dsh-site-bridge 0.6.2 → 0.6.4

package/README.md

@@ -124,7 +124,7 @@ The popup UI follows the browser language: English, Russian and Simplified Chine
 
 ```text
 site_status                     → bridge state, pairing path, tabs
-site_tabs {action:"list"}       → tabs; claim/use/release/open/focus
+site_tabs {action:"list"}       → tabs; claim/use/release/open/close/focus
 site_network {action:"start"}   → begin recording, then act on the page
 site_capture {screenshot:true}  → write the bundle into the workspace
 site_snapshot {limit:40}        → interactive elements with stable selectors
@@ -145,6 +145,13 @@ A typical loop for writing a page-embedded extension:
    the browser's cookies.
 5. Iterate on the selectors the capture marked as fragile.
 
+### Popup and tools are the same surface
+
+The popup is a manual control for the person at the keyboard: attach a tab, detach it, start recording,
+pick an element. The agent can do all of that through the tools, including `site_tabs {action:"claim"}`
+for any tab it sees in `list`. The attach button is a human gesture, not a permission gate — the
+bridge token is the only thing that decides who may drive the browser.
+
 ## Architecture
 
 ```

package/README.ru.md

@@ -124,7 +124,7 @@ Chrome покажет плашку «началась отладка этого
 
 ```text
 site_status                     → состояние моста, путь к спариванию, вкладки
-site_tabs {action:"list"}       → вкладки; claim/use/release/open/focus
+site_tabs {action:"list"}       → вкладки; claim/use/release/open/close/focus
 site_network {action:"start"}   → начать запись, затем действовать на странице
 site_capture {screenshot:true}  → записать пакет снимка в рабочее пространство
 site_snapshot {limit:40}        → интерактивные элементы с устойчивыми селекторами
@@ -145,6 +145,13 @@ site_inject {js:"..."}          → выполнить ваш скрипт в с
    браузера.
 5. Доработать селекторы, которые снимок пометил как хрупкие.
 
+### Попап и инструменты — одна и та же поверхность
+
+Попап — ручное управление для человека за клавиатурой: подключить вкладку, отключить, включить
+запись, выбрать элемент. Агент умеет то же самое через инструменты, включая
+`site_tabs {action:"claim"}` для любой вкладки из `list`. Кнопка подключения — жест человека, а не
+разрешение: доступ решает только токен моста.
+
 ## Архитектура
 
 ```

package/README.zh-CN.md

@@ -103,7 +103,7 @@ Chrome 会显示「已开始调试此浏览器」提示条：这正是全部功
 
 ```text
 site_status                     → 网桥状态、配对路径、标签页
-site_tabs {action:"list"}       → 标签页；claim/use/release/open/focus
+site_tabs {action:"list"}       → 标签页；claim/use/release/open/close/focus
 site_network {action:"start"}   → 开始录制，然后在页面上操作
 site_capture {screenshot:true}  → 把快照包写入工作区
 site_snapshot {limit:40}        → 带稳定选择器的可交互元素
@@ -123,6 +123,12 @@ site_inject {js:"..."}          → 在页面里执行你的脚本以验证
 4. 用 `site_inject` 注入脚本体 → 确认锚点能找到、BFF 调用能带着浏览器 Cookie 通过。
 5. 针对快照标记为脆弱的选择器继续调整。
 
+### 弹出窗口与工具是同一条通道
+
+弹出窗口是给键盘前的人的双手控制：连接标签页、断开、开始录制、选择元素。智能体通过工具可以做同样
+的事，包括对 `list` 中任意标签页执行 `site_tabs {action:"claim"}`。连接按钮是人的操作，而不是权限
+闸门——能否驱动浏览器只由网桥令牌决定。
+
 ## 架构
 
 ```

package/extension/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "default_locale": "en",
   "name": "__MSG_appName__",
-  "version": "0.6.2",
+  "version": "0.6.4",
   "description": "__MSG_appDesc__",
   "minimum_chrome_version": "116",
   "permissions": [

package/extension/sw.js

@@ -294,6 +294,25 @@ async function claimTab(tabId) {
   return attach(id)
 }
 
+chrome.tabs.onUpdated.addListener((tabId, info, tab) => {
+  const session = state.sessions.get(tabId)
+  if (!session) return
+  const next = { id: tab.id, url: tab.url, title: tab.title }
+  if (next.title === session.target.title && next.url === session.target.url) return
+  session.target = next
+  void evt('target', { tab: next, tabId })
+})
+
+chrome.tabs.onRemoved.addListener((tabId) => {
+  if (!state.sessions.has(tabId)) return
+  state.sessions.delete(tabId)
+  if (state.activeTabId === tabId) {
+    state.activeTabId = state.sessions.size > 0 ? [...state.sessions.keys()][0] : null
+  }
+  void evt('target', { tab: null, tabId })
+  void evt('active', { tabId: state.activeTabId })
+})
+
 chrome.debugger.onDetach.addListener((source, reason) => {
   const session = state.sessions.get(source.tabId)
   if (!session) return
@@ -1512,7 +1531,21 @@ async function dispatch(op, args) {
     case 'tab.open': {
       const tab = await chrome.tabs.create({ url: String(args.url ?? 'about:blank'), active: args.active !== false })
       await attach(tab.id)
-      return { target: state.sessions.get(tab.id)?.target ?? { id: tab.id, url: tab.url, title: tab.title } }
+      // A fresh tab has no title yet: wait for the load so the caller gets a
+      // target it can show, instead of an empty string.
+      const deadline = Date.now() + Math.min(Number(args.waitMs ?? 10000), 30000)
+      let info = tab
+      while (Date.now() < deadline) {
+        info = await chrome.tabs.get(tab.id).catch(() => info)
+        if (info.status === 'complete' && info.title) break
+        await sleep(150)
+      }
+      const session = state.sessions.get(tab.id)
+      if (session) {
+        session.target = { id: info.id, url: info.url, title: info.title }
+        await evt('target', { tab: session.target, tabId: tab.id })
+      }
+      return { target: session?.target ?? { id: tab.id, url: tab.url, title: tab.title } }
     }
     case 'tab.focus': {
       const session = requireSession(args.tabId)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-site-bridge",
-  "version": "0.6.2",
+  "version": "0.6.4",
   "description": "Chrome/Edge MV3 bridge for DeepSeek Harness: capture page markup (DOM, styles, selectors) and BFF traffic (xhr/fetch with headers and bodies) into a workspace snapshot bundle, drive the page with trusted CDP input, and verify injected scripts. Authorization never leaves the browser and is never written to disk.",
   "icon": "./icon.svg",
   "type": "module",