pi-agent-browser-native 0.3.0 → 0.6.5

package/dist/extensions/agent-browser/lib/launch-scoped-flags.js

@@ -1,5 +1,5 @@
 import { findCommandStartIndex } from "./argv-descriptor.js";
-import { isBooleanFlagEnabled, optionalGlobalValueFlagConsumesNext } from "./argv-grammar.js";
+import { isBooleanFlagEnabled } from "./argv-grammar.js";
 export const LAUNCH_SCOPED_FLAG_DEFINITIONS = [
     {
         flag: "--auto-connect",
@@ -17,6 +17,14 @@ export const LAUNCH_SCOPED_FLAG_DEFINITIONS = [
         flag: "--cdp",
         reason: "selects the browser/CDP endpoint used when an upstream session is launched",
     },
+    {
+        flag: "--ca-cert",
+        reason: "selects isolated Chromium CA trust and may relaunch the browser",
+    },
+    {
+        flag: "--no-ca-cert",
+        reason: "clears retained isolated Chromium CA trust and may relaunch the browser",
+    },
     {
         flag: "--enable",
         reason: "selects built-in page init scripts before the upstream browser session is launched",
@@ -29,6 +37,10 @@ export const LAUNCH_SCOPED_FLAG_DEFINITIONS = [
         flag: "--webgpu",
         reason: "selects the platform-specific WebGPU browser launch preset",
     },
+    {
+        flag: "--no-webmcp",
+        reason: "selects whether locally launched Chrome enables experimental WebMCP support",
+    },
     {
         flag: "--init-script",
         reason: "registers page init scripts before the upstream browser session is launched",
@@ -37,6 +49,14 @@ export const LAUNCH_SCOPED_FLAG_DEFINITIONS = [
         flag: "--idle-timeout",
         reason: "configures background browser lifecycle for the launched session",
     },
+    {
+        flag: "--args",
+        reason: "selects raw Chrome arguments for the browser launch",
+    },
+    {
+        flag: "--user-agent",
+        reason: "selects the browser user agent at launch time",
+    },
     {
         flag: "--headed",
         reason: "selects whether the launched browser has a visible window",
@@ -112,6 +132,7 @@ export const MANAGED_RESTORE_INCOMPATIBLE_FLAGS = [
     "--user-agent",
     "--proxy",
     "--proxy-bypass",
+    "--ca-cert",
     "--ignore-https-errors",
     "--allow-file-access",
     "--webgpu",
@@ -140,6 +161,7 @@ export const MANAGED_RESTORE_INCOMPATIBLE_ENVS = [
     "AGENT_BROWSER_USER_AGENT",
     "AGENT_BROWSER_PROXY",
     "AGENT_BROWSER_PROXY_BYPASS",
+    "AGENT_BROWSER_CA_CERT",
     "AGENT_BROWSER_PLUGINS",
     "AGENT_BROWSER_IOS_DEVICE",
     "AGENT_BROWSER_IOS_UDID",
@@ -162,12 +184,12 @@ export function hasLaunchScopedFlagToken(args, flag) {
     const commandStartIndex = findCommandStartIndex(args);
     const command = commandStartIndex === undefined ? undefined : args[commandStartIndex];
     return args.some((token, index) => {
-        if (token !== flag && !token.startsWith(`${flag}=`))
+        if (token.startsWith(`${flag}=`))
+            return flag === "--restore";
+        if (token !== flag)
             return false;
         if (flag === "--auto-connect")
             return isBooleanFlagEnabled(args, flag);
-        if (flag === "--restore" && token === "--restore" && optionalGlobalValueFlagConsumesNext(flag, args[index + 1]))
-            return true;
         if (flag === "--state" && command === "wait" && commandStartIndex !== undefined && index > commandStartIndex)
             return false;
         return true;

package/dist/extensions/agent-browser/lib/managed-session-policy-lock.js

@@ -12,7 +12,9 @@ const LOCK_TICKET_FILE = "ticket.json";
 function getCoordinationDirectory(platform = process.platform) {
     if (platform !== "win32") {
         const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
-        return `/tmp/pi-agent-browser-policy${uid === undefined ? "" : `-${uid}`}`;
+        return platform === "android"
