@modootoday/datalab-extension-mcp 1.8.6 → 1.8.7

package/dist/{chunk-TPYHNPF4.js → chunk-YTMY2DAN.js}

@@ -1,4 +1,4 @@
-// ../mcp-server/dist/chunk-Y2BX76F2.js
+// ../mcp-server/dist/chunk-CWKYOEBJ.js
 import { createHash } from "crypto";
 import { createHash as createHash2, randomUUID } from "crypto";
 import { mkdir, readFile, readdir, rm, writeFile } from "fs/promises";
@@ -6,8 +6,9 @@ import { join } from "path";
 import {
   createServer
 } from "http";
-import { createReadStream } from "fs";
-import { open, stat } from "fs/promises";
+import { pipeline } from "stream/promises";
+import { constants } from "fs";
+import { lstat, open } from "fs/promises";
 import { basename, isAbsolute } from "path";
 import {
   appendFileSync,
@@ -14436,6 +14437,8 @@ var HelloSchema = external_exports.object({
   capabilities: external_exports.array(external_exports.string()).default([])
 });
 var BRIDGE_AUTH_CAPABILITY = "bridge-auth-bearer";
+var BROWSER_ROUTING_CAPABILITY = "browser-routing-v1";
+var LOCAL_FILE_REQUEST_CAPABILITY = "local-file-request-v1";
 function bearerToken(header) {
   if (typeof header !== "string") return null;
   const match = /^Bearer (.+)$/i.exec(header.trim());
@@ -14459,6 +14462,15 @@ var HelloNackReasonSchema = external_exports.enum([
   /** Origin header absent or not our extension. */
   "forbidden_origin"
 ]);
+var BrowserRoutingSchema = external_exports.object({
+  targetBrowserId: external_exports.string(),
+  explicit: external_exports.boolean(),
+  fallbackFromPinned: external_exports.boolean(),
+  connectedBrowserCount: external_exports.number().int().nonnegative()
+});
+var BrowserRouteEchoSchema = external_exports.object({
+  browserId: external_exports.string()
+});
 var HelloNackSchema = external_exports.object({
   t: external_exports.literal("hello_nack"),
   reason: HelloNackReasonSchema,
@@ -14471,7 +14483,8 @@ var BridgeRequestSchema = external_exports.discriminatedUnion("method", [
   external_exports.object({
     t: external_exports.literal("req"),
     id: external_exports.string(),
-    method: external_exports.literal("tools/list")
+    method: external_exports.literal("tools/list"),
+    routing: BrowserRoutingSchema.optional()
   }),
   external_exports.object({
     t: external_exports.literal("req"),
@@ -14479,7 +14492,8 @@ var BridgeRequestSchema = external_exports.discriminatedUnion("method", [
     method: external_exports.literal("tools/call"),
     /** Must be on the read-only allowlist — enforced extension-side. */
     name: external_exports.string(),
-    args: external_exports.record(external_exports.string(), external_exports.unknown())
+    args: external_exports.record(external_exports.string(), external_exports.unknown()),
+    routing: BrowserRoutingSchema.optional()
   })
 ]);
 var elapsedMs = external_exports.number().nonnegative().optional();
@@ -14489,7 +14503,8 @@ var BridgeResultSchema = external_exports.union([
     id: external_exports.string(),
     ok: external_exports.literal(true),
     result: external_exports.unknown(),
-    ms: elapsedMs
+    ms: elapsedMs,
+    route: BrowserRouteEchoSchema.optional()
   }),
   external_exports.object({
     t: external_exports.literal("res"),
@@ -14499,7 +14514,8 @@ var BridgeResultSchema = external_exports.union([
     message: external_exports.string(),
     // Carried on failure too: the timing of a call that FAILED is exactly
     // what tells a timeout apart from a refusal.
-    ms: elapsedMs
+    ms: elapsedMs,
+    route: BrowserRouteEchoSchema.optional()
   })
 ]);
 var BridgeHeartbeatSchema = external_exports.object({
@@ -14517,7 +14533,8 @@ var BridgeUpstreamSchema = external_exports.union([
   external_exports.object({
     t: external_exports.literal("tools"),
     id: external_exports.string(),
-    tools: external_exports.array(BridgeToolDescriptorSchema)
+    tools: external_exports.array(BridgeToolDescriptorSchema),
+    route: BrowserRouteEchoSchema.optional()
   })
 ]);
 var UPSTREAM_FRAME_TYPES = ["res", "tools"];
@@ -14647,6 +14664,7 @@ function resolveCredential(presented, known) {
   return root.ok ? { kind: "root" } : REFUSED;
 }
 var READ_ONLY_TOOLS = [
+  "datalab_browsers",
   // --- Search-ad estimates. Uses the user's own advertiser API credentials. ---
   "ad_average_position_bid",
   "ad_competition_density",
@@ -14988,6 +15006,10 @@ var REASON_POLICY = Object.freeze({
    */
   disconnected: Object.freeze({ retryable: true }),
   superseded: Object.freeze({ retryable: true }),
+  browser_detached: Object.freeze({
+    retryable: true,
+    retryAfterMs: 1e3
+  }),
   // --- The request itself must change ---
   unknown_tool: Object.freeze({ retryable: false }),
   invalid_args: Object.freeze({ retryable: false }),
@@ -15004,6 +15026,7 @@ var REASON_POLICY = Object.freeze({
   // --- The connection itself must be repaired ---
   not_connected: Object.freeze({ retryable: false }),
   unauthorized: Object.freeze({ retryable: false }),
+  browser_unknown: Object.freeze({ retryable: false }),
   // --- Staging: the request must change, except where nobody knows yet ---
   stale_fence: Object.freeze({ retryable: false }),
   already_sealed: Object.freeze({ retryable: false }),
@@ -15164,6 +15187,7 @@ var BY_PREFIX = [
 ];
 var GALLERY = ["gallery_image_add"];
 var EXPLICIT = [
+  { slug: "connection", tools: ["datalab_browsers"] },
