fix(govern): observe({page}) routes through the live-capture path

src/govern.mjs

@@ -87,7 +87,8 @@ export class GovernedBrowser {
   _log(entry) { this.audit.push({ ...entry }); return entry; }
 
   /**
-   * Perception plane. Accepts either static HTML or a live bridge target, runs
+   * Perception plane. Accepts static HTML, a live bridge target, or a
+   * caller-owned `page` (a broker checkout, an agent's active session), runs
    * it through the firewall, and returns the safe, model-facing view.
    * @returns {Promise<{observation, detection, decision, safe}>}
    */
@@ -97,7 +98,11 @@ export class GovernedBrowser {
     // computed styles resolve class-based hiding. The static parser is the
     // browserless fallback (CI, offline demos), not a silent override that
     // would bypass the whole reason the bridge exists on a hostile page.
-    const hasBridge = input.browserWSEndpoint != null || input.browserURL != null;
+    // A caller-owned `page` is a bridge target too: captureFromBridge reuses
+    // it as-is (no navigation when no url/html is given, lifecycle untouched),
+    // so an agent's CURRENT page state reads through the live extractor —
+    // without this, observe({page}) fell through to captureFromHtml(undefined).
+    const hasBridge = input.browserWSEndpoint != null || input.browserURL != null || input.page != null;
     const observation = hasBridge
       ? await captureFromBridge(input)
       : captureFromHtml(input.html, { url: input.url });

test/broker.test.mjs

@@ -5,7 +5,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { ContextBroker } from '../src/broker.mjs';
-import { KeeperStub } from '../src/govern.mjs';
+import { GovernedBrowser, KeeperStub } from '../src/govern.mjs';
 import { captureFromBridge } from '../src/capture.mjs';
 
 const tick = () => new Promise((r) => setTimeout(r, 0));
@@ -131,3 +131,22 @@ test('captureFromBridge reuses a provided page (broker session) without touching
   assert.equal(obs.nodes.length, 1);
   assert.equal(obs.origin, 'https://acme.example');
 });
+
+test('observe({page}) routes through the live-capture path, not the static parser', async () => {
+  const page = {
+    gotos: [],
+    async goto(u) { this.gotos.push(u); },
+    async evaluate() {
+      return { title: 'Live', nodes: [{ id: 'n0', text: 'hello from the live page', source: 'text', tag: 'p', hidden: false, hiddenReasons: [] }] };
+    },
+    url: () => 'https://live.example/session',
+  };
+  const gov = new GovernedBrowser();
+  const res = await gov.observe({ page });
+  // Regression: a bare {page} used to miss the hasBridge check and fall
+  // through to captureFromHtml(undefined). It must read the LIVE page.
+  assert.equal(res.observation.capturedBy, 'cdp');
+  assert.equal(res.observation.url, 'https://live.example/session');
+  assert.deepEqual(page.gotos, []); // current state read as-is, no navigation
+  assert.ok(res.safe.text.includes('hello from the live page'));
+});