feat: keyboard key-press actions; enforce single-tab navigation; UX improvements

fix: prevent base64/binary output leakage to chat stream

Author: hannesrudolph

src/core/prompts/tools/browser-action.ts

@@ -23,6 +23,8 @@ Parameters:
         - Always click in the center of an element (icon, button, link, etc.) based on coordinates derived from a screenshot.
     * type: Type a string of text on the keyboard. You might use this after clicking on a text field to input text.
         - Use with the \`text\` parameter to provide the string to type.
+    * press: Press a single keyboard key (e.g., Enter, Tab, Escape).
+        - Use with the \`text\` parameter to provide the key name (e.g., Enter).
     * resize: Resize the viewport to a specific w,h size.
         - Use with the \`size\` parameter to specify the new size.
     * scroll_down: Scroll down the page by one page height.
@@ -39,7 +41,7 @@ Parameters:
     * Example: <text>Hello, world!</text>
 Usage:
 <browser_action>
-<action>Action to perform (e.g., launch, click, type, scroll_down, scroll_up, close)</action>
+<action>Action to perform (e.g., launch, click, type, press, scroll_down, scroll_up, close)</action>
 <url>URL to launch the browser at (optional)</url>
 <coordinate>x,y coordinates (optional)</coordinate>
 <text>Text to type (optional)</text>

src/core/tools/browserActionTool.ts

@@ -90,7 +90,7 @@ export async function browserActionTool(
 					}
 				}
 
-				if (action === "type") {
+				if (action === "type" || action === "press") {
 					if (!text) {
 						cline.consecutiveMistakeCount++
 						cline.recordToolError("browser_action")
@@ -133,6 +133,9 @@ export async function browserActionTool(
 					case "type":
 						browserActionResult = await cline.browserSession.type(text!)
 						break
+					case "press":
+						browserActionResult = await cline.browserSession.press(text!)
+						break
 					case "scroll_down":
 						browserActionResult = await cline.browserSession.scrollDown()
 						break
@@ -153,6 +156,7 @@ export async function browserActionTool(
 				case "click":
 				case "hover":
 				case "type":
+				case "press":
 				case "scroll_down":
 				case "scroll_up":
 				case "resize":

src/services/browser/BrowserSession.ts

@@ -453,6 +453,64 @@ export class BrowserSession {
 		}
 	}
 
+	/**
+	 * Force links and window.open to navigate in the same tab.
+	 * This makes clicks on anchors with target="_blank" stay in the current page
+	 * and also intercepts window.open so SPA/open-in-new-tab patterns don't spawn popups.
+	 */
+	private async forceLinksToSameTab(page: Page): Promise<void> {
+		try {
+			await page.evaluate(() => {
+				try {
+					// Ensure we only install once per document
+					if ((window as any).__ROO_FORCE_SAME_TAB__) return
+					;(window as any).__ROO_FORCE_SAME_TAB__ = true
+
+					// Override window.open to navigate current tab instead of creating a new one
+					const originalOpen = window.open
+					window.open = function (url: string | URL, target?: string, features?: string) {
+						try {
+							const href = typeof url === "string" ? url : String(url)
+							location.href = href
+						} catch {
+							// fall back to original if something unexpected occurs
+							try {
+								return originalOpen.apply(window, [url as any, "_self", features]) as any
+							} catch {}
+						}
+						return null as any
+					} as any
+
+					// Rewrite anchors that explicitly open new tabs
+					document.querySelectorAll('a[target="_blank"]').forEach((a) => {
+						a.setAttribute("target", "_self")
+					})
+
+					// Defensive capture: if an element still tries to open in a new tab, force same-tab
+					document.addEventListener(
+						"click",
+						(ev) => {
+							const el = (ev.target as HTMLElement | null)?.closest?.(
+								'a[target="_blank"]',
+							) as HTMLAnchorElement | null
+							if (el && el.href) {
+								ev.preventDefault()
+								try {
+									location.href = el.href
+								} catch {}
+							}
+						},
+						{ capture: true, passive: false },
+					)
+				} catch {
+					// no-op; forcing same-tab is best-effort
+				}
+			})
+		} catch {
+			// If evaluate fails (e.g., cross-origin/state), continue without breaking the action
+		}
+	}
+
 	/**
 	 * Handles mouse interaction with network activity monitoring
 	 */
@@ -463,6 +521,9 @@ export class BrowserSession {
 	): Promise<void> {
 		const [x, y] = coordinate.split(",").map(Number)
 
