# Managed agent history and window controls

Administrators independently enable `history:list`, `history:go`, `window:state`
and `window:control` in the signed baseline and approved individual grant. All
four start unchecked. User-profile restrictions, global agent disable, grant
expiry, credential generation and destination restrictions continue to apply.
Use the existing locally paired DPAPI/PQ agent client; there is no new plaintext
or unauthenticated endpoint.

| Action | Arguments | Returned data |
| --- | --- | --- |
| `history:list` | Native `sessionId` | `snapshotId`, entries with opaque `entryId`, sanitized title, optional inspected URL and active flag |
| `history:go` | Same `sessionId`, returned `snapshotId` and `entryId` | `completed` |
| `window:state` | Empty object | Bounded dimensions and visible/focused/minimized/maximized/fullScreen booleans |
| `window:control` | `command`: minimize, maximize, restore or focus | `completed`; query state separately |

For history navigation, first request a list, select a returned entry and use its
handles within 60 seconds. The snapshot is consumed once. Refresh the list after
navigation or a stale-snapshot refusal; do not automatically repeat a mutation.
Agents never supply a raw native history index or URL to the history-go action.

History is limited to 100 entries and current native tab ownership. Complete DLP
inspection precedes title/URL export. Credential-bearing entries are masked and
cannot be selected for navigation, even with sensitive-read permission. Other
classified confidential entries retain opaque handles while hiding their title
and URL. Entries outside the actor's destination scope are excluded.

Private snapshots bind the actor/generation, session, native contents, policy,
navigation token and complete bounded inventory. Native Chromium `pageState`
can contain form values: it is never exported or retained in the snapshot.
Only a private comparison checksum is used to detect replacement even when URL
and title stay the same; this checksum also never leaves the privileged process.
The final native comparison occurs immediately before dispatch. Scroll/form-state
updates can legitimately make a snapshot stale. This is active-tab history
navigation, not persistent session restoration.

Window control operates only on S Browser's own window. It rechecks policy,
principal authorization, cancellation and native window identity before effects
and before returning state. Closing the application, arbitrary resizing,
positioning and general OS automation are not provided by this scope. A failure
after an effect does not imply undo, and never triggers a retry.

Every action retains durable pre-execution and completion/failure audit with
verified actor attribution. Ordinary events contain no history titles, URLs,
serialized page state or arguments. Debug spans name the action and native
navigation/window phase under the protected RPC parent. Administrators retain
central control of diagnostic export independently of these capabilities.

Actual Windows/Electron proof exercises two individually paired actors,
cross-actor/stale/replayed history refusal, DLP/credential masking, host exclusions,
one exact indexed navigation, native maximize/restore/minimize/focus, targeted
revocation and global disable. Named OTLP stages correlate with completed audit
events (`artifacts/extended-agent-controls-native-proof.json`). Same-URL/title
page-state replacement has unit-boundary evidence; a separate native mutation
experiment is not claimed. Same-user Windows DPAPI trust and production identity
custody remain separate limitations.