;
-    }
-    if (overlayByNode.has(node.backendNodeId)) continue;
-    const path: DecodedNode[] = [];
-    const visiting = new Set<number>();
-    let current: DecodedNode | undefined = node;
-    let overlay = false;
-    while (current && !overlayByNode.has(current.backendNodeId)) {
-      if (work++ % 256 === 0) {
-        const pending = checkpoint();
-        if (pending) await pending;
-      }
-      if (visiting.has(current.backendNodeId)) {
-        // Only an overlay inside the cycle may mark the cycle and its descendants.
-        overlay = path
-          .slice(path.findIndex((item) => item.backendNodeId === current!.backendNodeId))
-          .some((item) => isOverlayHostNode(item.tag, Object.keys(item.attrs)));
-        break;
-      }
-      visiting.add(current.backendNodeId);
-      path.push(current);
-      if (current.parentBackendNodeId === null) {
-        current = undefined;
-        break;
-      }
-      current = nodes.get(current.parentBackendNodeId);
-    }
-    if (current && overlayByNode.has(current.backendNodeId))
-      overlay = overlayByNode.get(current.backendNodeId)!;
-    for (let i = path.length - 1; i >= 0; i--) {
-      if (work++ % 256 === 0) {
-        const pending = checkpoint();
-        if (pending) await pending;
-      }
-      const item = path[i];
-      overlay = overlay || isOverlayHostNode(item.tag, Object.keys(item.attrs));
-      overlayByNode.set(item.backendNodeId, overlay);
-      if (overlay) excludedBackendNodeIds.add(item.backendNodeId);
-    }
-  }
-  return { nodes, excludedBackendNodeIds };
-}
-
-export interface DocumentIdentity {
-  attachmentId: string;
-  target: CdpTarget;
-  frameId: string;
-  documentElementBackendNodeId: number;
-}
-
-/** Narrow input shared by the existing semantic scene/hover consumers. */
-export interface CapturedSceneInput {
-  nodes: CapturedNode[];
-  viewport: Viewport;
-  rootFrameId?: string;
-  excludedBackendNodeIds: ReadonlySet<number>;
-}
-
-export interface CaptureIssue {
-  /** Owner failure or inherited blockage; absent for other geometry failures. */
-  projectionIssue?: FrameProjectionIssue;
-  target: CdpTarget;
-  frameId?: string;
-  stage: "dom" | "ax" | "identity" | "ownership" | "geometry" | "forms";
-  reason:
-    | "document-changed"
-    | "identity-unavailable"
-    | "identity-unverified"
-    | "capture-unavailable"
-    | "frame-ownership-unresolved"
-    | "geometry-unavailable";
-}
-
-export interface DocumentFacts<T extends FrameOwnedAxNode> {
-  readonly frame: CdpFrame;
-  readonly identity?: DocumentIdentity;
-  readonly index: DocumentIndex;
-  readonly domNodes: CapturedNode[];
-  readonly axNodes: T[];
-}
-
-export interface ObservationFacts<T extends FrameOwnedAxNode> {
-  readonly rootFrameId: string;
-  readonly viewport: Viewport;
-  readonly documents: readonly DocumentFacts<T>[];
-  readonly issues: readonly CaptureIssue[];
-  readonly startedAt: number;
-  readonly finishedAt: number;
-}
-
-export interface CapturedSurfaceProbe {
-  triggerBackendNodeId: number;
-  triggerPoint?: { x: number; y: number };
-  triggerAction: "hover" | "focus" | string;
-  subItems: string[];
-  confidence?: "high" | "medium" | "low";
-}
-
-export type { CapturedNode } from "./capture-types";

apps/extension/src/tools/vom/form-capture.ts

@@ -1,155 +0,0 @@
-import type { CdpRunner } from "../shared";
-import { isAbortError, throwIfAborted } from "./capture-abort";
-import type { CapturedNode } from "./capture-types";
-
-interface RuntimeEvaluateReply {
-  result?: { deepSerializedValue?: DeepSerializedValue };
-}
-const MAX_FORM_ENRICH_CONTROLS = 250;
-
-interface CapturedFormState {
-  value?: string;
-  defaultValue?: string;
-  placeholder?: string;
-  state?: "empty" | "filled" | "default";
-  sensitive?: boolean;
-}
-
-interface DeepSerializedValue {
-  type: string;
-  value?: unknown;
-}
-
-function formStateBatchExpression(maxControls: number): string {
-  return `(() => {
-    const maxControls = ${JSON.stringify(maxControls)};
-    let remaining = maxControls;
-    const controlSelector = "input,textarea,select";
-    const controlState = (el) => {
-      const tag = el.tagName.toLowerCase();
-      const type = tag === "input" ? String(el.type || "text").toLowerCase() : tag;
-      const sensitive = type === "password" || type === "credit-card";
-      const rawValue = typeof el.value === "string" ? el.value : "";
-      const defaultValue = typeof el.defaultValue === "string" ? el.defaultValue : "";
-      const placeholder = typeof el.placeholder === "string" ? el.placeholder : "";
-      const state = rawValue === "" ? "empty" : rawValue === defaultValue ? "default" : "filled";
-      return {
-        state,
-        sensitive,
-        placeholder,
-        ...(sensitive ? {} : { value: rawValue, defaultValue }),
-      };
-    };
-    const controls = [];
-    const collect = (doc) => {
-      for (const el of Array.from(doc.querySelectorAll(controlSelector))) {
-        if (remaining <= 0) break;
-        // Deep serialization supplies the node's backend id. Keep the
-        // state as JSON so decoding needs no general-purpose V8 deserializer.
-        controls.push([el, JSON.stringify(controlState(el))]);
-        remaining -= 1;
-      }
-      for (const frame of Array.from(doc.querySelectorAll("iframe"))) {
-        if (remaining <= 0) break;
-        let childDoc = null;
-        try { childDoc = frame.contentDocument; } catch { childDoc = null; }
-        if (childDoc) collect(childDoc);
-      }
-    };
-    collect(document);
-    return controls;
-  })()`;
-}
-
-function formStatesByBackendId(result: RuntimeEvaluateReply): Map<number, CapturedFormState> {
-  const states = new Map<number, CapturedFormState>();
-  const serialized = result.result?.deepSerializedValue;
-  if (serialized?.type !== "array" || !Array.isArray(serialized.value)) return states;
-  for (const entry of serialized.value as DeepSerializedValue[]) {
-    if (entry?.type !== "array" || !Array.isArray(entry.value)) continue;
-    const [element, json] = entry.value as DeepSerializedValue[];
-    if (element?.type !== "node" || json?.type !== "string" || typeof json.value !== "string") {
-      continue;
-    }
-    const backendNodeId = (element.value as { backendNodeId?: number } | undefined)?.backendNodeId;
-    if (typeof backendNodeId !== "number" || !Number.isSafeInteger(backendNodeId)) continue;
-    try {
-      const state = JSON.parse(json.value) as CapturedFormState | null;
-      if (
-        !state ||
-        !["empty", "filled", "default"].includes(state.state ?? "") ||
-        typeof state.sensitive !== "boolean" ||
-        typeof state.placeholder !== "string" ||
-        (!state.sensitive &&
-          (typeof state.value !== "string" || typeof state.defaultValue !== "string"))
-      ) {
-        continue;
-      }
-      states.set(backendNodeId, state);
-    } catch {
-      // A malformed entry must not overwrite the snapshot's own state.
-    }
-  }
-  return states;
-}
-
-function applyFormStates(nodes: CapturedNode[], states: Map<number, CapturedFormState>): void {
-  for (const node of nodes) {
-    if (!["input", "textarea", "select"].includes(node.tag)) continue;
-    const state = states.get(node.backendNodeId);
-    if (!state) continue;
-    node.formState = state.state;
-    node.formPlaceholder = state.placeholder ?? "";
-    if (
-      state.sensitive ||
-      (node.tag === "input" && (node.attrs.type ?? "").toLowerCase() === "password")
-    ) {
-      delete node.formValue;
-      delete node.formDefaultValue;
-      delete node.attrs.value;
-    } else {
-      node.formDefaultValue = state.defaultValue ?? "";
-      if (state.value !== undefined) node.formValue = state.value;
-    }
-  }
-}
-
-export async function enrichFormControlStates(
-  cdp: CdpRunner,
-  tabId: number,
-  frameNodeGroups: CapturedNode[][],
-  signal?: AbortSignal,
-): Promise<boolean> {
-  const hasControls = frameNodeGroups.some((nodes) =>
-    nodes.some((node) => ["input", "textarea", "select"].includes(node.tag)),
-  );
-  if (!hasControls) return true;
-  const objectGroup = `bsk-vom-forms-${crypto.randomUUID()}`;
-  try {
-    throwIfAborted(signal);
-    const result = await cdp.send<RuntimeEvaluateReply>(tabId, "Runtime.evaluate", {
-      expression: formStateBatchExpression(MAX_FORM_ENRICH_CONTROLS),
-      objectGroup,
-      serializationOptions: {
-        serialization: "deep",
-        maxDepth: 3,
-        additionalParameters: { maxNodeDepth: 0, includeShadowTree: "none" },
-      },
-    });
-    throwIfAborted(signal);
-    // Backend ids are scoped to this capture's CDP target. OOPIF targets
-    // have separate enrichment calls and never share this lookup.
-    const states = formStatesByBackendId(result);
-    for (const nodes of frameNodeGroups) {
-      applyFormStates(nodes, states);
-    }
-    return true;
-  } catch (error) {
-    if (isAbortError(error)) throw error;
-    // Best-effort enrichment. DOMSnapshot/AX data still carries the nodes.
-    return false;
-  } finally {
-    await cdp.send(tabId, "Runtime.releaseObjectGroup", { objectGroup }).catch(() => undefined);
-    throwIfAborted(signal);
-  }
-}

apps/extension/src/tools/vom/frame-capture.ts

@@ -0,0 +1,230 @@
+import type { CdpFrame, CdpFrameGraph } from "@/browser-driver/frame-graph";
+import { createFrameGeometryContext } from "../frame-geometry";
+import { type CdpRunner, cdpRunnerForTarget, sendToCdpTarget } from "../shared";
+import { type CapturedNode, type CapturedViewModel, captureViewModel } from "./capture";
+import {
+  buildFrameDocuments,
+  type FrameAxBatch,
+  type FrameDocument,
+  type FrameOwnedAxNode,
+} from "./frame-document";
+
+export type FrameAxNode = FrameOwnedAxNode;
+export type CapturedFrameDocument<T extends FrameAxNode> = FrameDocument<T>;
+
+const FRAME_GEOMETRY_CONCURRENCY = 4;
+
+function throwIfAborted(signal?: AbortSignal): void {
+  if (signal?.aborted) throw new DOMException("observation aborted", "AbortError");
+}
+
+function isAbortError(err: unknown): boolean {
+  return err instanceof Error && err.name === "AbortError";
+}
+
+async function forEachWithConcurrency<T>(
+  items: readonly T[],
+  concurrency: number,
+  worker: (item: T) => Promise<void>,
+): Promise<void> {
+  let next = 0;
+  const run = async () => {
+    while (next < items.length) {
+      const index = next;
+      next += 1;
+      await worker(items[index]);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, run));
+}
+
+async function discoverFrameGraph(cdp: CdpRunner, tabId: number): Promise<CdpFrameGraph | null> {
+  if (!cdp.getFrameGraph) return null;
+  try {
+    return await cdp.getFrameGraph(tabId);
+  } catch (err) {
+    console.debug("[bsk observation] frame graph capture failed", err);
+    return null;
+  }
+}
+
+async function captureMissingFrameDocuments(
+  cdp: CdpRunner,
+  tabId: number,
+  graph: CdpFrameGraph,
+  captured: CapturedViewModel,
+  signal?: AbortSignal,
+): Promise<void> {
+  if (!captured.frameNodes) captured.frameNodes = new Map();
+  if (!captured.frameOwnerBackendNodeIds) captured.frameOwnerBackendNodeIds = new Map();
+  if (!captured.frameParentIds) captured.frameParentIds = new Map();
+
+  for (const frame of graph.frames) {
+    if (!frame.target.sessionId || captured.frameNodes.has(frame.frameId)) continue;
+    try {
+      const child = await captureViewModel(cdpRunnerForTarget(cdp, frame.target), tabId, {
+        signal,
+      });
+      const rootFrameId = child.rootFrameId ?? frame.frameId;
+      const childFrames = child.frameNodes ?? new Map<string, CapturedNode[]>();
+      if (!childFrames.has(rootFrameId)) childFrames.set(rootFrameId, child.nodes);
+      if (rootFrameId !== frame.frameId && !childFrames.has(frame.frameId)) {
+        childFrames.set(
+          frame.frameId,
+          child.nodes.map((node) => ({ ...node, frameId: frame.frameId })),
+        );
+      }
+      for (const [childFrameId, nodes] of childFrames) {
+        captured.frameNodes.set(childFrameId, nodes);
+      }
+      if (frame.ownerBackendNodeId !== undefined) {
+        captured.iframeNodes.set(
+          frame.ownerBackendNodeId,
+          captured.frameNodes.get(frame.frameId) ?? [],
+        );
+        captured.frameOwnerBackendNodeIds.set(frame.frameId, frame.ownerBackendNodeId);
+      }
+      if (frame.parentFrameId) captured.frameParentIds.set(frame.frameId, frame.parentFrameId);
+      for (const [childFrameId, ownerBackendNodeId] of child.frameOwnerBackendNodeIds ?? []) {
+        captured.frameOwnerBackendNodeIds.set(childFrameId, ownerBackendNodeId);
+      }
+      for (const [childFrameId, parentFrameId] of child.frameParentIds ?? []) {
+        captured.frameParentIds.set(childFrameId, parentFrameId);
+      }
+    } catch (err) {
+      if (isAbortError(err)) throw err;
+      console.debug("[bsk observation] child frame DOM capture failed", {
+        frameId: frame.frameId,
+        err,
+      });
+    }
+  }
+}
+
+async function normalizeFrameLocalRects(
+  cdp: CdpRunner,
+  graph: CdpFrameGraph,
+  captured: CapturedViewModel,
+  signal?: AbortSignal,
+): Promise<void> {
+  if (!captured.frameNodes) return;
+  const geometry = createFrameGeometryContext(cdp, graph);
+  const frameById = new Map(graph.frames.map((frame) => [frame.frameId, frame]));
+  await forEachWithConcurrency(
+    [...captured.frameNodes],
+    FRAME_GEOMETRY_CONCURRENCY,
+    async ([frameId, nodes]) => {
+      if (frameId === graph.rootFrameId || !frameById.has(frameId)) return;
+      try {
+        const normalized: CapturedNode[] = [];
+        for (const node of nodes) {
+          if (!node.localRect) {
+            normalized.push({ ...node, rect: null });
+          } else {
+            const bounds = await geometry.projectFrameLocalRect(frameId, node.localRect);
+            normalized.push({
+              ...node,
+              rect: bounds ? { x: bounds.x, y: bounds.y, w: bounds.width, h: bounds.height } : null,
+            });
+          }
+        }
+        throwIfAborted(signal);
+        captured.frameNodes?.set(frameId, normalized);
+        const ownerBackendNodeId =
+          frameById.get(frameId)?.ownerBackendNodeId ??
+          captured.frameOwnerBackendNodeIds?.get(frameId);
+        if (ownerBackendNodeId !== undefined) {
+          captured.iframeNodes.set(ownerBackendNodeId, normalized);
+        }
+      } catch (err) {
+        if (isAbortError(err)) throw err;
+        console.debug("[bsk observation] frame-local geometry normalization failed", {
+          frameId,
+          err,
+        });
+        const unavailable = nodes.map((node) => ({ ...node, rect: null }));
+        captured.frameNodes?.set(frameId, unavailable);
+        const ownerBackendNodeId =
+          frameById.get(frameId)?.ownerBackendNodeId ??
+          captured.frameOwnerBackendNodeIds?.get(frameId);
+        if (ownerBackendNodeId !== undefined) {
+          captured.iframeNodes.set(ownerBackendNodeId, unavailable);
+        }
+      }
+    },
+  );
+}
+
+async function captureAxTrees<T extends FrameAxNode>(
+  cdp: CdpRunner,
+  tabId: number,
+  discoveredFrames: CdpFrame[],
+  captured: CapturedViewModel,
+  signal?: AbortSignal,
+): Promise<FrameAxBatch<T>[]> {
+  let frames = [...discoveredFrames];
+  const capturedFrameIds = [...(captured.frameNodes?.keys() ?? [])];
+  if (frames.length === 0) {
+    const rootFrameId = captured.rootFrameId ?? capturedFrameIds[0] ?? "root";
+    frames = [{ frameId: rootFrameId, target: { tabId } }];
+  }
+  for (const frameId of capturedFrameIds) {
+    if (!frames.some((frame) => frame.frameId === frameId)) {
+      frames.push({ frameId, target: { tabId } });
+    }
+  }
+
+  let firstFailure: unknown;
+  const trees = await Promise.all(
+    frames.map(async (frame): Promise<FrameAxBatch<T>> => {
+      try {
+        throwIfAborted(signal);
+        await sendToCdpTarget(cdp, frame.target, "Accessibility.enable", {});
+        const result = await sendToCdpTarget<{ nodes?: T[] }>(
+          cdp,
+          frame.target,
+          "Accessibility.getFullAXTree",
+          frame.frameId === "root" ? {} : { frameId: frame.frameId },
+        );
+        throwIfAborted(signal);
+        return {
+          frame,
+          nodes: result.nodes ?? [],
+        };
+      } catch (err) {
+        if (isAbortError(err)) throw err;
+        firstFailure ??= err;
+        console.debug("[bsk observation] frame AX capture failed", {
+          frameId: frame.frameId,
+          err,
+        });
+        return { frame, nodes: [] };
+      }
+    }),
+  );
+  const capturedNodeCount = [...captured.iframeNodes.values()].reduce(
+    (count, nodes) => count + nodes.length,
+    captured.nodes.length,
+  );
+  if (firstFailure && capturedNodeCount === 0 && trees.every((tree) => tree.nodes.length === 0)) {
+    throw firstFailure;
+  }
+  return trees;
+}
+
+export async function captureFrameData<T extends FrameAxNode>(
+  cdp: CdpRunner,
+  tabId: number,
+  captured: CapturedViewModel,
+  signal?: AbortSignal,
+): Promise<CapturedFrameDocument<T>[]> {
+  const graph = await discoverFrameGraph(cdp, tabId);
+  const frames = graph?.frames ?? [];
+  if (graph) {
+    await captureMissingFrameDocuments(cdp, tabId, graph, captured, signal);
+    await normalizeFrameLocalRects(cdp, graph, captured, signal);
+  }
+  throwIfAborted(signal);
+  const batches = await captureAxTrees<T>(cdp, tabId, frames, captured, signal);
+  return buildFrameDocuments(graph, batches, captured);
+}

apps/extension/src/tools/vom/frame-document.ts

@@ -4,8 +4,7 @@ import {
   type CdpTarget,
   cdpTargetKey,
 } from "@/browser-driver/frame-graph";
-import { createCaptureCheckpoint } from "./capture-abort";
-import type { CapturedNode } from "./capture-types";
+import type { CapturedNode, CapturedViewModel } from "./capture";
 
 export interface FrameOwnedAxNode {
   nodeId: string;
@@ -24,15 +23,6 @@ export interface FrameDocument<T extends FrameOwnedAxNode> extends CdpFrame {
   contextScopeId: string;
   axNodes: T[];
   domNodes: CapturedNode[];
-  excludedBackendNodeIds?: ReadonlySet<number>;
-}
-
-/** Explicit snapshot document data used to join DOM and AX ownership. */
-export interface FrameDomInput {
-  nodes: CapturedNode[];
-  rootFrameId?: string;
-  frameNodes?: ReadonlyMap<string, CapturedNode[]>;
-  frameExcludedBackendNodeIds?: ReadonlyMap<string, ReadonlySet<number>>;
 }
 
 interface Ownership {
@@ -57,25 +47,35 @@ function targetBackendKey(target: CdpTarget, backendNodeId: number): string {
 function frameList<T extends FrameOwnedAxNode>(
   graph: CdpFrameGraph | null,
   batches: FrameAxBatch<T>[],
+  captured: CapturedViewModel,
 ): CdpFrame[] {
   const frames = new Map<string, CdpFrame>();
   for (const frame of graph?.frames ?? []) frames.set(frame.frameId, frame);
   for (const batch of batches) {
     if (!frames.has(batch.frame.frameId)) frames.set(batch.frame.frameId, batch.frame);
   }
-  return [...frames.values()];
+  for (const frameId of captured.frameNodes?.keys() ?? []) {
+    if (!frames.has(frameId))
+      frames.set(frameId, { frameId, target: { tabId: batches[0]?.frame.target.tabId ?? 0 } });
+  }
+  return [...frames.values()].map((frame) => {
+    const ownerBackendNodeId =
+      frame.ownerBackendNodeId ?? captured.frameOwnerBackendNodeIds?.get(frame.frameId);
+    const parentFrameId = frame.parentFrameId ?? captured.frameParentIds?.get(frame.frameId);
+    return {
+      ...frame,
+      ...(ownerBackendNodeId !== undefined ? { ownerBackendNodeId } : {}),
+      ...(parentFrameId ? { parentFrameId } : {}),
+    };
+  });
 }
 
