@angelky7/dsh-browser-control 1.1.0 → 1.3.0

package/README.en.md

@@ -64,8 +64,8 @@ In one line: **for "use MY browser" tasks (logged-in Bilibili, Zhihu, admin pane
 
 | File | Purpose |
 |---|---|
-| [DSH-Browser-Control-v1.0.19.zip](https://github.com/angelky7/dsh-browser-control/releases/download/v1.0.19/DSH-Browser-Control-v1.0.19.zip) | Chrome extension (unzip and load; standard zip header, Explorer can expand it directly) |
-| [dsh-browser-control-plugin-v1.0.19.zip](https://github.com/angelky7/dsh-browser-control/releases/download/v1.0.19/dsh-browser-control-plugin-v1.0.19.zip) | dsh plugin (offline fallback; online installs use Option A/B) |
+| [DSH-Browser-Control-v1.3.0.zip](https://github.com/angelky7/dsh-browser-control/releases/download/v1.3.0/DSH-Browser-Control-v1.3.0.zip) | Chrome extension (unzip and load; extension code is unchanged since 1.2.0 — no reinstall needed) |
+| [dsh-browser-control-plugin-v1.3.0.zip](https://github.com/angelky7/dsh-browser-control/releases/download/v1.3.0/dsh-browser-control-plugin-v1.3.0.zip) | dsh plugin (offline fallback; online installs use Option A/B) |
 