+            ? join(tmpdir(), `pi-agent-browser-policy${uid === undefined ? "" : `-${uid}`}`)
+            : `/tmp/pi-agent-browser-policy${uid === undefined ? "" : `-${uid}`}`;
     }
     const user = process.env.USERNAME ?? process.env.USER ?? "unknown";
     const suffix = createHash("sha256").update(user).digest("hex").slice(0, 12);
@@ -48,9 +50,6 @@ function getPolicyLockDigest(sessionName, namespace) {
 export function getManagedSessionPolicyLockPath(sessionName, namespace) {
     return join(getCoordinationDirectory(), `.pi-agent-browser-policy-${getPolicyLockDigest(sessionName, namespace)}.lock-v3`);
 }
-export function getLegacyManagedSessionPolicyLockPath(sessionName, namespace) {
-    return join(getCoordinationDirectory(), `.pi-agent-browser-policy-${getPolicyLockDigest(sessionName, namespace)}.lock-v2`);
-}
 function parseOwner(content) {
     if (Buffer.byteLength(content) > POLICY_LOCK_MAX_BYTES)
         return undefined;
@@ -67,22 +66,6 @@ function parseOwner(content) {
         return undefined;
     }
 }
-function parseLegacyBridgeOwner(content) {
-    if (Buffer.byteLength(content) > POLICY_LOCK_MAX_BYTES)
-        return undefined;
-    try {
-        const parsed = JSON.parse(content);
-        return (parsed.version === 2 || parsed.version === 3)
-            && Number.isSafeInteger(parsed.pid) && (parsed.pid ?? 0) > 0
-            && typeof parsed.startIdentity === "string" && parsed.startIdentity.length > 0
-            && typeof parsed.token === "string" && parsed.token.length > 0
-            ? parsed
-            : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
 function parseTicket(content, token) {
     if (Buffer.byteLength(content) > POLICY_LOCK_MAX_BYTES)
         return undefined;
@@ -137,26 +120,6 @@ async function readClaim(path) {
         return undefined;
     }
 }
-async function readLegacyBridgeOwner(path) {
-    try {
-        const directory = await lstat(path);
-        const ownerPath = join(path, LOCK_OWNER_FILE);
-        const ownerEntry = await lstat(ownerPath);
-        if (!directory.isDirectory() || directory.isSymbolicLink() || !ownerEntry.isFile() || ownerEntry.isSymbolicLink())
-            return undefined;
-        if (ownerEntry.size > POLICY_LOCK_MAX_BYTES)
-            return undefined;
-        if (process.platform !== "win32") {
-            const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
-            if (uid === undefined || directory.uid !== uid || ownerEntry.uid !== uid || (directory.mode & 0o077) !== 0 || (ownerEntry.mode & 0o177) !== 0)
-                return undefined;
-        }
-        return parseLegacyBridgeOwner(await readFile(ownerPath, "utf8"));
-    }
-    catch {
-        return undefined;
-    }
-}
 async function readClaims(basePath) {
     const directory = dirname(basePath);
     const prefix = `${basename(basePath)}.claim-`;
@@ -223,28 +186,6 @@ async function removeClaimOwnedBy(path, token) {
     await rm(movedPath, { force: true, recursive: true });
     return true;
 }
-async function removeLegacyBridgeOwnedBy(path, token) {
-    const current = await readLegacyBridgeOwner(path);
-    if (current?.version !== 3 || current.token !== token)
-        return false;
-    const movedPath = join(dirname(path), `.pi-agent-browser-policy-bridge-remove-${token}-${randomUUID()}`);
-    try {
-        await rename(path, movedPath);
-    }
-    catch (error) {
-        return error.code === "ENOENT";
-    }
-    const moved = await readLegacyBridgeOwner(movedPath);
-    if (moved?.version !== 3 || moved.token !== token) {
-        try {
-            await rename(movedPath, path);
-        }
-        catch { }
-        return false;
-    }
-    await rm(movedPath, { force: true, recursive: true });
-    return true;
-}
 async function cleanDeadPolicyArtifacts(directory) {
     let names;
     try {
