Sanitize legacy persisted task state and document handoff URL semantics

CHANGELOG.md

@@ -1,13 +1,14 @@
 # Changelog
 
 ## Unreleased
-- Changed `browser_handoff` into an asynchronous start operation. It now returns `completed` immediately after the durable handoff and global browser blackout are active, allowing the initiating agent to continue independent non-browser work while the user completes the step; browser observation and mutation remain blocked until the handoff clears.
-- Added a disabled-by-default popup setting named YOLO mode. When enabled, recognizable consequential controls execute in the original `browser_act` call instead of entering Commit review; enabling it discards pending staged actions while task ownership, origin policy, revision checks, handoff blackout, credential isolation, and all other Standard boundaries remain enforced.
+- Made `browser_handoff` a nonblocking coordination marker. It persists the active handoff and completion condition, focuses the declared tab, and returns immediately without pausing browser observations or mutations; explicit **Pause agents** remains available when the page must stay unobservable.
+- Enabled YOLO mode for new and legacy default state so recognizable consequential controls execute in the original `browser_act` call. Turning YOLO mode off restores staged Commit review. Task ownership, origin policy, revision checks, credential isolation, and all other Standard boundaries remain enforced.
 - Replaced the Chrome Bridge v1 runtime with the AgentTab 2.0 release candidate: a Rust production host over OS-native local IPC, nine task-scoped Standard methods, explicit resumable capabilities, a developer-only tenth method, TypeScript and Python SDKs, MCP and OMP adapters, a transactional installer, and a minimal extension. Consequential controls now use a two-party Commit flow: `browser_act` stages an exact effect, the popup approves the durable review record without executing it, and the requesting task must consume its private one-use token through `browser_commit`.
 - Added explicit `browser_finish` lifecycle finalization across Core RPC, the extension, TypeScript and Python SDKs, CLI, MCP, OMP, and Pi. Automatic cleanup tracks tab provenance, closes task-created tabs, retains adopted tabs, ungroups retained tabs, and releases ownership; popup policy can require confirmation or retain all tabs, while active handoff, Commit review, and in-flight work defer cleanup without destroying resumability.
 - Fixed OMP adapter compatibility with providers that reject top-level union tool schemas. `browser_open` and `browser_snapshot` now expose provider-compatible object schemas while retaining strict runtime validation for their mode-specific parameters.
 - Added a focus-safe GPT-Control browser driver backed by AgentTab task ownership and durable resume capabilities. It creates background task tabs, fills and sends prompts through Standard actions and Commit review, uploads through a bounded file-input selector, captures the latest assistant message without activating Chrome, persists session state owner-only, and closes the underlying task explicitly.
-- Added a disabled-by-default, host-managed 1Password credential broker. `browser_credentials` derives the current origin from task-owned host state, accepts at most three matching Login items and attempts, and uses short-lived one-use tokens to fill username, password, or one-time-code refs without exposing values through Core RPC, MCP, OMP, Pi, responses, or audit output. More than three matches, provider failures, exhausted attempts, and unsupported verification return `needs_user`. The extension's private fill path blocks capture before injecting selected values and never submits the form.
+- Enabled the host-managed 1Password credential broker by default, with an explicit `one_password.enabled: false` policy opt-out and platform-specific `op` command resolution. `browser_credentials` derives the current origin from task-owned host state, accepts at most three matching Login items and attempts, and uses short-lived one-use tokens to fill username, password, or one-time-code refs without exposing values through Core RPC, MCP, OMP, Pi, responses, or audit output. More than three matches, provider failures, exhausted attempts, and unsupported verification return `needs_user`.
+- Hardened persisted-state migration so legacy task records cannot brick extension startup. Builds that tracked `createdTabIds` as a cleanup ledger left entries for tabs that had already left the task; the state parser now sanitizes those to the current subset invariant instead of rejecting the whole persisted state, and the handoff completion schema documents that `kind: "url"` matches the tab URL exactly.
 - Fixed credential-broker activation against upgraded local state and GUI-launched browser hosts. Legacy `staged_commits` columns are migrated before dependent indexes are created, and policy can pin an absolute 1Password CLI executable when the browser process does not inherit the user's shell `PATH`.
 - Added task-owned background window creation to Standard `browser_open` through `placement: "new_window"`. It is operation-specific rather than a general window-control grant: only an otherwise empty task can request it, the extension creates an unfocused normal window, `background: false` is rejected, ownership is derived from persisted task state, and a failed visible group grant removes the new tab. Focus, state changes, and closure of unrelated windows remain unavailable.
 - Added explicit restricted-origin routing for task tabs. `browser_open` and `browser_tabs` now report `automation_route: "full" | "tab_only"`; Chrome system pages, extension pages, DevTools, and the Chrome Web Store retain task-owned explicit navigation, reload, close, and bounded waits, while page inspection, interaction, and raw CDP fail before execution with the stable `browser_restricted_origin` / `not_started` result and non-retry recovery. History movement remains available without managed origin constraints and fails closed when constraints are configured because Chrome does not expose its destination for pre-navigation authorization.

