This is a comment left during a code review.
Path: src/browser/pw-tools-core.interactions.ts
Line: 690-706

Comment:
**`evaluate` and `wait --fn` bypass `evaluateEnabled` security gate**

`executeSingleAction` handles both `evaluate` and `wait` (with `fn`) actions directly without checking the `evaluateEnabled` config flag. In the HTTP route handler (`agent.act.ts`), there are explicit 403 guards:

```typescript
// agent.act.ts – direct evaluate route
if (!evaluateEnabled) {
  return jsonError(res, 403, "act:evaluate is disabled by config...");
}

// agent.act.ts – direct wait route
if (fn && !evaluateEnabled) {
  return jsonError(res, 403, "wait --fn is disabled by config...");
}
```

These guards are entirely skipped when either action kind appears inside a `batch` payload, because `executeSingleAction` calls `evaluateViaPlaywright` and `waitForViaPlaywright` unconditionally. An operator who has set `evaluateEnabled=false` to restrict arbitrary JS execution in the browser will have that restriction bypassed by wrapping the call in a batch.

The fix is to pass `evaluateEnabled` into `executeSingleAction` (or `batchViaPlaywright`) and replicate the same guards:

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: src/browser/routes/agent.act.ts
Line: 369-382

Comment:
**Raw, unvalidated user input passed directly into batch executor**

`body.actions` is taken as a raw JavaScript array without any field-level sanitization and forwarded straight to `batchViaPlaywright`. Every other action kind in this route handler runs its inputs through helpers like `toStringOrEmpty`, `toBoolean`, `toNumber`, `parseClickButton`, etc. before dispatching.

Because `BrowserActRequest` is a TypeScript type (erased at runtime), the cast inside `executeSingleAction` provides no runtime safety. A few concrete consequences:

1. A `{ kind: "evaluate", fn: "…" }` object bypasses the `evaluateEnabled` check (see the other comment), but also passes `fn` to `evaluateViaPlaywright` without the `toStringOrEmpty` normalisation that the direct route applies.
2. A `{ kind: "click", ref: {}, selector: null }` object arrives in `requireRefOrSelector` as non-string values; the current guard (`typeof ref === "string" ? … : ""`) handles this safely, but future action kinds may not.
3. Action-specific defaults (e.g., `doubleClick` coerced via `toBoolean`) are never applied, so the typed functions receive raw JSON values.

The batch handler should at minimum validate that each element is a plain object with a known `kind` string before passing it to `executeSingleAction`.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: src/browser/routes/agent.act.ts
Line: 35-46

Comment:
**`SELECTOR_ALLOWED_KINDS` set re-created on every request**

A new `Set` object is allocated for every incoming HTTP request. Since the set's contents are static, this should be a module-level constant:

```suggestion
    const SELECTOR_ALLOWED_KINDS = new Set([
      "batch",
      "click",
      "drag",
      "hover",
      "scrollIntoView",
      "select",
      "type",
      "wait",
    ]);
    if (Object.hasOwn(body, "selector") && !SELECTOR_ALLOWED_KINDS.has(kind)) {
```

Move the `const SELECTOR_ALLOWED_KINDS = new Set([...])` declaration to module scope (outside `registerBrowserAgentActRoutes`) so it is created once and shared across all requests.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: src/browser/pw-tools-core.interactions.ts
Line: 698-706

Comment:
**No recursion depth limit for nested batches**

`executeSingleAction` delegates nested `batch` actions back to `batchViaPlaywright`, which calls `executeSingleAction` again. There is no depth limit, so a malicious or buggy payload with deeply nested batches will exhaust the JS call stack (V8 typically limits at ~10 000 frames). Consider tracking and enforcing a maximum nesting depth (e.g., 5) and returning an error result rather than crashing:

```typescript
async function executeSingleAction(
  action: BrowserActRequest,
  cdpUrl: string,
  targetId?: string,
  depth = 0,
): Promise<void> {
  // ...
  case "batch":
    if (depth >= MAX_BATCH_DEPTH) {
      throw new Error("Maximum batch nesting depth exceeded");
    }
    await batchViaPlaywright({ ..., depth: depth + 1 });
    break;
```

How can I resolve this? If you propose a fix, please make it concise.