pi-chrome 0.15.38 → 0.15.39

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable user-facing changes to `pi-chrome`.
 
+## 0.15.39 — 2026-06-07
+
+- **Dedicated automation tab/window (no more hijacking your active tab).** When a chrome_* action runs without an explicit target, pi-chrome now opens and reuses a dedicated automation window it owns (falling back to a dedicated tab if a separate window can't be created) instead of navigating whatever tab you currently have open. Your existing tabs/windows are left untouched. Pass `targetId`/`urlIncludes`/`titleIncludes` to act on a specific existing tab.
+  - **Per session.** Ownership is scoped to the calling Pi session, so concurrent sessions sharing one companion extension each get their own automation window instead of fighting over a tab.
+  - **Survives `/reload` and Chrome service-worker restarts.** Ownership is tracked by id and mirrored to `chrome.storage.session`, so the window is reused rather than orphaned.
+  - **Guarded tab management.** `chrome_tab` `activate`/`close`/`group`/`ungroup` with no target now act on the session's automation tab if present, otherwise error — they no longer fall back to (or spawn a throwaway tab to touch) your active tab.
+  - **Safe, non-blocking cleanup.** The owned target is closed on `/chrome revoke` and on real session end (never on `/reload`); cleanup only ever closes the calling session's own window/tab — never user tabs/windows or another session's target — and is fire-and-forget so it never blocks `/quit`, `/reload`, or session end.
+- **One session, one tab group.** `chrome_tab new` now reuses this session's existing Pi tab group even when another Chrome window is focused, creating the tab in that group's window because Chrome tab groups cannot span windows. The old `group:false` / `groupTitle:""` opt-out is ignored; Pi-created tabs are never intentionally left ungrouped, and a grouping failure closes the just-created tab before returning an error.
+
 ## 0.15.38 — 2026-06-07
 
 - **Overlay-safe click/fill fallbacks.** `chrome_click` and `chrome_fill` now fall back to DOM-dispatched click/value events when Chrome's debugger input path is blocked by another extension overlay (for example password-manager/autofill UI), unless `domFallback:false` is passed.

package/README.md

@@ -173,6 +173,17 @@ Agents can verify page state immediately instead of blindly retrying.
 
 Each tool is documented inline in Pi — agents see the parameters and gotchas (Chrome input, CSP limits, file upload behavior) without trial-and-error.
 
+### Tab/window isolation
+
+pi-chrome never overwrites the tab you're currently looking at. The first time a chrome_* action runs without an explicit target, pi-chrome opens a **dedicated automation window** (falling back to a dedicated tab if a separate window can't be created) and reuses it for the rest of the session. Your existing tabs and windows are left untouched. To point pi-chrome at a specific tab you already have open, pass `targetId`/`urlIncludes`/`titleIncludes`.
+
+Details:
+
+- **Per session.** Each Pi session owns its *own* automation window, so concurrent sessions (which all share one companion extension) never fight over a tab.
+- **Survives `/reload` and Chrome service-worker restarts.** Ownership is tracked by id and mirrored to `chrome.storage.session`, so the window is reused rather than orphaned.
+- **Cleanup is safe.** The dedicated target is closed when you revoke Chrome control (`/chrome revoke`) and on real session end — never on `/reload`. Cleanup only ever closes the calling session's own automation window/tab; user tabs/windows and other sessions' targets are never closed. Cleanup is fire-and-forget so it never blocks `/quit`, `/reload`, or session end.
+- **Management actions are guarded.** `chrome_tab` `activate`/`close`/`group`/`ungroup` with no explicit target act on the session's automation tab if it exists, otherwise they error instead of touching your active tab.
+
 ### Known limits vs. human Chrome use
 
 pi-chrome is strongest on web-page workflows exposed through DOM, screenshots, tabs, and Chrome input. It is not a full human/OS substitute. Current limitations include native Chrome/OS surfaces (print/save dialogs, permission bubbles, password-manager prompts), cross-origin iframe DOM access, rich multitouch/pinch/stylus gestures, visual CAPTCHA/bot challenges, hardware-backed auth (passkeys/security keys/biometrics), and arbitrary OS app interaction. For strict-CSP pages, use screenshot + coordinate input when `chrome_snapshot`/`chrome_evaluate` are blocked.

package/docs/FAQ.md

@@ -30,7 +30,15 @@ Chrome control is also locked per Pi session until you run `/chrome authorize`;
 
 ## Can multiple Pi sessions use it at once?
 
-Yes. The first session opens the local bridge; later sessions detect it and pipe their commands through the same bridge. Each Pi session must be authorized with `/chrome authorize` before its chrome_* tools work.
+Yes. The first session opens the local bridge; later sessions detect it and pipe their commands through the same bridge. Each Pi session must be authorized with `/chrome authorize` before its chrome_* tools work. Each session also owns its **own** dedicated automation window (ownership is keyed by session id inside the one extension), so concurrent sessions never navigate into or close each other's tabs.
+
+## Does pi-chrome navigate my current tab?
+
+No. The first chrome_* action that has no explicit target opens a **dedicated automation window** that pi-chrome owns (falling back to a dedicated tab only if a separate window can't be created), and reuses it for the rest of the session. Your existing tabs and windows are never reused or overwritten. Pass `targetId`/`urlIncludes`/`titleIncludes` to deliberately act on a tab you already have open.
+
+The window survives `/reload` and Chrome service-worker restarts because ownership is tracked by id and mirrored to `chrome.storage.session`. It is closed when you run `/chrome revoke` and on real session end (not on `/reload`); cleanup only ever closes that session's own window/tab.
+
+**After a full browser restart**, `chrome.storage.session` is cleared by Chrome. If Chrome's session-restore reopens the old automation window, pi-chrome no longer recognizes it (its tracking is gone), so it is left alone as an ordinary window — pi-chrome will open a fresh dedicated window for the new run rather than reclaim or close the restored one. pi-chrome never closes a window it can't positively identify as its own, so a user window is never at risk.
 
 ## Why ship as an unpacked extension?
 

package/extensions/chrome-profile-bridge/browser-extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Pi Chrome Connector",
-  "version": "0.15.38",
+  "version": "0.15.39",
   "description": "Lets Pi control tabs in Chrome via a local connector at 127.0.0.1.",
   "permissions": [
     "tabs",

package/extensions/chrome-profile-bridge/browser-extension/service_worker.js

@@ -10,6 +10,151 @@ const SCRIPTING_TIMEOUT_MS = 8_000;
 const ATTACH_TIMEOUT_MS = 3_000;
 let polling = false;
 
