@moretea-labs/forge 1.8.0 → 1.8.2

package/src/runtime/plugins/browser-adapter.ts

@@ -1,7 +1,11 @@
 import { createHash, randomUUID } from 'crypto';
+import { spawn, spawnSync } from 'child_process';
 import { createRequire } from 'module';
-import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from 'fs';
+import { createServer as createNetServer } from 'net';
+import { existsSync, mkdirSync, readFileSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from 'fs';
+import { homedir } from 'os';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'path';
+import { fileURLToPath } from 'url';
 import type {
   AssistantPluginActionExecutionInput,
   AssistantPluginAuthorizationContext,
@@ -10,6 +14,8 @@ import type {
   AssistantPluginManifest,
 } from './types';
 import { AssistantPluginError, toAssistantPluginError } from './errors';
+import { listCanonicalGrants } from '../../../packages/kernel/identity/api/index';
+import { resolveRepoPreferredControllerHome } from '../../cli/repositories/controller-home';
 import { readRepositoryPluginConfig, writeRepositoryPluginConfig, type RepositoryPluginConfigContext } from './config-store';
 import {
   browserActions,
@@ -17,7 +23,6 @@ import {
   browserPermissions,
 } from './browser-manifest-surface';
 import { executeBrowserActionThroughNode, shouldUseBrowserNodeBridge } from './browser-node-bridge';
-import { BrowserProviderUnavailableBeforeActionError } from '../../../packages/plugin-runtime/browser/provider-registry';
 import { MAX_BROWSER_CDP_ENDPOINT_CANDIDATES } from '../../../packages/plugin-runtime/browser/runtime-contract';
 import {
   ALL_BROWSER_PROVIDER_CAPABILITIES,
@@ -28,6 +33,8 @@ import {
   invalidateBrowserRuntime,
 } from './browser-runtime';
 import { activateRuntimeComputerBrowserApplication } from '../root/computer-composition';
+import { resolveWorkspaceTargetPath, WorkspaceTargetGrantError } from '../workspace-targets';
+import { pluginCapabilityAuthorizationOwnerScope } from './capability-authorization-grants';
 import {
   DEFAULT_BROWSER_SESSION_LIST_LIMIT,
   MAX_BROWSER_SESSION_LIST_LIMIT,
@@ -50,6 +57,7 @@ import {
   readMacOsBrowserOwnedTabMetadata,
   macOsActiveBrowserAttachSupported,
   macOsBrowserJavaScriptAutomationDisabled,
+  assertMacOsBrowserApplicationRunning,
   type MacOsBrowserAttachAttempt,
   type MacOsBrowserCreateTabEvidence,
   type MacOsBrowserProduct,
@@ -107,12 +115,12 @@ type WaitForSelectorState = 'attached' | 'detached' | 'visible' | 'hidden';
 type BrowserChannel = 'chromium' | 'chrome' | 'chrome-beta' | 'chrome-dev' | 'chrome-canary';
 type BrowserNativeAttachMode = 'auto' | 'disabled';
 
-const CURRENT_BROWSER_CONFIG_SCHEMA_VERSION = 2 as const;
+const CURRENT_BROWSER_CONFIG_SCHEMA_VERSION = 3 as const;
 const DEFAULT_USER_BROWSER_CHANNEL: BrowserChannel = 'chrome';
-const DEFAULT_USER_NATIVE_BROWSER_CANDIDATES: MacOsBrowserProduct[] = ['chrome'];
+const DEFAULT_USER_NATIVE_BROWSER_CANDIDATES: MacOsBrowserProduct[] = ['chrome', 'vivaldi'];
 
 interface BrowserPluginConfig {
-  schemaVersion: 2;
+  schemaVersion: 3;
   enabled: boolean;
   provider: 'playwright';
   browserMode?: BrowserMode;
@@ -131,7 +139,7 @@ interface BrowserPluginConfig {
 }
 
 type PersistedBrowserPluginConfig = Partial<Omit<BrowserPluginConfig, 'schemaVersion'>> & {
-  schemaVersion?: 1 | 2;
+  schemaVersion?: 1 | 2 | 3;
 };
 
 type BrowserSessionInventory = {
@@ -175,15 +183,109 @@ interface BrowserProfileSelection {
   selectedProfilePath: string;
 }
 
+type BrowserExtensionTargetLike = { url(): string };
+type BrowserCdpSessionLike = {
+  send(method: string, params?: Record<string, unknown>): Promise<unknown>;
+  detach?(): Promise<void>;
+};
+
+function connectNativeBrowserCdp(endpoint: string, timeoutMs: number): Promise<BrowserCdpSessionLike> {
+  const boundedTimeoutMs = Math.max(250, Math.min(timeoutMs, 30_000));
+  return new Promise<BrowserCdpSessionLike>((resolveSession, rejectSession) => {
+    const socket = new WebSocket(endpoint);
+    const pending = new Map<number, {
+      resolve(value: unknown): void;
+      reject(error: Error): void;
+      timer: ReturnType<typeof setTimeout>;
+    }>();
+    let nextId = 1;
+    let connectSettled = false;
+
+    const failPending = (error: Error) => {
+      for (const request of pending.values()) {
+        clearTimeout(request.timer);
+        request.reject(error);
+      }
+      pending.clear();
+    };
+    const failConnect = (error: Error) => {
+      if (connectSettled) return;
+      connectSettled = true;
+      clearTimeout(connectTimer);
+      rejectSession(error);
+    };
+    const connectTimer = setTimeout(() => {
+      failConnect(new Error(`Browser CDP WebSocket did not open within ${boundedTimeoutMs}ms.`));
+      try { socket.close(); } catch { /* best-effort bounded cleanup */ }
+    }, boundedTimeoutMs);
+
+    socket.onopen = () => {
+      if (connectSettled) return;
+      connectSettled = true;
+      clearTimeout(connectTimer);
+      resolveSession({
+        send: (method, params) => new Promise<unknown>((resolveResult, rejectResult) => {
+          const id = nextId++;
+          const timer = setTimeout(() => {
+            pending.delete(id);
+            rejectResult(new Error(`Browser CDP method ${method} timed out after ${boundedTimeoutMs}ms.`));
+          }, boundedTimeoutMs);
+          pending.set(id, { resolve: resolveResult, reject: rejectResult, timer });
+          try {
+            socket.send(JSON.stringify({ id, method, ...(params ? { params } : {}) }));
+          } catch (error) {
+            clearTimeout(timer);
+            pending.delete(id);
+            rejectResult(error instanceof Error ? error : new Error(String(error)));
+          }
+        }),
+        detach: async () => {
+          failPending(new Error('Browser CDP session detached.'));
+          try { socket.close(); } catch { /* best-effort bounded cleanup */ }
+        },
+      });
+    };
+    socket.onmessage = (event) => {
+      if (typeof event.data !== 'string') return;
+      let message: { id?: unknown; result?: unknown; error?: { message?: unknown } };
+      try { message = JSON.parse(event.data) as typeof message; }
+      catch { return; }
+      if (!Number.isInteger(message.id)) return;
+      const request = pending.get(Number(message.id));
+      if (!request) return;
+      pending.delete(Number(message.id));
+      clearTimeout(request.timer);
+      if (message.error) {
+        request.reject(new Error(typeof message.error.message === 'string' ? message.error.message : 'Browser CDP command failed.'));
+      } else {
+        request.resolve(message.result);
+      }
+    };
+    socket.onerror = () => {
+      const error = new Error('Browser CDP WebSocket transport failed.');
+      failConnect(error);
+      failPending(error);
+    };
+    socket.onclose = () => {
+      const error = new Error('Browser CDP WebSocket transport closed.');
+      failConnect(error);
+      failPending(error);
+    };
+  });
+}
 type BrowserContextLike = {
   pages(): PageLike[];
   newPage(): Promise<PageLike>;
   close(): Promise<void>;
+  browser?(): BrowserLike | null;
+  serviceWorkers?(): BrowserExtensionTargetLike[];
+  backgroundPages?(): BrowserExtensionTargetLike[];
 };
 
 type BrowserLike = {
   contexts(): BrowserContextLike[];
   newContext?(): Promise<BrowserContextLike>;
+  newBrowserCDPSession?(): Promise<BrowserCdpSessionLike>;
   close?(): Promise<void>;
   disconnect?(): Promise<void> | void;
 };
@@ -251,20 +353,73 @@ type PlaywrightRuntime = {
   };
 };
 
+export function browserDependencyRequireAnchors(repoRoot?: string, moduleUrl = import.meta.url): string[] {
+  const releasePackageManifest = join(dirname(fileURLToPath(moduleUrl)), 'package', 'package.json');
+  return [
+    existsSync(releasePackageManifest) ? releasePackageManifest : undefined,
+    repoRoot ? join(repoRoot, 'package.json') : undefined,
+    moduleUrl,
+  ].filter((anchor): anchor is string => typeof anchor === 'string');
+}
+
 interface BrowserPluginRuntimeHooks {
   now(): string;
   moduleAvailable(name: string, repoRoot?: string): boolean;
   loadPlaywright(repoRoot?: string): PlaywrightRuntime;
   fetchJson(url: string, timeoutMs: number): Promise<unknown>;
   activateNativeBrowserApplication(input: AssistantPluginActionExecutionInput, product: MacOsBrowserProduct): Promise<void>;
+  /** Bounded process inventory used only to reclaim Forge-owned browser profiles. */
+  listProcesses(): Array<{ pid: number; command: string }>;
+  /** Signal one process; returns false when it already exited. */
+  signalProcess(pid: number, signal: NodeJS.Signals): boolean;
+  /** Launch one browser process without claiming its lifecycle through Playwright. */
+  launchProcess(executable: string, args: string[]): { pid?: number };
+  /** Allocate one currently-free loopback TCP port for an immediately following browser launch. */
+  allocateLoopbackPort(): Promise<number>;
+  /** Open one bounded browser-level CDP session without a Playwright browser/context adapter. */
+  connectBrowserCdp(endpoint: string, timeoutMs: number): Promise<BrowserCdpSessionLike>;
 }
 
 const defaultRuntimeHooks: BrowserPluginRuntimeHooks = {
   now: () => new Date().toISOString(),
+  listProcesses: () => {
+    const result = spawnSync('ps', ['-eo', 'pid=,command='], { encoding: 'utf8', timeout: 10_000, maxBuffer: 8 * 1024 * 1024 });
+    if (result.status !== 0 || typeof result.stdout !== 'string') return [];
+    const entries: Array<{ pid: number; command: string }> = [];
+    for (const line of result.stdout.split('\n')) {
+      const match = /^\s*(\d+)\s+(.*)$/.exec(line);
+      if (!match?.[1] || !match[2]) continue;
+      entries.push({ pid: Number(match[1]), command: match[2] });
+    }
+    return entries;
+  },
+  signalProcess: (pid, signal) => {
+    try { process.kill(pid, signal); return true; }
+    catch (error) { return (error as NodeJS.ErrnoException).code !== 'ESRCH'; }
+  },
+  launchProcess: (executable, args) => {
+    const child = spawn(executable, args, { stdio: 'ignore', detached: true });
+    child.once('error', () => undefined);
+    child.unref();
+    return { pid: child.pid };
+  },
+  allocateLoopbackPort: () => new Promise<number>((resolvePort, rejectPort) => {
+    const server = createNetServer();
+    server.unref();
+    server.once('error', rejectPort);
+    server.listen({ host: '127.0.0.1', port: 0, exclusive: true }, () => {
+      const address = server.address();
+      const port = typeof address === 'object' && address ? address.port : 0;
+      server.close((error) => {
+        if (error) return rejectPort(error);
+        if (!Number.isInteger(port) || port <= 0 || port > 65_535) return rejectPort(new Error('BROWSER_LOOPBACK_PORT_ALLOCATION_FAILED'));
+        resolvePort(port);
+      });
+    });
+  }),
+  connectBrowserCdp: connectNativeBrowserCdp,
   moduleAvailable: (name: string, repoRoot?: string) => {
-    const anchors = [repoRoot ? join(repoRoot, 'package.json') : undefined, import.meta.url]
-      .filter((value): value is string => Boolean(value));
-    for (const anchor of anchors) {
+    for (const anchor of browserDependencyRequireAnchors(repoRoot)) {
       try {
         createRequire(anchor).resolve(name);
         return true;
@@ -275,16 +430,14 @@ const defaultRuntimeHooks: BrowserPluginRuntimeHooks = {
     return false;
   },
   loadPlaywright: (repoRoot?: string) => {
-    const anchors = [repoRoot ? join(repoRoot, 'package.json') : undefined, import.meta.url]
-      .filter((value): value is string => Boolean(value));
-    for (const anchor of anchors) {
+    for (const anchor of browserDependencyRequireAnchors(repoRoot)) {
       try {
         return createRequire(anchor)('playwright') as PlaywrightRuntime;
       } catch {
         // Try the next trusted dependency anchor.
       }
     }
-    throw new AssistantPluginError('PLUGIN_DEPENDENCY_MISSING', 'Browser plugin requires playwright. Run bun install before using browser actions.', {
+    throw new AssistantPluginError('PLUGIN_DEPENDENCY_MISSING', 'Browser plugin cannot resolve packaged Playwright or an authorized repository-local installation.', {
       retryable: false,
     });
   },
@@ -313,6 +466,7 @@ interface ManagedBrowserContextState {
 }
 
 const managedBrowserContexts = new Map<string, Promise<ManagedBrowserContextState>>();
+const managedExtensionPaths = new Map<string, Set<string>>();
 
 export function setBrowserPluginRuntimeHooksForTest(hooks: Partial<BrowserPluginRuntimeHooks>): void {
   runtimeHooks = { ...defaultRuntimeHooks, ...hooks };
@@ -323,6 +477,7 @@ export function resetBrowserPluginRuntimeHooksForTest(): void {
   runtimeHooks = { ...defaultRuntimeHooks };
   runtimeHooksCustomized = false;
   managedBrowserContexts.clear();
+  managedExtensionPaths.clear();
 }
 
 function now(): string {
@@ -426,6 +581,8 @@ function resolveProfileSelection(repoRoot: string, profileDir: string, profileDi
 
