[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_330":331,"_332":333},"routes/_app.x.$handle.$name",{"_99":98,"_31":44,"_108":89,"_26":109,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_20":-5,"_120":-5,"_121":-5,"_122":24,"_123":124,"_125":58,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_31":44,"_37":45,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":24},"version",36,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_23":24},"previous","deleted",false,"deletedHere","path","lib/provider_health.ts","latestPath","fileId","7993f5d0-aa07-11f1-af42-1607ee4eb77e","name","provider_health.ts","fileType","script","content","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport type { BrowserReceipt, ProviderName } from \"./types.ts\";\nimport { POLICY } from \"./policy.ts\";\n\nexport async function providerAvailable(provider: ProviderName): Promise<{ available: boolean; reason?: string }> {\n const row = (await sqlite.execute({ sql: \"SELECT * FROM provider_health WHERE provider=?\", args: [provider] })).rows[0] as any;\n if (!row) return { available: true };\n if (row.circuit_state !== \"OPEN\") return { available: true };\n if (!row.open_until) return { available: false, reason: \"provider circuit open\" };\n const until = Date.parse(String(row.open_until));\n if (Number.isFinite(until) && Date.now() >= until) {\n await sqlite.execute({\n sql: \"UPDATE provider_health SET circuit_state='HALF_OPEN', updated_at=? WHERE provider=?\",\n args: [new Date().toISOString(), provider],\n });\n return { available: true };\n }\n return { available: false, reason: `provider circuit open until ${row.open_until}` };\n}\n\nexport async function recordProviderOutcome(provider: ProviderName, receipt: BrowserReceipt): Promise {\n const now = new Date().toISOString();\n if (receipt.status === \"PASS\" || receipt.status === \"PARTIAL\") {\n await sqlite.execute({\n sql: `UPDATE provider_health SET circuit_state='CLOSED', consecutive_failures=0, open_until=NULL,\n last_success_at=?, last_error=NULL, updated_at=? WHERE provider=?`,\n args: [now, now, provider],\n });\n return;\n }\n\n if (receipt.status === \"BLOCKED\") return;\n\n const row = (await sqlite.execute({ sql: \"SELECT consecutive_failures FROM provider_health WHERE provider=?\", args: [provider] })).rows[0] as any;\n const failures = Number(row?.consecutive_failures ?? 0) + 1;\n const shouldOpen = failures >= POLICY.providerCircuitFailureThreshold;\n const openUntil = shouldOpen ? new Date(Date.now() + POLICY.providerCircuitCooldownMs).toISOString() : null;\n await sqlite.execute({\n sql: `UPDATE provider_health SET circuit_state=?, consecutive_failures=?, open_until=?,\n last_failure_at=?, last_error=?, updated_at=? WHERE provider=?`,\n args: [shouldOpen ? \"OPEN\" : \"CLOSED\", failures, openUntil, now, receipt.error ?? receipt.status, now, provider],\n });\n}\n\nexport async function getProviderHealth() {\n return (await sqlite.execute(\"SELECT * FROM provider_health ORDER BY provider\")).rows;\n}\n","createdAt",["D",1788708450626],"branchVersion","branchId","22a6b9fb-662c-4823-89b0-7ec510c82fcd","id","1cb1fea8-3811-42e9-b0ad-3a5ec2d20472","chat-native-maestro",["D",1788707065045],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Cloud runtime for ChatGPT-native orchestration","imageUrl","6cc24525-830b-4db3-9c9c-fd19fb50e91f","pinnedFileId","3fca0dce-aa04-11f1-bd83-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0773d-9d6b-7580-a53a-683363c351c8","tursoName","1cb1fea8381142e9b0ad3a5ec2d20472","tursoHostname","1cb1fea8381142e9b0ad3a5ec2d20472-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789488693443],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_107":103},"org",{"_99":98,"_100":101,"_102":103,"_18":54,"_104":105,"_106":24},"branch",{"_13":88,"_31":89,"_42":41,"_90":43,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":44,"_97":98},"isOwned",68,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","cleitoncosta","handle","displayName","Cleiton Costa","avatar","https://lh3.googleusercontent.com/a/ACg8ocIgWisWQiXts_2fy5iRiRgl8A6c7Ef94eqE3ur-4mlyUrpCBmQ=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_42":43,"_31":44,"_37":325,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":326,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":327,"_83":328,"_85":329,"_87":24},"tree",[206,210,215,219,220,221,222,223],"files",[206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223],"counts",{"_196":62,"_197":181,"_198":62,"_199":200,"_201":202},"contents",[130,131,132,133,134,135,136,137],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_42":191,"_31":192,"_29":193,"_141":-5,"_40":41,"_39":167,"_143":58,"_37":194,"_13":62,"_33":183,"_35":-5,"_23":24,"_146":-5,"_26":195},{"_42":185,"_31":186,"_29":187,"_141":-5,"_40":41,"_39":188,"_143":58,"_37":189,"_13":62,"_33":183,"_35":-5,"_23":24,"_146":-5,"_26":190},{"_42":178,"_31":179,"_29":180,"_141":-5,"_40":41,"_39":181,"_143":58,"_37":182,"_13":62,"_33":183,"_35":-5,"_23":24,"_146":-5,"_26":184},{"_42":171,"_31":172,"_29":173,"_141":-5,"_40":41,"_39":174,"_143":24,"_37":175,"_13":153,"_33":20,"_35":176,"_23":24,"_146":-5,"_26":177},{"_42":163,"_31":164,"_29":56,"_141":-5,"_40":41,"_39":165,"_143":24,"_37":166,"_13":167,"_33":168,"_35":169,"_23":24,"_146":-5,"_26":170},{"_42":156,"_31":157,"_29":158,"_141":-5,"_40":41,"_39":159,"_143":24,"_37":160,"_13":62,"_33":34,"_35":161,"_23":24,"_146":-5,"_26":162},{"_42":148,"_31":149,"_29":150,"_141":-5,"_40":41,"_39":151,"_143":24,"_37":152,"_13":153,"_33":34,"_35":154,"_23":24,"_146":-5,"_26":155},{"_42":138,"_31":139,"_29":140,"_141":-5,"_40":41,"_39":142,"_143":24,"_37":144,"_13":62,"_33":34,"_35":145,"_23":24,"_146":-5,"_26":147},"173c79a2-47f4-4dc8-b4c4-beaa4c83efc5","status.ts","9fd401be-aa06-11f1-9ea0-1607ee4eb77e","parentId",31,"latest",["D",1788708085306],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { providerState } from \"./providers/router.ts\";\n\nconst counts = await sqlite.execute(\"SELECT status, COUNT(*) AS count FROM browser_tasks GROUP BY status ORDER BY status\");\nconst census = await sqlite.execute(\"SELECT provider, priority, state, recurring_free, notes, updated_at FROM provider_census ORDER BY priority\");\nconst recent = await sqlite.execute(\"SELECT run_id,status,provider,error,updated_at FROM browser_tasks ORDER BY id DESC LIMIT 10\");\n\nconst result = {\n service: \"chat-native-maestro\",\n version: \"0.4.1\",\n status: \"ready\",\n authenticatedDiagnostic: true,\n providers: providerState(),\n taskCounts: counts.rows,\n providerCensus: census.rows,\n recentReceipts: recent.rows,\n timestamp: new Date().toISOString(),\n};\n\nconsole.log(JSON.stringify(result, null, 2));\n","label",[139],"88c1f5bd-0048-45a0-b91f-fb0b93726fef","selftest.ts","226bfbf6-aa05-11f1-8f4b-1607ee4eb77e",24,["D",1788707862770],1,"import { validateTask } from \"./lib/dsl.ts\";\nimport { providerState } from \"./providers/router.ts\";\n\nconst validRead = {\n runId: \"selftest-read\",\n targetUrl: \"https://example.com\",\n risk: \"read_only\" as const,\n purpose: \"Validate DSL without opening a browser\",\n steps: [{ action: \"expect_text\" as const, text: \"Example Domain\" }],\n};\n\nconst blockedWrite = {\n runId: \"selftest-write\",\n targetUrl: \"https://example.com\",\n risk: \"consequential\" as const,\n approved: false,\n purpose: \"Negative control for approval gate\",\n steps: [{ action: \"click\" as const, selector: \"button\" }],\n};\n\nconst blockedSecret = {\n runId: \"selftest-secret\",\n targetUrl: \"https://example.com\",\n risk: \"read_only\" as const,\n approved: false,\n purpose: \"Negative control for secret resolution gate\",\n steps: [{ action: \"fill_secret\" as const, selector: \"#password\", envVar: \"EXAMPLE_PASSWORD\" }],\n};\n\nconst invalidSecretName = {\n runId: \"selftest-invalid-secret-name\",\n targetUrl: \"https://example.com\",\n risk: \"read_only\" as const,\n approved: true,\n purpose: \"Reject invalid env-var identifiers\",\n steps: [{ action: \"fill_secret\" as const, selector: \"#password\", envVar: \"BAD-SECRET\" }],\n};\n\nconst result = {\n version: \"0.4.1\",\n validReadErrors: validateTask(validRead),\n blockedWriteErrors: validateTask(blockedWrite),\n blockedSecretErrors: validateTask(blockedSecret),\n invalidSecretNameErrors: validateTask(invalidSecretName),\n providers: providerState(),\n expected: {\n validReadErrors: [],\n blockedWriteContains: \"NEEDS_APPROVAL\",\n blockedSecretContains: \"NEEDS_SECRET_APPROVAL\",\n invalidSecretNameContains: \"invalid secret env var\",\n providersConfigured: false,\n },\n};\n\nconsole.log(JSON.stringify(result, null, 2));\n",[149],"3222f370-2951-416a-ad22-cd27337b4e37","runner.ts","46aa03fa-aa05-11f1-b85b-1607ee4eb77e",10,["D",1788707506196],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport type { BrowserTask } from \"./lib/types.ts\";\nimport { validateTask } from \"./lib/dsl.ts\";\nimport { executeRouted } from \"./providers/router.ts\";\n\nasync function claimNext() {\n const now = new Date().toISOString();\n const result = await sqlite.execute({\n sql: `UPDATE browser_tasks\n SET status='RUNNING', updated_at=?\n WHERE id=(SELECT id FROM browser_tasks WHERE status='PENDING' ORDER BY id LIMIT 1)\n RETURNING *`,\n args: [now],\n });\n return result.rows[0] as Record | undefined;\n}\n\nasync function finish(id: number, status: string, provider: string, receipt: unknown, error?: string) {\n await sqlite.execute({\n sql: `UPDATE browser_tasks\n SET status=?, provider=?, receipt_json=?, error=?, updated_at=?\n WHERE id=?`,\n args: [status, provider, JSON.stringify(receipt), error ?? null, new Date().toISOString(), id],\n });\n}\n\nasync function main() {\n const row = await claimNext();\n if (!row) {\n const result = { status: \"NO_PENDING_TASK\" };\n console.log(JSON.stringify(result));\n return result;\n }\n\n const id = Number(row.id);\n let task: BrowserTask;\n try {\n task = JSON.parse(String(row.task_json)) as BrowserTask;\n } catch (error) {\n const receipt = { status: \"BLOCKED\", error: \"invalid task_json\" };\n await finish(id, \"BLOCKED\", \"none\", receipt, String(error));\n console.log(JSON.stringify(receipt, null, 2));\n return receipt;\n }\n\n const errors = validateTask(task);\n if (errors.length) {\n const receipt = { runId: task.runId, status: \"BLOCKED\", errors };\n await finish(id, \"BLOCKED\", task.preferredProvider ?? \"kernel\", receipt, errors.join(\"; \"));\n console.log(JSON.stringify(receipt, null, 2));\n return receipt;\n }\n\n const receipt = await executeRouted(task);\n await finish(id, receipt.status, receipt.provider, receipt, receipt.error);\n console.log(JSON.stringify(receipt, null, 2));\n return receipt;\n}\n\nawait main();\n",[157],"2d4aea10-de2a-4a52-9a80-3de0d8cf5b9a","main.ts",32,["D",1788708091346],4,"http","export default async function (req: Request): Promise {\n if (req.method !