   { slug: "gallery", tools: GALLERY },
   { slug: "blog-brief", tools: BLOG_BRIEF },
   { slug: "blog-insights", tools: BLOG_INSIGHTS },
@@ -15174,6 +15198,11 @@ var EXPLICIT = [
   { slug: "benchmark", tools: ["benchmark_gap"] }
 ];
 var META = [
+  {
+    slug: "connection",
+    label: "\uC5F0\uACB0 \uBE0C\uB77C\uC6B0\uC800",
+    summary: "\uC5EC\uB7EC \uBE0C\uB77C\uC6B0\uC800\xB7\uD504\uB85C\uD544 \uC911 \uB3C4\uAD6C\uB97C \uC2E4\uD589\uD560 \uACF3\uC744 \uACE0\uB978\uB2E4"
+  },
   {
     slug: "blog-brief",
     label: "\uC624\uB298\uC758 \uBE14\uB85C\uADF8 \uBE0C\uB9AC\uD551",
@@ -15310,6 +15339,12 @@ var CALL_TOOL = "datalab_call";
 var CONFIRM_STATUS_TOOL = "datalab_confirm_status";
 var SESSION_STATE_TOOL = "datalab_session_state";
 var BROWSERS_TOOL = "datalab_browsers";
+function browserProperty() {
+  return {
+    type: "string",
+    description: `${BROWSERS_TOOL} \uAC00 \uB3CC\uB824\uC900 \uC2E4\uD589 \uB300\uC0C1 \uBE0C\uB77C\uC6B0\uC800 id`
+  };
+}
 var DESCRIBE_PAGE_SIZE = 10;
 function discoveryDescriptors(entries) {
   const sets = buildToolsets(entries.map((e) => e.name));
@@ -15334,7 +15369,8 @@ function discoveryDescriptors(entries) {
           withSchemas: {
             type: "boolean",
             description: `\uC778\uC790 \uC2A4\uD0A4\uB9C8\uAE4C\uC9C0 \uD568\uAED8 \uBC1B\uB294\uB2E4 \u2014 \uADF8\uB7EC\uBA74 ${DESCRIBE_TOOL} \uC5C6\uC774 \uBC14\uB85C \uC2E4\uD589\uD560 \uC218 \uC788\uB2E4. toolset \uC774\uB098 query \uC640 \uAC19\uC774 \uC904 \uB54C\uB9CC \uC4F4\uB2E4`
-          }
+          },
+          browser: browserProperty()
         },
         additionalProperties: false
       }
@@ -15351,7 +15387,8 @@ function discoveryDescriptors(entries) {
             items: { type: "string" },
             maxItems: DESCRIBE_PAGE_SIZE,
             description: `\uC2A4\uD0A4\uB9C8\uB97C \uBCFC \uB3C4\uAD6C \uC774\uB984 (\uD55C \uBC88\uC5D0 ${DESCRIBE_PAGE_SIZE}\uAC1C\uAE4C\uC9C0)`
-          }
+          },
+          browser: browserProperty()
         },
         required: ["tools"],
         additionalProperties: false
@@ -15369,7 +15406,8 @@ function discoveryDescriptors(entries) {
           args: {
             type: "object",
             description: `\uADF8 \uB3C4\uAD6C\uC758 \uC778\uC790. ${DESCRIBE_TOOL} \uC758 \uC2A4\uD0A4\uB9C8\uB97C \uB530\uB978\uB2E4`
-          }
+          },
+          browser: browserProperty()
         },
         required: ["tool"],
         additionalProperties: false
@@ -15385,7 +15423,8 @@ function discoveryDescriptors(entries) {
           ticket: {
             type: "string",
             description: `${CALL_TOOL} \uC774 \uB3CC\uB824\uC900 ticket \uAC12 \uADF8\uB300\uB85C`
-          }
+          },
+          browser: browserProperty()
         },
         required: ["ticket"],
         additionalProperties: false
@@ -15399,7 +15438,7 @@ function sessionStateDescriptor() {
     description: "\uC9C0\uAE08 \uC774 \uBE0C\uB77C\uC6B0\uC800\uC5D0\uC11C \uD655\uC778 \uCC3D \uC5C6\uC774 \uC5BC\uB9C8\uB098 \uB354 \uC791\uC5C5\uD560 \uC218 \uC788\uB294\uC9C0, \uADF8\uB9AC\uACE0 \uC791\uC5C5\uD560 \uB300\uC0C1\uC774 \uC2E4\uC81C\uB85C \uC5F4\uB824 \uC788\uB294\uC9C0 \uC54C\uB824\uC900\uB2E4. \uC5EC\uB7EC \uBC88\uC758 \uD3B8\uC9D1\uC774\uB098 \uBC30\uCE58\uB97C \uC2DC\uC791\uD558\uAE30 \uC804\uC5D0 \uBA3C\uC800 \uBD80\uB978\uB2E4 \u2014 \uB0A8\uC740 \uC2DC\uAC04\uC774 \uC9E7\uC73C\uBA74 \uB3C4\uC911\uC5D0 \uD655\uC778 \uCC3D\uC774 \uB728\uAE30 \uC2DC\uC791\uD558\uACE0, \uC0AC\uC6A9\uC790\uAC00 \uC790\uB9AC\uC5D0 \uC5C6\uC73C\uBA74 \uAC70\uAE30\uC11C \uBA48\uCD98\uB2E4. surfaces \uB294 \uAE00\uC4F0\uAE30 \uCC3D\xB7\uC0AC\uC9C4 \uD3B8\uC9D1\uAE30\xB7\uC601\uC0C1 \uD3B8\uC9D1\uAE30\uAC00 \uAC01\uAC01 \uC900\uBE44\uB410\uB294\uC9C0 \uB9D0\uD574\uC900\uB2E4. ready \uAC00 \uC544\uB2CC \uD45C\uBA74\uC744 \uC4F0\uB294 \uACC4\uD68D\uC740 \uB9E4 \uD638\uCD9C\uC774 \uC2E4\uD328\uD558\uB2C8, \uACC4\uD68D\uC744 \uC138\uC6B0\uAE30 \uC804\uC5D0 \uD655\uC778\uD558\uACE0 \uD544\uC694\uD558\uBA74 \uC0AC\uC6A9\uC790\uC5D0\uAC8C \uC5F4\uC5B4 \uB2EC\uB77C\uACE0 \uC548\uB0B4\uD55C\uB2E4.",
     inputSchema: {
       type: "object",
-      properties: {},
+      properties: { browser: browserProperty() },
       additionalProperties: false
     },
     annotations: LOOKUP_ANNOTATIONS
@@ -15408,7 +15447,7 @@ function sessionStateDescriptor() {
 function browsersDescriptor() {
   return {
     name: BROWSERS_TOOL,
-    description: "\uC774 \uCEF4\uD4E8\uD130\uC5D0 \uC9C0\uAE08 \uC5F0\uACB0\uB3FC \uC788\uB294 \uBE0C\uB77C\uC6B0\uC800\uB97C \uC54C\uB824\uC900\uB2E4. \uD06C\uB86C\xB7\uC6E8\uC77C\xB7\uC5E3\uC9C0 \uC5B4\uB290 \uAC83\uC774\uB4E0, \uD504\uB85C\uD544\uC744 \uC5EC\uB7EC \uAC1C \uC5F0\uACB0\uD574 \uB454 \uC0AC\uC6A9\uC790\uC5D0\uAC8C\uB294 \uB3C4\uAD6C\uAC00 \uC5B4\uB514\uC11C \uC2E4\uD589\uB418\uB294\uC9C0\uAC00 \uACB0\uACFC\uB97C \uBC14\uAFBC\uB2E4 \u2014 \uC5F4\uB824 \uC788\uB294 \uAE00\uB3C4 \uB85C\uADF8\uC778\uD55C \uACC4\uC815\uB3C4 \uD504\uB85C\uD544\uB9C8\uB2E4 \uB2E4\uB974\uB2E4. \uBAA9\uB85D\uC758 id \uB97C \uB2E4\uB978 \uB3C4\uAD6C \uD638\uCD9C\uC758 browser \uC778\uC790\uC5D0 \uB123\uC73C\uBA74 \uADF8 \uBE0C\uB77C\uC6B0\uC800\uC5D0\uC11C \uC2E4\uD589\uB41C\uB2E4. \uC0DD\uB7B5\uD558\uBA74 \uAC00\uC7A5 \uBA3C\uC800 \uC5F0\uACB0\uB41C \uAC83\uC5D0\uC11C \uC2E4\uD589\uB418\uB2C8, \uB458 \uC774\uC0C1\uC774\uBA74 \uC5B4\uB514\uC11C \uD560\uC9C0 \uC0AC\uC6A9\uC790\uC5D0\uAC8C \uD655\uC778\uD558\uACE0 \uC9C0\uC815\uD55C\uB2E4. \uC774 \uB3C4\uAD6C\uB294 \uC870\uD68C\uB9CC \uD558\uBA70 \uC0C8 \uBE0C\uB77C\uC6B0\uC800\uB97C \uB4F1\uB85D\uD558\uC9C0\uB294 \uBABB\uD55C\uB2E4 \u2014 \uB4F1\uB85D \uCF54\uB4DC\uB294 \uC0AC\uC6A9\uC790\uAC00 \uD328\uB110\uC5D0\uC11C \uC9C1\uC811 \uB9CC\uB4E0\uB2E4.",