 function normalizeConfig(raw: PersistedBrowserPluginConfig): BrowserPluginConfig {
   const normalizedProfileDir = stringValue(raw.profileDir);
+  const normalizedExecutablePath = stringValue(raw.executablePath);
+  const normalizedBrowserChannel = browserChannel(raw.browserChannel);
   return {
     schemaVersion: CURRENT_BROWSER_CONFIG_SCHEMA_VERSION,
     enabled: raw.enabled === true,
@@ -434,8 +591,8 @@ function normalizeConfig(raw: PersistedBrowserPluginConfig): BrowserPluginConfig
     profileMode: browserProfileMode(raw.profileMode) ?? (normalizedProfileDir ? 'custom' : 'repo_local'),
     profileDir: normalizedProfileDir,
     profileDirectory: stringValue(raw.profileDirectory),
-    browserChannel: browserChannel(raw.browserChannel) ?? DEFAULT_USER_BROWSER_CHANNEL,
-    executablePath: stringValue(raw.executablePath),
+    browserChannel: normalizedBrowserChannel ?? (normalizedExecutablePath ? undefined : DEFAULT_USER_BROWSER_CHANNEL),
+    executablePath: normalizedExecutablePath,
     cdpEndpoint: stringValue(raw.cdpEndpoint),
     cdpEndpointCandidates: stringList(raw.cdpEndpointCandidates)?.slice(0, MAX_BROWSER_CDP_ENDPOINT_CANDIDATES),
     cdpDiscoveryTimeoutMs: typeof raw.cdpDiscoveryTimeoutMs === 'number'
@@ -449,22 +606,38 @@ function normalizeConfig(raw: PersistedBrowserPluginConfig): BrowserPluginConfig
 }
 
 function migrateLegacyRepositoryConfig(raw: PersistedBrowserPluginConfig): PersistedBrowserPluginConfig {
-  if (raw.schemaVersion !== 1) return raw;
+  if (raw.schemaVersion === CURRENT_BROWSER_CONFIG_SCHEMA_VERSION) return raw;
+  // v1 legacy managed profiles were an implicit route to a fresh browser.
+  // Migrate that default to the existing signed-in native browser; preserve
+  // explicit v2 managed configurations as separate scripting capabilities.
+  const legacyV1 = raw.schemaVersion === 1;
   return {
+    ...raw,
     schemaVersion: CURRENT_BROWSER_CONFIG_SCHEMA_VERSION,
-    enabled: raw.enabled,
-    provider: 'playwright',
-    browserMode: 'attach_preferred',
-    profileMode: 'repo_local',
-    browserChannel: DEFAULT_USER_BROWSER_CHANNEL,
-    cdpAttachFallback: 'fail_closed',
-    nativeAttachMode: 'auto',
-    nativeBrowserCandidates: [...DEFAULT_USER_NATIVE_BROWSER_CANDIDATES],
-    defaultTimeoutMs: raw.defaultTimeoutMs,
-    cdpDiscoveryTimeoutMs: raw.cdpDiscoveryTimeoutMs,
+    browserMode: legacyV1 ? 'attach_preferred' : (browserMode(raw.browserMode) ?? 'attach_preferred'),
+    cdpAttachFallback: legacyV1 ? 'fail_closed' : (raw.cdpAttachFallback ?? 'fail_closed'),
+    nativeAttachMode: legacyV1 ? 'auto' : (raw.nativeAttachMode ?? 'auto'),
+    ...(legacyV1 ? {
+      profileMode: 'repo_local' as const, profileDir: undefined, profileDirectory: undefined,
+      browserChannel: DEFAULT_USER_BROWSER_CHANNEL, nativeBrowserCandidates: [...DEFAULT_USER_NATIVE_BROWSER_CANDIDATES],
+    } : {}),
   };
 }
 
+export function normalizeLegacyBrowserConfig(raw: unknown): BrowserPluginConfig {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
+    throw new Error('PLUGIN_CONFIG_MIGRATION_INVALID: browser config must be an object');
+  }
+  const parsed = raw as PersistedBrowserPluginConfig;
+  if (![1, 2, 3].includes(parsed.schemaVersion as number)) {
+    throw new Error('PLUGIN_CONFIG_MIGRATION_INVALID: unsupported browser schemaVersion');
+  }
+  const migrated = normalizeConfig(migrateLegacyRepositoryConfig(parsed));
+  const errors = validateConfig(migrated);
+  if (errors.length) throw new Error(`PLUGIN_CONFIG_MIGRATION_INVALID: ${errors[0]}`);
+  return migrated;
+}
+
 function readJson<T>(path: string): T | undefined {
   try {
     return JSON.parse(readFileSync(path, 'utf-8')) as T;
@@ -478,28 +651,63 @@ function writeJson(path: string, value: unknown): void {
   writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`, 'utf-8');
 }
 
-function loadConfig(repoRoot: string, context?: Pick<RepositoryPluginConfigContext, 'controllerHome' | 'repoId'>): BrowserPluginConfig {
+function loadConfig(
+  repoRoot: string,
+  context?: Pick<RepositoryPluginConfigContext, 'controllerHome' | 'repoId'>,
+  computerNativeOnly = false,
+): BrowserPluginConfig {
+  // Computer Browser is a built-in Forge capability, not an optional
+  // repository Browser-script plugin. Its native defaults ship with the
+  // first-party Computer adapter; never inherit an independent Playwright
+  // profile, enabled flag, CDP endpoint, or fallback from a repository.
+  if (computerNativeOnly) return normalizeConfig({
+    enabled: true, browserMode: 'attach_preferred',
+    nativeAttachMode: 'auto', cdpAttachFallback: 'fail_closed',
+    nativeBrowserCandidates: [...DEFAULT_USER_NATIVE_BROWSER_CANDIDATES],
+  });
   const persisted = context
     ? readRepositoryPluginConfig<PersistedBrowserPluginConfig>({ ...context, repoRoot }, BROWSER_PLUGIN_ID)
     : undefined;
-  if (!persisted) return normalizeConfig({});
-  return normalizeConfig(migrateLegacyRepositoryConfig(persisted));
+  return persisted ? normalizeConfig(migrateLegacyRepositoryConfig(persisted)) : normalizeConfig({});
 }
 
 async function resolveBrowserPluginAuthorizationContextInternal(
   input: AssistantPluginActionExecutionInput,
 ): Promise<AssistantPluginAuthorizationContext | undefined> {
   const action = browserActions().find((entry) => entry.actionId === input.actionId);
-  if (!action || action.confirmation !== 'authorization' || !action.scopes.includes('browser.interact')) return undefined;
-
-  const persistedConfig = loadConfig(input.repoRoot, input);
+  // Browser session/profile mutations also need an exact reusable target. In
+  // particular, create_session is the bootstrap action for a scheduled
+  // Controller round and intentionally carries browser.read + browser.profile
+  // rather than browser.interact. Restricting authorization resolution to
+  // browser.interact made the first interactive session usable only for that
+  // call and left the Scheduler without a durable browser-session grant.
+  if (!action || action.confirmation !== 'authorization' || !action.scopes.includes('browser.profile')) return undefined;
+
+  const persistedConfig = loadConfig(input.repoRoot, input, input.pluginId === 'computer');
   const sessionId = stringValue(input.args.session_id);
   const authorizationBrowserMode = parseBrowserModeInput(input.args.browser_mode) ?? persistedConfig.browserMode;
   if (!sessionId || authorizationBrowserMode === 'isolated') return undefined;
   const session = findBrowserSession(input.repoRoot, sessionId);
   const config = effectiveBrowserActionConfig(persistedConfig, input.args, session);
   const connection = session?.browser;
-  if (!session || !connection || connection.activeMode === 'isolated') return undefined;
+  if (!session || !connection || connection.activeMode === 'isolated') {
+    // create_session precedes its durable session record. Recover only the
+    // exact browser-origin target already named by this Work's grant refs.
+    if (input.actionId !== 'create_session') return undefined;
+    let origin: string;
+    try { origin = new URL(stringValue(input.args.url) ?? '').origin.toLowerCase(); } catch { return undefined; }
+    const refs = new Set((input.authorizationGrantRefs ?? []).map((ref) => ref.trim()).filter(Boolean));
+    const target = listCanonicalGrants(input.controllerHome).find((grant) => (
+      refs.has(grant.grantId)
+      && grant.target?.kind === 'browser-origin'
+      && grant.target.id.endsWith(`@${origin}`)
+      && grant.scopes?.includes('browser.profile')
+    ))?.target;
+    return target ? {
+      target: { kind: target.kind, id: target.id, identityFingerprint: target.identityFingerprint },
+      expiresInMinutes: 30 * 24 * 60,
+    } : undefined;
+  }
 
   let origin: string;
   try {
@@ -549,6 +757,10 @@ export async function resolveBrowserPluginAuthorizationContext(
 
 function saveConfig(input: Pick<AssistantPluginActionExecutionInput, 'controllerHome' | 'repoId' | 'repoRoot'>, patch: Partial<BrowserPluginConfig>): BrowserPluginConfig {
   const next = normalizeConfig({ ...loadConfig(input.repoRoot, input), ...patch });
+  const errors = validateConfig(next);
+  if (errors.length > 0) {
+    throw new AssistantPluginError('PLUGIN_CONFIGURATION_INVALID', errors[0], { retryable: false });
+  }
   return writeRepositoryPluginConfig(input, BROWSER_PLUGIN_ID, next);
 }
 
@@ -740,11 +952,11 @@ function validateConfig(config: BrowserPluginConfig): string[] {
     const error = cdpEndpointValidationError(endpoint);
     if (error) errors.push(error);
   }
-  if (config.browserMode === 'attach_preferred'
-    && endpoints.length === 0
-    && config.cdpAttachFallback === 'fail_closed'
-    && config.nativeAttachMode === 'disabled') {
-    errors.push('A CDP endpoint or nativeAttachMode=auto is required when browserMode=attach_preferred and cdpAttachFallback=fail_closed.');
+  if (config.browserMode === 'attach_preferred') {
+    if (endpoints.length > 1) errors.push('One Browser attach capability may bind only one CDP endpoint.');
+    if (config.cdpAttachFallback === 'managed_persistent') errors.push('Managed Browser is an explicit browser_mode, never an attach fallback.');
+    // The configured list is discovery scope; execution must bind exactly one
+    // provider from the actual tab/product evidence, never select by fallback.
   }
   return errors;
 }
@@ -757,14 +969,8 @@ function configWarnings(config: BrowserPluginConfig): string[] {
       warnings.push('Custom profile mode is more reliable with an explicit Chrome channel or executable path that matches the selected profile format.');
     }
   }
-  if (config.browserMode === 'attach_preferred' && cdpEndpoints(config).length === 0) {
-    if (config.nativeAttachMode === 'auto' && macOsActiveBrowserAttachSupported()) {
-      warnings.push(config.cdpAttachFallback === 'fail_closed'
-        ? 'browserMode=attach_preferred has no configured CDP endpoint; configured native-browser attach will be attempted and managed fallback is disabled.'
-        : 'browserMode=attach_preferred has no configured CDP endpoint; configured native-browser attach will be attempted before explicit managed fallback.');
-    } else {
-      warnings.push('browserMode=attach_preferred has no configured CDP endpoint; actions will use the configured fallback policy.');
-    }
+  if (config.browserMode === 'attach_preferred' && cdpEndpoints(config).length === 0 && config.nativeAttachMode === 'auto') {
+    warnings.push('Native browser attach is the single selected provider; CDP and managed browsers are not automatic alternatives.');
   }
   if (config.browserMode === 'isolated') {
     warnings.push('browserMode=isolated uses a per-session repo-local profile and will not share the default browser profile.');
@@ -1056,7 +1262,7 @@ interface BrowserOpenHandle {
 
 interface PageDiagnostics {
   consoleErrors: Array<{ type: string; text: string }>;
-  failedRequests: Array<{ url: string; status?: number; failure?: string }>;
+  failedRequests: Array<{ url: string; method?: string; status?: number; failure?: string }>;
   navigation?: { url: string; status?: number };
 }
 
@@ -1074,18 +1280,21 @@ function attachDiagnostics(page: PageLike): PageDiagnostics {
       }
     });
     page.on('requestfailed', (request) => {
-      const entry = request as { url?: () => string; failure?: () => { errorText?: string } | null };
+      const entry = request as { url?: () => string; method?: () => string; failure?: () => { errorText?: string } | null };
       diagnostics.failedRequests.push({
         url: typeof entry.url === 'function' ? entry.url() : '',
+        method: typeof entry.method === 'function' ? entry.method() : undefined,
         failure: typeof entry.failure === 'function' ? entry.failure()?.errorText : undefined,
       });
     });
     page.on('response', (response) => {
-      const entry = response as { url?: () => string; status?: () => number; ok?: () => boolean };
+      const entry = response as { url?: () => string; status?: () => number; ok?: () => boolean; request?: () => { method?: () => string } };
       const status = typeof entry.status === 'function' ? entry.status() : undefined;
       if (typeof status === 'number' && status >= 400) {
+        const request = typeof entry.request === 'function' ? entry.request() : undefined;
         diagnostics.failedRequests.push({
           url: typeof entry.url === 'function' ? entry.url() : '',
+          method: typeof request?.method === 'function' ? request.method() : undefined,
           status,
         });
       }
@@ -1214,54 +1423,7 @@ function sameOrigin(left: string, right: string): boolean {
   }
 }
 
-function stableBrowserEntityKey(value: string): string | undefined {
-  try {
-    const url = new URL(value);
-    if (url.protocol !== 'https:' && url.protocol !== 'http:') return undefined;
-    const segments = url.pathname.split('/').filter(Boolean);
-    for (let index = 0; index + 1 < segments.length; index += 1) {
-      if ((segments[index] ?? '').toLowerCase() !== 'apps') continue;
-      const id = segments[index + 1]?.trim();
-      if (id) return `${url.origin}/apps/${id}`;
-    }
-    return undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-function selectReusableNativeTab(
-  referenceUrls: string[],
-  inventory: Awaited<ReturnType<typeof listMacOsBrowserTabs>>,
-  preferredWindowId?: string,
-): {
-  candidate?: (typeof inventory.tabs)[number];
-  match: 'exact_url' | 'stable_entity' | 'none' | 'ambiguous';
-  candidateCount: number;
-} {
-  const normalizedReferences = [...new Set(referenceUrls.filter(Boolean).map(comparableUrl))];
-  const entityKeys = new Set(normalizedReferences.map(stableBrowserEntityKey).filter((value): value is string => Boolean(value)));
-  const scored = inventory.tabs.map((candidate) => {
-    const normalizedCandidate = comparableUrl(candidate.url);
-    const entityKey = stableBrowserEntityKey(candidate.url);
-    const matchScore = normalizedReferences.includes(normalizedCandidate)
-      ? 100
-      : entityKey && entityKeys.has(entityKey)
-        ? 50
-        : 0;
-    const score = matchScore === 0
-      ? 0
-      : matchScore + (preferredWindowId && candidate.windowId === preferredWindowId ? 10 : 0) + (candidate.active ? 1 : 0);
-    return { candidate, score, matchScore };
-  });
-  const maxScore = scored.reduce((max, entry) => Math.max(max, entry.score), 0);
-  if (maxScore === 0) return { match: 'none', candidateCount: 0 };
-  const matches = scored.filter((entry) => entry.score === maxScore);
-  if (matches.length !== 1) return { match: 'ambiguous', candidateCount: matches.length };
-  return { candidate: matches[0]!.candidate, match: matches[0]!.matchScore === 100 ? 'exact_url' : 'stable_entity', candidateCount: 1 };
-}
-
-function selectLiveForgeOwnedNativeTab(
+export function selectLiveForgeOwnedNativeTab(
   repoRoot: string,
   targetUrl: string,
   product: MacOsBrowserProduct,
@@ -1287,11 +1449,11 @@ function selectLiveForgeOwnedNativeTab(
   }
 
   const values = [...candidates.values()];
+  if (inventory.truncated) return { match: 'ambiguous', candidateCount: values.length };
   const exact = values.filter(({ candidate }) => comparableUrl(candidate.url) === comparableUrl(targetUrl));
   const choose = (matches: typeof values, match: 'exact_url' | 'same_origin') => {
     if (matches.length === 1) return { ...matches[0], match, candidateCount: 1 } as const;
-    const active = matches.filter(({ candidate }) => candidate.active);
-    if (active.length === 1) return { ...active[0], match, candidateCount: matches.length } as const;
+    // Multiple matching tabs remain ambiguous even when one is active.
     return { match: 'ambiguous' as const, candidateCount: matches.length };
   };
   if (exact.length > 0) return choose(exact, 'exact_url');
@@ -1301,15 +1463,15 @@ function selectLiveForgeOwnedNativeTab(
   return { match: 'none', candidateCount: 0 };
 }
 
