dsh-browser-playwright-codex 0.7.2 → 0.7.5

package/lib/session.d.ts

@@ -60,6 +60,32 @@ export declare class PlaywrightSession {
     /** Nonce of the baseline ref space; a change means navigation reset. */
     lastRefNonce: string | undefined;
     constructor(provider: PlaywrightProvider, owner: string, context: BrowserContext);
+    /**
+     * Turn a navigation the host guard refused into a named refusal.
+     *
+     * A page can navigate itself (location.href, meta refresh, a form submit, a
+     * 302) without passing any entry-point check. The guard stops the document
+     * request; this reports it, so "I clicked and nothing happened" becomes
+     * URL_NOT_ALLOWED naming the host. Consumed once: a later action must not
+     * inherit an earlier refusal.
+     */
+    throwIfNavigationBlocked(): void;
+    /**
+     * Refuse to go on driving a page that is outside the allow-list.
+     *
+     * The request-level guard (navigation-guard.ts) catches navigations started
+     * from inside the page, but NOT a redirect the browser follows on its own:
+     * measured 2026-10-26, `context.route()` never sees the hop after a
+     * `continue()`d request, so `127.0.0.1/x` answering `302 → localhost/y` lands
+     * on the disallowed host with no route event at all. So every action that
+     * settles a page also checks where it actually ended up.
+     *
+     * The off-list page is abandoned for about:blank (hostless, always allowed)
+     * instead of being left there: otherwise the session would wedge on a page it
+     * may never drive, and "navigate somewhere allowed" could not fix it.
+     * @param page - the page this action ran on.
+     */
+    assertCurrentUrlAllowed(page: Page): Promise<void>;
     /**
      * The session's cookies, reduced to what the login inference needs. `value` is dropped here,
      * at the only place cookies enter the summary path, so nothing downstream can leak it.
@@ -278,9 +304,13 @@ export declare class PlaywrightSession {
      * Send one raw CDP command on the current page's session and return its
      * result. This is the "direct protocol" escape hatch behind every other
      * tool — the model can inspect geometry, dispatch trusted input events or
-     * query the DOM the same way Chrome DevTools does. Policy (which methods
-     * are allowed) lives in the tool layer via lib/cdp-policy.js; this method
-     * itself performs no filtering so internal callers keep full control.
+     * query the DOM the same way Chrome DevTools does.
+     *
+     * Both rules live here as well as in the tool layer, deliberately: the
+     * allow-list and the switch must hold for anything that reaches this method,
+     * not just for the registered tool. Before 2026-10-26 only `browser_cdp`
+     * checked them, so a caller working through the service could send
+     * `Runtime.evaluate` — arbitrary JavaScript — with the switch off (measured).
      */
     cdp(method: string, params: Record<string, unknown>, signal?: AbortSignal): Promise<unknown>;
     close(): Promise<void>;