+    description: "\uC774 \uCEF4\uD4E8\uD130\uC5D0 \uC9C0\uAE08 \uC5F0\uACB0\uB3FC \uC788\uB294 \uBE0C\uB77C\uC6B0\uC800\uB97C \uC54C\uB824\uC900\uB2E4. \uD06C\uB86C\xB7\uC6E8\uC77C\xB7\uC5E3\uC9C0 \uC5B4\uB290 \uAC83\uC774\uB4E0, \uD504\uB85C\uD544\uC744 \uC5EC\uB7EC \uAC1C \uC5F0\uACB0\uD574 \uB454 \uC0AC\uC6A9\uC790\uC5D0\uAC8C\uB294 \uB3C4\uAD6C\uAC00 \uC5B4\uB514\uC11C \uC2E4\uD589\uB418\uB294\uC9C0\uAC00 \uACB0\uACFC\uB97C \uBC14\uAFBC\uB2E4 \u2014 \uC5F4\uB824 \uC788\uB294 \uAE00\uB3C4 \uB85C\uADF8\uC778\uD55C \uACC4\uC815\uB3C4 \uD504\uB85C\uD544\uB9C8\uB2E4 \uB2E4\uB974\uB2E4. \uBAA9\uB85D\uC758 id \uB97C \uB2E4\uB978 \uB3C4\uAD6C \uD638\uCD9C\uC758 browser \uC778\uC790\uC5D0 \uB123\uC73C\uBA74 \uADF8 \uBE0C\uB77C\uC6B0\uC800\uC5D0\uC11C \uC2E4\uD589\uB41C\uB2E4. \uC0DD\uB7B5\uD558\uBA74 \uACE0\uC815\uB41C \uAE30\uBCF8 \uBE0C\uB77C\uC6B0\uC800\uB97C \uC0AC\uC6A9\uD558\uBA70, \uADF8 \uC5F0\uACB0\uC774 \uB04A\uAE34 \uB3D9\uC548 \uBCC0\uACBD \uC791\uC5C5\uC740 \uB2E4\uB978 \uBE0C\uB77C\uC6B0\uC800\uB85C \uC790\uB3D9 \uC2B9\uACC4\uD558\uC9C0 \uC54A\uB294\uB2E4. \uB458 \uC774\uC0C1\uC774\uBA74 \uC5B4\uB514\uC11C \uD560\uC9C0 \uC0AC\uC6A9\uC790\uC5D0\uAC8C \uD655\uC778\uD558\uACE0 \uC9C0\uC815\uD55C\uB2E4. \uC774 \uB3C4\uAD6C\uB294 \uC870\uD68C\uB9CC \uD558\uBA70 \uC0C8 \uBE0C\uB77C\uC6B0\uC800\uB97C \uB4F1\uB85D\uD558\uC9C0\uB294 \uBABB\uD55C\uB2E4 \u2014 \uB4F1\uB85D \uCF54\uB4DC\uB294 \uC0AC\uC6A9\uC790\uAC00 \uD328\uB110\uC5D0\uC11C \uC9C1\uC811 \uB9CC\uB4E0\uB2E4.",
     inputSchema: {
       type: "object",
       properties: {},
@@ -15421,11 +15460,9 @@ function allowlistNames() {
   return [.../* @__PURE__ */ new Set([...READ_ONLY_TOOLS, ...Object.keys(TOOL_TIERS)])];
 }
 function staticDiscoveryCatalog() {
-  const entries = allowlistNames().map((name) => ({
-    name,
-    description: "",
-    inputSchema: {}
-  }));
+  const entries = allowlistNames().map(
+    (name) => name === BROWSERS_TOOL ? browsersDescriptor() : { name, description: "", inputSchema: {} }
+  );
   return [
     ...discoveryDescriptors(entries),
     sessionStateDescriptor(),
@@ -15590,6 +15627,7 @@ var Bridge = class {
   #sessions = /* @__PURE__ */ new Map();
   #idTag = daemonIdTag();
   #sessionSeq = 0;
+  #defaultKey = null;
   /** Consecutive handshakes refused for our own token. See `#noteStaleToken`. */
   #badTokenStreak = 0;
   #bucketTokens = 0;
@@ -15607,7 +15645,13 @@ var Bridge = class {
    * single key there is never more than one to choose between.
    */
   #primary() {
-    for (const entry of this.#sessions.values()) return entry;
+    if (this.#defaultKey !== null) {
+      const held = this.#sessions.get(this.#defaultKey);
+      if (held?.streamActive) return held;
+    }
+    for (const entry of this.#sessions.values()) {
+      if (entry.streamActive) return entry;
+    }
     return null;
   }
   /**
@@ -15618,11 +15662,12 @@ var Bridge = class {
    * landing in the older one and never learn why the newer one saw nothing.
    */
   connectedBrowsers() {
-    const keys = [...this.#sessions.keys()];
-    return keys.map((id, i) => ({
+    const keys = [...this.#sessions.values()].filter((entry) => entry.streamActive).map((entry) => entry.key);
+    const primary = this.#defaultKey === null ? this.#primary()?.key ?? null : this.#defaultKey;
+    return keys.map((id) => ({
       id,
       name: this.#deps.browserLabels.get(id) ?? null,
-      primary: i === 0
+      primary: primary === id
     }));
   }
   /**
@@ -15649,6 +15694,10 @@ var Bridge = class {
       session,
       tokenHash: auth.tokenHash,
       authRequired: auth.authRequired,
+      routingRequired: auth.routingRequired,
+      fileRequestBound: auth.fileRequestBound,
+      streamActive: false,
+      filePermits: /* @__PURE__ */ new Map(),
       pending: new PendingRegistry({
         now: this.#deps.now,
         timeoutMs: this.#deps.timeoutMs,
@@ -15693,9 +15742,25 @@ var Bridge = class {
     }
     return null;
   }
+  sessionForKey(key) {
+    return this.#sessions.get(key)?.session ?? null;
+  }
+  legacySessionKey() {
+    return this.#sessions.has(LEGACY_SESSION_KEY) ? LEGACY_SESSION_KEY : null;
+  }
   /** Is a panel connected and ready to serve tool calls? */
   get connected() {
-    return this.#sessions.size > 0;
+    return this.#primary() !== null;
+  }
+  activateSession(key, sessionId) {
+    const entry = this.#sessions.get(key);
+    if (!entry || entry.session.sessionId !== sessionId) return false;
+    entry.streamActive = true;
+    return true;
+  }
+  isSessionStreamActive(key, sessionId) {
+    const entry = this.#sessions.get(key);
+    return entry?.session.sessionId === sessionId && entry.streamActive;
   }
   /**
    * The last catalog the panel reported, empty if it has never connected in
@@ -15723,18 +15788,161 @@ var Bridge = class {
    * the same as that browser being here, and this gates a route that reads
    * files off the operator's disk.
