@te-river/opencode-team-mode 1.5.15 → 1.6.0

package/dist/tm/browser.js

@@ -12,10 +12,10 @@
  *     verbatim as the fallback.  On cdp-legacy only the core subset works
  *     (open/navigate/read/screenshot/close + navigate_page/take_screenshot/
  *     list_pages/evaluate_script aliases); the snapshot-first actions
- *     (take_snapshot + uid addressing, 16-verb chrome-devtools-mcp surface)
+ *     (take_snapshot + uid addressing, 18-verb chrome-devtools-mcp surface)
  *     require the playwright engine.
  *
- * Action surface aligns with chrome-devtools-mcp's 16 verbs (R2 mapping):
+ * Action surface aligns with chrome-devtools-mcp's 18 verbs (R2 mapping):
  *   navigate_page · take_snapshot · click · fill · hover · drag ·
  *   press_key · select_page · upload_file · wait_for · evaluate_script ·
  *   list_console_messages · list_network_requests · list_pages ·
@@ -61,12 +61,12 @@
  * Role access mirrors tm_webfetch: network roles (team + researcher) only,
  * tester browser-only (UI verification).
  */
-import { execFileSync, spawn } from "node:child_process";
+import { execFileSync, spawn, spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { checkWebUrl, seedWebfetchDomains } from "./webfetch.js";
-import { askUserForTarget } from "./perm-ask.js";
+import { askGrantNote, askRefusalNote, askUserForTarget, askUserForTargetDetailed } from "./perm-ask.js";
 import { assertReadablePath } from "./guard.js";
 import { isEnvFilePath } from "../envprotect.js";
 import { tmError, toToolResult } from "./result.js";
@@ -291,6 +291,44 @@ export function findBrowserExecutable(env = process.env) {
  *   auto (default)                    → headless ONLY when there is no
  *   display possible (Linux without DISPLAY/WAYLAND_DISPLAY).
  */
+/** Decide what profile directory TM_BROWSER_USER_DATA_DIR asks for.
+ *
+ *  The tool description has claimed for a long time that "the real profile is
+ *  never touched" while nothing enforced it: the string went straight into
+ *  `launchPersistentContext`.  Pointing it at the user's own browser data dir is
+ *  not a neutral choice — with the browser open, the new process hands its URL
+ *  to the running instance and exits (the confusing "本机已有同品牌浏览器在跑"
+ *  failure), and with it closed the agent browses AS THE USER, with every cookie
+ *  and saved session, while our orphan reaper force-kills (`taskkill /T /F`) any
+ *  browser whose owner died — a real route to corrupting a profile.
+ *
+ *  So: a real browser data dir is refused with the fix named, anything else is
+ *  honored, and an unset value keeps the isolated temp profile (the default).
+ *  Pure, so both engines and the tests share one answer. */
+export function classifyProfileDir(env = process.env) {
+    const raw = String(env.TM_BROWSER_USER_DATA_DIR ?? "").trim();
+    if (!raw)
+        return { dir: null, refusal: null };
+    const norm = raw.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+    const segs = norm.split("/").filter(Boolean);
+    const last = segs[segs.length - 1] ?? "";
+    const looksReal = last === "user data" ||
+        last === "google-chrome" ||
+        last === "chromium" ||
+        last === "profiles" ||
+        /(^|\/)(microsoft|google)\/(edge|chrome|chromium|chrome sxs)(\/(user data))?$/.test(norm) ||
+        /\/mozilla\/firefox\/(profiles|profile)$/.test(norm);
+    if (looksReal) {
+        return {
+            dir: null,
+            refusal: `TM_BROWSER_USER_DATA_DIR 指向的看起来是浏览器自己的数据目录（${raw}），拒绝用它启动。` +
+                `那样 agent 就是以你的真实身份上网，而孤儿回收是强杀进程，可能损坏这个目录。` +
+                `要保留登录态：把它改成一个专用空目录（例如 D:\\tm-browser-profile 或 ~/.tm-browser-profile），` +
+                `第一次让 agent 打开登录页、你人工登录一次，之后 cookie 就在这个目录里跨会话保留。`,
+        };
+    }
+    return { dir: raw, refusal: null };
+}
 export function resolveHeadless(env = process.env) {
     const raw = String(env.TM_BROWSER_HEADLESS ?? "auto").trim().toLowerCase();
     if (["1", "true", "force", "yes"].includes(raw))
@@ -378,6 +416,102 @@ export function rememberSite(allowedSites, url) {
         /* unparseable — nothing to remember */
     }
 }
+// ---------- a page that is not a page, but a wall ----------------------------
+/**
+ * Human-verification walls.  This exists because "0 个可寻址节点" and "this
+ * site wants a human to prove it is one" look identical to the agent, and the
+ * two have opposite next moves: an empty page is worth retrying, a wall never
+ * is — retrying just spends rounds on a captcha.  Measured on baike.baidu.com
+ * item pages, where every arm (raw playwright included, all resources allowed)
+ * returns 0–6 nodes titled 百度安全验证, and the agent reported "该网站没有内容".
+ *
+ * Deliberately narrow: signatures we observed live, plus the unambiguous
+ * English ones.  Callers consult it ONLY when the page came back thin, so an
+ * article that merely mentions 验证码 is never mislabelled as a wall.
+ */
+export const CHALLENGE_WALL_SIGNS = [
+    { re: /百度安全验证|百度的安全验证/, label: "百度安全验证" },
+    { re: /安全验证|访问验证|请完成验证|滑动验证|拖动滑块|人机验证|点击按钮进行验证/, label: "站点安全验证" },
+    { re: /just a moment|checking before the link|cf-browser-verification/i, label: "Cloudflare 人机校验" },
+    { re: /verify you are a human|are you a robot|enable javascript and cookies/i, label: "人机校验" },
+    { re: /access denied|attention required|blocked because|request blocked/i, label: "访问被拒（反爬拦截）" },
+];
+/** Which wall this thin page actually is, or null when it is just empty. */
+export function challengeWallOf(...texts) {
+    const hay = texts.filter(Boolean).join("\n").slice(0, 4000);
+    if (!hay.trim())
+        return null;
+    for (const s of CHALLENGE_WALL_SIGNS)
+        if (s.re.test(hay))
+            return s.label;
+    return null;
+}
+/** One hostname for `allow_host`, or "" when the argument is not a single bare
+ *  domain.  Strict on purpose: this value becomes the pattern in an official
+ *  consent dialog, and a user approving "bkssl.bdimg.com" must not be getting a
+ *  wildcard, a URL with a path, or a port. */
+export function normalizeApprovalHost(raw) {
+    const s = String(raw ?? "").trim().toLowerCase().replace(/^[a-z]+:\/\//, "").replace(/^\.+|\.+$/g, "");
+    if (!s || s.length > 253)
+        return "";
+    if (/[\s/@:*?#%\\]/.test(s))
+        return "";
+    if (!/^[a-z0-9一-鿿-]+(\.[a-z0-9一-鿿-]+)+$/.test(s))
+        return "";
+    return s;
+}
+/** The document title, or "" — a title is a diagnostic, never a reason for the
+ *  action that was asked for to fail. */
+async function readTitle(page) {
+    try {
+        return String((await page.title?.()) ?? "");
+    }
+    catch {
+        return "";
+    }
+}
+/**
+ * The launch pid, asked more than once.
+ *
+ * Why this exists: `childProcRows` folds EVERY OS-query failure (PowerShell
+ * exiting non-zero, the 6 s timeout killing it mid-flight, a JSON parse miss)
+ * into an empty list, and the launcher used to ask exactly once.  Under load —
+ * this plugin's own parallel test runner reproduces it, four suites hammering
+ * CIM at once — one such query fails now and then, and a single failed query
+ * used to cost the session two things permanently: the orphan-ledger entry (so
+ * the next boot could not reclaim that browser) and `close`'s process
+ * verification.  Worse, an exception escaping the lookup failed `open` itself,
+ * reporting a browser that had launched fine as an error.
+ *
+ * So: a failed or empty answer is retried a bounded number of times, and any
+ * throw is swallowed into the retry counter — the pid is diagnostic and
+ * reclamation metadata, never a reason to lose the session.  When it still
+ * cannot be resolved, `via: "none"` says so and close keeps refusing the
+ * 已确认关闭 sentence (pinned by §25).
+ */
+export const LAUNCH_PID_ATTEMPTS = 3;
+export const LAUNCH_PID_RETRY_MS = 250;
+export async function resolveLaunchPid(opts) {
+    const pwPid = Number(opts.playwrightPid?.() ?? 0) || 0;
+    if (pwPid > 0)
+        return { pid: pwPid, via: "playwright", failures: 0 };
+    const attempts = Math.max(1, Number(opts.attempts) || LAUNCH_PID_ATTEMPTS);
+    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    let failures = 0;
+    for (let i = 0; i < attempts; i++) {
+        if (i)
+            await sleep(LAUNCH_PID_RETRY_MS);
+        try {
+            const scan = launchedBrowserPid(opts.executablePath, { rows: opts.rows() });
+            if (scan > 0)
+                return { pid: scan, via: "child-scan", failures };
+        }
+        catch {
+            failures++;
+        }
+    }
+    return { pid: 0, via: "none", failures };
+}
 // ---------- evaluate_script: consent + result redaction ---------------------
 /** `evaluate_script` is the one browser verb the network gate cannot cover:
  *  the allowlist limits where we NAVIGATE, not what an already-loaded page
@@ -413,11 +547,375 @@ export function redactEvalResult(text) {
     }
     return { text: out, masked: kinds };
 }
+export function browserLedgerFile(storeRoot) {
+    return path.join(storeRoot, "browsers.jsonl");
+}
+/** Best-effort append: a ledger that cannot be written must never cost the
+ *  user their browser session. */
+export function appendBrowserLedger(file, rec) {
+    try {
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.appendFileSync(file, JSON.stringify(rec) + "\n", "utf8");
+    }
+    catch {
+        /* observability + reclamation only */
+    }
+}
+/** Read the ledger, terminate the orphans, and rewrite what is still live.
+ *  Returns the counts so the caller can log them; never throws. */
+export function reapOrphanBrowsers(file, opts = {}) {
+    const alive = opts.alive ?? pidAlive;
+    const kill = opts.kill ?? ((p) => killBrowserTree(p));
+    const identity = opts.identity ?? procIdentity;
+    const out = { reaped: [], kept: 0, dropped: 0 };
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf8");
+    }
+    catch {
+        return out;
+    }
+    const survivors = [];
+    const seen = new Set();
+    for (const line of raw.split("\n")) {
+        if (!line.trim())
+            continue;
+        let e;
+        try {
+            e = JSON.parse(line);
+        }
+        catch {
+            continue; // a torn line is not an instruction to kill anything
+        }
+        const pid = Number(e?.pid);
+        const owner = Number(e?.ownerPid);
+        if (!Number.isFinite(pid) || pid <= 0 || seen.has(pid)) {
+            out.dropped++;
+            continue;
+        }
+        seen.add(pid);
+        if (!alive(pid)) {
+            out.dropped++; // browser exited on its own — the entry is history
+            continue;
+        }
+        if (owner > 0 && !alive(owner)) {
+            // An OS pid is a recyclable number, and the kill below is a FORCE kill of
+            // a whole process tree.  So the entry has to still describe the
+            // executable we launched: if it does not, that pid belongs to an
+            // unrelated program now and killing it would be our bug, not our job.