== \"GET\") {\n return Response.json({ error: \"method_not_allowed\" }, { status: 405 });\n }\n\n return Response.json({\n service: \"chat-native-maestro\",\n version: \"0.4.1\",\n status: \"alive\",\n executionSurface: \"authenticated_val_town_plugin_only\",\n security: {\n publicEndpointWriteMethods: \"disabled\",\n detailedRuntimeState: \"not_exposed_publicly\",\n arbitraryCodeInput: \"disabled\",\n },\n });\n}\n",[164],"f8eab693-dab5-4ffa-bfeb-8b3b111049c9","README.md","3efb9a6e-aa06-11f1-82ca-1607ee4eb77e",34,["D",1788708125606],"# Chat-Native Maestro V0.4.1\n\nCloud runtime controlled from normal ChatGPT mobile/web.\n\n## Canonical constraint\n\n- No Codex.\n- No user PC.\n- No local browser runtime.\n- Normal ChatGPT is the control plane.\n- Val Town is the persistent cloud compute/state plane.\n\n## Current browser routing\n\n1. Kernel — champion, recurring free monthly credits.\n2. Browserless — recurring-free fallback.\n3. Browserbase — researched fallback, not yet implemented.\n4. Steel — one-time-credit fallback, not preferred for zero-cost steady state.\n\nAutomatic cross-provider retry is permitted only for `read_only` tasks. Writes are never retried on another provider automatically because the first provider may have caused a partial side effect.\n\n## Execution model\n\nChatGPT uses its authenticated Val Town plugin to:\n\n1. classify a task and risk;\n2. insert a task into val-scoped SQLite;\n3. run `runner.ts`;\n4. read the persisted receipt;\n5. verify/falsify the result.\n\nThe public HTTP endpoint is minimal liveness only. It rejects non-GET methods and does not expose provider configuration, task counts, receipts, or database state. Detailed diagnostics live in authenticated `status.ts`.\n\n## Browser DSL\n\nSupported actions:\n- `goto`\n- `wait_for`\n- `click`\n- `fill`\n- `fill_secret`\n- `type`\n- `select`\n- `extract_text`\n- `extract_attribute`\n- `expect_text`\n- `expect_url`\n\nArbitrary JavaScript and shell input are intentionally absent from the public task schema.\n\n## Risk gates\n\n- `read_only`: normal execution.\n- `reversible_write`: requires explicit `approved=true`.\n- `consequential`: requires explicit `approved=true`.\n- `fill_secret`: separately requires `approved=true`, even in a read-only navigation task.\n\n## Secret handling\n\nNever store a password/token in `task_json`.\n\nUse:\n\n```json\n{\"action\":\"fill_secret\",\"selector\":\"#password\",\"envVar\":\"PORTAL_PASSWORD\"}\n```\n\nThe SQLite task stores only `PORTAL_PASSWORD`. The actual value is read from a Val Town environment variable in memory immediately before browser execution.\n\nProvider API credentials also belong only in Val Town environment variables:\n- `KERNEL_API_KEY`\n- `BROWSERLESS_TOKEN`\n- optional `BROWSERLESS_BASE_URL`\n\n## Read-only network control\n\nFor browser tasks classified `read_only`, the generated browser program allows only GET, HEAD, and OPTIONS requests. Main-frame navigation is restricted to the original target host plus explicit `allowedHosts`. Popups are closed.\n\nThis is a strong control, not proof of zero side effects: a poorly designed website can mutate state with GET. Post-action verification remains mandatory.\n\n## Evidence policy\n\n`TOOL_SUCCESS_RESPONSE != BEHAVIOR_PROOF`.\n\nA browser task is PASS only when at least one explicit expectation exists and all expectations pass. Otherwise a successful execution remains PARTIAL.\n\n## Current live evidence\n\nPASS:\n- Val Town authentication and Free workspace.\n- create/edit/run/deploy.\n- HTTP health endpoint.\n- val-scoped SQLite.\n- atomic task claim.\n- persisted receipts.\n- risk validation.\n- secret-approval validation.\n- Kernel SDK module loading.\n- Browserless adapter module loading.\n- safe missing-provider-credential classification.\n\nUNVERIFIED:\n- live Kernel browser session (API key not configured).\n- live Browserless browser session (token not configured).\n- real provider credit accounting on this account.\n\nSee `docs/CURRENT_STATE.md` and `docs/PROVIDER_CENSUS.md`.\n",[172],"52abd68c-7eb8-45d0-87f2-28a80af822c4","providers","f528640e-aa04-11f1-8241-1607ee4eb77e",3,["D",1788707369470],"directory",[179],"561d863a-e041-4f0a-b61d-8884716cb727","lib","f30be01a-aa04-11f1-b5ff-1607ee4eb77e",2,["D",1788707365920],[186],"7a194648-9f6b-42ee-8ade-4a9c3bcd3220","docs","f7f2feb0-aa04-11f1-9265-1607ee4eb77e",["D",1788707374127],[192],"pulls","branches","forks","envVars",{"_203":62,"_205":62},"connections",{"_203":62,"_204":62},"count","unfilledCount","emptyCount",{"_42":191,"_31":192,"_29":193,"_141":-5,"_40":41,"_39":167,"_143":58,"_37":322,"_13":62,"_33":183,"_35":-5,"_23":24,"_146":-5,"_225":323,"_26":324},{"_42":314,"_31":315,"_29":316,"_141":193,"_40":41,"_39":317,"_143":24,"_37":318,"_13":62,"_33":20,"_35":319,"_23":24,"_146":-5,"_225":320,"_26":321},{"_42":306,"_31":307,"_29":308,"_141":193,"_40":41,"_39":309,"_143":24,"_37":310,"_13":153,"_33":20,"_35":311,"_23":24,"_146":-5,"_225":312,"_26":313},{"_42":298,"_31":299,"_29":300,"_141":193,"_40":41,"_39":301,"_143":24,"_37":302,"_13":62,"_33":20,"_35":303,"_23":24,"_146":-5,"_225":304,"_26":305},{"_42":185,"_31":186,"_29":187,"_141":-5,"_40":41,"_39":188,"_143":58,"_37":295,"_13":62,"_33":183,"_35":-5,"_23":24,"_146":-5,"_225":296,"_26":297},{"_42":287,"_31":288,"_29":289,"_141":187,"_40":41,"_39":290,"_143":24,"_37":291,"_13":181,"_33":34,"_35":292,"_23":24,"_146":-5,"_225":293,"_26":294},{"_42":279,"_31":280,"_29":281,"_141":187,"_40":41,"_39":282,"_143":24,"_37":283,"_13":62,"_33":34,"_35":284,"_23":24,"_146":-5,"_225":285,"_26":286},{"_42":275,"_31":32,"_29":30,"_141":187,"_40":41,"_39":