dsh-builtin-browser 0.4.2 → 0.4.6

package/lib/tool-browser/index.js

@@ -14,6 +14,7 @@
  * @module dsh-browser/tool-browser
  */
 import { defineTool } from '@deepseek-ai/dsh-tools';
+import { ELEMENT_ITEM_SCHEMA, NODE_ITEM_SCHEMA, projectElement, projectNode, } from './element-fields.js';
 /**
  * Register a cleanup that runs once when the process exits.
  *
@@ -278,24 +279,8 @@ export function apply(ctx, config = {}) {
                     elements: {
                         type: 'array',
                         required: true,
-                        items: {
-                            type: 'object',
-                            additionalProperties: false,
-                            properties: {
-                                ref: { type: 'number', required: true },
-                                kind: { type: 'string', required: true },
-                                label: { type: 'string', required: true },
-                                x: { type: 'number', required: true },
-                                y: { type: 'number', required: true },
-                                frame: { type: 'boolean' },
-                                // The page-side script computes this for every element and the tool layer
-                                // passes it through. Without it in the schema, a declared
-                                // additionalProperties: false rejects the whole result at run time — which is
-                                // how this was found, on the very first real call, after a static review had
-                                // called the change verified.
-                                selector: { type: 'string' },
-                            },
-                        },
+                        // Same shared item schema as browser_open's, so the two cannot drift apart.
+                        items: ELEMENT_ITEM_SCHEMA,
                     },
                     challenge: {
                         type: 'object',
@@ -329,7 +314,7 @@ export function apply(ctx, config = {}) {
             return {
                 url: snapshot.url,
                 ...snapshot.title !== undefined ? { title: snapshot.title } : {},
-                elements: snapshot.elements.map(el => ({ ref: el.ref, kind: el.kind, label: el.label, selector: el.selector, x: el.x, y: el.y, ...el.frame === true ? { frame: true } : {} })),
+                elements: snapshot.elements.map(el => projectElement(el)),
                 truncated: snapshot.truncated,
                 ...snapshot.challenge !== undefined ? { challenge: snapshot.challenge } : {},
             };
@@ -395,7 +380,7 @@ export function apply(ctx, config = {}) {
             return {
                 url: snapshot.url,
                 ...snapshot.title !== undefined ? { title: snapshot.title } : {},
-                elements: snapshot.elements.map(el => ({ ref: el.ref, kind: el.kind, label: el.label, selector: el.selector, x: el.x, y: el.y, ...el.frame === true ? { frame: true } : {} })),
+                elements: snapshot.elements.map(el => projectElement(el)),
                 truncated: snapshot.truncated,
                 ...snapshot.challenge !== undefined ? { challenge: snapshot.challenge } : {},
             };
@@ -421,28 +406,8 @@ export function apply(ctx, config = {}) {
                     nodes: {
                         type: 'array',
                         required: true,
-                        items: {
-                            type: 'object',
-                            additionalProperties: false,
-                            properties: {
-                                ref: { type: 'number', required: true },
-                                role: { type: 'string', required: true },
-                                name: { type: 'string', required: true },
-                                value: { type: 'string' },
-                                states: { type: 'array', required: true, items: { type: 'string' } },
-                                depth: { type: 'number', required: true },
-                                tag: { type: 'string', required: true },
-                                x: { type: 'number', required: true },
-                                y: { type: 'number', required: true },
-                                frame: { type: 'boolean' },
-                                // The page-side script computes this for every element and the tool layer
-                                // passes it through. Without it in the schema, a declared
-                                // additionalProperties: false rejects the whole result at run time — which is
-                                // how this was found, on the very first real call, after a static review had
-                                // called the change verified.
-                                selector: { type: 'string' },
-                            },
-                        },
+                        // Same shared table as the node projection.
+                        items: NODE_ITEM_SCHEMA,
                     },
                 },
             },