README.md

@@ -6,7 +6,7 @@
 
 > Give an agent a tab, not the keys to your browser.
 
-AgentTab lets an agent work in your existing signed-in Chrome profile without giving it unrestricted control of the profile. Each connection receives a task-owned browser workspace. The agent can create tabs, inspect and act in those tabs, wait for page state, and ask for help. A disabled-by-default 1Password broker can fill a matching login or one-time code without exposing its value to the agent; passkeys, security keys, CAPTCHA, payment secrets, account recovery, and unsupported verification remain **Your Turn**. Recognizable consequential actions are staged for **Commit** instead of being performed immediately.
+AgentTab lets an agent work in your existing signed-in Chrome profile without giving it unrestricted control of the profile. Each connection receives a task-owned browser workspace. The agent can create tabs, inspect and act in those tabs, wait for page state, and ask for help. The built-in 1Password broker is available by default and can fill a matching login or one-time code without exposing its value to the agent; passkeys, security keys, CAPTCHA, payment secrets, account recovery, and unsupported verification remain **Your Turn**. Recognizable consequential actions execute directly by default, while the popup can enable a staged **Commit** review when desired.
 
 ## Release status
 
@@ -24,8 +24,8 @@ The command has no path, token, or shell-specific argument and is suitable for P
 
 1. An agent calls `browser_open` with `mode: "create"`. AgentTab creates a background tab for that task and returns its task, tab, window, page-revision, and automation-route identifiers. `placement: "new_window"` may create the task's first tab in a separate unfocused normal window.
 2. On a normal web origin, the agent calls `browser_snapshot`, works from revisioned accessibility references, then calls `browser_act` with the expected page revision. It cannot act on unrelated tabs.
-3. If managed policy enables 1Password and an ordinary sign-in page has at most three origin-matching Login items, the agent can request a short-lived opaque token and ask the host to fill named field refs. Credential values travel only from `op` to the host and extension, never through Core RPC or the adapter. Every other human-only input uses `browser_handoff`, which focuses that tab, pauses automation, and blocks browser observation until the declared completion condition or **I'm done**.
-4. If AgentTab recognizes a send, publish, purchase, delete, upload, authorization, or permission-grant control, `browser_act` can return `commit_required`. The extension shows the staged effect in its popup. A human must approve it there before the agent can call `browser_commit` with the one-use staged token. The disabled-by-default YOLO mode setting skips this Commit review and executes recognized consequential controls in the original `browser_act` call.
+3. On an ordinary sign-in page with at most three origin-matching Login items, the agent can request a short-lived opaque token and ask the host to fill named field refs through the local `op` command. Credential values travel only from `op` to the host and extension, never through Core RPC or the adapter. Owner-only policy can disable or constrain this broker. Every other human-only input uses `browser_handoff`, which focuses that tab and records a durable completion condition while browser automation remains available.
+4. Recognized send, publish, purchase, delete, upload, authorization, and permission-grant controls execute in the original `browser_act` call by default. Turn off YOLO mode in the popup to require Commit review instead. In review mode, AgentTab stages the control, shows its effect in the popup, requires human approval, and then accepts the one-use token through `browser_commit`.
 5. The task can list only its own tabs with `browser_tabs`. A separate client gets a separate task unless it proves its durable resume capability.
 6. When browser work is complete, the agent calls `browser_finish`. Automatic cleanup closes tabs created by the task, preserves tabs adopted from the user's existing browser state, ungroups retained tabs, and releases task ownership. The popup setting can instead require confirmation or retain every tab.
 