 ## Install the Chrome extension (30 seconds)
 
@@ -95,7 +95,7 @@ npm install @angelky7/dsh-browser-control
 > **A version published minutes ago may not install yet, and that is not a broken package.** `dsh plugin add` pins the dependency to an **exact version**, while pnpm resolves it from **your configured registry** — for many users that is `registry.npmmirror.com`, which syncs from the official registry with a delay (measured: the official registry had 1.0.10 published while the mirror's `latest` still said 1.0.8). If you hit `ERR_PNPM_NO_MATCHING_VERSION ... while fetching it from https://registry.npmmirror.com/`, pick one:
 >
 > 1. Use the official registry for this install: `dsh plugin --profile web add @angelky7/dsh-browser-control@<version> --registry=https://registry.npmjs.org/`
-> 2. Use the offline asset from the Release, `dsh-browser-control-plugin-v<version>.zip`: unzip it, then `dsh plugin --profile web add file:<the unzipped directory>`
+> 2. Use the offline asset from the Release, `dsh-browser-control-plugin-v<version>.zip`: unzip it, then point `dsh plugin --profile web add file:<…>` at **the layer that contains `package.json`** (some releases wrapped the entries in an extra folder — point at the layer that contains `package.json`)
 > 3. Wait for the mirror and retry: `curl -s https://registry.npmmirror.com/@angelky7/dsh-browser-control` — once the version appears there and `dist-tags.latest` moved, the plain command works
 >
 > **A second failure looks similar but has the opposite cause — do not touch your registry for it.** dsh profiles ship a 24-hour package-age supply-chain gate (`minimumReleaseAge: 1440` in `node_modules/.pnpm-workspace-state-v1.json`). A version younger than that is rejected with `ERR_PNPM_NO_MATURE_MATCHING_VERSION`, and the message quotes `was published at …, within the minimumReleaseAge cutoff (…)` — the version **does** exist, it is just too new. Waiting past the cutoff is the only fix. Discriminator: `NO_MATCHING_VERSION` = your registry does not have that version; `NO_MATURE_MATCHING_VERSION` = it has it, but the version is younger than 24h.
@@ -104,7 +104,7 @@ npm install @angelky7/dsh-browser-control
 
 ```bash
 # Straight from GitHub
-dsh plugin --profile web add "github:angelky7/dsh-browser-control#v1.0.19"
+dsh plugin --profile web add "github:angelky7/dsh-browser-control#v1.3.0"
 
 # Local checkout for debugging (note: the explicit file: prefix is required)
 dsh plugin --profile web add "file:D:\path\to\dsh-browser-control"
@@ -255,6 +255,7 @@ curl -X POST http://127.0.0.1:9777/api/command \
 | `browser_find` | Query elements by CSS selector, returning count and viewport rects (read-only, v1.0.9+) |
 | `browser_dialog` | Read or set the native-dialog policy accept/dismiss/manual, plus the recent dialog log (v1.0.9+) |
 | `browser_hold` | Put or remove a cancellable take-over overlay on a tab (tells the user, stops mis-clicks); `covered:false` says why it could not cover the page. A soft layer, not a security boundary |
+| `browser_cookies` | Read/set/remove cookies visible to a tab (`action: get/set/remove`; get takes a `domain` filter, set/remove need a `url` or `domain` anchor, remove re-checks and reports `remaining`). **Cookie values are credentials** — a get puts them fully into the model-visible text; see SECURITY.md |
 | `browser_tabs` | Tab management (list/open/close/activate/group/ungroup; see "What agent tabs look like") |
 | `browser_evaluate` | Run arbitrary JS |
 | `browser_screenshot` | Capture page screenshot |

package/README.md

@@ -64,8 +64,8 @@ Chrome 扩展（CDP 驱动）
 
 | 文件 | 说明 |
 |---|---|
-| [DSH-Browser-Control-v1.0.19.zip](https://github.com/angelky7/dsh-browser-control/releases/download/v1.0.19/DSH-Browser-Control-v1.0.19.zip) | Chrome 扩展（解压后加载；标准 zip 头，资源管理器可直接展开） |
-| [dsh-browser-control-plugin-v1.0.19.zip](https://github.com/angelky7/dsh-browser-control/releases/download/v1.0.19/dsh-browser-control-plugin-v1.0.19.zip) | dsh 插件（离线兜底，在线装直接用方式 A/B） |
+| [DSH-Browser-Control-v1.3.0.zip](https://github.com/angelky7/dsh-browser-control/releases/download/v1.3.0/DSH-Browser-Control-v1.3.0.zip) | Chrome 扩展（解压后加载；与 1.2.0 相比扩展代码无改动，已装 1.2.0 不必重装） |
+| [dsh-browser-control-plugin-v1.3.0.zip](https://github.com/angelky7/dsh-browser-control/releases/download/v1.3.0/dsh-browser-control-plugin-v1.3.0.zip) | dsh 插件（离线兜底，在线装直接用方式 A/B） |
 
 ## 安装 Chrome 扩展（30 秒）
 
@@ -95,7 +95,7 @@ npm install @angelky7/dsh-browser-control
 > **刚发布的新版本可能一时装不上，那不是插件坏了。** `dsh plugin add` 会把依赖钉成**确切版本号**，而 pnpm 用的是**你自己配置的源**——国内默认常常是 `registry.npmmirror.com`，它同步官方源有延迟（实测 1.0.10 在官方源已发布时，镜像的 `latest` 还停在 1.0.8）。撞上 `ERR_PNPM_NO_MATCHING_VERSION ... while fetching it from https://registry.npmmirror.com/` 时有三条路：
 >
 > 1. 这一次显式走官方源：`dsh plugin --profile web add @angelky7/dsh-browser-control@<版本> --registry=https://registry.npmjs.org/`
-> 2. 用 Release 里的离线包 `dsh-browser-control-plugin-v<版本>.zip`，解压后 `dsh plugin --profile web add file:<解压目录>`
+> 2. 用 Release 里的离线包 `dsh-browser-control-plugin-v<版本>.zip`，解压后对**含有 `package.json` 的那一层**执行 `dsh plugin --profile web add file:<那一层>`（个别版本的 zip 会把条目包进一层子目录，以解压后**含有 `package.json` 的那一层**为准）
 > 3. 等镜像同步后重试原命令：`curl -s https://registry.npmmirror.com/@angelky7/dsh-browser-control`，看到该版本、且 `dist-tags.latest` 也跟上即可
 >
 > **另一种装不上长得像、原因完全不同，别改 registry。** dsh 的 profile 自带 24 小时「包龄」供应链闸门（`node_modules/.pnpm-workspace-state-v1.json` 里的 `minimumReleaseAge: 1440`）。发布未满 24 小时的版本被它拦下时报的是 `ERR_PNPM_NO_MATURE_MATCHING_VERSION`，而且报文里会直接写 `was published at …, within the minimumReleaseAge cutoff (…)`——版本是**存在**的，只是太新。这种只有等满 cutoff 时刻这一条路（改 registry、离线包都不必）。两个码的判据：`NO_MATCHING_VERSION` = 你配置的源里没有这个版本；`NO_MATURE_MATCHING_VERSION` = 有，但没满 24 小时。
@@ -104,7 +104,7 @@ npm install @angelky7/dsh-browser-control
 
