Add shared Environment browser with progressive agent tools

.papercuts/troubleshooting.md

@@ -311,3 +311,51 @@ owns; reopen the terminal before judging the final live state.
   platform-independent test that exercises both certificate and keychain paths.
 - A changelog search conflated the stable and prerelease lines. Verify published
   package code before assuming a release contains the upstream patch.
+- The environment-browser checkout has no `.memory/` directory despite AGENTS guidance; use current source, existing design references, and the scoped browser parity document as implementation evidence.
+- t3code's browser spans profiles/import, recording, annotations, device emulation, and agent control across desktop/server/web. Track a source-backed feature matrix before porting; a navigation-only webview would silently miss the requested parity.
+- `npm ci` completed without Electron's macOS payload in this worktree; `node node_modules/electron/install.js` restored `Electron.app` before UI testing.
+- T3's hardcoded `source3` Playwright extraction points at a different bundle string in installed Playwright 1.62.1; locate the named generated module to preserve selector-engine parity.
+- Generated onboarding art had real alpha but a 1254px canvas despite the requested 1024px; normalize the final PNG to the repository's exact 1024px contract and validate its alpha.
+- System `java_home` has no registered JDK, but Android Studio's bundled JBR works for Gradle; use its `Contents/jbr/Contents/Home` and the existing Android SDK explicitly for focused mobile tests.
+- No physical iOS device is connected for this run, and repository guidance prohibits simulators. Generic iOS `build-for-testing` with signing disabled compiles the app/tests; actual XCTest execution remains a physical-device check.
+- Electron 43 emits the console-message payload on the event object; reading the legacy second argument as that payload threw during first navigation and blocked the test app behind an exception dialog. Use the current typed event and verify in real Electron, not just service mocks.
+
+- 2026-09-07: Native Browser views sit above renderer menus/dialogs. Presentation now observes visible overlays and serializes tab show/hide across remounts so delayed cleanup cannot hide the replacement view.
+- Renderer-only Playwright captures omit native WebContentsViews; use the exact worktree Electron.app with CUA for visual proof. Several installed Electron copies share a bundle ID, so resolve the full app path.
+- Streaming reveal briefly renders duplicate final message text; E2E assertions must target the visible transcript occurrence and independently check the scripted tool scenario completed.
+- Browser preflight exposed two existing source-contract mismatches in unchanged provider badges and button press-feedback tests. Keep that baseline distinct from browser regression results.
+- Responsive emulation letterboxes inside the native slot. Crop captures to the rendered viewport before translating annotation coordinates; using the full slot silently distorts vertical selections.
+
+## 2026-09-07 — Browser integration verification
+
+- Floating placement measured the workbench wrapper and covered the Environment close control. Measure the chat viewport and visible side surfaces; retain a normal pointer-click regression.
+- Approval summaries and tool admission both use browser policy helpers. Full-mode E2E misses Ask-mode summary errors; retain TypeScript validation and an actual approval-loop regression.
+- Reverting live styles during the preview debounce must still enqueue the restored desired state; comparing only the last completed key leaves an in-flight change applied.
+- Native visual verification exposed empty-chat composer overlap and CDP visible-size ownership. Reserve every composer and use `dontSetVisibleSize` so device emulation cannot override the measured native slot.
+- Browser tab titles and renderer selection can lag the main state response. E2E waits for `aria-selected`, closes the intended row, and canonicalizes URLs when finding the native guest.
+- Launching the shared Dev profile hit existing artifact/history recovery errors. Browser testing uses `build/browser-dev-profile/` with separate portable/user-data roots, copied provider setup, and a fresh workspace history.
+- Live browser test: agent tried `browser_open(file:///tmp/sample.html)` and received HTTP(S)-only rejection, then recovered with a Python server serving all of `/tmp` on port 8899. UI workspace `open_file` is not exposed to agent tools; add explicit local-preview guidance and a bounded file-preview route through existing tools, including intentional handling of user-requested files outside the workspace and server cleanup.
+
+## Browser lifecycle and progressive disclosure — 2026-09-08
+- An agent-created Python preview outlived its document. Verified the exact task-owned PID/start/cwd/port, terminated it, confirmed the HTML was absent, and removed its log. Managed exact-file previews now replace that fallback.
+- Review found queued actions could resume after human takeover, approvals could outlive page identity, and hover overlays could intercept semantic clicks. Added focused regression coverage and fixes. A cursor-cleanup review incorrectly read evaluate's isolated-world argument; the live cursor test caught the regression, and cleanup was restored to the creation context.
+- Progressive disclosure must install executable tools and update both outbound and durable-compaction budgets at a turn boundary. A setup-return wiring mistake was caught by TypeScript/review before Electron validation.
+- `tsx -e` uses CommonJS here and cannot load Pi's ESM-only export; use `node --import tsx --input-type=module` for measurement scripts.
+- Host preparation runs after a tool turn, and Pi journals an aborted assistant on Stop. Cancellation tests must reach that boundary and preserve its journal record; an abort rejection must not become a policy fault, while an independent host failure must still fail closed.
+
+- Electron main-process evaluation cannot dynamically import a module from the Playwright utility world. The delayed-acquisition regression uses `process.getBuiltinModule` and synchronizes builtin ESM exports so its filesystem gate actually reaches the production namespace import; restored in test cleanup.
+- Final dev restart exposed Browser mounting with a fabricated default workspace while workspace data loaded. Mount it only after the selected workspace exists; verify cold startup and the existing Environment/browser integration suites.
+
+## PR99 hosted CI follow-up — 2026-09-08
+- Diagnostics source scanning treated console calls in the serialized Playwright guest runtime as executable main-process logging. Use syntax-aware scanning with regression cases, retaining the reviewed-sink boundary.
+- Hosted CDP returned redacted object keys in a different order; the test incorrectly tied collision suffixes to boolean values. Verify distinct sanitized keys and preservation of both values without relying on enumeration order.
+
+- Pullfrog identified silent sensitive guest permissions and a workspace-wide local-preview origin. Restrict guest grants and serve exact pinned document/asset sets with distinct origins; keep declared workspace-file authorization while blocking unrelated siblings.
+- Ad-hoc `tsx -e` selected CommonJS and rejected the ESM-only Pi package exports. Use `node --import tsx --input-type=module` for token-estimate probes.
+- Matching-first input probing showed Chromium suppresses the duplicate injected keyDown, so a timing-only expectation could swallow the only physical event. Use Electron's native debugger-source flag for keyboard input, and interrupt unexpected repeats. Mouse-down/up omit this flag and retain a bounded documented collision fallback.
+- The next hosted Electron gate exposed immediate recording stop before the encoder produced a frame (both attempts). Validate recorder readiness instead of weakening the WebM assertion. Completed-job logs during an active run require the jobs/logs API; gh run view waits for whole-run completion.
+- Independent Chromium reproduction showed per-port preview cookies leaked to other localhost ports because cookies ignore ports. Replace cookies with native frame/origin-scoped request authorization, strip inherited headers and legacy cookies, and test redirects against a controlled server.
+
+## PR99 direct-preview follow-up — 2026-09-08
+- Exact-grant hardening left path-only Files/chat/terminal previews unable to load local sidecars. Derive a bounded static resource set for user-originated opens only, preserve strict explicit agent grants, and test the actual path-only entry point.
+- Static-discovery review found a sidecar symlink could target an excluded HTML/PDF, and same-content rewrites could reuse an older modification-time fingerprint. Reject canonical document targets and include pinned source metadata in grant identity.

