@xopcai/xopc 0.0.264 → 0.0.266

package/dist/src/auth/credentials.js

@@ -1,10 +1,10 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveCredentialsDir, resolveOAuthPath } from "../config/paths.js";
 import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
-import { getOAuthProviderDefinition, init_registry } from "./oauth/registry.js";
+import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveCredentialsDir, resolveOAuthPath } from "../config/paths.js";
 import { getApiKeyFromEnv, init_env_keys } from "../providers/env-keys.js";
+import { getOAuthProviderDefinition, init_registry } from "./oauth/registry.js";
 import { init_oauth_provider_lock, withOAuthProviderLock } from "./oauth-provider-lock.js";
 import { dirname, join } from "path";
 import { mkdir, readFile, readdir, rm } from "fs/promises";

package/dist/src/auth/oauth/xopc-cloud.js

@@ -1,6 +1,6 @@
 import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
-import { init_resolution, resolveConnectedPlatformEndpoint } from "../../platform/resolution.js";
 import { generatePKCE, init_pkce } from "./pkce.js";
+import { init_resolution, resolveConnectedPlatformEndpoint } from "../../platform/resolution.js";
 import { hostname } from "node:os";
 import { randomBytes } from "node:crypto";
 import http from "node:http";

package/dist/src/auth/profiles/store.js

@@ -1,5 +1,5 @@
-import { init_paths, resolveCredentialsDir } from "../../config/paths.js";
 import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
+import { init_paths, resolveCredentialsDir } from "../../config/paths.js";
 import path from "node:path";
 import { chmodSync, existsSync, mkdirSync, readFileSync } from "node:fs";
 //#region src/auth/profiles/store.ts

package/dist/src/auth/sync-provider-auth.js

@@ -1,8 +1,8 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveOAuthPath } from "../config/paths.js";
-import { init_loader, loadConfig } from "../config/loader.js";
 import { init_registry, isOAuthOnlyProvider } from "./oauth/registry.js";
+import { init_loader, loadConfig } from "../config/loader.js";
+import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/auth/sync-provider-auth.ts
 /**

package/dist/src/browser/automations/schema.d.ts

@@ -128,8 +128,8 @@ export declare const BrowserAutomationDefinitionSchema: z.ZodObject<{
     }, z.core.$strict>, z.ZodObject<{
         action: z.ZodLiteral<"wait">;
         condition: z.ZodEnum<{
-            hidden: "hidden";
             text: "text";
+            hidden: "hidden";
             visible: "visible";
             page_idle: "page_idle";
         }>;

package/dist/src/browser/automations/service.d.ts

@@ -120,7 +120,7 @@ export declare class BrowserAutomationService {
             };
         } | {
             action: "wait";
-            condition: "hidden" | "text" | "visible" | "page_idle";
+            condition: "text" | "hidden" | "visible" | "page_idle";
             value?: string;
             target?: {
                 role: string;

package/dist/src/browser/native-messaging-host.d.ts

@@ -0,0 +1,15 @@
+export declare const BROWSER_NATIVE_HOST_NAME = "ai.xopc.browser";
+export declare const BROWSER_EXTENSION_ID = "gopbfhaojnnhiheiikblejnpgmfmkmgd";
+export type BrowserNativeBootstrap = {
+    type: 'bootstrap';
+};
+export type BrowserNativeBootstrapResult = {
+    ok: true;
+    gatewayUrl: string;
+    pairingLink: string;
+    expiresAt: number;
+};
+export declare function encodeNativeMessage(value: unknown): Buffer;
+export declare function decodeNativeMessage(buffer: Buffer): unknown;
+export declare function createBrowserNativeBootstrap(configPath: string): BrowserNativeBootstrapResult;
+export declare function runBrowserNativeMessagingHost(configPath: string): Promise<void>;