package/lib/session.js

@@ -1,11 +1,13 @@
 import { looksLikeToken, registrableDomain } from "./login-sites.js";
-import { BrowserError } from "./errors.js";
+import { BrowserError, cdpDisabled, evaluateDisabled } from "./errors.js";
+import { isCdpMethodAllowed, cdpDenialMessage } from "./cdp-policy.js";
+import { getGates } from "./runtime-state.js";
 import { asTimeoutError, isAbortError, isContextDestroyed, isCrashError } from "./page-diagnostics.js";
 import { consoleMessages, networkRequests, pageData, trackPage } from "./page-diagnostics.js";
 import { elementStabilityProbe, pageStabilityProbe } from "./page-probes.js";
 import { assertActionable, back, clickAt, clickAtRef, clickLocator, clickText, closeTab, fill, forward, hoverLocator, hoverText, navigate, openTab, press, resolveClickPoint, runAction, scroll, switchTab, verifyFill, withAbort, } from "./page-actions.js";
 import { assertLive, attachDiff, attachDocResponse, attachNoProgress, buildRefSignatures, captureAria, captureLegacy, refLocator, resolveSnapshotEngine, settleAndSnapshot, snapshot, } from "./page-snapshot.js";
-import { assertAllowedUrl } from "./url-policy.js";
+import { assertAllowedUrl, isHostAllowed } from "./url-policy.js";
 /** Live session over one browser context owned by one caller. */
 export class PlaywrightSession {
     provider;
@@ -55,6 +57,66 @@ export class PlaywrightSession {
         this.owner = owner;
         this.context = context;
     }
+    /**
+     * Turn a navigation the host guard refused into a named refusal.
+     *
+     * A page can navigate itself (location.href, meta refresh, a form submit, a
+     * 302) without passing any entry-point check. The guard stops the document
+     * request; this reports it, so "I clicked and nothing happened" becomes
+     * URL_NOT_ALLOWED naming the host. Consumed once: a later action must not
+     * inherit an earlier refusal.
+     */
+    throwIfNavigationBlocked() {
+        const refused = this.provider.takeBlockedNavigation();
+        if (refused === undefined)
+            return;
+        throw new BrowserError('URL_NOT_ALLOWED', 'the page tried to navigate to ' +
+            refused.url +
+            ' and was blocked: host ' +
+            refused.host +
+            ' is not in allowedDomains. Nothing left this site — the request was stopped before it reached the network. ' +
+            'The page you were on is unchanged; tell the user the site tried to leave the allow-list.');
+    }
+    /**
+     * Refuse to go on driving a page that is outside the allow-list.
+     *
+     * The request-level guard (navigation-guard.ts) catches navigations started
+     * from inside the page, but NOT a redirect the browser follows on its own:
+     * measured 2026-10-26, `context.route()` never sees the hop after a
+     * `continue()`d request, so `127.0.0.1/x` answering `302 → localhost/y` lands
+     * on the disallowed host with no route event at all. So every action that
+     * settles a page also checks where it actually ended up.
+     *
+     * The off-list page is abandoned for about:blank (hostless, always allowed)
+     * instead of being left there: otherwise the session would wedge on a page it
+     * may never drive, and "navigate somewhere allowed" could not fix it.
+     * @param page - the page this action ran on.
+     */
+    async assertCurrentUrlAllowed(page) {
+        const raw = page.url();
+        if (raw === '')
+            return;
+        let target;
+        try {
+            target = new URL(raw);
+        }
+        catch {
+            return;
+        }
+        if (target.protocol !== 'http:' && target.protocol !== 'https:')
+            return;
+        const allowedDomains = this.provider.config.allowedDomains ?? [];
+        if (isHostAllowed(target.hostname, allowedDomains))
+            return;
+        await page.goto('about:blank').catch(() => { });
+        throw new BrowserError('URL_NOT_ALLOWED', 'the page ended up on host ' +
+            target.hostname +
+            ' (' +
+            raw +
+            '), which is not in allowedDomains — a redirect the browser followed on its own. ' +
+            'The tab has been reset to about:blank, so nothing outside the allow-list stays reachable. ' +
+            'Tell the user: the site tried to send this session off the allow-list.');
+    }
     /**
      * The session's cookies, reduced to what the login inference needs. `value` is dropped here,
      * at the only place cookies enter the summary path, so nothing downstream can leak it.
@@ -120,6 +182,9 @@ export class PlaywrightSession {
     }
     /** Run one operation under busy tracking: idle disposal defers until it settles. */
     run(operation) {
+        // Every action starts from a clean slate: a refusal recorded during an
+        // earlier action must not be reported as this one's outcome.
+        this.provider.blockedNavigation = undefined;
         this.provider.beginOp(this.owner);
         return Promise.resolve()
             .then(operation)
@@ -491,6 +556,14 @@ export class PlaywrightSession {
         return pageData(this);
     }
     async evaluate(expression, signal) {
+        // The switch is enforced HERE, not only in the tool layer: browser_evaluate
+        // used to be guarded by tool.ts alone, so anything holding the service (a
+        // sibling plugin, a script) could run arbitrary page JavaScript with the
+        // user's logins while the setting said off (measured 2026-10-26). An
+        // unpublished gate set counts as OFF — a deployment that never said yes has
+        // not said yes.
+        if (!(getGates()?.allowEvaluate ?? false))
+            throw evaluateDisabled();
         return this.run(async () => {
             this.assertLive();
             this.provider.touch(this.owner);
@@ -511,11 +584,19 @@ export class PlaywrightSession {
      * Send one raw CDP command on the current page's session and return its
      * result. This is the "direct protocol" escape hatch behind every other
      * tool — the model can inspect geometry, dispatch trusted input events or
-     * query the DOM the same way Chrome DevTools does. Policy (which methods
-     * are allowed) lives in the tool layer via lib/cdp-policy.js; this method
-     * itself performs no filtering so internal callers keep full control.
+     * query the DOM the same way Chrome DevTools does.
+     *
+     * Both rules live here as well as in the tool layer, deliberately: the
+     * allow-list and the switch must hold for anything that reaches this method,
+     * not just for the registered tool. Before 2026-10-26 only `browser_cdp`
+     * checked them, so a caller working through the service could send
+     * `Runtime.evaluate` — arbitrary JavaScript — with the switch off (measured).
      */
     async cdp(method, params, signal) {
+        if (!(getGates()?.allowCdp ?? false))
+            throw cdpDisabled();
+        if (!isCdpMethodAllowed(method))
+            throw new BrowserError('CDP_DENIED', cdpDenialMessage(method));
         return this.run(async () => {
             this.assertLive();
             this.provider.touch(this.owner);