-export async function buildFrameDocuments<T extends FrameOwnedAxNode>(
+export function buildFrameDocuments<T extends FrameOwnedAxNode>(
   graph: CdpFrameGraph | null,
   batches: FrameAxBatch<T>[],
-  captured: FrameDomInput,
-  signal?: AbortSignal,
-  unresolved?: (frame: CdpFrame) => void,
-): Promise<FrameDocument<T>[]> {
-  const checkpoint = createCaptureCheckpoint(signal);
-  let work = 0;
-  const frames = frameList(graph, batches);
+  captured: CapturedViewModel,
+): FrameDocument<T>[] {
+  const frames = frameList(graph, batches, captured);
   const frameById = new Map(frames.map((frame) => [frame.frameId, frame]));
   const rootFrameId = graph?.rootFrameId ?? captured.rootFrameId ?? frames[0]?.frameId;
   const domNodesForFrame = (frameId: string): CapturedNode[] =>
@@ -83,80 +83,54 @@ export async function buildFrameDocuments<T extends FrameOwnedAxNode>(
   const backendOwner = new Map<string, string>();
   for (const frame of frames) {
     for (const node of domNodesForFrame(frame.frameId)) {
-      if (work++ % 256 === 0) {
-        const pending = checkpoint();
-        if (pending) await pending;
-      }
       backendOwner.set(targetBackendKey(frame.target, node.backendNodeId), frame.frameId);
     }
   }
 
   const candidates = new Map<string, OwnedCandidate<T>>();
   for (const batch of batches) {
-    const nodeById = new Map<string, T>();
-    for (const node of batch.nodes) {
-      if (work++ % 256 === 0) {
-        const pending = checkpoint();
-        if (pending) await pending;
-      }
-      nodeById.set(node.nodeId, node);
-    }
-    let reported = false;
+    const nodeById = new Map(batch.nodes.map((node) => [node.nodeId, node]));
     const ownershipByNodeId = new Map<string, Ownership>();
-    for (const node of batch.nodes) {
-      const path: T[] = [];
-      const visiting = new Set<string>();
-      let current: T | undefined = node;
-      let ownership: Ownership = { frameId: batch.frame.frameId, strength: 1 };
-      while (current) {
-        if (work++ % 256 === 0) {
-          const pending = checkpoint();
-          if (pending) await pending;
-        }
-        const cached = ownershipByNodeId.get(current.nodeId);
-        if (cached) {
-          ownership = cached;
-          break;
-        }
-        if (visiting.has(current.nodeId)) break;
-        visiting.add(current.nodeId);
-        if (current.frameId) {
-          const frame = frameById.get(current.frameId);
-          // An explicit contradiction must not fall through to a guessed owner.
-          if (!frame || cdpTargetKey(frame.target) !== cdpTargetKey(batch.frame.target)) {
-            if (!reported) {
-              unresolved?.(batch.frame);
-              reported = true;
-            }
-            ownership = { frameId: "", strength: 0 };
-            break;
-          }
-          ownership = { frameId: frame.frameId, strength: 4 };
-          ownershipByNodeId.set(current.nodeId, ownership);
-          break;
-        }
-        const frameId =
-          typeof current.backendDOMNodeId === "number"
-            ? backendOwner.get(targetBackendKey(batch.frame.target, current.backendDOMNodeId))
-            : undefined;
+    const resolving = new Set<string>();
+    const resolveOwnership = (node: T): Ownership => {
+      const cached = ownershipByNodeId.get(node.nodeId);
+      if (cached) return cached;
+      if (node.frameId && frameById.has(node.frameId)) {
+        const ownership = { frameId: node.frameId, strength: 4 };
+        ownershipByNodeId.set(node.nodeId, ownership);
+        return ownership;
+      }
+      if (typeof node.backendDOMNodeId === "number") {
+        const frameId = backendOwner.get(
+          targetBackendKey(batch.frame.target, node.backendDOMNodeId),
+        );
         if (frameId) {
-          ownership = { frameId, strength: 3 };
-          ownershipByNodeId.set(current.nodeId, ownership);
-          break;
+          const ownership = { frameId, strength: 3 };
+          ownershipByNodeId.set(node.nodeId, ownership);
+          return ownership;
         }
-        path.push(current);
-        current = current.parentId ? nodeById.get(current.parentId) : undefined;
       }
-      for (let i = path.length - 1; i >= 0; i--) {
-        if (work++ % 256 === 0) {
-          const pending = checkpoint();
-          if (pending) await pending;
+      if (node.parentId && !resolving.has(node.nodeId)) {
+        const parent = nodeById.get(node.parentId);
+        if (parent) {
+          resolving.add(node.nodeId);
+          const inherited = resolveOwnership(parent);
+          resolving.delete(node.nodeId);
+          const ownership = {
+            frameId: inherited.frameId,
+            strength: Math.min(2, inherited.strength),
+          };
+          ownershipByNodeId.set(node.nodeId, ownership);
+          return ownership;
         }
-        ownership = { frameId: ownership.frameId, strength: Math.min(2, ownership.strength) };
-        ownershipByNodeId.set(path[i].nodeId, ownership);
       }
-      if (!ownershipByNodeId.has(node.nodeId)) ownershipByNodeId.set(node.nodeId, ownership);
-      if (!ownership.frameId) continue;
+      const ownership = { frameId: batch.frame.frameId, strength: 1 };
+      ownershipByNodeId.set(node.nodeId, ownership);
+      return ownership;
+    };
+
+    for (const node of batch.nodes) {
+      const ownership = resolveOwnership(node);
       const key = targetNodeKey(batch.frame.target, node.nodeId);
       const existing = candidates.get(key);
       if (!existing || ownership.strength > existing.ownership.strength) {
@@ -170,10 +144,6 @@ export async function buildFrameDocuments<T extends FrameOwnedAxNode>(
   );
   const axNodesByFrame = new Map<string, T[]>();
   for (const candidate of candidates.values()) {
-    if (work++ % 256 === 0) {
-      const pending = checkpoint();
-      if (pending) await pending;
-    }
     const { node, target, ownership } = candidate;
     const parentFrameId = node.parentId
       ? ownershipByTargetNode.get(targetNodeKey(target, node.parentId))
@@ -199,6 +169,5 @@ export async function buildFrameDocuments<T extends FrameOwnedAxNode>(
     contextScopeId: frame.frameId,
     axNodes: axNodesByFrame.get(frame.frameId) ?? [],
     domNodes: domNodesForFrame(frame.frameId),
-    excludedBackendNodeIds: captured.frameExcludedBackendNodeIds?.get(frame.frameId),
   }));
 }

apps/extension/src/tools/vom/normalize.ts

@@ -1,325 +0,0 @@
-import type { Viewport } from "@browser-skill/vom";
-import { type CdpFrame, type CdpTarget, cdpTargetKey } from "@/browser-driver/frame-graph";
-import { type GeometryProjection, projectRectToViewport } from "../geometry";
-import {
-  type FrameProjectionState,
-  projectSnapshotRect,
-  type SnapshotCoordinates,
-  snapshotCoordinates,
-  snapshotViewportRect,
-} from "../geometry/coordinate-types";
-import {
-  GeometryContext,
-  type LayoutMetrics,
-  snapshotLayoutScale,
-} from "../geometry/frame-context";
-import {
-  createCaptureCheckpoint,
-  isAbortError as isCaptureAbort,
-  throwIfAborted as throwCaptureAborted,
-} from "./capture-abort";
-import { buildDocumentIndex, type CaptureIssue, type DocumentIndex, type NodeFacts } from "./facts";
-import {
-  decodeDocument,
-  type SnapshotDocument,
-  type SnapshotReply,
-  snapshotFrameId,
-} from "./snapshot";
-
-export interface FrameContext {
-  frameId?: string;
-  ownerFrameBackendNodeId: number | null;
-  projection: FrameProjectionState | null;
-  targetProjection?: GeometryProjection | null;
-  target: CdpTarget;
-  coordinates: SnapshotCoordinates | null;
-}
-
-export interface NormalizedDocument {
-  nodes: NodeFacts[];
-  index: DocumentIndex;
-  documentElementBackendNodeId?: number;
-}
-
-/** Interpret one document using a supplied projection. No live reads or frame scheduling. */
-export async function normalizeDocument(
-  doc: SnapshotDocument,
-  strings: string[],
-  context: FrameContext,
-  signal?: AbortSignal,
-): Promise<NormalizedDocument> {
-  const decoded = await decodeDocument(doc, strings, signal);
-  const checkpoint = createCaptureCheckpoint(signal);
-  const nodes: NodeFacts[] = [];
-  for (let i = 0; i < decoded.nodes.length; i++) {
-    if (i % 256 === 0) {
-      const pending = checkpoint();
-      if (pending) await pending;
-    }
-    const node = decoded.nodes[i];
-    const bounds = node.layout?.bounds ?? [];
-    const input = snapshotViewportRect(
-      bounds,
-      { target: context.target, frameId: context.frameId },
-      context.coordinates,
-    );
-    const local = input?.rect;
-    let rect =
-      input && context.projection?.status === "available"
-        ? projectSnapshotRect(input, context.projection.projection)
-        : null;
-    if (rect && context.targetProjection !== undefined)
-      rect = context.targetProjection
-        ? projectRectToViewport(
-            { x: rect.x, y: rect.y, w: rect.width, h: rect.height },
-            context.targetProjection,
-          )
-        : null;
-    const visibility = node.layout?.styles.visibility || "visible";
-    const opacity = node.layout?.styles.opacity || "1";
-    nodes.push({
-      ...node,
-      ...(context.frameId ? { frameId: context.frameId } : {}),
-      ownerFrameBackendNodeId: context.ownerFrameBackendNodeId,
-      localRect: local ? { x: local.x, y: local.y, w: local.width, h: local.height } : null,
-      rect: rect ? { x: rect.x, y: rect.y, w: rect.width, h: rect.height } : null,
-      rendered:
-        bounds.length >= 4 &&
-        bounds.slice(0, 4).every(Number.isFinite) &&
-        bounds[2] > 0 &&
-        bounds[3] > 0 &&
-        visibility !== "hidden" &&
-        visibility !== "collapse" &&
-        (Number.parseFloat(opacity) || 0) > 0,
-    });
-  }
-  const index = await buildDocumentIndex(nodes, signal);
-  return {
-    nodes: nodes.filter(
-      (node) => !node.tag.startsWith("#") && !index.excludedBackendNodeIds.has(node.backendNodeId),
-    ),
-    index,
-    documentElementBackendNodeId: nodes.find(
-      (node) =>
-        node.nodeType === 1 &&
-        node.parentBackendNodeId !== null &&
-        index.nodes.get(node.parentBackendNodeId)?.nodeType === 9,
-    )?.backendNodeId,
-  };
-}
-
-export interface NormalizedFrameDocument extends NormalizedDocument {
-  frame: CdpFrame;
-}
-
-/** One target's snapshot. Source ownership is checked before interpreting any
- * coordinates. Snapshot and live quad coordinates are deliberately not conflated. */
-export async function normalizeSnapshot(
-  snapshot: SnapshotReply,
-  target: CdpTarget,
-  frames: readonly CdpFrame[],
-  geometry: GeometryContext,
-  issues: CaptureIssue[],
-  signal?: AbortSignal,
-  rootFrameId?: string,
-): Promise<NormalizedFrameDocument[]> {
-  const strings = snapshot.strings ?? [];
-  const raw = snapshot.documents ?? [];
-  const ownerIds = new Set<number>();
-  for (const document of raw) {
-    for (const index of document.nodes?.contentDocumentIndex?.index ?? []) {
-      const id = document.nodes?.backendNodeId?.[index];
-      if (id !== undefined) ownerIds.add(id);
-    }
-  }
-  geometry.registerSnapshotOwners(target, ownerIds);
-  const frameById = new Map(frames.map((frame) => [frame.frameId, frame]));
-  const sources = new Map<string, SnapshotDocument>();
-  for (const doc of raw) {
-    const id = snapshotFrameId(doc, strings);
-    if (!id || !frameById.has(id) || sources.has(id)) {
-      issues.push({
-        target,
-        frameId: id,
-        stage: "ownership",
-        reason: "frame-ownership-unresolved",
-      });
-      continue;
-    }
-    sources.set(id, doc);
-  }
-  let metrics: LayoutMetrics = {};
-  try {
-    metrics = await geometry.layoutMetrics(target);
-  } catch (error) {
-    if (isCaptureAbort(error)) throw error;
-  }
-  const viewport: Viewport = {
-    width: metrics.cssLayoutViewport?.clientWidth ?? 0,
-    height: metrics.cssLayoutViewport?.clientHeight ?? 0,
-  };
-  const layoutUnitsPerCssPixel = snapshotLayoutScale(metrics);
-  const viewportAvailable = [viewport.width, viewport.height].every(
-    (size) => Number.isFinite(size) && size > 0,
-  );
-
-  const children = new Map<string, CdpFrame[]>();
-  const pending: CdpFrame[] = [];
-  for (const frame of frames) {
-    if (!frame.parentFrameId || !frameById.has(frame.parentFrameId)) pending.push(frame);
-    else {
-      const siblings = children.get(frame.parentFrameId);
-      if (siblings) siblings.push(frame);
-      else children.set(frame.parentFrameId, [frame]);
-    }
-  }
-  const projections = new Map<string, FrameProjectionState | null>();
-  const result: NormalizedFrameDocument[] = [];
-  let targetProjection: GeometryProjection | null = null;
-  const targetRoot = rootFrameId ? frameById.get(rootFrameId) : undefined;
-  if (target.sessionId && targetRoot) {
-    try {
-      const known = await geometry.frame(targetRoot.frameId);
-      if (known && cdpTargetKey(known.target) === cdpTargetKey(target))
-        targetProjection = await geometry.targetProjection(targetRoot.frameId);
-    } catch (error) {
-      if (isCaptureAbort(error)) throw error;
-    }
-  }
-  const checkpoint = createCaptureCheckpoint(signal);
-  const visited = new Set<string>();
-  const remaining = frames[Symbol.iterator]();
-  for (let cursor = 0; visited.size < frames.length; cursor++) {
-    if (cursor >= pending.length) {
-      let next = remaining.next();
-      while (!next.done && visited.has(next.value.frameId)) next = remaining.next();
-      if (next.done) break;
-      pending.push(next.value);
-    }
-    if (cursor % 256 === 0) {
-      const pending = checkpoint();
-      if (pending) await pending;
-    }
-    const frame = pending[cursor];
-    if (visited.has(frame.frameId)) continue;
-    visited.add(frame.frameId);
-    for (const child of children.get(frame.frameId) ?? []) pending.push(child);
-    const doc = sources.get(frame.frameId);
-    if (!doc) continue;
-    const source = { target, frameId: frame.frameId };
-    const coordinates = snapshotCoordinates(
-      doc,
-      layoutUnitsPerCssPixel,
-      frame.frameId === rootFrameId
-        ? { x: metrics.cssLayoutViewport?.pageX, y: metrics.cssLayoutViewport?.pageY }
-        : undefined,
-    );
-    let state: FrameProjectionState | null =
-      frame.frameId === rootFrameId
-        ? viewportAvailable && coordinates
-          ? {
-              status: "available",
-              projection: {
-                source,
-                geometry: { sourceClips: [], edges: [], topViewport: viewport },
-              },
-            }
-          : { status: "unavailable", source, reason: "snapshot-coordinates-unavailable" }
-        : (projections.get(frame.frameId) ?? null);
-    if (!state && frame.frameId !== rootFrameId)
-      issues.push({
-        target,
-        frameId: frame.frameId,
-        stage: "ownership",
-        reason: "frame-ownership-unresolved",
-      });
-    if (!coordinates && (!state || state.status === "available"))
-      state = { status: "unavailable", source, reason: "snapshot-coordinates-unavailable" };
-    projections.set(frame.frameId, state);
-    const projection = state?.status === "available" ? state.projection : null;
-    if (!projection || (target.sessionId && !targetProjection))
-      issues.push({
-        target,
-        frameId: frame.frameId,
-        stage: "geometry",
-        reason: "geometry-unavailable",
-        ...(state && state.status !== "available" ? { projectionIssue: state } : {}),
-      });
-
-    // Only direct siblings share this pool. Keep normalization in its existing
-    // breadth-first order, independent of owner read completion order.
-    const siblings = (children.get(frame.frameId) ?? []).filter((child) =>
-      sources.has(child.frameId),
-    );
-    const edge = projection?.geometry.edges[0];
-    const clips = edge
-      ? [edge.destinationQuad, ...(edge.destinationClips ?? [])]
-      : (projection?.geometry.sourceClips ?? []);
-    let next = 0;
-    let failure: unknown;
-    await Promise.all(
-      Array.from({ length: Math.min(4, siblings.length) }, async () => {
-        while (next < siblings.length && !signal?.aborted && !failure) {
-          const child = siblings[next++];
-          const childSource = { target, frameId: child.frameId };
-          if (!projection) {
-            projections.set(
-              child.frameId,
-              state && state.status !== "available"
-                ? {
-                    status: "blocked",
-                    source: childSource,
-                    cause: state.status === "blocked" ? state.cause : state,
-                  }
-                : null,
-            );
-            continue;
-          }
-          if (child.ownerBackendNodeId === undefined) {
-            projections.set(child.frameId, null);
-            continue;
-          }
-          if (!snapshotCoordinates(sources.get(child.frameId)!, layoutUnitsPerCssPixel)) {
-            projections.set(child.frameId, {
-              status: "unavailable",
-              source: childSource,
-              reason: "snapshot-coordinates-unavailable",
-            });
-            continue;
-          }
-          try {
-            projections.set(
-              child.frameId,
-              await geometry.snapshotProjection(
-                childSource,
-                child.ownerBackendNodeId,
-                clips,
-                viewport,
-              ),
-            );
-          } catch (error) {
-            failure ??= error;
-          }
-        }
-      }),
-    );
-    // Join active reads and their cleanup before returning cancellation.
-    if (failure) throw failure;
-    throwCaptureAborted(signal);
-    const normalized = await normalizeDocument(
-      doc,
-      strings,
-      {
-        frameId: frame.frameId,
-        ownerFrameBackendNodeId: frame.ownerBackendNodeId ?? null,
-        projection: state,
-        target,
-        ...(target.sessionId ? { targetProjection } : {}),
-        coordinates,
-      },
-      signal,
-    );
-    result.push({ ...normalized, frame });
-  }
-  return result;
-}

apps/extension/src/tools/vom/record-safe-observation.ts

@@ -2,10 +2,7 @@ import type { Rect, RenderedRef, VomResult } from "@browser-skill/vom";
 import type { CdpTarget } from "@/browser-driver/frame-graph";
 import { readRecordingDocumentIdentity } from "@/shared/recording-document-identity";
 import type { CapturedSurfaceProbe } from "./capture";
-import type {
-  FrameDocument as CapturedFrameDocument,
-  FrameOwnedAxNode as FrameAxNode,
-} from "./frame-document";
+import type { CapturedFrameDocument, FrameAxNode } from "./frame-capture";
 
 /** Frame identity needed to resolve an `@eN` that lives in an iframe. */
 export interface CaptureVomFrame {

