fix(desktop): stabilize browser sessions and improve agent inbox

[killswitch-GUI]

Browser tools could lose their visible page during a pending operation, disconnect on a slow metadata read, or replace the completed page with a blank pane. This repairs those lifecycle failures and makes agent control, completion, and recovery visible in the workspace.

Cached agent observation and frame reads now remain available during finite Core waits, with the existing document/control/viewport checks and mutation restrictions intact. Metadata reads have a bounded five-second deadline; effect deadlines remain short and uncertain effects are not replayed. Recovery preserves the selected tab until a replacement is admitted. Browser and terminal content follows window visibility through app switching and restore.

Active control has a persistent badge, page frame, and eight-second cursor indicator. Completion retains an immutable, input-free last view only when accepted pixels and acknowledged cleanup are available, within a shared 32 MiB budget. Continue browsing opens a fresh human session. Explicit browser.close is respected; expired authority and network contexts are not restored. Browser activity reveals the correct workspace pane, and screenshot results use the existing inline image preview and full image viewer.

Global/workspace browser settings and the bundled browser skill expose capability and network controls. Supporting assets and redirects follow the workspace network grant. Agent inboxes have readable labels, delivery status, search/filter controls, preserved recipient selection, and expandable details; starting a new thread from an inbox immediately restores the composer. OpenRouter requires an API key and supports adding it through native secure credential storage.

Windows Developer Preview packaging now explicitly includes a sealed, signed-component browser payload. Admission requires an ordinary interactive user, fixed relative installation layout, verified inventory, private channels, Chromium sandboxing, and supervised process custody. This is an explicit functional preview: it does not claim production network containment, headless support, private CAs, or client identities. Stable/default browser guards remain unchanged. The installer grants read/execute only to the component subtree, and source-free release backend tests cover relocation and tamper rejection.

The Desktop upgrade also fixes the Tao nested keyboard-message deadlock observed during live testing. Dependency remediation replaces the vulnerable credential/single-instance dependency paths without advisory suppressions, preserves credential compatibility, and uses the platform-owned backends.

The vendored Linux credential backend also exposed an ARM64 musl static-link failure. Target-specific C flags now keep its atomics inline for baseline ARMv8 without changing other platforms or adding a newer CPU requirement. The provider inventory acceptance test now matches its neutral credential label; the separate keyless setup-wizard behavior remains covered.

Validation:

• Full cargo xtask check rust, Desktop, and dependency completion gates pass. Renderer validation includes 542 tests, type/security/format checks, and 80 selected headless UI tests across browser, inbox, models, images, providers, terminal, and settings.
• The native regression reproduces blanking with the previous DLL, then requires four advancing authenticated frames and actual foreground-window pixels while the same Core browser.wait remains pending. Both rebuilt native acceptance scenarios pass, including input, screenshots, resize, cursor, recovery, retained completion, explicit close, and acknowledged cleanup with no new session state left behind.
• Live rebuilt-app checks pass for styled GitHub, browser/terminal switching and restore, screenshot previews, child-agent inbox delivery and acknowledgment, the new-thread composer, and a GPT-6.1 Sol browser run that leaves the completed page visible.
• Source-free unsigned Release backend acceptance passes real CEF rendering/input/PNG capture, close acknowledgments, relocated payload admission, tamper rejection, and zero remaining processes in the retained Job. This is distinct from signed installed acceptance, which is required before publishing a release draft.
• The change-selected local PR attempt and current-head hosted checks are recorded separately; Windows cannot execute the repository's POSIX SDK generator.

The separate Windows computer-control feature remains in stacked #300.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T05:05:04.832664Z	164d178	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.