full native (#754)

* full native

* fix: apply cargo fmt formatting

* fix: prevent zip path traversal in Chromium installer

Use enclosed_name() to sanitize zip entry paths, preventing malicious
archives from writing outside the extraction directory.

* improvements

* fix: apply cargo fmt formatting

* benchmarks

* bench

* updates

* fixes

cli/src/native/cdp/chrome.rs

@@ -190,7 +190,7 @@ pub fn launch_chrome(options: &LaunchOptions) -> Result<ChromeProcess, String> {
     let chrome_path = match &options.executable_path {
         Some(p) => PathBuf::from(p),
         None => {
-            find_chrome().ok_or("Chrome not found. Install Chrome or use --executable-path.")?
+            find_chrome().ok_or("Chrome not found. Run `agent-browser install` to download Chrome, or use --executable-path.")?
         }
     };
 
@@ -320,6 +320,12 @@ fn chrome_launch_error(message: &str, stderr_lines: &[String]) -> String {
 }
 
 pub fn find_chrome() -> Option<PathBuf> {
+    // 1. Check Chrome downloaded by `agent-browser install`
+    if let Some(p) = crate::install::find_installed_chrome() {
+        return Some(p);
+    }
+
+    // 2. Check system-installed Chrome
     #[cfg(target_os = "macos")]
     {
         let candidates = [
@@ -333,10 +339,6 @@ pub fn find_chrome() -> Option<PathBuf> {
                 return Some(p);
             }
         }
-
-        if let Some(p) = find_playwright_chromium() {
-            return Some(p);
-        }
     }
 
     #[cfg(target_os = "linux")]
@@ -357,10 +359,6 @@ pub fn find_chrome() -> Option<PathBuf> {
                 }
             }
         }
-
-        if let Some(p) = find_playwright_chromium() {
-            return Some(p);
-        }
     }
 
     #[cfg(target_os = "windows")]
@@ -383,6 +381,11 @@ pub fn find_chrome() -> Option<PathBuf> {
         }
     }
 
+    // 3. Fallback: check Playwright's browser cache (for existing installs)
+    if let Some(p) = find_playwright_chromium() {
+        return Some(p);
+    }
+
     None
 }
 
@@ -500,7 +503,7 @@ fn should_disable_sandbox(existing_args: &[String]) -> bool {
 }
 
 /// Search Playwright's browser cache for a Chromium binary.
-/// This is where `agent-browser install` (via `npx playwright install chromium`) puts it.
+/// Legacy fallback for users who previously installed Chromium via Playwright.
 fn find_playwright_chromium() -> Option<PathBuf> {
     let mut search_dirs = Vec::new();
 

cli/src/native/cdp/lightpanda.rs

@@ -342,6 +342,7 @@ mod tests {
         socket.write_all(response.as_bytes()).await.unwrap();
     }
 
+    #[cfg(unix)]
     #[tokio::test]
     async fn waits_for_ready_without_logs() {
         let port = unused_port();
@@ -369,6 +370,7 @@ mod tests {
         let _ = child.wait();
     }
 
+    #[cfg(unix)]
     #[tokio::test]
     async fn child_exit_surfaces_logs() {
         let port = unused_port();
@@ -389,6 +391,7 @@ mod tests {
         assert!(err.contains("boom"));
     }
 
+    #[cfg(unix)]
     #[tokio::test]
     async fn timeout_reports_last_probe_error() {
         let port = unused_port();