From 0ad4920a8ed01854732ef992cabbf7fcb73f29e9 Mon Sep 17 00:00:00 2001
From: yiliang114 <effortyiliang@gmail.com>
Date: Thu, 16 Jul 2026 11:02:20 +0800
Subject: [PATCH 01/13] feat(chrome): add native browser tools

---
 ...07-13-chrome-extension-native-tools-pr1.md | 340 ++++++
 package-lock.json                             |   1 +
 package.json                                  |   2 +-
 packages/chrome-extension/README.md           |  96 +-
 .../config/esbuild.background.config.js       |   8 +-
 .../docs/05-daemon-direct-architecture.md     |  65 +-
 packages/chrome-extension/package.json        |   5 +-
 .../chrome-extension/public/sidepanel.html    |  69 +-
 packages/chrome-extension/public/sidepanel.js | 300 +++++-
 .../chrome-extension/scripts/artifact-scan.js | 106 ++
 .../scripts/package-extension.js              |  32 +
 .../browser-mcp/browser-tools.test.ts         | 589 +++++++++++
 .../background/browser-mcp/browser-tools.ts   | 986 ++++++++++++++++++
 .../background/browser-mcp/connection.test.ts |  61 ++
 .../src/background/browser-mcp/connection.ts  |  39 +
 .../browser-mcp/debugger-session.test.ts      | 253 +++++
 .../browser-mcp/debugger-session.ts           | 214 ++++
 .../src/background/browser-mcp/server.test.ts |  98 ++
 .../src/background/browser-mcp/server.ts      | 143 +++
 .../src/background/service-worker.test.ts     | 192 ++++
 .../src/background/service-worker.ts          | 145 ++-
 .../chrome-extension/src/daemon/config.ts     |  11 +-
 .../src/daemon/discovery.test.ts              | 159 +++
 .../chrome-extension/src/daemon/discovery.ts  | 135 ++-
 .../client-mcp-sender-registry.test.ts        |  25 +
 .../acp-http/client-mcp-sender-registry.ts    |   5 +
 .../src/serve/acp-http/client-mcp-ws.test.ts  | 197 +++-
 .../cli/src/serve/acp-http/client-mcp-ws.ts   |  40 +-
 packages/cli/src/serve/acp-http/index.ts      |  83 +-
 .../cli/src/serve/extension-pairing-routes.ts |  84 ++
 .../cli/src/serve/extension-pairing.test.ts   | 186 ++++
 packages/cli/src/serve/extension-pairing.ts   | 209 ++++
 packages/cli/src/serve/run-qwen-serve.test.ts | 271 ++++-
 packages/cli/src/serve/run-qwen-serve.ts      |  82 +-
 packages/cli/src/serve/server.ts              |   6 +
 packages/cli/src/serve/types.ts               |  16 +-
 .../tests/chrome-extension-package.test.js    |  66 +-
 37 files changed, 5131 insertions(+), 188 deletions(-)
 create mode 100644 docs/plans/2026-07-13-chrome-extension-native-tools-pr1.md
 create mode 100644 packages/chrome-extension/scripts/artifact-scan.js
 create mode 100644 packages/chrome-extension/scripts/package-extension.js
 create mode 100644 packages/chrome-extension/src/background/browser-mcp/browser-tools.test.ts
 create mode 100644 packages/chrome-extension/src/background/browser-mcp/browser-tools.ts
 create mode 100644 packages/chrome-extension/src/background/browser-mcp/connection.test.ts
 create mode 100644 packages/chrome-extension/src/background/browser-mcp/connection.ts
 create mode 100644 packages/chrome-extension/src/background/browser-mcp/debugger-session.test.ts
 create mode 100644 packages/chrome-extension/src/background/browser-mcp/debugger-session.ts
 create mode 100644 packages/chrome-extension/src/background/browser-mcp/server.test.ts
 create mode 100644 packages/chrome-extension/src/background/browser-mcp/server.ts
 create mode 100644 packages/chrome-extension/src/background/service-worker.test.ts
 create mode 100644 packages/chrome-extension/src/daemon/discovery.test.ts
 create mode 100644 packages/cli/src/serve/extension-pairing-routes.ts
 create mode 100644 packages/cli/src/serve/extension-pairing.test.ts
 create mode 100644 packages/cli/src/serve/extension-pairing.ts

diff --git a/docs/plans/2026-07-13-chrome-extension-native-tools-pr1.md b/docs/plans/2026-07-13-chrome-extension-native-tools-pr1.md
new file mode 100644
index 00000000000..5e542797c22
--- /dev/null
+++ b/docs/plans/2026-07-13-chrome-extension-native-tools-pr1.md
@@ -0,0 +1,340 @@
+# Chrome Extension Native Browser Tools PR1 Implementation Plan
+
+**Goal:** Ship PR1 for the official Qwen Code Chrome extension so users can install the extension, run `qwen serve`, and get baseline browser debugging tools without bundling or installing `chrome-devtools-mcp`.
+
+**Architecture:** Keep Qwen Code's agent loop and tool orchestration in the local daemon. The Chrome extension connects to the daemon over `/acp`, hosts a small native MCP server inside the extension, and implements browser tools with `chrome.debugger` CDP access. Add a one-time daemon-to-extension pairing step so the extension only exposes browser-control tools to a trusted local daemon.
+
+**Tech Stack:** TypeScript, Chrome Manifest V3 service worker, `chrome.debugger`, daemon `/acp` WebSocket, existing `qwen serve` Express server, Vitest, esbuild, npm package scanner.
+
+## Scope
+
+PR1 must include:
+
+- Native extension-hosted browser tools: navigation, click/fill/key/scroll/wait, screenshot/snapshot, console, network, evaluate, and request sending.
+- Default `qwen serve` compatibility for the official extension ID, with no `QWEN_SERVE_CLIENT_MCP_OVER_WS` or `QWEN_SERVE_CDP_TUNNEL_OVER_WS` required.
+- No bundled `chrome-devtools-mcp`, Puppeteer, or external browser automation server in the main npm package or extension ZIP.
+- Compatibility fallback for explicit external adapter users through `QWEN_CDP_MCP_COMMAND`.
+- One-time pairing/auth so a random local process cannot impersonate the daemon and invoke extension-hosted browser tools.
+- Self-contained verification: unit tests, extension packaging scan, CLI tests, typecheck/build/bundle/package scan, and real Chrome smoke test.
+
+Out of scope for PR1:
+
+- Recording/replay workflows.
+- Performance timeline/profiling UI.
+- Multi-tab orchestration beyond active-tab control.
+- Publishing to Chrome Web Store.
+
+## Current Baseline
+
+The worktree contains the native browser-tools implementation and daemon-extension pairing. First-use mutual HMAC proof keeps the terminal code and derived credential secret off the wire; stored credentials are challenge-verified before `/acp`, pairing routes precede bearer authentication, and failed attempts are bounded.
+
+## Task 1: Sync Base Branch
+
+**Files:**
+
+- No direct source edits.
+
+**Step 1: Fetch latest main**
+
+Run:
+
+```bash
+git fetch origin main
+```
+
+Expected: fetch succeeds.
+
+**Step 2: Merge latest main into the worktree**
+
+Run:
+
+```bash
+git merge origin/main
+```
+
+Expected: merge succeeds or exposes concrete conflicts to resolve.
+
+**Step 3: Inspect conflicts or changed upstream serve/extension code**
+
+Run:
+
+```bash
+git status --short --branch
+git diff --name-only --diff-filter=U
+```
+
+Expected: no unresolved conflicts before continuing.
+
+## Task 2: Define Pairing Contract Tests
+
+**Files:**
+
+- Create: `packages/cli/src/serve/extension-pairing.test.ts`
+- Create: `packages/cli/src/serve/extension-pairing.ts`
+- Modify: `packages/cli/src/serve/run-qwen-serve.test.ts`
+- Modify: `packages/chrome-extension/src/daemon/discovery.test.ts`
+- Modify: `packages/chrome-extension/src/background/service-worker.ts`
+- Modify: `packages/chrome-extension/src/daemon/discovery.ts`
+
+**Behavior:**
+
+- Daemon prints a time-limited pairing code in the terminal and exposes only
+  pairing status on loopback.
+- Extension can store a daemon trust credential after explicit pairing.
+- `/acp` browser-tools connection must carry the trust credential after pairing.
+- Official extension still shows `qwen serve` as the default startup command.
+- If no credential is present, the extension must not register browser tools with an untrusted daemon.
+
+**Step 1: Write failing CLI pairing tests**
+
+Add tests for:
+
+- Pairing challenge generation returns a high-entropy code, nonce, and expiration timestamp.
+- Pairing exchange rejects wrong or expired HMAC proofs without receiving the code.
+- Pairing exchange mutually authenticates the daemon and derives a persistent credential without transferring its secret.
+- Stored credential verification accepts the issued credential and rejects random values.
+
+Run:
+
+```bash
+cd packages/cli && npx vitest run src/serve/extension-pairing.test.ts
+```
+
+Expected: fails because the module does not exist or behavior is missing.
+
+**Step 2: Write failing extension discovery tests**
+
+Add tests for:
+
+- Reading pairing state from storage.
+- Returning `unpaired` when daemon is reachable but no trust credential exists.
+- Returning `ready` when daemon is reachable and trust credential is accepted.
+
+Run:
+
+```bash
+npm -w packages/chrome-extension run test -- src/daemon/discovery.test.ts
+```
+
+Expected: fails because pairing behavior is missing.
+
+## Task 3: Implement Minimal Daemon Pairing
+
+**Files:**
+
+- Create: `packages/cli/src/serve/extension-pairing.ts`
+- Modify: `packages/cli/src/serve/run-qwen-serve.ts`
+- Modify: `packages/cli/src/serve/run-qwen-serve.test.ts`
+- Modify: `packages/cli/src/serve/types.ts` only if a shared type is truly needed.
+
+**Implementation:**
+
+- Keep state in the running daemon process for PR1: current pairing code, expiration, and issued trust credential hash.
+- Generate a pasteable 128-bit code and nonce with Node `crypto`.
+- Add loopback-only HTTP endpoints:
+  - `GET /extension/pairing` returns pairing status and expiration metadata,
+    but never returns the terminal code.
+  - `POST /extension/pairing/confirm` accepts a client proof and returns a credential ID plus daemon proof; the secret is derived independently at both ends.
+  - `POST /extension/pairing/verify` returns a challenge proof for the public
+    credential id without receiving the credential secret.
+- Use constant-time comparison for credential verification.
+- Do not write secrets to logs.
+- Do not persist credentials in the repo; extension stores its copy in Chrome storage.
+
+**Step 1: Implement module only**
+
+Run:
+
+```bash
+cd packages/cli && npx vitest run src/serve/extension-pairing.test.ts
+```
+
+Expected: pairing module tests pass.
+
+**Step 2: Wire routes into `qwen serve`**
+
+Run:
+
+```bash
+cd packages/cli && npx vitest run src/serve/run-qwen-serve.test.ts
+```
+
+Expected: existing serve tests plus new pairing route tests pass.
+
+## Task 4: Implement Extension Pairing Flow
+
+**Files:**
+
+- Modify: `packages/chrome-extension/src/daemon/discovery.ts`
+- Modify: `packages/chrome-extension/src/daemon/discovery.test.ts`
+- Modify: `packages/chrome-extension/src/background/service-worker.ts`
+- Modify: `packages/chrome-extension/public/sidepanel.js`
+- Modify: `packages/chrome-extension/public/sidepanel.html` only if the existing markup cannot support the pairing UI.
+
+**Implementation:**
+
+- Add a `paired` daemon state in discovery.
+- Store the daemon credential under the existing daemon storage object.
+- Side panel states:
+  - daemon down: show `qwen serve`;
+  - daemon up but unpaired: ask the user to paste the pairing code shown
+    in the `qwen serve` terminal;
+  - daemon up and paired: frame Web Shell.
+- Service worker behavior:
+  - Do not connect/register native browser tools until pairing verifies.
+  - Include the trust credential in `/acp` authentication using the existing token/subprotocol mechanism only if it does not collide with `QWEN_SERVER_TOKEN`; otherwise add a small pairing-specific message before MCP registration.
+- Keep external adapter fallback unchanged.
+
+**Step 1: Add failing extension tests**
+
+Run:
+
+```bash
+npm -w packages/chrome-extension run test -- src/daemon/discovery.test.ts src/background/service-worker.test.ts
+```
+
+Expected: tests fail for missing pairing state or service worker gating.
+
+**Step 2: Implement minimal pairing UI and service worker gating**
+
+Run:
+
+```bash
+npm -w packages/chrome-extension run test
+```
+
+Expected: all extension tests pass.
+
+## Task 5: Preserve Packaging and Scanner Guarantees
+
+**Files:**
+
+- Modify: `packages/chrome-extension/scripts/artifact-scan.js` only if new signatures must be added.
+- Modify: `scripts/tests/chrome-extension-package.test.js` if packaging expectations change.
+- Modify: `packages/chrome-extension/package.json` only if package scripts need adjustment.
+
+**Behavior:**
+
+- Extension production ZIP must not contain `chrome-devtools-mcp`, Puppeteer, or external MCP server code.
+- Main npm final package must not contain those signatures either.
+- Native CDP code remains extension-only.
+
+**Step 1: Run extension release test**
+
+Run:
+
+```bash
+npm -w packages/chrome-extension run test:release
+```
+
+Expected: tests, typecheck, build/package, and artifact scan pass.
+
+**Step 2: Run root package scanner**
+
+Run:
+
+```bash
+npm run build
+npm run bundle
+npm run prepare:package
+```
+
+Expected: build and final package scan pass.
+
+## Task 6: Real Chrome Smoke Test
+
+**Files:**
+
+- No source edits unless smoke test exposes a product bug.
+
+**Setup:**
+
+Run daemon without browser env flags:
+
+```bash
+node packages/cli/dist/index.js serve --port 4170 --hostname 127.0.0.1 --no-web
+```
+
+Load the built extension ZIP or unpacked `packages/chrome-extension/dist/extension`.
+
+**Verify manually or with Playwright:**
+
+- Extension side panel detects daemon.
+- First run requires pairing.
+- After pairing, reload the extension and verify it stays paired.
+- `/workspace/mcp` includes `qwen-browser-tools`.
+- Agent can:
+  - navigate to `http://127.0.0.1:4170/demo`;
+  - inspect snapshot;
+  - fill and click;
+  - evaluate JavaScript;
+  - read console output;
+  - read network requests and response metadata.
+
+Expected: all checks pass without `QWEN_SERVE_CLIENT_MCP_OVER_WS`, `QWEN_SERVE_CDP_TUNNEL_OVER_WS`, or `QWEN_CDP_MCP_COMMAND`.
+
+## Task 7: Final Review and PR Readiness
+
+**Files:**
+
+- Modify docs as needed:
+  - `packages/chrome-extension/README.md`
+  - `packages/chrome-extension/docs/05-daemon-direct-architecture.md`
+
+**Step 1: Run changed-file lint**
+
+Run:
+
+```bash
+npm run lint
+```
+
+Expected: no errors.
+
+**Step 2: Run full typecheck**
+
+Run:
+
+```bash
+npm run typecheck
+```
+
+Expected: no errors.
+
+**Step 3: Run code review workflow**
+
+Use review and ponytail checks on the final diff.
+
+Expected: no Critical or High issues remain. Any remaining Medium/Low items are documented as PR2 follow-ups.
+
+**Step 4: Prepare Draft PR**
+
+Draft PR must state:
+
+- PR1 user flow.
+- Pairing behavior and security model.
+- Native tools included.
+- Explicit statement that `chrome-devtools-mcp` is not bundled.
+- Test evidence with exact commands.
+- Known PR2 follow-ups: recording/replay, performance profiling, richer multi-tab workflow.
+
+## Validation Results
+
+Validated on `origin/main` at `536cb713c6`:
+
+- Extension tests: 54 passed.
+- Relevant CLI pairing, reverse MCP, ACP transport, and serve tests: 478 passed.
+- Release-script tests: 3 passed.
+- `npm run lint`, `npm run build`, `npm run typecheck`, and `npm run bundle`: passed.
+- Extension `test:release`: passed, including ZIP creation and artifact scan.
+- Real Chrome smoke test: pairing succeeded without browser environment flags, the Web Shell iframe loaded, `qwen-browser-tools` registered, and all 20 tools were discoverable.
+- Main npm tarball: 23,231,294 bytes and 833 files; path and content scans found no `chrome-devtools-mcp`, Puppeteer, extension ZIP/manifest, or native browser-MCP source.
+
+## Acceptance Criteria
+
+- Official extension + `qwen serve` gives browser tools after one-time pairing.
+- No external `chrome-devtools-mcp` install is required for PR1 baseline tools.
+- No browser env flags are required for the official extension path.
+- Main npm package and extension ZIP scans do not flag `chrome-devtools-mcp` or Puppeteer.
+- Untrusted local processes cannot silently use the extension-hosted tools.
+- All listed verification commands pass in this worktree before declaring the PR ready.
diff --git a/package-lock.json b/package-lock.json
index 49afd855a02..3c9783a0e30 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -28093,6 +28093,7 @@
       "license": "Apache-2.0",
       "devDependencies": {
         "@types/chrome": "^0.1.32",
+        "archiver": "^7.0.1",
         "esbuild": "^0.25.3",
         "typescript": "^5.8.3"
       },
diff --git a/package.json b/package.json
index 2efad459b3f..dcaa158cef4 100644
--- a/package.json
+++ b/package.json
@@ -40,7 +40,7 @@
     "bundle": "npm run generate && node esbuild.config.js && node scripts/copy_bundle_assets.js",
     "test": "cross-env NODE_OPTIONS=\"--max-old-space-size=3072\" npm run test --workspaces --if-present --parallel",
     "test:ci": "cross-env NODE_OPTIONS=\"--max-old-space-size=3072\" npm run test:ci --workspaces --if-present --parallel && npm run test:scripts",
-    "test:release": "cross-env NODE_OPTIONS=\"--max-old-space-size=3072\" npm run test:ci --workspaces --if-present --parallel -- --coverage.enabled=false && npm run test:scripts",
+    "test:release": "cross-env NODE_OPTIONS=\"--max-old-space-size=3072\" npm run test:ci --workspaces --if-present --parallel -- --coverage.enabled=false && npm run test:scripts && npm -w packages/chrome-extension run package",
     "test:scripts": "vitest run --config ./scripts/tests/vitest.config.ts",
     "test:e2e": "cross-env VERBOSE=true KEEP_OUTPUT=true npm run test:integration:sandbox:none",
     "test:integration:all": "npm run test:integration:sandbox:none && npm run test:integration:sandbox:docker && npm run test:integration:sandbox:podman",
diff --git a/packages/chrome-extension/README.md b/packages/chrome-extension/README.md
index 05f3f221deb..dfc19279ad5 100644
--- a/packages/chrome-extension/README.md
+++ b/packages/chrome-extension/README.md
@@ -6,11 +6,10 @@ Messaging host to install.
 
 It does two things:
 
-- **Side panel** — frames the daemon's Web Shell (chat + tools), the same UI the
-  daemon serves to the browser. The panel has no UI of its own.
-- **Service worker** — a CDP-tunnel pipe. It connects to the daemon's `/acp`
-  WebSocket and bridges `cdp_*` frames into `chrome.debugger`, so the agent can
-  drive the real browser when an external CDP MCP adapter is configured.
+- **Side panel** — handles daemon discovery and pairing, then frames the
+  daemon's Web Shell (chat + tools).
+- **Service worker** — hosts Qwen's browser MCP tools and executes them through
+  `chrome.debugger`. Tool calls travel over the daemon's reverse MCP WebSocket.
 
 ## Build
 
@@ -23,53 +22,70 @@ Then load it: `chrome://extensions` → enable Developer mode → **Load unpacke
 
 ## Run
 
-The extension is a client; the daemon does the work and must be started
-separately (an extension cannot spawn a local process). Open the side panel and
-it will tell you exactly what to run — it generates the command with this
-extension's own id:
+The extension cannot spawn a local process, so start the daemon separately:
 
 ```bash
-qwen serve --allow-origin chrome-extension://<this-extension-id>
+qwen serve
 ```
 
-`--allow-origin chrome-extension://<id>` is required: it lets the daemon's Web
-Shell be framed by the extension (the `frame-ancestors` CSP) and accepts the
-extension's requests. The side panel reads the id at runtime via
-`chrome.runtime.id`, so you never have to look it up.
+The official extension id is pinned by `qwen serve`, so no browser-related
+environment variables or `--allow-origin` flag are required. Custom or forked
+extension builds must still pass their own origin explicitly:
 
-Once the daemon is reachable and permits framing, the side panel swaps the
-welcome screen for the chat UI automatically.
+```bash
+qwen serve --allow-origin chrome-extension://<custom-extension-id>
+```
+
+Paste the pairing code printed by `qwen serve`. The credential remains in
+Chrome storage across extension reloads, but a restarted daemon requires a new
+pairing code because the daemon keeps trust state in memory. Once pairing
+succeeds, the panel opens the chat UI and browser tools register immediately.
+If Chrome storage is cleared while the daemon is still running, restart the
+daemon to generate fresh pairing material.
+
+The first-use exchange sends only an HMAC challenge proof; the pairing code and
+derived credential secret never cross HTTP. The extension verifies the daemon's
+proof before storing that credential, then uses a separate challenge-response
+before sending it over `/acp`. Pairing endpoints intentionally precede bearer
+authentication so an unknown process never receives a stored bearer token. The
+pairing code is time-limited and failed attempts are bounded.
 
 ## Browser Automation Tools
 
-The command above only makes the side panel and Web Shell available. Browser
-automation tools such as console/network inspection, screenshots, and page
-clicking require an explicit external MCP adapter command:
+Browser debugging tools are implemented in and bundled with this Chrome
+extension. The main `@qwen-code/qwen-code` npm package does not contain an
+external Chrome DevTools MCP server. The first-release catalog covers page
+snapshot/navigation/input, screenshots, JavaScript evaluation, console output,
+and network request/response inspection.
 
-```bash
-QWEN_CDP_MCP_COMMAND=/path/to/cdp-mcp-adapter \
-qwen serve --allow-origin chrome-extension://<this-extension-id>
-```
+Tools act on the active tab. `evaluate_script` and `send_request` execute in the
+page context and can access that page's authenticated session, so use a dedicated
+browser profile or tab for untrusted sites and keep normal tool approval enabled.
 
-No browser automation adapter is bundled with the main `@qwen-code/qwen-code`
-package. When `QWEN_CDP_MCP_COMMAND` is unset, the extension can still open the
-Web Shell, but the daemon will not register browser automation MCP tools.
-Clients can distinguish the states through `/capabilities`:
+An explicitly configured `QWEN_CDP_MCP_COMMAND` remains a deprecated
+compatibility path targeted for removal in PR2. When present, the extension does
+not register its native tool catalog and instead keeps the CDP tunnel available
+to that adapter.
+
+Relevant `/capabilities` tags:
 
 - `allow_origin` means the extension may frame and call the daemon.
 - `cdp_tunnel_over_ws` means the daemon exposes the reverse CDP tunnel.
-- `browser_automation_mcp` means the external adapter command is configured and
-  browser automation MCP tools can be registered when the CDP bridge connects.
+- `client_mcp_over_ws` means extension-hosted tools can register over `/acp`.
+- `browser_automation_mcp` means the legacy external adapter is configured.
 
 ## Onboarding states
 
 The side panel probes `GET /health` and `GET /capabilities` and shows one of:
 
-| State                | Meaning                                | Shown                            |
-| -------------------- | -------------------------------------- | -------------------------------- |
-| `down`               | no daemon reachable                    | "Start qwen serve" + command     |
-| `needs-allow-origin` | daemon up but `--allow-origin` not set | "Allow this extension" + command |
-| `ready`              | daemon up and framing permitted        | the Web Shell (chat)             |
+| State                | Meaning                                  | Shown                            |
+| -------------------- | ---------------------------------------- | -------------------------------- |
+| `down`               | no daemon reachable                      | "Start qwen serve" + command     |
+| `needs-upgrade`      | daemon lacks secure extension pairing    | Qwen Code update command         |
+| `needs-restart`      | Chrome lost the active daemon credential | daemon restart guidance          |
+| `needs-allow-origin` | daemon up but `--allow-origin` not set   | "Allow this extension" + command |
+| `needs-pairing`      | daemon reachable, credential not trusted | pairing-code form                |
+| `ready`              | daemon reachable and paired              | the Web Shell (chat)             |
 
 ## Packaging for the Chrome Web Store
 
@@ -77,6 +93,12 @@ The side panel probes `GET /health` and `GET /capabilities` and shows one of:
 npm run package      # -> chrome-extension.zip (manifest at the zip root)
 ```
 
-Upload the zip to the Chrome Web Store Developer Dashboard. Note that the
-`debugger` and `<all_urls>` permissions will draw manual review — justify them
-in the store listing.
+Upload the zip to the Chrome Web Store Developer Dashboard. The `debugger`
+permission will draw manual review; explain that it is used only after a paired
+local Qwen Code daemon requests a browser debugging action. Host permissions
+are limited to the loopback daemon.
+
+Release the matching Qwen Code CLI before publishing the extension update. The
+pairing handshake intentionally does not downgrade for older daemons; the side
+panel detects them and shows an update command instead of sending browser tools
+to an unauthenticated local process.
diff --git a/packages/chrome-extension/config/esbuild.background.config.js b/packages/chrome-extension/config/esbuild.background.config.js
index c90ebf0a502..3b14e3d0f61 100644
--- a/packages/chrome-extension/config/esbuild.background.config.js
+++ b/packages/chrome-extension/config/esbuild.background.config.js
@@ -38,6 +38,7 @@ async function build() {
     target: ['chrome115'],
     minify: isProduction,
     sourcemap: !isProduction,
+    metafile: !isWatch,
     outdir: path.join(projectRoot, outDir),
     outbase: path.join(projectRoot, 'src'),
     logLevel: 'info',
@@ -47,7 +48,12 @@ async function build() {
     console.log('Watching background/content scripts...');
     await ctx.watch();
   } else {
-    await ctx.rebuild();
+    const result = await ctx.rebuild();
+    if (result.metafile) {
+      const metafilePath = path.join(projectRoot, 'dist/esbuild.json');
+      fs.mkdirSync(path.dirname(metafilePath), { recursive: true });
+      fs.writeFileSync(metafilePath, JSON.stringify(result.metafile, null, 2));
+    }
     await ctx.dispose();
     console.log('Background/content build complete!');
   }
diff --git a/packages/chrome-extension/docs/05-daemon-direct-architecture.md b/packages/chrome-extension/docs/05-daemon-direct-architecture.md
index d1c38982cb7..4c670c0ec1f 100644
--- a/packages/chrome-extension/docs/05-daemon-direct-architecture.md
+++ b/packages/chrome-extension/docs/05-daemon-direct-architecture.md
@@ -1,40 +1,40 @@
 # Daemon-Direct Architecture (issue #5626)
 
 Revival of the Chrome extension on the `qwen serve` daemon, dropping Native
-Messaging. This doc is the concrete implementation spec for the two phases.
+Messaging and external browser-tool servers from the default path.
 
 ```
 ┌─ Chrome extension (pure web client) ──────────────┐
-│  Side panel (React, @qwen-code/webui)             │
-│    DaemonSessionProvider ── chat over HTTP+SSE ───┼──┐
+│  Side panel                                       │
+│    daemon discovery + framed Web Shell ───────────┼──┐
 │  Service worker                                   │  │
 │    browser-tools MCP server (over WS) ────────────┼─┐│
-│  Content scripts (DOM / a11y / network capture)   │ ││
+│    chrome.debugger CDP tools + event capture ──────┼─┘│
 └───────────────────────────────────────────────────┘ ││
                                                        ▼▼
                         qwen serve daemon (localhost:4170, loopback auth-free)
 ```
 
-## Phase 1 — chat (no daemon changes)
+## Chat and pairing
 
 The side panel is a daemon client. `@qwen-code/webui`'s `DaemonSessionProvider`
 ({ baseUrl, token? }) handles connect / session-create / SSE / reconnect /
 heartbeat. Loopback ⇒ `token` omitted, `workspaceCwd` omitted (daemon uses its
 bound workspace).
 
-- `src/daemon/config.ts` — `{ baseUrl, token? }`, default `http://127.0.0.1:4170`,
-  overridable via `chrome.storage.local`.
-- `src/daemon/discovery.ts` — `GET /health` probe; gate the chat on reachability,
-  otherwise show a "run `qwen serve`" hint.
-- Side panel renders transcript/streaming/permissions from the webui daemon hooks,
-  reusing the existing presentational components + `ChromePlatformProvider`.
+- `src/daemon/config.ts` stores the loopback base URL, optional daemon bearer,
+  and the paired extension credential in `chrome.storage.local`.
+- `src/daemon/discovery.ts` probes daemon health and verifies a pairing
+  challenge before the panel or service worker trusts that daemon.
+- The side panel frames the daemon Web Shell after discovery and pairing.
+- Pairing state is process-local in PR1, so restarting `qwen serve` requires a
+  fresh terminal code. First-use mutual HMAC proof keeps both the code and the
+  derived credential secret off the wire; later discovery also uses an HMAC
+  challenge so stored credentials are not sent to an unknown process.
 
-The native-messaging transport (`background/native-connection.ts`,
-`native-message-handler.ts`, `native-messaging.ts` wiring) is dropped; the
-browser-tool executors, catalog, router, network tools, and content scripts are
-kept for Phase 2.
+The native-messaging transport is not part of this path.
 
-## Phase 2 — browser tools (reverse channel; touches the daemon contract)
+## Browser tools — extension-hosted reverse MCP
 
 A browser extension cannot be a listening MCP server. The agent runs inside the
 daemon and must reach tools that execute in the extension. The mechanism already
@@ -64,31 +64,28 @@ agent MCP client → SdkControlClientTransport.send
   → daemon: resolve sendMcpMessage promise → agent gets the tool result
 ```
 
-### Daemon side (new — `packages/cli/src/serve`, public-contract surface)
+### Daemon side (`packages/cli/src/serve`, public-contract surface)
 
 1. WS message types on the serve transport: `mcp_register` (client advertises a
-   server name + tool catalog), `mcp_message` (bidirectional JSON-RPC with an
-   `id` for request/response correlation), `mcp_unregister`.
+   server name; tools are discovered through MCP), `mcp_message` (bidirectional
+   JSON-RPC with an `id` for request/response correlation), `mcp_unregister`.
 2. On `mcp_register`, register a runtime **SDK-type** MCP server for the session
    (reuse `addRuntimeMcpServer` + `isSdkMcpServerConfig`), wiring its
    `sendSdkMcpMessage` callback to push `mcp_message` frames down this client's WS
    and await the correlated response.
 3. Tear down on WS close / `mcp_unregister`.
-4. Gate behind a capability flag (`caps.features` += `client_mcp_over_ws`) until
-   the contract is settled — this is the open question raised in #5626.
-
-### Extension side (reuses existing executors)
-
-- `src/background/browser-tools-server.ts` (new): build an MCP `Server`
-  (`@modelcontextprotocol/sdk`) whose `tools/list` = the kept `tool-catalog.ts`
-  and `tools/call` dispatches via the existing `tool-router.ts` →
-  `browser-tool-executors.ts` / `browser-network-tools.ts`, formatting with
-  `mcp-tool-result.ts`. Connect it to a transport that sends/receives
-  `mcp_message` over the DaemonClient WS; register on connect.
-- MVP catalog (~6 tools, read-first): `chrome_read_page`, `chrome_screenshot`,
-  `chrome_console`, `chrome_navigate`, `chrome_click_element`, `chrome_fill_or_select`.
-  Write/navigate tools gated behind per-tool consent (security: browser origin
-  defaults to read-only).
+4. Advertise `client_mcp_over_ws`; paired extension clients work by default.
+   Operators can disable the channel with `QWEN_SERVE_CLIENT_MCP_OVER_WS=0` or
+   explicitly set it to `1` to permit legacy unpaired reverse MCP clients.
+
+### Extension side
+
+- `src/background/browser-mcp/server.ts` implements the small MCP JSON-RPC
+  surface needed by the daemon transport without bundling another server.
+- `src/background/browser-mcp/browser-tools.ts` owns the tool catalog and the
+  bounded Console/Network recorders.
+- `src/background/browser-mcp/debugger-session.ts` owns the active tab debugger
+  attachment and CDP command/event lifecycle.
 
 ## Daemon lifecycle (issue #5626 Q3)
 
diff --git a/packages/chrome-extension/package.json b/packages/chrome-extension/package.json
index 598794e1605..92af263d894 100644
--- a/packages/chrome-extension/package.json
+++ b/packages/chrome-extension/package.json
@@ -32,8 +32,10 @@
     "build": "node scripts/sync-extension.js && node config/esbuild.background.config.js --production",
     "test": "vitest run --config vitest.config.ts",
     "test:ci": "vitest run --config vitest.config.ts",
+    "test:release": "npm run test:ci && npm run typecheck && npm run package",
+    "scan:artifacts": "node scripts/artifact-scan.js",
     "dev:chrome": "open -a 'Google Chrome' --args --load-extension=$PWD/dist/extension --auto-open-devtools-for-tabs",
-    "package": "npm run build && cd dist/extension && zip -r ../../chrome-extension.zip .",
+    "package": "npm run build && node scripts/package-extension.js && npm run scan:artifacts",
     "clean": "./scripts/clean.sh",
     "typecheck": "tsc --noEmit"
   },
@@ -42,6 +44,7 @@
   },
   "devDependencies": {
     "@types/chrome": "^0.1.32",
+    "archiver": "^7.0.1",
     "esbuild": "^0.25.3",
     "typescript": "^5.8.3"
   }
diff --git a/packages/chrome-extension/public/sidepanel.html b/packages/chrome-extension/public/sidepanel.html
index b4b7ea9f733..36db5f04454 100644
--- a/packages/chrome-extension/public/sidepanel.html
+++ b/packages/chrome-extension/public/sidepanel.html
@@ -272,6 +272,53 @@
         display: inline;
       }
 
+      .pair {
+        display: grid;
+        gap: 9px;
+        animation: rise 0.55s 0.21s both;
+      }
+      .pair__row {
+        display: flex;
+        gap: 8px;
+      }
+      .pair__input {
+        min-width: 0;
+        flex: 1;
+        padding: 10px 11px;
+        color: var(--text);
+        background: var(--panel);
+        border: 1px solid var(--border);
+        border-radius: 8px;
+        font:
+          600 13px/1 ui-monospace,
+          SFMono-Regular,
+          monospace;
+        letter-spacing: 0;
+      }
+      .pair__input:focus {
+        outline: 2px solid var(--accent);
+        outline-offset: 1px;
+      }
+      .pair__button {
+        flex: none;
+        padding: 0 13px;
+        color: var(--bg);
+        background: var(--status);
+        border: 1px solid transparent;
+        border-radius: 8px;
+        font-weight: 650;
+        cursor: pointer;
+      }
+      .pair__button:disabled {
+        opacity: 0.6;
+        cursor: wait;
+      }
+      .pair__message {
+        min-height: 18px;
+        color: var(--muted);
+        font-size: 12px;
+      }
+
       /* ---- live status ---- */
       .status {
         display: flex;
@@ -365,8 +412,7 @@
           <h1 id="welcome-title">Start qwen serve</h1>
           <p id="welcome-desc">
             No local qwen&nbsp;serve daemon is reachable. Run this in a terminal
-            and leave it running — this panel connects on its own. Browser
-            automation tools require QWEN_CDP_MCP_COMMAND.
+            and leave it running — this panel connects on its own.
           </p>
         </section>
 
@@ -427,6 +473,25 @@ <h1 id="welcome-title">Start qwen serve</h1>
             <span id="copy-label">Copy command</span>
           </button>
         </figure>
+
+        <form id="pair-form" class="pair hidden">
+          <div class="pair__row">
+            <input
+              id="pair-code"
+              class="pair__input"
+              inputmode="text"
+              autocomplete="one-time-code"
+              placeholder="xxxx-xxxx-xxxx-xxxx-xxxx-xxxx-xxxx-xxxx"
+              maxlength="39"
+              pattern="(?:[0-9a-fA-F]{4}-?){8}"
+              aria-label="Pairing code"
+            />
+            <button id="pair-submit" class="pair__button" type="submit">
+              Pair
+            </button>
+          </div>
+          <div id="pair-message" class="pair__message" role="status"></div>
+        </form>
       </div>
 
       <footer class="status">
diff --git a/packages/chrome-extension/public/sidepanel.js b/packages/chrome-extension/public/sidepanel.js
index 1c5a3ec69c5..d5e5ad53b27 100644
--- a/packages/chrome-extension/public/sidepanel.js
+++ b/packages/chrome-extension/public/sidepanel.js
@@ -5,24 +5,32 @@
  *
  * Side panel host. Probes the local `qwen serve` daemon and either frames its
  * Web Shell (chat + tools) or shows a welcome screen with the exact command to
- * run. The extension has no UI of its own — it's a CDP-tunnel pipe — so the
- * panel just frames the daemon once one is reachable and permits framing.
+ * run. Native browser tools run in the extension service worker; the panel
+ * handles daemon discovery and first-use pairing before framing the Web Shell.
  *
  * Static asset (no bundler). Constants intentionally duplicate daemon/config.ts
  * (which the bundled service worker uses) to stay standalone.
  */
-/* global chrome, document, fetch, AbortController, navigator, setTimeout, clearTimeout, setInterval, URL */
+/* global chrome, document, fetch, AbortController, navigator, setTimeout, clearTimeout, setInterval, URL, crypto, TextEncoder, btoa */
 
 const DEFAULT_BASE_URL = 'http://127.0.0.1:4170';
 const STORAGE_KEY = 'qwen.daemon';
 const POLL_MS = 2000;
 const PROBE_TIMEOUT_MS = 2000;
+const PAIRING_VERIFY_CACHE_MS = 10_000;
 const FRAMED_MISS_LIMIT = 2;
 const SHELL_AUTH_MESSAGE_TYPE = 'qwen-daemon-auth';
+const DAEMON_READY_MESSAGE_TYPE = 'qwen-daemon-ready';
+const OFFICIAL_EXTENSION_ID = 'idkijaaipeeinemigojbjkmfmabokbdk';
+const PAIRING_DOMAIN = 'qwen-extension-pairing';
+const VERIFICATION_DOMAIN = 'qwen-extension-daemon';
+const BASE64URL_256_PATTERN = /^[A-Za-z0-9_-]{43}$/;
 
-/** The command to start a daemon that allows this extension's own origin. */
+/** Official builds are allowlisted by qwen serve; custom builds stay explicit. */
 const allowOriginCommand = (extensionId) =>
-  `qwen serve --allow-origin chrome-extension://${extensionId}`;
+  extensionId === OFFICIAL_EXTENSION_ID
+    ? 'qwen serve'
+    : `qwen serve --allow-origin chrome-extension://${extensionId}`;
 
 const els = {
   iframe: document.getElementById('ui'),
@@ -33,6 +41,11 @@ const els = {
   cmdRow: document.getElementById('cmd-row'),
   copy: document.getElementById('copy'),
   copyLabel: document.getElementById('copy-label'),
+  pairForm: document.getElementById('pair-form'),
+  pairCode: document.getElementById('pair-code'),
+  pairSubmit: document.getElementById('pair-submit'),
+  pairMessage: document.getElementById('pair-message'),
+  statusText: document.querySelector('.status__text'),
 };
 
 /** Whether a URL points at the local loopback interface. */
@@ -62,6 +75,10 @@ async function readConfig() {
     return {
       baseUrl,
       token: (typeof cfg.token === 'string' && cfg.token.trim()) || undefined,
+      extensionPairingCredential:
+        (typeof cfg.extensionPairingCredential === 'string' &&
+          cfg.extensionPairingCredential.trim()) ||
+        undefined,
     };
   } catch {
     return { baseUrl: DEFAULT_BASE_URL, token: undefined };
@@ -69,12 +86,16 @@ async function readConfig() {
 }
 
 /** GET a daemon endpoint with a short timeout; returns parsed JSON or null. */
-async function probeJson(url, token) {
+async function probeJson(url, token, options = {}) {
   const ctrl = new AbortController();
   const timer = setTimeout(() => ctrl.abort(), PROBE_TIMEOUT_MS);
+  const headers = { ...(options.headers || {}) };
+  if (token) headers.Authorization = `Bearer ${token}`;
   try {
     const res = await fetch(url, {
-      headers: token ? { Authorization: `Bearer ${token}` } : {},
+      method: options.method || 'GET',
+      headers,
+      body: options.body,
       signal: ctrl.signal,
     });
     if (!res.ok) return null;
@@ -86,13 +107,134 @@ async function probeJson(url, token) {
   }
 }
 
-/** Probe `/health` then `/capabilities` and reduce to an onboarding state. */
-async function probeState(baseUrl, token) {
+async function verifyPairing(baseUrl, credential) {
+  if (!credential) return false;
+  const separator = credential.indexOf('.');
+  if (separator <= 0 || separator === credential.length - 1) return false;
+  const credentialId = credential.slice(0, separator);
+  const secret = credential.slice(separator + 1);
+  const challengeBytes = new Uint8Array(32);
+  crypto.getRandomValues(challengeBytes);
+  const challenge = base64Url(challengeBytes.buffer);
+  const body = await probeJson(
+    `${baseUrl}/extension/pairing/verify`,
+    undefined,
+    {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ credentialId, challenge }),
+    },
+  );
+  if (typeof body?.proof !== 'string') return false;
+  return proofsEqual(body.proof, await pairingProof(secret, challenge));
+}
+
+function base64Url(bytes) {
+  let binary = '';
+  for (const byte of new Uint8Array(bytes)) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary)
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+}
+
+async function hmacProof(secret, message) {
+  const encoder = new TextEncoder();
+  const digest = await crypto.subtle.digest('SHA-256', encoder.encode(secret));
+  const key = await crypto.subtle.importKey(
+    'raw',
+    digest,
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign'],
+  );
+  return base64Url(
+    await crypto.subtle.sign('HMAC', key, encoder.encode(message)),
+  );
+}
+
+function pairingProof(secret, challenge) {
+  return hmacProof(secret, `${VERIFICATION_DOMAIN}:${challenge}`);
+}
+
+function exchangeProof(code, direction, pairingNonce, challenge, suffix = '') {
+  return hmacProof(
+    code,
+    `${PAIRING_DOMAIN}:${direction}:${pairingNonce}:${challenge}${suffix}`,
+  );
+}
+
+function proofsEqual(left, right) {
+  if (left.length !== right.length) return false;
+  let difference = 0;
+  for (let index = 0; index < left.length; index++) {
+    difference |= left.charCodeAt(index) ^ right.charCodeAt(index);
+  }
+  return difference === 0;
+}
+
+function notifyDaemonReady() {
+  void chrome.runtime
+    .sendMessage({ type: DAEMON_READY_MESSAGE_TYPE })
+    .catch(() => undefined);
+}
+
+let pairingCache = null;
+let pendingPairingNonce = null;
+
+/** Probe the daemon and reduce it to one onboarding state. */
+async function probeState(baseUrl, token, extensionPairingCredential) {
+  const cacheFresh =
+    !token &&
+    pairingCache?.baseUrl === baseUrl &&
+    pairingCache?.credential === extensionPairingCredential &&
+    Date.now() - pairingCache.verifiedAt < PAIRING_VERIFY_CACHE_MS;
+  if (
+    cacheFresh ||
+    (await verifyPairing(baseUrl, extensionPairingCredential))
+  ) {
+    pendingPairingNonce = null;
+    pairingCache = {
+      baseUrl,
+      credential: extensionPairingCredential,
+      verifiedAt: Date.now(),
+    };
+  } else {
+    pairingCache = null;
+    // Pairing endpoints intentionally precede bearer auth. The terminal code
+    // stays in the extension and authenticates this first-use exchange before
+    // any stored daemon token is exposed.
+    const status = await probeJson(`${baseUrl}/extension/pairing`, undefined);
+    if (status?.paired === true) {
+      pendingPairingNonce = null;
+      return 'needs-restart';
+    }
+    if (
+      status?.paired === false &&
+      typeof status.pairingNonce === 'string' &&
+      /^[A-Za-z0-9_-]{22}$/.test(status.pairingNonce)
+    ) {
+      pendingPairingNonce = status.pairingNonce;
+      return 'needs-pairing';
+    }
+    pendingPairingNonce = null;
+    // This carries no credential. A successful health probe with no pairing
+    // route identifies an older daemon, so the panel can show the right fix.
+    const legacyHealth = await probeJson(`${baseUrl}/health`, undefined);
+    return legacyHealth ? 'needs-upgrade' : 'down';
+  }
+
   const health = await probeJson(`${baseUrl}/health`, token);
-  if (!health) return 'down';
+  if (!health) {
+    pairingCache = null;
+    return 'down';
+  }
   const caps = await probeJson(`${baseUrl}/capabilities`, token);
   const features = Array.isArray(caps?.features) ? caps.features : [];
-  return features.includes('allow_origin') ? 'ready' : 'needs-allow-origin';
+  if (!features.includes('allow_origin')) return 'needs-allow-origin';
+  return 'ready';
 }
 
 /** Render the welcome screen for a non-ready state. */
@@ -101,20 +243,39 @@ function showWelcome(state, command) {
   els.iframe.removeAttribute('src');
   els.iframe.classList.add('hidden');
   els.welcome.classList.remove('hidden');
+  els.pairForm.classList.toggle('hidden', state !== 'needs-pairing');
   els.cmd.textContent = command;
   if (state === 'down') {
     els.title.textContent = 'Start qwen serve';
     els.desc.textContent =
       'No local qwen serve daemon is reachable. Run this in a terminal and ' +
-      'leave it running, then this panel connects automatically. Set ' +
-      'QWEN_CDP_MCP_COMMAND as well to enable browser automation tools.';
-  } else {
+      'leave it running, then this panel connects automatically.';
+    els.statusText.textContent = 'Listening for the daemon...';
+  } else if (state === 'needs-allow-origin') {
     els.title.textContent = 'Allow this extension';
     els.desc.textContent =
       'qwen serve is running but is not allowed to load its UI here. Restart ' +
       'it with the flag below (it names this extension), then this panel ' +
-      'connects automatically. Set QWEN_CDP_MCP_COMMAND as well to enable ' +
-      'browser automation tools.';
+      'connects automatically.';
+    els.statusText.textContent = 'Waiting for an allowed daemon...';
+  } else if (state === 'needs-upgrade') {
+    els.title.textContent = 'Update Qwen Code';
+    els.desc.textContent =
+      'The local daemon is running but does not support secure Chrome ' +
+      'extension pairing. Update Qwen Code, then restart qwen serve.';
+    els.statusText.textContent = 'Waiting for an updated daemon...';
+  } else if (state === 'needs-restart') {
+    els.title.textContent = 'Restart qwen serve';
+    els.desc.textContent =
+      'Chrome pairing data is missing or no longer matches this daemon. Stop ' +
+      'the running daemon, start it again, then enter the new pairing code.';
+    els.statusText.textContent = 'Waiting for a fresh daemon...';
+  } else {
+    els.title.textContent = 'Pair Qwen Code';
+    els.desc.textContent =
+      'qwen serve is running. Enter the Chrome extension pairing code shown ' +
+      'in that terminal, then this panel connects automatically.';
+    els.statusText.textContent = 'Waiting for pairing...';
   }
 }
 
