dsh-builtin-browser 0.3.0 → 0.4.0

package/src/tool-browser/index.ts

@@ -19,6 +19,27 @@ import { defineTool } from '@deepseek-ai/dsh-tools'
 import type {} from '@deepseek-ai/dsh-system-prompt'
 import type { BrowserSessionId } from '../browser/types.js'
 
+/**
+ * Register a cleanup that runs once when the process exits.
+ *
+ * A single hook per process, holding a list of callbacks, rather than one listener per
+ * session: sessions come and go, listeners do not, and Node warns when a listener count
+ * passes ten.
+ */
+const exitCleanups = new Set<() => void>()
+let exitHookInstalled = false
+function registerExitCleanup(cleanup: () => void): void {
+  exitCleanups.add(cleanup)
+  if (exitHookInstalled) return
+  exitHookInstalled = true
+  process.on('exit', () => {
+    for (const run of exitCleanups) {
+      try { run() } catch { /* exiting; nothing useful to do */ }
+    }
+  })
+}
+
+
 /** Plugin name used by loader diagnostics. */
 export const name = 'tool-browser'
 /** The tool registry, browser seam, and system-prompt registry this tool layer consumes. */
@@ -41,17 +62,21 @@ interface ToolBrowserState {
   /** In-flight first-open per task key, so concurrent first calls share one session. */
   readonly pendingOpens: Map<string, Promise<BrowserSessionId>>
   /**
-   * Action restriction: an allow-list of browser tool names, or undefined for
-   * unrestricted. When set, any browser_* tool not in the list is refused
-   * (browser_restrict itself is always allowed so the guard can be lifted).
-   * Scoped to one plugin apply (one context), so a restriction set by one
-   * task never leaks into another context.
+   * Action restriction per task, plus one from the plugin's own configuration.
+   *
+   * Two different things share this policy. A restriction from `cordis.patch.yml` is an
+   * operator decision about the whole plugin, so it applies to everyone and lives in
+   * `configRestrictedTo`. One set by `browser_restrict` is a decision by one task about
+   * its own work, so it is keyed by task — a single shared value let one task lock the
+   * browser tools of every other task, which is not what any caller asks for. Sessions
+   * beside it were already keyed this way; this was not.
    */
-  restrictedTo: readonly string[] | undefined
+  configRestrictedTo: readonly string[] | undefined
+  restrictedByTask: Map<string, readonly string[]>
 }
 
 function createState(): ToolBrowserState {
-  return { sessionsByTask: new Map(), pendingOpens: new Map(), restrictedTo: undefined }
+  return { sessionsByTask: new Map(), pendingOpens: new Map(), configRestrictedTo: undefined, restrictedByTask: new Map() }
 }
 
 /** Every live state, for the test hook (introspection only, never shared). */
@@ -63,11 +88,41 @@ const liveStates = new Set<ToolBrowserState>()
  * @param state - the calling context's tool state.
  * @param toolName - the browser tool about to run.
  */
-function assertAllowed(state: ToolBrowserState, toolName: string): void {
-  const { restrictedTo } = state
-  if (restrictedTo === undefined) return
-  if (restrictedTo.includes(toolName)) return
-  throw new Error(`browser action "${toolName}" is restricted (allow-list: ${restrictedTo.join(', ')})`)
+/**
+ * Tools that only observe, plus the ones that undo a restriction.
+ *
+ * Never subject to an allow-list: restricting what the agent may *do* must not also
+ * blind it or trap it, and the tool descriptions promise as much. browser_restrict
+ * is in here so a task that restricted everything can still lift it.
+ */
+export const READ_ONLY_TOOLS: ReadonlySet<string> = new Set([
+  // Tools that only observe.
+  'browser_snapshot', 'browser_a11y', 'browser_content', 'browser_scrape',
+  'browser_screenshot', 'browser_get_value', 'browser_wait', 'browser_challenge',
+  'browser_list_tabs', 'browser_session', 'browser_history', 'browser_visited',
+  // browser_auth reads cookies out of the browser: an observation, and one the
+  // credentials switch gates on its own (see credentials.allowRead in the settings).
+  'browser_auth',
+  // Getting out of a bad state, or lifting the restriction itself. Without these a task
+  // that restricted everything could neither recover nor be released.
+  'browser_restrict', 'browser_reset_session', 'browser_reset',
+])
+function assertAllowed(state: ToolBrowserState, toolName: string, task: string): void {
+  // browser_restrict must stay usable, or a task that restricted everything
+  // could never lift it again.