@@ -491,23 +456,18 @@ export function apply(ctx, config = {}) {
                 ...result.title !== undefined ? { title: result.title } : {},
                 count: result.count,
                 truncated: result.truncated,
-                nodes: result.nodes.map(n => ({
-                    ref: n.ref,
-                    role: n.role,
-                    name: n.name,
-                    ...n.value !== null ? { value: n.value } : {},
-                    states: [...n.states],
-                    depth: n.depth,
-                    tag: n.tag,
-                    // The provider computes this and the renderer prints it, but this mapping is an
-                    // explicit allow-list rather than a pass-through — so leaving it out here silently
-                    // dropped the field between the two, and the tool promised a reference it never
-                    // sent. The snapshot mapping lists its selector; this one did not.
-                    selector: n.selector,
-                    x: n.x,
-                    y: n.y,
-                    ...n.frame === true ? { frame: true } : {},
-                })),
+                // The projection drops `value: null` (the schema declares a string, and the contract is
+                // that an absent value means "not applicable"), so the run-time shape and the inferred
+                // type differ by exactly that. The field table is what keeps the schema and the
+                // projection in agreement; this assertion is the type-level echo of that.
+                // The projection and the schema are now generated from one field table, so the shape
+                // they agree on is guaranteed at run time. TypeScript cannot see that agreement — it
+                // infers the output type from the schema object and compares it against the provider's
+                // interface, which describes the provider's internal shape rather than the contract
+                // (`value` nullable internally, absent on the wire; `selector` required by the
+                // interface, optional in the inferred schema). The assertion bridges that last gap; the
+                // test that walks every registered tool is what checks the agreement for real.
+                nodes: result.nodes.map(n => projectNode(n)),
             };
         },
     }));
@@ -1266,7 +1226,7 @@ export function apply(ctx, config = {}) {
                     path: { type: 'string', description: 'The file path the screenshot was saved to, when savePath was given.' },
                 },
             },
-            render: (_args, value) => [{ type: 'text', text: `Screenshot captured (${Math.round(value.dataUrl.length * 3 / 4 / 1024)} KiB)${value.path !== undefined ? ` saved to ${value.path}` : ''}.` }],
+            render: (_args, value) => [{ type: 'text', text: `Screenshot captured (${Math.round(value.dataUrl.length * 3 / 4 / 1024)} KiB${value.width !== undefined && value.height !== undefined ? `, ${value.width}x${value.height}` : ''})${value.path !== undefined ? ` saved to ${value.path}` : ''}.` }],
         },
         timeoutMs,
         isConcurrencySafe: () => true,
@@ -1286,6 +1246,12 @@ export function apply(ctx, config = {}) {
             return {
                 dataUrl: shot.dataUrl,
                 ...shot.path !== undefined ? { path: shot.path } : {},
+                // The provider measures these when it scales, the schema declares them, and the seam
+                // type carries them — but this mapping is an allow-list, so leaving them out dropped
+                // them silently. Same shape of bug as the a11y selector, found the same way: by
+                // reading the three places that mention a field and noticing this one did not.
+                ...shot.width !== undefined ? { width: shot.width } : {},
+                ...shot.height !== undefined ? { height: shot.height } : {},
             };
         },
     }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-builtin-browser",
-  "version": "0.4.2",
+  "version": "0.4.6",
   "description": "Shared real browser plugin for DeepSeek Harness: install-and-use — a visible native browser the human can take over, driven by the agent over CDP. DOM-level interaction (React/Vue safe), per-task session isolation, cookie persistence (browser_auth), CAPTCHA detection, batch form fill (browser_fill), authenticated download, history/replay, action restriction",
   "type": "module",
   "main": "lib/index.js",
@@ -40,6 +40,7 @@
     "cordis.patch.yml",
     "README.md",
     "README.en.md",
+    "CHANGELOG.md",
     "LICENSE",
     "scripts"
   ],
@@ -74,7 +75,10 @@
     "@deepseek-ai/dsh-llm": ">=0.1.1-rc.2 <0.3.0",
     "@deepseek-ai/dsh-tools": ">=0.1.1-rc.2 <0.3.0",
     "@deepseek-ai/dsh-system-prompt": ">=0.1.1-rc.2 <0.3.0",
-    "@deepseek-ai/schemastery": "^3.18.1"
+    "@deepseek-ai/schemastery": "^3.18.1",
+    "@deepseek-ai/dsh-client-locale": ">=0.1.1-rc.2 <0.3.0",
+    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.1-rc.2 <0.3.0",
+    "@deepseek-ai/dsh-client-ui-slots": ">=0.1.1-rc.2 <0.3.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",