package/dist/src/browser/native-messaging-host.js

@@ -0,0 +1,105 @@
+import { closeXopcDatabase, openXopcDatabase } from "../storage/sqlite/connection.js";
+import { getGatewayIdentityPublicKeyRaw, getOrCreateGatewayIdentity } from "../storage/sqlite/gateway-identity-repository.js";
+import { createDevicePairingSetup } from "../storage/sqlite/device-pairing-repository.js";
+import { init_loader, loadConfig } from "../config/loader.js";
+import os from "node:os";
+//#region src/browser/native-messaging-host.ts
+init_loader();
+const BROWSER_NATIVE_HOST_NAME = "ai.xopc.browser";
+const BROWSER_EXTENSION_ID = "gopbfhaojnnhiheiikblejnpgmfmkmgd";
+function gatewayLoopbackUrl(port) {
+	return `http://127.0.0.1:${port}`;
+}
+function encodeNativeMessage(value) {
+	const payload = Buffer.from(JSON.stringify(value), "utf8");
+	const header = Buffer.allocUnsafe(4);
+	header.writeUInt32LE(payload.length, 0);
+	return Buffer.concat([header, payload]);
+}
+function decodeNativeMessage(buffer) {
+	if (buffer.length < 4) throw new Error("Native message header is incomplete");
+	const length = buffer.readUInt32LE(0);
+	if (length === 0 || length > 1024 * 1024 || buffer.length !== length + 4) throw new Error("Native message length is invalid");
+	return JSON.parse(buffer.subarray(4).toString("utf8"));
+}
+function createBrowserNativeBootstrap(configPath) {
+	const gatewayUrl = gatewayLoopbackUrl(loadConfig(configPath).gateway.port ?? 18790);
+	openXopcDatabase();
+	try {
+		const route = {
+			id: "local-browser",
+			kind: "local-browser",
+			url: gatewayUrl
+		};
+		const setup = createDevicePairingSetup([route], Date.now(), 3);
+		const identity = getOrCreateGatewayIdentity();
+		return {
+			ok: true,
+			gatewayUrl,
+			pairingLink: `https://link.xopc.ai/connect#p=${Buffer.from(JSON.stringify({
+				version: 3,
+				pairingToken: setup.token,
+				gatewayId: identity.id,
+				gatewayName: os.hostname(),
+				gatewayPublicKey: getGatewayIdentityPublicKeyRaw(identity),
+				routes: [route],
+				expiresAt: setup.expiresAt
+			})).toString("base64url")}`,
+			expiresAt: setup.expiresAt
+		};
+	} finally {
+		closeXopcDatabase();
+	}
+}
+async function readOneNativeMessage(input) {
+	return new Promise((resolve, reject) => {
+		let buffered = Buffer.alloc(0);
+		let expectedLength;
+		const cleanup = () => {
+			input.off("data", onData);
+			input.off("end", onEnd);
+			input.off("error", onError);
+		};
+		const onError = (error) => {
+			cleanup();
+			reject(error);
+		};
+		const onEnd = () => {
+			cleanup();
+			reject(/* @__PURE__ */ new Error("Native messaging input ended before one complete request"));
+		};
+		const onData = (chunk) => {
+			buffered = Buffer.concat([buffered, Buffer.from(chunk)]);
+			if (expectedLength === void 0 && buffered.length >= 4) {
+				expectedLength = buffered.readUInt32LE(0);
+				if (expectedLength === 0 || expectedLength > 1024 * 1024) {
+					cleanup();
+					reject(/* @__PURE__ */ new Error("Native message length is invalid"));
+					return;
+				}
+			}
+			if (expectedLength !== void 0 && buffered.length >= expectedLength + 4) {
+				cleanup();
+				input.pause();
+				resolve(buffered.subarray(0, expectedLength + 4));
+			}
+		};
+		input.on("data", onData);
+		input.once("end", onEnd);
+		input.once("error", onError);
+	});
+}
+async function runBrowserNativeMessagingHost(configPath) {
+	try {
+		const request = decodeNativeMessage(await readOneNativeMessage(process.stdin));
+		if (!request || typeof request !== "object" || request.type !== "bootstrap") throw new Error("Unsupported native messaging request");
+		process.stdout.write(encodeNativeMessage(createBrowserNativeBootstrap(configPath)));
+	} catch (error) {
+		process.stdout.write(encodeNativeMessage({
+			ok: false,
+			error: error instanceof Error ? error.message : String(error)
+		}));
+	}
+}
+//#endregion
+export { BROWSER_EXTENSION_ID, BROWSER_NATIVE_HOST_NAME, createBrowserNativeBootstrap, decodeNativeMessage, encodeNativeMessage, runBrowserNativeMessagingHost };