+  // An allow-list is a statement about ACTIONS, so it must not take away the ability to
+  // look, or to get out of a bad state. The tool description and both READMEs promise
+  // that read-only tools are never blocked; before this they were, because only
+  // browser_restrict itself was exempt — a narrow list then locked browser_history,
+  // browser_reset_session and browser_auth away with no way back.
+  if (READ_ONLY_TOOLS.has(toolName) || toolName === 'browser_restrict') return
+  const config = state.configRestrictedTo
+  if (config !== undefined && !config.includes(toolName)) {
+    throw new Error(`browser action "${toolName}" is restricted by the plugin configuration (allow-list: ${config.join(', ')})`)
+  }
+  const allowed = state.restrictedByTask.get(task)
+  if (allowed === undefined || allowed.includes(toolName)) return
+  throw new Error(`browser action "${toolName}" is restricted (allow-list: ${allowed.join(', ')})`)
 }
 
 /** The agent view a tool execution carries (id + agent-scoped context). */
@@ -135,9 +190,10 @@ async function ensureSession(browser: NonNullable<Context['browser']>, state: To
         } else if (key === 'default') {
           // Agentless / CLI probe: close the session on process exit so the
           // window is not orphaned.
-          process.on('exit', () => {
-            void browser.close(session).catch(() => {})
-          })
+          // One hook for the whole process, not one listener per session: a default session can
+          // be created repeatedly (a CLI probe does), and each registration lived for the life of
+          // the process — so the listener list grew without bound and Node warned at eleven.
+          registerExitCleanup(() => browser.close(session).catch(() => {}))
         }
       } catch (error) {
         // effect() failed — undo the registration so future calls retry.
@@ -157,7 +213,10 @@ async function ensureSession(browser: NonNullable<Context['browser']>, state: To
 function parseFillValue(v: string | undefined): string | number | boolean {
   if (v === 'true') return true
   if (v === 'false') return false
-  if (v !== undefined && /^-?\d+(\.\d+)?$/.test(v) && String(Number(v)) === v) return Number(v)
+  // Deliberately NOT coerced to a number. The description says numbers are accepted in
+  // string form, and callers pass account numbers, postcodes and zero-padded ids through
+  // here: "007" became "7" and "1e3" became "1000", which silently rewrote the value they
+  // meant to type. A numeric-looking string is a string; the DOM decides how to store it.
   return v ?? ''
 }
 
@@ -200,7 +259,7 @@ export function apply(ctx: Context, config: Config = {}): void {
   liveStates.add(state)
   ctx.effect(() => () => { liveStates.delete(state) })
   // Re-apply resets the restriction: an omitted allowedActions lifts it.
-  state.restrictedTo = config.allowedActions !== undefined ? [...config.allowedActions] : undefined
+  state.configRestrictedTo = config.allowedActions !== undefined ? [...config.allowedActions] : undefined
 
   ctx.systemPrompt.section({
     name: 'tool:browser',
@@ -255,12 +314,12 @@ export function apply(ctx: Context, config: Config = {}): void {
       // browser_open is an overview of what just loaded, not a locator: it has no
       // `coords` parameter, so coordinates stay off here (browser_snapshot owns
       // that switch for callers that actually target pixels).
-      render: (args, value) => [{ type: 'text', text: formatSnapshot(value, { coords: (args as { coords?: boolean }).coords === true }) }],
+      render: (args, value) => [{ type: 'text', text: formatSnapshot(value, {}) }],
     },
     timeoutMs,
     isConcurrencySafe: () => false, // opens tabs / navigates; exclusive within a task
     async execute(args, exec) {
-      assertAllowed(state, 'browser_open')
+      assertAllowed(state, 'browser_open', taskKey(exec))
       const browser = ctx.get('browser')
       if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
       const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
@@ -525,7 +584,7 @@ export function apply(ctx: Context, config: Config = {}): void {
     timeoutMs,
     isConcurrencySafe: () => false, // page JS can be stateful
     async execute(args, exec) {
-      assertAllowed(state, 'browser_execute')
+      assertAllowed(state, 'browser_execute', taskKey(exec))
       const browser = ctx.get('browser')
       if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
       const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
@@ -612,7 +671,7 @@ export function apply(ctx: Context, config: Config = {}): void {
     timeoutMs,
     isConcurrencySafe: () => true,
     async execute(args, exec) {
-      assertAllowed(state, 'browser_scrape')
+      assertAllowed(state, 'browser_scrape', taskKey(exec))
       const browser = ctx.get('browser')
       if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
       const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
@@ -650,11 +709,17 @@ export function apply(ctx: Context, config: Config = {}): void {
     timeoutMs,
     isConcurrencySafe: () => false,
     async execute(args, exec) {
-      assertAllowed(state, 'browser_click')
+      assertAllowed(state, 'browser_click', taskKey(exec))
       const browser = ctx.get('browser')
       if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
       const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
       const target = args.target as { by?: string; value?: string; index?: number } | undefined
+      // A target whose value is empty is a caller mistake, not a request to fall back.
