feat(browser): enforce managed CloakBrowser skill boundary

Signed-off-by: Danil Silantyev <danilsilantyevwork@gmail.com>

Author: rldyourmnd

.claude/CLAUDE.md

@@ -58,10 +58,13 @@ Do not treat OpenCode or Gemini command formats as native Codex runtime.
 ## MCP and Security Notes
 
 - MCP server definitions are portable in `plugins/rldyour-mcps/.mcp.json`.
-- Browser work must use the bootstrap-owned `$HOME/.local/bin/webwright`,
-  `$HOME/.local/bin/playwright-cli`, and
-  `$HOME/.local/bin/chrome-devtools-mcp` wrappers backed by CloakBrowser; no
-  stock Chromium, in-app browser, or raw-browser fallback is allowed.
+- Before every browser action, run exactly
+  `$HOME/.local/bin/cloakbrowser-cdp-health`; missing or nonzero health means
+  stop with `NOT_PROVEN`. Browser work may then use only exact
+  `$HOME/.local/bin/playwright-cli` (without `run-code` or `--filename`) or the
+  approved exact Chrome DevTools MCP managed-wrapper transport. Webwright,
+  stock/raw/in-app browser paths, browser/computer-use helpers, raw Playwright,
+  direct packages, alternate CDP/config/executables, and fallbacks are banned.
 - System install keeps `browser@openai-bundled`, `node_repl`, and
   `computer-use` explicitly disabled; doctor rejects reinjected active copies
   and requires reinstall plus Codex restart.

.gitignore

@@ -15,7 +15,7 @@ node_modules/
 diagnostics/
 dist/
 
-# Browser / Webwright / Playwright CLI runtime artifacts
+# Browser / Playwright CLI runtime artifacts, including retired Webwright residue
 browser/**
 !browser/
 !browser/.gitkeep

CHANGELOG.md

@@ -1,71 +1,32 @@
 # Changelog
 
-## [1.7.15] - 2026-06-29
-
-### Fixed
-
-- Harden Ruff and Pyright baseline across adapter configs.
-
-## [1.7.11] - 2026-06-27
-
-### Changed
-
-- Refresh Codex CLI runtime baseline to 0.142.4.
-
-## [1.7.9] - 2026-06-27
-
-### Changed
-
-- Refresh shadcn MCP runtime pin to the latest published 4.12.0 release.
-
-## [1.7.8] - 2026-06-26
-
-### Changed
-
-- Sync Serena release memories after runtime and MCP refresh.
-
-## [1.7.7] - 2026-06-26
-
-### Changed
-
-- Refresh CLI runtime and MCP pins to latest stable versions.
-
-## [1.7.6] - 2026-06-26
-
-### Fixed
-
-- Publish a clean follow-up release with a valid Conventional Commit head subject after the 1.7.5 release commit subject included literal quotes.
-
-## [1.7.5] - 2026-06-26
-
-### Fixed
-
-- Replace non-ASCII punctuation in Flow tracked-context documentation so root ASCII hygiene passes.
-
-## [1.7.4] - 2026-06-26
-
-### Fixed
+All notable changes to this project are documented in this file.
 
-- Align README memory heading with the shared tracked-context adapter template.
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and marketplace/plugin versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [1.7.3] - 2026-06-26
+## [Unreleased]
 
-### Fixed
+## [1.8.8] - 2026-07-10
 
-- Pin the security-static workflow actionlint install to existing upstream `v1.7.12` instead of the invalid `v1.7.22` tag.
+### Security
 
-## [1.7.2] - 2026-06-26
+- Require every browser-capable skill to run the exact
+  `$HOME/.local/bin/cloakbrowser-cdp-health` preflight before every browser
+  action and fail closed as `NOT_PROVEN` when it is missing or unhealthy.
+- Restrict browser execution to exact managed Playwright CLI and the approved
+  Chrome DevTools MCP wrapper transport; forbid Playwright executable escape
+  flags, raw/in-app/computer-use providers, direct packages, alternate CDP or
+  config paths, and all fallbacks while preserving the 1.8.7 app-managed
+  surface disabling.
+- Convert `webwright-task` into a compatibility-only route that decomposes old
+  prompts across managed Playwright CLI and Chrome DevTools MCP without a
+  Webwright or Python runtime, and enforce the boundary in policy validation
+  plus mutation tests for every browser skill.
 
 ### Fixed
 
-- Sync generated cmux worker/orchestrator skill projections with the tracked-context branch model.
-
-All notable changes to this project are documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and marketplace/plugin versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [Unreleased]
-
+- Keep runtime validation portable to macOS Bash 3.2 by passing a non-empty
+  installer argument array under `set -u`, including non-strict static mode.
 
 ## [1.8.7] - 2026-07-10
 
@@ -86,7 +47,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
   remove every workflow path that creates or pushes a tag and keep publication
   centralized behind `gh release --verify-tag`.
 
-
 ## [1.8.6] - 2026-07-10
 
 ### Fixed
@@ -101,7 +61,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
   `0.144.1`, CloakBrowser `0.4.10`, MCP package pins, managed transport, or
   reusable CI `0.5.1`.
 
