dsh-builtin-browser 0.1.8 → 0.1.10

package/lib/browser-electron/remote-host.js

@@ -2,9 +2,9 @@
  * Self-hosted Electron browser host (parent side): an
  * {@link ElectronBrowserViewHost} implementation that spawns the plugin's own
  * Electron child process (host-main.js) and drives it over line-delimited
- * JSON-RPC on stdio. This is what makes the plugin work on surfaces without a
- * desktop shell's electronViewHost (plain dsh web): installing the plugin is
- * enough — the browser window appears on first use.
+ * JSON-RPC on a loopback TCP socket. This is what makes the plugin work on
+ * surfaces without a desktop shell's electronViewHost (plain dsh web):
+ * installing the plugin is enough — the browser window appears on first use.
  *
  * Protocol (one JSON object per line, both directions):
  *   -> { id, op: 'createView' } | { id, op: 'destroyView', viewId } |
@@ -23,6 +23,8 @@ import { createServer } from 'node:net';
 import { fileURLToPath } from 'node:url';
 /** How long to wait for the child to signal readiness before failing. */
 const READY_TIMEOUT_MS = 20_000;
+/** Safety cap on a single RPC reply line (base64 downloads are the big ones). */
+const MAX_RPC_BUFFER_BYTES = 512 * 1024 * 1024;
 /**
  * Locate the Electron binary, trying, in order:
  *   1. require('electron') from this module (optional peer dependency),
@@ -147,6 +149,7 @@ function findElectronExe(store) {
 class ElectronChildClient {
     hostMainPath;
     port;
+    onExit;
     child;
     pending = new Map();
     nextId = 1;
@@ -154,9 +157,12 @@ class ElectronChildClient {
     socket;
     connected = false;
     outbox = [];
-    constructor(hostMainPath, port) {
+    /** Set once the child has exited; further calls fail fast instead of queueing. */
+    dead = false;
+    constructor(hostMainPath, port, onExit) {
         this.hostMainPath = hostMainPath;
         this.port = port;
+        this.onExit = onExit;
         const electron = resolveElectronPath();
         // ELECTRON_RUN_AS_NODE (even an empty string) makes Electron run as plain
         // Node, breaking require('electron'); NODE_OPTIONS can inject flags that
@@ -174,25 +180,45 @@ class ElectronChildClient {
             // Diagnostics only; never parse stderr as protocol.
             process.stderr.write(`[dsh-browser host] ${String(chunk)}`);
         });
+        // A failed spawn (bad/corrupt binary) emits 'error' — without a listener
+        // that would crash the whole DSH process.
+        this.child.on('error', error => {
+            process.stderr.write(`[dsh-browser host] spawn error: ${String(error)}\n`);
+            this.fail(new Error(`dsh-builtin-browser: browser host failed to start: ${String(error)}`));
+        });
         this.child.on('exit', (code, signal) => {
-            const err = new Error(`dsh-builtin-browser: browser host exited (code=${String(code)} signal=${String(signal)})`);
-            for (const pending of this.pending.values())
-                pending.reject(err);
-            this.pending.clear();
+            this.fail(new Error(`dsh-builtin-browser: browser host exited (code=${String(code)} signal=${String(signal)})`));
         });
     }
+    /** Reject everything in flight, mark the client dead, and notify the host. */
+    fail(err) {
+        if (this.dead)
+            return;
+        this.dead = true;
+        this.connected = false;
+        for (const pending of this.pending.values())
+            pending.reject(err);
+        this.pending.clear();
+        this.outbox = [];
+        this.onExit?.();
+    }
     /** Accept the child's connection (called by the server). */
     attach(socket) {
         this.socket = socket;
         this.connected = true;
         socket.setEncoding('utf8');
+        // Without an 'error' listener a remote reset (ECONNRESET/EPIPE) throws an
+        // uncaught 'error' event and crashes the whole DSH process; 'close' below
+        // does the cleanup.
+        socket.on('error', error => {
+            process.stderr.write(`[dsh-browser host] socket error: ${String(error)}\n`);
+        });
         socket.on('data', chunk => this.onData(chunk));
         socket.on('close', () => {
             this.connected = false;
-            const err = new Error('dsh-builtin-browser: browser host connection closed');
-            for (const pending of this.pending.values())
-                pending.reject(err);
-            this.pending.clear();
+            if (!this.dead) {
+                this.fail(new Error('dsh-builtin-browser: browser host connection closed'));
+            }
         });
         // Flush anything queued while disconnected.
         if (this.outbox.length > 0) {
@@ -203,6 +229,14 @@ class ElectronChildClient {
     }
     onData(chunk) {
         this.buffer += typeof chunk === 'string' ? chunk : chunk.toString('utf8');
+        // Safety net: a pathological child (or a reply larger than expected)
+        // must not grow the parent's memory without bound. The child caps
+        // downloads at 256 MiB, so a healthy stream never approaches this.
+        if (this.buffer.length > MAX_RPC_BUFFER_BYTES) {
+            this.buffer = '';
+            this.fail(new Error(`dsh-builtin-browser: RPC reply exceeded ${MAX_RPC_BUFFER_BYTES} bytes`));
+            return;
+        }
         let nl;
         while ((nl = this.buffer.indexOf('\n')) >= 0) {
             const line = this.buffer.slice(0, nl).trim();
@@ -231,6 +265,9 @@ class ElectronChildClient {
     }
     /** Send one command and await the reply. */
     call(op, payload = {}) {
+        if (this.dead) {
+            return Promise.reject(new Error('dsh-builtin-browser: browser host is not running'));
+        }
         const id = this.nextId++;
         const line = JSON.stringify({ id, op, ...payload });
         return new Promise((resolve, reject) => {
@@ -294,15 +331,30 @@ export class RemoteElectronViewHost {
     pendingSocket;
     views = new Map();
     readyPromise;
+    disposed = false;
     constructor(hostMainPath) {
         this.hostMainPath = hostMainPath;
     }
-    /** Ensure the child is up and ready (lazy on first use). */
+    /** Ensure the child is up and ready (lazy on first use; restarts after a crash). */