14,"_143":58,"_37":276,"_13":62,"_33":34,"_35":36,"_23":24,"_146":-5,"_225":277,"_26":278},{"_42":267,"_31":268,"_29":269,"_141":187,"_40":41,"_39":270,"_143":24,"_37":271,"_13":153,"_33":34,"_35":272,"_23":24,"_146":-5,"_225":273,"_26":274},{"_42":178,"_31":179,"_29":180,"_141":-5,"_40":41,"_39":181,"_143":58,"_37":264,"_13":62,"_33":183,"_35":-5,"_23":24,"_146":-5,"_225":265,"_26":266},{"_42":256,"_31":257,"_29":258,"_141":180,"_40":41,"_39":259,"_143":24,"_37":260,"_13":181,"_33":34,"_35":261,"_23":24,"_146":-5,"_225":262,"_26":263},{"_42":248,"_31":249,"_29":250,"_141":180,"_40":41,"_39":251,"_143":24,"_37":252,"_13":181,"_33":34,"_35":253,"_23":24,"_146":-5,"_225":254,"_26":255},{"_42":240,"_31":241,"_29":242,"_141":180,"_40":41,"_39":243,"_143":24,"_37":244,"_13":153,"_33":34,"_35":245,"_23":24,"_146":-5,"_225":246,"_26":247},{"_42":171,"_31":172,"_29":173,"_141":-5,"_40":41,"_39":174,"_143":24,"_37":237,"_13":153,"_33":20,"_35":176,"_23":24,"_146":-5,"_225":238,"_26":239},{"_42":163,"_31":164,"_29":56,"_141":-5,"_40":41,"_39":165,"_143":24,"_37":234,"_13":167,"_33":168,"_35":169,"_23":24,"_146":-5,"_225":235,"_26":236},{"_42":156,"_31":157,"_29":158,"_141":-5,"_40":41,"_39":159,"_143":24,"_37":231,"_13":62,"_33":34,"_35":161,"_23":24,"_146":-5,"_225":232,"_26":233},{"_42":148,"_31":149,"_29":150,"_141":-5,"_40":41,"_39":151,"_143":24,"_37":228,"_13":153,"_33":34,"_35":154,"_23":24,"_146":-5,"_225":229,"_26":230},{"_42":138,"_31":139,"_29":140,"_141":-5,"_40":41,"_39":142,"_143":24,"_37":224,"_13":62,"_33":34,"_35":145,"_23":24,"_146":-5,"_225":226,"_26":227},["D",1788708085306],"children",[],[139],["D",1788707862770],[],[149],["D",1788707506196],[],[157],["D",1788708091346],[],[164],["D",1788708125606],[],[172],"42144ee5-6f70-47d8-90e9-b3debd2448fe","router.ts","40781008-aa05-11f1-bfc5-1607ee4eb77e",12,["D",1788707579675],"import type { BrowserReceipt, BrowserTask } from \"../lib/types.ts\";\nimport { executeKernel, kernelConfigured } from \"./kernel.ts\";\nimport { browserlessConfigured, executeBrowserless } from \"./browserless.ts\";\n\nexport function providerState() {\n const kernel = kernelConfigured();\n const browserless = browserlessConfigured();\n return {\n kernel: { priority: 1, configured: kernel, state: kernel ? \"READY\" : \"ACCOUNT_KEY_REQUIRED\" },\n browserless: { priority: 2, configured: browserless, state: browserless ? \"READY\" : \"ACCOUNT_TOKEN_REQUIRED\" },\n };\n}\n\nfunction withFallbackMeta(receipt: BrowserReceipt, from: string): BrowserReceipt {\n return { ...receipt, providerMeta: { ...(receipt.providerMeta ?? {}), fallbackFrom: from } };\n}\n\nexport async function executeRouted(task: BrowserTask): Promise {\n if (task.preferredProvider === \"browserless\") return executeBrowserless(task);\n if (task.preferredProvider === \"kernel\") return executeKernel(task);\n\n if (kernelConfigured()) {\n const primary = await executeKernel(task);\n if (primary.status === \"PASS\" || primary.status === \"PARTIAL\") return primary;\n if (task.risk === \"read_only\" && browserlessConfigured()) {\n return withFallbackMeta(await executeBrowserless(task), \"kernel\");\n }\n return primary;\n }\n\n if (browserlessConfigured()) return executeBrowserless(task);\n\n return executeKernel(task);\n}\n",[],[179,241],"433a362b-589f-47d7-a65e-756e18883f44","kernel.ts","1aa22634-aa05-11f1-8241-1607ee4eb77e",20,["D",1788707710236],"import Kernel from \"npm:@onkernel/sdk\";\nimport type { BrowserReceipt, BrowserTask } from \"../lib/types.ts\";\nimport { buildKernelPlaywrightCode, resolveSecrets } from \"../lib/dsl.ts\";\n\nexport function kernelConfigured(): boolean {\n return Boolean(Deno.env.get(\"KERNEL_API_KEY\"));\n}\n\nexport async function executeKernel(task: BrowserTask): Promise {\n const apiKey = Deno.env.get(\"KERNEL_API_KEY\");\n if (!apiKey) {\n return { runId: task.runId, provider: \"kernel\", status: \"BLOCKED\", error: \"KERNEL_API_KEY missing\" };\n }\n\n let resolvedTask: BrowserTask;\n try {\n resolvedTask = resolveSecrets(task);\n } catch (error) {\n return { runId: task.runId, provider: \"kernel\", status: \"BLOCKED\", error: error instanceof Error ? error.message : String(error) };\n }\n\n const started = Date.now();\n const kernel = new Kernel({ apiKey });\n let sessionId: string | undefined;\n try {\n const kernelBrowser = await kernel.browsers.create({\n headless: true,\n stealth: true,\n });\n sessionId = kernelBrowser.session_id;\n\n const response = await kernel.browsers.playwright.execute(sessionId, {\n code: buildKernelPlaywrightCode(resolvedTask),\n });\n const result = (response as any).result ?? response;\n const verified = Boolean(result?.verified);\n return {\n runId: task.runId,\n provider: \"kernel\",\n status: verified ? \"PASS\" : \"PARTIAL\",\n finalUrl: result?.finalUrl,\n outputs: result?.outputs ?? {},\n checks: result?.checks ?? [],\n durationMs: Date.now() - started,\n providerMeta: { sessionId, headless: true, stealth: true },\n };\n } catch (error) {\n return {\n runId: task.runId,\n provider: \"kernel\",\n status: \"FAIL\",\n error: error instanceof Error ? error.message : String(error),\n durationMs: Date.now() - started,\n providerMeta: sessionId ? { sessionId } : {},\n };\n } finally {\n if (sessionId) {\n try { await kernel.browsers.deleteByID(sessionId); } catch (cleanupError) {\n console.error(\"kernel cleanup failed\", cleanupError);\n }\n }\n }\n}\n",[],[179,249],"6723fcd6-2f53-4f19-8043-31da4cdf2a75","browserless.ts","62afee48-aa05-11f1-9a10-1607ee4eb77e",23,["D",1788707851450],"import type { BrowserReceipt, BrowserTask } from \"../lib/types.ts\";\nimport { resolveSecrets } from \"../lib/dsl.ts\";\n\nconst FUNCTION_CODE = String.raw`\nexport default async ({ page, context }) => {\n const plan = context.plan;\n const outputs = {};\n const checks = [];\n const targetHost = new URL(plan.targetUrl).hostname;\n const allowedHosts = new Set([targetHost, ...