+      // Degrading silently sent typed text to whatever held focus — possibly a password
+      // field — or dropped the semantic target in favour of coordinates.
+      if (target !== undefined && typeof target.value === 'string' && target.value === '') {
+        throw new Error('target.value is empty; pass a css selector, visible text or XPath, or omit target entirely to use x/y')
+      }
       if (target !== undefined && typeof target.value === 'string' && target.value !== '') {
         await browser.click(session, {
           target: {
@@ -696,11 +761,17 @@ export function apply(ctx: Context, config: Config = {}): void {
     timeoutMs,
     isConcurrencySafe: () => false,
     async execute(args, exec) {
-      assertAllowed(state, 'browser_type')
+      assertAllowed(state, 'browser_type', taskKey(exec))
       const browser = ctx.get('browser')
       if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
       const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
       const target = args.target as { by?: string; value?: string; index?: number } | undefined
+      // A target whose value is empty is a caller mistake, not a request to fall back.
+      // Degrading silently sent typed text to whatever held focus — possibly a password
+      // field — or dropped the semantic target in favour of coordinates.
+      if (target !== undefined && typeof target.value === 'string' && target.value === '') {
+        throw new Error('target.value is empty; pass a css selector, visible text or XPath, or omit target entirely to use x/y')
+      }
       if (target !== undefined && typeof target.value === 'string' && target.value !== '') {
         await browser.type(session, {
           text: args.text,
@@ -734,7 +805,7 @@ export function apply(ctx: Context, config: Config = {}): void {
     timeoutMs,
     isConcurrencySafe: () => false, // mutates page scroll state; exclusive within a task
     async execute(args, exec) {
-      assertAllowed(state, 'browser_scroll')
+      assertAllowed(state, 'browser_scroll', taskKey(exec))
       const browser = ctx.get('browser')
       if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
       const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
@@ -760,7 +831,7 @@ export function apply(ctx: Context, config: Config = {}): void {
     timeoutMs,
     isConcurrencySafe: () => false, // mutates page state; exclusive within a task
     async execute(_args, exec) {
-      assertAllowed(state, 'browser_back')
+      assertAllowed(state, 'browser_back', taskKey(exec))
       const browser = ctx.get('browser')
       if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
       const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
@@ -780,7 +851,7 @@ export function apply(ctx: Context, config: Config = {}): void {
     timeoutMs,
     isConcurrencySafe: () => false, // mutates page state; exclusive within a task
     async execute(_args, exec) {
-      assertAllowed(state, 'browser_forward')
+      assertAllowed(state, 'browser_forward', taskKey(exec))
       const browser = ctx.get('browser')
       if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
       const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
@@ -800,7 +871,7 @@ export function apply(ctx: Context, config: Config = {}): void {
     timeoutMs,
     isConcurrencySafe: () => false, // reloads the page; exclusive within a task
     async execute(_args, exec) {
-      assertAllowed(state, 'browser_refresh')
+      assertAllowed(state, 'browser_refresh', taskKey(exec))
       const browser = ctx.get('browser')
       if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
       const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
@@ -822,7 +893,7 @@ export function apply(ctx: Context, config: Config = {}): void {
     timeoutMs,
     isConcurrencySafe: () => false, // mutates page state; exclusive within a task
     async execute(args, exec) {
-      assertAllowed(state, 'browser_key')
+      assertAllowed(state, 'browser_key', taskKey(exec))
       const browser = ctx.get('browser')
       if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
       const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
@@ -847,7 +918,7 @@ export function apply(ctx: Context, config: Config = {}): void {
             label: { type: 'string', description: 'Match by associated <label> text or aria-label.' },
             placeholder: { type: 'string', description: 'Match by placeholder text.' },
             kind: { type: 'string', enum: ['text', 'textarea', 'checkbox', 'radio', 'select'], description: 'Field kind; defaults to text.' },
-            value: { type: 'string', description: 'Value to set (string form; booleans/numbers accepted as strings).' },
+            value: { type: 'string', required: true, description: 'Value to set (string form; booleans/numbers accepted as strings). Required: omitting it would be read as "set empty", which unchecks a checkbox and clears a text field while still reporting success.' },