README.md

@@ -27,6 +27,7 @@ I don't come from a coding background. I'd been bouncing between the coding agen
 - **Workspaces and managed worktrees** - use folders, scratch workspaces, or isolated managed worktrees with three access levels, workspace-scoped tools, Ask-mode approvals, guarded creation/deletion, and crash-aware cleanup.
 - **Models and the Model Pad** - choose from Pi's native hosted-provider catalog, local Ollama or LM Studio models, and declarative compatible endpoints. Arrange a personal capability-and-pace map, optionally enrich hosted models with explicitly fetched Artificial Analysis scores through a benchmark-only OpenRouter key, and keep benchmark evidence visibly separate from runtime limits and availability.
 - **Terminal, Git, and review** - keep a terminal drawer beside the conversation, inspect files and diffs in Environment, edit with dirty-file protection, compare branches, commit or push checked snapshots, and open the workspace in a discovered external editor.
+- **Shared browser and annotations** - browse beside the chat in Environment, preview workspace HTML/PDF files, use isolated profiles and responsive viewports, and share selected text, elements, drawings, and image crops with Aiden. Aiden's browser tools operate on those same tabs. See [browser behavior and controls](docs/environment-browser.md).
 - **macOS integration and appearance** - native menus, **Keychain**, **Parakeet**, the dictation pill, Apple **Foundation Models**, the signed **Rust** Computer Use broker, semantic themes, high contrast, reduced motion, and consistent light/dark rendering.
 - **Extensibility and background work** - use skills, **MCP**, **Exa** search, scheduled tasks, voice, and attachments through typed, allowlisted boundaries.
 - **Aiden On The Go** - opt in to a pinned local-network connection or an explicit non-Funnel Tailscale Serve route, pair each iPhone or iPad separately, and revoke devices from [Remote Access settings](docs/aiden-on-the-go-remote-access.md).

