dsh-browser-playwright-codex 0.7.4 → 0.7.5

package/CHANGELOG.md

@@ -1,3 +1,36 @@
+## 0.7.5 — 2026-10-26
+
+一句话摘要：**两条安全洞补上，同时唤醒不再多开浏览器** —— 白名单从"门口打一次勾"变成"装在浏览器的请求上"，`allowEvaluate` / `allowCdp` 从工具层下沉到会话层（绕过工具直接拿服务也拒），两个任务同时要浏览器时共用一次启动，默认持久化模式下「最多几个会话」也真的算数了。
+
+### Fixed
+
+- **白名单可被绕过（安全）**：入口检查只覆盖 `navigate` / 带 `href` 的点击 / 切标签 / 开标签，页面自己 `location.href='外站'`、meta refresh、`<form action="外站">` 提交、网页自开的弹窗全都绕得过去。实测把名单设成 `127.0.0.1` 后，页面脚本一跳就落在了 `localhost` 上。现在新增 `src/navigation-guard.ts`，把名单**装在这个浏览器 context 的请求上**：发往名单外主机的**导航**当场掐断并报 `URL_NOT_ALLOWED`，**数据请求**（`fetch` / `xhr` / `EventSource`）同样掐断；`script` / 图片 / CSS / 字体 / 媒体这类渲染资源放行，否则页面只会看起来是坏的。空名单（默认）完全不接管路由，所以默认行为一个字没变。
+- **302 跳转是请求拦截看不见的那一跳**：Chromium 在它自己的网络栈里跟随重定向，`context.route()` 根本不会为那一跳触发（实测）。所以每个动作收尾时还会核对页面**最终落在哪个主机**——落在名单外就报 `URL_NOT_ALLOWED`，并把标签页重置成 `about:blank`，绝不留一个可以继续驱动的越界页面。
+- **evaluate / CDP 的开关只在工具层挡（安全）**：此前只有 `tool.ts` 检查 `allowEvaluate` / `allowCdp`，任何拿到浏览器服务的代码（兄弟插件、脚本）都能直接调 `session.evaluate` 跑任意页面 JS，或用 `session.cdp` 发白名单外的 `Runtime.evaluate`（两条都实测跑通）。现在 `session.evaluate` / `session.cdp` 自己就拒（`EVALUATE_DISABLED` / `CDP_DISABLED`），CDP 还要再过一道白名单（`CDP_DENIED`）。**没发布过的门禁算关闭**——部署没说「可以」就是「不可以」。
+- **两个任务同时唤醒会多开浏览器**：`ensureContext` / `ensureBrowser` 没有在途合并，两个会话同时醒来都看到"还没有 context"，于是各自 `launchPersistentContext` 同一个 profile。实测后果比"多开"更难看：第二个死在 Chrome 的单例锁上，恢复流程**把正在运行的那个浏览器的锁文件删了**，而调用方收到的错误是「你没装浏览器」——锁被删正是之后关不干净、残留进程的来路。现在并发调用共享同一次启动，并且在途启动结束就清空；恢复路径也不再动活浏览器的锁文件。
+- **`maxSessions` 在默认（持久化）模式不生效**：这个上限只写在非持久化分支里，而默认就是持久化模式，所以形同虚设。现在它按**会话句柄**生效：最久没用、且当前没有操作在跑的句柄会被回收，共用窗口一动不动，那个 owner 下次拿到一个新句柄（同一批标签页，索引回到 0）。顺便修掉 `browser-lifecycle.ts` 一处复制粘贴多出来的重复赋值。
+- **设置卡可能把关闭的门禁显示成开着**：`publishGates` 原来上报的是「工具是否注册」，而 `registerDisabledTools: true` 会故意把关着的工具也注册（好让模型能发现它并读到说明），于是卡片把关闭的能力显示为开启。现在上报的是能力值本身。
+
+### Added
+
+- **`src/navigation-guard.ts`**：名单的请求层实现，含"文档请求 / 数据请求 / 渲染资源"三分类与拒绝记录。
+- **公开导出（只增不减）**：`isHostAllowed`、`installHostGuard`、`BlockedRequest`、`evaluateDisabled`、`cdpDisabled`。
+- **`tests/host-guard.test.ts`（4 条，真浏览器）**：空名单不插手（默认行为不变）、302 越界被拒并报出主机名、页面自己跳转永远到不了名单外、`fetch` 到名单外**服务器一个请求都没收到**。
+- **`tests/gates-enforcement.test.ts`（5 条，不需要浏览器）**：没发布门禁时 `evaluate` / `cdp` 都拒、开了 CDP 门禁 `Runtime.evaluate` 仍被白名单拒、门禁开关对会话层依旧权威、`getGates()` 报的是能力值。
+- **`tests/concurrency.test.ts`（3 条，真浏览器）**：三个会话同时唤醒共用一个窗口、两个会话同时唤醒共用一个浏览器、持久化模式下 `maxSessions` 按 LRU 回收句柄且窗口不动。
+- **随包验收新增 `[0]` 段（3 条）**：不经工具层直接调 `session.evaluate` / `session.cdp` 必须被拒；开了门禁后 `Runtime.evaluate` 仍报 `CDP_DENIED`。
+
+### Changed
+
+- **行为变化**：代码层调用 `evaluate` / `cdp` 现在也要过门禁，且未发布门禁 = 关闭。走工具层的老路径行为不变（工具层先给出同样口径的错误）。
+- **`allowedDomains` 的语义收紧**：填了名单，就不再只是"插件不去"，而是"这个浏览器不去"。
+- 三个测试文件（`provider` / `regressions` / `scenarios`，另加 `live-smoke`）显式发布门禁——它们本来就直接调 `session.evaluate`，等于把自己声明成"开了开关的部署"。
+
+### Tests
+
+- 全套 243 → **255 条**（+12）：通过 252、跳过 3、失败 0。
+- `npm run verify` 57 → **60 项**：`[0]` 段三条是新增的门禁回归闸。
+
 ## 0.7.4 — 2026-10-23
 
 一句话摘要：**设置卡可以切换有头 / 无头** —— 运行时开关，不用改 YAML、不用重启 DSH；切换在**下一次操作**时生效（先导出登录态，再按新模式重开窗口）。默认仍是有头。

package/README.md

@@ -232,7 +232,7 @@ All tunables are patchable through the profile's `cordis.patch.yml` (later layer
         ignoreHTTPSErrors: false
       allowedDomains: []                  # e.g. ['github.com'] restricts navigation
       idleTimeoutMs: 0                    # shipped value: never auto-close (schema default 600000 = 10 min)
-      maxSessions: 8                      # LRU eviction (persistent mode: one window)
+      maxSessions: 8                      # live-session cap; persistent mode caps handles, still one window
       snapshot:
         engine: legacy                    # 'legacy' (default) or 'aria' (Playwright ariaSnapshot, refs aligned back)
         maxNodes: 500                     # token budget per snapshot tree
@@ -330,7 +330,7 @@ npm install
 npm test           # full suite: engine/action integration on real Chrome, policy, rendering,
                    # schema assembly, plus the realistic scenario suites below
 npm run verify     # naming/folding + click/hover/dialog acceptance; self-contained, prints its own count
-                   # (57 in a checkout; from an npm install it prints 56 + "1 skipped", because the
+                   # (60 in a checkout; from an npm install it prints 59 + "1 skipped", because the
                    #  `lib/`-vs-`src/` check has no `src/` to compare against)
 npm run verify:live  # same, plus a live sample of a real page (needs network)
 npm run doctor     # does the installed harness still export everything this plugin imports?
@@ -426,7 +426,7 @@ links below go to GitHub rather than to files inside the package:
 - **Headless servers must opt in** — the bundle defaults to `headless: false`; on a headless/remote host set `launch.headless: true`.