@@ -254,72 +195,13 @@ async function cleanDeadPolicyArtifacts(directory) {
         return;
     }
     for (const name of names.filter((candidate) => candidate.startsWith(".pi-agent-browser-policy-remove-")
-        || candidate.startsWith(".pi-agent-browser-policy-bridge-remove-")
-        || candidate.includes(".lock-v2.bridge-candidate-")
-        || candidate.includes(".lock-v2.candidate-")
         || candidate.includes(".lock-v3.candidate-"))) {
         const path = join(directory, name);
-        const owner = await readLegacyBridgeOwner(path);
-        if (owner && await ownerAlive(owner) === false)
+        const claim = await readClaim(path);
+        if (claim && await ownerAlive(claim.owner) === false)
             await rm(path, { force: true, recursive: true }).catch(() => undefined);
     }
 }
-async function hasLegacyV2Contender(path) {
-    try {
-        const prefix = `${basename(path)}.candidate-`;
-        return (await readdir(dirname(path))).some((name) => name.startsWith(prefix));
-    }
-    catch {
-        return undefined;
-    }
-}
-async function acquireLegacyPolicyBridge(options) {
-    const path = getLegacyManagedSessionPolicyLockPath(options.sessionName, options.namespace);
-    const candidatePath = `${path}.bridge-candidate-${options.owner.token}`;
-    try {
-        await mkdir(candidatePath, { mode: 0o700 });
-        await writeFile(join(candidatePath, LOCK_OWNER_FILE), JSON.stringify(options.owner), { encoding: "utf8", flag: "wx", mode: 0o600 });
-        while (!options.signal?.aborted) {
-            const legacyContender = await hasLegacyV2Contender(path);
-            if (legacyContender === undefined)
-                return undefined;
-            if (legacyContender) {
-                if (Date.now() >= options.deadline)
-                    return undefined;
-                await waitForRetry(options.signal);
-                continue;
-            }
-            try {
-                await rename(candidatePath, path);
-                const installed = await readLegacyBridgeOwner(path);
-                return installed?.version === 3 && installed.token === options.owner.token
-                    ? { release: async () => { await removeLegacyBridgeOwnedBy(path, options.owner.token); } }
-                    : undefined;
-            }
-            catch (error) {
-                if (!["EACCES", "EEXIST", "ENOTEMPTY", "EPERM"].includes(error.code ?? ""))
-                    return undefined;
-            }
-            const observed = await readLegacyBridgeOwner(path);
-            if (!observed)
-                return undefined;
-            if (observed.version === 3 && await ownerAlive(observed) === false) {
-                if (await removeLegacyBridgeOwnedBy(path, observed.token))
-                    continue;
-            }
-            if (Date.now() >= options.deadline)
-                return undefined;
-            await waitForRetry(options.signal);
-        }
-        return undefined;
-    }
-    catch {
-        return undefined;
-    }
-    finally {
-        await rm(candidatePath, { force: true, recursive: true }).catch(() => undefined);
-    }
-}
 function claimPrecedes(left, right) {
     if (left.ticket === null)
         return true;
@@ -356,7 +238,6 @@ export async function acquireManagedSessionPolicyLock(options) {
     const candidatePath = `${basePath}.candidate-${token}`;
     const claimPath = `${basePath}.claim-${token}`;
     let claimPublished = false;
-    let legacyBridge;
     let lockAcquired = false;
     try {
         await mkdir(candidatePath, { mode: 0o700 });
@@ -395,20 +276,8 @@ export async function acquireManagedSessionPolicyLock(options) {
             }
             if (!blocked) {
                 await cleanDeadPolicyArtifacts(directory);
-                legacyBridge = await acquireLegacyPolicyBridge({