 ```bash
 # 直接从 GitHub 安装
-dsh plugin --profile web add "github:angelky7/dsh-browser-control#v1.0.19"
+dsh plugin --profile web add "github:angelky7/dsh-browser-control#v1.3.0"
 
 # 本地目录调试（注意：必须显式 file: 前缀）
 dsh plugin --profile web add "file:D:\path\to\dsh-browser-control"
@@ -249,6 +249,7 @@ curl -X POST http://127.0.0.1:9777/api/command \
 | `browser_find` | 按 CSS 选择器查元素，返回数量与位置尺寸（只读，v1.0.9+） |
 | `browser_dialog` | 读改原生弹窗应答策略 accept/dismiss/manual，并回最近弹窗记录（v1.0.9+） |
 | `browser_hold` | 在某个标签页上加/撤一层可取消的接管浮层（告知用户 + 防误触）；`covered:false` 时说明盖不住的原因。软层，不是安全边界 |
+| `browser_cookies` | 读/设/删某标签页可见的 cookie（`action: get/set/remove`；get 带 `domain` 过滤，set/remove 需要 `url` 或 `domain` 锚点，remove 复查并回报 `remaining`）。**cookie 的值是凭据**，get 会把值完整放进模型可见文本——见 SECURITY.md |
 | `browser_tabs` | 标签页管理（列表/新建/关闭/切换/归组/拆组；见「agent 开的标签长什么样」） |
 | `browser_evaluate` | 执行任意 JS |
 | `browser_screenshot` | 截取页面截图 |