 - **Selector-free, not vision-free** — interaction is a11y-tree based; purely visual widgets (canvas, WebGL, custom-drawn controls) may expose no refs. `browser_screenshot` + an image-capable model is the fallback.
 - **Cross-origin iframes** appear as leaf `(frame)` nodes without refs; same-origin frames are walked up to two levels deep.
-- **Evaluate gate is config, not approval** — enabling `allowEvaluate` trusts the model with arbitrary page JavaScript; compose it with the harness approval/permission policy for stricter control.
+- **Evaluate gate is config, not approval** — enabling `allowEvaluate` trusts the model with arbitrary page JavaScript; compose it with the harness approval/permission policy for stricter control. The gate is enforced in **two** places: `tool.ts` refuses before a browser is even launched, and the session itself refuses too (`EVALUATE_DISABLED` / `CDP_DISABLED`), so a sibling plugin or a script holding the browser service cannot go around it. A gate that was never published counts as **off**. `browser_cdp` additionally passes the CDP allow-list at the session layer, so `Runtime.evaluate` is rejected even with the switch on.
 - **The package ships both power gates OFF, and that is deliberate** — `cordis.patch.yml` is part of the package, so anything it enables is enabled for *everyone who installs this*. It therefore sets `allowEvaluate: false` and `allowCdp: false` (the code defaults), and each deployment opts in through its **own profile patch** (`~/.dsh/profiles/<name>/cordis.patch.yml`). A package that shipped them on would be handing every installer a backdoor they never asked for. Snippet:
   ```yaml
   # dsh replaces an entry's config object wholesale — list every key you rely on.
@@ -444,7 +444,7 @@ links below go to GitHub rather than to files inside the package:
 - **`launch.viewport` only applies headless** — the visible window is a real window: it tracks the desktop size (`browser-lifecycle.ts` passes `viewport: null` in headful), so setting 1280×800 there changes nothing. Pin the size by running `headless: true`, or resize the window itself.
 - **Chromium family only** — Firefox/WebKit channels are not probed; providers are swappable if another engine is needed.
 - **Extract needs a dedicated model route** — it does not reuse the main request's route; misconfiguration fails loudly at call time.
-- **JS-driven navigations are not statically checkable** — `allowedDomains` covers `browser_navigate`, `browser_open_tab`, every navigating click (`browser_click`: `ref`, `text`, `precise` and raw-coordinate modes) and `browser_switch_tab`; `mode: "hover"` reveals content without activating anything, so it is not checked against the URL policy. A button whose handler runs `location.href = …` can still leave the allowed hosts, and so can a `<form>` whose `action` points at another host (pressing its submit button is a navigation this check does not statically see), and a tab that is already sitting on a disallowed host stays open (the agent simply refuses to drive it); deploy an external network guard for hard isolation.
+- **`allowedDomains` is enforced on the wire, not just at the entry points** — the host list is installed on the browser context itself (`navigation-guard.ts`), so a navigation nobody vetted is refused by the browser: `location.href = …`, `meta refresh`, a `<form>` posting to another host and a page-opened popup all stop at the request. Data requests (`fetch` / `xhr` / `EventSource`) to a host outside the list are refused too, so page script cannot move data off-site; rendering assets (script / image / CSS / font / media) are left alone, because blocking them only makes a page look broken. `browser_navigate`, `browser_open_tab`, every navigating click and `browser_switch_tab` still check first — that is what produces the friendly error before anything happens. One case needs a second look, because Chromium follows a redirect inside its own network stack where request interception never sees the hop: after every action the page's final URL is checked, and a landing outside the list is refused with `URL_NOT_ALLOWED` and the tab is reset to `about:blank`. Entry-point checks remain as the second layer for a tab that already existed on a disallowed host (a profile from an older version): the agent simply refuses to drive it. For hard isolation from the whole host stack, still deploy an external network guard.
 - **Stability waits are bounded by design** — a perpetually animating element falls back to a forced click on its current rect rather than stalling; a page that never settles is snapshotted after the cap. This is intentional: the agent must never hang.
 - **Challenge detection reads the responses it has actually seen** — the response-header tier applies to a document response this session observed after it attached to the tab. A tab that was already sitting on a challenge page when the session took it over falls through to the widget and wording tiers and, failing those, to the no-progress backstop: it reports a *possible* wall instead of guessing the vendor. A page that is not recognised still never goes silent: a non-2xx document carries an `[http NNN]` note, and a page with no clickable elements and almost no text carries a `[nothing here]` note.
 
@@ -454,7 +454,7 @@ The scenario suites originally surfaced four hazards, now fixed and regression-t
 
 - **Stale refs fail fast** — refs carry a per-snapshot nonce, so after a client-side re-render a stale ref matches nothing and `browser_click` fails with `REF_NOT_FOUND` instead of silently acting on a different element.
 - **Link clicks respect `allowedDomains`** — every click path is checked before any input is delivered: `browser_click` — ref mode (the element's `href`), `precise` ref mode, and raw-coordinate mode (the enclosing link found at the point). A disallowed host is rejected with `URL_NOT_ALLOWED`. `javascript:` links are exempt because they run in-page and navigate nowhere; other non-http(s) schemes stay refused.
-- **A page-opened tab outside `allowedDomains` cannot be driven** — a page can open a tab itself (`target="_blank"`, `window.open`) and the plugin never sees that navigation, so the policy is applied where it can be: `browser_switch_tab` refuses to enter such a tab (the current tab is kept, the tab itself stays open for the user).
+- **A page-opened tab outside `allowedDomains` cannot be driven** — two layers: the request-level guard refuses the popup's document (so it never loads the disallowed host), and `browser_switch_tab` still refuses to enter a tab that already sits on one (the current tab is kept).
 - **Idle disposal defers during operations** — a navigation slower than `idleTimeoutMs` completes normally; disposal only fires when the session is truly idle.
 - **Mid-navigation snapshots settle** — a `browser_snapshot` racing a JS navigation waits for the new document and retries instead of surfacing a raw "Execution context was destroyed" error.
 

package/SECURITY.md

@@ -114,7 +114,7 @@ Two honest notes:
 npm test          # 219 tests: contracts, tool schemas, scenarios,
                   # aria engine, CDP policy, diff, click/tab allow-lists, snapshot rendering,
                   # prompt budget, docs-vs-reality consistency
-npm run verify    # 57 self-contained acceptance checks in a checkout (56 checks + 1 skipped
+npm run verify    # 60 self-contained acceptance checks in a checkout (59 checks + 1 skipped
                   # from an npm install, where there is no src/): no DSH, no network, local fixture server
 npm run doctor    # the host packages this plugin imports are still exporting what it uses
 npm run cost      # resident prompt cost of the registered tool surface

package/lib/browser-lifecycle.d.ts

@@ -4,9 +4,21 @@ import type { PlaywrightProvider } from './provider.ts';
  * profile-backed window is launched once and reused until closed by the
  * last owner, idle disposal, or an external close; login state lives in
  * the profile plus the exported state file, so reopening is seamless.
+ *
+ * Concurrent callers share ONE launch. Without this, two sessions waking up at
+ * the same moment both saw "no context" and both called launchPersistentContext
+ * on the same profile directory: the loser died on Chrome's profile singleton,
+ * the recovery path deleted the running browser's lock files, and the caller was
+ * told "install a Chromium-family browser" (measured 2026-10-26).
  */
 export declare function ensureContext(provider: PlaywrightProvider): Promise<import("playwright-core").BrowserContext>;
 /** Remove stale Chrome singleton lock files inside the profile directory. */
 export declare function clearChromeLocks(provider: PlaywrightProvider): Promise<void>;
-/** Launch the browser once, probing the configured or auto-detected channel. */
+/**
+ * Launch the browser once, probing the configured or auto-detected channel.
