diff --git a/apps/desktop/scripts/browser-runtime.e2e.mjs b/apps/desktop/scripts/browser-runtime.e2e.mjs
index bca384af..8707b00e 100644
--- a/apps/desktop/scripts/browser-runtime.e2e.mjs
+++ b/apps/desktop/scripts/browser-runtime.e2e.mjs
@@ -122,7 +122,19 @@ const server = createServer((request, response) => {
     <a id="download" href="/download" download="fixture.txt">Download</a>
     <output id="result"></output>
     <iframe id="cross-origin-frame" src="\${frameOrigin}/"></iframe>
+    <form id="search-form" style="display:none;position:fixed;right:8px;bottom:8px;width:260px;height:70px">
+      <div style="position:relative;width:260px;height:40px">
+        <input id="kw" name="wd" title="搜索" placeholder="请输入搜索内容" style="box-sizing:border-box;width:260px;height:40px">
+        <label for="kw" style="position:absolute;inset:0;color:transparent">搜索</label>
+      </div>
+      <button id="su" type="submit">百度一下</button>
+    </form>
+    <output id="search-result"></output>
     <script>
+      document.querySelector('#search-form').addEventListener('submit', event => {
+        event.preventDefault();
+        document.querySelector('#search-result').textContent = document.querySelector('#kw').value;
+      });
       document.modelContext = {
         getTools: () => [{
           name: 'set_result',
@@ -265,7 +277,8 @@ app.whenReady().then(async () => {
     const navigatedUrl = await call('url', { tabId: 'fixture-tab' })
     check(navigatedUrl.startsWith(origin), 'fixture navigation failed: ' + JSON.stringify(navigatedUrl))
     setStage('popup-policy')
-    await call('click', { tabId: 'fixture-tab', locator: { version: 1, steps: [{ kind: 'css', selector: '#open-popup' }] } })
+    const popupAction = await call('click', { tabId: 'fixture-tab', locator: { version: 1, steps: [{ kind: 'css', selector: '#open-popup' }] } })
+    check(popupAction.effect?.kind === 'new_tab_requested', 'Agent action did not report its popup effect')
     await waitUntil(() => events.some(event => event.method === 'browser:popup-request' && event.params?.tabId === 'fixture-tab'))
     check(BrowserWindow.getAllWindows().length === 1, 'Agent-triggered popup bypassed confirmation')
     const popupCreated = new Promise(resolvePopup => view.once('did-create-window', resolvePopup))
@@ -276,6 +289,13 @@ app.whenReady().then(async () => {
     await popupWindow.webContents.executeJavaScript(\`new Promise(resolve => document.readyState === 'complete' ? resolve() : addEventListener('load', resolve, { once: true }))\`)
     check(await popupWindow.webContents.executeJavaScript(\`document.querySelector('#opener').textContent\`) === 'present', 'user popup lost its opener relationship')
     popupWindow.close()
+    const takenOver = await userCall('get', { tabId: 'fixture-tab' })
+    check(takenOver.agentControlState === 'paused_by_user', 'real user input did not pause Agent browser control')
+    await checkRejects(() => call('url', { tabId: 'fixture-tab' }), 'user_takeover_required', 'Agent kept controlling a user-taken-over tab')
+    await checkRejects(() => call('ensure', { tabId: 'takeover-side-tab' }), 'user_takeover_required', 'Agent opened a side tab to bypass a user takeover')
+    await checkRejects(() => call('close', { tabId: 'fixture-tab' }), 'user_takeover_required', 'Agent closed a tab the user had taken over')
+    const resumedControl = await userCall('agentControl:resume', { tabId: 'fixture-tab' })
+    check(resumedControl.agentControlState === 'active' && resumedControl.generation > takenOver.generation, 'explicit user resume did not invalidate old Agent page state')
     if (process.env.LUME_BROWSER_POPUP_ONLY === '1') {
       writeFileSync(resultPath, JSON.stringify({ ok: true, assertions }))
       return
@@ -309,6 +329,18 @@ app.whenReady().then(async () => {
     const geolocationPermission = await view.executeJavaScript("new Promise(resolve => navigator.geolocation.getCurrentPosition(() => resolve('allowed'), error => resolve(error.code === 1 ? 'denied' : 'other'), { timeout: 1000 }))")
     check(geolocationPermission === 'denied', 'agent browser session did not deny site permissions')
     const locator = selector => ({ version: 1, steps: [{ kind: 'css', selector }] })
+    await view.executeJavaScript("document.querySelector('#search-form').style.display = 'block'")
+    const searchByRole = { version: 1, steps: [{ kind: 'role', role: 'textbox', name: '搜索', exact: true }] }
+    await call('fill', { tabId: 'fixture-tab', locator: searchByRole, text: 'agent loop' })
+    check(await call('locator:inputValue', { tabId: 'fixture-tab', locator: locator('#kw') }) === 'agent loop', 'role textbox fill did not resolve the associated search label')
+    await call('press', { tabId: 'fixture-tab', locator: searchByRole, key: 'Enter' })
+    check(await call('locator:innerText', { tabId: 'fixture-tab', locator: locator('#search-result') }) === 'agent loop', 'search textbox Enter did not submit the form')
+    check(view.getURL() === origin + '/', 'search textbox Enter unexpectedly navigated: ' + view.getURL())
+    await call('fill', { tabId: 'fixture-tab', locator: locator('#kw'), text: 'Lume browser' })
+    await call('click', { tabId: 'fixture-tab', locator: locator('#su') })
+    check(await call('locator:innerText', { tabId: 'fixture-tab', locator: locator('#search-result') }) === 'Lume browser', 'CSS search textbox fill did not submit the expected value')
+    check(view.getURL() === origin + '/', 'search button unexpectedly navigated: ' + view.getURL())
+    await view.executeJavaScript("document.querySelector('#search-form').style.display = 'none'")
     await call('fill', { tabId: 'fixture-tab', locator: locator('#name'), text: 'Lume Agent' })
     const inputValue = await view.executeJavaScript("document.querySelector('#name').value")
     check(inputValue === 'Lume Agent', 'locator fill did not update the input: ' + JSON.stringify(inputValue))
@@ -317,7 +349,7 @@ app.whenReady().then(async () => {
     check(await call('locator:evaluate', { tabId: 'fixture-tab', locator: locator('#name'), expression: '(element, suffix) => element.value + suffix', arg: '!' }) === 'Lume Agent!', 'locator evaluate did not receive the strict element')
     await checkRejects(() => call('locator:evaluate', { tabId: 'fixture-tab', locator: locator('#name'), expression: '(element) => { element.value = \"mutated\"; return element.value }' }), 'action_denied', 'locator evaluate allowed a side effect')
     check(await call('locator:inputValue', { tabId: 'fixture-tab', locator: locator('#name') }) === 'Lume Agent', 'rejected locator evaluate changed the page')
-    check(await call('locator:count', { tabId: 'fixture-tab', locator: locator('button') }) === 3, 'locator count was incorrect')
+    check(await call('locator:count', { tabId: 'fixture-tab', locator: locator('button') }) === 4, 'locator count was incorrect')
     await call('locator:waitFor', { tabId: 'fixture-tab', locator: locator('#submit'), state: 'visible', timeoutMs: 1000 })
     await call('wait:url', { tabId: 'fixture-tab', url: origin + '/*', timeoutMs: 1000 })
     await call('click', { tabId: 'fixture-tab', locator: locator('#submit') })
@@ -365,6 +397,12 @@ app.whenReady().then(async () => {
       staleTargetObserved = actionResult.status === 'rejected'
     }
     check(staleTargetObserved, 'navigation race allowed an action against a stale target')
+    await view.loadURL(origin + '/')
+    const queuedNavigation = call('navigate', { tabId: 'fixture-tab', url: origin + '/queued-navigation' })
+    const queuedOldPageAction = call('fill', { tabId: 'fixture-tab', locator: locator('#name'), text: 'must-not-run' })
+    const [queuedNavigationResult, queuedActionResult] = await Promise.allSettled([queuedNavigation, queuedOldPageAction])
+    check(queuedNavigationResult.status === 'fulfilled', 'queued navigation did not complete')
+    check(queuedActionResult.status === 'rejected' && String(queuedActionResult.reason?.code ?? queuedActionResult.reason?.message).includes('stale_target'), 'an old-page action ran after queued navigation')
     const beforeCrash = await call('get', { tabId: 'fixture-tab' })
     setStage('crash-recovery')
     view.forcefullyCrashRenderer()
diff --git a/apps/desktop/src/browser-action-effect.test.ts b/apps/desktop/src/browser-action-effect.test.ts
new file mode 100644
index 00000000..748ddd12
--- /dev/null
+++ b/apps/desktop/src/browser-action-effect.test.ts
@@ -0,0 +1,31 @@
+import { describe, expect, test } from "bun:test"
+import { detectBrowserActionEffect, type BrowserActionEffectSnapshot } from "./browser-action-effect"
+
+describe("detectBrowserActionEffect", () => {
+  test("prioritizes blocking and navigation effects over DOM noise", () => {
+    const before = snapshot()
+    expect(detectBrowserActionEffect(before, { ...before, dialogId: "dialog-1", domRevision: 2 })).toEqual({ kind: "dialog_opened" })
+    expect(detectBrowserActionEffect(before, { ...before, generation: 2, url: "https://example.test/next", domRevision: 2 })).toEqual({ kind: "navigation", url: "https://example.test/next" })
+  })
+
+  test("reports new tabs, downloads, popup requests and DOM changes", () => {
+    const before = snapshot()
+    expect(detectBrowserActionEffect(before, { ...before, tabIds: ["tab-1", "tab-2"] })).toEqual({ kind: "new_tab_opened", new_tab_ids: ["tab-2"] })
+    expect(detectBrowserActionEffect(before, { ...before, popupCount: 1 })).toEqual({ kind: "new_tab_requested" })
+    expect(detectBrowserActionEffect(before, { ...before, downloadIds: ["download-1"] })).toEqual({ kind: "download_started" })
+    expect(detectBrowserActionEffect(before, { ...before, domRevision: 2 })).toEqual({ kind: "dom_changed" })
+    expect(detectBrowserActionEffect(before, before)).toBeUndefined()
+  })
+})
+
+function snapshot(): BrowserActionEffectSnapshot {
+  return {
+    domRevision: 1,
+    downloadIds: [],
+    generation: 1,
+    lifecycle: "active",
+    popupCount: 0,
+    tabIds: ["tab-1"],
+    url: "https://example.test/",
+  }
+}
diff --git a/apps/desktop/src/browser-action-effect.ts b/apps/desktop/src/browser-action-effect.ts
new file mode 100644
index 00000000..d5aa3971
--- /dev/null
+++ b/apps/desktop/src/browser-action-effect.ts
@@ -0,0 +1,38 @@
+export type BrowserActionEffectKind =
+  | "crashed"
+  | "dialog_opened"
+  | "new_tab_opened"
+  | "new_tab_requested"
+  | "download_started"
+  | "navigation"
+  | "dom_changed"
+  | "no_detectable_change"
+
+export interface BrowserActionEffectSnapshot {
+  dialogId?: string
+  domRevision: number
+  downloadIds: string[]
+  generation: number
+  lifecycle?: string
+  popupCount: number
+  tabIds: string[]
+  url: string
+}
+
+export interface BrowserActionEffect {
+  kind: BrowserActionEffectKind
+  new_tab_ids?: string[]
+  url?: string
+}
+
+export function detectBrowserActionEffect(before: BrowserActionEffectSnapshot, after: BrowserActionEffectSnapshot): BrowserActionEffect | undefined {
+  if (after.lifecycle === "crashed" && before.lifecycle !== "crashed") return { kind: "crashed" }
+  if (after.dialogId && after.dialogId !== before.dialogId) return { kind: "dialog_opened" }
+  const newTabIds = after.tabIds.filter((tabId) => !before.tabIds.includes(tabId))
+  if (newTabIds.length) return { kind: "new_tab_opened", new_tab_ids: newTabIds }
+  if (after.popupCount > before.popupCount) return { kind: "new_tab_requested" }
+  if (after.downloadIds.some((downloadId) => !before.downloadIds.includes(downloadId))) return { kind: "download_started" }
+  if (after.generation !== before.generation || after.url !== before.url) return { kind: "navigation", url: after.url }
+  if (after.domRevision > before.domRevision) return { kind: "dom_changed" }
+  return undefined
+}
diff --git a/apps/desktop/src/browser-action-queue.test.ts b/apps/desktop/src/browser-action-queue.test.ts
new file mode 100644
index 00000000..2d0ae457
--- /dev/null
+++ b/apps/desktop/src/browser-action-queue.test.ts
@@ -0,0 +1,53 @@
+import { describe, expect, test } from "bun:test"
+import { BrowserActionQueue } from "./browser-action-queue"
+
+describe("BrowserActionQueue", () => {
+  test("serializes mutations that share a Browser session", async () => {
+    const queue = new BrowserActionQueue()
+    const order: string[] = []
+    let releaseFirst!: () => void
+    const firstGate = new Promise<void>((resolve) => { releaseFirst = resolve })
+
+    const first = queue.run("session-1", async () => {
+      order.push("first:start")
+      await firstGate
+      order.push("first:end")
+      return 1
+    })
+    const second = queue.run("session-1", async () => {
+      order.push("second")
+      return 2
+    })
+
+    await Promise.resolve()
+    expect(order).toEqual(["first:start"])
+    releaseFirst()
+    await expect(Promise.all([first, second])).resolves.toEqual([1, 2])
+    expect(order).toEqual(["first:start", "first:end", "second"])
+  })
+
+  test("continues the queue after an action fails", async () => {
+    const queue = new BrowserActionQueue()
+    const first = queue.run("session-1", async () => { throw new Error("failed") })
+    const second = queue.run("session-1", async () => "recovered")
+
+    await expect(first).rejects.toThrow("failed")
+    await expect(second).resolves.toBe("recovered")
+  })
+
+  test("cancels queued actions without replaying them after user takeover", async () => {
+    const queue = new BrowserActionQueue()
+    let releaseFirst!: () => void
+    const firstGate = new Promise<void>((resolve) => { releaseFirst = resolve })
+    const first = queue.run("session-1", () => firstGate)
+    const second = queue.run("session-1", async () => "must-not-run")
+
+    await Promise.resolve()
+    queue.cancel("session-1")
+    const cancelled = second.then(() => undefined, (error: Error) => error)
+    releaseFirst()
+
+    await expect(first).resolves.toBeUndefined()
+    expect((await cancelled)?.message).toBe("user_takeover_required")
+  })
+})
diff --git a/apps/desktop/src/browser-action-queue.ts b/apps/desktop/src/browser-action-queue.ts
new file mode 100644
index 00000000..e82b8bfc
--- /dev/null
+++ b/apps/desktop/src/browser-action-queue.ts
@@ -0,0 +1,24 @@
+export class BrowserActionQueue {
+  private readonly epochs = new Map<string, number>()
+  private readonly tails = new Map<string, Promise<void>>()
+
+  async run<T>(key: string, action: () => Promise<T>): Promise<T> {
+    const epoch = this.epochs.get(key) ?? 0
+    const previous = this.tails.get(key) ?? Promise.resolve()
+    const execution = previous.then(() => {
+      if ((this.epochs.get(key) ?? 0) !== epoch) throw Object.assign(new Error("user_takeover_required"), { code: "user_takeover_required" })
+      return action()
+    })
+    const tail = execution.then(() => undefined, () => undefined)
+    this.tails.set(key, tail)
+    try {
+      return await execution
+    } finally {
+      if (this.tails.get(key) === tail) this.tails.delete(key)
+    }
+  }
+
+  cancel(key: string): void {
+    this.epochs.set(key, (this.epochs.get(key) ?? 0) + 1)
+  }
+}
diff --git a/apps/desktop/src/browser-cdp-input.test.ts b/apps/desktop/src/browser-cdp-input.test.ts
new file mode 100644
index 00000000..d18cc443
--- /dev/null
+++ b/apps/desktop/src/browser-cdp-input.test.ts
@@ -0,0 +1,113 @@
+import { describe, expect, test } from "bun:test"
+import {
+  dispatchBrowserClick,
+  dispatchBrowserKey,
+  dispatchBrowserText,
+  focusBrowserPoint,
+  type BrowserCdpCommandSender,
+} from "./browser-cdp-input"
+
+describe("browser CDP input", () => {
+  test("dispatches a complete real mouse click sequence", async () => {
+    const sender = recorder()
+
+    await dispatchBrowserClick(sender, { x: 12, y: 34 })
+
+    expect(sender.calls.map((call) => [call.method, call.params.type, call.params.clickCount])).toEqual([
+      ["Input.dispatchMouseEvent", "mouseMoved", undefined],
+      ["Input.dispatchMouseEvent", "mousePressed", 1],
+      ["Input.dispatchMouseEvent", "mouseReleased", 1],
+    ])
+  })
+
+  test("replaces text with select-all, backspace and insertText", async () => {
+    const sender = recorder()
+
+    await dispatchBrowserText(sender, "Lume", { platform: "win32", replace: true })
+
+    expect(sender.calls.filter((call) => call.method === "Input.dispatchKeyEvent").map((call) => [call.params.type, call.params.key])).toEqual([
+      ["rawKeyDown", "Control"],
+      ["rawKeyDown", "a"],
+      ["keyUp", "a"],
+      ["keyUp", "Control"],
+      ["rawKeyDown", "Backspace"],
+      ["keyUp", "Backspace"],
+    ])
+    expect(sender.calls.at(-1)).toEqual({ method: "Input.insertText", params: { text: "Lume" } })
+  })
+
+  test("dispatches modifier key lifecycles around the main key", async () => {
+    const sender = recorder()
+
+    await dispatchBrowserKey(sender, "Control+Shift+P")
+
+    expect(sender.calls.map((call) => [call.params.type, call.params.key, call.params.modifiers])).toEqual([
+      ["rawKeyDown", "Control", 2],
+      ["rawKeyDown", "Shift", 10],
+      ["rawKeyDown", "P", 10],
+      ["keyUp", "P", 10],
+      ["keyUp", "Shift", 2],
+      ["keyUp", "Control", 0],
+    ])
+  })
+
+  test("dispatches Enter as a native text-producing key event", async () => {
+    const sender = recorder()
+
+    await dispatchBrowserKey(sender, "Enter")
+
+    expect(sender.calls.map((call) => [call.params.type, call.params.key, call.params.text])).toEqual([
+      ["keyDown", "Enter", "\r"],
+      ["keyUp", "Enter", undefined],
+    ])
+  })
+
+  test("focuses the deepest DOM node at a page coordinate", async () => {
+    const sender = recorder({ backendNodeId: 42 })
+
+    await focusBrowserPoint(sender, { x: 10.2, y: 20.7 })
+
+    expect(sender.calls.map((call) => call.method)).toEqual([
+      "DOM.enable",
+      "DOM.getNodeForLocation",
+      "DOM.focus",
+      "DOM.resolveNode",
+      "Runtime.callFunctionOn",
+      "Runtime.releaseObject",
+    ])
+    expect(sender.calls[1]?.params).toEqual({ x: 10, y: 21, includeUserAgentShadowDOM: false })
+    expect(sender.calls[2]?.params).toEqual({ backendNodeId: 42 })