+		// Force any new-tab behavior (target="_blank", window.open) to stay in the same tab
+		await this.forceLinksToSameTab(page)
+
 		// Set up network request monitoring
 		let hasNetworkActivity = false
 		const requestListener = () => {
@@ -506,6 +567,27 @@ export class BrowserSession {
 		})
 	}
 
+	async press(key: string): Promise<BrowserActionResult> {
+		return this.doAction(async (page) => {
+			// Allow common aliases
+			const mapping: Record<string, string> = {
+				esc: "Escape",
+				return: "Enter",
+				escape: "Escape",
+				enter: "Enter",
+				tab: "Tab",
+				space: "Space",
+				arrowup: "ArrowUp",
+				arrowdown: "ArrowDown",
+				arrowleft: "ArrowLeft",
+				arrowright: "ArrowRight",
+			}
+			const normalized = key.trim()
+			const mapped = mapping[normalized.toLowerCase()] ?? key
+			await page.keyboard.press(mapped)
+		})
+	}
+
 	/**
 	 * Scrolls the page by the specified amount
 	 */

src/services/browser/__tests__/BrowserSession.spec.ts

@@ -229,4 +229,65 @@ describe("BrowserSession", () => {
 			expect(mockBrowser.close).not.toHaveBeenCalled()
 		})
 	})
+
+	it("forces same-tab behavior before click", async () => {
+		// Prepare a minimal mock page with required APIs
+		const page: any = {
+			on: vi.fn(),
+			off: vi.fn(),
+			screenshot: vi.fn().mockResolvedValue("mockScreenshotBase64"),
+			url: vi.fn().mockReturnValue("https://example.com"),
+			waitForNavigation: vi.fn().mockResolvedValue(undefined),
+			evaluate: vi.fn().mockResolvedValue(undefined),
+			mouse: {
+				click: vi.fn().mockResolvedValue(undefined),
+				move: vi.fn().mockResolvedValue(undefined),
+			},
+		}
+
+		;(browserSession as any).page = page
+
+		// Spy on the forceLinksToSameTab helper to ensure it's invoked
+		const forceSpy = vi.fn().mockResolvedValue(undefined)
+		;(browserSession as any).forceLinksToSameTab = forceSpy
+
+		await browserSession.click("10,20")
+
+		expect(forceSpy).toHaveBeenCalledTimes(1)
+		expect(forceSpy).toHaveBeenCalledWith(page)
+		expect(page.mouse.click).toHaveBeenCalledWith(10, 20)
+	})
+})
+
+describe("keyboard press", () => {
+	it("presses a keyboard key", async () => {
+		// Prepare a minimal mock page with required APIs
+		const page: any = {
+			on: vi.fn(),
+			off: vi.fn(),
+			screenshot: vi.fn().mockResolvedValue("mockScreenshotBase64"),
+			url: vi.fn().mockReturnValue("https://example.com"),
+			waitForNavigation: vi.fn().mockResolvedValue(undefined),
+			evaluate: vi.fn().mockResolvedValue(undefined),
+			keyboard: {
+				press: vi.fn().mockResolvedValue(undefined),
+				type: vi.fn().mockResolvedValue(undefined),
+			},
+		}
+
+		// Create a fresh BrowserSession with a mock context
+		const mockCtx: any = {
+			globalState: { get: vi.fn(), update: vi.fn() },
+			globalStorageUri: { fsPath: "/mock/global/storage/path" },
+			extensionUri: { fsPath: "/mock/extension/path" },
+		}
+		const session = new BrowserSession(mockCtx)
+
+		;(session as any).page = page
+
+		await session.press("Enter")
+
+		expect(page.keyboard.press).toHaveBeenCalledTimes(1)
+		expect(page.keyboard.press).toHaveBeenCalledWith("Enter")
+	})
 })

src/shared/ExtensionMessage.ts

@@ -432,6 +432,7 @@ export const browserActions = [
 	"click",
 	"hover",
 	"type",
+	"press",
 	"scroll_down",
 	"scroll_up",
 	"resize",