+            const exe = String(e?.exe ?? "").trim();
+            if (exe && !identityMatchesExecutable(exe, identity(pid))) {
+                out.dropped++;
+                continue;
+            }
+            try {
+                kill(pid);
+                out.reaped.push(pid);
+            }
+            catch {
+                survivors.push(e); // not ours to signal (or already gone) — keep the record, say nothing false
+            }
+            continue;
+        }
+        survivors.push(e);
+    }
+    out.kept = survivors.length;
+    try {
+        if (survivors.length)
+            fs.writeFileSync(file, survivors.map((s) => JSON.stringify(s) + "\n").join(""), "utf8");
+        else
+            fs.rmSync(file, { force: true });
+    }
+    catch {
+        /* the next boot retries */
+    }
+    return out;
+}
+/** Is this OS pid still alive? `process.kill(pid, 0)` is the portable probe:
+ *  ESRCH means gone, EPERM means alive but owned by someone else — both are
+ *  answers, and "no answer" is never one of them. */
+export function pidAlive(pid) {
+    if (!Number.isFinite(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err?.code === "EPERM";
+    }
+}
+/** Wait up to `ms` for a pid to disappear, then terminate it once and give it
+ *  a short grace. Returns whether the process is GONE — the only honest basis
+ *  for a "已确认关闭" claim. */
+export async function waitForPidExit(pid, ms = 3000, kill = (p) => killBrowserTree(p)) {
+    if (!pidAlive(pid))
+        return true;
+    const deadline = Date.now() + Math.max(0, ms);
+    while (Date.now() < deadline && pidAlive(pid)) {
+        await new Promise((r) => setTimeout(r, 100));
+    }
+    if (!pidAlive(pid))
+        return true;
+    try {
+        kill(pid);
+    }
+    catch {
+        /* already gone, or not ours to signal — the re-check below decides */
+    }
+    await new Promise((r) => setTimeout(r, 250));
+    return !pidAlive(pid);
+}
+/** What a pid actually is right now — its image name and command line, or null
+ *  when the pid is gone.  Used to prove a recorded pid is still the browser we
+ *  launched before anything force-kills it (see reapOrphanBrowsers). */
+function procIdentity(pid) {
+    const p = Number(pid);
+    if (!Number.isInteger(p) || p <= 0)
+        return null;
+    if (process.platform === "win32") {
+        const script = `Get-CimInstance Win32_Process -Filter 'ProcessId=${p}' | Select-Object Name,CommandLine | ConvertTo-Json -Compress`;
+        const r = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
+            encoding: "utf8",
+            windowsHide: true,
+            timeout: 6000,
+            maxBuffer: 4 * 1024 * 1024,
+        });
+        if (r.status !== 0)
+            return null;
+        const text = String(r.stdout ?? "").trim();
+        if (!text)
+            return null;
+        try {
+            const row = JSON.parse(text);
+            const one = (Array.isArray(row) ? row[0] : row) ?? {};
+            return { name: String(one?.Name ?? ""), cmdline: String(one?.CommandLine ?? "") };
+        }
+        catch {
+            return null;
+        }
+    }
+    try {
+        const raw = fs.readFileSync(`/proc/${p}/cmdline`);
+        const parts = String(raw).split("\0").filter((s) => s !== "");
+        if (!parts.length)
+            return null;
+        return { name: path.basename(parts[0]), cmdline: parts.join(" ") };
+    }
+    catch {
+        return null;
+    }
+}
+/** Does this identity look like the executable we launched?  Compared on the
+ *  file NAME: the command line's quoting and path form can differ from ours
+ *  (8.3-short vs long path, escaped quotes), while a pid recycled by an
+ *  unrelated program almost never carries the same image name.  A missing
+ *  identity counts as NO — the safe answer before a force-kill. */
+export function identityMatchesExecutable(exePath, ident) {
+    const want = path.basename(String(exePath ?? "")).toLowerCase();
+    if (!want || !ident)
+        return false;
+    const name = String(ident.name ?? "").toLowerCase();
+    const cmd = String(ident.cmdline ?? "").toLowerCase();
+    return name === want || cmd.includes(want);
+}
+/** The same question asked of a live pid (see identityMatchesExecutable). */
+export function pidMatchesExecutable(pid, exePath) {
+    return identityMatchesExecutable(exePath, procIdentity(pid));
+}
+/** Terminate a browser process AND everything it spawned.
+ *
+ *  `process.kill(pid)` signals the ROOT only.  Measured on the desktop host the
+ *  day this was written: the orphan reaper's default kill took the msedge root
+ *  down and left all NINE of its child processes running — which is exactly the
+ *  leftover the reaper exists to remove.  The graceful path does not have this
+ *  problem (playwright's `browser.close()` shuts its children down first, and
+ *  the real-host leg verifies it), so this is the fallback's job.
+ *
+ *  win32: `taskkill /T /F` walks the tree for us.
+ *  POSIX: no tree flag, so descendants are enumerated and killed deepest-first.
+ *  Best-effort throughout: a process that vanishes mid-walk is not an error.
+ */
+export function killBrowserTree(pid, opts = {}) {
+    const p = Number(pid);
+    if (!Number.isInteger(p) || p <= 0)
+        return;
+    const run = opts.run ?? ((cmd, args) => {
+        spawnSync(cmd, args, { windowsHide: true, timeout: 8000 });
+    });
+    if ((opts.platform ?? process.platform) === "win32") {
+        try {
+            run("taskkill.exe", ["/PID", String(p), "/T", "/F"]);
+        }
+        catch {
+            /* gone already, or not ours to signal */
+        }
+        return;
+    }
+    const children = opts.children ?? childProcRows;
+    const order = [];
+    const queue = [p];
+    while (queue.length) {
+        const cur = queue.shift();
+        let kids = [];
+        try {
+            kids = children(cur) ?? [];
+        }
+        catch {
+            kids = [];
+        }
+        for (const k of kids) {
+            const kid = Number(k?.pid);
+            if (Number.isInteger(kid) && kid > 0 && kid !== p && !order.includes(kid)) {
+                order.push(kid);
+                queue.push(kid);
+            }
+        }
+    }
+    const signal = opts.signal ?? ((p) => process.kill(p));
+    for (const kid of order.reverse()) {
+        try {
+            signal(kid);
+        }
+        catch {
+            /* racy by design — the re-check above is what decides */
+        }
+    }
+    try {
+        signal(p);
+    }
+    catch {
+        /* already gone */
+    }
+}
+/** Children of `ppid`, straight from the OS.  Best-effort by design: a host
+ *  without PowerShell/CIM or a refused query returns [], and the caller then
+ *  reports that the process could not be verified rather than guessing. */
+function childProcRows(ppid) {
+    if (process.platform === "win32") {
+        // The filter runs server-side, so the reply holds ONLY our own children —
+        // never a full-table scan, never a name match on someone else's browser.
+        const script = `Get-CimInstance Win32_Process -Filter 'ParentProcessId=${ppid}' | ` +
+            "Select-Object ProcessId,Name,CommandLine | ConvertTo-Json -Compress";
+        const r = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
+            encoding: "utf8",
+            windowsHide: true,
+            timeout: 6000,
+            maxBuffer: 8 * 1024 * 1024,
+        });
+        if (r.status !== 0)
+            return [];
+        const text = String(r.stdout ?? "").trim();
+        if (!text)
+            return [];
+        let rows;
+        try {
+            rows = JSON.parse(text);
+        }
+        catch {
+            return [];
+        }
+        const list = Array.isArray(rows) ? rows : [rows];
+        return list
+            .map((x) => ({
+            pid: Number(x?.ProcessId) || 0,
+            name: String(x?.Name ?? ""),
+            cmdline: String(x?.CommandLine ?? ""),
+        }))
+            .filter((x) => x.pid > 0);
+    }
+    const r = spawnSync("ps", ["-eo", "pid=,ppid=,args="], { encoding: "utf8", timeout: 4000 });
+    if (r.status !== 0)
+        return [];
+    const out = [];
+    for (const line of String(r.stdout ?? "").split("\n")) {
+        const m = /^\s*(\d+)\s+(\d+)\s+(.+)$/.exec(line);
+        if (!m || Number(m[2]) !== ppid)
+            continue;
+        const cmdline = m[3].trim();
+        out.push({ pid: Number(m[1]), name: path.basename(cmdline.split(/\s+/)[0] ?? ""), cmdline });
+    }
+    return out;
+}
+/** The OS pid behind a playwright-launched browser.
+ *
+ *  playwright-core has NO `Browser.process()` — that accessor belongs to
+ *  ElectronApplication and BrowserServer.  Measured on the desktop host with a
+ *  real 1.63 session: `typeof browser.process === "undefined"`, so the pid
+ *  stayed 0, the orphan ledger recorded nothing, and close printed 已确认关闭
+ *  over a browser process it had never checked.
+ *
+ *  The only exact anchor available is that the browser is a DIRECT CHILD of
+ *  this process, started from the executable WE resolved.  That matters: this
+ *  machine carries a dozen unrelated msedge trees (the user's own windows,
+ *  msedgewebview2 under SearchHost.exe and under a vendor utility), so matching
+ *  by process name would be a loaded gun pointed at them.
+ *
+ *  0 = not found, and every caller treats 0 as "no verification" — never as
+ *  "verified gone".
+ */
+export function launchedBrowserPid(executablePath, opts = {}) {
+    const exe = String(executablePath ?? "").trim();
+    const base = path.basename(exe).toLowerCase();
+    if (!base)
+        return 0;
+    let rows;
+    try {
+        rows = opts.rows ?? childProcRows(opts.ppid ?? process.pid);
+    }
+    catch {
+        return 0;
+    }
+    const mine = (rows ?? []).filter((r) => Number.isFinite(Number(r?.pid)) && Number(r.pid) > 0);
+    const byPath = mine.filter((r) => String(r.cmdline ?? "").toLowerCase().includes(exe.toLowerCase()));
+    if (byPath.length === 1)
+        return Number(byPath[0].pid);
+    // More than one of OUR children from the same executable = an older session
+    // that has not been reaped yet.  pids climb, so the highest is this launch.
+    if (byPath.length > 1)
+        return Math.max(...byPath.map((r) => Number(r.pid)));
+    // Name fallback, and only for rows where the OS gave us NO command line at
+    // all.  A row that carries a command line for some OTHER executable is
+    // evidence against, not a missing clue — adopting it would mean signalling a
+    // browser we never launched.
+    const byName = mine.filter((r) => String(r.cmdline ?? "").trim() === "" && String(r.name ?? "").toLowerCase() === base);
+    return byName.length === 1 ? Number(byName[0].pid) : 0;
+}
 /** Consent is per BROWSER SESSION, not per call: one dialog when the lead
  *  decides to script the page, then the round stops paying for it. */
 export function needsEvalConsent(policy, alreadyApproved) {
     return policy !== "off" && !alreadyApproved;
 }
+/** A function-shaped source has to be INVOKED.  Every browser MCP documents
+ *  `function: "() => …"`, but evaluate() treats a STRING as an expression: a
+ *  function source evaluates to a function object, which is not serializable,
+ *  so the call resolves to undefined and the agent reads "null" and goes
+ *  looking for a bug that is in our call rather than in the page (measured
+ *  live 2026-09-21 — six rounds lost this way).  An expression the model
+ *  already wrapped, or a bare `document.title`, passes through untouched. */
+export function evalExpression(src) {
+    const t = src.trim();
+    if (!t)
+        return t;
+    const fnLike = /^(async\s+)?function\b/.test(t) ||
+        /^(async\s+)?\(\s*[^()]*?\s*\)\s*=>/.test(t) ||
+        /^(async\s+)?[A-Za-z_$][\w$]*\s*=>/.test(t);
+    return fnLike ? `(${t})()` : t;
+}
+/** `null` is not a diagnosis.  The render names the type, so "the page has no
+ *  such links" and "your function returned nothing" and "it was not called"
+ *  stop looking like the same answer. */
+export function renderEvalResult(value) {
+    if (value === undefined) {
+        return ("执行结果：undefined —— 函数没有 return 值（或返回了不可序列化的对象，比如 DOM 节点本身）。" +
+            "要拿数据就返回字符串或数组，例：() => [...document.querySelectorAll('a')].map(a => a.href)");
+    }
+    if (value === null)
+        return "执行结果：null（页面确实返回了 null —— 这是成功执行，不是失败）";
+    const kind = Array.isArray(value) ? `array(${value.length})` : typeof value;
+    const json = JSON.stringify(value) ?? String(value);
+    return `执行结果（${kind}）：${json}`;
+}
 /** Host only — the consent line in the dialog and in the trajectory never
  *  carries a query string (a search URL can hold the very token we guard). */
 export function hostOnly(url) {
@@ -428,6 +926,133 @@ export function hostOnly(url) {
         return url.slice(0, 60);
     }
 }
+const CLICK_EFFECT_BUDGET_MS = 900;
+const CLICK_POLL_MS = 150;
+const CLICK_SETTLE_MS = 5000;
+/** Runs in the page.  Kept free of TS annotations and outer-scope references
+ *  because playwright serializes it. */
+const clickProbeFn = (el) => {
+    const attrs = {};
+    for (const a of ["aria-expanded", "aria-checked", "aria-selected", "aria-pressed", "disabled"]) {
+        const v = el.getAttribute ? el.getAttribute(a) : null;
+        if (v !== null && v !== undefined)
+            attrs[a] = String(v);
+    }
+    if (typeof el.value === "string")
+        attrs.value = el.value;
+    return {
+        attrs,
+        url: String(location.href || ""),
+        ready: String(document.readyState || ""),
+        nodes: document.getElementsByTagName("*").length,
+    };
+};
+async function probeClickTarget(loc) {
+    if (typeof loc.evaluate !== "function")
+        return null;
+    try {
+        const raw = (await loc.evaluate(clickProbeFn));
+        if (!raw || typeof raw !== "object")
+            return null;
+        return {
+            attrs: (raw.attrs ?? {}),
+            url: String(raw.url ?? ""),
+            ready: String(raw.ready ?? ""),
+            nodes: Number(raw.nodes ?? 0),
+        };
+    }
+    catch {
+        return null; // a detached element is an answer, not a crash
+    }
+}
+/** Bounded settle.  `open` deliberately returns at domcontentloaded — reading a
+ *  page must not wait for analytics — so the wait belongs to the action that
+ *  needs a handler attached, not to every navigation. */
+async function settlePage(page, timeoutMs = CLICK_SETTLE_MS) {
+    const waiting = typeof page.waitForLoadState === "function" ? page.waitForLoadState("load", { timeout: timeoutMs }) : null;
+    if (waiting) {
+        await Promise.race([
+            Promise.resolve(waiting).catch(() => undefined),
+            new Promise((r) => setTimeout(r, timeoutMs)),
+        ]);
+    }
+    await new Promise((r) => setTimeout(r, 250));
+}
+/** What differs between two probes, in the order a reader cares about. */
+export function describeClickChange(before, after) {
+    const out = [];
+    const attrsBefore = before.attrs ?? {};
+    const attrsAfter = after.attrs ?? {};
+    for (const k of Object.keys(attrsBefore)) {
+        if (attrsAfter[k] !== attrsBefore[k])
+            out.push(`${k}: ${attrsBefore[k]} → ${attrsAfter[k] ?? "（消失）"}`);
+    }
+    for (const k of Object.keys(attrsAfter)) {
+        if (!(k in attrsBefore))
+            out.push(`${k}: → ${attrsAfter[k]}`);
+    }
+    if (before.url && after.url && before.url !== after.url)
+        out.push(`已跳转 → ${after.url.slice(0, 120)}`);
+    if (before.nodes && after.nodes !== before.nodes)
+        out.push(`DOM 节点 ${before.nodes} → ${after.nodes}`);
+    return out;
+}
+/** Poll until something changed or the budget runs out.  A navigating click can
+ *  detach the element, so the URL is checked independently of the probe. */
+async function observeClickEffect(loc, page, before, budgetMs = CLICK_EFFECT_BUDGET_MS) {
+    const deadline = Date.now() + Math.max(0, budgetMs);
+    for (;;) {
+        const after = await probeClickTarget(loc);
+        if (after) {
+            const changed = describeClickChange(before, after);
+            if (changed.length)
+                return { changed, after };
+        }
+        else {
+            const urlNow = typeof page.url === "function" ? String(page.url() ?? "") : "";
+            if (urlNow && before.url && urlNow !== before.url)
+                return { changed: [`已跳转 → ${urlNow.slice(0, 120)}`], after: null };
+        }
+        if (Date.now() >= deadline)
+            return { changed: [], after };
+        await new Promise((r) => setTimeout(r, CLICK_POLL_MS));
+    }
+}
+/** The reply.  Pure, so the wording is pinnable without a browser: a click that
+ *  observably did something says what changed; one that did not says so and
+ *  names the next move instead of reporting success. */
+export function clickVerdict(target, before, changed, opts) {
+    const head = `已点击 ${target}`;
+    const dialogNote = opts.dialog ? "；有未处理对话框——handle_dialog（同轮观察，勿另起动作）" : "";
+    if (!before)
+        return head + dialogNote; // nothing could be probed: claim no more than we know
+    if (changed.length) {
+        const retryNote = opts.retried
+            ? `（第一次点击落在页面还没就绪时 readyState=${before.ready || "?"}，未观测到变化；等加载完重试才生效）`
+            : "";
+        return `${head} · ${changed.join(" · ")}${retryNote}${dialogNote}`;
+    }
+    const watched = Object.keys(before.attrs).length
+        ? Object.entries(before.attrs).map(([k, v]) => `${k}=${v}`).join(" ")
+        : "无可观测状态属性";
+    const facts = `${watched} · URL 未变 · DOM 节点 ${before.nodes} 未变 · readyState=${before.ready || "?"}`;
+    // Three different reasons produce the same "nothing changed", and the advice
+    // that fits one of them is a dead end for the others.  Measured live: a page
+    // at readyState=complete whose framework bundles the governance gate had
+    // trimmed was told to "wait for the text" — wait_for then threw a strict-mode
+    // violation, so the recommended way out led nowhere.