@@ -133,10 +294,12 @@ function postShellAuth(baseUrl, token) {
 function showShell(baseUrl, token) {
   framedMisses = 0;
   els.welcome.classList.add('hidden');
+  els.pairForm.classList.add('hidden');
   els.iframe.onload = () => postShellAuth(baseUrl, token);
   if (framedUrl !== baseUrl) {
     framedUrl = baseUrl;
     els.iframe.src = baseUrl;
+    notifyDaemonReady();
   } else {
     postShellAuth(baseUrl, token);
   }
@@ -156,8 +319,8 @@ async function tick() {
   if (ticking) return;
   ticking = true;
   try {
-    const { baseUrl, token } = await readConfig();
-    const state = await probeState(baseUrl, token);
+    const { baseUrl, token, extensionPairingCredential } = await readConfig();
+    const state = await probeState(baseUrl, token, extensionPairingCredential);
     if (state === 'ready') {
       showShell(baseUrl, token);
     } else {
@@ -166,13 +329,102 @@ async function tick() {
         return;
       }
       framedMisses = 0;
-      showWelcome(state, allowOriginCommand(chrome.runtime.id));
+      showWelcome(
+        state,
+        state === 'needs-upgrade'
+          ? 'npm install -g @qwen-code/qwen-code@latest'
+          : allowOriginCommand(chrome.runtime.id),
+      );
     }
   } finally {
     ticking = false;
   }
 }
 
+async function savePairingCredential(baseUrl, credential) {
+  const stored = await chrome.storage.local.get(STORAGE_KEY);
+  const current = (stored && stored[STORAGE_KEY]) || {};
+  await chrome.storage.local.set({
+    [STORAGE_KEY]: {
+      ...current,
+      baseUrl,
+      extensionPairingCredential: credential,
+    },
+  });
+}
+
+async function submitPairing(event) {
+  event.preventDefault();
+  const code = (els.pairCode.value || '').trim().toLowerCase();
+  const pairingNonce = pendingPairingNonce;
+  if (!code || !pairingNonce) {
+    els.pairMessage.textContent = 'Enter the code from your terminal.';
+    return;
+  }
+  const { baseUrl } = await readConfig();
+  els.pairMessage.textContent = 'Pairing...';
+  els.pairSubmit.disabled = true;
+  try {
+    const challengeBytes = new Uint8Array(32);
+    crypto.getRandomValues(challengeBytes);
+    const challenge = base64Url(challengeBytes.buffer);
+    const clientProof = await exchangeProof(
+      code,
+      'client',
+      pairingNonce,
+      challenge,
+    );
+    const body = await probeJson(
+      `${baseUrl}/extension/pairing/confirm`,
+      undefined,
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ pairingNonce, challenge, clientProof }),
+      },
+    );
+    const credentialId = body?.credentialId;
+    if (
+      typeof credentialId !== 'string' ||
+      !/^[A-Za-z0-9_-]{11}$/.test(credentialId) ||
+      typeof body?.proof !== 'string' ||
+      !BASE64URL_256_PATTERN.test(body.proof)
+    ) {
+      els.pairMessage.textContent =
+        'Pairing failed. Check the latest code in the terminal and try again.';
+      return;
+    }
+    const expectedProof = await exchangeProof(
+      code,
+      'server',
+      pairingNonce,
+      challenge,
+      `:${credentialId}`,
+    );
+    if (!proofsEqual(body.proof, expectedProof)) {
+      els.pairMessage.textContent =
+        'Pairing failed because the daemon could not prove its identity.';
+      return;
+    }
+    const credentialSecret = await exchangeProof(
+      code,
+      'credential',
+      pairingNonce,
+      challenge,
+      `:${credentialId}`,
+    );
+    await savePairingCredential(baseUrl, `${credentialId}.${credentialSecret}`);
+    pendingPairingNonce = null;
+    pairingCache = null;
+    els.pairMessage.textContent = 'Paired.';
+    els.pairCode.value = '';
+    notifyDaemonReady();
+    await tick();
+  } finally {
+    els.pairSubmit.disabled = false;
+  }
+}
+
 let copyResetTimer = null;
 /** Copy the command and flash a check-mark confirmation on the footer button. */
 async function copyCommand() {
@@ -201,6 +453,16 @@ els.cmdRow.addEventListener('keydown', (e) => {
     copyCommand();
   }
 });
+els.pairForm.addEventListener('submit', (event) => {
+  void submitPairing(event);
+});
+els.pairCode.addEventListener('input', () => {
+  const hex = els.pairCode.value
+    .replace(/[^0-9a-f]/gi, '')
+    .slice(0, 32)
+    .toLowerCase();
+  els.pairCode.value = (hex.match(/.{1,4}/g) || []).join('-');
+});
 