apps/extension/src/tools/vom/rendered-surfaces/cluster.ts

@@ -0,0 +1,252 @@
+import { compareVisualSurfacePriority, type Rect } from "@browser-skill/vom";
+import type { ClusteredRenderedSurfaces, RenderedSurface, RenderedSurfaceGroup } from "./types";
+
+const STACK_IOU_RATIO = 0.9;
+const STACK_SIZE_RATIO = 0.9;
+const SIZE_BAND_BASE = 1 / STACK_SIZE_RATIO;
+const POSITION_CELL_RATIO = 0.1;
+const MAX_CLUSTER_COMPARISONS = 1_000_000;
+const MAX_CLUSTER_SURFACES = 50_000;
+
+export interface ClusterRenderedSurfaceOptions {
+  maxComparisons?: number;
+  maxSurfaces?: number;
+}
+
+interface IndexedGroup extends RenderedSurfaceGroup {
+  creationIndex: number;
+  indexKey: string;
+}
+
+function area(rect: Rect): number {
+  return Math.max(0, rect.w) * Math.max(0, rect.h);
+}
+
+function intersectionArea(a: Rect, b: Rect): number {
+  const width = Math.max(0, Math.min(a.x + a.w, b.x + b.w) - Math.max(a.x, b.x));
+  const height = Math.max(0, Math.min(a.y + a.h, b.y + b.h) - Math.max(a.y, b.y));
+  return width * height;
+}
+
+function stackScore(a: RenderedSurface, b: RenderedSurface): number | null {
+  const aArea = area(a.visibleRect);
+  const bArea = area(b.visibleRect);
+  const intersection = intersectionArea(a.visibleRect, b.visibleRect);
+  const union = aArea + bArea - intersection;
+  const widthRatio =
+    Math.min(a.visibleRect.w, b.visibleRect.w) / Math.max(a.visibleRect.w, b.visibleRect.w);
+  const heightRatio =
+    Math.min(a.visibleRect.h, b.visibleRect.h) / Math.max(a.visibleRect.h, b.visibleRect.h);
+  const iou = union > 0 ? intersection / union : 0;
+  return iou >= STACK_IOU_RATIO && widthRatio >= STACK_SIZE_RATIO && heightRatio >= STACK_SIZE_RATIO
+    ? iou
+    : null;
+}
+
+function sizeBand(value: number): number {
+  return Math.floor(Math.log(Math.max(Number.EPSILON, value)) / Math.log(SIZE_BAND_BASE));
+}
+
+function bandSize(band: number): number {
+  return SIZE_BAND_BASE ** band;
+}
+
+function spatialKey(rect: Rect): string {
+  const widthBand = sizeBand(rect.w);
+  const heightBand = sizeBand(rect.h);
+  const cellWidth = bandSize(widthBand) * POSITION_CELL_RATIO;
+  const cellHeight = bandSize(heightBand) * POSITION_CELL_RATIO;
+  const centerX = rect.x + rect.w / 2;
+  const centerY = rect.y + rect.h / 2;
+  return `${widthBand}:${heightBand}:${Math.floor(centerX / cellWidth)}:${Math.floor(centerY / cellHeight)}`;
+}
+
+function candidateKeys(rect: Rect): string[] {
+  const keys: string[] = [];
+  const centerX = rect.x + rect.w / 2;
+  const centerY = rect.y + rect.h / 2;
+  const widthBand = sizeBand(rect.w);
+  const heightBand = sizeBand(rect.h);
+  // A >=0.9 size ratio crosses at most one logarithmic band. IoU >=0.9
+  // likewise keeps centers within one 10%-of-size position cell.
+  for (let dw = -1; dw <= 1; dw += 1) {
+    for (let dh = -1; dh <= 1; dh += 1) {
+      const candidateWidthBand = widthBand + dw;
+      const candidateHeightBand = heightBand + dh;
+      const cellWidth = bandSize(candidateWidthBand) * POSITION_CELL_RATIO;
+      const cellHeight = bandSize(candidateHeightBand) * POSITION_CELL_RATIO;
+      const cellX = Math.floor(centerX / cellWidth);
+      const cellY = Math.floor(centerY / cellHeight);
+      for (let dx = -1; dx <= 1; dx += 1) {
+        for (let dy = -1; dy <= 1; dy += 1) {
+          keys.push(`${candidateWidthBand}:${candidateHeightBand}:${cellX + dx}:${cellY + dy}`);
+        }
+      }
+    }
+  }
+  return keys;
+}
+
+function preferredRepresentative(a: RenderedSurface, b: RenderedSurface): RenderedSurface {
+  const aArea = area(a.visibleRect);
+  const bArea = area(b.visibleRect);
+  return bArea > aArea || (bArea === aArea && b.paintOrder > a.paintOrder) ? b : a;
+}
+
+function partitionKey(surface: RenderedSurface): string {
+  return `${surface.frameId}\u0000${surface.parentBackendNodeId ?? "root"}`;
+}
+
+function siftWorstUp(heap: RenderedSurface[], start: number): void {
+  let index = start;
+  while (index > 0) {
+    const parent = Math.floor((index - 1) / 2);
+    if (compareVisualSurfacePriority(heap[index], heap[parent]) <= 0) break;
+    [heap[index], heap[parent]] = [heap[parent], heap[index]];
+    index = parent;
+  }
+}
+
+function siftWorstDown(heap: RenderedSurface[], start: number): void {
+  let index = start;
+  while (true) {
+    const left = index * 2 + 1;
+    if (left >= heap.length) return;
+    const right = left + 1;
+    let worst = left;
+    if (right < heap.length && compareVisualSurfacePriority(heap[right], heap[left]) > 0) {
+      worst = right;
+    }
+    if (compareVisualSurfacePriority(heap[worst], heap[index]) <= 0) return;
+    [heap[index], heap[worst]] = [heap[worst], heap[index]];
+    index = worst;
+  }
+}
+
+function highestPrioritySurfaces(
+  surfaces: readonly RenderedSurface[],
+  limit: number,
+): RenderedSurface[] {
+  if (limit <= 0) return [];
+  if (surfaces.length <= limit) return [...surfaces].sort(compareVisualSurfacePriority);
+  const heap: RenderedSurface[] = [];
+  for (const surface of surfaces) {
+    if (heap.length < limit) {
+      heap.push(surface);
+      siftWorstUp(heap, heap.length - 1);
+    } else if (compareVisualSurfacePriority(surface, heap[0]) < 0) {
+      heap[0] = surface;
+      siftWorstDown(heap, 0);
+    }
+  }
+  return heap.sort(compareVisualSurfacePriority);
+}
+
+function normalizedLimit(value: number | undefined, fallback: number): number {
+  const resolved = value ?? fallback;
+  return Number.isFinite(resolved) ? Math.max(0, Math.floor(resolved)) : fallback;
+}
+
+export function clusterRenderedSurfaces(
+  surfaces: RenderedSurface[],
+  options: ClusterRenderedSurfaceOptions = {},
+): ClusteredRenderedSurfaces {
+  const maxComparisons = normalizedLimit(options.maxComparisons, MAX_CLUSTER_COMPARISONS);
+  const maxSurfaces = normalizedLimit(options.maxSurfaces, MAX_CLUSTER_SURFACES);
+  const prioritized = highestPrioritySurfaces(surfaces, maxSurfaces);
+  const partitions = new Map<string, Map<string, Set<IndexedGroup>>>();
+  const groups: IndexedGroup[] = [];
+  let comparisons = 0;
+  let processed = 0;
+  let truncated = prioritized.length < surfaces.length;
+  let comparisonLimitReached = false;
+
+  for (const surface of prioritized) {
+    if (comparisons >= maxComparisons) {
+      truncated = true;
+      break;
+    }
+    const key = partitionKey(surface);
+    let index = partitions.get(key);
+    if (!index) {
+      index = new Map();
+      partitions.set(key, index);
+    }
+    const candidates = new Set<IndexedGroup>();
+    for (const candidateKey of candidateKeys(surface.visibleRect)) {
+      for (const candidate of index.get(candidateKey) ?? []) candidates.add(candidate);
+    }
+
+    let best: { group: IndexedGroup; score: number; areaDelta: number } | null = null;
+    for (const group of candidates) {
+      if (comparisons >= maxComparisons) {
+        truncated = true;
+        comparisonLimitReached = true;
+        break;
+      }
+      comparisons += 1;
+      const score = stackScore(group.representative, surface);
+      if (score === null) continue;
+      const areaDelta = Math.abs(
+        area(group.representative.visibleRect) - area(surface.visibleRect),
+      );
+      if (
+        !best ||
+        score > best.score ||
+        (score === best.score && areaDelta < best.areaDelta) ||
+        (score === best.score &&
+          areaDelta === best.areaDelta &&
+          group.creationIndex < best.group.creationIndex)
+      ) {
+        best = { group, score, areaDelta };
+      }
+    }
+    if (comparisonLimitReached) break;
+
+    if (best) {
+      const group = best.group;
+      const representative = preferredRepresentative(group.representative, surface);
+      group.memberCount += 1;
+      group.label ??= surface.label;
+      if (representative !== group.representative) {
+        index.get(group.indexKey)?.delete(group);
+        group.representative = representative;
+        group.indexKey = spatialKey(representative.visibleRect);
+        const indexed = index.get(group.indexKey) ?? new Set<IndexedGroup>();
+        indexed.add(group);
+        index.set(group.indexKey, indexed);
+      }
+      processed += 1;
+      continue;
+    }
+
+    const indexKey = spatialKey(surface.visibleRect);
+    const group: IndexedGroup = {
+      frameId: surface.frameId,
+      parentBackendNodeId: surface.parentBackendNodeId,
+      representative: surface,
+      ...(surface.label ? { label: surface.label } : {}),
+      memberCount: 1,
+      creationIndex: groups.length,
+      indexKey,
+    };
+    groups.push(group);
+    const indexed = index.get(indexKey) ?? new Set<IndexedGroup>();
+    indexed.add(group);
+    index.set(indexKey, indexed);
+    processed += 1;
+  }
+
+  return {
+    groups: groups
+      .map(({ creationIndex: _creationIndex, indexKey: _indexKey, ...group }) => group)
+      .sort(
+        (a, b) =>
+          a.frameId.localeCompare(b.frameId) ||
+          a.representative.visibleRect.y - b.representative.visibleRect.y ||
+          a.representative.visibleRect.x - b.representative.visibleRect.x,
+      ),
+    truncated,
+    ...(truncated ? { omittedCount: surfaces.length - processed } : {}),
+  };
+}

apps/extension/src/tools/vom/rendered-surfaces/discovery.ts

@@ -0,0 +1,113 @@
+import type { Rect, Viewport } from "@browser-skill/vom";
+import type { CapturedNode } from "../capture";
+import type { CapturedFrameDocument } from "../frame-capture";
+import type { SemanticAxNode } from "../semantic-graph";
+import type { RenderedSurface } from "./types";
+
+function clean(value: string | undefined): string | undefined {
+  const normalized = value?.replace(/\s+/g, " ").trim();
+  return normalized || undefined;
+}
+
+function intersectViewport(rect: Rect, viewport: Viewport): Rect | null {
+  return intersectRect(rect, { x: 0, y: 0, w: viewport.width, h: viewport.height });
+}
+
+function intersectRect(a: Rect, b: Rect): Rect | null {
+  const x = Math.max(a.x, b.x);
+  const y = Math.max(a.y, b.y);
+  const right = Math.min(a.x + a.w, b.x + b.w);
+  const bottom = Math.min(a.y + a.h, b.y + b.h);
+  if (right <= x || bottom <= y) return null;
+  return { x, y, w: right - x, h: bottom - y };
+}
+
+const CLIPPING_OVERFLOW = new Set(["auto", "clip", "hidden", "scroll"]);
+
+function clipToOverflowAncestors(
+  node: CapturedNode,
+  rect: Rect,
+  nodesByBackend: ReadonlyMap<number, CapturedNode>,
+): Rect | null {
+  let clipped: Rect | null = rect;
+  let parentBackendNodeId = node.parentBackendNodeId;
+  let guard = 0;
+  while (clipped && parentBackendNodeId !== null && guard <= nodesByBackend.size) {
+    const parent = nodesByBackend.get(parentBackendNodeId);
+    if (!parent) break;
+    if (parent.rect) {
+      const clipX = CLIPPING_OVERFLOW.has(parent.overflowX ?? "visible");
+      const clipY = CLIPPING_OVERFLOW.has(parent.overflowY ?? "visible");
+      if (clipX || clipY) {
+        const clipRect = {
+          x: clipX ? parent.rect.x : clipped.x,
+          y: clipY ? parent.rect.y : clipped.y,
+          w: clipX ? parent.rect.w : clipped.w,
+          h: clipY ? parent.rect.h : clipped.h,
+        };
+        clipped = intersectRect(clipped, clipRect);
+      }
+    }
+    parentBackendNodeId = parent.parentBackendNodeId;
+    guard += 1;
+  }
+  return clipped;
+}
+
+function excludedByDomPolicy(
+  node: CapturedNode,
+  nodesByBackend: Map<number, CapturedNode>,
+  excludedBackendNodeIds: ReadonlySet<number>,
+): boolean {
+  let current: CapturedNode | undefined = node;
+  let guard = 0;
+  while (current && guard <= nodesByBackend.size) {
+    if (excludedBackendNodeIds.has(current.backendNodeId)) return true;
+    if (current.visuallySuppressed === true) return true;
+    const attrs = current.attrs;
+    if (
+      Object.prototype.hasOwnProperty.call(attrs, "hidden") ||
+      Object.prototype.hasOwnProperty.call(attrs, "inert") ||
+      (attrs["aria-hidden"] ?? "").toLowerCase() === "true"
+    ) {
+      return true;
+    }
+    current =
+      current.parentBackendNodeId === null
+        ? undefined
+        : nodesByBackend.get(current.parentBackendNodeId);
+    guard += 1;
+  }
+  return false;
+}
+
+export function discoverRenderedSurfaces(
+  documents: CapturedFrameDocument<SemanticAxNode>[],
+  viewport: Viewport,
+  excludedBackendNodeIds: ReadonlySet<number> = new Set(),
+): RenderedSurface[] {
+  const surfaces: RenderedSurface[] = [];
+  for (const document of documents) {
+    const nodesByBackend = new Map(document.domNodes.map((node) => [node.backendNodeId, node]));
+    for (const node of document.domNodes) {
+      if (node.tag.toLowerCase() !== "canvas" || node.rendered !== true || !node.rect) continue;
+      if (excludedByDomPolicy(node, nodesByBackend, excludedBackendNodeIds)) continue;
+      const viewportRect = intersectViewport(node.rect, viewport);
+      const visibleRect = viewportRect
+        ? clipToOverflowAncestors(node, viewportRect, nodesByBackend)
+        : null;
+      if (!visibleRect) continue;
+      const label = clean(node.attrs["aria-label"] ?? node.attrs.title);
+      surfaces.push({
+        renderingKind: "canvas",
+        frameId: document.frameId,
+        backendNodeId: node.backendNodeId,
+        parentBackendNodeId: node.parentBackendNodeId,
+        visibleRect,
+        paintOrder: node.paintOrder,
+        ...(label ? { label } : {}),
+      });
+    }
+  }
+  return surfaces;
+}

apps/extension/src/tools/vom/rendered-surfaces/index.ts

@@ -0,0 +1,8 @@
+export { type ClusterRenderedSurfaceOptions, clusterRenderedSurfaces } from "./cluster";
+export { discoverRenderedSurfaces } from "./discovery";
+export { projectRenderedSurfaces } from "./project";
+export type {
+  ClusteredRenderedSurfaces,
+  RenderedSurface,
+  RenderedSurfaceGroup,
+} from "./types";

apps/extension/src/tools/vom/rendered-surfaces/project.ts

@@ -0,0 +1,108 @@
+import type { VomScene, VomVisualSurface } from "@browser-skill/vom";
+import type { CapturedFrameDocument } from "../frame-capture";
+import type { SemanticAxNode } from "../semantic-graph";
+import type { ClusteredRenderedSurfaces, RenderedSurfaceGroup } from "./types";
+
+function frameBackendKey(frameId: string, backendNodeId: number): string {
+  return `${frameId}\u0000${backendNodeId}`;
+}
+
+interface ProjectionIndex {
+  sceneByBackend: ReadonlyMap<string, number>;
+  documentByFrame: ReadonlyMap<string, CapturedFrameDocument<SemanticAxNode>>;
+  domByFrame: ReadonlyMap<
+    string,
+    ReadonlyMap<number, CapturedFrameDocument<SemanticAxNode>["domNodes"][number]>
+  >;
+  rootSceneIdByFrame: ReadonlyMap<string, number>;
+}
+
+function nearestSceneParent(index: ProjectionIndex, group: RenderedSurfaceGroup): number | null {
+  const document = index.documentByFrame.get(group.frameId);
+  const domByBackend = index.domByFrame.get(group.frameId) ?? new Map();
+  let parentBackendNodeId = group.representative.parentBackendNodeId;
+  let guard = 0;
+  while (parentBackendNodeId !== null && guard <= domByBackend.size) {
+    const sceneId = index.sceneByBackend.get(frameBackendKey(group.frameId, parentBackendNodeId));
+    if (sceneId !== undefined) return sceneId;
+    parentBackendNodeId = domByBackend.get(parentBackendNodeId)?.parentBackendNodeId ?? null;
+    guard += 1;
+  }
+
+  if (document?.parentFrameId && document.ownerBackendNodeId !== undefined) {
+    const owner = index.sceneByBackend.get(
+      frameBackendKey(document.parentFrameId, document.ownerBackendNodeId),
+    );
+    if (owner !== undefined) return owner;
+  }
+
+  return index.rootSceneIdByFrame.get(group.frameId) ?? null;
+}
+
+function buildProjectionIndex(
+  scene: VomScene,
+  documents: CapturedFrameDocument<SemanticAxNode>[],
+): ProjectionIndex {
+  const rootSceneIdByFrame = new Map<string, number>();
+  for (const node of scene.nodes) {
+    if (
+      node.frameId &&
+      !rootSceneIdByFrame.has(node.frameId) &&
+      ["rootwebarea", "webarea"].includes(node.role?.toLowerCase() ?? "")
+    ) {
+      rootSceneIdByFrame.set(node.frameId, node.id);
+    }
+  }
+  return {
+    sceneByBackend: new Map(
+      scene.nodes.flatMap((node) =>
+        node.backendNodeId === undefined
+          ? []
+          : [[frameBackendKey(node.frameId ?? "", node.backendNodeId), node.id] as const],
+      ),
+    ),
+    documentByFrame: new Map(documents.map((document) => [document.frameId, document])),
+    domByFrame: new Map(
+      documents.map((document) => [
+        document.frameId,
+        new Map(document.domNodes.map((node) => [node.backendNodeId, node])),
+      ]),
+    ),
+    rootSceneIdByFrame,
+  };
+}
+
+export function projectRenderedSurfaces(
+  scene: VomScene,
+  documents: CapturedFrameDocument<SemanticAxNode>[],
+  clustered: ClusteredRenderedSurfaces,
+): VomScene {
+  const index = buildProjectionIndex(scene, documents);
+  const visualSurfaces: VomVisualSurface[] = [];
+
+  for (const group of clustered.groups) {
+    const parentId = nearestSceneParent(index, group);
+    visualSurfaces.push({
+      parentId,
+      backendNodeId: group.representative.backendNodeId,
+      frameId: group.frameId,
+      renderingKind: "canvas",
+      visibleRect: group.representative.visibleRect,
+      ...(group.label ? { label: group.label } : {}),
+      memberCount: group.memberCount,
+    });
+  }
+
+  return {
+    ...scene,
+    ...(visualSurfaces.length > 0 ? { visualSurfaces } : {}),
+    ...(clustered.truncated
+      ? {
+          visualSurfacesTruncated: true,
+          ...(clustered.omittedCount !== undefined
+            ? { omittedVisualSurfaceCount: clustered.omittedCount }
+            : {}),
+        }
+      : {}),
+  };
+}

apps/extension/src/tools/vom/rendered-surfaces/types.ts

@@ -0,0 +1,25 @@
+import type { Rect } from "@browser-skill/vom";
+
+export interface RenderedSurface {
+  renderingKind: "canvas";
+  frameId: string;
+  backendNodeId: number;
+  parentBackendNodeId: number | null;
+  visibleRect: Rect;
+  paintOrder: number;
+  label?: string;
+}
+
+export interface RenderedSurfaceGroup {
+  frameId: string;
+  parentBackendNodeId: number | null;
+  representative: RenderedSurface;
+  label?: string;
+  memberCount: number;
+}
+
+export interface ClusteredRenderedSurfaces {
+  groups: RenderedSurfaceGroup[];
+  truncated: boolean;
+  omittedCount?: number;
+}

apps/extension/src/tools/vom/semantic-graph/build.ts

@@ -61,9 +61,8 @@ export function buildSemanticGraph(input: BuildSemanticGraphInput): SemanticGrap
         dom,
         sourceOrder: index,
         excluded:
-          document.excludedBackendNodeIds?.has(dom.backendNodeId) === true ||
-          (document.frameId === rootFrameId &&
-            input.excludedBackendNodeIds?.has(dom.backendNodeId) === true),
+          document.frameId === rootFrameId &&
+          input.excludedBackendNodeIds?.has(dom.backendNodeId) === true,
       };
       nodes.set(id, node);
       frameNodeIds.push(id);
@@ -91,10 +90,9 @@ export function buildSemanticGraph(input: BuildSemanticGraphInput): SemanticGrap
           ax,
           sourceOrder: document.domNodes.length + index,
           excluded:
+            document.frameId === rootFrameId &&
             typeof ax.backendDOMNodeId === "number" &&
-            (document.excludedBackendNodeIds?.has(ax.backendDOMNodeId) === true ||
-              (document.frameId === rootFrameId &&
-                input.excludedBackendNodeIds?.has(ax.backendDOMNodeId) === true)),
+            input.excludedBackendNodeIds?.has(ax.backendDOMNodeId) === true,
         });
         frameNodeIds.push(id);
       }

