Merge remote-tracking branch 'upstream/main' into feat/agent-skills-frontmatter

Author: alectimison-maker

CONTRIBUTING.md

@@ -177,12 +177,12 @@ the FAQ on the main page. If you've benchmarked a model that should be on
 that list (or shouldn't, for a stated reason), open an issue with the
 benchmark setup, the trace, and the comparison data.
 
-### Code: prompt tier system, Firefox parity, recorder fixes
+### Code: prompt tier system and Firefox parity
 
 See [`TODOs.md`](TODOs.md) for engineering items we know we want to do but
-haven't gotten to. Some of those (e.g. small-tier ACT prompt, `upload_file`
-in Firefox, missing step numbers on tool events in traces) are well-scoped
-and a good first PR if you want a code task.
+haven't gotten to. Some of those (e.g. the small-tier ACT prompt and
+`full_page_screenshot` in Firefox) are well-scoped and a good first PR if you
+want a code task.
 
 ---
 

README.fr.md

@@ -102,7 +102,7 @@ compacte la conversation à mesure qu'elle se remplit. Il existe aussi un relais
 **API cloud** — OpenAI, Anthropic Claude, Google Gemini, Azure OpenAI, AWS
 Bedrock, Mistral, DeepSeek, xAI Grok, MiniMax, Kimi, Qwen, z.ai GLM, Groq,
 Together, Cloudflare, Nvidia NIM, Hugging Face, Fireworks, OpenRouter et
-d'autres. Les Paramètres embarquent **103 cartes de fournisseurs** avec URL de
+d'autres. Les Paramètres embarquent **104 cartes de fournisseurs** avec URL de
 base et modèle par défaut préremplis — voir le
 [catalogue complet](docs/fr/providers-and-models.md#catalogue-étendu-de-fournisseurs).
 
@@ -195,7 +195,7 @@ WebBrain a le focus.
 | [Architecture](docs/fr/architecture.md) | Vue d'ensemble, flux d'un tour, sous-systèmes |
 | [Outils de l'agent](docs/fr/agent-tools.md) | Niveaux, modes et matrice complète |
 | [Commandes slash](docs/fr/slash-commands.md) | Toutes les commandes et options |
-| [Fournisseurs et modèles](docs/fr/providers-and-models.md) | Les 103 cartes, configuration locale, niveaux |
+| [Fournisseurs et modèles](docs/fr/providers-and-models.md) | Les 104 cartes, configuration locale, niveaux |
 | [Compétences](docs/fr/skills.md) | Compétences intégrées, import, outils de compétence |
 | [Modèle de sécurité](docs/fr/security-model.md) | Permissions, identifiants, frontières de confiance |
 | [Défense contre l'injection de prompt](docs/fr/prompt-injection-defense.md) | Couches de défense et limites connues |

README.md

@@ -96,7 +96,7 @@ preview `ollama launch webbrain --model <model>` handoff. Details:
 **Cloud APIs** — OpenAI, Anthropic Claude, Google Gemini, Azure OpenAI, AWS
 Bedrock, Mistral, DeepSeek, xAI Grok, MiniMax, Kimi, Qwen, z.ai GLM, Groq,
 Together, Cloudflare, Nvidia NIM, Hugging Face, Fireworks, OpenRouter, and more.
-Settings ships **103 built-in provider cards** with base URLs and default models
+Settings ships **104 built-in provider cards** with base URLs and default models
 pre-filled — see the [full catalog](docs/providers-and-models.md#extended-provider-catalog).
 
 ## Features
@@ -179,7 +179,7 @@ Chrome side panel shortcuts work when the WebBrain side panel has focus.
 | [Architecture](docs/architecture.md) | System overview, turn flow, subsystems |
 | [Agent tools](docs/agent-tools.md) | Tiers, modes, and the full tool matrix |
 | [Slash commands](docs/slash-commands.md) | Every command and flag |
-| [Providers and models](docs/providers-and-models.md) | All 103 provider cards, local setup, tiers |
+| [Providers and models](docs/providers-and-models.md) | All 104 provider cards, local setup, tiers |
 | [Skills](docs/skills.md) | Bundled skills, importing, skill tools |
 | [Security model](docs/security-model.md) | Permissions, credentials, trust boundaries |
 | [Prompt-injection defense](docs/prompt-injection-defense.md) | Defense layers and known gaps |