-function selectExactNativeTab(
+export function selectExactNativeTab(
   targetUrl: string,
   inventory: Awaited<ReturnType<typeof listMacOsBrowserTabs>>,
 ): { candidate?: (typeof inventory.tabs)[number]; match: 'exact_url' | 'none' | 'ambiguous'; candidateCount: number } {
+  if (inventory.truncated) return { match: 'ambiguous', candidateCount: inventory.tabs.length };
   const matches = inventory.tabs.filter((candidate) => comparableUrl(candidate.url) === comparableUrl(targetUrl));
   if (matches.length === 0) return { match: 'none', candidateCount: 0 };
   if (matches.length === 1) return { candidate: matches[0], match: 'exact_url', candidateCount: 1 };
-  const active = matches.filter((candidate) => candidate.active);
-  if (active.length === 1) return { candidate: active[0], match: 'exact_url', candidateCount: matches.length };
+  // A frontmost tab does not disambiguate two tabs with the same URL.
   return { match: 'ambiguous', candidateCount: matches.length };
 }
 
@@ -1342,7 +1504,7 @@ async function inventoryTabs(context: BrowserContextLike): Promise<BrowserTabInv
   return entries;
 }
 
-function chooseTab(
+export function chooseTab(
   inventory: BrowserTabInventoryEntry[],
   target: BrowserActionTarget,
   options: { allowBlank?: boolean; requireOwnedToken?: boolean } = {},
@@ -1350,6 +1512,20 @@ function chooseTab(
   const desiredUrl = comparableUrl(target.url);
   const savedTab = target.existingSession?.browser?.tab;
   const expectedOwnerToken = savedTab?.ownership === 'plugin_owned' ? savedTab.ownerToken : undefined;
+  const unique = (matches: BrowserTabInventoryEntry[], basis: string): BrowserTabInventoryEntry | undefined => {
+    if (matches.length > 1) {
+      throw new AssistantPluginError('PLUGIN_BROWSER_REUSABLE_TAB_AMBIGUOUS',
+        'Multiple browser tabs satisfy the same lookup; exact tab identity is not proven.',
+        { retryable: false, details: { sessionId: target.sessionId, basis, candidateCount: matches.length } });
+    }
+    return matches[0];
+  };
+  if (options.requireOwnedToken && expectedOwnerToken
+      && inventory.filter((entry) => entry.ownerToken === expectedOwnerToken).length > 1) {
+    throw new AssistantPluginError('PLUGIN_BROWSER_REUSABLE_TAB_AMBIGUOUS',
+      'Multiple browser tabs report the same owned marker.',
+      { retryable: false, details: { sessionId: target.sessionId, basis: 'owned_token' } });
+  }
   if (options.requireOwnedToken) {
     const owned = expectedOwnerToken ? inventory.find((entry) => entry.ownerToken === expectedOwnerToken) : undefined;
     if (owned) {
@@ -1367,25 +1543,8 @@ function chooseTab(
     };
   }
   const savedUrl = savedTab?.url ? comparableUrl(savedTab.url) : undefined;
-  const savedTitle = savedTab?.title;
-  const savedUrlTitle = savedUrl && savedTitle
-    ? inventory.find((entry) => comparableUrl(entry.url) === savedUrl && entry.title === savedTitle)
-    : undefined;
-  if (savedUrlTitle) {
-    return {
-      entry: savedUrlTitle,
-      matchedBy: 'saved_url_title',
-      sessionResume: {
-        sessionId: target.sessionId,
-        status: 'matched',
-        reason: 'Saved tab URL and title matched an attached browser tab.',
-        savedTab,
-      },
-    };
-  }
-
   const savedUrlOnly = savedUrl
-    ? inventory.find((entry) => comparableUrl(entry.url) === savedUrl)
+    ? unique(inventory.filter((entry) => comparableUrl(entry.url) === savedUrl), 'saved_url')
     : undefined;
   if (savedUrlOnly) {
     return {
@@ -1394,13 +1553,13 @@ function chooseTab(
       sessionResume: {
         sessionId: target.sessionId,
         status: savedTab ? 'matched' : 'no_saved_tab',
-        reason: savedTab ? 'Saved tab URL matched but the previous title was not present.' : 'No saved tab metadata was available.',
+        reason: savedTab ? 'Saved tab URL was unique in this browser context; page title was not used as identity.' : 'No saved tab metadata was available.',
         savedTab,
       },
     };
   }
 
-  const exactUrl = inventory.find((entry) => comparableUrl(entry.url) === desiredUrl);
+  const exactUrl = unique(inventory.filter((entry) => comparableUrl(entry.url) === desiredUrl), 'exact_url');
   if (exactUrl) {
     return {
       entry: exactUrl,
@@ -1420,7 +1579,7 @@ function chooseTab(
     };
   }
 
-  const blank = options.allowBlank === false ? undefined : inventory.find((entry) => isBlankPage(entry.url));
+  const blank = options.allowBlank === false ? undefined : unique(inventory.filter((entry) => isBlankPage(entry.url)), 'blank');
   if (blank) {
     return {
       entry: blank,
@@ -1544,14 +1703,71 @@ async function discoverCdpEndpoint(endpoint: string, timeoutMs: number): Promise
   };
 }
 
+async function waitForCdpEndpoint(endpoint: string, timeoutMs: number): Promise<CdpAttachAttempt> {
+  const deadline = Date.now() + Math.max(250, timeoutMs);
+  let lastError: unknown;
+  while (Date.now() < deadline) {
+    try {
+      return await discoverCdpEndpoint(endpoint, Math.max(100, Math.min(500, deadline - Date.now())));
+    } catch (error) {
+      lastError = error;
+      await delay(50);
+    }
+  }
+  throw new AssistantPluginError('PLUGIN_BROWSER_EXTENSION_CONTROL_UNAVAILABLE', 'Vivaldi did not expose the allocated loopback CDP endpoint after launch.', {
+    retryable: true,
+    details: { endpoint, error: lastError instanceof Error ? lastError.message : String(lastError ?? 'unknown') },
+  });
+}
+
+async function browserCdpExtensionTarget(session: BrowserCdpSessionLike, extensionId: string): Promise<string | undefined> {
+  const response = await session.send('Target.getTargets') as { targetInfos?: Array<{ url?: unknown }> };
+  const prefix = `chrome-extension://${extensionId}/`;
+  return (response.targetInfos ?? [])
+    .map((target) => typeof target.url === 'string' ? target.url : '')
+    .find((url) => url.startsWith(prefix));
+}
+
+async function waitForBrowserCdpExtensionTarget(session: BrowserCdpSessionLike, extensionId: string, timeoutMs: number): Promise<string> {
+  const deadline = Date.now() + Math.min(Math.max(timeoutMs, 250), 10_000);
+  while (Date.now() <= deadline) {
+    const target = await browserCdpExtensionTarget(session, extensionId);
+    if (target) return target;
+    await delay(100);
+  }
+  throw new AssistantPluginError('PLUGIN_BROWSER_EXTENSION_POSTCONDITION_FAILED', 'Browser-level CDP did not expose an exact runtime target for the requested extension id.', {
+    retryable: true,
+    details: { extensionId },
+  });
+}
+
 function launchOptionsForRepo(repoRoot: string, config: BrowserPluginConfig, profile: BrowserProfileSelection): Record<string, unknown> {
+  const extensionPaths = [...(managedExtensionPaths.get(managedContextKey(profile)) ?? [])].sort();
+  const args = [
+    ...(profile.profileDirectory ? [`--profile-directory=${profile.profileDirectory}`] : []),
+    ...(extensionPaths.length > 0 ? ['--enable-unsafe-extension-debugging'] : []),
+  ];
+  const customProfileDefaultArgsToPreserve = [
+    '--disable-extensions',
+    '--disable-component-extensions-with-background-pages',
+    '--disable-default-apps',
+    '--disable-sync',
+    '--use-mock-keychain',
+    '--password-store=basic',
+  ];
+  const ignoreDefaultArgs = config.profileMode === 'custom'
+    ? customProfileDefaultArgsToPreserve
+    : extensionPaths.length > 0
+      ? ['--disable-extensions']
+      : [];
   return {
     headless: false,
     acceptDownloads: true,
     viewport: { width: 1280, height: 900 },
     ...(config.executablePath ? { executablePath: resolveConfiguredPath(repoRoot, config.executablePath) } : {}),
-    ...(!config.executablePath && config.browserChannel && config.browserChannel !== 'chromium' ? { channel: config.browserChannel } : {}),
-    ...(profile.profileDirectory ? { args: [`--profile-directory=${profile.profileDirectory}`] } : {}),
+    ...(!config.executablePath && extensionPaths.length === 0 && config.browserChannel && config.browserChannel !== 'chromium' ? { channel: config.browserChannel } : {}),
+    ...(ignoreDefaultArgs.length > 0 ? { ignoreDefaultArgs } : {}),
+    ...(args.length > 0 ? { args } : {}),
   };
 }
 
@@ -1571,8 +1787,87 @@ async function evictManagedContext(key: string): Promise<void> {
   }
 }
 
+/**
+ * Forge-owned isolated/handoff browser profiles are per-session and cannot be
+ * shared, so a browser still running on one of those profiles while no managed
+ * context in this Runtime incarnation owns it is an orphan: the session that
+ * launched it is gone. Left alone it stays visible as a logged-out browser the
+ * user never opened and keeps a stale profile locked.
+ *
+ * Reclamation is mechanical and bounded: only processes whose own command line
+ * names a Forge-owned profile path are considered, browser child processes
+ * (`--type=`) are ignored so the main process is signalled once, and a profile
+ * with a live managed context is never touched.
+ */
+export function reclaimOrphanedIsolatedBrowserProfiles(input: { profileRoots: readonly string[]; graceMs?: number }): { terminated: number; details: string[] } {
+  const roots = input.profileRoots.map((root) => resolve(root)).filter(Boolean);
+  if (roots.length === 0) return { terminated: 0, details: [] };
+  const owned = (profileDir: string): boolean => {
+    const normalized = resolve(profileDir);
+    const isForgeProfile = /\/browser\/profiles\/(?:isolated|handoff)\//.test(normalized);
+    if (!isForgeProfile) return false;
+    return roots.some((root) => normalized === root || normalized.startsWith(`${root}${sep}`));
+  };
+  const liveOwners = new Set([...managedBrowserContexts.keys()].map((key) => resolve(key)));
+  const graceMs = Math.max(0, Math.min(30_000, input.graceMs ?? 2_000));
+  const targets: Array<{ pid: number; profileDir: string }> = [];
+  for (const entry of runtimeHooks.listProcesses()) {
+    if (entry.command.includes('--type=')) continue;
+    const match = /--user-data-dir=(?:"([^"]+)"|'([^']+)'|(\S+))/.exec(entry.command);
+    const profileDir = match?.[1] ?? match?.[2] ?? match?.[3];
+    if (!profileDir || !owned(profileDir)) continue;
+    if (liveOwners.has(resolve(profileDir))) continue;
+    targets.push({ pid: entry.pid, profileDir: resolve(profileDir) });
+  }
+  const details: string[] = [];
+  let terminated = 0;
+  for (const target of targets) {
+    runtimeHooks.signalProcess(target.pid, 'SIGTERM');
+    details.push(`SIGTERM ${target.pid} ${target.profileDir}`);
+    terminated += 1;
+  }
+  if (graceMs > 0 && targets.length > 0) {
+    const deadline = Date.now() + graceMs;
+    while (Date.now() < deadline) {
+      const remaining = new Set(targets
+        .filter((target) => runtimeHooks.listProcesses().some((entry) => entry.pid === target.pid && !entry.command.includes('--type=')))
+        .map((target) => target.pid));
+      if (remaining.size === 0) break;
+      sleepSyncMs(50);
+    }
+    for (const target of targets) {
+      const alive = runtimeHooks.listProcesses().some((entry) => entry.pid === target.pid && !entry.command.includes('--type='));
+      if (!alive) continue;
+      runtimeHooks.signalProcess(target.pid, 'SIGKILL');
+      details.push(`SIGKILL ${target.pid} ${target.profileDir}`);
+    }
+  }
+  return { terminated, details };
+}
+
+function sleepSyncMs(ms: number): void {
+  try { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, Math.max(0, Math.min(1_000, ms))); }
+  catch { /* best-effort bounded wait */ }
+}
+
+export function browserProfileRootsForRuntime(input: { controllerHome: string; repoRoots?: readonly string[] }): string[] {
+  const roots = new Set<string>();
+  const home = input.controllerHome.trim();
+  if (home) roots.add(join(resolve(home), 'repositories'));
+  for (const repoRoot of input.repoRoots ?? []) {
+    const trimmed = repoRoot.trim();
+    if (trimmed) roots.add(join(resolve(trimmed), '.forge'));
+  }
+  return [...roots];
+}
+
 async function closeManagedContextsForRepo(repoRoot: string, options: { strict?: boolean } = {}): Promise<void> {
   const canonicalRoot = resolve(repoRoot);
+  // Explicit session cleanup must also retire a browser whose session record is
+  // gone; otherwise the profile stays locked by a process nothing owns.
+  reclaimOrphanedIsolatedBrowserProfiles({
+    profileRoots: browserProfileRootsForRuntime({ controllerHome: resolveRepoPreferredControllerHome(canonicalRoot), repoRoots: [canonicalRoot] }),
+  });
   for (const [key, pending] of [...managedBrowserContexts.entries()]) {
     let state: ManagedBrowserContextState;
     try {
@@ -1884,6 +2179,342 @@ async function openManagedContext(
   };
 }
 
