From 37cd9b91e14d55bafaca77ceac590e5e178dead2 Mon Sep 17 00:00:00 2001
From: leeguooooo <guoli@zhihu.com>
Date: Fri, 12 Jun 2026 01:34:15 +0900
Subject: [PATCH] fix(ab-connect): fail loudly on a stale sessionId instead of
 routing to a random tab (issue #8.1)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

handleForwardCdpCommand fell through to anyConnectedTab() when a
daemon-supplied sessionId didn't map to an attached tab, so eval/screenshot/
network silently ran on an arbitrary tab — the root of "eval ran on the
wrong page, no warning" and the blank-screenshot-after-restart symptom.

Now: a provided sessionId/targetId MUST resolve to a real tab or the command
throws an actionable error ("stale sessionId … re-open your target URL").
anyConnectedTab() is only used for genuinely browser-level commands that
specify neither. Manifest 0.4.1 → 0.4.2 (needs a Chrome Web Store republish
for installed users to pick this up).
---
 extensions/ab-connect/background.js | 29 +++++++++++++++++++++++++----
 extensions/ab-connect/manifest.json |  2 +-
 2 files changed, 26 insertions(+), 5 deletions(-)

diff --git a/extensions/ab-connect/background.js b/extensions/ab-connect/background.js
index e519090..a137a31 100644
--- a/extensions/ab-connect/background.js
+++ b/extensions/ab-connect/background.js
@@ -199,10 +199,31 @@ async function handleForwardCdpCommand(msg) {
   }
 
   // Everything else → chrome.debugger on the resolved tab.
-  const tabId =
-    (sessionId ? tabForSession(sessionId) : null) ??
-    (typeof params?.targetId === 'string' ? tabForTarget(params.targetId) : null) ??
-    anyConnectedTab()
+  //
+  // A daemon-supplied sessionId/targetId MUST resolve to a real attached tab.
+  // The old code fell through to anyConnectedTab() when it didn't, which
+  // silently ran the command (eval/screenshot/network) on an arbitrary tab —
+  // exactly the "ran on the wrong page with no warning" failure in issue #8.1,
+  // and the blank-screenshot symptom after a service-worker restart (#8.2).
+  // Fail loudly instead so the agent sees an actionable error, not bad data.
+  let tabId
+  if (sessionId) {
+    tabId = tabForSession(sessionId)
+    if (!tabId) {
+      throw new Error(
+        `stale sessionId ${sessionId} for ${method}: its tab is gone (closed, ` +
+          `navigated across processes, or lost after an extension restart). ` +
+          `Re-attach by re-opening your target URL before retrying.`,
+      )
+    }
+  } else if (typeof params?.targetId === 'string') {
+    tabId = tabForTarget(params.targetId)
+    if (!tabId) throw new Error(`no attached tab for targetId ${params.targetId} (${method})`)
+  } else {
+    // No session/target specified — a browser-level command that legitimately
+    // applies to any attached tab.
+    tabId = anyConnectedTab()
+  }
   if (!tabId) throw new Error(`no attached tab for ${method}`)
   const dbg = { tabId }
 
diff --git a/extensions/ab-connect/manifest.json b/extensions/ab-connect/manifest.json
index 74ed496..47a1fc5 100644
--- a/extensions/ab-connect/manifest.json
+++ b/extensions/ab-connect/manifest.json
@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "agent-browser-stealth",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Let agent-browser drive your logged-in Chrome \u2014 install once, no token, no per-use confirmation.",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6vQIyscGIPYPZdSpPwPL0+0gxUROyRgCpmvCSDoc8XUm4qm97VbKnD9Ijc1lV22lNWZtE78gaRjt6BeSfuMgnBymnhLKjN1gU6AI5QUU0mrJyeHdWKvrKQR5FmsM2A7Xr1ykE2SiiS8zNUS3Y/6O5l+Nva7wrVy6E4a2dkBVQkOsu+DV+nEZvhIyuDY5D5SPXqNwUTWTaglwj5mjvHz36xSwCWlPmrtJ+ED0AUyrb2z4GIOmvk4kqtBVrh/UD058klLo4CkYOnIybB5aV6WYuwarfPY4bF/dLggPem+ewLNTUNBuwrxj/A4nUv0LJTuRO8rR7f8WR9qnRCY0Ic5saQIDAQAB",
   "icons": {