feat(agent-browser): add opt-in preview data injection

.project-docs/30-worklog/tasks/20260826-ml06-agent-browser-injection-2c7e91a4.md

@@ -0,0 +1,113 @@
+# Task: Implement ML-06 Agent Browser pre-document injection
+
+## Identity
+
+- Task ID: 20260826-ml06-agent-browser-injection-2c7e91a4
+- Mode: Feature
+- Branch: codex/20260826-ml06-agent-browser-injection-2c7e91a4-ml06-agent-browser-injection
+- Worktree: D:\Datas\OthersProjects\makelore-ml06-agent-browser-injection-2c7e91a4
+- Base commit: 14fec701086f60d78466b8e1cc3fb57ca8d7e200
+- Owner: codex
+- Status: Ready for Integration
+
+## Scope
+
+- Implement ticket ML-06 against the exact ML-05 frontier
+  `14fec701086f60d78466b8e1cc3fb57ca8d7e200`.
+- Extend Agent Browser open inputs and the Pi `agent_browser` adapter with the
+  opt-in `injectProjectData` capability, without changing ordinary arbitrary-URL
+  opens.
+- Bind the accepted open to the ML-05 preview data session and install a
+  serialized exact-Origin CDP new-document script after debugger attach and
+  before the first target document load; track and remove every installed script.
+- Wire synchronous session invalidation and cleanup across cross-Origin
+  navigation/redirect, browser close/crash/detach/generation replacement,
+  project transitions, logout, and Main teardown, with focused unit/Electron/
+  E2E coverage where the repository prerequisites permit.
+
+## Intent And Constraints
+
+- Follow spec sections 10.1 and 10.4, ticket ML-06, the canonical Data Service
+  contract, and ADR-2026-08-26-makelore-development-data-service.md. Preserve the existing Agent Browser
+  abstraction, attach-before-load lifecycle, child-session handling, and single
+  BrowserWindow/view design.
+- Use only a narrow structural preview-session interface. Main remains the sole
+  Works credential owner; injected data contains only the local endpoint,
+  ephemeral token, and contract version. Do not add a generic dispatcher,
+  compatibility layer, preload, retry, cache, Firebase behavior, or ML-07 SDK /
+  Skill work.
+- The exact Origin guard is mandatory even while asynchronous CDP cleanup is in
+  flight. Data-enabled non-loopback targets must fail before any target page
+  load; failed session creation or script installation must tear down the view
+  before the target application can execute.
+
+## Planning Gate
+
+- Result: Passed on 2026-08-26.
+- Concurrent ownership is isolated from the occupied client coordinator and
+  matches this task ID, branch, absolute worktree, and exact base commit.
+- Loaded MakeLore AGENTS.md, required project-memory entry documents, active
+  coordinator task scope, accepted Data Service ADR, canonical contract, and
+  spec/plan sections 10.1 and 10.4. Active planning peers are either unrelated
+  or have placeholder scopes; no unresolved semantic conflict overlaps the ML-06
+  files. The coordinator owns the integration frontier and will cherry-pick this
+  task's single commit.
+
+## Implementation Plan
+
+1. Add red tests for opt-in propagation/rejection, attach-before-load script
+   installation and serialization, child target sessions, invalidation/removal,
+   and ordinary-open preservation.
+2. Add the narrow preview-session invalidation subscription and Agent Browser
+   capability state; install root/child scripts with tracked CDP IDs and strict
+   pre-load failure cleanup.
+3. Wire route/Pi input validation and Main/composition lifecycle subscription;
+   extend focused route/preview regressions without touching SDK/Skill work.
+4. Run focused tests, ML-05 regressions, typecheck/lint/build/Electron checks
+   available in this environment, inspect diff boundaries, update this record,
+   and run task-aware doc drift before returning one clean commit.
+
+## Outcome
+
+- Implemented ML-06 on the exact ML-05 frontier. Agent Browser now accepts an
+  explicit `injectProjectData` opt-in, rejects non-loopback targets before view
+  creation, opens a narrow preview session, and installs a serialized
+  exact-Origin `__MAKELORE_DATA__` new-document script after debugger attach
+  and before the target load. Root and document-child CDP sessions track script
+  identifiers; invalidation removes them and synchronously makes the token
+  unusable across navigation/redirect, close, project transitions, logout,
+  generation replacement, debugger detach, renderer crash, and Main shutdown.
+  Ordinary arbitrary-URL opens remain data-free, and route/Pi input propagation
+  is literal-true only. The child-target race is covered so a paused target is
+  released only after invalidation cleanup completes.
+
+## Verification
+
+- Focused Vitest: `pnpm exec vitest run tests/unit/agent-browser-core.test.ts
+  tests/unit/agent-browser-routes.test.ts tests/unit/pi-product-tools.test.ts
+  tests/unit/coding-core-routes.test.ts` — 4 files, 122 tests passed.
+- Full repository tests: `pnpm test` — 187 files, 1,596 passed, 2 skipped;
+  pressure test — 1 passed.
+- Electron smoke: `pnpm test:electron:windows` — 2 files, 4 tests passed.
+- TypeScript: `pnpm typecheck` passed.
+- Lint: `pnpm lint:check` passed with 0 errors and 5 pre-existing warnings in
+  `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`.
+- Build: `pnpm build:vite` passed for renderer, Main, preload, and utility
+  worker; existing dynamic-import and large-chunk warnings remain.
+- E2E: `pnpm test:e2e` reached 25 passing tests and 1 unrelated failure in
+  `tests/e2e/pi-coding-first-chat.spec.ts:575`, where the existing
+  `当前对话模型` combobox remained disabled until timeout. Re-running that
+  test alone reproduced the same timeout; no ML-06 injection path was involved.
+- Diff hygiene: `git diff --check` passed; no files outside the ML-06 ownership
+  boundary were changed.
+
+## Follow-ups
+
+- Parent integration must cherry-pick this commit into the client frontier,
+  then perform the repository review/remediation and X-01 real PostgreSQL plus
+  signed-in MakeLore preview acceptance. The E2E prerequisite failure above
+  remains an integration-environment deviation, not a claimed pass.
+
+## Promotion Candidates
+
+- None recorded.