     ready() {
         if (this.readyPromise !== undefined)
             return this.readyPromise;
-        this.readyPromise = this.start();
-        return this.readyPromise;
+        const started = this.start();
+        const wrapped = started.catch(error => {
+            // A failed startup must not poison the host forever: tear down whatever
+            // was half-created and let the next call retry from scratch.
+            if (this.readyPromise === wrapped) {
+                this.readyPromise = undefined;
+                this.client?.kill();
+                this.client = undefined;
+                this.server?.close();
+                this.server = undefined;
+                this.pendingSocket = undefined;
+            }
+            throw error;
+        });
+        this.readyPromise = wrapped;
+        return wrapped;
     }
     async start() {
         // Listen on an ephemeral loopback port; the child connects back.
@@ -316,10 +368,15 @@ export class RemoteElectronViewHost {
             server.once('error', reject);
             server.listen(0, '127.0.0.1', () => resolve());
         });
+        // A later server error (rare on a loopback ephemeral port) must not crash
+        // the process; the client's fail path handles the actual recovery.
+        server.on('error', error => {
+            process.stderr.write(`[dsh-browser host] rpc server error: ${String(error)}\n`);
+        });
         const address = server.address();
         const port = typeof address === 'object' && address !== null ? address.port : 0;
         this.server = server;
-        this.client = new ElectronChildClient(this.hostMainPath, port);
+        this.client = new ElectronChildClient(this.hostMainPath, port, () => this.onChildExit());
         if (this.pendingSocket !== undefined) {
             this.client.attach(this.pendingSocket);
             this.pendingSocket = undefined;
@@ -327,6 +384,18 @@ export class RemoteElectronViewHost {
         // Wait for the child's connection + readiness ping.
         await withTimeout(this.client.call('ping'), READY_TIMEOUT_MS, 'browser host did not become ready');
     }
+    /** The child died: tear down so the next use starts a fresh child. */
+    onChildExit() {
+        if (this.disposed)
+            return;
+        this.client = undefined;
+        this.server?.close();
+        this.server = undefined;
+        this.pendingSocket = undefined;
+        this.readyPromise = undefined;
+        // Keep the views map: handles still resolve to ids; a fresh child simply
+        // has no such views yet, and reset_session reopens clean sessions.
+    }
     createView() {
         // The seam is synchronous; the provider uses the handle immediately, so
         // commands are deferred until the child is up and the view materialized.
@@ -341,12 +410,21 @@ export class RemoteElectronViewHost {
         if (client === undefined)
             throw new Error('browser host unavailable');
         await client.call('createView', { viewId: id });
+        // If the view was destroyed while the createView RPC was in flight, do
+        // not re-insert a stale entry that would resurrect a dead child view.
+        if (this.views.get(id) === undefined) {
+            throw new Error('browser: view destroyed while starting');
+        }
         const view = new RemoteView(id, client);
         this.views.set(id, view);
         return view;
     }
     showView(handle) {
-        void this.ready().then(() => this.client?.call('showView', { viewId: handle.id }));
+        // Fire-and-forget by design (visibility is best-effort), but a rejected
+        // promise must not become an unhandled rejection (crash on Node >= 15).
+        void this.ready()
+            .then(() => this.client?.call('showView', { viewId: handle.id }))
+            .catch(() => { });
     }
     destroyView(handle) {
         const view = this.views.get(handle.id);
@@ -359,6 +437,7 @@ export class RemoteElectronViewHost {
     }
     /** Shut the child and the RPC server down. */
     dispose() {
+        this.disposed = true;
         this.client?.kill();
         this.client = undefined;
         this.server?.close();
@@ -376,27 +455,37 @@ class DeferredRemoteView {
         this.id = id;
         this.materialize = materialize;
     }
+    /**
+     * Materialize once and cache: every sendCommand on the same handle must
+     * target the SAME child view (re-materializing would re-run createView and
+     * duplicate the window). A FAILED materialization is reset so a later call
+     * (e.g. after the host restarted) can retry instead of being poisoned.
+     */
+    materializeOnce() {
+        if (this.materialized === undefined) {
+            const pending = this.materialize();
+            this.materialized = pending.catch(error => {
+                if (this.materialized === pending)
+                    this.materialized = undefined;
+                throw error;
+            });
+        }
+        return this.materialized;
+    }
     async sendCommand(method, params) {
-        // Materialize once and cache: every sendCommand on the same handle must
-        // target the SAME child view. Re-materializing would re-run createView
-        // (duplicate window) and drop the established view.
-        this.materialized ??= this.materialize();
-        const view = await this.materialized;
+        const view = await this.materializeOnce();
         return view.sendCommand(method, params);
     }
     async download(url, savePath) {
-        this.materialized ??= this.materialize();
-        const view = await this.materialized;
+        const view = await this.materializeOnce();
         return view.download(url, savePath);
     }
     async flushAuth() {
-        this.materialized ??= this.materialize();
-        const view = await this.materialized;
+        const view = await this.materializeOnce();
         return view.flushAuth();
     }
     async restoreAuth(cookies) {
-        this.materialized ??= this.materialize();
-        const view = await this.materialized;
+        const view = await this.materializeOnce();
         return view.restoreAuth(cookies);
     }
 }

