fix(browser): scope per-tab threads to one browser session

anagnorisis2peripeteia · anagnorisis2peripeteia · commit c688f94de6c1 · 2026-07-15T21:30:05.000+01:00
Tab ids are only unique within a browser session - Chrome reissues them from a
low counter every launch - but gateway sessions persist. Keying a thread on the
tab id alone therefore handed a brand-new tab the previous launch's conversation
for that id: hydrateHistory rendered a stranger's thread and new turns continued
it. That breaks the panel's central promise that two tabs never mix context, and
it hits low-numbered tabs after every restart.

Fold a per-launch nonce (kept in storage.session, alongside the generation map
it already scopes) into the derived key, and refuse to derive a key without it
rather than falling back to a colliding one. This trades resume-across-restart,
which tab-id reuse had already made meaningless, for correctness.
diff --git a/docs/tools/chrome-extension.md b/docs/tools/chrome-extension.md
@@ -125,8 +125,12 @@ my details", "summarize this thread" — the agent drives that tab through the
 normal `browser` tool.
 
 - **Per-tab conversations.** Each tab chats in its own gateway session
-  (`…:thread:tab-<id>`), so two tabs never mix context. Reopening the panel on
-  the same tab resumes its conversation; **New chat** starts a fresh one.
+  (`…:thread:tab-<browser-session>-<id>`), so two tabs never mix context.
+  Reopening the panel on the same tab resumes its conversation; **New chat**
+  starts a fresh one. Threads are scoped to one browser session on purpose:
+  Chrome reissues tab ids from a low counter every launch, so a restart starts
+  each tab fresh rather than handing it whichever conversation last held that
+  id.
 - **Allow the panel's origin — required once.** The panel is a Chrome
   extension page, so its WebSocket always sends an
   `Origin: chrome-extension://<extension-id>` header, and the Gateway checks any
diff --git a/extensions/browser/chrome-extension/modules/panel-core.d.ts b/extensions/browser/chrome-extension/modules/panel-core.d.ts
@@ -4,6 +4,7 @@
 export function deriveTabSessionKey(
   mainSessionKey: unknown,
   tabId: unknown,
+  browserSession: unknown,
   generation?: number,
 ): string | null;
 
diff --git a/extensions/browser/chrome-extension/modules/panel-core.js b/extensions/browser/chrome-extension/modules/panel-core.js
@@ -6,18 +6,31 @@
  * Deterministic per-tab session key: each pinned tab converses in its own
  * thread off the agent's main session, so reopening the panel on the same tab
  * resumes the same conversation without any client-side storage of history.
+ *
+ * `browserSession` namespaces the key, and is required. Chrome restarts tab ids
+ * from a low counter on every launch while gateway sessions persist, so a bare
+ * tab id would hand a brand-new tab the previous session's conversation for that
+ * id — the exact context bleed "the tab is the conversation" promises against.
+ * Scoping to a per-launch nonce trades resume-across-restart, which tab-id reuse
+ * had already made meaningless, for correctness.
+ *
  * `generation` supports "New chat" for write-scope clients: sessions.reset is
  * operator.admin-only and sessions.create adopts an existing key, so a fresh
  * thread is minted by bumping the suffix instead of resetting in place.
  */
-export function deriveTabSessionKey(mainSessionKey, tabId, generation = 0) {
+export function deriveTabSessionKey(mainSessionKey, tabId, browserSession, generation = 0) {
   if (typeof mainSessionKey !== "string" || !mainSessionKey || typeof tabId !== "number") {
     return null;
   }
+  // No nonce, no key: falling back to a bare tab id would silently reintroduce
+  // the cross-restart collision this parameter exists to close.
+  if (typeof browserSession !== "string" || !browserSession) {
+    return null;
+  }
   const threadIndex = mainSessionKey.indexOf(":thread:");
   const base = threadIndex === -1 ? mainSessionKey : mainSessionKey.slice(0, threadIndex);
   const generationSuffix = generation > 0 ? `-g${generation}` : "";
-  return `${base}:thread:tab-${tabId}${generationSuffix}`;
+  return `${base}:thread:tab-${browserSession}-${tabId}${generationSuffix}`;
 }
 
 /**
diff --git a/extensions/browser/chrome-extension/modules/panel-core.test.ts b/extensions/browser/chrome-extension/modules/panel-core.test.ts
@@ -13,25 +13,49 @@ import {
 } from "./panel-core.js";
 
 describe("deriveTabSessionKey", () => {
+  const B = "b1c2d3e4f5a6";
+
   it("threads the tab off the agent main key", () => {
-    expect(deriveTabSessionKey("agent:main:main", 42)).toBe("agent:main:main:thread:tab-42");
+    expect(deriveTabSessionKey("agent:main:main", 42, B)).toBe(
+      `agent:main:main:thread:tab-${B}-42`,
+    );
   });
 