+    const why = opts.blocked && opts.blocked.count > 0
+        ? `最可能的原因不是"还没加载完"，而是**这个页面的脚本被治理闸门拦掉了**：本次有 ${opts.blocked.count} 个子资源被拦截` +
+            `${opts.blocked.hosts.length ? `（${opts.blocked.hosts.join(", ")}）` : ""}，而它们的可执行资源不属于你导航过的那个站。` +
+            `出路：请操作者把这些主机加进 TM_WEBFETCH_ALLOWED_DOMAINS（或先在确认窗里批准该站点）后重新 open；` +
+            `也可以直接 TM_BROWSER_SUBRESOURCE=off 之外逐案判断——总之现在这个按钮上没有 handler。`
+        : before.ready === "complete"
+            ? `页面已经加载完成（readyState=complete），所以这不是加载时机问题：这个元素本身不响应这种点击（常见于 <a> 需要 navigate、事件绑在父节点、或被上层遮罩）。` +
+                `下一步：重新 take_snapshot 看清结构再决定，或改用 navigate / evaluate_script 直接取你要的东西。`
+            : `最常见的原因是页面脚本还没跑完（readyState=${before.ready || "?"}），而 playwright 的可见/稳定/可点检查在这种情况下全部通过。` +
+                `下一步：wait_for 你要点的文字，或重新 take_snapshot 再点一次。`;
+    return `${head}，但页面没有任何可观测变化（${facts}）。点击送达了，可是没有 handler 响应。${why}不要把这次点击当成成功。${dialogNote}`;
+}
 class PipeCdp {
     child;
     nextId = 1;
@@ -608,8 +1233,8 @@ export class SnapshotIndex {
 export function unescapeAriaName(raw) {
     return String(raw).replace(/\\(.)/g, (_, c) => (c === "s" ? " " : c === "n" ? "\n" : c === "t" ? "\t" : c));
 }
-// ---------- action surface (R2: chrome-devtools-mcp 16-verb alignment) --------
-/** The 16 canonical verbs, named byte-identical to chrome-devtools-mcp. */
+// ---------- action surface (R2: chrome-devtools-mcp 18-verb alignment) --------
+/** The 18 canonical verbs, named byte-identical to chrome-devtools-mcp. */
 export const BROWSER_PLAYWRIGHT_ACTIONS = [
     "navigate_page",
     "take_snapshot",
@@ -619,6 +1244,8 @@ export const BROWSER_PLAYWRIGHT_ACTIONS = [
     "drag",
     "press_key",
     "select_page",
+    "new_page",
+    "close_page",
     "upload_file",
     "wait_for",
     "evaluate_script",
@@ -628,8 +1255,26 @@ export const BROWSER_PLAYWRIGHT_ACTIONS = [
     "take_screenshot",
     "handle_dialog",
 ];
-/** Legacy compat verbs that ride on top of the 16 (both engines). */
+/** Legacy compat verbs that ride on top of the 18 (both engines). */
 export const BROWSER_COMPAT_ACTIONS = ["open", "navigate", "read", "screenshot", "close"];
+/** Verbs of our own that act on the GATE rather than the DOM: no page is
+ *  involved, so both engines serve them and neither can drift. */
+export const BROWSER_GATE_ACTIONS = ["allow_host"];
+/** Every verb the execute layer accepts — the ONE table the refusal menu and
+ *  the args schema are both built from.  The hand-written copies drifted the
+ *  day `new_page` landed (§6o/unknown-action menu), and a schema that omits a
+ *  verb is a capability no agent knows it has. */
+export const ALL_BROWSER_ACTIONS = [
+    ...BROWSER_PLAYWRIGHT_ACTIONS,
+    ...BROWSER_COMPAT_ACTIONS,
+    ...BROWSER_GATE_ACTIONS,
+];
+export const BROWSER_ACTION_MENU = ALL_BROWSER_ACTIONS.join(" | ");
+/** The verbs that must still WORK when a browser has zero tabs: `new_page` is
+ *  the remedy the error text points at, `list_pages` is how you find out you
+ *  are at zero, and `close_page` answers with its own "index 越界（0..-1）"
+ *  rather than this sentence. */
+const ZERO_TAB_SAFE = new Set(["new_page", "list_pages", "close_page"]);
 /** What the cdp-legacy fallback can still do (R2: degradation must keep the
  *  §6o behavior; everything snapshot-shaped is playwright-only). */
 export const BROWSER_LEGACY_ACTIONS = [
@@ -648,23 +1293,144 @@ export const BROWSER_LEGACY_ACTIONS = [
 const PW_DEFAULT_TIMEOUT_MS = 3000;
 const OBSERVE_BUFFER_CAP = 200;
 const HARDENED_UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36";
+// The browser's OWN site-permission bubble ("…想要 访问此设备上的其他应用和服务",
+// 阻止/允许) is not our ctx.ask channel, so nothing in perm-ask or the approval
+// gate can bound it: measured on npmjs.com, an unanswered bubble held
+// `page.goto` past its 45 s timeout without even reaching domcontentloaded, and
+// a server-side session has nobody to click. Denying at launch is the safe
+// direction and the ONLY one this toolset takes — there is deliberately no
+// auto-allow counterpart (no `permissions:` in the context options either),
+// because a browser that grants a site device access on the plugin's say-so
+// would be the self-allowing the rest of this codebase refuses to do.
+export const BROWSER_DENY_PERMISSIONS_ARG = "--deny-permission-prompts";
 const SPAWN_TIMEOUT_MS = 15_000;
 const NAVIGATE_EVENT_TIMEOUT_MS = 15_000;
+export function callerOf(ctx) {
+    const c = (ctx ?? {});
+    return { owner: String(c.sessionID ?? "").trim(), agent: String(c.agent ?? "").trim() };
+}
 export function buildTmBrowserTool(deps) {
     const { pipelines } = deps;
     const env = deps.env ?? process.env;
     const notify = typeof deps.notify === "function" ? deps.notify : undefined;
     const tool = "tm_browser";
     const traj = (e) => pipelines.store.appendTrajectory({ tool, ...e });
-    let session = null;
+    // The orphan ledger lives beside the run store (per workspace since the
+    // tmpdir sharding), so a crash in one project can never reap another's
+    // browser — and a test run, which gets its own store dir, never reaches a
+    // real one either.
+    const ledgerFile = (() => {
+        const root = pipelines.store?.blackboardRoot;
+        // No store root (a test double, or a host that never gave us one) means no
+        // ledger — and then nothing is recorded and nothing is reaped. It must not
+        // throw on the way to opening a browser.
+        return typeof root === "string" && root ? browserLedgerFile(root) : "";
+    })();
+    const recordBrowser = (pid, engine, exe) => {
+        if (!ledgerFile || !Number.isFinite(pid) || pid <= 0)
+            return;
+        appendBrowserLedger(ledgerFile, { pid, ownerPid: process.pid, engine, at: Date.now(), exe });
+    };
+    if (ledgerFile && String(env.TM_BROWSER_REAP ?? "on").trim().toLowerCase() !== "off") {
+        const r = reapOrphanBrowsers(ledgerFile);
+        if (r.reaped.length)
+            traj({ step_id: "browser", event: "orphans_reaped", count: r.reaped.length, pids: r.reaped.join(",") });
+    }
+    /** Live browser leases by id — ONE browser per caller (see BrowserLease). */
+    const leases = new Map();
+    let leaseSeq = 0;
+    const liveLeases = () => [...leases.values()];
+    const ownedBy = (owner) => liveLeases().filter((l) => l.owner === owner);
+    const leaseTable = () => liveLeases()
+        .map((l) => `${l.id} · ${l.agent || "未知角色"} · ${String(l.session.currentUrl || "").slice(0, 80) || "空白页"}`)
+        .join("\n  ");
+    /** Idle-reaper timers, one per lease: a forgotten window belongs to its
+     *  owner, so B's activity must not keep A's browser alive (or reap it). */
+    const idleTimers = new Map();
+    function clearIdle(id) {
+        const t = idleTimers.get(id);
+        if (t)
+            clearTimeout(t);
+        idleTimers.delete(id);
+    }
+    /** Drop the lease whose session died on its own (a cdp-legacy child exiting,
+     *  a browser the user closed) so a corpse is never handed back out. */
+    const dropSession = (sess) => {
+        for (const [id, l] of leases) {
+            if (l.session === sess) {
+                leases.delete(id);
+                clearIdle(id);
+            }
+        }
+    };
     // m2 (fix round): SAME seed policy as tm_webfetch / tm_search — the
     // built-in default list gains the T4 engine home hosts (api.stackexchange
     // .com, hn.algolia.com) so jump-reading a search hit stops re-popping the
     // dialog; a narrowed TM_WEBFETCH_ALLOWED_DOMAINS is never widened.
     const allowlist = seedWebfetchDomains(deps.cfg.webfetchAllowedDomains ?? ["*"]);
-    // hosts approved through the OFFICIAL dialog this plugin lifetime — the
-    // network layer (both engines) consults this in addition to the static allowlist
-    const approvedHosts = new Set();
+    /** Hosts approved through the OFFICIAL dialog, keyed by the CALLER's session.
+     *  It used to be one process-wide set, which meant a host the lead approved
+     *  became a silent pass for the researcher's browser too — consent given to
+     *  one agent is not a pass for another.  The network layer (both engines)
+     *  consults the caller's set in addition to the static allowlist. */
+    const approvedBy = new Map();
+    const approvedFor = (owner) => {
+        let s = approvedBy.get(owner);
+        if (!s) {
+            s = new Set();
+            approvedBy.set(owner, s);
+        }
+        return s;
+    };
+    /** Which browser an action may drive.