 // Fill the command synchronously so first paint isn't an empty prompt — the id
 // is available immediately; tick() then keeps title/desc/command per probe.
diff --git a/packages/chrome-extension/scripts/artifact-scan.js b/packages/chrome-extension/scripts/artifact-scan.js
new file mode 100644
index 00000000000..6a68c63a0ad
--- /dev/null
+++ b/packages/chrome-extension/scripts/artifact-scan.js
@@ -0,0 +1,106 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { access, readFile, readdir } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const CONTENT_SIGNATURES = [
+  'class McpContext',
+  'PageCollector',
+  'chrome-devtools-mcp',
+  'puppeteer-core',
+  '@modelcontextprotocol/server-puppeteer',
+];
+const INPUT_SIGNATURES = [
+  'node_modules/chrome-devtools-mcp/',
+  'node_modules/puppeteer-core/',
+];
+const ZIP_PATH_SIGNATURES = [
+  'chrome-devtools-mcp',
+  'puppeteer-core',
+  '@modelcontextprotocol/server-puppeteer',
+];
+
+async function filesUnder(root) {
+  const files = [];
+  for (const entry of await readdir(root, { withFileTypes: true })) {
+    const file = path.join(root, entry.name);
+    if (entry.isDirectory()) files.push(...(await filesUnder(file)));
+    else if (entry.isFile()) files.push(file);
+    else if (entry.isSymbolicLink()) {
+      throw new Error(`Release artifact contains a symbolic link: ${file}`);
+    }
+  }
+  return files;
+}
+
+async function scanRoot(root) {
+  const findings = [];
+  for (const file of await filesUnder(root)) {
+    const content = await readFile(file, 'utf8');
+    for (const signature of CONTENT_SIGNATURES) {
+      if (content.includes(signature)) findings.push(`${file}: ${signature}`);
+    }
+  }
+  return findings;
+}
+
+async function scanMetafile(file) {
+  const metafile = JSON.parse(await readFile(file, 'utf8'));
+  const findings = [];
+  for (const input of Object.keys(metafile.inputs ?? {})) {
+    const normalized = input.replaceAll('\\', '/');
+    for (const signature of INPUT_SIGNATURES) {
+      if (normalized.includes(signature))
+        findings.push(`${file}: ${signature}`);
+    }
+  }
+  return findings;
+}
+
+export async function scanZip(file) {
+  // ZIP entry names are stored verbatim in the central directory even when
+  // file bodies are deflated. The source tree is scanned for body signatures;
+  // this final-archive pass catches stale or unexpected forbidden entries.
+  const archive = (await readFile(file)).toString('latin1');
+  return ZIP_PATH_SIGNATURES.filter((signature) =>
+    archive.includes(signature),
+  ).map((signature) => `${file}: ${signature}`);
+}
+
+const scriptPath = fileURLToPath(import.meta.url);
+const packageRoot = path.resolve(path.dirname(scriptPath), '..');
+const roots = [path.join(packageRoot, 'dist/extension')];
+const metafiles = [path.join(packageRoot, 'dist/esbuild.json')];
+const archives = [path.join(packageRoot, 'chrome-extension.zip')];
+
+async function main() {
+  const findings = [];
+  for (const root of roots) {
+    await access(root);
+    findings.push(...(await scanRoot(root)));
+  }
+  for (const metafile of metafiles) {
+    await access(metafile);
+    findings.push(...(await scanMetafile(metafile)));
+  }
+  for (const archive of archives) {
+    await access(archive);
+    findings.push(...(await scanZip(archive)));
+  }
+
+  if (findings.length) {
+    findings.forEach((finding) => console.error(finding));
+    process.exitCode = 1;
+  } else {
+    console.log('ARTIFACT-SCAN: PASS');
+  }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === scriptPath) {
+  await main();
+}
diff --git a/packages/chrome-extension/scripts/package-extension.js b/packages/chrome-extension/scripts/package-extension.js
new file mode 100644
index 00000000000..4769f2693b1
--- /dev/null
+++ b/packages/chrome-extension/scripts/package-extension.js
@@ -0,0 +1,32 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import archiver from 'archiver';
+import { createWriteStream } from 'node:fs';
+import { rm } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const packageRoot = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '..',
+);
+const extensionRoot = path.join(packageRoot, 'dist/extension');
+const archive = path.join(packageRoot, 'chrome-extension.zip');
+
+await rm(archive, { force: true });
+await new Promise((resolve, reject) => {
+  const output = createWriteStream(archive);
+  const zip = archiver('zip', { zlib: { level: 9 } });
+  output.once('close', resolve);
+  output.once('error', reject);
+  zip.once('error', reject);
+  zip.once('warning', reject);
+  zip.pipe(output);
+  zip.directory(extensionRoot, false);
+  void zip.finalize();
+});
+console.log(`Created ${archive}`);
diff --git a/packages/chrome-extension/src/background/browser-mcp/browser-tools.test.ts b/packages/chrome-extension/src/background/browser-mcp/browser-tools.test.ts
new file mode 100644
index 00000000000..ac50d6f6726
--- /dev/null
+++ b/packages/chrome-extension/src/background/browser-mcp/browser-tools.test.ts
@@ -0,0 +1,589 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { BrowserTools } from './browser-tools.js';
+import type {
+  DebuggerEventListener,
+  DebuggerSession,
+} from './debugger-session.js';
+
+class FakeSession implements DebuggerSession {
+  listener: DebuggerEventListener = () => {};
+  changed = true;
+  tabId = 1;
+  readonly send = vi.fn(
+    async (
+      method: string,
+      params?: Record<string, unknown>,
+    ): Promise<Record<string, unknown>> => {
+      if (method === 'Accessibility.getFullAXTree') {
+        return {
+          nodes: [
+            {
+              role: { value: 'button' },
+              name: { value: 'Submit' },
+              backendDOMNodeId: 42,
+            },
+          ],
+        };
+      }
+      if (method === 'DOM.getBoxModel') {
+        return { model: { content: [0, 0, 20, 0, 20, 10, 0, 10] } };
+      }
+      if (method === 'DOM.resolveNode') {
+        return { object: { objectId: 'input-1' } };
+      }
+      if (method === 'Network.getResponseBody') {
+        return { body: '{"ok":true}', base64Encoded: false };
+      }
+      if (
+        method === 'Runtime.evaluate' &&
+        String(params?.['expression']).includes('document.readyState')
+      ) {
+        return { result: { value: true } };
+      }
+      return {};
+    },
+  );
+
+  async ensureAttached(): Promise<{ tabId: number; changed: boolean }> {
+    const changed = this.changed;
+    this.changed = false;
+    return { tabId: this.tabId, changed };
+  }
+
+  async withAttached<T>(operation: () => Promise<T>): Promise<T> {
+    return operation();
+  }
+
+  onEvent(listener: DebuggerEventListener): () => void {
+    this.listener = listener;
+    return () => {};
+  }
+
+  async getTab(): Promise<chrome.tabs.Tab> {
+    return {
+      id: this.tabId,
+      index: 0,
+      pinned: false,
+      highlighted: true,
+      active: true,
+      frozen: false,
+      incognito: false,
+      selected: true,
+      discarded: false,
+      autoDiscardable: true,
+      groupId: -1,
+      windowId: 1,
+      title: 'Fixture',
+      url: 'https://example.test',
+    };
+  }
+
+  async detach(): Promise<void> {}
+
+  emit(method: string, params: Record<string, unknown>): void {
+    this.listener(method, params);
+  }
+}
+
+function resultText(
+  result: Awaited<ReturnType<BrowserTools['callTool']>>,
+): string {
+  const content = result.content[0];
+  if (!content || content.type !== 'text')
+    throw new Error('Expected text result');
+  return content.text;
+}
+
+describe('BrowserTools', () => {
+  let session: FakeSession;
+  let tools: BrowserTools;
+
+  beforeEach(() => {
+    session = new FakeSession();
+    tools = new BrowserTools(session);
+  });
+
+  it('offers the complete first-release debugging catalog', () => {
+    expect(tools.tools.map((entry) => entry.name)).toEqual(
+      expect.arrayContaining([
+        'take_snapshot',
+        'take_screenshot',
+        'click',
+        'fill',
+        'evaluate_script',
+        'list_console_messages',
+        'list_network_requests',
+        'get_network_request',
+      ]),
+    );
+  });
+
+  it('creates element refs and clicks the referenced box', async () => {
+    const snapshot = await tools.callTool('take_snapshot', {});
+    expect(resultText(snapshot)).toContain('[ref=e1] button "Submit"');
+
+    const click = await tools.callTool('click', { ref: 'e1' });
+    expect(click.isError).not.toBe(true);
+    expect(session.send).toHaveBeenCalledWith('DOM.scrollIntoViewIfNeeded', {
+      backendNodeId: 42,
+    });
+    expect(session.send).toHaveBeenCalledWith(
+      'Input.dispatchMouseEvent',
+      expect.objectContaining({ type: 'mousePressed', x: 10, y: 5 }),
+    );
+  });
+
+  it('captures screenshots and drives navigation history', async () => {
+    await tools.callTool('list_console_messages', {});
+    session.send.mockResolvedValueOnce({ data: 'png-data' });
+    const screenshot = await tools.callTool('take_screenshot', {});
+    expect(screenshot.content).toEqual([
+      { type: 'image', data: 'png-data', mimeType: 'image/png' },
+    ]);
+
+    await tools.callTool('navigate_page', { url: 'example.test' });
+    expect(session.send).toHaveBeenCalledWith('Page.navigate', {
+      url: 'https://example.test',
+    });
+    await tools.callTool('reload_page', {});
+    expect(session.send).toHaveBeenCalledWith('Page.reload');
+
+    session.send.mockResolvedValueOnce({
+      currentIndex: 1,
+      entries: [{ id: 10 }, { id: 11 }],
+    });
+    await tools.callTool('go_back', {});
+    expect(session.send).toHaveBeenCalledWith('Page.navigateToHistoryEntry', {
+      entryId: 10,
+    });
+  });
+
+  it('rejects screenshots that would exceed the WebSocket frame budget', async () => {
+    await tools.callTool('list_console_messages', {});
+    session.send.mockResolvedValueOnce({
+      data: 'a'.repeat(8 * 1_048_576 + 1),
+    });
+
+    const screenshot = await tools.callTool('take_screenshot', {});
+
+    expect(screenshot.isError).toBe(true);
+    expect(resultText(screenshot)).toContain('Screenshot is too large');
+  });
+
+  it('caps evaluated text results to the reverse WebSocket frame budget', async () => {
+    await tools.callTool('list_console_messages', {});
+    session.send.mockResolvedValueOnce({
+      result: { value: 'a'.repeat(2 * 1_048_576) },
+    });
+
+    const result = await tools.callTool('evaluate_script', {
+      expression: 'window.largeValue',
+    });
+    const output = resultText(result);
+
+    expect(output.length).toBeLessThanOrEqual(1_048_576);
+    expect(output.endsWith('... [truncated]')).toBe(true);
+  });
+
+  it('caps snapshot text and redacts secrets from the page URL', async () => {
+    session.send.mockImplementation(async (method: string) => {
+      if (method === 'Accessibility.getFullAXTree') {
+        return {
+          nodes: Array.from({ length: 500 }, (_, index) => ({
+            role: { value: 'text' },
+            name: { value: `${index}-${'a'.repeat(65_536)}` },
+          })),
+        };
+      }
+      return {};
+    });
+    const tab = await session.getTab();
+    vi.spyOn(session, 'getTab').mockResolvedValue({
+      ...tab,
+      url: 'https://user:password@example.test/?access_token=secret&name=qwen',
+    });
+
+    const output = resultText(await tools.callTool('take_snapshot', {}));
+
+    expect(output.length).toBeLessThanOrEqual(1_048_576);
+    expect(output.endsWith('... [truncated]')).toBe(true);
+    expect(output).not.toContain('password');
+    expect(output).not.toContain('secret');
+    expect(output).toContain('name=qwen');
+  });
+
+  it('fills snapshot controls and rejects stale refs', async () => {
+    await tools.callTool('take_snapshot', {});
+    const result = await tools.callTool('fill', {
+      ref: 'e1',
+      value: 'qwen',
+    });
+    expect(result.isError).not.toBe(true);
+    expect(session.send).toHaveBeenCalledWith('Runtime.callFunctionOn', {
+      objectId: 'input-1',
+      functionDeclaration: expect.stringContaining("new Event('input'"),
+      arguments: [{ value: 'qwen' }],
+      returnByValue: true,
+    });
+
+    const stale = await tools.callTool('fill', {
+      ref: 'missing',
+      value: 'qwen',
+    });
+    expect(stale.isError).toBe(true);
+    expect(resultText(stale)).toContain('Unknown or stale element ref');
+  });
+
+  it('rejects navigation to non-web URL schemes', async () => {
+    const result = await tools.callTool('navigate_page', {
+      url: 'javascript:document.body.textContent',
+    });
+
+    expect(result.isError).toBe(true);
+    expect(resultText(result)).toContain(
+      'Navigation only supports http: and https: URLs',
+    );
+    expect(session.send).not.toHaveBeenCalledWith(
+      'Page.navigate',
+      expect.anything(),
+    );
+  });
+
+  it('reports navigation failures returned by Chrome', async () => {
+    await tools.callTool('list_console_messages', {});
+    session.send.mockResolvedValueOnce({
+      errorText: 'net::ERR_NAME_NOT_RESOLVED',
+    });
+
+    const result = await tools.callTool('navigate_page', {
+      url: 'https://missing.invalid',
+    });
+
+    expect(result.isError).toBe(true);
+    expect(resultText(result)).toContain('net::ERR_NAME_NOT_RESOLVED');
+  });
+
+  it('limits bulk form operations', async () => {
+    const result = await tools.callTool('fill_form', {
+      fields: Array.from({ length: 51 }, () => ({ ref: 'e1', value: 'x' })),
+    });
+
+    expect(result.isError).toBe(true);
+    expect(resultText(result)).toContain('more than 50 entries');
+  });
+
+  it('reports page-side fill failures', async () => {
+    await tools.callTool('take_snapshot', {});
+    session.send.mockImplementation(async (method: string) => {
+      if (method === 'DOM.resolveNode') {
+        return { object: { objectId: 'input-1' } };
+      }
+      if (method === 'Runtime.callFunctionOn') {
+        return {
+          exceptionDetails: {
+            exception: { description: 'TypeError: value setter failed' },
+          },
+        };
+      }
+      return {};
+    });
+
+    const result = await tools.callTool('fill', {
+      ref: 'e1',
+      value: 'qwen',
+    });
+
+    expect(result.isError).toBe(true);
+    expect(resultText(result)).toContain('TypeError: value setter failed');
+  });
+
+  it('retries CDP domain setup after initialization fails', async () => {
+    session.send.mockRejectedValueOnce(new Error('Network.enable failed'));
+
+    const failed = await tools.callTool('list_network_requests', {});
+    const retried = await tools.callTool('list_network_requests', {});
+
+    expect(failed.isError).toBe(true);
+    expect(retried.isError).not.toBe(true);
+    expect(session.send).toHaveBeenCalledTimes(12);
+  });
+
+  it('drives keyboard, scroll, wait, and page-context fetch commands', async () => {
+    await tools.callTool('list_console_messages', {});
+    await tools.callTool('press_key', { key: 'Enter' });
+    expect(session.send).toHaveBeenCalledWith(
+      'Input.dispatchKeyEvent',
+      expect.objectContaining({
+        type: 'keyDown',
+        key: 'Enter',
+        windowsVirtualKeyCode: 13,
+      }),
+    );
+
+    await tools.callTool('scroll_page', { x: 2, y: 300 });
+    expect(session.send).toHaveBeenCalledWith('Runtime.evaluate', {
+      expression: 'window.scrollBy(2, 300)',
+    });
+
+    session.send.mockResolvedValueOnce({ result: { value: true } });
+    const waited = await tools.callTool('wait_for', {
+      text: 'Ready',
+      timeoutMs: 10,
+    });
+    expect(resultText(waited)).toBe('Found text: Ready');
+
+    session.send.mockResolvedValueOnce({
+      result: { value: { status: 200, body: 'ok' } },
+    });
+    const request = await tools.callTool('send_request', {
+      url: '/api',
+      method: 'POST',
+      body: '{}',
+    });
+    expect(resultText(request)).toContain('"status": 200');
+    expect(session.send).toHaveBeenLastCalledWith(
+      'Runtime.evaluate',
+      expect.objectContaining({
+        expression: expect.stringContaining('fetch("/api"'),
+        timeout: 20_000,
+      }),
+    );
+  });
+
+  it('captures console output', async () => {
+    await tools.callTool('list_console_messages', {});
+    session.emit('Runtime.consoleAPICalled', {
+      type: 'error',
+      args: [{ value: 'boom' }, { value: 42 }],
+      timestamp: 10,
+    });
+    const result = await tools.callTool('list_console_messages', {});
+    expect(JSON.parse(resultText(result))).toMatchObject([
+      { id: 1, type: 'error', text: 'boom 42' },
+    ]);
+  });
+
+  it('keeps the useful exception description', async () => {
+    await tools.callTool('list_console_messages', {});
+    session.emit('Runtime.exceptionThrown', {
+      exceptionDetails: {
+        text: 'Uncaught',
+        exception: { description: 'TypeError: useful failure\n at app.js:1' },
+      },
+    });
+
+    const result = await tools.callTool('list_console_messages', {});
+
+    expect(resultText(result)).toContain('TypeError: useful failure');
+  });
+
+  it('limits console listings while keeping full entries addressable', async () => {
+    await tools.callTool('list_console_messages', {});
+    for (let index = 1; index <= 60; index++) {
+      session.emit('Runtime.consoleAPICalled', {
+        type: 'log',
+        args: [{ value: `message-${index}` }],
+        stackTrace: { callFrames: [{ functionName: `fn-${index}` }] },
+      });
+    }
+
+    const listed = JSON.parse(
+      resultText(await tools.callTool('list_console_messages', {})),
+    );
+    expect(listed).toHaveLength(50);
+    expect(listed[0]).toMatchObject({ id: 11, text: 'message-11' });
+    expect(listed[0]).not.toHaveProperty('stack');
+
+    const full = JSON.parse(
+      resultText(await tools.callTool('get_console_message', { id: 1 })),
+    );
+    expect(full.stack).toBeDefined();
+  });
+
+  it('returns valid text when an evaluated expression is undefined', async () => {
+    await tools.callTool('list_console_messages', {});
+    session.send.mockResolvedValueOnce({ result: { type: 'undefined' } });
+
+    const result = await tools.callTool('evaluate_script', {
+      expression: 'console.log("done")',
+    });
+
+    expect(resultText(result)).toBe('undefined');
+  });
+
+  it('captures and redacts network request and response details', async () => {
+    await tools.callTool('list_network_requests', {});
+    session.emit('Network.requestWillBeSent', {
+      requestId: 'request-1',
+      type: 'Fetch',
+      request: {
+        url: 'https://example.test/api',
+        method: 'POST',
+        headers: { Authorization: 'Bearer secret', Accept: 'application/json' },
+        postData: '{"token":"secret","name":"qwen"}',
+      },
+    });
+    session.emit('Network.responseReceived', {
+      requestId: 'request-1',
+      type: 'Fetch',
+      response: {
+        status: 200,
+        statusText: 'OK',
+        mimeType: 'application/json',
+        headers: { 'Set-Cookie': 'session=secret' },
+      },
+    });
+    session.emit('Network.loadingFinished', {
+      requestId: 'request-1',
+      encodedDataLength: 11,
+    });
+
+    const result = await tools.callTool('get_network_request', {
+      requestId: 'request-1',
+    });
+    const request = JSON.parse(resultText(result));
+    expect(request.requestHeaders.Authorization).toBe('[REDACTED]');
+    expect(request.requestHeaders.Accept).toBe('application/json');
+    expect(request.postData).toBe('{"token":"[REDACTED]","name":"qwen"}');
+    expect(request.responseHeaders['Set-Cookie']).toBe('[REDACTED]');
+    expect(request.responseBody).toBe('{"ok":true}');
+  });
+
+  it('redacts secrets from URLs, form bodies, and console text', async () => {
+    await tools.callTool('list_network_requests', {});
+    session.emit('Network.requestWillBeSent', {
+      requestId: 'request-3',
+      request: {
+        url: 'https://example.test/api?access_token=secret&name=qwen',
+        method: 'POST',
+        postData: 'token=secret&name=qwen',
+      },
+    });
+    session.emit('Runtime.consoleAPICalled', {
+      type: 'log',
+      args: [{ value: 'authorization=secret' }],
+    });
+
+    const network = await tools.callTool('get_network_request', {
+      requestId: 'request-3',
+    });
+    const consoleMessages = await tools.callTool('list_console_messages', {});
+
+    expect(resultText(network)).not.toContain('secret');
+    expect(resultText(network)).toContain('name=qwen');
+    expect(resultText(consoleMessages)).not.toContain('secret');
+  });
+
+  it('does not retain response bodies in the event buffer', async () => {
+    await tools.callTool('list_network_requests', {});
+    session.emit('Network.requestWillBeSent', {
+      requestId: 'request-2',
+      request: { url: 'https://example.test/api', method: 'GET' },
+    });
+    session.emit('Network.loadingFinished', {
+      requestId: 'request-2',
+      encodedDataLength: 11,
+    });
+
+    await tools.callTool('get_network_request', { requestId: 'request-2' });
+    await tools.callTool('get_network_request', { requestId: 'request-2' });
+
+    expect(session.send).toHaveBeenCalledTimes(2 + 6);
+    expect(session.send).toHaveBeenNthCalledWith(7, 'Network.getResponseBody', {
+      requestId: 'request-2',
+    });
+    expect(session.send).toHaveBeenNthCalledWith(8, 'Network.getResponseBody', {
+      requestId: 'request-2',
+    });
+  });
+
+  it('keeps network metadata when a response body is unavailable', async () => {
+    await tools.callTool('list_network_requests', {});
+    session.emit('Network.requestWillBeSent', {
+      requestId: 'cached-request',
+      request: { url: 'https://example.test/cached', method: 'GET' },
+    });
+    session.emit('Network.responseReceived', {
+      requestId: 'cached-request',
+      response: { status: 304, statusText: 'Not Modified' },
+    });
+    session.emit('Network.loadingFinished', { requestId: 'cached-request' });
+    session.send.mockRejectedValueOnce(new Error('No resource with given id'));
+
+    const result = await tools.callTool('get_network_request', {
+      requestId: 'cached-request',
+    });
+
+    expect(result.isError).not.toBe(true);
+    expect(JSON.parse(resultText(result))).toMatchObject({
+      requestId: 'cached-request',
+      status: 304,
+      finished: true,
+    });
+  });
+
+  it('clears page-scoped state when the active tab changes', async () => {
+    await tools.callTool('take_snapshot', {});
+    session.emit('Runtime.consoleAPICalled', {
+      type: 'log',
+      args: [{ value: 'old tab' }],
+    });
+    session.emit('Network.requestWillBeSent', {
+      requestId: 'old-request',
+      request: { url: 'https://example.test/old', method: 'GET' },
+    });
+
+    session.tabId = 2;
+    session.changed = true;
+    const network = await tools.callTool('list_network_requests', {});
+    const consoleMessages = await tools.callTool('list_console_messages', {});
+    const staleClick = await tools.callTool('click', { ref: 'e1' });
+
+    expect(JSON.parse(resultText(network))).toEqual([]);
+    expect(JSON.parse(resultText(consoleMessages))).toEqual([]);
+    expect(staleClick.isError).toBe(true);
+    expect(resultText(staleClick)).toContain('Unknown or stale element ref');
+  });
+
+  it('keeps each redirect hop addressable', async () => {
+    await tools.callTool('list_network_requests', {});
+    session.emit('Network.requestWillBeSent', {
+      requestId: 'redirect-1',
+      request: { url: 'https://example.test/start', method: 'GET' },
+    });
+    session.emit('Network.requestWillBeSent', {
+      requestId: 'redirect-1',
+      request: { url: 'https://example.test/final', method: 'GET' },
+      redirectResponse: {
+        url: 'https://example.test/start',
+        status: 302,
+        statusText: 'Found',
+        headers: { Location: '/final' },
+      },
+    });
+
+    const listed = JSON.parse(
+      resultText(await tools.callTool('list_network_requests', {})),
+    );
+
+    expect(listed).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          requestId: 'redirect-1:redirect:1',
+          url: 'https://example.test/start',
+          status: 302,
+        }),
+        expect.objectContaining({
+          requestId: 'redirect-1',
+          url: 'https://example.test/final',
+        }),
+      ]),
+    );
+  });
+});
diff --git a/packages/chrome-extension/src/background/browser-mcp/browser-tools.ts b/packages/chrome-extension/src/background/browser-mcp/browser-tools.ts
new file mode 100644
index 00000000000..a6bca0dcd1a
--- /dev/null
+++ b/packages/chrome-extension/src/background/browser-mcp/browser-tools.ts
@@ -0,0 +1,986 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import type { DebuggerSession } from './debugger-session.js';
+import type {
+  BrowserToolDefinition,
+  BrowserToolHandler,
+  BrowserToolResult,
+} from './server.js';
+
+const MAX_EVENTS = 300;
+const MAX_BODY_CHARS = 1_048_576;
+const MAX_STORED_TEXT_CHARS = 65_536;
+const MAX_CONSOLE_TEXT_CHARS = 16_384;
+const MAX_URL_CHARS = 4_096;
+const MAX_HEADER_COUNT = 50;
+const MAX_HEADER_VALUE_CHARS = 1_024;
+const MAX_STACK_FRAMES = 50;
+const MAX_SCREENSHOT_BASE64_CHARS = 8 * 1_048_576;
+const MAX_TEXT_RESULT_CHARS = 1_048_576;
+const EVALUATION_TIMEOUT_MS = 20_000;
+const PAGE_FETCH_TIMEOUT_MS = 15_000;
+const NAVIGATION_TIMEOUT_MS = 10_000;
+const WAIT_TIMEOUT_MS = 20_000;
+const MAX_FORM_FIELDS = 50;
+const SECRET = /authorization|cookie|token|secret|password|api[-_]?key/i;
+const AUTHORIZATION_VALUE =
+  /(authorization\s*[:=]\s*)(?:bearer\s+)?(?:"[^"]*"|'[^']*'|[^&,;\s]+)/gi;
+const SECRET_VALUE =
+  /((?:cookie|token|secret|password|api[-_]?key)\s*[:=]\s*)(?:"[^"]*"|'[^']*'|[^&,;\s]+)/gi;
+
+interface ConsoleEntry {
+  id: number;
+  type: string;
+  text: string;
+  timestamp?: number;
+  url?: string;
+  line?: number;
+  column?: number;
+  stack?: unknown;
+}
+
+interface NetworkEntry {
+  requestId: string;
+  url: string;
+  method: string;
+  type?: string;
+  requestHeaders?: Record<string, unknown>;
+  postData?: string;
+  status?: number;
+  statusText?: string;
+  responseHeaders?: Record<string, unknown>;
+  mimeType?: string;
+  encodedDataLength?: number;
+  failed?: string;
+  redirectFrom?: string;
+  redirectTo?: string;
+  timestamp?: number;
+  finished?: boolean;
+  postDataTruncated?: boolean;
+}
+
+interface AxValue {
+  value?: unknown;
+}
+
+interface AxNode {
+  ignored?: boolean;
+  backendDOMNodeId?: number;
+  role?: AxValue;
+  name?: AxValue;
+  value?: AxValue;
+}
+
+function object(value: unknown): Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : {};
+}
+
+function stringArg(
+  args: Record<string, unknown>,
+  name: string,
+  optional = false,
+): string | undefined {
+  const value = args[name];
+  if (optional && value === undefined) return undefined;
+  if (typeof value !== 'string' || (!optional && value.length === 0)) {
+    throw new Error(`'${name}' must be a non-empty string`);
+  }
+  return value;
+}
+
+function numberArg(
+  args: Record<string, unknown>,
+  name: string,
+  fallback: number,
+): number {
+  const value = args[name];
+  if (value === undefined) return fallback;
+  if (typeof value !== 'number' || !Number.isFinite(value)) {
+    throw new Error(`'${name}' must be a finite number`);
+  }
+  return value;
+}
+
+function text(text: string): BrowserToolResult {
+  return {
+    content: [
+      { type: 'text', text: truncateText(text, MAX_TEXT_RESULT_CHARS) },
+    ],
+  };
+}
+
+function sanitizeText(input: string): string {
+  try {
+    const parsed = JSON.parse(input) as unknown;
+    if (parsed !== null && typeof parsed === 'object') {
+      return JSON.stringify(sanitizeValue(parsed));
+    }
+  } catch {
+    // Non-JSON text is handled by the URL and assignment redactors below.
+  }
+  let value = input;
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(value)) {
+    try {
+      const url = new URL(value);
+      if (url.username) url.username = '[REDACTED]';
+      if (url.password) url.password = '[REDACTED]';
+      for (const name of url.searchParams.keys()) {
+        if (SECRET.test(name)) url.searchParams.set(name, '[REDACTED]');
+      }
+      value = url.toString();
+    } catch {
+      // Keep malformed URLs available for the assignment redactors.
+    }
+  }
+  return value
+    .replace(AUTHORIZATION_VALUE, '$1[REDACTED]')
+    .replace(SECRET_VALUE, '$1[REDACTED]');
+}
+
+function sanitizeValue(value: unknown, key?: string): unknown {
+  if (key && SECRET.test(key)) return '[REDACTED]';
+  if (typeof value === 'string') return sanitizeText(value);
+  if (Array.isArray(value)) return value.map((child) => sanitizeValue(child));
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(
+    Object.entries(value).map(([name, child]) => [
+      name,
+      sanitizeValue(child, name),
+    ]),
+  );
+}
+
+function truncateText(value: string, maxChars: number): string {
+  if (value.length <= maxChars) return value;
+  const marker = '... [truncated]';
+  return `${value.slice(0, Math.max(0, maxChars - marker.length))}${marker}`;
+}
+
+function compactStack(value: unknown): unknown {
+  const stack = object(value);
+  const frames = Array.isArray(stack['callFrames'])
+    ? stack['callFrames'].slice(0, MAX_STACK_FRAMES).map((frame) => {
+        const source = object(frame);
+        return {
+          functionName: truncateText(String(source['functionName'] ?? ''), 512),
+          url: sanitizeText(
+            truncateText(String(source['url'] ?? ''), MAX_URL_CHARS),
+          ),
+          lineNumber: Number(source['lineNumber']) || 0,
+          columnNumber: Number(source['columnNumber']) || 0,
+        };
+      })
+    : [];
+  return frames.length > 0 ? { callFrames: frames } : undefined;
+}
+
+function json(value: unknown): BrowserToolResult {
+  return text(
+    value === undefined
+      ? 'undefined'
+      : JSON.stringify(sanitizeValue(value), null, 2),
+  );
+}
+
+function tool(
+  name: string,
+  description: string,
+  properties: Record<string, unknown> = {},
+  required: string[] = [],
+): BrowserToolDefinition {
+  return {
+    name,
+    description,
+    inputSchema: {
+      type: 'object',
+      properties,
+      required: required.length ? required : undefined,
+      additionalProperties: false,
+    },
+  };
+}
+
+const stringProperty = (description: string) => ({
+  type: 'string',
+  description,
+});
+
+export const BROWSER_TOOLS: readonly BrowserToolDefinition[] = [
+  tool('take_snapshot', 'Read the current page accessibility tree.'),
+  tool('take_screenshot', 'Capture the visible page as a PNG image.'),
+  tool(
+    'navigate_page',
+    'Navigate the active tab to a URL.',
+    { url: stringProperty('Destination URL.') },
+    ['url'],
+  ),
+  tool('reload_page', 'Reload the active page.'),
+  tool('go_back', 'Navigate to the previous history entry.'),
+  tool('go_forward', 'Navigate to the next history entry.'),
+  tool(
+    'click',
+    'Click an element returned by take_snapshot.',
+    { ref: stringProperty('Element ref, for example e12.') },
+    ['ref'],
+  ),
+  tool(
+    'fill',
+    'Set the value of an input, textarea, or select element.',
+    {
+      ref: stringProperty('Element ref.'),
+      value: stringProperty('Value to enter or select.'),
+    },
+    ['ref', 'value'],
+  ),
+  tool(
+    'fill_form',
+    'Fill several controls returned by take_snapshot.',
+    {
+      fields: {
+        type: 'array',
+        items: {
+          type: 'object',
+          properties: {
+            ref: stringProperty('Element ref.'),
+            value: stringProperty('Value to enter or select.'),
+          },
+          required: ['ref', 'value'],
+          additionalProperties: false,
+        },
+      },
+    },
+    ['fields'],
+  ),
+  tool(
+    'press_key',
+    'Press a keyboard key in the active page.',
+    { key: stringProperty('Key value such as Enter, Escape, or Tab.') },
+    ['key'],
+  ),
+  tool('scroll_page', 'Scroll the page by a number of CSS pixels.', {
+    x: { type: 'number', description: 'Horizontal delta. Defaults to 0.' },
+    y: { type: 'number', description: 'Vertical delta. Defaults to 600.' },
+  }),
+  tool(
+    'wait_for',
+    'Wait until text appears in the page.',
+    {
+      text: stringProperty('Text to wait for.'),
+      timeoutMs: {
+        type: 'number',
+        description: 'Timeout in milliseconds. Defaults to 5000.',
+      },
+    },
+    ['text'],
+  ),
+  tool(
+    'evaluate_script',
+    'Evaluate JavaScript in the active page and return its value.',
+    { expression: stringProperty('JavaScript expression.') },
+    ['expression'],
+  ),
+  tool(
+    'list_console_messages',
+    'List captured console messages and exceptions.',
+    {
+      limit: {
+        type: 'number',
+        description: 'Maximum recent messages to return. Defaults to 50.',
+      },
+    },
+  ),
+  tool(
+    'get_console_message',
+    'Get a captured console message by id.',
+    { id: { type: 'number', description: 'Console message id.' } },
+    ['id'],
+  ),
+  tool('clear_console_messages', 'Clear captured console messages.'),
+  tool('list_network_requests', 'List captured page network requests.'),
+  tool(
+    'get_network_request',
+    'Get request and response details, including response body when available.',
+    { requestId: stringProperty('CDP network request id.') },
+    ['requestId'],
+  ),
+  tool('clear_network_requests', 'Clear captured network requests.'),
+  tool(
+    'send_request',
+    'Send a fetch request in the current page context.',
+    {
+      url: stringProperty('Request URL.'),
+      method: stringProperty('HTTP method. Defaults to GET.'),
+      headers: { type: 'object', additionalProperties: { type: 'string' } },
+      body: stringProperty('Optional request body.'),
+    },
+    ['url'],
+  ),
+];
+
+export class BrowserTools implements BrowserToolHandler {
+  readonly tools = BROWSER_TOOLS;
+  private readonly elements = new Map<string, number>();
+  private readonly consoleEntries: ConsoleEntry[] = [];
+  private readonly networkEntries = new Map<string, NetworkEntry>();
+  private consoleId = 0;
+  private readyTabId: number | null = null;
+
+  constructor(private readonly session: DebuggerSession) {
+    this.session.onEvent((method, params) => this.handleEvent(method, params));
+  }
+
+  async callTool(
+    name: string,
+    args: Record<string, unknown>,
+  ): Promise<BrowserToolResult> {
+    try {
+      return await this.session.withAttached(async () => {
+        await this.ensureReady();
+        switch (name) {
+          case 'take_snapshot':
+            return await this.snapshot();
+          case 'take_screenshot':
+            return await this.screenshot();
+          case 'navigate_page':
+            return await this.navigate(stringArg(args, 'url')!);
+          case 'reload_page':
+            return await this.reload();
+          case 'go_back':
+            return await this.history(-1);
+          case 'go_forward':
+            return await this.history(1);
+          case 'click':
+            return await this.click(stringArg(args, 'ref')!);
+          case 'fill':
+            return await this.fill(
+              stringArg(args, 'ref')!,
+              stringArg(args, 'value')!,
+            );
+          case 'fill_form':
+            return await this.fillForm(args['fields']);
+          case 'press_key':
+            return await this.pressKey(stringArg(args, 'key')!);
+          case 'scroll_page':
+            return await this.scroll(
+              numberArg(args, 'x', 0),
+              numberArg(args, 'y', 600),
+            );
+          case 'wait_for':
+            return await this.waitFor(
+              stringArg(args, 'text')!,
+              numberArg(args, 'timeoutMs', 5_000),
+            );
+          case 'evaluate_script':
+            return await this.evaluate(stringArg(args, 'expression')!);
+          case 'list_console_messages':
+            return json(this.listConsole(numberArg(args, 'limit', 50)));
+          case 'get_console_message':
+            return this.getConsole(numberArg(args, 'id', -1));
+          case 'clear_console_messages':
+            this.consoleEntries.length = 0;
+            return text('Console messages cleared.');
+          case 'list_network_requests':
+            return json(this.listNetwork());
+          case 'get_network_request':
+            return await this.getNetwork(stringArg(args, 'requestId')!);
+          case 'clear_network_requests':
+            this.networkEntries.clear();
+            return text('Network requests cleared.');
+          case 'send_request':
+            return await this.sendRequest(args);
+          default:
+            return { ...text(`Unknown browser tool: ${name}`), isError: true };
+        }
+      });
+    } catch (error) {
+      return {
+        ...text(error instanceof Error ? error.message : String(error)),
+        isError: true,
+      };
+    }
+  }
+
+  async shutdown(): Promise<void> {
+    this.readyTabId = null;
+    this.elements.clear();
+    this.consoleEntries.length = 0;
+    this.networkEntries.clear();
+    await this.session.detach();
+  }
+
+  private async ensureReady(): Promise<void> {
+    const { tabId, changed } = await this.session.ensureAttached();
+    if (!changed && this.readyTabId === tabId) return;
+    this.elements.clear();
+    this.consoleEntries.length = 0;
+    this.networkEntries.clear();
+    await Promise.all([
+      this.session.send('Page.enable'),
+      this.session.send('DOM.enable'),
+      this.session.send('Accessibility.enable'),
+      this.session.send('Runtime.enable'),
+      this.session.send('Log.enable'),
+      this.session.send('Network.enable', {
+        maxTotalBufferSize: MAX_BODY_CHARS * 4,
+        maxResourceBufferSize: MAX_BODY_CHARS,
+      }),
+    ]);
+    this.readyTabId = tabId;
+  }
+
+  private async snapshot(): Promise<BrowserToolResult> {
+    const [tree, tab] = await Promise.all([
+      this.session.send('Accessibility.getFullAXTree'),
+      this.session.getTab(),
+    ]);
+    this.elements.clear();
+    const lines = [
+      `Page: ${truncateText(tab.title ?? '', 512)}`,
+      `URL: ${sanitizeText(truncateText(tab.url ?? '', MAX_URL_CHARS))}`,
+    ];
+    const nodes = Array.isArray(tree['nodes'])
+      ? (tree['nodes'] as AxNode[])
+      : [];
+    for (const node of nodes.slice(0, 500)) {
+      if (node.ignored) continue;
+      const role = truncateText(String(node.role?.value ?? '').trim(), 512);
+      const name = truncateText(
+        String(node.name?.value ?? '').trim(),
+        MAX_STORED_TEXT_CHARS,
+      );
+      const value = truncateText(
+        String(node.value?.value ?? '').trim(),
+        MAX_STORED_TEXT_CHARS,
+      );
+      if (!role || (!name && !value && role !== 'RootWebArea')) continue;
+      let ref = '';
+      if (typeof node.backendDOMNodeId === 'number') {
+        ref = `e${this.elements.size + 1}`;
+        this.elements.set(ref, node.backendDOMNodeId);
+      }
+      const details = [
+        name && JSON.stringify(name),
+        value && `value=${JSON.stringify(value)}`,
+      ]
+        .filter(Boolean)
+        .join(' ');
+      lines.push(
+        `${ref ? `[ref=${ref}] ` : ''}${role}${details ? ` ${details}` : ''}`,
+      );
+    }
+    return text(lines.join('\n'));
+  }
+
+  private async screenshot(): Promise<BrowserToolResult> {
+    const result = await this.session.send('Page.captureScreenshot', {
+      format: 'png',
+      fromSurface: true,
+    });
+    if (typeof result['data'] !== 'string')
+      throw new Error('Screenshot failed');
+    if (result['data'].length > MAX_SCREENSHOT_BASE64_CHARS) {
+      throw new Error(
+        'Screenshot is too large to send. Reduce the page zoom or viewport and try again.',
+      );
+    }
+    return {
+      content: [{ type: 'image', data: result['data'], mimeType: 'image/png' }],
+    };
+  }
+
+  private async navigate(url: string): Promise<BrowserToolResult> {
+    const normalized = /^[a-z][a-z0-9+.-]*:/i.test(url)
+      ? url
+      : `https://${url}`;
+    const protocol = new URL(normalized).protocol;
+    if (protocol !== 'http:' && protocol !== 'https:') {
+      throw new Error('Navigation only supports http: and https: URLs');
+    }
+    const result = await this.session.send('Page.navigate', {
+      url: normalized,
+    });
+    if (typeof result['errorText'] === 'string' && result['errorText']) {
+      throw new Error(`Navigation failed: ${result['errorText']}`);
+    }
+    this.elements.clear();
+    await this.waitForDocumentReady();
+    return json({ url: normalized, ...result });
+  }
+
+  private async reload(): Promise<BrowserToolResult> {
+    await this.session.send('Page.reload');
+    this.elements.clear();
+    await this.waitForDocumentReady();
+    return text('Page reloaded.');
+  }
+
+  private async history(offset: number): Promise<BrowserToolResult> {
+    const result = await this.session.send('Page.getNavigationHistory');
+    const entries = Array.isArray(result['entries']) ? result['entries'] : [];
+    const current = Number(result['currentIndex']);
+    const entry = object(entries[current + offset]);
+    if (typeof entry['id'] !== 'number')
+      throw new Error('No history entry available');
+    await this.session.send('Page.navigateToHistoryEntry', {
+      entryId: entry['id'],
+    });
+    this.elements.clear();
+    await this.waitForDocumentReady();
+    return text(offset < 0 ? 'Navigated back.' : 'Navigated forward.');
+  }
+
+  private async waitForDocumentReady(): Promise<void> {
+    const deadline = Date.now() + NAVIGATION_TIMEOUT_MS;
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    while (Date.now() <= deadline) {
+      const result = await this.session.send('Runtime.evaluate', {
+        expression:
+          "document.readyState === 'interactive' || document.readyState === 'complete'",
+        returnByValue: true,
+      });
+      if (object(result['result'])['value'] === true) return;
+      await new Promise((resolve) => setTimeout(resolve, 200));
+    }
+    throw new Error('Timed out waiting for page navigation');
+  }
+
+  private backendNode(ref: string): number {
+    const id = this.elements.get(ref);
+    if (id === undefined) {
+      throw new Error(
+        `Unknown or stale element ref '${ref}'. Run take_snapshot again.`,
+      );
+    }
+    return id;
+  }
+
+  private async click(ref: string): Promise<BrowserToolResult> {
+    const backendNodeId = this.backendNode(ref);
+    await this.session.send('DOM.scrollIntoViewIfNeeded', { backendNodeId });
+    const result = await this.session.send('DOM.getBoxModel', {
+      backendNodeId,
+    });
+    const model = object(result['model']);
+    const quad = Array.isArray(model['content'])
+      ? (model['content'] as number[])
+      : [];
+    if (quad.length < 8)
+      throw new Error(`Element '${ref}' has no clickable box`);
+    const x = (quad[0]! + quad[2]! + quad[4]! + quad[6]!) / 4;
+    const y = (quad[1]! + quad[3]! + quad[5]! + quad[7]!) / 4;
+    await this.session.send('Input.dispatchMouseEvent', {
+      type: 'mousePressed',
+      x,
+      y,
+      button: 'left',
+      clickCount: 1,
+    });
+    await this.session.send('Input.dispatchMouseEvent', {
+      type: 'mouseReleased',
+      x,
+      y,
+      button: 'left',
+      clickCount: 1,
+    });
+    return text(`Clicked ${ref}.`);
+  }
+
+  private async fill(ref: string, value: string): Promise<BrowserToolResult> {
+    const backendNodeId = this.backendNode(ref);
+    const resolved = await this.session.send('DOM.resolveNode', {
+      backendNodeId,
+    });
+    const objectId = object(resolved['object'])['objectId'];
+    if (typeof objectId !== 'string') throw new Error(`Cannot resolve ${ref}`);
+    const result = await this.session.send('Runtime.callFunctionOn', {
+      objectId,
+      functionDeclaration: `function(value) {
+        this.focus();
+        if (this instanceof HTMLSelectElement) {
+          this.value = value;
+        } else if (this instanceof HTMLInputElement || this instanceof HTMLTextAreaElement) {
+          const proto = this instanceof HTMLTextAreaElement
+            ? HTMLTextAreaElement.prototype : HTMLInputElement.prototype;
+          const setter = Object.getOwnPropertyDescriptor(proto, 'value')?.set;
+          if (setter) setter.call(this, value); else this.value = value;
+        } else if (this.isContentEditable) {
+          this.textContent = value;
+        } else {
+          throw new TypeError('Element is not fillable');
+        }
+        this.dispatchEvent(new Event('input', { bubbles: true }));
+        this.dispatchEvent(new Event('change', { bubbles: true }));
+      }`,
+      arguments: [{ value }],
+      returnByValue: true,
+    });
+    if (result['exceptionDetails']) {
+      throw new Error(this.exceptionText(result['exceptionDetails']));
+    }
+    return text(`Filled ${ref}.`);
+  }
+
+  private async fillForm(rawFields: unknown): Promise<BrowserToolResult> {
+    if (!Array.isArray(rawFields)) throw new Error("'fields' must be an array");
+    if (rawFields.length > MAX_FORM_FIELDS) {
+      throw new Error(
+        `'fields' cannot contain more than ${MAX_FORM_FIELDS} entries`,
+      );
+    }
+    for (const raw of rawFields) {
+      const field = object(raw);
+      await this.fill(stringArg(field, 'ref')!, stringArg(field, 'value')!);
+    }
+    return text(`Filled ${rawFields.length} field(s).`);
+  }
+
+  private async pressKey(key: string): Promise<BrowserToolResult> {
+    const keys: Record<string, { code: string; keyCode: number }> = {
+      Enter: { code: 'Enter', keyCode: 13 },
+      Escape: { code: 'Escape', keyCode: 27 },
+      Tab: { code: 'Tab', keyCode: 9 },
+      Backspace: { code: 'Backspace', keyCode: 8 },
+      ArrowUp: { code: 'ArrowUp', keyCode: 38 },
+      ArrowDown: { code: 'ArrowDown', keyCode: 40 },
+      ArrowLeft: { code: 'ArrowLeft', keyCode: 37 },
+      ArrowRight: { code: 'ArrowRight', keyCode: 39 },
+    };
+    const mapped = keys[key];
+    const params = {
+      key,
+      ...(mapped
+        ? {
+            code: mapped.code,
+            windowsVirtualKeyCode: mapped.keyCode,
+            nativeVirtualKeyCode: mapped.keyCode,
+          }
+        : {}),
+    };
+    await this.session.send('Input.dispatchKeyEvent', {
+      type: 'keyDown',
+      ...params,
+    });
+    await this.session.send('Input.dispatchKeyEvent', {
+      type: 'keyUp',
+      ...params,
+    });
+    return text(`Pressed ${key}.`);
+  }
+
+  private async scroll(x: number, y: number): Promise<BrowserToolResult> {
+    await this.session.send('Runtime.evaluate', {
+      expression: `window.scrollBy(${JSON.stringify(x)}, ${JSON.stringify(y)})`,
+    });
+    return text(`Scrolled by (${x}, ${y}).`);
+  }
+
+  private async waitFor(
+    value: string,
+    timeoutMs: number,
+  ): Promise<BrowserToolResult> {
+    const deadline =
+      Date.now() + Math.max(0, Math.min(timeoutMs, WAIT_TIMEOUT_MS));
+    while (Date.now() <= deadline) {
+      const result = await this.session.send('Runtime.evaluate', {
+        expression: `document.body?.innerText.includes(${JSON.stringify(value)}) ?? false`,
+        returnByValue: true,
+      });
+      if (object(result['result'])['value'] === true)
+        return text(`Found text: ${value}`);
+      await new Promise((resolve) => setTimeout(resolve, 200));
+    }
+    throw new Error(`Timed out waiting for text: ${value}`);
+  }
+
+  private async evaluate(expression: string): Promise<BrowserToolResult> {
+    const result = await this.session.send('Runtime.evaluate', {
+      expression,
+      awaitPromise: true,
+      returnByValue: true,
+      userGesture: true,
+      timeout: EVALUATION_TIMEOUT_MS,
+    });
+    const exception = result['exceptionDetails'];
+    if (exception) throw new Error(this.exceptionText(exception));
+    const remote = object(result['result']);
+    return json('value' in remote ? remote['value'] : remote['description']);
+  }
+
+  private getConsole(id: number): BrowserToolResult {
+    const entry = this.consoleEntries.find((candidate) => candidate.id === id);
+    if (!entry) throw new Error(`Console message ${id} not found`);
+    return json(entry);
+  }
+
+  private listConsole(limit: number): Array<Omit<ConsoleEntry, 'stack'>> {
+    const count = Math.max(1, Math.min(MAX_EVENTS, Math.floor(limit)));
+    return this.consoleEntries
+      .slice(-count)
+      .map(({ stack: _stack, ...entry }) => entry);
+  }
+
+  private listNetwork(): unknown[] {
+    return [...this.networkEntries.values()].map((entry) => ({
+      requestId: entry.requestId,
+      method: entry.method,
+      url: entry.url,
+      type: entry.type,
+      status: entry.status,
+      mimeType: entry.mimeType,
+      failed: entry.failed,
+    }));
+  }
+
+  private async getNetwork(requestId: string): Promise<BrowserToolResult> {
+    const entry = this.networkEntries.get(requestId);
+    if (!entry) throw new Error(`Network request '${requestId}' not found`);
+    const detail: NetworkEntry & {
+      responseBody?: string;
+      base64Encoded?: boolean;
+      bodyTruncated?: boolean;
+    } = { ...entry };
+    if (entry.finished && !entry.failed && !entry.redirectTo) {
+      try {
+        const body = await this.session.send('Network.getResponseBody', {
+          requestId,
+        });
+        const raw = typeof body['body'] === 'string' ? body['body'] : '';
+        detail.responseBody =
+          body['base64Encoded'] === true
+            ? '[BINARY BODY OMITTED]'
+            : this.redactBody(raw).slice(0, MAX_BODY_CHARS);
+        detail.bodyTruncated = raw.length > MAX_BODY_CHARS;
+        detail.base64Encoded = body['base64Encoded'] === true;
+      } catch {
+        // Some cached, streaming, or evicted responses have no retrievable body.
+      }
+    }
+    return json(detail);
+  }
+
+  private async sendRequest(
+    args: Record<string, unknown>,
+  ): Promise<BrowserToolResult> {
+    const url = stringArg(args, 'url')!;
+    const method = stringArg(args, 'method', true) ?? 'GET';
+    const headers = object(args['headers']);
+    const body = stringArg(args, 'body', true);
+    const init = { method, headers, ...(body === undefined ? {} : { body }) };
+    const expression = `(async () => {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), ${PAGE_FETCH_TIMEOUT_MS});
+      try {
+        const response = await fetch(${JSON.stringify(url)}, { ...${JSON.stringify(init)}, signal: controller.signal });
+        const text = await response.text();
+        return { url: response.url, status: response.status, statusText: response.statusText,
+          headers: Object.fromEntries(response.headers.entries()), body: text.slice(0, ${MAX_BODY_CHARS}),
+          bodyTruncated: text.length > ${MAX_BODY_CHARS} };
+      } finally {
+        clearTimeout(timer);
+      }
+    })()`;
+    return this.evaluate(expression);
+  }
+
+  private handleEvent(method: string, params: Record<string, unknown>): void {
+    if (
+      method === 'Page.frameNavigated' &&
+      !object(params['frame'])['parentId']
+    ) {
+      this.elements.clear();
+      return;
+    }
+    if (method === 'Qwen.detached') {
+      this.readyTabId = null;
+      this.elements.clear();
+      return;
+    }
+    if (method === 'Runtime.consoleAPICalled') {
+      const args = Array.isArray(params['args']) ? params['args'] : [];
+      this.pushConsole({
+        id: ++this.consoleId,
+        type: String(params['type'] ?? 'log'),
+        text: args.map((arg) => this.remoteObjectText(object(arg))).join(' '),
+        timestamp: Number(params['timestamp']) || undefined,
+        stack: compactStack(params['stackTrace']),
+      });
+      return;
+    }
+    if (method === 'Runtime.exceptionThrown') {
+      const details = object(params['exceptionDetails']);
+      this.pushConsole({
+        id: ++this.consoleId,
+        type: 'exception',
+        text: this.exceptionText(details),
+        timestamp: Number(params['timestamp']) || undefined,
+        url: typeof details['url'] === 'string' ? details['url'] : undefined,
+        line: Number(details['lineNumber']) || undefined,
+        column: Number(details['columnNumber']) || undefined,
+        stack: compactStack(details['stackTrace']),
+      });
+      return;
+    }
+    if (method === 'Log.entryAdded') {
+      const entry = object(params['entry']);
+      this.pushConsole({
+        id: ++this.consoleId,
+        type: String(entry['level'] ?? entry['source'] ?? 'log'),
+        text: String(entry['text'] ?? ''),
+        timestamp: Number(entry['timestamp']) || undefined,
+        url: typeof entry['url'] === 'string' ? entry['url'] : undefined,
+        line: Number(entry['lineNumber']) || undefined,
+        stack: compactStack(entry['stackTrace']),
+      });
+      return;
+    }
+    this.handleNetworkEvent(method, params);
+  }
+
+  private handleNetworkEvent(
+    method: string,
+    params: Record<string, unknown>,
+  ): void {
+    const requestId = params['requestId'];
+    if (typeof requestId !== 'string') return;
+    if (method === 'Network.requestWillBeSent') {
+      const request = object(params['request']);
+      const redirect = object(params['redirectResponse']);
+      const previous = this.networkEntries.get(requestId);
+      if (previous && Object.keys(redirect).length > 0) {
+        const redirectId = this.nextRedirectId(requestId);
+        this.networkEntries.delete(requestId);
+        previous.requestId = redirectId;
+        previous.status = Number(redirect['status']) || 0;
+        previous.statusText = String(redirect['statusText'] ?? '');
+        previous.responseHeaders = this.redactHeaders(
+          object(redirect['headers']),
+        );
+        previous.mimeType = String(redirect['mimeType'] ?? '');
+        previous.encodedDataLength = Number(redirect['encodedDataLength']) || 0;
+        previous.finished = true;
+        previous.redirectTo = sanitizeText(
+          truncateText(String(request['url'] ?? ''), MAX_URL_CHARS),
+        );
+        this.networkEntries.set(redirectId, previous);
+      }
+      const postData =
+        typeof request['postData'] === 'string'
+          ? request['postData']
+          : undefined;
+      const rawPostData = postData
+        ? this.redactBody(postData.slice(0, MAX_STORED_TEXT_CHARS))
+        : undefined;
+      this.networkEntries.set(requestId, {
+        requestId,
+        url: sanitizeText(
+          truncateText(String(request['url'] ?? ''), MAX_URL_CHARS),
+        ),
+        method: String(request['method'] ?? 'GET'),
+        type: typeof params['type'] === 'string' ? params['type'] : undefined,
+        requestHeaders: this.redactHeaders(object(request['headers'])),
+        postData: rawPostData?.slice(0, MAX_STORED_TEXT_CHARS),
+        postDataTruncated:
+          postData !== undefined && postData.length > MAX_STORED_TEXT_CHARS,
+        redirectFrom:
+          typeof redirect['url'] === 'string'
+            ? sanitizeText(truncateText(redirect['url'], MAX_URL_CHARS))
+            : undefined,
+        timestamp: Number(params['timestamp']) || undefined,
+      });
+      this.trimNetwork();
+    } else if (method === 'Network.responseReceived') {
+      const entry = this.networkEntries.get(requestId);
+      if (!entry) return;
+      const response = object(params['response']);
+      entry.status = Number(response['status']) || 0;
+      entry.statusText = String(response['statusText'] ?? '');
+      entry.responseHeaders = this.redactHeaders(object(response['headers']));
+      entry.mimeType = String(response['mimeType'] ?? '');
+      entry.type =
+        typeof params['type'] === 'string' ? params['type'] : entry.type;
+    } else if (method === 'Network.loadingFinished') {
+      const entry = this.networkEntries.get(requestId);
+      if (!entry) return;
+      entry.finished = true;
+      entry.encodedDataLength = Number(params['encodedDataLength']) || 0;
+    } else if (method === 'Network.loadingFailed') {
+      const entry = this.networkEntries.get(requestId);
+      if (!entry) return;
+      entry.failed = String(params['errorText'] ?? 'Request failed');
+      entry.finished = true;
+    }
+  }
+
+  private remoteObjectText(value: Record<string, unknown>): string {
+    if ('value' in value) {
+      try {
+        return typeof value['value'] === 'string'
+          ? value['value']
+          : JSON.stringify(value['value']);
+      } catch {
+        return String(value['value']);
+      }
+    }
+    return String(value['description'] ?? value['type'] ?? '');
+  }
+
+  private exceptionText(value: unknown): string {
+    const details = object(value);
+    const description = this.remoteObjectText(object(details['exception']));
+    return (
+      description || String(details['text'] ?? 'JavaScript execution failed')
+    );
+  }
+
+  private nextRedirectId(requestId: string): string {
+    let index = 1;
+    while (this.networkEntries.has(`${requestId}:redirect:${index}`)) index++;
+    return `${requestId}:redirect:${index}`;
+  }
+
+  private pushConsole(entry: ConsoleEntry): void {
+    this.consoleEntries.push({
+      ...entry,
+      text: sanitizeText(truncateText(entry.text, MAX_CONSOLE_TEXT_CHARS)),
+      url: entry.url
+        ? sanitizeText(truncateText(entry.url, MAX_URL_CHARS))
+        : undefined,
+    });
+    if (this.consoleEntries.length > MAX_EVENTS) this.consoleEntries.shift();
+  }
+
+  private trimNetwork(): void {
+    while (this.networkEntries.size > MAX_EVENTS) {
+      const first = this.networkEntries.keys().next().value as
+        | string
+        | undefined;
+      if (first === undefined) break;
+      this.networkEntries.delete(first);
+    }
+  }
+
+  private redactHeaders(
+    headers: Record<string, unknown>,
+  ): Record<string, unknown> {
+    return Object.fromEntries(
+      Object.entries(headers)
+        .slice(0, MAX_HEADER_COUNT)
+        .map(([name, value]) => [
+          truncateText(name, 256),
+          SECRET.test(name)
+            ? '[REDACTED]'
+            : truncateText(String(value), MAX_HEADER_VALUE_CHARS),
+        ]),
+    );
+  }
+
+  private redactBody(body: string): string {
+    return sanitizeText(body);
+  }
+}
diff --git a/packages/chrome-extension/src/background/browser-mcp/connection.test.ts b/packages/chrome-extension/src/background/browser-mcp/connection.test.ts
new file mode 100644
index 00000000000..de2e413111f
--- /dev/null
+++ b/packages/chrome-extension/src/background/browser-mcp/connection.test.ts
@@ -0,0 +1,61 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, expect, it, vi } from 'vitest';
+import {
+  BROWSER_MCP_SERVER_NAME,
+  registerBrowserMcp,
+  routeBrowserMcpFrame,
+} from './connection.js';
+import { BrowserMcpServer } from './server.js';
+
+describe('browser MCP WebSocket routing', () => {
+  it('answers discovery requests before the registration ack arrives', async () => {
+    vi.stubGlobal('chrome', {
+      runtime: { getManifest: () => ({ version: '1.0.0' }) },
+    });
+    const server = new BrowserMcpServer({
+      tools: [
+        {
+          name: 'take_snapshot',
+          description: 'Read the page',
+          inputSchema: { type: 'object' },
+        },
+      ],
+      callTool: vi.fn(),
+    });
+    const send = vi.fn();
+
+    registerBrowserMcp(send);
+    await routeBrowserMcpFrame(
+      server,
+      {
+        type: 'mcp_message',
+        id: 'discovery-1',
+        server: BROWSER_MCP_SERVER_NAME,
+        payload: { jsonrpc: '2.0', id: 1, method: 'tools/list' },
+      },
+      send,
+    );
+
+    expect(send).toHaveBeenNthCalledWith(1, {
+      type: 'mcp_register',
+      server: BROWSER_MCP_SERVER_NAME,
+    });
+    expect(send).toHaveBeenNthCalledWith(
+      2,
+      expect.objectContaining({
+        type: 'mcp_message',
+        id: 'discovery-1',
+        payload: expect.objectContaining({
+          result: {
+            tools: [expect.objectContaining({ name: 'take_snapshot' })],
+          },
+        }),
+      }),
+    );
+  });
+});
diff --git a/packages/chrome-extension/src/background/browser-mcp/connection.ts b/packages/chrome-extension/src/background/browser-mcp/connection.ts
new file mode 100644
index 00000000000..6f83fa4cfde
--- /dev/null
+++ b/packages/chrome-extension/src/background/browser-mcp/connection.ts
@@ -0,0 +1,39 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import type { BrowserMcpServer } from './server.js';
+
+export const BROWSER_MCP_SERVER_NAME = 'qwen-browser-tools';
+
+export type BrowserMcpSend = (frame: Record<string, unknown>) => void;
+
+export function registerBrowserMcp(send: BrowserMcpSend): void {
+  send({ type: 'mcp_register', server: BROWSER_MCP_SERVER_NAME });
+}
+
+export async function routeBrowserMcpFrame(
+  server: BrowserMcpServer,
+  frame: Record<string, unknown>,
+  send: BrowserMcpSend,
+): Promise<boolean> {
+  if (
+    frame['type'] !== 'mcp_message' ||
+    frame['server'] !== BROWSER_MCP_SERVER_NAME ||
+    typeof frame['id'] !== 'string'
+  ) {
+    return false;
+  }
+  const response = await server.handleMessage(frame['payload']);
+  if (response) {
+    send({
+      type: 'mcp_message',
+      id: frame['id'],
+      server: BROWSER_MCP_SERVER_NAME,
+      payload: response,
+    });
+  }
+  return true;
+}
diff --git a/packages/chrome-extension/src/background/browser-mcp/debugger-session.test.ts b/packages/chrome-extension/src/background/browser-mcp/debugger-session.test.ts
new file mode 100644
index 00000000000..1e1e12bb50d
--- /dev/null
+++ b/packages/chrome-extension/src/background/browser-mcp/debugger-session.test.ts
@@ -0,0 +1,253 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { ChromeDebuggerSession } from './debugger-session.js';
+
+describe('ChromeDebuggerSession', () => {
+  const onEvent = { addListener: vi.fn() };
+  const onDetach = { addListener: vi.fn() };
+  const attach = vi.fn();
+  const detach = vi.fn();
+  const sendCommand = vi.fn();
+  const query = vi.fn();
+  let runtime: {
+    lastError?: { message?: string };
+    getPlatformInfo: ReturnType<typeof vi.fn>;
+  };
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    runtime = {
+      lastError: undefined,
+      getPlatformInfo: vi.fn((callback) => callback()),
+    };
+    vi.stubGlobal('chrome', {
+      tabs: {
+        query,
+        get: vi.fn(async () => ({ id: 7, url: 'https://example.com' })),
+      },
+      debugger: { attach, detach, sendCommand, onEvent, onDetach },
+      runtime,
+    });
+    attach.mockImplementation((_target, _version, callback) => callback());
+    query.mockResolvedValue([
+      { id: 7, url: 'https://example.com', title: 'Example' },
+    ]);
+    detach.mockImplementation((_target, callback) => callback());
+    sendCommand.mockImplementation((_target, _method, _params, callback) =>
+      callback({ ok: true }),
+    );
+  });
+
+  afterEach(() => vi.useRealTimers());
+
+  it('attaches once and sends commands to the active tab', async () => {
+    const session = new ChromeDebuggerSession();
+    await expect(session.send('Page.enable')).resolves.toEqual({ ok: true });
+    await expect(session.send('Runtime.enable')).resolves.toEqual({ ok: true });
+    expect(attach).toHaveBeenCalledTimes(1);
+    expect(sendCommand).toHaveBeenCalledWith(
+      { tabId: 7 },
+      'Page.enable',
+      {},
+      expect.any(Function),
+    );
+    await session.detach();
+  });
+
+  it('rejects restricted pages before attaching', async () => {
+    query.mockResolvedValueOnce([{ id: 8, url: 'chrome://extensions' }]);
+    const session = new ChromeDebuggerSession();
+    await expect(session.ensureAttached()).rejects.toThrow(
+      'does not allow debugging',
+    );
+    expect(attach).not.toHaveBeenCalled();
+  });
+
+  it('detaches the previous tab when the new active tab is restricted', async () => {
+    query
+      .mockResolvedValueOnce([{ id: 7, url: 'https://example.com' }])
+      .mockResolvedValueOnce([{ id: 8, url: 'chrome://extensions' }]);
+    const session = new ChromeDebuggerSession();
+
+    await session.send('Page.enable');
+    await expect(session.send('Runtime.enable')).rejects.toThrow(
+      'does not allow debugging',
+    );
+
+    expect(detach).toHaveBeenCalledWith({ tabId: 7 }, expect.any(Function));
+  });
+
+  it('switches the debugger attachment when the active tab changes', async () => {
+    query
+      .mockResolvedValueOnce([{ id: 7, url: 'https://one.example' }])
+      .mockResolvedValueOnce([{ id: 8, url: 'https://two.example' }]);
+    const session = new ChromeDebuggerSession();
+
+    await session.send('Page.enable');
+    await session.send('Runtime.enable');
+
+    expect(attach).toHaveBeenNthCalledWith(
+      1,
+      { tabId: 7 },
+      '1.3',
+      expect.any(Function),
+    );
+    expect(detach).toHaveBeenCalledWith({ tabId: 7 }, expect.any(Function));
+    expect(attach).toHaveBeenNthCalledWith(
+      2,
+      { tabId: 8 },
+      '1.3',
+      expect.any(Function),
+    );
+    await session.detach();
+  });
+
+  it('reattaches after Chrome detaches the debugger', async () => {
+    const session = new ChromeDebuggerSession();
+    const listener = vi.fn();
+    session.onEvent(listener);
+    await session.send('Page.enable');
+
+    const detachListener = onDetach.addListener.mock.calls[0]?.[0];
+    detachListener({ tabId: 7 }, 'canceled_by_user');
+    await session.send('Runtime.enable');
+
+    expect(listener).toHaveBeenCalledWith('Qwen.detached', {
+      reason: 'canceled_by_user',
+    });
+    expect(attach).toHaveBeenCalledTimes(2);
+    await session.detach();
+  });
+
+  it('coalesces concurrent attachment attempts', async () => {
+    let finishAttach: (() => void) | undefined;
+    attach.mockImplementation((_target, _version, callback) => {
+      finishAttach = callback;
+    });
+    const session = new ChromeDebuggerSession();
+
+    const first = session.ensureAttached();
+    const second = session.ensureAttached();
+    await vi.waitFor(() => expect(finishAttach).toBeTypeOf('function'));
+    finishAttach!();
+
+    await expect(Promise.all([first, second])).resolves.toEqual([
+      { tabId: 7, changed: true },
+      { tabId: 7, changed: true },
+    ]);
+    expect(attach).toHaveBeenCalledTimes(1);
+    await session.detach();
+  });
+
+  it('detaches an attachment that finishes during shutdown', async () => {
+    let finishAttach: (() => void) | undefined;
+    attach.mockImplementation((_target, _version, callback) => {
+      finishAttach = callback;
+    });
+    const session = new ChromeDebuggerSession();
+
+    const pendingAttach = session.ensureAttached();
+    await vi.waitFor(() => expect(finishAttach).toBeTypeOf('function'));
+    const shutdown = session.detach();
+    finishAttach!();
+
+    await expect(pendingAttach).rejects.toThrow('canceled');
+    await shutdown;
+    expect(detach).toHaveBeenCalledWith({ tabId: 7 }, expect.any(Function));
+  });
+
+  it('pins commands to one tab for an operation', async () => {
+    query
+      .mockResolvedValueOnce([{ id: 7, url: 'https://one.example' }])
+      .mockResolvedValueOnce([{ id: 8, url: 'https://two.example' }]);
+    const session = new ChromeDebuggerSession();
+
+    await session.withAttached(async () => {
+      await session.send('DOM.getBoxModel');
+      await session.send('Input.dispatchMouseEvent');
+    });
+
+    expect(query).toHaveBeenCalledTimes(1);
+    expect(sendCommand).toHaveBeenNthCalledWith(
+      1,
+      { tabId: 7 },
+      'DOM.getBoxModel',
+      {},
+      expect.any(Function),
+    );
+    expect(sendCommand).toHaveBeenNthCalledWith(
+      2,
+      { tabId: 7 },
+      'Input.dispatchMouseEvent',
+      {},
+      expect.any(Function),
+    );
+
+    await session.withAttached(() => session.send('Runtime.enable'));
+    expect(sendCommand).toHaveBeenLastCalledWith(
+      { tabId: 8 },
+      'Runtime.enable',
+      {},
+      expect.any(Function),
+    );
+    await session.detach();
+  });
+
+  it('surfaces debugger attachment and command errors', async () => {
+    attach.mockImplementationOnce((_target, _version, callback) => {
+      runtime.lastError = { message: 'already attached' };
+      callback();
+      runtime.lastError = undefined;
+    });
+    const attachSession = new ChromeDebuggerSession();
+    await expect(attachSession.ensureAttached()).rejects.toThrow(
+      'already attached',
+    );
+    await expect(attachSession.ensureAttached()).resolves.toEqual({
+      tabId: 7,
+      changed: true,
+    });
+    await attachSession.detach();
+
+    sendCommand.mockImplementationOnce(
+      (_target, _method, _params, callback) => {
+        runtime.lastError = { message: 'target closed' };
+        callback();
+        runtime.lastError = undefined;
+      },
+    );
+    const commandSession = new ChromeDebuggerSession();
+    await expect(commandSession.send('Page.enable')).rejects.toThrow(
+      'target closed',
+    );
+    await commandSession.detach();
+  });
+
+  it('releases the operation queue after a CDP command times out', async () => {
+    vi.useFakeTimers();
+    sendCommand.mockImplementationOnce(() => undefined);
+    const session = new ChromeDebuggerSession();
+
+    const timedOut = session.withAttached(() =>
+      session.send('Runtime.evaluate'),
+    );
+    const timedOutError = timedOut.catch((error: unknown) => error);
+    await vi.advanceTimersByTimeAsync(20_000);
+    await expect(timedOutError).resolves.toEqual(
+      new Error('Chrome debugger command timed out: Runtime.evaluate'),
+    );
+
+    sendCommand.mockImplementation((_target, _method, _params, callback) =>
+      callback({ ok: true }),
+    );
+    await expect(
+      session.withAttached(() => session.send('Page.enable')),
+    ).resolves.toEqual({ ok: true });
+    await session.detach();
+  });
+});
diff --git a/packages/chrome-extension/src/background/browser-mcp/debugger-session.ts b/packages/chrome-extension/src/background/browser-mcp/debugger-session.ts
new file mode 100644
index 00000000000..648709abef8
--- /dev/null
+++ b/packages/chrome-extension/src/background/browser-mcp/debugger-session.ts
@@ -0,0 +1,214 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const CDP_VERSION = '1.3';
+const COMMAND_TIMEOUT_MS = 20_000;
+
+export type DebuggerEventListener = (
+  method: string,
+  params: Record<string, unknown>,
+) => void;
+
+export interface DebuggerSession {
+  ensureAttached(): Promise<{ tabId: number; changed: boolean }>;
+  withAttached<T>(operation: () => Promise<T>): Promise<T>;
+  send(
+    method: string,
+    params?: Record<string, unknown>,
+  ): Promise<Record<string, unknown>>;
+  onEvent(listener: DebuggerEventListener): () => void;
+  getTab(): Promise<chrome.tabs.Tab>;
+  detach(): Promise<void>;
+}
+
+export class ChromeDebuggerSession implements DebuggerSession {
+  private tabId: number | null = null;
+  private pinnedTabId: number | null = null;
+  private attaching: Promise<{ tabId: number; changed: boolean }> | null = null;
+  private operationTail: Promise<void> = Promise.resolve();
+  private attachGeneration = 0;
+  private readonly listeners = new Set<DebuggerEventListener>();
+  private keepalive: ReturnType<typeof setInterval> | null = null;
+
+  constructor() {
+    chrome.debugger.onEvent.addListener(this.handleEvent);
+    chrome.debugger.onDetach.addListener(this.handleDetach);
+  }
+
+  async ensureAttached(): Promise<{ tabId: number; changed: boolean }> {
+    if (this.pinnedTabId !== null) {
+      return { tabId: this.pinnedTabId, changed: false };
+    }
+    if (this.attaching) return this.attaching;
+    this.attaching = this.attachActiveTab(this.attachGeneration);
+    try {
+      return await this.attaching;
+    } finally {
+      this.attaching = null;
+    }
+  }
+
+  async withAttached<T>(operation: () => Promise<T>): Promise<T> {
+    const previous = this.operationTail;
+    let release!: () => void;
+    this.operationTail = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    await previous;
+    try {
+      const { tabId } = await this.ensureAttached();
+      this.pinnedTabId = tabId;
+      return await operation();
+    } finally {
+      this.pinnedTabId = null;
+      release();
+    }
+  }
+
+  async send(
+    method: string,
+    params: Record<string, unknown> = {},
+  ): Promise<Record<string, unknown>> {
+    const tabId = this.pinnedTabId ?? (await this.ensureAttached()).tabId;
+    return new Promise((resolve, reject) => {
+      let settled = false;
+      const timer = setTimeout(() => {
+        settled = true;
+        reject(new Error(`Chrome debugger command timed out: ${method}`));
+      }, COMMAND_TIMEOUT_MS);
+      chrome.debugger.sendCommand(
+        { tabId },
+        method,
+        params,
+        (result?: object) => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timer);
+          const error = chrome.runtime.lastError;
+          if (error) {
+            reject(new Error(error.message ?? `${method} failed`));
+          } else {
+            resolve((result ?? {}) as Record<string, unknown>);
+          }
+        },
+      );
+    });
+  }
+
+  onEvent(listener: DebuggerEventListener): () => void {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+
+  async getTab(): Promise<chrome.tabs.Tab> {
+    const tabId = this.pinnedTabId ?? (await this.ensureAttached()).tabId;
+    return chrome.tabs.get(tabId);
+  }
+
+  async detach(): Promise<void> {
+    this.attachGeneration += 1;
+    if (this.attaching) {
+      try {
+        await this.attaching;
+      } catch {
+        // A canceled or failed attachment still needs normal cleanup below.
+      }
+    }
+    await this.operationTail;
+    await this.detachCurrent();
+  }
+
+  private async detachCurrent(): Promise<void> {
+    const tabId = this.tabId;
+    this.tabId = null;
+    this.stopKeepalive();
+    if (tabId === null) return;
+    await new Promise<void>((resolve) => {
+      chrome.debugger.detach({ tabId }, () => {
+        void chrome.runtime.lastError;
+        resolve();
+      });
+    });
+  }
+
+  private async attachActiveTab(generation: number): Promise<{
+    tabId: number;
+    changed: boolean;
+  }> {
+    const tabs = await chrome.tabs.query({ active: true, currentWindow: true });
+    const tab = tabs[0];
+    if (tab?.id === undefined) {
+      await this.detachCurrent();
+      throw new Error('No active Chrome tab');
+    }
+    if (
+      !tab.url ||
+      /^(chrome|edge|devtools|chrome-extension):/i.test(tab.url)
+    ) {
+      await this.detachCurrent();
+      throw new Error(`Chrome does not allow debugging this page: ${tab.url}`);
+    }
+    if (this.tabId === tab.id) return { tabId: tab.id, changed: false };
+    await this.detachCurrent();
+
+    await new Promise<void>((resolve, reject) => {
+      chrome.debugger.attach({ tabId: tab.id! }, CDP_VERSION, () => {
+        const error = chrome.runtime.lastError;
+        if (error) {
+          reject(
+            new Error(
+              `Unable to attach Chrome debugger: ${error.message ?? 'unknown error'}. Close DevTools or another debugger attached to this tab.`,
+            ),
+          );
+        } else {
+          resolve();
+        }
+      });
+    });
+    this.tabId = tab.id;
+    if (generation !== this.attachGeneration) {
+      await this.detachCurrent();
+      throw new Error('Chrome debugger attachment canceled');
+    }
+    this.startKeepalive();
+    return { tabId: tab.id, changed: true };
+  }
+
+  private readonly handleEvent = (
+    source: chrome.debugger.Debuggee,
+    method: string,
+    params?: object,
+  ): void => {
+    if (source.tabId !== this.tabId) return;
+    const event = (params ?? {}) as Record<string, unknown>;
+    for (const listener of this.listeners) listener(method, event);
+  };
+
+  private readonly handleDetach = (
+    source: chrome.debugger.Debuggee,
+    reason: string,
+  ): void => {
+    if (source.tabId !== this.tabId) return;
+    this.tabId = null;
+    this.stopKeepalive();
+    const event = { reason: reason || 'target_closed' };
+    for (const listener of this.listeners) listener('Qwen.detached', event);
+  };
+
+  private startKeepalive(): void {
+    if (this.keepalive !== null) return;
+    this.keepalive = setInterval(() => {
+      chrome.runtime.getPlatformInfo(() => void chrome.runtime.lastError);
+    }, 20_000);
+  }
+
+  private stopKeepalive(): void {
+    if (this.keepalive !== null) {
+      clearInterval(this.keepalive);
+      this.keepalive = null;
+    }
+  }
+}
diff --git a/packages/chrome-extension/src/background/browser-mcp/server.test.ts b/packages/chrome-extension/src/background/browser-mcp/server.test.ts
new file mode 100644
index 00000000000..6066e1c09c0
--- /dev/null
+++ b/packages/chrome-extension/src/background/browser-mcp/server.test.ts
@@ -0,0 +1,98 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { BrowserMcpServer, type BrowserToolHandler } from './server.js';
+
+describe('BrowserMcpServer', () => {
+  let handler: BrowserToolHandler;
+  let server: BrowserMcpServer;
+
+  beforeEach(() => {
+    vi.stubGlobal('chrome', {
+      runtime: { getManifest: () => ({ version: '1.2.3' }) },
+    });
+    handler = {
+      tools: [
+        {
+          name: 'take_snapshot',
+          description: 'Read the page',
+          inputSchema: { type: 'object' },
+        },
+      ],
+      callTool: vi.fn(
+        async (name): Promise<import('./server.js').BrowserToolResult> => ({
+          content: [{ type: 'text', text: `called ${name}` }],
+        }),
+      ),
+    };
+    server = new BrowserMcpServer(handler);
+  });
+
+  it('completes the MCP initialize handshake', async () => {
+    await expect(
+      server.handleMessage({
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'initialize',
+        params: { protocolVersion: '2025-03-26' },
+      }),
+    ).resolves.toEqual({
+      jsonrpc: '2.0',
+      id: 1,
+      result: {
+        protocolVersion: '2025-03-26',
+        capabilities: { tools: { listChanged: false } },
+        serverInfo: { name: 'qwen-browser-tools', version: '1.2.3' },
+      },
+    });
+  });
+
+  it('lists and calls tools', async () => {
+    const list = await server.handleMessage({
+      jsonrpc: '2.0',
+      id: 'list',
+      method: 'tools/list',
+    });
+    expect(list).toMatchObject({
+      result: { tools: [{ name: 'take_snapshot' }] },
+    });
+
+    const call = await server.handleMessage({
+      jsonrpc: '2.0',
+      id: 'call',
+      method: 'tools/call',
+      params: { name: 'take_snapshot', arguments: {} },
+    });
+    expect(handler.callTool).toHaveBeenCalledWith('take_snapshot', {});
+    expect(call).toMatchObject({
+      result: { content: [{ type: 'text', text: 'called take_snapshot' }] },
+    });
+  });
+
+  it('returns protocol errors without throwing', async () => {
+    await expect(server.handleMessage({ bad: true })).resolves.toMatchObject({
+      error: { code: -32600 },
+    });
+    await expect(
+      server.handleMessage({
+        jsonrpc: '2.0',
+        id: 2,
+        method: 'tools/call',
+        params: { name: 42 },
+      }),
+    ).resolves.toMatchObject({ error: { code: -32602 } });
+  });
+
+  it('does not answer notifications', async () => {
+    await expect(
+      server.handleMessage({
+        jsonrpc: '2.0',
+        method: 'notifications/initialized',
+      }),
+    ).resolves.toBeNull();
+  });
+});
diff --git a/packages/chrome-extension/src/background/browser-mcp/server.ts b/packages/chrome-extension/src/background/browser-mcp/server.ts
new file mode 100644
index 00000000000..18702817565
--- /dev/null
+++ b/packages/chrome-extension/src/background/browser-mcp/server.ts
@@ -0,0 +1,143 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+export interface BrowserToolDefinition {
+  name: string;
+  description: string;
+  inputSchema: {
+    type: 'object';
+    properties?: Record<string, unknown>;
+    required?: string[];
+    additionalProperties?: boolean;
+  };
+}
+
+export interface BrowserToolResult {
+  content: Array<
+    | { type: 'text'; text: string }
+    | { type: 'image'; data: string; mimeType: string }
+  >;
+  isError?: boolean;
+}
+
+export interface BrowserToolHandler {
+  readonly tools: readonly BrowserToolDefinition[];
+  callTool(
+    name: string,
+    args: Record<string, unknown>,
+  ): Promise<BrowserToolResult>;
+}
+
+interface JsonRpcRequest {
+  jsonrpc: '2.0';
+  id?: string | number;
+  method: string;
+  params?: unknown;
+}
+
+interface JsonRpcResponse {
+  jsonrpc: '2.0';
+  id: string | number | null;
+  result?: unknown;
+  error?: { code: number; message: string };
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function errorResponse(
+  id: string | number | null,
+  code: number,
+  message: string,
+): JsonRpcResponse {
+  return { jsonrpc: '2.0', id, error: { code, message } };
+}
+
+export class BrowserMcpServer {
+  constructor(private readonly handler: BrowserToolHandler) {}
+
+  async handleMessage(message: unknown): Promise<JsonRpcResponse | null> {
+    if (!isRecord(message) || message['jsonrpc'] !== '2.0') {
+      return errorResponse(null, -32600, 'Invalid JSON-RPC request');
+    }
+    const request = message as unknown as JsonRpcRequest;
+    if (typeof request.method !== 'string') {
+      return errorResponse(request.id ?? null, -32600, 'Missing method');
+    }
+
+    const isNotification = request.id === undefined;
+    if (request.method === 'notifications/initialized') return null;
+
+    try {
+      switch (request.method) {
+        case 'initialize': {
+          if (isNotification) return null;
+          const params = isRecord(request.params) ? request.params : {};
+          return {
+            jsonrpc: '2.0',
+            id: request.id!,
+            result: {
+              protocolVersion:
+                typeof params['protocolVersion'] === 'string'
+                  ? params['protocolVersion']
+                  : '2024-11-05',
+              capabilities: { tools: { listChanged: false } },
+              serverInfo: {
+                name: 'qwen-browser-tools',
+                version: chrome.runtime.getManifest().version,
+              },
+            },
+          };
+        }
+        case 'ping':
+          return isNotification
+            ? null
+            : { jsonrpc: '2.0', id: request.id!, result: {} };
+        case 'tools/list':
+          return isNotification
+            ? null
+            : {
+                jsonrpc: '2.0',
+                id: request.id!,
+                result: { tools: this.handler.tools },
+              };
+        case 'tools/call': {
+          if (isNotification) return null;
+          if (!isRecord(request.params)) {
+            return errorResponse(request.id!, -32602, 'Invalid tool call');
+          }
+          const name = request.params['name'];
+          const rawArgs = request.params['arguments'];
+          if (typeof name !== 'string' || !isRecord(rawArgs ?? {})) {
+            return errorResponse(request.id!, -32602, 'Invalid tool call');
+          }
+          const result = await this.handler.callTool(
+            name,
+            (rawArgs ?? {}) as Record<string, unknown>,
+          );
+          return { jsonrpc: '2.0', id: request.id!, result };
+        }
+        default:
+          return isNotification
+            ? null
+            : errorResponse(
+                request.id!,
+                -32601,
+                `Method not found: ${request.method}`,
+              );
+      }
+    } catch (error) {
+      return isNotification
+        ? null
+        : errorResponse(
+            request.id!,
+            -32603,
+            error instanceof Error ? error.message : String(error),
+          );
+    }
+  }
+}
diff --git a/packages/chrome-extension/src/background/service-worker.test.ts b/packages/chrome-extension/src/background/service-worker.test.ts
new file mode 100644
index 00000000000..7aa8b489006
--- /dev/null
+++ b/packages/chrome-extension/src/background/service-worker.test.ts
@@ -0,0 +1,192 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+  getDaemonConfig: vi.fn(),
+  checkExtensionPairing: vi.fn(),
+  getDaemonFeatures: vi.fn(),
+  registerBrowserMcp: vi.fn(),
+  routeBrowserMcpFrame: vi.fn(async () => false),
+  shutdownBrowserTools: vi.fn(async () => {}),
+  shutdownCdpBridge: vi.fn(),
+}));
+
+vi.mock('../daemon/config.js', () => ({
+  getDaemonConfig: mocks.getDaemonConfig,
+}));
+vi.mock('../daemon/discovery.js', () => ({
+  checkExtensionPairing: mocks.checkExtensionPairing,
+  getDaemonFeatures: mocks.getDaemonFeatures,
+}));
+vi.mock('./browser-mcp/connection.js', () => ({
+  BROWSER_MCP_SERVER_NAME: 'qwen-browser',
+  registerBrowserMcp: mocks.registerBrowserMcp,
+  routeBrowserMcpFrame: mocks.routeBrowserMcpFrame,
+}));
+vi.mock('./browser-mcp/debugger-session.js', () => ({
+  ChromeDebuggerSession: class {},
+}));
+vi.mock('./browser-mcp/browser-tools.js', () => ({
+  BrowserTools: class {
+    shutdown = mocks.shutdownBrowserTools;
+  },
+}));
+vi.mock('./browser-mcp/server.js', () => ({
+  BrowserMcpServer: class {},
+}));
+vi.mock('./cdp-bridge', () => ({
+  isCdpBridgeFrame: () => false,
+  handleCdpFrame: vi.fn(),
+  shutdownCdpBridge: mocks.shutdownCdpBridge,
+}));
+
+type ScheduledTask = { callback: () => void; delay: number };
+
+class FakeWebSocket {
+  static readonly CONNECTING = 0;
+  static readonly OPEN = 1;
+  static readonly instances: FakeWebSocket[] = [];
+
+  readonly send = vi.fn();
+  readonly close = vi.fn();
+  readyState = FakeWebSocket.CONNECTING;
+  onopen: (() => void) | null = null;
+  onmessage: ((event: { data: string }) => void) | null = null;
+  onerror: ((event: Event) => void) | null = null;
+  onclose: ((event: { code: number; reason: string }) => void) | null = null;
+
+  constructor(
+    readonly url: string,
+    readonly protocols?: string | string[],
+  ) {
+    FakeWebSocket.instances.push(this);
+  }
+
+  open(): void {
+    this.readyState = FakeWebSocket.OPEN;
+    this.onopen?.();
+  }
+
+  message(payload: unknown): void {
+    this.onmessage?.({ data: JSON.stringify(payload) });
+  }
+
+  disconnect(code = 1006, reason = 'daemon stopped'): void {
+    this.readyState = 3;
+    this.onclose?.({ code, reason });
+  }
+}
+
+async function flushPromises(): Promise<void> {
+  for (let index = 0; index < 8; index++) await Promise.resolve();
+}
+
+describe('browser-tools service worker', () => {
+  const scheduled: ScheduledTask[] = [];
+
+  beforeEach(() => {
+    vi.resetModules();
+    vi.clearAllMocks();
+    FakeWebSocket.instances.length = 0;
+    scheduled.length = 0;
+    mocks.getDaemonConfig.mockResolvedValue({
+      baseUrl: 'http://127.0.0.1:4170',
+      token: 'daemon-token',
+      extensionPairingCredential: 'credential.secret',
+    });
+    mocks.checkExtensionPairing.mockResolvedValue({ paired: true });
+    mocks.getDaemonFeatures.mockResolvedValue(new Set());
+    vi.stubGlobal('WebSocket', FakeWebSocket);
+    vi.stubGlobal('chrome', {
+      alarms: {
+        create: vi.fn(),
+        onAlarm: { addListener: vi.fn() },
+      },
+      runtime: {
+        onMessage: { addListener: vi.fn() },
+      },
+      sidePanel: {
+        setPanelBehavior: vi.fn(async () => {}),
+      },
+    });
+    vi.spyOn(globalThis, 'setTimeout').mockImplementation(((
+      callback: () => void,
+      delay = 0,
+    ) => {
+      scheduled.push({ callback, delay });
+      return 1;
+    }) as typeof setTimeout);
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+  });
+
+  it('pairs before connecting, registers tools, and reconnects after cleanup', async () => {
+    await import('./service-worker.js');
+    await flushPromises();
+
+    expect(mocks.checkExtensionPairing).toHaveBeenCalledOnce();
+    expect(mocks.getDaemonFeatures).toHaveBeenCalledOnce();
+    expect(
+      mocks.checkExtensionPairing.mock.invocationCallOrder[0],
+    ).toBeLessThan(mocks.getDaemonFeatures.mock.invocationCallOrder[0]!);
+    expect(FakeWebSocket.instances).toHaveLength(1);
+
+    const first = FakeWebSocket.instances[0]!;
+    expect(first.url).toBe('ws://127.0.0.1:4170/acp');
+    expect(first.protocols).toEqual([
+      'qwen-ws',
+      expect.stringMatching(/^qwen-bearer\./),
+    ]);
+    expect(JSON.stringify(first.protocols)).not.toContain('daemon-token');
+
+    first.open();
+    const initialize = JSON.parse(String(first.send.mock.calls[0]![0])) as {
+      params: { clientInfo: Record<string, unknown> };
+    };
+    expect(initialize.params.clientInfo).toMatchObject({
+      name: 'qwen-cdp-bridge',
+      extensionPairingCredential: 'credential.secret',
+    });
+
+    first.message({ id: 'browser-tools-acp-init', result: {} });
+    await flushPromises();
+    expect(mocks.registerBrowserMcp).toHaveBeenCalledOnce();
+
+    first.message({ type: 'mcp_error', code: 'register_failed' });
+    await flushPromises();
+    expect(first.close).toHaveBeenCalledWith(
+      4001,
+      'Browser MCP registration failed',
+    );
+
+    let finishCleanup: (() => void) | undefined;
+    mocks.shutdownBrowserTools.mockImplementationOnce(
+      () =>
+        new Promise<void>((resolve) => {
+          finishCleanup = resolve;
+        }),
+    );
+    first.disconnect();
+    await flushPromises();
+    expect(mocks.shutdownBrowserTools).toHaveBeenCalledOnce();
+    expect(mocks.shutdownCdpBridge).not.toHaveBeenCalled();
+    expect(scheduled).toEqual([expect.objectContaining({ delay: 1_000 })]);
+
+    scheduled[0]!.callback();
+    await flushPromises();
+    expect(FakeWebSocket.instances).toHaveLength(1);
+
+    finishCleanup?.();
+    await flushPromises();
+    expect(mocks.shutdownCdpBridge).toHaveBeenCalledOnce();
+    expect(FakeWebSocket.instances).toHaveLength(2);
+  });
+});
diff --git a/packages/chrome-extension/src/background/service-worker.ts b/packages/chrome-extension/src/background/service-worker.ts
index d34bceddb59..83973d3a4cb 100644
--- a/packages/chrome-extension/src/background/service-worker.ts
+++ b/packages/chrome-extension/src/background/service-worker.ts
@@ -3,11 +3,11 @@
  * Copyright 2025 Qwen Team
  * SPDX-License-Identifier: Apache-2.0
  *
- * Daemon CDP client — the entire extension service worker (Plan C, issue #5626).
+ * Qwen browser-tools service worker (issue #5626).
  *
- * A dumb CDP-tunnel pipe: connects to the local `qwen serve` daemon's `/acp`
- * WebSocket and bridges `cdp_*` frames into `chrome.debugger` via
- * {@link handleCdpFrame}. No chat UI — chat lives in the daemon web UI.
+ * Connects to the local `qwen serve` daemon's `/acp` WebSocket, registers the
+ * extension-hosted browser MCP server, and retains the legacy `cdp_*` tunnel
+ * for operators who explicitly configure an external adapter.
  *
  * On open we send an ACP `initialize`: the daemon closes the socket on a 30s
  * timeout otherwise, and registers this connection as the CDP bridge at that
@@ -19,8 +19,19 @@ import {
   handleCdpFrame,
   shutdownCdpBridge,
 } from './cdp-bridge';
+import { BrowserTools } from './browser-mcp/browser-tools.js';
+import {
+  BROWSER_MCP_SERVER_NAME,
+  registerBrowserMcp,
+  routeBrowserMcpFrame,
+} from './browser-mcp/connection.js';
+import { ChromeDebuggerSession } from './browser-mcp/debugger-session.js';
+import { BrowserMcpServer } from './browser-mcp/server.js';
 import { getDaemonConfig } from '../daemon/config.js';
-import { checkDaemonHealth } from '../daemon/discovery.js';
+import {
+  checkExtensionPairing,
+  getDaemonFeatures,
+} from '../daemon/discovery.js';
 