README.zh-CN.md

@@ -92,7 +92,7 @@ LM Studio（`:1234/v1`）、Jan（`:1337/v1`）和 LocalAI（`:8080/v1`）用法
 **云端 API** —— OpenAI、Anthropic Claude、Google Gemini、Azure OpenAI、AWS Bedrock、
 Mistral、DeepSeek、xAI Grok、MiniMax、Kimi、通义千问、z.ai GLM、Groq、Together、
 Cloudflare、Nvidia NIM、Hugging Face、Fireworks、OpenRouter 等。设置中内置
-**103 张提供商卡片**，已预填 base URL 和默认模型 —— 参见
+**104 张提供商卡片**，已预填 base URL 和默认模型 —— 参见
 [完整目录](docs/zh-CN/providers-and-models.md#扩展提供商目录)。
 
 ## 功能特性
@@ -168,7 +168,7 @@ Chrome 侧边面板快捷键在 WebBrain 侧边面板获得焦点时生效。
 | [架构](docs/zh-CN/architecture.md) | 系统概览、轮次流程、子系统 |
 | [智能体工具](docs/zh-CN/agent-tools.md) | 层级、模式与完整工具矩阵 |
 | [斜杠命令](docs/zh-CN/slash-commands.md) | 所有命令与参数 |
-| [提供商与模型](docs/zh-CN/providers-and-models.md) | 全部 103 张提供商卡片、本地配置、层级 |
+| [提供商与模型](docs/zh-CN/providers-and-models.md) | 全部 104 张提供商卡片、本地配置、层级 |
 | [技能](docs/zh-CN/skills.md) | 内置技能、导入、技能工具 |
 | [安全模型](docs/zh-CN/security-model.md) | 权限、凭证、信任边界 |
 | [提示注入防御](docs/zh-CN/prompt-injection-defense.md) | 防御层级与已知缺口 |

TODOs.md

@@ -73,11 +73,11 @@ Per-model-class prompt selection wired through `_getActPrompt()`. Tier inferred
 
 The Firefox build is meaningfully weaker than Chrome (already noted in the README's "Known Issues"). Some gaps are platform-real (no CDP, no Manifest V3 service worker), but several are just unported features. Worth ticking off one at a time:
 
-- **`upload_file`** — not yet in Firefox. The dispatcher path exists for downloads but not for uploads. Likely a few hours of work; webextensions has the same `<input type="file">` mechanics.
 - **`full_page_screenshot`** — Chrome uses CDP `captureBeyondViewport`; Firefox would need `tabs.captureFullPage` or a scroll-and-stitch fallback. Lower priority.
 - **`shadow_dom_query`** — CDP-dependent. Hardest port; may not be worth it until a concrete user case emerges.
 
 Recently closed Firefox parity items:
+- **`upload_file`** — Firefox now supports `downloadId` re-fetch and a sidepanel user file picker (no arbitrary local `filePath` without CDP). Shipped via the Firefox upload_file port.
 - Firefox now has `downloads` permission and `download_files`; the old singular `download_file` TODO is obsolete because the tool surface was consolidated on plural `download_files`.
 - Firefox Ask mode can access the accessibility tree again (10.0.2).
 

docs/agent-tools.md

@@ -72,7 +72,7 @@ Legend: **Yes** = available · **-** = not available · **C** = Chrome only ·
 | `read_downloaded_file` | No | No | Yes | Yes | - |
 | `download_files` | No | No | Yes | Yes | - |
 | `download_resource_from_page` | No | No | Yes | Yes | - |
-| `upload_file` | No | No | C | C | - |
+| `upload_file` | No | No | Yes | Yes | - |
 | `verify_form` | No | No | Yes | Yes | - |
 | `hover` | No | No | No | Yes | - |
 | `drag_drop` | No | No | No | Yes | - |

