fix(extension): match form state by element identity

fix(extension): prevent closed borrowed tabs from blocking session stop

CHANGELOG.md

@@ -0,0 +1,92 @@
+# Changelog
+
+All notable changes to BrowserSkill will be documented in this file.
+The format is based on [Keep a Changelog](https://keepachangelog.com/).
+
+Starting from 0.2.0, CLI / Extension / DSH Plugin share the same version number.
+
+## [Unreleased]
+
+## [0.2.0] - 2026-09-02
+
+### Added
+- File transfer: upload and download support across CLI, Extension, and DSH Plugin
+- File transfer: drag-and-drop upload (`drop-to-upload`)
+- VOM semantic graph, name enrichment, and hover perception modules
+- VOM hover probing (opt-in via `observe` parameter)
+- DSH Plugin: browser tool parity with CLI commands
+- Edge Add-ons automated publishing in CI
+- Protocol upgrade reminder when CLI / Extension protocol versions differ
+- Browser evaluation harness (`evals/browser/`)
+- Unified release script (`scripts/release.mjs`)
+
+### Changed
+- **Version scheme**: all three components now share the same semver
+- VOM rendering algorithm optimizations
+- Leaner SKILL.md agent instructions
+- DSH Plugin: simplified browser commands
+- Borrow confirmation UX — proactive focus and longer timeout
+- PiP window now has a close button
+
+### Fixed
+- Screenshot media type detection (was hard-coded to `image/png`)
+- DSH Plugin session lifecycle stability
+- DSH Plugin Cordis package ID mismatch
+- Observation thumbnail media type sniffing
+- Upload/download race conditions and layout bypass issues
+- VOM repeated name and safety policy issues
+
+---
+
+*Previous releases used independent version numbers per component.*
+
+## CLI 0.1.11 / Extension 0.1.7 / DSH Plugin 0.1.2 — 2026-08-26 ~ 2026-08-29
+
+### Added
+- DSH Plugin sidebar integration, session lifecycle, and archive cleanup
+- Recorder iframe and OOPIF support
+
+### Changed
+- VOM functional refactor
+
+### Fixed
+- Recorder safety policy and bug fixes
+
+## CLI 0.1.10 / Extension 0.1.6 — 2026-08-08
+
+### Added
+- VOM observation recording and settled-state detection
+- Record overlay timer
+
+### Fixed
+- Browser keepalive disconnect handling
+
+## CLI 0.1.9 / Extension 0.1.5 — 2026-07-29
+
+### Added
+- CLI auto-update mechanism
+- Trace v3 protocol and recorder
+
+### Fixed
+- MV3 keepalive disconnect
+
+## CLI 0.1.8 / Extension 0.1.4 — 2026-07-22
+
+### Added
+- More browser interaction actions
+
+### Fixed
+- Windows named-pipe hash-only path issue
+
+## CLI 0.1.7 / Extension 0.1.3 — 2026-07-07
+
+Initial public release pair.
+
+## CLI 0.1.6 — 2026-06-30
+
+### Fixed
+- Minor CLI fixes
+
+## CLI 0.1.5 / Extension 0.1.2 — 2026-06-22
+
+First tagged releases.

Cargo.lock

@@ -134,7 +134,7 @@ dependencies = [
 
 [[package]]
 name = "bsk"
-version = "0.1.11"
+version = "0.2.0"
 dependencies = [
  "anyhow",
  "base64",
@@ -169,7 +169,7 @@ dependencies = [
 
 [[package]]
 name = "bsk-protocol"
-version = "0.1.11"
+version = "0.2.0"
 dependencies = [
  "schemars",
  "semver",

Cargo.toml

@@ -7,7 +7,7 @@ members = [
 default-members = ["crates/bsk-cli"]
 
 [workspace.package]
-version = "0.1.11"
+version = "0.2.0"
 edition = "2024"
 rust-version = "1.85"
 license = "MIT"
@@ -43,7 +43,7 @@ rand = "0.8"
 uuid = { version = "1", features = ["v4", "serde"] }
 
 # Workspace crates (version required for `cargo publish` of dependents)
-bsk-protocol = { version = "0.1.9", path = "crates/bsk-protocol" }
+bsk-protocol = { version = "0.2.0", path = "crates/bsk-protocol" }
 
 [profile.release]
 strip = "symbols"

apps/extension/e2e/fixtures/file-transfer.html

@@ -0,0 +1,81 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>BrowserSkill file-transfer fixture</title>
+    <style>
+      body { font: 16px system-ui; max-width: 760px; margin: 48px auto; }
+      .actions { display: flex; gap: 12px; align-items: center; margin: 24px 0; }
+      button, a { padding: 10px 16px; border: 1px solid #777; border-radius: 8px; }
+      a[aria-disabled="true"] { opacity: .45; pointer-events: none; }
+      #drop { padding: 36px; border: 3px dashed #777; border-radius: 12px; text-align: center; }
+      #drop.dragging { border-color: #2563eb; background: #eff6ff; }
+      img { display: block; max-width: 480px; max-height: 360px; margin-top: 20px; }
+    </style>
+  </head>
+  <body>
+    <h1>Upload then download the same image</h1>
+    <p id="status">No image selected</p>
+    <div class="actions">
+      <button id="upload" type="button">Upload through file input</button>
+      <input id="file" type="file" accept="image/png" hidden />
+      <a id="download" aria-disabled="true">Download uploaded image</a>
+    </div>
+    <div id="drop" role="button" tabindex="0">Drop an image here</div>
+    <img id="preview" alt="Uploaded image preview" hidden />
+    <script>
+      const input = document.querySelector('#file');
+      const upload = document.querySelector('#upload');
+      const drop = document.querySelector('#drop');
+      const download = document.querySelector('#download');
+      const preview = document.querySelector('#preview');
+      const status = document.querySelector('#status');
+      let objectUrl;
+
+      window.__bskTransferFixture = { events: [], result: null };
+
+      function accept(file, mechanism) {
+        if (!file) return;
+        if (objectUrl) URL.revokeObjectURL(objectUrl);
+        objectUrl = URL.createObjectURL(file);
+        preview.src = objectUrl;
+        preview.hidden = false;
+        download.href = objectUrl;
+        download.download = file.name;
+        download.removeAttribute('aria-disabled');
+        status.textContent = `Ready via ${mechanism}: ${file.name} (${file.size} bytes)`;
+        window.__bskTransferFixture.result = {
+          mechanism,
+          name: file.name,
+          size: file.size,
+          type: file.type,
+          hasPathProperty: 'path' in file,
+        };
+      }
+
+      upload.addEventListener('click', () => input.click());
+      input.addEventListener('change', () => accept(input.files[0], 'input'));
+
+      for (const type of ['dragenter', 'dragover']) {
+        drop.addEventListener(type, event => {
+          const types = [...event.dataTransfer.types];
+          window.__bskTransferFixture.events.push({ type, types });
+          if (!types.includes('Files')) return;
+          event.preventDefault();
+          drop.classList.add('dragging');
+        });
+      }
+      drop.addEventListener('dragleave', () => drop.classList.remove('dragging'));
+      drop.addEventListener('drop', event => {
+        window.__bskTransferFixture.events.push({
+          type: 'drop',
+          types: [...event.dataTransfer.types],
+          fileCount: event.dataTransfer.files.length,
+        });
+        event.preventDefault();
+        drop.classList.remove('dragging');
+        accept(event.dataTransfer.files[0], 'drop');
+      });
+    </script>
+  </body>
+</html>

apps/extension/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@browser-skill/extension",
-  "version": "0.1.7",
+  "version": "0.2.0",
   "private": true,
   "type": "module",
   "scripts": {

apps/extension/src/content/__tests__/record-frame-agent.test.ts

@@ -45,10 +45,32 @@ function portHarness() {
 
 describe("RecordFrameAgent", () => {
   afterEach(() => {
+    vi.unstubAllGlobals();
     document.documentElement.removeAttribute(RECORD_DOCUMENT_ATTRIBUTE);
     document.body.replaceChildren();
   });
 
+  it("starts when crypto.randomUUID is unavailable", async () => {
+    const harness = portHarness();
+    const getRandomValues = vi.fn((bytes: Uint8Array) => {
+      bytes.fill(0x11);
+      return bytes;
+    });
+    vi.stubGlobal("crypto", { getRandomValues });
+    vi.stubGlobal("chrome", {
+      runtime: {
+        connect: vi.fn(() => harness.port),
+        sendMessage: vi.fn(),
+      },
+    });
+    const agent = new RecordFrameAgent();
+
+    await expect(
+      agent.start({ type: RECORD_FRAME_START, requestId: "rec-http", startedAtMs: 10 }),
+    ).resolves.toEqual({ ok: true });
+    expect(getRandomValues).toHaveBeenCalled();
+  });
+
   it("keeps a failed stop retryable and flushes the final dirty fill", async () => {
     const harness = portHarness();
     const sendMessage = vi

apps/extension/src/content/record-step-delivery.ts

@@ -1,3 +1,4 @@
+import { createRandomUuid } from "@/lib/random-uuid";
 import {
   isAcceptedRecordStepAck,
   RECORD_STEP,
@@ -18,7 +19,7 @@ export class RecordStepDelivery {
   constructor(
     requestId: string,
     send: SendRecordStepMessage = (message) => chrome.runtime.sendMessage(message),
-    producerId: string = crypto.randomUUID(),
+    producerId: string = createRandomUuid(),
   ) {
     this.#requestId = requestId;
     this.#producerId = producerId;

apps/extension/src/content/recording/frame-agent.ts

@@ -1,3 +1,4 @@
+import { createRandomUuid } from "@/lib/random-uuid";
 import {
   markRecordingDocument,
   type RecordingDocumentMarker,
@@ -67,7 +68,7 @@ export class RecordFrameAgent {
   async #start(
     message: RecordFrameStartMessage,
   ): Promise<{ ok: true } | { ok: false; error: string }> {
-    const producerId = crypto.randomUUID();
+    const producerId = createRandomUuid();
     const root = await waitForDocumentElement();
     if (this.#disposed) return { ok: false, error: "recording document is disposed" };
     const marker = markRecordingDocument(producerId, root);

apps/extension/src/entrypoints/background.ts

@@ -25,7 +25,7 @@ import { recordFrameCoordinator } from "@/lib/recording/frame-coordinator";
 import { attachSessionsLiveFlag } from "@/lib/sessions-live-flag";
 import { createDisconnectCleanup } from "@/session-manager/disconnect-cleanup";
 import { attachSessionEventHandler } from "@/session-manager/event-handler";
-import { SessionManager } from "@/session-manager/manager";
+import { isAgentControlledTab, SessionManager } from "@/session-manager/manager";
 import {
   attachBorrowNotificationButtonHandler,
   attachBorrowNotificationClickHandler,
@@ -41,6 +41,8 @@ import {
   attachRecordStepListener,
   type RecordRuntimeDeps,
 } from "@/tools/record";
+import { chromeTabsApi } from "@/tools/shared";
+import { chromeTabMutationApi } from "@/tools/tabs";
 import { detectBrowserMeta } from "@/transport/handshake";
 import type { Transport } from "@/transport/transport";
 import { WSTransport } from "@/transport/ws-transport";
@@ -80,6 +82,24 @@ export default defineBackground(() => {
     };
   }
 
+  /**
+   * Authoritative overlay state for a specific tab. Agent Window tabs are
+   * free by default; only tabs explicitly claimed through session startup,
+   * `tab_create`, or `tab_borrow` receive the control overlay.
+   */
+  function overlayStateForTab(tabId?: number, windowId?: number): OverlayAgentStateMessage {
+    if (typeof tabId === "number" && typeof windowId === "number") {
+      const ctx = sessions.findByWindowId(windowId);
+      if (ctx && isAgentControlledTab(ctx, tabId)) return overlayStateForWindow(windowId);
+    }
+    return {
+      type: OVERLAY_AGENT_STATE,
+      sessionId: null,
+      mode: "hidden",
+      generation: overlayGeneration,
+    };
+  }
+
   async function pushOverlayStateToTab(
     tabId: number,
     state: OverlayAgentStateMessage,
@@ -91,13 +111,18 @@ export default defineBackground(() => {
     }
   }
 
+  async function pushOverlayStateForTab(tabId: number, windowId?: number): Promise<void> {
+    const state = overlayStateForTab(tabId, windowId);
+    await pushOverlayStateToTab(tabId, state);
+  }
+
   async function pushOverlayStateForWindow(windowId: number): Promise<void> {
-    const state = overlayStateForWindow(windowId);
     const tabs = await chrome.tabs.query({ windowId });
     await Promise.all(
-      tabs.map((tab) =>
-        typeof tab.id === "number" ? pushOverlayStateToTab(tab.id, state) : Promise.resolve(),
-      ),
+      tabs.map((tab) => {
+        if (typeof tab.id !== "number") return Promise.resolve();
+        return pushOverlayStateForTab(tab.id, windowId);
+      }),
     );
   }
 
@@ -136,13 +161,30 @@ export default defineBackground(() => {
     if (typeof tab.windowId !== "number") return;
     pushOverlayStateForAgentWindow(tab.windowId);
   });
+  // Newly observed tabs are free unless the agent's own creation path has
+  // already claimed their concrete id. This listener only renders that
+  // state; it never infers or mutates ownership from event ordering.
+  chrome.tabs.onCreated.addListener((tab) => {
+    if (typeof tab.windowId !== "number" || typeof tab.id !== "number") return;
+    if (!sessions.findByWindowId(tab.windowId)) return;
+    void pushOverlayStateForTab(tab.id, tab.windowId);
+  });
+  chrome.tabs.onRemoved.addListener((tabId, removeInfo) => {
+    sessions.forgetClosedTab(tabId, { isWindowClosing: removeInfo.isWindowClosing });
+  });
   // Re-sync the storage.session flag on SW startup so a previous SW's
   // stale `true` does not keep waking us on every page load until the
   // first mutation (review M4/M5 round 3 m-R3-1).
   void sessionsLive.refresh();
   const cleanupAfterDisconnect = createDisconnectCleanup({
     manager: sessions,
-    sessionStopDeps: { cdp },
+    // Same contract as the dispatcher's `tool.session_stop`: without these
+    // deps the agent-tab cleanup and the window-release path are dead code.
+    sessionStopDeps: {
+      cdp,
+      tabManagement: { tabs: chromeTabMutationApi },
+      tabsQuery: chromeTabsApi,
+    },
     onSessionsChanged: () => {
       void sessionsLive.syncFromManager();
     },
@@ -176,6 +218,9 @@ export default defineBackground(() => {
     recording: recordDeps,
     onSessionsChanged: onOverlaySessionStateChanged,
     onBrowserControlResumed,
+    onAgentTabClaimed: (tabId, windowId) => {
+      void pushOverlayStateForTab(tabId, windowId);
+    },
     approveBorrow: (ctx) =>
       requestBorrowConfirmation(ctx.tabId, {
         ...(ctx.signal !== undefined ? { signal: ctx.signal } : {}),
@@ -309,7 +354,11 @@ export default defineBackground(() => {
     }
 
     if (msg.kind === OVERLAY_MSG_READY) {
-      sendResponse(overlayStateForWindow(sender.tab?.windowId));
+      // Resolve from explicit tab ownership before sending so free tabs never
+      // flash the control mask.
+      if (typeof sender.tab?.id === "number") {
+        void pushOverlayStateForTab(sender.tab.id, sender.tab.windowId);
+      }
       return false;
     }
 

apps/extension/src/entrypoints/popup/App.test.tsx

@@ -122,8 +122,8 @@ describe("App", () => {
 
     expect(screen.queryByText(/^扩展 v/)).toBeNull();
     expect(screen.queryByText(/^daemon v/)).toBeNull();
-    expect(screen.getByTitle("扩展版本").textContent).toBe(EXTENSION_VERSION);
-    expect(screen.getByTitle("bsk 版本").textContent).toBe(mockDaemonVersion);
+    expect(screen.getByTitle("扩展版本").textContent).toBe(`Ext ${EXTENSION_VERSION}`);
+    expect(screen.getByTitle("bsk 版本").textContent).toBe(`CLI ${mockDaemonVersion}`);
     expect(screen.getByText("03c3e47f")).toBeTruthy();
 
     const copyButton = screen.getByRole("button", { name: "复制实例 ID" });

apps/extension/src/entrypoints/popup/App.tsx

@@ -267,9 +267,9 @@ export function App() {
             data-slot="popup-meta"
           >
             <div className="flex shrink-0 items-center gap-1">
-              <span title={t("popup.extensionVersionHint")}>{extensionVersion}</span>
+              <span title={t("popup.daemonVersionHint")}>CLI {daemonVersion}</span>
               <span aria-hidden>/</span>
-              <span title={t("popup.daemonVersionHint")}>{daemonVersion}</span>
+              <span title={t("popup.extensionVersionHint")}>Ext {extensionVersion}</span>
             </div>
             <div className="flex min-w-0 items-center justify-end gap-1">
               <span className="shrink-0">{t("popup.instanceTitle")}</span>

apps/extension/src/lib/__tests__/capture-suppress-bridge.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, it, vi } from "vitest";
 import {
   CAPTURE_SUPPRESS,
   type CaptureSuppressMessage,
-  withOverlaysHiddenForCapture,
+  withExtensionOverlayHidden,
 } from "../capture-suppress-bridge";
 
 function recordingSendToTab(events: string[]) {
@@ -12,12 +12,12 @@ function recordingSendToTab(events: string[]) {
   });
 }
 
-describe("withOverlaysHiddenForCapture", () => {
+describe("withExtensionOverlayHidden", () => {
   it("sends begin → fn → end and returns fn's result", async () => {
     const events: string[] = [];
     const sendToTab = recordingSendToTab(events);
 
-    const result = await withOverlaysHiddenForCapture(
+    const result = await withExtensionOverlayHidden(
       7,
       async () => {
         events.push("capture");
@@ -37,7 +37,7 @@ describe("withOverlaysHiddenForCapture", () => {
     const sendToTab = recordingSendToTab(events);
 
     await expect(
-      withOverlaysHiddenForCapture(
+      withExtensionOverlayHidden(
         7,
         async () => {
           events.push("capture");
@@ -55,7 +55,7 @@ describe("withOverlaysHiddenForCapture", () => {
     });
     const fn = vi.fn(async () => "shot");
 
-    const result = await withOverlaysHiddenForCapture(7, fn, sendToTab);
+    const result = await withExtensionOverlayHidden(7, fn, sendToTab);
 
     expect(result).toBe("shot");
     expect(fn).toHaveBeenCalledTimes(1);
@@ -69,7 +69,7 @@ describe("withOverlaysHiddenForCapture", () => {
       return { type: CAPTURE_SUPPRESS, ok: true };
     });
 
-    const result = await withOverlaysHiddenForCapture(7, async () => "shot", sendToTab);
+    const result = await withExtensionOverlayHidden(7, async () => "shot", sendToTab);
 
     expect(result).toBe("shot");
     expect(sendToTab).toHaveBeenCalledTimes(2);

apps/extension/src/lib/__tests__/random-uuid.test.ts

@@ -0,0 +1,30 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { createRandomUuid } from "../random-uuid";
+
+describe("createRandomUuid", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it("uses crypto.randomUUID when it is available", () => {
+    const randomUUID = vi.fn(() => "00000000-0000-4000-8000-000000000000");
+    vi.stubGlobal("crypto", { randomUUID, getRandomValues: vi.fn() });
+
+    expect(createRandomUuid()).toBe("00000000-0000-4000-8000-000000000000");
+    expect(randomUUID).toHaveBeenCalledOnce();
+  });
+
+  it("falls back to getRandomValues and sets UUID v4 bits", () => {
+    const bytes = new Uint8Array(16).fill(0xff);
+    const getRandomValues = vi.fn((target: Uint8Array) => {
+      target.set(bytes);
+      return target;
+    });
+    vi.stubGlobal("crypto", { getRandomValues });
+
+    const uuid = createRandomUuid();
+
+    expect(uuid).toBe("ffffffff-ffff-4fff-bfff-ffffffffffff");
+    expect(getRandomValues).toHaveBeenCalledOnce();
+  });
+});

apps/extension/src/lib/capture-suppress-bridge.ts

@@ -1,9 +1,9 @@
 /**
- * Wire protocol and background-side helper for hiding the extension's
- * in-page overlay while a screenshot is captured, so captured frames only
- * contain the page itself.
+ * Wire protocol and background-side helper for temporarily excluding the
+ * extension's in-page overlay. Screenshots use it to avoid captured chrome;
+ * coordinate-driven native input uses it so Chrome hit-tests the page.
  *
- * The background wraps every capture in `withOverlaysHiddenForCapture`,
+ * The background wraps each bounded operation in `withExtensionOverlayHidden`,
  * which sends `begin` (the content script hides the overlay host and only
  * acks once the compositor has produced an overlay-free frame) and always
  * follows up with `end`, even when the capture throws. Tabs without the
@@ -46,7 +46,7 @@ const defaultSendToTab: CaptureSuppressSendToTab = (tabId, message) =>
  * (or any other `begin` failure) simply skips suppression — there is no
  * overlay to hide in that tab.
  */
-export async function withOverlaysHiddenForCapture<T>(
+export async function withExtensionOverlayHidden<T>(
   tabId: number,
   fn: () => Promise<T>,
   sendToTab: CaptureSuppressSendToTab = defaultSendToTab,

apps/extension/src/lib/overlay-bridge.ts

@@ -3,8 +3,10 @@
  * between the content-script control overlay and the background SW.
  *
  * Content script → background:
- *  - `{ kind: "overlay.ready" }` → background replies with the authoritative
- *      overlay state for the sender's window.
+ *  - `{ kind: "overlay.ready" }` → background decides the per-tab state first
+ *      (see overlayStateForTab) and pushes the authoritative overlay state for
+ *      that tab. It also proactively pushes on tab create and control-mode
+ *      change, so a tab usually receives state before it ever sends ready.
  *  - `{ kind: "overlay.interrupt", sessionId }` → background asks the
  *      daemon (via a `session.user_interrupt` WS event) to cancel
  *      every inflight + queued tool call for that session with

apps/extension/src/lib/random-uuid.ts

@@ -0,0 +1,26 @@
+/**
+ * Generate a UUID v4 in browser contexts where randomUUID() is unavailable.
+ *
+ * Crypto.randomUUID() is restricted to secure contexts, while
+ * crypto.getRandomValues() is available to content scripts on ordinary HTTP
+ * origins. BrowserSkill records many intranet pages served over HTTP, so the
+ * fallback is required for recording to work on those pages.
+ */
+export function createRandomUuid(): string {
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi.randomUUID === "function") return cryptoApi.randomUUID();
+
+  const bytes = new Uint8Array(16);
+  cryptoApi.getRandomValues(bytes);
+  bytes[6] = (bytes[6]! & 0x0f) | 0x40;
+  bytes[8] = (bytes[8]! & 0x3f) | 0x80;
+
+  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+  return [
+    hex.slice(0, 8),
+    hex.slice(8, 12),
+    hex.slice(12, 16),
+    hex.slice(16, 20),
+    hex.slice(20),
+  ].join("-");
+}

apps/extension/src/lib/recording/frame-coordinator.ts

@@ -1,3 +1,4 @@
+import { createRandomUuid } from "../random-uuid";
 import {
   isRecordFrameQueryMessage,
   RECORD_FRAME_PORT,
@@ -188,7 +189,7 @@ export class RecordFrameCoordinator {
     const recording = this.#recordings.get(requestId);
     if (!recording) return true;
     recording.finishing = true;
-    const commandId = crypto.randomUUID();
+    const commandId = createRandomUuid();
     const results = await Promise.all(
       [...recording.agents.values()].map((agent) => this.#stopAgent(agent, requestId, commandId)),
     );

apps/extension/src/session-manager/__tests__/disconnect-cleanup.test.ts

@@ -9,7 +9,7 @@ describe("disconnect session cleanup", () => {
     const manager = new SessionManager({
       agentWindow: {
         create: vi.fn(async () => nextWindowId++),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
         remove,
       },
     });
@@ -41,7 +41,7 @@ describe("disconnect session cleanup", () => {
     const manager = new SessionManager({
       agentWindow: {
         create: vi.fn(async () => 100),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
         remove: vi.fn(() => removeGate),
       },
     });

apps/extension/src/session-manager/__tests__/event-handler.test.ts

@@ -39,7 +39,7 @@ describe("attachSessionEventHandler", () => {
       agentWindow: {
         create: vi.fn(async () => 4242),
         remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     await manager.start("aa11");
@@ -73,7 +73,7 @@ describe("attachSessionEventHandler", () => {
       agentWindow: {
         create: vi.fn(async () => 4242),
         remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     const ctx = await manager.start("aa11");
@@ -87,6 +87,7 @@ describe("attachSessionEventHandler", () => {
       windowEvents: events.api,
     });
 
+    manager.forgetClosedTab(7, { isWindowClosing: true });
     events.emit(4242);
     for (let i = 0; i < 4; i += 1) await Promise.resolve();
 
@@ -113,7 +114,7 @@ describe("attachSessionEventHandler", () => {
       agentWindow: {
         create: vi.fn(async () => 1),
         remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     const transport = fakeTransport();
@@ -129,7 +130,7 @@ describe("attachSessionEventHandler", () => {
       agentWindow: {
         create: vi.fn(async () => 1),
         remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     const transport = fakeTransport();

apps/extension/src/session-manager/__tests__/manager.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it, vi } from "vitest";
 import type { AgentWindowApi, AgentWindowCreateOptions } from "../agent-window";
-import { SessionManager } from "../manager";
+import { isAgentControlledTab, SessionManager } from "../manager";
 
 function fakeAgentWindow(): AgentWindowApi & {
   createMock: ReturnType<typeof vi.fn>;
@@ -13,7 +13,7 @@ function fakeAgentWindow(): AgentWindowApi & {
     return id;
   });
   const removeMock = vi.fn(async (_id: number) => {});
-  const ensureActiveTabMock = vi.fn(async (_windowId: number, _url: string) => {});
+  const ensureActiveTabMock = vi.fn(async (_windowId: number, _url: string) => 0);
   return {
     create: createMock,
     remove: removeMock,
@@ -151,6 +151,76 @@ describe("SessionManager", () => {
     expect(sm.list()).toEqual([]);
   });
 