 /* global WebSocket, console, setTimeout, chrome, TextEncoder, btoa */
 
@@ -51,6 +62,7 @@ function bearerSubprotocol(token: string): string {
 
 /** Correlation id for the ACP `initialize` sent right after the socket opens. */
 const ACP_INIT_ID = 'browser-tools-acp-init';
+const DAEMON_READY_MESSAGE_TYPE = 'qwen-daemon-ready';
 
 /**
  * `clientInfo.name` this extension sends so the daemon routes the reverse CDP
@@ -59,7 +71,6 @@ const ACP_INIT_ID = 'browser-tools-acp-init';
  * module).
  */
 const CDP_BRIDGE_CLIENT_NAME = 'qwen-cdp-bridge';
-
 /** Reconnect backoff bounds (ms). */
 const RECONNECT_MIN_MS = 1_000;
 const RECONNECT_MAX_MS = 30_000;
@@ -68,6 +79,11 @@ let socket: WebSocket | null = null;
 let started = false;
 let reconnectTimer: ReturnType<typeof setTimeout> | null = null;
 let reconnectDelay = RECONNECT_MIN_MS;
+let cleanupPromise: Promise<void> = Promise.resolve();
+const browserSession = new ChromeDebuggerSession();
+const browserTools = new BrowserTools(browserSession);
+const browserMcpServer = new BrowserMcpServer(browserTools);
+let nativeBrowserToolsEnabled = true;
 
 /** Translate the daemon's HTTP base URL into the `/acp` WebSocket URL. */
 function toWebSocketUrl(baseUrl: string): string {
@@ -90,7 +106,7 @@ function sendRaw(ws: WebSocket, message: unknown): void {
 }
 
 /** Parse and route an inbound WS frame. */
-function onWsMessage(ws: WebSocket, data: unknown): void {
+async function onWsMessage(ws: WebSocket, data: unknown): Promise<void> {
   if (socket !== ws) return;
   let msg: Record<string, unknown>;
   try {
@@ -115,11 +131,42 @@ function onWsMessage(ws: WebSocket, data: unknown): void {
       );
       ws.close();
     } else {
-      console.log(LOG_PREFIX, 'ACP initialized; CDP tunnel ready');
+      if (nativeBrowserToolsEnabled) {
+        console.log(LOG_PREFIX, 'ACP initialized; registering browser tools');
+        registerBrowserMcp((frame) => sendRaw(ws, frame));
+      } else {
+        console.log(
+          LOG_PREFIX,
+          'ACP initialized; external browser adapter active',
+        );
+        reconnectDelay = RECONNECT_MIN_MS;
+      }
     }
     return;
   }
 
+  if (
+    msg['type'] === 'mcp_registered' &&
+    msg['server'] === BROWSER_MCP_SERVER_NAME
+  ) {
+    console.log(LOG_PREFIX, 'Native browser tools registered');
+    reconnectDelay = RECONNECT_MIN_MS;
+    return;
+  }
+
+  if (
+    await routeBrowserMcpFrame(browserMcpServer, msg, (frame) =>
+      sendRaw(ws, frame),
+    )
+  )
+    return;
+
+  if (msg['type'] === 'mcp_error') {
+    console.warn(LOG_PREFIX, 'Browser MCP registration error:', msg);
+    ws.close(4001, 'Browser MCP registration failed');
+    return;
+  }
+
   // CDP-tunnel frames: route to the bridge, which drives the tab via
   // chrome.debugger and pushes results/events back over the active socket.
   if (isCdpBridgeFrame(msg['type'])) {
@@ -141,8 +188,19 @@ function scheduleReconnect(): void {
   }, delay);
 }
 
+function reconnectNow(): void {
+  if (reconnectTimer) {
+    clearTimeout(reconnectTimer);
+    reconnectTimer = null;
+  }
+  if (started) void connect();
+  else void start();
+}
+
 /** Open the WebSocket and wire up handlers. */
 async function connect(): Promise<void> {
+  if (!started) return;
+  await cleanupPromise;
   if (!started) return;
   // Skip when a socket is already OPEN *or* still CONNECTING — a rapid
   // reconnect (e.g. config change) must not orphan an in-flight handshake.
@@ -156,10 +214,27 @@ async function connect(): Promise<void> {
 
   let url: string;
   let token: string | undefined;
+  let extensionPairingCredential: string | undefined;
   try {
     const config = await getDaemonConfig();
     url = toWebSocketUrl(config.baseUrl);
     token = config.token;
+    extensionPairingCredential = config.extensionPairingCredential;
+    const pairing = await checkExtensionPairing(config);
+    if (!pairing.paired) {
+      console.log(
+        LOG_PREFIX,
+        'Daemon reachable but extension is not paired:',
+        pairing.reason,
+      );
+      scheduleReconnect();
+      return;
+    }
+    // Pairing authenticates the daemon before a bearer token is sent to any
+    // HTTP endpoint or WebSocket handshake. This prevents a process that
+    // temporarily occupies the configured port from collecting stored tokens.
+    const features = await getDaemonFeatures(config);
+    nativeBrowserToolsEnabled = !features.has('browser_automation_mcp');
   } catch (error) {
     console.warn(LOG_PREFIX, 'Failed to read daemon config:', error);
     scheduleReconnect();
@@ -188,7 +263,6 @@ async function connect(): Promise<void> {
       ws.close();
       return;
     }
-    reconnectDelay = RECONNECT_MIN_MS;
     console.log(LOG_PREFIX, 'Connected; sending ACP initialize');
     sendRaw(ws, {
       jsonrpc: '2.0',
@@ -197,12 +271,20 @@ async function connect(): Promise<void> {
       // `clientInfo.name` gates which /acp connection becomes the CDP bridge
       // (vs web UI / Zed clients sharing /acp); must match the daemon's gate.
       params: {
-        clientInfo: { name: CDP_BRIDGE_CLIENT_NAME, version: '1.0.0' },
+        clientInfo: {
+          name: CDP_BRIDGE_CLIENT_NAME,
+          version: '1.0.0',
+          extensionPairingCredential,
+        },
       },
     });
   };
 
-  ws.onmessage = (event: MessageEvent) => onWsMessage(ws, event.data);
+  ws.onmessage = (event: MessageEvent) => {
+    void onWsMessage(ws, event.data).catch((error) => {
+      console.warn(LOG_PREFIX, 'Failed to handle daemon message:', error);
+    });
+  };
 
   ws.onerror = (event: Event) => {
     console.warn(LOG_PREFIX, 'WebSocket error', event);
@@ -223,34 +305,25 @@ async function connect(): Promise<void> {
     // would yank the debugger banner and break the live `/cdp` client.
     if (socket !== ws) return;
     socket = null;
-    shutdownCdpBridge();
+    cleanupPromise = cleanupPromise
+      .then(async () => {
+        await browserTools.shutdown();
+        shutdownCdpBridge();
+      })
+      .catch((error) => {
+        console.warn(LOG_PREFIX, 'Browser tools cleanup failed:', error);
+      });
     scheduleReconnect();
   };
 }
 
 /**
- * Start the daemon CDP client: probe `/health` to avoid spamming reconnects
- * when no daemon is up, then open the `/acp` WebSocket (which owns its own
- * reconnect loop once started). Idempotent.
+ * Start the daemon CDP client. Pairing verification inside `connect()` doubles
+ * as discovery and authenticates the local daemon before bearer credentials
+ * are used. Idempotent.
  */
 async function start(): Promise<void> {
   if (started) return;
-  try {
-    const config = await getDaemonConfig();
-    const health = await checkDaemonHealth(config);
-    if (!health.reachable) {
-      console.log(
-        LOG_PREFIX,
-        'Daemon not reachable; CDP client idle:',
-        health.error,
-      );
-      return;
-    }
-    console.log(LOG_PREFIX, 'Daemon reachable; starting CDP client');
-  } catch (error) {
-    console.warn(LOG_PREFIX, 'Daemon health probe failed:', error);
-    return;
-  }
   started = true;
   reconnectDelay = RECONNECT_MIN_MS;
   void connect();
@@ -275,6 +348,16 @@ chrome.alarms.onAlarm.addListener((alarm) => {
   else void start();
 });
 
+chrome.runtime.onMessage.addListener((message: unknown) => {
+  if (
+    message &&
+    typeof message === 'object' &&
+    (message as Record<string, unknown>)['type'] === DAEMON_READY_MESSAGE_TYPE
+  ) {
+    reconnectNow();
+  }
+});
+
 // No UI of its own: clicking the toolbar icon opens the side panel, which hosts
 // the daemon web UI in an iframe (see sidepanel.html).
 chrome.sidePanel
diff --git a/packages/chrome-extension/src/daemon/config.ts b/packages/chrome-extension/src/daemon/config.ts
index a035c6a6967..d60a0cb18b4 100644
--- a/packages/chrome-extension/src/daemon/config.ts
+++ b/packages/chrome-extension/src/daemon/config.ts
@@ -15,6 +15,8 @@ export interface DaemonConfig {
   baseUrl: string;
   /** Bearer token; omitted for loopback (auth-free) daemons. */
   token?: string;
+  /** One-time-paired credential that lets the extension expose browser tools. */
+  extensionPairingCredential?: string;
 }
 
 /** `qwen serve`'s default bind (see `qwen serve --port`, default 4170). */
@@ -51,7 +53,14 @@ export async function getDaemonConfig(): Promise<DaemonConfig> {
     console.warn('[DaemonConfig] ignoring non-loopback baseUrl:', baseUrl);
     return { baseUrl: DEFAULT_DAEMON_BASE_URL, token: undefined };
   }
-  return { baseUrl, token: cfg.token?.trim() || undefined };
+  const token = cfg.token?.trim() || undefined;
+  const extensionPairingCredential =
+    cfg.extensionPairingCredential?.trim() || undefined;
+  return {
+    baseUrl,
+    ...(token ? { token } : {}),
+    ...(extensionPairingCredential ? { extensionPairingCredential } : {}),
+  };
 }
 
 /** Persist a partial daemon config override. */
diff --git a/packages/chrome-extension/src/daemon/discovery.test.ts b/packages/chrome-extension/src/daemon/discovery.test.ts
new file mode 100644
index 00000000000..2a9148028a6
--- /dev/null
+++ b/packages/chrome-extension/src/daemon/discovery.test.ts
@@ -0,0 +1,159 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { createHash, createHmac } from 'node:crypto';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import {
+  checkDaemonHealth,
+  checkExtensionPairing,
+  getDaemonFeatures,
+} from './discovery.js';
+
+describe('checkDaemonHealth', () => {
+  afterEach(() => vi.unstubAllGlobals());
+
+  it('never sends a stored bearer token before pairing authenticates the daemon', async () => {
+    const fetchMock = vi.fn(
+      async (_input: RequestInfo | URL, _init?: RequestInit) =>
+        new Response(JSON.stringify({ status: 'ok' }), { status: 200 }),
+    );
+    vi.stubGlobal('fetch', fetchMock);
+
+    await expect(
+      checkDaemonHealth({
+        baseUrl: 'http://127.0.0.1:4170',
+        token: 'daemon-token',
+      }),
+    ).resolves.toEqual({ reachable: true, status: 'ok' });
+
+    const [, init] = fetchMock.mock.calls[0]!;
+    expect(init).not.toHaveProperty('headers');
+  });
+});
+
+describe('getDaemonFeatures', () => {
+  afterEach(() => vi.unstubAllGlobals());
+
+  it('returns advertised string feature tags', async () => {
+    const fetchMock = vi.fn(
+      async () =>
+        new Response(
+          JSON.stringify({
+            features: ['client_mcp_over_ws', 'browser_automation_mcp', 42],
+          }),
+          { status: 200, headers: { 'Content-Type': 'application/json' } },
+        ),
+    );
+    vi.stubGlobal('fetch', fetchMock);
+
+    const features = await getDaemonFeatures({
+      baseUrl: 'http://127.0.0.1:4170',
+      token: 'secret',
+    });
+    expect([...features]).toEqual([
+      'client_mcp_over_ws',
+      'browser_automation_mcp',
+    ]);
+    expect(fetchMock).toHaveBeenCalledWith(
+      'http://127.0.0.1:4170/capabilities',
+      expect.objectContaining({
+        headers: { Authorization: 'Bearer secret' },
+      }),
+    );
+  });
+
+  it('fails closed to an empty feature set', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => Promise.reject(new Error('down'))),
+    );
+    await expect(
+      getDaemonFeatures({ baseUrl: 'http://127.0.0.1:4170' }),
+    ).resolves.toEqual(new Set());
+  });
+});
+
+describe('checkExtensionPairing', () => {
+  afterEach(() => vi.unstubAllGlobals());
+
+  it('fails closed when no pairing credential is stored', async () => {
+    const fetchMock = vi.fn();
+    vi.stubGlobal('fetch', fetchMock);
+
+    await expect(
+      checkExtensionPairing({ baseUrl: 'http://127.0.0.1:4170' }),
+    ).resolves.toEqual({ paired: false, reason: 'missing_credential' });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('verifies the stored pairing credential with the daemon', async () => {
+    const secret = 'pairing-secret';
+    const fetchMock = vi.fn(async (_url: string, init?: RequestInit) => {
+      const request = JSON.parse(String(init?.body)) as { challenge: string };
+      const key = createHash('sha256').update(secret).digest();
+      const proof = createHmac('sha256', key)
+        .update(`qwen-extension-daemon:${request.challenge}`)
+        .digest('base64url');
+      return new Response(JSON.stringify({ paired: true, proof }), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      });
+    });
+    vi.stubGlobal('fetch', fetchMock);
+
+    await expect(
+      checkExtensionPairing({
+        baseUrl: 'http://127.0.0.1:4170',
+        token: 'daemon-token',
+        extensionPairingCredential: `credential-id.${secret}`,
+      }),
+    ).resolves.toEqual({ paired: true });
+    const [url, init] = fetchMock.mock.calls[0]!;
+    expect(url).toBe('http://127.0.0.1:4170/extension/pairing/verify');
+    expect(init).toEqual(
+      expect.objectContaining({
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+      }),
+    );
+    expect(init?.headers).not.toHaveProperty('Authorization');
+    expect(String(init?.body)).toContain('credential-id');
+    expect(String(init?.body)).not.toContain(secret);
+  });
+
+  it('rejects a daemon that cannot prove it issued the stored credential', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(
+        async () =>
+          new Response(JSON.stringify({ proof: 'wrong' }), { status: 200 }),
+      ),
+    );
+
+    await expect(
+      checkExtensionPairing({
+        baseUrl: 'http://127.0.0.1:4170',
+        extensionPairingCredential: 'credential-id.pairing-secret',
+      }),
+    ).resolves.toEqual({ paired: false, reason: 'rejected' });
+  });
+
+  it('treats daemon rejection as unpaired', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => new Response('{}', { status: 401 })),
+    );
+
+    await expect(
+      checkExtensionPairing({
+        baseUrl: 'http://127.0.0.1:4170',
+        extensionPairingCredential: 'credential-id.stale',
+      }),
+    ).resolves.toEqual({ paired: false, reason: 'rejected' });
+  });
+});
diff --git a/packages/chrome-extension/src/daemon/discovery.ts b/packages/chrome-extension/src/daemon/discovery.ts
index c9efba180d4..a7c71ebe573 100644
--- a/packages/chrome-extension/src/daemon/discovery.ts
+++ b/packages/chrome-extension/src/daemon/discovery.ts
@@ -10,10 +10,69 @@
 
 import type { DaemonConfig } from './config.js';
 
+const VERIFICATION_DOMAIN = 'qwen-extension-daemon';
+
+function parsePairingCredential(
+  credential: string,
+): { id: string; secret: string } | undefined {
+  const separator = credential.indexOf('.');
+  if (separator <= 0 || separator === credential.length - 1) return undefined;
+  return {
+    id: credential.slice(0, separator),
+    secret: credential.slice(separator + 1),
+  };
+}
+
+function base64Url(bytes: ArrayBuffer): string {
+  let binary = '';
+  for (const byte of new Uint8Array(bytes)) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary)
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+}
+
+async function pairingProof(
+  secret: string,
+  challenge: string,
+): Promise<string> {
+  const encoder = new TextEncoder();
+  const digest = await crypto.subtle.digest('SHA-256', encoder.encode(secret));
+  const key = await crypto.subtle.importKey(
+    'raw',
+    digest,
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign'],
+  );
+  return base64Url(
+    await crypto.subtle.sign(
+      'HMAC',
+      key,
+      encoder.encode(`${VERIFICATION_DOMAIN}:${challenge}`),
+    ),
+  );
+}
+
+function randomChallenge(): string {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  return base64Url(bytes.buffer);
+}
+
 export type DaemonHealth =
   | { reachable: true; status: string }
   | { reachable: false; error: string };
 
+export type ExtensionPairingHealth =
+  | { paired: true }
+  | {
+      paired: false;
+      reason: 'missing_credential' | 'rejected' | 'unreachable';
+    };
+
 /** Probe the daemon's `/health` endpoint with a short timeout. */
 export async function checkDaemonHealth(
   config: DaemonConfig,
@@ -23,7 +82,6 @@ export async function checkDaemonHealth(
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
     const res = await fetch(`${config.baseUrl.replace(/\/+$/, '')}/health`, {
-      headers: config.token ? { Authorization: `Bearer ${config.token}` } : {},
       signal: controller.signal,
     });
     if (!res.ok) {
@@ -40,3 +98,78 @@ export async function checkDaemonHealth(
     clearTimeout(timer);
   }
 }
+
+/** Read the daemon's advertised feature tags. */
+export async function getDaemonFeatures(
+  config: DaemonConfig,
+  timeoutMs = 2_000,
+): Promise<Set<string>> {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(
+      `${config.baseUrl.replace(/\/+$/, '')}/capabilities`,
+      {
+        headers: config.token
+          ? { Authorization: `Bearer ${config.token}` }
+          : {},
+        signal: controller.signal,
+      },
+    );
+    if (!res.ok) return new Set();
+    const body = (await res.json().catch(() => ({}))) as {
+      features?: unknown;
+    };
+    return new Set(
+      Array.isArray(body.features)
+        ? body.features.filter(
+            (feature): feature is string => typeof feature === 'string',
+          )
+        : [],
+    );
+  } catch {
+    return new Set();
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/** Verify that this extension has been paired with the daemon it found. */
+export async function checkExtensionPairing(
+  config: DaemonConfig,
+  timeoutMs = 2_000,
+): Promise<ExtensionPairingHealth> {
+  const credential = config.extensionPairingCredential?.trim();
+  if (!credential) {
+    return { paired: false, reason: 'missing_credential' };
+  }
+  const parsed = parsePairingCredential(credential);
+  if (!parsed) return { paired: false, reason: 'rejected' };
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const challenge = randomChallenge();
+    const res = await fetch(
+      `${config.baseUrl.replace(/\/+$/, '')}/extension/pairing/verify`,
+      {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ credentialId: parsed.id, challenge }),
+        signal: controller.signal,
+      },
+    );
+    if (!res.ok) return { paired: false, reason: 'rejected' };
+    const body = (await res.json().catch(() => ({}))) as { proof?: unknown };
+    const expected = await pairingProof(parsed.secret, challenge);
+    return body.proof === expected
+      ? { paired: true }
+      : { paired: false, reason: 'rejected' };
+  } catch {
+    return { paired: false, reason: 'unreachable' };
+  } finally {
+    clearTimeout(timer);
+  }
+}
diff --git a/packages/cli/src/serve/acp-http/client-mcp-sender-registry.test.ts b/packages/cli/src/serve/acp-http/client-mcp-sender-registry.test.ts
index 87916d8d27e..7da5ed37512 100644
--- a/packages/cli/src/serve/acp-http/client-mcp-sender-registry.test.ts
+++ b/packages/cli/src/serve/acp-http/client-mcp-sender-registry.test.ts
@@ -74,6 +74,7 @@ describe('createClientMcpServerProvider', () => {
     addResult: Awaited<ReturnType<ClientMcpBridge['addRuntimeMcpServer']>>,
   ) {
     return {
+      preheat: vi.fn(async () => {}),
       addRuntimeMcpServer: vi.fn(async () => addResult),
       removeRuntimeMcpServer: vi.fn(async () => ({})),
     } satisfies ClientMcpBridge;
@@ -114,6 +115,7 @@ describe('createClientMcpServerProvider', () => {
   it('rolls back the sender when bridge add throws', async () => {
     const registry = new ClientMcpSenderRegistry();
     const bridge = {
+      preheat: vi.fn(async () => {}),
       addRuntimeMcpServer: vi.fn(async () => {
         throw new Error('boom');
       }),
@@ -132,6 +134,29 @@ describe('createClientMcpServerProvider', () => {
     expect(bridge.removeRuntimeMcpServer).not.toHaveBeenCalled();
   });
 
+  it('preheats the ACP child before adding the runtime server', async () => {
+    const registry = new ClientMcpSenderRegistry();
+    const order: string[] = [];
+    const bridge = {
+      preheat: vi.fn(async () => {
+        order.push('preheat');
+      }),
+      addRuntimeMcpServer: vi.fn(async () => {
+        order.push('add');
+        return { toolCount: 1 };
+      }),
+      removeRuntimeMcpServer: vi.fn(async () => ({})),
+    } satisfies ClientMcpBridge;
+    const provider = createClientMcpServerProvider(registry, bridge, 'connA');
+
+    await provider.registerClientMcpServer(
+      'srv',
+      vi.fn(async () => msg(1)),
+    );
+
+    expect(order).toEqual(['preheat', 'add']);
+  });
+
   it('does not unregister a server now owned by another connection', async () => {
     const registry = new ClientMcpSenderRegistry();
     const bridge = setupBridge({ toolCount: 1 });
diff --git a/packages/cli/src/serve/acp-http/client-mcp-sender-registry.ts b/packages/cli/src/serve/acp-http/client-mcp-sender-registry.ts
index e49b96440ef..f13c3f3f960 100644
--- a/packages/cli/src/serve/acp-http/client-mcp-sender-registry.ts
+++ b/packages/cli/src/serve/acp-http/client-mcp-sender-registry.ts
@@ -135,6 +135,7 @@ export class ClientMcpSenderRegistry {
  * bridge surface (and easy to fake in tests).
  */
 export interface ClientMcpBridge {
+  preheat(): Promise<void>;
   addRuntimeMcpServer(
     name: string,
     config: Record<string, unknown>,
@@ -167,6 +168,10 @@ export function createClientMcpServerProvider(
 ): ClientMcpServerProvider {
   return {
     async registerClientMcpServer(serverName, sendSdkMcpMessage) {
+      // A browser extension can connect before the daemon's ACP child is warm.
+      // Runtime MCP mutation requires that live channel, so establish it here
+      // instead of relying on a Web Shell request to race ahead of registration.
+      await bridge.preheat();
       // Record the sender FIRST so the child's discovery handshake — which the
       // bridge add triggers synchronously — can route `client_mcp/message`
       // frames back to this WS. Owned by this connection's client id so a peer
diff --git a/packages/cli/src/serve/acp-http/client-mcp-ws.test.ts b/packages/cli/src/serve/acp-http/client-mcp-ws.test.ts
index d5dc7cc9623..07aa1cf7701 100644
--- a/packages/cli/src/serve/acp-http/client-mcp-ws.test.ts
+++ b/packages/cli/src/serve/acp-http/client-mcp-ws.test.ts
@@ -18,7 +18,10 @@ import type { JSONRPCMessage } from '@modelcontextprotocol/sdk/types.js';
 import { SdkControlClientTransport } from '@qwen-code/qwen-code-core';
 import type { DaemonWorkspaceService } from '../workspace-service/types.js';
 import { mountAcpHttp } from './index.js';
-import type { ClientMcpServerProvider } from './client-mcp-ws.js';
+import {
+  ClientMcpWsConnection,
+  type ClientMcpServerProvider,
+} from './client-mcp-ws.js';
 import { WorkspaceRememberTaskLane } from '../workspace-remember.js';
 
 vi.mock('../../utils/stdioHelpers.js', () => ({
@@ -168,10 +171,17 @@ describe('client_mcp_over_ws reverse channel (serve layer)', () => {
   let provider: AgentSideProvider;
 
   function startServer(
-    opts: { clientMcpOverWs?: boolean; withProvider?: boolean } = {},
+    opts: {
+      clientMcpOverWs?: boolean;
+      allowUnpairedClientMcp?: boolean;
+      withProvider?: boolean;
+      verifyExtensionPairingCredential?: (
+        credential: string | undefined,
+      ) => boolean;
+    } = {},
   ): Promise<void> {
     provider = new AgentSideProvider();
-    return new Promise<void>((resolve) => {
+    return new Promise<void>((resolve, reject) => {
       const app = express();
       app.use(express.json());
       const handle = mountAcpHttp(app, fakeBridge, {
@@ -180,13 +190,17 @@ describe('client_mcp_over_ws reverse channel (serve layer)', () => {
         enabled: true,
         workspaceRememberLane: new WorkspaceRememberTaskLane(fakeBridge),
         clientMcpOverWs: opts.clientMcpOverWs ?? true,
+        allowUnpairedClientMcp: opts.allowUnpairedClientMcp,
+        verifyExtensionPairingCredential: opts.verifyExtensionPairingCredential,
         ...(opts.withProvider === false ? {} : { clientMcpProvider: provider }),
       });
-      server = app.listen(0, '127.0.0.1', () => {
-        port = (server.address() as AddressInfo).port;
-        handle?.attachServer(server);
+      const listeningServer = app.listen(0, '127.0.0.1', () => {
+        port = (listeningServer.address() as AddressInfo).port;
+        handle?.attachServer(listeningServer);
         resolve();
       });
+      listeningServer.once('error', reject);
+      server = listeningServer;
     });
   }
 
@@ -204,15 +218,20 @@ describe('client_mcp_over_ws reverse channel (serve layer)', () => {
   }
 
   /** Initialize the ACP connection and resolve once the init reply lands. */
-  function initialize(ws: WebSocket): Promise<void> {
+  function initialize(
+    ws: WebSocket,
+    params: Record<string, unknown> = {},
+  ): Promise<Record<string, unknown>> {
     return new Promise((resolve) => {
-      ws.once('message', () => resolve());
+      ws.once('message', (data) =>
+        resolve(JSON.parse(data.toString()) as Record<string, unknown>),
+      );
       ws.send(
         JSON.stringify({
           jsonrpc: '2.0',
           id: 1,
           method: 'initialize',
-          params: {},
+          params,
         }),
       );
     });
@@ -329,6 +348,124 @@ describe('client_mcp_over_ws reverse channel (serve layer)', () => {
     ws.close();
   });
 
+  it('rejects the Chrome extension bridge initialize before daemon pairing', async () => {
+    await startServer({
+      verifyExtensionPairingCredential: (credential) => credential === 'paired',
+    });
+    const ws = await wsConnect();
+
+    const reply = await new Promise<Record<string, unknown>>((resolve) => {
+      ws.once('message', (data) =>
+        resolve(JSON.parse(data.toString()) as Record<string, unknown>),
+      );
+      ws.send(
+        JSON.stringify({
+          jsonrpc: '2.0',
+          id: 1,
+          method: 'initialize',
+          params: { clientInfo: { name: 'qwen-cdp-bridge' } },
+        }),
+      );
+    });
+
+    expect(reply).toMatchObject({
+      id: 1,
+      error: { message: 'Chrome extension is not paired with this daemon' },
+    });
+    ws.close();
+  });
+
+  it('rejects the Chrome extension bridge when no pairing verifier is wired', async () => {
+    await startServer();
+    const ws = await wsConnect();
+
+    const reply = await initialize(ws, {
+      clientInfo: { name: 'qwen-cdp-bridge' },
+    });
+
+    expect(reply).toMatchObject({
+      id: 1,
+      error: { message: 'Chrome extension is not paired with this daemon' },
+    });
+    ws.close();
+  });
+
+  it('rejects reverse MCP from ordinary ACP clients by default', async () => {
+    await startServer({
+      verifyExtensionPairingCredential: () => false,
+      withProvider: false,
+    });
+    const ws = await wsConnect();
+
+    const initReply = await initialize(ws, {
+      clientInfo: { name: 'ordinary-acp-client' },
+    });
+    expect(initReply['result']).toBeDefined();
+
+    const mcpReply = new Promise<Record<string, unknown>>((resolve) => {
+      ws.once('message', (data) =>
+        resolve(JSON.parse(data.toString()) as Record<string, unknown>),
+      );
+    });
+    ws.send(JSON.stringify({ type: 'mcp_register', server: 'chrome-tools' }));
+    await expect(mcpReply).resolves.toMatchObject({
+      type: 'mcp_error',
+      code: 'not_authorized',
+    });
+    ws.close();
+  });
+
+  it('allows ordinary reverse MCP after explicit operator opt-in', async () => {
+    await startServer({
+      verifyExtensionPairingCredential: () => false,
+      allowUnpairedClientMcp: true,
+      withProvider: false,
+    });
+    const ws = await wsConnect();
+
+    const initReply = await initialize(ws, {
+      clientInfo: { name: 'ordinary-acp-client' },
+    });
+    expect(initReply['result']).toBeDefined();
+
+    const mcpReply = new Promise<Record<string, unknown>>((resolve) => {
+      ws.once('message', (data) =>
+        resolve(JSON.parse(data.toString()) as Record<string, unknown>),
+      );
+    });
+    ws.send(JSON.stringify({ type: 'mcp_register', server: 'chrome-tools' }));
+    await expect(mcpReply).resolves.toMatchObject({
+      type: 'mcp_error',
+      code: 'not_wired',
+    });
+    ws.close();
+  });
+
+  it('accepts the Chrome extension bridge initialize after daemon pairing', async () => {
+    await startServer({
+      verifyExtensionPairingCredential: (credential) => credential === 'paired',
+    });
+    const ws = await wsConnect();
+
+    await new Promise<void>((resolve) => {
+      ws.once('message', () => resolve());
+      ws.send(
+        JSON.stringify({
+          jsonrpc: '2.0',
+          id: 1,
+          method: 'initialize',
+          params: {
+            clientInfo: {
+              name: 'qwen-cdp-bridge',
+              extensionPairingCredential: 'paired',
+            },
+          },
+        }),
+      );
+    });
+    ws.close();
+  });
+
   it('tears down the client-hosted server on WS close', async () => {
     await startServer({ clientMcpOverWs: true });
     const ws = await wsConnect();
@@ -362,3 +499,45 @@ describe('client_mcp_over_ws reverse channel (serve layer)', () => {
     });
   });
 });
+
+describe('ClientMcpWsConnection lifecycle', () => {
+  it('waits for an in-flight registration before disconnect cleanup', async () => {
+    let finishRegistration:
+      | ((value: { toolCount: number }) => void)
+      | undefined;
+    const registration = new Promise<{ toolCount: number }>((resolve) => {
+      finishRegistration = resolve;
+    });
+    const calls: string[] = [];
+    const provider: ClientMcpServerProvider = {
+      registerClientMcpServer: vi.fn(async () => {
+        calls.push('register:start');
+        const result = await registration;
+        calls.push('register:done');
+        return result;
+      }),
+      unregisterClientMcpServer: vi.fn(async () => {
+        calls.push('unregister');
+      }),
+    };
+    const connection = new ClientMcpWsConnection(() => {}, provider);
+
+    const registerResult = connection.handleFrame({
+      type: 'mcp_register',
+      server: 'browser-tools',
+    });
+    await vi.waitFor(() => expect(calls).toEqual(['register:start']));
+
+    const disposed = connection.dispose();
+    await Promise.resolve();
+    expect(calls).toEqual(['register:start']);
+
+    finishRegistration?.({ toolCount: 1 });
+    await expect(registerResult).resolves.toMatchObject({
+      kind: 'error',
+      code: 'closed',
+    });
+    await disposed;
+    expect(calls).toEqual(['register:start', 'register:done', 'unregister']);
+  });
+});
diff --git a/packages/cli/src/serve/acp-http/client-mcp-ws.ts b/packages/cli/src/serve/acp-http/client-mcp-ws.ts
index 21e0011a44f..bd430546620 100644
--- a/packages/cli/src/serve/acp-http/client-mcp-ws.ts
+++ b/packages/cli/src/serve/acp-http/client-mcp-ws.ts
@@ -118,6 +118,7 @@ export type ClientMcpHandleResult =
  */
 export class ClientMcpWsConnection {
   private readonly registrar: ClientMcpRegistrar;
+  private readonly inFlightRegistrations = new Map<string, Promise<void>>();
   private disposed = false;
 
   constructor(
@@ -212,22 +213,25 @@ export class ClientMcpWsConnection {
     // Advertise to the registrar BEFORE registering so the SDK discovery
     // handshake (which the provider triggers synchronously) can route frames.
     this.registrar.registerServer(server);
+    const registration = this.provider.registerClientMcpServer(
+      server,
+      this.registrar.sendSdkMcpMessage,
+    );
+    const settled = registration.then(
+      () => undefined,
+      () => undefined,
+    );
+    this.inFlightRegistrations.set(server, settled);
     try {
-      const { toolCount } = await this.provider.registerClientMcpServer(
-        server,
-        this.registrar.sendSdkMcpMessage,
-      );
-      // The WS may have closed (dispose() ran) while we awaited the provider
-      // round-trip. dispose() snapshots its server set before this register
-      // resolves, so the provider would otherwise be left holding a zombie
-      // runtime MCP server. Re-check and tear it back down.
-      if (this.disposed) {
-        this.registrar.unregisterServer(server);
-        await this.provider.unregisterClientMcpServer(server);
+      const { toolCount } = await registration;
+      // Unregister/dispose remove the registrar entry first, then wait for this
+      // registration before removing the provider entry. Do not acknowledge a
+      // server that was cancelled while its discovery handshake was running.
+      if (this.disposed || !this.registrar.hasServer(server)) {
         return {
           kind: 'error',
           code: 'closed',
-          message: 'connection disposed during register',
+          message: 'connection closed during register',
         };
       }
       return { kind: 'registered', server, toolCount };
@@ -239,6 +243,10 @@ export class ClientMcpWsConnection {
         code: 'register_failed',
         message: err instanceof Error ? err.message : String(err),
       };
+    } finally {
+      if (this.inFlightRegistrations.get(server) === settled) {
+        this.inFlightRegistrations.delete(server);
+      }
     }
   }
 
@@ -258,6 +266,7 @@ export class ClientMcpWsConnection {
     const existed = this.registrar.unregisterServer(server);
     if (existed && this.provider) {
       try {
+        await this.inFlightRegistrations.get(server);
         await this.provider.unregisterClientMcpServer(server);
       } catch {
         // Best-effort teardown — the registrar already rejected pending.
@@ -315,9 +324,10 @@ export class ClientMcpWsConnection {
     this.registrar.close(reason);
     if (this.provider) {
       await Promise.allSettled(
-        servers.map((server) =>
-          this.provider!.unregisterClientMcpServer(server),
-        ),
+        servers.map(async (server) => {
+          await this.inFlightRegistrations.get(server);
+          await this.provider!.unregisterClientMcpServer(server);
+        }),
       );
     }
   }
diff --git a/packages/cli/src/serve/acp-http/index.ts b/packages/cli/src/serve/acp-http/index.ts
index 9b1654ef81d..df15750bed5 100644
--- a/packages/cli/src/serve/acp-http/index.ts
+++ b/packages/cli/src/serve/acp-http/index.ts
@@ -390,6 +390,11 @@ export interface MountAcpHttpOptions {
    * default — the public contract is still settling.
    */
   clientMcpOverWs?: boolean;
+  /**
+   * Explicit compatibility opt-in for reverse MCP clients that do not use the
+   * Chrome extension pairing credential.
+   */
+  allowUnpairedClientMcp?: boolean;
   /**
    * Injection point for the deep wiring into the agent's live MCP stack. When
    * supplied, an `mcp_register` frame registers a real SDK-type runtime MCP
@@ -418,6 +423,14 @@ export interface MountAcpHttpOptions {
    * link. Off by default.
    */
   cdpTunnelOverWs?: boolean;
+  /**
+   * Extension-native browser tools must prove the daemon was explicitly paired
+   * before a `qwen-cdp-bridge` connection can register tools or claim CDP.
+   * Legacy CDP-only bridges do not use this credential.
+   */
+  verifyExtensionPairingCredential?: (
+    credential: string | undefined,
+  ) => boolean;
   /**
    * Process-scoped registry that pairs the extension `/acp` reverse connection
    * with the `/cdp` endpoint. Required when {@link cdpTunnelOverWs} is on;
@@ -1574,6 +1587,9 @@ export function mountAcpHttp(
         activeMount.webSockets.add(ws);
         activeMount.pendingWebSockets.add(ws);
         let initialized = false;
+        let clientMcpAuthorized =
+          opts.verifyExtensionPairingCredential === undefined ||
+          opts.allowUnpairedClientMcp === true;
         const initTimer = setTimeout(() => {
           if (!initialized) {
             writeStderrLine(
@@ -1752,6 +1768,18 @@ export function mountAcpHttp(
               return;
             }
 
+            if (!clientMcpAuthorized) {
+              ws.send(
+                JSON.stringify({
+                  type: 'mcp_error',
+                  code: 'not_authorized',
+                  message:
+                    'pair the Chrome extension before registering browser tools',
+                }),
+              );
+              return;
+            }
+
             const frameType = (parsed as { type?: unknown }).type;
 
             // Rate-limit the reverse client-MCP channel: an initialized client
@@ -1938,6 +1966,51 @@ export function mountAcpHttp(
               return;
             }
 