+    expect(sender.calls[5]?.params).toEqual({ objectId: "object-1" })
+  })
+
+  test("focuses the associated control when the physical hit node is a label", async () => {
+    const sender = recorder({ backendNodeId: 42 }, true)
+
+    await focusBrowserPoint(sender, { x: 10, y: 20 })
+
+    expect(sender.calls.map((call) => call.method)).toEqual([
+      "DOM.enable",
+      "DOM.getNodeForLocation",
+      "DOM.focus",
+      "DOM.resolveNode",
+      "Runtime.callFunctionOn",
+      "Runtime.releaseObject",
+    ])
+    expect(sender.calls.find((call) => call.method === "Runtime.callFunctionOn")?.params.functionDeclaration).toContain("label?.control")
+  })
+})
+
+function recorder(result: unknown = {}, failFocus = false): BrowserCdpCommandSender & { calls: Array<{ method: string; params: Record<string, unknown> }> } {
+  const calls: Array<{ method: string; params: Record<string, unknown> }> = []
+  return {
+    calls,
+    async sendCommand(method, params = {}) {
+      calls.push({ method, params })
+      if (method === "DOM.getNodeForLocation") return result
+      if (method === "DOM.focus" && failFocus) throw new Error("Element is not focusable")
+      if (method === "DOM.resolveNode") return { object: { objectId: "object-1" } }
+      if (method === "Runtime.callFunctionOn") return { result: { value: true } }
+      return {}
+    },
+  }
+}
diff --git a/apps/desktop/src/browser-cdp-input.ts b/apps/desktop/src/browser-cdp-input.ts
new file mode 100644
index 00000000..1bd413b4
--- /dev/null
+++ b/apps/desktop/src/browser-cdp-input.ts
@@ -0,0 +1,183 @@
+export interface BrowserCdpCommandSender {
+  sendCommand(method: string, params?: Record<string, unknown>): Promise<unknown>
+}
+
+export interface BrowserCdpPoint {
+  x: number
+  y: number
+}
+
+type KeyDefinition = {
+  code: string
+  key: string
+  text?: string
+  virtualKeyCode: number
+}
+
+const MODIFIERS = {
+  Alt: { bit: 1, code: "AltLeft", virtualKeyCode: 18 },
+  Control: { bit: 2, code: "ControlLeft", virtualKeyCode: 17 },
+  Meta: { bit: 4, code: "MetaLeft", virtualKeyCode: 91 },
+  Shift: { bit: 8, code: "ShiftLeft", virtualKeyCode: 16 },
+} as const
+
+type ModifierName = keyof typeof MODIFIERS
+
+export async function dispatchBrowserClick(
+  sender: BrowserCdpCommandSender,
+  point: BrowserCdpPoint,
+  clickCount = 1,
+): Promise<void> {
+  await sender.sendCommand("Input.dispatchMouseEvent", { type: "mouseMoved", x: point.x, y: point.y })
+  for (let count = 1; count <= clickCount; count += 1) {
+    await sender.sendCommand("Input.dispatchMouseEvent", {
+      type: "mousePressed",
+      x: point.x,
+      y: point.y,
+      button: "left",
+      buttons: 1,
+      clickCount: count,
+    })
+    await sender.sendCommand("Input.dispatchMouseEvent", {
+      type: "mouseReleased",
+      x: point.x,
+      y: point.y,
+      button: "left",
+      buttons: 0,
+      clickCount: count,
+    })
+  }
+}
+
+export async function focusBrowserPoint(sender: BrowserCdpCommandSender, point: BrowserCdpPoint): Promise<void> {
+  await sender.sendCommand("DOM.enable")
+  const located = await sender.sendCommand("DOM.getNodeForLocation", {
+    x: Math.round(point.x),
+    y: Math.round(point.y),
+    // UA shadow descendants cannot become document.activeElement; focus and
+    // verify the owning form control instead of its internal presentation node.
+    includeUserAgentShadowDOM: false,
+  }) as { backendNodeId?: unknown }
+  if (!Number.isInteger(located.backendNodeId)) throw Object.assign(new Error("stale_target"), { code: "stale_target" })
+  await sender.sendCommand("DOM.focus", { backendNodeId: located.backendNodeId }).catch(() => undefined)
+  // DOM.focus may succeed without changing focus for labels and nested presentation nodes.
+  // Resolve the exact hit node to verify focus and redirect associated labels to their control.
+  const resolved = await sender.sendCommand("DOM.resolveNode", { backendNodeId: located.backendNodeId }) as { object?: { objectId?: unknown } }
+  const objectId = typeof resolved.object?.objectId === "string" ? resolved.object.objectId : ""
+  if (!objectId) throw Object.assign(new Error("stale_target"), { code: "stale_target" })
+  try {
+    const focused = await sender.sendCommand("Runtime.callFunctionOn", {
+      objectId,
+      functionDeclaration: `function() {
+        const element = this.nodeType === 1 ? this : this.parentElement;
+        if (!element) return false;
+        const label = element.closest?.("label");
+        const target = label?.control || element.closest?.("input,textarea,select,button,a[href],[tabindex],[contenteditable=true]") || element;
+        if (typeof target.focus !== "function") return false;
+        target.focus({ preventScroll: true });
+        const active = target.ownerDocument?.activeElement;
+        return active === target || Boolean(active && target.contains?.(active));
+      }`,
+      returnByValue: true,
+    }) as { result?: { value?: unknown } }
+    if (focused.result?.value !== true) throw Object.assign(new Error("stale_target"), { code: "stale_target" })
+  } finally {
+    await sender.sendCommand("Runtime.releaseObject", { objectId }).catch(() => undefined)
+  }
+}
+
+export async function dispatchBrowserText(
+  sender: BrowserCdpCommandSender,
+  text: string,
+  options: { platform: NodeJS.Platform; replace: boolean },
+): Promise<void> {
+  if (options.replace) {
+    await dispatchBrowserKey(sender, `${options.platform === "darwin" ? "Meta" : "Control"}+A`)
+    await dispatchBrowserKey(sender, "Backspace")
+  }
+  if (text) await sender.sendCommand("Input.insertText", { text })
+}
+
+export async function dispatchBrowserKey(sender: BrowserCdpCommandSender, keySpec: string): Promise<void> {
+  const parsed = parseKeySpec(keySpec)
+  let activeModifiers = 0
+  for (const modifier of parsed.modifiers) {
+    const definition = MODIFIERS[modifier]
+    activeModifiers |= definition.bit
+    await sender.sendCommand("Input.dispatchKeyEvent", {
+      type: "rawKeyDown",
+      key: modifier,
+      code: definition.code,
+      modifiers: activeModifiers,
+      windowsVirtualKeyCode: definition.virtualKeyCode,
+    })
+  }
+
+  const text = parsed.key.text && (activeModifiers & 7) === 0 ? parsed.key.text : undefined
+  await sender.sendCommand("Input.dispatchKeyEvent", {
+    type: text ? "keyDown" : "rawKeyDown",
+    key: parsed.key.key,
+    code: parsed.key.code,
+    ...(text ? { text, unmodifiedText: text } : {}),
+    modifiers: activeModifiers,
+    windowsVirtualKeyCode: parsed.key.virtualKeyCode,
+  })
+  await sender.sendCommand("Input.dispatchKeyEvent", {
+    type: "keyUp",
+    key: parsed.key.key,
+    code: parsed.key.code,
+    modifiers: activeModifiers,
+    windowsVirtualKeyCode: parsed.key.virtualKeyCode,
+  })
+
+  for (const modifier of [...parsed.modifiers].reverse()) {
+    const definition = MODIFIERS[modifier]
+    activeModifiers &= ~definition.bit
+    await sender.sendCommand("Input.dispatchKeyEvent", {
+      type: "keyUp",
+      key: modifier,
+      code: definition.code,
+      modifiers: activeModifiers,
+      windowsVirtualKeyCode: definition.virtualKeyCode,
+    })
+  }
+}
+
+function parseKeySpec(keySpec: string): { key: KeyDefinition; modifiers: ModifierName[] } {
+  const parts = keySpec.split("+").map((part) => part.trim()).filter(Boolean)
+  const rawKey = parts.pop() || "Enter"
+  const modifiers = Array.from(new Set(parts.map(normalizeModifier).filter((value): value is ModifierName => Boolean(value))))
+  return { key: keyDefinition(rawKey, modifiers.includes("Shift")), modifiers }
+}
+
+function normalizeModifier(value: string): ModifierName | undefined {
+  if (value === "Ctrl" || value === "Control") return "Control"
+  if (value === "Cmd" || value === "Command" || value === "Meta") return "Meta"
+  if (value === "Alt" || value === "Option") return "Alt"
+  if (value === "Shift") return "Shift"
+  return undefined
+}
+
+function keyDefinition(value: string, shifted: boolean): KeyDefinition {
+  const aliases: Record<string, KeyDefinition> = {
+    Backspace: { key: "Backspace", code: "Backspace", virtualKeyCode: 8 },
+    Delete: { key: "Delete", code: "Delete", virtualKeyCode: 46 },
+    Enter: { key: "Enter", code: "Enter", text: "\r", virtualKeyCode: 13 },
+    Escape: { key: "Escape", code: "Escape", virtualKeyCode: 27 },
+    Space: { key: " ", code: "Space", text: " ", virtualKeyCode: 32 },
+    Tab: { key: "Tab", code: "Tab", virtualKeyCode: 9 },
+    ArrowDown: { key: "ArrowDown", code: "ArrowDown", virtualKeyCode: 40 },
+    ArrowLeft: { key: "ArrowLeft", code: "ArrowLeft", virtualKeyCode: 37 },
+    ArrowRight: { key: "ArrowRight", code: "ArrowRight", virtualKeyCode: 39 },
+    ArrowUp: { key: "ArrowUp", code: "ArrowUp", virtualKeyCode: 38 },
+  }
+  if (aliases[value]) return aliases[value]!
+  if (/^[a-z]$/i.test(value)) {
+    const upper = value.toUpperCase()
+    const key = shifted ? upper : value.toLowerCase()
+    return { key, code: `Key${upper}`, text: key, virtualKeyCode: upper.charCodeAt(0) }
+  }
+  if (/^[0-9]$/.test(value)) return { key: value, code: `Digit${value}`, text: value, virtualKeyCode: value.charCodeAt(0) }
+  if ([...value].length === 1) return { key: value, code: "", text: value, virtualKeyCode: value.codePointAt(0) ?? 0 }
+  return { key: value.slice(0, 64), code: value.slice(0, 64), virtualKeyCode: 0 }
+}
diff --git a/apps/desktop/src/browser-input-ledger.test.ts b/apps/desktop/src/browser-input-ledger.test.ts
new file mode 100644
index 00000000..e0fd9a7c
--- /dev/null
+++ b/apps/desktop/src/browser-input-ledger.test.ts
@@ -0,0 +1,27 @@
+import { describe, expect, test } from "bun:test"
+import { BrowserInputLedger } from "./browser-input-ledger"
+
+describe("BrowserInputLedger", () => {
+  test("matches only input events emitted by the expected CDP command", () => {
+    const ledger = new BrowserInputLedger(() => 100)
+    ledger.expectCommand("tab-1", "Input.dispatchMouseEvent", { type: "mousePressed", button: "left" })
+    ledger.expectCommand("tab-1", "Input.dispatchKeyEvent", { type: "rawKeyDown", key: "Enter" })
+
+    expect(ledger.consumeMouse("tab-1", { type: "mouseDown", button: "right" })).toBeFalse()
+    expect(ledger.consumeMouse("tab-1", { type: "mouseDown", button: "left" })).toBeTrue()
+    expect(ledger.consumeKey("tab-1", { type: "keyDown", key: "Escape" })).toBeFalse()
+    expect(ledger.consumeKey("tab-1", { type: "keyDown", key: "Enter" })).toBeTrue()
+  })
+
+  test("expires and clears unmatched expectations", () => {
+    let now = 100
+    const ledger = new BrowserInputLedger(() => now)
+    ledger.expectCommand("tab-1", "Input.dispatchMouseEvent", { type: "mouseWheel" })
+    now = 601
+
+    expect(ledger.consumeMouse("tab-1", { type: "mouseWheel" })).toBeFalse()
+    ledger.expectCommand("tab-1", "Input.insertText", { text: "hello" })
+    ledger.clear("tab-1")
+    expect(ledger.consumeKey("tab-1", { type: "char", key: "h" })).toBeFalse()
+  })
+})
diff --git a/apps/desktop/src/browser-input-ledger.ts b/apps/desktop/src/browser-input-ledger.ts
new file mode 100644
index 00000000..e3f437fe
--- /dev/null
+++ b/apps/desktop/src/browser-input-ledger.ts
@@ -0,0 +1,68 @@
+type ExpectedInput = {
+  button?: string
+  expiresAt: number
+  key?: string
+  kind: "key" | "mouse"
+  type: string
+}
+
+export class BrowserInputLedger {
+  private readonly entries = new Map<string, ExpectedInput[]>()
+
+  constructor(private readonly now: () => number = Date.now) {}
+
+  expectCommand(tabId: string, method: string, params: Record<string, unknown> = {}): void {
+    const expiresAt = this.now() + 500
+    const expected = commandInputs(method, params, expiresAt)
+    if (!expected.length) return
+    this.entries.set(tabId, [...this.current(tabId), ...expected].slice(-64))
+  }
+
+  consumeKey(tabId: string, input: { type: string; key: string }): boolean {
+    return this.consume(tabId, { kind: "key", type: input.type, key: input.key })
+  }
+
+  consumeMouse(tabId: string, input: { type: string; button?: string }): boolean {
+    return this.consume(tabId, { kind: "mouse", type: input.type, button: input.button })
+  }
+
+  clear(tabId: string): void { this.entries.delete(tabId) }
+
+  private current(tabId: string): ExpectedInput[] {
+    const now = this.now()
+    return (this.entries.get(tabId) ?? []).filter((entry) => entry.expiresAt >= now)
+  }
+
+  private consume(tabId: string, actual: Omit<ExpectedInput, "expiresAt">): boolean {
+    const current = this.current(tabId)
+    const index = current.findIndex((entry) => entry.kind === actual.kind
+      && entry.type === actual.type
+      && (entry.key === undefined || entry.key.toLowerCase() === actual.key?.toLowerCase())
+      && (entry.button === undefined || entry.button === actual.button))
+    if (index < 0) {
+      if (current.length) this.entries.set(tabId, current)
+      else this.entries.delete(tabId)
+      return false
+    }
+    current.splice(index, 1)
+    if (current.length) this.entries.set(tabId, current)
+    else this.entries.delete(tabId)
+    return true
+  }
+}
+
+function commandInputs(method: string, params: Record<string, unknown>, expiresAt: number): ExpectedInput[] {
+  if (method === "Input.dispatchMouseEvent") {
+    const type = ({ mouseMoved: "mouseMove", mousePressed: "mouseDown", mouseReleased: "mouseUp", mouseWheel: "mouseWheel" } as Record<string, string>)[String(params.type ?? "")]
+    return type ? [{ kind: "mouse", type, ...(typeof params.button === "string" ? { button: params.button } : {}), expiresAt }] : []
+  }
+  if (method === "Input.dispatchKeyEvent") {
+    const rawType = String(params.type ?? "")
+    const type = rawType === "rawKeyDown" || rawType === "keyDown" ? "keyDown" : rawType === "keyUp" ? "keyUp" : rawType === "char" ? "char" : ""
+    if (!type) return []
+    const entry = { kind: "key" as const, type, key: String(params.key ?? ""), expiresAt }
+    return rawType === "keyDown" && typeof params.text === "string" ? [entry, { kind: "key", type: "char", expiresAt }] : [entry]
+  }
+  if (method === "Input.insertText") return [{ kind: "key", type: "char", expiresAt }]
+  return []
+}
diff --git a/apps/desktop/src/browser-locator.test.ts b/apps/desktop/src/browser-locator.test.ts
new file mode 100644
index 00000000..5d1aa808
--- /dev/null
+++ b/apps/desktop/src/browser-locator.test.ts
@@ -0,0 +1,63 @@
+import { describe, expect, test } from "bun:test"
+import { Window } from "happy-dom"
+import { browserLocatorScript, type BrowserLocatorQuery } from "./browser-locator"
+import type { BrowserLocator } from "../../../packages/shared/src/types/browser-runtime"
+
+describe("browser locator semantics", () => {
+  test("resolves textbox names from aria-labelledby, label, title and placeholder", () => {
+    const window = new Window()
+    window.document.body.innerHTML = `
+      <span id="aria-name">ARIA search</span><input id="by-aria" aria-labelledby="aria-name">
+      <label for="by-label">Label search</label><input id="by-label">
+      <input id="by-title" title="Title search">
+      <input id="by-placeholder" placeholder="Placeholder search">
+    `
+    const query = browserQuery(window)
+
+    for (const expected of ["ARIA search", "Label search", "Title search", "Placeholder search"]) {
+      expect(query(roleTextbox(expected), "count")).toBe(1)
+    }
+  })
+
+  test("accepts an associated label covering the input hit point", () => {
+    const window = new Window()
+    window.document.body.innerHTML = '<label for="kw">搜索</label><input id="kw" title="搜索">'
+    const input = window.document.querySelector("#kw") as unknown as HTMLInputElement
+    const label = window.document.querySelector("label") as unknown as HTMLLabelElement
+    input.getBoundingClientRect = () => rect(10, 20, 200, 40)
+    Object.defineProperty(window.document, "elementFromPoint", { value: () => label })
+
+    const target = browserQuery(window)(roleTextbox("搜索"), "target") as { x: number; y: number; editable: boolean }
+
+    expect(target).toMatchObject({ x: 110, y: 40, editable: true })
+  })
+
+  test("maps submit inputs to the button role and value name", () => {
+    const window = new Window()
+    window.document.body.innerHTML = '<input type="submit" value="百度一下">'
+
+    expect(browserQuery(window)({ version: 1, steps: [{ kind: "role", role: "button", name: "百度一下", exact: true }] }, "count")).toBe(1)
+  })
+})
+
+function browserQuery(window: Window): (locator: BrowserLocator, operation?: BrowserLocatorQuery, argument?: string) => unknown {
+  const names = [
+    "document", "innerHeight", "innerWidth", "getComputedStyle", "Element", "HTMLElement", "Document",
+    "HTMLInputElement", "HTMLTextAreaElement", "HTMLSelectElement", "HTMLLabelElement", "HTMLButtonElement",
+    "HTMLAnchorElement", "InputEvent", "Event", "MouseEvent", "KeyboardEvent",
+  ]
+  const values = [
+    window.document, window.innerHeight, window.innerWidth, window.getComputedStyle.bind(window), window.Element, window.HTMLElement, window.Document,
+    window.HTMLInputElement, window.HTMLTextAreaElement, window.HTMLSelectElement, window.HTMLLabelElement, window.HTMLButtonElement,
+    window.HTMLAnchorElement, window.InputEvent, window.Event, window.MouseEvent, window.KeyboardEvent,
+  ]
+  return Function(...names, `return ${browserLocatorScript()}`)(...values) as (locator: BrowserLocator, operation?: BrowserLocatorQuery, argument?: string) => unknown
+}
+
+function roleTextbox(name: string): BrowserLocator {
+  return { version: 1, steps: [{ kind: "role", role: "textbox", name, exact: true }] }
+}
+
+function rect(x: number, y: number, width: number, height: number): DOMRect {
+  return { x, y, width, height, top: y, right: x + width, bottom: y + height, left: x, toJSON: () => ({}) } as DOMRect
+}
diff --git a/apps/desktop/src/browser-locator.ts b/apps/desktop/src/browser-locator.ts
index f55b7384..c8bd62b8 100644
--- a/apps/desktop/src/browser-locator.ts
+++ b/apps/desktop/src/browser-locator.ts
@@ -1,8 +1,7 @@
 import type { BrowserLocator, BrowserLocatorStep, BrowserTextMatcher } from "../../../packages/shared/src/types/browser-runtime"
 
