openmausbot 0.1.65 → 0.1.66

package/dist-server/proxy-paths.js

@@ -8,6 +8,7 @@ function resolveProxy(relative) {
   return existsSync(source) ? source : join(SERVER_ROOT, `${relative}.js`);
 }
 var SPAWNED_PROXIES = {
+  browser: resolveProxy("browser-proxy"),
   computer: resolveProxy("computer-proxy"),
   permission: resolveProxy("permission-proxy"),
   containerMcp: resolveProxy("container-mcp"),

package/dist-server/server/attachments.js

@@ -27,6 +27,26 @@ const activePartials = new Set();
 const uploadLocks = new Map();
 let reservedAttachmentBytes = 0;
 const STREAM_RESERVATION_INCREMENT_BYTES = 1024 * 1024;
+/** Cached total of on-disk bytes that count against the quota: committed
+ * attachments plus any partial file this process did not itself write (a
+ * crash leftover, until it is cleaned up). `null` means a fresh scan is needed
+ * after cold start or a cleanup failure. Every normal commit
+ * and delete after that updates it in place instead of rescanning, which is
+ * what makes reservation growth O(1) rather than O(directory size).
+ *
+ * This is single-process, in-memory state: it does not see files another
+ * process adds or removes in ATTACHMENTS_DIR. That is an accepted limit
+ * (the app runs one server per data dir; uploadLocks already assumes the
+ * same), not a design gap this fix covers. */
+let committedAttachmentBytes = null;
+// An async link can finish while another upload invalidates or refreshes the
+// cache. Its bytes must not be added again if a scan may already include it.
+let attachmentAccountingVersion = 0;
+/** Force a fresh disk total and invalidate any in-flight commit's snapshot. */
+function invalidateAttachmentAccounting() {
+    committedAttachmentBytes = null;
+    attachmentAccountingVersion += 1;
+}
 /** Mimes the endpoint accepts, mapped to the extension stored on disk.
  * Sniffing is not attempted — a lie here only changes the filename. */
 const IMAGE_MIMES = {
@@ -88,7 +108,10 @@ export function validateAttachmentUploadId(value) {
     }
     return normalized;
 }
-function attachmentUsageAndCleanup(now = Date.now()) {
+/** The one full directory walk. Run from cold or invalidated accounting,
+ * or from an explicit cleanup sweep — never
+ * from the per-reservation hot path, which is what made PERF-03 quadratic. */
+function scanAttachmentUsageAndCleanup(now = Date.now()) {
     ensureAttachmentsDir();
     let bytes = 0;
     let removed = 0;
@@ -117,10 +140,62 @@ function attachmentUsageAndCleanup(now = Date.now()) {
     }
     return { bytes, removed };
 }
-/** Remove only abandoned temporary uploads. Active partials are protected
- * even if a very slow request crosses the age threshold. */
+/** Return cached usage, initializing it from disk after cold start or
+ * invalidation. Reservations must use this rather than trusting a cold cache. */
+function committedBytes() {
+    if (committedAttachmentBytes === null) {
+        committedAttachmentBytes = scanAttachmentUsageAndCleanup().bytes;
+        attachmentAccountingVersion += 1;
+    }
+    return committedAttachmentBytes;
+}
+/** A newly committed file (saveFile/saveImage success path only — never the
+ * idempotent-retry branches, which reuse bytes already counted) adds to the
+ * cache. If accounting changed during an async link, a scan may already have
+ * counted that file. Let the next reservation rescan instead of adding twice. */
+function addCommittedBytes(delta, version = attachmentAccountingVersion) {
+    if (version !== attachmentAccountingVersion || committedAttachmentBytes === null) {
+        invalidateAttachmentAccounting();
+        return;
+    }
+    committedAttachmentBytes += delta;
+}
+/** Remove only abandoned temporary uploads, and refresh the cached usage
+ * total from the same fresh scan. Outside accounting recovery, this is the
+ * only full directory walk after start-up; nothing on the upload path calls it
+ * per byte or per chunk anymore, so callers that want stale partials
+ * reclaimed promptly should invoke it on their own schedule. */
 export function cleanupStaleAttachmentPartials(now = Date.now()) {
-    return attachmentUsageAndCleanup(now).removed;
+    const { bytes, removed } = scanAttachmentUsageAndCleanup(now);
+    committedAttachmentBytes = bytes;
+    attachmentAccountingVersion += 1;
+    return removed;
+}
+/** Delete a committed attachment (e.g. a generated image whose owning
+ * message/turn was retired) and keep the quota cache in sync. Every caller
+ * outside this module that removes a file saveImage/saveFile created must
+ * route through here instead of a raw unlink, or the cache will overcount
+ * forever and eventually reject uploads that should fit. */
+export function deleteAttachment(path) {
+    try {
+        // Only bother sizing it if the cache is already warm — if it isn't, the
+        // eventual first scan just won't see this file, which is correct.