+  describe("explicit tab claims", () => {
+    it("claims the exact home tab returned by AgentWindowApi", async () => {
+      const sm = new SessionManager({ agentWindow: fakeAgentWindow() });
+      const ctx = await sm.start("aa11");
+      expect(ctx.agentCreatedTabs).toEqual(new Set([0]));
+      expect(isAgentControlledTab(ctx, 0)).toBe(true);
+    });
+
+    it("keeps every other tab free without classification state", async () => {
+      const sm = new SessionManager({ agentWindow: fakeAgentWindow() });
+      const ctx = await sm.start("aa11");
+      expect(isAgentControlledTab(ctx, 99)).toBe(false);
+      expect(ctx).not.toHaveProperty("userTabs");
+      expect(ctx).not.toHaveProperty("pendingAgentTabCount");
+    });
+
+    it("treats a committed borrow as an explicit claim", async () => {
+      const sm = new SessionManager({ agentWindow: fakeAgentWindow() });
+      const ctx = await sm.start("aa11");
+      const reservation = sm.tryReserveBorrow(42, ctx.sessionId);
+      if ("borrowedBy" in reservation) throw new Error("unexpected borrow conflict");
+      reservation.commit({ tabId: 42, originalWindowId: 7, originalIndex: 3 });
+      expect(isAgentControlledTab(ctx, 42)).toBe(true);
+    });
+
+    it("forgets an agent-created tab after Chrome removes it", async () => {
+      const sm = new SessionManager({ agentWindow: fakeAgentWindow() });
+      const ctx = await sm.start("aa11");
+      ctx.agentCreatedTabs.add(42);
+      sm.forgetClosedTab(42);
+      expect(ctx.agentCreatedTabs.has(42)).toBe(false);
+      expect(isAgentControlledTab(ctx, 0)).toBe(true);
+    });
+
+    it("forgets closed borrows idempotently without affecting other tabs or sessions", async () => {
+      const sm = new SessionManager({ agentWindow: fakeAgentWindow() });
+      const a = await sm.start("aa11");
+      const b = await sm.start("bb22");
+      a.borrowedTabs.set(42, { tabId: 42, originalWindowId: 7, originalIndex: 0 });
+      a.borrowedTabs.set(43, { tabId: 43, originalWindowId: 7, originalIndex: 1 });
+      b.borrowedTabs.set(44, { tabId: 44, originalWindowId: 8, originalIndex: 0 });
+
+      sm.forgetClosedTab(42);
+      sm.forgetClosedTab(42);
+      sm.forgetClosedTab(999);
+
+      expect(isAgentControlledTab(a, 42)).toBe(false);
+      expect(sm.findBorrowingSession(42, null)).toBeNull();
+      expect([...a.borrowedTabs.keys()]).toEqual([43]);
+      expect([...b.borrowedTabs.keys()]).toEqual([44]);
+      expect(sm.list()).toHaveLength(2);
+    });
+
+    it("prevents an in-flight borrow from reclaiming a closed tab", async () => {
+      const sm = new SessionManager({ agentWindow: fakeAgentWindow() });
+      const ctx = await sm.start("aa11");
+      const reservation = sm.tryReserveBorrow(42, ctx.sessionId);
+      if ("borrowedBy" in reservation) throw new Error("unexpected borrow conflict");
+
+      sm.forgetClosedTab(42);
+
+      expect(() =>
+        reservation.commit({ tabId: 42, originalWindowId: 7, originalIndex: 0 }),
+      ).toThrow(/reservation disappeared/);
+      reservation.release();
+      expect(sm.findBorrowingSession(42, null)).toBeNull();
+      expect(ctx.borrowedTabs.has(42)).toBe(false);
+    });
+  });
+
   describe("findBorrowingSession", () => {
     it("returns null when no session has borrowed the tab", async () => {
       const sm = new SessionManager({ agentWindow: fakeAgentWindow() });

apps/extension/src/session-manager/agent-window.ts

@@ -14,8 +14,11 @@ export interface AgentWindowApi {
    * Guarantee the Agent Window has an active, CDP-navigable tab.
    * `chrome://` pages (including the New Tab page) reject `Page.navigate`,
    * so sessions bootstrap with `about:blank` instead.
+   *
+   * Resolves with the id of the activated (or newly created) tab, so callers
+   * can track the session's home tab without re-querying Chrome.
    */
-  ensureActiveTab(windowId: number, url: string): Promise<void>;
+  ensureActiveTab(windowId: number, url: string): Promise<number>;
 }
 
 /** Creation hints for a new Agent Window. */
@@ -49,15 +52,19 @@ export const chromeAgentWindowApi: AgentWindowApi = {
     // cancellation success while the Agent Window remains open.
     await chrome.windows.remove(windowId);
   },
-  async ensureActiveTab(windowId: number, url: string): Promise<void> {
+  async ensureActiveTab(windowId: number, url: string): Promise<number> {
     const tabs = await chrome.tabs.query({ windowId });
     const first = tabs.find((t) => typeof t.id === "number");
-    if (first?.id) {
+    if (first?.id !== undefined) {
       if (!first.active) {
         await chrome.tabs.update(first.id, { active: true });
       }
-      return;
+      return first.id;
     }
-    await chrome.tabs.create({ windowId, url, active: true });
+    const created = await chrome.tabs.create({ windowId, url, active: true });
+    if (typeof created?.id !== "number") {
+      throw new Error("[bh] chrome.tabs.create returned no tab id");
+    }
+    return created.id;
   },
 };

apps/extension/src/session-manager/manager.ts

@@ -6,9 +6,20 @@ export interface SessionContext {
   agentWindowId: number;
   refStore: RefStore;
   borrowedTabs: Map<number, BorrowedTab>;
+  /**
+   * Tabs explicitly claimed by the agent because it created them. This
+   * includes the Agent Window's home tab and tabs created by `tool.tab_create`.
+   * Tabs opened through Chrome UI never enter this set.
+   */
+  agentCreatedTabs: Set<number>;
   createdAtMs: number;
 }
 
+/** Whether this session has explicitly claimed control of `tabId`. */
+export function isAgentControlledTab(ctx: SessionContext, tabId: number): boolean {
+  return ctx.agentCreatedTabs.has(tabId) || ctx.borrowedTabs.has(tabId);
+}
+
 export interface BorrowedTab {
   tabId: number;
   originalWindowId: number;
@@ -106,6 +117,19 @@ export class SessionManager {
     return Array.from(this.sessions.values());
   }
 
+  /**
+   * Forget a tab Chrome has removed, including any uncommitted borrow.
+   * Whole-window closures keep committed borrows until the window-removed
+   * handler reports which user tabs could not be returned.
+   */
+  forgetClosedTab(tabId: number, { isWindowClosing = false } = {}): void {
+    this.borrowReservations.delete(tabId);
+    for (const ctx of this.sessions.values()) {
+      ctx.agentCreatedTabs.delete(tabId);
+      if (!isWindowClosing) ctx.borrowedTabs.delete(tabId);
+    }
+  }
+
   /**
    * Look up whether `tabId` is currently borrowed by some *other*
    * session than the one calling. Used by M8 `tab_borrow` to refuse
@@ -179,7 +203,7 @@ export class SessionManager {
       const { signal: _signal, ...createOptions } = opts;
       windowId = await this.agentWindow.create(AGENT_WINDOW_HOME, createOptions);
       throwIfSessionStartAborted(opts.signal);
-      await this.agentWindow.ensureActiveTab(windowId, AGENT_WINDOW_HOME);
+      const homeTabId = await this.agentWindow.ensureActiveTab(windowId, AGENT_WINDOW_HOME);
       throwIfSessionStartAborted(opts.signal);
 
       const ctx: SessionContext = {
@@ -187,6 +211,10 @@ export class SessionManager {
         agentWindowId: windowId,
         refStore: new RefStore(),
         borrowedTabs: new Map(),
+        // The home tab is the session's first explicit claim. Every other
+        // tab remains free until `tab_create` or `tab_borrow` identifies it
+        // by its concrete Chrome tab id.
+        agentCreatedTabs: new Set([homeTabId]),
         createdAtMs: this.now(),
       };
       this.sessions.set(sessionId, ctx);

apps/extension/src/tools/__tests__/console.test.ts

@@ -13,7 +13,7 @@ function fakeAgentWindow(ids: number[]) {
       return id;
     }),
     remove: vi.fn(async () => {}),
-    ensureActiveTab: vi.fn(async () => {}),
+    ensureActiveTab: vi.fn(async () => 1),
   };
 }
 

apps/extension/src/tools/__tests__/dispatcher.test.ts

@@ -55,7 +55,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(async () => 4242),
         remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     await sessions.start("aa11");
@@ -117,7 +117,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(async () => 4242),
         remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -140,7 +140,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create,
         remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -158,7 +158,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(async () => 4242),
         remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     await sessions.start("aa11");
@@ -172,6 +172,47 @@ describe("ToolDispatcher", () => {
     expect(sent[0]).toEqual({ id: "r-1", result: {} });
   });
 
+  it("wires the production tab APIs into tool.session_stop so a surviving user tab releases the window", async () => {
+    // Regression guard for the deps that session_stop reads directly: when
+    // `tabManagement.tabs` / `tabsQuery` are not injected by the dispatcher,
+    // the agent-tab cleanup and the release decision silently no-op and the
+    // Agent Window is closed even though a user tab is still open (issue #57).
+    const removeTab = vi.fn(async () => {});
+    const closeWindow = vi.fn(async () => {});
+    // After cleanup the window still holds one tab (id 99) that is neither
+    // the home tab nor an agent-created tab — i.e. a genuine user tab.
+    vi.stubGlobal("chrome", {
+      tabs: {
+        remove: removeTab,
+        query: vi.fn(async () => [{ id: 99, windowId: 4242, active: true }]),
+      },
+    });
+    const { transport, sent, deliver } = fakeTransport();
+    const sessions = new SessionManager({
+      agentWindow: {
+        create: vi.fn(async () => 4242),
+        remove: closeWindow,
+        ensureActiveTab: vi.fn(async () => 1),
+      },
+    });
+    await sessions.start("aa11");
+    // Register the exact tab id returned by the agent's creation path.
+    sessions.get("aa11")?.agentCreatedTabs.add(7);
+
+    const dispatcher = new ToolDispatcher({ transport, sessions });
+    dispatcher.start();
+
+    deliver(makeRequest("tool.session_stop", { session_id: "aa11" }));
+    await flushMicrotasks();
+
+    // The agent tab is closed through the real chrome.tabs surface...
+    expect(removeTab).toHaveBeenCalledWith(7);
+    // ...and the window is released rather than closed, so the user's tab survives.
+    expect(closeWindow).not.toHaveBeenCalled();
+    expect(sessions.has("aa11")).toBe(false);
+    expect(sent[0]).toEqual({ id: "r-1", result: { window_released: true } });
+  });
+
   it("routes tool.console through the CDP console buffer", async () => {
     vi.stubGlobal("chrome", {
       tabs: {
@@ -183,7 +224,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(async () => 4242),
         remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     await sessions.start("aa11");
@@ -246,7 +287,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(async () => 4242),
         remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     const ctx = await sessions.start("aa11");
@@ -339,7 +380,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(async () => 4242),
         remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     await sessions.start("aa11");
@@ -375,7 +416,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(async () => 4242),
         remove,
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     await sessions.start("aa11");
@@ -423,7 +464,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(async () => 1),
         remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -443,7 +484,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(async () => 1),
         remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -467,7 +508,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(async () => 1),
         remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -484,7 +525,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(async () => 1),
         remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -501,7 +542,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(async () => 1),
         remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     const onSessionsChanged = vi.fn();
@@ -518,16 +559,32 @@ describe("ToolDispatcher", () => {
   });
 
   it("invokes onBrowserControlResumed for browser-control tools but not passive reads", async () => {
+    vi.stubGlobal("chrome", {
+      tabs: {
+        create: vi.fn(async (props: chrome.tabs.CreateProperties) => ({
+          id: 7,
+          windowId: props.windowId,
+          url: props.url,
+          active: props.active,
+        })),
+      },
+    });
     const { transport, sent, deliver } = fakeTransport();
     const sessions = new SessionManager({
       agentWindow: {
         create: vi.fn(async () => 1),
         remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     const onBrowserControlResumed = vi.fn();
-    const dispatcher = new ToolDispatcher({ transport, sessions, onBrowserControlResumed });
+    const onAgentTabClaimed = vi.fn();
+    const dispatcher = new ToolDispatcher({
+      transport,
+      sessions,
+      onBrowserControlResumed,
+      onAgentTabClaimed,
+    });
     dispatcher.start();
 
     deliver(makeRequest("tool.session_start", { session_id: "aa11" }));
@@ -544,6 +601,7 @@ describe("ToolDispatcher", () => {
     });
     await flushMicrotasks();
     expect(onBrowserControlResumed).toHaveBeenCalledWith("aa11");
+    expect(onAgentTabClaimed).toHaveBeenCalledWith(7, 1);
   });
 
   it("reasserts remembered hover before follow-up work and releases only after actions", async () => {
@@ -557,7 +615,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(async () => 1),
         remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     const order: string[] = [];
@@ -639,7 +697,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(async () => 1),
         remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     const cdp = {
@@ -700,7 +758,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(async () => 1),
         remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -737,7 +795,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(async () => 4242),
         remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     await sessions.start("aa11");
@@ -789,7 +847,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(async () => 1),
         remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -823,7 +881,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(async () => 4242),
         remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     transport.send = () => {
@@ -845,7 +903,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(async () => 5555),
         remove,
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     transport.send = () => {
@@ -873,7 +931,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(() => createPromise),
         remove: vi.fn(async () => {}),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -924,7 +982,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(async () => 1),
         remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     const dispatcher = new ToolDispatcher({ transport, sessions });
@@ -945,7 +1003,7 @@ describe("ToolDispatcher", () => {
       agentWindow: {
         create: vi.fn(() => createPromise),
         remove: vi.fn(),
-        ensureActiveTab: vi.fn(async () => {}),
+        ensureActiveTab: vi.fn(async () => 1),
       },
     });
     const dispatcher = new ToolDispatcher({ transport, sessions });

apps/extension/src/tools/__tests__/emulate.test.ts

@@ -20,7 +20,7 @@ function fakeAgentWindow(ids: number[]) {
       return id;
     }),
     remove: vi.fn(async () => {}),
-    ensureActiveTab: vi.fn(async () => {}),
+    ensureActiveTab: vi.fn(async () => 1),
   };
 }
 

apps/extension/src/tools/__tests__/evaluate.test.ts

@@ -12,7 +12,7 @@ function fakeAgentWindow(ids: number[]) {
       return id;
     }),
     remove: vi.fn(async () => {}),
-    ensureActiveTab: vi.fn(async () => {}),
+    ensureActiveTab: vi.fn(async () => 1),
   };
 }
 

apps/extension/src/tools/__tests__/file-transfer.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it, vi } from "vitest";
 import { SessionManager } from "@/session-manager/manager";
 import { type DownloadsApi, handleDownload } from "../download";
 import { captureBrowserDownload } from "../download-capture";
+import { uploadThroughFileDrop } from "../file-drop-transaction";
 import { uploadThroughActivatedFileInput } from "../file-input-transaction";
 import type { ResolvedActionTarget } from "../interaction";
 import type { CdpRunner } from "../shared";
@@ -12,7 +13,7 @@ function sessions() {
     agentWindow: {
       create: vi.fn(async () => 100),
       remove: vi.fn(async () => {}),
-      ensureActiveTab: vi.fn(async () => {}),
+      ensureActiveTab: vi.fn(async () => 1),
     },
   });
 }
@@ -37,16 +38,20 @@ function fakeEvent<T extends (...args: never[]) => unknown>() {
   };
 }
 
-function actionTarget(frameId?: string): ResolvedActionTarget {
+function actionTarget(frameId?: string, sessionId?: string): ResolvedActionTarget {
   return {
     tab: { tabId: 4, windowId: 100, active: true },
     backendNodeId: 123,
-    cdpTarget: { tabId: 4 },
+    cdpTarget: { tabId: 4, ...(sessionId ? { sessionId } : {}) },
     ...(frameId ? { frameId } : {}),
     usedRef: "e3",
   };
 }
 
+function withoutOverlay<T>(operation: () => Promise<T>): Promise<T> {
+  return operation();
+}
+
 function uploadCdp(
   options: {
     inputCount?: number;
@@ -59,6 +64,7 @@ function uploadCdp(
   let cdpEvent: Parameters<NonNullable<CdpRunner["onEvent"]>>[0] | undefined;
   const send = vi.fn(async (_tabId: number, method: string, params?: object) => {
     calls.push({ method, params });
+    if (method === "DOM.scrollIntoViewIfNeeded") return {};
     if (method === "Page.setInterceptFileChooserDialog") return {};
     if (method === "Page.getLayoutMetrics")
       return { cssLayoutViewport: { clientWidth: 1280, clientHeight: 720 } };
@@ -110,6 +116,50 @@ function uploadCdp(
   };
 }
 
+function dropCdp(
+  options: {
+    targetContainsPoint?: boolean;
+    dispatchError?: (type: string) => Error | Promise<never> | undefined;
+    onCall?: (method: string) => void;
+  } = {},
+) {
+  const calls: Array<{ method: string; params?: object }> = [];
+  const detach = vi.fn(async () => {});
+  const send = vi.fn(async (_tabId: number, method: string, params?: object) => {
+    calls.push({ method, params });
+    options.onCall?.(method);
+    if (method === "DOM.scrollIntoViewIfNeeded") return {};
+    if (method === "Page.getLayoutMetrics") {
+      return { cssLayoutViewport: { clientWidth: 1280, clientHeight: 720 } };
+    }
+    if (method === "DOM.getContentQuads") {
+      return { quads: [[10, 20, 210, 20, 210, 120, 10, 120]] };
+    }
+    if (method === "DOM.getNodeForLocation") return { backendNodeId: 124 };
+    if (method === "DOM.resolveNode") {
+      const id = (params as { backendNodeId?: number }).backendNodeId;
+      return { object: { objectId: id === 123 ? "drop-target" : "hit-target" } };
+    }
+    if (method === "Runtime.callFunctionOn") {
+      return { result: { value: options.targetContainsPoint ?? true } };
+    }
+    if (method === "Input.dispatchDragEvent") {
+      const type = (params as { type?: string }).type ?? "";
+      const error = options.dispatchError?.(type);
+      if (error instanceof Promise) return error;
+      if (error) throw error;
+      return {};
+    }
+    if (method === "Runtime.releaseObjectGroup") return {};
+    throw new Error(`unexpected drop CDP command ${method}`);
+  });
+  const cdp: CdpRunner = {
+    send: send as unknown as CdpRunner["send"],
+    detach,
+  };
+  return { calls, cdp, detach };
+}
+
 describe("file transfer tools", () => {
   it("captures the file input activated by the requested click and injects only staged paths", async () => {
     const manager = sessions();
@@ -246,104 +296,6 @@ describe("file transfer tools", () => {
     });
   });
 
-  it("does not dispatch browser work when upload is already cancelled", async () => {
-    const controller = new AbortController();
-    controller.abort();
-    const { cdp, calls } = uploadCdp();
-
-    const result = await uploadThroughActivatedFileInput({
-      cdp,
-      actionTarget: actionTarget(),
-      files: ["/private/stage/one"],
-      timeoutMs: 100,
-      signal: controller.signal,
-      trigger: vi.fn(),
-    });
-
-    expect(result).toMatchObject({
-      code: "cancelled",
-      data: { effect_state: "none", phase: "arm_interception" },
-    });
-    expect(calls).not.toContainEqual({
-      method: "Page.setInterceptFileChooserDialog",
-      params: { enabled: true },
-    });
-    expect(calls.some((call) => call.method === "DOM.setFileInputFiles")).toBe(false);
-  });
-
-  it("stops before file assignment when cancellation interrupts input resolution", async () => {
-    const controller = new AbortController();
-    const fixture = uploadCdp();
-    const originalSend = fixture.cdp.send;
-    let markProbeStarted!: () => void;
-    const probeStarted = new Promise<void>((resolve) => {
-      markProbeStarted = resolve;
-    });
-    fixture.cdp.send = vi.fn((tabId: number, method: string, params?: object) => {
-      const declaration = (params as { functionDeclaration?: string } | undefined)
-        ?.functionDeclaration;
-      if (
-        method === "Runtime.callFunctionOn" &&
-        declaration?.includes("count: state.inputs.length")
-      ) {
-        markProbeStarted();
-        return new Promise<never>(() => {});
-      }
-      return originalSend(tabId, method, params);
-    }) as CdpRunner["send"];
-
-    const transaction = uploadThroughActivatedFileInput({
-      cdp: fixture.cdp,
-      actionTarget: actionTarget(),
-      files: ["/private/stage/one"],
-      timeoutMs: 1_000,
-      signal: controller.signal,
-      trigger: async () => ({ tab_id: 4, x: 10, y: 10 }),
-    });
-    await probeStarted;
-    controller.abort();
-    const result = await transaction;
-
-    expect(result).toMatchObject({
-      code: "cancelled",
-      data: { effect_state: "none", phase: "resolve_input" },
-    });
-    expect(fixture.calls.some((call) => call.method === "DOM.setFileInputFiles")).toBe(false);
-  });
-
-  it("disarms chooser interception when its enable response times out", async () => {
-    const calls: Array<{ method: string; params?: object }> = [];
-    const cdp: CdpRunner = {
-      send: vi.fn(async (_tabId: number, method: string, params?: object) => {
-        calls.push({ method, params });
-        if (
-          method === "Page.setInterceptFileChooserDialog" &&
-          (params as { enabled?: boolean }).enabled
-        ) {
-          return new Promise<never>(() => {});
-        }
-        return {};
-      }) as CdpRunner["send"],
-    };
-
-    const result = await uploadThroughActivatedFileInput({
-      cdp,
-      actionTarget: actionTarget(),
-      files: ["/private/stage/one"],
-      timeoutMs: 5,
-      trigger: vi.fn(),
-    });
-
-    expect(result).toMatchObject({
-      code: "timeout",
-      data: { effect_state: "none", phase: "arm_interception" },
-    });
-    expect(calls).toContainEqual({
-      method: "Page.setInterceptFileChooserDialog",
-      params: { enabled: false, cancel: true },
-    });
-  });
-
   it("marks a timed-out file assignment unknown and detaches browser state", async () => {
     const fixture = uploadCdp();
     const originalSend = fixture.cdp.send;
@@ -369,6 +321,236 @@ describe("file transfer tools", () => {
     expect(detach).toHaveBeenCalledWith(4);
   });
 