apps/extension/src/tools/vom/snapshot.ts

@@ -1,291 +0,0 @@
-import { type CdpFrame, type CdpTarget, cdpTargetKey } from "@/browser-driver/frame-graph";
-import { createCaptureCheckpoint } from "./capture-abort";
-import type { CapturedNode } from "./capture-types";
-import type { DecodedDocument, DecodedNode } from "./facts";
-export const REQUESTED_STYLES = [
-  "position",
-  "pointer-events",
-  "cursor",
-  "visibility",
-  "opacity",
-] as const;
-const STYLE_COL = Object.fromEntries(
-  REQUESTED_STYLES.map((name, index) => [name, index]),
-) as Record<(typeof REQUESTED_STYLES)[number], number>;
-/** Sparse array format Chrome uses for infrequently-set per-node fields. */
-interface SparseArray {
-  index: number[];
-  value: number[];
-}
-
-interface RareBooleanData {
-  index: number[];
-}
-
-export interface SnapshotDocument {
-  frameId?: string | number;
-  documentURL?: number;
-  scrollOffsetX?: number;
-  scrollOffsetY?: number;
-  nodes?: {
-    parentIndex?: number[];
-    nodeName?: number[];
-    nodeType?: number[];
-    backendNodeId?: number[];
-    attributes?: number[][];
-    /**
-     * Per-node text value (index into strings), set for `#text` / CDATA nodes.
-     * Element nodes carry -1. Same length as `backendNodeId`.
-     */
-    nodeValue?: number[];
-    /** Maps node array index → index into `documents[]` for frame content. */
-    contentDocumentIndex?: SparseArray;
-    inputValue?: SparseArray;
-    textValue?: SparseArray;
-    inputChecked?: RareBooleanData;
-    optionSelected?: RareBooleanData;
-  };
-  layout?: {
-    nodeIndex?: number[];
-    styles?: number[][];
-    bounds?: number[][];
-    paintOrders?: number[];
-  };
-}
-
-export function snapshotFrameId(document: SnapshotDocument, strings: string[]): string | undefined {
-  if (typeof document.frameId === "string") return document.frameId || undefined;
-  if (typeof document.frameId === "number") return str(strings, document.frameId) || undefined;
-  return undefined;
-}
-
-export interface SnapshotReply {
-  strings?: string[];
-  documents?: SnapshotDocument[];
-}
-
-function isSensitiveFormControl(node: Pick<CapturedNode, "tag" | "attrs">): boolean {
-  return node.tag === "input" && (node.attrs.type ?? "").toLowerCase() === "password";
-}
-
-function snapshotFormState(
-  value: string | undefined,
-  defaultValue: string,
-  hasDefaultValue: boolean,
-  sensitive: boolean,
-): CapturedNode["formState"] {
-  if (sensitive) {
-    if (value === undefined && !hasDefaultValue) return undefined;
-    return (value ?? defaultValue) === "" ? "empty" : "filled";
-  }
-  if (value === undefined) return undefined;
-  if (value === "") return "empty";
-  return value === defaultValue ? "default" : "filled";
-}
-
-function str(strings: string[], idx: number | undefined): string {
-  if (idx === undefined || idx < 0) return "";
-  return strings[idx] ?? "";
-}
-
-export function sparseIndexMap(sparse: SparseArray | undefined): Map<number, number> {
-  const out = new Map<number, number>();
-  if (!sparse?.index || !sparse.value) return out;
-  for (let i = 0; i < sparse.index.length; i++) {
-    const nodeIndex = sparse.index[i];
-    const docIndex = sparse.value[i];
-    if (nodeIndex !== undefined && docIndex !== undefined) out.set(nodeIndex, docIndex);
-  }
-  return out;
-}
-
-export async function decodeDocument(
-  doc: SnapshotDocument,
-  strings: string[],
-  signal?: AbortSignal,
-): Promise<DecodedDocument> {
-  const checkpoint = createCaptureCheckpoint(signal);
-  const dn = doc.nodes;
-  const dl = doc.layout;
-  if (!dn?.backendNodeId) {
-    return { nodes: [] };
-  }
-
-  const count = dn.backendNodeId.length;
-  const layoutByNode = new Map<number, number>();
-  for (let i = 0; i < (dl?.nodeIndex?.length ?? 0); i++) {
-    if (i % 256 === 0) {
-      const pending = checkpoint();
-      if (pending) await pending;
-    }
-    layoutByNode.set(dl!.nodeIndex![i], i);
-  }
-
-  const inputValues = sparseIndexMap(dn.inputValue);
-  const textValues = sparseIndexMap(dn.textValue);
-  const checkedInputs = new Set(dn.inputChecked?.index ?? []);
-  const selectedOptions = new Set(dn.optionSelected?.index ?? []);
-
-  // Collect visible text from #text child nodes so element CapturedNodes
-  // carry a textContent value usable as a button/link label fallback.
-  // nodeValue is a parallel array: string index for text nodes, -1 otherwise.
-  const nodeTextContent = new Map<number, string[]>();
-  if (dn.nodeValue) {
-    for (let n = 0; n < count; n++) {
-      if (n % 256 === 0) {
-        const pending = checkpoint();
-        if (pending) await pending;
-      }
-      const nvIdx = dn.nodeValue[n] ?? -1;
-      if (nvIdx < 0) continue;
-      const text = str(strings, nvIdx).trim();
-      if (!text) continue;
-      const parentIdx = dn.parentIndex?.[n] ?? -1;
-      if (parentIdx >= 0) {
-        const existing = nodeTextContent.get(parentIdx);
-        if (existing) existing.push(text);
-        else nodeTextContent.set(parentIdx, [text]);
-      }
-    }
-  }
-
-  // Decode fields without assigning a coordinate projection or semantic policy.
-  const nodes: DecodedNode[] = [];
-  for (let n = 0; n < count; n++) {
-    if (n % 256 === 0) {
-      const pending = checkpoint();
-      if (pending) await pending;
-    }
-    const backendNodeId = dn.backendNodeId[n];
-    const parentIdx = dn.parentIndex?.[n] ?? -1;
-    const parentBackendNodeId = parentIdx >= 0 ? (dn.backendNodeId[parentIdx] ?? null) : null;
-    const tag = str(strings, dn.nodeName?.[n]).toLowerCase();
-
-    const attrs: Record<string, string> = {};
-    const pairs = dn.attributes?.[n] ?? [];
-    for (let a = 0; a + 1 < pairs.length; a += 2) {
-      attrs[str(strings, pairs[a]).toLowerCase()] = str(strings, pairs[a + 1]);
-    }
-
-    const li = layoutByNode.get(n);
-    const styleRow = li === undefined ? [] : (dl?.styles?.[li] ?? []);
-    const styles: Record<string, string> = {};
-    for (const name of REQUESTED_STYLES) styles[name] = str(strings, styleRow[STYLE_COL[name]]);
-    const layout =
-      li === undefined
-        ? undefined
-        : {
-            boundsSpace: "snapshot-document-layout" as const,
-            bounds: dl?.bounds?.[li],
-            styles,
-          };
-
-    const textContent = nodeTextContent.get(n)?.join(" ");
-
-    const rawFormValueIndex = tag === "textarea" ? textValues.get(n) : inputValues.get(n);
-    const rawFormValue =
-      rawFormValueIndex !== undefined ? str(strings, rawFormValueIndex) : undefined;
-    const sensitive = isSensitiveFormControl({ tag, attrs });
-    const formDefaultValue = attrs.value ?? "";
-    const formValue = sensitive ? undefined : rawFormValue;
-    const formState = snapshotFormState(
-      rawFormValue,
-      formDefaultValue,
-      Object.prototype.hasOwnProperty.call(attrs, "value"),
-      sensitive,
-    );
-    if (sensitive) delete attrs.value;
-
-    nodes.push({
-      backendNodeId,
-      nodeType: dn.nodeType?.[n],
-      parentBackendNodeId,
-
-      tag,
-      attrs,
-      layout,
-      paintOrder: li === undefined ? 0 : (dl?.paintOrders?.[li] ?? 0),
-      position: styles.position || "static",
-      pointerEvents: styles["pointer-events"] || "auto",
-      cursor: styles.cursor || "auto",
-
-      textContent,
-      ...(formValue !== undefined ? { formValue } : {}),
-      ...(tag === "input" || tag === "textarea"
-        ? {
-            formPlaceholder: attrs.placeholder ?? "",
-            ...(!sensitive ? { formDefaultValue } : {}),
-            ...(formState ? { formState } : {}),
-          }
-        : {}),
-      ...(checkedInputs.has(n) ? { formValue: "true", formState: "filled" } : {}),
-      ...(selectedOptions.has(n) ? { formValue: attrs.value ?? textContent ?? "" } : {}),
-    });
-  }
-  return { nodes };
-}
-
-/** Snapshot membership and same-target edges are current response evidence.
- * The earlier graph only supplies compatible metadata and cross-target edges. */
-export function describeSnapshotFrames(
-  snapshot: SnapshotReply,
-  target: CdpTarget,
-  hintById: ReadonlyMap<string, CdpFrame>,
-  pageUrl?: string,
-): { frames: CdpFrame[]; ids: Set<string>; rootFrameId?: string } {
-  const raw = snapshot.documents ?? [];
-  const strings = snapshot.strings ?? [];
-  const ids = new Set<string>();
-  const invalid = new Set<string>();
-  const frames = raw.map((doc) => {
-    const frameId = snapshotFrameId(doc, strings);
-    if (!frameId) return undefined;
-    if (ids.has(frameId)) invalid.add(frameId);
-    ids.add(frameId);
-    const hint = hintById.get(frameId);
-    const compatible =
-      hint && cdpTargetKey(hint.target) === cdpTargetKey(target) ? hint : undefined;
-    const url =
-      (doc.documentURL === undefined ? undefined : strings[doc.documentURL]) || compatible?.url;
-    return { frameId, target, ...(url ? { url } : {}) } as CdpFrame;
-  });
-  const root = frames[0];
-  if (root) {
-    const hint = hintById.get(root.frameId);
-    const parent = hint?.parentFrameId ? hintById.get(hint.parentFrameId) : undefined;
-    if (
-      target.sessionId &&
-      hint &&
-      cdpTargetKey(hint.target) === cdpTargetKey(target) &&
-      parent &&
-      cdpTargetKey(parent.target) !== cdpTargetKey(target)
-    ) {
-      root.parentFrameId = parent.frameId;
-      root.ownerBackendNodeId = hint.ownerBackendNodeId;
-    }
-    if (!target.sessionId && !root.url && pageUrl) root.url = pageUrl;
-  }
-  const owned = new Set<string>();
-  for (let i = 0; i < raw.length; i++) {
-    const edges = raw[i].nodes?.contentDocumentIndex;
-    const parent = frames[i];
-    if (!parent || !edges) continue;
-    for (let e = 0; e < edges.index.length; e++) {
-      const child = frames[edges.value[e]];
-      const owner = raw[i].nodes?.backendNodeId?.[edges.index[e]];
-      if (!child || owner === undefined) continue;
-      if (child === root || child === parent || owned.has(child.frameId)) {
-        invalid.add(child.frameId);
-        continue;
-      }
-      owned.add(child.frameId);
-      child.parentFrameId = parent.frameId;
-      child.ownerBackendNodeId = owner;
-    }
-  }
-  return {
-    frames: frames.filter((frame): frame is CdpFrame => !!frame && !invalid.has(frame.frameId)),
-    ids,
-    rootFrameId: root?.frameId,
-  };
-}

apps/extension/src/transport/types.ts

@@ -23,6 +23,7 @@ export type ErrorCode =
 export type RpcErrorReason =
   | "agent_window_scope"
   | "element_not_visible"
+  | "ref_capability_denied"
   | "ref_not_found"
   | "selector_not_found"
   | "target_not_fillable"
@@ -470,59 +471,6 @@ export interface HoverResult {
   dialogs?: JavaScriptDialogInfo[];
 }
 
-export interface ScrollToParams {
-  session_id: string;
-  ref?: string;
-  selector?: string;
-  tab_id?: number;
-  timeout_ms?: number;
-}
-
-export interface ScrollToResult {
-  tab_id: number;
-  used_ref?: string;
-  used_selector?: string;
-  /** Clipped border-box bounds in top-level viewport CSS pixels; not an occlusion test. */
-  x: number;
-  y: number;
-  width: number;
-  height: number;
-  dialogs?: JavaScriptDialogInfo[];
-}
-
-export interface FocusParams {
-  session_id: string;
-  ref?: string;
-  selector?: string;
-  tab_id?: number;
-  timeout_ms?: number;
-}
-
-export interface FocusResult {
-  tab_id: number;
-  used_ref?: string;
-  used_selector?: string;
-  focused: boolean;
-  dialogs?: JavaScriptDialogInfo[];
-}
-
-export interface BlurParams {
-  session_id: string;
-  ref?: string;
-  selector?: string;
-  tab_id?: number;
-  timeout_ms?: number;
-}
-
-export interface BlurResult {
-  tab_id: number;
-  used_ref?: string;
-  used_selector?: string;
-  was_focused: boolean;
-  focused: boolean;
-  dialogs?: JavaScriptDialogInfo[];
-}
-
 export interface FillParams {
   session_id: string;
   value: string;

apps/extension/test-fixtures/rendered-surfaces/README.md

@@ -0,0 +1,110 @@
+# Rendered Surface browser fixtures
+
+These pages exercise Canvas discovery through a real browser DOMSnapshot and AX tree. They are deliberately framework- and site-independent.
+
+## Serve
+
+From the repository root:
+
+```bash
+python3 -m http.server 4173 --bind 127.0.0.1 \
+  --directory apps/extension/test-fixtures/rendered-surfaces
+```
+
+Use an Agent Window large enough to keep the primary matrix visible:
+
+```bash
+bsk session start --width 1440 --height 1100
+bsk navigate http://127.0.0.1:4173/index.html --session <id>
+bsk observe --session <id>
+```
+
+Always stop the session after the run.
+
+## Pages
+
+### `index.html`
+
+Expected individual Surface labels:
+
+- `fixture-basic-large`
+- `fixture-tiny-8px`
+- `fixture-pointer-events-none`
+- `fixture-partial-ax`
+- `fixture-contained-outer`
+- `fixture-contained-inner`
+- `fixture-different-parent-a`
+- `fixture-different-parent-b`
+
+Expected one grouped Surface:
+
+- `fixture-layered-group`, with `layers=2`
+
+Expected absent:
+
+- `fixture-display-none`
+- `fixture-visibility-hidden`
+- `fixture-opacity-zero`
+- `fixture-parent-opacity-zero`
+- `fixture-hidden-attribute`
+- `fixture-inert-parent`
+- `fixture-aria-hidden-parent`
+- `fixture-zero-size`
+- `fixture-offscreen-right`
+- `fixture-fully-overflow-clipped`
+
+`fixture-partially-overflow-clipped` must remain present because part of it is visible. Its screenshot must contain only the browser's final composited view.
+
+### `unlabeled.html`
+
+This page contains eight Canvas elements but must render seven generic Surface markers because
+the two coincident layers form one group.
+
+- Every marker uses the stable fallback label `canvas visual surface`.
+- Exactly one marker has `layers=2`.
+- The two contained canvases remain separate markers.
+- `id`, `class`, `data-testid`, nearby prose, and fallback AX content never become a Surface label.
+- Blank `aria-label` and `title` values behave as no label.
+- Fallback AX content does not suppress the corresponding Surface.
+
+### `frames.html`
+
+Expected Surface labels:
+
+- `fixture-same-origin-frame`
+- `fixture-cross-origin-frame`
+- `fixture-nested-frame`
+
+The cross-origin frame uses `http://localhost:4173` while the parent uses `http://127.0.0.1:4173`. With Chromium site isolation this exercises the OOPIF path without an external service.
+
+### `viewport.html`
+
+Run with a `900x700` Agent Window.
+
+- `fixture-partial-viewport` is partly visible and must be represented.
+- `fixture-below-fold` is absent initially.
+- After scrolling it into view and observing again, `fixture-below-fold` must be represented with a fresh ref.
+
+### `dynamic.html`
+
+Use the normal DOM buttons and re-observe after each action:
+
+- Initial state: `fixture-dynamic` absent.
+- After **Insert canvas**: present.
+- After **Resize to zero**: absent.
+- After **Restore size**: present with a fresh ref.
+- After **Remove canvas**: absent.
+
+### `sparklines.html`
+
+Expected Surface labels `fixture-sparkline-01` through `fixture-sparkline-20` must all be present.
+The adjacent, non-overlapping canvases remain twenty independent screenshot-only Surface refs.
+
+## Invariants
+
+- `snapshot` must not emit any of these Surface markers.
+- `observe` must emit only currently visible Canvas surfaces.
+- Existing DOM/AX controls remain readable alongside Surface markers.
+- Missing labels never prevent discovery; naming and discovery are independent.
+- A Surface ref allows `screenshot --ref` and rejects ordinary click/fill/hover/select.
+- No fixture URL, id, label, or layout constant may appear in production discovery code.

apps/extension/test-fixtures/rendered-surfaces/dynamic.html

@@ -0,0 +1,46 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Rendered Surface dynamic matrix</title>
+    <style>
+      html, body { margin: 0; font: 14px system-ui, sans-serif; }
+      body { padding: 16px; }
+      .controls { display: flex; gap: 8px; margin-bottom: 16px; }
+      button { padding: 8px 12px; }
+      canvas { display: block; width: 260px; height: 120px; background: #e8daef; border: 2px solid #7d3c98; }
+    </style>
+  </head>
+  <body>
+    <h1>Dynamic Canvas lifecycle</h1>
+    <div class="controls">
+      <button id="insert" type="button">Insert canvas</button>
+      <button id="zero" type="button">Resize to zero</button>
+      <button id="restore" type="button">Restore size</button>
+      <button id="remove" type="button">Remove canvas</button>
+    </div>
+    <div id="mount"></div>
+    <script>
+      const mount = document.querySelector("#mount");
+      const getCanvas = () => mount.querySelector("canvas");
+      document.querySelector("#insert").addEventListener("click", () => {
+        if (getCanvas()) return;
+        const canvas = document.createElement("canvas");
+        canvas.width = 260;
+        canvas.height = 120;
+        canvas.setAttribute("aria-label", "fixture-dynamic");
+        mount.append(canvas);
+      });
+      document.querySelector("#zero").addEventListener("click", () => {
+        const canvas = getCanvas();
+        if (canvas) canvas.style.cssText = "width:0;height:0;border:0";
+      });
+      document.querySelector("#restore").addEventListener("click", () => {
+        const canvas = getCanvas();
+        if (canvas) canvas.removeAttribute("style");
+      });
+      document.querySelector("#remove").addEventListener("click", () => getCanvas()?.remove());
+    </script>
+  </body>
+</html>

apps/extension/test-fixtures/rendered-surfaces/frame.html

@@ -0,0 +1,28 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <style>
+      html, body { margin: 0; font: 14px system-ui, sans-serif; }
+      body { padding: 12px; background: #fdfefe; }
+      canvas { display: block; width: 220px; height: 90px; background: #d5f5e3; border: 2px solid #1e8449; }
+      iframe { width: 280px; height: 150px; margin-top: 10px; border: 2px solid #85929e; }
+    </style>
+  </head>
+  <body>
+    <canvas id="frame-canvas" width="220" height="90"></canvas>
+    <script>
+      const params = new URLSearchParams(location.search);
+      const canvas = document.querySelector("#frame-canvas");
+      if (params.get("canvas") === "0") canvas.remove();
+      else canvas.setAttribute("aria-label", params.get("label") || "fixture-frame-default");
+      if (params.get("nested") === "1") {
+        const iframe = document.createElement("iframe");
+        iframe.title = "nested fixture frame";
+        iframe.src = "frame.html?label=fixture-nested-frame";
+        document.body.append(iframe);
+      }
+    </script>
+  </body>
+</html>

apps/extension/test-fixtures/rendered-surfaces/frames.html

@@ -0,0 +1,22 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Rendered Surface frame matrix</title>
+    <style>
+      html, body { margin: 0; font: 14px system-ui, sans-serif; }
+      body { padding: 16px; }
+      .frames { display: grid; grid-template-columns: repeat(3, 320px); gap: 16px; }
+      iframe { width: 300px; height: 300px; border: 2px solid #5d6d7e; }
+    </style>
+  </head>
+  <body>
+    <h1>Frame matrix</h1>
+    <div class="frames">
+      <iframe title="same-origin fixture" src="frame.html?label=fixture-same-origin-frame"></iframe>
+      <iframe title="cross-origin fixture" src="http://localhost:4173/frame.html?label=fixture-cross-origin-frame"></iframe>
+      <iframe title="nested fixture" src="frame.html?canvas=0&nested=1"></iframe>
+    </div>
+  </body>
+</html>

apps/extension/test-fixtures/rendered-surfaces/index.html

@@ -0,0 +1,118 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Rendered Surface discovery matrix</title>
+    <style>
+      * { box-sizing: border-box; }
+      html, body { margin: 0; min-height: 100%; font: 14px/1.4 system-ui, sans-serif; }
+      body { padding: 16px; background: #f4f6f8; color: #17202a; }
+      h1 { margin: 0 0 12px; font-size: 20px; }
+      .matrix { display: grid; grid-template-columns: repeat(4, minmax(220px, 1fr)); gap: 12px; }
+      .case { min-height: 150px; padding: 10px; overflow: hidden; border: 1px solid #aeb6bf; border-radius: 6px; background: white; }
+      .case h2 { margin: 0 0 8px; font-size: 13px; }
+      canvas { display: block; background: #d6eaf8; border: 2px solid #2874a6; }
+      .stack { position: relative; width: 180px; height: 90px; }
+      .stack canvas { position: absolute; inset: 0; width: 180px; height: 90px; }
+      .stack canvas + canvas { background: rgb(244 208 63 / 45%); border-color: #b7950b; }
+      .contained { position: relative; width: 190px; height: 100px; }
+      .contained > canvas:first-child { width: 190px; height: 100px; }
+      .contained > canvas:last-child { position: absolute; left: 55px; top: 30px; width: 70px; height: 40px; background: #fadbd8; border-color: #c0392b; }
+      .same-place { position: relative; width: 180px; height: 90px; }
+      .same-place > div { position: absolute; inset: 0; }
+      .same-place canvas { width: 180px; height: 90px; }
+      .same-place > div:last-child canvas { border-color: #7d3c98; background: rgb(210 180 222 / 35%); }
+      .clip-box { width: 100px; height: 70px; overflow: hidden; border: 2px dashed #566573; }
+      .partially-clipped { width: 140px; height: 60px; transform: translateX(45px); }
+      .fully-clipped { width: 80px; height: 50px; transform: translateX(130px); }
+      .tiny { width: 8px; height: 8px; border-width: 1px; }
+    </style>
+  </head>
+  <body>
+    <h1>Rendered Surface discovery matrix</h1>
+    <main class="matrix">
+      <section class="case">
+        <h2>Visible named canvas</h2>
+        <canvas aria-label="fixture-basic-large" width="200" height="90"></canvas>
+      </section>
+
+      <section class="case">
+        <h2>Tiny canvas remains addressable</h2>
+        <canvas class="tiny" aria-label="fixture-tiny-8px" width="8" height="8"></canvas>
+      </section>
+
+      <section class="case">
+        <h2>Visible but pointer-events none</h2>
+        <canvas aria-label="fixture-pointer-events-none" width="180" height="80" style="pointer-events: none"></canvas>
+      </section>
+
+      <section class="case">
+        <h2>Partial AX/fallback content</h2>
+        <canvas aria-label="fixture-partial-ax" width="180" height="80">
+          <button type="button">Fallback button must not suppress the surface</button>
+        </canvas>
+      </section>
+
+      <section class="case">
+        <h2>Two real rendering layers</h2>
+        <div class="stack">
+          <canvas aria-label="fixture-layered-group" width="180" height="90"></canvas>
+          <canvas width="180" height="90"></canvas>
+        </div>
+      </section>
+
+      <section class="case">
+        <h2>Contained canvases are independent</h2>
+        <div class="contained">
+          <canvas aria-label="fixture-contained-outer" width="190" height="100"></canvas>
+          <canvas aria-label="fixture-contained-inner" width="70" height="40"></canvas>
+        </div>
+      </section>
+
+      <section class="case">
+        <h2>Same geometry, different parents</h2>
+        <div class="same-place">
+          <div><canvas aria-label="fixture-different-parent-a" width="180" height="90"></canvas></div>
+          <div><canvas aria-label="fixture-different-parent-b" width="180" height="90"></canvas></div>
+        </div>
+      </section>
+
+      <section class="case">
+        <h2>Partially overflow-clipped</h2>
+        <div class="clip-box">
+          <canvas class="partially-clipped" aria-label="fixture-partially-overflow-clipped" width="140" height="60"></canvas>
+        </div>
+      </section>
+
+      <section class="case">
+        <h2>Fully overflow-clipped</h2>
+        <div class="clip-box">
+          <canvas class="fully-clipped" aria-label="fixture-fully-overflow-clipped" width="80" height="50"></canvas>
+        </div>
+      </section>
+
+      <section class="case">
+        <h2>CSS-hidden variants</h2>
+        <canvas aria-label="fixture-display-none" width="80" height="40" style="display: none"></canvas>
+        <canvas aria-label="fixture-visibility-hidden" width="80" height="40" style="visibility: hidden"></canvas>
+        <canvas aria-label="fixture-opacity-zero" width="80" height="40" style="opacity: 0"></canvas>
+      </section>
+
+      <section class="case">
+        <h2>Hidden ancestor variants</h2>
+        <div style="opacity: 0"><canvas aria-label="fixture-parent-opacity-zero" width="80" height="40"></canvas></div>
+        <div hidden><canvas aria-label="fixture-hidden-attribute" width="80" height="40"></canvas></div>
+        <div inert><canvas aria-label="fixture-inert-parent" width="80" height="40"></canvas></div>
+        <div aria-hidden="true"><canvas aria-label="fixture-aria-hidden-parent" width="80" height="40"></canvas></div>
+      </section>
+
+      <section class="case">
+        <h2>Zero-size and offscreen</h2>
+        <canvas aria-label="fixture-zero-size" width="80" height="40" style="width: 0; height: 0; border: 0"></canvas>
+        <canvas aria-label="fixture-offscreen-right" width="80" height="40" style="position: fixed; left: 5000px; top: 0"></canvas>
+      </section>
+    </main>
+  </body>
+</html>
+