+     *
+     *  The id is REQUIRED as soon as it could mean more than one thing: with a
+     *  single live browser that belongs to the caller, omitting it is unambiguous
+     *  and allowed (and every reply echoes the id back); the moment a second
+     *  agent opens one, every call must name its own.  An id belonging to somebody
+     *  else is refused WITH the owner named, because `b1` is guessable and the
+     *  whole point is that guessing must not work. */
+    function resolveLease(args, caller) {
+        const want = String(args.id ?? "").trim();
+        const all = liveLeases();
+        const mine = ownedBy(caller.owner);
+        if (want) {
+            const hit = all.find((l) => l.id === want);
+            if (!hit) {
+                return {
+                    error: all.length
+                        ? `没有 id 为 "${want}" 的浏览器。活着的：\n  ${leaseTable()}`
+                        : `没有 id 为 "${want}" 的浏览器——现在一个都没开，先用 action:"open"。`,
+                };
+            }
+            if (hit.owner !== caller.owner) {
+                return {
+                    error: `${hit.id} 是 ${hit.agent || "另一个会话"} 的浏览器，不是你的——两个 agent 共用一个窗口会互相踩当前标签和 uid 编号，` +
+                        `而你看到的每一次"成功"都可能是对方的页面。` +
+                        (mine.length
+                            ? `你自己的是 ${mine.map((l) => l.id).join(" / ")}。`
+                            : `你还没有浏览器：用 action:"open" 开一个，它会给你自己的 id。`),
+                };
+            }
+            hit.lastActivity = Date.now();
+            return { lease: hit };
+        }
+        if (all.length === 1 && mine.length === 1) {
+            mine[0].lastActivity = Date.now();
+            return { lease: mine[0] };
+        }
+        if (!mine.length) {
+            return {
+                error: all.length
+                    ? `你还没有浏览器（活着的：\n  ${leaseTable()}）——先用 action:"open" 开一个，之后带上它给你的 id。`
+                    : '没有打开的浏览器会话——先用 action:"open"',
+            };
+        }
+        return {
+            error: `现在有 ${all.length} 个浏览器在跑，动作必须写明 id（你自己的：${mine.map((l) => l.id).join(" / ")}）——` +
+                `省略 id 只在"全场只有一个、且是你的"时才安全。\n  ${leaseTable()}`,
+        };
+    }
     const snapshotBudget = Math.max(10, Number(deps.cfg?.browserSnapshotMaxTokens) || 1200);
     const subPolicy = deps.cfg?.browserSubresource ?? "same-site";
     const evalAskPolicy = deps.cfg?.browserAskEval ?? "on";
@@ -764,8 +1530,15 @@ export function buildTmBrowserTool(deps) {
     }
     /** One line telling the agent that the page is NOT actually empty — the
      *  subresource gate dropped N requests.  Without this the model reads a
-     *  blank-looking page and reports "该网站没有图片". */
-    function blockedNote(sess) {
+     *  blank-looking page and reports "该网站没有图片".
+     *
+     *  `thin` means the page ALSO came back with nothing addressable, which
+     *  changes the sentence from a footnote into the diagnosis: on baike the
+     *  blocked request was the site's own bundle, so 0 nodes and "no content"
+     *  were our doing.  An agent that is told the causality has two real moves
+     *  (allow_host, or the env seed + restart); one that is not, reports the
+     *  site as empty. */
+    function blockedNote(sess, thin = false) {
         if (!sess.blocked.count)
             return "";
         const n = sess.blocked.count;
@@ -775,9 +1548,28 @@ export function buildTmBrowserTool(deps) {
         // drain (and the note would never appear again for the session).
         sess.blocked.count = 0;
         sess.blocked.hosts.clear();
-        traj({ step_id: "browser", event: "blocked", count: n, hosts: hosts.slice(0, 20).join(",") });
-        return (`\n注意：本页有 ${n} 个子资源请求被治理白名单拦截（${hosts.slice(0, 6).join(", ")}${hosts.length > 6 ? ` …+${hosts.length - 6}` : ""}）——不是站点没有内容。` +
-            `当前策略 TM_BROWSER_SUBRESOURCE=${subPolicy}；同域资源已自动放行，跨域脚本仍需白名单或弹窗批准。`);
+        traj({ step_id: "browser", event: "blocked", count: n, hosts: hosts.slice(0, 20).join(","), thin });
+        const list = `${hosts.slice(0, 6).join(", ")}${hosts.length > 6 ? ` …+${hosts.length - 6}` : ""}`;
+        const base = `\n注意：本页有 ${n} 个子资源请求被治理白名单拦截（${list}）——不是站点没有内容。` +
+            `当前策略 TM_BROWSER_SUBRESOURCE=${subPolicy}；同域资源已自动放行，跨域脚本仍需白名单或弹窗批准。`;
+        if (!thin)
+            return base;
+        return (base +
+            `这一页的可寻址内容为 0，而被拦的正是页面自己的脚本域名——空白是我们的门禁造成的，不是页面没有内容。` +
+            `两条出路：action:"allow_host" {host:"${hosts[0] ?? "被拦域名"}"} 由我拿官方确认窗去问用户（只放行这个域名、只对你这个浏览器、本次会话），` +
+            `或请用户把域名加进 TM_WEBFETCH_ALLOWED_DOMAINS 后重启 OpenCode。批准后要重新 navigate 一次——门禁在请求时判定，已加载的页面不会自己补回来。` +
+            `在拿到真实内容之前不要把这一页当成"网站没有内容"汇报。`);
+    }
+    /** A thin page may be a wall rather than an empty site.  Say which, because
+     *  the next move is the opposite: retry an empty page, never a captcha. */
+    function wallNote(...texts) {
+        const wall = challengeWallOf(...texts);
+        if (!wall)
+            return "";
+        traj({ step_id: "browser", event: "challenge_wall", sign: wall });
+        return (`\n这一页不是"没有内容"，它是一张${wall}墙——站点要求真人完成验证，自动化通道到此为止。` +
+            `不要重试这一页来"等它加载完"，也不要把"该站点无内容"写进结论：换来源（tm_search 的其它引擎 / 别的站点），` +
+            `或者告诉用户需要他本人在这个窗口里完成一次验证后再继续。`);
     }
     function pageTextOutput(url, text) {
         return `页面文本（${url}）：\n${text.slice(0, 20000)}${text.length > 20000 ? "\n…(截断)" : ""}`;
@@ -821,7 +1613,7 @@ export function buildTmBrowserTool(deps) {
      * under EVERY subresource policy: they are not consentable, so a passive
      * image or a same-site script can never relax them.
      */
-    function gateDecide(st, url, resourceType) {
+    function gateDecide(st, url, resourceType, approvedHosts) {
         const verdict = checkWebUrl(url, allowlist);
         if (!verdict.ok && !verdict.askable)
             return { pass: false, via: "red-line" };
@@ -858,11 +1650,18 @@ export function buildTmBrowserTool(deps) {
         // and flush as ONE line (blockedNote / close).
         return v;
     }
-    async function openLegacySession(headless) {
+    async function openLegacySession(headless, approvedHosts) {
         const executable = discover(env);
         if (!executable)
             throw discoveryError();
-        const profileDir = fs.mkdtempSync(path.join(os.tmpdir(), "tm-browser-"));
+        // The SAME knob on BOTH engines.  This used to be temp-only, so a session
+        // that degraded to cdp-legacy kept its logins nowhere while the reply still
+        // read the env and announced 持久登录配置.
+        const profile = classifyProfileDir(env);
+        if (profile.refusal)
+            throw new Error(profile.refusal);
+        const persistent = profile.dir !== null;
+        const profileDir = persistent ? profile.dir : fs.mkdtempSync(path.join(os.tmpdir(), "tm-browser-"));
         const child = spawn(executable, [
             headless ? "--headless=new" : "--start-maximized",
             "--remote-debugging-pipe",
@@ -873,6 +1672,7 @@ export function buildTmBrowserTool(deps) {
             "--accept-lang=zh-CN,zh;q=0.9,en;q=0.8",
             "--no-first-run", "--no-default-browser-check", "--disable-extensions",
             "--disable-background-networking", "--mute-audio",
+            BROWSER_DENY_PERMISSIONS_ARG,
             "about:blank",
         ], { stdio: ["ignore", "ignore", "ignore", "pipe", "pipe"], windowsHide: true });
         const cdp = new PipeCdp(child);
@@ -909,7 +1709,7 @@ export function buildTmBrowserTool(deps) {
             const requestId = String(m.params.requestId ?? "");
             const p = m.params.request ?? {};
             const url = String(p.url ?? "");
-            const { pass } = gateDecide({ allowedSites, blocked }, url, p.resourceType);
+            const { pass } = gateDecide({ allowedSites, blocked }, url, p.resourceType, approvedHosts);
             if (pass) {
                 void cdp.call("Fetch.continueRequest", { requestId }, sessionId, 5000).catch(() => { });
             }
@@ -917,14 +1717,18 @@ export function buildTmBrowserTool(deps) {
                 void cdp.call("Fetch.failRequest", { requestId, errorReason: "BlockedByClient" }, sessionId, 5000).catch(() => { });
             }
         });
+        recordBrowser(Number(child.pid ?? 0), "cdp-legacy", executable);
         const sess = {
             kind: "cdp-legacy",
             currentUrl: "about:blank",
             headless,
+            persistentProfile: persistent ? profileDir : null,
             label: `cdp-legacy · ${path.basename(executable)} · pid ${child.pid ?? "?"}`,
             attachments: [],
             blocked,
             allowedSites,
+            // the CDP child still running IS the browser being alive on this engine
+            alive: () => child.exitCode === null,
             async act(action, args, stepId) {
                 if (action === "navigate" || action === "navigate_page") {
                     const url = String(args.url ?? "").trim();
@@ -939,7 +1743,17 @@ export function buildTmBrowserTool(deps) {
                     const ev = await cdp.call("Runtime.evaluate", { expression: "document.body ? document.body.innerText : ''", returnByValue: true }, sessionId);
                     const text = String(ev.result?.value ?? "");
                     traj({ step_id: stepId, event: "result", tokens: Math.ceil(text.length / 4) });
-                    return `${pageTextOutput(sess.currentUrl, text)}${blockedNote(sess)}`;
+                    // Same diagnosis as the playwright leg — the two engines must not
+                    // drift on what a blank page is allowed to be called.
+                    const thin = text.replace(/\s+/g, "").length < 80;
+                    let title = "";
+                    if (thin) {
+                        const t = await cdp
+                            .call("Runtime.evaluate", { expression: "document.title", returnByValue: true }, sessionId)
+                            .catch(() => null);
+                        title = String(t?.result?.value ?? "");
+                    }
+                    return `${pageTextOutput(sess.currentUrl, text)}${wallNote(title, text)}${blockedNote(sess, thin)}`;
                 }
                 if (action === "screenshot" || action === "take_screenshot") {
                     traj({ step_id: stepId, event: "call", kind: "screenshot", url: sess.currentUrl.slice(0, 200) });
@@ -962,9 +1776,17 @@ export function buildTmBrowserTool(deps) {
                     if (!src)
                         throw new Error('缺少 expression/function 参数（evaluate_script 需要一个 JS 表达式）');
                     traj({ step_id: stepId, event: "call", kind: "evaluate" });
-                    const ev = await cdp.call("Runtime.evaluate", { expression: src, returnByValue: true }, sessionId);
-                    const value = ev.result?.value;
-                    return capTokens(`执行结果：${JSON.stringify(value ?? null)}`, "…(结果超长已截断)");
+                    const ev = await cdp.call("Runtime.evaluate", { expression: evalExpression(src), returnByValue: true, awaitPromise: true }, sessionId);
+                    // A page-side throw used to render as "执行结果：null", which is how an
+                    // agent spends six rounds wondering whether the selector was wrong.
+                    const det = ev?.exceptionDetails;
+                    if (det) {
+                        const first = String(det.exception?.description ?? det.text ?? JSON.stringify(det))
+                            .split("\n")[0]
+                            .slice(0, 300);
+                        throw new Error(`页面内抛出异常（不是"没找到"）：${first}`);
+                    }
+                    return capTokens(renderEvalResult(ev.result?.value), "…(结果超长已截断)");
                 }
                 throw new Error(`action "${action}" 需要 playwright 引擎（当前为 cdp-legacy 降级：playwright-core 未安装或 node<20）。` +
                     `cdp-legacy 可用: ${BROWSER_LEGACY_ACTIONS.filter((a) => a !== "open" && a !== "close").join(" | ")}`);
@@ -987,24 +1809,33 @@ export function buildTmBrowserTool(deps) {
                     });
                 });
                 const dead = child.exitCode !== null;
-                try {
-                    rmForceSafe(profileDir, { recursive: true });
-                }
-                catch {
-                    /* a locked leftover temp dir is reclaimed by the OS — never fail close */
+                // Only a directory WE created is ours to remove. Deleting a user-named
+                // persistent profile on close would destroy the logins the knob exists
+                // to keep.