-                    deadline,
-                    owner,
-                    signal: options.signal,
-                    sessionName: options.sessionName,
-                    namespace: options.namespace,
-                });
-                if (!legacyBridge)
-                    return undefined;
                 lockAcquired = true;
-                return { release: async () => {
-                        await legacyBridge?.release();
-                        await removeClaimOwnedBy(claimPath, token);
-                    } };
+                return { release: async () => { await removeClaimOwnedBy(claimPath, token); } };
             }
             if (Date.now() >= deadline)
                 return undefined;
@@ -421,8 +290,6 @@ export async function acquireManagedSessionPolicyLock(options) {
     }
     finally {
         await rm(candidatePath, { force: true, recursive: true }).catch(() => undefined);
-        if (!lockAcquired)
-            await legacyBridge?.release();
         if (claimPublished && !lockAcquired)
             await removeClaimOwnedBy(claimPath, token);
     }

package/dist/extensions/agent-browser/lib/managed-session-restore.js

@@ -1,23 +1,17 @@
 import { AsyncLocalStorage } from "node:async_hooks";
-import { chmodSync, lstatSync, readFileSync, unlinkSync } from "node:fs";
-import { join } from "node:path";
-import { extractCommandTokens, parseCommandInfo } from "./argv-descriptor.js";
+import { extractUpstreamCommandTokens, parseCommandInfo } from "./argv-descriptor.js";
 import { canonicalizeAgentBrowserNamespace, extractExplicitNamespace, extractExplicitSessionName, extractRequestedRestoreKey, getAgentBrowserSessionIdentityKey, isUpstreamEnvFlagEnabled, scanUpstreamGlobalFlagOccurrences, } from "./argv-grammar.js";
 import { hasLaunchScopedFlagToken, MANAGED_RESTORE_INCOMPATIBLE_BOOLEAN_ENVS, MANAGED_RESTORE_INCOMPATIBLE_ENVS, MANAGED_RESTORE_INCOMPATIBLE_FLAGS, } from "./launch-scoped-flags.js";
-import { createManagedSessionRestoreKey, ensureManagedSessionRestoreStorageIsSecure, getManagedSessionRestoreProtectedStorageEnv, hasManagedSessionRestoreProjectIdentity, resolveManagedSessionRestoreHome, } from "./managed-session-storage.js";
+import { createManagedSessionRestoreKey, ensureManagedSessionRestoreStorageIsSecure, getManagedSessionRestoreScope, getManagedSessionRestoreProtectedStorageEnv, hasManagedSessionRestoreProjectIdentity, resolveManagedSessionRestoreHome, } from "./managed-session-storage.js";
 import { parseUserBatchStdin } from "./orchestration/batch-stdin.js";
-import { writeSecureTempFile } from "./temp.js";
-export { createManagedSessionRestoreKey, ensureManagedSessionRestoreStorageIsSecure } from "./managed-session-storage.js";
+import { getAgentBrowserProcessEnvironment } from "./process-environment.js";
+export { createManagedSessionRestoreKey, ensureManagedSessionRestoreStorageIsSecure, getManagedSessionRestoreScope } from "./managed-session-storage.js";
 export { pruneOwnedManagedSessionRestoreSnapshots } from "./managed-session-snapshots.js";
 const AGENT_BROWSER_CONFIG_ENV = "AGENT_BROWSER_CONFIG";
 const AGENT_BROWSER_RESTORE_ENV = "AGENT_BROWSER_RESTORE";
 const MANAGED_SESSION_RESTORE_ENV = "PI_AGENT_BROWSER_MANAGED_SESSION_RESTORE";
 export const MANAGED_SESSION_NAME_PREFIX = "piab-";
-const MANAGED_SESSION_RESTORE_EMPTY_CONFIG_CONTENT = "{}\n";
-const MANAGED_SESSION_RESTORE_EMPTY_CONFIG_NAME = ".pi-agent-browser-managed-restore-config-v1.json";
 const MANAGED_SESSION_RESTORE_SPAWN_PINNED_ENVS = new Set([AGENT_BROWSER_CONFIG_ENV, AGENT_BROWSER_RESTORE_ENV, "AGENT_BROWSER_NAMESPACE"]);
-let managedSessionRestoreEmptyConfigPath;
-let managedSessionRestoreEmptyConfigPromise;
 function isDisabledEnvFlag(value) {
     if (value === undefined)
         return false;
