diff --git a/extensions/agent-browser/lib/process.ts b/extensions/agent-browser/lib/process.ts
index 95b63a7f..82dd9f1d 100644
--- a/extensions/agent-browser/lib/process.ts
+++ b/extensions/agent-browser/lib/process.ts
@@ -21,7 +21,7 @@ const AGENT_BROWSER_SOCKET_DIR_ENV = "AGENT_BROWSER_SOCKET_DIR";
 const AGENT_BROWSER_DEFAULT_TIMEOUT_ENV = "AGENT_BROWSER_DEFAULT_TIMEOUT";
 const PI_AGENT_BROWSER_PROCESS_TIMEOUT_ENV = "PI_AGENT_BROWSER_PROCESS_TIMEOUT_MS";
 const DEFAULT_AGENT_BROWSER_SOCKET_DIR_PREFIX = "/tmp/piab";
-export const SAFE_AGENT_BROWSER_OPERATION_TIMEOUT_MS = 25_000;
+export const SAFE_AGENT_BROWSER_OPERATION_TIMEOUT_MS = 35_000;
 const DEFAULT_AGENT_BROWSER_PROCESS_TIMEOUT_MS = 35_000;
 /** Grace period after `exit` before resolving when `close` is delayed by inherited stdio handles. */
 const EXIT_STDIO_GRACE_MS = 100;
diff --git a/extensions/agent-browser/lib/results/editable-ref-evidence.ts b/extensions/agent-browser/lib/results/editable-ref-evidence.ts
index 046d3f24..d08b524e 100644
--- a/extensions/agent-browser/lib/results/editable-ref-evidence.ts
+++ b/extensions/agent-browser/lib/results/editable-ref-evidence.ts
@@ -11,6 +11,9 @@ const EDITABLE_FALSE_TEXT_PATTERN = /\b(?:contenteditable|editable)\s*=\s*["']?(
 const EDITABLE_ASSIGNMENT_TEXT_PATTERN = /\b(contenteditable|editable)\s*=\s*("[^"]*"|'[^']*'|[^\s,\]]+)/gi;
 const EDITABLE_BARE_TEXT_PATTERN = /\b(?:contenteditable|editable)\b(?!\s*=)/i;
 
+/** Roles that are inherently editable controls in the browser accessibility tree. */
+const KNOWN_EDITABLE_ROLES = new Set(["searchbox", "textbox", "combobox", "spinbutton"]);
+
 function parseEditableEvidenceValue(value: unknown): boolean | undefined {
 	if (typeof value === "boolean") return value;
 	if (typeof value === "number") {
@@ -61,6 +64,11 @@ export function getEditableRefEvidence(options: {
 	const textEvidence = parseEditableEvidenceText(options.text);
 	if (textEvidence === false) return false;
 	if (textEvidence === true) hasPositiveEvidence = true;
+	// Fallback: treat inherently editable ARIA roles as editable even when
+	// upstream snapshot metadata does not include explicit editable flags.
+	if (!hasPositiveEvidence && options.ref?.role && KNOWN_EDITABLE_ROLES.has((options.ref.role as string).toLowerCase())) {
+		hasPositiveEvidence = true;
+	}
 	return hasPositiveEvidence ? true : undefined;
 }