+                if (!persistent) {
+                    try {
+                        rmForceSafe(profileDir, { recursive: true });
+                    }
+                    catch {
+                        /* a locked leftover temp dir is reclaimed by the OS — never fail close */
+                    }
                 }
                 return dead
-                    ? { closed: true, text: "浏览器进程已退出（cdp-legacy），临时配置目录已清理。" }
+                    ? {
+                        closed: true,
+                        text: persistent
+                            ? `浏览器进程已退出（cdp-legacy）；持久配置目录已保留（下次 open 复用登录态）：${profileDir}。`
+                            : "浏览器进程已退出（cdp-legacy），临时配置目录已清理。",
+                    }
                     : {
                         closed: false,
                         text: `警告：cdp-legacy 子进程 pid ${child.pid ?? "?"} 未在 3s 内退出，窗口可能仍在前台——` +
-                            `请手动关闭该浏览器窗口（临时目录 ${profileDir}）。`,
+                            `请手动关闭该浏览器窗口（配置目录 ${profileDir}${persistent ? "，持久目录我不会删" : "，临时目录"}）。`,
                     };
             },
         };
         const onExit = () => {
-            if (session === sess)
-                session = null;
+            dropSession(sess);
             // best-effort: the profile may still be file-locked during shutdown —
             // a leftover temp dir is reclaimed by the OS, never an error for the task
             try {
@@ -1018,13 +1849,14 @@ export function buildTmBrowserTool(deps) {
         return sess;
     }
     // ================= playwright engine (primary) ==============================
-    async function openPlaywrightSession(pw, headless) {
+    async function openPlaywrightSession(pw, headless, approvedHosts) {
         const executable = discover(env);
         if (!executable)
             throw discoveryError();
         const launchArgs = [
             "--no-first-run", "--no-default-browser-check", "--disable-extensions",
             "--disable-background-networking", "--mute-audio",
+            BROWSER_DENY_PERMISSIONS_ARG,
             ...(headless ? [] : ["--start-maximized"]),
         ];
         const contextOpts = {
@@ -1036,7 +1868,10 @@ export function buildTmBrowserTool(deps) {
             // headful: honor --start-maximized (null viewport = the OS window size)
             viewport: headless ? undefined : null,
         };
-        const persistentDir = String(env.TM_BROWSER_USER_DATA_DIR ?? "").trim();
+        const profile = classifyProfileDir(env);
+        if (profile.refusal)
+            throw new Error(profile.refusal);
+        const persistentDir = profile.dir ?? "";
         // R2 (revised 2026-09-18): playwright's `channel` resolves the executable
         // ITSELF, which silently overrode our discovery (a Beta-default Windows
         // host opened STABLE Edge).  executablePath is now the primary launch and
@@ -1070,6 +1905,32 @@ export function buildTmBrowserTool(deps) {
             context = await browser.newContext(contextOpts);
         }
         const snapIndex = new SnapshotIndex();
+        // The OS process behind the connection. playwright exposes it as
+        // browser.process(); on the persistent path the browser is reached through
+        // the context. Without a pid there is no way to tell "the CDP connection
+        // dropped" apart from "the browser is gone" — and they are NOT the same
+        // thing (measured: close printed 已确认关闭 while the msedge tree was still
+        // alive under OpenCode.exe).
+        const owningBrowser = browser ??
+            (() => {
+                try {
+                    return context.browser?.() ?? null;
+                }
+                catch {
+                    return null;
+                }
+            })();
+        const { pid: browserPid, via: pidRoute, failures: pidFailures } = await resolveLaunchPid({
+            // playwright's own accessor first — it does not exist on 1.63, so the OS
+            // scan is what answers today.  Which route replied is AUDITED: a silent
+            // fall-back to 0 would put us straight back to printing 已确认关闭 about a
+            // process nobody looked at.
+            playwrightPid: () => Number(owningBrowser?.process?.()?.pid ?? 0) || 0,
+            executablePath: target.executablePath ?? executable,
+            rows: () => (deps.listChildren ? deps.listChildren(process.pid) : undefined),
+        });
+        traj({ step_id: "browser", event: "launch_pid", via: pidRoute, pid: browserPid, tries: pidFailures });
+        recordBrowser(browserPid, persistentDir ? "playwright-persistent" : "playwright", executable);
         const state = {
             page: context.pages()[0] ?? (await context.newPage()),
             dialogs: [],
@@ -1130,7 +1991,7 @@ export function buildTmBrowserTool(deps) {
                 await route.continue().catch(() => { });
                 return;
             }
-            const { pass } = gateDecide(state, u, request.resourceType?.());
+            const { pass } = gateDecide(state, u, request.resourceType?.(), approvedHosts);
             if (pass) {
                 await route.continue().catch(() => { });
             }
@@ -1185,11 +2046,26 @@ export function buildTmBrowserTool(deps) {
             kind: "playwright",
             currentUrl: "about:blank",
             headless,
+            persistentProfile: persistentDir || null,
             label: `playwright/${via} · ${path.basename(executable)} · ${headless ? "headless" : "headful"}`,
             attachments: [],
             blocked: state.blocked,
             allowedSites: state.allowedSites,
+            // The browser object is the truth about liveness; a closed TAB is not it.
+            alive: () => owningBrowser?.isConnected?.() !== false,
             async act(action, args, stepId) {
+                // A context with zero pages is ALIVE — it simply has no tab. Addressing
+                // the tab close_page removed threw "Target page, context or browser has
+                // been closed", which the recovery in execute() reads as a dead BROWSER:
+                // the lease was dropped, `close` then reported "no browser open", and the
+                // user kept a window nothing was claiming any more (measured live,
+                // 1-6-0-click.json step 11 — right after our own reply promised
+                // "浏览器仍在运行"). An empty window gets its own honest answer here and
+                // keeps its lease.
+                if (!ZERO_TAB_SAFE.has(action) && context.pages().length === 0) {
+                    throw new Error("这个浏览器已经没有标签页了（0 个，窗口和进程都还在，你的租约我没有丢）。" +
+                        '要继续用 new_page 在同一个窗口开一个标签；要结束整个会话用 action:"close"（它会验进程真的退出）。');
+                }
                 if (action === "navigate" || action === "navigate_page") {
                     const url = String(args.url ?? "").trim();
                     // the navigation itself already cleared the allowlist (execute()
@@ -1205,7 +2081,9 @@ export function buildTmBrowserTool(deps) {
                     traj({ step_id: stepId, event: "call", url: sess.currentUrl.slice(0, 200) });
                     const text = String((await state.page.evaluate("document.body ? document.body.innerText : ''")) ?? "");
                     traj({ step_id: stepId, event: "result", tokens: Math.ceil(text.length / 4) });
-                    return `${pageTextOutput(sess.currentUrl, text)}${blockedNote(sess)}`;
+                    const thin = text.replace(/\s+/g, "").length < 80;
+                    const title = thin ? await readTitle(state.page) : "";
+                    return `${pageTextOutput(sess.currentUrl, text)}${wallNote(title, text)}${blockedNote(sess, thin)}`;
                 }
                 if (action === "screenshot" || action === "take_screenshot") {
                     traj({ step_id: stepId, event: "call", kind: "screenshot", url: sess.currentUrl.slice(0, 200) });
@@ -1220,18 +2098,62 @@ export function buildTmBrowserTool(deps) {
                         yaml = await state.page.locator("body").ariaSnapshot();
                     }
                     catch (e) {
-                        throw new Error(`ariaSnapshot 不可用：${e.message} —— locator.ariaSnapshot 需要 playwright-core ≥1.49（本包 optionalDependencies 锁 1.63）；未安装或过旧会走 cdp-legacy 降级，那边没有快照动作。`);
+                        const m = String(e?.message ?? e);
+                        // Only talk about VERSIONS when the accessor itself is missing. It
+                        // threw "…has been closed" live and blamed playwright-core 1.63 for
+                        // it, which sent the agent off to check dependencies instead of
+                        // looking at the page — a wrong diagnosis costs more than none.
+                        throw new Error(/not a function|is not defined|unsupported|no method/i.test(m)
+                            ? `ariaSnapshot 不可用：${m} —— locator.ariaSnapshot 需要 playwright-core ≥1.49（本包 optionalDependencies 锁 1.63）；未安装或过旧会走 cdp-legacy 降级，那边没有快照动作。`
+                            : `快照读取失败：${m.slice(0, 300)}`);
                     }
                     const annotated = snapIndex.annotate(yaml);
                     traj({ step_id: stepId, event: "result", tokens: estimateTokens(annotated), nodes: snapIndex.size });
                     const body = capTokens(annotated, `…(快照超过 browserSnapshotMaxTokens=${snapshotBudget}，后续行已截断——用 read 拿原文或先滚动再快照)`);
                     const hint = state.dialogs.length ? `\n注意：有 ${state.dialogs.length} 个未处理对话框——先 handle_dialog` : "";
-                    return `ARIA 快照（${sess.currentUrl} · ${snapIndex.size} 个可寻址节点）——后续动作按行内 [uid=eN] 寻址：\n${body}${hint}${blockedNote(sess)}`;
+                    // A snapshot with nothing addressable is the one case worth spending
+                    // a title read on: it is either our gate, or the site asking for a
+                    // human, and the agent has to be told which — "0 个可寻址节点" alone
+                    // reads as "this site is empty".
+                    const thin = snapIndex.size === 0;
+                    const wall = thin ? wallNote(await readTitle(state.page), yaml) : "";
+                    return `ARIA 快照（${sess.currentUrl} · ${snapIndex.size} 个可寻址节点）——后续动作按行内 [uid=eN] 寻址：\n${body}${hint}${wall}${blockedNote(sess, thin)}`;
                 }
                 if (action === "click") {
                     const loc = targetOf("uid", "selector", args);
+                    const target = describeTarget(args);
+                    const before = await probeClickTarget(loc);
                     await loc.click();
-                    return `已点击 ${describeTarget(args)}${state.dialogs.length ? "；有未处理对话框——handle_dialog（同轮观察，勿另起动作）" : ""}`;
+                    const dialogOpen = state.dialogs.length > 0;
+                    let seen = before ? await observeClickEffect(loc, state.page, before) : { changed: [], after: null };
+                    let retried = false;
+                    // A delivered click that changed NOTHING is the SPA hazard this
+                    // verification exists for.  Retrying is safe precisely BECAUSE nothing
+                    // changed — a toggle that worked is never clicked twice — and a dialog
+                    // is open means the click did land, so it is never retried.
+                    if (before && !seen.changed.length && !dialogOpen) {
+                        await settlePage(state.page);
+                        const again = await probeClickTarget(loc);
+                        await loc.click().catch(() => { });
+                        retried = true;
+                        seen = await observeClickEffect(loc, state.page, again ?? before);
+                    }
+                    traj({
+                        step_id: stepId,
+                        event: "click_verified",
+                        effective: seen.changed.length > 0,
+                        retried,
+                        probed: Boolean(before),
+                        ready: String(before?.ready ?? ""),
+                    });
+                    return clickVerdict(target, before, seen.changed, {
+                        retried,
+                        dialog: state.dialogs.length > 0,
+                        // The gate's own ledger rides along: "nothing changed" on a page
+                        // whose scripts were trimmed needs a different next move than a page
+                        // that is still loading.
+                        blocked: { count: state.blocked.count, hosts: [...state.blocked.hosts].slice(0, 5) },
+                    });
                 }
                 if (action === "fill") {
                     const loc = targetOf("uid", "selector", args);
@@ -1277,17 +2199,24 @@ export function buildTmBrowserTool(deps) {
                     const what = uid ? `uid "${uid}"` : text ? `文本 "${text.slice(0, 80)}"` : "";
                     if (!uid && !text)
                         throw new Error('wait_for 需要 text 或 uid');
-                    const loc = uid ? targetOf("uid", "selector", { uid }) : state.page.getByText(text);
+                    const base = uid ? targetOf("uid", "selector", { uid }) : state.page.getByText(text);
+                    // A visible label matches several nodes on a real page, and playwright's
+                    // STRICT mode answers that by throwing its whole internal report at the
+                    // agent — measured live, where `wait_for` was the very recovery step our
+                    // own click message had just recommended. So: wait for the first match
+                    // and SAY that there were several, instead of blocking the way out.
+                    const hits = typeof base.count === "function" ? Number(await base.count().catch(() => 1)) || 1 : 1;
+                    const loc = hits > 1 && typeof base.first === "function" ? base.first() : base;
                     await loc.waitFor({ state: "visible", timeout });
-                    return `等待命中：${what}（≤${timeout}ms 内可见）`;
+                    return `等待命中：${what}（≤${timeout}ms 内可见）${hits > 1 ? `\n（这个文本命中 ${hits} 个元素，等的是第一个——要精确就改用 uid 寻址）` : ""}`;
                 }
                 if (action === "evaluate_script") {
                     const src = String(args.function ?? args.expression ?? "").trim();
                     if (!src)
                         throw new Error('缺少 expression/function 参数（JS 函数源或表达式）');
                     traj({ step_id: stepId, event: "call", kind: "evaluate" });
-                    const value = await state.page.evaluate(src);
-                    return capTokens(`执行结果：${JSON.stringify(value ?? null)}`, "…(结果超长已截断)");
+                    const value = await state.page.evaluate(evalExpression(src));
+                    return capTokens(renderEvalResult(value), "…(结果超长已截断)");
                 }
                 if (action === "list_pages") {
                     const pages = context.pages();
@@ -1311,6 +2240,52 @@ export function buildTmBrowserTool(deps) {
                     sess.currentUrl = String(state.page.url?.() ?? "");
                     return `已切换到标签页 ${idx}：${sess.currentUrl}`;
                 }
+                if (action === "new_page") {
+                    // Multi-tab is an operator need, not a nicety: comparing two pages,
+                    // or reading a doc while keeping the first open, was impossible
+                    // because `open` on a live session only navigates the CURRENT tab.
+                    const p = await context.newPage();
+                    state.page = p;
+                    attach(p);
+                    const url = String(args.url ?? "").trim();
+                    const index = context.pages().indexOf(p);
+                    if (!url) {
+                        sess.currentUrl = String(p.url?.() ?? "about:blank");
+                        traj({ step_id: stepId, event: "call", kind: "new_page", url: "" });
+                        return `已新建空白标签页 ${index}（共 ${context.pages().length} 个，当前在它上面）：${sess.currentUrl || "about:blank"}\n后续动作按 [uid] 寻址前请先 take_snapshot；切回去用 select_page { index }。`;
+                    }
+                    // The URL cleared the allowlist at the execute layer (that is where
+                    // the official dialog lives), exactly like navigate_page does.