+const FORGE_NATIVE_MESSAGING_DECLARATION = 'forge-native-messaging-host.json';
+interface ManagedNativeMessagingHost {
+  name: string;
+  manifest: string;
+}
+interface BrowserExtensionInfo {
+  id: string;
+  name?: string;
+  version?: string;
+  path: string;
+  enabled: boolean;
+}
+
+function pathWithin(root: string, candidate: string): boolean {
+  const rel = relative(root, candidate);
+  return rel === '' || (!rel.startsWith(`..${sep}`) && rel !== '..' && !isAbsolute(rel));
+}
+
+function unpackedExtensionPath(input: AssistantPluginActionExecutionInput): { path: string; expectedId?: string; nativeHost?: ManagedNativeMessagingHost } {
+  const requested = requiredString(input.args.extension_path, 'extension_path');
+  if (!isAbsolute(requested)) throw new AssistantPluginError('PLUGIN_ACTION_ARGUMENT_INVALID', 'extension_path must be absolute.', { retryable: false });
+  if (!existsSync(requested) || !statSync(requested).isDirectory()) {
+    throw new AssistantPluginError('PLUGIN_ACTION_ARGUMENT_INVALID', 'extension_path must reference an existing directory.', { retryable: false });
+  }
+  const realPath = realpathSync(requested);
+  const trustedRoots = [realpathSync(input.repoRoot)];
+  const controllerBrowserRoot = join(resolve(input.controllerHome), 'supervisor', 'browser-adapter');
+  if (existsSync(controllerBrowserRoot)) trustedRoots.push(realpathSync(controllerBrowserRoot));
+  if (!trustedRoots.some((root) => pathWithin(root, realPath))) {
+    throw new AssistantPluginError('PLUGIN_POLICY_BLOCKED', 'Unpacked extensions must resolve inside the repository or Controller-owned browser-adapter root.', { retryable: false });
+  }
+  const manifestPath = join(realPath, 'manifest.json');
+  if (!existsSync(manifestPath) || !statSync(manifestPath).isFile() || !pathWithin(realPath, realpathSync(manifestPath))) {
+    throw new AssistantPluginError('PLUGIN_ACTION_ARGUMENT_INVALID', 'Unpacked extension requires a regular manifest.json inside the extension directory.', { retryable: false });
+  }
+  let manifest: { key?: unknown };
+  try { manifest = JSON.parse(readFileSync(manifestPath, 'utf8')) as { key?: unknown }; }
+  catch { throw new AssistantPluginError('PLUGIN_ACTION_ARGUMENT_INVALID', 'Unpacked extension manifest.json must contain valid JSON.', { retryable: false }); }
+  let expectedId: string | undefined;
+  if (typeof manifest.key === 'string' && /^[A-Za-z0-9+/]+={0,2}$/.test(manifest.key.trim())) {
+    const bytes = Buffer.from(manifest.key.trim(), 'base64');
+    if (bytes.length > 0) expectedId = createHash('sha256').update(bytes).digest('hex').slice(0, 32)
+      .replace(/[0-9a-f]/g, (nibble) => String.fromCharCode(97 + Number.parseInt(nibble, 16)));
+  }
+  const declarationPath = join(realPath, FORGE_NATIVE_MESSAGING_DECLARATION);
+  let nativeHost: ManagedNativeMessagingHost | undefined;
+  if (existsSync(declarationPath)) {
+    if (!expectedId || !statSync(declarationPath).isFile() || !pathWithin(realPath, realpathSync(declarationPath))) {
+      throw new AssistantPluginError('PLUGIN_ACTION_ARGUMENT_INVALID', 'Managed native messaging declaration requires a regular file and stable extension manifest key.', { retryable: false });
+    }
+    let declaration: { name?: unknown; description?: unknown; path?: unknown; type?: unknown; allowed_origins?: unknown };
+    try { declaration = JSON.parse(readFileSync(declarationPath, 'utf8')) as typeof declaration; }
+    catch { throw new AssistantPluginError('PLUGIN_ACTION_ARGUMENT_INVALID', 'forge-native-messaging-host.json must contain valid JSON.', { retryable: false }); }
+    const name = typeof declaration.name === 'string' ? declaration.name.trim() : '';
+    const hostPath = typeof declaration.path === 'string' ? declaration.path.trim() : '';
+    const expectedOrigin = `chrome-extension://${expectedId}/`;
+    if (!/^[a-z0-9_]+(?:\.[a-z0-9_]+)*$/.test(name)
+      || declaration.type !== 'stdio'
+      || !isAbsolute(hostPath)
+      || !Array.isArray(declaration.allowed_origins)
+      || declaration.allowed_origins.length !== 1
+      || declaration.allowed_origins[0] !== expectedOrigin) {
+      throw new AssistantPluginError('PLUGIN_ACTION_ARGUMENT_INVALID', 'Managed native messaging declaration must bind one valid host name, stdio transport, absolute executable, and the exact stable extension origin.', { retryable: false });
+    }
+    if (!existsSync(hostPath) || !statSync(hostPath).isFile()) {
+      throw new AssistantPluginError('PLUGIN_ACTION_ARGUMENT_INVALID', 'Managed native messaging host executable must exist as a regular file.', { retryable: false });
+    }
+    const realHostPath = realpathSync(hostPath);
+    if (!trustedRoots.some((root) => pathWithin(root, realHostPath))) {
+      throw new AssistantPluginError('PLUGIN_POLICY_BLOCKED', 'Managed native messaging host executable must resolve inside an already trusted extension, repository, or Controller browser-adapter root.', { retryable: false });
+    }
+    if (process.platform !== 'win32' && (statSync(realHostPath).mode & 0o111) === 0) {
+      throw new AssistantPluginError('PLUGIN_ACTION_ARGUMENT_INVALID', 'Managed native messaging host must be executable.', { retryable: false });
+    }
+    nativeHost = {
+      name,
+      manifest: `${JSON.stringify({
+        name,
+        description: typeof declaration.description === 'string' ? declaration.description.slice(0, 512) : '',
+        path: realHostPath,
+        type: 'stdio',
+        allowed_origins: [expectedOrigin],
+      }, null, 2)}\n`,
+    };
+  }
+  return { path: realPath, expectedId, nativeHost };
+}
+
+function projectManagedNativeMessagingHost(profileDir: string, host: ManagedNativeMessagingHost | undefined): boolean {
+  if (!host) return false;
+  const root = join(profileDir, 'NativeMessagingHosts');
+  mkdirSync(root, { recursive: true, mode: 0o700 });
+  const target = join(root, `${host.name}.json`);
+  if (existsSync(target) && readFileSync(target, 'utf8') === host.manifest) return false;
+  const temporary = `${target}.${randomUUID().slice(0, 12)}.tmp`;
+  writeFileSync(temporary, host.manifest, { mode: 0o600 });
+  renameSync(temporary, target);
+  return true;
+}
+
+function extensionTargets(context: BrowserContextLike): string[] {
+  return [...(context.serviceWorkers?.() ?? []), ...(context.backgroundPages?.() ?? [])].map((target) => target.url());
+}
+
+async function waitForManagedExtension(context: BrowserContextLike, extensionId: string, timeoutMs: number): Promise<string> {
+  const prefix = `chrome-extension://${extensionId}/`;
+  const deadline = Date.now() + Math.min(Math.max(timeoutMs, 250), 10_000);
+  while (Date.now() <= deadline) {
+    const url = extensionTargets(context).find((candidate) => candidate.startsWith(prefix));
+    if (url) return url;
+    await delay(100);
+  }
+  throw new AssistantPluginError('PLUGIN_BROWSER_EXTENSION_POSTCONDITION_FAILED', 'Managed browser did not expose an exact runtime target for the requested extension id.', { retryable: true, details: { extensionId } });
+}
+
+async function browserLevelCdp(
+  repoRoot: string,
+  config: BrowserPluginConfig,
+): Promise<{ browser: BrowserLike; session: BrowserCdpSessionLike; endpoint: string } | undefined> {
+  if (cdpEndpoints(config).length === 0 || !runtimeHooks.moduleAvailable('playwright', repoRoot)) return undefined;
+  const runtime = runtimeHooks.loadPlaywright(repoRoot);
+  const connectOverCDP = runtime.chromium.connectOverCDP;
+  if (typeof connectOverCDP !== 'function') return undefined;
+  for (const endpoint of cdpEndpoints(config)) {
+    try {
+      const discovered = await discoverCdpEndpoint(endpoint, cdpDiscoveryTimeout(config));
+      const browser = await connectOverCDP.call(runtime.chromium, discovered.discoveredEndpoint ?? endpoint);
+      if (typeof browser.newBrowserCDPSession !== 'function') {
+        if (browser.disconnect) await Promise.resolve(browser.disconnect()).catch(() => undefined);
+        else if (browser.close) await browser.close().catch(() => undefined);
+        continue;
+      }
+      const session = await browser.newBrowserCDPSession();
+      return { browser, session, endpoint: discovered.discoveredEndpoint ?? endpoint };
+    } catch { /* Pre-dispatch endpoint discovery/attach failure; try the next configured endpoint. */ }
+  }
+  return undefined;
+}
+
+async function closeBrowserLevelCdp(handle: { browser: BrowserLike; session: BrowserCdpSessionLike }): Promise<void> {
+  await handle.session.detach?.().catch(() => undefined);
+  if (handle.browser.disconnect) await Promise.resolve(handle.browser.disconnect()).catch(() => undefined);
+  else if (handle.browser.close) await handle.browser.close().catch(() => undefined);
+}
+
+async function cdpExtensionList(repoRoot: string, config: BrowserPluginConfig): Promise<{ provider: string; endpoint: string; extensions: BrowserExtensionInfo[] } | undefined> {
+  const handle = await browserLevelCdp(repoRoot, config);
+  if (!handle) return undefined;
+  try {
+    const result = await handle.session.send('Extensions.getExtensions') as { extensions?: BrowserExtensionInfo[] };
+    return { provider: 'playwright-cdp', endpoint: handle.endpoint, extensions: Array.isArray(result.extensions) ? result.extensions : [] };
+  } finally { await closeBrowserLevelCdp(handle); }
+}
+
+async function loadAndVerifyUnpackedExtension(
+  session: BrowserCdpSessionLike,
+  extensionPath: string,
+  expectedId: string | undefined,
+  enableInIncognito: boolean,
+): Promise<BrowserExtensionInfo> {
+  const loaded = await session.send('Extensions.loadUnpacked', {
+    path: extensionPath,
+    ...(enableInIncognito ? { enableInIncognito: true } : {}),
+  }) as { id?: string };
+  const id = typeof loaded.id === 'string' && loaded.id.trim() ? loaded.id.trim() : undefined;
+  if (!id) throw new AssistantPluginError('PLUGIN_BROWSER_EXTENSION_POSTCONDITION_FAILED', 'Browser did not return an extension id after loadUnpacked.', { retryable: true });
+  if (expectedId && id !== expectedId) {
+    throw new AssistantPluginError('PLUGIN_BROWSER_EXTENSION_POSTCONDITION_FAILED', 'Browser returned an unpacked extension id that does not match the manifest-derived stable id.', {
+      retryable: false,
+      details: { extensionId: id, expectedExtensionId: expectedId },
+    });
+  }
+  const listed = await session.send('Extensions.getExtensions') as { extensions?: BrowserExtensionInfo[] };
+  const exact = (listed.extensions ?? []).find((entry) => {
+    if (entry.id !== id || entry.enabled !== true) return false;
+    try { return realpathSync(entry.path) === extensionPath; } catch { return false; }
+  });
+  if (!exact) throw new AssistantPluginError('PLUGIN_BROWSER_EXTENSION_POSTCONDITION_FAILED', 'Browser did not verify the exact enabled unpacked extension id/path after loadUnpacked.', { retryable: true, details: { extensionId: id } });
+  return exact;
+}
+
+function customVivaldiExtensionInstall(config: BrowserPluginConfig, repoRoot: string): { executable: string } | undefined {
+  if (config.profileMode !== 'custom' || !config.executablePath) return undefined;
+  const executable = resolveConfiguredPath(repoRoot, config.executablePath);
+  return basename(executable).toLowerCase() === 'vivaldi' ? { executable } : undefined;
+}
+
+function processUsesUserDataDir(command: string, profileDir: string): boolean {
+  const expected = resolve(profileDir);
+  const forms = [
+    `--user-data-dir=${expected}`,
+    `--user-data-dir="${expected}"`,
+    `--user-data-dir='${expected}'`,
+  ];
+  return forms.some((form) => {
+    const index = command.indexOf(form);
+    if (index < 0) return false;
+    const next = command[index + form.length];
+    return next === undefined || /\s/.test(next);
+  });
+}
+
+function exactCustomVivaldiProfileOwner(
+  executable: string,
+  profile: BrowserProfileSelection,
+): { pid: number; command: string } | undefined {
+  let lockTarget: string;
+  try { lockTarget = readlinkSync(join(profile.profileDir, 'SingletonLock')); }
+  catch { return undefined; }
+  const pidText = /(?:^|-)(\d+)$/.exec(lockTarget.trim())?.[1];
+  const pid = pidText ? Number(pidText) : 0;