+// =================== pi-chrome automation target ownership ===================
+// pi-chrome must never hijack the user's active tab. When a page/navigation action runs without
+// an explicit target (targetId/urlIncludes/titleIncludes), we route it to a dedicated automation
+// target that pi-chrome created and owns. We prefer a separate Chrome window so the user's
+// windows are left untouched; if the windows API is unavailable we fall back to a dedicated tab.
+//
+// Ownership is SESSION-SCOPED, keyed by the calling Pi session's `sessionKey` (forwarded on the
+// wire). One Chrome extension / service worker brokers commands for *all* Pi sessions (see the
+// client/server bridge in index.ts), so a single global target would make concurrent sessions
+// fight over one window. A per-session map gives each session its own isolated window and lets
+// cleanup close exactly that session's target — never another session's, never a user's.
+//
+// State is mirrored to chrome.storage.session so a service-worker restart (MV3 can suspend the
+// worker at any time) re-hydrates ownership instead of orphaning the window it already created.
+// storage.session is cleared on browser restart; any window restored by Chrome's session-restore
+// is then untracked and simply left alone (we only ever close ids we still recognize as ours).
+const automationTargets = new Map(); // sessionKey -> { windowId?: number, tabId: number }
+const DEFAULT_SESSION_KEY = "__default__";
+const AUTOMATION_STORAGE_KEY = "piChromeAutomationTargets";
+let automationHydrated = false;
+
+function sessionKeyOf(params) {
+  return params && typeof params.sessionKey === "string" && params.sessionKey
+    ? params.sessionKey
+    : DEFAULT_SESSION_KEY;
+}
+
+// Re-hydrate the in-memory ownership map from storage.session once per worker lifetime. Best
+// effort: storage may be unavailable on old Chrome, and a failure just means we may create a
+// fresh window (a harmless orphan) rather than reusing one.
+async function hydrateAutomationTargets() {
+  if (automationHydrated) return;
+  automationHydrated = true;
+  try {
+    const stored = await chrome.storage?.session?.get?.(AUTOMATION_STORAGE_KEY);
+    const saved = stored && stored[AUTOMATION_STORAGE_KEY];
+    if (saved && typeof saved === "object") {
+      for (const [key, value] of Object.entries(saved)) {
+        if (value && typeof value.tabId === "number") {
+          automationTargets.set(key, {
+            windowId: typeof value.windowId === "number" ? value.windowId : undefined,
+            tabId: value.tabId,
+          });
+        }
+      }
+    }
+  } catch {
+    // Ignore: treat as "no persisted state".
+  }
+}
+
+async function persistAutomationTargets() {
+  try {
+    const obj = {};
+    for (const [key, value] of automationTargets) {
+      obj[key] = { windowId: typeof value.windowId === "number" ? value.windowId : null, tabId: value.tabId };
+    }
+    await chrome.storage?.session?.set?.({ [AUTOMATION_STORAGE_KEY]: obj });
+  } catch {
+    // Ignore: persistence is an optimization, not a correctness requirement.
+  }
+}
+
+// True if `tabId` is a pi-chrome-owned automation tab. Pass `sessionKey` to check a specific
+// session; omit it to check ownership across *any* session (used as a safety predicate so we
+// never operate on a user-created tab). Never infers ownership from "active".
+function isPiChromeOwnedTarget(tabId, sessionKey) {
+  if (typeof tabId !== "number") return false;
+  if (sessionKey !== undefined) {
+    const t = automationTargets.get(sessionKey);
+    return !!t && t.tabId === tabId;
+  }
+  for (const t of automationTargets.values()) if (t.tabId === tabId) return true;
+  return false;
+}
+
+// Create a fresh dedicated automation target for `sessionKey`. Prefer an isolated window; fall
+// back to a tab. Structured so a window can be the default while tab-fallback stays a one-liner.
+async function createAutomationTarget(sessionKey) {
+  if (chrome.windows && typeof chrome.windows.create === "function") {
+    try {
+      const win = await chrome.windows.create({ url: "about:blank", focused: false });
+      const created = win && Array.isArray(win.tabs) ? win.tabs[0] : undefined;
+      if (created && typeof created.id === "number") {
+        automationTargets.set(sessionKey, { windowId: typeof win.id === "number" ? win.id : undefined, tabId: created.id });
+        await persistAutomationTargets();
+        return created;
+      }
+    } catch {
+      // Window creation can fail (policy, headless, etc.); fall back to a dedicated tab below.
+    }
+  }
+  // Tab fallback: the tab lives in a pre-existing (user/shared) window we did NOT create, so we
+  // must leave windowId unset — cleanup then closes only our tab, never the user's window.
+  const tab = await chrome.tabs.create({ url: "about:blank", active: false });
+  automationTargets.set(sessionKey, { windowId: undefined, tabId: typeof tab.id === "number" ? tab.id : undefined });
+  await persistAutomationTargets();
+  return tab;
+}
+
+// Return the session's owned automation target if it still exists, else null. Robust to the user
+// (or Chrome) having closed it: a stale entry is forgotten so callers can recreate cleanly.
+async function resolveOwnedAutomationTarget(sessionKey) {
+  await hydrateAutomationTargets();
+  const t = automationTargets.get(sessionKey);
+  if (!t || typeof t.tabId !== "number") return null;
+  const existing = await chrome.tabs.get(t.tabId).catch(() => null);
+  if (existing && typeof existing.id === "number") return existing;
+  automationTargets.delete(sessionKey);
+  await persistAutomationTargets();
+  return null;
+}
+
+// Return the session's dedicated automation target, creating it on first use (or after the user
+// closed it). Used by page/navigation actions that need a live surface to drive.
+async function getOrCreateAutomationTarget(sessionKey) {
+  return (await resolveOwnedAutomationTarget(sessionKey)) || createAutomationTarget(sessionKey);
+}
+
+// Close only the session's pi-chrome-owned window/tab, and only if it still exists. Never touches
+// user tabs/windows or other sessions' targets. Safe to call repeatedly and when nothing exists.
+async function cleanupAutomationTarget(sessionKey) {
+  await hydrateAutomationTargets();
+  const t = automationTargets.get(sessionKey);
+  automationTargets.delete(sessionKey);
+  await persistAutomationTargets();
+  if (!t) return { closedWindowId: null, closedTabId: null };
+  const { windowId, tabId } = t;
+  if (typeof windowId === "number" && chrome.windows && typeof chrome.windows.remove === "function") {
+    const win = await chrome.windows.get(windowId).catch(() => null);
+    if (win) {
+      await chrome.windows.remove(windowId).catch(() => {});
+      return { closedWindowId: windowId, closedTabId: typeof tabId === "number" ? tabId : null };
+    }
+  }
+  if (typeof tabId === "number") {
+    const tab = await chrome.tabs.get(tabId).catch(() => null);
+    if (tab) {
+      await chrome.tabs.remove(tabId).catch(() => {});
+      return { closedWindowId: null, closedTabId: tabId };
+    }
+  }
+  return { closedWindowId: null, closedTabId: null };
+}
+
 function withTimeout(promise, ms, label, onTimeout) {
   let timer;
   return Promise.race([
@@ -928,8 +1073,10 @@ async function groupRecord(groupId) {
   };
 }
 
-// Find an existing tab group in `windowId` whose title matches `title` (case-insensitive).
-// Used so all Pi-opened tabs collect into one group per window instead of spawning new ones.
+// Find existing tab groups whose title matches `title` (case-insensitive).
+// Same-window lookup is used when grouping an already-created tab. Any-window lookup is used before
+// creating a new Pi tab so one Pi session keeps one tab group and new tabs are created in that
+// group's window (Chrome tab groups cannot span windows).
 async function findGroupByTitle(windowId, title) {
   if (!chrome.tabGroups) return null;
   const wanted = cleanGroupTitle(title).toLowerCase();
@@ -938,6 +1085,13 @@ async function findGroupByTitle(windowId, title) {
   return match ? match.id : null;
 }
 