+                    rememberSite(state.allowedSites, url);
+                    traj({ step_id: stepId, event: "call", kind: "new_page", url: url.slice(0, 200) });
+                    await p.goto(url, { waitUntil: "domcontentloaded", timeout: 20_000 });
+                    sess.currentUrl = p.url?.() || url;
+                    rememberSite(state.allowedSites, sess.currentUrl);
+                    return `已新建标签页 ${index} 并导航（共 ${context.pages().length} 个，当前在它上面）：${url}${blockedNote(sess)}`;
+                }
+                if (action === "close_page") {
+                    const pages = context.pages();
+                    const raw = args.index;
+                    const idx = raw === undefined || raw === "" ? pages.indexOf(state.page) : Number(raw);
+                    if (!Number.isInteger(idx) || idx < 0 || idx >= pages.length) {
+                        throw new Error(`index 越界（0..${pages.length - 1}）——先 list_pages`);
+                    }
+                    const victim = pages[idx];
+                    await Promise.resolve(victim.close?.()).catch(() => { });
+                    const rest = context.pages();
+                    const closedIndex = idx;
+                    if (!rest.length) {
+                        state.page = victim;
+                        sess.currentUrl = "";
+                        return `标签页 ${closedIndex} 已关闭，这是最后一个——浏览器仍在运行。` +
+                            `要结束整个会话用 action:"close"（它会验进程真的退出）；要继续就用 new_page 再开一个。`;
+                    }
+                    state.page = rest.includes(state.page) ? state.page : rest[rest.length - 1];
+                    attach(state.page);
+                    const nextIdx = rest.indexOf(state.page);
+                    sess.currentUrl = String(state.page.url?.() ?? "");
+                    return `标签页 ${closedIndex} 已关闭，剩 ${rest.length} 个，当前在 ${nextIdx}：${sess.currentUrl}`;
+                }
                 if (action === "list_console_messages") {
                     const lines = state.consoleBuf.map((m, i) => `${i + 1}. [${m.type}] ${m.text.slice(0, 300)}`);
                     if (args.clear)
@@ -1355,66 +2330,108 @@ export function buildTmBrowserTool(deps) {
                     alivePages = 0;
                 }
                 const connected = browser ? Boolean(browser.isConnected?.()) : false;
-                const closed = errs.length === 0 && alivePages === 0 && !connected;
+                // The connection is NOT the process. Wait for the pid to actually
+                // disappear; if it refuses, terminate it once and re-check. Only then
+                // may this line say 已确认关闭 — an agent quotes it to the user as
+                // proof the window is gone, and a lingering msedge tree is not gone.
+                const pidWasThere = pidAlive(browserPid);
+                const processGone = browserPid > 0 ? await waitForPidExit(browserPid) : true;
+                const pidNote = browserPid > 0
+                    ? processGone
+                        ? pidWasThere
+                            ? `进程 ${browserPid} 已退出`
+                            : `进程 ${browserPid} 早已不在`
+                        : `进程 ${browserPid} 仍在（已尝试终止但系统未放行）`
+                    : "未取得浏览器 pid，进程未核验";
+                // The pid check is what makes the word 确认 mean anything.  An
+                // unverifiable close must not borrow the verified sentence, because an
+                // agent quotes this line to the user as proof the window is gone.
+                const verified = browserPid > 0 && processGone;
+                const closed = errs.length === 0 && alivePages === 0 && !connected && processGone;
                 const profile = persistentDir
                     ? `持久配置目录已保留（下次 open 复用登录态）：${persistentDir}`
                     : "临时配置目录由 playwright 自行回收";
-                if (closed)
-                    return { closed: true, text: `浏览器会话已确认关闭（${sess.label}）；${profile}。` };
+                if (closed && verified)
+                    return { closed: true, text: `浏览器会话已确认关闭（${sess.label} · ${pidNote}）；${profile}。` };
+                if (closed) {
+                    return {
+                        closed: false,
+                        text: `连接与窗口已释放，但进程未核验（${sess.label} · ${pidNote}）——这次没拿到浏览器 pid，` +
+                            `所以这句不是"已确认关闭"。若桌面上窗口仍在请手动关闭；反复出现可换 TM_BROWSER_ENGINE=cdp-legacy 试一次。${profile}。`,
+                    };
+                }
                 return {
                     closed: false,
                     text: `警告：关闭未完全成功（${sess.label}${errs.length ? `：${errs.join("; ")}` : ""}）——` +
-                        `残留标签页 ${alivePages} 个${connected ? "，浏览器进程仍处于连接状态" : ""}。` +
-                        `窗口可能仍在前台，需要用户手动关闭。${profile}。`,
+                        `残留标签页 ${alivePages} 个${connected ? "，浏览器进程仍处于连接状态" : ""} · ${pidNote}。` +
+                        // Three states, and the sentence must match the one we are in.  A
+                        // dead pid cannot have a window on the desktop, so telling the user
+                        // to go hunt it sends them after something that is not there — and
+                        // the leftover count is OUR own stale reference (close_page leaves
+                        // state.page on the tab it closed).  No pid at all is a DIFFERENT
+                        // fact: nothing was verified, so the window may genuinely remain.
+                        (browserPid > 0 && processGone
+                            ? `进程已确认不在（pid ${browserPid} 已退出），所以桌面上不该还有它的窗口——那个"残留标签页"是我自己留着的路由引用，不是窗口，你不用去找。${profile}。`
+                            : browserPid > 0
+                                ? `窗口很可能仍在前台（pid ${browserPid} 还在），请用户手动关闭该浏览器窗口。${profile}。`
+                                : `这次没拿到浏览器 pid，进程无法核验——若桌面上窗口仍在请手动关闭。${profile}。`),
                 };
             },
         };
         return sess;
     }
     // ---------- engine-neutral session lifecycle ----------
-    /** Idle reaper.  The pre-v1.5.13 layer had NO cleanup path other than the
-     *  agent remembering to call `close` — and an agent that believes it
-     *  closed the window (issue #3) leaves the user staring at a Chromium
-     *  window nobody owns.  An untouched session now closes itself and tells
-     *  the user it did. */
-    let idleTimer = null;
-    const armIdle = () => {
-        if (idleTimer)
-            clearTimeout(idleTimer);
-        idleTimer = null;
-        if (!idleCloseMs || !session)
+    /** Idle reaper, PER LEASE.  The pre-v1.5.13 layer had NO cleanup path other
+     *  than the agent remembering to call `close` — and an agent that believes it
+     *  closed the window (issue #3) leaves the user staring at a Chromium window
+     *  nobody owns.  With one browser per caller the timer belongs to the lease:
+     *  one agent going quiet must not keep another's window alive, and a reap must
+     *  never touch a browser somebody is still driving. */
+    function armIdle(lease) {
+        clearIdle(lease.id);
+        if (!idleCloseMs)
             return;
-        idleTimer = setTimeout(() => {
-            idleTimer = null;
-            if (!session)
+        const t = setTimeout(() => {
+            idleTimers.delete(lease.id);
+            if (!leases.has(lease.id))
                 return;
-            traj({ step_id: "browser", event: "idle_close", idle_ms: idleCloseMs });
-            void closeActive()
-                .then((r) => notify?.(`tm_browser 空闲 ${Math.round(idleCloseMs / 1000)}s，会话已自动关闭${r.closed ? "（窗口应已消失）" : "——但窗口可能仍需手动关闭"}`))
+            traj({ step_id: "browser", event: "idle_close", idle_ms: idleCloseMs, id: lease.id, agent: lease.agent });
+            void closeLease(lease)
+                .then((r) => notify?.(`tm_browser ${lease.id}（${lease.agent || "agent"} 的浏览器）空闲 ${Math.round(idleCloseMs / 1000)}s，已自动关闭${r.closed ? "（窗口应已消失）" : "——但窗口可能仍需手动关闭"}`))
                 .catch(() => { });
         }, idleCloseMs);
-        idleTimer.unref?.();
-    };
-    async function ensureSession(headless) {
-        if (session)
-            return session;
+        t.unref?.();
+        idleTimers.set(lease.id, t);
+    }
+    /** The caller's browser, launched on first use.  `open` on an existing lease
+     *  navigates that window instead of spawning a second one. */
+    async function ensureLease(headless, caller) {
+        const mine = ownedBy(caller.owner);
+        if (mine.length)
+            return mine[0];
         const sel = await selection();
-        session =
-            sel.kind === "playwright" && sel.pw
-                ? await openPlaywrightSession(sel.pw, headless)
-                : await openLegacySession(headless);
-        return session;
-    }
-    async function closeActive() {
-        const s = session;
-        if (!s)
+        const approved = approvedFor(caller.owner);
+        const session = sel.kind === "playwright" && sel.pw
+            ? await openPlaywrightSession(sel.pw, headless, approved)
+            : await openLegacySession(headless, approved);
+        const lease = {
+            id: `b${++leaseSeq}`,
+            owner: caller.owner,
+            agent: caller.agent,
+            session,
+            at: Date.now(),
+            lastActivity: Date.now(),
+        };
+        leases.set(lease.id, lease);
+        traj({ step_id: "browser", event: "lease", id: lease.id, agent: lease.agent, live: leases.size });
+        return lease;
+    }
+    async function closeLease(lease) {
+        if (!lease)
             return { text: "没有打开的浏览器会话。", closed: true };
-        session = null;
-        if (idleTimer) {
-            clearTimeout(idleTimer);
-            idleTimer = null;
-        }
-        return s.close();
+        leases.delete(lease.id);
+        clearIdle(lease.id);
+        return lease.session.close();
     }
     /** Move any screenshot pixels act() produced out of the session and onto
      *  the ToolResult.  Drained per call so a stale attachment can never ride
@@ -1428,85 +2445,203 @@ export function buildTmBrowserTool(deps) {
         const base = typeof res === "string" ? { output: res } : res;
         return { ...base, attachments: atts };
     }
-    const ALL_ACTIONS = new Set([...BROWSER_PLAYWRIGHT_ACTIONS, ...BROWSER_COMPAT_ACTIONS, "navigate_page"]);
+    const ALL_ACTIONS = new Set(ALL_BROWSER_ACTIONS);
+    // The menu IS the table the gate below reads.  A hand-written copy drifted the
+    // day `new_page` landed: an agent that mistyped a verb was shown a list that
+    // did not contain the capability it wanted.
+    const ACTION_MENU = BROWSER_ACTION_MENU;
     const execute = async (rawArgs, ctx) => {
+        // Set once a lease is resolved, so the catch below knows WHICH browser died
+        // — with one browser per caller, dropping the wrong lease would kill an
+        // agent that was working fine.
+        let activeLease = null;
         try {
             const args = rawArgs ?? {};
             const action = String(args.action ?? "").trim();
             const url = String(args.url ?? "").trim();
+            // Whose browser this is.  The host hands every tool ctx a sessionID, and
+            // a lease is keyed by it; without one (an older host, a test harness) all
+            // callers share the single anonymous bucket, which is the old behaviour.
+            const caller = callerOf(ctx);
+            // The profile knob is checked BEFORE any engine runs: a refused value must
+            // not spawn a browser that then discovers the problem.
+            {
+                const probe = classifyProfileDir(env);
+                if (probe.refusal)
+                    return toToolResult(tmError(tool, "args", probe.refusal));
+            }
+            // Set when this call proceeded on a DIALOG approval rather than the
+            // static allowlist; appended to whichever reply the action returns.
+            let grantNote = "";
             // allowlist FIRST — an out-of-allowlist URL only proceeds after the
             // OFFICIAL dialog approves it (then the host passes the network layer
             // too); hard red lines (scheme / env-file) reject with no dialog.
             // NOTE: this gate runs BEFORE engine selection — a blocked target
             // never touches playwright nor spawns anything (§6o invariant).
-            if ((action === "open" || action === "navigate" || action === "navigate_page") && url) {
+            // new_page carries a URL too — it must clear the SAME allowlist gate, or
+            // "open a second tab" becomes a way around the official dialog.
+            if ((action === "open" || action === "navigate" || action === "navigate_page" || action === "new_page") && url) {
                 const verdict = checkWebUrl(url, allowlist);
                 if (!verdict.ok) {
                     if (!verdict.askable || !verdict.url) {
                         return toToolResult(tmError(tool, "permission", verdict.message));
                     }
-                    const outcome = await askUserForTarget(ctx, {
+                    const res = await askUserForTargetDetailed(ctx, {
                         permission: tool,
                         patterns: [verdict.url.toString()],
                         metadata: { tool, url: url.slice(0, 200) },
                     });
-                    if (outcome !== "approved") {
-                        return toToolResult(tmError(tool, "permission", verdict.message +
-                            (outcome === "rejected" ? "。用户未批准。" : "。宿主无法弹出确认窗口（旧版协议）。")));
+                    if (res.outcome !== "approved") {
+                        return toToolResult(tmError(tool, "permission", verdict.message + " " + askRefusalNote(res.outcome)));
                     }
-                    approvedHosts.add(verdict.url.hostname);
+                    approvedFor(caller.owner).add(verdict.url.hostname);
+                    // The approval is recorded in the REPLY, not only the trajectory: an
+                    // agent that cannot tell a saved "always" from a fresh click reports
+                    // "no dialog appeared" as evidence about the allowlist — measured live,
+                    // that is exactly what a researcher wrote into its deliverable.