package/lib/settings-card.js

@@ -64,6 +64,7 @@ import * as runtimeState from "./runtime-state.js";
 // without a DSH host (a half-written patch layer would break every plugin load).
 import { homePatchPath, parseGatesBlock, writeGates } from "./gates-patch.js";
 import { readFileSync } from 'node:fs';
+import { clean, isTargetId, resolvePaths, scan } from "./cache-clean.js";
 const { getEnabled, setEnabled, getEffectiveEngine, setSnapshotEngine, isEngineUserChosen } = runtimeState;
 export const name = 'browser-toggle';
 export const inject = ['webServer'];
@@ -114,7 +115,132 @@ async function readBody(req) {
     }
     return { ok: true, text: Buffer.concat(chunks).toString('utf8') };
 }
+/** The plugin's own version, used to refuse other versions' installers. */
+function installedVersion() {
+    try {
+        const raw = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+        return typeof raw.version === 'string' ? raw.version : '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+/** Resolved disk locations; never taken from the request body. */
+function diskPaths() {
+    return resolvePaths(process.env, installedVersion());
+}
+/**
+ * GET /disk/stat — sizes per bucket; POST /disk/clean — preview or execute.
+ * Both require the CSRF header, both answer with per-target detail so partial
+ * failures are visible instead of being folded into one number.
+ */
+function registerDiskRoutes(ctx) {
+    ctx.effect(() => ctx.webServer.register({
+        kind: 'exact',
+        path: PREFIX + '/disk/stat',
+        handler: async (req, res) => {
+            if (req.method !== 'GET')
+                return sendJson(res, 405, { error: { code: 'METHOD', message: 'GET only' } });
+            if (req.headers[HEADER] !== 'browser-toggle')
+                return sendJson(res, 403, { error: { code: 'CSRF', message: 'missing plugin header' } });
+            try {
+                const report = await scan(diskPaths());
+                sendJson(res, 200, { ...report, browserActive: getEnabled() === true });
+            }
+            catch (error) {
+                sendJson(res, 500, {
+                    error: { code: 'DISK_SCAN', message: String(error && error.message ? error.message : error) },
+                });
+            }
+        },
+    }));
+    ctx.effect(() => ctx.webServer.register({
+        kind: 'exact',
+        path: PREFIX + '/disk/clean',
+        handler: async (req, res) => {
+            if (req.method !== 'POST')
+                return sendJson(res, 405, { error: { code: 'METHOD', message: 'POST only' } });
+            if (req.headers[HEADER] !== 'browser-toggle')
+                return sendJson(res, 403, { error: { code: 'CSRF', message: 'missing plugin header' } });
+            const body = await readBody(req);
+            if (!body.ok)
+                return sendJson(res, 400, { error: { code: 'BODY_READ', message: body.error } });
+            let payload;
+            try {
+                payload = JSON.parse(body.text || '{}');
+            }
+            catch {
+                return sendJson(res, 400, { error: { code: 'INVALID_JSON', message: 'body must be JSON' } });
+            }
+            if (typeof payload.dryRun !== 'boolean')
+                return sendJson(res, 400, { error: { code: 'INVALID_BODY', message: '`dryRun` must be a boolean' } });
+            if (!Array.isArray(payload.targets) || payload.targets.length === 0)
+                return sendJson(res, 400, { error: { code: 'INVALID_BODY', message: '`targets` must be a non-empty array' } });
+            const targets = [];
+            for (const value of payload.targets) {
+                if (!isTargetId(value))
+                    return sendJson(res, 400, {
+                        error: { code: 'UNKNOWN_TARGET', message: 'unknown target: ' + String(value) },
+                    });
+                targets.push(value);
+            }
+            try {
+                const report = await clean({
+                    ...diskPaths(),
+                    targets,
+                    dryRun: payload.dryRun,
+                    browserActive: getEnabled() === true,
+                });
+                sendJson(res, 200, report);
+            }
+            catch (error) {
+                sendJson(res, 500, {
+                    error: { code: 'DISK_CLEAN', message: String(error && error.message ? error.message : error) },
+                });
+            }
+        },
+    }));
+}
+/**
+ * POST /window { headless } — the user's window-mode switch.
+ *
+ * The change is persisted immediately and applied by the provider on its next
+ * acquire (it compares the mode it launched with against the desired one and
+ * relaunches, exporting login state first). Nothing is killed mid-operation.
+ */
+function registerWindowRoute(ctx) {
+    ctx.effect(() => ctx.webServer.register({
+        kind: 'exact',
+        path: PREFIX + '/window',
+        handler: async (req, res) => {
+            if (req.method !== 'POST')
+                return sendJson(res, 405, { error: { code: 'METHOD', message: 'POST only' } });
+            if (req.headers[HEADER] !== 'browser-toggle')
+                return sendJson(res, 403, { error: { code: 'CSRF', message: 'missing plugin header' } });
+            const body = await readBody(req);
+            if (!body.ok)
+                return sendJson(res, 400, { error: { code: 'BODY_READ', message: body.error } });
+            let payload;
+            try {
+                payload = JSON.parse(body.text || '{}');
+            }
+            catch {
+                return sendJson(res, 400, { error: { code: 'INVALID_JSON', message: 'body must be JSON' } });
+            }
+            if (typeof payload.headless !== 'boolean')
+                return sendJson(res, 400, { error: { code: 'INVALID_BODY', message: '`headless` must be a boolean' } });
+            const changed = runtimeState.setHeadless(payload.headless);
+            sendJson(res, 200, {
+                headless: runtimeState.getEffectiveHeadless(),
+                changed,
+                appliedOn: 'next-operation',
+            });
+        },
+    }));
+}
 export function apply(ctx) {
+    registerDiskRoutes(ctx);
+    registerWindowRoute(ctx);
     ctx.effect(() => ctx.webServer.register({
         kind: 'exact',
         path: `${PREFIX}/state`,
@@ -136,6 +262,9 @@ export function apply(ctx) {
                 allowEvaluate: gates ? gates.allowEvaluate : null,
                 allowCdp: gates ? gates.allowCdp : null,
                 diagnostics: gates ? gates.diagnostics : null,
+                headless: runtimeState.getEffectiveHeadless(),
+                headlessUserChosen: runtimeState.isHeadlessUserChosen(),
+                headlessConfigured: runtimeState.getConfiguredHeadless(),
                 // What the user's own layer says right now. Differs from the above
                 // between a write and the live reload that applies it.
                 patchGates: managedBlockGates() ?? null,