+  it("delivers staged files through one explicit native drop without clicking", async () => {
+    const manager = sessions();
+    const ctx = await manager.start("s1");
+    ctx.refStore.set("e3", 123, { tabId: 4 });
+    const lifecycle: string[] = [];
+    const { cdp, calls } = dropCdp({ onCall: (method) => lifecycle.push(method) });
+    const overlayPhases: string[] = [];
+
+    const result = await handleUpload(
+      manager,
+      {
+        session_id: "s1",
+        ref: "@e3",
+        mode: "drop",
+        files: [{ transfer_id: "tr_1", name: "one.png", staged_path: "/stage/one.png" }],
+      },
+      {
+        cdp,
+        tabsApi: tabsApi(),
+        sendToTab: vi.fn(async (_tabId, message) => {
+          overlayPhases.push(message.phase);
+          lifecycle.push(`overlay:${message.phase}`);
+        }),
+      },
+    );
+
+    expect(result).toMatchObject({ tab_id: 4, used_ref: "e3", file_names: ["one.png"] });
+    expect(calls.filter((call) => call.method === "Input.dispatchDragEvent")).toEqual([
+      {
+        method: "Input.dispatchDragEvent",
+        params: {
+          type: "dragEnter",
+          x: 110,
+          y: 70,
+          data: { items: [], files: ["/stage/one.png"], dragOperationsMask: 1 },
+        },
+      },
+      {
+        method: "Input.dispatchDragEvent",
+        params: {
+          type: "dragOver",
+          x: 110,
+          y: 70,
+          data: { items: [], files: ["/stage/one.png"], dragOperationsMask: 1 },
+        },
+      },
+      {
+        method: "Input.dispatchDragEvent",
+        params: {
+          type: "drop",
+          x: 110,
+          y: 70,
+          data: { items: [], files: ["/stage/one.png"], dragOperationsMask: 1 },
+        },
+      },
+    ]);
+    expect(calls.some((call) => call.method === "Input.dispatchMouseEvent")).toBe(false);
+    expect(overlayPhases).toEqual(["begin", "end"]);
+    expect(lifecycle.indexOf("DOM.getContentQuads")).toBeLessThan(
+      lifecycle.indexOf("overlay:begin"),
+    );
+    expect(lifecycle.indexOf("overlay:begin")).toBeLessThan(
+      lifecycle.indexOf("DOM.getNodeForLocation"),
+    );
+    expect(lifecycle.lastIndexOf("Input.dispatchDragEvent")).toBeLessThan(
+      lifecycle.indexOf("overlay:end"),
+    );
+    expect(lifecycle.indexOf("overlay:end")).toBeLessThan(
+      lifecycle.indexOf("Runtime.releaseObjectGroup"),
+    );
+  });
+
+  it("fails closed before dragging when another element owns the action point", async () => {
+    const { cdp, calls } = dropCdp({ targetContainsPoint: false });
+    const result = await uploadThroughFileDrop({
+      cdp,
+      actionTarget: actionTarget(),
+      files: ["/stage/one.png"],
+      timeoutMs: 100,
+      withOverlayHidden: withoutOverlay,
+    });
+
+    expect(result).toMatchObject({
+      code: "permission_denied",
+      data: {
+        reason: "file_drop_target_unavailable",
+        mechanism: "drop",
+        effect_state: "none",
+        phase: "resolve_target",
+      },
+    });
+    expect(calls.some((call) => call.method === "Input.dispatchDragEvent")).toBe(false);
+  });
+
+  it("dispatches an OOPIF file drop in the child target's local coordinates", async () => {
+    const rootCalls: Array<{ method: string; params?: object }> = [];
+    const childCalls: Array<{ method: string; params?: object }> = [];
+    const cdp: CdpRunner = {
+      send: vi.fn(async (_tabId, method, params) => {
+        rootCalls.push({ method, params });
+        if (method === "DOM.scrollIntoViewIfNeeded") return {};
+        if (method === "DOM.getBoxModel") {
+          return { model: { content: [100, 100, 300, 100, 300, 200, 100, 200] } };
+        }
+        if (method === "Page.getLayoutMetrics") {
+          return { cssLayoutViewport: { clientWidth: 800, clientHeight: 600 } };
+        }
+        throw new Error(`unexpected root command ${method}`);
+      }) as CdpRunner["send"],
+      sendToTarget: vi.fn(async (_target, method, params) => {
+        childCalls.push({ method, params });
+        if (method === "DOM.scrollIntoViewIfNeeded") return {};
+        if (method === "DOM.getContentQuads") {
+          return { quads: [[10, 20, 210, 20, 210, 120, 10, 120]] };
+        }
+        if (method === "Page.getLayoutMetrics") {
+          return { cssLayoutViewport: { clientWidth: 400, clientHeight: 300 } };
+        }
+        if (method === "DOM.getNodeForLocation") {
+          return { backendNodeId: 124, frameId: "child" };
+        }
+        if (method === "DOM.resolveNode") {
+          const id = (params as { backendNodeId?: number }).backendNodeId;
+          return { object: { objectId: id === 123 ? "drop-target" : "hit-target" } };
+        }
+        if (method === "Runtime.callFunctionOn") return { result: { value: true } };
+        if (method === "Input.dispatchDragEvent" || method === "Runtime.releaseObjectGroup") {
+          return {};
+        }
+        throw new Error(`unexpected child command ${method}`);
+      }) as CdpRunner["sendToTarget"],
+      getFrameGraph: vi.fn(async () => ({
+        rootFrameId: "main",
+        frames: [
+          { frameId: "main", target: { tabId: 4 } },
+          {
+            frameId: "child",
+            parentFrameId: "main",
+            ownerBackendNodeId: 10,
+            target: { tabId: 4, sessionId: "child-session" },
+          },
+        ],
+      })),
+    };
+
+    const result = await uploadThroughFileDrop({
+      cdp,
+      actionTarget: actionTarget("child", "child-session"),
+      files: ["/stage/one.png"],
+      timeoutMs: 100,
+      withOverlayHidden: withoutOverlay,
+    });
+
+    expect(result).toMatchObject({ x: 110, y: 70 });
+    expect(
+      childCalls
+        .filter((call) => call.method === "Input.dispatchDragEvent")
+        .map((call) => call.params),
+    ).toEqual([
+      expect.objectContaining({ type: "dragEnter", x: 110, y: 70 }),
+      expect.objectContaining({ type: "dragOver", x: 110, y: 70 }),
+      expect.objectContaining({ type: "drop", x: 110, y: 70 }),
+    ]);
+    expect(rootCalls.some((call) => call.method === "Input.dispatchDragEvent")).toBe(false);
+  });
+
+  it("reports a missing native drag command as unsupported before commit", async () => {
+    const { cdp } = dropCdp({
+      dispatchError: (type) =>
+        type === "dragEnter" ? new Error("'Input.dispatchDragEvent' wasn't found") : undefined,
+    });
+    const result = await uploadThroughFileDrop({
+      cdp,
+      actionTarget: actionTarget(),
+      files: ["/stage/one.png"],
+      timeoutMs: 100,
+      withOverlayHidden: withoutOverlay,
+    });
+
+    expect(result).toMatchObject({
+      code: "unsupported",
+      data: {
+        reason: "upload_mechanism_unsupported",
+        effect_state: "none",
+        phase: "drag_enter",
+      },
+    });
+  });
+
+  it("cancels an unresolved drag before returning a pre-commit timeout", async () => {
+    const { cdp, calls } = dropCdp({
+      dispatchError: (type) => (type === "dragEnter" ? new Promise<never>(() => {}) : undefined),
+    });
+    const result = await uploadThroughFileDrop({
+      cdp,
+      actionTarget: actionTarget(),
+      files: ["/stage/one.png"],
+      timeoutMs: 10,
+      withOverlayHidden: withoutOverlay,
+    });
+
+    expect(result).toMatchObject({
+      code: "timeout",
+      data: { reason: "file_drop_failed", effect_state: "none", phase: "drag_enter" },
+    });
+    expect(calls).toContainEqual({
+      method: "Input.dispatchDragEvent",
+      params: expect.objectContaining({ type: "dragCancel" }),
+    });
+  });
+
+  it("marks an unresolved drop unknown and detaches browser state", async () => {
+    const { cdp, detach } = dropCdp({
+      dispatchError: (type) => (type === "drop" ? new Promise<never>(() => {}) : undefined),
+    });
+    const result = await uploadThroughFileDrop({
+      cdp,
+      actionTarget: actionTarget(),
+      files: ["/stage/one.png"],
+      timeoutMs: 10,
+      withOverlayHidden: withoutOverlay,
+    });
+
+    expect(result).toMatchObject({
+      code: "timeout",
+      data: { reason: "file_drop_failed", effect_state: "unknown", phase: "drop" },
+    });
+    expect(detach).toHaveBeenCalledWith(4);
+  });
+
   it("routes one exact-target download through a browser-relative capability", async () => {
     const manager = sessions();
     const ctx = await manager.start("s1");
@@ -665,10 +847,7 @@ describe("file transfer tools", () => {
     expect(downloads.cancel).not.toHaveBeenCalled();
   });
 
-  it.each([
-    ["cancel resolves", false],
-    ["cancel reports that completion won", true],
-  ])("reconciles a download that completes while %s", async (_label, cancelThrows) => {
+  it("reconciles a download that completes while cancellation is being requested", async () => {
     const onCreated = fakeEvent<(item: chrome.downloads.DownloadItem) => void>();
     const onChanged = fakeEvent<(delta: chrome.downloads.DownloadDelta) => void>();
     const onDeterminingFilename =
@@ -702,7 +881,7 @@ describe("file transfer tools", () => {
       onDeterminingFilename,
       search: vi.fn().mockResolvedValueOnce([initial]).mockResolvedValueOnce([complete]),
       cancel: vi.fn(async () => {
-        if (cancelThrows) throw new Error("download already complete");
+        throw new Error("download already complete");
       }),
       removeFile: vi.fn(async () => {}),
     };

apps/extension/src/tools/__tests__/frame-geometry.test.ts

@@ -169,6 +169,7 @@ describe("frame geometry projection", () => {
     expect(geometry).toMatchObject({
       topBounds: { x: 100, y: 100, width: 200, height: 100 },
       actionPoint: { x: 200, y: 150 },
+      targetActionPoint: { x: 100, y: 50 },
     });
   });
 
@@ -261,6 +262,7 @@ describe("frame geometry projection", () => {
     expect(geometry).toMatchObject({
       topBounds: { x: 100, y: 100, width: 200, height: 100 },
       actionPoint: { x: 200, y: 150 },
+      targetActionPoint: { x: 200, y: 150 },
     });
   });
 

apps/extension/src/tools/__tests__/interaction.test.ts

@@ -21,7 +21,7 @@ function fakeAgentWindow(ids: number[]) {
       return id;
     }),
     remove: vi.fn(async () => {}),
-    ensureActiveTab: vi.fn(async () => {}),
+    ensureActiveTab: vi.fn(async () => 1),
   };
 }
 

apps/extension/src/tools/__tests__/navigation.test.ts

@@ -21,7 +21,7 @@ function fakeAgentWindow(ids: number[]) {
       return id;
     }),
     remove: vi.fn(async () => {}),
-    ensureActiveTab: vi.fn(async () => {}),
+    ensureActiveTab: vi.fn(async () => 1),
   };
 }
 

apps/extension/src/tools/__tests__/network.test.ts

@@ -12,7 +12,7 @@ function fakeAgentWindow(ids: number[]) {
       return id;
     }),
     remove: vi.fn(async () => {}),
-    ensureActiveTab: vi.fn(async () => {}),
+    ensureActiveTab: vi.fn(async () => 1),
   };
 }
 

apps/extension/src/tools/__tests__/observation.test.ts

@@ -28,7 +28,7 @@ function fakeAgentWindow(ids: number[]) {
       return id;
     }),
     remove: vi.fn(async () => {}),
-    ensureActiveTab: vi.fn(async () => {}),
+    ensureActiveTab: vi.fn(async () => 1),
   };
 }
 

apps/extension/src/tools/__tests__/session.test.ts

@@ -1,8 +1,26 @@
 import { describe, expect, it, vi } from "vitest";
 import { SessionManager } from "@/session-manager/manager";
 import { handleSessionStop } from "../session";
+import type { ChromeTabsApi } from "../shared";
 import { type AgentOverlayResetApi, type ChromeWindowsApi, type TabMutationApi } from "../tabs";
 
+/** Build a read-only query api over a FakeState. */
+function makeQuery(state: FakeState): ChromeTabsApi {
+  return {
+    get: vi.fn(async (id) => {
+      const t = state.tabs.get(id);
+      if (!t) throw new Error(`tab ${id} not found`);
+      return t;
+    }),
+    query: vi.fn(async (q: chrome.tabs.QueryInfo) => {
+      const w = q.windowId;
+      return Array.from(state.tabs.values()).filter(
+        (t) => typeof w !== "number" || t.windowId === w,
+      );
+    }),
+  };
+}
+
 function fakeAgentWindow(ids: number[]) {
   let i = 0;
   const create = vi.fn(async () => {
@@ -11,7 +29,7 @@ function fakeAgentWindow(ids: number[]) {
     return id;
   });
   const remove = vi.fn(async () => {});
-  const ensureActiveTab = vi.fn(async () => {});
+  const ensureActiveTab = vi.fn(async () => 0);
   return { create, remove, ensureActiveTab };
 }
 
@@ -30,7 +48,9 @@ function makeApis(
 } {
   const tabs: TabMutationApi = {
     create: vi.fn(),
-    remove: vi.fn(async () => {}),
+    remove: vi.fn(async (id: number) => {
+      state.tabs.delete(id);
+    }),
     update: vi.fn(async (_id, _p) => undefined),
     get: vi.fn(async (id) => {
       const t = state.tabs.get(id);
@@ -267,4 +287,275 @@ describe("handleSessionStop with auto-return", () => {
     await handleSessionStop(sm, { session_id: "aa11" }, { tabManagement: { tabs, windows } });
     expect(ctx.refStore.isEmpty()).toBe(true);
   });
+
+  it.each([
+    "before teardown",
+    "during its return",
+    "after its return failed",
+    "before its turn in the return loop",
+  ])("finishes stopping when a borrowed tab closes %s", async (timing) => {
+    const aw = fakeAgentWindow([100]);
+    const sm = new SessionManager({ agentWindow: aw });
+    const ctx = await sm.start("aa11");
+    ctx.borrowedTabs.set(1, { tabId: 1, originalWindowId: 200, originalIndex: 0 });
+    ctx.borrowedTabs.set(2, { tabId: 2, originalWindowId: 200, originalIndex: 1 });
+    const state: FakeState = {
+      tabs: new Map([
+        [1, { id: 1, windowId: 100 } as chrome.tabs.Tab],
+        [2, { id: 2, windowId: 100 } as chrome.tabs.Tab],
+      ]),
+      windowsClosed: new Set(),
+      moves: [],
+    };
+    const { tabs, windows } = makeApis(state);
+    const cdp = { detachSession: vi.fn(async () => {}) };
+    const closeTab = (tabId: number) => {
+      state.tabs.delete(tabId);
+      sm.forgetClosedTab(tabId);
+    };
+    const baseMove = tabs.move;
+    tabs.move = vi.fn(async (tabId, props) => {
+      if (tabId === 1 && timing === "during its return") closeTab(1);
+      if (tabId === 1 && timing === "after its return failed") {
+        throw new Error("simulated move failure");
+      }
+      if (tabId === 2 && timing === "after its return failed") closeTab(1);
+      if (tabId === 1 && timing === "before its turn in the return loop") closeTab(2);
+      if (!state.tabs.has(tabId)) throw new Error(`tab ${tabId} not found`);
+      return baseMove(tabId, props);
+    });
+    if (timing === "before teardown") closeTab(1);
+
+    const res = await handleSessionStop(
+      sm,
+      { session_id: "aa11" },
+      {
+        cdp,
+        tabManagement: {
+          tabs,
+          windows,
+          agentOverlayReset: { resetAgentOverlays: vi.fn(async () => {}) },
+        },
+        tabsQuery: makeQuery(state),
+      },
+    );
+
+    if ("code" in res) throw new Error(`unexpected error: ${JSON.stringify(res)}`);
+    const closedTabId = timing === "before its turn in the return loop" ? 2 : 1;
+    expect(res.returned_tab_ids).toEqual([closedTabId === 1 ? 2 : 1]);
+    expect(res.return_failures).toBeUndefined();
+    expect(ctx.borrowedTabs.size).toBe(0);
+    expect(sm.has("aa11")).toBe(false);
+    expect(cdp.detachSession).toHaveBeenCalledWith("aa11");
+    expect(aw.remove).toHaveBeenCalledWith(100);
+    if (timing === "before teardown" || timing === "before its turn in the return loop") {
+      expect(tabs.move).not.toHaveBeenCalledWith(closedTabId, expect.anything());
+    }
+  });
+});
+
+describe("handleSessionStop window release (issue #57)", () => {
+  const agentWindowId = 100;
+
+  it("releases the window when user-created tabs remain", async () => {
+    const aw = fakeAgentWindow([agentWindowId]);
+    // ensureActiveTab returns the home tab id (10). We override the fake to
+    // return a known id.
+    aw.ensureActiveTab = vi.fn(async () => 10);
+    const sm = new SessionManager({ agentWindow: aw });
+    const ctx = await sm.start("aa11");
+    ctx.agentCreatedTabs.add(11);
+    ctx.agentCreatedTabs.add(12);
+    // user tab 99 (created via Chrome UI, NOT in agentCreatedTabs)
+    const state: FakeState = {
+      tabs: new Map([
+        [10, { id: 10, windowId: agentWindowId } as chrome.tabs.Tab],
+        [11, { id: 11, windowId: agentWindowId } as chrome.tabs.Tab],
+        [12, { id: 12, windowId: agentWindowId } as chrome.tabs.Tab],
+        [99, { id: 99, windowId: agentWindowId } as chrome.tabs.Tab],
+      ]),
+      windowsClosed: new Set(),
+      moves: [],
+    };
+    const { tabs, windows } = makeApis(state);
+    const query = makeQuery(state);
+
+    const res = await handleSessionStop(
+      sm,
+      { session_id: "aa11" },
+      { tabManagement: { tabs, windows }, tabsQuery: query },
+    );
+    if ("code" in res) throw new Error(`unexpected error: ${JSON.stringify(res)}`);
+    expect(res.window_released).toBe(true);
+    // agent tabs + home removed, user tab 99 kept
+    expect((tabs.remove as ReturnType<typeof vi.fn>).mock.calls.map((c) => c[0]).sort()).toEqual([
+      10, 11, 12,
+    ]);
+    expect(state.tabs.has(99)).toBe(true);
+    // window released (dropOnly), not closed
+    expect(aw.remove).not.toHaveBeenCalled();
+    expect(sm.has("aa11")).toBe(false);
+  });
+
+  it("closes the window (not release) when no user tabs remain", async () => {
+    const aw = fakeAgentWindow([agentWindowId]);
+    aw.ensureActiveTab = vi.fn(async () => 10);
+    const sm = new SessionManager({ agentWindow: aw });
+    const ctx = await sm.start("aa11");
+    ctx.agentCreatedTabs.add(11);
+    const state: FakeState = {
+      tabs: new Map([
+        [10, { id: 10, windowId: agentWindowId } as chrome.tabs.Tab],
+        [11, { id: 11, windowId: agentWindowId } as chrome.tabs.Tab],
+      ]),
+      windowsClosed: new Set(),
+      moves: [],
+    };
+    const { tabs, windows } = makeApis(state);
+    const query = makeQuery(state);
+
+    const res = await handleSessionStop(
+      sm,
+      { session_id: "aa11" },
+      { tabManagement: { tabs, windows }, tabsQuery: query },
+    );
+    if ("code" in res) throw new Error(`unexpected error: ${JSON.stringify(res)}`);
+    expect(res.window_released).toBeFalsy();
+    expect(aw.remove).toHaveBeenCalledWith(agentWindowId);
+    expect(sm.has("aa11")).toBe(false);
+  });
+
+  it("is non-fatal when an agent tab is already gone", async () => {
+    const aw = fakeAgentWindow([agentWindowId]);
+    aw.ensureActiveTab = vi.fn(async () => 10);
+    const sm = new SessionManager({ agentWindow: aw });
+    const ctx = await sm.start("aa11");
+    ctx.agentCreatedTabs.add(11); // no longer in state → remove throws
+    const state: FakeState = {
+      tabs: new Map([[10, { id: 10, windowId: agentWindowId } as chrome.tabs.Tab]]),
+      windowsClosed: new Set(),
+      moves: [],
+    };
+    const { tabs, windows } = makeApis(state);
+    (tabs.remove as ReturnType<typeof vi.fn>).mockImplementation(async (id: number) => {
+      if (id === 11) throw new Error("tab 11 already closed");
+      state.tabs.delete(id); // home (10) removed normally
+    });
+    const query = makeQuery(state);
+
+    const res = await handleSessionStop(
+      sm,
+      { session_id: "aa11" },
+      { tabManagement: { tabs, windows }, tabsQuery: query },
+    );
+    if ("code" in res) throw new Error(`unexpected error: ${JSON.stringify(res)}`);
+    // user tab 10? no — 10 is home, removed. window would be empty → close.
+    expect(res.window_released).toBeFalsy();
+    expect(aw.remove).toHaveBeenCalled();
+  });
+
+  it("degrades to close-window when tabsQuery is missing", async () => {
+    const aw = fakeAgentWindow([agentWindowId]);
+    aw.ensureActiveTab = vi.fn(async () => 10);
+    const sm = new SessionManager({ agentWindow: aw });
+    const ctx = await sm.start("aa11");
+    ctx.agentCreatedTabs.add(11);
+    const state: FakeState = {
+      tabs: new Map([
+        [10, { id: 10, windowId: agentWindowId } as chrome.tabs.Tab],
+        [11, { id: 11, windowId: agentWindowId } as chrome.tabs.Tab],
+      ]),
+      windowsClosed: new Set(),
+      moves: [],
+    };
+    const { tabs, windows } = makeApis(state);
+
+    const res = await handleSessionStop(
+      sm,
+      { session_id: "aa11" },
+      { tabManagement: { tabs, windows } }, // no tabsQuery
+    );
+    if ("code" in res) throw new Error(`unexpected error: ${JSON.stringify(res)}`);
+    // No query available → conservatively close the window.
+    expect(res.window_released).toBeFalsy();
+    expect(aw.remove).toHaveBeenCalledWith(agentWindowId);
+  });
+
+  it("degrades to close-window when tabsQuery.query throws", async () => {
+    const aw = fakeAgentWindow([agentWindowId]);
+    aw.ensureActiveTab = vi.fn(async () => 10);
+    const sm = new SessionManager({ agentWindow: aw });
+    const ctx = await sm.start("aa11");
+    ctx.agentCreatedTabs.add(11);
+    const state: FakeState = {
+      tabs: new Map([[11, { id: 11, windowId: agentWindowId } as chrome.tabs.Tab]]),
+      windowsClosed: new Set(),
+      moves: [],
+    };
+    const { tabs, windows } = makeApis(state);
+    const query = makeQuery(state);
+    (query.query as ReturnType<typeof vi.fn>).mockImplementation(async () => {
+      throw new Error("query failed");
+    });
+
+    const res = await handleSessionStop(
+      sm,
+      { session_id: "aa11" },
+      { tabManagement: { tabs, windows }, tabsQuery: query },
+    );
+    if ("code" in res) throw new Error(`unexpected error: ${JSON.stringify(res)}`);
+    expect(res.window_released).toBeFalsy();
+    expect(aw.remove).toHaveBeenCalled();
+  });
+
+  it("tracks agentCreatedTabs across tab_create / tab_close", async () => {
+    const aw = fakeAgentWindow([agentWindowId]);
+    aw.ensureActiveTab = vi.fn(async () => 10);
+    const sm = new SessionManager({ agentWindow: aw });
+    const ctx = await sm.start("aa11");
+    // Simulate handleTabCreate adding, then handleTabClose removing.
+    ctx.agentCreatedTabs.add(11);
+    expect(ctx.agentCreatedTabs.has(11)).toBe(true);
+    ctx.agentCreatedTabs.delete(11); // as handleTabClose does on success
+    expect(ctx.agentCreatedTabs.has(11)).toBe(false);
+    // Unknown id delete is a safe no-op (user-closed tab).
+    expect(() => ctx.agentCreatedTabs.delete(999)).not.toThrow();
+  });
+
+  it("closes the window (not release) when an agent tab fails to close", async () => {
+    // Regression: a leaked agent tab (still in agentCreatedTabs, but
+    // still present because Step 4 remove() threw) must NOT be mistaken
+    // for a user tab. Otherwise the window would be released (dropOnly)
+    // and the agent tab would leak (issue #57 regression).
+    const aw = fakeAgentWindow([agentWindowId]);
+    aw.ensureActiveTab = vi.fn(async () => 10);
+    const sm = new SessionManager({ agentWindow: aw });
+    const ctx = await sm.start("aa11");
+    ctx.agentCreatedTabs.add(11); // Step 4 remove() will throw for this tab
+    const state: FakeState = {
+      tabs: new Map([
+        [10, { id: 10, windowId: agentWindowId } as chrome.tabs.Tab],
+        [11, { id: 11, windowId: agentWindowId } as chrome.tabs.Tab],
+      ]),
+      windowsClosed: new Set(),
+      moves: [],
+    };
+    const { tabs, windows } = makeApis(state);
+    (tabs.remove as ReturnType<typeof vi.fn>).mockImplementation(async (id: number) => {
+      if (id === 11) throw new Error("tab 11 failed to close");
+      state.tabs.delete(id); // home (10) removed normally; 11 lingers
+    });
+    const query = makeQuery(state);
+
+    const res = await handleSessionStop(
+      sm,
+      { session_id: "aa11" },
+      { tabManagement: { tabs, windows }, tabsQuery: query },
+    );
+    if ("code" in res) throw new Error(`unexpected error: ${JSON.stringify(res)}`);
+    // The leaked agent tab must NOT keep the window open.
+    expect(res.window_released).toBeFalsy();
+    expect(aw.remove).toHaveBeenCalledWith(agentWindowId);
+    expect(sm.has("aa11")).toBe(false);
+  });
 });

apps/extension/src/tools/__tests__/shared.test.ts

@@ -12,7 +12,7 @@ function fakeAgentWindow() {
   return {
     create: vi.fn(async () => 100),
     remove: vi.fn(async () => {}),
-    ensureActiveTab: vi.fn(async () => {}),
+    ensureActiveTab: vi.fn(async () => 1),
   };
 }
 

apps/extension/src/tools/__tests__/snapshot-ref.test.ts

@@ -11,7 +11,7 @@ function fakeAgentWindow(ids: number[]) {
       return id;
     },
     remove: async () => {},
-    ensureActiveTab: async () => {},
+    ensureActiveTab: async () => 1,
   };
 }
 

apps/extension/src/tools/__tests__/tabs.test.ts

@@ -23,7 +23,7 @@ function fakeAgentWindow(ids: number[]) {
       return id;
     }),
     remove: vi.fn(async () => {}),
-    ensureActiveTab: vi.fn(async () => {}),
+    ensureActiveTab: vi.fn(async () => 1),
   };
 }
 