           },
         },
       },
@@ -891,18 +962,28 @@ export function apply(ctx: Context, config: Config = {}): void {
     timeoutMs,
     isConcurrencySafe: () => false,
     async execute(args, exec) {
-      assertAllowed(state, 'browser_fill')
+      assertAllowed(state, 'browser_fill', taskKey(exec))
       const browser = ctx.get('browser')
       if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
       const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
-      const fields = (args.fields ?? []).map((f: { selector?: string; name?: string; label?: string; placeholder?: string; kind?: string; value?: string }) => ({
-        ...f.selector !== undefined ? { selector: f.selector } : {},
-        ...f.name !== undefined ? { name: f.name } : {},
-        ...f.label !== undefined ? { label: f.label } : {},
-        ...f.placeholder !== undefined ? { placeholder: f.placeholder } : {},
-        ...f.kind !== undefined ? { kind: f.kind as 'text' | 'textarea' | 'checkbox' | 'radio' | 'select' } : {},
-        value: parseFillValue(f.value),
-      }))
+      const fields = (args.fields ?? []).map((f: { selector?: string; name?: string; label?: string; placeholder?: string; kind?: string; value?: string }) => {
+        // A missing value is a caller mistake, not a request to clear the field. Turning
+        // it into '' silently unchecks a checkbox or empties a text input while the tool
+        // still reports success, so it fails loudly. The schema marks value required, but
+        // a call can still arrive without it.
+        if (f.value === undefined) {
+          const matcher = f.selector ?? f.name ?? f.label ?? f.placeholder ?? '(no matcher)'
+          throw new Error(`browser_fill: field "${matcher}" has no "value"; pass one (use "false" to uncheck, or "" to clear deliberately)`)
+        }
+        return {
+          ...f.selector !== undefined ? { selector: f.selector } : {},
+          ...f.name !== undefined ? { name: f.name } : {},
+          ...f.label !== undefined ? { label: f.label } : {},
+          ...f.placeholder !== undefined ? { placeholder: f.placeholder } : {},
+          ...f.kind !== undefined ? { kind: f.kind as 'text' | 'textarea' | 'checkbox' | 'radio' | 'select' } : {},
+          value: parseFillValue(f.value),
+        }
+      })
       const result = await browser.fillForm(session, {
         fields,
         ...args.submit === true ? { submit: true } : {},
@@ -950,7 +1031,7 @@ export function apply(ctx: Context, config: Config = {}): void {
     timeoutMs,
     isConcurrencySafe: () => false, // mutates a field; exclusive within a task
     async execute(args, exec) {
-      assertAllowed(state, 'browser_set_value')
+      assertAllowed(state, 'browser_set_value', taskKey(exec))
       const browser = ctx.get('browser')
       if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
       const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
@@ -981,7 +1062,7 @@ export function apply(ctx: Context, config: Config = {}): void {
     timeoutMs,
     isConcurrencySafe: () => false, // mutates a field; exclusive within a task
     async execute(args, exec) {
-      assertAllowed(state, 'browser_check')
+      assertAllowed(state, 'browser_check', taskKey(exec))
       const browser = ctx.get('browser')
       if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
       const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
@@ -1021,7 +1102,7 @@ export function apply(ctx: Context, config: Config = {}): void {
     timeoutMs,
     isConcurrencySafe: () => false, // mutates a field; exclusive within a task
     async execute(args, exec) {
-      assertAllowed(state, 'browser_select')
+      assertAllowed(state, 'browser_select', taskKey(exec))
       const browser = ctx.get('browser')
       if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
       const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
@@ -1053,7 +1134,7 @@ export function apply(ctx: Context, config: Config = {}): void {
     timeoutMs,
     isConcurrencySafe: () => false, // mutates a field; exclusive within a task
     async execute(args, exec) {
-      assertAllowed(state, 'browser_clear')
+      assertAllowed(state, 'browser_clear', taskKey(exec))
       const browser = ctx.get('browser')
       if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
       const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
@@ -1094,7 +1175,7 @@ export function apply(ctx: Context, config: Config = {}): void {
     timeoutMs,
     isConcurrencySafe: () => true,
     async execute(args, exec) {
-      assertAllowed(state, 'browser_get_value')
+      assertAllowed(state, 'browser_get_value', taskKey(exec))
       const browser = ctx.get('browser')
       if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
       const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