    */
-  verifyLiveSessionToken(presented) {
-    if (typeof presented !== "string" || presented.length === 0) return false;
-    if (this.verifyRootToken(presented)) {
-      return this.#sessions.has(LEGACY_SESSION_KEY);
+  #fileCredential(entry, presented) {
+    const hash2 = digestToken(presented);
+    if (!timingSafeEqual(hash2, entry.tokenHash) || this.#deps.wasRevoked(hash2)) {
+      return null;
     }
+    if (entry.key === LEGACY_SESSION_KEY) {
+      return this.verifyRootToken(presented) ? "root" : null;
+    }
+    const current = this.#deps.claimedBrowsers.get(entry.key);
+    return current !== void 0 && timingSafeEqual(hash2, current) ? "claimed_browser" : null;
+  }
+  #fileCredentialClass(presented) {
+    if (this.verifyRootToken(presented)) return "root";
     const hash2 = digestToken(presented);
+    for (const current of this.#deps.claimedBrowsers.values()) {
+      if (timingSafeEqual(hash2, current)) return "claimed_browser";
+    }
+    return "unknown";
+  }
+  authorizeLegacyFileCredential(presented) {
+    if (typeof presented !== "string" || presented.length === 0) {
+      return {
+        ok: false,
+        reason: "file_session_token_missing",
+        credential: "missing"
+      };
+    }
+    const credential = this.#fileCredentialClass(presented);
     for (const entry of this.#sessions.values()) {
-      const expected = this.#deps.claimedBrowsers.get(entry.key);
-      if (expected !== void 0 && timingSafeEqual(hash2, expected))
-        return true;
+      const accepted = this.#fileCredential(entry, presented);
+      if (accepted && !entry.fileRequestBound) {
+        return {
+          ok: true,
+          key: entry.key,
+          sessionId: entry.session.sessionId,
+          credential: accepted,
+          requestBound: false
+        };
+      }
     }
-    return false;
+    return {
+      ok: false,
+      reason: "file_session_token_mismatch",
+      credential
+    };
+  }
+  authorizeFileRequest(input) {
+    const entry = [...this.#sessions.values()].find(
+      (candidate) => candidate.session.sessionId === input.sessionId
+    );
+    if (!entry) {
+      return {
+        ok: false,
+        reason: "file_session_not_live",
+        credential: typeof input.token === "string" && input.token.length > 0 ? this.#fileCredentialClass(input.token) : "missing"
+      };
+    }
+    if (typeof input.token !== "string" || input.token.length === 0) {
+      return {
+        ok: false,
+        reason: "file_session_token_missing",
+        credential: "missing",
+        key: entry.key,
+        sessionId: entry.session.sessionId,
+        ...input.requestId === void 0 ? {} : { requestId: input.requestId }
+      };
+    }
+    const credential = this.#fileCredential(entry, input.token);
+    if (!credential) {
+      return {
+        ok: false,
+        reason: "file_session_token_mismatch",
+        credential: this.#fileCredentialClass(input.token),
+        key: entry.key,
+        sessionId: entry.session.sessionId,
+        ...input.requestId === void 0 ? {} : { requestId: input.requestId }
+      };
+    }
+    if (!entry.fileRequestBound) {
+      return {
+        ok: true,
+        key: entry.key,
+        sessionId: entry.session.sessionId,
+        ...input.requestId === void 0 ? {} : { requestId: input.requestId },
+        credential,
+        requestBound: false
+      };
+    }
+    const now = (this.#deps.now ?? Date.now)();
+    for (const [requestId, permit2] of entry.filePermits) {
+      if (permit2.expiresAt <= now) entry.filePermits.delete(requestId);
+    }
+    if (input.requestId === void 0) {
+      return {
+        ok: false,
+        reason: "file_request_expired",
+        credential,
+        key: entry.key,
+        sessionId: entry.session.sessionId
+      };
+    }
+    const permit = entry.filePermits.get(input.requestId);
+    if (!permit) {
+      return {
+        ok: false,
+        reason: "file_request_expired",
+        credential,
+        key: entry.key,
+        sessionId: entry.session.sessionId,
+        requestId: input.requestId
+      };
+    }
+    if (permit.path !== input.path || permit.tool !== input.tool) {
+      return {
+        ok: false,
+        reason: "file_request_mismatch",
+        credential,
+        key: entry.key,
+        sessionId: entry.session.sessionId,
+        requestId: input.requestId
+      };
+    }
+    return {
+      ok: true,
+      key: entry.key,
+      sessionId: entry.session.sessionId,
+      requestId: input.requestId,
+      credential,
+      requestBound: true
+    };
+  }
+  consumeFileRequest(auth) {
+    const entry = this.#sessions.get(auth.key);
+    if (!entry || !entry.streamActive || entry.session.sessionId !== auth.sessionId) {
+      return false;
+    }
+    if (!auth.requestBound) return true;
+    if (auth.requestId === void 0 || !entry.filePermits.has(auth.requestId)) {
+      return false;
+    }
+    entry.filePermits.delete(auth.requestId);
+    return true;
+  }
+  cancelFileRequest(input) {
+    const entry = [...this.#sessions.values()].find(
+      (candidate) => candidate.session.sessionId === input.sessionId
+    );
+    if (!entry || !entry.streamActive) return "file_session_not_live";
+    if (typeof input.token !== "string" || !this.#fileCredential(entry, input.token)) {
+      return "file_session_token_mismatch";
+    }
+    if (!entry.filePermits.delete(input.requestId)) {
+      return "file_request_expired";
+    }
+    return null;
   }
   /**
    * The extension is right about the token, and we can be wrong about it.
@@ -15836,7 +16044,16 @@ var Bridge = class {
     const authRequired = parsed.data.capabilities.includes(
       BRIDGE_AUTH_CAPABILITY
     );
-    this.#installSession(key, session, { tokenHash, authRequired });
+    const routingRequired = credential.kind === "claimed" && parsed.data.capabilities.includes(BROWSER_ROUTING_CAPABILITY);
+    const fileRequestBound = parsed.data.capabilities.includes(
+      LOCAL_FILE_REQUEST_CAPABILITY
+    );
+    this.#installSession(key, session, {
+      tokenHash,
+      authRequired,
+      routingRequired,
+      fileRequestBound
+    });
     const limit = this.#deps.rateLimit ?? DEFAULT_RATE_LIMIT;
     this.#bucketTokens = limit.capacity;
     this.#bucketRefilledAt = (this.#deps.now ?? Date.now)();
@@ -15847,7 +16064,11 @@ var Bridge = class {
       sessionId: session.sessionId,
       // Echoed only when it is actually on, so the panel can tell a server that
       // is holding it to the header from one that predates the gate entirely.
-      capabilities: authRequired ? [BRIDGE_AUTH_CAPABILITY] : []
+      capabilities: [
+        ...authRequired ? [BRIDGE_AUTH_CAPABILITY] : [],
+        ...routingRequired ? [BROWSER_ROUTING_CAPABILITY] : [],
+        ...fileRequestBound ? [LOCAL_FILE_REQUEST_CAPABILITY] : []
+      ]
     };
   }
   /**
@@ -15896,21 +16117,27 @@ var Bridge = class {
       return this.#settle(
         frame.id,
         { ok: true, result: frame.tools },
-        presented
+        presented,
+        frame.route?.browserId
       );
     }
     if (frame.ok) {
-      return this.#settle(
+      const settled2 = this.#settle(
         frame.id,
         {
           ok: true,
           result: frame.result,
           ...frame.ms === void 0 ? {} : { ms: frame.ms }
         },
-        presented
+        presented,
+        frame.route?.browserId
       );
+      if (settled2 === "settled" && !(typeof frame.result === "object" && frame.result !== null && frame.result.status === "awaiting_confirm")) {
+        this.#discardFilePermit(frame.id);
+      }
+      return settled2;
     }
-    return this.#settle(
+    const settled = this.#settle(
       frame.id,
       {
         ok: false,
@@ -15918,8 +16145,11 @@ var Bridge = class {
         message: frame.message,
         ...frame.ms === void 0 ? {} : { ms: frame.ms }
       },
-      presented
+      presented,
+      frame.route?.browserId
     );
+    if (settled === "settled") this.#discardFilePermit(frame.id);
+    return settled;
   }
   /**
    * The id is the only axis a reply carries, and the prefixes make it unique
@@ -15931,15 +16161,28 @@ var Bridge = class {
    * mint the same one — and would report "unknown", which reads as an ordinary
    * late reply.