+ *
+ * Concurrent callers share one launch, for the same reason ensureContext does:
+ * otherwise two sessions wake up, both see `browser === undefined`, and two
+ * browsers are launched (the reported "两个任务同时唤醒会多开浏览器").
+ */
 export declare function ensureBrowser(provider: PlaywrightProvider): Promise<import("playwright-core").Browser>;

package/lib/browser-lifecycle.js

@@ -14,8 +14,26 @@ import { BrowserError, launchFailed } from "./errors.js";
  * profile-backed window is launched once and reused until closed by the
  * last owner, idle disposal, or an external close; login state lives in
  * the profile plus the exported state file, so reopening is seamless.
+ *
+ * Concurrent callers share ONE launch. Without this, two sessions waking up at
+ * the same moment both saw "no context" and both called launchPersistentContext
+ * on the same profile directory: the loser died on Chrome's profile singleton,
+ * the recovery path deleted the running browser's lock files, and the caller was
+ * told "install a Chromium-family browser" (measured 2026-10-26).
  */
 export async function ensureContext(provider) {
+    const inFlight = provider.contextLaunch;
+    if (inFlight !== undefined)
+        return await inFlight;
+    const launch = launchContext(provider).finally(() => {
+        if (provider.contextLaunch === launch)
+            provider.contextLaunch = undefined;
+    });
+    provider.contextLaunch = launch;
+    return await launch;
+}
+/** The actual launch, shared by every concurrent {@link ensureContext} caller. */
+async function launchContext(provider) {
     if (provider.context !== undefined) {
         try {
             const browser = provider.context.browser();
@@ -60,14 +78,19 @@ export async function ensureContext(provider) {
             provider.launchedHeadless = headless;
         }
         catch (error) {
-            // A stale Chrome singleton lock from a dirty shutdown breaks a
-            // relaunch into the same profile; clear the lock files and
-            // retry once before surfacing the failure.
+            // Another launch may have won while this one was starting (an explicit
+            // `dispose()` racing a fresh acquire, a second provider on the same
+            // profile). Hand back that window: clearing the lock files it is running
+            // on would let a later launch start a SECOND browser on this profile.
+            if (provider.context !== undefined)
+                return provider.context;
+            // A stale Chrome singleton lock from a dirty shutdown breaks a relaunch
+            // into the same profile; clear the lock files and retry once before
+            // surfacing the failure.
             if (error instanceof Error && /user data directory|SingletonLock|ProcessSingleton/i.test(error.message)) {
                 await provider.clearChromeLocks();
                 provider.context = await chromium.launchPersistentContext(provider.profileDir, { ...baseOptions, ...extra });
                 provider.launchedHeadless = headless;
-                provider.launchedHeadless = headless;
             }
             else {
                 throw error;
@@ -95,6 +118,9 @@ export async function ensureContext(provider) {
         catch {
             /* malformed state file must not block startup */
         }
+        // Allow-list on the wire: registered before the first navigation, so a
+        // page cannot leave the list by itself (navigation-guard.ts).
+        await provider.installHostGuard(ctx);
         await ctx.addInitScript(SNAPSHOT_SCRIPT);
         // The initial blank page predates addInitScript: reload so the
         // snapshot engine and restored localStorage apply on first use.
@@ -147,8 +173,26 @@ export async function clearChromeLocks(provider) {
         }
     }
 }
-/** Launch the browser once, probing the configured or auto-detected channel. */
+/**
+ * Launch the browser once, probing the configured or auto-detected channel.
+ *
+ * Concurrent callers share one launch, for the same reason ensureContext does:
+ * otherwise two sessions wake up, both see `browser === undefined`, and two
+ * browsers are launched (the reported "两个任务同时唤醒会多开浏览器").
+ */
 export async function ensureBrowser(provider) {
+    const inFlight = provider.browserLaunch;
+    if (inFlight !== undefined)
+        return await inFlight;
+    const launch = launchBrowser(provider).finally(() => {
+        if (provider.browserLaunch === launch)
+            provider.browserLaunch = undefined;
+    });
+    provider.browserLaunch = launch;
+    return await launch;
+}
+/** The actual launch, shared by every concurrent {@link ensureBrowser} caller. */
+async function launchBrowser(provider) {
     if (provider.browser !== undefined)
         return provider.browser;
     const { executablePath, channel } = provider.config.launch;

package/lib/errors.d.ts

@@ -23,3 +23,15 @@ export declare class BrowserError extends Error {
 }
 /** Wrap an unknown cause into a launch failure with the code preserved. */
 export declare function launchFailed(cause: unknown): BrowserError;
+/**
+ * "browser_evaluate is switched off". One wording, thrown by both layers that
+ * enforce it: the tool layer (before a browser is even launched) and the
+ * session itself (so a programmatic caller cannot go around the switch).
+ * @returns the denial, ready to throw.
+ */
+export declare function evaluateDisabled(): BrowserError;
+/**
+ * "browser_cdp is switched off". Same two-layer rule as {@link evaluateDisabled}.
+ * @returns the denial, ready to throw.
+ */
+export declare function cdpDisabled(): BrowserError;

package/lib/errors.js

@@ -19,3 +19,19 @@ export function launchFailed(cause) {
     const detail = cause instanceof Error ? cause.message : String(cause);
     return new BrowserError('BROWSER_LAUNCH_FAILED', 'failed to launch the browser: ' + detail);
 }
+/**
+ * "browser_evaluate is switched off". One wording, thrown by both layers that
+ * enforce it: the tool layer (before a browser is even launched) and the
+ * session itself (so a programmatic caller cannot go around the switch).
+ * @returns the denial, ready to throw.
+ */
+export function evaluateDisabled() {
+    return new BrowserError('EVALUATE_DISABLED', 'browser_evaluate is disabled; set allowEvaluate: true on the browser-tool plugin to enable arbitrary page JavaScript');
+}
+/**
+ * "browser_cdp is switched off". Same two-layer rule as {@link evaluateDisabled}.
+ * @returns the denial, ready to throw.
+ */
+export function cdpDisabled() {
+    return new BrowserError('CDP_DISABLED', 'browser_cdp is disabled; set allowCdp: true on the browser-tool plugin to enable raw CDP inspection commands');
+}

package/lib/index.d.ts

@@ -4,7 +4,7 @@
  * session-scoped browser contexts, screenshots as attachments.
  * @module dsh-browser-playwright-codex
  */
-export { BrowserError, launchFailed } from './errors.ts';
+export { BrowserError, cdpDisabled, evaluateDisabled, launchFailed } from './errors.ts';
 export type { BrowserErrorCode } from './errors.ts';
 export { ALWAYS_ON_SUFFIXES, ERROR_CODES, GATED_SUFFIXES, TOOL_SUFFIXES, registeredSuffixes, registeredToolNames, toolNames, } from './contract.ts';
 export type { ToolSuffix, ToolSurfaceConfig } from './contract.ts';
@@ -15,7 +15,9 @@ export type { SnapshotOptions, PageDataOptions } from './injected.ts';
 export { default as BrowserRuntime } from './service.ts';
 export type { BrowserRuntimeConfig } from './service.ts';
 export { PlaywrightProvider } from './provider.ts';
-export { assertAllowedUrl } from './url-policy.ts';
+export { assertAllowedUrl, isHostAllowed } from './url-policy.ts';
+export { installHostGuard } from './navigation-guard.ts';
+export type { BlockedRequest } from './navigation-guard.ts';
 export { Config as PlaywrightConfigSchema } from './config.ts';
 export type { PlaywrightConfig, PageData } from './config.ts';
 export type { BrowserNode, BrowserProvider, BrowserSession, BrowserSnapshot, LoadState, ScreenshotCapture, TabInfo, } from './types.ts';

package/lib/index.js

@@ -4,13 +4,14 @@
  * session-scoped browser contexts, screenshots as attachments.