apps/extension/test-fixtures/rendered-surfaces/sparklines.html

@@ -0,0 +1,28 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Rendered Surface sparkline matrix</title>
+    <style>
+      html, body { margin: 0; font: 14px system-ui, sans-serif; }
+      body { padding: 16px; }
+      main { display: grid; grid-template-columns: repeat(5, 120px); gap: 12px; }
+      canvas { display: block; width: 100px; height: 30px; background: #eaf2f8; }
+    </style>
+  </head>
+  <body>
+    <h1>Twenty independent sparklines</h1>
+    <main id="sparklines"></main>
+    <script>
+      const host = document.querySelector("#sparklines");
+      for (let index = 1; index <= 20; index += 1) {
+        const canvas = document.createElement("canvas");
+        canvas.width = 100;
+        canvas.height = 30;
+        canvas.setAttribute("aria-label", `fixture-sparkline-${String(index).padStart(2, "0")}`);
+        host.append(canvas);
+      }
+    </script>
+  </body>
+</html>

apps/extension/test-fixtures/rendered-surfaces/unlabeled.html

@@ -0,0 +1,68 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Unlabeled Rendered Surface matrix</title>
+    <style>
+      * { box-sizing: border-box; }
+      html, body { margin: 0; min-height: 100%; font: 14px/1.4 system-ui, sans-serif; }
+      body { padding: 16px; background: #f4f6f8; color: #17202a; }
+      h1 { margin: 0 0 12px; font-size: 20px; }
+      .matrix { display: grid; grid-template-columns: repeat(3, minmax(240px, 1fr)); gap: 12px; }
+      .case { min-height: 150px; padding: 10px; overflow: hidden; border: 1px solid #aeb6bf; border-radius: 6px; background: white; }
+      .case h2 { margin: 0 0 8px; font-size: 13px; }
+      .case p { margin: 0 0 8px; }
+      canvas { display: block; background: #d6eaf8; border: 2px solid #2874a6; }
+      .stack { position: relative; width: 180px; height: 90px; }
+      .stack canvas { position: absolute; inset: 0; width: 180px; height: 90px; }
+      .stack canvas + canvas { background: rgb(244 208 63 / 45%); border-color: #b7950b; }
+      .contained { position: relative; width: 190px; height: 100px; }
+      .contained > canvas:first-child { width: 190px; height: 100px; }
+      .contained > canvas:last-child { position: absolute; left: 55px; top: 30px; width: 70px; height: 40px; background: #fadbd8; border-color: #c0392b; }
+    </style>
+  </head>
+  <body>
+    <h1>Unlabeled Rendered Surface matrix</h1>
+    <main class="matrix">
+      <section class="case">
+        <h2>Only engineering attributes</h2>
+        <canvas id="must-not-be-a-label" class="must-not-be-a-label" data-testid="must-not-be-a-label" width="200" height="90"></canvas>
+      </section>
+
+      <section class="case">
+        <h2>Blank explicit names</h2>
+        <canvas aria-label="   " title="   " width="180" height="80"></canvas>
+      </section>
+
+      <section class="case">
+        <h2>Nearby prose is not a Canvas name</h2>
+        <p>must-not-be-inferred-as-a-surface-label</p>
+        <canvas width="180" height="80"></canvas>
+      </section>
+
+      <section class="case">
+        <h2>Fallback AX content does not name or suppress the Canvas</h2>
+        <canvas width="180" height="80">
+          <button type="button">Fallback control remains separate</button>
+        </canvas>
+      </section>
+
+      <section class="case">
+        <h2>Unnamed rendering layers still cluster</h2>
+        <div class="stack">
+          <canvas width="180" height="90"></canvas>
+          <canvas width="180" height="90"></canvas>
+        </div>
+      </section>
+
+      <section class="case">
+        <h2>Unnamed contained canvases stay independent</h2>
+        <div class="contained">
+          <canvas width="190" height="100"></canvas>
+          <canvas width="70" height="40"></canvas>
+        </div>
+      </section>
+    </main>
+  </body>
+</html>

apps/extension/test-fixtures/rendered-surfaces/viewport.html

@@ -0,0 +1,22 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Rendered Surface viewport matrix</title>
+    <style>
+      html, body { margin: 0; font: 14px system-ui, sans-serif; }
+      body { min-height: 1800px; padding: 16px; }
+      canvas { display: block; background: #fdebd0; border: 2px solid #ca6f1e; }
+      #partial { position: fixed; left: -70px; top: 120px; width: 180px; height: 100px; }
+      #below { position: absolute; left: 40px; top: 1350px; width: 240px; height: 120px; }
+    </style>
+  </head>
+  <body>
+    <h1>Viewport matrix</h1>
+    <p>The orange canvas on the left is intentionally clipped by the viewport.</p>
+    <canvas id="partial" aria-label="fixture-partial-viewport" width="180" height="100"></canvas>
+    <canvas id="below" aria-label="fixture-below-fold" width="240" height="120"></canvas>
+  </body>
+</html>
+

crates/bsk-cli/skill/SKILL.md

@@ -55,20 +55,10 @@ Use this default loop:
 ```text
 bsk navigate <url> --session <id>
 bsk observe --session <id>
-bsk click|hover|scroll-to|focus|blur|fill|select|press ... --session <id>
+bsk click|hover|fill|select|press ... --session <id>
 bsk observe --session <id>             # after navigation or a meaningful DOM change
 ```
 
-`bsk scroll-to <ref-or-selector> --session <id>` scrolls an element and its frame owners into view.
-Use a fresh element ref for iframe/shadow-root targets; CSS selectors search the main document.
-The result is the visible border-box portion's bounds in top-level viewport CSS pixels after
-ancestor clipping. Partial visibility is enough; hidden or fully clipped targets fail with
-`permission_denied` and `data.reason=element_not_visible`. This does not test occlusion by other elements.
-For a specific tab or deadline: `bsk scroll-to @e3 --session <id> --tab-id 42 --timeout 5s`.
-
-`bsk focus <ref>` explicitly focuses a target; `bsk blur <ref>` removes focus and reports whether
-it was focused. Use these for UI states triggered by focus changes.
-
 Prefer fresh `@eN` refs over CSS selectors. Navigation invalidates refs; large DOM changes may also
 make them stale. Observe again before the next interaction.
 
@@ -83,6 +73,16 @@ CSS-only hover menu looks like from here. It hovers a bounded set of likely trig
 few seconds and touches the live page; once you know which element hides the menu, `bsk hover <ref>`
 is cheaper and more precise.
 
+When `bsk observe` renders
+`@eN surface ... [visual-only; requires=image-understanding; ...]`, the ref identifies rendered
+canvas content that is not represented by the text observation, not an interactable DOM control.
+Keep using any reliable DOM/AX text and controls that appear alongside it. If you can actually
+inspect image output, use `bsk screenshot --ref @eN --session <id>` to obtain the visible crop. If
+you lack multimodal or image-reading capability, do not take a screenshot and pretend to know its
+contents, and never guess coordinates; tell the user that they need to switch to a model with
+image-understanding capability. Do not pass a visual surface ref to click, fill, hover, or select;
+those commands intentionally reject screenshot-only refs.
+
 Escalate page reading only as needed:
 