@@ -1116,11 +1197,11 @@ export function apply(ctx: Context, config: Config = {}): void {
 
   ctx.tools.register(defineTool({
     name: 'browser_screenshot',
-    description: 'Capture the current shared-browser page as a screenshot (PNG default, JPEG optional). This is for models that can read images: layout checks, charts, designs, CAPTCHAs, or locating an element by eye before clicking its coordinates. A model without image input gains nothing from it — browser_snapshot, browser_a11y and browser_content carry the same page as text, and browser_scrape extracts structured data. Supports full-page capture, save-to-file, JPEG encoding, and downscaling (maxWidth/maxHeight) to cut vision-tool token cost. JPEG is only available on the self-hosted native path; the desktop-shell path returns PNG.',
+    description: 'Capture the current shared-browser page as a screenshot (PNG default, JPEG optional). This is for models that can read images: layout checks, charts, designs, CAPTCHAs, or locating an element by eye before clicking its coordinates. A model without image input gains nothing from it — browser_snapshot, browser_a11y and browser_content carry the same page as text, and browser_scrape extracts structured data. Supports full-page capture, save-to-file, JPEG encoding, and downscaling (maxWidth/maxHeight) to cut vision-tool token cost. JPEG needs a browser whose CDP encoder works — the self-hosted browser and an installed Chrome/Edge; the desktop sidebar falls back to PNG because the Electron CDP JPEG encoder hangs. Downscaling works on every carrier.',
     parameters: {
       fullPage: { type: 'boolean', description: 'Capture the full scrollable page instead of the viewport (default false).' },
       savePath: { type: 'string', description: 'Absolute file path to also save the image to (e.g. for read_image vision location). Must resolve inside the configured downloadDir (default: the system Downloads folder, localized names such as ~/下载 included); an existing file is never overwritten.' },
-      format: { type: 'string', enum: ['png', 'jpeg'], description: 'Image format (default png; jpeg is self-hosted native path only).' },
+      format: { type: 'string', enum: ['png', 'jpeg'], description: 'Image format (default png; jpeg needs the self-hosted browser or an installed Chrome/Edge; the desktop sidebar returns PNG because the Electron CDP JPEG encoder hangs).' },
       quality: { type: 'number', description: 'JPEG quality 1-100 (default 80); ignored for PNG.' },
       maxWidth: { type: 'number', description: 'Downscale to fit within this width (aspect preserved).' },
       maxHeight: { type: 'number', description: 'Downscale to fit within this height (aspect preserved).' },
@@ -1212,7 +1293,7 @@ export function apply(ctx: Context, config: Config = {}): void {
       timeoutMs,
       isConcurrencySafe: () => false, // mutates the active tab; exclusive within a task
       async execute(args, exec) {
-        assertAllowed(state, 'browser_switch_tab')
+        assertAllowed(state, 'browser_switch_tab', taskKey(exec))
         const browser = ctx.get('browser')
         if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
         const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
@@ -1234,7 +1315,7 @@ export function apply(ctx: Context, config: Config = {}): void {
       timeoutMs,
       isConcurrencySafe: () => false, // mutates the tab list; exclusive within a task
       async execute(args, exec) {
-        assertAllowed(state, 'browser_close_tab')
+        assertAllowed(state, 'browser_close_tab', taskKey(exec))
         const browser = ctx.get('browser')
         if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
         const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
@@ -1254,7 +1335,7 @@ export function apply(ctx: Context, config: Config = {}): void {
       timeoutMs,
       isConcurrencySafe: () => false, // closes every tab; exclusive within a task
       async execute(_args, exec) {
-        assertAllowed(state, 'browser_reset')
+        assertAllowed(state, 'browser_reset', taskKey(exec))
         const browser = ctx.get('browser')
         if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
         const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
@@ -1327,9 +1408,6 @@ export function apply(ctx: Context, config: Config = {}): void {
         if (e.action === 'replay' && params.of === 'type' && typeof params.text === 'string') {
           params.text = '*'.repeat(Math.min(params.text.length, 64)) + ` (${params.text.length} chars)`
         }
-        if (e.action === 'replay' && params.of === 'setValue' && typeof params.value === 'string') {
-          params.value = '*'.repeat(Math.min(params.value.length, 64)) + ` (${params.value.length} chars)`
-        }
         // Execute scripts may embed form tokens / credentials; mask script,
         // args, and result for both direct execute and replay-of-execute.