package/dist/src/browser/providers/browser-ext-install.d.ts

@@ -3,7 +3,7 @@
  * Fixed path — gateway upgrades overwrite in place so Chrome sideload paths stay stable.
  */
 import type { Config } from '../../config/schema.js';
-export declare const BROWSER_EXT_REQUIRED_FILES: readonly ["manifest.json", "popup.html", "dist/background.js", "dist/content.js", "dist/popup.js"];
+export declare const BROWSER_EXT_REQUIRED_FILES: readonly ["manifest.json", "dist/background.js", "dist/sidepanel.html"];
 export type BrowserExtBundledFrom = 'npm-dist' | 'git-dev' | 'electron-asar' | 'env-override';
 export interface BrowserExtInstallMeta {
     xopcVersion: string;
@@ -32,6 +32,11 @@ export interface EnsureBrowserExtResult {
     xopcVersion: string;
     copied: boolean;
 }
+export interface BrowserNativeHostInstallResult {
+    installed: boolean;
+    manifestPaths: string[];
+    reason?: string;
+}
 /** Validate a directory contains a loadable extension tree. */
 export declare function validateBrowserExtLayout(dir: string): boolean;
 export declare function browserExtContentHash(dir: string): string;
@@ -59,6 +64,17 @@ export declare function ensureBrowserExtensionArtifacts(opts?: {
     force?: boolean;
     cacheDir?: string;
 }): Promise<EnsureBrowserExtResult>;
+export declare function browserNativeManifestDirectories(platform?: NodeJS.Platform, home?: string): string[];
+/** Install the local-only bootstrap host used to discover and pair with a Gateway. */
+export declare function installBrowserNativeMessagingHost(opts?: {
+    cacheDir?: string;
+    cliPath?: string;
+    nodePath?: string;
+    platform?: NodeJS.Platform;
+    home?: string;
+    configPath?: string;
+    stateDir?: string;
+}): Promise<BrowserNativeHostInstallResult>;
 /** Gateway startup hook: ensure artifacts only while the extension driver is active. */
 export declare function ensureBrowserExtensionOnStartup(config: Config | undefined): Promise<void>;
 export declare function readInstalledExtensionDir(cacheDir?: string): Promise<string | null>;

