# v0.14.0 — Browser input simulation upgrade (hover + CDP click)

The agent's mouse and keyboard pipeline is rebuilt around Chrome DevTools Protocol. Synthetic DOM events are gone for click; hover is new. Sites that previously rejected Pie's clicks because of `isTrusted` checks — login flows, payment pages, anti-bot forms — now work.

## `hover` tool

```
hover({ tabId, frameId, index, expectedFrameVersion })
```

Dispatches a real CDP `mouseMoved` event to the element at `data-pie-idx` in the given frame. Hover-only menus, tooltip triggers, and hover cards that were previously invisible to the agent are now reachable: hover → `read_page` → see expanded content → click.

## `click` upgrade

`click` now uses a CDP `mouseMoved → mousePressed → mouseReleased` three-event sequence instead of a synthetic `(el).click()` call. The events carry `isTrusted: true` from the browser's perspective, which unblocks:

- Sites that gate submission on `event.isTrusted` (payment buttons, login forms)
- Anti-bot checks that look for DOM-dispatch vs. real input events
- React / Vue synthetic event handlers that set `isTrusted` as a security guard

RTT increases from <5 ms to 50–150 ms per click. This is negligible against per-iteration LLM latency.

## Inline consent card

Both `hover` and `click` (and the existing `type` / keyboard tools) now share a single tri-state flag `cdp_input_enabled`. The first time the agent calls any of these tools on a fresh profile, the sidepanel shows an inline consent card explaining the Chrome yellow debugger bar. The user can Enable or decline (Not now). The task waits for the response; no tool call is dispatched until the user decides.

Chrome's yellow "Pie is debugging this browser" bar appears in the top-right of every tab while a task is active and CDP is connected. It disappears when the task ends.

## Cross-origin iframe clicks

`click` and `hover` now resolve element geometry via CDP `DOM.getNodeForFrameOwner` + `DOM.getBoxModel`. CDP runs in the browser process and is not bound by same-origin policy, so clicking inside a cross-origin iframe (YouTube embeds, Stripe payment frames, Recaptcha) works the same as clicking in the top frame.

## Breaking changes

- **`click` now requires CDP input simulation to be enabled.** Users who previously declined keyboard simulation (or who have never set up the extension) will see `click` fail with a "CDP input is disabled — enable Browser input simulation in Settings" error until they enable the toggle.
- **Settings label changed.** The toggle was "Keyboard simulation"; it is now "Browser input simulation (CDP)". The setting covers hover, click, and keyboard in one switch.

## Internal

- New storage key `cdp_input_enabled` (tri-state: `undefined | true | false`) replaces `keyboard_simulation_enabled`. `migrateLegacyKeyboardFlag()` runs at SW install / startup: if the new key is unset, copies the old boolean value 1:1 and deletes the legacy key. Users who had keyboard simulation enabled will not see the consent card.
- New cross-layer invariant test `src/__tests__/cross-layer/cdp-tools-routing.test.ts` (R-cdp-1): asserts that every call to `acquireCdpSession` in the codebase goes through `requireCdpInput` or the approved screenshot shim. New callers that bypass it cause the test to fail at CI.
- R-iframe-1 extended: `hover` joins `click/type/select` in the write-class tools that must declare `frameId`. The module-load IIFE in `tools.ts` now checks `getMouseTools` in addition to `BUILT_IN_TOOLS`.

## 中文摘要

用 CDP 真实鼠标事件重建了点击与悬停流程。

- 新增 `hover` 工具：向目标元素派发 CDP `mouseMoved`，展开悬停菜单 / tooltip / hover card。
- `click` 从合成 `el.click()` 升级为 CDP `mouseMoved → mousePressed → mouseReleased`；事件 `isTrusted: true`，登录表单 / 支付按钮 / 反机器人检测不再拦截。
- 跨域 iframe 可点击：CDP 在浏览器进程侧运行，不受同源策略限制；YouTube embed、Stripe 支付框均可操作。
- 统一三态标志 `cdp_input_enabled`（`undefined | true | false`）替换旧 `keyboard_simulation_enabled`；首次触发时展示侧边栏内嵌授权卡，旧用户自动迁移无需重新授权。

主要破坏性改动：
- `click` 现在依赖 CDP 权限；未启用的用户会看到明确报错，需在 Settings 开启"Browser input simulation (CDP)"
- Settings 开关标签从"Keyboard simulation"改为"Browser input simulation (CDP)"