+async function findGroupRecordByTitle(title) {
+  if (!chrome.tabGroups) return null;
+  const wanted = cleanGroupTitle(title).toLowerCase();
+  const groups = await chrome.tabGroups.query({}).catch(() => []);
+  return groups.find((g) => (g.title || "").trim().toLowerCase() === wanted) || null;
+}
+
 // Add `tab` to a tab group, then set title/color. If the tab is ungrouped, reuse an
 // existing same-title group in its window when present, otherwise create a new group.
 async function groupTab(tab, title, color) {
@@ -970,28 +1124,40 @@ async function dispatch(action, params) {
       return Promise.all(tabs.map(formatTab));
     }
     case "tab.new": {
-      const tab = await chrome.tabs.create({ url: params.url || "about:blank", active: true });
-      // Every Pi-opened tab joins a group by default. Pass groupTitle:"" (or group:false) to opt out.
-      const optOut = params.groupTitle === "" || params.group === false;
-      if (optOut && !params.groupColor) return formatTab(tab);
-      return groupTab(tab, params.groupTitle || "Pi", params.groupColor);
+      // Every Pi-opened tab must join a tab group. There is intentionally no opt-out: an ungrouped
+      // Pi-created tab is easy to lose among user tabs. If grouping fails after creation, close the
+      // tab best-effort before surfacing the error so tab.new never leaves an ungrouped Pi tab.
+      const groupTitle = params.groupTitle || "Pi";
+      const existingGroup = await findGroupRecordByTitle(groupTitle);
+      const createParams = { url: params.url || "about:blank", active: true };
+      if (existingGroup && typeof existingGroup.windowId === "number") createParams.windowId = existingGroup.windowId;
+      const tab = await chrome.tabs.create(createParams);
+      try {
+        return await groupTab(tab, groupTitle, params.groupColor);
+      } catch (error) {
+        if (typeof tab.id === "number") await chrome.tabs.remove(tab.id).catch(() => {});
+        throw error;
+      }
     }
     case "tab.activate": {
-      const tab = await getTabByParams(params);
+      // Management actions never auto-create an automation target (createOwnedTarget:false): with
+      // no explicit target they act on an owned target if one exists, else error — they must never
+      // fall back to (or spawn a tab just to touch) the user's active tab.
+      const tab = await getTabByParams(params, { createOwnedTarget: false });
       await chrome.windows.update(tab.windowId, { focused: true });
       return formatTab(await chrome.tabs.update(tab.id, { active: true }));
     }
     case "tab.group": {
-      const tab = await getTabByParams(params);
+      const tab = await getTabByParams(params, { createOwnedTarget: false });
       return groupTab(tab, params.groupTitle || "Pi", params.groupColor);
     }
     case "tab.ungroup": {
-      const tab = await getTabByParams(params);
+      const tab = await getTabByParams(params, { createOwnedTarget: false });
       if (typeof tab.groupId === "number" && tab.groupId >= 0) await chrome.tabs.ungroup(tab.id);
       return formatTab(await chrome.tabs.get(tab.id));
     }
     case "tab.close": {
-      const tab = await getTabByParams(params);
+      const tab = await getTabByParams(params, { createOwnedTarget: false });
       await chrome.tabs.remove(tab.id);
       return { closed: tab.id };
     }
@@ -1073,6 +1239,16 @@ async function dispatch(action, params) {
     }
     case "page.screenshot":
       return takeScreenshot(params);
+    case "automation.status": {
+      // Report this session's owned automation target (ids only). Used for diagnostics/tests.
+      await hydrateAutomationTargets();
+      const t = automationTargets.get(sessionKeyOf(params));
+      return { windowId: t?.windowId ?? null, tabId: t?.tabId ?? null };
+    }
+    case "automation.cleanup":
+      // Close only THIS session's pi-chrome-owned window/tab. Never touches user tabs/windows or
+      // another Pi session's target.
+      return cleanupAutomationTarget(sessionKeyOf(params));
     default:
       throw new Error(`Unknown action: ${action}`);
   }
@@ -1094,7 +1270,23 @@ async function formatTab(tab) {
   };
 }
 
-async function getTabByParams(params) {
+// Resolve which Chrome tab an action targets.
+//
+// Explicit targeting (targetId / urlIncludes / titleIncludes) is unchanged: callers can still act
+// on any existing tab, including a user tab, when they ask for it by name. Only the implicit
+// "no target given" case changed — it used to grab the user's *active* tab (and page.navigate
+// would then overwrite it); it now resolves to this Pi session's dedicated automation target.
+//
+// `createOwnedTarget` controls the implicit case:
+//   - true  (default): create the automation target on first use. Used by every page/content
+//     action — page.navigate, click/type/fill/key/hover/drag/scroll/tap/upload, snapshot,
+//     inspect, evaluate, screenshot, waitFor, console/network list, probe. These need a live
+//     surface to drive, so auto-creating is correct and they no longer touch the user's tab.
+//   - false: do NOT create. Used by tab.activate/close/group/ungroup (tab *management*): with no
+//     explicit target they operate on an already-owned automation target if one exists, else
+//     throw asking for an explicit target — so e.g. `chrome_tab close` can never silently close
+//     the user's active tab the way it used to, and never spawns a throwaway tab just to close it.
+async function getTabByParams(params, { createOwnedTarget = true } = {}) {
   const tabs = await chrome.tabs.query({});
   let tab;
   if (params.targetId !== undefined) {
@@ -1119,8 +1311,20 @@ async function getTabByParams(params) {
   } else if (params.titleIncludes) {
     tab = tabs.find((candidate) => (candidate.title || "").includes(params.titleIncludes));
   } else {
-    const active = await chrome.tabs.query({ active: true, lastFocusedWindow: true });
-    tab = active[0] || tabs.find((candidate) => candidate.active) || tabs[0];
+    // No explicit target: use this session's dedicated automation target instead of hijacking the
+    // user's active tab. This keeps human browsing and Pi automation separated — navigating here
+    // never replaces whatever the user currently has open. Callers that *want* a specific
+    // existing tab pass targetId/urlIncludes/titleIncludes above.
+    const sessionKey = sessionKeyOf(params);
+    tab = createOwnedTarget
+      ? await getOrCreateAutomationTarget(sessionKey)
+      : await resolveOwnedAutomationTarget(sessionKey);
+    if (!tab) {
+      throw new Error(
+        "No target tab specified and this Pi session has no automation tab yet. " +
+        "Pass targetId/urlIncludes/titleIncludes, or run chrome_navigate first.",
+      );
+    }
   }
   if (!tab?.id) throw new Error("No matching Chrome tab found");
   const url = tab.url || "";

package/extensions/chrome-profile-bridge/index.ts

@@ -702,6 +702,7 @@ export default function (pi: ExtensionAPI): void {
 	};
 	let chromeToolsRegistered = false;
 	let authExpiryTimer: NodeJS.Timeout | undefined;
+	let countdownInterval: NodeJS.Timeout | undefined;
 	// Remembered so bridge sends can tag tabs with this session's group even when ctx isn't handy.
 	let sessionCtx: ExtensionContext | undefined;
 
@@ -711,6 +712,12 @@ export default function (pi: ExtensionAPI): void {
 		authExpiryTimer = undefined;
 	};
 
+	const clearCountdownInterval = (): void => {
+		if (!countdownInterval) return;
+		clearInterval(countdownInterval);
+		countdownInterval = undefined;
+	};
+
 	const activeToolNamesWithoutChrome = (): string[] => pi.getActiveTools().filter((name) => !CHROME_TOOL_NAME_SET.has(name));
 
 	const activateChromeTools = (): void => {
@@ -722,11 +729,23 @@ export default function (pi: ExtensionAPI): void {
 		pi.setActiveTools(activeToolNamesWithoutChrome());
 	};
 