-
 ## [1.8.5] - 2026-07-10
 
 ### Fixed
@@ -112,7 +71,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 - Preserve Codex CLI `0.144.1`, bootstrap-owned CloakBrowser `0.4.10`, the exact
   managed Chrome DevTools transport, and reusable CI `0.5.1` unchanged.
 
-
 ## [1.8.4] - 2026-07-10
 
 ### Changed
@@ -124,7 +82,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 - Repin every reusable `nddev-ci-workflows` caller to the signed `0.5.1`
   release and add an exact pin regression test.
 
-
 ## [1.8.3] - 2026-07-10
 
 ### Changed
@@ -133,7 +90,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
   health-gated CloakBrowser wrapper and align Playwright CLI to `0.1.17`.
 - Adopt the published Codex CLI `0.144.0` stable runtime baseline.
 
-
 ## [1.8.2] - 2026-07-08
 
 ### Changed
@@ -225,6 +181,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 - Fix Codex published SBOM checksum and attestation proof.
 
+## [1.7.15] - 2026-06-29
+
+### Fixed
+
+- Harden Ruff and Pyright baseline across adapter configs.
+
 ## [1.7.14] - 2026-06-29
 
 ### Fixed
@@ -243,6 +205,60 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 - Fix Codex CodeQL regex anchor alerts.
 
+## [1.7.11] - 2026-06-27
+
+### Changed
+
+- Refresh Codex CLI runtime baseline to 0.142.4.
+
+## [1.7.9] - 2026-06-27
+
+### Changed
+
+- Refresh shadcn MCP runtime pin to the latest published 4.12.0 release.
+
+## [1.7.8] - 2026-06-26
+
+### Changed
+
+- Sync Serena release memories after runtime and MCP refresh.
+
+## [1.7.7] - 2026-06-26
+
+### Changed
+
+- Refresh CLI runtime and MCP pins to latest stable versions.
+
+## [1.7.6] - 2026-06-26
+
+### Fixed
+
+- Publish a clean follow-up release with a valid Conventional Commit head subject after the 1.7.5 release commit subject included literal quotes.
+
+## [1.7.5] - 2026-06-26
+
+### Fixed
+
+- Replace non-ASCII punctuation in Flow tracked-context documentation so root ASCII hygiene passes.
+
+## [1.7.4] - 2026-06-26
+
+### Fixed
+
+- Align README memory heading with the shared tracked-context adapter template.
+
+## [1.7.3] - 2026-06-26
+
+### Fixed
+
+- Pin the security-static workflow actionlint install to existing upstream `v1.7.12` instead of the invalid `v1.7.22` tag.
+
+## [1.7.2] - 2026-06-26
+
+### Fixed
+
+- Sync generated cmux worker/orchestrator skill projections with the tracked-context branch model.
+
 ## [1.7.1] - 2026-06-25
 
 ### Fixed
@@ -518,7 +534,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 - Make `/ry-repair` and launcher planning OS/mode aware for standard and macOS cmux orchestrator installs.
 
-
 ## [1.1.25] - 2026-06-06
 
 ### Fixed

README.md

@@ -17,10 +17,10 @@ It is not a generic preset, not an automatic configuration takeover, and not a b
 
 | Field | Value |
 |---|---|
-| Adapter version | `1.8.7` |
+| Adapter version | `1.8.8` |
 | Runtime baseline | Codex CLI 0.144.1 (`@openai/codex`) |
 | Browser wrapper baseline | CloakBrowser 0.4.10 (`cloakbrowser`; bootstrap-owned) |
-| GitHub release tag | `1.8.7` |
+| GitHub release tag | `1.8.8` |
 
 The runtime baseline reference is `references/codex-baseline.json`, verified 2026-07-10. The npm package is `@openai/codex`; the upstream release artifact is at `https://github.com/openai/codex/releases/tag/rust-v0.144.1`.
 
@@ -47,12 +47,14 @@ MCP launcher packages are pinned in `.mcp.json` and mirrored in `config/mcp-runt
 **Runtime install or update** - on machines that need a Codex CLI install or update:
 
 ```bash
-curl -fsSL https://chatgpt.com/codex/install.sh | CODEX_NON_INTERACTIVE=1 sh
 bun add -g @openai/codex@0.144.1
 codex --version
 codex doctor
 ```
 