    */
-  #settle(id, outcome, presented) {
+  #settle(id, outcome, presented, browserId) {
     for (const entry of this.#sessions.values()) {
       if (!entry.pending.owns(id)) continue;
       if (!this.#mayAct(entry, presented)) return "unauthorized";
+      if (entry.routingRequired && browserId !== entry.key) {
+        entry.pending.settle(id, {
+          ok: false,
+          reason: "browser_unknown",
+          message: "The responding browser did not match the routed browser."
+        });
+        return "settled";
+      }
       entry.pending.settle(id, outcome);
       return "settled";
     }
     return "dropped";
   }
+  #discardFilePermit(id) {
+    for (const entry of this.#sessions.values()) {
+      if (entry.filePermits.delete(id)) return;
+    }
+  }
   /** One panel went away. Nothing it owed can land, so settle that session now. */
   disconnect(key) {
     this.#closeSession(
@@ -15957,6 +16200,10 @@ var Bridge = class {
     let expired = 0;
     for (const entry of this.#sessions.values()) {
       expired += entry.pending.sweep();
+      const now = (this.#deps.now ?? Date.now)();
+      for (const [requestId, permit] of entry.filePermits) {
+        if (permit.expiresAt <= now) entry.filePermits.delete(requestId);
+      }
     }
     return expired;
   }
@@ -15967,10 +16214,11 @@ var Bridge = class {
    * shape, catalog size — with no membership check. Membership is enforced
    * where the session and the execution live, in the panel's own executor.
    */
-  async listTools() {
-    const out = await this.#request({
-      method: "tools/list"
-    });
+  async listTools(browser) {
+    const out = await this.#request(
+      { method: "tools/list" },
+      browser
+    );
     if (!out.ok) throw new BridgeError(out.reason, out.message);
     const { tools, rejected } = projectTools(out.result);
     if (tools.length > 0) {
@@ -15990,13 +16238,16 @@ var Bridge = class {
    * `bridgeMs - toolMs` is the transport and the queue. A single total cannot
    * tell a slow tool from a slow wire, and that is the question being asked.
    */
-  async callTool(name, args) {
+  async callTool(name, args, browser) {
     const startedAt = (this.#deps.now ?? Date.now)();
-    const out = await this.#request({
-      method: "tools/call",
-      name,
-      args
-    });
+    const out = await this.#request(
+      {
+        method: "tools/call",
+        name,
+        args
+      },
+      browser
+    );
     const bridgeMs = (this.#deps.now ?? Date.now)() - startedAt;
     if (!out.ok) {
       throw new BridgeError(out.reason, out.message, {
@@ -16030,8 +16281,28 @@ var Bridge = class {
     this.#bucketTokens -= 1;
     return true;
   }
-  async #request(req) {
-    const entry = this.#primary();
+  async #request(req, browser) {
+    let entry;
+    if (browser === void 0) {
+      entry = this.#primary();
+    } else {
+      const known = this.#deps.claimedBrowsers.has(browser) || browser === LEGACY_SESSION_KEY && this.#sessions.has(browser);
+      if (!known) {
+        return {
+          ok: false,
+          reason: "browser_unknown",
+          message: "The requested browser is not registered."
+        };
+      }
+      entry = this.#sessions.get(browser) ?? null;
+      if (!entry?.streamActive) {
+        return {
+          ok: false,
+          reason: "browser_detached",
+          message: "The requested browser is registered but not connected."
+        };
+      }
+    }
     if (!entry) {
       return {
         ok: false,
@@ -16047,23 +16318,47 @@ var Bridge = class {
       };
     }
     const id = entry.pending.nextId();
+    const routing = entry.routingRequired ? {
+      targetBrowserId: entry.key,
+      explicit: browser !== void 0,
+      fallbackFromPinned: browser === void 0 && this.#defaultKey !== null && this.#defaultKey !== entry.key,
+      connectedBrowserCount: this.connectedBrowsers().length
+    } : void 0;
+    const delegatedTool = req.method === "tools/call" && req.name === CALL_TOOL ? req.args["tool"] : void 0;
+    const delegatedArgs = req.method === "tools/call" && typeof req.args["args"] === "object" && req.args["args"] !== null && !Array.isArray(req.args["args"]) ? req.args["args"] : null;
+    const fileTool = req.method === "tools/call" && (req.name === "editor_insert_image" || req.name === "gallery_image_add") ? req.name : delegatedTool === "editor_insert_image" || delegatedTool === "gallery_image_add" ? delegatedTool : null;
+    const fileArgs = delegatedArgs ?? (req.method === "tools/call" ? req.args : null);
+    const path = fileArgs?.["path"];
+    if (entry.fileRequestBound && fileTool !== null && typeof path === "string" && path.length > 0) {
+      entry.filePermits.set(id, {
+        expiresAt: (this.#deps.now ?? Date.now)() + (this.#deps.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+        tool: fileTool,
+        path
+      });
+    }
     const settled = entry.pending.register(id);
     const delivered = this.#deps.send(
       {
         t: "req",
         id,
-        ...req
+        ...req,
+        ...routing ? { routing } : {}
       },
       entry.key
     );
     if (!delivered) {
+      entry.filePermits.delete(id);
       entry.pending.settle(id, {
         ok: false,
         reason: "not_connected",
         message: BRIDGE_USER_MESSAGES.panelClosed
       });
     }
-    return settled;
+    const outcome = await settled;
+    if (outcome.ok && (browser !== void 0 || this.#defaultKey === null)) {
+      this.#defaultKey = entry.key;
+    }
+    return outcome;
   }
 };
 var BridgeError = class extends Error {
@@ -16444,8 +16739,43 @@ function timingMeta(timing) {
     }
   };
 }
+var ROUTED_FACADES = /* @__PURE__ */ new Set([
+  CATALOG_TOOL,
+  DESCRIBE_TOOL,
+  CALL_TOOL,
+  CONFIRM_STATUS_TOOL,
+  SESSION_STATE_TOOL
+]);
 function ownTools(stage) {
-  return stage ? mediaToolDescriptors() : [];
+  const browsers = staticDiscoveryCatalog().find(
+    (tool) => tool.name === BROWSERS_TOOL
+  );
+  return [
+    ...browsers ? [browsers] : [],
+    ...stage ? mediaToolDescriptors() : []
+  ];
+}
+function withOwnTools(tools, stage) {
+  const canonical = new Map(
+    staticDiscoveryCatalog().map((tool) => [tool.name, tool])
+  );
+  const out = tools.map((tool) => {
+    const name = typeof tool["name"] === "string" ? tool["name"] : "";
+    const facade = canonical.get(name);
+    if (!facade || !ROUTED_FACADES.has(name)) return tool;
+    return { ...tool, inputSchema: facade.inputSchema };
+  });
+  const names = new Set(
+    out.flatMap(
+      (tool) => typeof tool["name"] === "string" ? [tool["name"]] : []
+    )
+  );
+  for (const tool of ownTools(stage)) {
+    if (typeof tool["name"] !== "string" || names.has(tool["name"])) continue;
+    names.add(tool["name"]);
+    out.push(tool);
+  }
+  return out;
 }
 function rpcToolError(id, err) {
   const policy = policyFor(err.reason);
@@ -16487,7 +16817,7 @@ function frameMcpResponse(payload, accept) {
 function offlineCatalog(bridge, stage, id, accept) {
   const base = bridge.lastKnownTools.length > 0 ? bridge.lastKnownTools : staticDiscoveryCatalog();
   return frameMcpResponse(
-    rpcResult(id, { tools: [...base, ...ownTools(stage)] }),
+    rpcResult(id, { tools: withOwnTools(base, stage) }),
     accept
   );
 }
@@ -16508,7 +16838,7 @@ async function handleMcpRequest(bridge, body, accept, stage) {
     try {
       const { tools } = await bridge.listTools();
       return frameMcpResponse(
-        rpcResult(id, { tools: [...tools, ...ownTools(stage)] }),
+        rpcResult(id, { tools: withOwnTools(tools, stage) }),
         accept
       );
     } catch (err) {
@@ -16527,7 +16857,23 @@ async function handleMcpRequest(bridge, body, accept, stage) {
         accept
       );
     }
-    const args = typeof params.arguments === "object" && params.arguments !== null ? params.arguments : {};
+    let args = typeof params.arguments === "object" && params.arguments !== null ? params.arguments : {};
+    let browser;
+    if (ROUTED_FACADES.has(params.name) && Object.hasOwn(args, "browser")) {
+      if (typeof args["browser"] !== "string" || args["browser"].length === 0 || args["browser"] !== args["browser"].trim()) {
+        return frameMcpResponse(
+          rpcError(
+            id,
+            CODE_INVALID_PARAMS,
+            "browser must be a connected browser id."