+        const size = committedAttachmentBytes !== null ? statSync(path).size : 0;
+        unlinkSync(path);
+        if (committedAttachmentBytes !== null) {
+            committedAttachmentBytes = Math.max(0, committedAttachmentBytes - size);
+        }
+    }
+    catch {
+        // Already gone, or never existed — nothing to reconcile.
+    }
+}
+/** Test-only: force the next quota check to rescan the directory instead of
+ * trusting the cache. Needed because tests mutate ATTACHMENTS_DIR directly
+ * (truncateSync, rmSync, writeFileSync) to simulate quota states, which the
+ * cache can't observe. */
+export function __resetAttachmentAccountingForTests() {
+    invalidateAttachmentAccounting();
 }
 /** A retry owns the same UUID namespace as the interrupted attempt. Once it
  * holds that UUID's in-process lock, any inactive partial with the prefix is
@@ -136,7 +211,14 @@ function cleanupAttachmentPartialsForUpload(uploadId) {
         if (activePartials.has(path))
             continue;
         try {
+            // Only bother sizing it if the cache is already warm — if it isn't,
+            // the eventual first scan runs after this unlink and simply never
+            // sees the file, so there is nothing to reconcile.
+            const size = committedAttachmentBytes !== null ? statSync(path).size : 0;
             unlinkSync(path);
+            if (committedAttachmentBytes !== null) {
+                committedAttachmentBytes = Math.max(0, committedAttachmentBytes - size);
+            }
         }
         catch {
             // A concurrent cleanup already removed the abandoned attempt.
@@ -152,7 +234,7 @@ class AttachmentReservation {
         this.reserveAtLeast(bytes, bytes);
     }
     reserveAtLeast(required, preferred) {
-        const used = attachmentUsageAndCleanup().bytes;
+        const used = committedBytes();
         const available = ATTACHMENTS_MAX_BYTES - used - reservedAttachmentBytes;
         if (available < required) {
             throw statusError(507, `attachments storage is full (limit ${ATTACHMENTS_MAX_BYTES} bytes)`);
@@ -199,15 +281,34 @@ async function withUploadLock(uploadId, operation) {
             uploadLocks.delete(uploadId);
     }
 }
+/** Every committed attachment name is `${uuid}${extension}` for one of these
+ * fixed extensions — saveFile/saveImage never write any other suffix — so
+ * whether a given upload ID is already committed, and under which content
+ * type, can be answered with a handful of direct stats instead of a scan
+ * over every file in the directory. */
+const KNOWN_ATTACHMENT_EXTENSIONS = Array.from(new Set([...Object.values(IMAGE_MIMES), ...Object.values(FILE_MIMES)]));
+/** Missing or unreadable candidates count as absent here; the atomic link
+ * still detects a collision if a file exists when an upload commits. */
+function statSizeIfFile(path) {
+    try {
+        const stat = statSync(path);
+        return stat.isFile() ? stat.size : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Find an idempotent retry without listing the directory, rejecting an ID
+ * already committed under a different accepted content type. */
 function committedPathForUpload(uploadId, extension) {
     ensureAttachmentsDir();
-    const exact = `${uploadId}${extension}`;
-    for (const entry of readdirSync(ATTACHMENTS_DIR, { withFileTypes: true })) {
-        if (!entry.isFile() || PARTIAL_NAME.test(entry.name))
+    const exactPath = join(ATTACHMENTS_DIR, `${uploadId}${extension}`);
+    if (statSizeIfFile(exactPath) !== null)
+        return exactPath;