package/src/browser/types.ts

@@ -396,8 +396,15 @@ export interface BrowserA11yNode {
   readonly role: string
   /** Accessible name (aria-label, label text, placeholder, own text, …). */
   readonly name: string
-  /** Current value of input-like nodes (null when not applicable). */
-  readonly value: string | null
+  /**
+   * Current value of input-like nodes; absent when the node has none.
+   *
+   * The provider produces `null` for "not applicable" and the tool layer drops it, so absence
+   * and null mean the same thing here — which is what the output schema declares (`string`,
+   * not nullable). Saying `string | null` described the provider's internal shape rather than
+   * the contract, and the two disagreed at every call.
+   */
+  readonly value?: string
   /** ARIA/DOM states: enabled/disabled/checked/unchecked/expanded/… */
   readonly states: readonly string[]
   /** DOM depth (within its document), for reconstructing the tree. */

package/src/browser-electron/bridge-connection.ts

@@ -1,3 +1,4 @@
+import { readFileSync } from 'node:fs'
 /**
  * Transport for the desktop shell's browser bridge: one long-lived connection to a
  * loopback TCP service.
@@ -80,8 +81,41 @@ export class BridgeConnection {
 
   /**
    * @param endpoint - the shell's published bridge endpoint.
+   * @param endpointPath - where that endpoint is republished, so a moved port can be followed.
    */
-  constructor(private readonly endpoint: BridgeEndpoint) {}
+  constructor(private endpoint: BridgeEndpoint, private readonly endpointPath?: string) {}
+
+  /**
+   * Re-read the published endpoint, and adopt it if the shell has moved.
+   *
+   * The bridge binds an ephemeral port and picks a NEW one whenever its server is recreated. The
+   * endpoint file is rewritten every fifteen seconds, but a host that adopted the old one keeps
+   * dialling a dead port forever: measured here as `connect ECONNREFUSED 127.0.0.1:52276` while
+   * the live bridge sat on 52411. Discarding the socket is not enough — the comment below says a
+   * dead connection must never become a dead plugin, and a stale PORT makes exactly that happen.
+   *
+   * Cheap and safe: one small file read per call, no socket work.
+   *
+   * @returns true when a different endpoint was adopted.
+   */
+  private refreshEndpoint(): boolean {
+    if (this.endpointPath === undefined) return false
+    try {
+      const raw = JSON.parse(readFileSync(this.endpointPath, 'utf8')) as Partial<BridgeEndpoint>
+      if (typeof raw.port !== 'number' || typeof raw.token !== 'string') return false
+      if (raw.port === this.endpoint.port && raw.token === this.endpoint.token) return false
+      this.endpoint = {
+        port: raw.port,
+        token: raw.token,
+        pid: typeof raw.pid === 'number' ? raw.pid : this.endpoint.pid,
+      }
+      // The old socket belongs to the old port.
+      this.reset(new Error('dsh-builtin-browser: the bridge moved; reconnecting to the new port'))
+      return true
+    } catch {
+      return false
+    }
+  }
 
   /**
    * Send one request, reusing the socket if it is still healthy.
@@ -102,6 +136,8 @@ export class BridgeConnection {
     // straight-line re-dial rather than a retry loop: an earlier revision re-entered call()
     // from inside its own promise executor, which left an orphaned pending entry behind and,
     // when the condition could not clear, spun until the process ran out of heap.
+    // Follow the shell if its bridge moved to a new port (see refreshEndpoint).
+    this.refreshEndpoint()
     let socket = this.ensureSocket()
     if (this.serialisable && this.queue.length > 0) {
       this.reset(new Error('dsh-builtin-browser: bridge connection reopened so replies stay attributable'))

package/src/browser-electron/desktop-bridge-host.ts

@@ -45,7 +45,9 @@ export function bridgeEndpointPath(): string {
  */
 function isGuestGone(error: unknown): boolean {
   const message = error instanceof Error ? error.message : String(error)
-  return /guest \d+ is not available|sidebar unavailable|did not create a browser guest/i.test(message)
+  // The panel path reports its own failure when the renderer never produced a page, and that is the
+  // same class as a vanished guest — worth one retry on a fresh panel — so it is listed here too.
+  return /guest \d+ is not available|sidebar unavailable|produced no page/i.test(message)
 }
 