+                    grantNote = askGrantNote(res);
+                    traj({
+                        step_id: "browser",
+                        event: res.autoGranted ? "silent_grant" : "dialog_approved",
+                        host: verdict.url.hostname,
+                        answered_ms: res.answeredInMs,
+                    });
+                }
+            }
+            // The remedy for "our gate blanked this page".  A blocked asset host used
+            // to be a dead end: the only move was an env edit plus a restart, which no
+            // agent can do mid-task, so it reported the site as empty instead.  This
+            // routes the SAME official dialog at ONE host, for ONE owner, for the
+            // length of the session — and it cannot widen anything: a host already on
+            // the static allowlist is refused (asking would train the user to approve
+            // what is already allowed), a red-line host is refused with no dialog, and
+            // the pattern handed to the dialog is the exact hostname, never a glob.
+            if (action === "allow_host") {
+                const host = normalizeApprovalHost(args.host);
+                if (!host) {
+                    return toToolResult(tmError(tool, "args", '缺少或非法的 host 参数——要形如 "bkssl.bdimg.com" 的单个域名（不接受通配、URL、路径或端口）'));
                 }
+                const verdict = checkWebUrl(`https://${host}/`, allowlist);
+                if (verdict.ok) {
+                    return toToolResult(`不用批准：${host} 本来就在静态白名单里，它的子资源不会被拦。这一页的空白另有原因——看 take_snapshot 的拦截说明（被拦的是别的域名）或用 read 拿原文。`);
+                }
+                if (!verdict.askable || !verdict.url) {
+                    return toToolResult(tmError(tool, "permission", `拒绝放行 ${host}：${verdict.message}`));
+                }
+                const outcome = await askUserForTarget(ctx, {
+                    permission: tool,
+                    patterns: [host],
+                    metadata: { tool, host, reason: "被拦的跨域脚本域名，放行后需重新导航" },
+                });
+                if (outcome !== "approved") {
+                    return toToolResult(tmError(tool, "permission", `未放行 ${host}。` + askRefusalNote(outcome)));
+                }
+                approvedFor(caller.owner).add(host);
+                traj({ step_id: "browser", event: "host_approved", host, agent: caller.agent });
+                const mine = ownedBy(caller.owner)[0];
+                return toToolResult(`${mine ? `[${mine.id}] ` : ""}已按用户批准临时放行 ${host}（只对这个浏览器、本次会话，不改任何配置文件）。` +
+                    `现在重新 navigate 一次同一页——门禁在请求时判定，已经加载完的页面不会自己把脚本补回来。`);
             }
             if (action === "open") {
                 if (!url)
                     return toToolResult(tmError(tool, "args", "缺少 url 参数"));
-                if (session) {
+                const existing = ownedBy(caller.owner)[0];
+                if (existing) {
                     // already open: navigate instead of spawning a second browser.
                     // Report the mode the RUNNING instance is actually in — the old
                     // code echoed the REQUESTED mode, so a sticky session could be
                     // described as headful while it was a headless leftover.
-                    const out = await session.act("navigate", { url }, "browser");
-                    armIdle();
-                    return withAttachments(toToolResult(`复用已运行的会话（${session.headless ? "无头" : "有头窗口"} · ${session.label}）。${out}`), session);
+                    // Tracked as the active lease: a browser that dies HERE must be
+                    // dropped too, or the next open hands back the same corpse.
+                    activeLease = existing;
+                    const out = await existing.session.act("navigate", { url }, "browser");
+                    armIdle(existing);
+                    return withAttachments(toToolResult(`[${existing.id}] 复用你自己的浏览器（${existing.session.headless ? "无头" : "有头窗口"} · ${existing.session.label}）。${out}${grantNote}`), existing.session);
                 }
                 // Mode is an OPERATOR decision (TM_BROWSER_HEADLESS), never a model
                 // arg: a model that once passed headless:"false" (string → truthy
                 // under Boolean()) pinned the whole process to headless and every
                 // anti-bot gate in the run failed.
                 const headless = resolveHeadless(env);
-                const s = await ensureSession(headless);
+                const lease = await ensureLease(headless, caller);
+                activeLease = lease;
+                const s = lease.session;
                 const out = await s.act("navigate", { url }, "browser");
-                traj({ step_id: "browser", event: "open", headless, label: s.label });
+                traj({ step_id: "browser", event: "open", headless, label: s.label, id: lease.id, agent: lease.agent });
                 const mode = s.headless ? "无头" : "有头窗口";
-                const profile = String(env.TM_BROWSER_USER_DATA_DIR ?? "").trim() ? "持久登录配置" : "隔离临时配置";
+                // From the SESSION, never from the environment: this line used to re-read
+                // TM_BROWSER_USER_DATA_DIR at reply time, so a session that had degraded
+                // to cdp-legacy (temp profile) announced 持久登录配置.
+                const profile = s.persistentProfile ? "持久登录配置" : "隔离临时配置";
                 const note = lastSel && preference !== "cdp-legacy" && lastSel.kind === "cdp-legacy"
                     ? `\n（引擎：cdp-legacy 降级——${lastSel.reason ?? ""}；完整 16 动作需 npm install playwright-core + node≥20）`
                     : "";
                 const guard = subPolicy === "off"
                     ? `\n（子资源策略=off：跨域图片/脚本一律拦截，页面可能显示不全——TM_BROWSER_SUBRESOURCE=same-site 可恢复）`
                     : "";
-                armIdle();
-                return withAttachments(toToolResult(`浏览器已启动（${mode}，${profile} · ${s.label}）。${out}${note}${guard}`), s);
+                const others = liveLeases().length - 1;
+                // The close duty belongs in the reply that OPENS the window, not only in
+                // the tool description: a long-lived host never re-reads a description
+                // (the same finding that moved the date onto the search header), and the
+                // agent's attention is here — the moment it stops needing the page is the
+                // moment it forgets the window exists. When the reaper is off, say so
+                // rather than promising a cleanup that will not come.
+                const duty = idleCloseMs
+                    ? `\n用完必须 action:"close"（窗口用户看得见；空闲 ${Math.round(idleCloseMs / 1000)}s 我会替你关掉并提示他）。`
+                    : `\n用完必须 action:"close"——TM_BROWSER_IDLE_MS=0，没有空闲回收，你不关它就一直开着。`;
+                armIdle(lease);
+                return withAttachments(toToolResult(`[${lease.id}] 浏览器已启动（${mode}，${profile} · ${s.label}）。${out}${note}${guard}` +
+                    `\n这个窗口的 id 是 ${lease.id}，归你（${lease.agent || "本会话"}）：后续动作带 id:"${lease.id}"。` +
+                    duty +
+                    (others > 0
+                        ? `现在共有 ${others + 1} 个浏览器在跑（别的 agent 各有各的窗口），省略 id 会被拒绝。`
+                        : "") +
+                    grantNote), s);
             }
             if (action === "navigate" || action === "navigate_page") {
                 if (!url)
                     return toToolResult(tmError(tool, "args", "缺少 url 参数"));
-                if (!session)
-                    return toToolResult(tmError(tool, "args", '没有打开的浏览器会话——先用 action:"open"'));
-                const out = await session.act(action, { url }, "browser");
-                armIdle();
-                return withAttachments(toToolResult(out), session);
+                const got = resolveLease(args, caller);
+                if ("error" in got)
+                    return toToolResult(tmError(tool, "args", got.error));
+                activeLease = got.lease;
+                const out = await got.lease.session.act(action, { url }, "browser");
+                armIdle(got.lease);
+                return withAttachments(toToolResult(`[${got.lease.id}] ${out}${grantNote}`), got.lease.session);
             }
             if (action === "close") {
-                traj({ step_id: "browser", event: "close" });
-                const r = await closeActive();
-                return toToolResult(r.text);
+                // `id:"all"` closes every browser the CALLER owns — never anybody
+                // else's, which is the one thing a shared kill switch would get wrong.
+                const mine = ownedBy(caller.owner);
+                if (String(args.id ?? "").trim().toLowerCase() === "all") {
+                    if (!mine.length)
+                        return toToolResult(tmError(tool, "args", "你没有打开的浏览器。"));
+                    traj({ step_id: "browser", event: "close", id: "all", count: mine.length, agent: caller.agent });
+                    const parts = [];
+                    for (const l of mine)
+                        parts.push(`[${l.id}] ${(await closeLease(l)).text}`);
+                    return toToolResult(parts.join("\n"));
+                }
+                const got = resolveLease(args, caller);
+                if ("error" in got)
+                    return toToolResult(tmError(tool, "args", got.error));
+                traj({ step_id: "browser", event: "close", id: got.lease.id, agent: caller.agent });
+                const r = await closeLease(got.lease);
+                return toToolResult(`[${got.lease.id}] ${r.text}`);
             }
             if (!ALL_ACTIONS.has(action)) {
-                return toToolResult(tmError(tool, "args", `未知 action "${String(action).slice(0, 30)}"——可用: open | navigate | take_snapshot | click | fill | hover | drag | press_key | select_page | upload_file | wait_for | evaluate_script | list_console_messages | list_network_requests | list_pages | take_screenshot | handle_dialog | read | screenshot | close（快照优先：先 take_snapshot，按 [uid=…] 寻址）`));
+                return toToolResult(tmError(tool, "args", `未知 action "${String(action).slice(0, 30)}"——可用: ${ACTION_MENU}（快照优先：先 take_snapshot，按 [uid=…] 寻址）`));
             }
-            if (!session)
-                return toToolResult(tmError(tool, "args", '没有打开的浏览器会话——先用 action:"open"'));
+            const got = resolveLease(args, caller);
+            if ("error" in got)
+                return toToolResult(tmError(tool, "args", got.error));
+            const lease = got.lease;
+            // Bound locally so the dispatch below reads the way it did when the whole
+            // process had one browser — except `session` now means "the CALLER's
+            // browser", never "the browser".
+            const session = lease.session;
+            activeLease = lease;
+            armIdle(lease);
             // M1: upload_file SOURCE containment runs at the execute layer — the
             // engine act() has no host ctx. Out-of-P2 paths and R6 env files are
             // refused before setInputFiles can move any bytes.
@@ -1523,6 +2658,16 @@ export function buildTmBrowserTool(deps) {
             // cannot drift from the other.
             if (action === "evaluate_script" && needsEvalConsent(evalAskPolicy, session.evalApproved)) {
                 const target = hostOnly(session.currentUrl);
+                // An error page or a blank tab has no host to consent to. Asking the
+                // official dialog about `evaluate_script:` with an EMPTY pattern gives
+                // the user a prompt they cannot judge, and the refusal then reads
+                // "未获批准（目标站点 ）" — seen live on a chrome-error:// tab.
+                if (!/^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)+$/.test(target)) {
+                    const where = String(session.currentUrl ?? "").slice(0, 80) || "空白页";
+                    traj({ step_id: "browser", event: "eval_refused_no_host", where });
+                    return toToolResult(tmError(tool, "permission", `evaluate_script 被拒绝：当前页面不是可识别的 http(s) 站点（${where}），没有可批准的主机。` +
+                        `先 open/navigate 到一个真实页面再执行 JS——对着错误页要权限，用户无法判断该不该批。`));
+                }
                 const outcome = await askUserForTarget(ctx, {
                     permission: tool,
                     patterns: [`evaluate_script:${target}`],
@@ -1535,17 +2680,18 @@ export function buildTmBrowserTool(deps) {
                 });
                 traj({ step_id: "browser", event: "eval_consent", host: target, verdict: outcome });
                 if (outcome !== "approved") {
-                    return toToolResult(tmError(tool, "permission", outcome === "unavailable"
+                    return toToolResult(tmError(tool, "permission", (outcome === "unavailable"
                         ? `evaluate_script 需要官方确认窗授权，本宿主没有 ask 桥——已拒绝执行。TM_BROWSER_ASK_EVAL=off 可关掉这道确认（不建议：这个动词能在你已登录的浏览器里读任意页面数据）。`
-                        : `evaluate_script 未获批准（目标站点 ${target}），已拒绝执行。改用 take_snapshot/read 的受治理读取，或让用户单独批准。`));
+                        : `evaluate_script 未获批准（目标站点 ${target}），已拒绝执行。改用 take_snapshot/read 的受治理读取，或让用户单独批准。`) +
+                        " " +
+                        askRefusalNote(outcome)));
                 }
                 session.evalApproved = true;
             }
             const stepId = pipelines.nextStepId();
             const out = await session.act(action, args, stepId);
             if (action !== "evaluate_script") {
-                armIdle();
-                return withAttachments(toToolResult(out), session);
+                return withAttachments(toToolResult(`[${lease.id}] ${out}${grantNote}`), session);
             }
             // The value is masked BEFORE it can reach the context window, the run
             // store or the trajectory; the agent is told a mask happened (a silent
@@ -1553,28 +2699,65 @@ export function buildTmBrowserTool(deps) {
             const red = redactEvalResult(out);
             if (red.masked.length) {
                 traj({ step_id: "browser", event: "eval_redacted", kinds: red.masked.join(",") });
-                armIdle();
-                return withAttachments(toToolResult(`${red.text}\n注意：结果里有 ${red.masked.join("、")} 被识别为密钥形状并已脱敏——不是页面没有这些值，是插件不把它们送进上下文。需要它们请让用户自己在浏览器里看。`), session);
+                return withAttachments(toToolResult(`[${lease.id}] ${red.text}\n注意：结果里有 ${red.masked.join("、")} 被识别为密钥形状并已脱敏——不是页面没有这些值，是插件不把它们送进上下文。需要它们请让用户自己在浏览器里看。`), session);
             }
-            armIdle();
-            return withAttachments(toToolResult(red.text), session);
+            return withAttachments(toToolResult(`[${lease.id}] ${red.text}`), session);
         }
         catch (err) {
             const e = err;
-            return toToolResult(tmError(tool, "execute", String(e?.message ?? err ?? "browser 操作失败")));
+            const msg = String(e?.message ?? err ?? "browser 操作失败");
+            // A browser the user closed — or a launch that handed its request to an
+            // already-running Edge and exited — leaves a cached session whose every
+            // action throws the SAME line. Live session: three identical failures,
+            // then a fourth, with no way out except our own bookkeeping. Drop the
+            // corpse, say that we did, and name the one move that works.  With one
+            // browser per caller, only THAT lease is dropped: another agent's window
+            // is not ours to declare dead.