(plan.allowedHosts || [])]);\n const allowedMethods = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n const assertUrl = (value) => {\n const u = new URL(value);\n if (![\"http:\", \"https:\"].includes(u.protocol)) throw new Error(\"blocked protocol\");\n if (!allowedHosts.has(u.hostname)) throw new Error(\"blocked host: \" + u.hostname);\n };\n\n await page.setRequestInterception(true);\n page.on(\"request\", (req) => {\n try {\n if (req.isNavigationRequest() && req.frame() === page.mainFrame()) assertUrl(req.url());\n if (plan.risk === \"read_only\" && !allowedMethods.has(req.method().toUpperCase())) return req.abort(\"blockedbyclient\");\n return req.continue();\n } catch {\n return req.abort(\"blockedbyclient\");\n }\n });\n page.on(\"popup\", async (popup) => { try { await popup.close(); } catch {} });\n\n assertUrl(plan.targetUrl);\n await page.goto(plan.targetUrl, { waitUntil: \"domcontentloaded\" });\n assertUrl(page.url());\n\n for (const step of plan.steps) {\n switch (step.action) {\n case \"goto\": {\n const url = step.url || plan.targetUrl;\n assertUrl(url);\n await page.goto(url, { waitUntil: \"domcontentloaded\" });\n break;\n }\n case \"wait_for\":\n await page.waitForSelector(step.selector, { visible: true, timeout: step.timeoutMs || 10000 });\n break;\n case \"click\":\n if (step.waitForNavigation) {\n await Promise.all([page.waitForNavigation({ waitUntil: \"domcontentloaded\" }), page.click(step.selector)]);\n } else await page.click(step.selector);\n break;\n case \"fill\":\n await page.click(step.selector, { clickCount: 3 });\n await page.keyboard.press(\"Backspace\");\n await page.type(step.selector, step.text);\n break;\n case \"type\":\n await page.type(step.selector, step.text, { delay: step.delayMs || 0 });\n break;\n case \"select\":\n await page.select(step.selector, step.value);\n break;\n case \"extract_text\":\n outputs[step.key] = await page.$eval(step.selector, (el) => el.textContent || \"\");\n break;\n case \"extract_attribute\":\n outputs[step.key] = await page.$eval(step.selector, (el, attr) => el.getAttribute(attr), step.attribute);\n break;\n case \"expect_text\": {\n const body = await page.evaluate(() => document.body?.innerText || \"\");\n checks.push({ type: \"text\", expected: step.text, ok: body.includes(step.text) });\n break;\n }\n case \"expect_url\": {\n const actual = page.url();\n checks.push({ type: \"url\", expected: step.contains, actual, ok: actual.includes(step.contains) });\n break;\n }\n }\n assertUrl(page.url());\n }\n\n return {\n data: {\n finalUrl: page.url(),\n outputs,\n checks,\n verified: checks.length > 0 && checks.every((x) => x.ok),\n },\n type: \"application/json\",\n };\n};\n`;\n\nexport function browserlessConfigured(): boolean {\n return Boolean(Deno.env.get(\"BROWSERLESS_TOKEN\"));\n}\n\nexport async function executeBrowserless(task: BrowserTask): Promise {\n const token = Deno.env.get(\"BROWSERLESS_TOKEN\");\n if (!token) return { runId: task.runId, provider: \"browserless\", status: \"BLOCKED\", error: \"BROWSERLESS_TOKEN missing\" };\n\n let resolvedTask: BrowserTask;\n try {\n resolvedTask = resolveSecrets(task);\n } catch (error) {\n return { runId: task.runId, provider: \"browserless\", status: \"BLOCKED\", error: error instanceof Error ? error.message : String(error) };\n }\n\n const started = Date.now();\n const base = (Deno.env.get(\"BROWSERLESS_BASE_URL\") || \"https://production-sfo.browserless.io\").replace(/\\/+$/, \"\");\n try {\n const response = await fetch(`${base}/function?token=${encodeURIComponent(token)}`, {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify({ code: FUNCTION_CODE, context: { plan: resolvedTask } }),\n });\n const text = await response.text();\n let result: any;\n try { result = JSON.parse(text); } catch { result = { raw: text }; }\n if (!response.ok) {\n return { runId: task.runId, provider: \"browserless\", status: \"FAIL\", error: `HTTP ${response.status}: ${text.slice(0, 500)}`, durationMs: Date.now() - started };\n }\n return {\n runId: task.runId,\n provider: \"browserless\",\n status: result?.verified ? \"PASS\" : \"PARTIAL\",\n finalUrl: result?.finalUrl,\n outputs: result?.outputs ?? {},\n checks: result?.checks ?? [],\n durationMs: Date.now() - started,\n providerMeta: { base },\n };\n } catch (error) {\n return { runId: task.runId, provider: \"browserless\", status: \"FAIL\", error: error instanceof Error ? error.message : String(error), durationMs: Date.now() - started };\n }\n}\n",[],[179,257],["D",1788707369470],[216,217,218],[179],"6ca4c286-9146-47f9-9180-78b1498da06c","types.ts","08217668-aa05-11f1-b47d-1607ee4eb77e",14,["D",1788707664212],"export type Risk = \"read_only\" | \"reversible_write\" | \"consequential\";\nexport type ProviderName = \"kernel\" | \"browserless\";\n\nexport type Step =\n | { action: \"goto\"; url?: string }\n | { action: \"wait_for\"; selector: string; timeoutMs?: number }\n | { action: \"click\"; selector: string; waitForNavigation?: boolean }\n | { action: \"fill\"; selector: string; text: string }\n | { action: \"fill_secret\"; selector: string; envVar: string }\n | { action: \"type\"; selector: string; text: string; delayMs?: number }\n | { action: \"select\"; selector: string; value: string }\n | { action: \"extract_text\"; selector: string; key: string }\n | { action: \"extract_attribute\"; selector: string; attribute: string; key: string }\n | { action: \"expect_text\"; text: string }\n | { action: \"expect_url\"; contains: string };\n\nexport type BrowserTask = {\n runId: string;\n targetUrl: string;\n risk: Risk;\n approved?: boolean;\n purpose: string;\n allowedHosts?: string[];\n preferredProvider?: ProviderName;\n steps: Step[];\n};\n\nexport type BrowserReceipt = {\n runId: string;\n provider: ProviderName;\n status: \"PASS\" | \"PARTIAL\" | \"FAIL\" | \"BLOCKED\";\n finalUrl?: string;\n outputs?: Record;\n checks?: Array>;\n error?: string;\n durationMs?: number;\n providerMeta?: Record;\n};\n",[],[186,268],"9e8d90ce-1918-4afb-9a17-f03ecb926764",["D",1788708450626],[],[186,32],"1a0f3441-f13d-411a-a51f-a61c2ff3d01a","policy.ts","50662fa2-aa07-11f1-b77b-1607ee4eb77e",35,["D",1788708381537],"export const POLICY = {\n version: \"0.5.0\",\n maxAttemptsPerTask: 2,\n runningLeaseMs: 90_000,\n readOnlyFallbackAllowed: true,\n browserTimeoutMs: 25_000,\n providerFailureWindow: 5,\n providerCircuitFailureThreshold: 3,\n providerCircuitCooldownMs: 15 * 60_000,\n} as const;\n\nexport function isTerminalStatus(status: string): boolean {\n return [\"PASS\", \"PARTIAL\", \"FAIL\", \"BLOCKED\", \"CANCELLED\"].includes(status);\n}\n",[],[186,280],"73ac09e4-e356-4a81-9972-dd75322bd809","dsl.ts","1341db6e-aa05-11f1-ba4c-1607ee4eb77e",17,["D",1788707689924],"import type { BrowserTask } from \"./types.ts\";\n\nconst ALLOWED_ACTIONS = new Set([\n \"goto\", \"wait_for\", \"click\", \"fill\", \"fill_secret\", \"type\", \"select\",\n \"extract_text\", \"extract_attribute\", \"expect_text\", \"expect_url\",\n]);\n\nexport function validateTask(task: BrowserTask): string[] {\n const errors: string[] = [];\n if (!task || typeof task !== \"object\") return [\"task must be an object\"];\n if (!task.runId || task.runId.length > 128) errors.push(\"invalid runId\");\n if (!task.purpose || task.purpose.length > 1000) errors.push(\"invalid purpose\");\n if (!Array.isArray(task.steps) || task.steps.length < 1 || task.steps.length > 30) errors.push(\"steps must contain 1..30 actions\");\n if (![\"read_only\", \"reversible_write\", \"consequential\"].includes(task.risk)) errors.push(\"invalid risk\");\n if (task.risk !== \"read_only\" && task.approved !== true) errors.push(\"NEEDS_APPROVAL\");\n\n let target: URL | undefined;\n try {\n target = new URL(task.targetUrl);\n if (![\"http:\", \"https:\"].includes(target.protocol)) errors.push(\"target protocol blocked\");\n } catch {\n errors.push(\"invalid targetUrl\");\n }\n\n const targetHost = target?.hostname;\n const allowed = new Set([targetHost, ...(task.allowedHosts ?? [])].filter(Boolean) as string[]);\n for (const [i, step] of (task.steps ?? []).entries()) {\n if (!step || !ALLOWED_ACTIONS.has((step as any).action)) {\n errors.push(`step ${i}: unsupported action`);\n continue;\n }\n const maybe = step as any;\n if (typeof maybe.selector === \"string\" && maybe.selector.length > 1000) errors.push(`step ${i}: selector too long`);\n if (typeof maybe.text === \"string\" && maybe.text.length > 10000) errors.push(`step ${i}: text too long`);\n if (maybe.action === \"fill_secret\") {\n if (typeof maybe.envVar !== \"string\" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(maybe.envVar)) errors.push(`step ${i}: invalid secret env var`);\n if (task.approved !== true) errors.push(\"NEEDS_SECRET_APPROVAL\");\n }\n if (maybe.action === \"goto\" && maybe.url) {\n try {\n const u = new URL(maybe.url);\n if (![\"http:\", \"https:\"].includes(u.protocol) || !allowed.has(u.hostname)) errors.push(`step ${i}: navigation host blocked`);\n } catch {\n errors.push(`step ${i}: invalid goto url`);\n }\n }\n }\n return errors;\n}\n\nexport function buildKernelPlaywrightCode(task: BrowserTask): string {\n const plan = JSON.stringify(task);\n return `\nconst plan = ${plan};\nconst outputs = {};\nconst checks = [];\nconst targetHost = new URL(plan.targetUrl).hostname;\nconst allowedHosts = new Set([targetHost, ...(plan.allowedHosts || [])]);\nconst allowedMethods = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n\nconst assertUrl = (value) => {\n const u = new URL(value);\n if (![\"http:\", \"https:\"].includes(u.protocol)) throw new Error(\"blocked protocol\");\n if (!allowedHosts.has(u.hostname)) throw new Error(\"blocked host: \" + u.hostname);\n};\n\nawait page.route(\"**/*\", async (route) => {\n const req = route.request();\n try {\n if (req.isNavigationRequest() && req.frame() === page.mainFrame()) assertUrl(req.url());\n if (plan.risk === \"read_only\" && !allowedMethods.has(req.method().toUpperCase())) return route.abort(\"blockedbyclient\");\n return route.continue();\n } catch {\n return route.abort(\"blockedbyclient\");\n }\n});\n\npage.on(\"popup\", async (popup) => { try { await popup.close(); } catch {} });\nassertUrl(plan.targetUrl);\nawait page.goto(plan.targetUrl, { waitUntil: \"domcontentloaded\" });\nassertUrl(page.url());\n\nfor (const step of plan.steps) {\n switch (step.action) {\n case \"goto\": {\n const url = step.url || plan.targetUrl;\n assertUrl(url);\n await page.goto(url, { waitUntil: \"domcontentloaded\" });\n break;\n }\n case \"wait_for\":\n await page.locator(step.selector).waitFor({ state: \"visible\", timeout: step.timeoutMs || 10000 });\n