+    for (const other of KNOWN_ATTACHMENT_EXTENSIONS) {
+        if (other === extension)
             continue;
-        if (entry.name === exact)
-            return join(ATTACHMENTS_DIR, entry.name);
-        if (entry.name.startsWith(`${uploadId}.`)) {
+        if (statSizeIfFile(join(ATTACHMENTS_DIR, `${uploadId}${other}`)) !== null) {
             throw statusError(409, "uploadId was already used for another content type");
         }
     }
@@ -317,6 +418,7 @@ export async function saveFile(chunks, originalName, mime, options = {}) {
         let file;
         let bytes = 0;
         let closed = false;
+        let partialCleanupFailed = false;
         try {
             file = await open(partialPath, "wx", 0o600);
             for await (const value of chunks) {
@@ -343,7 +445,9 @@ export async function saveFile(chunks, originalName, mime, options = {}) {
             await file.close();
             closed = true;
             try {
+                const accountingVersion = attachmentAccountingVersion;
                 await link(partialPath, path);
+                addCommittedBytes(bytes, accountingVersion);
                 await unlink(partialPath);
             }
             catch (error) {
@@ -359,11 +463,15 @@ export async function saveFile(chunks, originalName, mime, options = {}) {
         catch (error) {
             if (file && !closed)
                 await file.close().catch(() => undefined);
-            await unlink(partialPath).catch(() => undefined);
+            await unlink(partialPath).catch(() => { partialCleanupFailed = true; });
             throw error;
         }
         finally {
             activePartials.delete(partialPath);
+            // A leftover partial was excluded from the cache while active. Rescan
+            // after releasing it so a retry cannot subtract bytes never counted.
+            if (partialCleanupFailed)
+                invalidateAttachmentAccounting();
             reservation.release();
         }
     });
@@ -397,10 +505,12 @@ export function saveImage(bytes, mime, requestedUploadId) {
     const path = join(ATTACHMENTS_DIR, name);
     const partialPath = join(ATTACHMENTS_DIR, `.openmaus-upload-${id}-${randomUUID()}.partial`);
     activePartials.add(partialPath);
+    let partialCleanupFailed = false;
     try {
         writeFileSync(partialPath, bytes, { mode: 0o600, flag: "wx" });
         try {
             linkSync(partialPath, path);
+            addCommittedBytes(bytes.byteLength);
         }
         catch (error) {
             if (error.code !== "EEXIST")
@@ -418,12 +528,14 @@ export function saveImage(bytes, mime, requestedUploadId) {
             unlinkSync(partialPath);
         }
         catch {
-            // The successful path already removed it, or the write never created it.
+            partialCleanupFailed = true;
         }
         throw error;
     }
     finally {
         activePartials.delete(partialPath);
+        if (partialCleanupFailed)
+            invalidateAttachmentAccounting();
         reservation.release();
     }
 }

package/dist-server/server/browser-engine-release.js

@@ -1,37 +1,39 @@
 // The pinned agent-browser release the harness downloads for the bots'
 // browser (docs/plans/browser-engine.md). Digests were computed from the
-// official GitHub assets on 2026-09-06, except the explicitly versioned Windows
+// official GitHub assets on 2026-09-08, except the explicitly versioned Windows
 // vendor build below. Update pins through a reviewed native end-to-end run.
 // The Dockerfile retains the official Linux version.