@@ -221,6 +221,7 @@ describe("handleTabCreate", () => {
       active: true,
     });
     expect(res).toMatchObject({ tab_id: 10, window_id: 100 });
+    expect(sm.get("aa11")?.agentCreatedTabs.has(10)).toBe(true);
   });
 
   it("forwards explicit url + index + active=false", async () => {
@@ -256,6 +257,41 @@ describe("handleTabCreate", () => {
     const res = await handleTabCreate(sm, { session_id: "aa11", index: -1 }, { tabs: api });
     expect(res).toMatchObject({ code: "invalid_params" });
   });
+
+  it("does not claim any tab when chrome.tabs.create fails", async () => {
+    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
+    await sm.start("aa11");
+    const state: FakeTabState = { tabs: new Map(), nextTabId: 10, windowsClosed: new Set() };
+    const { api, spies } = makeTabMutationApi(state);
+    spies.create.mockRejectedValueOnce(new Error("chrome.tabs.create failed"));
+
+    const res = await handleTabCreate(sm, { session_id: "aa11" }, { tabs: api });
+    expect(res).toMatchObject({ code: "protocol_error" });
+
+    expect(sm.get("aa11")?.agentCreatedTabs).toEqual(new Set([1]));
+  });
+
+  it("claims the returned id even when a user tab appears during tab creation", async () => {
+    const sm = new SessionManager({ agentWindow: fakeAgentWindow([100]) });
+    const ctx = await sm.start("aa11");
+    const state: FakeTabState = { tabs: new Map(), nextTabId: 10, windowsClosed: new Set() };
+    const { api, spies } = makeTabMutationApi(state);
+    let resolveCreate!: (tab: chrome.tabs.Tab) => void;
+    const createResult = new Promise<chrome.tabs.Tab>((resolve) => {
+      resolveCreate = resolve;
+    });
+    spies.create.mockImplementationOnce(() => createResult);
+
+    const pending = handleTabCreate(sm, { session_id: "aa11" }, { tabs: api });
+    // A user can create an unrelated same-window tab while Chrome is still
+    // resolving the agent request. There is no pending slot for it to steal.
+    expect(ctx.agentCreatedTabs.has(99)).toBe(false);
+    resolveCreate({ id: 10, windowId: 100, active: true } as chrome.tabs.Tab);
+
+    await expect(pending).resolves.toMatchObject({ tab_id: 10 });
+    expect(ctx.agentCreatedTabs.has(10)).toBe(true);
+    expect(ctx.agentCreatedTabs.has(99)).toBe(false);
+  });
 });
 
 describe("handleTabClose", () => {

apps/extension/src/tools/__tests__/waits.test.ts

@@ -12,7 +12,7 @@ function fakeAgentWindow(ids: number[]) {
       return id;
     }),
     remove: vi.fn(async () => {}),
-    ensureActiveTab: vi.fn(async () => {}),
+    ensureActiveTab: vi.fn(async () => 1),
   };
 }
 

apps/extension/src/tools/__tests__/window.test.ts

@@ -11,7 +11,7 @@ function fakeAgentWindow(ids: number[]) {
     return id;
   });
   const remove = vi.fn(async () => {});
-  const ensureActiveTab = vi.fn(async () => {});
+  const ensureActiveTab = vi.fn(async () => 1);
   return { create, remove, ensureActiveTab };
 }
 

apps/extension/src/tools/dispatcher.ts

@@ -69,6 +69,7 @@ import {
 import { chromeTabsApi, lookupSession, resolveTargetTab } from "./shared";
 import {
   type BorrowConfirmationApprover,
+  chromeTabMutationApi,
   handleTabBorrow,
   handleTabClose,
   handleTabCreate,
@@ -118,6 +119,8 @@ export interface DispatcherDeps {
   onSessionsChanged?: () => void;
   /** Invoked before a tool that dispatches page input or mutates browser state is forwarded. */
   onBrowserControlResumed?: (sessionId: string) => void;
+  /** Invoked after a tab is explicitly claimed so its overlay can be refreshed immediately. */
+  onAgentTabClaimed?: (tabId: number, windowId: number) => void;
   /** User approval for `tool.tab_borrow` (overlay in content script). */
   approveBorrow?: BorrowConfirmationApprover;
   /** i18n notification copy for `tool.request_help` (resolved per-call). */
@@ -147,6 +150,7 @@ export class ToolDispatcher {
   private readonly recording?: RecordRuntimeDeps;
   private readonly onSessionsChanged?: () => void;
   private readonly onBrowserControlResumed?: (sessionId: string) => void;
+  private readonly onAgentTabClaimed?: (tabId: number, windowId: number) => void;
   private readonly approveBorrow?: BorrowConfirmationApprover;
   private readonly helpNotificationCopy?: () => { title: string; body: string };
   private subscription: { dispose(): void } | null = null;
@@ -167,6 +171,7 @@ export class ToolDispatcher {
     this.recording = deps.recording;
     this.onSessionsChanged = deps.onSessionsChanged;
     this.onBrowserControlResumed = deps.onBrowserControlResumed;
+    this.onAgentTabClaimed = deps.onAgentTabClaimed;
     this.approveBorrow = deps.approveBorrow;
     this.helpNotificationCopy = deps.helpNotificationCopy;
   }
@@ -302,13 +307,25 @@ export class ToolDispatcher {
         await this.releaseHoverLatch((req.params as SessionStopParams).session_id);
         return handleSessionStop(this.sessions, req.params as SessionStopParams, {
           cdp: this.cdp,
+          // Must be wired in production: the agent-tab cleanup and the
+          // window-release decision (issue #57) read these deps directly
+          // and silently no-op when they are absent.
+          tabManagement: { tabs: chromeTabMutationApi },
+          tabsQuery: chromeTabsApi,
           signal,
         });
       }
       case "tool.tab_list":
         return handleTabList(this.sessions, req.params as TabListParams, chromeTabsApi, signal);
-      case "tool.tab_create":
-        return handleTabCreate(this.sessions, req.params as TabCreateParams, { signal });
+      case "tool.tab_create": {
+        const result = await handleTabCreate(this.sessions, req.params as TabCreateParams, {
+          signal,
+        });
+        if (!isRpcError(result)) {
+          this.onAgentTabClaimed?.(result.tab_id, result.window_id);
+        }
+        return result;
+      }
       case "tool.tab_close":
         return this.withHoverReleaseForRequest(
           req.params as TabCloseParams,
@@ -317,11 +334,16 @@ export class ToolDispatcher {
         );
       case "tool.tab_select":
         return handleTabSelect(this.sessions, req.params as TabSelectParams, { signal });
-      case "tool.tab_borrow":
-        return handleTabBorrow(this.sessions, req.params as TabBorrowParams, {
+      case "tool.tab_borrow": {
+        const result = await handleTabBorrow(this.sessions, req.params as TabBorrowParams, {
           signal,
           approveBorrow: this.approveBorrow,
         });
+        if (!isRpcError(result)) {
+          this.onAgentTabClaimed?.(result.tab_id, result.agent_window_id);
+        }
+        return result;
+      }
       case "tool.tab_return":
         return handleTabReturn(this.sessions, req.params as TabReturnParams, { signal });
       case "tool.window_resize":

apps/extension/src/tools/download-capture.ts

@@ -9,8 +9,6 @@ import { type CdpRunner, isRpcError } from "./shared";
 
 const CORRELATION_GRACE_MS = 750;
 const UNIQUE_SETTLE_MS = 50;
-const CLEANUP_RECONCILE_MS = 1_000;
-const CLEANUP_POLL_MS = 25;
 const SIZE_POLL_MS = 250;
 
 type DeterminingFilenameListener = (
@@ -112,35 +110,26 @@ function captureError(
 
 async function cleanupClaimedDownload(downloads: DownloadsApi, downloadId: number): Promise<void> {
   const lookup = async () => (await downloads.search({ id: downloadId }))[0];
-  let item = await lookup();
+  const item = await lookup();
   if (!item || item.state === "interrupted") return;
   if (item.state === "complete") {
     await downloads.removeFile(downloadId);
     return;
   }
 
-  let cancelError: unknown;
   try {
     await downloads.cancel(downloadId);
-  } catch (error) {
-    cancelError = error;
-  }
-
-  const deadline = Date.now() + CLEANUP_RECONCILE_MS;
-  while (true) {
-    item = await lookup();
-    if (!item || item.state === "interrupted") return;
-    if (item.state === "complete") {
+  } catch (cancelError) {
+    // Completion can win the race after the lookup but before cancellation.
+    // Reconcile against Chrome's authoritative state before declaring cleanup
+    // failed so every terminal state has one explicit cleanup path.
+    const reconciled = await lookup();
+    if (!reconciled || reconciled.state === "interrupted") return;
+    if (reconciled.state === "complete") {
       await downloads.removeFile(downloadId);
       return;
     }
-    if (Date.now() >= deadline) {
-      if (cancelError instanceof Error) throw cancelError;
-      throw new Error("download remained in progress after cancellation");
-    }
-    await new Promise((resolve) =>
-      setTimeout(resolve, Math.min(CLEANUP_POLL_MS, Math.max(1, deadline - Date.now()))),
-    );
+    throw cancelError;
   }
 }
 

apps/extension/src/tools/file-drop-transaction.ts

@@ -0,0 +1,319 @@
+// One native file-drop transaction bound to an explicit page target. CDP drag
+// events are sent to the target that owns the node: root targets use top-level
+// coordinates, while OOPIF targets require coordinates local to their session.
+
+import type { RpcError, TransferEffectState } from "@/transport/types";
+import { transferError } from "./errors";
+import { resolveNodeGeometry } from "./frame-geometry";
+import type { ResolvedActionTarget } from "./interaction";
+import { type CdpRunner, isRpcError, sendToCdpTarget } from "./shared";
+import { BoundedWaitError, waitBounded } from "./transfer-transaction";
+
+const CLEANUP_TIMEOUT_MS = 1_000;
+
+type FileDropPhase = "resolve_target" | "drag_enter" | "drag_over" | "drop" | "cleanup";
+
+interface RuntimeReply {
+  result?: { value?: unknown; objectId?: string };
+  exceptionDetails?: { text?: string; exception?: { description?: string } };
+}
+
+interface DragData {
+  items: [];
+  files: string[];
+  dragOperationsMask: number;
+}
+
+export interface FileDropTransactionOptions {
+  cdp: CdpRunner;
+  actionTarget: ResolvedActionTarget;
+  files: string[];
+  timeoutMs: number;
+  signal?: AbortSignal;
+  withOverlayHidden: <T>(operation: () => Promise<T>) => Promise<T>;
+}
+
+export interface FileDropTransactionResult {
+  x: number;
+  y: number;
+}
+
+function failure(
+  code: RpcError["code"],
+  reason: "upload_mechanism_unsupported" | "file_drop_target_unavailable" | "file_drop_failed",
+  message: string,
+  effectState: TransferEffectState,
+  phase: FileDropPhase,
+): RpcError {
+  const error = transferError(code, reason, message, { effectState, phase });
+  error.data = { ...error.data, mechanism: "drop" };
+  return error;
+}
+
+function enrichFailure(
+  error: RpcError,
+  effectState: TransferEffectState,
+  phase: FileDropPhase,
+): RpcError {
+  return {
+    ...error,
+    data: {
+      ...error.data,
+      mechanism: "drop",
+      effect_state: effectState,
+      phase,
+    },
+  };
+}
+
+function messageOf(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+function methodUnavailable(error: unknown): boolean {
+  return /(?:method|command).*(?:not found|wasn't found|unsupported)|wasn't found|-32601/i.test(
+    messageOf(error),
+  );
+}
+
+function runtimeError(reply: RuntimeReply, fallback: string): Error | null {
+  if (!reply.exceptionDetails) return null;
+  return new Error(
+    reply.exceptionDetails.exception?.description ?? reply.exceptionDetails.text ?? fallback,
+  );
+}
+
+async function pointBelongsToTarget(
+  options: FileDropTransactionOptions,
+  x: number,
+  y: number,
+  objectGroup: string,
+): Promise<boolean> {
+  const target = options.actionTarget.cdpTarget;
+  const hit = await sendToCdpTarget<{ backendNodeId?: number; frameId?: string }>(
+    options.cdp,
+    target,
+    "DOM.getNodeForLocation",
+    { x: Math.round(x), y: Math.round(y), includeUserAgentShadowDOM: true },
+  );
+  if (typeof hit.backendNodeId !== "number") return false;
+  if (options.actionTarget.frameId && hit.frameId !== options.actionTarget.frameId) return false;
+
+  const [resolvedTarget, resolvedHit] = await Promise.all([
+    sendToCdpTarget<{ object?: { objectId?: string } }>(options.cdp, target, "DOM.resolveNode", {
+      backendNodeId: options.actionTarget.backendNodeId,
+      objectGroup,
+    }),
+    sendToCdpTarget<{ object?: { objectId?: string } }>(options.cdp, target, "DOM.resolveNode", {
+      backendNodeId: hit.backendNodeId,
+      objectGroup,
+    }),
+  ]);
+  const targetObjectId = resolvedTarget.object?.objectId;
+  const hitObjectId = resolvedHit.object?.objectId;
+  if (!targetObjectId || !hitObjectId) return false;
+
+  const reply = await sendToCdpTarget<RuntimeReply>(options.cdp, target, "Runtime.callFunctionOn", {
+    objectId: targetObjectId,
+    functionDeclaration: `function(hit) {
+        for (let node = hit; node; ) {
+          if (node === this) return true;
+          if (this.contains?.(node)) return true;
+          const root = node.getRootNode?.();
+          node = node.parentNode || (root && root !== node ? root.host : null);
+        }
+        return false;
+      }`,
+    arguments: [{ objectId: hitObjectId }],
+    returnByValue: true,
+  });
+  const error = runtimeError(reply, "failed to verify file-drop target");
+  if (error) throw error;
+  return reply.result?.value === true;
+}
+
+export async function uploadThroughFileDrop(
+  options: FileDropTransactionOptions,
+): Promise<FileDropTransactionResult | RpcError> {
+  const deadline = Date.now() + options.timeoutMs;
+  const target = options.actionTarget.cdpTarget;
+  const objectGroup = `bsk-file-drop-${crypto.randomUUID()}`;
+  const dragData: DragData = {
+    items: [],
+    files: options.files,
+    dragOperationsMask: 1,
+  };
+  let dragStarted = false;
+  let dropSent = false;
+  let dragPoint = { x: 0, y: 0 };
+  let cleanupFailed = false;
+  let outcome: FileDropTransactionResult | RpcError = failure(
+    "protocol_error",
+    "file_drop_failed",
+    "file-drop transaction ended without an outcome",
+    "none",
+    "cleanup",
+  );
+
+  try {
+    const geometry = await waitBounded(
+      resolveNodeGeometry(
+        options.cdp,
+        options.actionTarget.tab.tabId,
+        {
+          target,
+          backendNodeId: options.actionTarget.backendNodeId,
+          ...(options.actionTarget.frameId ? { frameId: options.actionTarget.frameId } : {}),
+        },
+        { scrollIntoView: true },
+      ),
+      deadline,
+      options.signal,
+      "resolving file-drop target timed out",
+    );
+    if (isRpcError(geometry)) {
+      outcome = enrichFailure(geometry, "none", "resolve_target");
+      return outcome;
+    }
+    const point = geometry.targetActionPoint;
+    dragPoint = point;
+
+    outcome = await options.withOverlayHidden(async () => {
+      try {
+        try {
+          const belongs = await waitBounded(
+            pointBelongsToTarget(options, point.x, point.y, objectGroup),
+            deadline,
+            options.signal,
+            "verifying file-drop target timed out",
+          );
+          if (!belongs) {
+            return failure(
+              "permission_denied",
+              "file_drop_target_unavailable",
+              "file-drop target is not the topmost element at its action point",
+              "none",
+              "resolve_target",
+            );
+          }
+        } catch (error) {
+          return failure(
+            error instanceof BoundedWaitError ? "timeout" : "cdp_failed",
+            "file_drop_target_unavailable",
+            messageOf(error),
+            "none",
+            "resolve_target",
+          );
+        }
+
+        for (const [type, phase] of [
+          ["dragEnter", "drag_enter"],
+          ["dragOver", "drag_over"],
+        ] as const) {
+          try {
+            if (type === "dragEnter") dragStarted = true;
+            await waitBounded(
+              sendToCdpTarget(options.cdp, target, "Input.dispatchDragEvent", {
+                type,
+                x: point.x,
+                y: point.y,
+                data: dragData,
+              }),
+              deadline,
+              options.signal,
+              `${type} timed out`,
+            );
+          } catch (error) {
+            const unsupported = methodUnavailable(error);
+            if (type === "dragEnter" && unsupported) dragStarted = false;
+            return failure(
+              unsupported
+                ? "unsupported"
+                : error instanceof BoundedWaitError
+                  ? "timeout"
+                  : "cdp_failed",
+              unsupported ? "upload_mechanism_unsupported" : "file_drop_failed",
+              messageOf(error),
+              "none",
+              phase,
+            );
+          }
+        }
+
+        try {
+          dropSent = true;
+          await waitBounded(
+            sendToCdpTarget(options.cdp, target, "Input.dispatchDragEvent", {
+              type: "drop",
+              x: point.x,
+              y: point.y,
+              data: dragData,
+            }),
+            deadline,
+            options.signal,
+            "file drop timed out",
+          );
+          return { x: point.x, y: point.y };
+        } catch (error) {
+          outcome = failure(
+            error instanceof BoundedWaitError ? "timeout" : "cdp_failed",
+            "file_drop_failed",
+            messageOf(error),
+            "unknown",
+            "drop",
+          );
+          return outcome;
+        }
+      } finally {
+        if (dragStarted && !dropSent) {
+          try {
+            await waitBounded(
+              sendToCdpTarget(options.cdp, target, "Input.dispatchDragEvent", {
+                type: "dragCancel",
+                x: dragPoint.x,
+                y: dragPoint.y,
+                data: dragData,
+              }),
+              Date.now() + CLEANUP_TIMEOUT_MS,
+              undefined,
+              "cancelling file drag timed out",
+            );
+          } catch {
+            cleanupFailed = true;
+          }
+        }
+      }
+    });
+    return outcome;
+  } catch (error) {
+    outcome = failure(
+      error instanceof BoundedWaitError ? "timeout" : "cdp_failed",
+      "file_drop_target_unavailable",
+      messageOf(error),
+      "none",
+      "resolve_target",
+    );
+    return outcome;
+  } finally {
+    try {
+      await waitBounded(
+        sendToCdpTarget(options.cdp, target, "Runtime.releaseObjectGroup", { objectGroup }),
+        Date.now() + CLEANUP_TIMEOUT_MS,
+        undefined,
+        "releasing file-drop object group timed out",
+      );
+    } catch {
+      cleanupFailed = true;
+    }
+
+    const effect = isRpcError(outcome)
+      ? (outcome.data?.effect_state as TransferEffectState | undefined)
+      : "committed";
+    if (effect === "unknown" || cleanupFailed) {
+      await options.cdp.detach?.(target.tabId);
+    }
+    if (cleanupFailed && isRpcError(outcome)) {
+      outcome.data = { ...outcome.data, cleanup_state: "failed" };
+    }
+  }
+}

apps/extension/src/tools/file-input-transaction.ts

@@ -7,9 +7,9 @@ import type { ClickResult, RpcError, TransferEffectState } from "@/transport/typ
 import { transferError } from "./errors";
 import type { ResolvedActionTarget } from "./interaction";
 import { type CdpRunner, isRpcError, sendToCdpTarget } from "./shared";
+import { BoundedWaitError, remainingMs, waitBounded } from "./transfer-transaction";
 
 const CLEANUP_TIMEOUT_MS = 1_000;
-const DETACH_TIMEOUT_MS = 500;
 const ACTIVATION_GRACE_MS = 1_000;
 const PROBE_INTERVAL_MS = 20;
 
@@ -46,51 +46,6 @@ export interface FileInputTransactionResult {
   multiple: boolean;
 }
 
-class BoundedWaitError extends Error {
-  constructor(
-    readonly kind: "timeout" | "aborted",
-    message: string,
-  ) {
-    super(message);
-  }
-}
-
-function remainingMs(deadline: number): number {
-  return Math.max(0, deadline - Date.now());
-}
-
-async function waitBounded<T>(
-  operation: () => Promise<T>,
-  deadline: number,
-  signal: AbortSignal | undefined,
-  timeoutMessage: string,
-): Promise<T> {
-  const remaining = remainingMs(deadline);
-  if (signal?.aborted) throw new BoundedWaitError("aborted", "upload transaction aborted");
-  if (remaining === 0) throw new BoundedWaitError("timeout", timeoutMessage);
-
-  let timer: ReturnType<typeof setTimeout> | undefined;
-  let onAbort: (() => void) | undefined;
-  const boundary = new Promise<never>((_resolve, reject) => {
-    timer = setTimeout(() => reject(new BoundedWaitError("timeout", timeoutMessage)), remaining);
-    if (signal) {
-      onAbort = () => reject(new BoundedWaitError("aborted", "upload transaction aborted"));
-      signal.addEventListener("abort", onAbort, { once: true });
-    }
-  });
-  try {
-    const work = Promise.resolve().then(() => {
-      if (signal?.aborted) throw new BoundedWaitError("aborted", "upload transaction aborted");
-      if (remainingMs(deadline) === 0) throw new BoundedWaitError("timeout", timeoutMessage);
-      return operation();
-    });
-    return await Promise.race([work, boundary]);
-  } finally {
-    if (timer) clearTimeout(timer);
-    if (signal && onAbort) signal.removeEventListener("abort", onAbort);
-  }
-}
-
 function runtimeError(reply: RuntimeReply, fallback: string): Error | null {
   if (!reply.exceptionDetails) return null;
   return new Error(
@@ -128,18 +83,13 @@ function sameTarget(
 
 async function delay(ms: number, signal?: AbortSignal): Promise<void> {
   await waitBounded(
-    () => new Promise((resolve) => setTimeout(resolve, ms)),
+    new Promise((resolve) => setTimeout(resolve, ms)),
     Date.now() + ms + 1,
     signal,
     "upload activation probe timed out",
   );
 }
 
-function waitErrorCode(error: unknown): RpcError["code"] {
-  if (!(error instanceof BoundedWaitError)) return "cdp_failed";
-  return error.kind === "aborted" ? "cancelled" : "timeout";
-}
-
 async function callOnTrigger<T = RuntimeReply>(
   options: FileInputTransactionOptions,
   objectId: string,
@@ -164,8 +114,8 @@ export async function uploadThroughActivatedFileInput(
   const objectGroup = `bsk-upload-${crypto.randomUUID()}`;
   const stateKey = `__bskUpload_${crypto.randomUUID().replaceAll("-", "")}`;
   const chooserEvents: ChooserEvent[] = [];
-  let interceptionState: "not_started" | "possibly_active" | "active" = "not_started";
-  let probeState: "not_started" | "possibly_active" | "active" = "not_started";
+  let interceptionArmed = false;
+  let probeArmed = false;
   let triggerObjectId: string | undefined;
   let outcome: FileInputTransactionResult | RpcError = transferFailure(
     "protocol_error",
@@ -183,20 +133,18 @@ export async function uploadThroughActivatedFileInput(
 
   try {
     try {
-      interceptionState = "possibly_active";
       await waitBounded(
-        () =>
-          sendToCdpTarget(options.cdp, target, "Page.setInterceptFileChooserDialog", {
-            enabled: true,
-          }),
+        sendToCdpTarget(options.cdp, target, "Page.setInterceptFileChooserDialog", {
+          enabled: true,
+        }),
         deadline,
         options.signal,
         "arming native file chooser interception timed out",
       );
-      interceptionState = "active";
+      interceptionArmed = true;
     } catch (err) {
       outcome = transferFailure(
-        waitErrorCode(err),
+        err instanceof BoundedWaitError ? "timeout" : "cdp_failed",
         "file_input_probe_failed",
         err instanceof Error ? err.message : String(err),
         "none",
@@ -207,16 +155,15 @@ export async function uploadThroughActivatedFileInput(
 
     try {
       const resolved = await waitBounded(
-        () =>
-          sendToCdpTarget<{ object?: { objectId?: string } }>(
-            options.cdp,
-            target,
-            "DOM.resolveNode",
-            {
-              backendNodeId: options.actionTarget.backendNodeId,
-              objectGroup,
-            },
-          ),
+        sendToCdpTarget<{ object?: { objectId?: string } }>(
+          options.cdp,
+          target,
+          "DOM.resolveNode",
+          {
+            backendNodeId: options.actionTarget.backendNodeId,
+            objectGroup,
+          },
+        ),
         deadline,
         options.signal,
         "resolving upload trigger timed out",
@@ -224,13 +171,11 @@ export async function uploadThroughActivatedFileInput(
       triggerObjectId = resolved.object?.objectId;
       if (!triggerObjectId) throw new Error("DOM.resolveNode returned no trigger objectId");
 
-      probeState = "possibly_active";
       const armed = await waitBounded(
-        () =>
-          callOnTrigger<RuntimeReply>(
-            options,
-            triggerObjectId as string,
-            `function(key) {
+        callOnTrigger<RuntimeReply>(
+          options,
+          triggerObjectId,
+          `function(key) {
             const doc = this.ownerDocument;
             const owner = doc.defaultView;
             if (!owner) return false;
@@ -248,9 +193,9 @@ export async function uploadThroughActivatedFileInput(
             doc.addEventListener("click", state.listener, true);
             return true;
           }`,
-            [stateKey],
-            true,
-          ),
+          [stateKey],
+          true,
+        ),
         deadline,
         options.signal,
         "arming frame-scoped file input probe timed out",
@@ -259,10 +204,10 @@ export async function uploadThroughActivatedFileInput(
       if (armError || armed.result?.value !== true) {
         throw armError ?? new Error("file input probe did not arm");
       }
-      probeState = "active";
+      probeArmed = true;
     } catch (err) {
       outcome = transferFailure(
-        waitErrorCode(err),
+        err instanceof BoundedWaitError ? "timeout" : "cdp_failed",
         "file_input_probe_failed",
         err instanceof Error ? err.message : String(err),
         "none",
@@ -274,14 +219,14 @@ export async function uploadThroughActivatedFileInput(
     let click: ClickResult | RpcError;
     try {
       click = await waitBounded(
-        options.trigger,
+        options.trigger(),
         deadline,
         options.signal,
         "upload trigger timed out",
       );
     } catch (err) {
       outcome = transferFailure(
-        waitErrorCode(err),
+        err instanceof BoundedWaitError ? "timeout" : "cdp_failed",
         "file_input_probe_failed",
         err instanceof Error ? err.message : String(err),
         "none",
@@ -299,23 +244,17 @@ export async function uploadThroughActivatedFileInput(
       let summary: { count: number; multiple: boolean } = { count: 0, multiple: false };
       while (Date.now() < activationDeadline) {
         if (chooserEvents.length > 0) break;
-        const reply = await waitBounded(
-          () =>
-            callOnTrigger<RuntimeReply>(
-              options,
-              triggerObjectId as string,
-              `function(key) {
+        const reply = await callOnTrigger<RuntimeReply>(
+          options,
+          triggerObjectId,
+          `function(key) {
             const state = this.ownerDocument.defaultView?.[key];
             return state
               ? { count: state.inputs.length, multiple: state.inputs[0]?.multiple === true }
               : { count: 0, multiple: false };
           }`,
-              [stateKey],
-              true,
-            ),
-          activationDeadline,
-          options.signal,
-          "inspecting activated file input timed out",
+          [stateKey],
+          true,
         );
         const summaryError = runtimeError(reply, "failed to inspect activated file input");
         if (summaryError) throw summaryError;
@@ -378,33 +317,21 @@ export async function uploadThroughActivatedFileInput(
           );
           return outcome;
         }
-        const input = await waitBounded(
-          () =>
-            callOnTrigger<RuntimeReply>(
-              options,
-              triggerObjectId as string,
-              `function(key) { return this.ownerDocument.defaultView?.[key]?.inputs[0]; }`,
-              [stateKey],
-              false,
-            ),
-          deadline,
-          options.signal,
-          "resolving activated file input timed out",
+        const input = await callOnTrigger<RuntimeReply>(
+          options,
+          triggerObjectId,
+          `function(key) { return this.ownerDocument.defaultView?.[key]?.inputs[0]; }`,
+          [stateKey],
+          false,
         );
         const inputError = runtimeError(input, "failed to resolve activated file input object");
         if (inputError) throw inputError;
         if (!input.result?.objectId) throw new Error("activated file input returned no objectId");
-        const described = await waitBounded(
-          () =>
-            sendToCdpTarget<{ node?: { backendNodeId?: number } }>(
-              options.cdp,
-              target,
-              "DOM.describeNode",
-              { objectId: input.result?.objectId },
-            ),
-          deadline,
-          options.signal,
-          "describing activated file input timed out",
+        const described = await sendToCdpTarget<{ node?: { backendNodeId?: number } }>(
+          options.cdp,
+          target,
+          "DOM.describeNode",
+          { objectId: input.result.objectId },
         );
         backendNodeId = described.node?.backendNodeId;
         if (typeof backendNodeId !== "number") {
@@ -423,18 +350,17 @@ export async function uploadThroughActivatedFileInput(
 
