feat: surface failed network requests in the console region

[Steel-tech]

Closes #1.

Failed network requests now paint in the pane's console region — ✖ 404 GET <url> for HTTP 400–599 and ✖ no response GET <url> for connection-level failures — in both polling and live-stream modes.

Why a poll, not the stream

agent-browser 0.33.2's per-session WebSocket emits only url/frame/console/page_error/tabs (verified in the upstream source) — there is no network event to consume. The pane instead diffs network requests --type xhr,fetch,document --json by requestId with prune-to-current-log semantics, because a live spike showed the daemon's log can be wiped without --clear (browser relaunch) and pid.N requestIds can restart.

Key decisions

• Separate exec, not the --bail snapshot batch — an engine without the network subcommand degrades only failure reporting, never frames/console. network() is duck-typed like streamEnable, so existing test fakes and older engines stay working.
• Seen-set = reported or resolved-OK ids only — a request observed in flight whose 500 lands one poll later still reports; null-status entries become no response only past a 15 s entry-age threshold (poll-count heuristics break under pollDelay backoff).
• Silent baseline on attach/re-attach — stale failures from an hours-old agent session never replay. On the pane's own navigate(), baseline splits on the existed check: real read before open for existing sessions, state-only seeding for fresh ones (a pre-open read would auto-create a session and break the ownership rule).
• Noise control — dedupe by method+URL+status within a 60 s refreshing window (Chrome nav retries and app retry loops paint once), per-poll cap of 5 with an …and N more overflow line.
• Unbounded-log self-defense — tracked_requests is append-only in 0.33.2 with no eviction; on a maxBuffer/timeout-class failure the feed latches off for the attach with a one-time console note instead of retrying a known-fatal multi-MiB exec every tick.
• Passivity preserved — no network call before attached, never --clear (stub test asserts it), live-mode timer cleared first in dropLive() with a shared in-flight guard.

Testing

• 21 new tests: pure diff/format helpers, CLI contract via bash stub, poll-mode tick integration (baseline, re-attach, degrade, latch-off, navigate both paths, console-reconcile isolation), live-timer behavior (cadence, drop, in-flight guard).
• Full suite: 223/224 pass. The one failure is the pre-existing e2e: goLive receives pushed frames… test, which also fails on the base branch (agent-browser 0.33.2 vs the 0.28.x the repo was built against) — not touched by this change.
• Live smoke against agent-browser 0.33.2: in-page fetch 404 → status: 404 entry; connection-refused fetch → null-status entry (ages into no response); refused navigation → null-status Document with Chrome's retry duplicate (deduped).

Code review: plan went through a 4-persona doc review (coherence, feasibility, scope, adversarial) with all P1 findings folded in pre-implementation; dedicated diff review skipped (no Tier 1 tool for working diffs; Tier 2 escalation criteria not met — single subsystem, no sensitive surface).

Post-Deploy Monitoring & Validation

No server-side deploy — ships with the plugin. Validation after herdr plugin link/update (close and reopen the pane to load the new renderer):

• Open a localhost dev page, trigger a failing fetch → ✖ line within one poll interval (poll mode) or ~4 s (live mode).
• Healthy signal: console region stays quiet on pages without failures; no agent-browser not responding banner.
• Failure signal: ✖ network reporting off — request log too large on long-lived sessions is expected self-defense, not a bug; anything else spamming the region → check the 60 s dedupe window.
• Rollback: reinstall the previous plugin version; the feature has no persistent state.

Follow-ups (deferred)

• Upstream feature request to vercel-labs/agent-browser for a network stream event (would replace the live-mode timer) — read their CONTRIBUTING first.
• Upstream issue: tracked_requests unbounded growth (append-only Vec, --clear is the only eviction).

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 26958f45-11f4-41f7-a46d-68b7e9348c8c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}