refactor: refresh Rust CDP and retire hidden windows

[Nikhil (shadowfax92)]

Summary

• vendor the exact 58-domain ch1 protocol with pinned SHA-256 provenance and generate only the focused Rust surface plus transitive referenced types
• remove hidden page/window state and wire behavior from browseros-core and Rust server call sites while retaining source-derived compatibility tombstones
• remove hidden controls, structured output, and prompt guidance from the Rust MCP tools and JavaScript run bridge

Design

browseros-cdp now owns a byte-exact combined Chromium protocol input, a declarative focused surface, and deterministic transitive reference closure in its build generator. The generated wire layer may retain Chromium's hidden-window compatibility tombstones, but core, MCP, and server runtime code no longer advertises, sends, caches, branches on, or serializes hidden state. Ordinary background-tab, default-window, tab-group, and visibility-reporting behavior remains intact.

Integration

• merged origin/main additively after chore: refresh TypeScript CDP and retire hidden surfaces #2014 landed; no rebase or force-push
• retained deletion of the old reduced js_protocol.json and selected canonical Runtime.getProperties for the new perf(core): acquire snapshots concurrently #2011 core consumer
• aligned inherited fake PropertyDescriptor responses with the exact ch1 required fields

Test plan

• canonical protocol byte comparison, SHA-256, and 58-domain source contract
• cargo fmt --all --check
• cargo test --workspace
• cargo clippy --workspace --all-targets -- -D warnings
• bun run check
• bun run test
• git diff --check
• Rust runtime boundary audit for retired hidden-window calls and state

[Nikhil (shadowfax92)]

Greptile (@greptileai) review

[Nikhil (shadowfax92)]

Claude (@claude) review

[claude]

Claude finished Nikhil (@shadowfax92)'s task in 3m 12s —— View job

---

Review

Todo list

• Read repo CLAUDE.md and setup instructions
• Review protocol vendoring / build.rs changes (browseros-cdp)
• Review hidden-window removal in browseros-core
• Review MCP tool changes (run.rs, windows.rs, tabs.rs, prompt.rs)
• Review server call sites (tab_registry.rs, tab_activity.rs, audit.rs)
• Post final review

---

Reviewed against d9d6ad9 (the actual fork point — 4 commits, matches the PR's stated diff stats exactly). Overall this is a clean, well-tested refactor.

Strengths

• Protocol vendoring (crates/browseros-cdp/build.rs, protocol/protocol.sha256, tests/protocol_source.rs): SHA-256-pinned combined ch1 protocol with a declarative surface.json selection + deterministic transitive-reference closure is a solid design — reproducible, no network I/O at build time, and protocol_source.rs locks in both the 58-domain source contract and the fact that Chromium's hidden-window compatibility fields (TabInfo.isHidden, createWindow.hidden, getTabs.includeHidden, showTab, setWindowVisibility) are intentionally retained in the generated wire layer as tombstones, even though nothing in application code calls them anymore. That's a good way to make the "generated surface keeps compat, app logic doesn't use it" claim in the PR description verifiable rather than just asserted.
• Hidden-state removal is thorough and consistent. I grepped crates/ and apps/claw-server-rust/src for is_hidden, hidden_window, set_visibility, and .hidden outside of tests/generated code and found nothing left dangling — WindowManager::create (crates/browseros-core/src/windows.rs), PageManager::list/new_page (crates/browseros-core/src/pages.rs), Browser::new_page (crates/browseros-core/src/browser.rs), and TabRegistry (apps/claw-server-rust/.../tab_registry.rs) all drop includeHidden/hidden params cleanly.
• Good regression coverage for the removal itself, not just the happy path: crates/browseros-mcp/src/tests.rs adds tab_and_window_schemas_omit_hidden_controls and retired_hidden_inputs_are_rejected, which assert that a client still passing hidden/visible/activate gets a rejected-argument error rather than being silently ignored. run.rs's pages.newPage JS bridge similarly returns an explicit "hidden is no longer supported" error instead of silently dropping the option. This is the right behavior for a breaking API change — good attention to detail.
• prompt.rs and service.rs both had their tool-guidance prose updated to stop mentioning hidden windows, with a test (prompt_recommends_only_ordinary_window_isolation) locking that in.