       try {
         await waitBounded(
-          () =>
-            sendToCdpTarget(options.cdp, target, "DOM.setFileInputFiles", {
-              files: options.files,
-              backendNodeId,
-            }),
+          sendToCdpTarget(options.cdp, target, "DOM.setFileInputFiles", {
+            files: options.files,
+            backendNodeId,
+          }),
           deadline,
           options.signal,
           "setting file input files timed out",
         );
       } catch (err) {
         outcome = transferFailure(
-          waitErrorCode(err),
+          err instanceof BoundedWaitError ? "timeout" : "cdp_failed",
           "set_file_input_failed",
           err instanceof Error ? err.message : String(err),
           "unknown",
@@ -446,7 +372,7 @@ export async function uploadThroughActivatedFileInput(
       return outcome;
     } catch (err) {
       outcome = transferFailure(
-        waitErrorCode(err),
+        err instanceof BoundedWaitError ? "timeout" : "cdp_failed",
         "file_input_probe_failed",
         err instanceof Error ? err.message : String(err),
         "none",
@@ -456,70 +382,61 @@ export async function uploadThroughActivatedFileInput(
     }
   } finally {
     chooserSubscription?.dispose();
-    const cleanupDeadline = Date.now() + CLEANUP_TIMEOUT_MS;
-    const cleanupTasks: Promise<boolean>[] = [];
-    const cleanup = async (operation: () => Promise<unknown>, message: string) => {
+    let cleanupFailed = false;
+    if (probeArmed && triggerObjectId) {
       try {
-        await waitBounded(operation, cleanupDeadline, undefined, message);
-        return true;
-      } catch {
-        return false;
-      }
-    };
-    if (probeState !== "not_started" && triggerObjectId) {
-      cleanupTasks.push(
-        cleanup(
-          () =>
-            callOnTrigger(
-              options,
-              triggerObjectId as string,
-              `function(key) {
+        await waitBounded(
+          callOnTrigger(
+            options,
+            triggerObjectId,
+            `function(key) {
               const owner = this.ownerDocument.defaultView;
               const state = owner?.[key];
               if (state?.listener) this.ownerDocument.removeEventListener("click", state.listener, true);
               if (owner) delete owner[key];
             }`,
-              [stateKey],
-              true,
-            ),
+            [stateKey],
+            true,
+          ),
+          Date.now() + CLEANUP_TIMEOUT_MS,
+          undefined,
           "cleaning file input probe timed out",
-        ),
-      );
+        );
+      } catch {
+        cleanupFailed = true;
+      }
     }
-    if (interceptionState !== "not_started") {
-      cleanupTasks.push(
-        cleanup(
-          () =>
-            sendToCdpTarget(options.cdp, target, "Page.setInterceptFileChooserDialog", {
-              enabled: false,
-              cancel: true,
-            }),
+    if (interceptionArmed) {
+      try {
+        await waitBounded(
+          sendToCdpTarget(options.cdp, target, "Page.setInterceptFileChooserDialog", {
+            enabled: false,
+            cancel: true,
+          }),
+          Date.now() + CLEANUP_TIMEOUT_MS,
+          undefined,
           "disabling file chooser interception timed out",
-        ),
-      );
+        );
+      } catch {
+        cleanupFailed = true;
+      }
     }
-    let cleanupFailed = (await Promise.all(cleanupTasks)).some((completed) => !completed);
-    if (!cleanupFailed) {
-      cleanupFailed = !(await cleanup(
-        () => sendToCdpTarget(options.cdp, target, "Runtime.releaseObjectGroup", { objectGroup }),
+    try {
+      await waitBounded(
+        sendToCdpTarget(options.cdp, target, "Runtime.releaseObjectGroup", { objectGroup }),
+        Date.now() + CLEANUP_TIMEOUT_MS,
+        undefined,
         "releasing upload object group timed out",
-      ));
+      );
+    } catch {
+      cleanupFailed = true;
     }
 
     const effect = isRpcError(outcome)
       ? (outcome.data?.effect_state as TransferEffectState | undefined)
       : "committed";
     if (effect === "unknown" || cleanupFailed) {
-      try {
-        await waitBounded(
-          () => options.cdp.detach?.(target.tabId) ?? Promise.resolve(),
-          Date.now() + DETACH_TIMEOUT_MS,
-          undefined,
-          "detaching upload target timed out",
-        );
-      } catch {
-        cleanupFailed = true;
-      }
+      await options.cdp.detach?.(target.tabId);
     }
     if (cleanupFailed && isRpcError(outcome)) {
       outcome.data = { ...outcome.data, cleanup_state: "failed" };

apps/extension/src/tools/frame-geometry.ts

@@ -29,7 +29,10 @@ export interface NodeAddress {
 export interface ResolvedNodeGeometry {
   topVisibleRegions: Region;
   topBounds: ViewportRect;
+  /** Point in the top-level tab viewport, used by root-target input events. */
   actionPoint: Point;
+  /** Point in the addressed CDP target's viewport, used by OOPIF-local input events. */
+  targetActionPoint: Point;
 }
 
 function geometryError(message: string): RpcError {
@@ -262,11 +265,30 @@ export async function resolveNodeGeometry(
     if (isRpcError(localRegion)) return localRegion;
 
     let topVisibleRegions: Region;
+    let targetActionPoint: Point | null = null;
     if (address.frameId && graph) {
       const projection = await resolveFrameProjection(cdp, graph, address.frameId);
       if (!projection)
         return geometryError(`could not resolve frame geometry for ${address.frameId}`);
       topVisibleRegions = projectRegionToViewport(localRegion, projection);
+      if (address.target.sessionId) {
+        const localViewport = projection.edges[0]?.sourceViewport ?? projection.topViewport;
+        const localVisibleRegions = localRegion
+          .map((polygon) =>
+            clipPolygon(
+              polygon,
+              rectPolygon({
+                x: 0,
+                y: 0,
+                w: localViewport.width,
+                h: localViewport.height,
+              }),
+            ),
+          )
+          .filter((polygon) => polygon.length >= 3);
+        const localActionRegion = largestRegion(localVisibleRegions);
+        targetActionPoint = localActionRegion ? polygonCentroid(localActionRegion) : null;
+      }
     } else {
       const viewport = await targetViewport(cdp, address.target);
       if (!viewport) return geometryError("could not resolve top viewport geometry");
@@ -283,7 +305,11 @@ export async function resolveNodeGeometry(
     if (!topBounds || !actionPoint) {
       return { code: "permission_denied", message: "element not visible" };
     }
-    return { topVisibleRegions, topBounds, actionPoint };
+    if (address.target.sessionId && !targetActionPoint) {
+      return { code: "permission_denied", message: "element not visible in its target" };
+    }
+    targetActionPoint ??= actionPoint;
+    return { topVisibleRegions, topBounds, actionPoint, targetActionPoint };
   } catch (error) {
     return geometryError(error instanceof Error ? error.message : String(error));
   }

apps/extension/src/tools/observation.ts

@@ -17,7 +17,7 @@ import { ChromiumCdp } from "@/browser-driver/chromium-cdp";
 import type { CdpTarget } from "@/browser-driver/frame-graph";
 import {
   type CaptureSuppressSendToTab,
-  withOverlaysHiddenForCapture,
+  withExtensionOverlayHidden,
 } from "@/lib/capture-suppress-bridge";
 import type { SessionContext, SessionManager } from "@/session-manager/manager";
 import type {
@@ -324,7 +324,7 @@ export async function handleScreenshot(
       tabId: target.tabId,
       ...(node.cdpSessionId ? { sessionId: node.cdpSessionId } : {}),
     };
-    const captured = await withOverlaysHiddenForCapture(
+    const captured = await withExtensionOverlayHidden(
       target.tabId,
       () =>
         captureElementScreenshot(
@@ -356,7 +356,7 @@ export async function handleScreenshot(
     );
   }
 
-  const captured = await withOverlaysHiddenForCapture(
+  const captured = await withExtensionOverlayHidden(
     target.tabId,
     () => captureFullTabPng(deps, ctx, target, signal),
     deps.sendToTab,

apps/extension/src/tools/session.ts

@@ -2,6 +2,7 @@ import { type SessionManager, SessionStartCleanupError } from "@/session-manager
 import type { RpcError } from "@/transport/types";
 import { rpcError } from "./errors";
 import { clearRecordingForSession } from "./record";
+import type { ChromeTabsApi } from "./shared";
 import { isRpcError } from "./shared";
 import { returnBorrowedTab, type TabManagementDeps } from "./tabs";
 
@@ -73,6 +74,12 @@ export interface SessionStopResult {
   /** Tab ids whose return path failed; those entries remain borrowed so
    *  shutdown can be retried without closing the Agent Window. */
   return_failures?: Array<{ tab_id: number; code: string; message: string }>;
+  /**
+   * True when the Agent Window was *released* to the user (instead of being
+   * closed) because it still contained user-created tabs after the agent's own
+   * tabs were closed. Single-session scope.
+   */
+  window_released?: boolean;
 }
 
 export interface SessionStopDeps {
@@ -87,6 +94,13 @@ export interface SessionStopDeps {
    * without a real browser.
    */
   tabManagement?: TabManagementDeps;
+  /**
+   * Read-only Chrome tabs API used to *query* remaining tabs before deciding
+   * whether to release the window. Kept separate from `tabManagement.tabs`
+   * (a `TabMutationApi` that has no `query`) so the mutation interface stays
+   * pure. Tests can inject a fake `ChromeTabsApi` too.
+   */
+  tabsQuery?: ChromeTabsApi;
 }
 
 /**
@@ -152,8 +166,10 @@ export async function handleSessionStart(
  *      cleanly (review parity with M6).
  *   3. Detach CDP sessions the extension still holds for this
  *      session (no-op if M6/M7 didn't attach to any tab).
- *   4. Close the Agent Window. SessionManager.stop() removes the
- *      Chrome window and forgets the context.
+ *   4. Close the agent-created tabs and the home tab (design §3.2).
+ *   5. If any tab remains — those are user-created tabs — release the
+ *      window to the user (dropOnly) instead of closing it, so user
+ *      tabs survive. Otherwise close the window as before.
  *
  * Failures in step 1 keep the Agent Window open: a failed borrowed tab
  * may still be there, so closing the window would risk losing user
@@ -188,6 +204,8 @@ export async function handleSessionStop(
   const returnFailures: SessionStopResult["return_failures"] = [];
   const borrowedIds = Array.from(ctx.borrowedTabs.keys());
   for (const tabId of borrowedIds) {
+    // A close event may have removed this borrow while another tab returned.
+    if (!ctx.borrowedTabs.has(tabId)) continue;
     try {
       const tabManagement = {
         ...(deps.tabManagement ?? {}),
@@ -197,6 +215,7 @@ export async function handleSessionStop(
           ((windowId: number) => manager.findByWindowId(windowId) !== null),
       };
       const outcome = await returnBorrowedTab(ctx, tabId, tabManagement);
+      if (!ctx.borrowedTabs.has(tabId)) continue;
       if (typeof outcome === "object" && "code" in outcome) {
         console.warn(`[bsk session_stop] auto-return failed for tab ${tabId}`, outcome);
         returnFailures?.push({
@@ -209,6 +228,7 @@ export async function handleSessionStop(
         ctx.borrowedTabs.delete(tabId);
       }
     } catch (err) {
+      if (!ctx.borrowedTabs.has(tabId)) continue;
       const message = err instanceof Error ? err.message : String(err);
       console.warn(`[bsk session_stop] auto-return threw for tab ${tabId}: ${message}`);
       returnFailures?.push({
@@ -219,8 +239,15 @@ export async function handleSessionStop(
     }
   }
 
+  // A previously failed tab may have closed during a later return. Only
+  // confirmed close events remove borrows; ordinary move failures stay retryable.
+  const pendingReturnFailures = returnFailures.filter((failure) =>
+    ctx.borrowedTabs.has(failure.tab_id),
+  );
   if (deps.signal?.aborted) {
-    const nonCancelFailures = returnFailures?.filter((failure) => failure.code !== "cancelled");
+    const nonCancelFailures = pendingReturnFailures.filter(
+      (failure) => failure.code !== "cancelled",
+    );
     if (nonCancelFailures && nonCancelFailures.length > 0) {
       return {
         ...(returnedTabIds.length > 0 ? { returned_tab_ids: returnedTabIds } : {}),
@@ -232,8 +259,8 @@ export async function handleSessionStop(
 
   const result: SessionStopResult = {};
   if (returnedTabIds.length > 0) result.returned_tab_ids = returnedTabIds;
-  if (returnFailures && returnFailures.length > 0) {
-    result.return_failures = returnFailures;
+  if (pendingReturnFailures.length > 0) {
+    result.return_failures = pendingReturnFailures;
     // A failed return means at least one borrowed user tab may still be
     // inside the Agent Window. Keep the session/window alive so the user
     // can retry `bsk session stop` or explicitly `bsk tab return` after the
@@ -253,8 +280,66 @@ export async function handleSessionStop(
     return { code: "cancelled", message: "session_stop aborted before window close" };
   }
 
-  // Step 4: close the Agent Window and drop the context.
-  await manager.stop(params.session_id);
+  // Step 4: close every tab explicitly created by the agent, including the
+  // home tab. `tabsApi` is a
+  // TabMutationApi (remove only); `queryApi` is a separate read-only
+  // ChromeTabsApi. If neither is injected, we conservatively fall back to
+  // closing the window (see Step 5).
+  const tabsApi = deps.tabManagement?.tabs;
+  const queryApi = deps.tabsQuery;
+
+  if (tabsApi) {
+    // Close each agent-created tab that still exists.
+    const agentCreatedTabIds = Array.from(ctx.agentCreatedTabs);
+    for (const tabId of agentCreatedTabIds) {
+      try {
+        await tabsApi.remove(tabId);
+        ctx.agentCreatedTabs.delete(tabId);
+      } catch (err) {
+        // Tab may already be gone (closed by the user). Non-fatal.
+        console.warn(`[bsk session_stop] failed to close agent tab ${tabId}`, err);
+      }
+    }
+  }
+
+  // Step 5: decide whether to release (keep) the window or close it.
+  let shouldRelease = false;
+  if (queryApi) {
+    try {
+      const liveWindowTabs = await queryApi.query({ windowId: ctx.agentWindowId });
+      // Only genuine *user* tabs count toward keeping the window open.
+      // An agent tab that failed to close in Step 4 may still be present
+      // here; if we counted it as a reason to release (dropOnly), the
+      // window would be kept and that agent tab would leak (issue #57
+      // regression). Exclude any id still tracked in agentCreatedTabs.
+      const userTabs = liveWindowTabs.filter((t) => {
+        if (t.id === undefined) return false;
+        return !ctx.agentCreatedTabs.has(t.id);
+      });
+      const leakedAgentTabs = liveWindowTabs.filter(
+        (t) => t.id !== undefined && ctx.agentCreatedTabs.has(t.id),
+      );
+      if (leakedAgentTabs.length > 0) {
+        console.warn(
+          `[bsk session_stop] ${leakedAgentTabs.length} agent tab(s) failed to close; forcing window close instead of release`,
+          leakedAgentTabs.map((t) => t.id),
+        );
+      }
+      shouldRelease = userTabs.length > 0;
+    } catch {
+      // Query failed (e.g. window already gone) — conservatively close it.
+      shouldRelease = false;
+    }
+  }
+
+  if (shouldRelease) {
+    // Keep the window + its user tabs; only drop the session binding.
+    await manager.stop(params.session_id, { dropOnly: true });
+    result.window_released = true;
+  } else {
+    // Window is empty (or we couldn't verify state) — close it.
+    await manager.stop(params.session_id);
+  }
 
   return result;
 }

apps/extension/src/tools/tabs.ts

@@ -369,6 +369,7 @@ function buildCreateProps(
  * Returns the created tab on success, or an `RpcError` on failure.
  */
 async function createTabAndCleanup(
+  ctx: SessionContext,
   deps: TabManagementDeps,
   createProps: chrome.tabs.CreateProperties,
 ): Promise<CreatedChromeTab | RpcError> {
@@ -381,25 +382,28 @@ async function createTabAndCleanup(
       message: err instanceof Error ? err.message : String(err),
     };
   }
-  if (aborted(deps.signal, "tab_create")) {
-    // We already opened the tab; close it on abort so we don't leak.
-    if (typeof tab.id === "number") {
-      try {
-        await getTabsApi(deps).remove(tab.id);
-      } catch (cleanupErr) {
-        return rpcError(
-          "protocol_error",
-          "cleanup_failed",
-          `tab_create aborted but cleanup of tab ${tab.id} failed: ${describeError(cleanupErr)}`,
-          { resource_type: "tab", resource_id: tab.id },
-        );
-      }
-    }
-    return { code: "cancelled", message: "tab_create aborted" };
-  }
   if (typeof tab.id !== "number") {
     return { code: "protocol_error", message: "chrome.tabs.create returned no tab id" };
   }
+  // Claim the concrete id returned by Chrome. Ownership never depends on
+  // matching this request to an asynchronous onCreated event.
+  ctx.agentCreatedTabs.add(tab.id);
+  if (aborted(deps.signal, "tab_create")) {
+    try {
+      await getTabsApi(deps).remove(tab.id);
+      ctx.agentCreatedTabs.delete(tab.id);
+    } catch (cleanupErr) {
+      // Keep the claim when cleanup fails so session_stop can retry instead
+      // of releasing an agent-owned tab to the user.
+      return rpcError(
+        "protocol_error",
+        "cleanup_failed",
+        `tab_create aborted but cleanup of tab ${tab.id} failed: ${describeError(cleanupErr)}`,
+        { resource_type: "tab", resource_id: tab.id },
+      );
+    }
+    return { code: "cancelled", message: "tab_create aborted" };
+  }
   return { ...tab, id: tab.id };
 }
 
@@ -426,7 +430,7 @@ export async function handleTabCreate(
   const paramErr = validateTabCreateParams(params);
   if (paramErr) return paramErr;
 
-  const tab = await createTabAndCleanup(deps, buildCreateProps(ctx, params));
+  const tab = await createTabAndCleanup(ctx, deps, buildCreateProps(ctx, params));
   if (isRpcError(tab)) return tab;
 
   return {
@@ -526,6 +530,9 @@ export async function handleTabClose(
   }
   try {
     await getTabsApi(deps).remove(params.tab_id);
+    // Keep the tracking set accurate so session_stop won't try to close a
+    // tab that's already gone (design §3.1).
+    ctx.agentCreatedTabs.delete(params.tab_id);
   } catch (err) {
     return {
       code: "protocol_error",
@@ -753,13 +760,6 @@ async function executeBorrowCore(
   );
   if (moveErr) return moveErr;
 
-  // Best-effort activation — failure is non-fatal.
-  try {
-    await p.tabsApi.update(p.tabId, { active: true });
-  } catch (err) {
-    console.debug("[bsk tab_borrow] activate after move failed", err);
-  }
-
   return { originalWindowId, originalIndex };
 }
 
@@ -823,6 +823,12 @@ export async function handleTabBorrow(
         message: err instanceof Error ? err.message : String(err),
       };
     }
+    // Activate after commit so overlay/event observers see the tab as claimed.
+    try {
+      await tabsApi.update(params.tab_id, { active: true });
+    } catch (err) {
+      console.debug("[bsk tab_borrow] activate after move failed", err);
+    }
     return {
       tab_id: params.tab_id,
       original_window_id: coreResult.originalWindowId,

apps/extension/src/tools/transfer-transaction.ts

@@ -0,0 +1,42 @@
+// Shared time boundary for browser-side file-transfer transactions. Concrete
+// upload/download mechanisms own their state machines and effect semantics.
+
+export class BoundedWaitError extends Error {
+  constructor(
+    readonly kind: "timeout" | "aborted",
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+export function remainingMs(deadline: number): number {
+  return Math.max(0, deadline - Date.now());
+}
+
+export async function waitBounded<T>(
+  promise: Promise<T>,
+  deadline: number,
+  signal: AbortSignal | undefined,
+  timeoutMessage: string,
+): Promise<T> {
+  const remaining = remainingMs(deadline);
+  if (signal?.aborted) throw new BoundedWaitError("aborted", "file transfer aborted");
+  if (remaining === 0) throw new BoundedWaitError("timeout", timeoutMessage);
+
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let onAbort: (() => void) | undefined;
+  const boundary = new Promise<never>((_resolve, reject) => {
+    timer = setTimeout(() => reject(new BoundedWaitError("timeout", timeoutMessage)), remaining);
+    if (signal) {
+      onAbort = () => reject(new BoundedWaitError("aborted", "file transfer aborted"));
+      signal.addEventListener("abort", onAbort, { once: true });
+    }
+  });
+  try {
+    return await Promise.race([promise, boundary]);
+  } finally {
+    if (timer) clearTimeout(timer);
+    if (signal && onAbort) signal.removeEventListener("abort", onAbort);
+  }
+}

apps/extension/src/tools/upload.ts

@@ -2,8 +2,13 @@
 // target, then delegate the browser protocol transaction to the file-input
 // transaction module.
 
+import {
+  type CaptureSuppressSendToTab,
+  withExtensionOverlayHidden,
+} from "@/lib/capture-suppress-bridge";
 import type { SessionManager } from "@/session-manager/manager";
 import type { RpcError, UploadParams, UploadResult } from "@/transport/types";
+import { uploadThroughFileDrop } from "./file-drop-transaction";
 import { uploadThroughActivatedFileInput } from "./file-input-transaction";
 import { clickResolvedTarget, type InteractionDeps, resolveActionTarget } from "./interaction";
 import {
@@ -18,6 +23,7 @@ const DEFAULT_TIMEOUT_MS = 120_000;
 
 export interface UploadDeps extends InteractionDeps {
   cdp: CdpRunner;
+  sendToTab?: CaptureSuppressSendToTab;
 }
 
 export async function handleUpload(
@@ -41,19 +47,39 @@ export async function handleUpload(
   const address = await resolveActionTarget(deps.cdp, ctx, target, params, "upload");
   if (isRpcError(address)) return address;
   const timeoutMs = params.timeout_ms ?? DEFAULT_TIMEOUT_MS;
-  const transaction = await uploadThroughActivatedFileInput({
-    cdp: deps.cdp,
-    actionTarget: address,
-    files: params.files.map((file) => file.staged_path as string),
-    timeoutMs,
-    signal: deps.signal,
-    trigger: () => clickResolvedTarget(ctx, address, {}, deps),
-  });
-  if (isRpcError(transaction)) return transaction;
+  const files = params.files.map((file) => file.staged_path as string);
+  const mode = params.mode ?? "input";
+  let usedRef = address.usedRef;
+  let usedSelector = address.usedSelector;
+  if (mode === "drop") {
+    deps.cdp.trackSessionTab?.(ctx.sessionId, target.tabId);
+    const transaction = await uploadThroughFileDrop({
+      cdp: deps.cdp,
+      actionTarget: address,
+      files,
+      timeoutMs,
+      signal: deps.signal,
+      withOverlayHidden: (operation) =>
+        withExtensionOverlayHidden(target.tabId, operation, deps.sendToTab),
+    });
+    if (isRpcError(transaction)) return transaction;
+  } else {
+    const transaction = await uploadThroughActivatedFileInput({
+      cdp: deps.cdp,
+      actionTarget: address,
+      files,
+      timeoutMs,
+      signal: deps.signal,
+      trigger: () => clickResolvedTarget(ctx, address, {}, deps),
+    });
+    if (isRpcError(transaction)) return transaction;
+    usedRef = transaction.click.used_ref;
+    usedSelector = transaction.click.used_selector;
+  }
   return {
     tab_id: target.tabId,
-    used_ref: transaction.click.used_ref,
-    used_selector: transaction.click.used_selector,
+    used_ref: usedRef,
+    used_selector: usedSelector,
     file_names: params.files.map((file) => file.name),
   };
 }

apps/extension/src/tools/vom/__tests__/capture.test.ts

@@ -215,21 +215,29 @@ function makeCdp(snapshot: unknown) {
       if (method === "Runtime.evaluate") {
         return {
           result: {
-            value: {
-              controls: [
+            deepSerializedValue: {
+              type: "array",
+              value: [
                 {
-                  state: "filled",
-                  sensitive: true,
-                  defaultValue: "hunter2",
-                  value: "hunter2",
-                  placeholder: "secret",
+                  type: "array",
+                  value: [
+                    { type: "node", value: { backendNodeId: 13 } },
+                    {
+                      type: "string",
+                      value: JSON.stringify({
+                        state: "filled",
+                        sensitive: true,
+                        placeholder: "secret",
+                      }),
+                    },
+                  ],
                 },
               ],
-              childFrames: [],
             },
           },
         };
       }
+      if (method === "Runtime.releaseObjectGroup") return {};
       throw new Error(`unexpected ${method}`);
     }) as unknown as <T>(tabId: number, method: string, params?: object) => Promise<T>,
   };
@@ -273,8 +281,11 @@ describe("captureViewModel", () => {
     expect(cdp.send).toHaveBeenCalledWith(
       4,
       "Runtime.evaluate",
-      expect.objectContaining({ returnByValue: true }),
+      expect.objectContaining({
+        serializationOptions: expect.objectContaining({ serialization: "deep" }),
+      }),
     );
+    expect(cdp.send).toHaveBeenCalledWith(4, "Runtime.releaseObjectGroup", expect.anything());
     expect(cdp.send).not.toHaveBeenCalledWith(4, "DOM.resolveNode", expect.anything());
     expect(cdp.send).not.toHaveBeenCalledWith(4, "Runtime.callFunctionOn", expect.anything());
   });