+	// Close THIS session's dedicated automation window/tab. Fire-and-forget and best-effort: it
+	// must never block /quit, /reload, revoke, or session end, and the service-worker side only
+	// ever closes targets this session created itself (never user tabs/windows, never another
+	// session's target). Errors (bridge down, target already closed) are intentionally swallowed.
+	const cleanupAutomationTargetBestEffort = (): void => {
+		const sessionKey = sessionKeyFor(sessionCtx);
+		void bridge.send("automation.cleanup", sessionKey !== undefined ? { sessionKey } : {}, 3_000).catch(() => undefined);
+	};
+
 	const lockChromeControl = (): void => {
 		clearAuthExpiryTimer();
+		clearCountdownInterval();
 		chromeAuthorizedUntil = undefined;
 		persistAuth();
 		deactivateChromeTools();
+		// Revoking control ends pi-chrome's automation for this session; tidy up the target we own.
+		cleanupAutomationTargetBestEffort();
 	};
 
 	const authSummary = (): string => {
@@ -759,16 +778,51 @@ export default function (pi: ExtensionAPI): void {
 		return `Pi Session: ${name || id || "unknown"}`;
 	};
 
+	const authCountdownLabel = (): string => {
+		if (chromeAuthorizedUntil === "indefinite") return " (indefinite)";
+		if (typeof chromeAuthorizedUntil === "number") {
+			const remainingMs = chromeAuthorizedUntil - Date.now();
+			if (remainingMs > 0) {
+				const mins = Math.ceil(remainingMs / 60_000);
+				return mins >= 1 ? ` (${mins}m)` : " (<1m)";
+			}
+		}
+		return "";
+	};
+
+	// Stable per-session key the service worker uses to scope its dedicated automation tab/window
+	// to *this* session (one extension brokers all sessions). The session id is stable across
+	// /reload, so the automation target is reused rather than orphaned. Returns undefined only
+	// before session_start, in which case the worker uses its default bucket.
+	const sessionKeyFor = (ctx: ExtensionContext | undefined): string | undefined => {
+		const id = ctx?.sessionManager?.getSessionId?.();
+		return typeof id === "string" && id ? `session:${id}` : undefined;
+	};
+
 	const updateChromeStatus = (ctx: ExtensionContext): void => {
 		if (chromeControlAuthorized()) {
-			ctx.ui.setStatus("chrome", ctx.ui.theme.fg("success", "●") + " Chrome Bridge");
+			ctx.ui.setStatus("chrome", ctx.ui.theme.fg("success", "●") + " Chrome Bridge" + authCountdownLabel());
 		} else {
 			ctx.ui.setStatus("chrome", undefined);
 		}
 	};
 
+	// Ticks every 60 s while a timed authorization is active to keep the countdown current.
+	const startCountdownTicker = (ctx: ExtensionContext): void => {
+		clearCountdownInterval();
+		if (chromeAuthorizedUntil === "indefinite" || typeof chromeAuthorizedUntil !== "number") return;
+		countdownInterval = setInterval(() => {
+			if (!chromeControlAuthorized()) {
+				clearCountdownInterval();
+				return;
+			}
+			updateChromeStatus(ctx);
+		}, 60_000);
+	};
+
 	const scheduleAuthExpiry = (ctx: ExtensionContext, until: number | "indefinite"): void => {
 		clearAuthExpiryTimer();
+		startCountdownTicker(ctx);
 		if (until === "indefinite") return;
 		authExpiryTimer = setTimeout(() => {
 			if (chromeAuthorizedUntil !== until) return;
@@ -784,14 +838,27 @@ export default function (pi: ExtensionAPI): void {
 
 	const authorizedBridgeSend = (action: string, params: Record<string, unknown>, timeoutMs = DEFAULT_TIMEOUT_MS, signal?: AbortSignal): Promise<unknown> => {
 		requireChromeControlAuthorized();
+		// Scope the service worker's dedicated automation tab/window to this session. Forwarded on
+		// every action so tab resolution, navigation, and cleanup all agree on which target is ours.
+		const sessionKey = sessionKeyFor(sessionCtx);
+		let wireParams: Record<string, unknown> = sessionKey !== undefined && params.sessionKey === undefined
+			? { ...params, sessionKey }
+			: params;
+		const sessionTitle = sessionCtx !== undefined ? sessionGroupTitle(sessionCtx) : undefined;
+		// Any tab Pi opens through tab.new/tab.group must use THIS session's group, even if a caller
+		// passes group:false or a custom groupTitle. This central guard covers chrome_tab plus internal
+		// callers such as chrome_launch(url).
+		if ((action === "tab.new" || action === "tab.group") && sessionTitle !== undefined) {
+			wireParams = { ...wireParams, groupTitle: sessionTitle };
+		}
 		// Any tab Pi *uses* (page.* interactions) should join this session's group, mirroring the
 		// auto-grouping that tab.new already does. Tagging the wire params lets getTabByParams pull
-		// the resolved (e.g. active) tab into the session group on the service-worker side. We skip
-		// tab.* actions: tab.new/group group explicitly, and activate/close/ungroup/list must not.
-		const shouldJoinGroup = action.startsWith("page.") && sessionCtx !== undefined && params.sessionGroupTitle === undefined;
-		const wireParams = shouldJoinGroup
-			? { ...params, sessionGroupTitle: sessionGroupTitle(sessionCtx as ExtensionContext), joinSessionGroup: true }
-			: params;
+		// the resolved tab into the session group on the service-worker side. We skip tab.* actions:
+		// tab.new/group are forced above, and activate/close/ungroup/list must not group tabs.
+		const shouldJoinGroup = action.startsWith("page.") && sessionTitle !== undefined && params.sessionGroupTitle === undefined;
+		if (shouldJoinGroup) {
+			wireParams = { ...wireParams, sessionGroupTitle: sessionTitle, joinSessionGroup: true };
+		}
 		return bridge.send(action, wireParams, timeoutMs, signal);
 	};
 
@@ -816,12 +883,22 @@ export default function (pi: ExtensionAPI): void {
 		if (chromeControlAuthorized()) {
 			activateChromeTools();
 			if (typeof chromeAuthorizedUntil === "number") scheduleAuthExpiry(ctx, chromeAuthorizedUntil);
+			else if (chromeAuthorizedUntil === "indefinite") startCountdownTicker(ctx);
 		}
 		updateChromeStatus(ctx);
 	});
 
-	pi.on("session_shutdown", () => {
+	pi.on("session_shutdown", (event) => {
 		clearAuthExpiryTimer();
+		clearCountdownInterval();
+		// Tidy up this session's dedicated automation window on real session end, but NOT on
+		// "reload": /reload tears down and re-evaluates this module while the *same* session
+		// (same sessionKey) continues, so we keep the window so it is reused, not churned. The
+		// call is fire-and-forget and runs before bridge.stop() so it never blocks shutdown.
+		// (Owner-session quit may not deliver in time since stop() closes the bridge server;
+		// that only ever leaves a clearly pi-chrome window for the user to close — never a user
+		// tab — and /chrome revoke remains the reliable, bridge-alive cleanup path.)
+		if (event?.reason !== "reload") cleanupAutomationTargetBestEffort();
 		bridge.stop();
 		if (globalState[PI_CHROME_GLOBAL_KEY]?.token === instanceToken) {
 			delete globalState[PI_CHROME_GLOBAL_KEY];
@@ -836,6 +913,11 @@ export default function (pi: ExtensionAPI): void {
 <chrome-profile-bridge>
 Chrome control is available through the chrome_* tools via a companion Chrome extension installed in the user's normal Chrome profile. Tools target the existing signed-in profile: no remote-debug port, no throwaway profile.
 