 export type ResolvedBrowserTarget = { x: number; y: number; width: number; height: number; tagName: string; role?: string; editable: boolean; enabled: boolean }
-export type BrowserLocatorQuery = "target" | "element" | "evaluate" | "count" | "allTextContents" | "readAll" | "getAttribute" | "innerText" | "textContent" | "inputValue" | "isVisible" | "isEnabled" | "isChecked"
-  | "click" | "doubleClick" | "fill" | "type" | "press" | "select" | "check" | "uncheck" | "scroll"
+export type BrowserLocatorQuery = "target" | "element" | "focus" | "evaluate" | "count" | "allTextContents" | "readAll" | "getAttribute" | "innerText" | "textContent" | "inputValue" | "editableValue" | "isVisible" | "isEnabled" | "isChecked" | "select"
 
 export function isBrowserLocator(value: unknown): value is BrowserLocator {
   return Boolean(value) && typeof value === "object" && Array.isArray((value as { steps?: unknown }).steps)
@@ -48,8 +47,32 @@ function queryLocatorInPage(locator: BrowserLocator, operation: BrowserLocatorQu
     if (item.mode === "regex") { try { return new RegExp(item.value).test(value) } catch { return false } }
     return item.mode === "exact" ? value === item.value : value.includes(item.value)
   }
-  const role = (element: Element) => element.getAttribute("role") || ({ A: "link", BUTTON: "button", INPUT: (element as HTMLInputElement).type === "checkbox" ? "checkbox" : "textbox", TEXTAREA: "textbox", SELECT: "combobox" } as Record<string, string>)[element.tagName] || "generic"
-  const name = (element: Element) => element.getAttribute("aria-label") || (element as HTMLElement).innerText || element.textContent || ""
+  const role = (element: Element) => {
+    const explicit = element.getAttribute("role")
+    if (explicit) return explicit
+    if (element instanceof HTMLInputElement) {
+      if (["button", "submit", "reset", "image"].includes(element.type)) return "button"
+      if (element.type === "checkbox") return "checkbox"
+      if (element.type === "radio") return "radio"
+      return "textbox"
+    }
+    return ({ A: "link", BUTTON: "button", TEXTAREA: "textbox", SELECT: "combobox" } as Record<string, string>)[element.tagName] || "generic"
+  }
+  const normalizedText = (value: string | null | undefined) => (value || "").replace(/\s+/g, " ").trim()
+  const name = (element: Element) => {
+    const labelledBy = normalizedText((element.getAttribute("aria-labelledby") || "").split(/\s+/).filter(Boolean)
+      .map(id => element.ownerDocument.getElementById(id)?.textContent || "").join(" "))
+    if (labelledBy) return labelledBy
+    const ariaLabel = normalizedText(element.getAttribute("aria-label"))
+    if (ariaLabel) return ariaLabel
+    const labels = "labels" in element && element.labels ? Array.from(element.labels as NodeListOf<HTMLLabelElement>) : []
+    const label = normalizedText(labels.map(item => (item as HTMLElement).innerText || item.textContent || "").join(" "))
+    if (label) return label
+    if (element instanceof HTMLInputElement && ["button", "submit", "reset"].includes(element.type) && element.value) return normalizedText(element.value)
+    const content = normalizedText((element as HTMLElement).innerText || element.textContent)
+    if (content) return content
+    return normalizedText(element.getAttribute("title") || element.getAttribute("placeholder") || element.getAttribute("alt"))
+  }
   const visible = (element: Element) => { const rect = (element as HTMLElement).getBoundingClientRect(); const style = getComputedStyle(element); return rect.width > 0 && rect.height > 0 && style.visibility !== "hidden" && style.display !== "none" }
   const enabled = (element: Element) => !(element as HTMLButtonElement).disabled && element.getAttribute("aria-disabled") !== "true"
   const all = (scope: Element | Document, selector = "*") => Array.from(scope.querySelectorAll(selector))
@@ -93,45 +116,16 @@ function queryLocatorInPage(locator: BrowserLocator, operation: BrowserLocatorQu
     if (!(element instanceof HTMLInputElement || element instanceof HTMLTextAreaElement || element instanceof HTMLSelectElement)) throw new Error("action_denied")
     return element.value
   }
+  if (operation === "editableValue") {
+    if (element instanceof HTMLInputElement || element instanceof HTMLTextAreaElement) return element.value
+    if ((element as HTMLElement).isContentEditable) return element.textContent || ""
+    throw new Error("action_denied")
+  }
   if (operation === "isVisible") return visible(element)
   if (operation === "isEnabled") return enabled(element)
-  if (operation === "isChecked") return (element instanceof HTMLInputElement && ["checkbox", "radio"].includes(element.type)) ? element.checked : false
-  if (operation === "click" || operation === "doubleClick") {
-    if (!(element instanceof HTMLElement)) throw new Error("action_denied")
-    element.click()
-    if (operation === "doubleClick") {
-      element.click()
-      element.dispatchEvent(new MouseEvent("dblclick", { bubbles: true, cancelable: true, detail: 2 }))
-    }
-    return true
-  }
-  if (operation === "fill" || operation === "type") {
-    const text = argument || ""
-    const replace = operation === "fill"
-    if (element instanceof HTMLInputElement) {
-      const setter = Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, "value")?.set
-      if (!setter) throw new Error("action_denied")
-      setter.call(element, replace ? text : element.value + text)
-    } else if (element instanceof HTMLTextAreaElement) {
-      const setter = Object.getOwnPropertyDescriptor(HTMLTextAreaElement.prototype, "value")?.set
-      if (!setter) throw new Error("action_denied")
-      setter.call(element, replace ? text : element.value + text)
-    } else if ((element as HTMLElement).isContentEditable) {
-      element.textContent = replace ? text : (element.textContent || "") + text
-    } else throw new Error("action_denied")
-    element.dispatchEvent(new InputEvent("input", { bubbles: true, inputType: replace ? "insertReplacementText" : "insertText", data: text }))
-    return true
-  }
-  if (operation === "press") {
-    if (!(element instanceof HTMLElement)) throw new Error("action_denied")
-    element.focus({ preventScroll: true })
-    const parts = (argument || "Enter").split("+")
-    const key = parts.pop() || "Enter"
-    const options = { key, bubbles: true, cancelable: true, ctrlKey: parts.includes("Control") || parts.includes("Ctrl"), metaKey: parts.includes("Meta"), altKey: parts.includes("Alt"), shiftKey: parts.includes("Shift") }
-    const proceed = element.dispatchEvent(new KeyboardEvent("keydown", options))
-    if (proceed && (key === "Enter" || key === " ") && (element instanceof HTMLButtonElement || element instanceof HTMLAnchorElement || (element instanceof HTMLInputElement && ["button", "submit", "reset", "checkbox", "radio"].includes(element.type)))) element.click()
-    element.dispatchEvent(new KeyboardEvent("keyup", options))
-    return true
+  if (operation === "isChecked") {
+    if (!(element instanceof HTMLInputElement) || !["checkbox", "radio"].includes(element.type)) throw new Error("action_denied")
+    return element.checked
   }
   if (operation === "select") {
     if (!(element instanceof HTMLSelectElement)) throw new Error("action_denied")
@@ -141,23 +135,19 @@ function queryLocatorInPage(locator: BrowserLocator, operation: BrowserLocatorQu
     element.dispatchEvent(new Event("change", { bubbles: true }))
     return true
   }
-  if (operation === "check" || operation === "uncheck") {
-    if (!(element instanceof HTMLInputElement) || !["checkbox", "radio"].includes(element.type)) throw new Error("action_denied")
-    const checked = operation === "check"
-    if (element.checked !== checked) element.click()
-    return true
-  }
-  if (operation === "scroll") {
+  if (!visible(element) || !enabled(element)) throw new Error("action_denied")
+  let rect = (element as HTMLElement).getBoundingClientRect()
+  const view = element.ownerDocument.defaultView
+  if (view && (rect.bottom <= 0 || rect.right <= 0 || rect.top >= view.innerHeight || rect.left >= view.innerWidth)) {
     ;(element as HTMLElement).scrollIntoView({ block: "center", inline: "center" })
-    return true
+    rect = (element as HTMLElement).getBoundingClientRect()
   }
-  if (!visible(element) || !enabled(element)) throw new Error("action_denied")
-  const rect = (element as HTMLElement).getBoundingClientRect()
   const x = Math.max(rect.left, Math.min(rect.right, rect.left + rect.width / 2))
   const y = Math.max(rect.top, Math.min(rect.bottom, rect.top + rect.height / 2))
   const ownerDocument = element.ownerDocument
   const top = ownerDocument.elementFromPoint(x, y)
-  if (top && top !== element && !element.contains(top)) throw new Error("action_denied")
+  const hitLabel = top instanceof HTMLElement ? top.closest("label") : null
+  if (top && top !== element && !element.contains(top) && (!(hitLabel instanceof HTMLLabelElement) || hitLabel.control !== element)) throw new Error("action_denied")
   let topX = x
   let topY = y
   let frame = ownerDocument.defaultView?.frameElement
@@ -167,5 +157,8 @@ function queryLocatorInPage(locator: BrowserLocator, operation: BrowserLocatorQu
     topY += frameRect.top
     frame = frame.ownerDocument.defaultView?.frameElement
   }
-  return { x: topX, y: topY, width: rect.width, height: rect.height, tagName: element.tagName.toLowerCase(), role: role(element), editable: element instanceof HTMLInputElement || element instanceof HTMLTextAreaElement || element instanceof HTMLSelectElement || (element as HTMLElement).isContentEditable, enabled: enabled(element) }
+  const editable = (element instanceof HTMLInputElement || element instanceof HTMLTextAreaElement)
+    ? !element.readOnly && !element.disabled
+    : (element as HTMLElement).isContentEditable
+  return { x: topX, y: topY, width: rect.width, height: rect.height, tagName: element.tagName.toLowerCase(), role: role(element), editable, enabled: enabled(element) }
 }
diff --git a/apps/desktop/src/browser-runtime.ts b/apps/desktop/src/browser-runtime.ts
index cb64e754..bcc3550a 100644
--- a/apps/desktop/src/browser-runtime.ts
+++ b/apps/desktop/src/browser-runtime.ts
@@ -42,6 +42,10 @@ import { BrowserCredentialVault } from "./browser-credentials"
 import { BrowserWorkspaceStore } from "./browser-workspace-store"
 import { BrowserReferenceGrantStore } from "./browser-reference-grants"
 import { BrowserAnnotationManager } from "./browser-annotation-manager"
+import { dispatchBrowserClick, dispatchBrowserKey, dispatchBrowserText, focusBrowserPoint, type BrowserCdpCommandSender } from "./browser-cdp-input"
+import { BrowserActionQueue } from "./browser-action-queue"
+import { BrowserInputLedger } from "./browser-input-ledger"
+import { detectBrowserActionEffect, type BrowserActionEffect, type BrowserActionEffectSnapshot } from "./browser-action-effect"
 