apps/extension/src/tools/vom/__tests__/form-state.test.ts

@@ -0,0 +1,270 @@
+import { describe, expect, it, vi } from "vitest";
+import { type CdpRunner, cdpRunnerForTarget } from "../../shared";
+import { captureViewModel } from "../capture";
+
+interface Control {
+  id: number;
+  value: string;
+  type?: string;
+}
+
+function snapshot(groups: Control[][]) {
+  const strings: string[] = [];
+  const str = (value: string) => {
+    let index = strings.indexOf(value);
+    if (index < 0) index = strings.push(value) - 1;
+    return index;
+  };
+  const documents = groups.map((controls, groupIndex) => ({
+    frameId: `frame-${groupIndex}`,
+    nodes: {
+      parentIndex: [-1, 0, ...controls.map(() => 1)],
+      nodeName: [str("html"), str("body"), ...controls.map(() => str("input"))],
+      backendNodeId: [8000 + groupIndex * 2, 8001 + groupIndex * 2, ...controls.map((c) => c.id)],
+      attributes: [
+        [],
+        [],
+        ...controls.map((c) => [
+          str("type"),
+          str(c.type ?? "text"),
+          str("placeholder"),
+          str("snapshot placeholder"),
+        ]),
+      ],
+      inputValue: {
+        index: controls.map((_, i) => i + 2),
+        value: controls.map((c) => str(c.value)),
+      },
+      contentDocumentIndex: { index: [] as number[], value: [] as number[] },
+    },
+  }));
+  const root = documents[0].nodes;
+  for (let i = 1; i < documents.length; i++) {
+    root.contentDocumentIndex.index.push(root.backendNodeId.length);
+    root.contentDocumentIndex.value.push(i);
+    root.parentIndex.push(1);
+    root.nodeName.push(str("iframe"));
+    root.backendNodeId.push(9000 + i);
+    root.attributes.push([]);
+  }
+  return { strings, documents };
+}
+
+function state(value: string) {
+  return {
+    value,
+    defaultValue: "",
+    placeholder: "live placeholder",
+    state: value ? "filled" : "empty",
+    sensitive: false,
+  };
+}
+
+function reply(entries: Array<[number, unknown]>) {
+  return {
+    result: {
+      deepSerializedValue: {
+        type: "array",
+        value: entries.map(([backendNodeId, fields]) => ({
+          type: "array",
+          value: [
+            { type: "node", value: { backendNodeId } },
+            { type: "string", value: JSON.stringify(fields) },
+          ],
+        })),
+      },
+    },
+  };
+}
+
+function fakeCdp(groups: Control[][], evaluate: (params: Record<string, unknown>) => unknown) {
+  const snap = snapshot(groups);
+  const send = vi.fn(async (_tabId: number, method: string, params?: object) => {
+    if (method === "DOMSnapshot.captureSnapshot") return snap;
+    if (method === "Runtime.evaluate") return evaluate(params as Record<string, unknown>);
+    return {};
+  });
+  return { send, cdp: { send: send as CdpRunner["send"] } };
+}
+
+describe("form state identity", () => {
+  it("matches reordered controls by identity and preserves controls missing from the batch", async () => {
+    // The snapshot includes a shadow input. The runtime query skips it,
+    // encounters a new input, and sees the remaining inputs in a new order.
+    const { cdp } = fakeCdp(
+      [
+        [
+          { id: 10, value: "" },
+          { id: 11, value: "old email" },
+          { id: 12, value: "old city" },
+        ],
+      ],
+      () =>
+        reply([
+          [99, state("new control")],
+          [12, state("上海")],
+          [11, state("alice@example.com")],
+        ]),
+    );
+    const captured = await captureViewModel(cdp, 7);
+    expect(captured.nodes.find((n) => n.backendNodeId === 10)).toMatchObject({
+      formValue: "",
+      formState: "empty",
+      formPlaceholder: "snapshot placeholder",
+    });
+    expect(captured.nodes.find((n) => n.backendNodeId === 11)).toMatchObject({
+      formValue: "alice@example.com",
+    });
+    expect(captured.nodes.find((n) => n.backendNodeId === 12)).toMatchObject({ formValue: "上海" });
+    expect(captured.nodes.some((n) => n.backendNodeId === 99)).toBe(false);
+  });
+
+  it("does not shift state between frames when one frame is absent from the runtime batch", async () => {
+    const { cdp } = fakeCdp(
+      [
+        [],
+        [{ id: 11, value: "inaccessible frame" }],
+        [{ id: 21, value: "old second" }],
+        [{ id: 31, value: "old third" }],
+      ],
+      () =>
+        reply([
+          [31, state("third frame")],
+          [21, state("second frame")],
+        ]),
+    );
+    const captured = await captureViewModel(cdp, 7);
+    const controls = [...captured.iframeNodes.values()].flat();
+    expect(controls.find((n) => n.backendNodeId === 11)?.formValue).toBe("inaccessible frame");
+    expect(controls.find((n) => n.backendNodeId === 21)?.formValue).toBe("second frame");
+    expect(controls.find((n) => n.backendNodeId === 31)?.formValue).toBe("third frame");
+  });
+
+  it("keeps identical backend ids in different OOPIF targets separate", async () => {
+    const sendToTarget = vi.fn(async (target, method) => {
+      if (method === "DOMSnapshot.captureSnapshot") return snapshot([[{ id: 11, value: "old" }]]);
+      if (method === "Runtime.evaluate") return reply([[11, state(target.sessionId)]]);
+      return {};
+    });
+    const send = vi.fn(async () => {
+      throw new Error("unexpected top-level target");
+    });
+    const cdp = { send, sendToTarget } as unknown as CdpRunner;
+    for (const sessionId of ["left-frame", "right-frame"]) {
+      const captured = await captureViewModel(cdpRunnerForTarget(cdp, { tabId: 7, sessionId }), 7);
+      expect(captured.nodes.find((n) => n.backendNodeId === 11)?.formValue).toBe(sessionId);
+      expect(sendToTarget).toHaveBeenCalledWith(
+        { tabId: 7, sessionId },
+        "Runtime.releaseObjectGroup",
+        expect.anything(),
+      );
+    }
+    expect(send).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    "unsupported",
+    "legacy",
+    "malformed",
+    "invalid-state",
+  ])("preserves snapshot data when enrichment is %s", async (mode) => {
+    const { cdp, send } = fakeCdp([[{ id: 11, value: "snapshot value" }]], () => {
+      if (mode === "unsupported") throw new Error("serialization unsupported");
+      if (mode === "legacy") return { result: { value: { controls: [state("wrong value")] } } };
+      const result = reply([
+        [11, mode === "invalid-state" ? { value: "wrong value" } : state("wrong value")],
+      ]);
+      if (mode === "malformed")
+        result.result.deepSerializedValue.value[0].value[1].value = "not json";
+      return result;
+    });
+    const captured = await captureViewModel(cdp, 7);
+    expect(captured.nodes.find((n) => n.backendNodeId === 11)).toMatchObject({
+      formValue: "snapshot value",
+      formPlaceholder: "snapshot placeholder",
+    });
+    expect(send).toHaveBeenCalledWith(7, "Runtime.releaseObjectGroup", expect.anything());
+  });
+
+  it("releases the batch's remote objects when capture is cancelled", async () => {
+    const controller = new AbortController();
+    const { cdp, send } = fakeCdp([[{ id: 11, value: "old" }]], () => {
+      controller.abort();
+      return reply([[11, state("new")]]);
+    });
+    await expect(captureViewModel(cdp, 7, { signal: controller.signal })).rejects.toMatchObject({
+      name: "AbortError",
+    });
+    expect(send).toHaveBeenCalledWith(7, "Runtime.releaseObjectGroup", expect.anything());
+  });
+
+  it("skips entries without node identity while still applying valid entries", async () => {
+    const { cdp } = fakeCdp(
+      [
+        [
+          { id: 11, value: "snapshot value" },
+          { id: 12, value: "old value" },
+        ],
+      ],
+      () => {
+        const result = reply([
+          [11, state("wrong value")],
+          [12, state("live value")],
+        ]);
+        const element = result.result.deepSerializedValue.value[0].value[0];
+        delete (element.value as { backendNodeId?: number }).backendNodeId;
+        return result;
+      },
+    );
+    const captured = await captureViewModel(cdp, 7);
+    expect(captured.nodes.find((n) => n.backendNodeId === 11)?.formValue).toBe("snapshot value");
+    expect(captured.nodes.find((n) => n.backendNodeId === 12)?.formValue).toBe("live value");
+  });
+
+  it.each([
+    "password",
+    "text",
+  ])("redacts a sensitive %s control after identity matching", async (type) => {
+    const { cdp } = fakeCdp([[{ id: 11, value: "secret", type }]], () =>
+      reply([[11, { ...state("secret"), sensitive: true }]]),
+    );
+    const captured = await captureViewModel(cdp, 7);
+    const control = captured.nodes.find((n) => n.backendNodeId === 11);
+    expect(control?.formState).toBe("filled");
+    expect(control?.formValue).toBeUndefined();
+    expect(control?.formDefaultValue).toBeUndefined();
+    expect(control?.attrs.value).toBeUndefined();
+  });
+
+  it("keeps one bounded batch without per-control CDP queries", async () => {
+    const controls = Array.from({ length: 251 }, (_, i) => ({ id: i + 1, value: "old" }));
+    const elements = controls.map((c) => ({
+      backendNodeId: c.id,
+      tagName: "INPUT",
+      type: "text",
+      value: `live ${c.id}`,
+      defaultValue: "",
+      placeholder: "",
+    }));
+    const { cdp, send } = fakeCdp([controls], (params) => {
+      const doc = {
+        querySelectorAll: (selector: string) =>
+          selector === "input,textarea,select" ? elements : [],
+      };
+      const entries = new Function("document", `return ${params.expression}`)(doc) as Array<
+        [{ backendNodeId: number }, string]
+      >;
+      expect(entries).toHaveLength(250);
+      return reply(entries.map(([element, json]) => [element.backendNodeId, JSON.parse(json)]));
+    });
+    const captured = await captureViewModel(cdp, 7);
+    expect(captured.nodes.find((n) => n.backendNodeId === 250)?.formValue).toBe("live 250");
+    expect(captured.nodes.find((n) => n.backendNodeId === 251)?.formValue).toBe("old");
+    expect(send.mock.calls.filter(([, method]) => method === "Runtime.evaluate")).toHaveLength(1);
+    expect(
+      send.mock.calls.filter(([, method]) => method === "Runtime.releaseObjectGroup"),
+    ).toHaveLength(1);
+    expect(send).not.toHaveBeenCalledWith(7, "DOM.resolveNode", expect.anything());
+    expect(send).not.toHaveBeenCalledWith(7, "Runtime.callFunctionOn", expect.anything());
+  });
+});

apps/extension/src/tools/vom/capture.ts

@@ -190,9 +190,9 @@ interface CapturedFormState {
   sensitive?: boolean;
 }
 
-interface CapturedFrameFormState {
-  controls: CapturedFormState[];
-  childFrames: CapturedFrameFormState[];
+interface DeepSerializedValue {
+  type: string;
+  value?: unknown;
 }
 
 function formStateBatchExpression(maxControls: number): string {
@@ -215,43 +215,63 @@ function formStateBatchExpression(maxControls: number): string {
         ...(sensitive ? {} : { value: rawValue, defaultValue }),
       };
     };
+    const controls = [];
     const collect = (doc) => {
-      const controls = [];
       for (const el of Array.from(doc.querySelectorAll(controlSelector))) {
         if (remaining <= 0) break;
-        controls.push(controlState(el));
+        // Deep serialization supplies the node's backend id. Keep the
+        // state as JSON so decoding needs no general-purpose V8 deserializer.
+        controls.push([el, JSON.stringify(controlState(el))]);
         remaining -= 1;
       }
-      const childFrames = [];
       for (const frame of Array.from(doc.querySelectorAll("iframe"))) {
+        if (remaining <= 0) break;
         let childDoc = null;
         try { childDoc = frame.contentDocument; } catch { childDoc = null; }
-        childFrames.push(childDoc && remaining > 0 ? collect(childDoc) : { controls: [], childFrames: [] });
+        if (childDoc) collect(childDoc);
       }
-      return { controls, childFrames };
     };
-    return collect(document);
+    collect(document);
+    return controls;
   })()`;
 }
 
-function flattenFrameFormStates(
-  frame: CapturedFrameFormState | undefined,
-  out: CapturedFormState[][] = [],
-): CapturedFormState[][] {
-  if (!frame) return out;
-  out.push(Array.isArray(frame.controls) ? frame.controls : []);
-  for (const child of Array.isArray(frame.childFrames) ? frame.childFrames : []) {
-    flattenFrameFormStates(child, out);
+function formStatesByBackendId(result: RuntimeEvaluateReply): Map<number, CapturedFormState> {
+  const states = new Map<number, CapturedFormState>();
+  const serialized = result.result?.deepSerializedValue;
+  if (serialized?.type !== "array" || !Array.isArray(serialized.value)) return states;
+  for (const entry of serialized.value as DeepSerializedValue[]) {
+    if (entry?.type !== "array" || !Array.isArray(entry.value)) continue;
+    const [element, json] = entry.value as DeepSerializedValue[];
+    if (element?.type !== "node" || json?.type !== "string" || typeof json.value !== "string") {
+      continue;
+    }
+    const backendNodeId = (element.value as { backendNodeId?: number } | undefined)?.backendNodeId;
+    if (typeof backendNodeId !== "number" || !Number.isSafeInteger(backendNodeId)) continue;
+    try {
+      const state = JSON.parse(json.value) as CapturedFormState | null;
+      if (
+        !state ||
+        !["empty", "filled", "default"].includes(state.state ?? "") ||
+        typeof state.sensitive !== "boolean" ||
+        typeof state.placeholder !== "string" ||
+        (!state.sensitive &&
+          (typeof state.value !== "string" || typeof state.defaultValue !== "string"))
+      ) {
+        continue;
+      }
+      states.set(backendNodeId, state);
+    } catch {
+      // A malformed entry must not overwrite the snapshot's own state.
+    }
   }
-  return out;
+  return states;
 }
 
-function applyFormStates(nodes: CapturedNode[], states: CapturedFormState[]): void {
-  let index = 0;
+function applyFormStates(nodes: CapturedNode[], states: Map<number, CapturedFormState>): void {
   for (const node of nodes) {
     if (!isFormControlTag(node.tag)) continue;
-    const state = states[index];
-    index += 1;
+    const state = states.get(node.backendNodeId);
     if (!state) continue;
     node.formState = state.state;
     node.formPlaceholder = state.placeholder ?? "";
@@ -276,26 +296,37 @@ async function enrichFormControlStates(
     nodes.some((node) => isFormControlTag(node.tag)),
   );
   if (!hasControls) return;
+  const objectGroup = `bsk-vom-forms-${crypto.randomUUID()}`;
   try {
     throwIfAborted(signal);
     const result = await cdp.send<RuntimeEvaluateReply>(tabId, "Runtime.evaluate", {
       expression: formStateBatchExpression(MAX_FORM_ENRICH_CONTROLS),
-      returnByValue: true,
+      objectGroup,
+      serializationOptions: {
+        serialization: "deep",
+        maxDepth: 3,
+        additionalParameters: { maxNodeDepth: 0, includeShadowTree: "none" },
+      },
     });
     throwIfAborted(signal);
-    const frameStates = flattenFrameFormStates(runtimeValue<CapturedFrameFormState>(result));
-    for (let i = 0; i < frameNodeGroups.length; i += 1) {
-      applyFormStates(frameNodeGroups[i], frameStates[i] ?? []);
+    // Backend ids are scoped to this capture's CDP target. OOPIF targets
+    // use their own captureViewModel call and never share this lookup.
+    const states = formStatesByBackendId(result);
+    for (const nodes of frameNodeGroups) {
+      applyFormStates(nodes, states);
     }
   } catch (error) {
     if (isAbortError(error)) throw error;
     // Best-effort enrichment. DOMSnapshot/AX data still carries the nodes.
+  } finally {
+    await cdp.send(tabId, "Runtime.releaseObjectGroup", { objectGroup }).catch(() => undefined);
   }
 }
 
 interface RuntimeEvaluateReply {
   result?: {
     value?: unknown;
+    deepSerializedValue?: DeepSerializedValue;
   };
 }
 

apps/extension/src/transport/types.ts

@@ -36,6 +36,9 @@ export type RpcErrorReason =
   | "file_input_probe_failed"
   | "file_input_not_activated"
   | "set_file_input_failed"
+  | "upload_mechanism_unsupported"
+  | "file_drop_target_unavailable"
+  | "file_drop_failed"
   | "download_capture_failed"
   | "transfer_outcome_unknown"
   | "transfer_timeout"
@@ -523,12 +526,15 @@ export interface UploadFile {
   staged_path?: string;
 }
 
+export type UploadMode = "input" | "drop";
+
 export interface UploadParams {
   session_id: string;
   ref?: string;
   selector?: string;
   tab_id?: number;
   files: UploadFile[];
+  mode?: UploadMode;
   timeout_ms?: number;
 }
 

crates/bsk-cli/skill/SKILL.md

@@ -116,156 +116,15 @@ navigate   navigate-back   navigate-forward   reload   wait-for-navigation   wai
 observe   snapshot   get-html   screenshot   console   network
 click   hover   fill   select   press   evaluate
 tab list|create|close|select|borrow|return   window resize   emulate
-request-help   record start|stop
+upload   download   request-help   record start|stop
 ```
 
 Required flags that are easy to get wrong:
 
-### Tabs (require `--session <id>`)
-
-| Command | Summary |
-|---------|---------|
-| `bsk tab list` | List tabs (`--scope user\|agent\|all`, default `all`) |
-| `bsk tab create` | New tab in Agent Window (`--url`, `--no-active`, `--index`) |
-| `bsk tab close <tab-id>` | Close an agent tab |
-| `bsk tab select <tab-id>` | Focus an agent tab |
-| `bsk tab borrow <tab-id>` | Move a user tab into the Agent Window |
-| `bsk tab return <tab-id>` | Return a borrowed tab to its original window |
-
-### Observation (require `--session` unless noted)
-
-| Command | Summary |
-|---------|---------|
-| `bsk snapshot` | First-choice static page understanding: accessibility tree with `@eN` element refs |
-| `bsk observe` | Semantic VOM observation with bounded perception probes for conditional surfaces |
-| `bsk get-html` | Raw HTML dump after snapshot is insufficient (high token cost) |
-| `bsk screenshot` | PNG capture after snapshot is insufficient: full visible tab, or `--ref @eN` to crop to one element (`--out` path optional) |
-
-### Console & network debugging (read-only; require `--session`)
-
-| Command | Summary |
-|---------|---------|
-| `bsk console` | Buffered page console messages, JS exceptions, and browser log entries (`--include-stack` for stack traces) |
-| `bsk network` | Buffered network responses (status, method, URL, MIME/resource type) and failures (`net::ERR_*` reason) |
-
-Both capture from the moment the tab is attached and read a bounded per-tab buffer: `--since <seq>` pages from a cursor (`next_since` in the result), `--limit` (default 50, max 200), `--max-text-chars` (default 1000, max 4096), `--tab-id` to target a non-active tab. Both are strictly read-only — they never intercept or modify traffic, and request/response headers, bodies, and timings are not captured.
-
-### Navigation
-
-| Command | Summary |
-|---------|---------|
-| `bsk navigate <url>` | Go to URL in agent tab (`--wait-until`, `--timeout`) |
-| `bsk navigate-back` | History back one step |
-| `bsk navigate-forward` | History forward one step |
-| `bsk reload` | Reload current tab (`--hard` bypass cache) |
-
-(`bsk navigate back` / `bsk navigate forward` are equivalent subcommands.)
-
-### Interaction
-
-| Command | Summary |
-|---------|---------|
-| `bsk click <ref-or-selector>` | Click element (`--button`, `--click-count`, `--modifiers`) |
-| `bsk hover <ref-or-selector>` | Move the mouse to an element and wait for hover UI to settle (`--settle`, `--modifiers`) |
-| `bsk fill <ref-or-selector> --value <text>` | Clear and type into input |
-| `bsk select <ref-or-selector> --value <v>` | Set `<select>` option(s) by `value` (repeat `--value` for multi-select) |
-| `bsk press <key>` | Key/combo (`Enter`, `Ctrl+A`, …; optional `--ref` to focus first) |
-
-### File transfer (require `--session`)
-
-| Command | Summary |
-|---------|---------|
-| `bsk upload <ref-or-selector> --file <path>` | Click one upload trigger and attach an agent-readable local file (`--file` is repeatable) |
-| `bsk download <ref-or-selector> --out <path>` | Click one download trigger and copy the single completed file to an exact local path (`--overwrite` is opt-in) |
-
-The agent/harness decides whether a file transfer is appropriate and which local path belongs to the task. Treat upload as disclosure of that file to the current website, and download as accepting website-controlled bytes onto the local filesystem. Use only paths that are necessary for the user's bounded goal.
-
-BrowserSkill enforces the mechanical boundary: files are staged under a session-scoped opaque transfer, only daemon-minted capabilities reach the extension, upload/download still obey Agent Window tab checks, and transfers are chunk/size bounded. Upload intercepts the native chooser for one transaction, locates the input activated in the resolved target's document, and assigns only the staged file paths. Download uniquely correlates one exact-target browser intent with one Chrome download in either event order, routes it through a daemon-minted relative directory, and lets the daemon validate and import it. Upload staging remains available for a later form submission and is removed when the session ends. Downloads cannot overwrite an existing destination unless `--overwrite` is explicit. BrowserSkill does not inspect file content or decide whether its meaning is sensitive.
-
-Do not use `request-help` merely because a native file chooser or browser download is involved; try these commands first. For transfer failures, use the structured error instead of retrying blindly:
-
-- `reason=file_input_not_activated` means the requested click did not activate exactly one `<input type="file">`; the page may use a non-input picker such as `window.showOpenFilePicker()`. Do not retry blindly. If human help is available, call `request-help` and tell the user the exact original local path to choose. The staged daemon path is internal and must not be shown to the user.
-- `reason=file_input_probe_failed` means BrowserSkill could not safely establish the browser-side upload transaction. Do not repeat the same action; use `request-help` when available.
-- `reason=set_file_input_failed` means BrowserSkill found the activated file input but Chrome rejected the staged path or assignment. Check the extension's file-URL access permission; otherwise use `request-help`.
-- `reason=download_capture_failed` means BrowserSkill could not attribute exactly one completed download to the requested target. Do not retry blindly or accept an unrelated browser download; use `request-help` when available.
-- `effect_state=none` means BrowserSkill confirmed that no file-transfer effect was committed. Follow the accompanying reason; a corrected target or explicit human fallback may be attempted.
-- `effect_state=unknown` means the browser may already have attached or created the file. Do not repeat the transfer. Observe the page if that can establish the result; otherwise stop and report the uncertainty.
-- `effect_state=committed` means the browser-side effect occurred even if later completion or cleanup failed. Do not repeat it; continue only after verifying the resulting page/download state.
-
-If `request-help` returns `outcome="disabled"`, do not retry it. Stop gracefully and report the transfer mechanism that requires human intervention.
-
-### Scripting & timing
-
-| Command | Summary |
-|---------|---------|
-| `bsk evaluate <expression>` | Run JS in agent tab (see red lines). JS throw → stderr, **exit 0** (RPC success); use `--json` and check `.ok` to detect JS errors |
-| `bsk wait-for-navigation` | Block until load/DOM idle/etc. (`--wait-until`, `--timeout`) |
-| `bsk wait-ms <duration>` | Sleep (`500ms`, `2s`, `1m`; **no** `--session`) |
-
-### Ask the human for help — `bsk request-help`
-
-When a step needs a human (captcha, login, OTP) or you want the user to
-confirm an important action, pause and ask:
-
-    bsk request-help --session <id> --prompt "Solve the captcha, then click Done only after the site accepts it" \
-      --title "Captcha required" --target @e7 --target "#submit" --timeout 5m
-
-- `--prompt` (required): what the user should do.
-- `--title` (optional): custom title for the overlay panel. When omitted,
-  the extension shows its default localized title.
-- `--target` (repeatable): a snapshot ref (`@e7`) or CSS selector
-  (`#submit`) to scroll to and flash-highlight. **Strongly recommended** —
-  whenever the prompt refers to a concrete element (a button to click, a
-  field to fill, a checkbox to toggle), pass its `@eN` ref / selector so the
-  user is guided straight to the right spot instead of hunting for it. For
-  interaction scenarios, always include the relevant target(s); reserve a
-  prompt with no `--target` for cases where there is genuinely no specific
-  element to point at (e.g. "wait for the page to finish loading").
-- `--timeout` (default `5m`): how long to wait.
-- `--completion-criteria` (optional): JSON success detector. Use it only
-  when there is a concrete post-help success signal, e.g.
-  `{"any":[{"url_contains":"/dashboard"},{"selector_exists":"[data-testid='account-menu']"}],"stable_for_ms":1000}`.
-
-The target tab is brought to the foreground; the page stays interactive
-while the agent control mask is hidden. The call blocks until the user
-explicitly acts, the timeout expires, cancellation arrives, or explicit
-completion criteria match. Page reloads, SPA route changes, and captcha
-refreshes do not return control by themselves. The result `outcome` is one of:
-
-- `continued` — the user finished and clicked Done / return control (treat as confirm).
-- `cancelled` — the user clicked Cancel (treat as reject/abort).
-- `timed_out` — nobody acted within the timeout.
-- `completed` — the explicit `--completion-criteria` matched while the user had control.
-- `navigated` — deprecated legacy outcome. Do not rely on navigation as a completion signal.
-
-`note` carries any text the user typed back. `resolved_targets` reports
-which refs/selectors matched a live element.
-
-`request-help` does not refresh the page model after the user returns
-control. After a `continued` or `completed` result, issue a separate
-observation tool call (usually `bsk snapshot --session <id>`) before using
-new refs or reasoning about the post-help page state.
-#### Disabling request-help (unattended mode)
-Set `BSK_REQUEST_HELP=off` on unattended servers: `bsk request-help` then
-returns immediately with `outcome="disabled"` (no overlay, no waiting,
-exit 0). Any other value keeps it enabled. If you get `disabled`, do not
-retry — complete the task autonomously or stop gracefully.
-
-### Recording — `bsk record`
-
-Capture the user's own actions in the Agent Window to a **trace bundle**, for later LLM-driven automation. New CLI builds request **trace v3** (page observations + action chain); older extensions may still return **trace v2** (actions only), which the CLI exports as a single `trace.json` without `states/`.
-
-```bash
-bsk record start --browser <instance-id-or-label> \
-  [--url https://…] [--purpose "publish a wiki doc"] \
-  [--max-page-tokens 3000] [--redact-values] \
-  [--output trace]
-# `--url` is optional; default https://example.com/ when omitted (must be http(s)).
-# Blocks until the user clicks Finish in the recording panel, then writes:
-#   trace/trace.json    — action chain (+ state index when v3)
-#   trace/states/       — v3 only: one `sN.txt` observe snapshot per settled page state
-
-bsk record stop [--output trace]   # terminal fallback if the browser panel is unavailable
+```text
+bsk fill <ref> --value <text>      bsk select <ref> --value <option-value>
+bsk screenshot --out <path>        bsk emulate --device <preset-id>
+bsk upload <ref> --file <path>     bsk download <ref> --out <path>
 ```
 
 `select` matches an option's `value` attribute, not its visible label. Device preset ids are
@@ -280,6 +139,34 @@ lowercase and hyphenated, such as `iphone-14`.
 - `record` captures a user's actions for later replay. Read `bsk record start --help` before use,
   and never record banking, SSO, password-manager, or other sensitive pages.
 