+  if (!Number.isInteger(pid) || pid <= 0) return undefined;
+  const process = runtimeHooks.listProcesses().find((entry) => entry.pid === pid && !entry.command.includes('--type='));
+  if (!process || !process.command.includes(executable)) return undefined;
+  const hasExplicitProfileDir = process.command.includes('--user-data-dir=');
+  if (hasExplicitProfileDir) {
+    if (!processUsesUserDataDir(process.command, profile.profileDir)) return undefined;
+  } else {
+    const defaultVivaldiProfileDir = resolve(join(homedir(), 'Library', 'Application Support', 'Vivaldi'));
+    if (resolve(profile.profileDir) !== defaultVivaldiProfileDir) return undefined;
+  }
+  return process;
+}
+
+async function gracefullyRestartExactCustomVivaldiOwner(
+  executable: string,
+  profile: BrowserProfileSelection,
+  timeoutMs: number,
+): Promise<{ restarted: boolean; pid?: number }> {
+  const owner = exactCustomVivaldiProfileOwner(executable, profile);
+  if (!owner) return { restarted: false };
+  runtimeHooks.signalProcess(owner.pid, 'SIGTERM');
+  const deadline = Date.now() + Math.max(500, Math.min(timeoutMs, 10_000));
+  while (Date.now() < deadline) {
+    const alive = runtimeHooks.listProcesses().some((entry) => entry.pid === owner.pid && !entry.command.includes('--type='));
+    if (!alive) return { restarted: true, pid: owner.pid };
+    await delay(50);
+  }
+  throw new AssistantPluginError('PLUGIN_BROWSER_PROFILE_IN_USE', 'The exact Vivaldi custom-profile owner did not exit after a bounded graceful restart request.', {
+    retryable: true,
+    details: { pid: owner.pid, profileDir: profile.profileDir },
+  });
+}
+
+async function installExtensionThroughCustomVivaldiCdpPort(
+  input: AssistantPluginActionExecutionInput,
+  config: BrowserPluginConfig,
+  profile: BrowserProfileSelection,
+  extensionPath: string,
+  expectedId: string,
+): Promise<Record<string, unknown>> {
+  const vivaldi = customVivaldiExtensionInstall(config, input.repoRoot);
+  if (!vivaldi) {
+    throw new AssistantPluginError('PLUGIN_BROWSER_EXTENSION_CONTROL_UNAVAILABLE', 'Custom Vivaldi unpacked-extension install requires the configured Vivaldi executable.', { retryable: true });
+  }
+  const timeoutMs = positiveNumber(input.args.timeout_ms, config.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS);
+  await gracefullyRestartExactCustomVivaldiOwner(vivaldi.executable, profile, timeoutMs);
+  const port = await runtimeHooks.allocateLoopbackPort();
+  const endpoint = `http://127.0.0.1:${port}`;
+  const args = [
+    `--user-data-dir=${profile.profileDir}`,
+    ...(profile.profileDirectory ? [`--profile-directory=${profile.profileDirectory}`] : []),
+    '--remote-debugging-address=127.0.0.1',
+    `--remote-debugging-port=${port}`,
+    '--enable-unsafe-extension-debugging',
+    '--no-first-run',
+    '--no-default-browser-check',
+  ];
+  const launched = runtimeHooks.launchProcess(vivaldi.executable, args);
+  const pid = launched.pid;
+  if (!pid || !Number.isInteger(pid) || pid <= 0) {
+    throw new AssistantPluginError('PLUGIN_BROWSER_EXTENSION_CONTROL_UNAVAILABLE', 'Vivaldi launcher did not return a process identity for bounded cleanup.', { retryable: true });
+  }
+  let session: BrowserCdpSessionLike | undefined;
+  let keepBrowser = false;
+  try {
+    const discovered = await waitForCdpEndpoint(endpoint, timeoutMs);
+    const browserEndpoint = discovered.discoveredEndpoint ?? endpoint;
+    session = await runtimeHooks.connectBrowserCdp(browserEndpoint, Math.max(1_000, Math.min(timeoutMs, 30_000)));
+    const listed = await session.send('Extensions.getExtensions') as { extensions?: BrowserExtensionInfo[] };
+    let verifiedExtension = (listed.extensions ?? []).find((entry) => {
+      if (entry.id !== expectedId || entry.enabled !== true) return false;
+      try { return realpathSync(entry.path) === extensionPath; } catch { return false; }
+    });
+    let runtimeTarget = await browserCdpExtensionTarget(session, expectedId);
+    if (!verifiedExtension || !runtimeTarget) {
+      verifiedExtension = await loadAndVerifyUnpackedExtension(session, extensionPath, expectedId, input.args.enable_in_incognito === true);
+      if (!runtimeTarget) runtimeTarget = await waitForBrowserCdpExtensionTarget(session, expectedId, timeoutMs);
+    }
+    keepBrowser = true;
+    return {
+      provider: 'native-cdp-vivaldi-custom',
+      endpoint,
+      extension: { ...verifiedExtension, runtimeTarget },
+      verified: true,
+    };
+  } finally {
+    await session?.detach?.().catch(() => undefined);
+    if (!keepBrowser) runtimeHooks.signalProcess(pid, 'SIGTERM');
+  }
+}
+
+async function managedCdpInstallExtension(
+  input: AssistantPluginActionExecutionInput,
+  context: BrowserContextLike,
+  extensionPath: string,
+  expectedId: string,
+  runtimeTargetPresent: boolean,
+): Promise<BrowserExtensionInfo> {
+  const browser = context.browser?.();
+  if (!browser || typeof browser.newBrowserCDPSession !== 'function') {
+    throw new AssistantPluginError('PLUGIN_BROWSER_EXTENSION_CONTROL_UNAVAILABLE', 'Managed unpacked-extension install requires browser-level CDP on the launched Chromium context.', { retryable: true });
+  }
+  const session = await browser.newBrowserCDPSession();
+  try {
+    const listed = await session.send('Extensions.getExtensions') as { extensions?: BrowserExtensionInfo[] };
+    const exact = (listed.extensions ?? []).find((entry) => {
+      if (entry.id !== expectedId || entry.enabled !== true) return false;
+      try { return realpathSync(entry.path) === extensionPath; } catch { return false; }
+    });
+    if (exact && runtimeTargetPresent) return exact;
+    return await loadAndVerifyUnpackedExtension(session, extensionPath, expectedId, input.args.enable_in_incognito === true);
+  } finally {
+    await session.detach?.().catch(() => undefined);
+  }
+}
+
+async function cdpInstallExtension(input: AssistantPluginActionExecutionInput, config: BrowserPluginConfig, extensionPath: string, expectedId?: string): Promise<Record<string, unknown> | undefined> {
+  const handle = await browserLevelCdp(input.repoRoot, config);
+  if (!handle) return undefined;
+  try {
+    const exact = await loadAndVerifyUnpackedExtension(handle.session, extensionPath, expectedId, input.args.enable_in_incognito === true);
+    return { provider: 'playwright-cdp', endpoint: handle.endpoint, extension: exact, verified: true };
+  } finally { await closeBrowserLevelCdp(handle); }
+}
+
 async function openAttachedContext(
   runtime: PlaywrightRuntime,
   repoRoot: string,
@@ -1978,15 +2609,13 @@ async function openNativeAttachedContext(
   args: Record<string, unknown>,
 ): Promise<{ handle?: BrowserOpenHandle; attempts: MacOsBrowserAttachAttempt[] }> {
   if (config.nativeAttachMode === 'disabled') return { attempts: [] };
-  if (!target.existingSession && !stringValue(args.session_id)) {
+  if (!target.existingSession && !stringValue(args.session_id) && args.__forge_computer_native_only !== true) {
     await inspectNativeOwnedSessions({ repoRoot, savedSessions: listSavedSessions(repoRoot), timeoutMs: config.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS, pruneDead: true });
   }
   const timeout = positiveNumber(args.timeout_ms, config.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS);
   const savedTab = target.existingSession?.browser?.tab;
   const savedOwnership = savedTab?.ownership;
   let effectiveOwnership = savedOwnership;
-  let recoveredTabTitle = '';
-  let recoveredTabUrl: string | undefined;
   const savedProduct = target.existingSession?.browser?.provider === 'macos-apple-events'
     && savedTab
     && (savedOwnership === 'plugin_owned' || savedOwnership === 'user_owned')
@@ -2036,63 +2665,18 @@ async function openNativeAttachedContext(
         savedTab,
       };
     } catch (error) {
-      if (error instanceof AssistantPluginError
-        && error.code === 'PLUGIN_BROWSER_NATIVE_TAB_IDENTITY_UNPROVEN'
-        && savedOwnership === 'user_owned') {
+      // URL/title or a formerly active window cannot identify a lost native tab.
+      // Never silently adopt another user's tab or create a replacement for a saved session.
+      if (savedOwnership === 'user_owned' && error instanceof AssistantPluginError && error.code === 'PLUGIN_BROWSER_NATIVE_TAB_IDENTITY_UNPROVEN') {
         throw error;
       }
-      if (savedOwnership === 'user_owned') {
-        throw new AssistantPluginError(
-          'PLUGIN_BROWSER_SESSION_STATE_LOST',
-          'Explicitly adopted user-owned macOS browser tab no longer exists; refusing to silently switch to another user tab.',
-          {
-            retryable: false,
-            details: { sessionId: target.sessionId, browserProduct: savedProduct, ownership: savedOwnership, windowId: savedTab.windowId, tabId: savedTab.tabId, cause: error instanceof Error ? error.message : String(error) },
-          },
-        );
-      }
-      let inventory: Awaited<ReturnType<typeof listMacOsBrowserTabs>> | undefined;
-      let selection: ReturnType<typeof selectReusableNativeTab> | undefined;
-      let recoveryFailure: string | undefined;
-      try {
-        inventory = await listMacOsBrowserTabs(savedProduct, timeout);
-        selection = selectReusableNativeTab(
-          [savedTab.url, target.existingSession?.url ?? '', target.url],
-          inventory,
-          savedTab.windowId,
-        );
-        if (selection.candidate) {
-          const recovered = await reattachMacOsBrowserOwnedPage(savedProduct, { windowId: selection.candidate.windowId, tabId: selection.candidate.tabId }, timeout);
-          page = recovered.page as unknown as PageLike;
-          discovered = { attachment: recovered.attachment, attempts: recovered.attachment.attempts };
-          matchedBy = 'recovered_tab';
-          effectiveOwnership = 'user_owned';
-          recoveredTabTitle = selection.candidate.title;
-          recoveredTabUrl = selection.candidate.url;
-          sessionResume = {
-            sessionId: target.sessionId,
-            status: 'matched',
-            reason: selection.match === 'exact_url'
-              ? 'Saved plugin-owned tab disappeared; rebound safely to the unique currently open tab with the same URL and preserved it as user-owned.'
-              : 'Saved plugin-owned tab disappeared; rebound safely to the unique currently open tab for the same stable app entity and preserved its current page as user-owned.',
-            savedTab,
-          };
-        }
-      } catch (recoveryError) {
-        recoveryFailure = recoveryError instanceof Error ? recoveryError.message : String(recoveryError);
-      }
-      if (!page) {
-        sessionResume = {
-          sessionId: target.sessionId,
-          status: 'stale_tab',
-          reason: recoveryFailure
-            ? `Saved plugin-owned macOS browser tab disappeared and current-tab recovery failed (${recoveryFailure}); creating one replacement plugin-owned tab.`
-            : selection?.match === 'ambiguous'
-              ? 'Saved plugin-owned macOS browser tab disappeared and multiple reusable current tabs matched; refusing to guess between user tabs and creating one replacement plugin-owned tab.'
-              : 'Saved plugin-owned macOS browser tab disappeared and no uniquely reusable current tab matched; creating one replacement plugin-owned tab.',
-          savedTab,
-        };
-      }
+      throw new AssistantPluginError('PLUGIN_BROWSER_SESSION_STATE_LOST',
+        'Saved native browser tab could not be reattached by its exact identity; refusing URL-based recovery or replacement.',
+        { retryable: false, details: {
+          sessionId: target.sessionId, browserProduct: savedProduct, ownership: savedOwnership,
+          windowId: savedTab.windowId, tabId: savedTab.tabId,
+          causeCode: error instanceof AssistantPluginError ? error.code : 'NATIVE_REATTACH_FAILED',
+        } });
     }
   } else {
     sessionResume = savedTab
@@ -2100,11 +2684,105 @@ async function openNativeAttachedContext(
       : { sessionId: target.sessionId, status: 'no_saved_tab', reason: 'Created one plugin-owned tab while preserving the user active tab.' };
   }
 