 1. `bsk observe` for normal semantic understanding, text, controls, and refs.
@@ -124,7 +124,7 @@ This list of names is complete. Never invent a command outside it; read
 session start|stop|list   browsers   status   doctor   update   logs
 navigate   navigate-back   navigate-forward   reload   wait-for-navigation   wait-ms
 observe   snapshot   get-html   screenshot   console   network
-click   hover   scroll-to   focus   blur   fill   select   press   evaluate
+click   hover   fill   select   press   evaluate
 tab list|create|close|select|borrow|return   window resize   emulate
 upload   download   request-help   record start|stop
 ```

crates/bsk-cli/src/cli/business_rpc.rs

@@ -73,14 +73,6 @@ where
     P: Serialize + Send + 'static,
     R: DeserializeOwned + Send + 'static,
 {
-    let parent_cancel = stdin_cancellation();
-    if parent_cancel.as_ref().is_some_and(|rx| *rx.borrow()) {
-        return Err(CliError::from_rpc(RpcError {
-            code: ErrorCode::Cancelled,
-            message: "parent closed the cancellation pipe".into(),
-            data: Some(serde_json::json!({"reason": "cancelled_before_dispatch"})),
-        }));
-    }
     let rpc_id: RpcId = format!("{}-{}", rpc_id_prefix, random_short_id());
     let mut client = IpcClient::connect(sock.clone()).await?;
     let rpc_id_for_call = rpc_id.clone();
@@ -96,16 +88,16 @@ where
     let outcome = tokio::select! {
         biased;
         res = &mut main_fut => res?,
-        sig = wait_for_cancel(parent_cancel) => {
-            sig.context("wait for cancellation").map_err(CliError::Local)?;
-            debug!(rpc_id = %rpc_id_for_cancel, "forwarding cancel to daemon");
+        sig = wait_for_sigint() => {
+            sig.context("install SIGINT handler").map_err(CliError::Local)?;
+            debug!(rpc_id = %rpc_id_for_cancel, "SIGINT: forwarding cancel to daemon");
             let _ = send_cancel(&sock, &rpc_id_for_cancel).await;
             match tokio::time::timeout(CANCEL_RESPONSE_GRACE, &mut main_fut).await {
                 Ok(res) => res?,
                 Err(_) => {
                     debug!(
                         rpc_id = %rpc_id_for_cancel,
-                        "cancel grace elapsed; synthesising cancelled error"
+                        "SIGINT: cancel grace elapsed; synthesising cancelled error"
                     );
                     return Err(CliError::from_rpc(RpcError {
                         code: ErrorCode::Cancelled,
@@ -120,46 +112,6 @@ where
     outcome.map_err(CliError::from_rpc)
 }
 
-/// Release caller-owned staging even after cancellation. This deliberately
-/// exposes only transfer.release, not a general bypass for business RPCs.
-/// The entire batch, including connection setup, shares one bounded budget.
-pub fn release_transfers<'a>(
-    sock: &Path,
-    transfer_ids: impl IntoIterator<Item = &'a str>,
-) -> Result<(), CliError> {
-    use bsk_protocol::tools::{TransferIdParams, TransferReleaseResult};
-    const CLEANUP_TIMEOUT: Duration = Duration::from_secs(5);
-    let ids: Vec<_> = transfer_ids.into_iter().collect();
-    if ids.is_empty() {
-        return Ok(());
-    }
-    let rt = tokio::runtime::Builder::new_current_thread()
-        .enable_all()
-        .build()
-        .context("build runtime for transfer cleanup")?;
-    rt.block_on(async {
-        tokio::time::timeout(CLEANUP_TIMEOUT, async {
-            let mut client = IpcClient::connect(sock).await?;
-            for id in ids {
-                client
-                    .call::<_, TransferReleaseResult>(
-                        "transfer-release",
-                        Method::TransferRelease,
-                        Some(TransferIdParams {
-                            transfer_id: id.to_string(),
-                        }),
-                        CLEANUP_TIMEOUT,
-                    )
-                    .await?
-                    .map_err(CliError::from_rpc)?;
-            }
-            Ok::<_, CliError>(())
-        })
-        .await
-        .context("transfer cleanup exceeded its total time budget")?
-    })
-}
-
 /// Send a `cancel { rpc_id }` frame over a fresh connection so it
 /// lands on the daemon while the original call is still parked.
 ///
@@ -194,57 +146,8 @@ fn random_short_id() -> String {
     bytes.iter().map(|b| format!("{b:02x}")).collect()
 }
 
-/// Opt-in control pipe for parent processes that cannot send Ctrl-C (Node on
-/// Windows). One reader survives the short-lived runtimes used by multi-RPC
-/// commands such as upload. Ordinary CLI stdin and terminal Ctrl-C are unchanged.
-fn stdin_cancellation() -> Option<tokio::sync::watch::Receiver<bool>> {
-    if std::env::var("BSK_CANCEL_ON_STDIN_CLOSE").as_deref() != Ok("1") {
-        return None;
-    }
-    static CANCEL: std::sync::OnceLock<tokio::sync::watch::Receiver<bool>> =
-        std::sync::OnceLock::new();
-    Some(
-        CANCEL
-            .get_or_init(|| {
-                let (tx, rx) = tokio::sync::watch::channel(false);
-                std::thread::spawn(move || {
-                    use std::io::Read;
-                    let mut stdin = std::io::stdin().lock();
-                    let mut buf = [0; 64];
-                    loop {
-                        match stdin.read(&mut buf) {
-                            Ok(0) => break,
-                            Ok(_) => {}
-                            Err(err) if err.kind() == std::io::ErrorKind::Interrupted => continue,
-                            Err(_) => break,
-                        }
-                    }
-                    let _ = tx.send(true);
-                });
-                rx
-            })
-            .clone(),
-    )
-}
-
-async fn wait_for_cancel(
-    parent_cancel: Option<tokio::sync::watch::Receiver<bool>>,
-) -> anyhow::Result<()> {
-    let parent_closed = async move {
-        match parent_cancel {
-            Some(mut rx) => {
-                let _ = rx.wait_for(|closed| *closed).await;
-            }
-            None => std::future::pending::<()>().await,
-        }
-    };
-    tokio::select! {
-        result = wait_for_sigint() => result,
-        _ = parent_closed => Ok(()),
-    }
-}
-
-/// Wait for terminal Ctrl-C.
+/// Wait for either Ctrl-C or process SIGTERM. Returning here means
+/// the user has asked us to stop.
 async fn wait_for_sigint() -> anyhow::Result<()> {
     tokio::signal::ctrl_c().await.context("listen for SIGINT")?;
     Ok(())

crates/bsk-cli/src/cli/download.rs

@@ -9,7 +9,8 @@ use anyhow::Context;
 use base64::Engine;
 use bsk_protocol::Method;
 use bsk_protocol::tools::{
-    DownloadParams, DownloadResult, TransferChunkParams, TransferChunkResult,
+    DownloadParams, DownloadResult, TransferChunkParams, TransferChunkResult, TransferIdParams,
+    TransferReleaseResult,
 };
 use clap::Args;
 use uuid::Uuid;
@@ -69,7 +70,13 @@ pub fn dispatch(args: DownloadArgs, format: Format) -> Result<(), CliError> {
         CliError::Local(anyhow::anyhow!("daemon returned no download transfer id"))
     })?;
     let write_result = write_transfer(&info.sock_path, &transfer_id, &args.out, args.overwrite);
-    let _ = crate::cli::business_rpc::release_transfers(&info.sock_path, [transfer_id.as_str()]);
+    let _: Result<TransferReleaseResult, CliError> = crate::cli::business_rpc::call(
+        info.sock_path,
+        "transfer-release",
+        Method::TransferRelease,
+        Some(TransferIdParams { transfer_id }),
+        Duration::from_secs(5),
+    );
     write_result?;
     match format {
         Format::Json => {

crates/bsk-cli/src/cli/interaction.rs

@@ -1,5 +1,4 @@
-//! `bsk click` / `bsk focus` / `bsk blur` / `bsk fill` / `bsk press`
-//! interaction tools.
+//! `bsk click` / `bsk fill` / `bsk press` (M7 interaction tools).
 //!
 //! The `<target>` positional accepts either a snapshot ref (`@e3`,
 //! `e3`) or a CSS selector. Use `--ref` / `--selector` explicitly when
@@ -11,9 +10,8 @@ use std::time::Duration;
 use anyhow::Context;
 use bsk_protocol::Method;
 use bsk_protocol::tools::{
-    BlurParams, BlurResult, ClickParams, ClickResult, FillParams, FillResult, FocusParams,
-    FocusResult, HoverParams, HoverResult, KeyModifier, MouseButton, PressParams, PressResult,
-    SelectParams, SelectResult,
+    ClickParams, ClickResult, FillParams, FillResult, HoverParams, HoverResult, KeyModifier,
+    MouseButton, PressParams, PressResult, SelectParams, SelectResult,
 };
 use clap::{Args, ValueEnum};
 
@@ -276,124 +274,6 @@ pub fn dispatch_hover(args: HoverArgs, format: Format) -> Result<(), CliError> {
     Ok(())
 }
 
-// ---------------------------------------------------------------------------
-// bsk focus / bsk blur
-// ---------------------------------------------------------------------------
-
-#[derive(Debug, Clone, Args)]
-pub struct FocusArgs {
-    /// Snapshot ref (`@e3`, `e3`) or CSS selector. Optional when `--ref`/`--selector` is used.
-    pub target: Option<String>,
-
-    #[arg(long = "ref")]
-    pub ref_: Option<String>,
-
-    #[arg(long = "selector")]
-    pub selector: Option<String>,
-
-    #[arg(long)]
-    pub session: String,
-
-    #[arg(long = "tab-id")]
-    pub tab_id: Option<i64>,
-
-    #[arg(long, default_value = "30s", value_parser = parse_timeout_ms)]
-    pub timeout: u32,
-}
-
-pub fn dispatch_focus(args: FocusArgs, format: Format) -> Result<(), CliError> {
-    let info = ensure_daemon().context("ensure daemon is running")?;
-    let (ref_, selector) = split_target(args.target, args.ref_, args.selector)?;
-    let params = FocusParams {
-        session_id: args.session,
-        ref_,
-        selector,
-        tab_id: args.tab_id,
-        timeout_ms: Some(args.timeout),
-    };
-    let reply: FocusResult = call(
-        info.sock_path,
-        Method::ToolFocus,
-        params,
-        "focus-1",
-        args.timeout,
-    )?;
-    match format {
-        Format::Json => println!(
-            "{}",
-            serde_json::to_string_pretty(&reply)
-                .map_err(|e| CliError::Local(anyhow::anyhow!(e)))?
-        ),
-        Format::Human => {
-            let target =
-                format_used_target(reply.used_ref.as_deref(), reply.used_selector.as_deref());
-            println!(
-                "focus ok tab={} target={target} focused={}",
-                reply.tab_id, reply.focused
-            );
-            print_dialog_summaries(&reply.dialogs);
-        }
-    }
-    Ok(())
-}
-
-#[derive(Debug, Clone, Args)]
-pub struct BlurArgs {
-    /// Snapshot ref (`@e3`, `e3`) or CSS selector. Optional when `--ref`/`--selector` is used.
-    pub target: Option<String>,
-
-    #[arg(long = "ref")]
-    pub ref_: Option<String>,
-
-    #[arg(long = "selector")]
-    pub selector: Option<String>,
-
-    #[arg(long)]
-    pub session: String,
-
-    #[arg(long = "tab-id")]
-    pub tab_id: Option<i64>,
-
-    #[arg(long, default_value = "30s", value_parser = parse_timeout_ms)]
-    pub timeout: u32,
-}
-
-pub fn dispatch_blur(args: BlurArgs, format: Format) -> Result<(), CliError> {
-    let info = ensure_daemon().context("ensure daemon is running")?;
-    let (ref_, selector) = split_target(args.target, args.ref_, args.selector)?;
-    let params = BlurParams {
-        session_id: args.session,
-        ref_,
-        selector,
-        tab_id: args.tab_id,
-        timeout_ms: Some(args.timeout),
-    };
-    let reply: BlurResult = call(
-        info.sock_path,
-        Method::ToolBlur,
-        params,
-        "blur-1",
-        args.timeout,
-    )?;
-    match format {
-        Format::Json => println!(
-            "{}",
-            serde_json::to_string_pretty(&reply)
-                .map_err(|e| CliError::Local(anyhow::anyhow!(e)))?
-        ),
-        Format::Human => {
-            let target =
-                format_used_target(reply.used_ref.as_deref(), reply.used_selector.as_deref());
-            println!(
-                "blur ok tab={} target={target} was_focused={} focused={}",
-                reply.tab_id, reply.was_focused, reply.focused
-            );
-            print_dialog_summaries(&reply.dialogs);
-        }
-    }
-    Ok(())
-}
-
 // ---------------------------------------------------------------------------
 // bsk fill
 // ---------------------------------------------------------------------------

crates/bsk-cli/src/cli/mod.rs

@@ -28,7 +28,6 @@ pub mod record_recovery;
 pub mod record_state;
 pub mod render_error;
 pub mod screenshot;
-pub mod scroll;
 pub mod session;
 pub mod snapshot;
 pub mod status;
@@ -48,15 +47,12 @@ use crate::cli::evaluate::EvaluateArgs;
 use crate::cli::get_html::GetHtmlArgs;
 use crate::cli::human_loop::RequestHelpArgs;
 use crate::cli::install_skill::InstallSkillArgs;
-use crate::cli::interaction::{
-    BlurArgs, ClickArgs, FillArgs, FocusArgs, HoverArgs, PressArgs, SelectArgs,
-};
+use crate::cli::interaction::{ClickArgs, FillArgs, HoverArgs, PressArgs, SelectArgs};
 use crate::cli::navigate::{NavigateCommand, NavigateHistoryArgs, ReloadArgs};
 use crate::cli::network::NetworkArgs;
 use crate::cli::observe::ObserveArgs;
 use crate::cli::record::RecordCmd;
 use crate::cli::screenshot::ScreenshotArgs;
-use crate::cli::scroll::ScrollToArgs;
 use crate::cli::session::SessionCmd;
 use crate::cli::snapshot::SnapshotArgs;
 use crate::cli::tab::TabCmd;
@@ -177,16 +173,6 @@ pub enum Command {
     /// Hover a snapshot ref or CSS selector.
     Hover(HoverArgs),
 
-    /// Scroll a snapshot ref or CSS selector into the visible viewport.
-    #[command(name = "scroll-to")]
-    ScrollTo(ScrollToArgs),
-
-    /// Focus a snapshot ref or CSS selector.
-    Focus(FocusArgs),
-
-    /// Remove focus from a snapshot ref or CSS selector.
-    Blur(BlurArgs),
-
     /// Fill an input / textarea / contenteditable.
     Fill(FillArgs),
 

crates/bsk-cli/src/cli/render_error.rs

@@ -40,6 +40,7 @@ use bsk_protocol::ErrorCode;
 pub mod reason {
     pub const AGENT_WINDOW_SCOPE: &str = "agent_window_scope";
     pub const ELEMENT_NOT_VISIBLE: &str = "element_not_visible";
+    pub const REF_CAPABILITY_DENIED: &str = "ref_capability_denied";
     pub const REF_NOT_FOUND: &str = "ref_not_found";
     pub const SELECTOR_NOT_FOUND: &str = "selector_not_found";
     pub const TARGET_NOT_FILLABLE: &str = "target_not_fillable";
@@ -299,6 +300,13 @@ pub fn info_for_error(code: ErrorCode, data: Option<&serde_json::Value>) -> Rend
             ),
             exit_code: base.exit_code,
         },
+        (ErrorCode::PermissionDenied, reason::REF_CAPABILITY_DENIED) => RenderInfo {
+            summary: "snapshot ref does not support this operation",
+            hint: Some(
+                "visual surface refs are screenshot-only; inspect `bsk screenshot --ref <ref> --session <id>` with image-understanding capability",
+            ),
+            exit_code: base.exit_code,
+        },
         (ErrorCode::InvalidParams, reason::TARGET_NOT_SELECT) => RenderInfo {
             summary: "target element is not a <select>",
             hint: Some(
@@ -564,6 +572,18 @@ mod tests {
         assert_eq!(info.exit_code, 3);
     }
 
+    #[test]
+    fn ref_capability_denied_explains_visual_surface_refs() {
+        let data = serde_json::json!({ "reason": reason::REF_CAPABILITY_DENIED });
+        let info = info_for_error(ErrorCode::PermissionDenied, Some(&data));
+        assert_eq!(info.summary, "snapshot ref does not support this operation");
+        assert!(
+            info.hint.unwrap().contains("screenshot-only"),
+            "expected visual-surface-specific hint"
+        );
+        assert_eq!(info.exit_code, 1);
+    }
+
     #[test]
     fn session_busy_overrides_timeout_copy() {
         let data = serde_json::json!({ "reason": reason::SESSION_BUSY });

crates/bsk-cli/src/cli/scroll.rs

@@ -1,100 +0,0 @@
-//! `bsk scroll-to` — bring a target element into the visible viewport.
-
-use std::time::Duration;
-
-use anyhow::Context;
-use bsk_protocol::Method;
-use bsk_protocol::tools::{ScrollToParams, ScrollToResult};
-use clap::Args;
-
-use crate::cli::dialogs::print_dialog_summaries;
-use crate::cli::ensure_daemon::ensure_daemon;
-use crate::cli::error::{CliError, Format};
-use crate::cli::interaction::split_target;
-use crate::cli::navigate::parse_timeout_ms;
-
-#[derive(Debug, Clone, Args)]
-pub struct ScrollToArgs {
-    /// Snapshot ref (`@e3`, `e3`) or CSS selector. Optional when `--ref`/`--selector` is used.
-    pub target: Option<String>,
-
-    #[arg(long = "ref")]
-    pub ref_: Option<String>,
-
-    #[arg(long = "selector")]
-    pub selector: Option<String>,
-
-    #[arg(long)]
-    pub session: String,
-
-    #[arg(long = "tab-id")]
-    pub tab_id: Option<i64>,
-
-    #[arg(long, default_value = "30s", value_parser = parse_timeout_ms)]
-    pub timeout: u32,
-}
-
-pub fn dispatch(args: ScrollToArgs, format: Format) -> Result<(), CliError> {
-    let (ref_, selector) = split_target(args.target, args.ref_, args.selector)?;
-    let info = ensure_daemon().context("ensure daemon is running")?;
-    let params = ScrollToParams {
-        session_id: args.session,
-        ref_,
-        selector,
-        tab_id: args.tab_id,
-        timeout_ms: Some(args.timeout),
-    };
-    let reply: ScrollToResult = crate::cli::business_rpc::call(
-        info.sock_path,
-        "scroll-to-1",
-        Method::ToolScrollTo,
-        Some(params),
-        ipc_timeout(args.timeout),
-    )?;
-    match format {
-        Format::Json => println!(
-            "{}",
-            serde_json::to_string_pretty(&reply)
-                .map_err(|e| CliError::Local(anyhow::anyhow!(e)))?
-        ),
-        Format::Human => {
-            let target =
-                format_used_target(reply.used_ref.as_deref(), reply.used_selector.as_deref());
-            println!(
-                "scroll-to ok tab={} target={target} bounds=({}, {}, {}, {})",
-                reply.tab_id, reply.x, reply.y, reply.width, reply.height
-            );
-            print_dialog_summaries(&reply.dialogs);
-        }
-    }
-    Ok(())
-}
-
-fn format_used_target(used_ref: Option<&str>, used_selector: Option<&str>) -> String {
-    used_ref
-        .map(|r| format!("@{r}"))
-        .or_else(|| used_selector.map(str::to_string))
-        .unwrap_or_else(|| "?".into())
-}
-
-fn ipc_timeout(timeout_ms: u32) -> Duration {
-    Duration::from_millis(u64::from(timeout_ms))
-        .checked_add(Duration::from_secs(15))
-        .unwrap_or(Duration::from_secs(u64::from(timeout_ms / 1_000) + 15))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn split_target_detects_refs_and_selectors() {
-        let (ref_, selector) = split_target(Some("@e3".into()), None, None).unwrap();
-        assert_eq!(ref_.as_deref(), Some("@e3"));
-        assert!(selector.is_none());
-
-        let (ref_, selector) = split_target(Some("#target".into()), None, None).unwrap();
-        assert!(ref_.is_none());
-        assert_eq!(selector.as_deref(), Some("#target"));
-    }
-}

crates/bsk-cli/src/cli/upload.rs

@@ -10,7 +10,8 @@ use base64::Engine;
 use bsk_protocol::Method;
 use bsk_protocol::tools::{
     TransferBeginParams, TransferBeginResult, TransferChunkParams, TransferChunkResult,
-    TransferIdParams, TransferReadyResult, UploadFile, UploadMode, UploadParams, UploadResult,
+    TransferIdParams, TransferReadyResult, TransferReleaseResult, UploadFile, UploadMode,
+    UploadParams, UploadResult,
 };
 use clap::{Args, ValueEnum};
 
@@ -68,12 +69,14 @@ pub fn dispatch(args: UploadArgs, format: Format) -> Result<(), CliError> {
     let (ref_, selector) = split_target(args.target, args.ref_, args.selector)?;
     let mut staged = Vec::new();
     for path in &args.files {
-        if let Err(err) = stage_file(&info.sock_path, &args.session, path, &mut staged) {
-            let _ = crate::cli::business_rpc::release_transfers(
-                &info.sock_path,
-                staged.iter().map(|(id, _)| id.as_str()),
-            );
-            return Err(err);
+        match stage_file(&info.sock_path, &args.session, path) {
+            Ok(file) => staged.push(file),
+            Err(err) => {
+                for (id, _) in &staged {
+                    let _ = release(&info.sock_path, id);
+                }
+                return Err(err);
+            }
         }
     }
     let params = UploadParams {
@@ -99,17 +102,6 @@ pub fn dispatch(args: UploadArgs, format: Format) -> Result<(), CliError> {
         Some(params),
         ipc_timeout(args.timeout),
     );
-    // The helper can reject cancellation before handing any request to the
-    // daemon. In that case staging still belongs to this CLI.
-    if result.as_ref().is_err_and(|err| {
-        err.data()
-            .is_some_and(|data| data["reason"] == "cancelled_before_dispatch")
-    }) {
-        let _ = crate::cli::business_rpc::release_transfers(
-            &info.sock_path,
-            staged.iter().map(|(id, _)| id.as_str()),
-        );
-    }
     // Once tool.upload is dispatched, staging ownership belongs to the
     // session. A transport timeout cannot prove that Chrome did not attach
     // the file, so releasing here could invalidate a late successful attach.
@@ -126,12 +118,7 @@ pub fn dispatch(args: UploadArgs, format: Format) -> Result<(), CliError> {
     Ok(())
 }
 
-fn stage_file(
-    sock: &Path,
-    session: &str,
-    path: &PathBuf,
-    staged: &mut Vec<(String, String)>,
-) -> Result<(), CliError> {
+fn stage_file(sock: &Path, session: &str, path: &PathBuf) -> Result<(String, String), CliError> {
     let mut file = File::open(path)
         .with_context(|| format!("open upload file {}", path.display()))
         .map_err(CliError::Local)?;
@@ -162,39 +149,55 @@ fn stage_file(
         }),
         Duration::from_secs(10),
     )?;
-    // Record ownership immediately so one error path releases both completed
-    // files and the current partially staged file.
-    staged.push((begin.transfer_id.clone(), name));
-    let mut offset = 0u64;
-    let mut buf = vec![0u8; begin.chunk_size as usize];
-    loop {
-        let n = file.read(&mut buf).map_err(|e| CliError::Local(e.into()))?;
-        if n == 0 {
-            break;
+    let staged = (|| {
+        let mut offset = 0u64;
+        let mut buf = vec![0u8; begin.chunk_size as usize];
+        loop {
+            let n = file.read(&mut buf).map_err(|e| CliError::Local(e.into()))?;
+            if n == 0 {
+                break;
+            }
+            let reply: TransferChunkResult = crate::cli::business_rpc::call(
+                sock.to_path_buf(),
+                "transfer-chunk",
+                Method::TransferChunk,
+                Some(TransferChunkParams {
+                    transfer_id: begin.transfer_id.clone(),
+                    offset,
+                    data_base64: base64::engine::general_purpose::STANDARD.encode(&buf[..n]),
+                }),
+                Duration::from_secs(30),
+            )?;
+            offset = reply.next_offset;
         }
-        let reply: TransferChunkResult = crate::cli::business_rpc::call(
+        let _: TransferReadyResult = crate::cli::business_rpc::call(
             sock.to_path_buf(),
-            "transfer-chunk",
-            Method::TransferChunk,
-            Some(TransferChunkParams {
+            "transfer-finish",
+            Method::TransferFinish,
+            Some(TransferIdParams {
                 transfer_id: begin.transfer_id.clone(),
-                offset,
-                data_base64: base64::engine::general_purpose::STANDARD.encode(&buf[..n]),
             }),
-            Duration::from_secs(30),
+            Duration::from_secs(10),
         )?;
-        offset = reply.next_offset;
+        Ok::<_, CliError>(())
+    })();
+    if let Err(err) = staged {
+        let _ = release(sock, &begin.transfer_id);
+        return Err(err);
     }
-    let _: TransferReadyResult = crate::cli::business_rpc::call(
+    Ok((begin.transfer_id, name))
+}
+
+fn release(sock: &Path, id: &str) -> Result<TransferReleaseResult, CliError> {
+    crate::cli::business_rpc::call(
         sock.to_path_buf(),
-        "transfer-finish",
-        Method::TransferFinish,
+        "transfer-release",
+        Method::TransferRelease,
         Some(TransferIdParams {
-            transfer_id: begin.transfer_id.clone(),
+            transfer_id: id.to_string(),
         }),
-        Duration::from_secs(10),
-    )?;
-    Ok(())
+        Duration::from_secs(5),
+    )
 }
 
 fn ipc_timeout(timeout_ms: u32) -> Duration {

crates/bsk-cli/src/daemon/ipc.rs

@@ -253,9 +253,6 @@ pub fn full_handler(status: DaemonStatus, state: Arc<DaemonState>) -> RpcHandler
                 | Method::ToolReload
                 | Method::ToolClick
                 | Method::ToolHover
-                | Method::ToolScrollTo
-                | Method::ToolFocus
-                | Method::ToolBlur
                 | Method::ToolFill
                 | Method::ToolPress
                 | Method::ToolSelect

crates/bsk-cli/src/main.rs

@@ -94,9 +94,6 @@ fn dispatch(cli: Cli, format: Format) -> Result<(), CliError> {
         Command::Reload(args) => cli::navigate::dispatch_reload(args, format),
         Command::Click(args) => cli::interaction::dispatch_click(args, format),
         Command::Hover(args) => cli::interaction::dispatch_hover(args, format),
-        Command::ScrollTo(args) => cli::scroll::dispatch(args, format),
-        Command::Focus(args) => cli::interaction::dispatch_focus(args, format),
-        Command::Blur(args) => cli::interaction::dispatch_blur(args, format),
         Command::Fill(args) => cli::interaction::dispatch_fill(args, format),
         Command::Press(args) => cli::interaction::dispatch_press(args, format),
         Command::Select(args) => cli::interaction::dispatch_select(args, format),

crates/bsk-cli/tests/cli_parse.rs

@@ -255,65 +255,6 @@ fn parses_hover_with_settle() {
     assert_eq!(args.settle, 300);
 }
 
-#[test]
-fn parses_scroll_to_target() {
-    let cli = parse(&["bsk", "scroll-to", "@e2", "--session", "s1"]);
-    let Command::ScrollTo(args) = cli.command else {
-        panic!("expected scroll-to command");
-    };
-    assert_eq!(args.target.as_deref(), Some("@e2"));
-}
-
-#[test]
-fn parses_scroll_to_explicit_target_tab_and_timeout() {
-    for flag in ["--ref", "--selector"] {
-        let cli = parse(&[
-            "bsk",
-            "scroll-to",
-            flag,
-            "e3",
-            "--session",
-            "s1",
-            "--tab-id",
-            "42",
-            "--timeout",
-            "5s",
-        ]);
-        let Command::ScrollTo(args) = cli.command else {
-            panic!("expected scroll-to command");
-        };
-        assert_eq!(args.tab_id, Some(42));
-        assert_eq!(args.timeout, 5_000);
-        assert_eq!(
-            if flag == "--ref" {
-                args.ref_
-            } else {
-                args.selector
-            }
-            .as_deref(),
-            Some("e3")
-        );
-    }
-}
-
-#[test]
-fn parses_focus_target() {
-    let cli = parse(&["bsk", "focus", "@e2", "--session", "s1"]);
-    let Command::Focus(args) = cli.command else {
-        panic!("expected focus command");
-    };
-    assert_eq!(args.target.as_deref(), Some("@e2"));