@@ -61,7 +55,7 @@ export class ManagedSessionRestoreState {
         if (sessionName)
             this.#daemonRestoreKeys.set(getAgentBrowserSessionIdentityKey(sessionName, namespace), restoreKey);
     }
-    replace(identities, options = {}) {
+    replace(identities = [], options = {}) {
         if (!options.preserveDaemonRestoreKeys)
             this.#daemonRestoreKeys.clear();
         this.#disabled.clear();
@@ -73,6 +67,9 @@ const ownedManagedSessionStorage = new AsyncLocalStorage();
 export async function withOwnedManagedSessionContext(context, run) {
     return await ownedManagedSessionStorage.run(context, run);
 }
+export function getOwnedManagedSessionRestoreKey() {
+    return ownedManagedSessionStorage.getStore()?.restoreKey;
+}
 export function resolveOwnedManagedSessionContext(options) {
     const namespace = canonicalizeAgentBrowserNamespace(options.namespace);
     const currentNamespace = canonicalizeAgentBrowserNamespace(options.currentManagedSessionNamespace);
@@ -96,33 +93,18 @@ function ownedContextMatches(sessionName, namespace) {
 export function isOwnedManagedSessionTarget(args) {
     return ownedContextMatches(extractExplicitSessionName(args), extractExplicitNamespace(args)) !== undefined;
 }
-function pathExistsOrIsUnreadable(path) {
-    try {
-        lstatSync(path);
-        return true;
-    }
-    catch (error) {
-        return error.code !== "ENOENT";
-    }
-}
 function hasExplicitConfigArg(args) {
     return scanUpstreamGlobalFlagOccurrences(args, "--config").length > 0;
 }
 function closesBrowserSession(args) {
     return ["close", "exit", "quit"].includes(parseCommandInfo(args).command ?? "");
 }
-export function agentBrowserConfigIsPresent(cwd, parentEnv = process.env, args = [], platform = process.platform) {
-    if (hasExplicitConfigArg(args) || hasUpstreamEnvValue(parentEnv, AGENT_BROWSER_CONFIG_ENV))
-        return true;
-    const paths = [join(cwd, "agent-browser.json")];
-    const home = resolveManagedSessionRestoreHome(parentEnv, platform);
-    if (home)
-        paths.push(join(home, ".agent-browser", "config.json"));
-    return paths.some(pathExistsOrIsUnreadable);
+export function agentBrowserExplicitConfigIsPresent(parentEnv = getAgentBrowserProcessEnvironment(), args = []) {
+    return hasExplicitConfigArg(args) || hasUpstreamEnvValue(parentEnv, AGENT_BROWSER_CONFIG_ENV);
 }
-/** Any upstream config disables automatic restore; content inspection would add parser and resource-exhaustion gaps. */
-export function agentBrowserConfigBlocksManagedRestore(cwd, parentEnv = process.env, args = [], platform = process.platform) {
-    return !resolveManagedSessionRestoreHome(parentEnv, platform) || agentBrowserConfigIsPresent(cwd, parentEnv, args, platform);
+/** Caller-selected upstream config disables the wrapper's automatic restore injection without blocking that config. */
+export function agentBrowserConfigBlocksManagedRestore(_cwd, parentEnv = getAgentBrowserProcessEnvironment(), args = [], platform = process.platform) {
+    return !resolveManagedSessionRestoreHome(parentEnv, platform) || agentBrowserExplicitConfigIsPresent(parentEnv, args);
 }
 function omitWrapperInjectedUserAgent(args, enabled) {
     if (!enabled)
@@ -131,7 +113,7 @@ function omitWrapperInjectedUserAgent(args, enabled) {
     return index < 0 ? args : [...args.slice(0, index), ...args.slice(index + 2)];
 }
 function batchHasManagedSessionRestoreConflict(args, stdin) {
-    const [command, ...commandArgs] = extractCommandTokens(args);
+    const [command, ...commandArgs] = extractUpstreamCommandTokens(args);
     if (command !== "batch")
         return false;
     if (commandArgs.some((token) => token !== "--bail"))
@@ -142,7 +124,7 @@ function batchHasManagedSessionRestoreConflict(args, stdin) {
     return parsed.steps.some((step) => ["connect", "batch"].includes(parseCommandInfo(step).command ?? ""));