 /**
@@ -58,16 +60,53 @@ function isGuestGone(error: unknown): boolean {
  */
 export class DesktopBridgeViewHost implements ElectronBrowserViewHost {
   private readonly connection: BridgeConnection
-  private readonly views = new Map<string, number>()
   /**
-   * Guests whose view is gone but whose page may still be open in the sidebar.
+   * One entry per view this host handed out: the conversation it serves, and the guest backing it.
    *
-   * The provider destroys its view handles before it asks for a release, so the
-   * mapping is dropped by then — keeping the guest ids here is what lets us close
-   * only our own tabs when several sessions are running (requirements §4: each
-   * session gets its own page).
+   * The conversation belongs to the ENTRY, not to this host. A single plugin process serves every
+   * conversation — DSH runs them all through one host instance — so an owner held on the host
+   * would be one conversation's id applied to all of them, and a page could still land in
+   * another's sidebar however carefully the bridge checked it.
    */
-  private readonly orphaned = new Set<number>()
+  private readonly views = new Map<string, { guest?: number; owner: string }>()
+  /**
+   * This process's identity with the bridge, for tab ownership.
+   *
+   * Every DSH session is its own plugin process, and the sidebar is one surface they all share.
+   * A session can only see its own `views` map, so before the bridge kept a ledger it adopted
+   * whichever tab it found — including one another session had opened, which is how a URL from
+   * one session appeared in another's sidebar. The id is per process, so two sessions never
+   * collide and one session's tabs are never handed to another; it is deliberately not the DSH
+   * session id, which this layer has no access to and does not need.
+   *
+   * The whole ledger rests on that premise, so it was measured rather than assumed: with two
+   * sessions running, the desktop had TWO host processes (plus one main, two renderers and a
+   * gpu/utility pair). If sessions ever shared a process, every owner check in the bridge would
+   * compare equal and the bleed would return in a new shape — so a change to how DSH spawns
+   * sessions invalidates this file, not just this comment.
+   *
+   * It is now the CONVERSATION id rather than an invented uuid, read from the plugin's ctx by the
+   * same path DSH's own desktop host uses. That matters because the shell keeps one sidebar per
+   * conversation and writes its session id onto each sidebar container (on the React fiber,
+   * measured on the running app) — so the bridge can only answer "is this sidebar mine" if it has
+   * a comparable id. With an invented uuid it never could, which is how a command came to be typed
+   * into another conversation's address bar.
+   *
+   * Falls back to a random uuid when the host cannot supply one — an older DSH, or a non-desktop
+   * composition. That is no worse than before: the bridge then knows only "this process", and it
+   * refuses to operate on a sidebar it cannot prove is its own.
+   */
+  private readonly owner: string
+  /**
+   * Guests whose view is gone but whose page may still be open in the sidebar, with the
+   * conversation each belongs to.
+   *
+   * The provider destroys its view handles before it asks for a release, so the mapping is dropped
+   * by then — keeping the guest ids here is what lets us close only our own tabs when several
+   * conversations are running (requirements §4: each session gets its own page). The owner rides
+   * along for the same reason it does in {@link views}: a release names one conversation.
+   */
+  private readonly orphaned = new Map<number, string>()
   /**
    * Registered by the provider, and deliberately never invoked on this carrier.
    *
@@ -83,8 +122,9 @@ export class DesktopBridgeViewHost implements ElectronBrowserViewHost {
   /**
    * @param endpoint - the shell's published bridge endpoint.
    */
-  private constructor(endpoint: BridgeEndpoint) {
-    this.connection = new BridgeConnection(endpoint)
+  private constructor(endpoint: BridgeEndpoint, sessionId?: string) {
+    this.owner = sessionId !== undefined && sessionId !== String.fromCharCode(39,39) ? sessionId : randomUUID()
+    this.connection = new BridgeConnection(endpoint, bridgeEndpointPath())
   }
 