break;\n case \"click\":\n if (step.waitForNavigation) {\n await Promise.all([\n page.waitForLoadState(\"domcontentloaded\"),\n page.locator(step.selector).click(),\n ]);\n } else await page.locator(step.selector).click();\n break;\n case \"fill\":\n await page.locator(step.selector).fill(step.text);\n break;\n case \"type\":\n await page.locator(step.selector).pressSequentially(step.text, { delay: step.delayMs || 0 });\n break;\n case \"select\":\n await page.locator(step.selector).selectOption(step.value);\n break;\n case \"extract_text\":\n outputs[step.key] = await page.locator(step.selector).innerText();\n break;\n case \"extract_attribute\":\n outputs[step.key] = await page.locator(step.selector).getAttribute(step.attribute);\n break;\n case \"expect_text\": {\n const body = await page.locator(\"body\").innerText();\n checks.push({ type: \"text\", expected: step.text, ok: body.includes(step.text) });\n break;\n }\n case \"expect_url\": {\n const actual = page.url();\n checks.push({ type: \"url\", expected: step.contains, actual, ok: actual.includes(step.contains) });\n break;\n }\n }\n assertUrl(page.url());\n}\n\nreturn {\n finalUrl: page.url(),\n outputs,\n checks,\n verified: checks.length > 0 && checks.every((x) => x.ok),\n};\n`;\n}\n\n\nexport function resolveSecrets(task: BrowserTask): BrowserTask {\n const steps = task.steps.map((step) => {\n if (step.action !== \"fill_secret\") return step;\n const value = Deno.env.get(step.envVar);\n if (value === undefined) throw new Error(`secret env var missing: ${step.envVar}`);\n return { action: \"fill\" as const, selector: step.selector, text: value };\n });\n return { ...task, steps };\n}\n",[],[186,288],["D",1788707365920],[211,212,213,214],[186],"552929ae-79cc-46d2-a38c-653e6426f7bc","PROVIDER_CENSUS.md","5865efa4-aa06-11f1-b715-1607ee4eb77e",29,["D",1788707965447],"# Browser Provider Census — V0.4.1\n\nResearch snapshot: 2026-09-06.\n\nThe ranking optimizes for a ChatGPT-mobile control plane with no user PC, recurring free allowance, deterministic browser control, provider isolation, and minimal browser-open time.\n\n## 1. Kernel — CHAMPION\n\nState in this val: `ACCOUNT_KEY_REQUIRED`.\n\nWhy first:\n- Free plan with recurring monthly credits.\n- Multiple concurrent browsers.\n- Headless browser available.\n- Stealth/CAPTCHA/proxy features.\n- Managed auth capability.\n- Uploads/downloads and replay/live-view capabilities.\n- Official Val Town browser-automation guide and starter val.\n- Current Kernel SDK supports server-side Playwright execution in the browser VM, reducing Val Town-side browser-library overhead.\n\nAdapter: `providers/kernel.ts`.\n\nRequired env var: `KERNEL_API_KEY`.\n\n## 2. Browserless — RECURRING-FREE FALLBACK\n\nState in this val: `ACCOUNT_TOKEN_REQUIRED`.\n\nWhy second:\n- Recurring Free plan.\n- No card advertised for Free.\n- 1,000 browser units/month.\n- Two concurrent browsers.\n- Short bounded sessions are a good fit for deterministic plans.\n- Function API can execute Puppeteer code over one HTTPS request.\n\nAdapter: `providers/browserless.ts`.\n\nRequired env var: `BROWSERLESS_TOKEN`.\nOptional: `BROWSERLESS_BASE_URL`.\n\n## 3. Browserbase — RESEARCHED FALLBACK\n\nState: not implemented.\n\nCurrent Free allowance researched:\n- recurring Free plan;\n- three concurrent browsers;\n- one browser-hour/month;\n- Free CAPTCHA support is weaker than higher-priority choices.\n\nOfficial Val Town integration guide exists.\n\n## 4. Steel — ONE-TIME-CREDIT FALLBACK\n\nState: not implemented.\n\nUseful properties:\n- open-source browser infrastructure;\n- Playwright/Puppeteer support;\n- official Val Town guide;\n- substantial starter credits.\n\nReason for lower rank: starter credits are not the preferred recurring-free steady-state budget and some advanced anti-bot/proxy capability can require paid-balance verification.\n\n## Routing rules\n\n1. Honor an explicit `preferredProvider` when the requested provider is configured.\n2. Otherwise use Kernel first.\n3. For `read_only` only, if Kernel fails and Browserless is configured, fallback to Browserless.\n4. Never automatically retry `reversible_write` or `consequential` work on another provider. A failed response is not proof that the first provider caused no side effect.\n5. Keep browser sessions as short as possible; reasoning occurs in ChatGPT before opening a browser.\n\n## Promotion rule\n\nNo provider becomes `OPERATIONAL` from pricing/docs alone. Promotion requires:\n- credential authentication;\n- real browser creation;\n- a read-only smoke task;\n- explicit expectation PASS;\n- receipt persistence;\n- provider usage/cost observation if available.\n",[],[192,299],"6d6405c1-8586-412e-90b2-3cf7056d77d8","CURRENT_STATE.md","48d7c6c0-aa06-11f1-b220-1607ee4eb77e",33,["D",1788708119821],"# CURRENT_STATE — V0.4.1\n\nUpdated: 2026-09-06\n\n## Canonical runtime\n\n`normal ChatGPT mobile/web -> authenticated Val Town plugin -> val-scoped SQLite -> runner.ts -> browser provider -> receipt`\n\nNo Codex and no user computer are required.\n\n## Val Town\n\n- Val: `cleitoncosta/chat-native-maestro`\n- Personal workspace tier: Free\n- Code visibility: public (Free-tier constraint)\n- HTTP endpoint: public health/status only\n- Task execution: authenticated Val Town plugin only\n- Persistent state: val-scoped SQLite\n\n## Implemented files\n\n- `main.ts` — minimal public GET-only liveness endpoint; detailed runtime state is not exposed.\n- `status.ts` — authenticated provider/task/receipt diagnostics via the Val Town plugin.