 }
 function hasManagedSessionRestoreLaunchConflict(options) {
-    const parentEnv = options.parentEnv ?? process.env;
+    const parentEnv = options.parentEnv ?? getAgentBrowserProcessEnvironment();
     const effectiveEnv = { ...parentEnv, ...options.env };
     const args = omitWrapperInjectedUserAgent(options.args, options.wrapperInjectedUserAgent);
     if (MANAGED_RESTORE_INCOMPATIBLE_ENVS.some((name) => hasUpstreamEnvValue(effectiveEnv, name)))
@@ -156,7 +138,7 @@ function hasManagedSessionRestoreLaunchConflict(options) {
     return hasExplicitConfigArg(args) || hasUpstreamEnvValue({ ...parentEnv, ...options.env }, AGENT_BROWSER_CONFIG_ENV);
 }
 function managedSessionRestoreOptedOut(options) {
-    const effectiveEnv = { ...(options.parentEnv ?? process.env), ...options.env };
+    const effectiveEnv = { ...(options.parentEnv ?? getAgentBrowserProcessEnvironment()), ...options.env };
     return isDisabledEnvFlag(effectiveEnv[MANAGED_SESSION_RESTORE_ENV]);
 }
 function isManagedSessionRestoreIncompatible(options) {
@@ -164,7 +146,7 @@ function isManagedSessionRestoreIncompatible(options) {
         return true;
     if (managedSessionRestoreOptedOut(options))
         return false;
-    const effectiveEnv = { ...(options.parentEnv ?? process.env), ...options.env };
+    const effectiveEnv = { ...(options.parentEnv ?? getAgentBrowserProcessEnvironment()), ...options.env };
     const args = omitWrapperInjectedUserAgent(options.args, options.wrapperInjectedUserAgent);
     if (options.cwd && !hasManagedSessionRestoreProjectIdentity(options.cwd))
         return true;
@@ -173,7 +155,7 @@ function isManagedSessionRestoreIncompatible(options) {
     return !ensureManagedSessionRestoreStorageIsSecure(effectiveEnv, process.platform, extractExplicitNamespace(args));
 }
 function resolveManagedSessionRestorePolicy(options) {
-    const parentEnv = options.parentEnv ?? process.env;
+    const parentEnv = options.parentEnv ?? getAgentBrowserProcessEnvironment();
     const sessionName = extractExplicitSessionName(options.args);
     const namespace = extractExplicitNamespace(options.args);
     const ownedContext = ownedContextMatches(sessionName, namespace);
@@ -204,7 +186,7 @@ export function getOwnedManagedSessionCompatibilityEnv(options) {
     const { owned, ownedContext } = resolveManagedSessionRestorePolicy(options);
     if (!owned || !ownedContext)
         return {};
-    const parentEnv = options.parentEnv ?? process.env;
+    const parentEnv = options.parentEnv ?? getAgentBrowserProcessEnvironment();
     const callEnv = options.env ?? {};
     const explicitRawInterval = Object.hasOwn(callEnv, "AGENT_BROWSER_AUTOSAVE_INTERVAL_MS")
         ? callEnv.AGENT_BROWSER_AUTOSAVE_INTERVAL_MS
@@ -215,87 +197,13 @@ export function getOwnedManagedSessionCompatibilityEnv(options) {
         ...(ownedContext.headedManagedAutosaveInterval !== undefined && !explicitIntervalMatches ? { AGENT_BROWSER_AUTOSAVE_INTERVAL_MS: ownedContext.headedManagedAutosaveInterval } : {}),
     };
 }
-export function shouldOmitOwnedManagedSessionRestoreEnv(options) {
-    return resolveManagedSessionRestorePolicy(options).owned && closesBrowserSession(options.args);
-}
-export function canonicalizeOwnedManagedSessionCloseArgs(options, force = false) {
-    const policy = resolveManagedSessionRestorePolicy(options);
-    if (!policy.owned || !closesBrowserSession(options.args))
-        return options.args;
-    const sessionName = policy.ownedContext?.sessionName ?? policy.sessionName;
-    if (!sessionName)
-        return options.args;
-    const namespace = canonicalizeAgentBrowserNamespace(policy.ownedContext?.namespace ?? policy.namespace) ?? "";
-    const command = options.args.at(-1);
-    const prefix = options.args.slice(0, -1);
-    const safePrefixes = [
