Unify iframe + agent-browser into one swappable-renderer browser surface

[nedtwigg]

What

Collapses dor iframe and dor ab (agent-browser) into a single surfaceType: 'browser' surface with three interchangeable renderers — ab-screencast, ab-popout, and iframe — all sharing one browser chrome (URL bar + Back/Forward + the far-left Display chip). params.url becomes the canonical URL across renderers, so swapping renderers or restoring a session keeps the page.

See docs/specs/dor-iframe.md and the agent-browser spec for the as-built design.

Highlights

• Unified surface & chrome. One browser surface type; render modes renamed to ab-screencast / ab-popout / iframe. Every browser surface gets real chrome (URL, nav, Display modal) on every host.
• Transparent iframe proxy. A loopback proxy fronts http upstreams and injects a shim that gives Dormouse a keyboard side-channel, an accurate focus model, real error pages, and same-frame navigation reporting. New-tab/window.open attempts are offered as a new pane instead of vanishing in the single-frame renderer. CSP / X-Frame-Options framing refusals are diagnosed and shown as a served page.
• Render-swap + pop-out. Bidirectional swap between the embedded screencast and the iframe embed; headed pop-out windows on hosts that can spawn them, closing cleanly on editor shutdown. ab→iframe swap is gated behind a typed confirm when ≥2 tabs are open.
• Hosts unified. VS Code and standalone hosts share one lib module for agent-browser; standalone gains screencast + render-swap + pop-out capabilities and a dev harness (dev:standalone:ab) with a debugging skill.
• StrictMode everywhere. Web, standalone, VS Code, storybook, tests, and website entries all run under StrictMode; the screencast loop and registrations were made StrictMode-safe.
• Lifecycle/transition fixes. Daemon restart on pop-out/pop-in, graceful sidecar stop on quit, tab-click at the root, canvas repaint on tab switch, dropped duplicate frame/tab re-broadcasts, preserved iframe URL on render swap and adapter method bindings.

Review follow-ups (ultrareview + dormouse-bot)

Three chrome-desync / build issues caught in review, all now fixed with coverage:

• Modifier-clicks lied to the URL bar. The proxy shim posted location for any anchor click, so Cmd/Ctrl/Shift/Alt+click — which open a new tab and leave the frame put — moved the parent URL bar + Back history to a page the iframe wasn't showing. Now guarded on modifier keys / primary button.
• Cancelled same-origin clicks lied too. The shim's same-frame post runs in the capture phase, ahead of the page's own handlers, so a link the page cancels (preventDefault, or an <a> that fetches instead of navigating) still reported a navigation. The post is now deferred a tick and skipped when the click was cancelled; real navigations re-report via the next document's shim.
• Back/Forward didn't reload after an observed nav. After a shim-observed in-frame navigation, params.url stays at the source URL, so Back to that URL was a no-op write and the proxy effect never re-fired — the frame kept showing the navigated page while the chrome showed the Back target. goToHistoryIndex now bumps reloadNonce to force a re-resolution (fresh proxy port → real reload), matching the reload button.
• Build break (fixed). This branch rewrote AgentBrowserPanel's popped-out CDP-connect path to call the optional platform.agentBrowserCommand directly inside a nested closure; TS doesn't carry the optional-property narrowing into the closure, so it failed tsc and reddened CI. Bound to a local const after the guard. (An earlier revision of this description wrongly called this pre-existing — it is introduced by this branch; main used getAgentBrowserStreamUrl?.(…).)

Test

tsc -b clean; pnpm -r run test green. The iframe-proxy shim and IframePanel chrome/Back behavior have direct coverage.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	15733ef
Status:	✅  Deploy successful!
Preview URL:	https://51d2e0e3.mouseterm.pages.dev
Branch Preview URL:	https://ab-iframe-unify.mouseterm.pages.dev

View logs

[dormouse-bot]

Both Build & Test and Standalone Smoketest are red on the same tsc error at AgentBrowserPanel.tsx:546 (platform.agentBrowserCommand possibly undefined). The PR description calls this "pre-existing... present before this branch's latest fixes" — but it isn't on main: there connect() resolved the stream URL via getAgentBrowserStreamUrl?.(wsPort) (optional-chained). This branch rewrote connect() to call platform.agentBrowserCommand(...) directly, which introduces the error. The effect already guards with if (!platform.agentBrowserCommand) return; a few lines up, but TS doesn't carry that narrowing of an optional property into the nested connect closure — so the call still needs a local binding. Inline suggestion below makes the build green.

One lower-confidence observation on the new iframe proxy shim, for your call (no fix pushed since the right behavior is a judgment): the injected click handler in iframe-proxy-rewrite.ts posts location: a.href from the capture phase for same-frame primary-button anchor clicks. Capture runs before the page's own bubble-phase handlers, so a same-origin link the page intercepts and cancels (<a href="/logout" onClick={e => e.preventDefault()}>, or an <a> styled as a button that does a fetch instead of navigating) still reports /logout to the parent, which pushes it into Back history and the URL bar though the frame never navigated. SPA <Link> clicks self-correct via the patched pushState, and javascript:/cross-origin hrefs are already dropped by the parent's origin check — so the residual gap is genuinely-cancelled same-origin clicks. If that matters, deferring the post a tick (setTimeout(() => { if (!e.defaultPrevented) post('location', ...) }, 0)) or relying on the navigation hooks instead of the click guess would close it.