+Tab/window isolation (important):
+- pi-chrome owns a dedicated automation window/tab. When a chrome_* tool runs with no explicit target, it acts on that pi-chrome-owned target — it never reuses or overwrites the user's currently active tab. The dedicated target is created on first use and reused afterward.
+- To act on a specific *existing* tab (e.g. one the user asks you to use), pass targetId/urlIncludes/titleIncludes. Without one of those, assume you are working in pi-chrome's own automation target.
+- pi-chrome's automation target may be closed automatically when Chrome control is revoked; user tabs/windows are never closed by pi-chrome.
+
 Capability model (important):
 - Interactive controls (click/type/fill/key/hover/drag/scroll/tap) use Chrome's real input layer via chrome.debugger / CDP. Events satisfy normal user-activation gates.
 - Input bypasses page CSP because it is injected at browser input layer, not page JavaScript. Chrome may show the “Pi Chrome Connector started debugging this browser” banner while attached.
@@ -1204,7 +1286,7 @@ Usage rules:
 	pi.registerTool({
 		name: "chrome_tab",
 		label: "Chrome Tab",
-		description: "List, create, activate, close, group, ungroup, or inspect tabs in the user's existing Chrome profile via the companion extension.",
+		description: "List, create, activate, close, group, ungroup, or inspect tabs in the user's existing Chrome profile via the companion extension. New/grouped tabs always use this session's Pi tab group. activate/close/group/ungroup require a target (targetId/urlIncludes/titleIncludes); with no target they act on this session's pi-chrome automation tab if one exists, and otherwise error rather than touching the user's active tab.",
 		promptSnippet: "List/open/activate/close/group existing Chrome tabs through the companion extension.",
 		parameters: Type.Object({
 			action: StringEnum(tabActionValues),
@@ -1212,18 +1294,18 @@ Usage rules:
 			targetId: Type.Optional(Type.String({ description: "Chrome tab id for activate/close/group/ungroup." })),
 			urlIncludes: Type.Optional(Type.String({ description: "Match the target tab by URL substring for activate/close/group/ungroup." })),
 			titleIncludes: Type.Optional(Type.String({ description: "Match the target tab by title substring for activate/close/group/ungroup." })),
-			group: Type.Optional(Type.Boolean({ description: "action=new only: pass false to open an ungrouped tab. By default every Pi-opened tab joins this session's own tab group." })),
-			groupTitle: Type.Optional(Type.String({ description: "Tab group title for action=group/new. Defaults to this Pi session's group ('Pi Session: <name-or-id>'). Pass an empty string on action=new to opt out of grouping." })),
+			group: Type.Optional(Type.Boolean({ description: "Deprecated; ignored. Pi-created tabs always join this session's own tab group." })),
+			groupTitle: Type.Optional(Type.String({ description: "Deprecated for action=new/group; ignored so one Pi session uses one tab group ('Pi Session: <name-or-id>')." })),
 			groupColor: Type.Optional(Type.String({ description: "Tab group color for action=group/new: grey, blue, red, yellow, green, pink, purple, cyan, or orange. Defaults to blue." })),
 			host: Type.Optional(Type.String()),
 			port: Type.Optional(Type.Number()),
 		}),
 		async execute(_id, params, signal, _onUpdate, ctx): Promise<ToolTextResult> {
 			const forwarded = { ...params } as typeof params & { groupTitle?: string };
-			// Default every Pi-opened/explicitly-grouped tab into this session's own group,
-			// named after the session display name (falling back to the session id), unless
-			// the caller specified a group title or opted out with group:false.
-			if ((params.action === "new" || params.action === "group") && params.groupTitle === undefined && params.group !== false) {
+			// Force every Pi-opened/explicitly-grouped tab into this session's own group,
+			// named after the session display name (falling back to the session id). There is
+			// intentionally no opt-out: one Pi session should create/use one tab group.
+			if (params.action === "new" || params.action === "group") {
 				forwarded.groupTitle = sessionGroupTitle(ctx);
 			}
 			const result = await authorizedBridgeSend(`tab.${params.action}`, forwarded, DEFAULT_TIMEOUT_MS, signal);
@@ -1351,7 +1433,7 @@ Usage rules:
 		name: "chrome_navigate",
 		label: "Chrome Navigate",
 		description:
-			"Navigate an existing Chrome tab to a URL via the companion extension. Runs in the background by default; pass background=false to focus Chrome and activate the tab so the user can watch. Optionally waits for load completion.",
+			"Navigate a Chrome tab to a URL via the companion extension. With no target, navigation goes to pi-chrome's own dedicated automation window/tab — it never replaces the user's active tab. Pass targetId/urlIncludes/titleIncludes only to act on a specific existing tab. Runs in the background by default; pass background=false to focus Chrome and activate the tab so the user can watch. Optionally waits for load completion.",
 		promptSnippet: "Navigate a Chrome tab in the user's existing profile.",
 		parameters: Type.Object({
 			url: Type.String(),

package/package.json

@@ -1,8 +1,8 @@
 {
 	"name": "pi-chrome",
-	"version": "0.15.38",
+	"version": "0.15.39",
 	"scripts": {
-		"test": "node test-suite/unit/csp-eval.test.mjs",
+		"test": "node test-suite/unit/csp-eval.test.mjs && node test-suite/unit/automation-target.test.mjs",
 		"version": "node scripts/sync-manifest-version.js",
 		"prepublishOnly": "node scripts/sync-manifest-version.js"
 	},