 type BrowserEvent = { method: string; params: Record<string, unknown> }
 type BrowserRuntimeOptions = {
@@ -203,6 +207,8 @@ export class BrowserRuntime {
   private readonly workspaces: BrowserWorkspaceStore
   private readonly referenceGrants = new BrowserReferenceGrantStore()
   private readonly annotations: BrowserAnnotationManager
+  private readonly actionQueue = new BrowserActionQueue()
+  private readonly inputLedger = new BrowserInputLedger()
   private annotationSweepTimer: ReturnType<typeof setTimeout> | null = null
   private annotationSweepInterval: ReturnType<typeof setInterval> | null = null
   private agentPluginEnabled = false
@@ -214,7 +220,7 @@ export class BrowserRuntime {
   private readonly sessionNames = new Map<string, string>()
   private readonly claimSnapshots = new Map<string, { tabId: string; providerTabId?: string; title: string; url: string; generation: number }>()
   private readonly downloadWaiters = new Map<string, BrowserDownloadWaiter[]>()
-  private readonly downloadResults = new Map<string, { browserSessionId: string; browserTurnId: string; state: "pending" | "completed" | "failed"; fileRef?: string; waiters: Array<(value: string | null) => void> }>()
+  private readonly downloadResults = new Map<string, { browserSessionId: string; browserTurnId: string; tabId: string; state: "pending" | "completed" | "failed"; fileRef?: string; waiters: Array<(value: string | null) => void> }>()
   private readonly fileChooserWaiters = new Map<string, BrowserFileChooserWaiter[]>()
   private readonly fileChoosers = new Map<string, BrowserFileChooserEntry>()
   private readonly pageAssetInventories = new Map<string, BrowserPageAssetInventory>()
@@ -539,6 +545,102 @@ export class BrowserRuntime {
 