package/lib/index.js

@@ -873,7 +873,8 @@ const READ_ONLY_ALLOWED = /* @__PURE__ */ new Set([
 	"wait",
 	"tabs.list",
 	"console.log",
-	"network.log"
+	"network.log",
+	"cookies.get"
 ]);
 /**
 * 会执行**任意页面脚本**的扩展命令。这条与只读档分开管，因为用户可能想「可以读、
@@ -938,6 +939,15 @@ function policyRefusal(command, flags, params) {
 * fix, so the model can tell the user what to do instead of hanging.
 * @module @deepseek-ai/dsh-browser-bridge
 */
+/** Navigation wait ceiling (same as browser_wait); the bridge gets this plus BRIDGE_MARGIN_MS. */
+const NAV_MAX_MS = 12e4;
+/**
+* Extra time handed to the bridge on top of the navigation budget. Without it a
+* caller-requested budget longer than the bridge default (60s) would be beaten by
+* the bridge, and the model would get `command_timeout` (effect unknown) instead
+* of a navigation timeout (nothing was touched) - two very different next steps.
+*/
+const BRIDGE_MARGIN_MS = 2e3;
 /** Cordis plugin name used by loader diagnostics. */
 const name = "browser-bridge";
 /** The tool registry this plugin contributes `browser_*` tools to. */
@@ -1235,6 +1245,10 @@ function applyBrowserTools(ctx, controller) {
 			tabId: {
 				type: "number",
 				description: "Target tab; defaults to the active tab."
+			},
+			timeoutMs: {
+				type: "number",
+				description: `How long to wait for the page load to settle: defaults to 15000, capped at ${NAV_MAX_MS}. Raise it for slow pages instead of retrying; drop it to 3000-5000 when you do not need the page to finish loading and will read/wait afterwards.`
 			}
 		},
 		output: {
@@ -1286,7 +1300,9 @@ function applyBrowserTools(ctx, controller) {
 		async execute(args, exec) {
 			const params = { url: args.url };
 			if (args.tabId !== void 0) params.tabId = args.tabId;
-			const raw = await controller.execute("nav", params, exec.signal);
+			const budgetMs = typeof args.timeoutMs === "number" && Number.isFinite(args.timeoutMs) ? Math.min(NAV_MAX_MS, Math.max(100, Math.trunc(args.timeoutMs))) : 15e3;
+			params.timeoutMs = budgetMs;
+			const raw = await controller.execute("nav", params, exec.signal, budgetMs + BRIDGE_MARGIN_MS);
 			const out = { tabId: raw.tabId };
 			if (typeof raw.url === "string") out.url = raw.url;
 			if (typeof raw.title === "string") out.title = raw.title;
@@ -1820,6 +1836,95 @@ function applyBrowserTools(ctx, controller) {
 			return await controller.execute("hold", params, exec.signal);
 		}
 	}));
+	ctx.tools.register(defineTool({
+		name: "browser_cookies",
+		description: "Read, set or remove cookies of a tab (CDP Network.*, no new permission). Cookie values are credentials — a get returns them in full and they land in the model-visible text, so filter by domain and do not point this at a page whose cookies you do not actually need. set/remove need an anchor: url, or domain (with optional path).",
+		parameters: {
+			action: {
+				type: "string",
+				enum: [
+					"get",
+					"set",
+					"remove"
+				],
+				required: true,
+				description: "\"get\" lists cookies visible to the tab (domain filter optional); \"set\" writes one; \"remove\" deletes one and reports whether it is still visible afterwards."
+			},
+			name: {
+				type: "string",
+				description: "set/remove: cookie name (required)."
+			},
+			value: {
+				type: "string",
+				description: "set: cookie value (required; pass an empty string to clear the content)."
+			},
+			domain: {
+				type: "string",
+				description: "get: only cookies whose domain contains this substring. set/remove: anchor — the cookie domain."
+			},
+			url: {
+				type: "string",
+				description: "set/remove: alternative anchor — Chrome derives origin/secure defaults from it."
+			},
+			path: {
+				type: "string",
+				description: "set/remove: cookie path."
+			},
+			secure: {