+            const clientInfo =
+              message.params &&
+              typeof message.params === 'object' &&
+              !Array.isArray(message.params) &&
+              typeof (message.params as Record<string, unknown>)[
+                'clientInfo'
+              ] === 'object' &&
+              (message.params as Record<string, unknown>)['clientInfo'] !==
+                null &&
+              !Array.isArray(
+                (message.params as Record<string, unknown>)['clientInfo'],
+              )
+                ? ((message.params as Record<string, unknown>)[
+                    'clientInfo'
+                  ] as Record<string, unknown>)
+                : undefined;
+            const clientName =
+              typeof clientInfo?.['name'] === 'string'
+                ? clientInfo['name']
+                : undefined;
+            const requiresExtensionPairing =
+              opts.clientMcpOverWs === true &&
+              clientName === CDP_BRIDGE_CLIENT_NAME;
+            if (requiresExtensionPairing) {
+              clientMcpAuthorized =
+                opts.verifyExtensionPairingCredential?.(
+                  typeof clientInfo?.['extensionPairingCredential'] === 'string'
+                    ? clientInfo['extensionPairingCredential']
+                    : undefined,
+                ) === true;
+            }
+            if (requiresExtensionPairing && !clientMcpAuthorized) {
+              ws.send(
+                JSON.stringify(
+                  rpcError(
+                    message.id,
+                    RPC.INVALID_REQUEST,
+                    'Chrome extension is not paired with this daemon',
+                  ),
+                ),
+              );
+              ws.close(1008, 'Extension not paired');
+              return;
+            }
+
             const conn = activeMount.registry.create(fromLoopback);
             if (!conn) {
               ws.send(
@@ -1998,16 +2071,6 @@ export function mountAcpHttp(
             // Gate on `clientInfo.name`: web UI / Zed agents share this `/acp`
             // endpoint, and an un-gated last-writer-wins would let an agent steal
             // the bridge with `cdp_*` frames it can't answer.
-            const clientName =
-              message.params &&
-              typeof message.params === 'object' &&
-              !Array.isArray(message.params)
-                ? (
-                    (message.params as Record<string, unknown>)[
-                      'clientInfo'
-                    ] as { name?: string } | undefined
-                  )?.name
-                : undefined;
             if (
               activeMount.primary &&
               opts.cdpTunnelOverWs === true &&
diff --git a/packages/cli/src/serve/extension-pairing-routes.ts b/packages/cli/src/serve/extension-pairing-routes.ts
new file mode 100644
index 00000000000..3ee2ae212f5
--- /dev/null
+++ b/packages/cli/src/serve/extension-pairing-routes.ts
@@ -0,0 +1,84 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import express, {
+  type Application,
+  type Request,
+  type Response,
+} from 'express';
+import { detectFromLoopback } from './server/request-helpers.js';
+import type { ExtensionPairingManager } from './extension-pairing.js';
+
+export const EXTENSION_PAIRING_PATH = '/extension/pairing';
+export const EXTENSION_PAIRING_CONFIRM_PATH = '/extension/pairing/confirm';
+export const EXTENSION_PAIRING_VERIFY_PATH = '/extension/pairing/verify';
+
+function requireLoopback(req: Request, res: Response): boolean {
+  if (detectFromLoopback(req)) return true;
+  res.status(403).json({ error: 'extension_pairing_requires_loopback' });
+  return false;
+}
+
+export function installExtensionPairingRoutes(
+  app: Application,
+  extensionPairingManager: ExtensionPairingManager,
+): void {
+  app.get(EXTENSION_PAIRING_PATH, (req: Request, res: Response): void => {
+    if (!requireLoopback(req, res)) return;
+    res.status(200).json(extensionPairingManager.getStatus());
+  });
+
+  app.post(
+    EXTENSION_PAIRING_CONFIRM_PATH,
+    express.json({ limit: '1kb' }),
+    (req: Request, res: Response): void => {
+      if (!requireLoopback(req, res)) return;
+      const body =
+        req.body && typeof req.body === 'object' && !Array.isArray(req.body)
+          ? (req.body as Record<string, unknown>)
+          : {};
+      const result = extensionPairingManager.confirm({
+        pairingNonce:
+          typeof body['pairingNonce'] === 'string' ? body['pairingNonce'] : '',
+        challenge:
+          typeof body['challenge'] === 'string' ? body['challenge'] : '',
+        clientProof:
+          typeof body['clientProof'] === 'string' ? body['clientProof'] : '',
+      });
+      if (!result.ok) {
+        res.status(401).json({ error: result.error });
+        return;
+      }
+      res.status(200).json({
+        credentialId: result.credentialId,
+        proof: result.proof,
+      });
+    },
+  );
+
+  app.post(
+    EXTENSION_PAIRING_VERIFY_PATH,
+    express.json({ limit: '1kb' }),
+    (req: Request, res: Response): void => {
+      if (!requireLoopback(req, res)) return;
+      const body =
+        req.body && typeof req.body === 'object' && !Array.isArray(req.body)
+          ? (req.body as Record<string, unknown>)
+          : {};
+      const proof = extensionPairingManager.createVerificationProof(
+        typeof body['credentialId'] === 'string'
+          ? body['credentialId']
+          : undefined,
+        typeof body['challenge'] === 'string' ? body['challenge'] : undefined,
+      );
+      if (!proof) {
+        res.status(401).json({ paired: false });
+        return;
+      }
+      res.status(200).json({ paired: true, proof });
+    },
+  );
+}
diff --git a/packages/cli/src/serve/extension-pairing.test.ts b/packages/cli/src/serve/extension-pairing.test.ts
new file mode 100644
index 00000000000..f952c7990d7
--- /dev/null
+++ b/packages/cli/src/serve/extension-pairing.test.ts
@@ -0,0 +1,186 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { createHash, createHmac } from 'node:crypto';
+import { describe, expect, it, vi } from 'vitest';
+import {
+  createExtensionPairingManager,
+  type ExtensionPairingManager,
+} from './extension-pairing.js';
+
+const CHALLENGE = 'A'.repeat(43);
+
+function pairingProof(
+  code: string,
+  direction: 'client' | 'server' | 'credential',
+  pairingNonce: string,
+  challenge: string,
+  credentialId?: string,
+): string {
+  const suffix = credentialId ? `:${credentialId}` : '';
+  return createHmac('sha256', createHash('sha256').update(code).digest())
+    .update(
+      `qwen-extension-pairing:${direction}:${pairingNonce}:${challenge}${suffix}`,
+    )
+    .digest('base64url');
+}
+
+function pairingRequest(
+  manager: ExtensionPairingManager,
+  code = manager.getDisplayCode(),
+) {
+  const status = manager.getStatus();
+  if (status.paired) throw new Error('expected unpaired status');
+  return {
+    pairingNonce: status.pairingNonce,
+    challenge: CHALLENGE,
+    clientProof: pairingProof(code, 'client', status.pairingNonce, CHALLENGE),
+  };
+}
+
+describe('createExtensionPairingManager', () => {
+  it('generates high-entropy pairing material without exposing the code', () => {
+    const manager = createExtensionPairingManager({
+      now: () => 1_000,
+      randomBytes: (size) => Buffer.alloc(size, 7),
+    });
+
+    const status = manager.getStatus();
+
+    expect(status.paired).toBe(false);
+    if (status.paired) throw new Error('expected unpaired status');
+    expect(status.expiresAt).toBe(601_000);
+    expect(status.pairingNonce).toMatch(/^[A-Za-z0-9_-]{22}$/);
+    expect('code' in status).toBe(false);
+    expect(manager.getDisplayCode()).toMatch(
+      /^(?:[0-9a-f]{4}-){7}[0-9a-f]{4}$/,
+    );
+  });
+
+  it('rejects an invalid proof without receiving the pairing code', () => {
+    const manager = createExtensionPairingManager({
+      now: () => 1_000,
+      randomBytes: (size) => Buffer.alloc(size, 2),
+    });
+    const request = pairingRequest(manager, '0000-0000-0000-0000');
+
+    expect(JSON.stringify(request)).not.toContain(manager.getDisplayCode());
+    expect(manager.confirm(request)).toEqual({
+      ok: false,
+      error: 'invalid_proof',
+    });
+    expect(manager.verifyCredential('anything')).toBe(false);
+  });
+
+  it('locks pairing after repeated invalid proofs', () => {
+    let now = 1_000;
+    const manager = createExtensionPairingManager({
+      now: () => now,
+      randomBytes: (size) => Buffer.alloc(size, 2),
+    });
+    const invalidRequest = pairingRequest(manager, 'wrong-code');
+
+    for (let index = 0; index < 10; index++) {
+      expect(manager.confirm(invalidRequest)).toEqual({
+        ok: false,
+        error: 'invalid_proof',
+      });
+    }
+    expect(manager.confirm(pairingRequest(manager))).toEqual({
+      ok: false,
+      error: 'too_many_attempts',
+    });
+
+    now += 60_000;
+    expect(manager.confirm(invalidRequest)).toEqual({
+      ok: false,
+      error: 'invalid_proof',
+    });
+  });
+
+  it('rejects expired pairing material and rotates its nonce', () => {
+    let now = 1_000;
+    let randomValue = 1;
+    const onCodeRotated = vi.fn();
+    const manager = createExtensionPairingManager({
+      now: () => now,
+      randomBytes: (size) => Buffer.alloc(size, randomValue++),
+      onCodeRotated,
+    });
+    const request = pairingRequest(manager);
+    const oldNonce = request.pairingNonce;
+
+    now = 601_001;
+
+    expect(manager.confirm(request)).toEqual({
+      ok: false,
+      error: 'expired_code',
+    });
+    const status = manager.getStatus();
+    if (status.paired) throw new Error('expected unpaired status');
+    expect(status.pairingNonce).not.toBe(oldNonce);
+    expect(onCodeRotated).toHaveBeenCalledWith(
+      manager.getDisplayCode(),
+      1_201_001,
+    );
+  });
+
+  it('mutually proves pairing and never transfers the credential secret', () => {
+    let counter = 1;
+    const manager = createExtensionPairingManager({
+      now: () => 1_000,
+      randomBytes: (size) => Buffer.alloc(size, counter++),
+    });
+    const code = manager.getDisplayCode();
+    const request = pairingRequest(manager, code);
+
+    const result = manager.confirm(request);
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) throw new Error('expected pairing success');
+    expect(result.credentialId).toMatch(/^[A-Za-z0-9_-]{11}$/);
+    expect(result.proof).toBe(
+      pairingProof(
+        code,
+        'server',
+        request.pairingNonce,
+        request.challenge,
+        result.credentialId,
+      ),
+    );
+    const credentialSecret = pairingProof(
+      code,
+      'credential',
+      request.pairingNonce,
+      request.challenge,
+      result.credentialId,
+    );
+    const credential = `${result.credentialId}.${credentialSecret}`;
+    expect(JSON.stringify(result)).not.toContain(credentialSecret);
+    expect(manager.verifyCredential(credential)).toBe(true);
+    expect(manager.verifyCredential(`${credential}x`)).toBe(false);
+    expect(manager.getStatus()).toEqual({ paired: true });
+    expect(manager.confirm(request)).toEqual({
+      ok: false,
+      error: 'already_paired',
+    });
+
+    const challenge = 'B'.repeat(43);
+    const key = createHash('sha256').update(credentialSecret).digest();
+    const expectedProof = createHmac('sha256', key)
+      .update(`qwen-extension-daemon:${challenge}`)
+      .digest('base64url');
+    expect(
+      manager.createVerificationProof(result.credentialId, challenge),
+    ).toBe(expectedProof);
+    expect(
+      manager.createVerificationProof(result.credentialId, 'short'),
+    ).toBeUndefined();
+    expect(
+      manager.createVerificationProof('unknown', challenge),
+    ).toBeUndefined();
+  });
+});
diff --git a/packages/cli/src/serve/extension-pairing.ts b/packages/cli/src/serve/extension-pairing.ts
new file mode 100644
index 00000000000..efbfbdcfbe7
--- /dev/null
+++ b/packages/cli/src/serve/extension-pairing.ts
@@ -0,0 +1,209 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import {
+  createHash,
+  createHmac,
+  randomBytes,
+  timingSafeEqual,
+} from 'node:crypto';
+
+const DEFAULT_TTL_MS = 10 * 60_000;
+const PAIRING_CODE_BYTES = 16;
+const PAIRING_NONCE_BYTES = 16;
+const CREDENTIAL_ID_BYTES = 8;
+const MAX_FAILED_ATTEMPTS = 10;
+const FAILED_ATTEMPT_WINDOW_MS = 60_000;
+const PAIRING_DOMAIN = 'qwen-extension-pairing';
+const VERIFICATION_DOMAIN = 'qwen-extension-daemon';
+const BASE64URL_256_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+
+export type ExtensionPairingStatus =
+  | { paired: true }
+  | { paired: false; expiresAt: number; pairingNonce: string };
+
+export type ExtensionPairingConfirmRequest = {
+  pairingNonce: string;
+  challenge: string;
+  clientProof: string;
+};
+
+export type ExtensionPairingConfirmResult =
+  | { ok: true; credentialId: string; proof: string }
+  | {
+      ok: false;
+      error:
+        | 'invalid_proof'
+        | 'expired_code'
+        | 'too_many_attempts'
+        | 'already_paired';
+    };
+
+type ExtensionPairingManagerOptions = {
+  now?: () => number;
+  randomBytes?: (size: number) => Buffer;
+  ttlMs?: number;
+  onCodeRotated?: (code: string, expiresAt: number) => void;
+};
+
+export type ExtensionPairingManager = {
+  getStatus(): ExtensionPairingStatus;
+  getDisplayCode(): string;
+  confirm(
+    request: ExtensionPairingConfirmRequest,
+  ): ExtensionPairingConfirmResult;
+  verifyCredential(credential: string | undefined): boolean;
+  createVerificationProof(
+    credentialId: string | undefined,
+    challenge: string | undefined,
+  ): string | undefined;
+};
+
+function hash(value: string): Buffer {
+  return createHash('sha256').update(value).digest();
+}
+
+function hmac(key: Buffer, message: string): Buffer {
+  return createHmac('sha256', key).update(message).digest();
+}
+
+function parseCredential(
+  credential: string | undefined,
+): { id: string; secret: string } | undefined {
+  if (!credential) return undefined;
+  const separator = credential.indexOf('.');
+  if (separator <= 0 || separator === credential.length - 1) return undefined;
+  return {
+    id: credential.slice(0, separator),
+    secret: credential.slice(separator + 1),
+  };
+}
+
+function verificationProof(key: Buffer, challenge: string): string {
+  return hmac(key, `${VERIFICATION_DOMAIN}:${challenge}`).toString('base64url');
+}
+
+function formatCode(bytes: Buffer): string {
+  return bytes.toString('hex').match(/.{4}/g)!.join('-');
+}
+
+function decodeProof(value: string): Buffer | undefined {
+  if (!BASE64URL_256_PATTERN.test(value)) return undefined;
+  const decoded = Buffer.from(value, 'base64url');
+  return decoded.length === 32 ? decoded : undefined;
+}
+
+export function createExtensionPairingManager(
+  options: ExtensionPairingManagerOptions = {},
+): ExtensionPairingManager {
+  const now = options.now ?? Date.now;
+  const rand = options.randomBytes ?? randomBytes;
+  const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+  let expiresAt = now() + ttlMs;
+  let code = formatCode(rand(PAIRING_CODE_BYTES));
+  let pairingNonce = rand(PAIRING_NONCE_BYTES).toString('base64url');
+  const credentialHashes = new Map<string, Buffer>();
+  let failedAttempts = 0;
+  let failedAttemptWindowStartedAt = now();
+
+  const rotateCode = (): void => {
+    code = formatCode(rand(PAIRING_CODE_BYTES));
+    pairingNonce = rand(PAIRING_NONCE_BYTES).toString('base64url');
+    expiresAt = now() + ttlMs;
+    failedAttempts = 0;
+    failedAttemptWindowStartedAt = now();
+    options.onCodeRotated?.(code, expiresAt);
+  };
+
+  return {
+    getStatus(): ExtensionPairingStatus {
+      if (credentialHashes.size > 0) return { paired: true };
+      if (now() > expiresAt) rotateCode();
+      return { paired: false, expiresAt, pairingNonce };
+    },
+
+    getDisplayCode(): string {
+      if (credentialHashes.size === 0 && now() > expiresAt) rotateCode();
+      return code;
+    },
+
+    confirm(
+      request: ExtensionPairingConfirmRequest,
+    ): ExtensionPairingConfirmResult {
+      if (credentialHashes.size > 0) {
+        return { ok: false, error: 'already_paired' };
+      }
+
+      const currentTime = now();
+      if (currentTime > expiresAt) {
+        rotateCode();
+        return { ok: false, error: 'expired_code' };
+      }
+      if (
+        currentTime - failedAttemptWindowStartedAt >=
+        FAILED_ATTEMPT_WINDOW_MS
+      ) {
+        failedAttempts = 0;
+        failedAttemptWindowStartedAt = currentTime;
+      }
+      if (failedAttempts >= MAX_FAILED_ATTEMPTS) {
+        return { ok: false, error: 'too_many_attempts' };
+      }
+
+      const submittedProof = decodeProof(request.clientProof);
+      const codeKey = hash(code);
+      const expectedProof = hmac(
+        codeKey,
+        `${PAIRING_DOMAIN}:client:${pairingNonce}:${request.challenge}`,
+      );
+      if (
+        request.pairingNonce !== pairingNonce ||
+        !BASE64URL_256_PATTERN.test(request.challenge) ||
+        !submittedProof ||
+        !timingSafeEqual(expectedProof, submittedProof)
+      ) {
+        failedAttempts += 1;
+        return { ok: false, error: 'invalid_proof' };
+      }
+
+      const credentialId = rand(CREDENTIAL_ID_BYTES).toString('base64url');
+      const credentialSecret = hmac(
+        codeKey,
+        `${PAIRING_DOMAIN}:credential:${pairingNonce}:${request.challenge}:${credentialId}`,
+      ).toString('base64url');
+      credentialHashes.set(credentialId, hash(credentialSecret));
+      const proof = hmac(
+        codeKey,
+        `${PAIRING_DOMAIN}:server:${pairingNonce}:${request.challenge}:${credentialId}`,
+      ).toString('base64url');
+      return { ok: true, credentialId, proof };
+    },
+
+    verifyCredential(credential: string | undefined): boolean {
+      const parsed = parseCredential(credential);
+      if (!parsed) return false;
+      const expected = credentialHashes.get(parsed.id);
+      if (!expected) return false;
+      const actual = hash(parsed.secret);
+      return timingSafeEqual(expected, actual);
+    },
+
+    createVerificationProof(
+      credentialId: string | undefined,
+      challenge: string | undefined,
+    ): string | undefined {
+      if (
+        !credentialId ||
+        !challenge ||
+        !BASE64URL_256_PATTERN.test(challenge)
+      ) {
+        return undefined;
+      }
+      const key = credentialHashes.get(credentialId);
+      return key ? verificationProof(key, challenge) : undefined;
+    },
+  };
+}
diff --git a/packages/cli/src/serve/run-qwen-serve.test.ts b/packages/cli/src/serve/run-qwen-serve.test.ts
index b17a90701f2..fb667fbe799 100644
--- a/packages/cli/src/serve/run-qwen-serve.test.ts
+++ b/packages/cli/src/serve/run-qwen-serve.test.ts
@@ -7,6 +7,7 @@
 import * as os from 'node:os';
 import * as path from 'node:path';
 import * as fs from 'node:fs';
+import { createHash, createHmac } from 'node:crypto';
 import { createServer } from 'node:http';
 import * as https from 'node:https';
 import type { AddressInfo } from 'node:net';
@@ -17,6 +18,7 @@ import {
   extractContextFilename,
   formatChannelWorkerDaemonUrl,
   InvalidPolicyConfigError,
+  OFFICIAL_QWEN_CHROME_EXTENSION_ORIGIN,
   createDisabledChannelWorkerSupervisor,
   resolveRuntimeStartupTimeoutMs,
   runQwenServe,
@@ -24,6 +26,10 @@ import {
   validatePolicyConfig,
   waitForRuntimeStartingForShutdown,
 } from './run-qwen-serve.js';
+import {
+  createExtensionPairingManager,
+  type ExtensionPairingManager,
+} from './extension-pairing.js';
 import { isBrowserAutomationMcpAvailable } from './cdp-mcp-command.js';
 import { RUNTIME_STARTUP_CANCELLED_MESSAGE } from './runtime-startup-errors.js';
 import { isLoopbackBind } from './loopback-binds.js';
@@ -54,6 +60,71 @@ import {
   type WorkspaceRegistrationStore,
 } from './workspace-registration-store.js';
 
+const PAIRING_CHALLENGE = 'A'.repeat(43);
+
+function pairingExchangeProof(
+  code: string,
+  direction: 'client' | 'server' | 'credential',
+  pairingNonce: string,
+  challenge: string,
+  credentialId?: string,
+): string {
+  const suffix = credentialId ? `:${credentialId}` : '';
+  return createHmac('sha256', createHash('sha256').update(code).digest())
+    .update(
+      `qwen-extension-pairing:${direction}:${pairingNonce}:${challenge}${suffix}`,
+    )
+    .digest('base64url');
+}
+
+function createPairingExchange(manager: ExtensionPairingManager) {
+  const status = manager.getStatus();
+  if (status.paired) throw new Error('expected unpaired pairing manager');
+  const code = manager.getDisplayCode();
+  return {
+    code,
+    pairingNonce: status.pairingNonce,
+    challenge: PAIRING_CHALLENGE,
+    request: {
+      pairingNonce: status.pairingNonce,
+      challenge: PAIRING_CHALLENGE,
+      clientProof: pairingExchangeProof(
+        code,
+        'client',
+        status.pairingNonce,
+        PAIRING_CHALLENGE,
+      ),
+    },
+  };
+}
+
+function finishPairing(
+  exchange: ReturnType<typeof createPairingExchange>,
+  response: { credentialId?: string; proof?: string },
+): string {
+  if (!response.credentialId || !response.proof) {
+    throw new Error('pairing response is incomplete');
+  }
+  const expectedProof = pairingExchangeProof(
+    exchange.code,
+    'server',
+    exchange.pairingNonce,
+    exchange.challenge,
+    response.credentialId,
+  );
+  if (response.proof !== expectedProof) {
+    throw new Error('daemon pairing proof is invalid');
+  }
+  const secret = pairingExchangeProof(
+    exchange.code,
+    'credential',
+    exchange.pairingNonce,
+    exchange.challenge,
+    response.credentialId,
+  );
+  return `${response.credentialId}.${secret}`;
+}
+
 const BASE_BRIDGE_SNAPSHOT: BridgeDaemonStatusSnapshot = {
   limits: {
     maxSessions: 20,
@@ -1604,7 +1675,7 @@ describe('runQwenServe runtime startup failures', () => {
 
   async function readBrowserMcpFeatureFlagsForEnv(
     raw: string | undefined,
-    origin = 'chrome-extension://qwen-test-extension',
+    origin: string | null = 'chrome-extension://qwen-test-extension',
     cdpMcpCommand?: string,
   ) {
     tmpDir = fs.realpathSync(
@@ -1639,7 +1710,7 @@ describe('runQwenServe runtime startup failures', () => {
         workspace: tmpDir,
         maxSessions: 1,
         serveWebShell: false,
-        allowOrigins: [origin],
+        allowOrigins: origin ? [origin] : undefined,
       },
       { resolveOnListen: true },
     );
@@ -1647,7 +1718,9 @@ describe('runQwenServe runtime startup failures', () => {
     try {
       await expect(handle.runtimeReady).rejects.toThrow('runtime boom');
       const capabilitiesRes = await fetch(`${handle.url}/capabilities`, {
-        headers: { Origin: origin },
+        headers: {
+          Origin: origin ?? OFFICIAL_QWEN_CHROME_EXTENSION_ORIGIN,
+        },
       });
       expect(capabilitiesRes.status).toBe(200);
       return ((await capabilitiesRes.json()) as { features: string[] })
@@ -1743,14 +1816,175 @@ describe('runQwenServe runtime startup failures', () => {
     },
   );
 
-  it('auto-enables only the CDP tunnel for Chrome extension origins when the env flag is unset', async () => {
+  it('enables reverse MCP by default and the CDP tunnel for explicit Chrome extension origins', async () => {
     const features = await readBrowserMcpFeatureFlagsForEnv(undefined);
 
     expect(features).toContain('cdp_tunnel_over_ws');
-    expect(features).not.toContain('client_mcp_over_ws');
+    expect(features).toContain('client_mcp_over_ws');
     expect(features).not.toContain('browser_automation_mcp');
   });
 
+  it('allows the official Chrome extension with no serve flags', async () => {
+    const features = await readBrowserMcpFeatureFlagsForEnv(undefined, null);
+
+    expect(features).toContain('allow_origin');
+    expect(features).toContain('client_mcp_over_ws');
+    expect(features).not.toContain('cdp_tunnel_over_ws');
+  });
+
+  it('uses independent pairing auth without leaking the terminal code or weakening daemon auth', async () => {
+    tmpDir = fs.realpathSync(
+      fs.mkdtempSync(path.join(os.tmpdir(), 'qws-extension-pairing-')),
+    );
+    vi.spyOn(acpBridge, 'createAcpSessionBridge').mockImplementation(() => {
+      throw new Error('runtime boom');
+    });
+    const extensionPairingManager = createExtensionPairingManager({
+      now: () => 1_000,
+      randomBytes: (size) => Buffer.alloc(size, 4),
+    });
+    const pairingExchange = createPairingExchange(extensionPairingManager);
+
+    const handle = await runQwenServe(
+      {
+        port: 0,
+        hostname: '127.0.0.1',
+        mode: 'http-bridge',
+        workspace: tmpDir,
+        maxSessions: 1,
+        serveWebShell: false,
+        token: 'daemon-token',
+        extensionPairingManager,
+      },
+      { resolveOnListen: true },
+    );
+
+    try {
+      await expect(handle.runtimeReady).rejects.toThrow('runtime boom');
+      const statusRes = await fetch(`${handle.url}/extension/pairing`);
+      expect(statusRes.status).toBe(200);
+      const statusBody = await statusRes.json();
+      expect(statusBody).toMatchObject({
+        paired: false,
+        expiresAt: 601_000,
+        pairingNonce: pairingExchange.pairingNonce,
+      });
+      expect(statusBody).not.toHaveProperty('code');
+
+      const protectedRes = await fetch(`${handle.url}/capabilities`);
+      expect(protectedRes.status).toBe(401);
+
+      const wrongCodeRes = await fetch(
+        `${handle.url}/extension/pairing/confirm`,
+        {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+          },
+          body: JSON.stringify({
+            ...pairingExchange.request,
+            clientProof: 'A'.repeat(43),
+          }),
+        },
+      );
+      expect(wrongCodeRes.status).toBe(401);
+
+      const confirmRes = await fetch(
+        `${handle.url}/extension/pairing/confirm`,
+        {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+          },
+          body: JSON.stringify(pairingExchange.request),
+        },
+      );
+      expect(confirmRes.status).toBe(200);
+      const confirmBody = (await confirmRes.json()) as {
+        credentialId?: string;
+        proof?: string;
+      };
+      const credential = finishPairing(pairingExchange, confirmBody);
+      expect(JSON.stringify(confirmBody)).not.toContain(
+        credential.split('.')[1],
+      );
+
+      const credentialId = confirmBody.credentialId;
+      const challenge = 'A'.repeat(43);
+      const verifyRes = await fetch(`${handle.url}/extension/pairing/verify`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ credentialId, challenge }),
+      });
+      expect(verifyRes.status).toBe(200);
+      const verifyBody = (await verifyRes.json()) as {
+        paired?: boolean;
+        proof?: string;
+      };
+      expect(verifyBody.paired).toBe(true);
+      expect(verifyBody.proof).toBe(
+        extensionPairingManager.createVerificationProof(
+          credentialId,
+          challenge,
+        ),
+      );
+      expect(JSON.stringify(verifyBody)).not.toContain(credential);
+    } finally {
+      await handle.close();
+    }
+  });
+
+  it('keeps extension pairing routes mounted after the runtime app is ready', async () => {
+    tmpDir = fs.realpathSync(
+      fs.mkdtempSync(path.join(os.tmpdir(), 'qws-extension-pairing-ready-')),
+    );
+    const extensionPairingManager = createExtensionPairingManager({
+      now: () => 1_000,
+      randomBytes: (size) => Buffer.alloc(size, 5),
+    });
+    const pairingExchange = createPairingExchange(extensionPairingManager);
+
+    const handle = await runQwenServe(
+      {
+        port: 0,
+        hostname: '127.0.0.1',
+        mode: 'http-bridge',
+        workspace: tmpDir,
+        maxSessions: 1,
+        serveWebShell: false,
+        extensionPairingManager,
+      },
+      {
+        bridge: makeRuntimeBridge(),
+        daemonLogBaseDir: path.join(tmpDir, 'debug'),
+      },
+    );
+
+    try {
+      await handle.runtimeReady;
+      const confirmRes = await fetch(
+        `${handle.url}/extension/pairing/confirm`,
+        {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify(pairingExchange.request),
+        },
+      );
+      expect(confirmRes.status).toBe(200);
+      const confirmBody = (await confirmRes.json()) as {
+        credentialId?: string;
+        proof?: string;
+      };
+      expect(finishPairing(pairingExchange, confirmBody)).toMatch(
+        /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/,
+      );
+    } finally {
+      await handle.close();
+    }
+  });
+
   it('advertises browser automation MCP when the external CDP adapter command is set', async () => {
     const features = await readBrowserMcpFeatureFlagsForEnv(
       undefined,
@@ -1760,12 +1994,23 @@ describe('runQwenServe runtime startup failures', () => {
 
     expect(features).toContain('cdp_tunnel_over_ws');
     expect(features).toContain('browser_automation_mcp');
-    expect(features).not.toContain('client_mcp_over_ws');
+    expect(features).toContain('client_mcp_over_ws');
   });
 
-  it('does not advertise browser automation MCP without an active CDP tunnel', async () => {
+  it('enables the legacy CDP tunnel when its adapter command is explicitly configured', async () => {
     const features = await readBrowserMcpFeatureFlagsForEnv(
       undefined,
+      null,
+      '/opt/qwen-cdp-mcp-adapter',
+    );
+
+    expect(features).toContain('cdp_tunnel_over_ws');
+    expect(features).toContain('browser_automation_mcp');
+  });
+
+  it('does not advertise browser automation MCP without an active CDP tunnel', async () => {
+    const features = await readBrowserMcpFeatureFlagsForEnv(
+      '0',
       'https://example.com',
       '/opt/qwen-cdp-mcp-adapter',
     );
@@ -2731,13 +2976,13 @@ describe('runQwenServe runtime startup failures', () => {
     }
   });
 
-  it('keeps browser MCP features disabled for non-extension origins when the env flag is unset', async () => {
+  it('keeps the legacy CDP tunnel disabled for non-extension origins while reverse MCP stays available', async () => {
     const features = await readBrowserMcpFeatureFlagsForEnv(
       undefined,
       'https://example.com',
     );
 
-    expect(features).not.toContain('client_mcp_over_ws');
+    expect(features).toContain('client_mcp_over_ws');
     expect(features).not.toContain('cdp_tunnel_over_ws');
   });
 
@@ -4286,7 +4531,7 @@ describe('runQwenServe runtime startup failures', () => {
         policy: { permission: 'first-responder' },
         limits: { maxPendingPromptsPerSession: 5 },
       });
-      expect(capabilitiesBody.features).not.toContain('client_mcp_over_ws');
+      expect(capabilitiesBody.features).toContain('client_mcp_over_ws');
       expect(capabilitiesBody.features).not.toContain('cdp_tunnel_over_ws');
 
       const port = new URL(handle.url).port;
@@ -4335,7 +4580,7 @@ describe('runQwenServe runtime startup failures', () => {
       expect(sameOriginBody).toMatchObject({
         v: 1,
         detail: 'full',
-        security: { allowOriginMode: 'none' },
+        security: { allowOriginMode: 'specific' },
         limits: {
           maxSessions: 1,
           maxPendingPromptsPerSession: 5,
@@ -7406,8 +7651,8 @@ describe('runQwenServe startup observability', () => {
       expect(stderrWrites.join('')).toMatch(
         /qwen serve: startup timing: processToListenMs=\d+ runQwenServeToListenMs=\d+/,
       );
-      expect(stderrWrites.join('')).not.toContain(
-        'qwen serve: client-hosted MCP tools are accepted over the WebSocket without auth.',
+      expect(stderrWrites.join('')).toContain(
+        'qwen serve: client-hosted MCP tools require Chrome extension pairing.',
       );
 
       expect(await readStartup(handle)).toMatchObject({
diff --git a/packages/cli/src/serve/run-qwen-serve.ts b/packages/cli/src/serve/run-qwen-serve.ts
index e06b454bf0e..05fae2c7c73 100644
--- a/packages/cli/src/serve/run-qwen-serve.ts
+++ b/packages/cli/src/serve/run-qwen-serve.ts
@@ -138,15 +138,34 @@ import type {
   ServiceInfoWorker,
 } from '../commands/channel/pidfile.js';
 import { sanitizeLogText } from '@qwen-code/channel-base';
-import { isBrowserAutomationMcpAvailable } from './cdp-mcp-command.js';
+import {
+  isBrowserAutomationMcpAvailable,
+  resolveCdpMcpCommand,
+} from './cdp-mcp-command.js';
+import {
+  createExtensionPairingManager,
+  type ExtensionPairingManager,
+} from './extension-pairing.js';
+import {
+  EXTENSION_PAIRING_CONFIRM_PATH,
+  EXTENSION_PAIRING_PATH,
+  EXTENSION_PAIRING_VERIFY_PATH,
+  installExtensionPairingRoutes,
+} from './extension-pairing-routes.js';
 
-// Reverse MCP channel; enabled only by explicit option or env opt-in.
+// Reverse MCP channel; enabled by default for extension-hosted tools. Operators
+// can explicitly disable it with QWEN_SERVE_CLIENT_MCP_OVER_WS=0.
 const QWEN_SERVE_CLIENT_MCP_OVER_WS_ENV = 'QWEN_SERVE_CLIENT_MCP_OVER_WS';
 // CDP tunnel; default-on for Chrome-extension origins or explicit env opt-in.
 const QWEN_SERVE_CDP_TUNNEL_OVER_WS_ENV = 'QWEN_SERVE_CDP_TUNNEL_OVER_WS';
 const QWEN_SERVE_PROMPT_DEADLINE_MS_ENV = 'QWEN_SERVE_PROMPT_DEADLINE_MS';
 const QWEN_SERVE_WRITER_IDLE_TIMEOUT_MS_ENV =
   'QWEN_SERVE_WRITER_IDLE_TIMEOUT_MS';
+// Derived from packages/chrome-extension/public/manifest.json's stable key.
+// Pinning one extension origin preserves the browser Origin/CSWSH boundary
+// without requiring every user to pass --allow-origin.
+export const OFFICIAL_QWEN_CHROME_EXTENSION_ORIGIN =
+  'chrome-extension://idkijaaipeeinemigojbjkmfmabokbdk';
 const SHUTDOWN_FORCE_CLOSE_MS = 5_000;
 
 function daemonPipeDirection(
@@ -198,6 +217,7 @@ const WORKSPACE_SETTING_SCOPE =
 type RunQwenServeOptions = Omit<ServeOptions, 'token' | 'workspace'> & {
   token?: string;
   workspace?: string | string[];
+  extensionPairingManager?: ExtensionPairingManager;
 };
 type WorkspaceSettingsWrite =
   import('./workspace-service/types.js').WorkspaceSettingsWrite;
@@ -1157,6 +1177,9 @@ const BOOTSTRAP_SERVE_PATHS = new Set([
   BOOTSTRAP_HEALTH_PATH,
   BOOTSTRAP_CAPABILITIES_PATH,
   BOOTSTRAP_DAEMON_STATUS_PATH,
+  EXTENSION_PAIRING_PATH,
+  EXTENSION_PAIRING_CONFIRM_PATH,
+  EXTENSION_PAIRING_VERIFY_PATH,
 ]);
 
 function createBootstrapServeApp(input: {
@@ -1175,6 +1198,7 @@ function createBootstrapServeApp(input: {
     ChannelWorkerSupervisor['snapshot']
   >;
   getChannelWorkerSnapshots: () => ChannelWorkerGroupSnapshot[];
+  extensionPairingManager: ExtensionPairingManager;
   onHealthServed?: () => void;
 }): Application {
   const {
@@ -1191,6 +1215,7 @@ function createBootstrapServeApp(input: {
     getRuntimeError,
     getChannelWorkerSnapshot,
     getChannelWorkerSnapshots,
+    extensionPairingManager,
     onHealthServed,
   } = input;
   const app = express();
@@ -1224,6 +1249,7 @@ function createBootstrapServeApp(input: {
     app.get(BOOTSTRAP_HEALTH_PATH, healthHandler);
   }
 
+  installExtensionPairingRoutes(app, extensionPairingManager);
   app.use(bearerAuth(opts.token));
 
   if (!exposeHealthPreAuth) {
@@ -1673,26 +1699,51 @@ export async function runQwenServe(
       process.env[QWEN_SERVE_WRITER_IDLE_TIMEOUT_MS_ENV],
     );
   const clientMcpOverWsEnv = process.env[QWEN_SERVE_CLIENT_MCP_OVER_WS_ENV];
+  const clientMcpExplicitlyEnabled =
+    optsIn.clientMcpOverWs === true ||
+    (clientMcpOverWsEnv !== undefined && !envFlagDisabled(clientMcpOverWsEnv));
   const cdpTunnelOverWsEnv = process.env[QWEN_SERVE_CDP_TUNNEL_OVER_WS_ENV];
+  const cdpMcpCommandConfigured =
+    resolveCdpMcpCommand(process.env) !== undefined;
   const chromeExtensionOriginAllowed = hasChromeExtensionOrigin(
     optsIn.allowOrigins,
   );
+  const allowOrigins = [
+    OFFICIAL_QWEN_CHROME_EXTENSION_ORIGIN,
+    ...(optsIn.allowOrigins ?? []),
+  ].filter((origin, index, origins) => origins.indexOf(origin) === index);
   const rawWorkspaces = resolveWorkspaceInputs(optsIn.workspace);
   const rawWorkspace = rawWorkspaces[0]!;
+  const extensionPairingManager =
+    optsIn.extensionPairingManager ??
+    createExtensionPairingManager({
+      onCodeRotated: (code) => {
+        writeStderrLine(
+          `qwen serve: Chrome extension pairing code rotated → ` +
+            `${code} (expires in 10 minutes)`,
+        );
+      },
+    });
   const opts: ServeOptions = {
     ...optsIn,
     token,
     promptDeadlineMs,
     writerIdleTimeoutMs,
     workspace: rawWorkspace,
+    allowOrigins,
     clientMcpOverWs:
-      optsIn.clientMcpOverWs ??
-      (!envFlagDisabled(clientMcpOverWsEnv) &&
-        clientMcpOverWsEnv !== undefined),
+      optsIn.clientMcpOverWs ?? !envFlagDisabled(clientMcpOverWsEnv),
+    allowUnpairedClientMcp:
+      optsIn.allowUnpairedClientMcp ?? clientMcpExplicitlyEnabled,
     cdpTunnelOverWs:
       optsIn.cdpTunnelOverWs ??
       (!envFlagDisabled(cdpTunnelOverWsEnv) &&
-        (cdpTunnelOverWsEnv !== undefined || chromeExtensionOriginAllowed)),
+        (cdpTunnelOverWsEnv !== undefined ||
+          chromeExtensionOriginAllowed ||
+          cdpMcpCommandConfigured)),
+    verifyExtensionPairingCredential: (credential) =>
+      extensionPairingManager.verifyCredential(credential),
+    extensionPairingManager,
   };
   let channelRuntime = opts.channelSelection
     ? await loadChannelWorkerRuntime()
@@ -2167,6 +2218,10 @@ export async function runQwenServe(
   writeStderrLine(
     `qwen serve: daemon log → ${daemonLog.getLogPath() || '(disabled)'}`,
   );
+  writeStderrLine(
+    `qwen serve: Chrome extension pairing code → ` +
+      `${extensionPairingManager.getDisplayCode()} (expires in 10 minutes)`,
+  );
 
   // The MCP client guardrails enforce in the ACP child process (where
   // `McpClientManager` lives), not the daemon. Forward the budget
@@ -4131,6 +4186,7 @@ export async function runQwenServe(
     getRuntimeError: () => runtimeStartupError,
     getChannelWorkerSnapshot,
     getChannelWorkerSnapshots,
+    extensionPairingManager,
     onHealthServed: deferRuntimeUntilFirstHealth
       ? () => startRuntimeAfterHealth?.()
       : undefined,
@@ -4380,10 +4436,16 @@ export async function runQwenServe(
           `qwen serve: bearer auth disabled (loopback default). Set ${QWEN_SERVER_TOKEN_ENV} to enable.`,
         );
         if (opts.clientMcpOverWs === true) {
-          writeStderrLine(
-            `qwen serve: client-hosted MCP tools are accepted over the WebSocket without auth. ` +
-              `Set ${QWEN_SERVE_CLIENT_MCP_OVER_WS_ENV}=0 to disable.`,
-          );
+          if (opts.allowUnpairedClientMcp === true) {
+            writeStderrLine(
+              'qwen serve: unpaired client-hosted MCP tools are explicitly enabled.',
+            );
+          } else {
+            writeStderrLine(
+              `qwen serve: client-hosted MCP tools require Chrome extension pairing. ` +
+                `Set ${QWEN_SERVE_CLIENT_MCP_OVER_WS_ENV}=0 to disable.`,
+            );
+          }
         }
       } else if (opts.requireAuth) {
         // The boot check above guarantees `token` is set whenever
diff --git a/packages/cli/src/serve/server.ts b/packages/cli/src/serve/server.ts
index b266a02390e..aeff2d8ea3f 100644
--- a/packages/cli/src/serve/server.ts
+++ b/packages/cli/src/serve/server.ts
@@ -63,6 +63,7 @@ import {
   mountWebShellAssets,
   mountWebShellSpaFallback,
 } from './web-shell-static.js';
+import { installExtensionPairingRoutes } from './extension-pairing-routes.js';
 import {
   mountWorkspaceMemoryRoutes,
   mountWorkspaceQualifiedMemoryRoutes,
@@ -986,6 +987,9 @@ export function createServeApp(
     });
   }
 
+  if (opts.extensionPairingManager) {
+    installExtensionPairingRoutes(app, opts.extensionPairingManager);
+  }
   app.use(bearerAuth(opts.token));
 
   // Rate limiter: after auth (only count authenticated requests), except
@@ -1626,6 +1630,7 @@ export function createServeApp(
     workspaceRememberLane,
     checkRate: rateLimiter?.checkRate,
     clientMcpOverWs: opts.clientMcpOverWs === true,
+    allowUnpairedClientMcp: opts.allowUnpairedClientMcp === true,
     // Reverse tool channel (issue #5626, Phase 2). Per-connection provider:
     // on `mcp_register` it records the WS registrar's sender in the shared
     // registry and adds an SDK-type runtime MCP server in the ACP child
@@ -1644,6 +1649,7 @@ export function createServeApp(
     // Plan C CDP tunnel (issue #5626): the `/cdp` branch + `cdp_*` routing
     // activate only when the flag is on and a registry is supplied.
     cdpTunnelOverWs: opts.cdpTunnelOverWs === true,
+    verifyExtensionPairingCredential: opts.verifyExtensionPairingCredential,
     ...(cdpTunnelRegistry ? { cdpTunnelRegistry } : {}),
     // Browser captures audio and streams raw PCM here; the daemon transcribes
     // server-side via the reused CLI voice pipeline. Shares the ACP upgrade
diff --git a/packages/cli/src/serve/types.ts b/packages/cli/src/serve/types.ts
index 0102e365cb7..5b55316856f 100644
--- a/packages/cli/src/serve/types.ts
+++ b/packages/cli/src/serve/types.ts
@@ -14,6 +14,7 @@ import {
 // are compiler-flagged here.
 import type { PermissionPolicy } from '@qwen-code/acp-bridge';
 import type { AuthType, InputModalities } from '@qwen-code/qwen-code-core';
+import type { ExtensionPairingManager } from './extension-pairing.js';
 
 /**
  * Stage 1 daemon mode shape.
@@ -241,10 +242,12 @@ export interface ServeOptions {
    * Phase 2 "reverse tool channel"). When enabled, a connected WS client may
    * send `mcp_register` / `mcp_message` / `mcp_unregister` frames so the
    * daemon's agent can call tools that execute in the client (e.g. the Chrome
-   * extension's browser tools). `runQwenServe` only enables this when a caller
-   * or environment variable opts in.
+   * extension's browser tools). Enabled by default for paired extension
+   * clients; ordinary unpaired clients require an explicit opt-in.
    */
   clientMcpOverWs?: boolean;
+  /** Allow ordinary ACP clients to register reverse MCP without pairing. */
+  allowUnpairedClientMcp?: boolean;
   /**
    * Tunnel raw CDP to a real browser tab over the reverse `/acp` WS
    * (Plan C "CDP tunnel", issue #5626). When enabled, a loopback CDP client can
@@ -253,6 +256,15 @@ export interface ServeOptions {
    * Chrome extension origins or explicit env opt-in; callers may pass `false`.
    */
   cdpTunnelOverWs?: boolean;
+  /**
+   * Verify the Chrome extension's daemon pairing credential before accepting
+   * extension-hosted browser tools over `/acp`.
+   */
+  verifyExtensionPairingCredential?: (
+    credential: string | undefined,
+  ) => boolean;
+  /** Process-local manager for Chrome extension one-time pairing routes. */
+  extensionPairingManager?: ExtensionPairingManager;
   /** Forward the experimental LSP opt-in to spawned ACP children. */
   experimentalLsp?: boolean;
   /**
diff --git a/scripts/tests/chrome-extension-package.test.js b/scripts/tests/chrome-extension-package.test.js
index b289078cb24..5892f8f5c72 100644
--- a/scripts/tests/chrome-extension-package.test.js
+++ b/scripts/tests/chrome-extension-package.test.js
@@ -4,10 +4,14 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { readFileSync } from 'node:fs';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { describe, expect, it } from 'vitest';
+import { scanZip } from '../../packages/chrome-extension/scripts/artifact-scan.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const root = path.resolve(__dirname, '../..');
@@ -24,5 +28,65 @@ describe('chrome extension package scripts', () => {
     expect(packageJson.scripts.build).not.toMatch(
       /(?:^|\s&&\s)[A-Za-z_][A-Za-z0-9_]*=/,
     );
+    expect(packageJson.scripts.package).toContain('package-extension.js');
+    expect(packageJson.scripts.package).not.toContain('zip -r');
+    expect(packageJson.devDependencies.archiver).toBeDefined();
+
+    const packageScript = readFileSync(
+      path.join(root, 'packages/chrome-extension/scripts/package-extension.js'),
+      'utf8',
+    );
+    expect(packageScript).toContain("archiver('zip'");
+    expect(packageScript).not.toContain("execFile('zip'");
+
+    const rootPackageJson = JSON.parse(
+      readFileSync(path.join(root, 'package.json'), 'utf8'),
+    );
+    expect(rootPackageJson.scripts['test:release']).toContain(
+      'npm -w packages/chrome-extension run package',
+    );
+  });
+
+  it('rejects forbidden stale entries in the final extension archive', async () => {
+    const tempDir = await mkdtemp(path.join(os.tmpdir(), 'qwen-ext-scan-'));
+    const archive = path.join(tempDir, 'extension.zip');
+    try {
+      writeFileSync(
+        archive,
+        'central-directory: node_modules/chrome-devtools-mcp/index.js',
+      );
+      await expect(scanZip(archive)).resolves.toEqual([
+        `${archive}: chrome-devtools-mcp`,
+      ]);
+    } finally {
+      await rm(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it('keeps the pinned official id aligned with the manifest key', () => {
+    const manifest = JSON.parse(
+      readFileSync(
+        path.join(root, 'packages/chrome-extension/public/manifest.json'),
+        'utf8',
+      ),
+    );
+    const hex = createHash('sha256')
+      .update(Buffer.from(manifest.key, 'base64'))
+      .digest('hex')
+      .slice(0, 32);
+    const extensionId = [...hex]
+      .map((digit) => String.fromCharCode(97 + Number.parseInt(digit, 16)))
+      .join('');
+
+    const daemonSource = readFileSync(
+      path.join(root, 'packages/cli/src/serve/run-qwen-serve.ts'),
+      'utf8',
+    );
+    const sidePanelSource = readFileSync(
+      path.join(root, 'packages/chrome-extension/public/sidepanel.js'),
+      'utf8',
+    );
+    expect(daemonSource).toContain(`chrome-extension://${extensionId}`);
+    expect(sidePanelSource).toContain(`'${extensionId}'`);
   });
 });

From e97cdc1f097c05922b0cb503892812e01f44d0fc Mon Sep 17 00:00:00 2001
From: yiliang114 <effortyiliang@gmail.com>
Date: Thu, 16 Jul 2026 14:53:08 +0800
Subject: [PATCH 02/13] fix(chrome): harden native browser tools

---
 packages/acp-bridge/src/bridge.test.ts        |  28 ++++
 packages/acp-bridge/src/bridge.ts             |  20 +++
 packages/acp-bridge/src/bridgeClient.test.ts  |  45 +++++-
 packages/acp-bridge/src/bridgeClient.ts       |  17 ++
 packages/acp-bridge/src/bridgeOptions.ts      |   6 +
 packages/chrome-extension/public/sidepanel.js |  37 ++---
 .../scripts/sync-extension.js                 |   7 +
 .../browser-mcp/browser-tools.test.ts         |  79 ++++++++-
 .../background/browser-mcp/browser-tools.ts   | 151 +++++++++++++-----
 .../browser-mcp/debugger-session.test.ts      |  34 ++--
 .../browser-mcp/debugger-session.ts           |   8 +-
 .../src/background/service-worker.test.ts     |  29 ++++
 .../client-mcp-sender-registry.test.ts        |  17 ++
 .../acp-http/client-mcp-sender-registry.ts    |  28 +++-
 packages/cli/src/serve/routes/session.ts      |  45 +++++-
 packages/cli/src/serve/run-qwen-serve.ts      |  10 ++
 packages/cli/src/serve/server.test.ts         |  64 ++++++++
 packages/cli/src/serve/server.ts              |   5 +
 .../sdk-typescript/src/daemon/DaemonClient.ts |   7 +
 .../test/unit/DaemonClient.test.ts            |  19 +++
 .../components/WorkspaceSessionProvider.tsx   |   5 +
 .../web-shell/client/config/daemon.test.ts    |   9 +-
 packages/web-shell/client/config/daemon.ts    |  16 +-
 packages/web-shell/client/main.tsx            |  16 +-
 .../tests/chrome-extension-package.test.js    |  30 ++++
 25 files changed, 623 insertions(+), 109 deletions(-)

diff --git a/packages/acp-bridge/src/bridge.test.ts b/packages/acp-bridge/src/bridge.test.ts
index 6ac36ed3a6f..f5de9a8070a 100644
--- a/packages/acp-bridge/src/bridge.test.ts
+++ b/packages/acp-bridge/src/bridge.test.ts
@@ -89,6 +89,34 @@ function deferred<T>(): {
 }
 
 describe('createAcpSessionBridge', () => {
+  it('restores client-hosted MCP servers when an ACP child starts', async () => {
+    const handle = makeChannel({
+      extMethodImpl: async () => ({ toolCount: 20 }),
+    });
+    const bridge = makeBridge({
+      channelFactory: vi.fn().mockResolvedValue(handle.channel),
+      clientMcpRuntimeRegistrations: () => [
+        {
+          name: 'qwen-browser-tools',
+          config: { type: 'sdk', __clientMcpOverWs: true },
+          originatorClientId: 'extension-client',
+        },
+      ],
+    });
+
+    await bridge.preheat();
+
+    expect(handle.agent.extMethodCalls).toContainEqual({
+      method: SERVE_CONTROL_EXT_METHODS.workspaceMcpRuntimeAdd,
+      params: {
+        name: 'qwen-browser-tools',
+        config: { type: 'sdk', __clientMcpOverWs: true },
+        originatorClientId: 'extension-client',
+      },
+    });
+    await bridge.shutdown();
+  });
+
   it('starts a workspace channel for MCP management without a session', async () => {
     const handle = makeChannel({
       extMethodImpl: async (method, params) => {
diff --git a/packages/acp-bridge/src/bridge.ts b/packages/acp-bridge/src/bridge.ts
index fee31ddef50..93e2ebe1485 100644
--- a/packages/acp-bridge/src/bridge.ts
+++ b/packages/acp-bridge/src/bridge.ts
@@ -2097,6 +2097,26 @@ export function createAcpSessionBridge(opts: BridgeOptions): AcpSessionBridge {
               'initialize',
             ),
         );
+        for (const registration of opts.clientMcpRuntimeRegistrations?.() ??
+          []) {
+          const response = await withTimeout(
+            connection.extMethod(
+              SERVE_CONTROL_EXT_METHODS.workspaceMcpRuntimeAdd,
+              registration,
+            ),
+            MCP_RESTART_SERVER_DEADLINE_MS,
+            SERVE_CONTROL_EXT_METHODS.workspaceMcpRuntimeAdd,
+          );
+          if (
+            response !== null &&
+            typeof response === 'object' &&
+            (response as { skipped?: boolean }).skipped === true
+          ) {
+            throw new Error(
+              `Failed to restore client MCP server '${registration.name}'`,
+            );
+          }
+        }
       } catch (err) {
         // Mark the half-initialized channel as dying/unavailable, then
         // kill it. Coalesced callers (`inFlightChannelSpawn` branch in
diff --git a/packages/acp-bridge/src/bridgeClient.test.ts b/packages/acp-bridge/src/bridgeClient.test.ts
index 243b2dce89b..69f640508c1 100644
--- a/packages/acp-bridge/src/bridgeClient.test.ts
+++ b/packages/acp-bridge/src/bridgeClient.test.ts
@@ -2429,6 +2429,7 @@ describe('BridgeClient — reverse tool channel (qwen/control/client_mcp/message
    */
   function makeClientWithRegistrar(
     registrar: ClientMcpRegistrar,
+    sourceType?: string,
   ): BridgeClient {
     const sender: ClientMcpMessageSender = (serverName: string) =>
       registrar.hasServer(serverName)
@@ -2436,7 +2437,10 @@ describe('BridgeClient — reverse tool channel (qwen/control/client_mcp/message
             registrar.sendSdkMcpMessage(serverName, payload as JSONRPCMessage)
         : undefined;
     return new BridgeClient(
-      (() => undefined) as never, // resolveEntry: client_mcp/message is sessionless
+      ((sessionId: string | undefined) =>
+        sessionId === 'extension-session'
+          ? ({ sourceType } as never)
+          : undefined) as never,
       (() => undefined) as never, // resolvePendingRestoreEvents
       { request: thrower } as never,
       0,
@@ -2507,6 +2511,45 @@ describe('BridgeClient — reverse tool channel (qwen/control/client_mcp/message
     expect((result as { payload?: unknown }).payload).toBeDefined();
   });
 