   resetAgentCursor(): void { this.hideAgentCursor() }
 
+  // 用户接管是会话级暂停：同 session 任意 tab 处于 paused_by_user 时，
+  // Agent 不得开新 Tab 或认领其他 Tab 绕开暂停继续操作。
+  private hasPausedTakeoverTab(browserSessionId: string): boolean {
+    for (const tab of this.tabs.values()) {
+      if (tab.agentLease?.browserSessionId === browserSessionId && tab.agentControlState === "paused_by_user") return true
+    }
+    return false
+  }
+
+  private pauseAgentControl(tab: BrowserTab): void {
+    if (!tab.agentLease || tab.agentControlState === "paused_by_user") return
+    const lease = tab.agentLease
+    tab.agentControlState = "paused_by_user"
+    tab.handoff = { browserSessionId: lease.browserSessionId, status: "handoff", reason: "user_takeover" }
+    tab.generation += 1
+    tab.inputSequence += 1
+    tab.agentLease = { ...lease, generation: tab.generation }
+    this.inputLedger.clear(tab.tabId)
+    this.actionQueue.cancel(`agent:${lease.browserSessionId}`)
+    this.hideAgentCursor()
+    this.options.emit({ method: "browser:user-takeover", params: { tabId: tab.tabId, generation: tab.generation } })
+    this.options.emit({ method: "browser:tab-changed", params: publicTab(tab) as unknown as Record<string, unknown> })
+    this.rememberTab(tab)
+  }
+
+  private resumeAgentControl(tabId: string, context: BrowserRequestContext): BrowserTabDescriptor {
+    if (context.actor !== "user") throw browserError("action_denied")
+    const tab = this.tabs.get(tabId)
+    if (!tab || tab.agentControlState !== "paused_by_user" || !tab.agentLease) throw browserError("invalid_browser_request")
+    tab.agentControlState = "active"
+    if (tab.handoff?.reason === "user_takeover") tab.handoff = undefined
+    tab.generation += 1
+    tab.inputSequence += 1
+    tab.agentLease = { ...tab.agentLease, generation: tab.generation }
+    this.inputLedger.clear(tab.tabId)
+    this.options.emit({ method: "browser:agent-control-resumed", params: { tabId: tab.tabId, generation: tab.generation } })
+    this.options.emit({ method: "browser:tab-changed", params: publicTab(tab) as unknown as Record<string, unknown> })
+    this.rememberTab(tab)
+    return publicTab(tab)
+  }
+
+  private expectedAgentInputSender(tab: BrowserTab, sender: BrowserCdpCommandSender): BrowserCdpCommandSender {
+    if (!tab.agentDispatching) return sender
+    return {
+      sendCommand: async (method, params = {}) => {
+        if (agentControlPaused(tab)) throw browserError("user_takeover_required")
+        this.inputLedger.expectCommand(tab.tabId, method, params)
+        const result = await sender.sendCommand(method, params)
+        if (agentControlPaused(tab)) throw browserError("user_takeover_required")
+        return result
+      },
+    }
+  }
+
+  private async captureActionEffect(tab: BrowserTab): Promise<BrowserActionEffectSnapshot> {
+    const domRevision = await this.browserDomRevision(tab)
+    return {
+      ...(tab.dialogInfo?.id ? { dialogId: tab.dialogInfo.id } : {}),
+      domRevision,
+      downloadIds: [...this.downloadResults].flatMap(([id, result]) => result.tabId === tab.tabId ? [id] : []),
+      generation: tab.generation,
+      lifecycle: tab.lifecycle,
+      popupCount: [...this.popupTokens.values()].filter((popup) => popup.sourceTabId === tab.tabId).length,
+      tabIds: [...this.tabs.values()].flatMap((candidate) => candidate.openerTabId === tab.tabId ? [candidate.tabId] : []),
+      url: tab.url,
+    }
+  }
+
+  private async waitForActionEffect(tab: BrowserTab, before: BrowserActionEffectSnapshot, agent: boolean): Promise<BrowserActionEffect> {
+    const deadline = Date.now() + 300
+    do {
+      if (agent && agentControlPaused(tab)) throw browserError("user_takeover_required")
+      await delay(50)
+      const effect = detectBrowserActionEffect(before, await this.captureActionEffect(tab))
+      if (effect) return effect
+    } while (Date.now() < deadline)
+    return { kind: "no_detectable_change" }
+  }
+
+  private async browserDomRevision(tab: BrowserTab): Promise<number> {
+    try {
+      const value = await browserContents(tab).executeJavaScriptInIsolatedWorld(999, [{ code: `(() => {
+        const key = "__lumeBrowserActionEffect";
+        const root = globalThis;
+        if (!root[key]) {
+          const state = { revision: 0 };
+          const observer = new MutationObserver(() => { state.revision += 1; });
+          observer.observe(document, { attributes: true, characterData: true, childList: true, subtree: true });
+          root[key] = state;
+        }
+        return root[key].revision;
+      })()` }], true)
+      return Number.isInteger(value) ? Number(value) : -1
+    } catch { return -1 }
+  }
+
   async dispatch(request: BrowserActionRequest): Promise<unknown> {
     const context = validateContext(request.context)
     const startedAt = Date.now()
@@ -638,7 +740,10 @@ export class BrowserRuntime {
       return { ok: true }
     }
     if (method.startsWith("workspace:")) return this.dispatchWorkspace(method, params, context)
-    if (method === "ensure") return this.ensureTab(String(params.tabId ?? randomUUID()), context, params)
+    if (method === "ensure") {
+      if (context.actor === "agent" && this.hasPausedTakeoverTab(context.browserSessionId)) throw browserError("user_takeover_required")
+      return this.ensureTab(String(params.tabId ?? randomUUID()), context, params)
+    }
     if (method === "mount:prepare") return this.prepareGuestMount(String(params.tabId ?? context.tabId ?? ""), context)
     if (method === "mount:release") return this.releaseGuestMount(String(params.tabId ?? context.tabId ?? ""), context, String(params.mountToken ?? ""))
     if (method === "get") return publicTab(this.requireTab(String(params.tabId ?? context.tabId ?? ""), context))
@@ -652,8 +757,18 @@ export class BrowserRuntime {
     if (method === "finalize") return this.finalizeTabs(context, params)
     if (method === "share") return this.shareTab(String(params.tabId ?? context.tabId ?? ""), context)
     if (method === "unshare") return this.unshareTab(String(params.tabId ?? context.tabId ?? ""), context)
-    if (method === "claim") return this.claimTab(String(params.tabId ?? context.tabId ?? ""), context, params)
-    if (method === "close") return this.closeTab(String(params.tabId ?? context.tabId ?? ""), context)
+    if (method === "claim") {
+      if (context.actor === "agent" && this.hasPausedTakeoverTab(context.browserSessionId)) throw browserError("user_takeover_required")
+      return this.claimTab(String(params.tabId ?? context.tabId ?? ""), context, params)
+    }
+    if (method === "close") {
+      // 被用户接管的 Tab 所有权已转移，Agent 不得关闭用户正在查看的页面
+      if (context.actor === "agent") {
+        const closeTarget = this.tabs.get(String(params.tabId ?? context.tabId ?? ""))
+        if (closeTarget?.agentControlState === "paused_by_user") throw browserError("user_takeover_required")
+      }
+      return this.closeTab(String(params.tabId ?? context.tabId ?? ""), context)
+    }
     if (method === "bounds") return this.updateBounds(String(params.tabId ?? context.tabId ?? ""), params)
     if (method === "visible") return this.setVisible(String(params.tabId ?? context.tabId ?? ""), params.visible === true)
     if (method === "move-owner") {
@@ -737,8 +852,11 @@ export class BrowserRuntime {
       if (context.actor !== "user") throw browserError("action_denied")
       return this.annotations.migrate(params.sessions)
     }
+    if (method === "agentControl:resume") return this.resumeAgentControl(String(params.tabId ?? context.tabId ?? ""), context)
 