  * @module dsh-browser-playwright-codex
  */
-export { BrowserError, launchFailed } from "./errors.js";
+export { BrowserError, cdpDisabled, evaluateDisabled, launchFailed } from "./errors.js";
 export { ALWAYS_ON_SUFFIXES, ERROR_CODES, GATED_SUFFIXES, TOOL_SUFFIXES, registeredSuffixes, registeredToolNames, toolNames, } from "./contract.js";
 export { CallId, toolCallId } from "./compat.js";
 export { SNAPSHOT_SCRIPT } from "./injected.js";
 export { default as BrowserRuntime } from "./service.js";
 export { PlaywrightProvider } from "./provider.js";
-export { assertAllowedUrl } from "./url-policy.js";
+export { assertAllowedUrl, isHostAllowed } from "./url-policy.js";
+export { installHostGuard } from "./navigation-guard.js";
 export { Config as PlaywrightConfigSchema } from "./config.js";
 // Single loader row (2026-10-19): the package root is the plugin. The three
 // sub-entries below stay importable, but the loader mounts this one.

package/lib/navigation-guard.d.ts

@@ -0,0 +1,48 @@
+/**
+ * 白名单的网络层守卫：把「只能访问这些站点」变成**路上的一道闸**，而不是只在调用入口
+ * 打一次勾。
+ *
+ * 起因（2026-10-26 实测）：入口检查只覆盖 navigate / 点击带 href 的链接 / 切标签 / 开标签。
+ * 页面自己 `location.href = 'http://别的站点'`、meta refresh、302 跳转、表单提交，全都
+ * 绕过白名单——实测把名单设成 `127.0.0.1` 后，页面脚本一跳就落在了 `localhost` 上。
+ * 入口检查在这里永远追不上：那些导航不是插件发起的。
+ *
+ * 做法：接管这个 context 的每一条请求（context.route），按主机名判定。
+ *   - **文档请求**（导航、iframe）：不在名单里 → 掐断，并记下来。调用方在动作收尾时
+ *     用它把「我点了但页面没动」变成一条明确的 URL_NOT_ALLOWED，而不是一次静默。
+ *   - **数据请求**（xhr / fetch / eventsource）：不在名单里 → 掐断。页面脚本不该拿着
+ *     这个浏览器的身份去白名单外的站点取数据。
+ *   - 其余子资源（script / img / css / font / media）：放行。它们几乎是页面渲染的刚需
+ *     （CDN、头像、字体），且不带目标站点的凭据；拦掉只会让页面看起来是坏的。
+ *
+ * 只在配置了名单时才接管：空名单的语义是「任意站点」，此时接管路由纯属拖慢每一页
+ * （Playwright 的路由会关掉 HTTP 缓存）。
+ *
+ * @module dsh-browser-playwright-codex/navigation-guard
+ */
+import type { BrowserContext } from 'playwright-core';
+/** One request the guard refused, in the shape callers report it. */
+export interface BlockedRequest {
+    /** Full requested URL. */
+    url: string;
+    /** Hostname that was not in the allow-list. */
+    host: string;
+    /** Playwright resourceType: document, xhr, script, … */
+    resourceType: string;
+    /** True for a navigation-level block (a document request). */
+    document: boolean;
+    /** Epoch milliseconds. */
+    at: number;
+}
+/**
+ * Refuse every request to a host outside the allow-list for one context.
+ *
+ * Installed once per context, before the first navigation. When the configured
+ * list is empty nothing is installed: "any host" must not pay the routing cost.
+ * @param context - the context to guard.
+ * @param allowedDomains - reads the live allow-list.
+ * @param onBlocked - called for each refused request; the caller keeps the last
+ *   document-level block and turns it into an error for the action that caused it.
+ * @returns true when a guard was installed, false when the list is empty.
+ */
+export declare function installHostGuard(context: BrowserContext, allowedDomains: () => readonly string[], onBlocked: (blocked: BlockedRequest) => void): Promise<boolean>;

package/lib/navigation-guard.js

@@ -0,0 +1,48 @@
+import { isHostAllowed } from "./url-policy.js";
+/** Resource types that carry data off the page and are refused outside the allow-list. */
+const DATA_RESOURCE_TYPES = new Set(['xhr', 'fetch', 'eventsource']);
+/**
+ * Refuse every request to a host outside the allow-list for one context.
+ *
+ * Installed once per context, before the first navigation. When the configured
+ * list is empty nothing is installed: "any host" must not pay the routing cost.
+ * @param context - the context to guard.
+ * @param allowedDomains - reads the live allow-list.
+ * @param onBlocked - called for each refused request; the caller keeps the last
+ *   document-level block and turns it into an error for the action that caused it.
+ * @returns true when a guard was installed, false when the list is empty.
+ */
+export async function installHostGuard(context, allowedDomains, onBlocked) {
+    const domains = allowedDomains();
+    if (domains.length === 0)
+        return false;
+    await context.route('**/*', async (route) => {
+        const request = route.request();
+        let host;
+        try {
+            host = new URL(request.url()).hostname;
+        }
+        catch {
+            // Not a URL we can judge (data:, blob:, about:, chrome-extension: …).
+            // Neither a host nor a site the policy talks about: let the browser decide.
+            await route.continue().catch(() => { });
+            return;
+        }
+        if (isHostAllowed(host, allowedDomains())) {
+            await route.continue().catch(() => { });
+            return;
+        }
+        const resourceType = request.resourceType();
+        const document = resourceType === 'document';
+        // Sub-resources the page needs in order to render are left alone; only the
+        // request classes that move the user or move data are refused.
+        if (!document && !DATA_RESOURCE_TYPES.has(resourceType)) {
+            await route.continue().catch(() => { });
+            return;
+        }
+        if (document)
+            onBlocked({ url: request.url(), host, resourceType, document, at: Date.now() });
+        await route.abort('blockedbyclient').catch(() => { });
+    });
+    return true;
+}

package/lib/page-actions.js

@@ -121,6 +121,9 @@ export async function navigate(session, url, waitUntil, signal) {
         catch (error) {
             if (isAbortError(error) || signal?.aborted === true)
                 throw error;
+            // A redirect chain can leave the allow-list: the guard refuses the hop and
+            // Playwright reports a plain navigation failure. Name the real cause.
+            session.throwIfNavigationBlocked();
             throw asTimeoutError('navigation', error);
         }
         return session.settleAndSnapshot(page, true);
@@ -716,6 +719,7 @@ export async function back(session, signal) {
         catch (error) {
             if (isAbortError(error))
                 throw error;
+            session.throwIfNavigationBlocked();
             throw asTimeoutError('navigation', error);
         }
         return session.settleAndSnapshot(page, true);
@@ -730,6 +734,7 @@ export async function forward(session, signal) {
         catch (error) {
             if (isAbortError(error))
                 throw error;
+            session.throwIfNavigationBlocked();
             throw asTimeoutError('navigation', error);
         }
         return session.settleAndSnapshot(page, true);
@@ -776,6 +781,7 @@ export async function openTab(session, url, waitUntil, signal) {
         catch (error) {
             if (isAbortError(error))
                 throw error;
+            session.throwIfNavigationBlocked();
             throw asTimeoutError('navigation', error);
         }
         return session.settleAndSnapshot(page, true);

package/lib/page-snapshot.js

@@ -77,6 +77,11 @@ export async function settleAndSnapshot(session, page, navChanged) {
     });
     if (raced.blocked)
         return session.blockedSnapshot(page, raced.pending);
+    // A page can leave the allow-list without any entry-point check seeing it: the
+    // request-level guard catches self-started navigations, and this catches the
+    // redirect the browser followed on its own.