+            if (/has been closed|Target closed|Browser closed|browser has been closed/i.test(msg)) {
+                const dead = activeLease;
+                const leaseId = dead?.id ?? "";
+                // That one string covers two very different facts — a TAB the user closed
+                // and a BROWSER that died.  Only the second may cost the lease: measured
+                // live, closing the last tab threw this line while the window was still
+                // up, the lease got dropped, `close` then reported "no browser open", and
+                // the user was left holding a browser no agent could address.
+                const alive = dead ? dead.session.alive?.() !== false : false;
+                if (dead && !alive) {
+                    leases.delete(dead.id);
+                    clearIdle(dead.id);
+                }
+                traj({
+                    step_id: "browser",
+                    event: alive ? "page_dead_browser_alive" : "session_dead",
+                    cleared: Boolean(dead && !alive),
+                    id: leaseId,
+                    reason: msg.slice(0, 160),
+                });
+                return toToolResult(tmError(tool, "execute", alive
+                    ? `${msg.slice(0, 200)}\n但浏览器本身还连着（${leaseId} 我保留了，你的 id 不变）——死的是**这一个页面/标签**，不是实例。` +
+                        `下一步：list_pages 看还剩几个标签，或 new_page 在同一个窗口开一个；要结束整个会话用 close。`
+                    : `${msg.slice(0, 200)}\n浏览器实例已失效${dead ? `（${leaseId}，${dead.agent || "本会话"} 的窗口）：我已丢弃它，下一次 action:"open" 会真的重启一个新实例` : "，当前没有可复用的会话"}。` +
+                        `连着两次都这样，通常是本机已有同品牌浏览器在跑、新进程把请求移交给旧实例后退掉了——请用户关掉那个窗口再 open，或设 TM_BROWSER_ENGINE=cdp-legacy 换一条传输。` +
+                        `不要第三次重复同一个动作。`));
+            }
+            return toToolResult(tmError(tool, "execute", msg));
         }
     };
-    const DESCRIPTION = `Interactive browser (governed, Plan C): drives the user's own Chromium-family browser HEADFUL — playwright-core engine primary (npm install + node>=20; auto-degrades to the zero-dep CDP pipe when absent, snapshot actions then unavailable). Snapshot-first flow: open → take_snapshot → act by [uid] → observe again.
-- 16 actions (chrome-devtools-mcp aligned): navigate_page { url } · take_snapshot { } → ariaSnapshot YAML with injected [uid=eN] · click/fill{text}/hover { uid|selector } · drag { uid, targetUid } · press_key { key } · select_page { index } · upload_file { uid, filePath } (filePath must live INSIDE the workspace/blackboard scope — .env & shell-rc files are refused) · wait_for { text|uid, timeoutMs<=3000 default } · evaluate_script { function } (arbitrary JS in YOUR browser: needs one official-dialog consent per browser session, and the result is scanned so JWT/bearer/cookie/api-key shapes never enter the context) · list_console_messages · list_network_requests · list_pages · take_screenshot { fullPage?, image? } → the PNG always lands in the run store (path in the reply); with image:true a quality-70 JPEG of the same view is attached to THIS result so a vision model can actually see it (opt-in: pixels cost context, so ask only when the screenshot is the evidence) · handle_dialog { dialogAction: accept|dismiss, promptText }.
-- Compat actions: open { url } — launch/reuse + navigate (TM_BROWSER_PATH override → DEFAULT browser, Chromium-family only; the registry ProgId decides the CHANNEL, so an Edge Beta default opens Edge Beta, not stable). Isolated temp profile by default; persistent login ONLY via TM_BROWSER_USER_DATA_DIR (the real profile is never touched). navigate / read (page text) / screenshot / close also work.
-- Lifecycle (the user SEES this window): headful by default — headless is an operator setting (TM_BROWSER_HEADLESS), not a parameter you can pass. An idle session closes itself (TM_BROWSER_IDLE_MS, default 180s) and the user is told. ALWAYS action:"close" when your browser work is done, and quote the tool's own close line — "已确认关闭" vs "警告：关闭未完全成功" — instead of asserting the window is gone.
-- Discipline (enforced by defaults): act ONLY on uids from the latest take_snapshot — no guessed locators; one action then one observation; fold dialogs into the same round (snapshot header warns while a dialog is held); 3000 ms action budget; networkidle is never waited on; screenshots are the visual-last-resort, not the primary read.
-- Network: the top-level navigation must clear the domain allowlist (seeded = tm_webfetch's hosts; out-of-allowlist open/navigate asks the user through the OFFICIAL confirmation dialog BEFORE any spawn). SUBRESOURCES then follow TM_BROWSER_SUBRESOURCE (default same-site): images/media/fonts/stylesheets load, a script/XHR loads when it belongs to a site this session actually opened, anything else is blocked and reported as a "N 个子资源被拦截" note on the next snapshot — that note means the gate trimmed the page, NOT that the site has no images. env-file URLs and non-http(s) schemes hard-reject under every policy.
-- Fixed priority ladder: ① tm_* governed tools → ② user MCP/plugin tools → ③ reasoning (never fabricate).  No browser installed → structured error, fall back to tm_webfetch / MCP.  Role grant: team + researcher full, tester browser-only (UI verification).`;
+    const DESCRIPTION = `Interactive browser (governed, Plan C): drives the user's own Chromium-family browser HEADFUL — playwright-core engine primary (npm install + node>=20; auto-degrades to the zero-dep CDP pipe when absent, snapshot actions then unavailable). Snapshot-first flow: open → take_snapshot → act by [uid] → observe again.
+- MULTI-TAB is a first-class flow: new_page { url? } opens a tab and makes it current (its url clears the SAME allowlist gate and dialog as navigate_page), list_pages numbers them, select_page { index } switches, close_page { index? } closes one and moves you to a survivor — closing the LAST tab does NOT close the browser, and the reply says so. Compare two pages without losing either.
+- ONE BROWSER PER AGENT: open returns an id ("b1") and that window is YOURS — its own uid numbering, its own current tab, its own dialog-approved hosts. Every reply is prefixed with the id it ran on. Pass id on every action once more than one browser is live (omitting it is only unambiguous while exactly one exists and it is yours); another agent's id is refused with the owner named, because sharing one window means your take_snapshot renumbers the uids they are holding and their next click lands somewhere else while STILL reporting success. close { id: "all" } closes all of yours — never anybody else's.
+- 18 actions (chrome-devtools-mcp aligned): navigate_page { url } · take_snapshot { } → ariaSnapshot YAML with injected [uid=eN] · click/fill{text}/hover { uid|selector } · drag { uid, targetUid } · press_key { key } · select_page { index } · upload_file { uid, filePath } (filePath must live INSIDE the workspace/blackboard scope — .env & shell-rc files are refused) · wait_for { text|uid, timeoutMs<=3000 default } · evaluate_script { function } (arbitrary JS in YOUR browser: needs one official-dialog consent per browser session, and the result is scanned so JWT/bearer/cookie/api-key shapes never enter the context) · list_console_messages · list_network_requests · list_pages · take_screenshot { fullPage?, image? } → the PNG always lands in the run store (path in the reply); with image:true a quality-70 JPEG of the same view is attached to THIS result so a vision model can actually see it (opt-in: pixels cost context, so ask only when the screenshot is the evidence) · handle_dialog { dialogAction: accept|dismiss, promptText }.
+- Compat actions: open { url } — launch/reuse + navigate (TM_BROWSER_PATH override → DEFAULT browser, Chromium-family only; the registry ProgId decides the CHANNEL, so an Edge Beta default opens Edge Beta, not stable). Isolated temp profile by default; persistent login ONLY via TM_BROWSER_USER_DATA_DIR — honored by BOTH engines, and a value pointing at your browser's OWN data dir (…\\Microsoft\\Edge\\User Data, google-chrome, Firefox Profiles) is refused before anything spawns, because browsing as your real identity plus a force-kill reaper is how a profile gets corrupted. navigate / read (page text) / screenshot / close also work.
+- Lifecycle (the user SEES this window): headful by default — headless is an operator setting (TM_BROWSER_HEADLESS), not a parameter you can pass. An idle session closes itself (TM_BROWSER_IDLE_MS, default 180s) and the user is told. ALWAYS action:"close" when your browser work is done, and quote the tool's own close line — "已确认关闭" vs "警告：关闭未完全成功" — instead of asserting the window is gone.
+- Discipline (enforced by defaults): act ONLY on uids from the latest take_snapshot — no guessed locators; one action then one observation; fold dialogs into the same round (snapshot header warns while a dialog is held); 3000 ms action budget; networkidle is never waited on; screenshots are the visual-last-resort, not the primary read.
+- Network: the top-level navigation must clear the domain allowlist (seeded = tm_webfetch's hosts; out-of-allowlist open/navigate asks the user through the OFFICIAL confirmation dialog BEFORE any spawn). SUBRESOURCES then follow TM_BROWSER_SUBRESOURCE (default same-site): images/media/fonts/stylesheets load, a script/XHR loads when it belongs to a site this session actually opened, anything else is blocked and reported as a "N 个子资源被拦截" note on the next snapshot — that note means the gate trimmed the page, NOT that the site has no images. env-file URLs and non-http(s) schemes hard-reject under every policy.
+- An EMPTY page gets a reason, never a shrug. A site whose own bundle sits on a brand-unrelated CDN (Baidu's bdimg.com is the case that started this) renders 0 addressable nodes behind our gate; the reply then names the blocked host and says the blankness is OURS, with two ways out: allow_host { host } — one bare domain, this browser, this session, via the OFFICIAL dialog, nothing written to any config (re-navigate afterwards, the gate decides per request) — or the user adding the host to TM_WEBFETCH_ALLOWED_DOMAINS and restarting. And if the page is really a human-verification wall (百度安全验证 / Cloudflare / access denied) the reply says so, because a wall is not an empty site: retrying it buys nothing, the move is another source or the user's own hands.
+- A dead instance is never retried: if an action reports the browser/page "has been closed", the cached session is dropped, the reply says the next open really rebuilds, and the trajectory records session_dead — do NOT repeat the same open a third time (close the competing browser window, or set TM_BROWSER_ENGINE=cdp-legacy). evaluate_script on a hostless page (chrome-error://, about:blank) is refused outright: an empty dialog pattern is something no user can judge.  No browser installed → structured error, fall back to tm_webfetch / MCP.  Role grant: team + researcher full, tester browser-only (UI verification).`;
     return {
         description: DESCRIPTION,
         args: deps.args ?? {
-            action: { descriptor: "action: take_snapshot|click|fill|navigate_page|... (16 playwright verbs + open/navigate/read/screenshot/close)" },
+            action: { descriptor: "action: take_snapshot|click|fill|navigate_page|... (18 playwright verbs + open/navigate/read/screenshot/close)" },
+            id: { descriptor: 'id: which browser — the id open gave you ("b1"). One browser per agent: required once more than one is live, and it must be YOURS (another agent\'s id is refused). close {id:"all"} closes all of yours' },
             url: { descriptor: "url: string (open/navigate/navigate_page, allowlisted https)" },
             image: { descriptor: "image: true (take_screenshot only — attach the PNG pixels to this result; default is path-only)" },
             uid: { descriptor: "uid: snapshot [uid=eN] token (click/fill/hover/drag/upload_file/wait_for)" },
@@ -1594,18 +2777,29 @@ export function buildTmBrowserTool(deps) {
         },
         execute,
         dispose: async () => {
-            if (idleTimer) {
-                clearTimeout(idleTimer);
-                idleTimer = null;
-            }
+            for (const t of idleTimers.values())
+                clearTimeout(t);
+            idleTimers.clear();
             // AWAITED: the host's dispose hook is Promise-returning, and tearing
             // down while a close was still in flight left the window on screen.
-            await closeActive().catch(() => { });
+            // EVERY lease, not just one caller's: plugin unload owns all of them.
+            for (const l of liveLeases()) {
+                await closeLease(l).catch(() => { });
+            }
         },
         engineInfo: () => ({
             kind: lastSel?.kind ?? null,
             reason: lastSel?.reason ?? null,
         }),
+        leases: () => {
+            const nowMs = Date.now();
+            return liveLeases().map((l) => ({
+                id: l.id,
+                owner: l.owner,
+                agent: l.agent,
+                idleMs: Math.max(0, nowMs - l.lastActivity),
+            }));
+        },
     };
 }
 //# sourceMappingURL=browser.js.map