\n- `runner.ts` — atomic queue claim, validation, execution, receipt persistence.\n- `selftest.ts` — positive and negative controls.\n- `lib/types.ts` — task/receipt DSL types.\n- `lib/dsl.ts` — validation, browser program generation, in-memory secret resolution.\n- `providers/router.ts` — provider routing/fallback.\n- `providers/kernel.ts` — primary browser adapter.\n- `providers/browserless.ts` — secondary browser adapter.\n\n## Evidence states\n\n### PASS\n\n- ChatGPT Val Town plugin connected and authenticated.\n- Free workspace enumerated.\n- Val creation/editing/running works.\n- HTTP endpoint returns 200.\n- SQLite schema, writes and reads work.\n- Queue claim works.\n- Receipts persist after execution.\n- Consequential action without approval -> BLOCKED.\n- `fill_secret` without approval -> BLOCKED.\n- Invalid secret env-var name -> BLOCKED.\n- Missing Kernel key -> classified BLOCKED.\n- Missing Browserless token -> classified BLOCKED.\n- Kernel SDK and Browserless adapter modules load in Val Town runtime.\n\n### UNVERIFIED\n\n- Kernel API authentication for this user.\n- Kernel real browser creation.\n- Kernel Playwright execution against a real page.\n- Kernel real credit consumption for this user.\n- Browserless API authentication for this user.\n- Browserless `/function` real execution.\n- Browserless real unit accounting for this user.\n\n## Negative-control receipts currently stored\n\n1. `neg-control-no-kernel-key` -> BLOCKED / `KERNEL_API_KEY missing`.\n2. `neg-control-no-browserless-token` -> BLOCKED / `BROWSERLESS_TOKEN missing`.\n3. `neg-control-secret-not-approved` -> BLOCKED / `NEEDS_SECRET_APPROVAL`.\n\n## Secrets\n\nTask JSON must never contain passwords, auth cookies or API tokens.\n\nA browser secret is referenced by env-var name with `fill_secret`. The value is resolved only in execution memory after approval. Provider API credentials live only in Val Town environment variables.\n\n## Next incomplete milestone\n\nConfigure exactly one recurring-free browser provider credential, preferably Kernel, then execute a read-only smoke test against `https://example.com` with explicit extraction and expectations. Measure actual provider usage and only then upgrade live browser state from UNVERIFIED.\n",[],[192,307],"576913e9-063e-4587-9ab3-e3a47f4d9ef5","ACTIVATION_RUNBOOK.md","60d7bb54-aa06-11f1-91f3-1607ee4eb77e",30,["D",1788707979591],"# Activation Runbook — V0.4.1\n\n## Preferred activation: Kernel\n\n1. Create or sign in to a Kernel Free account.\n2. Create an API key in the Kernel dashboard.\n3. Store it only as Val Town env var `KERNEL_API_KEY`.\n4. Do not paste the key into chat, README, SQLite, task JSON, logs, or source code.\n5. Re-run `selftest.ts` and verify Kernel changes from `ACCOUNT_KEY_REQUIRED` to `READY`.\n6. Enqueue a read-only smoke task for `https://example.com`:\n - extract `h1`;\n - expect `Example Domain`;\n - expect URL contains `example.com`.\n7. Run `runner.ts`.\n8. Query the persisted receipt.\n9. Promote Kernel to OPERATIONAL only if receipt status is PASS and the output matches the expected page state.\n10. Observe provider usage/credit consumption if the account API/dashboard exposes it.\n\nVal Town env editor:\nhttps://www.val.town/x/cleitoncosta/chat-native-maestro/environment-variables?key=KERNEL_API_KEY\n\nKernel API key dashboard:\nhttps://dashboard.onkernel.com/api-keys\n\n## Secondary activation: Browserless\n\nUse only if Kernel onboarding is blocked or as fallback testing.\n\n1. Create/sign in to Browserless Free.\n2. Obtain the account token.\n3. Store it as `BROWSERLESS_TOKEN` in Val Town.\n4. If the account gives a regional base endpoint different from the default, store it as `BROWSERLESS_BASE_URL`.\n5. Re-run `selftest.ts` and health GET.\n6. Run the same read-only smoke task with `preferredProvider: \"browserless\"`.\n7. Persist and inspect receipt.\n8. Observe actual unit consumption.\n\nVal Town env editor:\nhttps://www.val.town/x/cleitoncosta/chat-native-maestro/environment-variables?key=BROWSERLESS_TOKEN\n\n## Browser-login secrets\n\nFor credentials used inside a target site, create dedicated Val Town env vars, for example:\n- `PORTAL_USERNAME`\n- `PORTAL_PASSWORD`\n\nTask JSON uses only references:\n\n```json\n{\n \"action\": \"fill_secret\",\n \"selector\": \"#password\",\n \"envVar\": \"PORTAL_PASSWORD\"\n}\n```\n\nA task containing `fill_secret` requires explicit approval before execution.\n\n## Never do\n\n- Never embed API keys in public source code.\n- Never store passwords in SQLite task JSON.\n- Never retry a failed write task automatically on another browser provider.\n- Never treat provider HTTP/SDK success as proof that the requested page state was achieved.\n- Never downgrade an explicit expectation failure to PASS.\n",[],[192,315],["D",1788707374127],[207,208,209],[192],["D",1788707065045],["D",1789488693443],{"_99":98,"_107":103},{"_99":98,"_100":101,"_102":103,"_18":54,"_104":105,"_106":24},{"_13":88,"_31":89,"_42":41,"_90":43,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":44,"_97":98},"ctx",{"_81":-5,"_127":363,"_364":365,"_366":367,"_368":24,"_369":24,"_370":24,"_371":58,"_372":-5,"_373":-7,"_374":-7,"_375":62,"_376":24,"_377":24,"_378":-5,"_379":24,"_380":24,"_381":24,"_382":-5},"ENV",{"_334":335,"_336":337,"_338":89,"_339":340,"_341":342,"_343":344,"_345":346,"_347":348,"_349":350,"_351":352,"_353":354,"_355":356,"_357":358,"_359":360,"_361":362},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v36