+				type: "boolean",
+				description: "set: https-only cookie."
+			},
+			httpOnly: {
+				type: "boolean",
+				description: "set: hide the cookie from page scripts."
+			},
+			sameSite: {
+				type: "string",
+				description: "set: Strict | Lax | None."
+			},
+			expires: {
+				type: "number",
+				description: "set: Unix seconds; omit for a session cookie."
+			},
+			tabId: {
+				type: "number",
+				description: "Target tab; defaults to the active tab."
+			}
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: true
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: clampRendered(JSON.stringify(value))
+			}]
+		},
+		presentCall: (args) => ({
+			card: "generic",
+			title: `Cookies ${args.action}`,
+			kind: "other"
+		}),
+		async execute(args, exec) {
+			const command = args.action === "get" ? "cookies.get" : args.action === "set" ? "cookies.set" : args.action === "remove" ? "cookies.remove" : null;
+			if (command === null) throw new Error("browser_cookies action must be get, set or remove");
+			const params = {};
+			if (args.name !== void 0) params.name = args.name;
+			if (args.value !== void 0) params.value = args.value;
+			if (args.domain !== void 0) params.domain = args.domain;
+			if (args.url !== void 0) params.url = args.url;
+			if (args.path !== void 0) params.path = args.path;
+			if (args.secure !== void 0) params.secure = args.secure;
+			if (args.httpOnly !== void 0) params.httpOnly = args.httpOnly;
+			if (args.sameSite !== void 0) params.sameSite = args.sameSite;
+			if (args.expires !== void 0) params.expires = args.expires;
+			if (args.tabId !== void 0) params.tabId = args.tabId;
+			if (command === "cookies.get") return await controller.execute("cookies.get", params, exec.signal);
+			if (command === "cookies.set") return await controller.execute("cookies.set", params, exec.signal);
+			return await controller.execute("cookies.remove", params, exec.signal);
+		}
+	}));
 	ctx.tools.register(defineTool({
 		name: "browser_dialog",
 		description: "Read or change how native alert/confirm/prompt dialogs are answered (accept, dismiss, or manual), and get the recent dialog log so you can prove one appeared.",
@@ -1951,6 +2056,8 @@ function applyBrowserTools(ctx, controller) {
 			}
 		}
 	}));
+	/** Page-side ceiling of the eval race in the extension; the bridge budget adds slack on top. */
+	const EVAL_MAX_MS = 12e4;
 	ctx.tools.register(defineTool({
 		name: "browser_evaluate",
 		description: "Run JavaScript in the page and get the JSON result back as a string. Prefer read-only inspection.",
@@ -1963,6 +2070,10 @@ function applyBrowserTools(ctx, controller) {
 			tabId: {
 				type: "number",
 				description: "Target tab; defaults to the active tab."
+			},
+			timeoutMs: {
+				type: "number",
+				description: `Give up after this many milliseconds; defaults to 60000, capped at ${EVAL_MAX_MS}.`
 			}
 		},
 		output: {
@@ -1991,10 +2102,15 @@ function applyBrowserTools(ctx, controller) {
 			kind: "other"
 		}),
 		async execute(args, exec) {
-			const raw = await controller.execute("eval", args.tabId === void 0 ? { expression: args.expression } : {
-				expression: args.expression,
-				tabId: args.tabId
-			}, exec.signal);
+			const params = { expression: args.expression };
+			if (args.tabId !== void 0) params.tabId = args.tabId;
+			let bridgeCeiling;
+			if (typeof args.timeoutMs === "number" && Number.isFinite(args.timeoutMs)) {
+				const evalBudget = Math.min(EVAL_MAX_MS, Math.max(100, Math.trunc(args.timeoutMs)));
+				params.timeoutMs = evalBudget;
+				bridgeCeiling = evalBudget + 2e3;
+			}
+			const raw = await controller.execute("eval", params, exec.signal, bridgeCeiling);
 			let json;
 			try {
 				json = JSON.stringify(raw.value) ?? String(raw.value);