package/test-suite/unit/automation-target.test.mjs

@@ -0,0 +1,387 @@
+// Unit harness for pi-chrome's dedicated automation tab/window isolation in service_worker.js.
+//
+// Feature under test: pi-chrome must never navigate or replace the user's active tab. Page and
+// navigation actions without an explicit target are routed to a dedicated automation target that
+// the *calling Pi session* created and owns. Ownership is session-scoped (one extension brokers
+// every session) and mirrored to chrome.storage.session so a service-worker restart re-hydrates
+// it instead of orphaning the window. Cleanup closes only the calling session's owned target.
+//
+// Like csp-eval.test.mjs we load the *real* worker into a vm sandbox with a stateful chrome.*
+// mock, then exercise the real helpers and the real dispatch() paths. Chrome state (tabs/windows/
+// storage.session) can be shared across two sandbox loads to simulate a service-worker restart.
+
+import vm from "node:vm";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const workerPath = path.resolve(__dirname, "../../extensions/chrome-profile-bridge/browser-extension/service_worker.js");
+const src = fs.readFileSync(workerPath, "utf8");
+
+let failures = 0;
+let passes = 0;
+function ok(cond, msg) {
+  if (cond) { passes++; }
+  else { failures++; console.error(`  ✗ ${msg}`); }
+}
+async function throwsWith(fn, re, msg) {
+  try { await fn(); ok(false, `${msg} (expected throw)`); }
+  catch (e) { ok(re.test(String(e.message || e)), `${msg} (got: ${e.message})`); }
+}
+
+// ---- stateful Chrome mock. `state` (tabs/windows/storage) can be shared to simulate a
+// service-worker restart: the browser keeps its tabs/windows/session-storage, the worker memory
+// is wiped (a fresh sandbox).
+function makeChromeState() {
+  const tabs = new Map(); // id -> { id, windowId, url, active, groupId }
+  const windows = new Map(); // id -> { id }
+  const groups = new Map(); // groupId -> { id, title, color, collapsed, windowId }
+  const storage = {}; // chrome.storage.session backing
+  let nextTabId = 1;
+  let nextWindowId = 1;
+  let nextGroupId = 1;
+  const alloc = { tab: () => nextTabId++, window: () => nextWindowId++, group: () => nextGroupId++ };
+
+  // Seed a user window with two real user tabs (Gmail + a research article, the active one).
+  const userWindowId = alloc.window();
+  windows.set(userWindowId, { id: userWindowId });
+  const userGmail = { id: alloc.tab(), windowId: userWindowId, url: "https://mail.google.com/", active: false, groupId: -1 };
+  const userArticle = { id: alloc.tab(), windowId: userWindowId, url: "https://example.com/research-article", active: true, groupId: -1 };
+  tabs.set(userGmail.id, userGmail);
+  tabs.set(userArticle.id, userArticle);
+
+  return { tabs, windows, groups, storage, alloc, userWindowId, userGmail, userArticle };
+}
+
+function makeChrome(state, { withWindows = true, withStorage = true, withTabGroups = false } = {}) {
+  const { tabs, windows, groups, storage, alloc, userWindowId } = state;
+  const noop = () => {};
+  const listener = { addListener: noop, removeListener: noop };
+
+  const chrome = {
+    runtime: { id: "unittestextension", getManifest: () => ({ version: "0.0.0" }), onInstalled: listener, onStartup: listener, lastError: null },
+    alarms: { onAlarm: listener, create: noop, clear: noop, clearAll: noop },
+    action: { onClicked: listener },
+    debugger: { sendCommand: noop, attach: async () => {}, detach: async () => {}, getTargets: (cb) => cb([]), onDetach: listener },
+    scripting: { executeScript: async () => [{ result: undefined }], registerContentScripts: async () => {}, unregisterContentScripts: async () => {} },
+    webNavigation: { onCommitted: listener },
+    tabs: {
+      onUpdated: listener,
+      query: async (q = {}) => {
+        let list = [...tabs.values()];
+        if (q.active === true) list = list.filter((t) => t.active);
+        if (typeof q.windowId === "number") list = list.filter((t) => t.windowId === q.windowId);
+        return list.map((t) => ({ ...t }));
+      },
+      get: async (id) => { const t = tabs.get(id); if (!t) throw new Error(`No tab with id ${id}`); return { ...t }; },
+      create: async ({ url = "about:blank", active = false, windowId = userWindowId } = {}) => {
+        const tab = { id: alloc.tab(), windowId, url, active, groupId: -1 };
+        tabs.set(tab.id, tab);
+        return { ...tab };
+      },
+      update: async (id, props = {}) => { const t = tabs.get(id); if (!t) throw new Error(`No tab with id ${id}`); Object.assign(t, props); return { ...t }; },
+      remove: async (id) => { tabs.delete(id); },
+      group: async ({ groupId, tabIds = [] } = {}) => {
+        let gid = groupId;
+        if (typeof gid !== "number") {
+          gid = alloc.group();
+          const firstTab = tabs.get(tabIds[0]);
+          groups.set(gid, { id: gid, title: "", color: "grey", collapsed: false, windowId: firstTab ? firstTab.windowId : userWindowId });
+        }
+        for (const tid of tabIds) { const t = tabs.get(tid); if (t) t.groupId = gid; }
+        return gid;
+      },
+      ungroup: async (id) => { const ids = Array.isArray(id) ? id : [id]; for (const tid of ids) { const t = tabs.get(tid); if (t) t.groupId = -1; } },
+    },
+    storage: withStorage ? {
+      session: {
+        get: async (key) => (key in storage ? { [key]: storage[key] } : {}),
+        set: async (obj) => { Object.assign(storage, obj); },
+      },
+    } : undefined,
+  };
+
+  if (withTabGroups) {
+    chrome.tabGroups = {
+      query: async ({ windowId } = {}) => [...groups.values()].filter((g) => windowId === undefined || g.windowId === windowId).map((g) => ({ ...g })),
+      get: async (id) => { const g = groups.get(id); if (!g) throw new Error(`No group ${id}`); return { ...g }; },
+      update: async (id, props = {}) => { const g = groups.get(id); if (!g) throw new Error(`No group ${id}`); Object.assign(g, props); return { ...g }; },
+    };
+  }
+
+  if (withWindows) {
+    chrome.windows = {
+      create: async ({ url = "about:blank", focused = false } = {}) => {
+        const id = alloc.window();
+        windows.set(id, { id });
+        const tab = { id: alloc.tab(), windowId: id, url, active: true, groupId: -1 };
+        tabs.set(tab.id, tab);
+        return { id, focused, tabs: [{ ...tab }] };
+      },
+      get: async (id) => { const w = windows.get(id); if (!w) throw new Error(`No window with id ${id}`); return { ...w }; },
+      remove: async (id) => { windows.delete(id); for (const [tid, t] of [...tabs]) if (t.windowId === id) tabs.delete(tid); },
+      update: async () => {},
+    };
+  } else {
+    chrome.windows = { update: async () => {} }; // no create/get/remove -> tab fallback path
+  }
+
+  return chrome;
+}
+
+function loadWorker(chrome) {
+  const noop = () => {};
+  const sandbox = {
+    console, JSON, Date, Math, Promise, Array, Object, String, Number, Boolean,
+    Error, TypeError, Map, Set, BigInt, Symbol, structuredClone,
+    setTimeout, clearTimeout, setInterval: () => 0, clearInterval: noop,
+    fetch: async () => { throw new Error("no network in unit test"); },
+    navigator: { userAgent: "unit-test" },
+    WebSocket: function () {},
+    chrome,
+  };
+  sandbox.globalThis = sandbox;
+  sandbox.self = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(src, sandbox);
+  return sandbox;
+}
+
+const SK = "session:alpha"; // a representative sessionKey
+
+async function run() {