   it("strips an existing :thread: suffix before threading", () => {
-    expect(deriveTabSessionKey("agent:main:main:thread:xyz", 7)).toBe(
-      "agent:main:main:thread:tab-7",
+    expect(deriveTabSessionKey("agent:main:main:thread:xyz", 7, B)).toBe(
+      `agent:main:main:thread:tab-${B}-7`,
     );
   });
 
   it("appends a generation suffix for fresh chats on the same tab", () => {
-    expect(deriveTabSessionKey("agent:main:main", 7, 2)).toBe("agent:main:main:thread:tab-7-g2");
-    expect(deriveTabSessionKey("agent:main:main", 7, 0)).toBe("agent:main:main:thread:tab-7");
+    expect(deriveTabSessionKey("agent:main:main", 7, B, 2)).toBe(
+      `agent:main:main:thread:tab-${B}-7-g2`,
+    );
+    expect(deriveTabSessionKey("agent:main:main", 7, B, 0)).toBe(
+      `agent:main:main:thread:tab-${B}-7`,
+    );
+  });
+
+  it("gives the same tab id a different thread in a different browser session", () => {
+    // Chrome restarts tab ids from a low counter each launch while gateway
+    // sessions persist, so without this a new tab would resume a stranger's
+    // conversation. Same id, same generation, different launch -> different key.
+    const first = deriveTabSessionKey("agent:main:main", 1, "aaaaaaaaaaaa");
+    const second = deriveTabSessionKey("agent:main:main", 1, "bbbbbbbbbbbb");
+    expect(first).not.toBe(second);
+  });
+
+  it("returns null rather than falling back to a bare tab id", () => {
+    // A missing nonce must not silently produce a colliding key.
+    expect(deriveTabSessionKey("agent:main:main", 7, "")).toBeNull();
+    expect(deriveTabSessionKey("agent:main:main", 7, undefined)).toBeNull();
+    expect(deriveTabSessionKey("agent:main:main", 7, null)).toBeNull();
   });
 
   it("returns null without a main key or tab id", () => {
-    expect(deriveTabSessionKey(null, 7)).toBeNull();
-    expect(deriveTabSessionKey("", 7)).toBeNull();
-    expect(deriveTabSessionKey("agent:main:main", undefined)).toBeNull();
+    expect(deriveTabSessionKey(null, 7, B)).toBeNull();
+    expect(deriveTabSessionKey("", 7, B)).toBeNull();
+    expect(deriveTabSessionKey("agent:main:main", undefined, B)).toBeNull();
   });
 });
 
diff --git a/extensions/browser/chrome-extension/sidepanel.js b/extensions/browser/chrome-extension/sidepanel.js
@@ -373,9 +373,32 @@ async function handleHelloOk(payload) {
 // Per-tab session binding
 // ---------------------------------------------------------------------------
 
-// Tab ids are per-browser-session, so the generation map lives in
-// chrome.storage.session: it survives panel reloads (same tab resumes the
-// same thread) and resets with the browser (when tab ids recycle anyway).
+// Chrome hands out tab ids from a low counter that restarts with the browser,
+// while gateway sessions persist — so a key built on the tab id alone would give
+// a brand-new tab the previous launch's conversation for that id. This nonce
+// namespaces every key to one browser session. It lives in storage.session, so
+// it survives panel reloads (the same tab keeps its thread) and dies with the
+// browser, exactly when the ids it disambiguates start being reused.
+let browserSessionId = null;
+
+async function browserSession() {
+  if (browserSessionId) {
+    return browserSessionId;
+  }
+  const stored = await chrome.storage.session.get(["browserSessionId"]);
+  if (typeof stored.browserSessionId === "string" && stored.browserSessionId) {
+    browserSessionId = stored.browserSessionId;
+    return browserSessionId;
+  }
+  const bytes = new Uint8Array(6);
+  crypto.getRandomValues(bytes);
+  browserSessionId = [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+  await chrome.storage.session.set({ browserSessionId });
+  return browserSessionId;
+}
+
+// The generation map is scoped the same way: it survives panel reloads and
+// resets with the browser, alongside the nonce that namespaces the keys.
 async function tabGeneration(tabId) {
   const stored = await chrome.storage.session.get(["tabSessionGen"]);
   return stored.tabSessionGen?.[tabId] ?? 0;
@@ -394,7 +417,7 @@ async function bindTabSession() {
     return;
   }
   const generation = await tabGeneration(pinnedTabId);
-  const key = deriveTabSessionKey(mainSessionKey, pinnedTabId, generation);
+  const key = deriveTabSessionKey(mainSessionKey, pinnedTabId, await browserSession(), generation);
   if (!key) {
     return;
   }
@@ -695,7 +718,7 @@ async function onNewChat() {
 
 async function startFreshThread() {
   const generation = await bumpTabGeneration(pinnedTabId);
-  sessionKey = deriveTabSessionKey(mainSessionKey, pinnedTabId, generation);
+  sessionKey = deriveTabSessionKey(mainSessionKey, pinnedTabId, await browserSession(), generation);
   // The bump is persisted and sessionKey has already moved, so show the new
   // thread BEFORE the gateway round trips rather than after. If one of them
   // throws, the pane still matches where sends will actually land and the