+The repository bootstrap owns verified system installation. This adapter does
+not recommend piping a mutable network response into a shell.
+
 **System config install** - dry-run first, then apply:
 
 ```bash
@@ -121,7 +123,7 @@ The active marketplace contains 11 plugins and 45 skills:
 - `rldyour-explore`: research skills for technical MCP research and authoritative web research.
 - `rldyour-serena-mcp`: Serena-first semantic code workflow, fact-only `.serena` memory sync, plans, research archive, and lifecycle hooks.
 - `rldyour-security`: non-blocking OWASP Top 10 2025 secure-implementation guidance and `ry-sec-review` security review skill.
-- `rldyour-browser`: provider-routed browser workflows for Webwright, Playwright CLI, and Chrome DevTools MCP.
+- `rldyour-browser`: fail-closed CloakBrowser workflows through managed Playwright CLI and Chrome DevTools MCP.
 - `rldyour-design`: Figma → code, centralized i18n, dynamic/static content classification, token-based design system, reusable UI kit, strict FSD frontend architecture, shadcn/ui, ReactBits, and browser validation workflows.
 - `rldyour-lsps`: language-server routing, health checks, brew-first setup profiles, and Serena LSP integration guidance.
 - `rldyour-flow`: autonomous SDLC workflows for `ry-init`, `ry-start`, `ry-newp`, `ry-review`, `ry-repair`, `ry-deploy`, scoped context packs, context sufficiency gates, instruction docs sync, fast offline SessionStart worktree bootstrap/context dispatcher hooks, cwd-safe PreToolUse guardrails, advisory commit hooks, reviewer tracks, and post-task synchronization.
@@ -146,13 +148,19 @@ Architecture decisions:
 
 ## Browser / Design / DevTools Routing
 
-Browser automation uses three active providers, routed by task type per `config/browser-automation-policy.json`:
+Browser automation uses two active providers, routed by task type per the root
+control-plane `config/browser-automation-policy.json`:
 
-- **Webwright** (`rldyour-browser`): task-harness provider for full autonomous browser workflows. Adapter-owned CLI wrapper; upstream-native availability is NOT_PROVEN in this adapter.
-- **Playwright CLI** (`rldyour-browser`): CLI provider for Playwright test execution and browser-driven validation.
+- **Playwright CLI** (`rldyour-browser`): exact
+  `$HOME/.local/bin/playwright-cli` for browser-driven validation and
+  decomposed long-horizon workflows; `run-code` and `--filename` are forbidden.
 - **Chrome DevTools MCP** (`plugins/rldyour-mcps`): MCP provider for DevTools protocol access - screenshots, network inspection, console, performance traces, and heap snapshots - via the `chrome-devtools` MCP server.
 
-The required browser engine is the bootstrap-managed CloakBrowser wrapper. Its
+Before every browser action, the skill contract executes exactly
+`$HOME/.local/bin/cloakbrowser-cdp-health`; missing or nonzero health fails
+closed as `NOT_PROVEN`. Chrome DevTools MCP is allowed only through the exact
+managed `/bin/sh -c` wrapper transport. The required browser engine is the
+bootstrap-managed CloakBrowser wrapper. Its
 adapter policy pin is `CLOAKBROWSER_VERSION=0.4.10`; the adapter rejects a
 stock-Chromium fallback and keeps Chrome DevTools MCP on the exact
 `~/.local/bin/chrome-devtools-mcp` transport. Installation and browser-binary
@@ -162,6 +170,12 @@ entry point without changing the browser binaries; see the
 [`v0.4.10` tag](https://github.com/CloakHQ/CloakBrowser/tree/v0.4.10)
 and [PyPI package](https://pypi.org/project/cloakbrowser/0.4.10/).
 
+The historical `webwright-task` skill name is compatibility-only and routes to
+managed Playwright CLI/Chrome DevTools MCP; Webwright runtime, Python
+Webwright, stock/raw/in-app Browser, `browser_agent`, `node_repl`,
+`computer-use`, Playwright MCP/raw Playwright, direct `bunx`/`npx` packages,
+alternate CDP/config/executables, and all browser fallbacks are forbidden.
+
 The `rldyour-design` plugin provides Figma → code workflows, FSD frontend architecture, token-based design system implementation, shadcn/ui integration, ReactBits, and browser validation workflows layered on top of these browser providers.
 
 Managed subagents (`browser-tester`) handle browser-tester review tracks. Specialist MCP servers (`figma`, `chrome-devtools`, `dart-flutter`, `shadcn`) are disabled inside managed subagents and remain parent-session tools for explicit design, browser, Flutter, or shadcn work.

SECURITY.md

@@ -12,8 +12,8 @@ historical patch in the line.
 
 | Version | Supported |
 |---|---|
-| Current exact tag `1.8.7` | yes |
-| Older `1.1.*` tags | no; upgrade to current exact tag |
+| Current exact tag `1.8.8` | yes |
+| Older patch tags | no; upgrade to current exact tag |
 | Older minor / major lines | no |
 
 ## Reporting a Vulnerability

VERSION

@@ -1 +1 @@
-1.8.7
+1.8.8

config/mcp-runtime-versions.env

@@ -17,6 +17,3 @@ SHADCN_VERSION=4.13.0
 # Browser providers outside MCP.
 CLOAKBROWSER_VERSION=0.4.10
 PLAYWRIGHT_CLI_VERSION=0.1.17
-WEBWRIGHT_VERSION=0.1.0
-WEBWRIGHT_INSTALL_SOURCE=github:microsoft/Webwright
-WEBWRIGHT_PIN=4a46f282ec37f27d6003cc498a977939d62d9015