[danew]

Summary

• Pin the native browser engine to the reviewed click-actionability candidate: fix(native): validate click actionability before dispatch agent-browser#1.
• Targets are scrolled and checked before pointer dispatch, with existing frame coordinates preserved and useful validation failures.
• Keep the existing clicked response contract; navigation and task completion remain explicit observations rather than universal click requirements.

Validation

• Dependency-pin files exactly match the combined candidate used for testing.
• Consumer CLI library: 359 passed; 8 existing ignored. Lifecycle/auth integrations: 25 passed.
• Actual Chromium regressions cover visible/off-screen original-reference activation, covered/disabled targets, DOM-only buttons, new tabs, frames and asymmetric padding.
• One live candidate scenario passed without caller scrolling, direct-href navigation or JavaScript-click workarounds; destination and exact owned-session release were checked independently.
• Native-client compatibility used scripted local providers and is separate from live model/autonomy coverage.

Stack and release gate

• Stacked on fix(browser): isolate daemon from shell process group #122 and therefore feat(auth): support first-party device login #120. The review diff contains only the dependency pin, not unrelated discovery work.
• Draft only. Do not merge or release until auth is in production, the dependency change is reviewed, and the release owner approves.
• Retarget the stack after its dependencies merge; no production release or public-installer acceptance is claimed.

[junhsss]

closing this since agent-browser is no longer part of the cli