package/dist/src/browser/providers/browser-ext-install.js

@@ -1,12 +1,14 @@
 import { PACKAGE_VERSION, init_package_version } from "../../package-version.js";
+import { resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { init_paths, resolveBinDir } from "../../config/paths.js";
 import { init_write_file_atomic, writeTextAtomic } from "../../infra/write-file-atomic.js";
-import { resolvePackageRoot } from "../../infra/update-check.js";
+import { init_paths, resolveBinDir, resolveConfigPath } from "../../config/paths.js";
 import { assertCacheDir } from "../cache-dir-policy.js";
+import { BROWSER_EXTENSION_ID, BROWSER_NATIVE_HOST_NAME } from "../native-messaging-host.js";
+import { resolvePackageRoot } from "../../infra/update-check.js";
 import { dirname, join } from "node:path";
-import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -25,16 +27,13 @@ const META_FILENAME = ".meta.json";
 const STAGING_MAX_AGE_MS = 3600 * 1e3;
 const INSTALLED_ARTIFACT_NAMES = [
 	"manifest.json",
-	"popup.html",
 	"dist",
 	"icons"
 ];
 const BROWSER_EXT_REQUIRED_FILES = [
 	"manifest.json",
-	"popup.html",
 	"dist/background.js",
-	"dist/content.js",
-	"dist/popup.js"
+	"dist/sidepanel.html"
 ];
 function moduleDir() {
 	return dirname(fileURLToPath(import.meta.url));
@@ -45,7 +44,16 @@ function validateBrowserExtLayout(dir) {
 }
 function browserExtContentHash(dir) {
 	const hash = createHash("sha256");
-	for (const relativePath of BROWSER_EXT_REQUIRED_FILES) {
+	const collectFiles = (relativeDir) => readdirSync(join(dir, relativeDir), { withFileTypes: true }).flatMap((entry) => {
+		const relativePath = join(relativeDir, entry.name);
+		return entry.isDirectory() ? collectFiles(relativePath) : [relativePath];
+	});
+	const relativePaths = [
+		"manifest.json",
+		...collectFiles("dist"),
+		...collectFiles("icons")
+	].sort();
+	for (const relativePath of relativePaths) {
 		hash.update(relativePath);
 		hash.update(readFileSync(join(dir, relativePath)));
 	}
@@ -177,21 +185,25 @@ function copyBundledFile(src, dest) {
 	mkdirSync(dirname(dest), { recursive: true });
 	writeFileSync(dest, readFileSync(src));
 }
-const BROWSER_EXT_DIST_FILES = [
-	"background.js",
-	"content.js",
-	"popup.js"
-];
 const BROWSER_EXT_ICON_FILES = [
 	"icon-16.png",
 	"icon-32.png",
 	"icon-48.png",
 	"icon-128.png"
 ];
+function copyBundledDirectory(src, dest) {
+	mkdirSync(dest, { recursive: true });
+	for (const entry of readdirSync(src, { withFileTypes: true })) {
+		const sourcePath = join(src, entry.name);
+		const destinationPath = join(dest, entry.name);
+		if (entry.isDirectory()) copyBundledDirectory(sourcePath, destinationPath);
+		else copyBundledFile(sourcePath, destinationPath);
+	}
+}
 function copyBundledTree(src, dest) {
 	mkdirSync(dest, { recursive: true });
-	for (const name of ["manifest.json", "popup.html"]) copyBundledFile(join(src, name), join(dest, name));
-	for (const file of BROWSER_EXT_DIST_FILES) copyBundledFile(join(src, "dist", file), join(dest, "dist", file));
+	copyBundledFile(join(src, "manifest.json"), join(dest, "manifest.json"));
+	copyBundledDirectory(join(src, "dist"), join(dest, "dist"));
 	for (const icon of BROWSER_EXT_ICON_FILES) {
 		const iconSrc = join(src, "icons", icon);
 		if (existsSync(iconSrc)) copyBundledFile(iconSrc, join(dest, "icons", icon));
@@ -283,6 +295,60 @@ async function ensureBrowserExtensionArtifacts(opts) {
 		copied: true
 	};
 }
+function shellQuote(value) {
+	return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function browserNativeManifestDirectories(platform = process.platform, home = process.env.HOME || process.env.USERPROFILE || "") {