+  it('only routes browser tool calls for paired extension sessions', async () => {
+    const outbound: ClientMcpFrame[] = [];
+    const registrar = new ClientMcpRegistrar({
+      sendFrame: (frame) => {
+        outbound.push(frame);
+      },
+    });
+    registrar.registerServer('qwen-browser-tools');
+
+    const denied = makeClientWithRegistrar(registrar)
+      .extMethod('qwen/control/client_mcp/message', {
+        server: 'qwen-browser-tools',
+        sessionId: 'extension-session',
+        payload: { jsonrpc: '2.0', id: 1, method: 'tools/call' },
+      })
+      .catch((error: unknown) => error);
+    await expect(denied).resolves.toMatchObject({ code: -32602 });
+    expect(outbound).toHaveLength(0);
+
+    const allowedClient = makeClientWithRegistrar(
+      registrar,
+      'chrome_extension',
+    );
+    const allowed = allowedClient.extMethod('qwen/control/client_mcp/message', {
+      server: 'qwen-browser-tools',
+      sessionId: 'extension-session',
+      payload: { jsonrpc: '2.0', id: 2, method: 'tools/call' },
+    });
+    await vi.waitFor(() => expect(outbound).toHaveLength(1));
+    registrar.resolveMessage(outbound[0]!.id, {
+      jsonrpc: '2.0',
+      id: 2,
+      result: { content: [] },
+    });
+    await expect(allowed).resolves.toMatchObject({
+      payload: { result: { content: [] } },
+    });
+  });
+
   it('rejects (invalidParams) when the named server is not connected', async () => {
     const registrar = new ClientMcpRegistrar({ sendFrame: () => {} });
     // No registerServer call — the lookup returns undefined.
diff --git a/packages/acp-bridge/src/bridgeClient.ts b/packages/acp-bridge/src/bridgeClient.ts
index c567daad191..89858aa5221 100644
--- a/packages/acp-bridge/src/bridgeClient.ts
+++ b/packages/acp-bridge/src/bridgeClient.ts
@@ -449,6 +449,7 @@ function sliceLineRange(
  */
 export interface BridgeClientSessionEntry {
   sessionId: string;
+  sourceType?: string;
   events: EventBus;
   artifacts: SessionArtifactStore;
   recordingDegraded: boolean;
@@ -1076,6 +1077,22 @@ export class BridgeClient implements Client {
         '`payload` must be a JSON-RPC message object',
       );
     }
+    if (
+      server === 'qwen-browser-tools' &&
+      (payload as Record<string, unknown>)['method'] === 'tools/call'
+    ) {
+      const sessionId = params['sessionId'];
+      const entry =
+        typeof sessionId === 'string'
+          ? this.resolveEntry(sessionId)
+          : undefined;
+      if (entry?.sourceType !== 'chrome_extension') {
+        throw RequestError.invalidParams(
+          undefined,
+          'browser tools require a session created by the paired Chrome extension',
+        );
+      }
+    }
     const send = this.clientMcpSender(server);
     if (!send) {
       // The client that hosted this server is gone (WS closed / unregistered).
diff --git a/packages/acp-bridge/src/bridgeOptions.ts b/packages/acp-bridge/src/bridgeOptions.ts
index 54de34e8579..86dfeb6a6aa 100644
--- a/packages/acp-bridge/src/bridgeOptions.ts
+++ b/packages/acp-bridge/src/bridgeOptions.ts
@@ -440,6 +440,12 @@ export interface BridgeOptions {
    * receives an SDK MCP runtime server, so the method is never called.
    */
   clientMcpSender?: ClientMcpMessageSender;
+  /** Client-hosted MCP servers to restore after an ACP child restart. */
+  clientMcpRuntimeRegistrations?: () => ReadonlyArray<{
+    name: string;
+    config: Record<string, unknown>;
+    originatorClientId: string;
+  }>;
   /**
    * Daemon-host seam for the `create_sub_session` tool. When a tool running
    * inside a child's agent turn asks (over `extMethod`) to spawn a fresh
diff --git a/packages/chrome-extension/public/sidepanel.js b/packages/chrome-extension/public/sidepanel.js
index d5e5ad53b27..83cbdc84a44 100644
--- a/packages/chrome-extension/public/sidepanel.js
+++ b/packages/chrome-extension/public/sidepanel.js
@@ -17,7 +17,6 @@ const DEFAULT_BASE_URL = 'http://127.0.0.1:4170';
 const STORAGE_KEY = 'qwen.daemon';
 const POLL_MS = 2000;
 const PROBE_TIMEOUT_MS = 2000;
-const PAIRING_VERIFY_CACHE_MS = 10_000;
 const FRAMED_MISS_LIMIT = 2;
 const SHELL_AUTH_MESSAGE_TYPE = 'qwen-daemon-auth';
 const DAEMON_READY_MESSAGE_TYPE = 'qwen-daemon-ready';
@@ -181,28 +180,13 @@ function notifyDaemonReady() {
     .catch(() => undefined);
 }
 
-let pairingCache = null;
 let pendingPairingNonce = null;
 
 /** Probe the daemon and reduce it to one onboarding state. */
 async function probeState(baseUrl, token, extensionPairingCredential) {
-  const cacheFresh =
-    !token &&
-    pairingCache?.baseUrl === baseUrl &&
-    pairingCache?.credential === extensionPairingCredential &&
-    Date.now() - pairingCache.verifiedAt < PAIRING_VERIFY_CACHE_MS;
-  if (
-    cacheFresh ||
-    (await verifyPairing(baseUrl, extensionPairingCredential))
-  ) {
+  if (await verifyPairing(baseUrl, extensionPairingCredential)) {
     pendingPairingNonce = null;
-    pairingCache = {
-      baseUrl,
-      credential: extensionPairingCredential,
-      verifiedAt: Date.now(),
-    };
   } else {
-    pairingCache = null;
     // Pairing endpoints intentionally precede bearer auth. The terminal code
     // stays in the extension and authenticates this first-use exchange before
     // any stored daemon token is exposed.
@@ -228,7 +212,6 @@ async function probeState(baseUrl, token, extensionPairingCredential) {
 
   const health = await probeJson(`${baseUrl}/health`, token);
   if (!health) {
-    pairingCache = null;
     return 'down';
   }
   const caps = await probeJson(`${baseUrl}/capabilities`, token);
@@ -281,27 +264,32 @@ function showWelcome(state, command) {
 
 let framedUrl = null;
 let framedMisses = 0;
-function postShellAuth(baseUrl, token) {
+function postShellAuth(baseUrl, token, extensionPairingCredential) {
   const win = els.iframe.contentWindow;
   if (!win) return;
   win.postMessage(
-    { type: SHELL_AUTH_MESSAGE_TYPE, token: token || null },
+    {
+      type: SHELL_AUTH_MESSAGE_TYPE,
+      token: token || null,
+      extensionPairingCredential: extensionPairingCredential || null,
+    },
     new URL(baseUrl).origin,
   );
 }
 
 /** Swap to the Web Shell iframe; only (re)assigns src when the URL changes. */
-function showShell(baseUrl, token) {
+function showShell(baseUrl, token, extensionPairingCredential) {
   framedMisses = 0;
   els.welcome.classList.add('hidden');
   els.pairForm.classList.add('hidden');
-  els.iframe.onload = () => postShellAuth(baseUrl, token);
+  els.iframe.onload = () =>
+    postShellAuth(baseUrl, token, extensionPairingCredential);
   if (framedUrl !== baseUrl) {
     framedUrl = baseUrl;
     els.iframe.src = baseUrl;
     notifyDaemonReady();
   } else {
-    postShellAuth(baseUrl, token);
+    postShellAuth(baseUrl, token, extensionPairingCredential);
   }
   els.iframe.classList.remove('hidden');
 }
@@ -322,7 +310,7 @@ async function tick() {
     const { baseUrl, token, extensionPairingCredential } = await readConfig();
     const state = await probeState(baseUrl, token, extensionPairingCredential);
     if (state === 'ready') {
-      showShell(baseUrl, token);
+      showShell(baseUrl, token, extensionPairingCredential);
     } else {
       if (framedUrl && framedMisses < FRAMED_MISS_LIMIT) {
         framedMisses += 1;
@@ -415,7 +403,6 @@ async function submitPairing(event) {
     );
     await savePairingCredential(baseUrl, `${credentialId}.${credentialSecret}`);
     pendingPairingNonce = null;
-    pairingCache = null;
     els.pairMessage.textContent = 'Paired.';
     els.pairCode.value = '';
     notifyDaemonReady();
diff --git a/packages/chrome-extension/scripts/sync-extension.js b/packages/chrome-extension/scripts/sync-extension.js
index 536739ce5c7..a73d19026a1 100644
--- a/packages/chrome-extension/scripts/sync-extension.js
+++ b/packages/chrome-extension/scripts/sync-extension.js
@@ -34,6 +34,13 @@ async function copyStatic(clean = false) {
   await fs.mkdir(targetDir, { recursive: true });
 
   await fs.cp(staticSrcDir, targetDir, { recursive: true });
+  const packageJson = JSON.parse(
+    await fs.readFile(path.join(projectRoot, 'package.json'), 'utf8'),
+  );
+  const manifestPath = path.join(targetDir, 'manifest.json');
+  const manifest = JSON.parse(await fs.readFile(manifestPath, 'utf8'));
+  manifest.version = packageJson.version;
+  await fs.writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
   console.log(
     `Static assets synced -> ${path.relative(projectRoot, targetDir)}`,
   );
diff --git a/packages/chrome-extension/src/background/browser-mcp/browser-tools.test.ts b/packages/chrome-extension/src/background/browser-mcp/browser-tools.test.ts
index ac50d6f6726..40b04fa5ac5 100644
--- a/packages/chrome-extension/src/background/browser-mcp/browser-tools.test.ts
+++ b/packages/chrome-extension/src/background/browser-mcp/browser-tools.test.ts
@@ -15,6 +15,7 @@ class FakeSession implements DebuggerSession {
   listener: DebuggerEventListener = () => {};
   changed = true;
   tabId = 1;
+  autoNavigate = true;
   readonly send = vi.fn(
     async (
       method: string,
@@ -46,6 +47,16 @@ class FakeSession implements DebuggerSession {
       ) {
         return { result: { value: true } };
       }
+      if (
+        this.autoNavigate &&
+        (method === 'Page.navigate' ||
+          method === 'Page.reload' ||
+          method === 'Page.navigateToHistoryEntry')
+      ) {
+        queueMicrotask(() =>
+          this.emit('Page.frameNavigated', { frame: { id: 'main' } }),
+        );
+      }
       return {};
     },
   );
@@ -231,6 +242,9 @@ describe('BrowserTools', () => {
       arguments: [{ value: 'qwen' }],
       returnByValue: true,
     });
+    expect(session.send).toHaveBeenCalledWith('Runtime.releaseObject', {
+      objectId: 'input-1',
+    });
 
     const stale = await tools.callTool('fill', {
       ref: 'missing',
@@ -301,6 +315,33 @@ describe('BrowserTools', () => {
 
     expect(result.isError).toBe(true);
     expect(resultText(result)).toContain('TypeError: value setter failed');
+    expect(session.send).toHaveBeenCalledWith('Runtime.releaseObject', {
+      objectId: 'input-1',
+    });
+  });
+
+  it('waits for the new document before accepting readyState', async () => {
+    await tools.callTool('list_console_messages', {});
+    session.autoNavigate = false;
+    vi.useFakeTimers();
+    try {
+      let settled = false;
+      const navigation = tools
+        .callTool('navigate_page', { url: 'https://example.test/next' })
+        .then((result) => {
+          settled = true;
+          return result;
+        });
+
+      await vi.advanceTimersByTimeAsync(0);
+      expect(settled).toBe(false);
+      session.emit('Page.frameNavigated', { frame: { id: 'main' } });
+      await vi.advanceTimersByTimeAsync(200);
+
+      expect((await navigation).isError).not.toBe(true);
+    } finally {
+      vi.useRealTimers();
+    }
   });
 
   it('retries CDP domain setup after initialization fails', async () => {
@@ -354,6 +395,12 @@ describe('BrowserTools', () => {
         timeout: 20_000,
       }),
     );
+    const expression = String(
+      session.send.mock.calls.at(-1)?.[1]?.['expression'] ?? '',
+    );
+    expect(expression).toContain('response.body?.getReader()');
+    expect(expression).toContain('await reader.cancel()');
+    expect(expression).not.toContain('response.text()');
   });
 
   it('captures console output', async () => {
@@ -446,6 +493,7 @@ describe('BrowserTools', () => {
 
     const result = await tools.callTool('get_network_request', {
       requestId: 'request-1',
+      includeResponseBody: true,
     });
     const request = JSON.parse(resultText(result));
     expect(request.requestHeaders.Authorization).toBe('[REDACTED]');
@@ -491,8 +539,14 @@ describe('BrowserTools', () => {
       encodedDataLength: 11,
     });
 
-    await tools.callTool('get_network_request', { requestId: 'request-2' });
-    await tools.callTool('get_network_request', { requestId: 'request-2' });
+    await tools.callTool('get_network_request', {
+      requestId: 'request-2',
+      includeResponseBody: true,
+    });
+    await tools.callTool('get_network_request', {
+      requestId: 'request-2',
+      includeResponseBody: true,
+    });
 
     expect(session.send).toHaveBeenCalledTimes(2 + 6);
     expect(session.send).toHaveBeenNthCalledWith(7, 'Network.getResponseBody', {
@@ -503,6 +557,27 @@ describe('BrowserTools', () => {
     });
   });
 
+  it('omits response bodies unless explicitly requested', async () => {
+    await tools.callTool('list_network_requests', {});
+    session.emit('Network.requestWillBeSent', {
+      requestId: 'sensitive-request',
+      request: { url: 'https://example.test/session', method: 'GET' },
+    });
+    session.emit('Network.loadingFinished', {
+      requestId: 'sensitive-request',
+    });
+
+    const result = await tools.callTool('get_network_request', {
+      requestId: 'sensitive-request',
+    });
+
+    expect(JSON.parse(resultText(result))).not.toHaveProperty('responseBody');
+    expect(session.send).not.toHaveBeenCalledWith(
+      'Network.getResponseBody',
+      expect.anything(),
+    );
+  });
+
   it('keeps network metadata when a response body is unavailable', async () => {
     await tools.callTool('list_network_requests', {});
     session.emit('Network.requestWillBeSent', {
diff --git a/packages/chrome-extension/src/background/browser-mcp/browser-tools.ts b/packages/chrome-extension/src/background/browser-mcp/browser-tools.ts
index a6bca0dcd1a..13870ed24a8 100644
--- a/packages/chrome-extension/src/background/browser-mcp/browser-tools.ts
+++ b/packages/chrome-extension/src/background/browser-mcp/browser-tools.ts
@@ -107,6 +107,17 @@ function numberArg(
   return value;
 }
 
+function booleanArg(
+  args: Record<string, unknown>,
+  name: string,
+  fallback: boolean,
+): boolean {
+  const value = args[name];
+  if (value === undefined) return fallback;
+  if (typeof value !== 'boolean') throw new Error(`'${name}' must be boolean`);
+  return value;
+}
+
 function text(text: string): BrowserToolResult {
   return {
     content: [
@@ -305,8 +316,15 @@ export const BROWSER_TOOLS: readonly BrowserToolDefinition[] = [
   tool('list_network_requests', 'List captured page network requests.'),
   tool(
     'get_network_request',
-    'Get request and response details, including response body when available.',
-    { requestId: stringProperty('CDP network request id.') },
+    'Get request and response details. Response bodies are omitted unless explicitly requested.',
+    {
+      requestId: stringProperty('CDP network request id.'),
+      includeResponseBody: {
+        type: 'boolean',
+        description:
+          'Include the response body. It may contain sensitive application data.',
+      },
+    },
     ['requestId'],
   ),
   tool('clear_network_requests', 'Clear captured network requests.'),
@@ -330,6 +348,7 @@ export class BrowserTools implements BrowserToolHandler {
   private readonly networkEntries = new Map<string, NetworkEntry>();
   private consoleId = 0;
   private readyTabId: number | null = null;
+  private navigationGeneration = 0;
 
   constructor(private readonly session: DebuggerSession) {
     this.session.onEvent((method, params) => this.handleEvent(method, params));
@@ -388,7 +407,10 @@ export class BrowserTools implements BrowserToolHandler {
           case 'list_network_requests':
             return json(this.listNetwork());
           case 'get_network_request':
-            return await this.getNetwork(stringArg(args, 'requestId')!);
+            return await this.getNetwork(
+              stringArg(args, 'requestId')!,
+              booleanArg(args, 'includeResponseBody', false),
+            );
           case 'clear_network_requests':
             this.networkEntries.clear();
             return text('Network requests cleared.');
@@ -502,6 +524,7 @@ export class BrowserTools implements BrowserToolHandler {
     if (protocol !== 'http:' && protocol !== 'https:') {
       throw new Error('Navigation only supports http: and https: URLs');
     }
+    const generation = this.navigationGeneration;
     const result = await this.session.send('Page.navigate', {
       url: normalized,
     });
@@ -509,14 +532,15 @@ export class BrowserTools implements BrowserToolHandler {
       throw new Error(`Navigation failed: ${result['errorText']}`);
     }
     this.elements.clear();
-    await this.waitForDocumentReady();
+    await this.waitForDocumentReady(generation);
     return json({ url: normalized, ...result });
   }
 
   private async reload(): Promise<BrowserToolResult> {
+    const generation = this.navigationGeneration;
     await this.session.send('Page.reload');
     this.elements.clear();
-    await this.waitForDocumentReady();
+    await this.waitForDocumentReady(generation);
     return text('Page reloaded.');
   }
 
@@ -527,24 +551,26 @@ export class BrowserTools implements BrowserToolHandler {
     const entry = object(entries[current + offset]);
     if (typeof entry['id'] !== 'number')
       throw new Error('No history entry available');
+    const generation = this.navigationGeneration;
     await this.session.send('Page.navigateToHistoryEntry', {
       entryId: entry['id'],
     });
     this.elements.clear();
-    await this.waitForDocumentReady();
+    await this.waitForDocumentReady(generation);
     return text(offset < 0 ? 'Navigated back.' : 'Navigated forward.');
   }
 
-  private async waitForDocumentReady(): Promise<void> {
+  private async waitForDocumentReady(generation: number): Promise<void> {
     const deadline = Date.now() + NAVIGATION_TIMEOUT_MS;
-    await new Promise((resolve) => setTimeout(resolve, 50));
     while (Date.now() <= deadline) {
-      const result = await this.session.send('Runtime.evaluate', {
-        expression:
-          "document.readyState === 'interactive' || document.readyState === 'complete'",
-        returnByValue: true,
-      });
-      if (object(result['result'])['value'] === true) return;
+      if (this.navigationGeneration !== generation) {
+        const result = await this.session.send('Runtime.evaluate', {
+          expression:
+            "document.readyState === 'interactive' || document.readyState === 'complete'",
+          returnByValue: true,
+        });
+        if (object(result['result'])['value'] === true) return;
+      }
       await new Promise((resolve) => setTimeout(resolve, 200));
     }
     throw new Error('Timed out waiting for page navigation');
@@ -598,30 +624,36 @@ export class BrowserTools implements BrowserToolHandler {
     });
     const objectId = object(resolved['object'])['objectId'];
     if (typeof objectId !== 'string') throw new Error(`Cannot resolve ${ref}`);
-    const result = await this.session.send('Runtime.callFunctionOn', {
-      objectId,
-      functionDeclaration: `function(value) {
-        this.focus();
-        if (this instanceof HTMLSelectElement) {
-          this.value = value;
-        } else if (this instanceof HTMLInputElement || this instanceof HTMLTextAreaElement) {
-          const proto = this instanceof HTMLTextAreaElement
-            ? HTMLTextAreaElement.prototype : HTMLInputElement.prototype;
-          const setter = Object.getOwnPropertyDescriptor(proto, 'value')?.set;
-          if (setter) setter.call(this, value); else this.value = value;
-        } else if (this.isContentEditable) {
-          this.textContent = value;
-        } else {
-          throw new TypeError('Element is not fillable');
-        }
-        this.dispatchEvent(new Event('input', { bubbles: true }));
-        this.dispatchEvent(new Event('change', { bubbles: true }));
-      }`,
-      arguments: [{ value }],
-      returnByValue: true,
-    });
-    if (result['exceptionDetails']) {
-      throw new Error(this.exceptionText(result['exceptionDetails']));
+    try {
+      const result = await this.session.send('Runtime.callFunctionOn', {
+        objectId,
+        functionDeclaration: `function(value) {
+          this.focus();
+          if (this instanceof HTMLSelectElement) {
+            this.value = value;
+          } else if (this instanceof HTMLInputElement || this instanceof HTMLTextAreaElement) {
+            const proto = this instanceof HTMLTextAreaElement
+              ? HTMLTextAreaElement.prototype : HTMLInputElement.prototype;
+            const setter = Object.getOwnPropertyDescriptor(proto, 'value')?.set;
+            if (setter) setter.call(this, value); else this.value = value;
+          } else if (this.isContentEditable) {
+            this.textContent = value;
+          } else {
+            throw new TypeError('Element is not fillable');
+          }
+          this.dispatchEvent(new Event('input', { bubbles: true }));
+          this.dispatchEvent(new Event('change', { bubbles: true }));
+        }`,
+        arguments: [{ value }],
+        returnByValue: true,
+      });
+      if (result['exceptionDetails']) {
+        throw new Error(this.exceptionText(result['exceptionDetails']));
+      }
+    } finally {
+      await this.session
+        .send('Runtime.releaseObject', { objectId })
+        .catch(() => undefined);
     }
     return text(`Filled ${ref}.`);
   }
@@ -737,7 +769,10 @@ export class BrowserTools implements BrowserToolHandler {
     }));
   }
 
-  private async getNetwork(requestId: string): Promise<BrowserToolResult> {
+  private async getNetwork(
+    requestId: string,
+    includeResponseBody: boolean,
+  ): Promise<BrowserToolResult> {
     const entry = this.networkEntries.get(requestId);
     if (!entry) throw new Error(`Network request '${requestId}' not found`);
     const detail: NetworkEntry & {
@@ -745,7 +780,12 @@ export class BrowserTools implements BrowserToolHandler {
       base64Encoded?: boolean;
       bodyTruncated?: boolean;
     } = { ...entry };
-    if (entry.finished && !entry.failed && !entry.redirectTo) {
+    if (
+      includeResponseBody &&
+      entry.finished &&
+      !entry.failed &&
+      !entry.redirectTo
+    ) {
       try {
         const body = await this.session.send('Network.getResponseBody', {
           requestId,
@@ -777,10 +817,29 @@ export class BrowserTools implements BrowserToolHandler {
       const timer = setTimeout(() => controller.abort(), ${PAGE_FETCH_TIMEOUT_MS});
       try {
         const response = await fetch(${JSON.stringify(url)}, { ...${JSON.stringify(init)}, signal: controller.signal });
-        const text = await response.text();
+        const reader = response.body?.getReader();
+        const decoder = new TextDecoder();
+        let text = '';
+        let bodyTruncated = false;
+        if (reader) {
+          while (true) {
+            const { done, value } = await reader.read();
+            if (done) break;
+            const chunk = decoder.decode(value, { stream: true });
+            const remaining = ${MAX_BODY_CHARS} - text.length;
+            if (chunk.length > remaining) {
+              text += chunk.slice(0, Math.max(0, remaining));
+              bodyTruncated = true;
+              await reader.cancel();
+              break;
+            }
+            text += chunk;
+          }
+          if (!bodyTruncated) text += decoder.decode();
+        }
         return { url: response.url, status: response.status, statusText: response.statusText,
-          headers: Object.fromEntries(response.headers.entries()), body: text.slice(0, ${MAX_BODY_CHARS}),
-          bodyTruncated: text.length > ${MAX_BODY_CHARS} };
+          headers: Object.fromEntries(response.headers.entries()), body: text,
+          bodyTruncated };
       } finally {
         clearTimeout(timer);
       }
@@ -793,6 +852,12 @@ export class BrowserTools implements BrowserToolHandler {
       method === 'Page.frameNavigated' &&
       !object(params['frame'])['parentId']
     ) {
+      this.navigationGeneration += 1;
+      this.elements.clear();
+      return;
+    }
+    if (method === 'Page.navigatedWithinDocument') {
+      this.navigationGeneration += 1;
       this.elements.clear();
       return;
     }
diff --git a/packages/chrome-extension/src/background/browser-mcp/debugger-session.test.ts b/packages/chrome-extension/src/background/browser-mcp/debugger-session.test.ts
index 1e1e12bb50d..9a8ff9751d8 100644
--- a/packages/chrome-extension/src/background/browser-mcp/debugger-session.test.ts
+++ b/packages/chrome-extension/src/background/browser-mcp/debugger-session.test.ts
@@ -68,24 +68,17 @@ describe('ChromeDebuggerSession', () => {
     expect(attach).not.toHaveBeenCalled();
   });
 
-  it('detaches the previous tab when the new active tab is restricted', async () => {
-    query
-      .mockResolvedValueOnce([{ id: 7, url: 'https://example.com' }])
-      .mockResolvedValueOnce([{ id: 8, url: 'chrome://extensions' }]);
+  it('rejects local file pages before attaching', async () => {
+    query.mockResolvedValueOnce([{ id: 8, url: 'file:///tmp/secret.txt' }]);
     const session = new ChromeDebuggerSession();
-
-    await session.send('Page.enable');
-    await expect(session.send('Runtime.enable')).rejects.toThrow(
+    await expect(session.ensureAttached()).rejects.toThrow(
       'does not allow debugging',
     );
-
-    expect(detach).toHaveBeenCalledWith({ tabId: 7 }, expect.any(Function));
+    expect(attach).not.toHaveBeenCalled();
   });
 
-  it('switches the debugger attachment when the active tab changes', async () => {
-    query
-      .mockResolvedValueOnce([{ id: 7, url: 'https://one.example' }])
-      .mockResolvedValueOnce([{ id: 8, url: 'https://two.example' }]);
+  it('keeps the first attached tab when the active tab changes', async () => {
+    query.mockResolvedValueOnce([{ id: 7, url: 'https://one.example' }]);
     const session = new ChromeDebuggerSession();
 
     await session.send('Page.enable');
@@ -97,11 +90,12 @@ describe('ChromeDebuggerSession', () => {
       '1.3',
       expect.any(Function),
     );
-    expect(detach).toHaveBeenCalledWith({ tabId: 7 }, expect.any(Function));
-    expect(attach).toHaveBeenNthCalledWith(
-      2,
-      { tabId: 8 },
-      '1.3',
+    expect(query).toHaveBeenCalledTimes(1);
+    expect(attach).toHaveBeenCalledTimes(1);
+    expect(sendCommand).toHaveBeenLastCalledWith(
+      { tabId: 7 },
+      'Runtime.enable',
+      {},
       expect.any(Function),
     );
     await session.detach();
@@ -113,7 +107,7 @@ describe('ChromeDebuggerSession', () => {
     session.onEvent(listener);
     await session.send('Page.enable');
 
-    const detachListener = onDetach.addListener.mock.calls[0]?.[0];
+    const detachListener = onDetach.addListener.mock.calls.at(-1)?.[0];
     detachListener({ tabId: 7 }, 'canceled_by_user');
     await session.send('Runtime.enable');
 
@@ -190,7 +184,7 @@ describe('ChromeDebuggerSession', () => {
 
     await session.withAttached(() => session.send('Runtime.enable'));
     expect(sendCommand).toHaveBeenLastCalledWith(
-      { tabId: 8 },
+      { tabId: 7 },
       'Runtime.enable',
       {},
       expect.any(Function),
diff --git a/packages/chrome-extension/src/background/browser-mcp/debugger-session.ts b/packages/chrome-extension/src/background/browser-mcp/debugger-session.ts
index 648709abef8..dcb5a9f3b24 100644
--- a/packages/chrome-extension/src/background/browser-mcp/debugger-session.ts
+++ b/packages/chrome-extension/src/background/browser-mcp/debugger-session.ts
@@ -39,6 +39,9 @@ export class ChromeDebuggerSession implements DebuggerSession {
   }
 
   async ensureAttached(): Promise<{ tabId: number; changed: boolean }> {
+    if (this.tabId !== null) {
+      return { tabId: this.tabId, changed: false };
+    }
     if (this.pinnedTabId !== null) {
       return { tabId: this.pinnedTabId, changed: false };
     }
@@ -144,10 +147,7 @@ export class ChromeDebuggerSession implements DebuggerSession {
       await this.detachCurrent();
       throw new Error('No active Chrome tab');
     }
-    if (
-      !tab.url ||
-      /^(chrome|edge|devtools|chrome-extension):/i.test(tab.url)
-    ) {
+    if (!tab.url || (!/^https?:/i.test(tab.url) && tab.url !== 'about:blank')) {
       await this.detachCurrent();
       throw new Error(`Chrome does not allow debugging this page: ${tab.url}`);
     }
diff --git a/packages/chrome-extension/src/background/service-worker.test.ts b/packages/chrome-extension/src/background/service-worker.test.ts
index 7aa8b489006..a16e973386a 100644
--- a/packages/chrome-extension/src/background/service-worker.test.ts
+++ b/packages/chrome-extension/src/background/service-worker.test.ts
@@ -128,6 +128,35 @@ describe('browser-tools service worker', () => {
     vi.restoreAllMocks();
   });
 
+  it('does not connect before extension pairing succeeds', async () => {
+    mocks.checkExtensionPairing.mockResolvedValueOnce({
+      paired: false,
+      reason: 'missing_credential',
+    });
+
+    await import('./service-worker.js');
+    await flushPromises();
+
+    expect(FakeWebSocket.instances).toHaveLength(0);
+    expect(mocks.getDaemonFeatures).not.toHaveBeenCalled();
+    expect(scheduled).toEqual([expect.objectContaining({ delay: 1_000 })]);
+  });
+
+  it('keeps native tools disabled when an external adapter is active', async () => {
+    mocks.getDaemonFeatures.mockResolvedValueOnce(
+      new Set(['browser_automation_mcp']),
+    );
+
+    await import('./service-worker.js');
+    await flushPromises();
+    const ws = FakeWebSocket.instances[0]!;
+    ws.open();
+    ws.message({ id: 'browser-tools-acp-init', result: {} });
+    await flushPromises();
+
+    expect(mocks.registerBrowserMcp).not.toHaveBeenCalled();
+  });
+
   it('pairs before connecting, registers tools, and reconnects after cleanup', async () => {
     await import('./service-worker.js');
     await flushPromises();
diff --git a/packages/cli/src/serve/acp-http/client-mcp-sender-registry.test.ts b/packages/cli/src/serve/acp-http/client-mcp-sender-registry.test.ts
index 7da5ed37512..16c3e5179e2 100644
--- a/packages/cli/src/serve/acp-http/client-mcp-sender-registry.test.ts
+++ b/packages/cli/src/serve/acp-http/client-mcp-sender-registry.test.ts
@@ -67,6 +67,23 @@ describe('ClientMcpSenderRegistry', () => {
     reg.delete('srv', 'connA'); // already gone -> no throw
     expect(reg.serverNames()).toEqual([]);
   });
+
+  it('exposes live registrations for ACP child recovery', () => {
+    const reg = new ClientMcpSenderRegistry();
+    reg.set(
+      'qwen-browser-tools',
+      vi.fn(async () => msg(1)),
+      'extension-client',
+    );
+
+    expect(reg.runtimeRegistrations()).toEqual([
+      {
+        name: 'qwen-browser-tools',
+        config: { type: 'sdk', __clientMcpOverWs: true },
+        originatorClientId: 'extension-client',
+      },
+    ]);
+  });
 });
 
 describe('createClientMcpServerProvider', () => {
diff --git a/packages/cli/src/serve/acp-http/client-mcp-sender-registry.ts b/packages/cli/src/serve/acp-http/client-mcp-sender-registry.ts
index f13c3f3f960..fa85455575f 100644
--- a/packages/cli/src/serve/acp-http/client-mcp-sender-registry.ts
+++ b/packages/cli/src/serve/acp-http/client-mcp-sender-registry.ts
@@ -59,6 +59,13 @@ export type WsClientMcpSender = (
   message: JSONRPCMessage,
 ) => Promise<JSONRPCMessage>;
 
+function runtimeConfig(): ClientMcpOverWsRuntimeConfig {
+  return {
+    type: 'sdk',
+    [CLIENT_MCP_OVER_WS_CONFIG_FLAG]: true,
+  };
+}
+
 /**
  * Process-scoped registry mapping an advertised client-hosted MCP server name
  * to the WS connection's `sendSdkMcpMessage`. One instance per daemon, shared
@@ -113,6 +120,18 @@ export class ClientMcpSenderRegistry {
     return [...this.senders.keys()];
   }
 
+  runtimeRegistrations(): Array<{
+    name: string;
+    config: Record<string, unknown>;
+    originatorClientId: string;
+  }> {
+    return [...this.senders].map(([name, { owner }]) => ({
+      name,
+      config: runtimeConfig(),
+      originatorClientId: owner,
+    }));
+  }
+
   /**
    * The {@link ClientMcpMessageSender} the bridge consumes. Returns a
    * `(payload) => Promise<payload>` bound to the named server, or `undefined`
@@ -178,16 +197,9 @@ export function createClientMcpServerProvider(
       // re-registering the same name can't be deleted by our teardown.
       registry.set(serverName, sendSdkMcpMessage, originatorClientId);
       try {
-        const runtimeConfig: ClientMcpOverWsRuntimeConfig = {
-          // SDK-type so the child binds `SdkControlClientTransport`
-          // (`isSdkMcpServerConfig`); the flag tells the child to KEEP the
-          // type and bind `sendSdkMcpMessage` to the reverse ext-method.
-          type: 'sdk',
-          [CLIENT_MCP_OVER_WS_CONFIG_FLAG]: true,
-        };
         const result = await bridge.addRuntimeMcpServer(
           serverName,
-          runtimeConfig,
+          runtimeConfig(),
           originatorClientId,
         );
         if ((result as { skipped?: boolean }).skipped) {
diff --git a/packages/cli/src/serve/routes/session.ts b/packages/cli/src/serve/routes/session.ts
index 583c4be30d8..237a0631e8f 100644
--- a/packages/cli/src/serve/routes/session.ts
+++ b/packages/cli/src/serve/routes/session.ts
@@ -97,8 +97,13 @@ interface RegisterSessionRoutesDeps {
   promptDeadlineMs?: number;
   sessionShellCommandEnabled: boolean;
   languageCodes: string[];
+  verifyExtensionPairingCredential?: (
+    credential: string | undefined,
+  ) => boolean;
 }
 
+const CHROME_EXTENSION_SESSION_SOURCE = 'chrome_extension';
+
 const WORKSPACE_TRANSCRIPT_PAGE_SOURCE_MAX_BYTES = 4 * 1024 * 1024;
 const WORKSPACE_TRANSCRIPT_RESPONSE_MAX_BYTES = 32 * 1024 * 1024;
 const WORKSPACE_TRANSCRIPT_CURSOR_MAX_BYTES = 64 * 1024;
@@ -1110,7 +1115,7 @@ export function registerSessionRoutes(
     }
     const approvalMode = parseOptionalApprovalMode(body, res);
     if (approvalMode === null) return;
-    const source = parseSessionSource(body['sourceType'], body['sourceId']);
+    let source = parseSessionSource(body['sourceType'], body['sourceId']);
     if ('error' in source) {
       res.status(400).json({
         error: source.error,
@@ -1118,6 +1123,44 @@ export function registerSessionRoutes(
       });
       return;
     }
+    const rawExtensionCredential = body['extensionPairingCredential'];
+    if (
+      rawExtensionCredential !== undefined &&
+      typeof rawExtensionCredential !== 'string'
+    ) {
+      res.status(400).json({
+        error: '`extensionPairingCredential` must be a string when provided',
+        code: 'invalid_extension_pairing_credential',
+      });
+      return;
+    }
+    if (source.sourceType === CHROME_EXTENSION_SESSION_SOURCE) {
+      res.status(400).json({
+        error: '`chrome_extension` is a reserved session source',
+        code: 'reserved_session_source',
+      });
+      return;
+    }
+    if (typeof rawExtensionCredential === 'string') {
+      if (
+        deps.verifyExtensionPairingCredential?.(rawExtensionCredential) !== true
+      ) {
+        res.status(401).json({
+          error: 'Chrome extension pairing credential rejected',
+          code: 'extension_pairing_rejected',
+        });
+        return;
+      }
+      if (source.sourceType !== undefined) {
+        res.status(400).json({
+          error:
+            '`extensionPairingCredential` cannot be combined with session source metadata',
+          code: 'extension_pairing_source_conflict',
+        });
+        return;
+      }
+      source = { sourceType: CHROME_EXTENSION_SESSION_SOURCE };
+    }
     const clientId = parseClientIdHeader(req, res);
     if (clientId === null) return;
     try {
diff --git a/packages/cli/src/serve/run-qwen-serve.ts b/packages/cli/src/serve/run-qwen-serve.ts
index 5f82809f3cc..88b1269ace5 100644
--- a/packages/cli/src/serve/run-qwen-serve.ts
+++ b/packages/cli/src/serve/run-qwen-serve.ts
@@ -3269,6 +3269,10 @@ export async function runQwenServe(
         // Reverse tool channel: let `BridgeClient.extMethod` reach the WS
         // connection that hosts a named client MCP server (#5626).
         clientMcpSender: clientMcpSenderRegistry.lookup,
+        clientMcpRuntimeRegistrations:
+          clientMcpSenderRegistry.runtimeRegistrations.bind(
+            clientMcpSenderRegistry,
+          ),
         onCreateSubSession: subSessionLauncher.launch,
         maxSessions: opts.maxSessions,
         freshSessionAdmission: totalSessionAdmission.admit,
@@ -3577,6 +3581,10 @@ export async function runQwenServe(
       });
       const secondaryBridge = runtime.createAcpSessionBridge({
         clientMcpSender: secondaryClientMcpSenderRegistry.lookup,
+        clientMcpRuntimeRegistrations:
+          secondaryClientMcpSenderRegistry.runtimeRegistrations.bind(
+            secondaryClientMcpSenderRegistry,
+          ),
         onCreateSubSession: secondarySubSessionLauncher.launch,
         maxSessions: opts.maxSessions,
         freshSessionAdmission: totalSessionAdmission.admit,
@@ -3944,6 +3952,8 @@ export async function runQwenServe(
       try {
         wsBridge = runtime.createAcpSessionBridge({
           clientMcpSender: wsClientMcpRegistry.lookup,
+          clientMcpRuntimeRegistrations:
+            wsClientMcpRegistry.runtimeRegistrations.bind(wsClientMcpRegistry),
           onCreateSubSession: wsSubSessionLauncher.launch,
           maxSessions: opts.maxSessions,
           freshSessionAdmission: totalSessionAdmission.admit,
diff --git a/packages/cli/src/serve/server.test.ts b/packages/cli/src/serve/server.test.ts
index cafa37689a0..3fc406ce6b3 100644
--- a/packages/cli/src/serve/server.test.ts
+++ b/packages/cli/src/serve/server.test.ts
@@ -7721,6 +7721,70 @@ describe('createServeApp', () => {
       });
     });
 
+    it('marks sessions authenticated by the paired Chrome extension', async () => {
+      const bridge = fakeBridge();
+      const app = createServeApp(
+        {
+          ...baseOpts,
+          workspace: WS_BOUND,
+          verifyExtensionPairingCredential: (credential) =>
+            credential === 'paired-credential',
+        },
+        undefined,
+        { bridge },
+      );
+
+      const res = await request(app)
+        .post('/session')
+        .set('Host', `127.0.0.1:${baseOpts.port}`)
+        .send({ extensionPairingCredential: 'paired-credential' });
+
+      expect(res.status).toBe(200);
+      expect(bridge.calls[0]).toMatchObject({
+        sourceType: 'chrome_extension',
+      });
+    });
+
+    it('rejects invalid Chrome extension session credentials', async () => {
+      const bridge = fakeBridge();
+      const app = createServeApp(
+        {
+          ...baseOpts,
+          workspace: WS_BOUND,
+          verifyExtensionPairingCredential: () => false,
+        },
+        undefined,
+        { bridge },
+      );
+
+      const res = await request(app)
+        .post('/session')
+        .set('Host', `127.0.0.1:${baseOpts.port}`)
+        .send({ extensionPairingCredential: 'wrong' });
+
+      expect(res.status).toBe(401);
+      expect(res.body.code).toBe('extension_pairing_rejected');
+      expect(bridge.calls).toHaveLength(0);
+    });
+
+    it('rejects client-supplied Chrome extension session metadata', async () => {
+      const bridge = fakeBridge();
+      const app = createServeApp(
+        { ...baseOpts, workspace: WS_BOUND },
+        undefined,
+        { bridge },
+      );
+
+      const res = await request(app)
+        .post('/session')
+        .set('Host', `127.0.0.1:${baseOpts.port}`)
+        .send({ sourceType: 'chrome_extension' });
+
+      expect(res.status).toBe(400);
+      expect(res.body.code).toBe('reserved_session_source');
+      expect(bridge.calls).toHaveLength(0);
+    });
+
     it('rejects sourceId without sourceType', async () => {
       const bridge = fakeBridge();
       const app = createServeApp(
diff --git a/packages/cli/src/serve/server.ts b/packages/cli/src/serve/server.ts
index 98385fde587..c21440993f7 100644
--- a/packages/cli/src/serve/server.ts
+++ b/packages/cli/src/serve/server.ts
@@ -770,6 +770,10 @@ export function createServeApp(
       // Reverse tool channel: answer the child's `client_mcp/message`
       // ext-method by reaching the WS connection that hosts the named server.
       clientMcpSender: clientMcpSenderRegistry.lookup,
+      clientMcpRuntimeRegistrations:
+        clientMcpSenderRegistry.runtimeRegistrations.bind(
+          clientMcpSenderRegistry,
+        ),
     });
   if (!injectedWorkspaceRegistry && !deps.bridge) {
     defaultBridgeForAdmission = bridge;
@@ -1418,6 +1422,7 @@ export function createServeApp(
     promptDeadlineMs: opts.promptDeadlineMs,
     sessionShellCommandEnabled,
     languageCodes,
+    verifyExtensionPairingCredential: opts.verifyExtensionPairingCredential,
   });
 
   registerWorkspaceMcpControlRoutes(app, {
diff --git a/packages/sdk-typescript/src/daemon/DaemonClient.ts b/packages/sdk-typescript/src/daemon/DaemonClient.ts
index 5451bcd6655..a0d4534c3e0 100644
--- a/packages/sdk-typescript/src/daemon/DaemonClient.ts
+++ b/packages/sdk-typescript/src/daemon/DaemonClient.ts
@@ -444,6 +444,8 @@ export interface CreateSessionRequest {
   sourceType?: string;
   /** Optional source-specific identifier. Requires `sourceType`. */
   sourceId?: string;
+  /** Pairing credential used only to authorize Chrome extension sessions. */
+  extensionPairingCredential?: string;
 }
 
 export interface RestoreSessionRequest {
@@ -1935,6 +1937,11 @@ export class DaemonClient {
             ? { sourceType: req.sourceType }
             : {}),
           ...(req.sourceId !== undefined ? { sourceId: req.sourceId } : {}),
+          ...(req.extensionPairingCredential !== undefined
+            ? {
+                extensionPairingCredential: req.extensionPairingCredential,
+              }
+            : {}),
         }),
       },
       async (res) => {
diff --git a/packages/sdk-typescript/test/unit/DaemonClient.test.ts b/packages/sdk-typescript/test/unit/DaemonClient.test.ts
index 2a626c5dea5..8deb0152b43 100644
--- a/packages/sdk-typescript/test/unit/DaemonClient.test.ts
+++ b/packages/sdk-typescript/test/unit/DaemonClient.test.ts
@@ -1481,6 +1481,25 @@ describe('DaemonClient', () => {
       expect(JSON.parse(calls[0]!.body!)).toEqual({});
     });
 
+    it('forwards the Chrome extension pairing credential', async () => {
+      const { fetch, calls } = recordingFetch(() =>
+        jsonResponse(200, {
+          sessionId: 's-1',
+          workspaceCwd: '/work/a',
+          attached: false,
+        }),
+      );
+      const client = new DaemonClient({ baseUrl: 'http://daemon', fetch });
+
+      await client.createOrAttachSession({
+        extensionPairingCredential: 'paired-credential',
+      });
+
+      expect(JSON.parse(calls[0]!.body!)).toEqual({
+        extensionPairingCredential: 'paired-credential',
+      });
+    });
+
     it('forwards empty-string workspaceCwd verbatim so the server can 400 it', async () => {
       // `workspaceCwd: ""` is a likely client-side bug shape. A
       // truthy-guard SDK would silently drop the field and let the
diff --git a/packages/web-shell/client/components/WorkspaceSessionProvider.tsx b/packages/web-shell/client/components/WorkspaceSessionProvider.tsx
index fd9570e4047..13747bba1da 100644
--- a/packages/web-shell/client/components/WorkspaceSessionProvider.tsx
+++ b/packages/web-shell/client/components/WorkspaceSessionProvider.tsx
@@ -17,6 +17,7 @@ interface WorkspaceSessionProviderProps {
   workspaceCwd?: string;
   lockWorkspaceCwd?: string;
   clientId?: string;
+  extensionPairingCredential?: string;
   webShellProps: WebShellProps;
 }
 
@@ -26,6 +27,7 @@ export function WorkspaceSessionProvider({
   workspaceCwd,
   lockWorkspaceCwd,
   clientId,
+  extensionPairingCredential,
   webShellProps,
 }: WorkspaceSessionProviderProps) {
   const workspace = useWorkspace();
@@ -225,6 +227,9 @@ export function WorkspaceSessionProvider({
       sessionId={effectiveSessionId}
       workspaceCwd={targetWorkspace?.cwd}
       clientId={clientId}
+      createSessionRequest={
+        extensionPairingCredential ? { extensionPairingCredential } : undefined
+      }
       suppressOwnUserEcho
     >
       <App
diff --git a/packages/web-shell/client/config/daemon.test.ts b/packages/web-shell/client/config/daemon.test.ts
index 47f73632e6a..57f12ba5ceb 100644
--- a/packages/web-shell/client/config/daemon.test.ts
+++ b/packages/web-shell/client/config/daemon.test.ts
@@ -146,18 +146,23 @@ describe('waitForDaemonTokenMessage', () => {
     });
   }
 
-  it('accepts a bearer token posted from a browser extension parent', async () => {
+  it('accepts daemon auth posted from a browser extension parent', async () => {
     mockFramedWindow();
     const mod = await import('./daemon');
     const token = mod.waitForDaemonTokenMessage(1000);
     window.dispatchEvent(
       new MessageEvent('message', {
-        data: { type: 'qwen-daemon-auth', token: 'posted-secret' },
+        data: {
+          type: 'qwen-daemon-auth',
+          token: 'posted-secret',
+          extensionPairingCredential: 'paired-credential',
+        },
         origin: 'chrome-extension://abcdefghijklmnop',
         source: window.parent,
       }),
     );
     await expect(token).resolves.toBe('posted-secret');
+    expect(mod.getExtensionPairingCredential()).toBe('paired-credential');
   });
 
   it('ignores bearer token messages from non-extension origins', async () => {
diff --git a/packages/web-shell/client/config/daemon.ts b/packages/web-shell/client/config/daemon.ts
index a805f0f4d41..74de470bc08 100644
--- a/packages/web-shell/client/config/daemon.ts
+++ b/packages/web-shell/client/config/daemon.ts
@@ -8,6 +8,7 @@ export function getDaemonBaseUrl(): string {
 }
 
 let cachedDaemonToken: string | undefined;
+let cachedExtensionPairingCredential: string | undefined;
 const DAEMON_AUTH_MESSAGE_TYPE = 'qwen-daemon-auth';
 const DEFAULT_TOKEN_MESSAGE_TIMEOUT_MS = 2500;
 
@@ -30,6 +31,10 @@ export function getDaemonToken(): string | undefined {
   return cachedDaemonToken;
 }
 
+export function getExtensionPairingCredential(): string | undefined {
+  return cachedExtensionPairingCredential;
+}
+
 export function waitForDaemonTokenMessage(
   timeoutMs = DEFAULT_TOKEN_MESSAGE_TIMEOUT_MS,
 ): Promise<string | undefined> {
@@ -54,9 +59,18 @@ export function waitForDaemonTokenMessage(
       ) {
         return;
       }
-      const data = event.data as { type?: unknown; token?: unknown };
+      const data = event.data as {
+        type?: unknown;
+        token?: unknown;
+        extensionPairingCredential?: unknown;
+      };
       if (data?.type !== DAEMON_AUTH_MESSAGE_TYPE) return;
       const token = typeof data.token === 'string' ? data.token : '';
+      const credential =
+        typeof data.extensionPairingCredential === 'string'
+          ? data.extensionPairingCredential.trim()
+          : '';
+      cachedExtensionPairingCredential = credential || undefined;
       finish(token.trim() || undefined);
     };
     const timer = setTimeout(() => finish(undefined), timeoutMs);
diff --git a/packages/web-shell/client/main.tsx b/packages/web-shell/client/main.tsx
index 2273e3a8525..347b6e3b41b 100644
--- a/packages/web-shell/client/main.tsx
+++ b/packages/web-shell/client/main.tsx
@@ -7,6 +7,7 @@ import { RootErrorFallback } from './components/RootErrorFallback';
 import { WorkspaceSessionProvider } from './components/WorkspaceSessionProvider';
 import {
   getDaemonBaseUrl,
+  getExtensionPairingCredential,
   getDaemonToken,
   removeDaemonTokenFromUrl,
   waitForDaemonTokenMessage,
@@ -116,7 +117,13 @@ function replaceStandaloneSessionUrl(
   window.history.replaceState(null, '', url);
 }
 