-}
-
-#[test]
-fn parses_blur_selector() {
-    let cli = parse(&["bsk", "blur", "--selector", "#search", "--session", "s1"]);
-    let Command::Blur(args) = cli.command else {
-        panic!("expected blur command");
-    };
-    assert_eq!(args.selector.as_deref(), Some("#search"));
-}
-
 #[test]
 fn rejects_zero_click_count() {
     assert!(

crates/bsk-cli/tests/session_user_interrupt.rs

@@ -293,15 +293,6 @@ async fn session_user_interrupt_event_cancels_inflight_with_user_aborted() {
 /// catch a tool dispatched arbitrarily later.
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn user_interrupt_rejects_next_mutating_tool_call_when_session_was_idle() {
-    assert_idle_interrupt_rejects(Method::ToolClick).await;
-}
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn user_interrupt_rejects_scroll_to_before_forwarding() {
-    assert_idle_interrupt_rejects(Method::ToolScrollTo).await;
-}
-
-async fn assert_idle_interrupt_rejects(method: Method) {
     let (handle, sock) = spawn_daemon().await;
     let mut ws = connect_ext(handle.ws_addr()).await;
     let _ = handshake_as_ext(&mut ws).await;
@@ -310,11 +301,10 @@ async fn assert_idle_interrupt_rejects(method: Method) {
 
     // Fake extension: answer tool.session_start, observe other
     // requests but never reply. We expect the daemon to reject the
-    // tool call BEFORE it ever forwards a browser-input frame.
+    // tool call BEFORE it ever forwards a tool.click frame.
     let ws_sink_for_responder = Arc::clone(&ws_sink);
-    let observed_call_count = Arc::new(std::sync::atomic::AtomicUsize::new(0));
-    let observed_call_count_clone = Arc::clone(&observed_call_count);
-    let forwarded_method = method.clone();
+    let observed_click_count = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+    let observed_click_count_clone = Arc::clone(&observed_click_count);
     let responder = tokio::spawn(async move {
         let mut ws_stream = ws_stream;
         while let Some(Ok(msg)) = ws_stream.next().await {
@@ -339,8 +329,8 @@ async fn assert_idle_interrupt_rejects(method: Method) {
                     g.send(Message::Text(serde_json::to_string(&reply).unwrap()))
                         .await
                         .unwrap();
-                } else if req.method == forwarded_method {
-                    observed_call_count_clone.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+                } else if req.method == Method::ToolClick {
+                    observed_click_count_clone.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
                     // Deliberately do NOT reply — daemon should reject before
                     // ever forwarding to us.
                     let _ = req;
@@ -387,12 +377,12 @@ async fn assert_idle_interrupt_rejects(method: Method) {
     let state = handle.state();
     wait_for_session_interrupt_pending(&state, &start.session_id).await;
 
-    // The CLI now issues a browser-input (mutating). The daemon must
+    // The CLI now issues a tool.click (mutating). The daemon must
     // reject it WITHOUT forwarding to the extension.
-    let outcome = ipc
+    let click_outcome = ipc
         .call::<_, serde_json::Value>(
-            "input-after-interrupt",
-            method,
+            "click-after-interrupt",
+            Method::ToolClick,
             Some(json!({
                 "session_id": start.session_id,
                 "ref": "fake-ref-1",
@@ -401,7 +391,7 @@ async fn assert_idle_interrupt_rejects(method: Method) {
         )
         .await
         .unwrap();
-    let err = outcome.expect_err("browser-input must be rejected");
+    let err = click_outcome.expect_err("tool.click must be rejected");
     assert_eq!(
         err.code,
         ErrorCode::UserAborted,
@@ -409,11 +399,11 @@ async fn assert_idle_interrupt_rejects(method: Method) {
         err
     );
 
-    // Crucially: the extension never saw a browser-input frame.
+    // Crucially: the extension never saw a tool.click frame.
     assert_eq!(
-        observed_call_count.load(std::sync::atomic::Ordering::SeqCst),
+        observed_click_count.load(std::sync::atomic::Ordering::SeqCst),
         0,
-        "browser-input must NOT have been forwarded to the extension"
+        "tool.click must NOT have been forwarded to the extension"
     );
 
     responder.abort();

crates/bsk-cli/tests/tools_m7_ipc.rs

@@ -1,4 +1,5 @@
-//! M7 integration: drive interaction and navigation tool RPCs
+//! M7 integration: drive the 7 new tool RPCs (navigate /
+//! navigate_back / navigate_forward / reload / click / fill / press)
 //! through the IPC + per-session queue + fake extension and assert
 //! the wire shapes line up. The extension stub mirrors each method's
 //! `*Result` so we exercise the daemon's serialise → forward →
@@ -12,13 +13,11 @@ use bsk::daemon::{self, DaemonConfig};
 use bsk::ipc_client::IpcClient;
 use bsk_protocol::system::{HandshakeParams, HandshakeResult};
 use bsk_protocol::tools::{
-    BlurParams, BlurResult, ClickParams, ClickResult, FillParams, FillResult, FocusParams,
-    FocusResult, KeyModifier, MouseButton, NavigateBackParams, NavigateBackResult,
-    NavigateForwardParams, NavigateForwardResult, NavigateParams, NavigateResult, PressParams,
-    PressResult, ReloadParams, ReloadResult, SelectParams, SelectResult, SessionStartParams,
-    SessionStartResult, WaitUntil,
+    ClickParams, ClickResult, FillParams, FillResult, KeyModifier, MouseButton, NavigateBackParams,
+    NavigateBackResult, NavigateForwardParams, NavigateForwardResult, NavigateParams,
+    NavigateResult, PressParams, PressResult, ReloadParams, ReloadResult, SelectParams,
+    SelectResult, SessionStartParams, SessionStartResult, WaitUntil,
 };
-use bsk_protocol::tools::{ScrollToParams, ScrollToResult};
 use bsk_protocol::{
     BrowserPeerInfo, ErrorCode, Frame, Method, RequestFrame, ResponseBody, ResponseFrame, RpcError,
 };
@@ -383,137 +382,6 @@ async fn click_round_trips_ref_and_modifiers() {
     handle.shutdown().await;
 }
 
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn focus_round_trips_verified_state() {
-    let (handle, sock) = spawn_daemon().await;
-    let mut ws = connect_ext(handle.ws_addr()).await;
-    let _ = do_handshake(&mut ws).await;
-
-    run_extension(ws, |req| {
-        assert_eq!(req.method, Method::ToolFocus);
-        let params = req.params.clone().unwrap();
-        let p: FocusParams = serde_json::from_value(params).unwrap();
-        assert_eq!(p.ref_.as_deref(), Some("@e3"));
-        ResponseBody::Ok(
-            serde_json::to_value(FocusResult {
-                tab_id: 9,
-                used_ref: Some("e3".into()),
-                used_selector: None,
-                focused: true,
-                dialogs: vec![],
-            })
-            .unwrap(),
-        )
-    });
-
-    let session_id = ipc_session_start(&sock).await;
-    let result: FocusResult = ipc_tool_call(
-        &sock,
-        Method::ToolFocus,
-        FocusParams {
-            session_id,
-            ref_: Some("@e3".into()),
-            selector: None,
-            tab_id: None,
-            timeout_ms: Some(5_000),
-        },
-    )
-    .await
-    .expect("focus ok");
-    assert!(result.focused);
-    assert_eq!(result.used_ref.as_deref(), Some("e3"));
-    handle.shutdown().await;
-}
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn blur_round_trips_previous_focus_state() {
-    let (handle, sock) = spawn_daemon().await;
-    let mut ws = connect_ext(handle.ws_addr()).await;
-    let _ = do_handshake(&mut ws).await;
-
-    run_extension(ws, |req| {
-        assert_eq!(req.method, Method::ToolBlur);
-        let params = req.params.clone().unwrap();
-        let p: BlurParams = serde_json::from_value(params).unwrap();
-        assert_eq!(p.selector.as_deref(), Some("#search"));
-        ResponseBody::Ok(
-            serde_json::to_value(BlurResult {
-                tab_id: 9,
-                used_ref: None,
-                used_selector: Some("#search".into()),
-                was_focused: true,
-                focused: false,
-                dialogs: vec![],
-            })
-            .unwrap(),
-        )
-    });
-
-    let session_id = ipc_session_start(&sock).await;
-    let result: BlurResult = ipc_tool_call(
-        &sock,
-        Method::ToolBlur,
-        BlurParams {
-            session_id,
-            ref_: None,
-            selector: Some("#search".into()),
-            tab_id: None,
-            timeout_ms: Some(5_000),
-        },
-    )
-    .await
-    .expect("blur ok");
-    assert!(result.was_focused);
-    assert!(!result.focused);
-    assert_eq!(result.used_selector.as_deref(), Some("#search"));
-    handle.shutdown().await;
-}
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn scroll_to_round_trips_visible_bounds() {
-    let (handle, sock) = spawn_daemon().await;
-    let mut ws = connect_ext(handle.ws_addr()).await;
-    let _ = do_handshake(&mut ws).await;
-
-    run_extension(ws, |req| {
-        assert_eq!(req.method, Method::ToolScrollTo);
-        let params = req.params.clone().unwrap();
-        let parsed: ScrollToParams = serde_json::from_value(params).unwrap();
-        assert_eq!(parsed.ref_.as_deref(), Some("@e3"));
-        ResponseBody::Ok(
-            serde_json::to_value(ScrollToResult {
-                tab_id: 9,
-                used_ref: Some("e3".into()),
-                used_selector: None,
-                x: 10.0,
-                y: 20.0,
-                width: 100.0,
-                height: 40.0,
-                dialogs: vec![],
-            })
-            .unwrap(),
-        )
-    });
-
-    let session_id = ipc_session_start(&sock).await;
-    let result: ScrollToResult = ipc_tool_call(
-        &sock,
-        Method::ToolScrollTo,
-        ScrollToParams {
-            session_id,
-            ref_: Some("@e3".into()),
-            selector: None,
-            tab_id: None,
-            timeout_ms: Some(5_000),
-        },
-    )
-    .await
-    .expect("scroll-to ok");
-    assert_eq!(result.used_ref.as_deref(), Some("e3"));
-    assert_eq!(result.width, 100.0);
-    handle.shutdown().await;
-}
-
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn fill_round_trips_clear_before_default() {
     let (handle, sock) = spawn_daemon().await;

crates/bsk-cli/tests/windows_parent_cancel.rs

@@ -1,342 +0,0 @@
-//! Real Windows CLI cancellation, including caller-owned transfer cleanup.
-#![cfg(windows)]
-
-use std::path::Path;
-use std::sync::{Arc, Mutex};
-use std::time::{Duration, Instant};
-
-use bsk::daemon::{file_transfer::TransferRegistry, info::DaemonInfo};
-use bsk_protocol::tools::{TransferBeginParams, TransferIdParams};
-use bsk_protocol::{ErrorCode, Frame, Method, ResponseBody, ResponseFrame, RpcError};
-use serde_json::json;
-use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
-use tokio::net::windows::named_pipe::ServerOptions;
-use tokio::process::Command;
-use tokio::sync::{Notify, watch};
-
-fn response<T: serde::Serialize>(result: Result<T, RpcError>) -> ResponseBody {
-    match result {
-        Ok(value) => ResponseBody::Ok(serde_json::to_value(value).unwrap()),
-        Err(err) => ResponseBody::Err(err),
-    }
-}
-
-#[test]
-fn stdin_close_cancels_business_but_releases_resources_with_a_bounded_budget() {
-    // Resolve the production registry's root before starting any runtime threads.
-    let registry_home = tempfile::tempdir().unwrap();
-    let original_home = std::env::var_os("BSK_HOME");
-    unsafe {
-        std::env::set_var("BSK_HOME", registry_home.path());
-    }
-    let transfers = Arc::new(TransferRegistry::new().unwrap());
-    unsafe {
-        match original_home {
-            Some(value) => std::env::set_var("BSK_HOME", value),
-            None => std::env::remove_var("BSK_HOME"),
-        }
-    }
-    transfers.initialize().unwrap();
-    tokio::runtime::Builder::new_current_thread()
-        .enable_all()
-        .build()
-        .unwrap()
-        .block_on(exercise(
-            transfers,
-            &registry_home.path().join("run/transfers"),
-        ));
-}
-
-async fn exercise(transfers: Arc<TransferRegistry>, staging_root: &Path) {
-    for mode in [
-        "wait",
-        "upload",
-        "upload-multi",
-        "upload-before-dispatch",
-        "download",
-        "upload-multi-stall",
-        "ordinary",
-    ] {
-        let home = tempfile::tempdir().unwrap();
-        let pipe_name = format!(r"\\.\pipe\bsk-parent-cancel-{}", uuid::Uuid::new_v4());
-        let info = DaemonInfo::now(std::process::id(), (&pipe_name).into(), 0, "0.2.0");
-        std::fs::write(
-            home.path().join("daemon.json"),
-            serde_json::to_vec(&info).unwrap(),
-        )
-        .unwrap();
-        let mut pipe = ServerOptions::new()
-            .first_pipe_instance(true)
-            .create(&pipe_name)
-            .unwrap();
-        let registered = Arc::new(Notify::new());
-        let pending = Arc::new(Mutex::new(None::<String>));
-        let ids = Arc::new(Mutex::new(Vec::<String>::new()));
-        let released = Arc::new(Mutex::new(Vec::<String>::new()));
-        let received = Arc::new(Mutex::new(Vec::<Method>::new()));
-        let download_id = if mode == "download" {
-            let staging = transfers.begin_download("fixture").unwrap();
-            let browser_dir = home.path().join("BrowserSkill").join(&staging.transfer_id);
-            std::fs::create_dir_all(&browser_dir).unwrap();
-            let file = browser_dir.join("download.txt");
-            std::fs::write(&file, b"download fixture").unwrap();
-            transfers
-                .import_download(&staging.transfer_id, &file)
-                .unwrap();
-            ids.lock().unwrap().push(staging.transfer_id.clone());
-            Some(staging.transfer_id)
-        } else {
-            None
-        };
-        let (cancel, cancelled) = watch::channel(false);
-        let ready = Arc::clone(&registered);
-        let name = pipe_name.clone();
-        let registry = Arc::clone(&transfers);
-        let server_ids = Arc::clone(&ids);
-        let server_released = Arc::clone(&released);
-        let server_received = Arc::clone(&received);
-        let server = tokio::spawn(async move {
-            let mut connections = tokio::task::JoinSet::new();
-            loop {
-                pipe.connect().await.unwrap();
-                let next = ServerOptions::new().create(&name).unwrap();
-                let connection = std::mem::replace(&mut pipe, next);
-                let ready = Arc::clone(&ready);
-                let pending = Arc::clone(&pending);
-                let cancel = cancel.clone();
-                let mut cancelled = cancelled.clone();
-                let name = name.clone();
-                let registry = Arc::clone(&registry);
-                let ids = Arc::clone(&server_ids);
-                let released = Arc::clone(&server_released);
-                let received = Arc::clone(&server_received);
-                let download_id = download_id.clone();
-                connections.spawn(async move {
-                    let (read, mut write) = tokio::io::split(connection);
-                    let mut reader = BufReader::new(read);
-                    let mut line = String::new();
-                    while reader.read_line(&mut line).await.unwrap_or(0) > 0 {
-                        let Frame::Request(req) = serde_json::from_str::<Frame>(&line).unwrap()
-                        else {
-                            panic!("expected request");
-                        };
-                        line.clear();
-                        received.lock().unwrap().push(req.method.clone());
-                        let params = req.params.clone().unwrap_or_default();
-                        let body = match req.method {
-                            Method::SystemStatus => ResponseBody::Ok(json!({
-                                "daemon_version": "0.2.0", "protocol_version": "1.1",
-                                "pid": std::process::id(), "uptime_secs": 0,
-                                "ws_port": 0, "sock_path": name,
-                                "browsers": [], "sessions": [], "version_skew_browsers": []
-                            })),
-                            Method::TransferBegin => {
-                                let begin = registry
-                                    .begin_upload(serde_json::from_value(params).unwrap())
-                                    .unwrap();
-                                ids.lock().unwrap().push(begin.transfer_id.clone());
-                                response(Ok(begin))
-                            }
-                            Method::ToolDownload => ResponseBody::Ok(json!({
-                                "tab_id": 1, "suggested_filename": "download.txt",
-                                "byte_size": 16, "transfer_id": download_id,
-                            })),
-                            Method::ToolWaitMs if mode == "ordinary" => {
-                                ResponseBody::Ok(json!({"waited_ms": 1}))
-                            }
-                            Method::TransferChunk
-                                if mode == "upload-before-dispatch"
-                                    || (mode.contains("multi")
-                                        && ids.lock().unwrap().len() == 1) =>
-                            {
-                                response(
-                                    registry.write_chunk(serde_json::from_value(params).unwrap()),
-                                )
-                            }
-                            Method::TransferFinish if mode != "upload-before-dispatch" => response(
-                                registry.finish_upload(serde_json::from_value(params).unwrap()),
-                            ),
-                            Method::ToolWaitMs
-                            | Method::TransferChunk
-                            | Method::TransferRead
-                            | Method::TransferFinish => {
-                                *pending.lock().unwrap() = Some(req.id.clone());
-                                ready.notify_one();
-                                cancelled.wait_for(|value| *value).await.unwrap();
-                                if mode == "upload-before-dispatch" {
-                                    // Finish won the race with cancellation, but tool.upload must
-                                    // not be dispatched and the CLI still owns the staging.
-                                    response(
-                                        registry
-                                            .finish_upload(serde_json::from_value(params).unwrap()),
-                                    )
-                                } else {
-                                    ResponseBody::Err(RpcError {
-                                        code: ErrorCode::Cancelled,
-                                        message: "parent cancellation reached daemon".into(),
-                                        data: None,
-                                    })
-                                }
-                            }
-                            Method::Cancel => {
-                                let target = params["rpc_id"].as_str().unwrap();
-                                assert_eq!(pending.lock().unwrap().as_deref(), Some(target));
-                                cancel.send(true).unwrap();
-                                ResponseBody::Ok(json!({"cancelled": true}))
-                            }
-                            Method::TransferRelease => {
-                                let params: TransferIdParams =
-                                    serde_json::from_value(params).unwrap();
-                                released.lock().unwrap().push(params.transfer_id.clone());
-                                if mode.contains("stall") {
-                                    std::future::pending::<()>().await;
-                                }
-                                response(Ok(registry.release(params)))
-                            }
-                            other => panic!("unexpected request after cancellation: {other:?}"),
-                        };
-                        let response = Frame::Response(ResponseFrame { id: req.id, body });
-                        let mut bytes = serde_json::to_vec(&response).unwrap();
-                        bytes.push(b'\n');
-                        if write.write_all(&bytes).await.is_err() {
-                            break;
-                        }
-                    }
-                });
-            }
-        });
-
-        let mut cmd = Command::new(env!("CARGO_BIN_EXE_bsk"));
-        cmd.env("BSK_HOME", home.path())
-            .env("BSK_AUTO_UPDATE", "off")
-            .env_remove("BSK_CANCEL_ON_STDIN_CLOSE")
-            .stdout(std::process::Stdio::piped())
-            .stderr(std::process::Stdio::piped())
-            .creation_flags(0x0800_0000)
-            .kill_on_drop(true);
-        if mode.starts_with("upload") {
-            let source = home.path().join("upload.txt");
-            // Declare 300 MiB without allocating or transferring that much data.
-            std::fs::File::create(&source)
-                .unwrap()
-                .set_len(if mode == "upload-before-dispatch" {
-                    16
-                } else {
-                    300 * 1024 * 1024
-                })
-                .unwrap();
-            cmd.args(["upload", "--session", "fixture", "--selector", "input"]);
-            if mode.contains("multi") {
-                let first = home.path().join("first.txt");
-                std::fs::write(&first, b"first file").unwrap();
-                cmd.arg("--file").arg(first);
-            }
-            cmd.arg("--file").arg(source);
-        } else if mode == "download" {
-            let out = home.path().join("out.txt");
-            std::fs::write(&out, b"existing output").unwrap();
-            cmd.args([
-                "download",
-                "--session",
-                "fixture",
-                "--selector",
-                "a",
-                "--overwrite",
-                "--out",
-            ])
-            .arg(out);
-        } else {
-            cmd.args(["wait-ms", if mode == "ordinary" { "1ms" } else { "60s" }]);
-        }
-        cmd.arg("--json");
-        if mode == "ordinary" {
-            cmd.stdin(std::process::Stdio::null());
-        } else {
-            cmd.env("BSK_CANCEL_ON_STDIN_CLOSE", "1")
-                .stdin(std::process::Stdio::piped());
-        }
-        let mut child = cmd.spawn().unwrap();
-        if mode != "ordinary" {
-            tokio::time::timeout(Duration::from_secs(10), registered.notified())
-                .await
-                .expect("CLI registered business RPC");
-            child
-                .stdin
-                .as_mut()
-                .unwrap()
-                .write_all(b"still connected")
-                .await
-                .unwrap();
-            drop(child.stdin.take());
-        }
-        let start = Instant::now();
-        let output = tokio::time::timeout(Duration::from_secs(8), child.wait_with_output())
-            .await
-            .expect("CLI must settle promptly, including cleanup")
-            .unwrap();
-        server.abort();
-        let _ = server.await;
-        assert_eq!(
-            output.status.code(),
-            Some(if mode == "ordinary" { 0 } else { 2 }),
-            "{mode}: stdout={} stderr={}",
-            String::from_utf8_lossy(&output.stdout),
-            String::from_utf8_lossy(&output.stderr)
-        );
-        if mode != "ordinary" {
-            let body: serde_json::Value = serde_json::from_slice(&output.stdout).unwrap();
-            assert_eq!(body["code"], "cancelled");
-            if mode != "upload-before-dispatch" {
-                assert_eq!(body["message"], "parent cancellation reached daemon");
-            }
-            let received = received.lock().unwrap();
-            let cancel = received.iter().position(|m| *m == Method::Cancel).unwrap();
-            assert!(
-                received[cancel + 1..]
-                    .iter()
-                    .all(|m| *m == Method::TransferRelease),
-                "only cleanup may follow cancellation: {received:?}"
-            );
-        }
-        let ids = ids.lock().unwrap();
-        if mode.contains("stall") {
-            assert_eq!(released.lock().unwrap().len(), 1);
-            assert!(start.elapsed() >= Duration::from_secs(4));
-            // The CLI cannot force an unresponsive daemon to clean up.
-            transfers.release_session("fixture");
-        } else {
-            assert_eq!(
-                *released.lock().unwrap(),
-                *ids,
-                "{mode}: every allocation must be released"
-            );
-            for id in ids.iter() {
-                assert!(!staging_root.join(id).exists(), "staging leaked: {id}");
-            }
-            if mode.starts_with("upload") {
-                let retry = transfers
-                    .begin_upload(TransferBeginParams {
-                        session_id: "fixture".into(),
-                        name: "retry.txt".into(),
-                        byte_size: 300 * 1024 * 1024,
-                    })
-                    .expect("same session must have room for another 300 MiB upload");
-                transfers.release(TransferIdParams {
-                    transfer_id: retry.transfer_id,
-                });
-            }
-        }
-        if mode == "download" {
-            assert_eq!(
-                std::fs::read(home.path().join("out.txt")).unwrap(),
-                b"existing output"
-            );
-            assert!(
-                !std::fs::read_dir(home.path())
-                    .unwrap()
-                    .flatten()
-                    .any(|entry| entry.file_name().to_string_lossy().ends_with(".part"))
-            );
-        }
-    }
-}

crates/bsk-protocol/schema/tool_blur_params.json

@@ -1,42 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "BlurParams",
-  "type": "object",
-  "required": [
-    "session_id"
-  ],
-  "properties": {
-    "ref": {
-      "description": "Optional `@e<N>` ref allocated by the last observation. Mutually exclusive with `selector`.",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "selector": {
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "session_id": {
-      "type": "string"
-    },
-    "tab_id": {
-      "description": "Target tab. Defaults to the Agent Window's active tab.",
-      "type": [
-        "integer",
-        "null"
-      ],
-      "format": "int64"
-    },
-    "timeout_ms": {
-      "type": [
-        "integer",
-        "null"
-      ],
-      "format": "uint32",
-      "minimum": 1.0
-    }
-  }
-}

crates/bsk-protocol/schema/tool_blur_result.json

@@ -1,112 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "BlurResult",
-  "type": "object",
-  "required": [
-    "focused",
-    "tab_id",
-    "was_focused"
-  ],
-  "properties": {
-    "dialogs": {