package/lib/tool-render.js

@@ -1,5 +1,6 @@
-import { CHALLENGE_NOTE, detectChallenge, detectSilentPage } from "./challenge.js";
+import { challengeNote, detectChallenge, detectSilentPage } from "./challenge.js";
 import { renderSnapshot, renderSnapshotDiff } from "./snapshot-render.js";
+import * as runtimeState from "./runtime-state.js";
 /**
  * Render one diagnostics payload as one line per entry. Diagnostics are read when
  * something already looks wrong, so the compact form matters more than the rich
@@ -134,7 +135,7 @@ export function snapshotValue(snapshot) {
                     ']: ' +
                     challenge.hint +
                     '.\n' +
-                    CHALLENGE_NOTE +
+                    challengeNote(runtimeState.getEffectiveHeadless(true)) +
                     '\n\n' +
                     tree) +
             diffBlock,

package/lib/tool.js

@@ -1,7 +1,7 @@
 import z from '@deepseek-ai/schemastery';
 import { defineTool } from '@deepseek-ai/dsh-tools';
 import { BlockAssembler, createUserMessage } from '@deepseek-ai/dsh-llm';
-import { BrowserError } from "./errors.js";
+import { BrowserError, cdpDisabled, evaluateDisabled } from "./errors.js";
 import { registeredSuffixes } from "./contract.js";
 import { getEnabled, publishGates, publishLoginSites } from "./runtime-state.js";
 import { summarizeLoginSites } from "./login-sites.js";
@@ -58,12 +58,17 @@ export function apply(ctx, config) {
     // Tell the Settings page what is actually in effect. It cannot read this
     // config itself (the value may come from a bundle patch, a profile patch or a
     // home-level patch), so the tool family publishes it at registration and the
-    // switch shows the truth instead of a guess. Driven by the same values that
-    // decided which tools register, so the two can never disagree.
+    // switch shows the truth instead of a guess.
+    //
+    // These are the CAPABILITY values, not `registered.has(...)`: the session
+    // layer enforces the switch too, and `registerDisabledTools` deliberately
+    // registers a switched-off tool so the model can discover it. Reading
+    // registration as permission published "on" for a gate that was off — the
+    // settings card showed a switch that was not there.
     publishGates({
-        allowEvaluate: registered.has('evaluate'),
-        allowCdp: registered.has('cdp'),
-        diagnostics: registered.has('console_messages'),
+        allowEvaluate: config.allowEvaluate,
+        allowCdp: config.allowCdp,
+        diagnostics: config.diagnostics,
     });
     /** Register one gated tool only when this configuration keeps it live. */
     const registerMaybe = (suffix, definition) => {
@@ -547,7 +552,7 @@ export function apply(ctx, config) {
         },
         async execute(args, exec) {
             if (!config.allowEvaluate) {
-                throw new BrowserError('EVALUATE_DISABLED', 'browser_evaluate is disabled; set allowEvaluate: true on the browser-tool plugin to enable arbitrary page JavaScript');
+                throw evaluateDisabled();
             }
             const session = await acquire(exec);
             return (await session.evaluate(args.expression, exec.signal));
@@ -583,7 +588,7 @@ export function apply(ctx, config) {
         },
         async execute(args, exec) {
             if (!config.allowCdp) {
-                throw new BrowserError('CDP_DISABLED', 'browser_cdp is disabled; set allowCdp: true on the browser-tool plugin to enable raw CDP inspection commands');
+                throw cdpDisabled();
             }