     const tab = this.requireTab(String(params.tabId ?? context.tabId ?? ""), context)
+    if (context.actor === "agent" && tab.agentControlState === "paused_by_user") throw browserError("user_takeover_required")
+    if (context.actor === "user" && tab.agentLease && MUTATING_METHODS.has(method)) this.pauseAgentControl(tab)
     if (tab.dialogOpen && method !== "dialog:handle" && method !== "dialog:get") throw browserError("dialog_blocking")
     if ((method === "reload" || method === "hardReload") && (!tab.webContents || tab.webContents.isDestroyed() || tab.guestState === "gone")) {
       return this.recoverGuest(tab)
@@ -746,38 +864,55 @@ export class BrowserRuntime {
     if ((method === "contactFill" || method === "upload" || method === "filechooser:setFiles" || method === "content:export" || method === "pageAssets:bundle" || method === "cdp" || method === "clipboard:read" || method === "clipboard:readText" || method === "clipboard:write" || method === "clipboard:writeText") && params.__policyRequired !== true) throw browserError("confirmation_unavailable")
     if (params.__policyRequired === true) this.consumePolicyToken(String(params.__policyConfirmation ?? ""), String(params.__policyBindingHash ?? ""))
     if (MUTATING_METHODS.has(method)) {
-      const operationId = request.idempotencyKey || request.requestId || randomUUID()
-      this.journal.write({
-        operationId,
-        method,
-        tabGeneration: tab.generation,
-        parameterHash: keyedParameterHash(method, params),
-        status: "prepared",
-        timestamp: Date.now(),
-      })
-      try {
-        const result = await this.dispatchAction(tab, method, params, context)
-        this.journal.write({
-          operationId,
-          method,
-          tabGeneration: tab.generation,
-          parameterHash: keyedParameterHash(method, params),
-          status: "committed",
-          timestamp: Date.now(),
-        })
-        this.journal.complete(operationId)
-        return result
-      } catch (error) {
+      const queuedGeneration = tab.generation
+      const queueKey = context.actor === "agent"
+        ? `agent:${context.browserSessionId}`
+        : `user:${tab.tabId}`
+      return this.actionQueue.run(queueKey, async () => {
+        if (this.tabs.get(tab.tabId) !== tab) throw browserError("tab_not_found")
+        if (tab.generation !== queuedGeneration) throw browserError("stale_target")
+        if (context.actor === "agent" && tab.agentControlState === "paused_by_user") throw browserError("user_takeover_required")
+        if (context.actor === "agent" && !canAgentUse(tab, context.browserSessionId, context.browserTurnId, tab.generation)) throw browserError("action_denied")
+        const operationId = request.idempotencyKey || request.requestId || randomUUID()
         this.journal.write({
           operationId,
           method,
           tabGeneration: tab.generation,
           parameterHash: keyedParameterHash(method, params),
-          status: "executed_unknown",
+          status: "prepared",
           timestamp: Date.now(),
         })
-        throw error
-      }
+        if (context.actor === "agent") tab.agentDispatching = true
+        try {
+          const result = await this.dispatchAction(tab, method, params, context)
+          if (context.actor === "agent" && tab.agentControlState === "paused_by_user") throw browserError("user_takeover_required")
+          this.journal.write({
+            operationId,
+            method,
+            tabGeneration: tab.generation,
+            parameterHash: keyedParameterHash(method, params),
+            status: "committed",
+            timestamp: Date.now(),
+          })
+          this.journal.complete(operationId)
+          return result
+        } catch (error) {
+          this.journal.write({
+            operationId,
+            method,
+            tabGeneration: tab.generation,
+            parameterHash: keyedParameterHash(method, params),
+            status: "executed_unknown",
+            timestamp: Date.now(),
+          })
+          throw error
+        } finally {
+          if (context.actor === "agent") {
+            tab.agentDispatching = false
+            this.inputLedger.clear(tab.tabId)
+          }
+        }
+      })
     }
     if (!GUEST_OPTIONAL_METHODS.has(method)) await this.waitForGuest(tab)
     if (method === "snapshot") return this.snapshot(tab)
@@ -813,7 +948,12 @@ export class BrowserRuntime {
     if (method === "clipboard:write") return this.writeBrowserClipboard(params)
     if (method === "dom:visible") return this.visibleDom(tab)
     if (method === "dom:click" || method === "dom:doubleClick" || method === "dom:scroll") return this.dispatchDomAction(tab, method, params)
-    if (method === "dom:type") { await this.applyTextToActive(tab, String(params.text ?? "")); return {} }
+    if (method === "dom:type") {
+      const text = String(params.text ?? "")
+      if (text.length > 100_000) throw browserError("invalid_browser_request")
+      await withDebugger(browserContents(tab), (debuggerRef) => dispatchBrowserText(this.expectedAgentInputSender(tab, debuggerRef), text, { platform: process.platform, replace: false }))
+      return {}
+    }
     if (method === "dom:keypress") {
       const keys = Array.isArray(params.keys) ? params.keys.filter((value): value is string => typeof value === "string") : []
       for (const key of keys.slice(0, 100)) await this.dispatchKey(tab, key)
@@ -936,7 +1076,14 @@ export class BrowserRuntime {
     }
     if (method === "tweaks:apply") return this.applyPageTweaks(tab, params, context)
     if (method === "tweaks:reset") return this.resetPageTweaks(tab, params, context)
-    if (method === "cdp") return this.cdp(tab, params)
+    if (method === "cdp") {
+      // Agent 的 CDP 调用与语义动作共用同 session 单写者队列，
+      // 且输入类命令须登记 inputLedger，否则会被误判为真实用户输入触发接管。
+      if (context.actor === "agent") {
+        return this.actionQueue.run(`agent:${context.browserSessionId}`, () => this.cdp(tab, params, true))
+      }
+      return this.cdp(tab, params)
+    }
     if (method === "url") return tab.url
     if (method === "title") return tab.title
     throw browserError("unsupported")
@@ -1036,6 +1183,7 @@ export class BrowserRuntime {
       if (context.actor === "agent") {
         if (!existing.agentLease && existing.shareable && existing.partition === "persist:lume-browser") {
           existing.agentLease = { browserSessionId: context.browserSessionId, browserTurnId: context.browserTurnId, generation: existing.generation }
+          existing.agentControlState = "active"
         }
         if (!existing.agentLease || existing.agentLease.browserSessionId !== context.browserSessionId || existing.agentLease.browserTurnId !== context.browserTurnId) throw browserError("action_denied")
       }
@@ -1078,7 +1226,7 @@ export class BrowserRuntime {
       viewportRevision: 0,
       webContents: null,
       partition,
-      ...(agentOwned ? { context, agentLease: { browserSessionId: context.browserSessionId, browserTurnId: context.browserTurnId, generation: 1 } } : {}),
+      ...(agentOwned ? { context, agentLease: { browserSessionId: context.browserSessionId, browserTurnId: context.browserTurnId, generation: 1 }, agentControlState: "active" as const } : {}),
       inputSequence: 0,
       navigationStack: Array.isArray(params.navigationEntries)
         ? params.navigationEntries.filter((value): value is string => typeof value === "string" && /^https?:/i.test(value)).map(stripUrl).filter(Boolean).slice(-200)
@@ -1201,11 +1349,10 @@ export class BrowserRuntime {
       tab.url = stripUrl(url)
       tab.securityState = securityStateForUrl(tab.url)
       tab.lastOpenedAt = new Date().toISOString()
-      tab.generation += 1
-      tab.inputSequence += 1
+      // in-page 导航（pushState/hash）不替换文档：backendNodeId 与语义引用在同一文档内保持有效，
+      // 不递增 generation 以免误杀仍可用的 ref（真实失效由命中测试兜底）。
       tab.domNodes = undefined
-      if (tab.context?.actor === "agent") tab.agentLease = { browserSessionId: tab.context.browserSessionId, browserTurnId: tab.context.browserTurnId, generation: tab.generation }
-      else tab.agentLease = undefined
+      if (tab.context?.actor !== "agent") tab.agentLease = undefined
       this.options.emit({ method: "browser:tab-changed", params: publicTab(tab) as unknown as Record<string, unknown> })
       this.annotations.onGuestReady(tab)
       this.rememberTab(tab)
@@ -1254,6 +1401,7 @@ export class BrowserRuntime {
       this.enforceBackgroundLimit()
     })
     wc.on("before-input-event", (event, input) => {
+      if (this.inputLedger.consumeKey(tab.tabId, input)) return
       const key = input.key.toLowerCase()
       const modifier = input.control || input.meta
       const action = modifier && key === "l"
@@ -1263,19 +1411,20 @@ export class BrowserRuntime {
           : (modifier && key === "r") || key === "f5"
             ? input.shift ? "hard-reload" : "reload"
             : undefined
-      if (!tab.agentDispatching) {
-        tab.inputSequence += 1
-        if (!action && input.type === "keyDown" && !input.isAutoRepeat) tab.lastUserActivationAt = Date.now()
-      }
+      tab.inputSequence += 1
+      if (!action && input.type === "keyDown" && !input.isAutoRepeat) tab.lastUserActivationAt = Date.now()
+      this.pauseAgentControl(tab)
       if (!action) return
       event.preventDefault()
       this.options.emit({ method: "browser:shortcut", params: { tabId: tab.tabId, action } })
     })
     wc.on("before-mouse-event", (_event, mouse) => {
-      if (!tab.agentDispatching) {
-        tab.inputSequence += 1
-        if (mouse.type === "mouseDown" && (mouse.button === "left" || mouse.button === "middle")) tab.lastUserActivationAt = Date.now()
-      }
+      if (this.inputLedger.consumeMouse(tab.tabId, mouse)) return
+      // 滚动与纯指针移动是查看型交互（如用户展开侧边栏观察 Agent 操作），不构成用户接管
+      if (mouse.type !== "mouseDown" && mouse.type !== "mouseUp") return
+      tab.inputSequence += 1
+      if (mouse.type === "mouseDown" && (mouse.button === "left" || mouse.button === "middle")) tab.lastUserActivationAt = Date.now()
+      this.pauseAgentControl(tab)
     })
     wc.on("page-title-updated", (_event, title) => {
       tab.title = title.slice(0, 256)
@@ -1475,6 +1624,7 @@ export class BrowserRuntime {
       this.downloadResults.set(prepared.id, {
         browserSessionId: recentAgent.browserSessionId,
         browserTurnId: recentAgent.browserTurnId,
+        tabId: tab.tabId,
         state: "pending",
         waiters: [],
       })
@@ -1637,61 +1787,79 @@ export class BrowserRuntime {
     if (method === "content:export") return this.exportPageContent(tab, context)
     if (method === "pageAssets:bundle") return this.bundlePageAssets(tab, params, context)
     if (method === "webmcp:invoke") return invokeWebMcpTool(tab, params)
-    if (method === "typeActive") { await this.applyTextToActive(tab, String(params.text ?? "")); return { ok: true } }
+    if (method === "typeActive") {
+      const text = String(params.text ?? "")
+      if (text.length > 100_000) throw browserError("invalid_browser_request")
+      await withDebugger(browserContents(tab), (debuggerRef) => dispatchBrowserText(this.expectedAgentInputSender(tab, debuggerRef), text, { platform: process.platform, replace: false }))
+      return { ok: true }
+    }
     if (method === "pressActive") { await this.dispatchKey(tab, String(params.key ?? "Enter")); return { ok: true } }
     if (["click", "doubleClick", "hover", "scroll", "drag", "fill", "type", "press", "select", "check", "uncheck"].includes(method)) {
       if (context.actor === "agent" && !context.capability) throw browserError("action_denied")
       const generation = tab.generation
       const inputSequence = tab.inputSequence
-      if (isBrowserLocator(params.locator)
-        && splitFrameLocator(params.locator)
-        && ["click", "doubleClick", "scroll", "fill", "type", "press", "select", "check", "uncheck"].includes(method)) {
-        if (tab.generation !== generation || tab.inputSequence !== inputSequence) throw browserError("stale_target")
-        const argument = method === "fill" || method === "type"
-          ? String(params.text ?? "")
-          : method === "press"
-            ? String(params.key ?? "Enter")
-            : method === "select"
-              ? JSON.stringify(Array.isArray(params.value) ? params.value : [String(params.value ?? "")])
-              : undefined
-        const rawFrameAutoWait = params.timeoutMs ?? params.timeout_ms
-        const frameAutoWaitMs = rawFrameAutoWait === 0 ? 0 : (boundedNumber(rawFrameAutoWait, 0, 30_000) || 3_000)
-        await this.runFrameLocatorActionWithAutoWait(tab, generation, inputSequence, params, method as BrowserLocatorQuery, argument, frameAutoWaitMs)
-        return { ok: true, inputSequence: tab.inputSequence }
-      }
       // 显式 timeoutMs:0 = 关闭 auto-wait（boundedNumber 的 || 3_000 会吞掉 0）
       const rawAutoWait = params.timeoutMs ?? params.timeout_ms
       const autoWaitMs = rawAutoWait === 0 ? 0 : (boundedNumber(rawAutoWait, 0, 30_000) || 3_000)
       const target = await this.resolveTargetWithAutoWait(tab, generation, params, autoWaitMs)
       if (tab.generation !== generation || tab.inputSequence !== inputSequence) throw browserError("stale_target")
+      const effectBefore = await this.captureActionEffect(tab)
       tab.inputSequence += 1
-      tab.agentDispatching = true
+      tab.agentDispatching = context.actor === "agent"
       try {
         if (method === "fill" || method === "type") {
           const text = String(params.text ?? "")
           if (text.length > 100_000) throw browserError("invalid_browser_request")
+          if (!target.editable) throw browserError("action_denied")
+          // 语义引用已做命中验证；locator 仅是工具层的兜底定位，用它做值验证会在
+          // 同角色多元素页面上 strict 多匹配，被 executeLocatorQuery 兜底映射成 stale_target。
+          const verifyByLocator = isBrowserLocator(params.locator) && params.semanticRef === undefined
+          const before = verifyByLocator
+            ? String(await this.executeLocatorQuery(tab, params, "editableValue"))
+            : undefined
           await this.dispatchMouse(tab, "click", target)
-          await this.applyText(tab, target, text, method === "fill")
+          await withDebugger(browserContents(tab), (debuggerRef) => dispatchBrowserText(this.expectedAgentInputSender(tab, debuggerRef), text, { platform: process.platform, replace: method === "fill" }))
+          if (verifyByLocator) {
+            const observed = String(await this.executeLocatorQuery(tab, params, "editableValue"))
+            const expected = method === "fill" ? text : `${before ?? ""}${text}`
+            if (observed !== expected) throw browserError("actionability_failed")
+          }
         } else if (method === "press") {
-          await this.dispatchMouse(tab, "hover", target)
-          await this.pressTarget(tab, target, String(params.key ?? "Enter"))
+          await withDebugger(browserContents(tab), async (debuggerRef) => {
+            await focusBrowserPoint(debuggerRef, target)
+            await dispatchBrowserKey(this.expectedAgentInputSender(tab, debuggerRef), String(params.key ?? "Enter"))
+          })
         } else if (method === "select") {
-          await this.dispatchMouse(tab, "click", target)
-          await this.applySelect(tab, params)
+          if (!isBrowserLocator(params.locator)) throw browserError("invalid_browser_request")
+          const values = Array.isArray(params.value) ? params.value : [String(params.value ?? "")]
+          await this.executeLocatorQuery(tab, params, "select", JSON.stringify(values))
+          const observed = String(await this.executeLocatorQuery(tab, params, "inputValue"))
+          if (values.length === 1 && observed !== String(values[0] ?? "")) throw browserError("actionability_failed")
         } else if (method === "check" || method === "uncheck") {
-          await this.dispatchMouse(tab, method === "check" ? "click" : "click", target)
-          await this.applyChecked(tab, params, method === "check")
+          if (!isBrowserLocator(params.locator)) throw browserError("invalid_browser_request")
+          const desired = method === "check"
+          const before = Boolean(await this.executeLocatorQuery(tab, params, "isChecked"))
+          if (before !== desired) await this.dispatchMouse(tab, "click", target)
+          const observed = Boolean(await this.executeLocatorQuery(tab, params, "isChecked"))
+          if (observed !== desired) throw browserError("actionability_failed")
         } else if (method === "scroll") {
           await this.dispatchScroll(tab, target, params)
         } else if (method === "drag") {
           await this.dispatchDrag(tab, target, params)
+        // Electron can drop a second root-session pointer sequence routed into
+        // a child frame. Focus + native Enter preserves browser activation for
+        // semantic buttons and links without falling back to element.click().
+        } else if (method === "click" && isBrowserLocator(params.locator) && splitFrameLocator(params.locator) && (target.role === "button" || target.tagName === "a")) {
+          await this.executeFrameLocatorQuery(tab, params.locator, "focus")
+          await this.dispatchKey(tab, "Enter")
         } else {
           await this.dispatchMouse(tab, method, target)
         }
       } finally {
         tab.agentDispatching = false
       }
-      return { ok: true, inputSequence: tab.inputSequence }
+      const effect = await this.waitForActionEffect(tab, effectBefore, context.actor === "agent")
+      return { ok: true, inputSequence: tab.inputSequence, effect }
     }
     throw browserError("unsupported")
   }
@@ -1847,7 +2015,7 @@ export class BrowserRuntime {
           const target = targets.get(field.id)
           if (value === undefined || !target) continue
           await this.dispatchMouse(tab, "click", target)
-          await this.applyText(tab, target, value, true)
+          await withDebugger(browserContents(tab), (debuggerRef) => dispatchBrowserText(this.expectedAgentInputSender(tab, debuggerRef), value, { platform: process.platform, replace: true }))
         }
         const submit = auth.request.submit
         if (submit?.kind === "click") {
@@ -1857,7 +2025,10 @@ export class BrowserRuntime {
           const targetField = auth.request.fields.find((field) => field.id === submit.fieldId) ?? [...auth.request.fields].reverse().find((field) => values.has(field.id))
           const target = targetField ? targets.get(targetField.id) : undefined
           if (!target) throw browserError("stale_target")
-          await this.pressTarget(tab, target, "Enter")
+          await withDebugger(browserContents(tab), async (debuggerRef) => {
+            await focusBrowserPoint(debuggerRef, target)
+            await dispatchBrowserKey(this.expectedAgentInputSender(tab, debuggerRef), "Enter")
+          })
         }
       } finally {
         tab.agentDispatching = false
@@ -1900,7 +2071,7 @@ export class BrowserRuntime {
     try {
       await this.dispatchMouse(tab, "click", target)
       if (tab.generation !== generation) throw browserError("stale_target")
-      await this.applyText(tab, target, value, true)
+      await withDebugger(browserContents(tab), (debuggerRef) => dispatchBrowserText(this.expectedAgentInputSender(tab, debuggerRef), value, { platform: process.platform, replace: true }))
     } finally { tab.agentDispatching = false }
   }
 