-      "type": "array",
-      "items": {
-        "$ref": "#/definitions/JavaScriptDialogInfo"
-      }
-    },
-    "focused": {
-      "description": "Always false for a successful blur; included for machine verification.",
-      "type": "boolean"
-    },
-    "tab_id": {
-      "type": "integer",
-      "format": "int64"
-    },
-    "used_ref": {
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "used_selector": {
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "was_focused": {
-      "description": "Whether the target held focus before the call.",
-      "type": "boolean"
-    }
-  },
-  "definitions": {
-    "JavaScriptDialogHandledAction": {
-      "description": "How the extension resolved the dialog so CDP could continue.",
-      "type": "string",
-      "enum": [
-        "accepted",
-        "dismissed"
-      ]
-    },
-    "JavaScriptDialogInfo": {
-      "description": "One observed + handled JavaScript dialog during a tool call.",
-      "type": "object",
-      "required": [
-        "handled",
-        "message",
-        "sequence",
-        "tab_id",
-        "type"
-      ],
-      "properties": {
-        "default_prompt": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "handled": {
-          "$ref": "#/definitions/JavaScriptDialogHandledAction"
-        },
-        "has_browser_handler": {
-          "type": [
-            "boolean",
-            "null"
-          ]
-        },
-        "message": {
-          "type": "string"
-        },
-        "sequence": {
-          "description": "Monotonic per-tab sequence for ordering within a session.",
-          "type": "integer",
-          "format": "uint64",
-          "minimum": 0.0
-        },
-        "tab_id": {
-          "type": "integer",
-          "format": "int64"
-        },
-        "type": {
-          "$ref": "#/definitions/JavaScriptDialogType"
-        },
-        "url": {
-          "type": [
-            "string",
-            "null"
-          ]
-        }
-      }
-    },
-    "JavaScriptDialogType": {
-      "description": "Native JS dialog kind reported by CDP.",
-      "type": "string",
-      "enum": [
-        "alert",
-        "confirm",
-        "prompt",
-        "beforeunload"
-      ]
-    }
-  }
-}

crates/bsk-protocol/schema/tool_focus_params.json

@@ -1,42 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "FocusParams",
-  "type": "object",
-  "required": [
-    "session_id"
-  ],
-  "properties": {
-    "ref": {
-      "description": "Optional `@e<N>` ref allocated by the last observation. Mutually exclusive with `selector`.",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "selector": {
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "session_id": {
-      "type": "string"
-    },
-    "tab_id": {
-      "description": "Target tab. Defaults to the Agent Window's active tab.",
-      "type": [
-        "integer",
-        "null"
-      ],
-      "format": "int64"
-    },
-    "timeout_ms": {
-      "type": [
-        "integer",
-        "null"
-      ],
-      "format": "uint32",
-      "minimum": 1.0
-    }
-  }
-}

crates/bsk-protocol/schema/tool_focus_result.json

@@ -1,107 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "FocusResult",
-  "type": "object",
-  "required": [
-    "focused",
-    "tab_id"
-  ],
-  "properties": {
-    "dialogs": {
-      "type": "array",
-      "items": {
-        "$ref": "#/definitions/JavaScriptDialogInfo"
-      }
-    },
-    "focused": {
-      "description": "Whether the target holds DOM focus in its document or shadow root after the call.",
-      "type": "boolean"
-    },
-    "tab_id": {
-      "type": "integer",
-      "format": "int64"
-    },
-    "used_ref": {
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "used_selector": {
-      "type": [
-        "string",
-        "null"
-      ]
-    }
-  },
-  "definitions": {
-    "JavaScriptDialogHandledAction": {
-      "description": "How the extension resolved the dialog so CDP could continue.",
-      "type": "string",
-      "enum": [
-        "accepted",
-        "dismissed"
-      ]
-    },
-    "JavaScriptDialogInfo": {
-      "description": "One observed + handled JavaScript dialog during a tool call.",
-      "type": "object",
-      "required": [
-        "handled",
-        "message",
-        "sequence",
-        "tab_id",
-        "type"
-      ],
-      "properties": {
-        "default_prompt": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "handled": {
-          "$ref": "#/definitions/JavaScriptDialogHandledAction"
-        },
-        "has_browser_handler": {
-          "type": [
-            "boolean",
-            "null"
-          ]
-        },
-        "message": {
-          "type": "string"
-        },
-        "sequence": {
-          "description": "Monotonic per-tab sequence for ordering within a session.",
-          "type": "integer",
-          "format": "uint64",
-          "minimum": 0.0
-        },
-        "tab_id": {
-          "type": "integer",
-          "format": "int64"
-        },
-        "type": {
-          "$ref": "#/definitions/JavaScriptDialogType"
-        },
-        "url": {
-          "type": [
-            "string",
-            "null"
-          ]
-        }
-      }
-    },
-    "JavaScriptDialogType": {
-      "description": "Native JS dialog kind reported by CDP.",
-      "type": "string",
-      "enum": [
-        "alert",
-        "confirm",
-        "prompt",
-        "beforeunload"
-      ]
-    }
-  }
-}

crates/bsk-protocol/schema/tool_scroll_to_params.json

@@ -1,42 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "ScrollToParams",
-  "type": "object",
-  "required": [
-    "session_id"
-  ],
-  "properties": {
-    "ref": {
-      "description": "Optional `@e<N>` ref allocated by the last observation. Mutually exclusive with `selector`.",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "selector": {
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "session_id": {
-      "type": "string"
-    },
-    "tab_id": {
-      "description": "Target tab. Defaults to the Agent Window's active tab.",
-      "type": [
-        "integer",
-        "null"
-      ],
-      "format": "int64"
-    },
-    "timeout_ms": {
-      "type": [
-        "integer",
-        "null"
-      ],
-      "format": "uint32",
-      "minimum": 1.0
-    }
-  }
-}

crates/bsk-protocol/schema/tool_scroll_to_result.json

@@ -1,123 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "ScrollToResult",
-  "type": "object",
-  "required": [
-    "height",
-    "tab_id",
-    "width",
-    "x",
-    "y"
-  ],
-  "properties": {
-    "dialogs": {
-      "type": "array",
-      "items": {
-        "$ref": "#/definitions/JavaScriptDialogInfo"
-      }
-    },
-    "height": {
-      "type": "number",
-      "format": "double"
-    },
-    "tab_id": {
-      "type": "integer",
-      "format": "int64"
-    },
-    "used_ref": {
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "used_selector": {
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "width": {
-      "type": "number",
-      "format": "double"
-    },
-    "x": {
-      "description": "Bounding rectangle of the element's visible border-box portion, in top-level viewport CSS pixels, after ancestor and viewport clipping. Partial visibility is sufficient. This is not an occlusion or hit test.",
-      "type": "number",
-      "format": "double"
-    },
-    "y": {
-      "type": "number",
-      "format": "double"
-    }
-  },
-  "definitions": {
-    "JavaScriptDialogHandledAction": {
-      "description": "How the extension resolved the dialog so CDP could continue.",
-      "type": "string",
-      "enum": [
-        "accepted",
-        "dismissed"
-      ]
-    },
-    "JavaScriptDialogInfo": {
-      "description": "One observed + handled JavaScript dialog during a tool call.",
-      "type": "object",
-      "required": [
-        "handled",
-        "message",
-        "sequence",
-        "tab_id",
-        "type"
-      ],
-      "properties": {
-        "default_prompt": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "handled": {
-          "$ref": "#/definitions/JavaScriptDialogHandledAction"
-        },
-        "has_browser_handler": {
-          "type": [
-            "boolean",
-            "null"
-          ]
-        },
-        "message": {
-          "type": "string"
-        },
-        "sequence": {
-          "description": "Monotonic per-tab sequence for ordering within a session.",
-          "type": "integer",
-          "format": "uint64",
-          "minimum": 0.0
-        },
-        "tab_id": {
-          "type": "integer",
-          "format": "int64"
-        },
-        "type": {
-          "$ref": "#/definitions/JavaScriptDialogType"
-        },
-        "url": {
-          "type": [
-            "string",
-            "null"
-          ]
-        }
-      }
-    },
-    "JavaScriptDialogType": {
-      "description": "Native JS dialog kind reported by CDP.",
-      "type": "string",
-      "enum": [
-        "alert",
-        "confirm",
-        "prompt",
-        "beforeunload"
-      ]
-    }
-  }
-}

crates/bsk-protocol/src/bin/dump-schema.rs

@@ -79,12 +79,6 @@ fn main() {
     dump!(ClickResult, "tool_click_result");
     dump!(HoverParams, "tool_hover_params");
     dump!(HoverResult, "tool_hover_result");
-    dump!(ScrollToParams, "tool_scroll_to_params");
-    dump!(ScrollToResult, "tool_scroll_to_result");
-    dump!(FocusParams, "tool_focus_params");
-    dump!(FocusResult, "tool_focus_result");
-    dump!(BlurParams, "tool_blur_params");
-    dump!(BlurResult, "tool_blur_result");
     dump!(FillParams, "tool_fill_params");
     dump!(FillResult, "tool_fill_result");
     dump!(PressParams, "tool_press_params");

crates/bsk-protocol/src/method.rs

@@ -72,12 +72,6 @@ pub enum Method {
     ToolClick,
     #[serde(rename = "tool.hover")]
     ToolHover,
-    #[serde(rename = "tool.scroll_to")]
-    ToolScrollTo,
-    #[serde(rename = "tool.focus")]
-    ToolFocus,
-    #[serde(rename = "tool.blur")]
-    ToolBlur,
     #[serde(rename = "tool.fill")]
     ToolFill,
     #[serde(rename = "tool.press")]
@@ -174,9 +168,6 @@ impl Method {
             | Method::ToolNavigateForward
             | Method::ToolReload
             | Method::ToolClick
-            | Method::ToolScrollTo
-            | Method::ToolFocus
-            | Method::ToolBlur
             | Method::ToolFill
             | Method::ToolPress
             | Method::ToolSelect
@@ -314,9 +305,6 @@ mod tests {
         assert!(Method::ToolNavigateForward.is_mutating());
         assert!(Method::ToolReload.is_mutating());
         assert!(Method::ToolClick.is_mutating());
-        assert!(Method::ToolScrollTo.is_mutating());
-        assert!(Method::ToolFocus.is_mutating());
-        assert!(Method::ToolBlur.is_mutating());
         assert!(Method::ToolFill.is_mutating());
         assert!(Method::ToolPress.is_mutating());
         assert!(Method::ToolSelect.is_mutating());
@@ -361,9 +349,6 @@ mod tests {
         assert_eq!(Method::ToolHover.effect(), MethodEffect::TransientInput);
         assert_eq!(Method::ToolObserve.effect(), MethodEffect::TransientInput);
         assert_eq!(Method::ToolClick.effect(), MethodEffect::BrowserMutation);
-        assert_eq!(Method::ToolScrollTo.effect(), MethodEffect::BrowserMutation);
-        assert_eq!(Method::ToolFocus.effect(), MethodEffect::BrowserMutation);
-        assert_eq!(Method::ToolBlur.effect(), MethodEffect::BrowserMutation);
         assert_eq!(Method::Cancel.effect(), MethodEffect::ControlPlane);
     }
 
@@ -373,9 +358,6 @@ mod tests {
         assert!(Method::ToolHover.requires_interrupt_gate());
         assert!(Method::ToolObserve.requires_interrupt_gate());
         assert!(Method::ToolClick.requires_interrupt_gate());
-        assert!(Method::ToolScrollTo.requires_interrupt_gate());
-        assert!(Method::ToolFocus.requires_interrupt_gate());
-        assert!(Method::ToolBlur.requires_interrupt_gate());
         assert!(!Method::Cancel.requires_interrupt_gate());
     }
 }

crates/bsk-protocol/src/tools/interaction.rs

@@ -1,5 +1,5 @@
-//! DOM interaction tools (`tool.click`, `tool.hover`, `tool.focus`,
-//! `tool.blur`, `tool.fill`, `tool.press`, `tool.select`).
+//! DOM interaction tools (`tool.click`, `tool.fill`, `tool.press`,
+//! `tool.select`).
 //!
 //! Element-targeted tools accept either a snapshot `ref` (`@e<N>` form,
 //! normalised against the session's RefStore) **or** a CSS selector
@@ -131,82 +131,6 @@ pub struct HoverResult {
     pub dialogs: Vec<JavaScriptDialogInfo>,
 }
 
-// ---------------------------------------------------------------------------
-// focus / blur
-// ---------------------------------------------------------------------------
-
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
-pub struct FocusParams {
-    pub session_id: String,
-    /// Optional `@e<N>` ref allocated by the last observation.
-    /// Mutually exclusive with `selector`.
-    #[serde(
-        rename = "ref",
-        alias = "ref_",
-        default,
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub ref_: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub selector: Option<String>,
-    /// Target tab. Defaults to the Agent Window's active tab.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub tab_id: Option<i64>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    #[schemars(range(min = 1))]
-    pub timeout_ms: Option<u32>,
-}
-
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
-pub struct FocusResult {
-    pub tab_id: i64,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub used_ref: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub used_selector: Option<String>,
-    /// Whether the target holds DOM focus in its document or shadow root after the call.
-    pub focused: bool,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub dialogs: Vec<JavaScriptDialogInfo>,
-}
-
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
-pub struct BlurParams {
-    pub session_id: String,
-    /// Optional `@e<N>` ref allocated by the last observation.
-    /// Mutually exclusive with `selector`.
-    #[serde(
-        rename = "ref",
-        alias = "ref_",
-        default,
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub ref_: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub selector: Option<String>,
-    /// Target tab. Defaults to the Agent Window's active tab.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub tab_id: Option<i64>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    #[schemars(range(min = 1))]
-    pub timeout_ms: Option<u32>,
-}
-
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
-pub struct BlurResult {
-    pub tab_id: i64,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub used_ref: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub used_selector: Option<String>,
-    /// Whether the target held focus before the call.
-    pub was_focused: bool,
-    /// Always false for a successful blur; included for machine verification.
-    pub focused: bool,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub dialogs: Vec<JavaScriptDialogInfo>,
-}
-
 // ---------------------------------------------------------------------------
 // fill
 // ---------------------------------------------------------------------------
@@ -401,37 +325,6 @@ mod tests {
         assert_eq!(round, p);
     }
 
-    #[test]
-    fn focus_params_serialise_ref_field_name() {
-        let p = FocusParams {
-            session_id: "abcd".into(),
-            ref_: Some("@e4".into()),
-            selector: None,
-            tab_id: Some(42),
-            timeout_ms: Some(5_000),
-        };
-        let v = serde_json::to_value(&p).unwrap();
-        assert_eq!(v.get("ref").and_then(|v| v.as_str()), Some("@e4"));
-        assert!(v.get("ref_").is_none());
-        let round: FocusParams = serde_json::from_value(v).unwrap();
-        assert_eq!(round, p);
-    }
-
-    #[test]
-    fn blur_result_round_trips_focus_state() {
-        let result = BlurResult {
-            tab_id: 42,
-            used_ref: Some("e4".into()),
-            used_selector: None,
-            was_focused: true,
-            focused: false,
-            dialogs: vec![],
-        };
-        let value = serde_json::to_value(&result).unwrap();
-        let round: BlurResult = serde_json::from_value(value).unwrap();
-        assert_eq!(round, result);
-    }
-
     #[test]
     fn modifiers_render_as_lowercase_strings() {
         let v = serde_json::to_value(KeyModifier::Ctrl).unwrap();

crates/bsk-protocol/src/tools/mod.rs

@@ -14,7 +14,6 @@ mod record_common;
 mod record_v2;
 mod record_v3;
 pub mod script;
-pub mod scroll;
 pub mod session;
 pub mod tabs;
 pub mod waits;
@@ -31,7 +30,6 @@ pub use network::*;
 pub use observation::*;
 pub use record::*;
 pub use script::*;
-pub use scroll::*;
 pub use session::*;
 pub use tabs::*;
 pub use waits::*;

crates/bsk-protocol/src/tools/scroll.rs

@@ -1,67 +0,0 @@
-//! Element scrolling primitive (`tool.scroll_to`).
-
-use schemars::JsonSchema;
-use serde::{Deserialize, Serialize};
-
-use super::JavaScriptDialogInfo;
-
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
-pub struct ScrollToParams {
-    pub session_id: String,
-    /// Optional `@e<N>` ref allocated by the last observation.
-    /// Mutually exclusive with `selector`.
-    #[serde(
-        rename = "ref",
-        alias = "ref_",
-        default,
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub ref_: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub selector: Option<String>,
-    /// Target tab. Defaults to the Agent Window's active tab.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub tab_id: Option<i64>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    #[schemars(range(min = 1))]
-    pub timeout_ms: Option<u32>,
-}
-
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
-pub struct ScrollToResult {
-    pub tab_id: i64,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub used_ref: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub used_selector: Option<String>,
-    /// Bounding rectangle of the element's visible border-box portion, in
-    /// top-level viewport CSS pixels, after ancestor and viewport clipping.
-    /// Partial visibility is sufficient. This is not an occlusion or hit test.
-    pub x: f64,
-    pub y: f64,
-    pub width: f64,
-    pub height: f64,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub dialogs: Vec<JavaScriptDialogInfo>,
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn params_serialise_ref_field_name() {
-        let params = ScrollToParams {
-            session_id: "abcd".into(),
-            ref_: Some("@e3".into()),
-            selector: None,
-            tab_id: Some(42),
-            timeout_ms: Some(5_000),
-        };
-        let value = serde_json::to_value(&params).unwrap();
-        assert_eq!(value.get("ref").and_then(|v| v.as_str()), Some("@e3"));
-        assert!(value.get("ref_").is_none());
-        let round: ScrollToParams = serde_json::from_value(value).unwrap();
-        assert_eq!(round, params);
-    }
-}

docs/architecture.md

@@ -84,11 +84,6 @@ Shared Rust types + JSON Schema generation. TypeScript mirrors frame shapes in
 4. Extension dispatcher validates sandbox rules, invokes CDP via `BrowserDriver`.
 5. Response travels CLI ← daemon ← extension; CLI prints result and exits.
 
-The [scroll-to primitive reference](scroll-to.md) documents `tool.scroll_to`,
-including its CLI/plugin mappings, visible-bounds contract and cancellation
-behavior. It follows the same routing path and is classified as a browser
-mutation for session queueing and user-interruption gating.
-
 ## Session and sandbox model
 
 - **Session** = opaque ID (4 lowercase letters in v0.1) + dedicated **Agent Window**

docs/scroll-to.md

@@ -1,131 +0,0 @@
-# Scroll-to primitive
-
-`scroll-to` brings an existing element and its containing frames into view, then
-returns the visible portion's bounds. Use it to reveal a target before inspecting
-the page or taking a screenshot. It accepts an element target rather than a pixel
-distance or scroll direction.
-
-| Entry point | Name |
-| --- | --- |
-| CLI | `bsk scroll-to` |
-| Wire protocol | `tool.scroll_to` |
-| DeepSeek Harness | `browser_interact` with `action: "scroll-to"` |
-
-## CLI
-
-Use a session you started and a fresh ref from an observation. The ids below are
-examples; substitute the session, tab and ref returned by your own calls.
-
-```sh
-bsk scroll-to @e3 --session abcd --tab-id 42 --timeout 5s --json
-bsk scroll-to --selector '#details' --session abcd
-```
-
-Supply exactly one target: a positional ref or selector, `--ref`, or `--selector`.
-Refs accept `@e3` and `e3`. CSS selectors search only the main document; use refs
-for elements in iframes (including out-of-process iframes) or shadow roots.
-Refs belong to one session and tab and may become stale after page changes.
-
-`--session` is required. `--tab-id` defaults to the Agent Window's active tab.
-`--timeout` defaults to `30s` and must be positive; durations such as `5000ms` and
-`5s` are accepted. The command operates on Agent Window tabs, including user tabs
-explicitly borrowed into that window.
-
-Example JSON output:
-
-```json
-{
-  "tab_id": 42,
-  "used_ref": "e3",
-  "x": 10,
-  "y": 20,
-  "width": 100,
-  "height": 80
-}
-```
-
-`used_ref` or `used_selector` identifies the resolved target. The optional
-`dialogs` array reports JavaScript dialogs handled during the call.
-
-## Result contract
-
-`x` and `y` are the upper-left corner, and `width` and `height` are the size of
-the visible border-box portion's bounding rectangle. All four values use
-**top-level viewport CSS pixels**, after scrolling and clipping by ancestor
-containers and frame viewports. They are not document or screenshot pixel
-coordinates.
-
-Partial visibility is sufficient: a 400px-high element clipped by an 80px-high
-scroll container can succeed with `height: 80`. Hidden or fully clipped targets
-fail. The rectangle is not an occlusion or hit test: another element can cover
-the target, and the rectangle's center is not a guaranteed click point. Layout
-can change after the result; use fresh refs for subsequent interactions.
-
-## Protocol and plugin
-
-The CLI sends a normal request through the daemon to the extension:
-
-```json
-{
-  "id": "scroll-1",
-  "method": "tool.scroll_to",
-  "params": {
-    "session_id": "abcd",
-    "ref": "@e3",
-    "tab_id": 42,
-    "timeout_ms": 5000
-  }
-}
-```
-
-Protocol callers must supply exactly one nonempty `ref` or `selector`.
-`tab_id` is optional; `timeout_ms` is a positive integer and defaults to 30000.
-These target constraints are enforced by the handler. See the generated
-[parameter schema](../crates/bsk-protocol/schema/tool_scroll_to_params.json) and
-[result schema](../crates/bsk-protocol/schema/tool_scroll_to_result.json) for field
-types. The wire response wraps the result above in `{ "id": "scroll-1", "result": ... }`.
-
-The plugin exposes the same action with its usual camelCase parameters:
-
-```json
-{
-  "action": "scroll-to",
-  "session": "abcd",
-  "target": "@e3",
-  "tabId": 42,
-  "timeoutMs": 5000
-}
-```
-
-Call this through `browser_interact` using a plugin-owned session. Its result
-contains `session`, `tabId`, `x`, `y`, `width` and `height` with the same bounds
-semantics. Omitted `session` uses the plugin's current session.
-
-## Errors and interruption
-
-The wire response uses the normal `error.code`, `error.message` and optional
-`error.data.reason` fields. Common cases are:
-
-| Code | `data.reason` | Meaning |
-| --- | --- | --- |
-| `invalid_params` | — | Missing/conflicting target or invalid timeout/tab id |
-| `not_found` | `ref_not_found` | Ref is unknown, expired or belongs to another tab |
-| `not_found` | `selector_not_found` | Main-document selector matched no element |
-| `permission_denied` | `agent_window_scope` | Target tab has not been borrowed into the Agent Window |
-| `permission_denied` | `element_not_visible` | No visible area remains after scrolling |
-| `cancelled` | — | The call was cancelled |
-| `timeout` | — | The action deadline expired |
-| `cdp_failed` | varies | Browser command, frame geometry or visibility measurement failed |
-
-The protocol classifies scroll-to as a browser mutation, so it uses the existing
-per-session queue and user-interruption gate. The extension releases any retained
-hover state before dispatch. Cancellation and deadline checks surround each CDP
-step, including frame lookup, scrolling and measurement. Once detected, they
-prevent further scrolling and a successful response; remote-object cleanup still
-runs. Already performed scrolling is not rolled back, so inspect the current
-page before retrying an interrupted call.
-
-The implementation is scoped to scroll-to: it reuses frame scrolling and
-coordinate projection, with a separate visibility measurement that accounts for
-ancestor clipping and hidden frame owners. Shared click, hover and screenshot
-geometry is unchanged.

evals/browser/cases/regression/oopif-scrollbars/README.md

@@ -1,41 +0,0 @@
-# OOPIF occupied-scrollbar regression
-
-An iframe's content quad includes its child viewport's scrollbar space, while
-`Page.getLayoutMetrics().cssLayoutViewport` excludes that space. Mapping the latter
-onto the whole quad stretches positions and sizes. The full target-local viewport
-must determine scale; the visible viewport must still clip content at every OOPIF
-boundary and constrain target-local action points.
-
-This fixture alternates loopback hostnames across two nested OOPIFs. It includes
-scrolling, borders, padding, scaled iframe owners, a partially clipped button and
-a fully clipped button. Custom scrollbars occupy different widths and heights.
-The `scrollbars` query parameter accepts `both` (default), `vertical`, `horizontal`
-or `none`.
-
-Run the numerical regression with Node 22+ and a local Chrome executable:
-
-```sh
-BSK_GEOMETRY_CHROME=/path/to/chrome pnpm --filter @browser-skill/extension exec vitest run \
-  src/tools/__tests__/snapshot-coordinates.browser.test.ts
-```
-
-The existing browser runner is shared with the snapshot-unit regression. The test:
-
-- Verifies actual OOPIF targets and occupied scrollbar dimensions.
-- Compares snapshot and live geometry with independent DOM rectangles and clipping.
-- Dispatches real root-target clicks and verifies the intended frame/button received them.
-- Rejects fully clipped controls and checks snapshot measurement reuse per target.
-- Covers five device-scale/browser-zoom combinations plus single-axis and no-scrollbar cases.
-
-The runner creates and removes isolated browser profiles. It is opt-in and skipped
-in normal unit runs when `BSK_GEOMETRY_CHROME` is unset.
-
-Run the CLI fixture smoke with a connected test extension:
-
-```sh
-BSK_AUTO_UPDATE=off pnpm eval:browser smoke --case oopif-scrollbars --bsk ./target/debug/bsk
-```
-
-The smoke assertions verify both nested frames have occupied scrollbars, that the
-marker is observed and that the session is closed. Numeric geometry and actual
-click assertions are exercised by the browser test above, not by smoke alone.