             if (!isCdpMethodAllowed(args.method)) {
                 throw new BrowserError('CDP_DENIED', cdpDenialMessage(args.method));

package/lib/url-policy.d.ts

@@ -1,2 +1,15 @@
+/**
+ * Is this host inside the allow-list? Empty list means "any host".
+ *
+ * Suffix matching is deliberately anchored one level down: `example.com`
+ * admits `example.com` and `a.example.com`, never `notexample.com` and never
+ * `example.com.evil.net`. A configured entry is compared after
+ * normalisation (lower case, leading dot dropped), because a user writing
+ * `.example.com` means the domain, not a subdomain literally named "example".
+ * @param host - hostname to test, e.g. "a.example.com".
+ * @param allowedDomains - configured suffixes; empty means everything passes.
+ * @returns true when the host is allowed.
+ */
+export declare function isHostAllowed(host: string, allowedDomains: readonly string[]): boolean;
 /** Validate one absolute URL against the navigation policy. */
 export declare function assertAllowedUrl(raw: string, allowedDomains: readonly string[]): URL;

package/lib/url-policy.js

@@ -3,6 +3,29 @@
  * @module dsh-browser-playwright-codex/url-policy
  */
 import { BrowserError } from "./errors.js";
+/**
+ * Is this host inside the allow-list? Empty list means "any host".
+ *
+ * Suffix matching is deliberately anchored one level down: `example.com`
+ * admits `example.com` and `a.example.com`, never `notexample.com` and never
+ * `example.com.evil.net`. A configured entry is compared after
+ * normalisation (lower case, leading dot dropped), because a user writing
+ * `.example.com` means the domain, not a subdomain literally named "example".
+ * @param host - hostname to test, e.g. "a.example.com".
+ * @param allowedDomains - configured suffixes; empty means everything passes.
+ * @returns true when the host is allowed.
+ */
+export function isHostAllowed(host, allowedDomains) {
+    if (allowedDomains.length === 0)
+        return true;
+    const target = host.toLowerCase();
+    return allowedDomains.some((raw) => {
+        const suffix = raw.trim().toLowerCase().replace(/^\.+/, '');
+        if (suffix === '')
+            return false;
+        return target === suffix || target.endsWith('.' + suffix);
+    });
+}
 /** Validate one absolute URL against the navigation policy. */
 export function assertAllowedUrl(raw, allowedDomains) {
     let parsed;
@@ -17,8 +40,7 @@ export function assertAllowedUrl(raw, allowedDomains) {
     }
     if (allowedDomains.length > 0) {
         const host = parsed.hostname.toLowerCase();
-        const allowed = allowedDomains.some((suffix) => host === suffix || host.endsWith('.' + suffix));
-        if (!allowed) {
+        if (!isHostAllowed(host, allowedDomains)) {
             throw new BrowserError('URL_NOT_ALLOWED', 'host ' + parsed.hostname + ' is not in allowedDomains');
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-browser-playwright-codex",
-  "version": "0.7.2",
+  "version": "0.7.5",
   "description": "Browser automation for DeepSeek Harness, one plugin: fill in forms, scrape lists and work across tabs in real pages, using the logins you already have. Runs in a visible window that stays quiet when minimised; native dialogs are parked instead of confirmed, CAPTCHA pages are flagged with a note that says stop and hand the page back, password / one-time-code / card fields are refused by browser_fill, and the Settings card (enable/disable, page-reading mode, capability gates) now lives inside this package.",
   "license": "MIT",
   "type": "module",