-        ["--session", sessionName],
-        ["--json", "--session", sessionName],
-        ["--namespace", namespace, "--session", sessionName],
-        ["--json", "--namespace", namespace, "--session", sessionName],
-    ];
-    if (!force && command && ["close", "exit", "quit"].includes(command)
-        && safePrefixes.some((candidate) => candidate.length === prefix.length && candidate.every((token, index) => token === prefix[index]))) {
-        return options.args;
-    }
-    return ["--json", "--namespace", namespace, "--session", sessionName, "close"];
-}
-export function cleanupManagedSessionRestoreConfig() {
-    if (managedSessionRestoreEmptyConfigPath) {
-        try {
-            unlinkSync(managedSessionRestoreEmptyConfigPath);
-        }
-        catch { }
-    }
-    managedSessionRestoreEmptyConfigPath = undefined;
-    managedSessionRestoreEmptyConfigPromise = undefined;
-}
-async function ensureManagedSessionRestoreEmptyConfig(platform) {
-    for (let attempt = 0; attempt < 2; attempt += 1) {
-        try {
-            managedSessionRestoreEmptyConfigPromise ??= writeSecureTempFile({
-                content: MANAGED_SESSION_RESTORE_EMPTY_CONFIG_CONTENT,
-                prefix: MANAGED_SESSION_RESTORE_EMPTY_CONFIG_NAME.replace(/\.json$/, ""),
-                suffix: ".json",
-            }).then((path) => {
-                if (platform !== "win32")
-                    chmodSync(path, 0o400);
-                managedSessionRestoreEmptyConfigPath = path;
-                return path;
-            });
-            const path = await managedSessionRestoreEmptyConfigPromise;
-            let entry = lstatSync(path);
-            if (entry.isSymbolicLink() || !entry.isFile())
-                throw new Error("Managed restore config is not a regular file.");
-            if (platform !== "win32" && (entry.mode & 0o777) !== 0o400) {
-                chmodSync(path, 0o400);
-                entry = lstatSync(path);
-            }
-            if (entry.isSymbolicLink() || !entry.isFile() || (platform !== "win32" && (entry.mode & 0o777) !== 0o400))
-                throw new Error("Managed restore config permissions are unsafe.");
-            if (readFileSync(path, "utf8") !== MANAGED_SESSION_RESTORE_EMPTY_CONFIG_CONTENT)
-                throw new Error("Managed restore config content changed.");
-            return path;
-        }
-        catch {
-            cleanupManagedSessionRestoreConfig();
-        }
-    }
-    return undefined;
-}
-export async function getManagedSessionRestoreConfigEnv(restoreEnv, pinForOwnedClose = false) {
-    if (restoreEnv[AGENT_BROWSER_RESTORE_ENV] === undefined && !pinForOwnedClose)
-        return {};
-    const path = await ensureManagedSessionRestoreEmptyConfig(process.platform);
-    return path ? { [AGENT_BROWSER_CONFIG_ENV]: path } : undefined;
-}
 export function getManagedSessionRestoreProtectedEnv(options, restoreEnv) {
     const { ownedContext } = resolveManagedSessionRestorePolicy(options);
     if (restoreEnv[AGENT_BROWSER_RESTORE_ENV] === undefined)
         return {};
     if (ownedContext?.protectedStorageEnv)
         return { ...ownedContext.protectedStorageEnv };
-    const effectiveEnv = { ...(options.parentEnv ?? process.env), ...options.env };
+    const effectiveEnv = { ...(options.parentEnv ?? getAgentBrowserProcessEnvironment()), ...options.env };
     return getManagedSessionRestoreProtectedStorageEnv(true, effectiveEnv);
 }
 export function validateManagedSessionRestoreContextForSpawn(options) {
@@ -303,7 +211,7 @@ export function validateManagedSessionRestoreContextForSpawn(options) {
     if (closesBrowserSession(options.args) || ownedContext?.restoreDecision !== "enabled")
         return true;
     const ownedCwd = ownedContext.cwd ?? options.cwd;