package/lib/index.d.ts

@@ -1,15 +1,16 @@
 /**
- * dsh-browser plugin entry: aggregates the shared-browser capability pieces.
- * The cordis.patch.yml rows reference subpath exports:
- *   - `dsh-browser/browser`            -> the ctx.browser seam (Service Definition)
- *   - `dsh-browser/browser-electron`   -> the Electron CDP provider
- *   - `dsh-browser/tool-browser`       -> the model-facing browser_* tools
+ * dsh-builtin-browser plugin entry: aggregates the shared-browser capability
+ * pieces. The cordis.patch.yml rows reference subpath exports:
+ *   - `dsh-builtin-browser/browser`          -> the ctx.browser seam (Service)
+ *   - `dsh-builtin-browser/browser-electron` -> the Electron CDP provider
+ *   - `dsh-builtin-browser/tool-browser`     -> the model-facing browser_* tools
  * This root entry only re-exports for programmatic use; the loader rows are
  * the composition surface.
- * @module dsh-browser
+ * @module dsh-builtin-browser
  */
 export { BrowserError } from './browser/types.ts';
-export type { BrowserClickRequest, BrowserContentFormat, BrowserContentRequest, BrowserContentResult, BrowserExecuteRequest, BrowserExecuteResult, BrowserNavigateRequest, BrowserOpenRequest, BrowserProvider, BrowserScreenshotRequest, BrowserScreenshotResult, BrowserSessionId, BrowserSnapshotElement, BrowserSnapshotResult, BrowserTab, BrowserTypeRequest, } from './browser/types.ts';
+export type { BrowserChallenge, BrowserClickRequest, BrowserContentFormat, BrowserContentRequest, BrowserContentResult, BrowserExecuteRequest, BrowserExecuteResult, BrowserFillField, BrowserFillRequest, BrowserFillResult, BrowserNavigateRequest, BrowserOpenRequest, BrowserProvider, BrowserScreenshotRequest, BrowserScreenshotResult, BrowserSessionId, BrowserSnapshotElement, BrowserSnapshotResult, BrowserTab, BrowserTypeRequest, ExportedCookie, } from './browser/types.ts';
 export { BrowserRuntime } from './browser/runtime.ts';
 export { ElectronBrowserProvider } from './browser-electron/provider.ts';
 export type { ElectronBrowserViewHost, ElectronViewHandle } from './browser-electron/provider.ts';
+export { RemoteElectronViewHost, defaultHostMainPath } from './browser-electron/remote-host.ts';