-export const AGENT_BROWSER_VERSION = "0.36.0";
+export const AGENT_BROWSER_VERSION = "0.37.0";
 const RELEASES = new Map([
     [
         "darwin-arm64",
-        { target: "darwin-arm64", asset: "agent-browser-darwin-arm64", sha256: "b2106ab39db0838e7b1772f7f26f760518de56d09053150c56f9dddf15af997d", bytes: 12363200 },
+        { target: "darwin-arm64", asset: "agent-browser-darwin-arm64", sha256: "da5a2b4ef7be8ba279b1258c542c33877f480b1951d0d94de607fc1528edd380", bytes: 12429360 },
     ],
     [
         "darwin-x64",
-        { target: "darwin-x64", asset: "agent-browser-darwin-x64", sha256: "45d9ac061a7d72e61eaff905326e2e19365f4dadb12142ea2f2d76d84689c708", bytes: 13510280 },
+        { target: "darwin-x64", asset: "agent-browser-darwin-x64", sha256: "f402c96350ffd2adc68d0e5e4d83aa49cf7735fef29882a8866be36cc2fc67e9", bytes: 13588296 },
     ],
     [
         "linux-arm64",
-        { target: "linux-arm64", asset: "agent-browser-linux-arm64", sha256: "aeb556addca3903601a433de1acad3ace1c9c61d170084bf58d875884599a990", bytes: 12442720 },
+        { target: "linux-arm64", asset: "agent-browser-linux-arm64", sha256: "0315a8c4f7bf167cc5fd5eeaea79009b0e6b5d2ae8b3057bf6f96be978483426", bytes: 12507840 },
     ],
     [
         "linux-musl-arm64",
-        { target: "linux-musl-arm64", asset: "agent-browser-linux-musl-arm64", sha256: "1ca7e003c9cb185f174fc81e51a609db27c77e3bfe00a0edff60688f8cd14f88", bytes: 12297000 },
+        { target: "linux-musl-arm64", asset: "agent-browser-linux-musl-arm64", sha256: "db67c0e84e0668c052c2cbdca325c57f896e309c3723755dcdd65b700f8a2b52", bytes: 12369352 },
     ],
     [
         "linux-musl-x64",
-        { target: "linux-musl-x64", asset: "agent-browser-linux-musl-x64", sha256: "a20cc2a5202a48f5820372803dedbcd5f556dff7a89421f1b0f2612962b10718", bytes: 13995728 },
+        { target: "linux-musl-x64", asset: "agent-browser-linux-musl-x64", sha256: "5cff3bc7b2486867aba2901f92c9ce6029bd2a37951630d9feec1c5b3fee402e", bytes: 14092888 },
     ],
     [
         "linux-x64",
-        { target: "linux-x64", asset: "agent-browser-linux-x64", sha256: "56d15181e51e00213f907fcf39707cfc76bfa804ff20f5a9373661c73f96de5e", bytes: 14156776 },
+        { target: "linux-x64", asset: "agent-browser-linux-x64", sha256: "78e0c5a14a7fa1f3d1ae2acdbdcc94a047b435b998a8c505fcc49d7fa4935a49", bytes: 14253776 },
     ],
     [
         "win32-x64",
         {
+            // Upstream 0.37.0 still lacks PR #1781's Windows cold-start fix.
+            // Retain the native-verified revision until its replacement is tested.
             target: "win32-x64", version: "0.36.0-omb.1",
             asset: "agent-browser-win32-x64-0.36.0-omb.1.exe",
             url: "https://github.com/milind-soni/OpenMausBot/releases/download/browser-engine-v0.36.0-omb.1/agent-browser-win32-x64-0.36.0-omb.1.exe",

package/dist-server/server/browser-engine.js

@@ -10,16 +10,182 @@
 // reason a person can act on, never a silently browserless bot.