+          ),
+          accept
+        );
+      }
+      browser = args["browser"];
+      args = { ...args };
+      delete args["browser"];
+    }
     if (params.name === BROWSERS_TOOL) {
       return frameMcpResponse(
         rpcResult(id, {
@@ -16556,7 +16902,7 @@ async function handleMcpRequest(bridge, body, accept, stage) {
       );
     }
     try {
-      const call = await bridge.callTool(params.name, args);
+      const call = browser === void 0 ? await bridge.callTool(params.name, args) : await bridge.callTool(params.name, args, browser);
       return frameMcpResponse(
         rpcResult(id, {
           content: [{ type: "text", text: JSON.stringify(call.result) }],
@@ -16610,17 +16956,16 @@ async function openLocalImage(path) {
       message: "\uC804\uCCB4 \uACBD\uB85C\uB97C \uC54C\uB824 \uC8FC\uC138\uC694(\uC608: /Users/me/photo.jpg)."
     };
   }
-  let size;
+  let initial;
   try {
-    const info = await stat(path);
-    if (!info.isFile()) {
+    initial = await lstat(path);
+    if (initial.isSymbolicLink()) {
       return {
         ok: false,
         reason: "not_a_file",
-        message: "\uADF8 \uACBD\uB85C\uB294 \uD30C\uC77C\uC774 \uC544\uB2C8\uC5D0\uC694."
+        message: "\uC2EC\uBCFC\uB9AD \uB9C1\uD06C\uB294 \uC0AC\uC9C4 \uD30C\uC77C\uB85C \uC5F4 \uC218 \uC5C6\uC5B4\uC694."
       };
     }
-    size = info.size;
   } catch {
     return {
       ok: false,
@@ -16628,47 +16973,80 @@ async function openLocalImage(path) {
       message: "\uADF8 \uACBD\uB85C\uC5D0\uC11C \uD30C\uC77C\uC744 \uCC3E\uC9C0 \uBABB\uD588\uC5B4\uC694."
     };
   }
-  if (size > MAX_FILE_BYTES) {
-    return {
-      ok: false,
-      reason: "too_large",
-      message: `\uC0AC\uC9C4\uC774 \uB108\uBB34 \uCEE4\uC694(\uCD5C\uB300 ${String(MAX_FILE_BYTES / 1024 / 1024)}MB).`
-    };
-  }
-  if (size === 0) {
-    return { ok: false, reason: "empty", message: "\uBE48 \uD30C\uC77C\uC774\uC5D0\uC694." };
-  }
-  let contentType = null;
+  let handle;
   try {
-    const fh = await open(path, "r");
-    try {
-      const head = new Uint8Array(12);
-      await fh.read(head, 0, 12, 0);
-      contentType = sniff(head);
-    } finally {
-      await fh.close();
+    const noFollow = constants.O_NOFOLLOW;
+    if (process.platform !== "win32" && typeof noFollow !== "number") {
+      return {
+        ok: false,
+        reason: "unreadable",
+        message: "\uC774 \uD658\uACBD\uC5D0\uC11C\uB294 \uD30C\uC77C\uC744 \uC548\uC804\uD558\uAC8C \uC5F4 \uC218 \uC5C6\uC5B4\uC694."
+      };
+    }
+    handle = await open(
+      path,
+      constants.O_RDONLY | (process.platform === "win32" ? 0 : noFollow)
+    );
+    const info = await handle.stat();
+    if (initial.dev !== info.dev || initial.ino !== info.ino) {
+      await handle.close();
+      return {
+        ok: false,
+        reason: "unreadable",
+        message: "\uD30C\uC77C\uC744 \uC5EC\uB294 \uB3D9\uC548 \uACBD\uB85C\uAC00 \uBC14\uB00C\uC5C8\uC5B4\uC694."
+      };
+    }
+    if (!info.isFile()) {
+      await handle.close();
+      return {
+        ok: false,
+        reason: "not_a_file",
+        message: "\uADF8 \uACBD\uB85C\uB294 \uD30C\uC77C\uC774 \uC544\uB2C8\uC5D0\uC694."
+      };
     }
+    if (info.size > MAX_FILE_BYTES) {
+      await handle.close();
+      return {
+        ok: false,
+        reason: "too_large",
+        message: `\uC0AC\uC9C4\uC774 \uB108\uBB34 \uCEE4\uC694(\uCD5C\uB300 ${String(MAX_FILE_BYTES / 1024 / 1024)}MB).`
+      };
+    }
+    if (info.size === 0) {
+      await handle.close();
+      return { ok: false, reason: "empty", message: "\uBE48 \uD30C\uC77C\uC774\uC5D0\uC694." };
+    }
+    const head = new Uint8Array(12);
+    await handle.read(head, 0, head.byteLength, 0);
+    const contentType = sniff(head);
+    if (contentType === null) {
+      await handle.close();
+      return {
+        ok: false,
+        reason: "not_an_image",
+        message: "\uC774\uBBF8\uC9C0 \uD30C\uC77C\uC774 \uC544\uB2C8\uC5D0\uC694(PNG\xB7JPEG\xB7GIF\xB7WebP\uB9CC \uB123\uC744 \uC218 \uC788\uC5B4\uC694)."
+      };
+    }
+    return {
+      ok: true,
+      stream: handle.createReadStream({
+        autoClose: true,
+        start: 0,
+        end: info.size - 1
+      }),
+      contentType,
+      byteLength: info.size,
+      fileName: basename(path)
+    };
   } catch {
+    await handle?.close().catch(() => {
+    });
     return {
       ok: false,
       reason: "unreadable",
       message: "\uD30C\uC77C\uC744 \uC5F4\uC9C0 \uBABB\uD588\uC5B4\uC694."
     };
   }
-  if (contentType === null) {
-    return {
-      ok: false,
-      reason: "not_an_image",
-      message: "\uC774\uBBF8\uC9C0 \uD30C\uC77C\uC774 \uC544\uB2C8\uC5D0\uC694(PNG\xB7JPEG\xB7GIF\xB7WebP\uB9CC \uB123\uC744 \uC218 \uC788\uC5B4\uC694)."
