# Task: Implement ML-06 Agent Browser pre-document injection

## Identity

- Task ID: 20260826-ml06-agent-browser-injection-2c7e91a4
- Mode: Feature
- Branch: codex/20260826-ml06-agent-browser-injection-2c7e91a4-ml06-agent-browser-injection
- Worktree: D:\Datas\OthersProjects\makelore-ml06-agent-browser-injection-2c7e91a4
- Base commit: 14fec701086f60d78466b8e1cc3fb57ca8d7e200
- Owner: codex
- Status: Ready for Integration

## Scope

- Implement ticket ML-06 against the exact ML-05 frontier
  `14fec701086f60d78466b8e1cc3fb57ca8d7e200`.
- Extend Agent Browser open inputs and the Pi `agent_browser` adapter with the
  opt-in `injectProjectData` capability, without changing ordinary arbitrary-URL
  opens.
- Bind the accepted open to the ML-05 preview data session and install a
  serialized exact-Origin CDP new-document script after debugger attach and
  before the first target document load; track and remove every installed script.
- Wire synchronous session invalidation and cleanup across cross-Origin
  navigation/redirect, browser close/crash/detach/generation replacement,
  project transitions, logout, and Main teardown, with focused unit/Electron/
  E2E coverage where the repository prerequisites permit.

## Intent And Constraints

- Follow spec sections 10.1 and 10.4, ticket ML-06, the canonical Data Service
  contract, and ADR-2026-08-26-makelore-development-data-service.md. Preserve the existing Agent Browser
  abstraction, attach-before-load lifecycle, child-session handling, and single
  BrowserWindow/view design.
- Use only a narrow structural preview-session interface. Main remains the sole
  Works credential owner; injected data contains only the local endpoint,
  ephemeral token, and contract version. Do not add a generic dispatcher,
  compatibility layer, preload, retry, cache, Firebase behavior, or ML-07 SDK /
  Skill work.
- The exact Origin guard is mandatory even while asynchronous CDP cleanup is in
  flight. Data-enabled non-loopback targets must fail before any target page
  load; failed session creation or script installation must tear down the view
  before the target application can execute.

## Planning Gate

- Result: Passed on 2026-08-26.
- Concurrent ownership is isolated from the occupied client coordinator and
  matches this task ID, branch, absolute worktree, and exact base commit.
- Loaded MakeLore AGENTS.md, required project-memory entry documents, active
  coordinator task scope, accepted Data Service ADR, canonical contract, and
  spec/plan sections 10.1 and 10.4. Active planning peers are either unrelated
  or have placeholder scopes; no unresolved semantic conflict overlaps the ML-06
  files. The coordinator owns the integration frontier and will cherry-pick this
  task's single commit.

## Implementation Plan

1. Add red tests for opt-in propagation/rejection, attach-before-load script
   installation and serialization, child target sessions, invalidation/removal,
   and ordinary-open preservation.
2. Add the narrow preview-session invalidation subscription and Agent Browser
   capability state; install root/child scripts with tracked CDP IDs and strict
   pre-load failure cleanup.
3. Wire route/Pi input validation and Main/composition lifecycle subscription;
   extend focused route/preview regressions without touching SDK/Skill work.
4. Run focused tests, ML-05 regressions, typecheck/lint/build/Electron checks
   available in this environment, inspect diff boundaries, update this record,
   and run task-aware doc drift before returning one clean commit.

## Outcome

- Implemented ML-06 on the exact ML-05 frontier. Agent Browser now accepts an
  explicit `injectProjectData` opt-in, rejects non-loopback targets before view
  creation, opens a narrow preview session, and installs a serialized
  exact-Origin `__MAKELORE_DATA__` new-document script after debugger attach
  and before the target load. Root and document-child CDP sessions track script
  identifiers; invalidation removes them and synchronously makes the token
  unusable across navigation/redirect, close, project transitions, logout,
  generation replacement, debugger detach, renderer crash, and Main shutdown.
  Ordinary arbitrary-URL opens remain data-free, and route/Pi input propagation
  is literal-true only. The child-target race is covered so a paused target is
  released only after invalidation cleanup completes.

## Verification

- Focused Vitest: `pnpm exec vitest run tests/unit/agent-browser-core.test.ts
  tests/unit/agent-browser-routes.test.ts tests/unit/pi-product-tools.test.ts
  tests/unit/coding-core-routes.test.ts` — 4 files, 122 tests passed.
- Full repository tests: `pnpm test` — 187 files, 1,596 passed, 2 skipped;
  pressure test — 1 passed.
- Electron smoke: `pnpm test:electron:windows` — 2 files, 4 tests passed.
- TypeScript: `pnpm typecheck` passed.
- Lint: `pnpm lint:check` passed with 0 errors and 5 pre-existing warnings in
  `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`.
- Build: `pnpm build:vite` passed for renderer, Main, preload, and utility
  worker; existing dynamic-import and large-chunk warnings remain.
- E2E: `pnpm test:e2e` reached 25 passing tests and 1 unrelated failure in
  `tests/e2e/pi-coding-first-chat.spec.ts:575`, where the existing
  `当前对话模型` combobox remained disabled until timeout. Re-running that
  test alone reproduced the same timeout; no ML-06 injection path was involved.
- Diff hygiene: `git diff --check` passed; no files outside the ML-06 ownership
  boundary were changed.

## Follow-ups

- Parent integration must cherry-pick this commit into the client frontier,
  then perform the repository review/remediation and X-01 real PostgreSQL plus
  signed-in MakeLore preview acceptance. The E2E prerequisite failure above
  remains an integration-environment deviation, not a claimed pass.

## Promotion Candidates

- None recorded.