 import { spawn } from "node:child_process";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { delimiter, join, resolve } from "node:path";
+import { chmodSync, constants, copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { delimiter, dirname, join, resolve } from "node:path";
 import { writeFileAtomic } from "./atomic.js";
 import { DATA_DIR } from "./config.js";
 import { browserBundlePaths } from "./browser-bundle-release.js";
+import { browserRuntimeEnv } from "./browser-runtime.js";
 import { AGENT_BROWSER_VERSION, agentBrowserReleaseUrl, agentBrowserReleaseVersion, resolveAgentBrowserReleaseAsset, } from "./browser-engine-release.js";
 const ENGINE_DIR = "tools/agent-browser";
 const KEY_FILE = "browser-engine-key";
 const DOWNLOAD_TIMEOUT_MS = 10 * 60_000;
+/** Native restore looks up a filename prefix. Fixed-length keys prevent a
+ * legacy profile named work from accidentally restoring work-client. */
+export function browserRestoreKey(session) {
+    if (!/^[A-Za-z0-9_-]{1,96}$/.test(session))
+        throw new Error("Invalid browser session.");
+    return `omb-${createHash("sha256").update(session).digest("hex")}`;
+}
+function browserSessionsDirectory(env) {
+    const namespace = env.AGENT_BROWSER_NAMESPACE;
+    if (namespace && !/^[a-z0-9]+(?:[-_][a-z0-9]+)*$/.test(namespace))
+        throw new Error("Invalid browser namespace.");
+    const home = (process.platform === "win32" ? env.USERPROFILE : env.HOME) || homedir();
+    const stateRoot = namespace ? join(home, ".agent-browser", "namespaces", namespace, "state") : join(home, ".agent-browser");
+    return join(stateRoot, "sessions");
+}
+function managedBrowserConfigPath(env) {
+    return join(browserSessionsDirectory(env), "..", "omb-managed-config.json");
+}
+function ensureManagedBrowserConfig(env) {
+    const path = managedBrowserConfigPath(env);
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    try {
+        writeFileSync(path, "{}\n", { flag: "wx", mode: 0o600 });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+        if (readFileSync(path, "utf8").trim() !== "{}")
+            throw new Error("The managed browser configuration was changed. Restore it to an empty JSON object before connecting.");
+    }
+    return path;
+}
+/** Close exactly one daemon without the CLI's implicit launch envelope. */
+export async function closeBrowserSession(binaryPath, env, timeoutMs = 15_000) {
+    if (!env.AGENT_BROWSER_SESSION || !/^[A-Za-z0-9_-]{1,96}$/.test(env.AGENT_BROWSER_SESSION))
+        return false;
+    // Native CLI prepends a launch even to `close` when launch flags are set.
+    // Remove them, and bypass external project/user config, so closing a
+    // missing profile cannot launch and restore another legacy prefix match.
+    let configPath;
+    try {
+        configPath = ensureManagedBrowserConfig(env);
+    }
+    catch {
+        return false;
+    }
+    const closeEnv = Object.fromEntries(Object.entries(env).filter(([key]) => !key.startsWith("AGENT_BROWSER_") || ["AGENT_BROWSER_SESSION", "AGENT_BROWSER_SOCKET_DIR", "AGENT_BROWSER_NAMESPACE", "AGENT_BROWSER_ENCRYPTION_KEY", "AGENT_BROWSER_RESTORE", "AGENT_BROWSER_RESTORE_SAVE"].includes(key)));
+    closeEnv.AGENT_BROWSER_CONFIG = configPath;
+    const deadline = Date.now() + timeoutMs;
+    const run = (args, capture = false) => new Promise((done) => {
+        let settled = false;
+        let output = "";
+        const finish = (ok) => { if (!settled) {
+            settled = true;
+            done({ ok, output });
+        } };
+        let child;
+        try {
+            child = spawn(binaryPath, args, { env: closeEnv, stdio: capture ? ["ignore", "pipe", "ignore"] : "ignore", windowsHide: true });
+        }
+        catch {
+            return finish(false);
+        }
+        const timer = setTimeout(() => { child.kill(); finish(false); }, Math.max(1, deadline - Date.now()));
+        timer.unref?.();
+        child.stdout?.on("data", (chunk) => {
+            output += String(chunk);
+            if (output.length > 262_144) {
+                clearTimeout(timer);
+                child.kill();
+                finish(false);
+            }
+        });
+        child.on("error", () => { clearTimeout(timer); finish(false); });
+        // exit can precede the last piped stdout chunk; close follows stdio.
+        child.on("close", (code) => { clearTimeout(timer); finish(code === 0); });
+    });
+    if (!(await run(["close"])).ok)
+        return false;
+    // Native close acknowledges before the daemon exits. Observe its actual
+    // removal through the launch-free inventory command before reconnecting.
+    while (Date.now() < deadline) {
+        const status = await run(["session", "list", "--json"], true);
+        if (!status.ok)
+            return false;
+        try {
+            const result = JSON.parse(status.output);
+            const sessions = result?.data?.sessions;
+            if (result?.success !== true || !Array.isArray(sessions) || !sessions.every((name) => typeof name === "string"))
+                return false;
+            if (!sessions.includes(env.AGENT_BROWSER_SESSION))
+                return true;
+        }
+        catch {
+            return false;
+        }
+        await new Promise((resolve) => setTimeout(resolve, Math.min(25, Math.max(1, deadline - Date.now()))));
+    }
+    return false;
+}
+const preparedBrowserSessions = new Map();
+/** Preserve only this profile's exact old file before adopting a collision-
+ * proof restore key. Originals stay intact; a reset removes both spellings.