-    };
-  }
-  return {
-    ok: true,
-    stream: createReadStream(path),
-    contentType,
-    byteLength: size,
-    fileName: basename(path)
-  };
 }
 var MAX_BODY_BYTES = 64 * 1024;
 var DEFAULT_TOOLS_CHANGED_DEBOUNCE_MS = 600;
@@ -16685,6 +17063,9 @@ function headerValue(raw) {
   const trimmed = one?.trim();
   return trimmed ? trimmed.slice(0, 128) : void 0;
 }
+function correlationValue(value, max) {
+  return /^[a-zA-Z0-9_-]+$/.test(value) ? value.slice(0, max) : "redacted";
+}
 function createHttpBridge(opts) {
   const host = opts.host ?? "127.0.0.1";
   if (!isLoopbackHost(host)) {
@@ -16763,22 +17144,34 @@ function createHttpBridge(opts) {
 `);
     return true;
   };
-  const installStream = (key, res) => {
+  const installStream = (key, sessionId, res) => {
     if (streams.has(key)) {
-      throw new Error(`stream key ${key} is still occupied`);
+      throw new Error("stream slot is still occupied");
     }
     const heartbeat = setInterval(() => {
       send({ t: "hb", at: Date.now() }, key);
     }, opts.heartbeatMs ?? HEARTBEAT_INTERVAL_MS);
     heartbeat.unref?.();
-    streams.set(key, { res, heartbeat });
+    streams.set(key, { res, sessionId, heartbeat, fileStreams: /* @__PURE__ */ new Set() });
+    if (!opts.bridge.activateSession(key, sessionId)) {
+      clearInterval(heartbeat);
+      deleteStreamEntry(key);
+      throw new Error("stream session is no longer current");
+    }
     lifecycle?.retain?.();
   };
+  const deleteStreamEntry = (key) => {
+    streams.delete(key);
+  };
   const removeStream = (key) => {
     const stream = streams.get(key);
     if (!stream) return null;
     clearInterval(stream.heartbeat);
-    streams.delete(key);
+    for (const fileStream of stream.fileStreams) {
+      fileStream.destroy(new Error("browser session ended"));
+    }
+    stream.fileStreams.clear();
+    deleteStreamEntry(key);
     lifecycle?.release?.();
     return stream.res;
   };
@@ -16857,14 +17250,10 @@ function createHttpBridge(opts) {
       return;
     }
     if (req.method === "GET" && url2.pathname === "/bridge/events") {
-      if (!opts.bridge.connected) {
-        json2(res, 403, { error: "handshake required" });
-        return;
-      }
       const claimed = url2.searchParams.get("session");
-      const key = claimed === null ? opts.bridge.sessionKey : opts.bridge.keyForSession(claimed);
+      const key = claimed === null ? opts.bridge.legacySessionKey() : opts.bridge.keyForSession(claimed);
       if (key === null) {
-        opts.log?.(`refused a stream for session ${claimed ?? "unnamed"}`);
+        opts.log?.("refused a stream for an unknown session");
         res.writeHead(200, { "content-type": "text/event-stream" });
         res.end();
         return;
@@ -16873,7 +17262,7 @@ function createHttpBridge(opts) {
         key,
         bearerToken(req.headers.authorization)
       )) {
-        opts.log?.(`refused an unauthorised stream for ${key}`);
+        opts.log?.("refused an unauthorised stream");
         json2(res, 403, { error: "unauthorized" });
         return;
       }
@@ -16889,7 +17278,18 @@ function createHttpBridge(opts) {
         // by nature.
         "x-accel-buffering": "no"
       });
-      installStream(key, res);
+      const sessionId = claimed ?? opts.bridge.sessionForKey(key)?.sessionId ?? "";
+      if (!sessionId) {
+        res.end();
+        return;
+      }
+      try {
+        installStream(key, sessionId, res);
+      } catch {
+        res.end();
+        return;
+      }
+      send({ t: "hb", at: Date.now() }, key);
       if (key === opts.bridge.sessionKey) {
         cancelToolsDrop();
         notifyToolsChanged();
@@ -16952,29 +17352,115 @@ function createHttpBridge(opts) {
     if (req.method === "POST" && url2.pathname === "/bridge/file") {
       void readJson(req, MAX_BODY_BYTES).then(async (body) => {
         const b = body;
-        if (!opts.bridge.verifyLiveSessionToken(
-          typeof b?.token === "string" ? b.token : ""
-        )) {
-          json2(res, 403, { error: "unauthorized" });
+        const token = typeof b?.token === "string" ? b.token : "";
+        const path = typeof b?.path === "string" ? b.path : "";
+        const hasSessionId = b !== null && Object.hasOwn(b, "sessionId");
+        const hasRequestId = b !== null && Object.hasOwn(b, "requestId");
+        const invalidSessionId = hasSessionId && (typeof b?.sessionId !== "string" || b.sessionId.length === 0);
+        const invalidRequestId = hasRequestId && (typeof b?.requestId !== "string" || b.requestId.length === 0);
+        if (invalidSessionId || invalidRequestId) {
+          json2(res, 403, {
+            error: "unauthorized",
+            message: "\uC0AC\uC9C4 \uC694\uCCAD\uC758 \uC5F0\uACB0 \uC815\uBCF4\uB97C \uD655\uC778\uD558\uC9C0 \uBABB\uD588\uC5B4\uC694."
+          });
+          return;
+        }
+        const auth = hasSessionId ? opts.bridge.authorizeFileRequest({
+          sessionId: b.sessionId,
+          ...hasRequestId ? { requestId: b.requestId } : {},
+          token,
+          path,
+          ...typeof b?.tool === "string" ? { tool: b.tool } : {}
+        }) : opts.bridge.authorizeLegacyFileCredential(token);
+        if (!auth.ok) {
+          opts.log?.(
+            `file request refused: reason=${auth.reason} credential=${auth.credential} tokenPresent=${String(token.length > 0)} sessionMatch=${String(auth.key !== void 0)} open=not-entered`
+          );
+          json2(res, 403, {
+            error: "unauthorized",
+            message: "\uC0AC\uC9C4\uC744 \uAC00\uC838\uC62C \uC5F0\uACB0\uC744 \uD655\uC778\uD558\uC9C0 \uBABB\uD588\uC5B4\uC694."
+          });
           return;
         }
-        const out = await openLocalImage(
-          typeof b?.path === "string" ? b.path : ""
+        const streamEntry = streams.get(auth.key);
+        if (!streamEntry || streamEntry.sessionId !== auth.sessionId || !opts.bridge.isSessionStreamActive(auth.key, auth.sessionId) || !opts.bridge.consumeFileRequest(auth)) {
+          opts.log?.(
+            `file request refused: reason=file_session_not_live credential=${auth.credential} tokenPresent=true sessionMatch=false open=not-entered`
+          );
+          json2(res, 403, {
+            error: "unauthorized",
+            message: "\uC0AC\uC9C4\uC744 \uAC00\uC838\uC62C \uC5F0\uACB0\uC774 \uC5F4\uB824 \uC788\uC9C0 \uC54A\uC544\uC694."