+    session.throwIfNavigationBlocked();
+    await session.assertCurrentUrlAllowed(page);
     return raced.value;
 }
 /**

package/lib/playwright.d.ts

@@ -11,6 +11,6 @@ export declare const inject: string[];
  */
 export { Config, type PageData, type PlaywrightConfig } from './config.ts';
 export { PlaywrightProvider } from './provider.ts';
-export { assertAllowedUrl } from './url-policy.ts';
+export { assertAllowedUrl, isHostAllowed } from './url-policy.ts';
 export { resolveSnapshotEngine } from './page-snapshot.ts';
 export declare function apply(ctx: Context, config: PlaywrightConfig): void;

package/lib/playwright.js

@@ -11,6 +11,8 @@
  *   page-snapshot.ts       capture, ref signatures, ref lookup
  *   page-diagnostics.ts    console messages, page errors, network records
  *   browser-lifecycle.ts   launching/reusing the persistent context, window state
+ *   window-focus.ts        is the window minimized / create a tab without raising it
+ *   navigation-guard.ts    the allow-list on the wire (refuses off-list requests)
  *   login-state.ts         exporting and restoring login state
  * @module dsh-browser-playwright-codex/playwright
  */
@@ -33,7 +35,7 @@ export const inject = ['browser'];
 // subpath stopped re-exporting it). The other names keep the pre-split public surface intact.
 export { Config } from "./config.js";
 export { PlaywrightProvider } from "./provider.js";
-export { assertAllowedUrl } from "./url-policy.js";
+export { assertAllowedUrl, isHostAllowed } from "./url-policy.js";
 export { resolveSnapshotEngine } from "./page-snapshot.js";
 export function apply(ctx, config) {
     const provider = new PlaywrightProvider(config);

package/lib/provider.d.ts

@@ -1,6 +1,7 @@
 import { type Browser, type BrowserContext, type Dialog, type Page } from 'playwright-core';
 import { PlaywrightSession } from './session.ts';
 import type { PlaywrightConfig } from './config.ts';
+import { type BlockedRequest } from './navigation-guard.ts';
 /**
  * Playwright-backed {@link BrowserProvider}: one shared browser, one context
  * per owner key, LRU eviction, idle disposal, ref-based snapshot interaction.
@@ -50,6 +51,26 @@ export declare class PlaywrightProvider {
     /** Owner that raised the dialog currently parked on a page. */
     lastActor: string | undefined;
     lastStatePersist: number;
+    /**
+     * Launch in flight, so two sessions waking up at the same time share ONE
+     * launch instead of racing for the same profile directory.
+     *
+     * Measured 2026-10-26: two concurrent acquires both saw "no context yet" and
+     * both called launchPersistentContext. The second died on Chrome's profile
+     * singleton, the recovery path deleted the RUNNING browser's lock files, and
+     * the caller got "install a Chromium-family browser". The lock files being
+     * gone is what let a later launch start a second browser on the same profile
+     * and leave processes behind.
+     */
+    contextLaunch: Promise<BrowserContext> | undefined;
+    /** Same for the legacy shared-browser launch. */
+    browserLaunch: Promise<Browser> | undefined;
+    /**
+     * The last navigation the host guard refused. Read (and cleared) once by the
+     * action that caused it, so "I clicked and nothing happened" becomes a named
+     * URL_NOT_ALLOWED instead of a silent no-op.
+     */
+    blockedNavigation: BlockedRequest | undefined;
     constructor(config: PlaywrightConfig);
     available(): boolean;
     /** Pages already carrying the dialog guard (WeakSet: pages stay collectable). */
@@ -98,6 +119,14 @@ export declare class PlaywrightProvider {
      */
     private relaunchIfModeChanged;
     acquire(owner: string): Promise<PlaywrightSession>;
+    /**
+     * Keep the number of tracked owner handles inside maxSessions in persistent
+     * mode. Handles share one window, so dropping the least recently used idle
+     * handle costs nothing the user can see; the owner gets a fresh handle on the
+     * same window next time. An owner with an operation in flight is never dropped.
+     * @param keep - the owner being acquired right now.
+     */
+    private evictIdleHandles;
     disposeOwner(owner: string): Promise<void>;
     dispose(): Promise<void>;
     /** Touch the entry's last-used clock and re-arm its idle timer. */
@@ -120,6 +149,19 @@ export declare class PlaywrightProvider {
     ensureContext(): Promise<BrowserContext>;
     /** Remove stale Chrome singleton lock files inside the profile directory. */
     clearChromeLocks(): Promise<void>;
+    /**
+     * Put the allow-list on the wire for one context: every navigation and every
+     * data request outside the list is refused from then on, whoever started it.
+     * See navigation-guard.ts for why the entry-point checks alone were not enough.
+     * @param context - freshly created context, before its first navigation.
+     */
+    installHostGuard(context: BrowserContext): Promise<void>;
+    /**
+     * Take the pending "a navigation was refused" record, if any. Consumed once:
+     * the next action must not inherit the previous action's refusal.
+     * @returns the refused navigation, or undefined.
+     */
+    takeBlockedNavigation(): BlockedRequest | undefined;
     /**
      * Collect the login-state fallback WITHOUT ever opening a page while the
      * window is put away.

package/lib/provider.js

@@ -10,10 +10,11 @@ import {} from 'playwright-core';
 import os from 'node:os';
 import path from 'node:path';
 import { PlaywrightSession } from "./session.js";
-import { getEffectiveHeadless, getEnabled, publishConfiguredEngine, publishLoginSites, } from "./runtime-state.js";
+import { getEffectiveHeadless, getEnabled, publishConfiguredEngine, publishLoginSites } from "./runtime-state.js";
 import { BrowserError } from "./errors.js";
 import { SNAPSHOT_SCRIPT } from "./injected.js";
 import { isWindowMinimized } from "./window-focus.js";
+import { installHostGuard } from "./navigation-guard.js";
 export class PlaywrightProvider {
     config;
     id = 'playwright';
@@ -37,6 +38,26 @@ export class PlaywrightProvider {
     /** Owner that raised the dialog currently parked on a page. */
     lastActor;
     lastStatePersist = 0;
+    /**
+     * Launch in flight, so two sessions waking up at the same time share ONE
+     * launch instead of racing for the same profile directory.
+     *
+     * Measured 2026-10-26: two concurrent acquires both saw "no context yet" and
+     * both called launchPersistentContext. The second died on Chrome's profile
+     * singleton, the recovery path deleted the RUNNING browser's lock files, and
+     * the caller got "install a Chromium-family browser". The lock files being
+     * gone is what let a later launch start a second browser on the same profile
+     * and leave processes behind.
+     */
+    contextLaunch = undefined;
+    /** Same for the legacy shared-browser launch. */
+    browserLaunch = undefined;
+    /**
+     * The last navigation the host guard refused. Read (and cleared) once by the
+     * action that caused it, so "I clicked and nothing happened" becomes a named
+     * URL_NOT_ALLOWED instead of a silent no-op.
+     */
+    blockedNavigation = undefined;
     constructor(config) {
         this.config = config;
         // Tell the settings card which page-reading mode this deployment was
@@ -215,6 +236,11 @@ export class PlaywrightProvider {
             // window (Codex-style). Entries are lightweight session handles on
             // the shared context; the last owner to leave closes the window.
             const context = await this.ensureContext();
+            // maxSessions applies here too, but as a cap on HANDLES: all of them
+            // drive the same window, so evicting one costs nothing visible and the
+            // owner simply gets a fresh handle (same page set, index back to 0) next
+            // time. Before this, the setting was inert in the default mode.
+            this.evictIdleHandles(owner);
             const session = new PlaywrightSession(this, owner, context);
             const entry = { context, session, lastUsed: Date.now(), pending: 0, timer: undefined };
             this.entries.set(owner, entry);
@@ -238,6 +264,8 @@ export class PlaywrightProvider {
             ignoreHTTPSErrors: this.config.launch.ignoreHTTPSErrors,
         });
         context.on('page', (page) => this.armDialogGuard(page));
+        // Allow-list on the wire, not just at the entry points (navigation-guard.ts).