@@ -2256,144 +2427,21 @@ export class BrowserRuntime {
     const x = boundedNumber(params.x, 0, 100_000)
     const y = boundedNumber(params.y, 0, 100_000)
     this.showAgentCursor(tab, x, y, method === "click" || method === "doubleClick")
-    if (method === "click" || method === "doubleClick") {
-      const clicked = await browserContents(tab).executeJavaScriptInIsolatedWorld(999, [{
-        code: `(() => {
-          let frameDocument = document;
-          let x = ${JSON.stringify(x)};
-          let y = ${JSON.stringify(y)};
-          let element = null;
-          for (let depth = 0; depth < 8; depth += 1) {
-            element = frameDocument.elementFromPoint(x, y);
-            if (!(element instanceof frameDocument.defaultView.Element)) return false;
-            if (!["iframe", "frame"].includes(element.tagName.toLowerCase()) || !element.contentDocument) break;
-            const rect = element.getBoundingClientRect();
-            x -= rect.left;
-            y -= rect.top;
-            frameDocument = element.contentDocument;
-          }
-          if (!(element instanceof frameDocument.defaultView.Element)) return false;
-          const win = frameDocument.defaultView;
-          if (typeof element.click === "function") element.click();
-          else element.dispatchEvent(new win.MouseEvent("click", { bubbles: true, cancelable: true, view: win }));
-          if (${JSON.stringify(method === "doubleClick")}) {
-            if (typeof element.click === "function") element.click();
-            else element.dispatchEvent(new win.MouseEvent("click", { bubbles: true, cancelable: true, view: win }));
-            element.dispatchEvent(new win.MouseEvent("dblclick", { bubbles: true, cancelable: true, view: win, detail: 2 }));
-          }
-          return true;
-        })()`,
-      }], true)
-      if (!clicked) throw browserError("stale_target")
-      return
-    }
     await withDebugger(browserContents(tab), async (debuggerRef) => {
-      await debuggerRef.sendCommand("Input.dispatchMouseEvent", { type: "mouseMoved", x, y })
-      if (method === "hover") return
+      const sender = this.expectedAgentInputSender(tab, debuggerRef)
+      if (method === "click" || method === "doubleClick") {
+        await dispatchBrowserClick(sender, { x, y }, method === "doubleClick" ? 2 : 1)
+      } else {
+        await sender.sendCommand("Input.dispatchMouseEvent", { type: "mouseMoved", x, y })
+      }
     })
   }
 
   private async dispatchKey(tab: BrowserTab, key: string, modifiers: string[] = []): Promise<void> {
-    await withDebugger(browserContents(tab), async (debuggerRef) => {
-      const modifier = modifiers.includes("CTRL") ? 2 : modifiers.includes("META") ? 4 : 0
-      await debuggerRef.sendCommand("Input.dispatchKeyEvent", { type: "keyDown", key, modifiers: modifier })
-      await debuggerRef.sendCommand("Input.dispatchKeyEvent", { type: "keyUp", key, modifiers: modifier })
-    })
-  }
-
-  private async applyText(tab: BrowserTab, target: ResolvedBrowserTarget, text: string, replace: boolean): Promise<void> {
-    const applied = await browserContents(tab).executeJavaScriptInIsolatedWorld(999, [{
-      code: `(() => {
-        let frameDocument = document;
-        let x = ${JSON.stringify(target.x)};
-        let y = ${JSON.stringify(target.y)};
-        let element = null;
-        for (let depth = 0; depth < 8; depth += 1) {
-          element = frameDocument.elementFromPoint(x, y);
-          if (!(element instanceof frameDocument.defaultView.HTMLElement)) return false;
-          if (!["iframe", "frame"].includes(element.tagName.toLowerCase()) || !element.contentDocument) break;
-          const rect = element.getBoundingClientRect();
-          x -= rect.left;
-          y -= rect.top;
-          frameDocument = element.contentDocument;
-        }
-        if (!(element instanceof frameDocument.defaultView.HTMLElement)) return false;
-        const win = frameDocument.defaultView;
-        const text = ${JSON.stringify(text)};
-        const replace = ${JSON.stringify(replace)};
-        element.focus({ preventScroll: true });
-        const nextValue = current => replace ? text : current + text;
-        if (element instanceof win.HTMLInputElement) {
-          const setter = Object.getOwnPropertyDescriptor(win.HTMLInputElement.prototype, "value")?.set;
-          if (!setter) return false;
-          setter.call(element, nextValue(element.value));
-        } else if (element instanceof win.HTMLTextAreaElement) {
-          const setter = Object.getOwnPropertyDescriptor(win.HTMLTextAreaElement.prototype, "value")?.set;
-          if (!setter) return false;
-          setter.call(element, nextValue(element.value));
-        } else if (element.isContentEditable) {
-          element.textContent = nextValue(element.textContent || "");
-        } else {
-          return false;
-        }
-        element.dispatchEvent(new win.InputEvent("input", { bubbles: true, inputType: replace ? "insertReplacementText" : "insertText", data: text }));
-        return true;
-      })()`,
-    }], true)
-    if (!applied) throw browserError("stale_target")
-  }
-
-  private async applyTextToActive(tab: BrowserTab, text: string): Promise<void> {
-    if (text.length > 100_000) throw browserError("invalid_browser_request")
-    const applied = await browserContents(tab).executeJavaScriptInIsolatedWorld(999, [{ code: `(() => {
-      const element = document.activeElement;
-      if (!(element instanceof HTMLElement)) return false;
-      if (element instanceof HTMLInputElement) {
-        const descriptor = Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, "value");
-        if (!descriptor?.set) return false;
-        descriptor.set.call(element, element.value + ${JSON.stringify(text)});
-      } else if (element instanceof HTMLTextAreaElement) {
-        const descriptor = Object.getOwnPropertyDescriptor(HTMLTextAreaElement.prototype, "value");
-        if (!descriptor?.set) return false;
-        descriptor.set.call(element, element.value + ${JSON.stringify(text)});
-      } else if (element.isContentEditable) element.textContent = (element.textContent || "") + ${JSON.stringify(text)};
-      else return false;
-      element.dispatchEvent(new Event("input", { bubbles: true }));
-      return true;
-    })()` }], true)
-    if (!applied) throw browserError("stale_target")
-  }
-
-  private async pressTarget(tab: BrowserTab, target: ResolvedBrowserTarget, keySpec: string): Promise<void> {
+    const normalizedModifiers = modifiers.flatMap((modifier) => ({ CTRL: "Control", META: "Meta", ALT: "Alt", SHIFT: "Shift" })[modifier.toUpperCase()] ?? [])
+    const keySpec = [...normalizedModifiers, key].join("+")
     if (!keySpec || keySpec.length > 128) throw browserError("invalid_browser_request")
-    const pressed = await browserContents(tab).executeJavaScriptInIsolatedWorld(999, [{ code: `(() => {
-      const element = document.elementFromPoint(${JSON.stringify(target.x)}, ${JSON.stringify(target.y)});
-      if (!(element instanceof HTMLElement)) return false;
-      element.focus({ preventScroll: true });
-      if (document.activeElement !== element && !element.contains(document.activeElement)) return false;
-      const parts = ${JSON.stringify(keySpec)}.split("+");
-      const key = parts.pop() || "Enter";
-      const options = {
-        key,
-        bubbles: true,
-        cancelable: true,
-        ctrlKey: parts.includes("Control") || parts.includes("Ctrl"),
-        metaKey: parts.includes("Meta"),
-        altKey: parts.includes("Alt"),
-        shiftKey: parts.includes("Shift"),
-      };
-      const proceed = element.dispatchEvent(new KeyboardEvent("keydown", options));
-      if (proceed && (key === "Enter" || key === " ")) {
-        if (element instanceof HTMLButtonElement || element instanceof HTMLAnchorElement || (element instanceof HTMLInputElement && ["button", "submit", "reset", "checkbox", "radio"].includes(element.type))) {
-          HTMLElement.prototype.click.call(element);
-        } else if (key === "Enter" && (element instanceof HTMLInputElement || element instanceof HTMLTextAreaElement)) {
-          element.form?.requestSubmit();
-        }
-      }
-      element.dispatchEvent(new KeyboardEvent("keyup", options));
-      return true;
-    })()` }], true)
-    if (!pressed) throw browserError("stale_target")
+    await withDebugger(browserContents(tab), (debuggerRef) => dispatchBrowserKey(this.expectedAgentInputSender(tab, debuggerRef), keySpec))
   }
 
   private async queryLocator(tab: BrowserTab, operation: string, params: Record<string, unknown>): Promise<unknown> {
@@ -2449,7 +2497,6 @@ export class BrowserRuntime {
     locator: BrowserLocator,
     operation: BrowserLocatorQuery,
     argument?: string,
-    actionGuard?: { generation: number; inputSequence: number },
   ): Promise<unknown> {
     const parts = splitFrameLocator(locator)
     if (!parts) throw browserError("invalid_browser_request")
@@ -2494,28 +2541,28 @@ export class BrowserRuntime {
         grantUniveralAccess: false,
       }) as { executionContextId?: number }
       if (!isolated.executionContextId || generation !== tab.generation) throw browserError("stale_target")
-      if (actionGuard) {
-        if (tab.generation !== actionGuard.generation || tab.inputSequence !== actionGuard.inputSequence) throw browserError("stale_target")
-        tab.inputSequence += 1
-        actionGuard.inputSequence = tab.inputSequence
-        tab.agentDispatching = true
-      }
-      let evaluated: { result?: { value?: unknown }; exceptionDetails?: { exception?: { description?: string }; text?: string } }
-      try {
-        evaluated = await debuggerRef.sendCommand("Runtime.evaluate", {
-          contextId: isolated.executionContextId,
-          expression: evaluation
-            ? locatorReadonlyExpression(parts.locator, evaluation.script, evaluation.arg)
-            : `(${browserLocatorScript()})(${JSON.stringify(parts.locator)},${JSON.stringify(operation)},${JSON.stringify(argument)})`,
-          returnByValue: true,
-          awaitPromise: true,
-          ...(evaluation ? { throwOnSideEffect: true, timeout: evaluation.timeoutMs } : {}),
-        }) as { result?: { value?: unknown }; exceptionDetails?: { exception?: { description?: string }; text?: string } }
-      } finally {
-        if (actionGuard) tab.agentDispatching = false
-      }
+      let evaluated: { result?: { objectId?: string; value?: unknown }; exceptionDetails?: { exception?: { description?: string }; text?: string } }
+      evaluated = await debuggerRef.sendCommand("Runtime.evaluate", {
+        contextId: isolated.executionContextId,
+        expression: evaluation
+          ? locatorReadonlyExpression(parts.locator, evaluation.script, evaluation.arg)
+          : `(${browserLocatorScript()})(${JSON.stringify(parts.locator)},${JSON.stringify(operation === "focus" ? "element" : operation)},${JSON.stringify(argument)})`,
+        returnByValue: operation !== "focus",
+        awaitPromise: true,
+        ...(evaluation ? { throwOnSideEffect: true, timeout: evaluation.timeoutMs } : {}),
+      }) as { result?: { objectId?: string; value?: unknown }; exceptionDetails?: { exception?: { description?: string }; text?: string } }
       if (evaluated.exceptionDetails) throw browserError(evaluation ? readonlyLocatorExceptionCode(evaluated.exceptionDetails) : frameLocatorExceptionCode(evaluated.exceptionDetails))
       if (generation !== tab.generation) throw browserError("stale_target")
+      if (operation === "focus") {
+        const objectId = evaluated.result?.objectId
+        if (!objectId) throw browserError("stale_target")
+        try {
+          await debuggerRef.sendCommand("DOM.focus", { objectId })
+        } finally {
+          await debuggerRef.sendCommand("Runtime.releaseObject", { objectId }).catch(() => undefined)
+        }
+        return true
+      }
       const value = evaluated.result?.value
       if (operation === "target" && isRecord(value)) return {
         ...value,
@@ -2591,60 +2638,29 @@ export class BrowserRuntime {
       return this.resolveTarget(tab, params)
     }
     const deadline = Date.now() + timeoutMs
+    let previousTarget: ResolvedBrowserTarget | undefined
     while (true) {
       if (tab.generation !== generation) throw browserError("stale_target")
       try {
-        return await this.resolveTarget(tab, params)
+        const target = await this.resolveTarget(tab, params)
+        if (previousTarget && browserTargetsStable(previousTarget, target)) return target
+        previousTarget = target
       } catch (error) {
+        previousTarget = undefined
         const message = error instanceof Error ? error.message : ""
         if (message.includes("invalid_browser_request")) throw browserError("invalid_browser_request")
         if (message.includes("strict_locator_violation")) throw browserError("strict_locator_violation")
         if (message.includes("tab_not_found")) throw browserError("tab_not_found")
         // resolveTarget 的 action_denied 仅表示目标暂时不可见、不可用或被遮挡；具体动作的永久拒绝发生在后续 dispatch。
-        if (Date.now() >= deadline) throw browserError("actionability_failed")
-        await delay(50)
-      }
-    }
-  }
-
-  // frame-locator action 的 auto-wait 包装（executeFrameLocatorQuery 单次查询无重试）
-  private async runFrameLocatorActionWithAutoWait(
-    tab: BrowserTab,
-    generation: number,
-    inputSequence: number,
-    params: Record<string, unknown>,
-    operation: BrowserLocatorQuery,
-    argument: string | undefined,
-    timeoutMs: number,
-  ): Promise<void> {
-    if (!isBrowserLocator(params.locator)) throw browserError("invalid_browser_request")
-    const locator = params.locator
-    const actionGuard = { generation, inputSequence }
-    if (timeoutMs <= 0) {
-      await this.executeFrameLocatorQuery(tab, locator, operation, argument, actionGuard)
-      return
-    }
-    const deadline = Date.now() + timeoutMs
-    while (true) {
-      if (tab.generation !== generation || tab.inputSequence !== actionGuard.inputSequence) throw browserError("stale_target")
-      try {
-        await this.executeFrameLocatorQuery(tab, locator, operation, argument, actionGuard)
-        return
-      } catch (error) {
-        const message = error instanceof Error ? error.message : ""
-        if (message.includes("invalid_browser_request")) throw browserError("invalid_browser_request")
-        if (message.includes("strict_locator_violation")) throw browserError("strict_locator_violation")
-        if (message.includes("tab_not_found")) throw browserError("tab_not_found")
-        if (message.includes("action_denied")) throw browserError("action_denied")
-        if (Date.now() >= deadline) throw browserError("actionability_failed")
-        await delay(50)
       }
+      if (Date.now() >= deadline) throw browserError("actionability_failed")
+      await delay(50)
     }
   }
 
   private async dispatchScroll(tab: BrowserTab, target: ResolvedBrowserTarget, params: Record<string, unknown>): Promise<void> {
     await this.dispatchMouse(tab, "hover", target)
-    await withDebugger(browserContents(tab), (debuggerRef) => debuggerRef.sendCommand("Input.dispatchMouseEvent", {
+    await withDebugger(browserContents(tab), (debuggerRef) => this.expectedAgentInputSender(tab, debuggerRef).sendCommand("Input.dispatchMouseEvent", {
       type: "mouseWheel", x: target.x, y: target.y, deltaX: boundedNumber(params.deltaX, -10000, 10000), deltaY: boundedNumber(params.deltaY ?? params.y, -10000, 10000),
     }))
   }
@@ -2654,10 +2670,11 @@ export class BrowserRuntime {
     const endY = boundedNumber(params.toY ?? params.y2, 0, 100_000)
     await this.showAgentCursor(tab, target.x, target.y, false)
     await withDebugger(browserContents(tab), async (debuggerRef) => {
-      await debuggerRef.sendCommand("Input.dispatchMouseEvent", { type: "mouseMoved", x: target.x, y: target.y })
-      await debuggerRef.sendCommand("Input.dispatchMouseEvent", { type: "mousePressed", x: target.x, y: target.y, button: "left", clickCount: 1 })
-      await debuggerRef.sendCommand("Input.dispatchMouseEvent", { type: "mouseMoved", x: endX, y: endY, button: "left" })
-      await debuggerRef.sendCommand("Input.dispatchMouseEvent", { type: "mouseReleased", x: endX, y: endY, button: "left", clickCount: 1 })
+      const sender = this.expectedAgentInputSender(tab, debuggerRef)
+      await sender.sendCommand("Input.dispatchMouseEvent", { type: "mouseMoved", x: target.x, y: target.y })
+      await sender.sendCommand("Input.dispatchMouseEvent", { type: "mousePressed", x: target.x, y: target.y, button: "left", clickCount: 1 })
+      await sender.sendCommand("Input.dispatchMouseEvent", { type: "mouseMoved", x: endX, y: endY, button: "left" })
+      await sender.sendCommand("Input.dispatchMouseEvent", { type: "mouseReleased", x: endX, y: endY, button: "left", clickCount: 1 })
     })
     this.showAgentCursor(tab, endX, endY, false)
   }
@@ -2692,16 +2709,6 @@ export class BrowserRuntime {
     if (this.cursorOverlay && !this.cursorOverlay.isDestroyed()) this.cursorOverlay.hide()
   }
 