+  // Session-bound reads and mutations must never turn a dead tab into a new
+  // tab or silently select another profile. The explicit open-page route is
+  // separate and retains its documented create/recover semantics.
+  if (args.__forge_require_existing_resource === true && target.existingSession && !page) {
+    throw new AssistantPluginError(
+      'PLUGIN_BROWSER_SESSION_STATE_LOST',
+      'The saved native browser tab is unavailable and no exact existing tab can be verified; the session was not moved to another profile or recreated.',
+      { retryable: false, details: {
+        sessionId: target.sessionId, browserProduct: savedProduct,
+        savedWindowId: savedTab?.windowId, savedTabId: savedTab?.tabId,
+      } },
+    );
+  }
   let createdThisCallRef: MacOsBrowserTabRef | undefined;
+  let preferredNativeWindowId: string | undefined;
   if (!discovered?.attachment) {
     const candidates = savedProduct ? [savedProduct] : (config.nativeBrowserCandidates ?? [...DEFAULT_USER_NATIVE_BROWSER_CANDIDATES]);
-    discovered = await discoverMacOsBrowserAttachment(candidates, Math.min(timeout, MAX_CDP_DISCOVERY_TIMEOUT_MS));
+    let preferredCandidates = candidates;
+    if (candidates.length > 1 && !target.existingSession && (args.__forge_computer_native_only === true || !stringValue(args.session_id))) {
+      // Choosing the frontmost browser can select a different, signed-out
+      // profile even while the user's matching Chrome tab is in the background.
+      // Prefer exact URL evidence across *all* configured native products.
+      const inventories = await Promise.all(candidates.map(async (product) => {
+        try { await assertMacOsBrowserApplicationRunning(product, timeout); }
+        catch (error) {
+          if (error instanceof AssistantPluginError && [
+            'PLUGIN_BROWSER_NATIVE_APP_NOT_RUNNING', 'PLUGIN_BROWSER_NATIVE_APP_NOT_INSTALLED',
+            'PLUGIN_BROWSER_NATIVE_APP_UNSUPPORTED_PLATFORM',
+          ].includes(error.code)) return undefined;
+          throw error;
+        }
+        try {
+          const inventory = await listMacOsBrowserTabs(product, timeout, { correctFrontmost: false });
+          if (inventory.truncated) throw new AssistantPluginError('PLUGIN_COMPUTER_BROWSER_INVENTORY_INCOMPLETE',
+            'Native browser inventory truncated; cannot prove the existing target tab is absent.',
+            { retryable: true, details: { browserProduct: product } });
+          return { product, inventory };
+        } catch (error) {
+          // Unreadable background tabs are not absent tabs: no replacement
+          // browser or new tab may be created from an incomplete inventory.
+          if (args.__forge_computer_native_only === true) {
+            throw new AssistantPluginError('PLUGIN_COMPUTER_BROWSER_INVENTORY_UNAVAILABLE',
+              'Cannot enumerate existing native browser tabs; refusing to create a duplicate.',
+              { retryable: true, details: { browserProduct: product, cause: error instanceof Error ? error.message : String(error) } });
+          }
+          return undefined;
+        }
+      }));
+      const observed = inventories.filter((item): item is NonNullable<typeof item> => Boolean(item));
+      const exact = observed.flatMap(({ product, inventory }) => inventory.tabs
+        .filter((entry) => comparableUrl(entry.url) === comparableUrl(target.url))
+        .map((entry) => ({ product, entry })));
+      if (exact.length > 1) {
+        throw new AssistantPluginError('PLUGIN_BROWSER_REUSABLE_TAB_AMBIGUOUS',
+          'Multiple browser products have existing tabs for the exact URL; refusing to guess and create another tab.',
+          { retryable: false, details: { targetUrl: target.url, candidateCount: exact.length } });
+      }
+      if (exact.length === 1) {
+        preferredCandidates = [exact[0]!.product];
+      } else {
+        // Same-origin tabs only identify a likely browser *profile*, not an
+        // exact resource. A new tab may be created there, but never overwrite
+        // an unrelated user tab or invent proof of authentication.
+        const origin = (() => { try { return new URL(target.url).origin; } catch { return ''; } })();
+        const originProducts = observed.filter(({ inventory }) => origin && inventory.tabs.some((entry) => {
+          try { return new URL(entry.url).origin === origin; } catch { return false; }
+        })).map(({ product }) => product);
+        if (originProducts.length === 1) {
+          preferredCandidates = [originProducts[0]!];
+          const matchingWindows = new Set(observed
+            .filter(({ product }) => product === originProducts[0])
+            .flatMap(({ inventory }) => inventory.tabs.filter((entry) => {
+              try { return new URL(entry.url).origin === origin; } catch { return false; }
+            }).map((entry) => entry.windowId)));
+          if (matchingWindows.size === 1) preferredNativeWindowId = [...matchingWindows][0];
+        } else if (observed.length === 1) {
+          // Exactly one available browser product is observed. Product discovery
+          // must not silently fall through multiple provider backends.
+          preferredCandidates = [observed[0]!.product];
+        } else if (observed.length === 0) {
+          throw new AssistantPluginError(args.__forge_computer_native_only === true
+            ? 'PLUGIN_COMPUTER_NATIVE_BROWSER_UNAVAILABLE' : 'PLUGIN_BROWSER_ATTACH_UNAVAILABLE',
+            'No usable existing native browser was observed; refusing to launch or guess a provider.',
+            { retryable: false });
+        } else {
+          if (args.__forge_require_existing_resource === true) {
+            throw new AssistantPluginError('PLUGIN_BROWSER_EXISTING_TAB_NOT_FOUND',
+              'No uniquely reusable tab matches the requested existing resource; refusing new tab creation.',
+              { retryable: false });
+          }
+          throw new AssistantPluginError('PLUGIN_BROWSER_PROVIDER_CARDINALITY_INVALID',
+            'No uniquely identified existing browser product; refusing implicit cross-provider selection.',
+            { retryable: false, details: { candidateCount: observed.length } });
+        }
+      }
+    }
+    discovered = await discoverMacOsBrowserAttachment(preferredCandidates, Math.min(timeout, MAX_CDP_DISCOVERY_TIMEOUT_MS));
     const zeroWindowAttempt = args.__forge_require_existing_resource !== true
+      && args.__forge_computer_native_only !== true
       ? discovered.attempts.find((attempt) => attempt.status === 'unavailable' && attempt.error?.includes('FORGE_NO_BROWSER_WINDOW'))
       : undefined;
     if (!discovered.attachment && zeroWindowAttempt) {
@@ -2112,6 +2790,7 @@ async function openNativeAttachedContext(
         zeroWindowAttempt.product,
         target.url,
         discovered.attempts,
+        undefined,
         timeout,
       );
       page = created.page as unknown as PageLike;
@@ -2220,12 +2899,17 @@ async function openNativeAttachedContext(
     }
   };
   try {
-    if (!page && !savedTab && !stringValue(args.session_id)) {
+    if (!page && !savedTab && !target.existingSession && (args.__forge_computer_native_only === true || !stringValue(args.session_id))) {
       let inventory: Awaited<ReturnType<typeof listMacOsBrowserTabs>> | undefined;
       try {
         inventory = await listMacOsBrowserTabs(activeAttachment.metadata.product, timeout);
       } catch (error) {
         if (!nativeTabInventoryUnsupported(error)) throw error;
+        if (args.__forge_computer_native_only === true) {
+          throw new AssistantPluginError('PLUGIN_COMPUTER_BROWSER_INVENTORY_UNAVAILABLE',
+            'Native tab inventory unavailable; Computer cannot prove an existing tab is absent.',
+            { retryable: true });
+        }
       }
       if (inventory) {
         const ownedSelection = selectLiveForgeOwnedNativeTab(repoRoot, target.url, activeAttachment.metadata.product, inventory);
@@ -2279,8 +2963,6 @@ async function openNativeAttachedContext(
             activeAttachment = rebound.attachment;
             matchedBy = 'exact_url';
             effectiveOwnership = 'user_owned';
-            recoveredTabTitle = exactSelection.candidate.title;
-            recoveredTabUrl = exactSelection.candidate.url;
             sessionResume = {
               sessionId: target.sessionId,
               status: 'matched',
@@ -2291,7 +2973,23 @@ async function openNativeAttachedContext(
       }
     }
     if (!page) {
-      page = await createMacOsBrowserOwnedPage(activeAttachment, target.url, timeout) as unknown as PageLike;
+      // Explicit existing-resource requests (including read-only live
+      // acceptance) must never create a new tab if no exact tab was found.
+      if (!target.existingSession && args.__forge_require_existing_resource === true) {
+        throw new AssistantPluginError('PLUGIN_BROWSER_EXISTING_TAB_NOT_FOUND',
+          'No uniquely reusable native tab matches the requested URL; refusing to create a new tab.',
+          { retryable: false });
+      }
+      if (preferredNativeWindowId) {
+        const created = await createMacOsBrowserOwnedPageForProduct(
+          activeAttachment.metadata.product, target.url, activeAttachment.attempts, preferredNativeWindowId, timeout,
+        );
+        page = created.page as unknown as PageLike;
+        activeAttachment = created.attachment;
+        discovered = { attachment: created.attachment, attempts: created.attachment.attempts };
+      } else {
+        page = await createMacOsBrowserOwnedPage(activeAttachment, target.url, timeout) as unknown as PageLike;
+      }
       createdThisCallRef = (page as unknown as { tabRef?: () => MacOsBrowserTabRef | undefined }).tabRef?.();
       const liveIdentity = await settleNativeCreatedPageIdentity(
         page as unknown as {
@@ -2311,21 +3009,15 @@ async function openNativeAttachedContext(
     if (comparableUrl(page.url()) !== comparableUrl(target.url) && !explicitUserOwnedUrlMatch) {
       const currentRef = (page as unknown as { tabRef?: () => MacOsBrowserTabRef | undefined }).tabRef?.();
       if (effectiveOwnership === 'user_owned') {
-        if (matchedBy === 'recovered_tab') {
-          sessionResume = { sessionId: target.sessionId, status: 'matched', reason: 'Recovered current user tab was already within the same saved app entity; preserved its current URL instead of navigating it.', savedTab };
-        } else {
-          throw new AssistantPluginError(
-            'PLUGIN_BROWSER_ADOPTED_TAB_URL_MISMATCH',
-            'Explicitly adopted user-owned tab no longer matches the saved session URL; refusing to navigate, replace, or close the user tab.',
-            { retryable: true, details: { sessionId: target.sessionId, expectedUrl: target.url, actualUrl: page.url(), windowId: savedTab?.windowId, tabId: savedTab?.tabId } },
-          );
-        }
+        throw new AssistantPluginError(
+          'PLUGIN_BROWSER_ADOPTED_TAB_URL_MISMATCH',
+          'Explicitly adopted user-owned tab no longer matches the saved session URL; refusing to navigate, replace, or close the user tab.',
+          { retryable: true, details: { sessionId: target.sessionId, expectedUrl: target.url, actualUrl: page.url(), windowId: savedTab?.windowId, tabId: savedTab?.tabId } },
+        );
       }
       const sessionTargetUnchanged = Boolean(target.existingSession?.url) && comparableUrl(target.url) === comparableUrl(target.existingSession?.url ?? '');
       const preserveOwnedSameOriginDrift = matchedBy === 'owned_token' && sessionTargetUnchanged && sameOrigin(page.url(), target.url);
-      if (matchedBy === 'recovered_tab' && effectiveOwnership === 'user_owned') {
-        // Safe recovery adopts an already-open tab. Its current page is authoritative and must not be navigated.
-      } else if (preserveOwnedSameOriginDrift) {
+      if (preserveOwnedSameOriginDrift) {
         sessionResume = { sessionId: target.sessionId, status: 'matched', reason: 'Plugin-owned tab navigated within the same origin; preserved the live tab and refreshed its session URL.', savedTab };
       } else {
         page = await navigateNativePageWithReplacement(page);
@@ -2343,13 +3035,13 @@ async function openNativeAttachedContext(
     if (matchedBy !== 'owned_token' && page.waitForLoadState && !explicitInternalUserSession) {
       await page.waitForLoadState(waitUntil(args.wait_until), { timeout });
     }
-    const observedPageUrl = matchedBy === 'recovered_tab' && recoveredTabUrl ? recoveredTabUrl : page.url();
+    const observedPageUrl = page.url();
     const pageUrl = explicitInternalUserSession
       ? normalizedExplicitNativeAdoptionUrl(observedPageUrl)
       : normalizedUrl(observedPageUrl);
     const nativeRef = (page as unknown as { tabRef?: () => MacOsBrowserTabRef | undefined }).tabRef?.();
     if (!nativeRef) throw new AssistantPluginError('PLUGIN_BROWSER_NATIVE_OWNERSHIP_MISSING', 'Native browser did not return a stable plugin-owned tab reference.', { retryable: true });
-    const title = matchedBy === 'owned_token' ? (target.existingSession?.title ?? '') : matchedBy === 'recovered_tab' ? recoveredTabTitle : '';
+    const title = matchedBy === 'owned_token' ? (target.existingSession?.title ?? '') : '';
     const inventory: BrowserTabInventoryEntry[] = [{ index: 0, key: tabKey(pageUrl, title), url: pageUrl, title }];
     const metadata = activeAttachment.metadata;
     // The live exact-tab URL is authoritative after a safe native rebind. Keep the
@@ -2392,80 +3084,66 @@ async function openBrowser(
   target: BrowserActionTarget,
   args: Record<string, unknown>,
 ): Promise<BrowserOpenHandle> {
-  const requestedMode = config.browserMode ?? 'managed_persistent';
+  const computerNativeOnly = args.__forge_computer_native_only === true;
+  const requestedMode = computerNativeOnly ? 'attach_preferred' : (config.browserMode ?? 'attach_preferred');
+  if (computerNativeOnly) {
+    // Computer operates existing desktop/browser resources. Playwright CDP and
+    // managed profiles remain exclusive to explicitly selected Browser scripts.
+    if (target.existingSession?.browser?.provider
+      && target.existingSession.browser.provider !== 'macos-apple-events') {
+      throw new AssistantPluginError('PLUGIN_COMPUTER_BROWSER_PROVIDER_MISMATCH',
+        'This saved session belongs to an independent scripted Browser provider; Computer cannot silently adopt or replace it.',
+        { retryable: false, details: { sessionId: target.sessionId, provider: target.existingSession.browser.provider } });
+    }
+    const native = await openNativeAttachedContext(repoRoot, {
+      ...config, browserMode: 'attach_preferred', nativeAttachMode: 'auto', cdpAttachFallback: 'fail_closed',
+    }, target, args);
+    if (native.handle) return native.handle;
+    throw new AssistantPluginError('PLUGIN_COMPUTER_NATIVE_BROWSER_UNAVAILABLE',
+      'No attachable existing Chrome or Vivaldi browser is available. Computer will not start a Playwright profile.',
+      { retryable: true, details: { nativeAttempts: native.attempts } });
+  }
   if (requestedMode === 'attach_preferred') {
-    const requireExistingResource = args.__forge_require_existing_resource === true;
-    const existingProvider = target.existingSession?.browser?.provider;
-    const attached = cdpEndpoints(config).length > 0 && runtimeHooks.moduleAvailable('playwright', repoRoot)
-      ? await openAttachedContext(runtimeHooks.loadPlaywright(repoRoot), repoRoot, config, target, args)
-      : { attempts: [] as CdpAttachAttempt[] };
-    if (attached.handle) return attached.handle;
-    if (requireExistingResource && existingProvider === 'playwright-cdp') {
-      throw new AssistantPluginError(
-        'PLUGIN_BROWSER_SESSION_STATE_LOST',
-        'Saved CDP browser page is no longer attachable; refusing to fall back to another browser or create a replacement page.',
-        { retryable: false, details: { sessionId: target.sessionId, provider: existingProvider } },
-      );
+    const savedProvider = target.existingSession?.browser?.provider;
+    if (savedProvider === 'playwright-persistent-context') {
+      throw new AssistantPluginError('PLUGIN_BROWSER_SESSION_STATE_LOST',
+        'A managed session cannot be silently adopted by an attach provider. Select managed_persistent explicitly.',
+        { retryable: false, details: { sessionId: target.sessionId, provider: savedProvider } });
     }
-    if (requireExistingResource && existingProvider === 'playwright-persistent-context') {
+    const endpoints = cdpEndpoints(config);
+    const route = savedProvider === 'macos-apple-events' ? 'native'
+      : savedProvider === 'playwright-cdp' || endpoints.length > 0 ? 'cdp' : 'native';
+    if (route === 'cdp') {
+      if (endpoints.length !== 1) {
+        throw new AssistantPluginError('PLUGIN_BROWSER_PROVIDER_CARDINALITY_INVALID',
+          'CDP attach requires exactly one configured endpoint.', { retryable: false });
+      }
       if (!runtimeHooks.moduleAvailable('playwright', repoRoot)) {
-        throw new AssistantPluginError('PLUGIN_BROWSER_DEPENDENCY_UNAVAILABLE', 'Managed browser mode requires Playwright.', { retryable: false });
+        throw new AssistantPluginError('PLUGIN_BROWSER_DEPENDENCY_UNAVAILABLE',
+          'Selected CDP provider requires Playwright; no other provider will be attempted.', { retryable: false });
       }
-      return openManagedContext(runtimeHooks.loadPlaywright(repoRoot), repoRoot, config, target, args, 'managed_persistent', requestedMode, {
-        policy: config.cdpAttachFallback ?? 'fail_closed',
-        from: 'attach_preferred',
-        to: 'managed_persistent',
-        reason: 'Reusing the existing managed fallback session without probing or creating a different browser resource.',
-        attempts: attached.attempts,
-      });
+      const attached = await openAttachedContext(runtimeHooks.loadPlaywright(repoRoot), repoRoot, config, target, args);
+      if (attached.handle) return attached.handle;
+      throw new AssistantPluginError('PLUGIN_BROWSER_ATTACH_UNAVAILABLE',
+        'Configured CDP endpoint unavailable. Native and managed providers will not be attempted.',
+        { retryable: true, details: { provider: 'playwright-cdp', attempts: attached.attempts } });
+    }
+    if (config.nativeAttachMode !== 'auto') {
+      throw new AssistantPluginError('PLUGIN_BROWSER_ATTACH_UNAVAILABLE',
+        'Native attach is not configured. Choose an explicit Browser mode or one CDP endpoint.',
+        { retryable: false });
     }
-
     const native = await openNativeAttachedContext(repoRoot, config, target, args);
     if (native.handle) return native.handle;
-    if (requireExistingResource) {
-      throw new AssistantPluginError(
-        'PLUGIN_BROWSER_SESSION_STATE_LOST',
-        'Saved browser resource is no longer attachable; refusing to create a replacement tab/page for this existing-session action.',
-        { retryable: false, details: { sessionId: target.sessionId, provider: existingProvider } },
-      );
-    }
-
-    const fallbackPolicy = config.cdpAttachFallback ?? 'fail_closed';
-    const cdpReason = attached.attempts.map((attempt) => `${attempt.endpoint}: ${attempt.error ?? 'unavailable'}`).join('; ')
-      || 'No CDP endpoint candidates were configured.';
-    const nativeReason = native.attempts.map((attempt) => `${attempt.appName}: ${attempt.error ?? attempt.status}`).join('; ')
-      || (config.nativeAttachMode === 'disabled' ? 'Native browser attach is disabled.' : 'No scriptable macOS browser was available.');
-    const reason = `CDP: ${cdpReason} Native: ${nativeReason}`;
-    if (fallbackPolicy === 'fail_closed') {
-      throw new AssistantPluginError('PLUGIN_BROWSER_ATTACH_UNAVAILABLE', `No configured browser attach provider was available. Fallback policy fail_closed prevented managed launch. ${reason}`, {
-        retryable: true,
-        details: {
-          browserMode: requestedMode,
-          fallbackPolicy,
-          attempts: attached.attempts,
-          nativeAttempts: native.attempts,
-        },
-      });
-    }
-    if (!runtimeHooks.moduleAvailable('playwright', repoRoot)) {
-      throw new AssistantPluginError('PLUGIN_BROWSER_DEPENDENCY_UNAVAILABLE', `Managed browser fallback requires Playwright, but native/CDP attach was unavailable. ${reason}`, { retryable: false });
-    }
-    return openManagedContext(runtimeHooks.loadPlaywright(repoRoot), repoRoot, config, target, args, 'managed_persistent', requestedMode, {
-      policy: fallbackPolicy,
-      from: 'attach_preferred',
-      to: 'managed_persistent',
-      reason,
-      attempts: attached.attempts,
-      nativeAttempts: native.attempts,
-    });
+    throw new AssistantPluginError('PLUGIN_BROWSER_ATTACH_UNAVAILABLE',
+      'Configured native browser target unavailable. No alternate provider will be attempted.',
+      { retryable: true, details: { provider: 'macos-apple-events', attempts: native.attempts } });
   }
-
   if (!runtimeHooks.moduleAvailable('playwright', repoRoot)) {
     throw new AssistantPluginError('PLUGIN_BROWSER_DEPENDENCY_UNAVAILABLE', 'Managed browser mode requires Playwright.', { retryable: false });
   }
   return openManagedContext(runtimeHooks.loadPlaywright(repoRoot), repoRoot, config, target, args, requestedMode, requestedMode);
 }
-
 async function withPage<T>(
   actionId: string,
   repoRoot: string,
@@ -2816,11 +3494,15 @@ const EXTRACTION_SCRIPTS = {
   })()`,
 };
 