+        await this.installHostGuard(context);
         await context.addInitScript(SNAPSHOT_SCRIPT);
         const session = new PlaywrightSession(this, owner, context);
         const entry = { context, session, lastUsed: Date.now(), pending: 0, timer: undefined };
@@ -252,6 +280,30 @@ export class PlaywrightProvider {
         });
         return session;
     }
+    /**
+     * Keep the number of tracked owner handles inside maxSessions in persistent
+     * mode. Handles share one window, so dropping the least recently used idle
+     * handle costs nothing the user can see; the owner gets a fresh handle on the
+     * same window next time. An owner with an operation in flight is never dropped.
+     * @param keep - the owner being acquired right now.
+     */
+    evictIdleHandles(keep) {
+        const limit = this.config.maxSessions;
+        if (!Number.isFinite(limit) || limit <= 0)
+            return;
+        while (this.entries.size >= limit) {
+            const candidates = [...this.entries.entries()]
+                .filter(([key, entry]) => key !== keep && entry.pending === 0)
+                .sort((left, right) => left[1].lastUsed - right[1].lastUsed);
+            const oldest = candidates[0];
+            if (oldest === undefined)
+                return;
+            const [key, entry] = oldest;
+            if (entry.timer !== undefined)
+                clearTimeout(entry.timer);
+            this.entries.delete(key);
+        }
+    }
     async disposeOwner(owner) {
         const entry = this.entries.get(owner);
         if (entry === undefined)
@@ -275,6 +327,10 @@ export class PlaywrightProvider {
     }
     async dispose() {
         this.launchedHeadless = undefined;
+        // A launch still in flight must not re-create a context after disposal.
+        this.contextLaunch = undefined;
+        this.browserLaunch = undefined;
+        this.blockedNavigation = undefined;
         const owners = [...this.entries.keys()];
         for (const owner of owners)
             await this.disposeOwner(owner);
@@ -364,6 +420,29 @@ export class PlaywrightProvider {
     async clearChromeLocks() {
         return clearChromeLocks(this);
     }
+    /**
+     * Put the allow-list on the wire for one context: every navigation and every
+     * data request outside the list is refused from then on, whoever started it.
+     * See navigation-guard.ts for why the entry-point checks alone were not enough.
+     * @param context - freshly created context, before its first navigation.
+     */
+    async installHostGuard(context) {
+        this.blockedNavigation = undefined;
+        await installHostGuard(context, () => this.config.allowedDomains ?? [], (blocked) => {
+            if (blocked.document)
+                this.blockedNavigation = blocked;
+        });
+    }
+    /**
+     * Take the pending "a navigation was refused" record, if any. Consumed once:
+     * the next action must not inherit the previous action's refusal.
+     * @returns the refused navigation, or undefined.
+     */
+    takeBlockedNavigation() {
+        const blocked = this.blockedNavigation;
+        this.blockedNavigation = undefined;
+        return blocked;
+    }
     /**
      * Collect the login-state fallback WITHOUT ever opening a page while the
      * window is put away.

package/lib/session.d.ts

@@ -60,6 +60,32 @@ export declare class PlaywrightSession {
     /** Nonce of the baseline ref space; a change means navigation reset. */
     lastRefNonce: string | undefined;
     constructor(provider: PlaywrightProvider, owner: string, context: BrowserContext);
+    /**
+     * Turn a navigation the host guard refused into a named refusal.
+     *
+     * A page can navigate itself (location.href, meta refresh, a form submit, a
+     * 302) without passing any entry-point check. The guard stops the document
+     * request; this reports it, so "I clicked and nothing happened" becomes
+     * URL_NOT_ALLOWED naming the host. Consumed once: a later action must not
+     * inherit an earlier refusal.
+     */
+    throwIfNavigationBlocked(): void;
+    /**
+     * Refuse to go on driving a page that is outside the allow-list.
+     *
+     * The request-level guard (navigation-guard.ts) catches navigations started
+     * from inside the page, but NOT a redirect the browser follows on its own:
+     * measured 2026-10-26, `context.route()` never sees the hop after a
+     * `continue()`d request, so `127.0.0.1/x` answering `302 → localhost/y` lands
+     * on the disallowed host with no route event at all. So every action that
+     * settles a page also checks where it actually ended up.
+     *
+     * The off-list page is abandoned for about:blank (hostless, always allowed)
+     * instead of being left there: otherwise the session would wedge on a page it
+     * may never drive, and "navigate somewhere allowed" could not fix it.
+     * @param page - the page this action ran on.
+     */
+    assertCurrentUrlAllowed(page: Page): Promise<void>;
     /**
      * The session's cookies, reduced to what the login inference needs. `value` is dropped here,
      * at the only place cookies enter the summary path, so nothing downstream can leak it.
@@ -278,9 +304,13 @@ export declare class PlaywrightSession {
      * Send one raw CDP command on the current page's session and return its
      * result. This is the "direct protocol" escape hatch behind every other
      * tool — the model can inspect geometry, dispatch trusted input events or
-     * query the DOM the same way Chrome DevTools does. Policy (which methods
-     * are allowed) lives in the tool layer via lib/cdp-policy.js; this method
-     * itself performs no filtering so internal callers keep full control.
+     * query the DOM the same way Chrome DevTools does.
+     *
+     * Both rules live here as well as in the tool layer, deliberately: the
+     * allow-list and the switch must hold for anything that reaches this method,
+     * not just for the registered tool. Before 2026-10-26 only `browser_cdp`
+     * checked them, so a caller working through the service could send
+     * `Runtime.evaluate` — arbitrary JavaScript — with the switch off (measured).
      */
     cdp(method: string, params: Record<string, unknown>, signal?: AbortSignal): Promise<unknown>;
     close(): Promise<void>;

package/lib/session.js

@@ -1,11 +1,13 @@
 import { looksLikeToken, registrableDomain } from "./login-sites.js";
-import { BrowserError } from "./errors.js";
+import { BrowserError, cdpDisabled, evaluateDisabled } from "./errors.js";
+import { isCdpMethodAllowed, cdpDenialMessage } from "./cdp-policy.js";
+import { getGates } from "./runtime-state.js";
 import { asTimeoutError, isAbortError, isContextDestroyed, isCrashError } from "./page-diagnostics.js";
 import { consoleMessages, networkRequests, pageData, trackPage } from "./page-diagnostics.js";
 import { elementStabilityProbe, pageStabilityProbe } from "./page-probes.js";
 import { assertActionable, back, clickAt, clickAtRef, clickLocator, clickText, closeTab, fill, forward, hoverLocator, hoverText, navigate, openTab, press, resolveClickPoint, runAction, scroll, switchTab, verifyFill, withAbort, } from "./page-actions.js";
 import { assertLive, attachDiff, attachDocResponse, attachNoProgress, buildRefSignatures, captureAria, captureLegacy, refLocator, resolveSnapshotEngine, settleAndSnapshot, snapshot, } from "./page-snapshot.js";
-import { assertAllowedUrl } from "./url-policy.js";
+import { assertAllowedUrl, isHostAllowed } from "./url-policy.js";
 /** Live session over one browser context owned by one caller. */
 export class PlaywrightSession {
     provider;
@@ -55,6 +57,66 @@ export class PlaywrightSession {
         this.owner = owner;
         this.context = context;
     }
+    /**
+     * Turn a navigation the host guard refused into a named refusal.
+     *
+     * A page can navigate itself (location.href, meta refresh, a form submit, a
+     * 302) without passing any entry-point check. The guard stops the document
+     * request; this reports it, so "I clicked and nothing happened" becomes
+     * URL_NOT_ALLOWED naming the host. Consumed once: a later action must not
+     * inherit an earlier refusal.