-function StandaloneApp({ daemonToken }: { daemonToken?: string }) {
+function StandaloneApp({
+  daemonToken,
+  extensionPairingCredential,
+}: {
+  daemonToken?: string;
+  extensionPairingCredential?: string;
+}) {
   const [theme, setTheme] = useState<WebShellTheme>(() => getInitialTheme());
   const [language, setLanguage] = useState<WebShellLanguage>(() =>
     getInitialLanguage(),
@@ -165,6 +172,7 @@ function StandaloneApp({ daemonToken }: { daemonToken?: string }) {
         <WorkspaceSessionProvider
           sessionId={sessionId}
           workspaceId={workspaceId}
+          extensionPairingCredential={extensionPairingCredential}
           webShellProps={{
             theme,
             onThemeChange: handleThemeChange,
@@ -183,11 +191,15 @@ function StandaloneApp({ daemonToken }: { daemonToken?: string }) {
 
 async function main() {
   const daemonToken = getDaemonToken() ?? (await waitForDaemonTokenMessage());
+  const extensionPairingCredential = getExtensionPairingCredential();
   removeDaemonTokenFromUrl();
 
   ReactDOM.createRoot(document.getElementById('root')!).render(
     <React.StrictMode>
-      <StandaloneApp daemonToken={daemonToken} />
+      <StandaloneApp
+        daemonToken={daemonToken}
+        extensionPairingCredential={extensionPairingCredential}
+      />
     </React.StrictMode>,
   );
 }
diff --git a/scripts/tests/chrome-extension-package.test.js b/scripts/tests/chrome-extension-package.test.js
index 5892f8f5c72..19c2ebda4ce 100644
--- a/scripts/tests/chrome-extension-package.test.js
+++ b/scripts/tests/chrome-extension-package.test.js
@@ -7,6 +7,7 @@
 import { readFileSync, writeFileSync } from 'node:fs';
 import { mkdtemp, rm } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -89,4 +90,33 @@ describe('chrome extension package scripts', () => {
     expect(daemonSource).toContain(`chrome-extension://${extensionId}`);
     expect(sidePanelSource).toContain(`'${extensionId}'`);
   });
+
+  it('writes the package version into the built manifest', async () => {
+    const tempDir = await mkdtemp(path.join(os.tmpdir(), 'qwen-ext-build-'));
+    try {
+      execFileSync(
+        process.execPath,
+        [
+          path.join(
+            root,
+            'packages/chrome-extension/scripts/sync-extension.js',
+          ),
+          `--target=${tempDir}`,
+        ],
+        { stdio: 'ignore' },
+      );
+      const manifest = JSON.parse(
+        readFileSync(path.join(tempDir, 'manifest.json'), 'utf8'),
+      );
+      const packageJson = JSON.parse(
+        readFileSync(
+          path.join(root, 'packages/chrome-extension/package.json'),
+          'utf8',
+        ),
+      );
+      expect(manifest.version).toBe(packageJson.version);
+    } finally {
+      await rm(tempDir, { recursive: true, force: true });
+    }
+  }, 30_000);
 });

From f28f701eaad52285be904c8d8c071450f58fe93a Mon Sep 17 00:00:00 2001
From: yiliang114 <effortyiliang@gmail.com>
Date: Thu, 16 Jul 2026 15:02:56 +0800
Subject: [PATCH 03/13] fix(chrome): preserve web shell session source

---
 packages/acp-bridge/src/bridgeClient.test.ts | 12 ++---
 packages/acp-bridge/src/bridgeClient.ts      |  6 ++-
 packages/cli/src/serve/routes/session.ts     | 21 +++++++--
 packages/cli/src/serve/server.test.ts        | 48 +++++++++++++++++---
 4 files changed, 69 insertions(+), 18 deletions(-)

diff --git a/packages/acp-bridge/src/bridgeClient.test.ts b/packages/acp-bridge/src/bridgeClient.test.ts
index 69f640508c1..3080190f66e 100644
--- a/packages/acp-bridge/src/bridgeClient.test.ts
+++ b/packages/acp-bridge/src/bridgeClient.test.ts
@@ -2429,7 +2429,7 @@ describe('BridgeClient — reverse tool channel (qwen/control/client_mcp/message
    */
   function makeClientWithRegistrar(
     registrar: ClientMcpRegistrar,
-    sourceType?: string,
+    source?: { sourceType?: string; sourceId?: string },
   ): BridgeClient {
     const sender: ClientMcpMessageSender = (serverName: string) =>
       registrar.hasServer(serverName)
@@ -2439,7 +2439,7 @@ describe('BridgeClient — reverse tool channel (qwen/control/client_mcp/message
     return new BridgeClient(
       ((sessionId: string | undefined) =>
         sessionId === 'extension-session'
-          ? ({ sourceType } as never)
+          ? ({ ...source } as never)
           : undefined) as never,
       (() => undefined) as never, // resolvePendingRestoreEvents
       { request: thrower } as never,
@@ -2530,10 +2530,10 @@ describe('BridgeClient — reverse tool channel (qwen/control/client_mcp/message
     await expect(denied).resolves.toMatchObject({ code: -32602 });
     expect(outbound).toHaveLength(0);
 
-    const allowedClient = makeClientWithRegistrar(
-      registrar,
-      'chrome_extension',
-    );
+    const allowedClient = makeClientWithRegistrar(registrar, {
+      sourceType: 'default',
+      sourceId: 'chrome_extension',
+    });
     const allowed = allowedClient.extMethod('qwen/control/client_mcp/message', {
       server: 'qwen-browser-tools',
       sessionId: 'extension-session',
diff --git a/packages/acp-bridge/src/bridgeClient.ts b/packages/acp-bridge/src/bridgeClient.ts
index 89858aa5221..c7c4f9962fc 100644
--- a/packages/acp-bridge/src/bridgeClient.ts
+++ b/packages/acp-bridge/src/bridgeClient.ts
@@ -450,6 +450,7 @@ function sliceLineRange(
 export interface BridgeClientSessionEntry {
   sessionId: string;
   sourceType?: string;
+  sourceId?: string;
   events: EventBus;
   artifacts: SessionArtifactStore;
   recordingDegraded: boolean;
@@ -1086,7 +1087,10 @@ export class BridgeClient implements Client {
         typeof sessionId === 'string'
           ? this.resolveEntry(sessionId)
           : undefined;
-      if (entry?.sourceType !== 'chrome_extension') {
+      if (
+        entry?.sourceType !== 'default' ||
+        entry.sourceId !== 'chrome_extension'
+      ) {
         throw RequestError.invalidParams(
           undefined,
           'browser tools require a session created by the paired Chrome extension',
diff --git a/packages/cli/src/serve/routes/session.ts b/packages/cli/src/serve/routes/session.ts
index 645d7dd6a85..91df4fe1694 100644
--- a/packages/cli/src/serve/routes/session.ts
+++ b/packages/cli/src/serve/routes/session.ts
@@ -102,7 +102,8 @@ interface RegisterSessionRoutesDeps {
   ) => boolean;
 }
 
-const CHROME_EXTENSION_SESSION_SOURCE = 'chrome_extension';
+const WEB_SHELL_SESSION_SOURCE = 'default';
+const CHROME_EXTENSION_SESSION_SOURCE_ID = 'chrome_extension';
 
 const WORKSPACE_TRANSCRIPT_PAGE_SOURCE_MAX_BYTES = 4 * 1024 * 1024;
 const WORKSPACE_TRANSCRIPT_RESPONSE_MAX_BYTES = 32 * 1024 * 1024;
@@ -1134,9 +1135,12 @@ export function registerSessionRoutes(
       });
       return;
     }
-    if (source.sourceType === CHROME_EXTENSION_SESSION_SOURCE) {
+    if (
+      source.sourceType === CHROME_EXTENSION_SESSION_SOURCE_ID ||
+      source.sourceId === CHROME_EXTENSION_SESSION_SOURCE_ID
+    ) {
       res.status(400).json({
-        error: '`chrome_extension` is a reserved session source',
+        error: '`chrome_extension` is reserved session metadata',
         code: 'reserved_session_source',
       });
       return;
@@ -1151,7 +1155,11 @@ export function registerSessionRoutes(
         });
         return;
       }
-      if (source.sourceType !== undefined) {
+      if (
+        source.sourceType !== undefined &&
+        (source.sourceType !== WEB_SHELL_SESSION_SOURCE ||
+          source.sourceId !== undefined)
+      ) {
         res.status(400).json({
           error:
             '`extensionPairingCredential` cannot be combined with session source metadata',
@@ -1159,7 +1167,10 @@ export function registerSessionRoutes(
         });
         return;
       }
-      source = { sourceType: CHROME_EXTENSION_SESSION_SOURCE };
+      source = {
+        sourceType: WEB_SHELL_SESSION_SOURCE,
+        sourceId: CHROME_EXTENSION_SESSION_SOURCE_ID,
+      };
     }
     const clientId = parseClientIdHeader(req, res);
     if (clientId === null) return;
diff --git a/packages/cli/src/serve/server.test.ts b/packages/cli/src/serve/server.test.ts
index e32dab0314f..f02b534954d 100644
--- a/packages/cli/src/serve/server.test.ts
+++ b/packages/cli/src/serve/server.test.ts
@@ -7737,11 +7737,15 @@ describe('createServeApp', () => {
       const res = await request(app)
         .post('/session')
         .set('Host', `127.0.0.1:${baseOpts.port}`)
-        .send({ extensionPairingCredential: 'paired-credential' });
+        .send({
+          sourceType: 'default',
+          extensionPairingCredential: 'paired-credential',
+        });
 
       expect(res.status).toBe(200);
       expect(bridge.calls[0]).toMatchObject({
-        sourceType: 'chrome_extension',
+        sourceType: 'default',
+        sourceId: 'chrome_extension',
       });
     });
 
@@ -7767,10 +7771,38 @@ describe('createServeApp', () => {
       expect(bridge.calls).toHaveLength(0);
     });
 
-    it('rejects client-supplied Chrome extension session metadata', async () => {
+    it.each([
+      { sourceType: 'chrome_extension' },
+      { sourceType: 'default', sourceId: 'chrome_extension' },
+    ])(
+      'rejects client-supplied Chrome extension session metadata: %j',
+      async (source) => {
+        const bridge = fakeBridge();
+        const app = createServeApp(
+          { ...baseOpts, workspace: WS_BOUND },
+          undefined,
+          { bridge },
+        );
+
+        const res = await request(app)
+          .post('/session')
+          .set('Host', `127.0.0.1:${baseOpts.port}`)
+          .send(source);
+
+        expect(res.status).toBe(400);
+        expect(res.body.code).toBe('reserved_session_source');
+        expect(bridge.calls).toHaveLength(0);
+      },
+    );
+
+    it('rejects pairing credentials combined with non-Web-Shell source metadata', async () => {
       const bridge = fakeBridge();
       const app = createServeApp(
-        { ...baseOpts, workspace: WS_BOUND },
+        {
+          ...baseOpts,
+          workspace: WS_BOUND,
+          verifyExtensionPairingCredential: () => true,
+        },
         undefined,
         { bridge },
       );
@@ -7778,10 +7810,14 @@ describe('createServeApp', () => {
       const res = await request(app)
         .post('/session')
         .set('Host', `127.0.0.1:${baseOpts.port}`)
-        .send({ sourceType: 'chrome_extension' });
+        .send({
+          sourceType: 'scheduled_task',
+          sourceId: 'task-123',
+          extensionPairingCredential: 'paired-credential',
+        });
 
       expect(res.status).toBe(400);
-      expect(res.body.code).toBe('reserved_session_source');
+      expect(res.body.code).toBe('extension_pairing_source_conflict');
       expect(bridge.calls).toHaveLength(0);
     });
 

From e867c414f8077fe8d91a78e3909520f8f358ac86 Mon Sep 17 00:00:00 2001
From: yiliang114 <effortyiliang@gmail.com>
Date: Thu, 16 Jul 2026 17:42:24 +0800
Subject: [PATCH 04/13] fix(chrome): secure native browser tool sessions

---
 ...07-13-chrome-extension-native-tools-pr1.md |  18 +--
 docs/users/qwen-serve.md                      |   2 +-
 .../chrome-extension/scripts/artifact-scan.js |   9 +-
 .../scripts/package-extension.js              |   6 +
 .../browser-mcp/browser-tools.test.ts         |  70 ++++++++++-
 .../background/browser-mcp/browser-tools.ts   |  66 ++++++++--
 .../browser-mcp/debugger-session.test.ts      |  24 +++-
 .../browser-mcp/debugger-session.ts           |   3 +-
 .../client-mcp-sender-registry.test.ts        |  54 +++++---
 .../acp-http/client-mcp-sender-registry.ts    |  43 +++----
 packages/cli/src/serve/acp-http/dispatch.ts   |  33 +++++
 packages/cli/src/serve/acp-http/index.ts      |  32 ++++-
 .../cli/src/serve/acp-http/transport.test.ts  | 115 +++++++++++++++++-
 .../cli/src/serve/extension-pairing.test.ts   |  13 +-
 packages/cli/src/serve/extension-pairing.ts   |   7 +-
 packages/cli/src/serve/routes/session.ts      |  37 +++++-
 packages/cli/src/serve/server.test.ts         |  37 ++++++
 .../sdk-typescript/src/daemon/DaemonClient.ts |  35 ++----
 .../src/daemon/DaemonSessionClient.ts         |  12 +-
 .../test/unit/DaemonClient.test.ts            |   6 +-
 .../test/unit/DaemonSessionClient.test.ts     |  15 ++-
 .../WorkspaceSessionProvider.test.tsx         |  75 ++++++++++++
 .../session/DaemonSessionProvider.test.tsx    |  12 +-
 .../daemon/session/DaemonSessionProvider.tsx  |  22 ++--
 scripts/tests/package-scripts.test.js         |   1 +
 25 files changed, 619 insertions(+), 128 deletions(-)
 create mode 100644 packages/web-shell/client/components/WorkspaceSessionProvider.test.tsx

diff --git a/docs/plans/2026-07-13-chrome-extension-native-tools-pr1.md b/docs/plans/2026-07-13-chrome-extension-native-tools-pr1.md
index 5e542797c22..24fdf5abc27 100644
--- a/docs/plans/2026-07-13-chrome-extension-native-tools-pr1.md
+++ b/docs/plans/2026-07-13-chrome-extension-native-tools-pr1.md
@@ -252,7 +252,7 @@ Expected: build and final package scan pass.
 Run daemon without browser env flags:
 
 ```bash
-node packages/cli/dist/index.js serve --port 4170 --hostname 127.0.0.1 --no-web
+node packages/cli/dist/index.js serve --port 4170 --hostname 127.0.0.1
 ```
 
 Load the built extension ZIP or unpacked `packages/chrome-extension/dist/extension`.
@@ -320,15 +320,15 @@ Draft PR must state:
 
 ## Validation Results
 
-Validated on `origin/main` at `536cb713c6`:
+Automated validation after syncing `origin/main` on 2026-07-16:
 
-- Extension tests: 54 passed.
-- Relevant CLI pairing, reverse MCP, ACP transport, and serve tests: 478 passed.
-- Release-script tests: 3 passed.
-- `npm run lint`, `npm run build`, `npm run typecheck`, and `npm run bundle`: passed.
-- Extension `test:release`: passed, including ZIP creation and artifact scan.
-- Real Chrome smoke test: pairing succeeded without browser environment flags, the Web Shell iframe loaded, `qwen-browser-tools` registered, and all 20 tools were discoverable.
-- Main npm tarball: 23,231,294 bytes and 833 files; path and content scans found no `chrome-devtools-mcp`, Puppeteer, extension ZIP/manifest, or native browser-MCP source.
+- Extension `test:release`: 58 tests passed, including typecheck, ZIP creation, and artifact scan.
+- Relevant CLI session authentication, ACP bridge, and Web Shell tests: 101 tests passed.
+- `npm run lint`, `npm run build`, `npm run typecheck`, `npm run bundle`, and `npm run prepare:package`: passed.
+- Main npm tarball: 23.4 MB and 833 files; path and content scans found no `chrome-devtools-mcp`, Puppeteer, extension ZIP/manifest, or native browser-MCP source.
+- Full `npm run verify:pr` passed every deterministic stage and all other workspaces. One unrelated CLI webhook test ended with `socket hang up`; the exact test passed twice in isolation.
+
+The real Chrome smoke test in Task 6 remains the final manual release check.
 
 ## Acceptance Criteria
 
diff --git a/docs/users/qwen-serve.md b/docs/users/qwen-serve.md
index 794f5089f3a..c12b404c27d 100644
--- a/docs/users/qwen-serve.md
+++ b/docs/users/qwen-serve.md
@@ -390,7 +390,7 @@ Notes:
 - **`LOOPBACK_BINDS` includes IPv6** — `::1` and `[::1]` count as loopback for the no-token rule.
 - **Host header allowlist** — on **loopback** binds the daemon checks `Host:` matches `localhost:port` / `127.0.0.1:port` / `[::1]:port` / `host.docker.internal:port` (case-insensitive per RFC 7230 §5.4) to defend against DNS rebinding. **Non-loopback binds (`--hostname 0.0.0.0`) intentionally bypass the Host allowlist** — the operator has chosen the surface area, so the bearer-token gate is the sole authentication layer; reverse proxies / SNI / client cert pinning are the operator's responsibility, not the daemon's. If you need Host-based isolation on a non-loopback bind, terminate TLS + check Host at a front proxy.
 - **CORS denies any browser Origin by default** — returns `403` JSON. Pass **`--allow-origin <pattern>`** (repeatable, T2.4 #4514) to opt specific browser origins through. Each value is either the literal `*` (any origin — boot refuses if no bearer token is configured; `--require-auth` on loopback is recommended for full hardening since `/health` and `/demo` remain pre-auth on loopback by default) or a canonical URL origin (`<scheme>://<host>[:<port>]`, no trailing slash / path / userinfo). Matched origins receive proper CORS response headers (`Access-Control-Allow-Origin: <echoed>`, `Vary: Origin`, plus standard methods / headers / max-age and exposed `Retry-After`); unmatched origins still get a 403 with the same envelope as the default wall. `caps.features.allow_origin` is advertised conditionally so SDK / webui clients can pre-flight whether the daemon honors cross-origin hits before issuing them. Example: `qwen serve --allow-origin http://localhost:3000 --allow-origin http://localhost:5173`. Loopback self-origin hits (e.g. the `/demo` page) are unaffected — a separate Origin-strip shim handles them regardless of `--allow-origin`. **Browser webuis without `--allow-origin` configured** still fall back to the same Stage 1 options as before: package as a native shell (Electron/Tauri) so no `Origin` header is sent, or front the daemon with a same-origin reverse proxy.
-- **Chrome extension browser automation is separate from framing.** `qwen serve --allow-origin chrome-extension://<id>` lets the extension frame the Web Shell and connect to the daemon. Console/network/screenshot/click tools require an external CDP MCP adapter command: `QWEN_CDP_MCP_COMMAND=/path/to/cdp-mcp-adapter qwen serve --allow-origin chrome-extension://<id>`. The main CLI package does not bundle a browser automation adapter; clients can check `caps.features.includes('browser_automation_mcp')` before presenting those tools as available.
+- **Chrome extension browser automation is separate from framing.** The official extension origin is pinned, so starting `qwen serve` and completing the first-use pairing enables its native console/network/screenshot/click tools without browser-related flags or an external MCP server. Custom extension builds must still pass `--allow-origin chrome-extension://<id>`. `QWEN_CDP_MCP_COMMAND` remains an explicit compatibility path for external adapters; the main CLI package does not bundle one, and `caps.features.includes('browser_automation_mcp')` is advertised only when that legacy adapter is configured.
 - **Spawned `qwen --acp` child inherits the daemon's environment** with one explicit scrub: `QWEN_SERVER_TOKEN` is removed before the child starts (the daemon's own bearer; the agent doesn't need it). Everything else — `OPENAI_API_KEY` / `ANTHROPIC_API_KEY` / `QWEN_*` / `DASHSCOPE_API_KEY` / your custom `modelProviders[].envKey` / etc. — passes through, because the agent legitimately needs those to authenticate to the LLM. **This is intentional, not a sandbox.** The agent runs as the same UID with shell-tool access, so anything in `~/.bashrc` / `~/.aws/credentials` / `~/.npmrc` is reachable by prompt injection regardless. The env passthrough is not the security boundary; the user-as-trust-root is. Don't run `qwen serve` under an identity that has env-resident credentials you wouldn't trust the agent with.
 - **Per-subscriber bounded SSE queues** — a slow client that overflows its queue gets a `client_evicted` terminal frame and is closed; one stuck consumer can't pin the daemon.
 - **Per-session prompt admission cap** — defaults to 5 accepted-but-unsettled prompts per session. A buggy client cannot enqueue unbounded prompt promises or temporary SSE waits for one session.
diff --git a/packages/chrome-extension/scripts/artifact-scan.js b/packages/chrome-extension/scripts/artifact-scan.js
index 6a68c63a0ad..86a4618f284 100644
--- a/packages/chrome-extension/scripts/artifact-scan.js
+++ b/packages/chrome-extension/scripts/artifact-scan.js
@@ -74,7 +74,14 @@ export async function scanZip(file) {
 
 const scriptPath = fileURLToPath(import.meta.url);
 const packageRoot = path.resolve(path.dirname(scriptPath), '..');
-const roots = [path.join(packageRoot, 'dist/extension')];
+const extensionRoot = path.join(packageRoot, 'dist/extension');
+if (
+  process.env.EXTENSION_OUT_DIR &&
+  path.resolve(packageRoot, process.env.EXTENSION_OUT_DIR) !== extensionRoot
+) {
+  throw new Error('Release artifact scan requires dist/extension output');
+}
+const roots = [extensionRoot];
 const metafiles = [path.join(packageRoot, 'dist/esbuild.json')];
 const archives = [path.join(packageRoot, 'chrome-extension.zip')];
 
diff --git a/packages/chrome-extension/scripts/package-extension.js b/packages/chrome-extension/scripts/package-extension.js
index 4769f2693b1..8d4306fd92c 100644
--- a/packages/chrome-extension/scripts/package-extension.js
+++ b/packages/chrome-extension/scripts/package-extension.js
@@ -15,6 +15,12 @@ const packageRoot = path.resolve(
   '..',
 );
 const extensionRoot = path.join(packageRoot, 'dist/extension');
+if (
+  process.env.EXTENSION_OUT_DIR &&
+  path.resolve(packageRoot, process.env.EXTENSION_OUT_DIR) !== extensionRoot
+) {
+  throw new Error('Release packaging requires dist/extension output');
+}
 const archive = path.join(packageRoot, 'chrome-extension.zip');
 
 await rm(archive, { force: true });
diff --git a/packages/chrome-extension/src/background/browser-mcp/browser-tools.test.ts b/packages/chrome-extension/src/background/browser-mcp/browser-tools.test.ts
index 40b04fa5ac5..c80e7bec3c2 100644
--- a/packages/chrome-extension/src/background/browser-mcp/browser-tools.test.ts
+++ b/packages/chrome-extension/src/background/browser-mcp/browser-tools.test.ts
@@ -167,7 +167,10 @@ describe('BrowserTools', () => {
 
     session.send.mockResolvedValueOnce({
       currentIndex: 1,
-      entries: [{ id: 10 }, { id: 11 }],
+      entries: [
+        { id: 10, url: 'https://example.test/previous' },
+        { id: 11, url: 'https://example.test/current' },
+      ],
     });
     await tools.callTool('go_back', {});
     expect(session.send).toHaveBeenCalledWith('Page.navigateToHistoryEntry', {
@@ -175,6 +178,26 @@ describe('BrowserTools', () => {
     });
   });
 
+  it('rejects restricted navigation history entries', async () => {
+    await tools.callTool('list_console_messages', {});
+    session.send.mockResolvedValueOnce({
+      currentIndex: 1,
+      entries: [
+        { id: 10, url: 'file:///tmp/secret.txt' },
+        { id: 11, url: 'https://example.test/current' },
+      ],
+    });
+
+    const result = await tools.callTool('go_back', {});
+
+    expect(result.isError).toBe(true);
+    expect(resultText(result)).toContain('does not allow debugging');
+    expect(session.send).not.toHaveBeenCalledWith(
+      'Page.navigateToHistoryEntry',
+      expect.anything(),
+    );
+  });
+
   it('rejects screenshots that would exceed the WebSocket frame budget', async () => {
     await tools.callTool('list_console_messages', {});
     session.send.mockResolvedValueOnce({
@@ -190,7 +213,12 @@ describe('BrowserTools', () => {
   it('caps evaluated text results to the reverse WebSocket frame budget', async () => {
     await tools.callTool('list_console_messages', {});
     session.send.mockResolvedValueOnce({
-      result: { value: 'a'.repeat(2 * 1_048_576) },
+      result: {
+        value: {
+          text: 'a'.repeat(1_048_576 - '... [truncated]'.length),
+          truncated: true,
+        },
+      },
     });
 
     const result = await tools.callTool('evaluate_script', {
@@ -200,6 +228,12 @@ describe('BrowserTools', () => {
 
     expect(output.length).toBeLessThanOrEqual(1_048_576);
     expect(output.endsWith('... [truncated]')).toBe(true);
+    expect(session.send).toHaveBeenLastCalledWith(
+      'Runtime.evaluate',
+      expect.objectContaining({
+        expression: expect.stringContaining('serialized.slice(0,'),
+      }),
+    );
   });
 
   it('caps snapshot text and redacts secrets from the page URL', async () => {
@@ -217,7 +251,7 @@ describe('BrowserTools', () => {
     const tab = await session.getTab();
     vi.spyOn(session, 'getTab').mockResolvedValue({
       ...tab,
-      url: 'https://user:password@example.test/?access_token=secret&name=qwen',
+      url: 'https://user:password@example.test/?access_token=secret&name=qwen#access_token=fragment-secret&route=home',
     });
 
     const output = resultText(await tools.callTool('take_snapshot', {}));
@@ -227,6 +261,23 @@ describe('BrowserTools', () => {
     expect(output).not.toContain('password');
     expect(output).not.toContain('secret');
     expect(output).toContain('name=qwen');
+    expect(output).toContain('route=home');
+  });
+
+  it('preserves non-secret URL fragments', async () => {
+    session.send.mockImplementation(async (method: string) => {
+      if (method === 'Accessibility.getFullAXTree') return { nodes: [] };
+      return {};
+    });
+    const tab = await session.getTab();
+    vi.spyOn(session, 'getTab').mockResolvedValue({
+      ...tab,
+      url: 'https://example.test/#/settings',
+    });
+
+    const output = resultText(await tools.callTool('take_snapshot', {}));
+
+    expect(output).toContain('https://example.test/#/settings');
   });
 
   it('fills snapshot controls and rejects stale refs', async () => {
@@ -367,6 +418,17 @@ describe('BrowserTools', () => {
       }),
     );
 
+    await tools.callTool('press_key', { key: 'a' });
+    expect(session.send).toHaveBeenCalledWith('Input.insertText', {
+      text: 'a',
+    });
+
+    const unsupportedKey = await tools.callTool('press_key', {
+      key: 'NotAKey',
+    });
+    expect(unsupportedKey.isError).toBe(true);
+    expect(resultText(unsupportedKey)).toContain('Unsupported key');
+
     await tools.callTool('scroll_page', { x: 2, y: 300 });
     expect(session.send).toHaveBeenCalledWith('Runtime.evaluate', {
       expression: 'window.scrollBy(2, 300)',
@@ -391,7 +453,7 @@ describe('BrowserTools', () => {
     expect(session.send).toHaveBeenLastCalledWith(
       'Runtime.evaluate',
       expect.objectContaining({
-        expression: expect.stringContaining('fetch("/api"'),
+        expression: expect.stringContaining('fetch(\\"/api\\"'),
         timeout: 20_000,
       }),
     );
diff --git a/packages/chrome-extension/src/background/browser-mcp/browser-tools.ts b/packages/chrome-extension/src/background/browser-mcp/browser-tools.ts
index 13870ed24a8..e0320b94722 100644
--- a/packages/chrome-extension/src/background/browser-mcp/browser-tools.ts
+++ b/packages/chrome-extension/src/background/browser-mcp/browser-tools.ts
@@ -21,6 +21,7 @@ const MAX_HEADER_VALUE_CHARS = 1_024;
 const MAX_STACK_FRAMES = 50;
 const MAX_SCREENSHOT_BASE64_CHARS = 8 * 1_048_576;
 const MAX_TEXT_RESULT_CHARS = 1_048_576;
+const TRUNCATED_MARKER = '... [truncated]';
 const EVALUATION_TIMEOUT_MS = 20_000;
 const PAGE_FETCH_TIMEOUT_MS = 15_000;
 const NAVIGATION_TIMEOUT_MS = 10_000;
@@ -144,6 +145,17 @@ function sanitizeText(input: string): string {
       for (const name of url.searchParams.keys()) {
         if (SECRET.test(name)) url.searchParams.set(name, '[REDACTED]');
       }
+      if (url.hash.length > 1) {
+        const fragment = new URLSearchParams(url.hash.slice(1));
+        let redacted = false;
+        for (const name of fragment.keys()) {
+          if (SECRET.test(name)) {
+            fragment.set(name, '[REDACTED]');
+            redacted = true;
+          }
+        }
+        if (redacted) url.hash = fragment.toString();
+      }
       value = url.toString();
     } catch {
       // Keep malformed URLs available for the assignment redactors.
@@ -169,8 +181,7 @@ function sanitizeValue(value: unknown, key?: string): unknown {
 
 function truncateText(value: string, maxChars: number): string {
   if (value.length <= maxChars) return value;
-  const marker = '... [truncated]';
-  return `${value.slice(0, Math.max(0, maxChars - marker.length))}${marker}`;
+  return `${value.slice(0, Math.max(0, maxChars - TRUNCATED_MARKER.length))}${TRUNCATED_MARKER}`;
 }
 
 function compactStack(value: unknown): unknown {
@@ -271,7 +282,11 @@ export const BROWSER_TOOLS: readonly BrowserToolDefinition[] = [
   tool(
     'press_key',
     'Press a keyboard key in the active page.',
-    { key: stringProperty('Key value such as Enter, Escape, or Tab.') },
+    {
+      key: stringProperty(
+        'Special key such as Enter, Escape, or Tab, or one printable character.',
+      ),
+    },
     ['key'],
   ),
   tool('scroll_page', 'Scroll the page by a number of CSS pixels.', {
@@ -551,6 +566,10 @@ export class BrowserTools implements BrowserToolHandler {
     const entry = object(entries[current + offset]);
     if (typeof entry['id'] !== 'number')
       throw new Error('No history entry available');
+    const url = typeof entry['url'] === 'string' ? entry['url'] : '';
+    if (!/^https?:/i.test(url) && url !== 'about:blank') {
+      throw new Error(`Chrome does not allow debugging this page: ${url}`);
+    }
     const generation = this.navigationGeneration;
     await this.session.send('Page.navigateToHistoryEntry', {
       entryId: entry['id'],
@@ -684,15 +703,18 @@ export class BrowserTools implements BrowserToolHandler {
       ArrowRight: { code: 'ArrowRight', keyCode: 39 },
     };
     const mapped = keys[key];
+    if (!mapped) {
+      if ([...key].length !== 1) {
+        throw new Error(`Unsupported key: ${key}`);
+      }
+      await this.session.send('Input.insertText', { text: key });
+      return text(`Pressed ${key}.`);
+    }
     const params = {
       key,
-      ...(mapped
-        ? {
-            code: mapped.code,
-            windowsVirtualKeyCode: mapped.keyCode,
-            nativeVirtualKeyCode: mapped.keyCode,
-          }
-        : {}),
+      code: mapped.code,
+      windowsVirtualKeyCode: mapped.keyCode,
+      nativeVirtualKeyCode: mapped.keyCode,
     };
     await this.session.send('Input.dispatchKeyEvent', {
       type: 'keyDown',
@@ -731,8 +753,22 @@ export class BrowserTools implements BrowserToolHandler {
   }
 
   private async evaluate(expression: string): Promise<BrowserToolResult> {
+    const maxChars = MAX_TEXT_RESULT_CHARS - TRUNCATED_MARKER.length;
     const result = await this.session.send('Runtime.evaluate', {
-      expression,
+      expression: `(async () => {
+        const value = await (0, eval)(${JSON.stringify(expression)});
+        let serialized;
+        try {
+          serialized = JSON.stringify(value);
+        } catch {
+          serialized = String(value);
+        }
+        if (serialized === undefined) serialized = 'undefined';
+        return {
+          text: serialized.slice(0, ${maxChars}),
+          truncated: serialized.length > ${maxChars},
+        };
+      })()`,
       awaitPromise: true,
       returnByValue: true,
       userGesture: true,
@@ -741,7 +777,13 @@ export class BrowserTools implements BrowserToolHandler {
     const exception = result['exceptionDetails'];
     if (exception) throw new Error(this.exceptionText(exception));
     const remote = object(result['result']);
-    return json('value' in remote ? remote['value'] : remote['description']);
+    const value = object(remote['value']);
+    if (typeof value['text'] !== 'string') {
+      return json('value' in remote ? remote['value'] : remote['description']);
+    }
+    return text(
+      `${sanitizeText(value['text'])}${value['truncated'] === true ? TRUNCATED_MARKER : ''}`,
+    );
   }
 
   private getConsole(id: number): BrowserToolResult {
diff --git a/packages/chrome-extension/src/background/browser-mcp/debugger-session.test.ts b/packages/chrome-extension/src/background/browser-mcp/debugger-session.test.ts
index 9a8ff9751d8..040f0b0c4df 100644
--- a/packages/chrome-extension/src/background/browser-mcp/debugger-session.test.ts
+++ b/packages/chrome-extension/src/background/browser-mcp/debugger-session.test.ts
@@ -183,8 +183,15 @@ describe('ChromeDebuggerSession', () => {
     );
 
     await session.withAttached(() => session.send('Runtime.enable'));
+    expect(detach).toHaveBeenCalledWith({ tabId: 7 }, expect.any(Function));
+    expect(attach).toHaveBeenNthCalledWith(
+      2,
+      { tabId: 8 },
+      '1.3',
+      expect.any(Function),
+    );
     expect(sendCommand).toHaveBeenLastCalledWith(
-      { tabId: 7 },
+      { tabId: 8 },
       'Runtime.enable',
       {},
       expect.any(Function),
@@ -192,6 +199,21 @@ describe('ChromeDebuggerSession', () => {
     await session.detach();
   });
 
+  it('rejects a restricted active target before each operation', async () => {
+    query
+      .mockResolvedValueOnce([{ id: 7, url: 'https://one.example' }])
+      .mockResolvedValueOnce([{ id: 7, url: 'chrome://settings' }]);
+    const session = new ChromeDebuggerSession();
+
+    await session.withAttached(() => session.send('Runtime.enable'));
+    await expect(
+      session.withAttached(() => session.send('Runtime.evaluate')),
+    ).rejects.toThrow('does not allow debugging');
+
+    expect(detach).toHaveBeenCalledWith({ tabId: 7 }, expect.any(Function));
+    expect(sendCommand).toHaveBeenCalledTimes(1);
+  });
+
   it('surfaces debugger attachment and command errors', async () => {
     attach.mockImplementationOnce((_target, _version, callback) => {
       runtime.lastError = { message: 'already attached' };
diff --git a/packages/chrome-extension/src/background/browser-mcp/debugger-session.ts b/packages/chrome-extension/src/background/browser-mcp/debugger-session.ts
index dcb5a9f3b24..009db47f47d 100644
--- a/packages/chrome-extension/src/background/browser-mcp/debugger-session.ts
+++ b/packages/chrome-extension/src/background/browser-mcp/debugger-session.ts
@@ -62,7 +62,8 @@ export class ChromeDebuggerSession implements DebuggerSession {
     });
     await previous;
     try {
-      const { tabId } = await this.ensureAttached();
+      if (this.attaching) await this.attaching;
+      const { tabId } = await this.attachActiveTab(this.attachGeneration);
       this.pinnedTabId = tabId;
       return await operation();
     } finally {
diff --git a/packages/cli/src/serve/acp-http/client-mcp-sender-registry.test.ts b/packages/cli/src/serve/acp-http/client-mcp-sender-registry.test.ts
index 16c3e5179e2..c937545bed3 100644
--- a/packages/cli/src/serve/acp-http/client-mcp-sender-registry.test.ts
+++ b/packages/cli/src/serve/acp-http/client-mcp-sender-registry.test.ts
@@ -22,7 +22,7 @@ describe('ClientMcpSenderRegistry', () => {
   it('lookup routes to the registered sender; undefined for unknown server', async () => {
     const reg = new ClientMcpSenderRegistry();
     const sender = vi.fn(async () => msg(1));
-    reg.set('srv', sender, 'connA');
+    expect(reg.claim('srv', sender, 'connA')).toBe(true);
 
     expect(reg.serverNames()).toEqual(['srv']);
     expect(reg.lookup('other')).toBeUndefined();
@@ -33,31 +33,27 @@ describe('ClientMcpSenderRegistry', () => {
     expect(sender).toHaveBeenCalledWith('srv', msg(7));
   });
 
-  it('ownership-scoped delete: a stale owner cannot remove an entry a peer re-registered', () => {
+  it('rejects a duplicate name from another connection', () => {
     const reg = new ClientMcpSenderRegistry();
     const senderA = vi.fn(async () => msg(1));
     const senderB = vi.fn(async () => msg(2));
 
-    // A registers, then B re-registers the same name (last-writer-wins + takes
-    // ownership — the regression: A's later teardown must not delete B's entry).
-    reg.set('srv', senderA, 'connA');
-    reg.set('srv', senderB, 'connB');
-
-    reg.delete('srv', 'connA'); // A disconnects — must be a no-op now
-    expect(reg.serverNames()).toEqual(['srv']);
+    expect(reg.claim('srv', senderA, 'connA')).toBe(true);
+    expect(reg.claim('srv', senderB, 'connB')).toBe(false);
 
     reg.lookup('srv')!(msg(9));
-    expect(senderB).toHaveBeenCalledWith('srv', msg(9));
-    expect(senderA).not.toHaveBeenCalled();
+    expect(senderA).toHaveBeenCalledWith('srv', msg(9));
+    expect(senderB).not.toHaveBeenCalled();
 
-    reg.delete('srv', 'connB'); // the real owner removes it
+    reg.delete('srv', 'connB');
+    expect(reg.serverNames()).toEqual(['srv']);
+    reg.delete('srv', 'connA');
     expect(reg.serverNames()).toEqual([]);
-    expect(reg.lookup('srv')).toBeUndefined();
   });
 
   it('delete is idempotent and a no-op for an unknown name', () => {
     const reg = new ClientMcpSenderRegistry();
-    reg.set(
+    reg.claim(
       'srv',
       vi.fn(async () => msg(1)),
       'connA',
@@ -70,7 +66,7 @@ describe('ClientMcpSenderRegistry', () => {
 
   it('exposes live registrations for ACP child recovery', () => {
     const reg = new ClientMcpSenderRegistry();
-    reg.set(
+    reg.claim(
       'qwen-browser-tools',
       vi.fn(async () => msg(1)),
       'extension-client',
@@ -174,10 +170,36 @@ describe('createClientMcpServerProvider', () => {
     expect(order).toEqual(['preheat', 'add']);
   });
 
+  it('rejects a name owned by another connection without mutating the child', async () => {
+    const registry = new ClientMcpSenderRegistry();
+    const bridge = setupBridge({ toolCount: 1 });
+    registry.claim(
+      'srv',
+      vi.fn(async () => msg(2)),
+      'connB',
+    );
+    const provider = createClientMcpServerProvider(registry, bridge, 'connA');
+
+    await expect(
+      provider.registerClientMcpServer(
+        'srv',
+        vi.fn(async () => msg(1)),
+      ),
+    ).rejects.toThrow(/already registered/);
+
+    expect(bridge.addRuntimeMcpServer).not.toHaveBeenCalled();
+    expect(registry.runtimeRegistrations()).toEqual([
+      expect.objectContaining({
+        name: 'srv',
+        originatorClientId: 'connB',
+      }),
+    ]);
+  });
+
   it('does not unregister a server now owned by another connection', async () => {
     const registry = new ClientMcpSenderRegistry();
     const bridge = setupBridge({ toolCount: 1 });
-    registry.set(
+    registry.claim(
       'srv',
       vi.fn(async () => msg(2)),
       'connB',
diff --git a/packages/cli/src/serve/acp-http/client-mcp-sender-registry.ts b/packages/cli/src/serve/acp-http/client-mcp-sender-registry.ts
index fa85455575f..be5541996f5 100644
--- a/packages/cli/src/serve/acp-http/client-mcp-sender-registry.ts
+++ b/packages/cli/src/serve/acp-http/client-mcp-sender-registry.ts
@@ -31,7 +31,7 @@
  *
  * Wire (full round-trip):
  *   extension --WS--> daemon: mcp_register{server}
- *   provider: registry.set(server, wsRegistrar.sendSdkMcpMessage)
+ *   provider: registry.claim(server, wsRegistrar.sendSdkMcpMessage)
  *   provider: bridge.addRuntimeMcpServer(server, {type:'sdk', __clientMcpOverWs}, clientId)
  *     -> parent->child ext: workspaceMcpRuntimeAdd
  *     -> child: addRuntimeMcpServer(sdk-type) -> SdkControlClientTransport
@@ -72,17 +72,13 @@ function runtimeConfig(): ClientMcpOverWsRuntimeConfig {
  * by the bridge (read side, via {@link ClientMcpSenderRegistry.lookup}) and the
  * WS provider (write side).
  *
- * Server names are unique per daemon: the WS layer rejects a second
- * `mcp_register` for a name on the same connection (`already_registered`), and
- * the bridge's `addRuntimeMcpServer` reconciles a cross-connection collision by
- * replacing the runtime server. `set` therefore last-writer-wins; the matching
- * `addRuntimeMcpServer` already tore down the prior server's transport.
+ * Server names are unique per daemon. The WS layer rejects a second
+ * `mcp_register` on the same connection, and `claim` rejects a duplicate from
+ * another connection before either registration can mutate the ACP child.
  *
  * Each entry remembers its OWNER (the registering connection's stable client
- * id). `delete` is ownership-scoped: a disconnecting connection only removes
- * the entry if it still owns it. Otherwise connection A's teardown could delete
- * a same-named entry that connection B re-registered after A — silently
- * breaking B's live tools.
+ * id). `delete` is ownership-scoped so one connection cannot remove another
+ * connection's live tools.
  */
 export class ClientMcpSenderRegistry {
   private readonly senders = new Map<
@@ -91,18 +87,18 @@ export class ClientMcpSenderRegistry {
   >();
 
   /**
-   * Record a server's WS sender, owned by `owner` (the registering
-   * connection's stable client id). Idempotent; last writer wins and takes
-   * ownership, so the new owner's `delete` is the one that takes effect.
+   * Atomically reserve a server name for one WS connection.
    */
-  set(serverName: string, sender: WsClientMcpSender, owner: string): void {
+  claim(serverName: string, sender: WsClientMcpSender, owner: string): boolean {
+    if (this.senders.has(serverName)) return false;
     this.senders.set(serverName, { sender, owner });
+    return true;
   }
 
   /**
    * Forget a server's WS sender — but only when `owner` still owns the entry.
-   * Idempotent. The ownership guard stops a disconnecting connection from
-   * clobbering an entry a later connection re-registered under the same name.
+   * Idempotent. The ownership guard stops a connection from clobbering a
+   * same-named entry owned by a peer.
    */
   delete(serverName: string, owner: string): void {
     if (this.senders.get(serverName)?.owner === owner) {
@@ -193,9 +189,13 @@ export function createClientMcpServerProvider(
       await bridge.preheat();
       // Record the sender FIRST so the child's discovery handshake — which the
       // bridge add triggers synchronously — can route `client_mcp/message`
-      // frames back to this WS. Owned by this connection's client id so a peer
-      // re-registering the same name can't be deleted by our teardown.
-      registry.set(serverName, sendSdkMcpMessage, originatorClientId);
+      // frames back to this WS. The atomic claim also prevents concurrent
+      // connections from mutating the same child-side runtime server.
+      if (!registry.claim(serverName, sendSdkMcpMessage, originatorClientId)) {
+        throw new Error(
+          `client MCP server '${serverName}' is already registered`,
+        );
+      }
       try {
         const result = await bridge.addRuntimeMcpServer(
           serverName,
@@ -229,10 +229,7 @@ export function createClientMcpServerProvider(
       }
     },
     async unregisterClientMcpServer(serverName) {
-      // Only tear down if THIS connection still owns the route. A later
-      // connection may have re-registered the same name (last-writer-wins), and
-      // `Config.removeRuntimeMcpServer` is NOT owner-scoped — removing the
-      // child server by name alone would kill the newer owner's live tools.
+      // Only tear down if THIS connection still owns the route.
       if (!registry.owns(serverName, originatorClientId)) return;
       registry.delete(serverName, originatorClientId);
       // Best-effort: drop the child-side runtime server too. Idempotent on the
diff --git a/packages/cli/src/serve/acp-http/dispatch.ts b/packages/cli/src/serve/acp-http/dispatch.ts
index f60bb7ceffb..38aa621d70b 100644
--- a/packages/cli/src/serve/acp-http/dispatch.ts
+++ b/packages/cli/src/serve/acp-http/dispatch.ts
@@ -141,6 +141,7 @@ function errMsg(err: unknown): string {
 }
 
 const debugLogger = createDebugLogger('ACP_HTTP_DISPATCH');
+const CHROME_EXTENSION_SESSION_SOURCE_ID = 'chrome_extension';
 
 type PermissionResponse = Parameters<
   HttpAcpBridge['respondToSessionPermission']
@@ -1097,6 +1098,21 @@ export class AcpDispatcher {
             }
             return;
           }
+          if (
+            source.sourceType === CHROME_EXTENSION_SESSION_SOURCE_ID ||
+            source.sourceId === CHROME_EXTENSION_SESSION_SOURCE_ID
+          ) {
+            if (id !== undefined) {
+              conn.sendConn(
+                error(
+                  id,
+                  RPC.INVALID_PARAMS,
+                  '`chrome_extension` is reserved session metadata',
+                ),
+              );
+            }
+            return;
+          }
           // ACP standard: session/new MUST create a new isolated session.
           // Always use sessionScope 'thread' regardless of client params.
           // The REST surface (POST /session) supports 'single' for
@@ -1184,6 +1200,23 @@ export class AcpDispatcher {
               const metadata = await new SessionService(
                 cwd,
               ).readCreationMetadata(sessionId);
+              let source = metadata;
+              try {
+                source = {
+                  ...metadata,
+                  ...this.bridge.getSessionSummary(sessionId),
+                };
+              } catch {
+                // A persisted session has no live summary until restore.
+              }
+              if (
+                source.sourceType === CHROME_EXTENSION_SESSION_SOURCE_ID ||
+                source.sourceId === CHROME_EXTENSION_SESSION_SOURCE_ID
+              ) {
+                throw new AcpParamError(
+                  'Chrome extension sessions can only be restored by the paired extension',
+                );
+              }
               return method === 'session/load'
                 ? await this.bridge.loadSession({
                     sessionId,
diff --git a/packages/cli/src/serve/acp-http/index.ts b/packages/cli/src/serve/acp-http/index.ts
index 1f61309b619..5781a1b525b 100644
--- a/packages/cli/src/serve/acp-http/index.ts
+++ b/packages/cli/src/serve/acp-http/index.ts
@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { createHash, timingSafeEqual } from 'node:crypto';
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import type { IncomingMessage } from 'node:http';
 import type { Duplex } from 'node:stream';
 import type { Application, Request, Response } from 'express';
@@ -202,6 +202,7 @@ function delay(ms: number): Promise<void> {
 function buildChromeDevToolsMcpRuntimeConfig(
   localPort: number | undefined,
   hostname: string | undefined,
+  accessToken: string,
 ): Record<string, unknown> | undefined {
   if (
     localPort === undefined ||
@@ -221,7 +222,7 @@ function buildChromeDevToolsMcpRuntimeConfig(
     command,
     args: [
       '--wsEndpoint',
-      `ws://${formatCdpEndpointHost(hostname)}:${localPort}/cdp`,
+      `ws://${formatCdpEndpointHost(hostname)}:${localPort}/cdp?access_token=${encodeURIComponent(accessToken)}`,
     ],
     alwaysLoadTools: true,
     [RUNTIME_MCP_IF_ABSENT_CONFIG_FLAG]: true,
@@ -580,6 +581,10 @@ export function mountAcpHttp(
   if (!enabled) return undefined;
 
   const path = opts.path ?? '/acp';
+  const cdpTunnelAccessToken = randomBytes(32).toString('base64url');
+  const expectedCdpTunnelAccessTokenHash = createHash('sha256')
+    .update(cdpTunnelAccessToken)
+    .digest();
   const dispatcherRef: { current?: AcpDispatcher } = {};
   // Lifecycle gate: once `dispose()` runs, late/in-flight HTTP requests get a
   // 503 instead of racing torn-down registries (issue #6378 daemon shutdown).
@@ -693,6 +698,7 @@ export function mountAcpHttp(
     const runtimeConfig = buildChromeDevToolsMcpRuntimeConfig(
       localPort,
       opts.hostname,
+      cdpTunnelAccessToken,
     );
     if (!runtimeConfig) {
       cdpMcpTerminalSkipLogged = true;
@@ -1525,6 +1531,27 @@ export function mountAcpHttp(
 