package/lib/index.js

@@ -1,13 +1,14 @@
 /**
- * dsh-browser plugin entry: aggregates the shared-browser capability pieces.
- * The cordis.patch.yml rows reference subpath exports:
- *   - `dsh-browser/browser`            -> the ctx.browser seam (Service Definition)
- *   - `dsh-browser/browser-electron`   -> the Electron CDP provider
- *   - `dsh-browser/tool-browser`       -> the model-facing browser_* tools
+ * dsh-builtin-browser plugin entry: aggregates the shared-browser capability
+ * pieces. The cordis.patch.yml rows reference subpath exports:
+ *   - `dsh-builtin-browser/browser`          -> the ctx.browser seam (Service)
+ *   - `dsh-builtin-browser/browser-electron` -> the Electron CDP provider
+ *   - `dsh-builtin-browser/tool-browser`     -> the model-facing browser_* tools
  * This root entry only re-exports for programmatic use; the loader rows are
  * the composition surface.
- * @module dsh-browser
+ * @module dsh-builtin-browser
  */
 export { BrowserError } from "./browser/types.js";
 export { BrowserRuntime } from "./browser/runtime.js";
 export { ElectronBrowserProvider } from "./browser-electron/provider.js";
+export { RemoteElectronViewHost, defaultHostMainPath } from "./browser-electron/remote-host.js";

package/lib/tool-browser/index.d.ts

@@ -32,7 +32,7 @@ export interface Config {
 export declare function apply(ctx: Context, config?: Config): void;
 /** Test hook: inspect and reset the plugin-level session map (used by tests). */
 export declare const internals: {
-    /** The per-task session map (task key -> provider session id). */
+    /** A copy of the per-task session map (task key -> provider session id). */
     readonly sessions: ReadonlyMap<string, BrowserSessionId>;
     /** Drop one task's mapping without closing the provider session. */
     clearSession(key?: string): void;