docs/architecture.md

@@ -378,6 +378,7 @@ tracks as a successful video or hand ffmpeg work to the user.
 | Read a YouTube transcript, fetch a blocked NYTimes article, or resolve/download supported public media | FreeSkillz.xyz | Ask, Act, Dev | Ask can load the skill but still cannot see its Act-only `download_public_media` tool. |
 | Look up weather or a short forecast | Open-Meteo weather | Ask, Act, Dev | Read-only tools remain subject to their manifest filters. |
 | Find books, ISBNs, authors, or publication data | Open Library | Ask, Act, Dev | Read-only tools remain subject to their manifest filters. |
+| Search or summarize an encyclopedia topic | Wikipedia | Ask, Act, Dev | Read-only Wikipedia REST/Action API tools; results are untrusted. |
 | Upload one non-sensitive file to a short-lived public link | Temporary file share (Litterbox) | Act, Dev | Not shown to Ask; the skill uses existing browser upload tools. |
 
 The runtime enforces catalog membership, mode/tier eligibility, active-skill

docs/claude-chrome-comparison.md

@@ -97,7 +97,7 @@ core surface, including Dev-only `execute_js`, is shared.
 | Reading/extraction | `read_page`, `read_pdf`, `read_page_source`, `extract_data`, `inspect_element_styles`, `get_selection` |
 | Dev editing and diagnostics | `inject_css`, `remove_injected_css`, `patch_element`, `revert_patch`, `execute_js`, `read_console`, `inspect_network_requests`, `inspect_event_listeners`, `highlight_element` |
 | Shadow DOM and frames | `get_shadow_dom`, `shadow_dom_query` on Chrome, `get_frames`, `iframe_read`, `iframe_click`, `iframe_type` |
-| Network and files | `fetch_url`, `research_url`, `list_downloads`, `read_downloaded_file`, `download_resource_from_page`, `download_files`, `upload_file` on Chrome |
+| Network and files | `fetch_url`, `research_url`, `list_downloads`, `read_downloaded_file`, `download_resource_from_page`, `download_files`, `upload_file` |
 | Long-running work | `schedule_resume`, `schedule_task`, `scratchpad_write`, `progress_update`, `progress_read` |
 | Safety/workflow | `verify_form`, `clarify`, `done`, `solve_captcha` |
 | Media | `download_social_media`, plus dynamic skill tools when enabled |
@@ -194,7 +194,7 @@ fresh screenshot.
 | Console/network inspection | No dedicated console log reader in the core WebBrain tool list. Network shortcuts exist for API observation, but not a model-facing request-log reader in the same way. | Dedicated `read_console_messages` and `read_network_requests`. |
 | Downloads | Several browser download/file tools plus dynamic download-job skill tools. | `downloads` permission exists and `gif_creator` can download exports, but no general download manager equivalent was recovered. |
 | Media download | `download_public_media` skill first; `download_social_media` browser fallback. | No public-media download equivalent recovered. |
-| File upload | Chrome has `upload_file` by downloadId/path-oriented flow; Firefox lacks it. | `file_upload` directly sets local absolute paths on a file input; `upload_image` uploads captured/user images by ref or coordinate. |
+| File upload | Both browsers have `upload_file`. Chrome supports `downloadId` and absolute `filePath`; Firefox supports `downloadId` re-fetch and a sidepanel user file picker (no arbitrary local paths without CDP). | `file_upload` directly sets local absolute paths on a file input; `upload_image` uploads captured/user images by ref or coordinate. |
 | Scheduler | `schedule_resume` and `schedule_task`. | Scheduled task UI/prompt strings exist, but no equivalent model-callable scheduler schema was recovered in the visible tool list. |
 | CAPTCHA | `solve_captcha` when CapSolver is configured. | Explicit security prompt says respect CAPTCHAs and never bypass; no solver tool recovered. |
 | Persistent agent memory | `scratchpad_write`, `progress_update`, `progress_read`. | Conversation compaction exists; no equivalent scratchpad/progress tools recovered. |