+  // ===== Isolation: navigation does not touch the user's active/other tabs. =====
+  {
+    const state = makeChromeState();
+    const w = loadWorker(makeChrome(state));
+    const userActiveUrl = state.userArticle.url;
+
+    const nav = await w.dispatch("page.navigate", { url: "https://pi.test/task", waitUntilLoad: false, sessionKey: SK });
+    ok(state.userArticle.url === userActiveUrl, "navigate: active user tab (research article) is not overwritten");
+    ok(state.userGmail.url === "https://mail.google.com/", "navigate: other user tab (Gmail) untouched");
+    ok(nav.url === "https://pi.test/task", "navigate: automation target navigated to requested URL");
+    ok(nav.id !== state.userArticle.id && nav.id !== state.userGmail.id, "navigate: did not reuse any user tab");
+    ok(nav.windowId !== state.userWindowId, "navigate: automation target lives in a dedicated window");
+
+    const status = await w.dispatch("automation.status", { sessionKey: SK });
+    ok(status.tabId === nav.id && status.windowId === nav.windowId, "ownership: target ids tracked for the session");
+    ok(w.isPiChromeOwnedTarget(nav.id, SK) === true, "ownership: isPiChromeOwnedTarget(owned, session) === true");
+    ok(w.isPiChromeOwnedTarget(state.userArticle.id) === false, "ownership: user tab is never owned (any session)");
+
+    // Reuse: a later navigation reuses the same owned target.
+    const nav2 = await w.dispatch("page.navigate", { url: "https://pi.test/step-2", waitUntilLoad: false, sessionKey: SK });
+    ok(nav2.id === nav.id && nav2.windowId === nav.windowId, "reuse: second navigation reuses the same automation window/tab");
+    ok(state.userArticle.url === userActiveUrl, "reuse: user tab still untouched after second navigation");
+
+    // Cleanup closes only the owned window; user tabs/windows survive.
+    const cleanup = await w.dispatch("automation.cleanup", { sessionKey: SK });
+    ok(cleanup.closedWindowId === nav.windowId, "cleanup: closed the owned window");
+    ok(state.tabs.has(state.userArticle.id) && state.tabs.has(state.userGmail.id), "cleanup: user tabs never closed");
+    ok(state.windows.has(state.userWindowId), "cleanup: user window never closed");
+    ok(!state.tabs.has(nav.id), "cleanup: the owned automation tab is gone");
+    const status2 = await w.dispatch("automation.status", { sessionKey: SK });
+    ok(status2.tabId === null && status2.windowId === null, "cleanup: ownership cleared");
+  }
+
+  // ===== Session-group integration: the dedicated-window tab joins this session's group. =====
+  {
+    const state = makeChromeState();
+    const w = loadWorker(makeChrome(state, { withTabGroups: true }));
+    // index.ts tags page.* actions with joinSessionGroup + sessionGroupTitle; replicate that here.
+    const groupTitle = "Pi Session: alpha";
+    const nav = await w.dispatch("page.navigate", {
+      url: "https://pi.test/grouped", waitUntilLoad: false,
+      sessionKey: SK, joinSessionGroup: true, sessionGroupTitle: groupTitle,
+    });
+    const navTab = state.tabs.get(nav.id);
+    ok(navTab.windowId !== state.userWindowId, "group: automation tab is in its dedicated window");
+    ok(typeof navTab.groupId === "number" && navTab.groupId >= 0, "group: automation tab joined a tab group");
+    const grp = state.groups.get(navTab.groupId);
+    ok(grp && grp.title === groupTitle, "group: the group is titled with this session's title");
+    ok(grp.windowId === navTab.windowId, "group: the session group lives inside the dedicated automation window (not the user window)");
+
+    // A second page action reuses the same tab and does not spawn a second group.
+    const groupsBefore = state.groups.size;
+    await w.dispatch("page.navigate", { url: "https://pi.test/grouped-2", waitUntilLoad: false, sessionKey: SK, joinSessionGroup: true, sessionGroupTitle: groupTitle });
+    ok(state.groups.size === groupsBefore, "group: reusing the automation tab does not create a second group");
+  }
+
+  // ===== tab.new joins the existing session group instead of creating one group per window. =====
+  {
+    const state = makeChromeState();
+    const w = loadWorker(makeChrome(state, { withTabGroups: true }));
+    const groupTitle = "Pi Session: alpha";
+    const nav = await w.dispatch("page.navigate", {
+      url: "https://pi.test/group-owner", waitUntilLoad: false,
+      sessionKey: SK, joinSessionGroup: true, sessionGroupTitle: groupTitle,
+    });
+    const navTab = state.tabs.get(nav.id);
+    const groupId = navTab.groupId;
+    const groupsBefore = state.groups.size;
+
+    const opened = await w.dispatch("tab.new", { url: "https://pi.test/new-tab", groupTitle, sessionKey: SK });
+    ok(state.groups.size === groupsBefore, "tab.new-group: did not create another same-session group");
+    ok(opened.tab.groupId === groupId, "tab.new-group: opened tab joined the existing session group");
+    ok(opened.tab.windowId === nav.windowId, "tab.new-group: opened tab was created in the existing group's window");
+
+    const forced = await w.dispatch("tab.new", { url: "https://pi.test/no-opt-out", groupTitle, group: false, sessionKey: SK });
+    ok(forced.tab.groupId === groupId, "tab.new-group: group:false is ignored; tab still joins the session group");
+    ok(state.groups.size === groupsBefore, "tab.new-group: group:false does not create another group");
+
+    const blankTitle = await w.dispatch("tab.new", { url: "https://pi.test/blank-title", groupTitle: "", group: false, sessionKey: SK });
+    ok(typeof blankTitle.tab.groupId === "number" && blankTitle.tab.groupId >= 0, "tab.new-group: groupTitle:'' still creates a grouped tab");
+    ok(blankTitle.group.title === "Pi", "tab.new-group: blank groupTitle falls back to a group instead of opting out");
+  }
+
+  // ===== tab.new never leaves an ungrouped tab behind when grouping fails. =====
+  {
+    const state = makeChromeState();
+    const chrome = makeChrome(state, { withTabGroups: true });
+    const w = loadWorker(chrome);
+    const tabsBefore = state.tabs.size;
+    chrome.tabs.group = async () => { throw new Error("group blew up"); };
+
+    await throwsWith(
+      () => w.dispatch("tab.new", { url: "https://pi.test/group-fail", groupTitle: "Pi Session: alpha", sessionKey: SK }),
+      /group blew up/,
+      "tab.new-group-fail: surfaces grouping error",
+    );
+    ok(state.tabs.size === tabsBefore, "tab.new-group-fail: closes the created tab instead of leaving it ungrouped");
+  }
+
+  // ===== Grouping is best-effort: a tabGroups failure must not break navigation. =====
+  {
+    const state = makeChromeState();
+    const chrome = makeChrome(state, { withTabGroups: true });
+    chrome.tabs.group = async () => { throw new Error("group blew up"); };
+    const w = loadWorker(chrome);
+    const nav = await w.dispatch("page.navigate", { url: "https://pi.test/group-fail", waitUntilLoad: false, sessionKey: SK, joinSessionGroup: true, sessionGroupTitle: "Pi Session: alpha" });
+    ok(nav.url === "https://pi.test/group-fail", "group-fail: navigation still succeeds when grouping throws");
+    ok(state.tabs.get(nav.id).windowId !== state.userWindowId, "group-fail: still used the dedicated automation window");
+  }
+
+  // ===== Concurrency: two sessions get separate windows; cleanup is per-session. =====
+  {
+    const state = makeChromeState();
+    const w = loadWorker(makeChrome(state));
+    const a = await w.dispatch("page.navigate", { url: "https://pi.test/a", waitUntilLoad: false, sessionKey: "session:A" });