+	if (!home) return [];
+	if (platform === "darwin") return [
+		join(home, "Library/Application Support/Google/Chrome/NativeMessagingHosts"),
+		join(home, "Library/Application Support/Chromium/NativeMessagingHosts"),
+		join(home, "Library/Application Support/Microsoft Edge/NativeMessagingHosts"),
+		join(home, "Library/Application Support/BraveSoftware/Brave-Browser/NativeMessagingHosts")
+	];
+	if (platform === "linux") return [
+		join(home, ".config/google-chrome/NativeMessagingHosts"),
+		join(home, ".config/chromium/NativeMessagingHosts"),
+		join(home, ".config/microsoft-edge/NativeMessagingHosts"),
+		join(home, ".config/BraveSoftware/Brave-Browser/NativeMessagingHosts")
+	];
+	return [];
+}
+/** Install the local-only bootstrap host used to discover and pair with a Gateway. */
+async function installBrowserNativeMessagingHost(opts) {
+	const directories = browserNativeManifestDirectories(opts?.platform ?? process.platform, opts?.home);
+	if (directories.length === 0) return {
+		installed: false,
+		manifestPaths: [],
+		reason: "Native bootstrap installation is supported on macOS and Linux"
+	};
+	const cliPath = opts?.cliPath ?? process.argv[1];
+	if (!cliPath) throw new Error("Unable to resolve the xopc CLI entry point");
+	const hostPath = join((opts?.cacheDir?.trim() ? assertCacheDir(opts.cacheDir) : resolveBinDir()) || resolveBinDir(), "browser-native-host");
+	mkdirSync(dirname(hostPath), { recursive: true });
+	const stateDir = opts?.stateDir ?? resolveStateDir();
+	const configPath = opts?.configPath ?? resolveConfigPath();
+	await writeTextAtomic(hostPath, `#!/bin/sh\nexec env XOPC_STATE_DIR=${shellQuote(stateDir)} XOPC_CONFIG_PATH=${shellQuote(configPath)} XOPC_LOG_CONSOLE=false ${shellQuote(opts?.nodePath ?? process.execPath)} ${shellQuote(cliPath)} browser extension native-host\n`);
+	chmodSync(hostPath, 493);
+	const manifest = JSON.stringify({
+		name: BROWSER_NATIVE_HOST_NAME,
+		description: "xopc local browser pairing bootstrap",
+		path: hostPath,
+		type: "stdio",
+		allowed_origins: [`chrome-extension://${BROWSER_EXTENSION_ID}/`]
+	}, null, 2);
+	const manifestPaths = [];
+	for (const directory of directories) {
+		mkdirSync(directory, { recursive: true });
+		const manifestPath = join(directory, `${BROWSER_NATIVE_HOST_NAME}.json`);
+		await writeTextAtomic(manifestPath, manifest);
+		manifestPaths.push(manifestPath);
+	}
+	return {
+		installed: true,
+		manifestPaths
+	};
+}
 /** Gateway startup hook: ensure artifacts only while the extension driver is active. */
 async function ensureBrowserExtensionOnStartup(config) {
 	if (config?.browser.enabled === false || config?.browser.driver.kind !== "extension") return;
@@ -366,4 +432,4 @@ async function openBrowserExtensionInstallUi(opts) {
 	};
 }
 //#endregion
-export { BROWSER_EXT_REQUIRED_FILES, browserExtContentHash, browserExtDoctor, computeNeedsRefresh, ensureBrowserExtensionArtifacts, ensureBrowserExtensionOnStartup, openBrowserExtensionInstallUi, readInstalledExtensionDir, resolveBundledBrowserExtDir, resolveInstalledExtensionPath, resolveWindowsExtensionManager, validateBrowserExtLayout };
+export { BROWSER_EXT_REQUIRED_FILES, browserExtContentHash, browserExtDoctor, browserNativeManifestDirectories, computeNeedsRefresh, ensureBrowserExtensionArtifacts, ensureBrowserExtensionOnStartup, installBrowserNativeMessagingHost, openBrowserExtensionInstallUi, readInstalledExtensionDir, resolveBundledBrowserExtDir, resolveInstalledExtensionPath, resolveWindowsExtensionManager, validateBrowserExtLayout };