-    if (!ownedContext.restoreKey || createManagedSessionRestoreKey(ownedCwd) !== ownedContext.restoreKey || !hasManagedSessionRestoreProjectIdentity(ownedCwd))
+    if (!ownedContext.restoreKey || !ownedContext.restoreScope || createManagedSessionRestoreKey(ownedCwd, ownedContext.restoreScope) !== ownedContext.restoreKey || !hasManagedSessionRestoreProjectIdentity(ownedCwd))
         return false;
     const effectiveEnv = { ...parentEnv, ...options.env };
     if (isDisabledEnvFlag(effectiveEnv[MANAGED_SESSION_RESTORE_ENV]))
@@ -330,7 +238,7 @@ export function getManagedSessionRestoreEnv(options) {
         return {};
     if (restoreState.isDisabled(sessionName, namespace) || !sessionName)
         return {};
-    return { [AGENT_BROWSER_RESTORE_ENV]: createManagedSessionRestoreKey(options.cwd) };
+    return { [AGENT_BROWSER_RESTORE_ENV]: createManagedSessionRestoreKey(options.cwd, getManagedSessionRestoreScope(sessionName)) };
 }
 /** Commit sticky suppression only after an owned-context subprocess has actually started. */
 export function commitManagedSessionRestoreSuppression(options) {
@@ -375,8 +283,9 @@ export function buildOwnedManagedSessionRestoreContext(options) {
     const projectIdentityAvailable = !optedOut && hasManagedSessionRestoreProjectIdentity(ownedCwd);
     const incompatible = !optedOut && isManagedSessionRestoreIncompatible(policyOptions);
     const enabled = !optedOut && !incompatible;
-    const effectiveEnv = { ...(options.parentEnv ?? process.env), ...options.env };
-    const restoreKey = projectIdentityAvailable ? createManagedSessionRestoreKey(ownedCwd) : undefined;
+    const effectiveEnv = { ...(options.parentEnv ?? getAgentBrowserProcessEnvironment()), ...options.env };
+    const restoreScope = getManagedSessionRestoreScope(owned.sessionName);
+    const restoreKey = projectIdentityAvailable ? createManagedSessionRestoreKey(ownedCwd, restoreScope) : undefined;
     return {
         ...owned,
         compatibilityUserAgent: options.compatibilityUserAgent,
@@ -386,6 +295,7 @@ export function buildOwnedManagedSessionRestoreContext(options) {
         protectedStorageEnv: enabled ? getManagedSessionRestoreProtectedStorageEnv(true, effectiveEnv) : undefined,
         restoreDecision: optedOut ? "opted-out" : incompatible ? "incompatible" : "enabled",
         restoreKey,
+        restoreScope,
         restoreSuppressed: optedOut || incompatible,
     };
 }

package/dist/extensions/agent-browser/lib/managed-session-snapshots.js

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join } from "node:path";
-import { createManagedSessionRestoreKey, directoryContainsSymlink, ensureManagedSessionRestoreStorageIsSecure, ensureOwnerOnlyDirectory, getManagedRestoreSessionsDirectory, hasManagedSessionRestoreProjectIdentity, isManagedSessionRestoreKey, resolveManagedSessionRestoreCheckoutRoot, resolveManagedSessionRestoreHome, } from "./managed-session-storage.js";
+import { createManagedSessionRestoreKey, directoryContainsSymlink, ensureManagedSessionRestoreStorageIsSecure, hasManagedSessionRestoreProjectIdentity, ensureOwnerOnlyDirectory, getManagedRestoreSessionsDirectory, isManagedSessionRestoreKey, resolveManagedSessionRestoreCheckoutRoot, resolveManagedSessionRestoreHome, } from "./managed-session-storage.js";
 const OWNED_RESTORE_SNAPSHOT_FAMILIES_TO_KEEP = 2;
 const OWNED_RESTORE_SNAPSHOT_MAX_RECORDS = 256;
 const OWNED_RESTORE_SNAPSHOT_RECORD_MAX_BYTES = 16 * 1_024;
@@ -344,9 +344,7 @@ export function pruneOwnedManagedSessionRestoreSnapshots(options) {
         if (!changed)
             break;
     }
-    const protectedRestoreKey = hasManagedSessionRestoreProjectIdentity(options.cwd)
-        ? createManagedSessionRestoreKey(options.cwd)
-        : restoreKey;
+    const protectedRestoreKey = restoreKey;
     if (!lineage)
         return removed;
     removed += pruneExpiredOtherRestoreKeys({