+function selectorUnavailableInTime(errorMessage: string): boolean {
+  return /timeout|timed out|waiting for selector|selector.*not found|not found.*selector/i.test(errorMessage);
+}
+
 function selectorRepairHint(selector: string, errorMessage: string): string {
   if (/strict mode violation|resolved to \d+ elements/i.test(errorMessage)) {
     return `Selector "${selector}" matched multiple elements. Prefer a unique #id, [data-testid], or more specific path.`;
   }
-  if (/Timeout|waiting for selector|not found/i.test(errorMessage)) {
+  if (selectorUnavailableInTime(errorMessage)) {
     return `Selector "${selector}" was not found in time. Use snapshot_interactive or query_all to discover stable selectors, then retry.`;
   }
   return `Check selector "${selector}" against the current page structure.`;
@@ -3221,9 +3903,12 @@ function health(config: BrowserPluginConfig, repoRoot?: string): AssistantPlugin
   };
 }
 
-export function buildBrowserPluginManifest(previousRevision = 0, previousUpdatedAt?: string, repoRoot?: string, context?: AssistantPluginBuildContext): AssistantPluginManifest {
+export function buildBrowserPluginManifest(
+  previousRevision = 0, previousUpdatedAt?: string, repoRoot?: string,
+  context?: AssistantPluginBuildContext, computerNativeOnly = false,
+): AssistantPluginManifest {
   const root = repoRoot ?? process.cwd();
-  const config = loadConfig(root, context);
+  const config = loadConfig(root, context, computerNativeOnly);
   const state = health(config, root);
   return {
     schemaVersion: 1,
@@ -3232,7 +3917,7 @@ export function buildBrowserPluginManifest(previousRevision = 0, previousUpdated
     pluginId: BROWSER_PLUGIN_ID,
     provider: 'local-browser',
     displayName: 'Controller Browser Plugin',
-    pluginVersion: '1.1.0',
+    pluginVersion: '1.2.0',
     authority: {
       strategy: 'derived',
       duplicateStateAllowed: false,
@@ -3245,9 +3930,7 @@ export function buildBrowserPluginManifest(previousRevision = 0, previousUpdated
         ? 'Browser plugin is disabled.'
         : state.ready
           ? `Browser plugin is ready via ${config.browserMode === 'attach_preferred'
-            ? config.cdpAttachFallback === 'managed_persistent'
-              ? 'CDP, macOS native attach, and explicit managed fallback.'
-              : 'CDP or macOS native attach; managed fallback is disabled.'
+            ? 'the one configured CDP or native browser target (no provider fallback).'
             : 'Playwright persistent context.'}`
           : state.state === 'degraded'
             ? state.warnings[0] ?? 'Browser plugin requires a successful live native attach probe.'
@@ -3261,13 +3944,6 @@ export function buildBrowserPluginManifest(previousRevision = 0, previousUpdated
   };
 }
 