package/dist/src/browser/providers/extension.d.ts

@@ -31,6 +31,8 @@ export declare class ExtensionBrowserProvider {
     private connected;
     private extensionProtocolVersion;
     private extensionVersion;
+    private connectionId;
+    private principalId;
     private readonly config;
     private connectionWaiters;
     constructor(config?: ExtensionProviderConfig);
@@ -48,10 +50,12 @@ export declare class ExtensionBrowserProvider {
         protocolVersion: number | null;
         expectedProtocolVersion: number;
         extensionVersion: string | null;
+        principalId: string | null;
     };
     private protocolMismatchMessage;
     /** Shutdown the WebSocket server. */
     shutdown(): Promise<void>;
     private _handleMessage;
+    private _authenticateCandidate;
 }
 export declare function isBrowserWireResult(value: unknown): value is BrowserWireResult;

package/dist/src/browser/providers/extension.js

@@ -1,5 +1,10 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { deleteBrowserTabBindingsByPrincipal, getBrowserTabBindingById } from "../../storage/sqlite/browser-tab-binding-repository.js";
+import { getDevice } from "../../storage/sqlite/device-access-repository.js";
+import { isChromeExtensionOrigin } from "../../gateway/security/origin-check.js";
+import { browserWireAuthenticationPayload } from "../../../packages/browser-control-contract/src/index.js";
+import crypto from "node:crypto";
 //#region src/browser/providers/extension.ts
 /**
 * Extension browser provider — connects to the xopc Chrome Extension via WebSocket.
@@ -29,6 +34,8 @@ var ExtensionBrowserProvider = class {
 	connected = false;
 	extensionProtocolVersion = null;
 	extensionVersion = null;
+	connectionId = null;
+	principalId = null;
 	config;
 	connectionWaiters = [];
 	constructor(config) {
@@ -62,20 +69,56 @@ var ExtensionBrowserProvider = class {
 			server: this.server,
 			path: "/browser-ext"
 		});
-		this.wss.on("connection", (ws) => {
-			log.info("Chrome Extension connected");
-			const previousClient = this.clientWs;
-			this.clientWs = ws;
-			this.socketConnected = true;
-			this.handshakeReceived = false;
-			this.connected = false;
-			this.extensionProtocolVersion = null;
-			this.extensionVersion = null;
-			if (previousClient && previousClient !== ws) try {
-				previousClient.close();
-			} catch {}
+		this.wss.on("connection", (ws, request) => {
+			const origin = request.headers.origin?.toLowerCase();
+			if (!isChromeExtensionOrigin(origin)) {
+				ws.close(4403, "Chrome extension origin required");
+				return;
+			}
+			const challenge = {
+				type: "auth_challenge",
+				protocolVersion: 4,
+				connectionId: crypto.randomUUID(),
+				challenge: crypto.randomBytes(32).toString("base64url"),
+				issuedAt: Date.now()
+			};
+			let authenticated = false;
+			const authenticationTimer = setTimeout(() => {
+				if (!authenticated) ws.close(4401, "Browser authentication timed out");
+			}, 5e3);
+			ws.send(JSON.stringify(challenge));
 			ws.on("message", (data) => {
-				this._handleMessage(data.toString(), ws);
+				if (authenticated) {
+					this._handleMessage(data.toString(), ws);
+					return;
+				}
+				if (!this._authenticateCandidate(data.toString(), origin, challenge)) {
+					clearTimeout(authenticationTimer);
+					ws.close(4401, "Browser authentication failed");
+					return;
+				}
+				authenticated = true;
+				clearTimeout(authenticationTimer);
+				const message = JSON.parse(data.toString());
+				const previousClient = this.clientWs;
+				this.clientWs = ws;
+				this.socketConnected = true;
+				this.handshakeReceived = true;
+				this.connected = true;
+				this.extensionProtocolVersion = message.protocolVersion;
+				this.extensionVersion = message.extensionVersion;
+				this.connectionId = message.connectionId;
+				this.principalId = message.principalId;
+				if (previousClient && previousClient !== ws) try {