+    const b = await w.dispatch("page.navigate", { url: "https://pi.test/b", waitUntilLoad: false, sessionKey: "session:B" });
+    ok(a.id !== b.id && a.windowId !== b.windowId, "concurrency: each session gets its own dedicated window/tab");
+    ok(w.isPiChromeOwnedTarget(a.id, "session:A") && !w.isPiChromeOwnedTarget(a.id, "session:B"), "concurrency: ownership is scoped to the creating session");
+
+    // Cleaning up session A must not touch session B's target.
+    await w.dispatch("automation.cleanup", { sessionKey: "session:A" });
+    ok(!state.tabs.has(a.id), "concurrency: cleanup closed session A's tab");
+    ok(state.tabs.has(b.id), "concurrency: cleanup left session B's tab open");
+    const bStatus = await w.dispatch("automation.status", { sessionKey: "session:B" });
+    ok(bStatus.tabId === b.id, "concurrency: session B still owns its target after A cleanup");
+  }
+
+  // ===== Service-worker restart / reconnect: persisted ownership re-hydrates from storage. =====
+  {
+    const state = makeChromeState();
+    const w1 = loadWorker(makeChrome(state));
+    const nav = await w1.dispatch("page.navigate", { url: "https://pi.test/persist", waitUntilLoad: false, sessionKey: SK });
+    ok(typeof state.storage.piChromeAutomationTargets === "object", "restart: ownership was persisted to storage.session");
+
+    // Simulate the MV3 service worker being suspended and restarted: fresh sandbox (memory wiped),
+    // same browser tabs/windows + same session storage.
+    const w2 = loadWorker(makeChrome(state));
+    const statusAfterRestart = await w2.dispatch("automation.status", { sessionKey: SK });
+    ok(statusAfterRestart.tabId === nav.id && statusAfterRestart.windowId === nav.windowId, "restart: re-hydrated the owned target from storage");
+
+    // A navigation after restart must REUSE the existing window, not orphan it with a new one.
+    const windowsBefore = state.windows.size;
+    const nav2 = await w2.dispatch("page.navigate", { url: "https://pi.test/persist-2", waitUntilLoad: false, sessionKey: SK });
+    ok(nav2.id === nav.id && nav2.windowId === nav.windowId, "restart: navigation after restart reuses the persisted window (no orphan)");
+    ok(state.windows.size === windowsBefore, "restart: no new window created after restart");
+
+    // Cleanup after restart works and clears persisted state.
+    await w2.dispatch("automation.cleanup", { sessionKey: SK });
+    const persisted = state.storage.piChromeAutomationTargets || {};
+    ok(!(SK in persisted), "restart: cleanup removed the session from persisted storage");
+  }
+
+  // ===== Restart after the user manually closed the window: no orphan, fresh target. =====
+  {
+    const state = makeChromeState();
+    const w1 = loadWorker(makeChrome(state));
+    const nav = await w1.dispatch("page.navigate", { url: "https://pi.test/closed", waitUntilLoad: false, sessionKey: SK });
+    await state.windows.delete(nav.windowId); // user closed pi-chrome's window
+    for (const [tid, t] of [...state.tabs]) if (t.windowId === nav.windowId) state.tabs.delete(tid);
+
+    const w2 = loadWorker(makeChrome(state)); // SW restart
+    const nav2 = await w2.dispatch("page.navigate", { url: "https://pi.test/reopened", waitUntilLoad: false, sessionKey: SK });
+    ok(nav2.id !== nav.id, "restart-after-close: a fresh automation target is created when the persisted one is gone");
+    ok(state.tabs.has(nav2.id), "restart-after-close: new target exists");
+  }
+
+  // ===== tab.* management never auto-creates / never falls back to the user's active tab. =====
+  {
+    const state = makeChromeState();
+    const w = loadWorker(makeChrome(state));
+    const windowsBefore = state.windows.size;
+    const tabsBefore = state.tabs.size;
+
+    await throwsWith(
+      () => w.dispatch("tab.close", { sessionKey: SK }),
+      /no automation tab yet|Pass targetId/,
+      "tab.close: with no target and no owned target, errors instead of closing the user's active tab",
+    );
+    ok(state.tabs.has(state.userArticle.id), "tab.close: user's active tab was NOT closed");
+    ok(state.windows.size === windowsBefore && state.tabs.size === tabsBefore, "tab.close: did not spawn a throwaway tab/window");
+
+    await throwsWith(() => w.dispatch("tab.activate", { sessionKey: SK }), /no automation tab yet|Pass targetId/, "tab.activate: errors with no target/owned target");
+
+    // Once an automation target exists, management actions operate on it (not on the user tab).
+    const nav = await w.dispatch("page.navigate", { url: "https://pi.test/manage", waitUntilLoad: false, sessionKey: SK });
+    const closed = await w.dispatch("tab.close", { sessionKey: SK });
+    ok(closed.closed === nav.id, "tab.close: with an owned target, closes that target");
+    ok(state.tabs.has(state.userArticle.id), "tab.close: user tab still safe after closing the owned target");
+  }
+
+  // ===== Explicit targeting still works on any existing tab (no regression). =====
+  {
+    const state = makeChromeState();
+    const w = loadWorker(makeChrome(state));
+    const nav = await w.dispatch("page.navigate", { url: "https://pi.test/explicit", targetId: String(state.userGmail.id), waitUntilLoad: false, sessionKey: SK });
+    ok(nav.id === state.userGmail.id, "explicit: targetId routes to the requested existing tab");
+    ok(state.userGmail.url === "https://pi.test/explicit", "explicit: explicitly targeted tab is navigated");
+    const status = await w.dispatch("automation.status", { sessionKey: SK });
+    ok(status.tabId === null, "explicit: explicit targeting does not create/claim an automation target");
+  }
+
+  // ===== Window-unavailable fallback: a dedicated TAB is used, and the user's window is safe. =====
+  {
+    const state = makeChromeState();
+    const w = loadWorker(makeChrome(state, { withWindows: false }));
+    const target = await w.getOrCreateAutomationTarget(SK);
+    ok(target.id !== state.userArticle.id && target.id !== state.userGmail.id, "fallback: created a dedicated tab, not a user tab");
+    ok(w.isPiChromeOwnedTarget(target.id, SK) === true, "fallback: dedicated tab is owned");
+    const cleanup = await w.cleanupAutomationTarget(SK);
+    ok(cleanup.closedTabId === target.id && cleanup.closedWindowId === null, "fallback: cleanup closes only the owned tab (never the shared window)");
+    ok(state.windows.has(state.userWindowId), "fallback: cleanup never closes the user/shared window");
+    ok(state.tabs.has(state.userArticle.id) && state.tabs.has(state.userGmail.id), "fallback: cleanup leaves user tabs intact");
+  }
+
+  // ===== Robust cleanup: no-op when nothing created, and when target already closed manually. =====
+  {
+    const state = makeChromeState();
+    const w = loadWorker(makeChrome(state));
+    const empty = await w.cleanupAutomationTarget(SK);
+    ok(empty.closedWindowId === null && empty.closedTabId === null, "cleanup: no-op when nothing was ever created");
+
+    const t = await w.getOrCreateAutomationTarget(SK);
+    // User closed pi-chrome's window manually (Chrome closes its tabs too).
+    state.windows.delete(t.windowId);
+    for (const [tid, tab] of [...state.tabs]) if (tab.windowId === t.windowId) state.tabs.delete(tid);
+    const stale = await w.cleanupAutomationTarget(SK);
+    ok(stale.closedWindowId === null && stale.closedTabId === null, "cleanup: robust when owned window was already closed");
+  }
+
+  console.log(`\n${passes} passed, ${failures} failed`);
+  if (failures) process.exit(1);
+}
+
+run().catch((e) => { console.error(e); process.exit(1); });