package/lib/tool-browser/index.js

@@ -20,6 +20,8 @@ export const name = 'tool-browser';
 export const inject = ['tools', 'browser', 'systemPrompt'];
 /** Per-task browser sessions, keyed by the calling DSH session id. */
 const sessionsByTask = new Map();
+/** In-flight first-open per task key, so concurrent first calls share one session. */
+const pendingOpens = new Map();
 /**
  * Action restriction state: an allow-list of browser tool names, or undefined
  * for unrestricted. When set, any browser_* tool not in the list is refused
@@ -48,25 +50,29 @@ function taskKey(exec) {
 }
 /**
  * Resolve the calling task's browser session, opening one on first use.
+ * Concurrent first calls for the same key share a single open.
  * @param browser - the seam service.
  * @param key - the task key (see {@link taskKey}).
  * @returns the task's session id.
  */
 async function ensureSession(browser, key) {
-    let session = sessionsByTask.get(key);
-    if (session === undefined) {
-        session = await browser.open();
-        sessionsByTask.set(key, session);
-    }
-    return session;
+    const existing = sessionsByTask.get(key);
+    if (existing !== undefined)
+        return existing;
+    const pending = pendingOpens.get(key);
+    if (pending !== undefined)
+        return pending;
+    const opening = browser.open().then(session => { sessionsByTask.set(key, session); pendingOpens.delete(key); return session; }, error => { pendingOpens.delete(key); throw error; });
+    pendingOpens.set(key, opening);
+    return opening;
 }
-/** Coerce a tool-provided string value back to boolean/number when it looks like one. */
+/** Coerce a tool-provided string value back to boolean/number only when lossless. */
 function parseFillValue(v) {
     if (v === 'true')
         return true;
     if (v === 'false')
         return false;
-    if (v !== undefined && /^-?\d+(\.\d+)?$/.test(v))
+    if (v !== undefined && /^-?\d+(\.\d+)?$/.test(v) && String(Number(v)) === v)
         return Number(v);
     return v ?? '';
 }
@@ -84,8 +90,8 @@ function formatSnapshot(snapshot) {
 /** Register all browser tools with `ctx.tools`. */
 export function apply(ctx, config = {}) {
     const timeoutMs = config.timeoutMs ?? 60_000;
-    if (config.allowedActions !== undefined)
-        restrictedTo = [...config.allowedActions];
+    // Re-apply resets the restriction: an omitted allowedActions lifts it.
+    restrictedTo = config.allowedActions !== undefined ? [...config.allowedActions] : undefined;
     ctx.systemPrompt.section({
         name: 'tool:browser',
         // Tool guidance band is 100-199; 150 keeps clear of the common 110/120
@@ -107,6 +113,7 @@ export function apply(ctx, config = {}) {
                 properties: {
                     url: { type: 'string', required: true },
                     title: { type: 'string' },
+                    truncated: { type: 'boolean' },
                     elements: {
                         type: 'array',
                         required: true,
@@ -168,6 +175,7 @@ export function apply(ctx, config = {}) {
                 properties: {
                     url: { type: 'string', required: true },
                     title: { type: 'string' },
+                    truncated: { type: 'boolean' },
                     elements: {
                         type: 'array',
                         required: true,
@@ -546,6 +554,7 @@ export function apply(ctx, config = {}) {
             timeoutMs,
             isConcurrencySafe: () => true,
             async execute(args, exec) {
+                assertAllowed('browser_switch_tab');
                 const browser = ctx.get('browser');
                 if (browser === undefined)
                     throw new Error('tool-browser: browser service unavailable');
@@ -629,7 +638,11 @@ export function apply(ctx, config = {}) {
                     return [{ type: 'text', text: '(no recorded operations yet)' }];
                 return [{
                         type: 'text',
-                        text: entries.map(e => `#${e.seq} ${e.action} ${e.ok ? 'ok' : 'FAIL'} ${JSON.stringify(e.params)}${e.result !== undefined ? ` -> ${e.result}` : ''}${e.error !== undefined ? ` !! ${e.error}` : ''}`).join('\n'),
+                        text: entries.map(e => {
+                            const rawParams = JSON.stringify(e.params);
+                            const shownParams = rawParams.length > 300 ? rawParams.slice(0, 300) + '…' : rawParams;
+                            return `#${e.seq} ${e.action} ${e.ok ? 'ok' : 'FAIL'} ${shownParams}${e.result !== undefined ? ` -> ${e.result}` : ''}${e.error !== undefined ? ` !! ${e.error}` : ''}`;
+                        }).join('\n'),
                     }];
             },
         },
@@ -738,9 +751,7 @@ export function apply(ctx, config = {}) {
             const browser = ctx.get('browser');
             if (browser === undefined)
                 throw new Error('tool-browser: browser service unavailable');
-            const key = taskKey(exec);
-            const session = sessionsByTask.get(key) ?? await browser.open();
-            sessionsByTask.set(key, session);
+            const session = await ensureSession(browser, taskKey(exec));
             const tabs = await browser.listTabs(session);
             return { session, tabs: tabs.map(t => ({ id: t.id, url: t.url, active: t.active })) };
         },
@@ -763,8 +774,14 @@ export function apply(ctx, config = {}) {
             const key = taskKey(exec);
             const session = sessionsByTask.get(key);
             if (session !== undefined) {
-                await browser.close(session);
-                sessionsByTask.delete(key);
+                try {
+                    await browser.close(session);
+                }
+                finally {
+                    // Always forget the mapping so the next call opens a fresh session,
+                    // even if the provider close threw (the session is half-closed).
+                    sessionsByTask.delete(key);
+                }
             }
             return { reset: true };
         },
@@ -787,8 +804,15 @@ export function apply(ctx, config = {}) {
         isConcurrencySafe: () => false,
         async execute(args, exec) {
             // Always allowed so the guard can be lifted.
-            restrictedTo = (args.allowed ?? []).filter((t) => t.startsWith('browser_'));
-            return { restrictedTo: [...restrictedTo] };
+            const allowed = args.allowed ?? [];
+            const unknown = allowed.filter((t) => !t.startsWith('browser_'));
+            if (unknown.length > 0) {
+                throw new Error(`browser_restrict: unknown tool name(s) ${unknown.map(t => `"${t}"`).join(', ')} (must start with "browser_")`);
+            }
+            // Empty list (or omitted) lifts the restriction; a non-empty list is the
+            // new allow-list.
+            restrictedTo = allowed.length === 0 ? undefined : [...allowed];
+            return { restrictedTo: restrictedTo === undefined ? [] : [...restrictedTo] };
         },
     }));
     ctx.tools.register(defineTool({
@@ -829,8 +853,8 @@ export function apply(ctx, config = {}) {
 }
 /** Test hook: inspect and reset the plugin-level session map (used by tests). */
 export const internals = {
-    /** The per-task session map (task key -> provider session id). */
-    get sessions() { return sessionsByTask; },
+    /** A copy of the per-task session map (task key -> provider session id). */
+    get sessions() { return new Map(sessionsByTask); },
     /** Drop one task's mapping without closing the provider session. */
     clearSession(key = 'default') { sessionsByTask.delete(key); },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-builtin-browser",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Shared real browser plugin for DeepSeek Harness: install-and-use — a visible native browser the human can take over, driven by the agent over CDP. DOM-level interaction (React/Vue safe), per-task session isolation, cookie persistence (browser_auth), CAPTCHA detection, batch form fill (browser_fill), authenticated download, history/replay, action restriction",
   "type": "module",
   "main": "lib/index.js",