+					previousClient.close(4001, "Connection replaced");
+				} catch {}
+				for (const waiter of this.connectionWaiters) waiter.resolve();
+				this.connectionWaiters = [];
+				log.info({
+					principalId: message.principalId,
+					extensionId: message.extensionId,
+					connectionId: message.connectionId
+				}, "Chrome extension authenticated");
 			});
 			ws.on("close", (code, reason) => {
 				if (this.clientWs !== ws) return;
@@ -84,12 +127,16 @@ var ExtensionBrowserProvider = class {
 					reason: reason.toString(),
 					pendingCount: this.pending.size
 				}, "Chrome Extension disconnected");
+				const disconnectedPrincipalId = this.principalId;
 				this.clientWs = null;
 				this.socketConnected = false;
 				this.handshakeReceived = false;
 				this.connected = false;
 				this.extensionProtocolVersion = null;
 				this.extensionVersion = null;
+				this.connectionId = null;
+				this.principalId = null;
+				if (disconnectedPrincipalId) deleteBrowserTabBindingsByPrincipal(disconnectedPrincipalId);
 				for (const [id, req] of this.pending) {
 					clearTimeout(req.timer);
 					req.reject(/* @__PURE__ */ new Error("Extension disconnected"));
@@ -145,7 +192,7 @@ var ExtensionBrowserProvider = class {
 	/** Wait for the Chrome Extension to connect. */
 	async waitForConnection(timeoutMs) {
 		if (this.connected) return;
-		if (this.socketConnected && this.handshakeReceived && this.extensionProtocolVersion !== 3) throw new Error(this.protocolMismatchMessage());
+		if (this.socketConnected && this.handshakeReceived && this.extensionProtocolVersion !== 4) throw new Error(this.protocolMismatchMessage());
 		const timeout = timeoutMs ?? this.config.connectionTimeout;
 		return new Promise((resolve, reject) => {
 			const timer = setTimeout(() => {
@@ -171,10 +218,15 @@ var ExtensionBrowserProvider = class {
 			const detail = this.socketConnected ? this.protocolMismatchMessage() : "Extension not connected. Ensure the Chrome Extension is installed and connected.";
 			throw new Error(detail);
 		}
+		if (input.target?.kind === "attached_tab") {
+			const binding = getBrowserTabBindingById(input.target.bindingId);
+			if (!binding || binding.principalId !== this.principalId) throw new Error("Attached tab binding does not belong to the connected browser");
+		}
 		const id = `cmd_${++this.commandCounter}_${Date.now()}`;
 		const cmd = {
 			id,
-			protocolVersion: 3,
+			protocolVersion: 4,
+			connectionId: this.connectionId,
 			input,
 			timeoutMs: timeoutMs ?? this.config.commandTimeout,
 			visualFallback
@@ -207,12 +259,13 @@ var ExtensionBrowserProvider = class {
 			socketConnected: this.socketConnected,
 			connected: this.connected,
 			protocolVersion: this.extensionProtocolVersion,
-			expectedProtocolVersion: 3,
-			extensionVersion: this.extensionVersion
+			expectedProtocolVersion: 4,
+			extensionVersion: this.extensionVersion,
+			principalId: this.principalId
 		};
 	}
 	protocolMismatchMessage() {
-		return `Browser extension protocol mismatch (expected 3, received ${this.extensionProtocolVersion ?? "unknown"}). Reload the extension in Chrome.`;
+		return `Browser extension protocol mismatch (expected 4, received ${this.extensionProtocolVersion ?? "unknown"}). Reload the extension in Chrome.`;
 	}
 	/** Shutdown the WebSocket server. */
 	async shutdown() {
@@ -246,32 +299,19 @@ var ExtensionBrowserProvider = class {
 		this.handshakeReceived = false;
 		this.extensionProtocolVersion = null;
 		this.extensionVersion = null;
+		this.connectionId = null;
+		this.principalId = null;
 		log.info("Extension provider shut down");
 	}
 	_handleMessage(raw, sourceWs) {
 		if (sourceWs !== this.clientWs) return;
 		try {
 			const msg = JSON.parse(raw);
+			if (!this.connectionId || msg.connectionId !== this.connectionId) return;
 			if (msg.type === "status") {
 				const status = msg;
-				this.handshakeReceived = true;
-				this.extensionProtocolVersion = typeof status.protocolVersion === "number" ? status.protocolVersion : null;