+     */
+    throwIfNavigationBlocked() {
+        const refused = this.provider.takeBlockedNavigation();
+        if (refused === undefined)
+            return;
+        throw new BrowserError('URL_NOT_ALLOWED', 'the page tried to navigate to ' +
+            refused.url +
+            ' and was blocked: host ' +
+            refused.host +
+            ' is not in allowedDomains. Nothing left this site — the request was stopped before it reached the network. ' +
+            'The page you were on is unchanged; tell the user the site tried to leave the allow-list.');
+    }
+    /**
+     * Refuse to go on driving a page that is outside the allow-list.
+     *
+     * The request-level guard (navigation-guard.ts) catches navigations started
+     * from inside the page, but NOT a redirect the browser follows on its own:
+     * measured 2026-10-26, `context.route()` never sees the hop after a
+     * `continue()`d request, so `127.0.0.1/x` answering `302 → localhost/y` lands
+     * on the disallowed host with no route event at all. So every action that
+     * settles a page also checks where it actually ended up.
+     *
+     * The off-list page is abandoned for about:blank (hostless, always allowed)
+     * instead of being left there: otherwise the session would wedge on a page it
+     * may never drive, and "navigate somewhere allowed" could not fix it.
+     * @param page - the page this action ran on.
+     */
+    async assertCurrentUrlAllowed(page) {
+        const raw = page.url();
+        if (raw === '')
+            return;
+        let target;
+        try {
+            target = new URL(raw);
+        }
+        catch {
+            return;
+        }
+        if (target.protocol !== 'http:' && target.protocol !== 'https:')
+            return;
+        const allowedDomains = this.provider.config.allowedDomains ?? [];
+        if (isHostAllowed(target.hostname, allowedDomains))
+            return;
+        await page.goto('about:blank').catch(() => { });
+        throw new BrowserError('URL_NOT_ALLOWED', 'the page ended up on host ' +
+            target.hostname +
+            ' (' +
+            raw +
+            '), which is not in allowedDomains — a redirect the browser followed on its own. ' +
+            'The tab has been reset to about:blank, so nothing outside the allow-list stays reachable. ' +
+            'Tell the user: the site tried to send this session off the allow-list.');
+    }
     /**
      * The session's cookies, reduced to what the login inference needs. `value` is dropped here,
      * at the only place cookies enter the summary path, so nothing downstream can leak it.
@@ -120,6 +182,9 @@ export class PlaywrightSession {
     }
     /** Run one operation under busy tracking: idle disposal defers until it settles. */
     run(operation) {
+        // Every action starts from a clean slate: a refusal recorded during an
+        // earlier action must not be reported as this one's outcome.
+        this.provider.blockedNavigation = undefined;
         this.provider.beginOp(this.owner);
         return Promise.resolve()
             .then(operation)
@@ -491,6 +556,14 @@ export class PlaywrightSession {
         return pageData(this);
     }
     async evaluate(expression, signal) {
+        // The switch is enforced HERE, not only in the tool layer: browser_evaluate
+        // used to be guarded by tool.ts alone, so anything holding the service (a
+        // sibling plugin, a script) could run arbitrary page JavaScript with the
+        // user's logins while the setting said off (measured 2026-10-26). An
+        // unpublished gate set counts as OFF — a deployment that never said yes has
+        // not said yes.
+        if (!(getGates()?.allowEvaluate ?? false))
+            throw evaluateDisabled();
         return this.run(async () => {
             this.assertLive();
             this.provider.touch(this.owner);
@@ -511,11 +584,19 @@ export class PlaywrightSession {
      * Send one raw CDP command on the current page's session and return its
      * result. This is the "direct protocol" escape hatch behind every other
      * tool — the model can inspect geometry, dispatch trusted input events or
-     * query the DOM the same way Chrome DevTools does. Policy (which methods
-     * are allowed) lives in the tool layer via lib/cdp-policy.js; this method
-     * itself performs no filtering so internal callers keep full control.
+     * query the DOM the same way Chrome DevTools does.
+     *
+     * Both rules live here as well as in the tool layer, deliberately: the
+     * allow-list and the switch must hold for anything that reaches this method,
+     * not just for the registered tool. Before 2026-10-26 only `browser_cdp`
+     * checked them, so a caller working through the service could send
+     * `Runtime.evaluate` — arbitrary JavaScript — with the switch off (measured).
      */
     async cdp(method, params, signal) {
+        if (!(getGates()?.allowCdp ?? false))
+            throw cdpDisabled();
+        if (!isCdpMethodAllowed(method))
+            throw new BrowserError('CDP_DENIED', cdpDenialMessage(method));
         return this.run(async () => {
             this.assertLive();
             this.provider.touch(this.owner);

package/lib/settings-card.js

@@ -148,7 +148,9 @@ function registerDiskRoutes(ctx) {
                 sendJson(res, 200, { ...report, browserActive: getEnabled() === true });
             }
             catch (error) {
-                sendJson(res, 500, { error: { code: 'DISK_SCAN', message: String(error && error.message ? error.message : error) } });
+                sendJson(res, 500, {
+                    error: { code: 'DISK_SCAN', message: String(error && error.message ? error.message : error) },
+                });
             }
         },
     }));
@@ -177,15 +179,24 @@ function registerDiskRoutes(ctx) {
             const targets = [];
             for (const value of payload.targets) {
                 if (!isTargetId(value))
-                    return sendJson(res, 400, { error: { code: 'UNKNOWN_TARGET', message: 'unknown target: ' + String(value) } });
+                    return sendJson(res, 400, {
+                        error: { code: 'UNKNOWN_TARGET', message: 'unknown target: ' + String(value) },
+                    });
                 targets.push(value);
             }
             try {
-                const report = await clean({ ...diskPaths(), targets, dryRun: payload.dryRun, browserActive: getEnabled() === true });
+                const report = await clean({
+                    ...diskPaths(),
+                    targets,
+                    dryRun: payload.dryRun,
+                    browserActive: getEnabled() === true,
+                });
                 sendJson(res, 200, report);
             }
             catch (error) {
-                sendJson(res, 500, { error: { code: 'DISK_CLEAN', message: String(error && error.message ? error.message : error) } });
+                sendJson(res, 500, {
+                    error: { code: 'DISK_CLEAN', message: String(error && error.message ? error.message : error) },
+                });
             }
         },
     }));

package/lib/tool.js

@@ -1,7 +1,7 @@
 import z from '@deepseek-ai/schemastery';
 import { defineTool } from '@deepseek-ai/dsh-tools';
 import { BlockAssembler, createUserMessage } from '@deepseek-ai/dsh-llm';
-import { BrowserError } from "./errors.js";
+import { BrowserError, cdpDisabled, evaluateDisabled } from "./errors.js";
 import { registeredSuffixes } from "./contract.js";
 import { getEnabled, publishGates, publishLoginSites } from "./runtime-state.js";
 import { summarizeLoginSites } from "./login-sites.js";
@@ -58,12 +58,17 @@ export function apply(ctx, config) {
     // Tell the Settings page what is actually in effect. It cannot read this
     // config itself (the value may come from a bundle patch, a profile patch or a
     // home-level patch), so the tool family publishes it at registration and the
-    // switch shows the truth instead of a guess. Driven by the same values that
-    // decided which tools register, so the two can never disagree.
+    // switch shows the truth instead of a guess.