package/src/browser/runtime.ts

@@ -250,9 +250,21 @@ export class BrowserRuntime extends Service {
     return this.resolveProvider().restoreAuth(session, cookies)
   }
 
-  /** Close the session through the selected provider. Idempotent. */
+  /** Close the session through the selected provider. Idempotent; a missing
+   *  provider is treated as already-closed so teardown paths stay no-ops. */
   async close(session: BrowserSessionId): Promise<void> {
-    return this.resolveProvider().close(session)
+    try {
+      await this.resolveProvider().close(session)
+    } catch (error) {
+      const code = error instanceof BrowserError ? (error as { code?: string }).code : undefined
+      if (code === 'BROWSER_PROVIDER_UNAVAILABLE'
+        || code === 'BROWSER_PROVIDER_CONFIGURED_MISSING'
+        || code === 'BROWSER_PROVIDER_CONFIGURED_UNAVAILABLE'
+        || code === 'BROWSER_PROVIDER_AMBIGUOUS') {
+        return // provider gone; nothing to close
+      }
+      throw error
+    }
   }
 }
 

package/src/browser/types.ts

@@ -313,7 +313,8 @@ export interface BrowserProvider {
 export interface BrowserHistoryEntry {
   /** Monotonic sequence number within the session. */
   readonly seq: number
-  /** The operation name: navigate | execute | click | type | replay. */
+  /** The operation name. Replayable: navigate | execute | click | type.
+   *  Also recorded (non-replayable): fill | download | flushAuth | restoreAuth. */
   readonly action: string
   /** The operation's arguments. */
   readonly params: Record<string, unknown>

package/src/browser-electron/entry.ts

@@ -49,10 +49,15 @@ export function apply(ctx: Context & { browser: BrowserRuntime }, config: Config
   // External host (desktop shell) wins; otherwise self-host. The self-hosted
   // child is disposed with the fiber, mirroring the shell's lifetime.
   const host: ElectronBrowserViewHost = config.viewHost ?? new RemoteElectronViewHost(defaultHostMainPath())
+  // Own the disposer on THIS plugin's fiber: registerBrowserProvider's effect
+  // is bound to the seam's own fiber (the browser row), so a reload of this
+  // row would otherwise collide with the still-registered provider
+  // (BROWSER_DUPLICATE_PROVIDER) or leave a stale provider behind.
+  const unregister = ctx.browser.registerBrowserProvider(new ElectronBrowserProvider(host, { httpOnly: config.httpOnly }))
   ctx.effect(() => () => {
+    unregister()
     if (config.viewHost === undefined && host instanceof RemoteElectronViewHost) {
       host.dispose()
     }
   })
-  ctx.browser.registerBrowserProvider(new ElectronBrowserProvider(host, { httpOnly: config.httpOnly }))
 }