+## File transfer
+
+`upload` and `download` stage files through the daemon; the agent never touches browser-internal
+paths. Treat upload as disclosure to the website, download as accepting website-controlled bytes.
+
+Upload has two independent mechanisms — choose explicitly, never rely on automatic fallback:
+
+- **Default (input mode):** for upload buttons, file-input labels, or "upload from computer"
+  actions. The command clicks the target and intercepts the native file chooser.
+- **`--mode drop`:** for reliably identified attachment-receiving areas — an explicit drop zone,
+  chat composer, email editor, or form attachment area. Do not target page whitespace, generic
+  containers, or areas whose attachment ownership is ambiguous.
+
+Decision sequence when uploading:
+
+1. Try input mode (the default).
+2. If it returns `reason=file_input_not_activated` with `effect_state=none`, re-observe. When a
+   reliable attachment target exists, try `--mode drop` once against that target.
+3. Otherwise fall back to `request-help`.
+4. **Never** switch mechanisms or repeat when `effect_state` is `unknown` or `committed` — the
+   browser may already have applied the file.
+
+A successful drop means Chrome dispatched the native file-drop event; it does not prove the site
+accepted the attachment. Observe the page once after the command.
+
+Download default-refuses to overwrite; pass `--overwrite` when replacing an existing file is
+intended. Read `bsk upload --help` and `bsk download --help` for all flags and error details.
+
 ## Recover without wandering
 
 - Stale ref: observe again and retry the intended action once.

crates/bsk-cli/src/cli/mod.rs

@@ -182,7 +182,7 @@ pub enum Command {
     /// Set `<select>` option values by `value` attribute.
     Select(SelectArgs),
 
-    /// Upload one or more local files through a page file chooser.
+    /// Upload files through a page file input or explicit drop target.
     Upload(UploadArgs),
 
     /// Capture one browser download and write it to a local path.

crates/bsk-cli/src/cli/render_error.rs

@@ -52,6 +52,9 @@ pub mod reason {
     pub const FILE_INPUT_PROBE_FAILED: &str = "file_input_probe_failed";
     pub const FILE_INPUT_NOT_ACTIVATED: &str = "file_input_not_activated";
     pub const SET_FILE_INPUT_FAILED: &str = "set_file_input_failed";
+    pub const UPLOAD_MECHANISM_UNSUPPORTED: &str = "upload_mechanism_unsupported";
+    pub const FILE_DROP_TARGET_UNAVAILABLE: &str = "file_drop_target_unavailable";
+    pub const FILE_DROP_FAILED: &str = "file_drop_failed";
     pub const DOWNLOAD_CAPTURE_FAILED: &str = "download_capture_failed";
     pub const TRANSFER_OUTCOME_UNKNOWN: &str = "transfer_outcome_unknown";
     pub const TRANSFER_TIMEOUT: &str = "transfer_timeout";
@@ -303,7 +306,7 @@ pub fn info_for_error(code: ErrorCode, data: Option<&serde_json::Value>) -> Rend
         (ErrorCode::Unsupported, reason::FILE_INPUT_NOT_ACTIVATED) => RenderInfo {
             summary: "the upload trigger did not activate a file input",
             hint: Some(
-                "the page may use a non-input picker such as showOpenFilePicker(); do not retry blindly — use `bsk request-help` with the exact original local path, or stop if human help is disabled",
+                "the page may use a non-input picker such as showOpenFilePicker(); when effect_state is none, re-observe and use `--mode drop` once only for a reliably identified attachment-receiving area — otherwise use `bsk request-help` with the exact original local path",
             ),
             exit_code: base.exit_code,
         },
@@ -323,6 +326,30 @@ pub fn info_for_error(code: ErrorCode, data: Option<&serde_json::Value>) -> Rend
             ),
             exit_code: base.exit_code,
         },
+        (ErrorCode::Unsupported, reason::UPLOAD_MECHANISM_UNSUPPORTED) => RenderInfo {
+            summary: "the browser does not support native file-drop upload",
+            hint: Some(
+                "do not retry the same drop; use a standard file-input target or `bsk request-help`",
+            ),
+            exit_code: base.exit_code,
+        },
+        (
+            ErrorCode::PermissionDenied | ErrorCode::Timeout | ErrorCode::CdpFailed,
+            reason::FILE_DROP_TARGET_UNAVAILABLE,
+        ) => RenderInfo {
+            summary: "the file-drop target could not be safely resolved",
+            hint: Some(
+                "rerun observe and select the attachment-receiving editor or drop zone itself; do not guess another target — no file was delivered when effect_state is none",
+            ),
+            exit_code: base.exit_code,
+        },
+        (ErrorCode::Timeout | ErrorCode::CdpFailed, reason::FILE_DROP_FAILED) => RenderInfo {
+            summary: "the browser could not complete the native file drop",
+            hint: Some(
+                "do not retry when effect_state is unknown; observe the page first, otherwise use `bsk request-help`",
+            ),
+            exit_code: base.exit_code,
+        },
         (ErrorCode::CdpFailed, reason::DOWNLOAD_CAPTURE_FAILED) => RenderInfo {
             summary: "the browser download could not be attributed or completed",
             hint: Some(
@@ -477,7 +504,10 @@ mod tests {
             info.summary,
             "the upload trigger did not activate a file input"
         );
-        assert!(info.hint.unwrap().contains("exact original local path"));
+        let hint = info.hint.unwrap();
+        assert!(hint.contains("--mode drop"));
+        assert!(hint.contains("reliably identified attachment-receiving area"));
+        assert!(hint.contains("exact original local path"));
 
         let control = serde_json::json!({ "reason": reason::FILE_INPUT_PROBE_FAILED });
         let info = info_for_error(ErrorCode::Timeout, Some(&control));
@@ -487,6 +517,29 @@ mod tests {
         );
         assert!(info.hint.unwrap().contains("do not retry"));
 
+        let unsupported_drop =
+            serde_json::json!({ "reason": reason::UPLOAD_MECHANISM_UNSUPPORTED });
+        let info = info_for_error(ErrorCode::Unsupported, Some(&unsupported_drop));
+        assert_eq!(
+            info.summary,
+            "the browser does not support native file-drop upload"
+        );
+        assert!(info.hint.unwrap().contains("standard file-input"));
+
+        let unavailable_target =
+            serde_json::json!({ "reason": reason::FILE_DROP_TARGET_UNAVAILABLE });
+        let info = info_for_error(ErrorCode::PermissionDenied, Some(&unavailable_target));
+        assert_eq!(
+            info.summary,
+            "the file-drop target could not be safely resolved"
+        );
+        assert!(info.hint.unwrap().contains("effect_state is none"));
+
+        let failed_drop = serde_json::json!({ "reason": reason::FILE_DROP_FAILED });
+        let info = info_for_error(ErrorCode::Timeout, Some(&failed_drop));
+        assert!(info.summary.contains("native file drop"));
+        assert!(info.hint.unwrap().contains("effect_state is unknown"));
+
         let download = serde_json::json!({ "reason": reason::DOWNLOAD_CAPTURE_FAILED });
         let info = info_for_error(ErrorCode::CdpFailed, Some(&download));
         assert!(info.summary.contains("download could not be attributed"));

crates/bsk-cli/src/cli/update.rs

@@ -761,6 +761,7 @@ fn stage_windows_replacement(
     .with_context(|| format!("write {}", paths.script_path.display()))?;
 
     const CREATE_NO_WINDOW: u32 = 0x0800_0000;
+    const CREATE_NEW_PROCESS_GROUP: u32 = 0x0000_0200;
     let command = format!("\"{}\"", paths.script_path.display());
     if let Err(err) = Command::new("cmd.exe")
         .args(["/D", "/S", "/C"])
@@ -768,7 +769,7 @@ fn stage_windows_replacement(
         .stdin(Stdio::null())
         .stdout(Stdio::null())
         .stderr(Stdio::null())
-        .creation_flags(CREATE_NO_WINDOW)
+        .creation_flags(CREATE_NO_WINDOW | CREATE_NEW_PROCESS_GROUP)
         .spawn()
     {
         let _ = std::fs::remove_file(&paths.binary_path);
@@ -806,7 +807,7 @@ fn windows_replacement_script(target: &Path, staged_binary: &Path, restart_daemo
          :retry\r\n\
          move /Y \"{staged_binary}\" \"{target}\" >nul 2>nul\r\n\
          if errorlevel 1 (\r\n\
-           timeout /t 1 /nobreak >nul\r\n\
+           ping -n 2 127.0.0.1 >nul\r\n\
            goto retry\r\n\
          )\r\n\
          {restart}\
@@ -1007,6 +1008,8 @@ mod tests {
 
         assert!(script.contains(":retry"));
         assert!(script.contains("move /Y"));
+        assert!(script.contains("ping -n 2 127.0.0.1"));
+        assert!(!script.contains("timeout"));
         assert!(script.contains(r#"start "" /B "C:\Program Files\bsk.exe" daemon start"#));
         assert!(script.contains(r#"del /F /Q "%~f0""#));
     }

crates/bsk-cli/src/cli/upload.rs

@@ -10,19 +10,35 @@ use base64::Engine;
 use bsk_protocol::Method;
 use bsk_protocol::tools::{
     TransferBeginParams, TransferBeginResult, TransferChunkParams, TransferChunkResult,
-    TransferIdParams, TransferReadyResult, TransferReleaseResult, UploadFile, UploadParams,
-    UploadResult,
+    TransferIdParams, TransferReadyResult, TransferReleaseResult, UploadFile, UploadMode,
+    UploadParams, UploadResult,
 };
-use clap::Args;
+use clap::{Args, ValueEnum};
 
 use crate::cli::ensure_daemon::ensure_daemon;
 use crate::cli::error::{CliError, Format};
 use crate::cli::interaction::split_target;
 use crate::cli::navigate::parse_timeout_ms;
 
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, ValueEnum)]
+pub enum UploadModeArg {
+    #[default]
+    Input,
+    Drop,
+}
+
+impl From<UploadModeArg> for UploadMode {
+    fn from(value: UploadModeArg) -> Self {
+        match value {
+            UploadModeArg::Input => Self::Input,
+            UploadModeArg::Drop => Self::Drop,
+        }
+    }
+}
+
 #[derive(Debug, Clone, Args)]
 pub struct UploadArgs {
-    /// Snapshot ref (`@e3`) or CSS selector for the file input / chooser trigger.
+    /// Snapshot ref (`@e3`) or CSS selector for the chooser trigger / drop target.
     pub target: Option<String>,
     #[arg(long = "ref")]
     pub ref_: Option<String>,
@@ -31,6 +47,9 @@ pub struct UploadArgs {
     /// Local file to upload. Repeat for a multiple-file input.
     #[arg(long = "file", required = true)]
     pub files: Vec<PathBuf>,
+    /// Browser mechanism used to deliver the staged files.
+    #[arg(long, value_enum, default_value_t)]
+    pub mode: UploadModeArg,
     #[arg(long)]
     pub session: String,
     #[arg(long = "tab-id")]
@@ -73,6 +92,7 @@ pub fn dispatch(args: UploadArgs, format: Format) -> Result<(), CliError> {
                 staged_path: None,
             })
             .collect(),
+        mode: args.mode.into(),
         timeout_ms: Some(args.timeout),
     };
     let result = crate::cli::business_rpc::call::<_, UploadResult>(

crates/bsk-cli/tests/cli_parse.rs

@@ -6,6 +6,7 @@ use bsk::cli::daemon::{DaemonCmd, parse_duration};
 use bsk::cli::navigate::NavigateCmd;
 use bsk::cli::record::{RecordCmd, RecordSub};
 use bsk::cli::session::{SessionCmd, SessionSub};
+use bsk::cli::upload::UploadModeArg;
 use bsk::{Cli, Command};
 use clap::Parser;
 
@@ -13,6 +14,54 @@ fn parse(args: &[&str]) -> Cli {
     Cli::try_parse_from(args).expect("clap parse should succeed")
 }
 
+#[test]
+fn parses_upload_modes() {
+    let cli = parse(&[
+        "bsk",
+        "upload",
+        "@e1",
+        "--file",
+        "image.png",
+        "--session",
+        "s1",
+    ]);
+    let Command::Upload(default_args) = cli.command else {
+        panic!("expected upload subcommand");
+    };
+    assert_eq!(default_args.mode, UploadModeArg::Input);
+
+    let cli = parse(&[
+        "bsk",
+        "upload",
+        "@e1",
+        "--file",
+        "image.png",
+        "--session",
+        "s1",
+        "--mode",
+        "drop",
+    ]);
+    let Command::Upload(drop_args) = cli.command else {
+        panic!("expected upload subcommand");
+    };
+    assert_eq!(drop_args.mode, UploadModeArg::Drop);
+
+    assert!(
+        Cli::try_parse_from([
+            "bsk",
+            "upload",
+            "@e1",
+            "--file",
+            "image.png",
+            "--session",
+            "s1",
+            "--mode",
+            "auto",
+        ])
+        .is_err()
+    );
+}
+
 #[test]
 fn parses_daemon_start_with_defaults() {
     let cli = parse(&["bsk", "daemon", "start"]);

crates/bsk-protocol/schema/tool_upload_params.json

@@ -13,6 +13,9 @@
         "$ref": "#/definitions/UploadFile"
       }
     },
+    "mode": {
+      "$ref": "#/definitions/UploadMode"
+    },
     "ref": {
       "type": [
         "string",
@@ -65,6 +68,13 @@
           "type": "string"
         }
       }
+    },
+    "UploadMode": {
+      "type": "string",
+      "enum": [
+        "input",
+        "drop"
+      ]
     }
   }
 }

crates/bsk-protocol/src/tools/file_transfer.rs

@@ -15,6 +15,20 @@ pub struct UploadFile {
     pub staged_path: Option<String>,
 }
 
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum UploadMode {
+    #[default]
+    Input,
+    Drop,
+}
+
+impl UploadMode {
+    fn is_input(&self) -> bool {
+        matches!(self, Self::Input)
+    }
+}
+
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
 pub struct UploadParams {
     pub session_id: String,
@@ -30,6 +44,8 @@ pub struct UploadParams {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub tab_id: Option<i64>,
     pub files: Vec<UploadFile>,
+    #[serde(default, skip_serializing_if = "UploadMode::is_input")]
+    pub mode: UploadMode,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub timeout_ms: Option<u32>,
 }
@@ -151,11 +167,32 @@ mod tests {
                 name: "image.png".into(),
                 staged_path: None,
             }],
+            mode: UploadMode::Input,
             timeout_ms: None,
         })
         .unwrap();
         assert_eq!(value["ref"], "@e3");
         assert!(value["files"][0].get("staged_path").is_none());
+        assert!(value.get("mode").is_none());
+    }
+
+    #[test]
+    fn upload_drop_mode_is_explicit_on_the_wire() {
+        let value = serde_json::to_value(UploadParams {
+            session_id: "s1".into(),
+            ref_: Some("@e3".into()),
+            selector: None,
+            tab_id: None,
+            files: vec![UploadFile {
+                transfer_id: "tr_1".into(),
+                name: "image.png".into(),
+                staged_path: None,
+            }],
+            mode: UploadMode::Drop,
+            timeout_ms: None,
+        })
+        .unwrap();
+        assert_eq!(value["mode"], "drop");
     }
 
     #[test]

docs/architecture.md

@@ -148,7 +148,7 @@ flowchart LR
 - The invoking agent/harness decides whether a transfer is authorized and supplies the task-local source or destination path.
 - The CLI is the only component that reads an upload source or writes the final download destination. Before browser dispatch it owns rollback of partially staged uploads; after dispatch, ownership moves to the session because a transport timeout cannot prove that Chrome did not attach the file. Download output becomes visible through one atomic commit, and replacement is opt-in without a pre-delete window. The extension never receives either agent-facing path.
 - The daemon is the authority for storage capabilities and limits. It issues opaque session-scoped transfer IDs, stages bounded chunks in a private runtime directory, and injects only private staged upload paths. For download it mints one relative Chrome directory capability. Only after validating the reported path, file type, symlink boundary, and authoritative byte limit does it take ownership of browser-file cleanup and import the bytes.
-- The extension owns only the browser transaction. Both tools resolve one `ResolvedActionTarget` and use that same target for protocol setup and the triggering click. Upload arms Chrome's chooser interception before clicking, then accepts either an exact `Page.fileChooserOpened` input node or an independent probe anchored in the trigger node's own document; one verified input is committed with `DOM.setFileInputFiles`. A non-input picker is rejected immediately as unsupported. Download correlates exact-target CDP intent and `chrome.downloads` filename candidates in either arrival order, claims only one unique match, and never cancels an unclaimed candidate.
+- The extension owns only the browser transaction. Every transfer resolves one `ResolvedActionTarget`. The default upload mechanism arms Chrome's chooser interception before clicking, then accepts either an exact `Page.fileChooserOpened` input node or an independent probe anchored in the trigger node's document; one verified input is committed with `DOM.setFileInputFiles`, while a non-input picker is rejected immediately. Explicit drop mode performs no click and never falls back to the chooser mechanism: after geometry resolution it temporarily excludes BrowserSkill's own overlay, verifies that the resolved drop zone still owns its local action point, and sends one native `dragEnter` / `dragOver` / `drop` transaction to that node's CDP target before restoring the overlay. OOPIF drops use target-local coordinates rather than top-level click coordinates. Download correlates exact-target CDP intent and `chrome.downloads` filename candidates in either arrival order, claims only one unique match, and never cancels an unclaimed candidate.
 - Browser-side operations report `effect_state` (`none`, `committed`, or `unknown`), `phase`, and `cleanup_state`. Confirmed success wins over a late cancel; an unknown effect is preserved across timeout or transport loss and must not be retried blindly. A transfer deadline sends cancellation to the extension and keeps the session queue occupied for bounded compensation rather than abandoning an in-flight browser effect.
 - Download staging is released after CLI commit. Upload staging remains until session teardown because the page may read an attached file only on a later form submission. Remaining staging is released on session stop/browser disconnect and on daemon startup after a crash. BrowserSkill does not inspect content or decide whether a transfer is appropriate.
 

packages/dsh-plugin-browserskill/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@wxg-prc-cpg/browser-skill-dsh-plugin",
   "description": "DeepSeek Harness tool plugin that exposes BrowserSkill browser automation (browser_* tools) to the model",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "license": "MIT",
   "publishConfig": {
     "access": "public",

packages/i18n/package.json

@@ -13,6 +13,10 @@
       "default": "./src/react.tsx"
     }
   },
+  "scripts": {
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
   "peerDependencies": {
     "react": "^19.0.0"
   },
@@ -20,5 +24,8 @@
     "i18next": "^24.2.2",
     "i18next-browser-languagedetector": "^8.0.2",
     "react-i18next": "^15.3.4"
+  },
+  "devDependencies": {
+    "vitest": "^4.1.6"
   }
 }

packages/i18n/src/chrome-storage-sync.ts

@@ -24,6 +24,9 @@ declare const chrome:
           ) => void;
         };
       };
+      i18n?: {
+        getUILanguage(): string;
+      };
     }
   | undefined;
 
@@ -31,14 +34,116 @@ function getChromeLocal(): ChromeStorageLocal | undefined {
   return typeof chrome !== "undefined" ? chrome.storage?.local : undefined;
 }
 
+/** Regions whose written Chinese defaults to Traditional. */
+const TRADITIONAL_CHINESE_REGIONS = new Set(["tw", "hk", "mo"]);
+
+/**
+ * Group resource keys by primary language subtag, so a bare `ko` can find
+ * `ko-KR` without anyone maintaining a side map by hand.
+ */
+function buildPrimarySubtagIndex(resourceKeys: string[]): Map<string, string[]> {
+  const index = new Map<string, string[]>();
+  for (const key of resourceKeys) {
+    const primary = key.split(/[-_]/)[0].toLowerCase();
+    const bucket = index.get(primary);
+    if (bucket) {
+      bucket.push(key);
+    } else {
+      index.set(primary, [key]);
+    }
+  }
+  return index;
+}
+
+/**
+ * Chinese is the one language where a single primary subtag maps to several
+ * resources, because Simplified and Traditional differ by script rather than
+ * by region. Every other language resolves straight from the index.
+ */
+function resolveChineseVariant(parts: string[], candidates: string[]): string {
+  const byRegion = (region: string): string | undefined =>
+    candidates.find((key) => key.toLowerCase().endsWith(`-${region}`));
+
+  // 1. Script subtag is the most accurate signal (zh-Hans / zh-Hant).
+  if (parts.includes("hans")) {
+    return byRegion("cn") ?? candidates[0];
+  }
+  if (parts.includes("hant")) {
+    return byRegion("tw") ?? candidates[candidates.length - 1];
+  }
+  // 2. Fall back to the region subtag, which is what Chrome actually reports.
+  //    Skip parts[0] — the primary subtag `zh` is also two characters long.
+  const region = parts.slice(1).find((part) => part.length === 2);
+  if (region && TRADITIONAL_CHINESE_REGIONS.has(region)) {
+    return byRegion("tw") ?? candidates[0];
+  }
+  // 3. Bare `zh` and any other region default to Simplified.
+  return byRegion("cn") ?? candidates[0];
+}
+
+/**
+ * Build a normalizer driven entirely by the resource keys i18next ships, so
+ * registering a new translation needs no change here.
+ *
+ * For a detected BCP 47 tag, in order:
+ *
+ * 1. it already names a resource (`ko-KR`)               → unchanged
+ * 2. one resource shares its language (`ko` → `ko-KR`)   → that resource
+ * 3. several do (`zh` → `zh-CN` / `zh-TW`)               → script, then region
+ * 4. nothing is shipped for the language                 → unchanged
+ *
+ * Case 4 leaves the tag untouched so i18next applies `fallbackLng`, rather
+ * than silently routing an untranslated language to the wrong bundle.
+ */
+export function createLanguageNormalizer(resourceKeys: string[]): (code: string) => string {
+  const keySet = new Set(resourceKeys);
+  const index = buildPrimarySubtagIndex(resourceKeys);
+
+  return (code: string): string => {
+    if (keySet.has(code)) {
+      return code;
+    }
+    const parts = code.split(/[-_]/).map((part) => part.toLowerCase());
+    const candidates = index.get(parts[0]);
+    if (!candidates?.length) {
+      return code;
+    }
+    if (candidates.length === 1) {
+      return candidates[0];
+    }
+    if (parts[0] === "zh") {
+      return resolveChineseVariant(parts, candidates);
+    }
+    return candidates[0];
+  };
+}
+
+/**
+ * i18next detector that prefers `chrome.i18n.getUILanguage()`, Chrome's
+ * authoritative source for the extension UI language. The popup runs on a
+ * `chrome-extension://` origin where `navigator.language` can disagree with it.
+ */
+export const chromeUiLanguageDetector = {
+  name: "chromeUILanguage",
+  lookup(): string | undefined {
+    if (typeof chrome !== "undefined" && chrome.i18n?.getUILanguage) {
+      return chrome.i18n.getUILanguage();
+    }
+    return undefined;
+  },
+};
+
 /** Avoid page-origin localStorage; use extension storage + navigator only. */
-export function getLanguageDetectionOptions(): {
+export function getLanguageDetectionOptions(resourceKeys: string[]): {
   order: string[];
   caches: string[];
+  convertDetectedLanguage: (lng: string) => string;
 } {
   return {
-    order: ["navigator"],
+    order: ["chromeUILanguage", "navigator"],
     caches: [],
+    // Normalise the detected tag before i18next resolves it against `resources`.
+    convertDetectedLanguage: createLanguageNormalizer(resourceKeys),
   };
 }
 

packages/i18n/src/i18n.ts

@@ -2,7 +2,11 @@ import i18n from "i18next";
 import LanguageDetector from "i18next-browser-languagedetector";
 import { initReactI18next } from "react-i18next";
 
-import { bindChromeStorageLanguageSync, getLanguageDetectionOptions } from "./chrome-storage-sync";
+import {
+  bindChromeStorageLanguageSync,
+  chromeUiLanguageDetector,
+  getLanguageDetectionOptions,
+} from "./chrome-storage-sync";
 import enUSCommon from "./locales/en-US/common.json";
 import enUSExtension from "./locales/en-US/extension.json";
 import zhCNCommon from "./locales/zh-CN/common.json";
@@ -19,12 +23,21 @@ const resources = {
   },
 } as const;
 
+const languageDetector = new LanguageDetector();
+languageDetector.addDetector(chromeUiLanguageDetector);
+
+// Drive locale normalisation off the keys we actually ship, so registering a
+// translation is the only step needed to support a new language.
+const resourceKeys = Object.keys(resources);
+
 i18n
-  .use(LanguageDetector)
+  .use(languageDetector)
   .use(initReactI18next)
   .init({
     resources,
-    fallbackLng: "zh-CN",
+    // English is the international default; Chinese users still get Chinese.
+    // `zh` → zh-CN also covers zh-TW/zh-HK until a Traditional resource exists.
+    fallbackLng: { en: ["en-US"], zh: ["zh-CN"], default: ["en-US"] },
     defaultNS: "common",
     ns: ["common", "extension"],
 