@@ -36,8 +36,8 @@ Commit is a two-party, best-effort semantic barrier, not proof that a page has n
 ## Trust contract
 
 - **Task ownership is an execution and coordination boundary, not profile isolation.** AgentTab can use the signed-in session in the browser profile, but Standard mode does not expose raw cookies, storage, passwords, arbitrary JavaScript, raw CDP, coordinate actions, network interception, or a generic browser-global mutation API. Its one window-level operation creates an unfocused normal window for the first tab of an otherwise empty task.
-- **Your Turn is the only routine focus transition.** Routine task work stays in task-owned tabs. During handoff, all agent observation and capture are denied so human credentials are not captured.
-- **Commit requires human approval and agent intent unless YOLO mode is enabled.** By default, a staged action is bound to its task, tab, page revision, element fingerprint, effect, and short expiry. Popup approval records consent but does not execute it. The agent must then call `browser_commit`; a changed page, expired stage, used token, or unapproved stage cannot execute. YOLO mode is an explicit local opt-out from Commit review, not from ownership, origin policy, revisions, handoff blackout, or credential boundaries.
+- **Your Turn is the only routine focus transition.** Routine task work stays in task-owned tabs. Handoff focuses the declared tab and records a durable completion condition without globally pausing browser work. This permissive default does not guarantee an observation blackout while the user types; prefer `browser_credentials` for ordinary sign-in fields because its values never enter AgentTab RPC or audit data.
+- **Consequential actions run directly by default; Commit review is available.** YOLO mode skips the staging step but not task ownership, origin policy, expected page revisions, restricted-origin routing, credential isolation, or action validation. Turning YOLO mode off binds each staged action to its task, tab, page revision, element fingerprint, effect, and short expiry. Popup approval records consent but does not execute it; the agent must call `browser_commit`.
 - **Local by default.** Policy, task state, audit records, and IPC stay on the machine. AgentTab has no telemetry. See [Telemetry](docs/telemetry.md) and [Security](docs/security.md).
 
 ## Tool surface
@@ -53,7 +53,7 @@ Standard mode exposes exactly nine tools:
 | `browser_tabs` | List only tabs owned by the current task, including each tab's automation route. |
 | `browser_handoff` | Give the user control for human-only input. |
 | `browser_commit` | Execute one staged consequential action. |
-| `browser_credentials` | Prepare and fill an origin-matching 1Password login through opaque, short-lived host tokens when managed policy explicitly enables it. |
+| `browser_credentials` | Prepare and fill an origin-matching 1Password login through opaque, short-lived host tokens. Available by default when the local `op` CLI is usable; owner-only policy can disable or constrain it. |
 | `browser_finish` | Finish the task, apply its cleanup policy, return closed and retained tab receipts, and release ownership. |
 
 Developer mode adds one tool, `browser_developer`. It is absent from Standard discovery. It requires both the persistent Developer mode control in the AgentTab popup and `AGENTTAB_DEVELOPER=1` in the adapter environment. Treat it as an explicit expansion of the normal boundary.

docs/adr/0001-agenttab-runtime.md

@@ -26,19 +26,19 @@ A task workspace is visible in Chrome. Task-owned tabs are grouped for display,
 
 ### Your Turn
 
-**Your Turn** is the human-only input boundary. AgentTab MUST hand control to the user for passkeys, security keys, CAPTCHA, payment secrets, account recovery, unsupported verification, and any credential workflow that returns `needs_user`. A disabled-by-default managed 1Password broker MAY fill an origin-matching Login item through the private host-to-extension path, but MUST NOT expose the value to an agent or submit the form.
+**Your Turn** is the human-only input boundary. AgentTab MUST hand control to the user for passkeys, security keys, CAPTCHA, payment secrets, account recovery, unsupported verification, and any credential workflow that returns `needs_user`. The managed 1Password broker is available by default and MAY fill an origin-matching Login item through the private host-to-extension path, but MUST NOT expose the value to an agent or submit the form. Owner-only policy MAY disable or constrain the broker.
 