+    //
+    // These are the CAPABILITY values, not `registered.has(...)`: the session
+    // layer enforces the switch too, and `registerDisabledTools` deliberately
+    // registers a switched-off tool so the model can discover it. Reading
+    // registration as permission published "on" for a gate that was off — the
+    // settings card showed a switch that was not there.
     publishGates({
-        allowEvaluate: registered.has('evaluate'),
-        allowCdp: registered.has('cdp'),
-        diagnostics: registered.has('console_messages'),
+        allowEvaluate: config.allowEvaluate,
+        allowCdp: config.allowCdp,
+        diagnostics: config.diagnostics,
     });
     /** Register one gated tool only when this configuration keeps it live. */
     const registerMaybe = (suffix, definition) => {
@@ -547,7 +552,7 @@ export function apply(ctx, config) {
         },
         async execute(args, exec) {
             if (!config.allowEvaluate) {
-                throw new BrowserError('EVALUATE_DISABLED', 'browser_evaluate is disabled; set allowEvaluate: true on the browser-tool plugin to enable arbitrary page JavaScript');
+                throw evaluateDisabled();
             }
             const session = await acquire(exec);
             return (await session.evaluate(args.expression, exec.signal));
@@ -583,7 +588,7 @@ export function apply(ctx, config) {
         },
         async execute(args, exec) {
             if (!config.allowCdp) {
-                throw new BrowserError('CDP_DISABLED', 'browser_cdp is disabled; set allowCdp: true on the browser-tool plugin to enable raw CDP inspection commands');
+                throw cdpDisabled();
             }
             if (!isCdpMethodAllowed(args.method)) {
                 throw new BrowserError('CDP_DENIED', cdpDenialMessage(args.method));

package/lib/url-policy.d.ts

@@ -1,2 +1,15 @@
+/**
+ * Is this host inside the allow-list? Empty list means "any host".
+ *
+ * Suffix matching is deliberately anchored one level down: `example.com`
+ * admits `example.com` and `a.example.com`, never `notexample.com` and never
+ * `example.com.evil.net`. A configured entry is compared after
+ * normalisation (lower case, leading dot dropped), because a user writing
+ * `.example.com` means the domain, not a subdomain literally named "example".
+ * @param host - hostname to test, e.g. "a.example.com".
+ * @param allowedDomains - configured suffixes; empty means everything passes.
+ * @returns true when the host is allowed.
+ */
+export declare function isHostAllowed(host: string, allowedDomains: readonly string[]): boolean;
 /** Validate one absolute URL against the navigation policy. */
 export declare function assertAllowedUrl(raw: string, allowedDomains: readonly string[]): URL;

package/lib/url-policy.js

@@ -3,6 +3,29 @@
  * @module dsh-browser-playwright-codex/url-policy
  */
 import { BrowserError } from "./errors.js";
+/**
+ * Is this host inside the allow-list? Empty list means "any host".
+ *
+ * Suffix matching is deliberately anchored one level down: `example.com`
+ * admits `example.com` and `a.example.com`, never `notexample.com` and never
+ * `example.com.evil.net`. A configured entry is compared after
+ * normalisation (lower case, leading dot dropped), because a user writing
+ * `.example.com` means the domain, not a subdomain literally named "example".
+ * @param host - hostname to test, e.g. "a.example.com".
+ * @param allowedDomains - configured suffixes; empty means everything passes.
+ * @returns true when the host is allowed.
+ */
+export function isHostAllowed(host, allowedDomains) {
+    if (allowedDomains.length === 0)
+        return true;
+    const target = host.toLowerCase();
+    return allowedDomains.some((raw) => {
+        const suffix = raw.trim().toLowerCase().replace(/^\.+/, '');
+        if (suffix === '')
+            return false;
+        return target === suffix || target.endsWith('.' + suffix);
+    });
+}
 /** Validate one absolute URL against the navigation policy. */
 export function assertAllowedUrl(raw, allowedDomains) {
     let parsed;
@@ -17,8 +40,7 @@ export function assertAllowedUrl(raw, allowedDomains) {
     }
     if (allowedDomains.length > 0) {
         const host = parsed.hostname.toLowerCase();
-        const allowed = allowedDomains.some((suffix) => host === suffix || host.endsWith('.' + suffix));
-        if (!allowed) {
+        if (!isHostAllowed(host, allowedDomains)) {
             throw new BrowserError('URL_NOT_ALLOWED', 'host ' + parsed.hostname + ' is not in allowedDomains');
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-browser-playwright-codex",
-  "version": "0.7.4",
+  "version": "0.7.5",
   "description": "Browser automation for DeepSeek Harness, one plugin: fill in forms, scrape lists and work across tabs in real pages, using the logins you already have. Runs in a visible window that stays quiet when minimised; native dialogs are parked instead of confirmed, CAPTCHA pages are flagged with a note that says stop and hand the page back, password / one-time-code / card fields are refused by browser_fill, and the Settings card (enable/disable, page-reading mode, capability gates) now lives inside this package.",
   "license": "MIT",
   "type": "module",

package/scripts/dsh-browser-verify.mjs

@@ -28,7 +28,7 @@ import path from 'node:path'
 import { PlaywrightProvider } from '../lib/provider.js'
 import { Config as ConfigSchema } from '../lib/config.js'
 import { renderSnapshot } from '../lib/snapshot-render.js'
-import { getEffectiveEngine, setSnapshotEngine } from '../lib/runtime-state.js'
+import { getEffectiveEngine, publishGates, setSnapshotEngine } from '../lib/runtime-state.js'
 
 // 验收必须只看代码，不看这台机器上用户的选择。
 // 设置页的「页面识别方式」存在 ~/.dsh/dsh-browser-playwright.state.json，运行时状态层
@@ -128,6 +128,36 @@ const provider = new PlaywrightProvider(
 )
 const session = await provider.acquire('verify')
 
+// ---------------------------------------------------------------------------
+// [0] 门禁在代码层也成立（2026-10-26 之前的漏洞：开关只在工具层挡）
+// ---------------------------------------------------------------------------
+// 本脚本不经过工具层，直接调 session —— 正是当初绕过门禁的那条路。默认（没发布门禁）
+// 必须拒绝；确认之后再把门禁打开，好让后面的用例能读页面状态。
+console.log('[0] 门禁：没开门禁时代码层也拒绝')
+let evaluateGate = ''
+try {
+  await session.evaluate('1 + 1')
+} catch (e) {
+  evaluateGate = e.code
+}
+check('evaluate 未开门禁时报 EVALUATE_DISABLED', evaluateGate === 'EVALUATE_DISABLED', evaluateGate)
+let cdpGate = ''
+try {
+  await session.cdp('DOM.getDocument', { depth: 1 })
+} catch (e) {
+  cdpGate = e.code
+}
+check('cdp 未开门禁时报 CDP_DISABLED', cdpGate === 'CDP_DISABLED', cdpGate)
+publishGates({ allowEvaluate: true, allowCdp: true, diagnostics: true })
+let cdpDenied = ''
+try {
+  // 门禁打开也仍然要过白名单：Runtime.evaluate 是任意页面 JS，永远不在名单里。
+  await session.cdp('Runtime.evaluate', { expression: 'document.cookie', returnByValue: true })
+} catch (e) {
+  cdpDenied = e.code
+}
+check('开门禁后 Runtime.evaluate 仍报 CDP_DENIED', cdpDenied === 'CDP_DENIED', cdpDenied)
+
 console.log('[1] 快照取名与折叠')
 const s0 = await session.navigate(URL_, 'load')
 const tree = renderSnapshot(s0)
@@ -366,6 +396,9 @@ const expectedTools = contractMod.registeredToolNames(toolConfig.toolPrefix, {
   registerDisabledTools: toolConfig.registerDisabledTools,
 })
 const byName = (n) => reg.find((t) => t.name === n)
+// apply() 会把有效门禁刷成这份配置里的值（这里出厂默认是关），而下面的用例直接调
+// session 而不是走工具层，所以再打开一次。
+publishGates({ allowEvaluate: true, allowCdp: true, diagnostics: true })
 check('存在 browser_dialog', byName('browser_dialog') !== undefined)
 check(
   'browser_dialog 有 accept 参数',