   /**
@@ -95,7 +135,7 @@ export class DesktopBridgeViewHost implements ElectronBrowserViewHost {
    * caller falls back to self-hosting, which always works.
    * @returns the host, or undefined when no bridge is available.
    */
-  static async discover(): Promise<DesktopBridgeViewHost | undefined> {
+  static async discover(sessionId?: string): Promise<DesktopBridgeViewHost | undefined> {
     let endpoint: BridgeEndpoint
     try {
       const raw = JSON.parse(readFileSync(bridgeEndpointPath(), 'utf8')) as Partial<BridgeEndpoint>
@@ -107,10 +147,10 @@ export class DesktopBridgeViewHost implements ElectronBrowserViewHost {
     try {
       // A throwaway connection for discovery: the adopted host opens its own, and a
       // rejected endpoint must not leave a socket behind.
-      const probe = new BridgeConnection(endpoint)
+      const probe = new BridgeConnection(endpoint, bridgeEndpointPath())
       try {
         const answer = await probe.call({ op: 'list' }, 5_000)
-        return answer.ok === true ? new DesktopBridgeViewHost(endpoint) : undefined
+        return answer.ok === true ? new DesktopBridgeViewHost(endpoint, sessionId) : undefined
       } finally {
         probe.close()
       }
@@ -126,61 +166,58 @@ export class DesktopBridgeViewHost implements ElectronBrowserViewHost {
   }
 
   /**
-   * The guest id backing a view, materialized on first use.
+   * The guest backing a view, materialized on first use.
    *
-   * The sidebar browser is itself a multi-tab surface, so each view gets its own
-   * tab's guest: the provider's tab bookkeeping then maps onto real tabs the human
-   * can see and switch between. Two rules keep that honest:
-   *   - a cached guest is used as-is: probing it first cost a round-trip on every
-   *     command, so liveness is established by the command failing instead;
-   *   - a fresh view takes an unclaimed guest, growing the tab strip only when
-   *     every existing guest is already spoken for.
+   * The conversation that called owns exactly one sidebar page on this carrier — a human and the
+   * agent look at the same page — so every view resolves to that conversation's own guest, and the
+   * page does not multiply behind the provider's own tab bookkeeping.
+   *
+   * A cached guest is used as-is: probing it first cost a round-trip on every command, so liveness
+   * is established by the command failing instead.
    * @param viewId - the view whose guest is wanted.
-   * @param url - address to use when a sidebar browser has to be opened first.
+   * @param url - address to use when this conversation has no page yet.
    */
+
   private async guestFor(viewId: string, url?: string): Promise<number> {
-    const existing = this.views.get(viewId)
+    const entry = this.views.get(viewId)
     // No liveness check here: verifying the cached guest cost a round-trip on every
     // command. A guest that has gone away is detected by the command itself failing,
     // and `createView`'s sendCommand then discards the cache and calls back in here.
-    if (existing !== undefined) return existing
+    if (entry?.guest !== undefined) return entry.guest
 
-    // The browser tab must exist before its strip can be extended: `ensureSidebar`
-    // opens the sidebar (and, on a fresh shell, materializes the first guest).
-    const sidebar = await this.connection.call({
+    // The conversation THIS VIEW serves — read from the view, never from the process.
+    //
+    // The difference is the whole bug. This host is one instance shared by every conversation, so
+    // `this.owner` alone can only be "whichever conversation this process happens to name", and
+    // naming the wrong one is exactly how a page requested in one conversation appeared in
+    // another. The view was created for a conversation (`createView(owner)`), so that is what it
+    // asks for its page.
+    //
+    // Nothing here asks which conversation is on screen: `ensureSidebar` reaches this
+    // conversation's own panel by id through the renderer, rather than by pressing the shell's
+    // shortcut or clicking its card, both of which the shell delivers to whatever it displays.
+    const owner = entry?.owner ?? this.owner
+    const answer = await this.connection.call({
       op: 'ensureSidebar',
-      ...url !== undefined ? { url } : {},
-    })
-    if (sidebar.ok !== true) throw new Error(`dsh-builtin-browser: sidebar unavailable (${String(sidebar.error)})`)
-
-    const wanted = this.views.size + 1
-    let ids = await this.guestIds(Math.max(1, wanted))
-    const taken = new Set(this.views.values())
-    let free = ids.find(id => !taken.has(id))
-    if (free === undefined) {
-      // Every tab is already driving something: the strip has to grow.
-      ids = await this.guestIds(ids.length + 1)
-      free = ids.find(id => !taken.has(id))
+      owner,
+      ...url !== undefined && url !== '' ? { url } : {},
+    }, 30_000)
+    if (answer.ok !== true) throw new Error(`dsh-builtin-browser: sidebar unavailable (${String(answer.error)})`)
+    const id = Number(answer.id)
+    if (!Number.isFinite(id) || id <= 0) {
+      throw new Error('dsh-builtin-browser: the sidebar reported no browser page for this conversation')
     }
-    if (free === undefined) throw new Error('dsh-builtin-browser: the sidebar reported no free browser tab')
-    this.views.set(viewId, free)
-    return free
+    this.views.set(viewId, { guest: id, owner })
+    return id
   }
 