         const isExecute = e.action === 'execute' || (e.action === 'replay' && params.of === 'execute')
@@ -1446,7 +1524,7 @@ export function apply(ctx: Context, config: Config = {}): void {
     timeoutMs,
     isConcurrencySafe: () => false,
     async execute(args, exec) {
-      assertAllowed(state, 'browser_replay')
+      assertAllowed(state, 'browser_replay', taskKey(exec))
       const browser = ctx.get('browser')
       if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
       const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
@@ -1469,7 +1547,7 @@ export function apply(ctx: Context, config: Config = {}): void {
     timeoutMs,
     isConcurrencySafe: () => false,
     async execute(args, exec) {
-      assertAllowed(state, 'browser_download')
+      assertAllowed(state, 'browser_download', taskKey(exec))
       const browser = ctx.get('browser')
       if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
       const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
@@ -1530,7 +1608,7 @@ export function apply(ctx: Context, config: Config = {}): void {
     timeoutMs,
     isConcurrencySafe: () => false, // closes the whole session; exclusive within a task
     async execute(_args, exec) {
-      assertAllowed(state, 'browser_reset_session')
+      assertAllowed(state, 'browser_reset_session', taskKey(exec))
       const browser = ctx.get('browser')
       if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
       const key = taskKey(exec)
@@ -1571,12 +1649,14 @@ export function apply(ctx: Context, config: Config = {}): void {
       if (unknown.length > 0) {
         throw new Error(`browser_restrict: unknown tool name(s) ${unknown.map(t => `"${t}"`).join(', ')} (must start with "browser_")`)
       }
-      // Empty list (or omitted) lifts the restriction; a non-empty list is the
-      // new allow-list. Scoped to this plugin apply (this Cordis context).
-      // In DSH each agent has its own context, so the restriction never leaks
-      // between tasks.
-      state.restrictedTo = allowed.length === 0 ? undefined : [...allowed]
-      return { restrictedTo: state.restrictedTo === undefined ? [] : [...state.restrictedTo] }
+      // Empty list (or omitted) lifts this task's restriction; a non-empty list is its
+      // new allow-list. Per task, not per plugin: this state object is shared by every
+      // agent, so one value here used to lock every other task's browser tools.
+      //
+      if (allowed.length === 0) state.restrictedByTask.delete(taskKey(exec))
+      else state.restrictedByTask.set(taskKey(exec), [...allowed])
+      const current = state.restrictedByTask.get(taskKey(exec))
+      return { restrictedTo: current === undefined ? [] : [...current] }
     },
   }))
 
@@ -1601,7 +1681,7 @@ export function apply(ctx: Context, config: Config = {}): void {
     timeoutMs,
     isConcurrencySafe: () => false,
     async execute(args, exec) {
-      assertAllowed(state, 'browser_auth')
+      assertAllowed(state, 'browser_auth', taskKey(exec))
       const browser = ctx.get('browser')
       if (browser === undefined) throw new Error('tool-browser: browser service unavailable')
       const session = await ensureSession(browser, state, taskKey(exec), agentOf(exec))
@@ -1609,7 +1689,13 @@ export function apply(ctx: Context, config: Config = {}): void {
         const cookies = await browser.flushAuth(session)
         return { cookies: cookies.map(c => ({ ...c })) as never }
       }
-      const list = (args.cookies ?? []) as unknown[]
+      // The description says cookies are required for restore; without this check an
+      // empty call returned {restored: 0} and rendered 'Restored 0 cookies.', which
+      // reads as success and would leave the caller believing the login was restored.
+      if (!Array.isArray(args.cookies) || args.cookies.length === 0) {
+        throw new Error('browser_auth: action "restore" needs a non-empty "cookies" array (get one from action "export" on the same profile)')
+      }
+      const list = args.cookies as unknown[]
       const restored = await browser.restoreAuth(session, list as never)
       return { restored }
     },