package/scripts/dsh-browser-verify.mjs

@@ -28,7 +28,7 @@ import path from 'node:path'
 import { PlaywrightProvider } from '../lib/provider.js'
 import { Config as ConfigSchema } from '../lib/config.js'
 import { renderSnapshot } from '../lib/snapshot-render.js'
-import { getEffectiveEngine, setSnapshotEngine } from '../lib/runtime-state.js'
+import { getEffectiveEngine, publishGates, setSnapshotEngine } from '../lib/runtime-state.js'
 
 // 验收必须只看代码，不看这台机器上用户的选择。
 // 设置页的「页面识别方式」存在 ~/.dsh/dsh-browser-playwright.state.json，运行时状态层
@@ -128,6 +128,36 @@ const provider = new PlaywrightProvider(
 )
 const session = await provider.acquire('verify')
 
+// ---------------------------------------------------------------------------
+// [0] 门禁在代码层也成立（2026-10-26 之前的漏洞：开关只在工具层挡）
+// ---------------------------------------------------------------------------
+// 本脚本不经过工具层，直接调 session —— 正是当初绕过门禁的那条路。默认（没发布门禁）
+// 必须拒绝；确认之后再把门禁打开，好让后面的用例能读页面状态。
+console.log('[0] 门禁：没开门禁时代码层也拒绝')
+let evaluateGate = ''
+try {
+  await session.evaluate('1 + 1')
+} catch (e) {
+  evaluateGate = e.code
+}
+check('evaluate 未开门禁时报 EVALUATE_DISABLED', evaluateGate === 'EVALUATE_DISABLED', evaluateGate)
+let cdpGate = ''
+try {
+  await session.cdp('DOM.getDocument', { depth: 1 })
+} catch (e) {
+  cdpGate = e.code
+}
+check('cdp 未开门禁时报 CDP_DISABLED', cdpGate === 'CDP_DISABLED', cdpGate)
+publishGates({ allowEvaluate: true, allowCdp: true, diagnostics: true })
+let cdpDenied = ''
+try {
+  // 门禁打开也仍然要过白名单：Runtime.evaluate 是任意页面 JS，永远不在名单里。
+  await session.cdp('Runtime.evaluate', { expression: 'document.cookie', returnByValue: true })
+} catch (e) {
+  cdpDenied = e.code
+}
+check('开门禁后 Runtime.evaluate 仍报 CDP_DENIED', cdpDenied === 'CDP_DENIED', cdpDenied)
+
 console.log('[1] 快照取名与折叠')
 const s0 = await session.navigate(URL_, 'load')
 const tree = renderSnapshot(s0)
@@ -366,6 +396,9 @@ const expectedTools = contractMod.registeredToolNames(toolConfig.toolPrefix, {
   registerDisabledTools: toolConfig.registerDisabledTools,
 })
 const byName = (n) => reg.find((t) => t.name === n)
+// apply() 会把有效门禁刷成这份配置里的值（这里出厂默认是关），而下面的用例直接调
+// session 而不是走工具层，所以再打开一次。
+publishGates({ allowEvaluate: true, allowCdp: true, diagnostics: true })
 check('存在 browser_dialog', byName('browser_dialog') !== undefined)
 check(
   'browser_dialog 有 accept 参数',