-const NODE_BRIDGE_PRE_ACTION_FAILURE_CODES = new Set([
-  'PLUGIN_BROWSER_NODE_UNAVAILABLE',
-  'PLUGIN_BROWSER_NODE_HOST_UNAVAILABLE',
-  'PLUGIN_BROWSER_NODE_REQUEST_TOO_LARGE',
-  'PLUGIN_BROWSER_NODE_START_FAILED',
-]);
-
 function browserRuntimeKey(input: AssistantPluginActionExecutionInput): string {
   return `${input.controllerHome}:${input.repoId}`;
 }
@@ -3276,9 +3952,15 @@ async function executeBrowserPluginActionInternal(
   input: AssistantPluginActionExecutionInput,
   runtimeAlreadyRouted = false,
 ): Promise<Record<string, unknown>> {
-  const persisted = loadConfig(input.repoRoot, input);
+  const persisted = loadConfig(input.repoRoot, input, input.pluginId === 'computer');
   const actionSessionId = input.actionId === 'configure' ? undefined : stringValue(input.args.session_id);
   const actionSession = actionSessionId ? findBrowserSession(input.repoRoot, actionSessionId) : undefined;
+  if (input.pluginId === 'computer' && actionSession?.browser?.provider
+    && actionSession.browser.provider !== 'macos-apple-events') {
+    throw new AssistantPluginError('PLUGIN_COMPUTER_BROWSER_PROVIDER_MISMATCH',
+      'Computer cannot manage an independent scripted Browser session; use the Browser plugin for that session.',
+      { retryable: false, details: { sessionId: actionSessionId, provider: actionSession.browser.provider } });
+  }
   const current = input.actionId === 'configure' ? persisted : effectiveBrowserActionConfig(persisted, input.args, actionSession);
   if (!current.enabled && input.actionId !== 'configure') {
     throw new AssistantPluginError('PLUGIN_DISABLED', 'Browser plugin is disabled.', { retryable: false });
@@ -3291,7 +3973,7 @@ async function executeBrowserPluginActionInternal(
   }
   if (!runtimeAlreadyRouted) {
     const runtimeKey = browserRuntimeKey(input);
-    const nodeBridgeEligible = shouldUseBrowserNodeBridge(
+    const nodeBridgeEligible = input.pluginId !== 'computer' && shouldUseBrowserNodeBridge(
       input.actionId,
       current.browserMode,
       runtimeHooksCustomized,
@@ -3300,33 +3982,21 @@ async function executeBrowserPluginActionInternal(
     const result = await executeBrowserRuntimeAction({
       runtimeKey,
       input,
-      providers: [
-        ...(nodeBridgeEligible ? [{
+      providers: nodeBridgeEligible ? [{
           providerId: 'browser.node_bridge',
           capabilities: ALL_BROWSER_PROVIDER_CAPABILITIES.filter((capability) => capability !== 'browser.persistent_handle'),
           foreground: 'none' as const,
           verifiesPostconditions: true,
           persistentHandle: false,
-          priority: 10,
           supportsInput: () => true,
-          execute: async (routedInput: AssistantPluginActionExecutionInput) => {
-            try {
-              return await executeBrowserActionThroughNode(routedInput);
-            } catch (error) {
-              if (error instanceof AssistantPluginError && NODE_BRIDGE_PRE_ACTION_FAILURE_CODES.has(error.code)) {
-                throw new BrowserProviderUnavailableBeforeActionError('browser.node_bridge', error.code);
-              }
-              throw error;
-            }
-          },
-        }] : []),
+          execute: async (routedInput: AssistantPluginActionExecutionInput) => await executeBrowserActionThroughNode(routedInput),
+        }] : [
         {
           providerId: 'browser.local',
           capabilities: ALL_BROWSER_PROVIDER_CAPABILITIES,
           foreground: 'none' as const,
           verifiesPostconditions: true,
           persistentHandle: true,
-          priority: 20,
           supportsInput: () => true,
           execute: async (routedInput: AssistantPluginActionExecutionInput) => executeBrowserPluginActionInternal(routedInput, true),
         },
@@ -3364,7 +4034,7 @@ async function executeBrowserPluginActionInternal(
           profileMode: nextProfileMode,
           profileDir: nextProfileMode === 'repo_local' ? undefined : nextProfileDir,
           profileDirectory: nextProfileMode === 'repo_local' ? undefined : nextProfileDirectory,
-          browserChannel: nextBrowserChannel ?? 'chromium',
+          browserChannel: nextBrowserChannel ?? (nextExecutablePath ? undefined : 'chromium'),
           executablePath: nextExecutablePath,
           cdpEndpoint: nextCdpEndpoint,
           cdpEndpointCandidates: nextCdpEndpointCandidates,
@@ -3378,13 +4048,74 @@ async function executeBrowserPluginActionInternal(
             ? positiveNumber(args.default_timeout_ms, DEFAULT_TIMEOUT_MS)
             : current.defaultTimeoutMs,
         });
-        const configErrors = validateConfig(config);
-        if (configErrors.length > 0) {
-          throw new AssistantPluginError('PLUGIN_CONFIGURATION_INVALID', configErrors[0], { retryable: false });
-        }
         await closeManagedContextsForRepo(input.repoRoot);
         return { config, health: health(config, input.repoRoot) };
       }
+      case 'list_unpacked_extensions': {
+        if (current.browserMode === 'attach_preferred') {
+          const cdp = await cdpExtensionList(input.repoRoot, current);
+          if (cdp) return { ...cdp, verified: true };
+          if (current.cdpAttachFallback !== 'managed_persistent') {
+            throw new AssistantPluginError('PLUGIN_BROWSER_EXTENSION_CONTROL_UNAVAILABLE', 'Unpacked-extension control requires a configured browser-level CDP endpoint; refusing to restart or mutate the user-owned native browser.', { retryable: true });
+          }
+        }
+        if (current.browserMode !== 'managed_persistent' && current.cdpAttachFallback !== 'managed_persistent') {
+          throw new AssistantPluginError('PLUGIN_BROWSER_EXTENSION_CONTROL_UNAVAILABLE', 'Selected Browser mode does not provide unpacked-extension control.', { retryable: false });
+        }
+        const profile = selectedProfile(current, input.repoRoot, 'managed_persistent');
+        const pending = managedBrowserContexts.get(managedContextKey(profile));
+        if (!pending) return { provider: 'playwright-persistent-context', extensions: [], verified: true };
+        const state = await pending;
+        const urls = extensionTargets(state.context);
+        const extensions = [...(managedExtensionPaths.get(managedContextKey(profile)) ?? [])].map((path) => {
+          const { expectedId } = unpackedExtensionPath({ ...input, args: { ...input.args, extension_path: path } });
+          const enabled = Boolean(expectedId && urls.some((url) => url.startsWith(`chrome-extension://${expectedId}/`)));
+          return { id: expectedId, path, enabled };
+        });
+        return { provider: 'playwright-persistent-context', extensions, verified: true };
+      }
+      case 'install_unpacked_extension': {
+        const extension = unpackedExtensionPath(input);
+        if (current.browserMode === 'attach_preferred') {
+          const cdp = await cdpInstallExtension(input, current, extension.path, extension.expectedId);
+          if (cdp) return cdp;
+          if (current.cdpAttachFallback !== 'managed_persistent') {
+            throw new AssistantPluginError('PLUGIN_BROWSER_EXTENSION_CONTROL_UNAVAILABLE', 'Unpacked-extension install requires a configured browser-level CDP endpoint; refusing to restart or mutate the user-owned native browser.', { retryable: true });
+          }
+        }
+        if ((current.browserMode !== 'managed_persistent' && current.cdpAttachFallback !== 'managed_persistent') || !extension.expectedId) {
+          throw new AssistantPluginError('PLUGIN_BROWSER_EXTENSION_CONTROL_UNAVAILABLE', extension.expectedId
+            ? 'Selected Browser mode does not provide managed unpacked-extension control.'
+            : 'Managed unpacked-extension verification requires a stable manifest key.', { retryable: false });
+        }
+        const profile = selectedProfile(current, input.repoRoot, 'managed_persistent');
+        const nativeHostChanged = projectManagedNativeMessagingHost(profile.profileDir, extension.nativeHost);
+        if (customVivaldiExtensionInstall(current, input.repoRoot)) {
+          return await installExtensionThroughCustomVivaldiCdpPort(input, current, profile, extension.path, extension.expectedId);
+        }
+        if (!runtimeHooks.moduleAvailable('playwright', input.repoRoot)) {
+          throw new AssistantPluginError('PLUGIN_BROWSER_DEPENDENCY_UNAVAILABLE', 'Managed unpacked-extension install requires Playwright.', { retryable: false });
+        }
+        const runtime = runtimeHooks.loadPlaywright(input.repoRoot);
+        const key = managedContextKey(profile);
+        const paths = managedExtensionPaths.get(key) ?? new Set<string>();
+        const changed = !paths.has(extension.path);
+        paths.add(extension.path);
+        managedExtensionPaths.set(key, paths);
+        if (changed || nativeHostChanged) await evictManagedContext(key);
+        const state = await managedContextState(runtime, input.repoRoot, current, profile);
+        const prefix = `chrome-extension://${extension.expectedId}/`;
+        let runtimeTarget = extensionTargets(state.context).find((candidate) => candidate.startsWith(prefix));
+        const verifiedExtension = await managedCdpInstallExtension(input, state.context, extension.path, extension.expectedId, Boolean(runtimeTarget));
+        if (!runtimeTarget) {
+          runtimeTarget = await waitForManagedExtension(state.context, extension.expectedId, positiveNumber(input.args.timeout_ms, current.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS));
+        }
+        return {
+          provider: 'playwright-persistent-context',
+          extension: { ...verifiedExtension, runtimeTarget },
+          verified: true,
+        };
+      }
       case 'list_sessions': {
         const inventory = await inspectSavedSessions(input.repoRoot, current);
         const requestedLimit = Math.max(1, Math.min(Math.trunc(positiveNumber(input.args.limit, DEFAULT_BROWSER_SESSION_LIST_LIMIT)), MAX_BROWSER_SESSION_LIST_LIMIT));
@@ -3399,7 +4130,10 @@ async function executeBrowserPluginActionInternal(
             throw new AssistantPluginError('PLUGIN_BROWSER_SESSION_CURSOR_INVALID', 'Browser session cursor is invalid or expired.', { retryable: false });
           }
         }
-        const page = inventory.sessions.slice(offset, offset + requestedLimit);
+        const visibleSessions = input.pluginId === 'computer'
+          ? inventory.sessions.filter(({ session }) => session.browser?.provider === 'macos-apple-events')
+          : inventory.sessions;
+        const page = visibleSessions.slice(offset, offset + requestedLimit);
         const nextOffset = offset + page.length;
         return {
           provider: 'playwright',
@@ -3412,8 +4146,8 @@ async function executeBrowserPluginActionInternal(
           deadManagedSessionCount: inventory.deadManagedSessionCount,
           deadNativeSessionCount: inventory.deadNativeSessionCount,
           limit: requestedLimit,
-          totalCount: inventory.sessions.length,
-          ...(nextOffset < inventory.sessions.length ? { nextCursor: Buffer.from(JSON.stringify({ offset: nextOffset }), 'utf8').toString('base64url') } : {}),
+          totalCount: visibleSessions.length,
+          ...(nextOffset < visibleSessions.length ? { nextCursor: Buffer.from(JSON.stringify({ offset: nextOffset }), 'utf8').toString('base64url') } : {}),
           sessions: page.map(({ session, liveness, evidence, cleanupError }) => ({
             sessionId: session.sessionId,
             url: session.url,
@@ -3498,7 +4232,13 @@ async function executeBrowserPluginActionInternal(
       case 'request_human_handoff': {
         const target = resolveActionTarget(input.repoRoot, input.args);
         const managedSession = target.existingSession;
-        const managedTarget = managedSession ? await runtimeManagedPageForSession(input.repoRoot, current, managedSession) : undefined;
+        if (input.pluginId === 'computer' && managedSession?.browser?.provider
+          && managedSession.browser.provider !== 'macos-apple-events') {
+          throw new AssistantPluginError('PLUGIN_COMPUTER_BROWSER_PROVIDER_MISMATCH',
+            'Computer handoff requires a native browser tab, not a scripted Browser session.', { retryable: false });
+        }
+        const managedTarget = input.pluginId === 'computer'
+          ? undefined : managedSession ? await runtimeManagedPageForSession(input.repoRoot, current, managedSession) : undefined;
         if (managedSession && managedTarget) {
           const result = { url: managedTarget.page.url(), title: await managedTarget.page.title().catch(() => managedSession.title) };
           const handoff = startRuntimeManagedBrowserHandoff({
@@ -3535,7 +4275,7 @@ async function executeBrowserPluginActionInternal(
         const nativeTab = nativeSession?.browser?.tab;
         const nativeBrowser = nativeSession?.browser?.provider === 'macos-apple-events'
           && nativeSession.browser.browserProduct
-          && nativeTab?.ownership === 'plugin_owned'
+          && (nativeTab?.ownership === 'plugin_owned' || nativeTab?.ownership === 'user_owned')
           && typeof nativeTab.windowId === 'string'
           && typeof nativeTab.tabId === 'string'
           ? {
@@ -3543,6 +4283,11 @@ async function executeBrowserPluginActionInternal(
               ref: { windowId: nativeTab.windowId, tabId: nativeTab.tabId },
             }
           : undefined;
+        if (input.pluginId === 'computer' && !nativeBrowser) {
+          throw new AssistantPluginError('PLUGIN_COMPUTER_NATIVE_BROWSER_HANDOFF_UNAVAILABLE',
+            'Computer handoff requires an existing bound native tab; it will not open a Playwright profile.',
+            { retryable: false });
+        }
         const handoffMode: BrowserMode = current.browserMode === 'isolated' ? 'isolated' : 'managed_persistent';
         const profile = selectedProfile(current, input.repoRoot, handoffMode, target.sessionId);
         if (!nativeBrowser) mkdirSync(profile.profileDir, { recursive: true });
@@ -3577,6 +4322,11 @@ async function executeBrowserPluginActionInternal(
       case 'get_handoff_status': {
         const interactionId = requiredString(input.args.interaction_id, 'interaction_id');
         const handoff = getBrowserHandoff(input.repoRoot, interactionId);
+        if (input.pluginId === 'computer' && !handoff.targetId.startsWith('macos-apple-events:')) {
+          throw new AssistantPluginError('PLUGIN_COMPUTER_BROWSER_PROVIDER_MISMATCH',
+            'Computer can only inspect native browser handoffs; standalone scripted handoffs are independent.',
+            { retryable: false });
+        }
         if (handoff.status === 'completed' && handoff.result?.url) {
           const session = findBrowserSession(input.repoRoot, handoff.sessionId);
           if (session) {
@@ -3604,6 +4354,11 @@ async function executeBrowserPluginActionInternal(
           throw new AssistantPluginError('PLUGIN_ACTION_ARGUMENT_INVALID', 'resolution must be resume or cancel', { retryable: false });
         }
         const currentHandoff = getBrowserHandoff(input.repoRoot, interactionId);
+        if (input.pluginId === 'computer' && !currentHandoff.targetId.startsWith('macos-apple-events:')) {
+          throw new AssistantPluginError('PLUGIN_COMPUTER_BROWSER_PROVIDER_MISMATCH',
+            'Computer can resolve only native browser handoffs; scripted Browser handoffs remain independent.',
+            { retryable: false });
+        }
         if (isRuntimeManagedBrowserHandoff(currentHandoff)) {
           const session = findBrowserSession(input.repoRoot, currentHandoff.sessionId);
           const managedTarget = session ? await runtimeManagedPageForSession(input.repoRoot, current, session) : undefined;
@@ -4245,10 +5000,14 @@ async function executeBrowserPluginActionInternal(
           });
         } catch (error) {
           const message = error instanceof Error ? error.message : String(error);
-          throw new AssistantPluginError('PLUGIN_ACTION_FAILED', message, {
-            retryable: true,
-            details: { selector, repairHint: selectorRepairHint(selector, message) },
-          });
+          throw new AssistantPluginError(
+            selectorUnavailableInTime(message) ? 'PLUGIN_BROWSER_SELECTOR_UNAVAILABLE' : 'PLUGIN_ACTION_FAILED',
+            message,
+            {
+              retryable: true,
+              details: { selector, repairHint: selectorRepairHint(selector, message) },
+            },
+          );
         }
       }
       case 'type':
@@ -4500,30 +5259,7 @@ async function executeBrowserPluginActionInternal(
         if (requested.length === 0 || requested.length > 32) {
           throw new AssistantPluginError('PLUGIN_ACTION_ARGUMENT_INVALID', 'attach_local_file requires file_path or 1-32 file_paths.', { retryable: false });
         }
-        const repositoryLexicalRoot = resolve(input.repoRoot);
-        const repositoryRoot = realpathSync(input.repoRoot);
-        const resolved = requested.map((filePath) => {
-          const lexicalPath = resolve(input.repoRoot, filePath);
-          const lexicalRelative = relative(repositoryLexicalRoot, lexicalPath);
-          if (lexicalRelative === '..' || lexicalRelative.startsWith(`..${sep}`) || isAbsolute(lexicalRelative)) {
-            throw new AssistantPluginError('PLUGIN_POLICY_BLOCKED', 'Local file attachments must stay inside the repository root.', { retryable: false, details: { fileName: basename(filePath) } });
-          }
-          if (!existsSync(lexicalPath)) {
-            throw new AssistantPluginError('PLUGIN_ACTION_ARGUMENT_INVALID', `Local attachment does not exist: ${basename(lexicalPath)}`, { retryable: false });
-          }
-          const realPath = realpathSync(lexicalPath);
-          const repositoryRelative = relative(repositoryRoot, realPath);
-          if (repositoryRelative === '..' || repositoryRelative.startsWith(`..${sep}`) || isAbsolute(repositoryRelative)) {
-            throw new AssistantPluginError('PLUGIN_POLICY_BLOCKED', 'Local file attachments must resolve inside the repository root.', { retryable: false, details: { fileName: basename(lexicalPath) } });
-          }
-          if (!statSync(realPath).isFile()) {
-            throw new AssistantPluginError('PLUGIN_ACTION_ARGUMENT_INVALID', `Local attachment is not a regular file: ${basename(lexicalPath)}`, { retryable: false });
-          }
-          if (/\.(exe|dmg|pkg|sh|bat|cmd|app)$/i.test(realPath)) {
-            throw new AssistantPluginError('PLUGIN_POLICY_BLOCKED', 'Executable file attachments are not allowed.', { retryable: false });
-          }
-          return lexicalPath;
-        });
+        const resolved = resolveBrowserAttachmentPaths(input, requested, stringValue(input.args.target_key));
         return await withPage(input.actionId, input.repoRoot, current, target, input.args, async (page, _diagnostics, connection) => {
           await page.evaluate((payload) => {
             const args = payload as { selector: string; count: number };
@@ -4629,6 +5365,61 @@ async function executeBrowserPluginActionInternal(
   }
 }
 
+/** Resolve one upload batch under the repository or the existing local-system target grant.
+ * A target_key changes the path base; it never grants arbitrary absolute filesystem access.
+ */
+export function resolveBrowserAttachmentPaths(
+  input: AssistantPluginActionExecutionInput,
+  requested: string[],
+  targetKey?: string,
+): string[] {
+  const repositoryLexicalRoot = resolve(input.repoRoot);
+  const repositoryRoot = realpathSync(input.repoRoot);
+  return requested.map((filePath) => {
+    let allowedPath: string;
+    if (targetKey) {
+      try {
+        allowedPath = resolveWorkspaceTargetPath(input.controllerHome, targetKey, filePath, {
+          mustExist: true,
+          kind: 'file',
+          operation: 'read',
+          ownerScope: pluginCapabilityAuthorizationOwnerScope(input.origin),
+        }).path;
+      } catch (error) {
+        if (!(error instanceof WorkspaceTargetGrantError)) throw error;
+        throw new AssistantPluginError('PLUGIN_POLICY_BLOCKED',
+          'Upload file is not within an active, caller-owned local-system target grant.',
+          { retryable: false, details: { fileName: basename(filePath), targetKey, causeCode: error.code } });
+      }
+    } else {
+      const lexicalPath = resolve(input.repoRoot, filePath);
+      const lexicalRelative = relative(repositoryLexicalRoot, lexicalPath);
+      if (lexicalRelative === '..' || lexicalRelative.startsWith(`..${sep}`) || isAbsolute(lexicalRelative)) {
+        throw new AssistantPluginError('PLUGIN_POLICY_BLOCKED', 'Local file attachments must stay inside the repository root.', {
+          retryable: false, details: { fileName: basename(filePath) },
+        });
+      }
+      if (!existsSync(lexicalPath)) {
+        throw new AssistantPluginError('PLUGIN_ACTION_ARGUMENT_INVALID', `Local attachment does not exist: ${basename(lexicalPath)}`, { retryable: false });
+      }
+      allowedPath = realpathSync(lexicalPath);
+      const repositoryRelative = relative(repositoryRoot, allowedPath);
+      if (repositoryRelative === '..' || repositoryRelative.startsWith(`..${sep}`) || isAbsolute(repositoryRelative)) {
+        throw new AssistantPluginError('PLUGIN_POLICY_BLOCKED', 'Local file attachments must resolve inside the repository root.', {
+          retryable: false, details: { fileName: basename(lexicalPath) },
+        });
+      }
+    }
+    if (!statSync(allowedPath).isFile()) {
+      throw new AssistantPluginError('PLUGIN_ACTION_ARGUMENT_INVALID', `Local attachment is not a regular file: ${basename(filePath)}`, { retryable: false });
+    }
+    if (/\.(exe|dmg|pkg|sh|bat|cmd|app)$/i.test(allowedPath)) {
+      throw new AssistantPluginError('PLUGIN_POLICY_BLOCKED', 'Executable file attachments are not allowed.', { retryable: false });
+    }
+    return allowedPath;
+  });
+}
+
 export async function executeBrowserPluginAction(input: AssistantPluginActionExecutionInput): Promise<Record<string, unknown>> {
   return await withBrowserSessionAuthorityContext(
     { controllerHome: input.controllerHome, repoId: input.repoId },