package/lib/types/index.js

@@ -24,6 +24,15 @@ import { defineTool } from '@deepseek-ai/dsh-tools';
 import { BridgeServer, cleanupArtifacts } from "./server.js";
 import { BridgeError, classify } from "./errors.js";
 import { policyRefusal } from "./policy.js";
+/** Navigation wait ceiling (same as browser_wait); the bridge gets this plus BRIDGE_MARGIN_MS. */
+const NAV_MAX_MS = 120_000;
+/**
+ * Extra time handed to the bridge on top of the navigation budget. Without it a
+ * caller-requested budget longer than the bridge default (60s) would be beaten by
+ * the bridge, and the model would get `command_timeout` (effect unknown) instead
+ * of a navigation timeout (nothing was touched) - two very different next steps.
+ */
+const BRIDGE_MARGIN_MS = 2_000;
 // Re-exported so the policy tables stay testable from the published bundle
 // (verify/verify_policy.mjs reconciles them against the extension's COMMANDS).
 export { LOCAL_DESTRUCTIVE_COMMANDS, PAGE_MUTATING_COMMANDS, READ_ONLY_ALLOWED, SCRIPT_COMMANDS, policyRefusal } from "./policy.js";
@@ -358,6 +367,7 @@ function applyBrowserTools(ctx, controller) {
         parameters: {
             url: { type: 'string', required: true, description: 'Absolute URL to open in the tab.' },
             tabId: { type: 'number', description: 'Target tab; defaults to the active tab.' },
+            timeoutMs: { type: 'number', description: `How long to wait for the page load to settle: defaults to 15000, capped at ${NAV_MAX_MS}. Raise it for slow pages instead of retrying; drop it to 3000-5000 when you do not need the page to finish loading and will read/wait afterwards.` },
         },
         output: {
             schema: {
@@ -397,7 +407,11 @@ function applyBrowserTools(ctx, controller) {
             const params = { url: args.url };
             if (args.tabId !== undefined)
                 params.tabId = args.tabId;
-            const raw = await controller.execute('nav', params, exec.signal);
+            const budgetMs = typeof args.timeoutMs === 'number' && Number.isFinite(args.timeoutMs)
+                ? Math.min(NAV_MAX_MS, Math.max(100, Math.trunc(args.timeoutMs)))
+                : 15_000;
+            params.timeoutMs = budgetMs;
+            const raw = await controller.execute('nav', params, exec.signal, budgetMs + BRIDGE_MARGIN_MS);
             // The declared schema is closed, so the fields describing a navigation that did
             // not arrive have to be carried over on purpose. The old shape check
             // (`siteUnreachable === true`) also missed the object the extension really
@@ -722,6 +736,65 @@ function applyBrowserTools(ctx, controller) {
             return await controller.execute('hold', params, exec.signal);
         },
     }));
+    ctx.tools.register(defineTool({
+        name: 'browser_cookies',
+        description: 'Read, set or remove cookies of a tab (CDP Network.*, no new permission). Cookie values are credentials — a get returns them in full and they land in the model-visible text, so filter by domain and do not point this at a page whose cookies you do not actually need. set/remove need an anchor: url, or domain (with optional path).',
+        parameters: {
+            action: { type: 'string', enum: ['get', 'set', 'remove'], required: true, description: '"get" lists cookies visible to the tab (domain filter optional); "set" writes one; "remove" deletes one and reports whether it is still visible afterwards.' },
+            name: { type: 'string', description: 'set/remove: cookie name (required).' },
+            value: { type: 'string', description: 'set: cookie value (required; pass an empty string to clear the content).' },
+            domain: { type: 'string', description: 'get: only cookies whose domain contains this substring. set/remove: anchor — the cookie domain.' },
+            url: { type: 'string', description: 'set/remove: alternative anchor — Chrome derives origin/secure defaults from it.' },
+            path: { type: 'string', description: 'set/remove: cookie path.' },
+            secure: { type: 'boolean', description: 'set: https-only cookie.' },
+            httpOnly: { type: 'boolean', description: 'set: hide the cookie from page scripts.' },
+            sameSite: { type: 'string', description: 'set: Strict | Lax | None.' },
+            expires: { type: 'number', description: 'set: Unix seconds; omit for a session cookie.' },
+            tabId: { type: 'number', description: 'Target tab; defaults to the active tab.' },
+        },
+        output: {