-While any Your Turn handoff is active, AgentTab MUST enforce a global observation blackout across every task and client. The extension and host each fail closed. AgentTab MUST NOT capture human keystrokes. Handoff clears only after its declared completion condition or explicit Done, capture scrubbing, and host acknowledgement.
+An active handoff MUST be a durable coordination marker, not an implicit automation pause. AgentTab MUST persist the handoff and completion condition before focusing the declared tab, then keep browser requests eligible. Product and security copy MUST state that handoff does not guarantee an observation blackout and MUST direct ordinary username, password, and one-time-code entry through `browser_credentials`. Explicit **Pause agents** remains the owner-controlled confidentiality boundary.
 
 ### Commit
 
 **Commit** is a best-effort semantic review barrier for recognizable consequential controls, including send, publish, purchase, delete, upload, authorization, and permission grants.
 
-Every Standard-mode mutation MUST pass through one extension-side `prepare -> classify -> revalidate -> execute` choke point. A recognizable consequential action is staged before any side effect. Its token is bound to the task, tab, effect class, exact element fingerprint, document revision, event, preview, and a five-minute expiry. The extension popup MUST send only an opaque review handle. Human approval MUST durably mark the corresponding stage approved without consuming it or dispatching the browser action. Only a later agent `browser_commit` carrying the private staged token may consume and execute the approved stage. Execution MUST reject an unapproved, changed, expired, foreign, or used stage, revalidate the target, and dispatch at most once.
+Every Standard-mode mutation MUST pass through one extension-side `prepare -> classify -> revalidate -> execute` choke point. YOLO mode is enabled by default, so recognizable consequential actions execute in the original mutation. When the user turns YOLO mode off, a recognizable consequential action is staged before any side effect. Its token is bound to the task, tab, effect class, exact element fingerprint, document revision, event, preview, and a five-minute expiry. The extension popup MUST send only an opaque review handle. Human approval MUST durably mark the corresponding stage approved without consuming it or dispatching the browser action. Only a later agent `browser_commit` carrying the private staged token may consume and execute the approved stage. Execution MUST reject an unapproved, changed, expired, foreign, or used stage, revalidate the target, and dispatch at most once.
 
 Commit does not guarantee recognition of every page-triggered external effect. A page can attach a consequential effect to an innocently labelled control. Product and security copy MUST describe Commit as risk reduction, not proof of semantic safety.
 
-Action batches are sequential and non-atomic. A batch stops before its first staged operation and returns the completed prefix plus staged index. Committing that staged operation MUST NOT execute later operations implicitly.
+Action batches are sequential and non-atomic. With YOLO mode off, a batch stops before its first staged operation and returns the completed prefix plus staged index. Committing that staged operation MUST NOT execute later operations implicitly. With YOLO mode on, the recognized action executes inline and the batch continues.
 
 ## Security boundary
 

docs/benchmarks.md

@@ -27,7 +27,7 @@ When comparing another surface, run the same scenario, user-visible success crit
 
 Do not convert security barriers into speed-only scores. If measuring Commit, record classification result, stage creation, human review delay as a separate interval, revalidation outcome, and execution or refusal. Never Commit a real consequential action only to collect a timing number.
 
-If measuring handoff, record only safe lifecycle timestamps such as request accepted, blackout active, completion acknowledged, and resume ready. Do not record keys, secrets, page contents, screenshots, or human input.
+If measuring handoff, record only safe lifecycle timestamps such as request accepted, marker active, completion acknowledged, and marker cleared. Do not record keys, secrets, page contents, screenshots, or human input.
 
 ## Publishing a result