-  private async applySelect(tab: BrowserTab, params: Record<string, unknown>): Promise<void> {
-    const values = Array.isArray(params.value) ? params.value.filter((value): value is string => typeof value === "string") : [String(params.value ?? "")]
-    await browserContents(tab).executeJavaScript(`(values => { const select = document.activeElement; if (!(select instanceof HTMLSelectElement)) throw new Error("action_denied"); for (const option of Array.from(select.options)) option.selected = values.includes(option.value); select.dispatchEvent(new Event("input", { bubbles: true })); select.dispatchEvent(new Event("change", { bubbles: true })); })(${JSON.stringify(values)})`, true)
-  }
-
-  private async applyChecked(tab: BrowserTab, params: Record<string, unknown>, checked: boolean): Promise<void> {
-    if (!params.locator) return
-    await browserContents(tab).executeJavaScript(`(locator => { const el = document.activeElement; if (!(el instanceof HTMLInputElement) || !["checkbox", "radio"].includes(el.type)) throw new Error("action_denied"); if (el.checked !== ${checked}) el.click(); })(${JSON.stringify(params.locator)})`, true)
-  }
-
   private async snapshot(tab: BrowserTab): Promise<unknown> {
     const result = await withDebugger(browserContents(tab), (debuggerRef) => debuggerRef.sendCommand("DOMSnapshot.captureSnapshot", { computedStyles: [] }))
     // 防 token 爆炸：大页面/SPA 的 DOMSnapshot 可达数 MB，超阈值返回截断提示，
@@ -3155,7 +3162,7 @@ export class BrowserRuntime {
     void restore.catch(() => undefined)
   }
 
-  private async cdp(tab: BrowserTab, params: Record<string, unknown>): Promise<unknown> {
+  private async cdp(tab: BrowserTab, params: Record<string, unknown>, agentInput = false): Promise<unknown> {
     if (!this.settings.advancedCdpEnabled || !shouldInstallAdvancedCdpPolicy(tab.partition)) throw browserError("action_denied")
     const origin = safeOrigin(tab.url)
     if (origin && this.settings.sitePermissionOverrides?.[origin]?.cdp !== "allow") throw browserError("action_denied")
@@ -3167,7 +3174,10 @@ export class BrowserRuntime {
       const url = String((commandParams as Record<string, unknown>).url ?? "")
       return this.navigate(tab, url, tab.context ?? userContext())
     }
-    const result = await withDebugger(browserContents(tab), (debuggerRef) => debuggerRef.sendCommand(method, commandParams))
+    const result = await withDebugger(browserContents(tab), (debuggerRef) => {
+      if (agentInput) this.inputLedger.expectCommand(tab.tabId, method, commandParams as Record<string, unknown>)
+      return debuggerRef.sendCommand(method, commandParams)
+    })
     if (Buffer.byteLength(JSON.stringify(result ?? null)) > 2 * 1024 * 1024) throw browserError("browser_internal_error")
     return result
   }
@@ -3430,6 +3440,7 @@ export class BrowserRuntime {
     this.claimSnapshots.delete(snapshotKey)
     tab.context = context
     tab.agentLease = { browserSessionId: context.browserSessionId, browserTurnId: context.browserTurnId, generation: tab.generation }
+    tab.agentControlState = "active"
     void this.setTabSuspended(tab, false)
     this.options.emit({ method: "browser:tab-share-changed", params: publicTab(tab) as unknown as Record<string, unknown> })
     return publicTab(tab)
@@ -3470,6 +3481,7 @@ export class BrowserRuntime {
       this.restoreAgentViewportOverride(tab, context)
       tab.context = undefined
       tab.agentLease = undefined
+      tab.agentControlState = undefined
       tab.generation += 1
       tab.inputSequence += 1
     }
@@ -3514,6 +3526,7 @@ export class BrowserRuntime {
     for (const tab of candidates) {
       tab.context = context
       tab.agentLease = { browserSessionId: context.browserSessionId, browserTurnId: context.browserTurnId, generation: tab.generation }
+      tab.agentControlState = "active"
       if (tab.handoff?.status === "handoff") tab.handoff = undefined
       resumed.push(publicTab(tab))
     }
@@ -3787,6 +3800,8 @@ function canContextUseTab(tab: BrowserTab, context: BrowserRequestContext): bool
   return context.actor === "user" || (canAgentUse(tab, context.browserSessionId, context.browserTurnId, tab.generation) && (!context.tabId || context.tabId === tab.tabId))
 }
 
+function agentControlPaused(tab: BrowserTab): boolean { return tab.agentControlState === "paused_by_user" }
+
 function annotationThreadId(tab: BrowserTab, params: Record<string, unknown>): string {
   const value = typeof params.threadId === "string" ? params.threadId.trim() : (tab.ownerThreadId ?? "")
   if (!/^[a-zA-Z0-9._-]{1,200}$/.test(value) || (tab.ownerThreadId && tab.ownerThreadId !== value)) throw browserError("action_denied")
@@ -3821,7 +3836,7 @@ function stableBrowserErrorCode(error: unknown): BrowserErrorCode {
 
 const BROWSER_ERROR_CODES = new Set<BrowserErrorCode>([
   "incompatible_protocol", "browser_unavailable", "invalid_browser_request", "invalid_url", "private_origin_confirmation_required", "stale_target", "tab_not_found", "tab_generation_changed", "confirmation_unavailable", "reference_grant_expired", "action_denied", "unsupported", "executed_unknown", "browser_internal_error",
-  "strict_locator_violation", "actionability_failed", "dialog_blocking",
+  "strict_locator_violation", "actionability_failed", "dialog_blocking", "user_takeover_required",
 ])
 
 function safeOrigin(value: string): string | undefined {
@@ -4160,6 +4175,13 @@ function finiteNumber(value: unknown): number {
   return typeof value === "number" && Number.isFinite(value) ? value : 0
 }
 
+function browserTargetsStable(left: ResolvedBrowserTarget, right: ResolvedBrowserTarget): boolean {
+  return Math.abs(left.x - right.x) <= 0.5
+    && Math.abs(left.y - right.y) <= 0.5
+    && Math.abs(left.width - right.width) <= 0.5
+    && Math.abs(left.height - right.height) <= 0.5
+}
+
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value)
 }
diff --git a/apps/sidecar/src/services/browser/browser-broker.ts b/apps/sidecar/src/services/browser/browser-broker.ts
index 723192dd..d0d0be3e 100644
--- a/apps/sidecar/src/services/browser/browser-broker.ts
+++ b/apps/sidecar/src/services/browser/browser-broker.ts
@@ -426,7 +426,7 @@ function stableJson(value: unknown): string {
 }
 function stableBrowserErrorCode(error: unknown): string {
   const value = error instanceof Error ? error.message : ""
-  return new Set(["browser_unavailable", "invalid_browser_request", "invalid_url", "private_origin_confirmation_required", "stale_target", "tab_not_found", "tab_generation_changed", "confirmation_unavailable", "reference_grant_expired", "action_denied", "strict_locator_violation", "actionability_failed", "dialog_blocking", "unsupported", "executed_unknown"]).has(value) ? value : "browser_internal_error"
+  return new Set(["browser_unavailable", "invalid_browser_request", "invalid_url", "private_origin_confirmation_required", "stale_target", "tab_not_found", "tab_generation_changed", "confirmation_unavailable", "reference_grant_expired", "action_denied", "strict_locator_violation", "actionability_failed", "dialog_blocking", "user_takeover_required", "unsupported", "executed_unknown"]).has(value) ? value : "browser_internal_error"
 }
 
 function inferBackend(explicit: "iab" | "extension" | undefined, params: Record<string, unknown> | undefined): "iab" | "extension" {
diff --git a/apps/web/src/components/browser/BrowserShell.tsx b/apps/web/src/components/browser/BrowserShell.tsx
index 429c3510..eea75a5c 100644
--- a/apps/web/src/components/browser/BrowserShell.tsx
+++ b/apps/web/src/components/browser/BrowserShell.tsx
@@ -667,6 +667,12 @@ export function BrowserShell({
     setActiveTabId('__settings__')
   }
 
+  const resumeAgentControl = () => {
+    void browserRuntime<BrowserTabDescriptor>({ method: 'agentControl:resume', params: { tabId } })
+      .then((next) => acceptDescriptor(next))
+      .catch(() => toast.error('无法将浏览器交还给 Agent'))
+  }
+
   const beginViewportResize = (axis: ViewportResizeAxis, event: ReactPointerEvent<HTMLElement>) => {
     event.preventDefault()
     const startX = event.clientX
@@ -1367,6 +1373,14 @@ export function BrowserShell({
         )}
       </div>
 
+      {descriptor.agentControlState === 'paused_by_user' && (
+        <div className="flex min-h-10 shrink-0 items-center gap-3 border-b border-amber-500/25 bg-amber-500/10 px-3 py-2 text-xs text-foreground">
+          <ShieldAlert className="size-4 shrink-0 text-amber-500" />
+          <span className="min-w-0 flex-1">你已接管此标签页，Agent 浏览器操作已暂停。</span>
+          <Button type="button" variant="outline" size="sm" className="h-7 shrink-0" onClick={resumeAgentControl}>交还给 Agent</Button>
+        </div>
+      )}
+
       {surface === 'right-panel' && ownerThreadId && commentsPanelOpen && annotationComments.length > 0 && (
         <div
           data-annotation-panel="true"
diff --git a/apps/web/src/lib/desktop-api/browser.ts b/apps/web/src/lib/desktop-api/browser.ts
index ace158df..1853c992 100644
--- a/apps/web/src/lib/desktop-api/browser.ts
+++ b/apps/web/src/lib/desktop-api/browser.ts
@@ -26,6 +26,7 @@ export type BrowserRuntimeMethod =
   | 'annotation:session' | 'annotation:mode' | 'annotation:delete' | 'annotation:clear' | 'annotation:migrate' | 'annotation:preview' | 'annotation:screenshot:prepare' | 'annotation:screenshot:read' | 'annotation:submit' | 'annotation:resolve' | 'annotation:mark-read'
   | 'workspace:list' | 'workspace:get' | 'workspace:activate' | 'workspace:reorder' | 'workspace:restore-closed' | 'workspace:import-legacy'
   | 'dialog:handle'
+  | 'agentControl:resume'
   | 'upload'
 
 export function browserRuntime<T = unknown>(input: {
diff --git a/packages/shared/src/types/browser-runtime.ts b/packages/shared/src/types/browser-runtime.ts
index 0baa2d4a..f2713338 100644
--- a/packages/shared/src/types/browser-runtime.ts
+++ b/packages/shared/src/types/browser-runtime.ts
@@ -9,7 +9,7 @@ export type BrowserErrorCode =
   | "incompatible_protocol" | "browser_unavailable" | "invalid_browser_request"
   | "invalid_url" | "private_origin_confirmation_required" | "stale_target"
   | "tab_not_found" | "tab_generation_changed" | "confirmation_unavailable" | "reference_grant_expired"
-  | "action_denied" | "strict_locator_violation" | "actionability_failed" | "dialog_blocking"
+  | "action_denied" | "strict_locator_violation" | "actionability_failed" | "dialog_blocking" | "user_takeover_required"
   | "unsupported" | "executed_unknown" | "browser_internal_error";
 
 export interface BrowserProtocolHandshake {
@@ -74,6 +74,7 @@ export interface BrowserTabDescriptor {
   surface: "main" | "right-panel" | null;
   shareable?: boolean;
   agentClaimed?: boolean;
+  agentControlState?: "active" | "paused_by_user";
   handoffStatus?: "handoff" | "deliverable";
   guestState?: "unmounted" | "attaching" | "ready" | "gone";
   viewportRevision?: number;