+            schema: { type: 'object', additionalProperties: true },
+            render: (_args, value) => [{ type: 'text', text: clampRendered(JSON.stringify(value)) }],
+        },
+        presentCall: args => ({ card: 'generic', title: `Cookies ${args.action}`, kind: 'other' }),
+        async execute(args, exec) {
+            // 三条命令各写一个字面量调用点：verify_surface 对账的是
+            // `controller.execute('命令名')` 的字面量，动态拼名字会让
+            // 「扩展实现了但 agent 拿不到」那条断言瞎掉。
+            const command = args.action === 'get' ? 'cookies.get'
+                : args.action === 'set' ? 'cookies.set'
+                    : args.action === 'remove' ? 'cookies.remove'
+                        : null;
+            if (command === null)
+                throw new Error('browser_cookies action must be get, set or remove');
+            const params = {};
+            if (args.name !== undefined)
+                params.name = args.name;
+            if (args.value !== undefined)
+                params.value = args.value;
+            if (args.domain !== undefined)
+                params.domain = args.domain;
+            if (args.url !== undefined)
+                params.url = args.url;
+            if (args.path !== undefined)
+                params.path = args.path;
+            if (args.secure !== undefined)
+                params.secure = args.secure;
+            if (args.httpOnly !== undefined)
+                params.httpOnly = args.httpOnly;
+            if (args.sameSite !== undefined)
+                params.sameSite = args.sameSite;
+            if (args.expires !== undefined)
+                params.expires = args.expires;
+            if (args.tabId !== undefined)
+                params.tabId = args.tabId;
+            if (command === 'cookies.get')
+                return await controller.execute('cookies.get', params, exec.signal);
+            if (command === 'cookies.set')
+                return await controller.execute('cookies.set', params, exec.signal);
+            return await controller.execute('cookies.remove', params, exec.signal);
+        },
+    }));
     ctx.tools.register(defineTool({
         name: 'browser_dialog',
         description: 'Read or change how native alert/confirm/prompt dialogs are answered (accept, dismiss, or manual), and get the recent dialog log so you can prove one appeared.',
@@ -807,12 +880,15 @@ function applyBrowserTools(ctx, controller) {
             }
         },
     }));
+    /** Page-side ceiling of the eval race in the extension; the bridge budget adds slack on top. */
+    const EVAL_MAX_MS = 120_000;
     ctx.tools.register(defineTool({
         name: 'browser_evaluate',
         description: 'Run JavaScript in the page and get the JSON result back as a string. Prefer read-only inspection.',
         parameters: {
             expression: { type: 'string', required: true, description: 'JavaScript expression or statement sequence; awaited like a promise body.' },
             tabId: { type: 'number', description: 'Target tab; defaults to the active tab.' },
+            timeoutMs: { type: 'number', description: `Give up after this many milliseconds; defaults to 60000, capped at ${EVAL_MAX_MS}.` },
         },
         output: {
             schema: {
@@ -827,7 +903,19 @@ function applyBrowserTools(ctx, controller) {
         },
         presentCall: () => ({ card: 'generic', title: 'Evaluate in page', kind: 'other' }),
         async execute(args, exec) {
-            const raw = await controller.execute('eval', args.tabId === undefined ? { expression: args.expression } : { expression: args.expression, tabId: args.tabId }, exec.signal);
+            const params = { expression: args.expression };
+            if (args.tabId !== undefined)
+                params.tabId = args.tabId;
+            // The extension races the evaluation at this budget; give the bridge 2s of
+            // slack so the page-side timeout reports first. Omitted → send nothing and
+            // let the bridge default (60s) govern, exactly as before the knob existed.
+            let bridgeCeiling;
+            if (typeof args.timeoutMs === 'number' && Number.isFinite(args.timeoutMs)) {
+                const evalBudget = Math.min(EVAL_MAX_MS, Math.max(100, Math.trunc(args.timeoutMs)));
+                params.timeoutMs = evalBudget;
+                bridgeCeiling = evalBudget + 2_000;
+            }
+            const raw = await controller.execute('eval', params, exec.signal, bridgeCeiling);
             let json;
             try {
                 json = JSON.stringify(raw.value) ?? String(raw.value);