@@ -32,7 +45,7 @@ i18n
       escapeValue: false,
     },
 
-    detection: getLanguageDetectionOptions(),
+    detection: getLanguageDetectionOptions(resourceKeys),
 
     react: {
       useSuspense: false,

packages/i18n/tests/locale-resolution.test.ts

@@ -0,0 +1,126 @@
+import { describe, expect, it, vi } from "vitest";
+import {
+  chromeUiLanguageDetector,
+  createLanguageNormalizer,
+  getLanguageDetectionOptions,
+} from "../src/chrome-storage-sync";
+
+/** What `packages/i18n` ships today — kept in sync with `resources` in i18n.ts. */
+const SHIPPED_RESOURCE_KEYS = ["zh-CN", "en-US"];
+
+/**
+ * Locks the locale-resolution table from issue #168: the UI must follow the
+ * browser language instead of falling through to Chinese for every locale
+ * other than `en-US`.
+ */
+describe("createLanguageNormalizer", () => {
+  const normalize = createLanguageNormalizer(SHIPPED_RESOURCE_KEYS);
+
+  const cases: Array<[detected: string, resource: string]> = [
+    // English — every variant maps to the single en-US resource.
+    ["en", "en-US"],
+    ["en-US", "en-US"],
+    ["en-GB", "en-US"],
+    ["en-CN", "en-US"],
+    ["en-AU", "en-US"],
+
+    // Chinese — only `zh-CN` ships today, so every variant resolves to it
+    // directly rather than leaking into the fallback chain. Traditional picks
+    // up `zh-TW` automatically once that bundle is registered (see below).
+    ["zh", "zh-CN"],
+    ["zh-CN", "zh-CN"],
+    ["zh-SG", "zh-CN"],
+    ["zh-Hans", "zh-CN"],
+    ["zh-Hans-CN", "zh-CN"],
+    ["zh-Hans-SG", "zh-CN"],
+    ["zh-TW", "zh-CN"],
+    ["zh-HK", "zh-CN"],
+    ["zh-MO", "zh-CN"],
+    ["zh-Hant", "zh-CN"],
+    ["zh-Hant-TW", "zh-CN"],
+    ["zh-Hant-HK", "zh-CN"],
+
+    // No translation shipped — returned unchanged so i18next applies the
+    // `default` fallback (en-US) rather than Chinese.
+    ["ja", "ja"],
+    ["ja-JP", "ja-JP"],
+    ["fr-FR", "fr-FR"],
+    ["de-DE", "de-DE"],
+  ];
+
+  it.each(cases)("maps %s to %s", (detected, resource) => {
+    expect(normalize(detected)).toBe(resource);
+  });
+
+  it("is case-insensitive", () => {
+    expect(normalize("EN-us")).toBe("en-US");
+    expect(normalize("zh-hant-tw")).toBe("zh-CN");
+  });
+});
+
+/**
+ * The point of the factory: supporting a new language means registering its
+ * bundle in `resources` — never touching the normalizer.
+ */
+describe("createLanguageNormalizer extensibility", () => {
+  it("auto-resolves a newly registered language", () => {
+    const normalize = createLanguageNormalizer(["en-US", "zh-CN", "ko-KR"]);
+    expect(normalize("ko")).toBe("ko-KR");
+    expect(normalize("ko-KR")).toBe("ko-KR");
+  });
+
+  it("disambiguates zh once a Traditional bundle ships", () => {
+    const normalize = createLanguageNormalizer(["en-US", "zh-CN", "zh-TW"]);
+    expect(normalize("zh-Hant")).toBe("zh-TW");
+    expect(normalize("zh-Hant-TW")).toBe("zh-TW");
+    expect(normalize("zh-TW")).toBe("zh-TW");
+    expect(normalize("zh-HK")).toBe("zh-TW");
+    expect(normalize("zh-MO")).toBe("zh-TW");
+    expect(normalize("zh-Hans")).toBe("zh-CN");
+    expect(normalize("zh-CN")).toBe("zh-CN");
+    expect(normalize("zh")).toBe("zh-CN");
+  });
+
+  it("leaves unregistered languages to fallbackLng", () => {
+    const normalize = createLanguageNormalizer(["en-US", "zh-CN"]);
+    expect(normalize("pt-BR")).toBe("pt-BR");
+    expect(normalize("ru")).toBe("ru");
+  });
+});
+
+describe("chromeUiLanguageDetector", () => {
+  it("prefers chrome.i18n.getUILanguage() when available", () => {
+    vi.stubGlobal("chrome", { i18n: { getUILanguage: () => "en-GB" } });
+    expect(chromeUiLanguageDetector.lookup()).toBe("en-GB");
+  });
+
+  it("returns undefined outside a Chrome extension context", () => {
+    vi.stubGlobal("chrome", undefined);
+    expect(chromeUiLanguageDetector.lookup()).toBeUndefined();
+  });
+
+  it("returns undefined when the i18n API is unavailable", () => {
+    vi.stubGlobal("chrome", {});
+    expect(chromeUiLanguageDetector.lookup()).toBeUndefined();
+  });
+});
+
+describe("getLanguageDetectionOptions", () => {
+  it("orders the Chrome UI language ahead of navigator", () => {
+    expect(getLanguageDetectionOptions(SHIPPED_RESOURCE_KEYS).order).toEqual([
+      "chromeUILanguage",
+      "navigator",
+    ]);
+  });
+
+  it("normalises whatever the detectors report", () => {
+    const { convertDetectedLanguage } = getLanguageDetectionOptions(SHIPPED_RESOURCE_KEYS);
+    expect(convertDetectedLanguage("en-GB")).toBe("en-US");
+    expect(convertDetectedLanguage("zh-TW")).toBe("zh-CN");
+    expect(convertDetectedLanguage("ja-JP")).toBe("ja-JP");
+  });
+
+  it("does not write to page-origin storage", () => {
+    expect(getLanguageDetectionOptions(SHIPPED_RESOURCE_KEYS).caches).toEqual([]);
+  });
+});

packages/i18n/vitest.config.ts

@@ -0,0 +1,8 @@
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    environment: "node",
+    include: ["tests/**/*.test.ts"],
+  },
+});

pnpm-lock.yaml

@@ -189,6 +189,10 @@ importers:
       react-i18next:
         specifier: ^15.3.4
         version: 15.7.4(i18next@24.2.3(typescript@5.9.3))(react@19.2.6)(typescript@5.9.3)
+    devDependencies:
+      vitest:
+        specifier: ^4.1.6
+        version: 4.1.6(@types/node@25.8.0)(happy-dom@15.11.7)(vite@8.0.13(@types/node@25.8.0)(esbuild@0.27.7)(jiti@2.7.0))
 
   packages/ui:
     dependencies:

scripts/release.mjs

@@ -0,0 +1,299 @@
+#!/usr/bin/env node
+/**
+ * Unified release script for BrowserSkill.
+ *
+ * Bumps CLI, Extension, and DSH Plugin to the same version, updates
+ * CHANGELOG.md, commits, tags, and optionally pushes.
+ *
+ * Usage:
+ *   node scripts/release.mjs <version>                  # bump + commit + tag
+ *   node scripts/release.mjs <version> --dry-run        # preview changes only
+ *   node scripts/release.mjs <version> --push           # also push to origin
+ *   node scripts/release.mjs <version> --push --only ext          # push only ext tag
+ *   node scripts/release.mjs <version> --push --only cli,dsh      # push only cli + dsh tags
+ *   node scripts/release.mjs --push-tags --only ext     # push tag(s) for an already-committed release
+ *
+ * Options:
+ *   --dry-run      Show what would change without writing anything
+ *   --push         After commit+tag, push the branch and all release tags
+ *   --push-tags    Push release tags only (skip version bump; useful for staged rollout)
+ *   --only <list>  Comma-separated subset of: cli, ext, dsh  (default: all three)
+ *   --no-commit    Write files but skip git commit and tagging
+ */
+
+import { execSync } from "node:child_process";
+import { readFileSync, writeFileSync } from "node:fs";
+import { parseArgs } from "node:util";
+
+const TAG_PREFIX = { cli: "cli-v", ext: "ext-v", dsh: "dsh-plugin-v" };
+const ALL_COMPONENTS = ["cli", "ext", "dsh"];
+
+const VERSION_FILES = {
+  cargo: "Cargo.toml",
+  extension: "apps/extension/package.json",
+  dshPlugin: "packages/dsh-plugin-browserskill/package.json",
+};
+
+// ---------------------------------------------------------------------------
+// CLI argument parsing
+// ---------------------------------------------------------------------------
+
+const { values, positionals } = parseArgs({
+  allowPositionals: true,
+  options: {
+    "dry-run": { type: "boolean", default: false },
+    push: { type: "boolean", default: false },
+    "push-tags": { type: "boolean", default: false },
+    "no-commit": { type: "boolean", default: false },
+    only: { type: "string", default: "" },
+    help: { type: "boolean", short: "h", default: false },
+  },
+});
+
+if (values.help) {
+  console.log(
+    readFileSync(new URL(import.meta.url), "utf8").match(/\/\*\*([\s\S]*?)\*\//)?.[1] ?? "",
+  );
+  process.exit(0);
+}
+
+const dryRun = values["dry-run"];
+const pushAfter = values.push;
+const pushTagsOnly = values["push-tags"];
+const noCommit = values["no-commit"];
+const onlyRaw = values.only;
+const components = onlyRaw ? onlyRaw.split(",").map((s) => s.trim().toLowerCase()) : ALL_COMPONENTS;
+
+for (const c of components) {
+  if (!ALL_COMPONENTS.includes(c)) {
+    console.error(`Unknown component "${c}". Valid: ${ALL_COMPONENTS.join(", ")}`);
+    process.exit(1);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Push-tags-only mode (no version bump)
+// ---------------------------------------------------------------------------
+
+if (pushTagsOnly) {
+  const currentVersion = readCurrentVersions();
+  const ver = positionals[0] ?? currentVersion.cargo;
+  for (const c of components) {
+    const tag = `${TAG_PREFIX[c]}${ver}`;
+    console.log(`  pushing tag ${tag}`);
+    if (!dryRun) {
+      run(`git push origin ${tag}`);
+    }
+  }
+  console.log("\nDone.");
+  process.exit(0);
+}
+
+// ---------------------------------------------------------------------------
+// Normal mode — require version argument
+// ---------------------------------------------------------------------------
+
+const newVersion = positionals[0];
+if (!newVersion) {
+  console.error(
+    "Usage: node scripts/release.mjs <version> [--dry-run] [--push] [--only cli,ext,dsh]",
+  );
+  process.exit(1);
+}
+
+if (!/^\d+\.\d+\.\d+(-[\w.]+)?$/.test(newVersion)) {
+  console.error(`Invalid semver: "${newVersion}"`);
+  process.exit(1);
+}
+
+// ---------------------------------------------------------------------------
+// Read current versions
+// ---------------------------------------------------------------------------
+
+function readCurrentVersions() {
+  const cargo = readFileSync(VERSION_FILES.cargo, "utf8");
+  const cargoVer =
+    cargo.match(/^\[workspace\.package\]\s*\nversion\s*=\s*"([^"]+)"/m)?.[1] ??
+    cargo.match(/^version\s*=\s*"([^"]+)"/m)?.[1];
+
+  const extPkg = JSON.parse(readFileSync(VERSION_FILES.extension, "utf8"));
+  const dshPkg = JSON.parse(readFileSync(VERSION_FILES.dshPlugin, "utf8"));
+
+  return { cargo: cargoVer, extension: extPkg.version, dshPlugin: dshPkg.version };
+}
+
+const current = readCurrentVersions();
+
+console.log("Current versions:");
+console.log(`  CLI/Daemon (Cargo.toml):         ${current.cargo}`);
+console.log(`  Extension (package.json):         ${current.extension}`);
+console.log(`  DSH Plugin (package.json):        ${current.dshPlugin}`);
+console.log(`\nBumping all → ${newVersion}`);
+if (dryRun) console.log("  (dry-run mode — no files will be written)\n");
+
+// ---------------------------------------------------------------------------
+// Bump Cargo.toml
+// ---------------------------------------------------------------------------
+
+function bumpCargo(version) {
+  let content = readFileSync(VERSION_FILES.cargo, "utf8");
+
+  // workspace.package version
+  content = content.replace(
+    /^(\[workspace\.package\]\s*\nversion\s*=\s*")([^"]+)(")/m,
+    `$1${version}$3`,
+  );
+
+  // workspace.dependencies.bsk-protocol version (for cargo publish)
+  content = content.replace(
+    /(bsk-protocol\s*=\s*\{\s*version\s*=\s*")([^"]+)(")/,
+    `$1${version}$3`,
+  );
+
+  return content;
+}
+
+function bumpPackageJson(filePath, version) {
+  const pkg = JSON.parse(readFileSync(filePath, "utf8"));
+  pkg.version = version;
+  return JSON.stringify(pkg, null, 2) + "\n";
+}
+
+// ---------------------------------------------------------------------------
+// Update CHANGELOG.md
+// ---------------------------------------------------------------------------
+
+function updateChangelog(version) {
+  const changelogPath = "CHANGELOG.md";
+  let content;
+  try {
+    content = readFileSync(changelogPath, "utf8");
+  } catch {
+    return null;
+  }
+
+  const today = new Date().toISOString().slice(0, 10);
+  const escapedVer = version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+  // First: fill in any date-placeholder line for this version (e.g. "## [0.2.0] - 2026-09-XX")
+  const versionPlaceholder = new RegExp(`^## \\[${escapedVer}\\]\\s*-\\s*\\d{4}-\\d{2}-XX`, "m");
+  if (versionPlaceholder.test(content)) {
+    content = content.replace(versionPlaceholder, `## [${version}] - ${today}`);
+  } else {
+    // Otherwise: insert a new section after [Unreleased]
+    const unreleased = /^## \[Unreleased\]/m;
+    if (unreleased.test(content)) {
+      content = content.replace(unreleased, `## [Unreleased]\n\n## [${version}] - ${today}`);
+    }
+  }
+
+  return { path: changelogPath, content };
+}
+
+// ---------------------------------------------------------------------------
+// Write files
+// ---------------------------------------------------------------------------
+
+const writes = [
+  { path: VERSION_FILES.cargo, content: bumpCargo(newVersion), label: "Cargo.toml" },
+  {
+    path: VERSION_FILES.extension,
+    content: bumpPackageJson(VERSION_FILES.extension, newVersion),
+    label: "Extension package.json",
+  },
+  {
+    path: VERSION_FILES.dshPlugin,
+    content: bumpPackageJson(VERSION_FILES.dshPlugin, newVersion),
+    label: "DSH Plugin package.json",
+  },
+];
+
+const changelogUpdate = updateChangelog(newVersion);
+if (changelogUpdate) {
+  writes.push({
+    path: changelogUpdate.path,
+    content: changelogUpdate.content,
+    label: "CHANGELOG.md",
+  });
+}
+
+for (const w of writes) {
+  console.log(`  ✓ ${w.label}`);
+  if (!dryRun) {
+    writeFileSync(w.path, w.content);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Update Cargo.lock (cargo check triggers it)
+// ---------------------------------------------------------------------------
+
+if (!dryRun) {
+  console.log("\n  Updating Cargo.lock...");
+  run("cargo check --workspace 2>&1 || true");
+}
+
+// ---------------------------------------------------------------------------
+// Git commit + tag
+// ---------------------------------------------------------------------------
+
+if (noCommit || dryRun) {
+  if (dryRun) {
+    console.log(`\nWould commit: "chore(release): ${newVersion}"`);
+    console.log("Would create tags:");
+    for (const c of components) {
+      console.log(`  ${TAG_PREFIX[c]}${newVersion}`);
+    }
+  }
+  console.log("\nDone.");
+  process.exit(0);
+}
+
+console.log("\nCommitting...");
+run(
+  "git add Cargo.toml Cargo.lock apps/extension/package.json packages/dsh-plugin-browserskill/package.json CHANGELOG.md 2>/dev/null || true",
+);
+run(`git commit -m "chore(release): ${newVersion}"`);
+
+console.log("Tagging...");
+for (const c of components) {
+  const tag = `${TAG_PREFIX[c]}${newVersion}`;
+  run(`git tag ${tag}`);
+  console.log(`  ✓ ${tag}`);
+}
+
+// ---------------------------------------------------------------------------
+// Push (optional)
+// ---------------------------------------------------------------------------
+
+if (pushAfter) {
+  console.log("\nPushing...");
+  run("git push origin HEAD");
+  for (const c of components) {
+    const tag = `${TAG_PREFIX[c]}${newVersion}`;
+    console.log(`  pushing tag ${tag}`);
+    run(`git push origin ${tag}`);
+  }
+}
+
+console.log(`\nRelease ${newVersion} prepared successfully.`);
+if (!pushAfter) {
+  console.log("\nNext steps:");
+  console.log("  # Push branch");
+  console.log("  git push origin main");
+  console.log("");
+  console.log("  # Push extension tag first (store review takes time)");
+  console.log(`  git push origin ext-v${newVersion}`);
+  console.log("");
+  console.log("  # Then push CLI and DSH plugin tags");
+  console.log(`  git push origin cli-v${newVersion}`);
+  console.log(`  git push origin dsh-plugin-v${newVersion}`);
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function run(cmd) {
+  execSync(cmd, { stdio: "inherit" });
+}

skill/SKILL.md

@@ -116,156 +116,15 @@ navigate   navigate-back   navigate-forward   reload   wait-for-navigation   wai
 observe   snapshot   get-html   screenshot   console   network
 click   hover   fill   select   press   evaluate
 tab list|create|close|select|borrow|return   window resize   emulate
-request-help   record start|stop
+upload   download   request-help   record start|stop
 ```
 
 Required flags that are easy to get wrong:
 
-### Tabs (require `--session <id>`)
-
-| Command | Summary |
-|---------|---------|
-| `bsk tab list` | List tabs (`--scope user\|agent\|all`, default `all`) |
-| `bsk tab create` | New tab in Agent Window (`--url`, `--no-active`, `--index`) |
-| `bsk tab close <tab-id>` | Close an agent tab |
-| `bsk tab select <tab-id>` | Focus an agent tab |
-| `bsk tab borrow <tab-id>` | Move a user tab into the Agent Window |
-| `bsk tab return <tab-id>` | Return a borrowed tab to its original window |
-
-### Observation (require `--session` unless noted)
-
-| Command | Summary |
-|---------|---------|
-| `bsk snapshot` | First-choice static page understanding: accessibility tree with `@eN` element refs |
-| `bsk observe` | Semantic VOM observation with bounded perception probes for conditional surfaces |
-| `bsk get-html` | Raw HTML dump after snapshot is insufficient (high token cost) |
-| `bsk screenshot` | PNG capture after snapshot is insufficient: full visible tab, or `--ref @eN` to crop to one element (`--out` path optional) |
-
-### Console & network debugging (read-only; require `--session`)
-
-| Command | Summary |
-|---------|---------|
-| `bsk console` | Buffered page console messages, JS exceptions, and browser log entries (`--include-stack` for stack traces) |
-| `bsk network` | Buffered network responses (status, method, URL, MIME/resource type) and failures (`net::ERR_*` reason) |
-
-Both capture from the moment the tab is attached and read a bounded per-tab buffer: `--since <seq>` pages from a cursor (`next_since` in the result), `--limit` (default 50, max 200), `--max-text-chars` (default 1000, max 4096), `--tab-id` to target a non-active tab. Both are strictly read-only — they never intercept or modify traffic, and request/response headers, bodies, and timings are not captured.
-
-### Navigation
-
-| Command | Summary |
-|---------|---------|
-| `bsk navigate <url>` | Go to URL in agent tab (`--wait-until`, `--timeout`) |
-| `bsk navigate-back` | History back one step |
-| `bsk navigate-forward` | History forward one step |
-| `bsk reload` | Reload current tab (`--hard` bypass cache) |
-
-(`bsk navigate back` / `bsk navigate forward` are equivalent subcommands.)
-
-### Interaction
-
-| Command | Summary |
-|---------|---------|
-| `bsk click <ref-or-selector>` | Click element (`--button`, `--click-count`, `--modifiers`) |
-| `bsk hover <ref-or-selector>` | Move the mouse to an element and wait for hover UI to settle (`--settle`, `--modifiers`) |
-| `bsk fill <ref-or-selector> --value <text>` | Clear and type into input |
-| `bsk select <ref-or-selector> --value <v>` | Set `<select>` option(s) by `value` (repeat `--value` for multi-select) |
-| `bsk press <key>` | Key/combo (`Enter`, `Ctrl+A`, …; optional `--ref` to focus first) |
-
-### File transfer (require `--session`)
-
-| Command | Summary |
-|---------|---------|
-| `bsk upload <ref-or-selector> --file <path>` | Click one upload trigger and attach an agent-readable local file (`--file` is repeatable) |
-| `bsk download <ref-or-selector> --out <path>` | Click one download trigger and copy the single completed file to an exact local path (`--overwrite` is opt-in) |
-
-The agent/harness decides whether a file transfer is appropriate and which local path belongs to the task. Treat upload as disclosure of that file to the current website, and download as accepting website-controlled bytes onto the local filesystem. Use only paths that are necessary for the user's bounded goal.
-
-BrowserSkill enforces the mechanical boundary: files are staged under a session-scoped opaque transfer, only daemon-minted capabilities reach the extension, upload/download still obey Agent Window tab checks, and transfers are chunk/size bounded. Upload intercepts the native chooser for one transaction, locates the input activated in the resolved target's document, and assigns only the staged file paths. Download uniquely correlates one exact-target browser intent with one Chrome download in either event order, routes it through a daemon-minted relative directory, and lets the daemon validate and import it. Upload staging remains available for a later form submission and is removed when the session ends. Downloads cannot overwrite an existing destination unless `--overwrite` is explicit. BrowserSkill does not inspect file content or decide whether its meaning is sensitive.
-
-Do not use `request-help` merely because a native file chooser or browser download is involved; try these commands first. For transfer failures, use the structured error instead of retrying blindly:
-
-- `reason=file_input_not_activated` means the requested click did not activate exactly one `<input type="file">`; the page may use a non-input picker such as `window.showOpenFilePicker()`. Do not retry blindly. If human help is available, call `request-help` and tell the user the exact original local path to choose. The staged daemon path is internal and must not be shown to the user.
-- `reason=file_input_probe_failed` means BrowserSkill could not safely establish the browser-side upload transaction. Do not repeat the same action; use `request-help` when available.
-- `reason=set_file_input_failed` means BrowserSkill found the activated file input but Chrome rejected the staged path or assignment. Check the extension's file-URL access permission; otherwise use `request-help`.
-- `reason=download_capture_failed` means BrowserSkill could not attribute exactly one completed download to the requested target. Do not retry blindly or accept an unrelated browser download; use `request-help` when available.
-- `effect_state=none` means BrowserSkill confirmed that no file-transfer effect was committed. Follow the accompanying reason; a corrected target or explicit human fallback may be attempted.
-- `effect_state=unknown` means the browser may already have attached or created the file. Do not repeat the transfer. Observe the page if that can establish the result; otherwise stop and report the uncertainty.
-- `effect_state=committed` means the browser-side effect occurred even if later completion or cleanup failed. Do not repeat it; continue only after verifying the resulting page/download state.
-
-If `request-help` returns `outcome="disabled"`, do not retry it. Stop gracefully and report the transfer mechanism that requires human intervention.
-
-### Scripting & timing
-
-| Command | Summary |
-|---------|---------|
-| `bsk evaluate <expression>` | Run JS in agent tab (see red lines). JS throw → stderr, **exit 0** (RPC success); use `--json` and check `.ok` to detect JS errors |
-| `bsk wait-for-navigation` | Block until load/DOM idle/etc. (`--wait-until`, `--timeout`) |
-| `bsk wait-ms <duration>` | Sleep (`500ms`, `2s`, `1m`; **no** `--session`) |
-
-### Ask the human for help — `bsk request-help`
-
-When a step needs a human (captcha, login, OTP) or you want the user to
-confirm an important action, pause and ask:
-
-    bsk request-help --session <id> --prompt "Solve the captcha, then click Done only after the site accepts it" \
-      --title "Captcha required" --target @e7 --target "#submit" --timeout 5m
-
-- `--prompt` (required): what the user should do.
-- `--title` (optional): custom title for the overlay panel. When omitted,
-  the extension shows its default localized title.
-- `--target` (repeatable): a snapshot ref (`@e7`) or CSS selector
-  (`#submit`) to scroll to and flash-highlight. **Strongly recommended** —
-  whenever the prompt refers to a concrete element (a button to click, a
-  field to fill, a checkbox to toggle), pass its `@eN` ref / selector so the
-  user is guided straight to the right spot instead of hunting for it. For
-  interaction scenarios, always include the relevant target(s); reserve a
-  prompt with no `--target` for cases where there is genuinely no specific
-  element to point at (e.g. "wait for the page to finish loading").
-- `--timeout` (default `5m`): how long to wait.
-- `--completion-criteria` (optional): JSON success detector. Use it only
-  when there is a concrete post-help success signal, e.g.
-  `{"any":[{"url_contains":"/dashboard"},{"selector_exists":"[data-testid='account-menu']"}],"stable_for_ms":1000}`.
-
-The target tab is brought to the foreground; the page stays interactive
-while the agent control mask is hidden. The call blocks until the user
-explicitly acts, the timeout expires, cancellation arrives, or explicit
-completion criteria match. Page reloads, SPA route changes, and captcha
-refreshes do not return control by themselves. The result `outcome` is one of:
-
-- `continued` — the user finished and clicked Done / return control (treat as confirm).
-- `cancelled` — the user clicked Cancel (treat as reject/abort).
-- `timed_out` — nobody acted within the timeout.
-- `completed` — the explicit `--completion-criteria` matched while the user had control.
-- `navigated` — deprecated legacy outcome. Do not rely on navigation as a completion signal.
-
-`note` carries any text the user typed back. `resolved_targets` reports
-which refs/selectors matched a live element.
-
-`request-help` does not refresh the page model after the user returns
-control. After a `continued` or `completed` result, issue a separate
-observation tool call (usually `bsk snapshot --session <id>`) before using
-new refs or reasoning about the post-help page state.
-#### Disabling request-help (unattended mode)
-Set `BSK_REQUEST_HELP=off` on unattended servers: `bsk request-help` then
-returns immediately with `outcome="disabled"` (no overlay, no waiting,
-exit 0). Any other value keeps it enabled. If you get `disabled`, do not
-retry — complete the task autonomously or stop gracefully.
-
-### Recording — `bsk record`
-
-Capture the user's own actions in the Agent Window to a **trace bundle**, for later LLM-driven automation. New CLI builds request **trace v3** (page observations + action chain); older extensions may still return **trace v2** (actions only), which the CLI exports as a single `trace.json` without `states/`.
-
-```bash
-bsk record start --browser <instance-id-or-label> \
-  [--url https://…] [--purpose "publish a wiki doc"] \
-  [--max-page-tokens 3000] [--redact-values] \
-  [--output trace]
-# `--url` is optional; default https://example.com/ when omitted (must be http(s)).
-# Blocks until the user clicks Finish in the recording panel, then writes:
-#   trace/trace.json    — action chain (+ state index when v3)
-#   trace/states/       — v3 only: one `sN.txt` observe snapshot per settled page state
-
-bsk record stop [--output trace]   # terminal fallback if the browser panel is unavailable
+```text
+bsk fill <ref> --value <text>      bsk select <ref> --value <option-value>
+bsk screenshot --out <path>        bsk emulate --device <preset-id>
+bsk upload <ref> --file <path>     bsk download <ref> --out <path>
 ```
 
 `select` matches an option's `value` attribute, not its visible label. Device preset ids are
@@ -280,6 +139,34 @@ lowercase and hyphenated, such as `iphone-14`.
 - `record` captures a user's actions for later replay. Read `bsk record start --help` before use,
   and never record banking, SSO, password-manager, or other sensitive pages.
 
+## File transfer
+
+`upload` and `download` stage files through the daemon; the agent never touches browser-internal
+paths. Treat upload as disclosure to the website, download as accepting website-controlled bytes.
+
+Upload has two independent mechanisms — choose explicitly, never rely on automatic fallback:
+
+- **Default (input mode):** for upload buttons, file-input labels, or "upload from computer"
+  actions. The command clicks the target and intercepts the native file chooser.
+- **`--mode drop`:** for reliably identified attachment-receiving areas — an explicit drop zone,
+  chat composer, email editor, or form attachment area. Do not target page whitespace, generic
+  containers, or areas whose attachment ownership is ambiguous.
+
+Decision sequence when uploading:
+
+1. Try input mode (the default).
+2. If it returns `reason=file_input_not_activated` with `effect_state=none`, re-observe. When a
+   reliable attachment target exists, try `--mode drop` once against that target.
+3. Otherwise fall back to `request-help`.
+4. **Never** switch mechanisms or repeat when `effect_state` is `unknown` or `committed` — the
+   browser may already have applied the file.
+
+A successful drop means Chrome dispatched the native file-drop event; it does not prove the site
+accepted the attachment. Observe the page once after the command.
+
+Download default-refuses to overwrite; pass `--overwrite` when replacing an existing file is
+intended. Read `bsk upload --help` and `bsk download --help` for all flags and error details.
+
 ## Recover without wandering
 
 - Stale ref: observe again and retry the intended action once.