v0.70.8

browser_type said "typed into" from having sent the keys, not from what the field kept. A field that a store rewrote a moment after the focus, one that took only digits, or one with a maxlength all answered "typed into" while holding something else; long text never finished inside the call; and two calls to the same browser interleaved their keys. Now every character is a real key at any length (text past what a call can type keeps going in the background, and the next action reports how it ended), input to one browser queues behind one lock, the pause between the focus and the first key is the wrapper's own (fill waits for it since invisible-playwright 0.25.8), and one reading of the field says what it kept: kept, reformatted, cut, emptied, only the tail, or focus moved on as in a one-time-code box. Nothing is retried, so a chip field gets one chip.

browser_upload_files attaches local files through the page's own file chooser: the visible input, button or label is clicked with the real pointer, a hidden input is opened through its label (or refused, naming the button to pass), and the files arrive after the session's hesitation rather than 60 ms later. It is off unless INVISIBLE_MCP_UPLOAD_DIRS lists absolute directories; each path is resolved, links included, and must sit inside one of them, hidden components and alternate data streams are refused, and per-call budgets apply. The engine gets a private copy that goes away with the session.

Co-authored-by: Richard Powell <1369873+richardpowellus@users.noreply.github.com>