package/lib/types/policy.js

@@ -24,6 +24,8 @@ export const READ_ONLY_ALLOWED = new Set([
     'content', 'find', 'snapshot', 'screenshot', 'pdf', 'wait',
     // 读扩展采集到的缓冲
     'tabs.list', 'console.log', 'network.log',
+    // 读浏览器自己的状态（cookie 是凭据，但 get 不改任何东西；set/remove 不在此列）
+    'cookies.get',
 ]);
 /**
  * 会执行**任意页面脚本**的扩展命令。这条与只读档分开管，因为用户可能想「可以读、

package/llms.txt

@@ -30,11 +30,12 @@ Chrome 浏览器扩展 + DeepSeek Harness 插件，让 AI Agent 通过 CDP 驱
 - `/` 与 `/api/status` 免鉴权，只报链路状态
 - 两个本机策略开关（profile 的 `browser-bridge` 配置）：`readOnly: true` 拒绝一切会改变页面/浏览器状态或删本机文件的命令，`allowScript: false` 单独关掉 `browser_evaluate`（它能做其它所有工具能做的事）。闸门在把命令发给扩展**之前**，所以被拒的调用零副作用；它们只约束模型那条工具面，HTTP 面按同一 token 走、不受影响，也**不是**防有权限的人
 - 扩展弹窗里的「锁定」是另一层：只有人工通道能开与关，冻结期间命令在扩展的 `runCommand` 入口就被拒绝（连接保持），读不出锁状态时按冻结处理（fail-closed）
+- `browser_cookies` 的 get 会把 **cookie 值原样**放进模型可见文本（cookie 值 = 凭据，这是这条工具的定义而不是副作用）；只读档放行 get、拒 set/remove
 - `browser_hold`（接管浮层）是**软层**：它告诉用户模型在操作这一页并挡住误触，用户双击即可关掉；卡片上按「中止操作」后扩展拒绝 `click`/`input`/`press`/`nav`，但模型可以调 `hold action=off` 解除。它不是安全边界，也不是防逃逸手段——要冻住浏览器用扩展弹窗里的「锁定」
 
 ## 关键文件
 
-- `src/index.ts` - 21 个 `browser_*` 工具注册 + settings 接线的版本兼容分支
+- `src/index.ts` - 22 个 `browser_*` 工具注册 + settings 接线的版本兼容分支
 - `src/policy.ts` - 三张互不相同的表：只读白名单、脚本命令、插件本地破坏性命令（`browser_cleanup` 不经过 `execute()`，必须自己站闸门）
 - `src/server.ts` - WebSocket 服务 + HTTP 面（鉴权、来源校验、状态页）
 - `src/ws.ts` - RFC 6455 帧编解码

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@angelky7/dsh-browser-control",
   "description": "Local WebSocket bridge between dsh and the DSH Browser Control browser extension, with model-facing browser_* tools and a Settings-managed on/off switch",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -37,7 +37,7 @@
     "build": "tsc -p tsconfig.json && tsdown",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "check": "npm run typecheck && npm run build && publint",
-    "verify": "node verify/verify_config_patch.mjs && node verify/verify_peers.mjs && node verify/verify_surface.mjs && node verify/verify_tab_groups.mjs && node verify/verify_tabs_close_many.mjs && node verify/verify_cdp_retry.mjs && node verify/verify_snapshot_ax.mjs && node verify/verify_hard_lock.mjs && node verify/verify_policy.mjs && node verify/verify_extension_e2e.mjs && node verify/verify_plugin.mjs legacy && node verify/verify_plugin.mjs conflict && node verify/verify_plugin.mjs new && node verify/verify_http.mjs && node verify/verify_errors.mjs && node verify/verify_hold.mjs && node verify/verify_protocol.mjs && node verify/verify_bundle_http.mjs && node verify/verify_nav_report.mjs && node verify/verify_nav_landing.mjs && node verify/verify_render_contract.mjs && node verify/verify_press_events.mjs"
+    "verify": "node verify/verify_config_patch.mjs && node verify/verify_peers.mjs && node verify/verify_surface.mjs && node verify/verify_tab_groups.mjs && node verify/verify_tabs_close_many.mjs && node verify/verify_cdp_retry.mjs && node verify/verify_snapshot_ax.mjs && node verify/verify_hard_lock.mjs && node verify/verify_policy.mjs && node verify/verify_cookies.mjs && node verify/verify_extension_e2e.mjs && node verify/verify_plugin.mjs legacy && node verify/verify_plugin.mjs conflict && node verify/verify_plugin.mjs new && node verify/verify_http.mjs && node verify/verify_errors.mjs && node verify/verify_hold.mjs && node verify/verify_protocol.mjs && node verify/verify_bundle_http.mjs && node verify/verify_nav_report.mjs && node verify/verify_nav_landing.mjs && node verify/verify_render_contract.mjs && node verify/verify_press_events.mjs && node verify/verify_nav_timeout.mjs"
   },
   "publishConfig": {
     "access": "public",