+          });
+          return;
+        }
+        opts.log?.(
+          `file request authorised: browser=${correlationValue(auth.key, 8)} session=${correlationValue(auth.sessionId, 32)} request=${auth.requestId ? correlationValue(auth.requestId, 96) : "legacy"} credential=${auth.credential} registryMatch=${String(auth.credential === "claimed_browser")} open=entered`
         );
-        if (!out.ok) {
-          json2(res, 400, { error: out.reason, message: out.message });
+        let source = null;
+        let owner = null;
+        let peerClosed = false;
+        const stop = () => {
+          peerClosed = true;
+          source?.destroy();
+        };
+        req.once("aborted", stop);
+        res.once("close", stop);
+        try {
+          const out = await (opts.openLocalImage ?? openLocalImage)(path);
+          if (!out.ok) {
+            if (!peerClosed) {
+              json2(res, 400, { error: out.reason, message: out.message });
+            }
+            return;
+          }
+          source = out.stream;
+          if (peerClosed) {
+            source.destroy();
+            return;
+          }
+          const current = streams.get(auth.key);
+          if (current !== streamEntry || current.sessionId !== auth.sessionId || !opts.bridge.isSessionStreamActive(auth.key, auth.sessionId)) {
+            source.destroy(new Error("browser session ended"));
+            json2(res, 403, {
+              error: "unauthorized",
+              message: "\uC0AC\uC9C4\uC744 \uAC00\uC838\uC62C \uC5F0\uACB0\uC774 \uC5F4\uB824 \uC788\uC9C0 \uC54A\uC544\uC694."
+            });
+            return;
+          }
+          res.writeHead(200, {
+            "content-type": out.contentType,
+            "content-length": String(out.byteLength),
+            "x-file-name": encodeURIComponent(out.fileName),
+            "cache-control": "no-store"
+          });
+          owner = current;
+          owner.fileStreams.add(source);
+          await pipeline(source, res);
+        } catch {
+          if (!res.writableEnded) res.destroy();
+        } finally {
+          req.off("aborted", stop);
+          res.off("close", stop);
+          if (source) owner?.fileStreams.delete(source);
+        }
+      }).catch(() => json2(res, 400, { error: "bad request" }));
+      return;
+    }
+    if (req.method === "POST" && url2.pathname === "/bridge/file/cancel") {
+      void readJson(req, MAX_BODY_BYTES).then((body) => {
+        const b = body;
+        if (typeof b?.token !== "string" || typeof b.sessionId !== "string" || typeof b.requestId !== "string") {
+          json2(res, 403, { error: "unauthorized" });
           return;
         }
-        res.writeHead(200, {
-          "content-type": out.contentType,
-          "content-length": String(out.byteLength),
-          // The extension shows this in its confirmation, so the user knows
-          // which file is about to be used.
-          "x-file-name": encodeURIComponent(out.fileName),
-          "cache-control": "no-store"
+        const reason = opts.bridge.cancelFileRequest({
+          token: b.token,
+          sessionId: b.sessionId,
+          requestId: b.requestId
+        });
+        json2(res, reason === null ? 200 : 403, {
+          ...reason === null ? { ok: true } : { error: "unauthorized" }
         });
-        out.stream.pipe(res);
-        out.stream.on("error", () => res.destroy());
       }).catch(() => json2(res, 400, { error: "bad request" }));
       return;
     }
@@ -17056,6 +17542,12 @@ function createHttpBridge(opts) {
   return {
     server,
     send,
+    disconnect: (key) => {
+      const wasPrimary = key === opts.bridge.sessionKey;
+      removeStream(key)?.end();
+      opts.bridge.disconnect(key);
+      if (wasPrimary) scheduleToolsDrop();
+    },
     close: () => new Promise((resolve) => {
       cancelToolsDrop();
       opts.bridge.disconnectAll();
@@ -17308,7 +17800,7 @@ function isRegistration(row) {
   const r = row;
   const id = r["browserId"];
   const hash2 = r["tokenHash"];
-  return (id === null || typeof id === "string") && typeof hash2 === "string" && hash2.length > 0 && typeof r["label"] === "string" && typeof r["createdAt"] === "string";
+  return (id === null || typeof id === "string" && id.length > 0) && typeof hash2 === "string" && /^[a-f0-9]{64}$/.test(hash2) && typeof r["label"] === "string" && typeof r["createdAt"] === "string";
 }
 function readLedger(path) {
   let raw;
@@ -17332,8 +17824,20 @@ function readLedger(path) {
   if (!parsed.every(isRegistration)) {
     return { state: "unreadable", reason: "a row is not a browser" };
   }
+  const browserIds = /* @__PURE__ */ new Set();
+  const tokenHashes = /* @__PURE__ */ new Set();
+  for (const row of parsed) {
+    if (tokenHashes.has(row.tokenHash) || row.browserId !== null && browserIds.has(row.browserId)) {
+      return { state: "unreadable", reason: "duplicate browser authority" };
+    }
+    tokenHashes.add(row.tokenHash);
+    if (row.browserId !== null) browserIds.add(row.browserId);
+  }
   return { state: "ok", rows: parsed };
 }
+function ledgerOverlapsToken(rows, tokenHash) {
+  return rows.some((row) => row.tokenHash === tokenHash);
+}
 async function writeLedger(path, claims) {
   const queued = (writing.get(path) ?? Promise.resolve()).then(
     () => writeOnce(path, claims),
@@ -17385,7 +17889,11 @@ function createBrowserRegistry(opts) {
     if (read.state === "unreadable") {
       throw new Error(`browser registry is unreadable: ${read.reason}`);
     }
-    return read.state === "ok" ? [...read.rows] : [];
+    const rows = read.state === "ok" ? [...read.rows] : [];
+    if (opts.forbiddenTokenHash && ledgerOverlapsToken(rows, opts.forbiddenTokenHash)) {
+      throw new Error("browser registry overlaps the root authority");
+    }
+    return rows;
   };
   return {
     async add(label) {
@@ -17436,7 +17944,10 @@ function createBrowserRegistry(opts) {
       for (const claim of claims) {
         if (!matches(claim, handle)) continue;
         revoked.add(claim.tokenHash);
-        if (claim.browserId !== null) opts.claimed.delete(claim.browserId);
+        if (claim.browserId !== null) {
+          opts.claimed.delete(claim.browserId);
+          opts.onRevoke?.(claim.browserId);
+        }
       }
       return true;
     },
@@ -17471,7 +17982,9 @@ function runDaemon(env, deps = {}) {
   const claimedBrowsers = /* @__PURE__ */ new Map();
   const browserLabels = /* @__PURE__ */ new Map();
   const ledger = readLedger(ledgerPath(deps.home));
-  if (ledger.state === "ok") {
+  const rootTokenHash = digestToken(token);
+  const ledgerAuthorityValid = ledger.state !== "ok" || !ledgerOverlapsToken(ledger.rows, rootTokenHash);
+  if (ledger.state === "ok" && ledgerAuthorityValid) {
     for (const [id, hash2] of claimedDigestsFrom(ledger.rows)) {
       claimedBrowsers.set(id, hash2);
     }
@@ -17484,6 +17997,9 @@ function runDaemon(env, deps = {}) {
       `browser registry is unreadable (${ledger.reason}); registering is off`
     );
   }
+  if (!ledgerAuthorityValid) {
+    log("browser registry overlaps the root authority; registering is off");
+  }
   const bridge = new Bridge({
     send: (frame, key) => http.send(frame, key),
     // Step aside once our own token looks stale. This process is detached
@@ -17522,7 +18038,9 @@ function runDaemon(env, deps = {}) {
   const mediaStage = createMediaStage({ root: join4(stateDir, "media") });
   const registry2 = createBrowserRegistry({
     path: ledgerPath(deps.home),
-    claimed: claimedBrowsers
+    claimed: claimedBrowsers,
+    forbiddenTokenHash: rootTokenHash,
+    onRevoke: (browserId) => http.disconnect(browserId)
   });
   const http = createHttpBridge({
     bridge,