THIRD_PARTY_NOTICES.md

@@ -77,3 +77,33 @@ Permission is hereby granted, free of charge, to any person obtaining a copy of
 The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+## T3 Code browser
+
+The browser feature contract and device viewport presets are adapted from T3 Code.
+
+MIT License
+
+Copyright (c) 2026 T3 Tools Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+## Playwright browser selector runtime
+
+The pinned injected selector runtime is bundled for sandboxed browser automation. Copyright Microsoft Corporation. Licensed under the Apache License, Version 2.0; the full license is in `main/services/browser/PLAYWRIGHT-LICENSE`.

android/app/src/main/java/sbtbiswas/AidenOnTheGo/models/AidenChat.kt

@@ -356,6 +356,21 @@ object AidenAgentActivityPresentation {
         "schedule_task" to Pair("Scheduling", "Scheduled"),
         "edit_automation" to Pair("Editing automation", "Edited automation"),
         "computer_use" to Pair("Using Mac", "Used Mac"),
+        "browser" to Pair("Loading browser tools", "Loaded browser tools"),
+        "browser_status" to Pair("Checking browser", "Checked browser"),
+        "browser_open" to Pair("Opening browser", "Opened browser"),
+        "browser_navigate" to Pair("Navigating browser", "Navigated browser"),
+        "browser_resize" to Pair("Resizing browser", "Resized browser"),
+        "browser_set_appearance" to Pair("Setting browser appearance", "Set browser appearance"),
+        "browser_snapshot" to Pair("Inspecting browser", "Inspected browser"),
+        "browser_click" to Pair("Clicking in browser", "Clicked in browser"),
+        "browser_type" to Pair("Typing in browser", "Typed in browser"),
+        "browser_press" to Pair("Pressing browser keys", "Pressed browser keys"),
+        "browser_scroll" to Pair("Scrolling browser", "Scrolled browser"),
+        "browser_evaluate" to Pair("Evaluating page", "Evaluated page"),
+        "browser_wait_for" to Pair("Waiting for page", "Waited for page"),
+        "browser_recording_start" to Pair("Starting browser recording", "Started browser recording"),
+        "browser_recording_stop" to Pair("Stopping browser recording", "Stopped browser recording"),
         "vcc_recall" to Pair("Recalling chat history", "Recalled chat history"),
         "compact_context" to Pair("Compacting context", "Compacted context")
     )

android/app/src/test/java/sbtbiswas/AidenOnTheGo/AidenChatTest.kt

@@ -762,6 +762,33 @@ class AidenChatTest {
 
     @Test
     fun currentChatRecallUsesFixedPrivateActivityLabel() {
+        val browserLabels = mapOf(
+            "browser" to "Loaded browser tools",
+            "browser_status" to "Checked browser",
+            "browser_open" to "Opened browser",
+            "browser_navigate" to "Navigated browser",
+            "browser_resize" to "Resized browser",
+            "browser_set_appearance" to "Set browser appearance",
+            "browser_snapshot" to "Inspected browser",
+            "browser_click" to "Clicked in browser",
+            "browser_type" to "Typed in browser",
+            "browser_press" to "Pressed browser keys",
+            "browser_scroll" to "Scrolled browser",
+            "browser_evaluate" to "Evaluated page",
+            "browser_wait_for" to "Waited for page",
+            "browser_recording_start" to "Started browser recording",
+            "browser_recording_stop" to "Stopped browser recording"
+        )
+        for ((name, expected) in browserLabels) {
+            val browserStep = AidenAgentStep(
+                id = name, order = 0, kind = AidenAgentStep.Kind.TOOL,
+                toolName = name, label = name,
+                status = AidenAgentStepStatus.COMPLETED, startedAt = 1000.0,
+                updatedAt = 2000.0, finishedAt = 2000.0, contentOffset = 0,
+                durationMs = 1000.0
+            )
+            assertEquals(expected, AidenAgentActivityPresentation.line(browserStep))
+        }
         val step = AidenAgentStep(
             id = "recall-1", order = 0, kind = AidenAgentStep.Kind.TOOL,
             toolName = "vcc_recall", label = "Recall chat history",