safetynet/docs/agent-history-window.md

Managed agent history and window controls

Administrators independently enable history:list, history:go, window:state and window:control in the signed baseline and approved individual grant. All four start unchecked. User-profile restrictions, global agent disable, grant expiry, credential generation and destination restrictions continue to apply. Use the existing locally paired DPAPI/PQ agent client; there is no new plaintext or unauthenticated endpoint.

Action	Arguments	Returned data
history:list	Native sessionId	snapshotId, entries with opaque entryId, sanitized title, optional inspected URL and active flag
history:go	Same sessionId, returned snapshotId and entryId	completed
window:state	Empty object	Bounded dimensions and visible/focused/minimized/maximized/fullScreen booleans
window:control	command: minimize, maximize, restore or focus	completed; query state separately

For history navigation, first request a list, select a returned entry and use its handles within 60 seconds. The snapshot is consumed once. Refresh the list after navigation or a stale-snapshot refusal; do not automatically repeat a mutation. Agents never supply a raw native history index or URL to the history-go action.

History is limited to 100 entries and current native tab ownership. Complete DLP inspection precedes title/URL export. Credential-bearing entries are masked and cannot be selected for navigation, even with sensitive-read permission. Other classified confidential entries retain opaque handles while hiding their title and URL. Entries outside the actor's destination scope are excluded.

Private snapshots bind the actor/generation, session, native contents, policy, navigation token and complete bounded inventory. Native Chromium pageState can contain form values: it is never exported or retained in the snapshot. Only a private comparison checksum is used to detect replacement even when URL and title stay the same; this checksum also never leaves the privileged process. The final native comparison occurs immediately before dispatch. Scroll/form-state updates can legitimately make a snapshot stale. This is active-tab history navigation, not persistent session restoration.

Window control operates only on S Browser's own window. It rechecks policy, principal authorization, cancellation and native window identity before effects and before returning state. Closing the application, arbitrary resizing, positioning and general OS automation are not provided by this scope. A failure after an effect does not imply undo, and never triggers a retry.

Every action retains durable pre-execution and completion/failure audit with verified actor attribution. Ordinary events contain no history titles, URLs, serialized page state or arguments. Debug spans name the action and native navigation/window phase under the protected RPC parent. Administrators retain central control of diagnostic export independently of these capabilities.

Actual Windows/Electron proof exercises two individually paired actors, cross-actor/stale/replayed history refusal, DLP/credential masking, host exclusions, one exact indexed navigation, native maximize/restore/minimize/focus, targeted revocation and global disable. Named OTLP stages correlate with completed audit events (artifacts/extended-agent-controls-native-proof.json). Same-URL/title page-state replacement has unit-boundary evidence; a separate native mutation experiment is not claimed. Same-user Windows DPAPI trust and production identity custody remain separate limitations.