   /**
-   * Ask for at least `count` sidebar tabs and return their guest ids.
-   * @param count - minimum number of tabs.
+   * @param owner - the conversation this view serves. Recorded WITH the view: one host instance
+   *   serves every conversation, so the owner cannot live on the host.
    */
-  private async guestIds(count: number): Promise<number[]> {
-    const answer = await this.connection.call({ op: 'ensureTabs', count })
-    if (answer.ok !== true) throw new Error(`dsh-builtin-browser: could not open a sidebar tab (${String(answer.error)})`)
-    const ids = Array.isArray(answer.ids) ? answer.ids.map(Number).filter(Number.isFinite) : []
-    if (ids.length === 0) throw new Error('dsh-builtin-browser: the sidebar reported no browser tabs')
-    return ids
-  }
-
-  createView(): ElectronViewHandle {
+  createView(owner?: string): ElectronViewHandle {
     const viewId = randomUUID()
+    this.views.set(viewId, { owner: owner !== undefined && owner !== '' ? owner : this.owner })
     const navigateUrl = (method: string, params?: Record<string, unknown>): string | undefined =>
       method === 'Page.navigate' ? String((params as { url?: unknown })?.url ?? '') : undefined
     const run = async (guest: number, method: string, params?: Record<string, unknown>): Promise<Record<string, unknown>> => {
@@ -205,7 +242,10 @@ export class DesktopBridgeViewHost implements ElectronBrowserViewHost {
           // The human closed the tab: the page is gone, so take a fresh one and
           // replay the command once. This is the "closing the interface ends the
           // session" rule, now paid for only when it actually happens.
-          this.views.delete(viewId)
+          // Drop the guest but keep the entry: the conversation it serves is what the retry needs,
+          // and removing the entry would lose it back to the process-wide fallback owner.
+          const lost = this.views.get(viewId)
+          if (lost !== undefined) delete lost.guest
           guest = await this.guestFor(viewId, url)
           return await run(guest, method, params)
         }
@@ -214,41 +254,44 @@ export class DesktopBridgeViewHost implements ElectronBrowserViewHost {
   }
 
   destroyView(handle: ElectronViewHandle): void {
-    const guest = this.views.get(handle.id)
-    if (guest !== undefined) {
-      // Remember it: the page outlives our handle, and a later release must be able
-      // to name exactly the tabs this plugin opened.
-      this.orphaned.add(guest)
+    const entry = this.views.get(handle.id)
+    if (entry !== undefined) {
+      // Remember the page: it outlives our handle, and a later release must be able to name
+      // exactly the tabs this conversation's views opened. The owner comes along so a release
+      // naming one conversation does not sweep up another's.
+      if (entry.guest !== undefined) this.orphaned.set(entry.guest, entry.owner)
       this.views.delete(handle.id)
     }
   }
 
   /**
-   * Nothing to show: the sidebar is already on screen, and showing it again is
-   * the shell's business (it owns the tab strip and the visibility toggle).
+   * Bring this view's tab to the front in the sidebar.
+   *
+   * This used to be empty, on the reasoning that the sidebar is already on screen so there is
+   * nothing to show. That confused "the sidebar is visible" with "this page is the one being
+   * looked at": opening a page left it behind whatever the human had in front, which is issue
+   * #23. The other two carriers both do this — the self-hosted window re-adds the view and the
+   * system browser calls `Page.bringToFront` — so this carrier was the odd one out.
+   *
+   * Best-effort by design: the tab strip belongs to the shell's renderer, and failing to raise
+   * it must not fail the navigation that has already happened.
+   * @param handle - the view to bring forward.
    */
-  showView(): void {}
+  showView(handle: ElectronViewHandle): void {
+    // `owner` is required: the bridge refuses to bring forward a guest held by another session.
+    // It comes from the view, not the process — with several conversations live, a process-wide
+    // owner would raise the wrong conversation's tab.
+    const owner = this.views.get(handle.id)?.owner ?? this.owner
+    void this.connection.call({ op: 'showTab', viewId: Number(handle.id), owner }, 5_000).catch(() => undefined)
+  }
 
