Keep browser input from submitting Paseo prompts (#1982)

* fix(desktop): keep browser input out of the composer

Unhandled webview keys could be redispatched into the active host window, allowing agent Enter to submit a draft prompt. Give pages first refusal for ordinary shortcuts and contain automation at the guest boundary.

* fix(desktop): tighten browser shortcut validation

* fix(desktop): respect browser shortcut ownership

* fix(desktop): retain browser keys across windows

* fix(desktop): scope browser webviews by host

* Reshape browser shortcut ownership

Use the browser webview registry as the single guest identity authority, scope browser operations to their host window, publish chord continuations only while pending, and restore focus to the originating browser after command center dismissal.

* Fix host-scoped browser shortcut follow-ups

* Fix browser keyboard review follow-ups

* Fix browser keyboard lifecycle regressions

* Fix browser shortcut review regressions

* Fix desktop browser review regressions

* Fix browser shortcut frame regressions

* Fix rebase integration regressions

* Preserve browser-native shortcut ownership

* Isolate browser shortcuts and automation by context

packages/desktop/capture-harness/index.html

@@ -38,12 +38,40 @@
     </style>
   </head>
   <body>
+    <form id="host-composer-form">
+      <label for="host-composer">Host composer</label>
+      <input id="host-composer" name="host-composer" autocomplete="off" />
+    </form>
     <div id="paseo-browser-resident-webviews" aria-hidden="true"></div>
 
     <script>
       const RESIDENT_VIEWPORT_WIDTH = 1280;
       const RESIDENT_VIEWPORT_HEIGHT = 800;
       const host = document.getElementById("paseo-browser-resident-webviews");
+      const hostComposer = document.getElementById("host-composer");
+      const hostComposerForm = document.getElementById("host-composer-form");
+      let hostComposerEnterEvents = 0;
+      let hostComposerSubmissions = 0;
+      let hostBrowserShortcutEvents = 0;
+      hostComposer.addEventListener("keydown", (event) => {
+        if (event.key === "Enter") {
+          hostComposerEnterEvents += 1;
+        }
+      });
+      hostComposerForm.addEventListener("submit", (event) => {
+        event.preventDefault();
+        hostComposerSubmissions += 1;
+      });
+      window.addEventListener("keydown", (event) => {
+        if (
+          (event.metaKey || event.ctrlKey) &&
+          !event.altKey &&
+          !event.shiftKey &&
+          event.key.toLowerCase() === "b"
+        ) {
+          hostBrowserShortcutEvents += 1;
+        }
+      });
       const params = new URLSearchParams(window.location.search);
       const requestedWebviewCount = params.has("webviewCount")
         ? Number(params.get("webviewCount"))
@@ -356,6 +384,23 @@
             typeof webview.getWebContentsId === "function" ? webview.getWebContentsId() : null,
           );
         },
+        focusHostComposer() {
+          hostComposer.focus();
+          return document.activeElement?.id || null;
+        },
+        hostComposerState() {
+          return {
+            activeElementId: document.activeElement?.id || null,
+            enterEvents: hostComposerEnterEvents,
+            submissions: hostComposerSubmissions,
+          };
+        },
+        resetHostBrowserShortcutState() {
+          hostBrowserShortcutEvents = 0;
+        },
+        hostBrowserShortcutState() {
+          return { events: hostBrowserShortcutEvents };
+        },
         addWebview(sourceUrl) {
           return appendHarnessWebview(sourceUrl || params.get("targetUrl") || "bright.html");
         },