-				this.extensionVersion = typeof status.extensionVersion === "string" ? status.extensionVersion : null;
-				this.connected = status.protocolVersion === 3;
-				if (this.connected) {
-					for (const waiter of this.connectionWaiters) waiter.resolve();
-					this.connectionWaiters = [];
-					log.debug(msg, "Compatible browser extension connected");
-				} else {
-					const error = new Error(this.protocolMismatchMessage());
-					for (const waiter of this.connectionWaiters) waiter.reject(error);
-					this.connectionWaiters = [];
-					log.warn({
-						expectedProtocolVersion: 3,
-						extensionProtocolVersion: this.extensionProtocolVersion,
-						extensionVersion: this.extensionVersion
-					}, "Browser extension protocol mismatch; reload the extension");
-				}
+				if (status.principalId !== this.principalId) return;
+				log.debug({ sessionCount: status.sessionCount }, "Browser extension status updated");
 				return;
 			}
 			if (isBrowserWireKeepAlive(msg)) return;
@@ -297,14 +337,40 @@ var ExtensionBrowserProvider = class {
 			log.error({ err: e }, "Failed to parse extension message");
 		}
 	}
+	_authenticateCandidate(raw, origin, challenge) {
+		try {
+			const message = JSON.parse(raw);
+			if (message.type !== "authenticate" || message.protocolVersion !== 4 || message.connectionId !== challenge.connectionId || `chrome-extension://${message.extensionId}` !== origin || Math.abs(Date.now() - challenge.issuedAt) > 5e3) return false;
+			const device = getDevice(message.principalId);
+			if (!device || device.revokedAt !== void 0 || device.platform !== "chrome" || device.extensionId !== message.extensionId) return false;
+			const payload = browserWireAuthenticationPayload({
+				protocolVersion: message.protocolVersion,
+				connectionId: message.connectionId,
+				challenge: challenge.challenge,
+				issuedAt: challenge.issuedAt,
+				principalId: message.principalId,
+				extensionId: message.extensionId,
+				extensionVersion: message.extensionVersion
+			});
+			return crypto.verify("sha256", Buffer.from(payload), {
+				key: crypto.createPublicKey({
+					key: device.publicKeyJwk,
+					format: "jwk"
+				}),
+				dsaEncoding: "ieee-p1363"
+			}, Buffer.from(message.signature, "base64url"));
+		} catch {
+			return false;
+		}
+	}
 };
 function isBrowserWireResult(value) {
 	if (!value || typeof value !== "object") return false;
 	const result = value.result;
-	return typeof value.id === "string" && Boolean(result) && typeof result === "object" && typeof result.ok === "boolean";
+	return typeof value.id === "string" && typeof value.connectionId === "string" && Boolean(result) && typeof result === "object" && typeof result.ok === "boolean";
 }
 function isBrowserWireKeepAlive(value) {
-	return Boolean(value) && typeof value === "object" && value.type === "keepalive" && typeof value.timestamp === "number";
+	return Boolean(value) && typeof value === "object" && value.type === "keepalive" && typeof value.connectionId === "string" && typeof value.timestamp === "number";
 }
 //#endregion
 export { ExtensionBrowserProvider, isBrowserWireResult };

package/dist/src/browser/runtime/browser-runtime.d.ts

@@ -1,4 +1,4 @@
-import type { BrowserActionInput, BrowserControlResult } from '@xopcai/browser-control-contract';
+import type { BrowserActionInput, BrowserControlResult, BrowserTarget } from '@xopcai/browser-control-contract';
 import type { Config } from '../../config/schema.js';
 import type { BrowserDriver } from '../drivers/browser-driver.js';
 export interface BrowserRuntimeOptions {
@@ -6,6 +6,7 @@ export interface BrowserRuntimeOptions {
     createDriver: () => Promise<BrowserDriver>;
     allowedUploadRoots?: string[];
     emit?: (type: string, payload: unknown) => void;
+    resolveTarget?: (taskKey: string) => BrowserTarget | undefined;
 }
 export declare class BrowserRuntime {
     private readonly options;