+ * Closing first flushes even an old daemon's not-yet-autosaved login. */
+export async function prepareBrowserSessionState(binaryPath, session, options = {}) {
+    const restoreKey = browserRestoreKey(session);
+    const check = () => { if (options.isCurrent?.() === false)
+        throw new Error("Browser access changed while connecting."); };
+    check();
+    const env = browserRuntimeEnv({ ...options.env, AGENT_BROWSER_SESSION: session, AGENT_BROWSER_HEADLESS: "1" });
+    ensureManagedBrowserConfig(env);
+    if (options.persistent === false)
+        return;
+    const directory = browserSessionsDirectory(env);
+    const key = join(directory, session);
+    let pending = preparedBrowserSessions.get(key);
+    if (!pending) {
+        pending = (async () => {
+            const targetBase = join(directory, `${restoreKey}-${session}`);
+            const hasTarget = () => existsSync(`${targetBase}.json.enc`) || existsSync(`${targetBase}.json`);
+            if (hasTarget())
+                return;
+            check();
+            // Retain the old key while flushing, never the new empty destination.
+            // A newer daemon flushes its own key before a key change; close itself
+            // never launches a browser, and we check for that new file afterward.
+            if (!await closeBrowserSession(binaryPath, { ...env, AGENT_BROWSER_RESTORE: session }, options.timeoutMs)) {
+                throw new Error("Could not safely prepare saved browser logins. Close this browser and try again.");
+            }
+            check();
+            if (hasTarget())
+                return; // a current daemon may just have flushed it.
+            const candidates = [".json.enc", ".json"].flatMap((suffix) => {
+                const path = join(directory, `${session}-${session}${suffix}`);
+                try {
+                    const stat = statSync(path);
+                    if (!stat.isFile())
+                        throw new Error("Saved browser state is not a file.");
+                    return [{ path, suffix, modified: stat.mtimeMs }];
+                }
+                catch (error) {
+                    if (error.code === "ENOENT")
+                        return [];
+                    throw error;
+                }
+            }).sort((a, b) => b.modified - a.modified);
+            const source = candidates[0];
+            if (!source)
+                return;
+            try {
+                copyFileSync(source.path, targetBase + source.suffix, constants.COPYFILE_EXCL);
+                chmodSync(targetBase + source.suffix, 0o600);
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+            }
+        })();
+        preparedBrowserSessions.set(key, pending);
+        void pending.catch(() => { if (preparedBrowserSessions.get(key) === pending)
+            preparedBrowserSessions.delete(key); });
+    }
+    await pending;
+    check();
+}
 function executableName(platform = process.platform) {
     return platform === "win32" ? "agent-browser.exe" : "agent-browser";
 }
@@ -181,21 +347,27 @@ export function browserEngineStatus(options = {}) {
  * auto-restored session per browser profile (or per bot), page-provided
  * WebMCP tools off, and only the core tool set. */
 export function agentBrowserIntegration(input) {
+    const sourceEnv = input.env ?? process.env;
     const env = {
         AGENT_BROWSER_SESSION: input.session,
         // The MCP server invokes child CLI commands without forwarding its own
         // global flags. The environment keeps page-provided tools disabled in
         // those commands too, and avoids changing browser launch settings later.
         AGENT_BROWSER_NO_WEBMCP: "1",
-        // This is a restore *name*, not a boolean. "1" would give every bot
-        // the same saved cookies despite using different daemon sessions.
-        AGENT_BROWSER_RESTORE: input.session,
+        // This is a restore *name*, not a boolean. Use a fixed-length identity:
+        // upstream looks up name prefixes, not an exact daemon-session filename.
+        AGENT_BROWSER_RESTORE: browserRestoreKey(input.session),
         AGENT_BROWSER_RESTORE_SAVE: input.persistent === false ? "never" : "auto",
         AGENT_BROWSER_ENCRYPTION_KEY: input.encryptionKey,
+        // OMB owns launch settings. A user's unrelated native CLI config must not
+        // inject a shared Chrome profile or a different saved-state path.