-  /** Same as {@link showView}: the page is already presented by the shell. */
-  async presentView(): Promise<void> {}
 
-  /**
-   * The shell owns window grouping, and one sidebar serves every view, so there
-   * is nothing to record here. (It must not write a placeholder guest id either:
-   * a view whose guest is not yet materialized has to stay absent from the map,
-   * or the first real command would be sent to the placeholder.)
-   */
-  groupView(): void {}
 
-  /** Focus is the shell's to manage, and there is no separate window to raise. */
-  async focus(): Promise<void> {}
 
   onUserAction(handler: (action: BrowserUserAction) => void): void {
     this.userActionHandler = handler
   }
 
-  /** The shell reports its own window lifecycle; nothing to subscribe to here. */
-  onViewClosed(): void {}
 
   /**
    * Release the sidebar's browser pages (requirements §3, `ui.closeWithSession`).
@@ -257,21 +300,38 @@ export class DesktopBridgeViewHost implements ElectronBrowserViewHost {
    * belongs to the shell and would happily keep the page (and its renderer) alive.
    * Closing the tabs is what actually ends the page — and only the page: cookies
    * live in the partition, history on disk, so both survive.
+   * @param owner - the conversation whose pages to close. Omit to close every conversation's,
+   *   which is only correct from a teardown that is itself global.
    * @returns a promise that settles once the shell has been asked.
    */
-  async releasePage(): Promise<void> {
-    // Only our own tabs: the ids come from the views we handed out (and their
-    // orphans), never from "every webview currently visible". With two sessions
-    // live, releasing one must leave the other's page alone.
-    const mine = [...this.views.values(), ...this.orphaned]
-    this.views.clear()
-    this.orphaned.clear()
+  async releasePage(owner?: string): Promise<void> {
+    // Only this conversation's tabs. The host is ONE instance shared by every conversation, so a
+    // release that named none would close pages other conversations are still driving — "every
+    // webview currently visible" is precisely what must never be used here.
+    const mine: number[] = []
+    for (const [viewId, entry] of [...this.views]) {
+      if (owner !== undefined && entry.owner !== owner) continue
+      if (entry.guest !== undefined) mine.push(entry.guest)
+      this.views.delete(viewId)
+    }
+    // A view destroyed before the release still owns its page; its guest is collected here.
+    for (const [guest, holder] of [...this.orphaned]) {
+      if (owner !== undefined && holder !== owner) continue
+      mine.push(guest)
+      this.orphaned.delete(guest)
+    }
     // Nothing of ours is open: release nothing. Falling through to an unfiltered
     // release here would close tabs a human opened, or another session's page.
     if (mine.length === 0) return
     let titles: string[]
     try {
-      const answer = await this.connection.call({ op: 'list' }, 5_000)
+      // `owner` is REQUIRED here now that the bridge filters `list` by it. Without it the bridge
+      // falls back to a different owner, so the guests this session holds are filtered out of the
+      // answer, `mine.includes(...)` matches nothing, the title list comes back empty and this
+      // returns without closing anything — the page stayed open and the human had to close it by
+      // hand. Adding the ledger to the bridge without updating this call site is exactly the kind
+      // of half-change that made the ownership work take four rounds.
+      const answer = await this.connection.call({ op: 'list', owner: owner ?? this.owner }, 5_000)
       const sidebar = Array.isArray(answer.sidebar) ? answer.sidebar as Array<{ id?: unknown; title?: unknown }> : []
       titles = sidebar
         .filter(guest => mine.includes(Number(guest.id)))
@@ -284,7 +344,9 @@ export class DesktopBridgeViewHost implements ElectronBrowserViewHost {
     }
     if (titles.length === 0) return
     try {
-      await this.connection.call({ op: 'closeSidebarBrowser', titles }, 10_000)
+      // `owner` is required for the same reason as above: the bridge closes only the guests the
+      // caller holds, so an owner-less call closes nothing and the page stays open.
+      await this.connection.call({ op: 'closeSidebarBrowser', titles, owner: owner ?? this.owner }, 10_000)
     } catch {
       // Best effort: the setting expresses a preference, and a shell that cannot
       // be reached is no reason to fail the session teardown that called us.