docs/fr/agent-tools.md

@@ -72,7 +72,7 @@ uniquement · **Dev** = module Dev (fournisseurs Mid/Full ; pas Compact).
 | `read_downloaded_file` | Non | Non | Oui | Oui | - |
 | `download_files` | Non | Non | Oui | Oui | - |
 | `download_resource_from_page` | Non | Non | Oui | Oui | - |
-| `upload_file` | Non | Non | C | C | - |
+| `upload_file` | Non | Non | Oui | Oui | - |
 | `verify_form` | Non | Non | Oui | Oui | - |
 | `hover` | Non | Non | Non | Oui | - |
 | `drag_drop` | Non | Non | Non | Oui | - |

docs/fr/claude-chrome-comparison.md

@@ -99,7 +99,7 @@ de la surface de base, y compris `execute_js` réservé au mode Dev, est partag
 | Lecture/extraction | `read_page`, `read_pdf`, `read_page_source`, `extract_data`, `inspect_element_styles`, `get_selection` |
 | Édition et diagnostic Dev | `inject_css`, `remove_injected_css`, `patch_element`, `revert_patch`, `execute_js`, `read_console`, `inspect_network_requests`, `inspect_event_listeners`, `highlight_element` |
 | Shadow DOM et cadres | `get_shadow_dom`, `shadow_dom_query` sur Chrome, `get_frames`, `iframe_read`, `iframe_click`, `iframe_type` |
-| Réseau et fichiers | `fetch_url`, `research_url`, `list_downloads`, `read_downloaded_file`, `download_resource_from_page`, `download_files`, `upload_file` sur Chrome |
+| Réseau et fichiers | `fetch_url`, `research_url`, `list_downloads`, `read_downloaded_file`, `download_resource_from_page`, `download_files`, `upload_file` |
 | Travail longue durée | `schedule_resume`, `schedule_task`, `scratchpad_write`, `progress_update`, `progress_read` |
 | Sécurité/flux de travail | `verify_form`, `clarify`, `done`, `solve_captcha` |
 | Média | `download_social_media`, plus les outils de compétences dynamiques lorsqu'ils sont activés |
@@ -198,7 +198,7 @@ synthétiques avec une nouvelle capture d'écran.
 | Inspection console/réseau | Pas de lecteur de logs console dédié dans la liste des outils de base WebBrain. Des raccourcis réseau existent pour l'observation d'API, mais pas un lecteur de logs de requêtes orienté modèle. | `read_console_messages` et `read_network_requests` dédiés. |
 | Téléchargements | Plusieurs outils de téléchargement/fichier navigateur plus des outils de compétences de tâche de téléchargement dynamiques. | La permission `downloads` existe et `gif_creator` peut télécharger des exports, mais aucun gestionnaire de téléchargement général équivalent n'a été trouvé. |
 | Téléchargement média | Compétence `download_public_media` d'abord ; `download_social_media` en repli navigateur. | Aucun équivalent de téléchargement de média public trouvé. |
-| Téléchargement de fichier | Chrome dispose de `upload_file` par flux orienté downloadId/chemin ; Firefox ne l'a pas. | `file_upload` définit directement des chemins absolus locaux sur une entrée fichier ; `upload_image` télécharge des images capturées/utilisateur par référence ou coordonnée. |
+| Téléchargement de fichier | Les deux navigateurs ont `upload_file`. Chrome accepte `downloadId` et un `filePath` absolu ; Firefox accepte le re-fetch par `downloadId` et un sélecteur de fichier dans le panneau latéral (pas de chemins locaux arbitraires sans CDP). | `file_upload` définit directement des chemins absolus locaux sur une entrée fichier ; `upload_image` télécharge des images capturées/utilisateur par référence ou coordonnée. |
 | Planificateur | `schedule_resume` et `schedule_task`. | L'interface utilisateur/les chaînes d'invite de tâches planifiées existent, mais aucun schéma de planificateur appelable par le modèle équivalent n'a été trouvé dans la liste d'outils visible. |
 | CAPTCHA | `solve_captcha` lorsque CapSolver est configuré. | L'invite de sécurité explicite demande de respecter les CAPTCHA et de ne jamais les contourner ; aucun outil de résolution trouvé. |
 | Mémoire persistante de l'agent | `scratchpad_write`, `progress_update`, `progress_read`. | La compaction de conversation existe ; aucun outil équivalent de bloc-notes/progression trouvé. |