Observation worth confirming (not necessarily a blocker for this PR)

• The TypeScript runtime under packages/browseros-agent/packages/browser-core/src/core/{windows,pages}.ts still actively calls Browser.setWindowVisibility / Browser.showTab and reads/sends isHidden/includeHidden (e.g. windows.ts:50, pages.ts:19,70,319,323,455). Commit 08abb8d ("retire hidden window implementation") already gutted the underlying Chromium C++ handler for these commands on main. If that TS path is still a live runtime (not fully superseded by claw-server-rust), those calls may now fail or behave differently against the trimmed native implementation. If the TS server is already fully deprecated in favor of the Rust one, this is moot — but if not, it'd be good to confirm there's a tracked follow-up for the TS side, since this PR explicitly scopes itself to "browseros-core and Rust server call sites."

Process notes

• CI so far has only run the CLA check (PR is draft, as expected). No cargo test/clippy/bun run check results are visible from CI yet, so I relied on reading the diff rather than a green build signal.
• The PR body's disclosed blockers (bun run check Biome failures in acpx-runtime.test.ts, bun run test failures in claw-app path aliases and the release workflow test) are all in files untouched by this diff and pre-existing on origin/main, consistent with keeping this PR in draft rather than merging on a red base.

No bugs found in the Rust changes themselves. Nice, disciplined refactor with tests that specifically pin down the "removed from app logic, retained as wire-format tombstone" design.

[greptile-apps]

Greptile Summary

Refactors the Rust browser stack to use a pinned, focused Chromium protocol surface and removes hidden-window behavior.

• Vendors and validates the combined 58-domain CDP protocol while generating selected commands, events, and transitive types.
• Removes hidden-tab and hidden-window state, controls, serialization, and prompt guidance from core, MCP, and server paths.
• Retains protocol-level compatibility tombstones while preventing runtime callers from using retired hidden-window options.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failures remain.

Important Files Changed

Filename	Overview
packages/browseros-agent/crates/browseros-cdp/build.rs	Replaces reduced-protocol generation with SHA-validated focused-surface generation, transitive reference closure, and automatic recursive-type boxing.
packages/browseros-agent/crates/browseros-cdp/protocol/surface.json	Declares the focused nine-domain Rust CDP surface while relying on generator-driven transitive type inclusion.
packages/browseros-agent/crates/browseros-core/src/pages.rs	Removes hidden-page state and creation/show behavior while retaining ordinary page discovery, creation, movement, and lifecycle handling.
packages/browseros-agent/crates/browseros-core/src/windows.rs	Removes hidden-window creation and visibility mutation, leaving list, create, close, and activate operations.
packages/browseros-agent/crates/browseros-mcp/src/tools/run.rs	Removes hidden state from the JavaScript bridge and explicitly rejects the retired hidden new-page option.
packages/browseros-agent/crates/browseros-mcp/src/tools/windows.rs	Narrows the windows tool schema and implementation to ordinary list, create, close, and activate actions.

_{Reviews (2): Last reviewed commit: "test(core): align getProperties fixtures..." | Re-trigger Greptile}

[Nikhil (shadowfax92)]

Review follow-up: the TypeScript runtime concern is resolved by #2014, which is now merged. I merged the resulting origin/main additively, kept the retired Rust snapshot deleted, added canonical Runtime.getProperties to the focused surface for #2011's new consumer, and aligned its fake CDP PropertyDescriptor payloads with the exact protocol. Full Rust and repository-wide gates pass; there are no inline or unresolved review threads.

[github-actions]

✅ Tests passed — 1694/1698

Suite	Passed	Failed	Skipped
✅ agent	350/350	0	0
✅ build	34/34	0	0
✅ claw-app	215/215	0	0
⚠️ claw-mcp	0/0	0	0
⚠️ claw-onboard	0/0	0	0
⚠️ claw-server-rust-quality	0/0	0	0
⚠️ claw-server-rust	0/0	0	0
✅ server-agent	313/313	0	0
✅ server-api	171/171	0	0
✅ server-browser	10/10	0	0
✅ server-integration	10/10	0	0
✅ server-lib	299/300	0	1
✅ server-root	38/41	0	3
✅ server-tools	254/254	0	0

View workflow run