[killswitch-GUI]

Connects owned, pinned Chromium hosts to Core and Desktop through the worker/SDK browser boundary. Core owns navigation, tabs, semantic snapshots, input, screenshots and artifact transfers; Desktop displays the same page through authenticated native presentation channels. Actions retain policy admission, one-writer control, current document/snapshot bindings and mandatory output release. Released screenshots become typed model images, including alongside image.view observations on all four provider wire formats.

Adds hover, double/right-click, element and screenshot-coordinate clicks and drags, with viewport/DPI and stale-document checks. Native highlights and labels support explicit clear and annotated screenshots, with expiry and invalidation on page/control changes. browser.evaluate uses Chromium's native side-effect checks, while browser.cdp accepts a closed DOM/style/layout/performance inspection list. Inspection requires an observed renderer pause, protected-field checks, bounded output and acknowledged debugger restoration before releasing a value.

The Windows launcher uses two fixed trusted pre-CEF roles. A verified fresh logon context creates one suspended AppContainer browser with exact private endpoints and an atomic inner Job. Core verifies the retained process/thread, image/birth, user/session, fresh authentication identity, exact package, Low integrity, zero capabilities and both Job memberships before Core alone resumes it. Elevated creators use an attenuated token; the exact suspended browser's token DACL retains its own user's access needed for Chromium's further sandbox attenuation. Newly staged immutable components retain explicit owner access and read/execute package access. Failed startup retains its cleanup owner and leases until the creator exits, Jobs drain and private I/O joins. Transfer retirement now recognizes the kernel's zero-link proof after closing the delete handle, while preserving live-file validation and refusing replacement or multiply linked files.

Preserves the selected model and reasoning level across the first browser handoff and later messages. The renderer regression exercises both sends through the actual App flow. The isolated terminal browser harness also supplies its existing AppearanceProvider context. The branch includes current main's Anthropic, image-view and managed VS Code runtime work; focused integration checks preserve both browser screenshots and local image views.

Scopes image-input budgets to each tool dispatch so subsequent model turns preserve the registered browser authority. The existing public tab-handoff protocol regression now also runs on Windows and verifies open/select/close across the authenticated presentation channels.

Validation on final commit a3b429ad (Windows native diagnostic on its 792bc631 ancestor):

• Clean Windows browser diagnostic: all 13 native checks and nine startup/recovery checks passed, including actual HTTP upload/download bytes, frames, input, tabs, origin denial, graceful CEF shutdown, full Job/I/O cleanup and private-state removal.
• Real Windows token-access and file-retirement regressions passed; component staging passed 14 tests with one unavailable-symlink skip. Focused merged-source tests passed 285 cases plus three image API integration tests.
• Full cargo xtask check rust passed on clean a3b429ad, including both handoff regressions, all workspace unit/integration/doc tests, strict workspace and fuzz Clippy. Focused image API (3) and agent (48) tests also passed.
• Exact-source Linux validation: cargo xtask pr --base origin/main passed on a3b429ad. The linked run also tracks the separate release-readiness gate.

This remains an explicitly selected preview/development composition. Signed installed-package acceptance, production PKI/certificate custody and whole-host network containment remain outstanding; production availability and publisher Desktop/Headless acceptance flags stay false. The startup/death cases prove their named barriers; outstanding logon-service creation and running full-CEF tree death remain outside those receipts. macOS temporary-profile preview and standalone broker/custody evidence retain their documented scope. Shipping builds continue to use the platform WebView by default.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T07:10:02.952253Z	7230dd8	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.