+        AGENT_BROWSER_CONFIG: managedBrowserConfigPath(browserRuntimeEnv({
+            ...(sourceEnv.HOME ? { HOME: sourceEnv.HOME } : {}),
+            ...(sourceEnv.USERPROFILE ? { USERPROFILE: sourceEnv.USERPROFILE } : {}),
+        })),
     };
     if (input.headless !== false)
         env.AGENT_BROWSER_HEADLESS = "1";
-    const sourceEnv = input.env ?? process.env;
     // MCP clients may filter the parent environment. Carry the configured
     // Chrome path explicitly without forwarding unrelated secrets or flags.
     for (const name of ["PATH", "AGENT_BROWSER_EXECUTABLE_PATH"]) {
@@ -226,7 +398,7 @@ export function agentBrowserFrame(input) {
     const file = join(tmpdir(), `openmausbot-browser-${randomUUID()}.png`);
     return new Promise((settle, fail) => {
         const child = spawn(input.binaryPath, ["screenshot", file], {
-            env: { ...process.env, ...input.env },
+            env: browserRuntimeEnv(input.env),
             stdio: ["ignore", "ignore", "pipe"],
             windowsHide: true,
         });
@@ -289,27 +461,55 @@ export const BUILT_IN_BROWSER_SYSTEM_PROMPT = " You have your own web browser th
  * profile is deleted. Best effort with a bound: a missing engine or an
  * already-empty session are both "done". */
 export async function clearBrowserSessionState(binaryPath, session, options = {}) {
-    const env = { ...(options.env ?? process.env), AGENT_BROWSER_SESSION: session, AGENT_BROWSER_HEADLESS: "1" };
+    // The native state-clear CLI ignores the daemon session, and even its named
+    // form currently drops that name before dispatch. Never invoke it here.
+    if (!/^[A-Za-z0-9_-]{1,96}$/.test(session))
+        return false;
+    const env = browserRuntimeEnv({ ...options.env, AGENT_BROWSER_SESSION: session, AGENT_BROWSER_HEADLESS: "1" });
+    let directory;
+    try {
+        directory = browserSessionsDirectory(env);
+    }
+    catch {
+        return false;
+    }
     if (options.encryptionKey)
         env.AGENT_BROWSER_ENCRYPTION_KEY = options.encryptionKey;
-    const run = (args) => new Promise((done) => {
-        let settled = false;
-        const finish = (ok) => { if (!settled) {
-            settled = true;
-            done(ok);
-        } };
-        let child;
+    // A failed close can still autosave later. Keep its state until it is safe
+    // to remove, rather than reporting a reset that silently comes back.
+    if (!await closeBrowserSession(binaryPath, env, options.timeoutMs))
+        return false;
+    const bases = [`${session}-${session}`, `${browserRestoreKey(session)}-${session}`];
+    const remove = (path) => {
         try {
-            child = spawn(binaryPath, args, { env, stdio: "ignore", windowsHide: true });
+            unlinkSync(path);
         }
-        catch {
-            return finish(false);
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
         }
-        const timer = setTimeout(() => { child.kill(); finish(false); }, options.timeoutMs ?? 15_000);
-        timer.unref?.();
-        child.on("error", () => { clearTimeout(timer); finish(false); });
-        child.on("exit", (code) => { clearTimeout(timer); finish(code === 0); });
-    });
-    await run(["close"]);
-    return run(["state", "clear", "--all"]);
+    };
+    try {
+        for (const base of bases)
+            for (const suffix of [".json", ".json.enc", ".json.previous", ".json.enc.previous"])
+                remove(join(directory, base + suffix));
+        const pendingDirectory = join(directory, ".tmp");
+        let pendingFiles = [];
+        try {
+            pendingFiles = readdirSync(pendingDirectory);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        const candidates = bases.map((base) => new RegExp(`^${base}-candidate-[0-9]+\\.json(?:\\.enc)?$`));
+        for (const name of pendingFiles)
+            if (candidates.some((candidate) => candidate.test(name)))
+                remove(join(pendingDirectory, name));
+        preparedBrowserSessions.delete(join(directory, session));
+        return true;
+    }
+    catch {
+        return false;
+    }
 }