       // ── /cdp branch: hand the upgraded socket to the CDP-tunnel glue ──
       if (isCdpPath) {
+        const accessToken = new URL(
+          req.url ?? '',
+          'ws://127.0.0.1',
+        ).searchParams.get('access_token');
+        const actualAccessTokenHash = accessToken
+          ? createHash('sha256').update(accessToken).digest()
+          : undefined;
+        if (
+          !actualAccessTokenHash ||
+          actualAccessTokenHash.length !==
+            expectedCdpTunnelAccessTokenHash.length ||
+          !timingSafeEqual(
+            expectedCdpTunnelAccessTokenHash,
+            actualAccessTokenHash,
+          )
+        ) {
+          logReject('cdp-access-token-mismatch');
+          socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
+          socket.destroy();
+          return;
+        }
         wss!.handleUpgrade(req, socket, head, (ws: WebSocket) => {
           if (disposed) {
             ws.close(1012, 'Server shutting down');
@@ -2052,7 +2079,6 @@ export function mountAcpHttp(
                 ? clientInfo['name']
                 : undefined;
             const requiresExtensionPairing =
-              opts.clientMcpOverWs === true &&
               clientName === CDP_BRIDGE_CLIENT_NAME;
             if (requiresExtensionPairing) {
               clientMcpAuthorized =
diff --git a/packages/cli/src/serve/acp-http/transport.test.ts b/packages/cli/src/serve/acp-http/transport.test.ts
index 1e697d6d356..de5b6835515 100644
--- a/packages/cli/src/serve/acp-http/transport.test.ts
+++ b/packages/cli/src/serve/acp-http/transport.test.ts
@@ -3205,6 +3205,37 @@ describe('ACP Streamable HTTP transport (over the wire)', () => {
     await sess.body?.cancel(); // release the long-lived SSE socket
   });
 
+  it('session/load rejects a persisted Chrome extension session', async () => {
+    await withRuntimeDir(async () => {
+      await writeStoredSession(
+        'extension-session',
+        'active',
+        undefined,
+        'default',
+        'chrome_extension',
+      );
+      const connId = await initialize();
+      const connStream = await openStream(connId);
+      const got = takeFrames(connStream, 1);
+      await new Promise((r) => setTimeout(r, 50));
+
+      await post(connId, {
+        jsonrpc: '2.0',
+        id: 21,
+        method: 'session/load',
+        params: { sessionId: 'extension-session' },
+      });
+
+      const [frame] = (await got) as Array<{
+        id: number;
+        error: { code: number; message: string };
+      }>;
+      expect(frame.id).toBe(21);
+      expect(frame.error.code).toBe(-32602);
+      expect(frame.error.message).toContain('paired extension');
+    });
+  });
+
   it('session/load reports partial replay status under qwen _meta', async () => {
     bridge.loadState = {
       replayed: true,
@@ -4496,6 +4527,28 @@ describe('ACP Streamable HTTP transport (over the wire)', () => {
     expect(bridge.lastSpawnScope).toBe('thread');
   });
 
+  it('session/new rejects reserved Chrome extension source metadata', async () => {
+    const connId = await initialize();
+    const connStream = await openStream(connId);
+    const got = takeFrames(connStream, 1);
+    await new Promise((r) => setTimeout(r, 50));
+
+    await post(connId, {
+      jsonrpc: '2.0',
+      id: 45,
+      method: 'session/new',
+      params: { sourceType: 'default', sourceId: 'chrome_extension' },
+    });
+
+    const [frame] = (await got) as Array<{
+      id: number;
+      error: { code: number; message: string };
+    }>;
+    expect(frame.id).toBe(45);
+    expect(frame.error.code).toBe(-32602);
+    expect(frame.error.message).toContain('reserved session metadata');
+  });
+
   it('session/prompt with empty prompt → INVALID_PARAMS', async () => {
     const connId = await initialize();
     await newSession(connId);
@@ -8020,6 +8073,9 @@ describe('ACP WebSocket transport security', () => {
           ? {
               cdpTunnelOverWs: true,
               cdpTunnelRegistry: new CdpTunnelRegistry(),
+              verifyExtensionPairingCredential: (
+                credential: string | undefined,
+              ) => credential === 'paired',
             }
           : {}),
       });
@@ -8058,6 +8114,19 @@ describe('ACP WebSocket transport security', () => {
     });
   }
 
+  function wsConnectUrl(
+    url: string,
+  ): Promise<{ code: number; ws?: WebSocket }> {
+    return new Promise((resolve) => {
+      const ws = new WebSocket(url, { handshakeTimeout: 2000 });
+      ws.once('open', () => resolve({ code: 101, ws }));
+      ws.once('unexpected-response', (_req, res) => {
+        resolve({ code: res.statusCode ?? 0 });
+      });
+      ws.once('error', () => resolve({ code: 0 }));
+    });
+  }
+
   function wsConnectRaw(
     host: string,
     origin?: string,
@@ -8088,13 +8157,21 @@ describe('ACP WebSocket transport security', () => {
     });
   }
 
-  function initializeCdpBridge(ws: WebSocket, id = 1): Promise<unknown> {
+  function initializeCdpBridge(
+    ws: WebSocket,
+    id = 1,
+    extensionPairingCredential: string | undefined = 'paired',
+  ): Promise<unknown> {
     return sendRpc(ws, {
       jsonrpc: '2.0',
       id,
       method: 'initialize',
       params: {
-        clientInfo: { name: 'qwen-cdp-bridge', version: '1.0.0' },
+        clientInfo: {
+          name: 'qwen-cdp-bridge',
+          version: '1.0.0',
+          ...(extensionPairingCredential ? { extensionPairingCredential } : {}),
+        },
       },
     });
   }
@@ -8159,6 +8236,20 @@ describe('ACP WebSocket transport security', () => {
     await new Promise<void>((resolve) => ws.once('close', () => resolve()));
   });
 
+  it('requires pairing before a Chrome bridge can claim the CDP tunnel', async () => {
+    await startServer({ cdpTunnelOverWs: true });
+    const ws = await wsConnect();
+    const closed = new Promise<void>((resolve) =>
+      ws.once('close', () => resolve()),
+    );
+
+    await expect(initializeCdpBridge(ws, 1, '')).resolves.toMatchObject({
+      error: { message: 'Chrome extension is not paired with this daemon' },
+    });
+
+    await closed;
+  });
+
   it('treats a whitespace-only CDP MCP command as unset', async () => {
     process.env['QWEN_CDP_MCP_COMMAND'] = '   ';
     stdioMocks.writeStderrLine.mockClear();
@@ -8191,9 +8282,27 @@ describe('ACP WebSocket transport security', () => {
       command: process.execPath,
       args: expect.arrayContaining([
         '--wsEndpoint',
-        `ws://127.0.0.1:${port}/cdp`,
+        expect.stringMatching(
+          new RegExp(`^ws://127\\.0\\.0\\.1:${port}/cdp\\?access_token=`),
+        ),
       ]),
     });
+    const runtimeArgs = bridge.runtimeMcpAdds[0]?.config['args'];
+    const endpoint = Array.isArray(runtimeArgs)
+      ? runtimeArgs[runtimeArgs.indexOf('--wsEndpoint') + 1]
+      : undefined;
+    expect(endpoint).toEqual(expect.any(String));
+
+    const unpairedCdp = await wsConnectUrl(`ws://127.0.0.1:${port}/cdp`);
+    expect(unpairedCdp.code).toBe(401);
+    const pairedCdp = await wsConnectUrl(String(endpoint));
+    expect(pairedCdp.code).toBe(101);
+    const cdpSocket = pairedCdp.ws;
+    if (!cdpSocket) throw new Error('Expected an upgraded CDP connection');
+    cdpSocket.close();
+    await new Promise<void>((resolve) =>
+      cdpSocket.once('close', () => resolve()),
+    );
 
     ws.close();
     await new Promise<void>((resolve) => ws.once('close', () => resolve()));
diff --git a/packages/cli/src/serve/extension-pairing.test.ts b/packages/cli/src/serve/extension-pairing.test.ts
index f952c7990d7..cbf6101710e 100644
--- a/packages/cli/src/serve/extension-pairing.test.ts
+++ b/packages/cli/src/serve/extension-pairing.test.ts
@@ -75,8 +75,8 @@ describe('createExtensionPairingManager', () => {
     expect(manager.verifyCredential('anything')).toBe(false);
   });
 
-  it('locks pairing after repeated invalid proofs', () => {
-    let now = 1_000;
+  it('throttles invalid proofs without blocking a valid proof', () => {
+    const now = 1_000;
     const manager = createExtensionPairingManager({
       now: () => now,
       randomBytes: (size) => Buffer.alloc(size, 2),
@@ -89,16 +89,11 @@ describe('createExtensionPairingManager', () => {
         error: 'invalid_proof',
       });
     }
-    expect(manager.confirm(pairingRequest(manager))).toEqual({
-      ok: false,
-      error: 'too_many_attempts',
-    });
-
-    now += 60_000;
     expect(manager.confirm(invalidRequest)).toEqual({
       ok: false,
-      error: 'invalid_proof',
+      error: 'too_many_attempts',
     });
+    expect(manager.confirm(pairingRequest(manager)).ok).toBe(true);
   });
 
   it('rejects expired pairing material and rotates its nonce', () => {
diff --git a/packages/cli/src/serve/extension-pairing.ts b/packages/cli/src/serve/extension-pairing.ts
index efbfbdcfbe7..b60b53b2725 100644
--- a/packages/cli/src/serve/extension-pairing.ts
+++ b/packages/cli/src/serve/extension-pairing.ts
@@ -149,10 +149,6 @@ export function createExtensionPairingManager(
         failedAttempts = 0;
         failedAttemptWindowStartedAt = currentTime;
       }
-      if (failedAttempts >= MAX_FAILED_ATTEMPTS) {
-        return { ok: false, error: 'too_many_attempts' };
-      }
-
       const submittedProof = decodeProof(request.clientProof);
       const codeKey = hash(code);
       const expectedProof = hmac(
@@ -165,6 +161,9 @@ export function createExtensionPairingManager(
         !submittedProof ||
         !timingSafeEqual(expectedProof, submittedProof)
       ) {
+        if (failedAttempts >= MAX_FAILED_ATTEMPTS) {
+          return { ok: false, error: 'too_many_attempts' };
+        }
         failedAttempts += 1;
         return { ok: false, error: 'invalid_proof' };
       }
diff --git a/packages/cli/src/serve/routes/session.ts b/packages/cli/src/serve/routes/session.ts
index 91df4fe1694..e69f44b02ff 100644
--- a/packages/cli/src/serve/routes/session.ts
+++ b/packages/cli/src/serve/routes/session.ts
@@ -105,6 +105,16 @@ interface RegisterSessionRoutesDeps {
 const WEB_SHELL_SESSION_SOURCE = 'default';
 const CHROME_EXTENSION_SESSION_SOURCE_ID = 'chrome_extension';
 
+function isChromeExtensionSessionSource(source: {
+  sourceType?: string;
+  sourceId?: string;
+}): boolean {
+  return (
+    source.sourceType === CHROME_EXTENSION_SESSION_SOURCE_ID ||
+    source.sourceId === CHROME_EXTENSION_SESSION_SOURCE_ID
+  );
+}
+
 const WORKSPACE_TRANSCRIPT_PAGE_SOURCE_MAX_BYTES = 4 * 1024 * 1024;
 const WORKSPACE_TRANSCRIPT_RESPONSE_MAX_BYTES = 32 * 1024 * 1024;
 const WORKSPACE_TRANSCRIPT_CURSOR_MAX_BYTES = 64 * 1024;
@@ -1307,6 +1317,30 @@ export function registerSessionRoutes(
         return;
       }
       try {
+        const sessionService = new SessionService(workspaceCwd);
+        const metadata = await sessionService.readCreationMetadata(sessionId);
+        let source = metadata;
+        try {
+          source = {
+            ...metadata,
+            ...runtime.bridge.getSessionSummary(sessionId),
+          };
+        } catch {
+          // A persisted session has no live summary until restore succeeds.
+        }
+        if (isChromeExtensionSessionSource(source)) {
+          const credential = body['extensionPairingCredential'];
+          if (
+            typeof credential !== 'string' ||
+            deps.verifyExtensionPairingCredential?.(credential) !== true
+          ) {
+            res.status(401).json({
+              error: 'Chrome extension pairing credential rejected',
+              code: 'extension_pairing_rejected',
+            });
+            return;
+          }
+        }
         const session = await archiveCoordinator.runSharedMany(
           [sessionId],
           async () => {
@@ -1314,9 +1348,6 @@ export function registerSessionRoutes(
             // Recover the persisted parent lineage so the restored live entry
             // reports it (the bridge otherwise creates the entry without it, and
             // status calls would show a restored sub-session as top-level).
-            const metadata = await new SessionService(
-              workspaceCwd,
-            ).readCreationMetadata(sessionId);
             return action === 'load'
               ? await runtime.bridge.loadSession({
                   sessionId,
diff --git a/packages/cli/src/serve/server.test.ts b/packages/cli/src/serve/server.test.ts
index f02b534954d..2603b5d4e10 100644
--- a/packages/cli/src/serve/server.test.ts
+++ b/packages/cli/src/serve/server.test.ts
@@ -8125,6 +8125,43 @@ describe('createServeApp', () => {
   });
 
   describe('POST /session/:id/load and /resume', () => {
+    it.each(['load', 'resume'] as const)(
+      'requires pairing to %s a live Chrome extension session',
+      async (action) => {
+        const bridge = fakeBridge({
+          summaryImpl: (sessionId) => ({
+            sessionId,
+            workspaceCwd: WS_BOUND,
+            sourceType: 'default',
+            sourceId: 'chrome_extension',
+          }),
+        });
+        const app = createServeApp(
+          {
+            ...baseOpts,
+            workspace: WS_BOUND,
+            verifyExtensionPairingCredential: (credential) =>
+              credential === 'paired-credential',
+          },
+          undefined,
+          { bridge },
+        );
+
+        const rejected = await request(app)
+          .post(`/session/extension-session/${action}`)
+          .set('Host', `127.0.0.1:${baseOpts.port}`)
+          .send({});
+        expect(rejected.status).toBe(401);
+        expect(rejected.body.code).toBe('extension_pairing_rejected');
+
+        const accepted = await request(app)
+          .post(`/session/extension-session/${action}`)
+          .set('Host', `127.0.0.1:${baseOpts.port}`)
+          .send({ extensionPairingCredential: 'paired-credential' });
+        expect(accepted.status).toBe(200);
+      },
+    );
+
     it('falls back to bound workspace and uses the route session id', async () => {
       for (const action of ['load', 'resume'] as const) {
         const bridge = fakeBridge();
diff --git a/packages/sdk-typescript/src/daemon/DaemonClient.ts b/packages/sdk-typescript/src/daemon/DaemonClient.ts
index a0d4534c3e0..8eeb5368583 100644
--- a/packages/sdk-typescript/src/daemon/DaemonClient.ts
+++ b/packages/sdk-typescript/src/daemon/DaemonClient.ts
@@ -455,6 +455,8 @@ export interface RestoreSessionRequest {
    */
   workspaceCwd?: string;
   approvalMode?: string;
+  /** Pairing credential required when restoring a Chrome extension session. */
+  extensionPairingCredential?: string;
 }
 
 export interface PromptRequest {
@@ -1921,27 +1923,13 @@ export class DaemonClient {
         body: JSON.stringify({
           cwd: req.workspaceCwd,
           ...(req.modelServiceId ? { modelServiceId: req.modelServiceId } : {}),
-          // `!== undefined` (not truthy) so a buggy caller passing
-          // `sessionScope: '' | null` doesn't get the field silently
-          // erased on the wire — let the daemon's `400
-          // invalid_session_scope` surface the bug. Same shape the
-          // bridge's own validation uses (`httpAcpBridge.ts:
-          // spawnOrAttach`); SDK should be a transparent layer here.
-          ...(req.sessionScope !== undefined
-            ? { sessionScope: req.sessionScope }
-            : {}),
-          ...(req.approvalMode !== undefined
-            ? { approvalMode: req.approvalMode }
-            : {}),
-          ...(req.sourceType !== undefined
-            ? { sourceType: req.sourceType }
-            : {}),
-          ...(req.sourceId !== undefined ? { sourceId: req.sourceId } : {}),
-          ...(req.extensionPairingCredential !== undefined
-            ? {
-                extensionPairingCredential: req.extensionPairingCredential,
-              }
-            : {}),
+          // JSON.stringify omits undefined while preserving malformed values
+          // such as null or '', so daemon validation still sees caller bugs.
+          sessionScope: req.sessionScope,
+          approvalMode: req.approvalMode,
+          sourceType: req.sourceType,
+          sourceId: req.sourceId,
+          extensionPairingCredential: req.extensionPairingCredential,
         }),
       },
       async (res) => {
@@ -2353,9 +2341,8 @@ export class DaemonClient {
         headers: this.headers({ 'Content-Type': 'application/json' }, clientId),
         body: JSON.stringify({
           cwd: req.workspaceCwd,
-          ...(req.approvalMode !== undefined
-            ? { approvalMode: req.approvalMode }
-            : {}),
+          approvalMode: req.approvalMode,
+          extensionPairingCredential: req.extensionPairingCredential,
         }),
       },
       async (res) => {
diff --git a/packages/sdk-typescript/src/daemon/DaemonSessionClient.ts b/packages/sdk-typescript/src/daemon/DaemonSessionClient.ts
index 3220ce5f1b3..76a5837eaa7 100644
--- a/packages/sdk-typescript/src/daemon/DaemonSessionClient.ts
+++ b/packages/sdk-typescript/src/daemon/DaemonSessionClient.ts
@@ -70,6 +70,8 @@ export interface DaemonSessionClientOptions {
   lastEventId?: number;
   /** Compacted replay snapshot from daemon load response. */
   replaySnapshot?: DaemonReplaySnapshot;
+  /** Original request fields retained for an automatic session reattach. */
+  restore?: RestoreSessionRequest;
   /**
    * Local per-session prompt cap. The counter is shared with the parent
    * `DaemonClient`; other session clients using the same parent instance
@@ -110,6 +112,7 @@ export class DaemonSessionClient {
   /** In-flight `reattach()` so concurrent prompts re-register only once. */
   private reattaching?: Promise<void>;
   private readonly promptLimit: number;
+  private readonly restore: RestoreSessionRequest | undefined;
   private readonly _pendingPrompts = new Map<
     string,
     {
@@ -128,6 +131,7 @@ export class DaemonSessionClient {
       liveJournal: [],
     };
     this.lastSeenEventId = validateLastEventId(opts.lastEventId);
+    this.restore = opts.restore;
     this.promptLimit =
       opts.maxPendingPromptsPerSession === undefined
         ? opts.client.maxPendingPromptsPerSession
@@ -178,6 +182,7 @@ export class DaemonSessionClient {
       client,
       session,
       hasActivePrompt: session.hasActivePrompt,
+      restore: req,
       lastEventId,
     });
   }
@@ -206,6 +211,7 @@ export class DaemonSessionClient {
       session,
       hasActivePrompt,
       state,
+      restore: req,
       lastEventId: serverLastEventId ?? 0,
       replaySnapshot: {
         compactedReplay: compactedReplay ?? [],
@@ -237,6 +243,7 @@ export class DaemonSessionClient {
       session,
       hasActivePrompt,
       state,
+      restore: req,
       lastEventId: serverLastEventId ?? 0,
     });
   }
@@ -388,7 +395,10 @@ export class DaemonSessionClient {
     // restore path resolves the workspace key before its existing-session fast
     // path, and that resolution rejects a missing/relative path.
     this.reattaching = this.client
-      .resumeSession(this.sessionId, { workspaceCwd: this.workspaceCwd })
+      .resumeSession(this.sessionId, {
+        ...this.restore,
+        workspaceCwd: this.workspaceCwd,
+      })
       .then((session) => {
         // Refresh only the clientId; leave the SSE cursor and ACP state intact.
         this.session.clientId = session.clientId;
diff --git a/packages/sdk-typescript/test/unit/DaemonClient.test.ts b/packages/sdk-typescript/test/unit/DaemonClient.test.ts
index 8deb0152b43..9b0bb01dd72 100644
--- a/packages/sdk-typescript/test/unit/DaemonClient.test.ts
+++ b/packages/sdk-typescript/test/unit/DaemonClient.test.ts
@@ -2164,12 +2164,16 @@ describe('DaemonClient', () => {
       const client = new DaemonClient({ baseUrl: 'http://daemon', fetch });
       const session = await client.loadSession('s-1', {
         workspaceCwd: '/work/a',
+        extensionPairingCredential: 'paired-credential',
       });
 
       expect(session.state).toEqual({ configOptions: [] });
       expect(calls[0]?.url).toBe('http://daemon/session/s-1/load');
       expect(calls[0]?.method).toBe('POST');
-      expect(JSON.parse(calls[0]!.body!)).toEqual({ cwd: '/work/a' });
+      expect(JSON.parse(calls[0]!.body!)).toEqual({
+        cwd: '/work/a',
+        extensionPairingCredential: 'paired-credential',
+      });
     });
 
     it('sends client identity headers on restore requests', async () => {
diff --git a/packages/sdk-typescript/test/unit/DaemonSessionClient.test.ts b/packages/sdk-typescript/test/unit/DaemonSessionClient.test.ts
index 63f82710ed7..289b7df0015 100644
--- a/packages/sdk-typescript/test/unit/DaemonSessionClient.test.ts
+++ b/packages/sdk-typescript/test/unit/DaemonSessionClient.test.ts
@@ -1565,7 +1565,10 @@ describe('DaemonSessionClient clientId self-heal', () => {
     });
   }
 
-  function newSession(client: DaemonClient): DaemonSessionClient {
+  function newSession(
+    client: DaemonClient,
+    extensionPairingCredential?: string,
+  ): DaemonSessionClient {
     return new DaemonSessionClient({
       client,
       session: {
@@ -1574,6 +1577,7 @@ describe('DaemonSessionClient clientId self-heal', () => {
         attached: true,
         clientId: 'client-1',
       },
+      restore: { extensionPairingCredential },
       maxPendingPromptsPerSession: 10,
     });
   }
@@ -1600,7 +1604,7 @@ describe('DaemonSessionClient clientId self-heal', () => {
       return jsonResponse(500, { error: `unexpected ${req.url}` });
     });
     const client = new DaemonClient({ baseUrl: 'http://daemon', fetch });
-    const session = newSession(client);
+    const session = newSession(client, 'paired-credential');
 
     await expect(
       session.prompt({ prompt: [{ type: 'text', text: 'hi' }] }),
@@ -1618,7 +1622,12 @@ describe('DaemonSessionClient clientId self-heal', () => {
     // resume re-registers without sending the stale clientId.
     const resumeReq = calls.find((c) => c.url.endsWith('/session/s-1/resume'));
     expect(resumeReq?.headers['x-qwen-client-id']).toBeUndefined();
-    expect(resumeReq?.body).toBe(JSON.stringify({ cwd: '/work/a' }));
+    expect(resumeReq?.body).toBe(
+      JSON.stringify({
+        cwd: '/work/a',
+        extensionPairingCredential: 'paired-credential',
+      }),
+    );
   });
 
   it('re-registers and retries once on the non-blocking prompt path', async () => {
diff --git a/packages/web-shell/client/components/WorkspaceSessionProvider.test.tsx b/packages/web-shell/client/components/WorkspaceSessionProvider.test.tsx
new file mode 100644
index 00000000000..c6f7381d42d
--- /dev/null
+++ b/packages/web-shell/client/components/WorkspaceSessionProvider.test.tsx
@@ -0,0 +1,75 @@
+// @vitest-environment jsdom
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { act } from 'react';
+import { createRoot, type Root } from 'react-dom/client';
+
+const sessionProviderProps: Array<Record<string, unknown>> = [];
+
+vi.mock('@qwen-code/webui/daemon-react-sdk', async () => {
+  const React = await import('react');
+  return {
+    DaemonSessionProvider: ({
+      children,
+      ...props
+    }: {
+      children: React.ReactNode;
+    }) => {
+      sessionProviderProps.push(props);
+      return React.createElement(React.Fragment, null, children);
+    },
+    useWorkspace: () => ({
+      capabilities: {
+        workspaceCwd: '/workspace',
+        workspaces: [{ id: 'primary', cwd: '/workspace', primary: true }],
+      },
+    }),
+    useWorkspaceActions: () => ({ addWorkspace: vi.fn() }),
+  };
+});
+
+vi.mock('../App', async () => {
+  const React = await import('react');
+  return {
+    App: () => React.createElement('div'),
+  };
+});
+
+const { WorkspaceSessionProvider } = await import('./WorkspaceSessionProvider');
+
+(
+  globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }
+).IS_REACT_ACT_ENVIRONMENT = true;
+
+let root: Root | undefined;
+let container: HTMLElement | undefined;
+
+afterEach(() => {
+  if (root) act(() => root?.unmount());
+  container?.remove();
+  root = undefined;
+  container = undefined;
+  sessionProviderProps.length = 0;
+});
+
+describe('WorkspaceSessionProvider', () => {
+  it('forwards the extension pairing credential when creating a session', () => {
+    container = document.createElement('div');
+    document.body.appendChild(container);
+    root = createRoot(container);
+
+    act(() => {
+      root?.render(
+        <WorkspaceSessionProvider
+          extensionPairingCredential="paired-credential"
+          webShellProps={{}}
+        />,
+      );
+    });
+
+    expect(sessionProviderProps[0]).toMatchObject({
+      createSessionRequest: {
+        extensionPairingCredential: 'paired-credential',
+      },
+    });
+  });
+});
diff --git a/packages/webui/src/daemon/session/DaemonSessionProvider.test.tsx b/packages/webui/src/daemon/session/DaemonSessionProvider.test.tsx
index b61d7f1ee55..c0561f41fa0 100644
--- a/packages/webui/src/daemon/session/DaemonSessionProvider.test.tsx
+++ b/packages/webui/src/daemon/session/DaemonSessionProvider.test.tsx
@@ -754,6 +754,9 @@ describe('DaemonSessionProvider', () => {
     await renderWithProvider(<Harness />, {
       autoConnect: true,
       sessionId: undefined,
+      createSessionRequest: {
+        extensionPairingCredential: 'paired-credential',
+      },
     });
     expect(
       sdkMocks.MockDaemonSessionClient.createOrAttach,
@@ -768,6 +771,7 @@ describe('DaemonSessionProvider', () => {
     ).toHaveBeenCalledWith(
       expect.anything(),
       expect.objectContaining({
+        extensionPairingCredential: 'paired-credential',
         sessionScope: 'thread',
         workspaceCwd: '/mock-workspace',
       }),
@@ -4604,7 +4608,12 @@ describe('DaemonSessionProvider', () => {
       return null;
     }
 
-    await renderWithProvider(<Harness />, { autoConnect: true });
+    await renderWithProvider(<Harness />, {
+      autoConnect: true,
+      createSessionRequest: {
+        extensionPairingCredential: 'paired-credential',
+      },
+    });
     await act(async () => {
       await flushPromises();
     });
@@ -4625,6 +4634,7 @@ describe('DaemonSessionProvider', () => {
     expect(
       sdkMocks.MockDaemonSessionClient.createOrAttach.mock.calls[0]?.[1],
     ).toMatchObject({
+      extensionPairingCredential: 'paired-credential',
       workspaceCwd: '/mock-workspace',
       sessionScope: 'thread',
     });
diff --git a/packages/webui/src/daemon/session/DaemonSessionProvider.tsx b/packages/webui/src/daemon/session/DaemonSessionProvider.tsx
index c42330592bf..863be5bcf2b 100644
--- a/packages/webui/src/daemon/session/DaemonSessionProvider.tsx
+++ b/packages/webui/src/daemon/session/DaemonSessionProvider.tsx
@@ -602,27 +602,33 @@ export function DaemonSessionProvider(props: DaemonSessionProviderProps) {
               ? await restoreMethod(
                   client,
                   restoreSessionId,
-                  { workspaceCwd: effectWorkspaceCwd },
+                  {
+                    workspaceCwd: effectWorkspaceCwd,
+                    extensionPairingCredential:
+                      createSessionRequestRef.current
+                        ?.extensionPairingCredential,
+                  },
                   requestClientId,
                 )
               : reconnectSessionId
                 ? await DaemonSessionClient.load(
                     client,
                     reconnectSessionId,
-                    { workspaceCwd: effectWorkspaceCwd },
+                    {
+                      workspaceCwd: effectWorkspaceCwd,
+                      extensionPairingCredential:
+                        createSessionRequestRef.current
+                          ?.extensionPairingCredential,
+                    },
                     requestClientId,
                   )
                 : await DaemonSessionClient.createOrAttach(
                     client,
                     {
-                      ...(modelServiceId !== undefined
-                        ? { modelServiceId }
-                        : {}),
+                      ...createSessionRequestRef.current,
                       ...(shouldCreateFreshSession
                         ? { sessionScope: 'thread' as const }
-                        : sessionScope !== undefined
-                          ? { sessionScope }
-                          : {}),
+                        : {}),
                       workspaceCwd: effectWorkspaceCwd,
                     },
                     requestClientId,
diff --git a/scripts/tests/package-scripts.test.js b/scripts/tests/package-scripts.test.js
index 29fb6f41277..db90e28ded4 100644
--- a/scripts/tests/package-scripts.test.js
+++ b/scripts/tests/package-scripts.test.js
@@ -98,6 +98,7 @@ describe('package scripts', () => {
         'cross-env NODE_OPTIONS="--max-old-space-size=3072"',
         'npm run test:ci --workspaces --if-present --parallel -- --coverage.enabled=false',
         '&& npm run test:scripts',
+        '&& npm -w packages/chrome-extension run package',
       ].join(' '),
     );
 

From 162707f684b7778b56c4f2a6a62ad936023c1759 Mon Sep 17 00:00:00 2001
From: yiliang114 <effortyiliang@gmail.com>
Date: Fri, 17 Jul 2026 15:46:16 +0800
Subject: [PATCH 05/13] test(serve): track environment access

---
 packages/cli/src/serve/process-env-guard.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/cli/src/serve/process-env-guard.test.ts b/packages/cli/src/serve/process-env-guard.test.ts
index dda23fde2b2..7e683ceb7e9 100644
--- a/packages/cli/src/serve/process-env-guard.test.ts
+++ b/packages/cli/src/serve/process-env-guard.test.ts
@@ -147,7 +147,7 @@ const allowedProcessEnvAccesses = normalizeAllowances([
         'key:QWEN_SERVE_NO_MCP_POOL': 1,
         'key:QWEN_SERVE_NO_PERSISTENT_REGISTRATION': 1,
         'key:VITEST_WORKER_ID': 1,
-        whole: 4,
+        whole: 5,
       },
     },
   ],

From b30615c8f17bdf7010dfd17169117f687de3afad Mon Sep 17 00:00:00 2001
From: yiliang114 <effortyiliang@gmail.com>
Date: Fri, 17 Jul 2026 17:36:45 +0800
Subject: [PATCH 06/13] test(web-shell): align workspace sidebar visual smoke

---
 packages/web-shell/client/e2e/visuals/screenshots.spec.ts | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/packages/web-shell/client/e2e/visuals/screenshots.spec.ts b/packages/web-shell/client/e2e/visuals/screenshots.spec.ts
index 29abe49c4b8..ed64b5821b0 100644
--- a/packages/web-shell/client/e2e/visuals/screenshots.spec.ts
+++ b/packages/web-shell/client/e2e/visuals/screenshots.spec.ts
@@ -381,10 +381,7 @@ for (const theme of THEMES) {
         resolveBaseURL(testInfo),
       );
       await gotoSession(page, scenario, daemon, theme);
-      // Each workspace renders a section headed by its basename; the primary one
-      // also carries a "Primary" tag. Assert both workspace names and the tag so
-      // a regression in the grouping or the (removable) primary label fails an
-      // assertion, not only the visually-reviewed screenshot.
+      // Each workspace renders a section headed by its basename.
       const sidebar = page.getByRole('complementary');
       await expect(
         sidebar.getByText('qwen-web-shell-e2e', { exact: true }),
@@ -392,7 +389,6 @@ for (const theme of THEMES) {
       await expect(
         sidebar.getByText('qwen-api-service', { exact: true }),
       ).toBeVisible();
-      await expect(sidebar.getByText('Primary', { exact: true })).toBeVisible();
       // The primary workspace auto-expands and streams its session rows in via a
       // per-workspace fetch. Wait for the loaded session's row before capturing
       // so the async load has settled — otherwise the row list races the

From beb9f5067462f9a0574e8f315a629dd9ceb264e9 Mon Sep 17 00:00:00 2001
From: yiliang114 <1204183885@qq.com>
Date: Thu, 3 Sep 2026 10:46:32 +0800
Subject: [PATCH 07/13] fix(acp-bridge): restore paired-extension browser tool
 gate after merge

---
 packages/acp-bridge/src/bridgeClient.test.ts |  6 +++++-
 packages/acp-bridge/src/bridgeClient.ts      | 19 +++++++++++++++++++
 packages/cli/src/serve/routes/session.ts     |  2 +-
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/packages/acp-bridge/src/bridgeClient.test.ts b/packages/acp-bridge/src/bridgeClient.test.ts
index 8fa7e30d112..0c3dfb4984a 100644
--- a/packages/acp-bridge/src/bridgeClient.test.ts
+++ b/packages/acp-bridge/src/bridgeClient.test.ts
@@ -4585,6 +4585,7 @@ describe('BridgeClient — reverse tool channel (qwen/control/client_mcp/message
    */
   function makeClientWithRegistrar(
     registrar: ClientMcpRegistrar,
+    source?: { sourceType?: string; sourceId?: string },
   ): BridgeClient {
     const sender: ClientMcpMessageSender = (serverName: string) =>
       registrar.hasServer(serverName)
@@ -4592,7 +4593,10 @@ describe('BridgeClient — reverse tool channel (qwen/control/client_mcp/message
             registrar.sendSdkMcpMessage(serverName, payload as JSONRPCMessage)
         : undefined;
     return new BridgeClient(
-      (() => undefined) as never, // resolveEntry: client_mcp/message is sessionless
+      ((sessionId: string | undefined) =>
+        sessionId === 'extension-session'
+          ? ({ ...source } as never)
+          : undefined) as never, // resolveEntry: paired extension session carries its source
       (() => undefined) as never, // resolvePendingRestoreEvents
       { request: thrower } as never,
       0,
diff --git a/packages/acp-bridge/src/bridgeClient.ts b/packages/acp-bridge/src/bridgeClient.ts
index 8675b4d9d5d..98b23a90b30 100644
--- a/packages/acp-bridge/src/bridgeClient.ts
+++ b/packages/acp-bridge/src/bridgeClient.ts
@@ -1819,6 +1819,25 @@ export class BridgeClient implements Client {
         '`payload` must be a JSON-RPC message object',
       );
     }
+    if (
+      server === 'qwen-browser-tools' &&
+      (payload as Record<string, unknown>)['method'] === 'tools/call'
+    ) {
+      const sessionId = params['sessionId'];
+      const entry =
+        typeof sessionId === 'string'
+          ? this.resolveEntry(sessionId)
+          : undefined;
+      if (
+        entry?.sourceType !== 'default' ||
+        entry.sourceId !== 'chrome_extension'
+      ) {
+        throw RequestError.invalidParams(
+          undefined,
+          'browser tools require a session created by the paired Chrome extension',
+        );
+      }
+    }
     const send = this.clientMcpSender(server);
     if (!send) {
       // The client that hosted this server is gone (WS closed / unregistered).
diff --git a/packages/cli/src/serve/routes/session.ts b/packages/cli/src/serve/routes/session.ts
index 3af31874d7d..fd354acb8b8 100644
--- a/packages/cli/src/serve/routes/session.ts
+++ b/packages/cli/src/serve/routes/session.ts
@@ -3695,7 +3695,7 @@ export function registerSessionRoutes(
       }
       let restoredStorageSessionId = sessionId;
       try {
-        const sessionService = new SessionService(workspaceCwd);
+        const sessionService = createWorkspaceRuntimeSessionService(runtime);
         const metadata = await sessionService.readCreationMetadata(sessionId);
         let source = metadata;
         try {

From bccba721bc72d1c93f2ec570a63af8151794654b Mon Sep 17 00:00:00 2001
From: yiliang114 <effortyiliang@gmail.com>
Date: Sun, 13 Sep 2026 01:05:23 +0800
Subject: [PATCH 08/13] test(cli): call claim() in the client MCP sender
 registry test

The suite registers a sender with `reg.set(...)`, but the registry exposes
`claim(serverName, sender, owner)`; every other call site in this PR already
uses it. `tsc --build` fails the tree at head:

    src/serve/acp-http/client-mcp-sender-registry.test.ts(117,9): error TS2339:
    Property 'set' does not exist on type 'ClientMcpSenderRegistry'.

That failure aborts `npm run build --workspace=packages/cli`, so every CI lane
fails in `Install dependencies` before it reaches its own step. `claim` on a
fresh registry has the same effect the test expects from `set`.
---
 .../cli/src/serve/acp-http/client-mcp-sender-registry.test.ts   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/cli/src/serve/acp-http/client-mcp-sender-registry.test.ts b/packages/cli/src/serve/acp-http/client-mcp-sender-registry.test.ts
index 55f1888437d..6a148ae6a8b 100644
--- a/packages/cli/src/serve/acp-http/client-mcp-sender-registry.test.ts
+++ b/packages/cli/src/serve/acp-http/client-mcp-sender-registry.test.ts
@@ -114,7 +114,7 @@ describe('ClientMcpSenderRegistry', () => {
   it('never falls back to a global sender for a reserved session server', async () => {
     const reg = new ClientMcpSenderRegistry();
     const globalSender = vi.fn(async () => msg(1));
-    reg.set('channel_loop', globalSender, 'browser');
+    reg.claim('channel_loop', globalSender, 'browser');
     reg.setSession(
       'channel_loop',
       'session-a',

From 62821ccc382fd4a635c1b4474601de66fe20798f Mon Sep 17 00:00:00 2001
From: yiliang114 <effortyiliang@gmail.com>
Date: Sun, 13 Sep 2026 02:12:19 +0800
Subject: [PATCH 09/13] test(serve): match the capability envelope to the
 served order

`capabilities.ts` advertises `client_mcp_over_ws` after
`session_worktree_reset_v1`; the integration expectation, written before the
merge, still listed it ahead of `workspace_session_live_state`.
---
 integration-tests/cli/qwen-serve-routes.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/integration-tests/cli/qwen-serve-routes.test.ts b/integration-tests/cli/qwen-serve-routes.test.ts
index e0dcb1069d8..e98ffa09857 100644
--- a/integration-tests/cli/qwen-serve-routes.test.ts
+++ b/integration-tests/cli/qwen-serve-routes.test.ts
@@ -475,11 +475,11 @@ describe('qwen serve — capabilities envelope', () => {
       'workspace_persisted_transcript',
       'workspace_session_export',
       'workspace_archived_session_export',
-      'client_mcp_over_ws',
       'workspace_session_live_state',
       'workspace_session_metadata',
       'session_worktree_persistence_v1',
       'session_worktree_reset_v1',
+      'client_mcp_over_ws',
       'voice_transcribe',
       'web_terminal',
     ]);

From 6b3cb8af1c18e8249c18a74ed6751de98dacc4a9 Mon Sep 17 00:00:00 2001
From: yiliang114 <effortyiliang@gmail.com>
Date: Sun, 13 Sep 2026 02:29:29 +0800
Subject: [PATCH 10/13] test(serve): follow the extension-origin defaults in
 capability assertions

The daemon pins the official Chrome extension origin and treats a
configured CDP adapter command as an active tunnel, so
browser_automation_mcp is advertised once QWEN_CDP_MCP_COMMAND is set and
security.allowOriginMode reports 'specific'. Update the two assertions
that still pinned the pre-extension defaults.
---
 packages/cli/src/serve/run-qwen-serve.test.ts | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/packages/cli/src/serve/run-qwen-serve.test.ts b/packages/cli/src/serve/run-qwen-serve.test.ts
index 435d69fb97c..04ff0726445 100644
--- a/packages/cli/src/serve/run-qwen-serve.test.ts
+++ b/packages/cli/src/serve/run-qwen-serve.test.ts
@@ -7612,7 +7612,6 @@ describe('runQwenServe runtime startup failures', () => {
     const features = await readBrowserMcpFeatureFlagsForEnv(
       undefined,
       'http://localhost:5173',
-      '/opt/qwen-cdp-mcp-adapter',
     );
 
     expect(features).not.toContain('browser_automation_mcp');
@@ -11740,7 +11739,7 @@ describe('runQwenServe runtime startup failures', () => {
           logDroppedRecords: 0,
           logDroppedBytes: 0,
         },
-        security: { allowOriginMode: 'none' },
+        security: { allowOriginMode: 'specific' },
         limits: {
           maxSessions: 1,
           maxPendingPromptsPerSession: 5,

From ea7219e6d95d4fe6647fa1bbdd37fc0b3f196216 Mon Sep 17 00:00:00 2001
From: yiliang114 <effortyiliang@gmail.com>
Date: Sun, 13 Sep 2026 03:18:47 +0800
Subject: [PATCH 11/13] fix(chrome-extension): restore the capability banner
 and pairing fixtures

The warning banner stopped rendering for daemons without the legacy adapter
feature: the snapshot branch returned early, before the capability model that
attributes the chat-only and tunnel-only messages ran. Poll `/workspace/mcp`
only where an adapter is discoverable and derive the banner from the feature
list otherwise.

Fixture and expectation updates for the extension pairing contract this branch
introduces:

- sidepanel fixtures store a paired credential, answer the
  `/extension/pairing/verify` challenge the way a paired daemon does, render
  the `#pair-form` / `.status__text` elements the panel dereferences, and stub
  `chrome.runtime.sendMessage`.
- the CDP transport cases wire a pairing verifier, and the registered CDP MCP
  server now receives a `?access_token=` endpoint.
- the serve env guard accounts for the CDP MCP adapter command read.
- the web shell boot mock exports `getExtensionPairingCredential`.
---
 packages/chrome-extension/public/sidepanel.js |  39 ++---
 .../src/sidepanel/sidepanel-assets.test.ts    | 133 +++++++++++++++---
 .../cli/src/serve/acp-http/transport.test.ts  |   5 +-
 .../cli/src/serve/process-env-guard.test.ts   |   6 +-
 packages/web-shell/client/main-boot.test.tsx  |   1 +
 5 files changed, 148 insertions(+), 36 deletions(-)

diff --git a/packages/chrome-extension/public/sidepanel.js b/packages/chrome-extension/public/sidepanel.js
index 806b21e7af8..f105cad4f1e 100644
--- a/packages/chrome-extension/public/sidepanel.js
+++ b/packages/chrome-extension/public/sidepanel.js
@@ -194,8 +194,9 @@ let lastProbedBaseUrl;
 
 /**
  * Compute the browser-automation warning banner. Only the legacy external
- * adapter path (`browser_automation_mcp`) has a discoverable adapter status;
- * the native tool catalog needs no banner, so return null when it is absent.
+ * adapter path (`browser_automation_mcp`) has a discoverable adapter status, so
+ * only that path polls `/workspace/mcp`; the states that warn without a
+ * snapshot (chat-only, tunnel-only) are derived from the feature list alone.
  */
 async function deriveWarning(baseUrl, token, features) {
   const { deriveCapabilityStatus } = QwenCapabilityStatus;
@@ -204,24 +205,28 @@ async function deriveWarning(baseUrl, token, features) {
     mcpProbeCounter = 0;
     cachedMcpSnapshot = undefined;
   }
-  if (!features.includes('browser_automation_mcp')) {
+  let mcpSnapshot;
+  if (features.includes('browser_automation_mcp')) {
+    // `/workspace/mcp` is a cross-process RPC to the ACP child while a channel
+    // is live, so refresh it on a slower cadence than health/capabilities and
+    // reuse the last snapshot in between. The banner content changes rarely and
+    // need not contend with an in-flight generation on every 2s tick.
+    if (mcpProbeCounter % MCP_POLL_EVERY === 0) {
+      const fresh = await probeJson(`${baseUrl}/workspace/mcp`, token);
+      // A transient failure after a successful probe keeps the previous
+      // snapshot instead of pinning automation-unavailable for MCP_POLL_EVERY
+      // ticks.
+      if (fresh !== null || !cachedMcpSnapshot) cachedMcpSnapshot = fresh;
+    }
+    mcpProbeCounter += 1;
+    mcpSnapshot = cachedMcpSnapshot;
+  } else {
+    // No discoverable adapter to inspect. The earlier capability states
+    // (chat-only, tunnel-only) warn without a snapshot, so the banner must
+    // still be derived from the feature list.
     mcpProbeCounter = 0;
     cachedMcpSnapshot = undefined;
-    return null;
-  }
-  // `/workspace/mcp` is a cross-process RPC to the ACP child while a channel
-  // is live, so refresh it on a slower cadence than health/capabilities and
-  // reuse the last snapshot in between. The banner content changes rarely and
-  // need not contend with an in-flight generation on every 2s tick.
-  let mcpSnapshot;
-  if (mcpProbeCounter % MCP_POLL_EVERY === 0) {
-    const fresh = await probeJson(`${baseUrl}/workspace/mcp`, token);
-    // A transient failure after a successful probe keeps the previous snapshot
-    // instead of pinning automation-unavailable for MCP_POLL_EVERY ticks.
-    if (fresh !== null || !cachedMcpSnapshot) cachedMcpSnapshot = fresh;
   }
-  mcpProbeCounter += 1;
-  mcpSnapshot = cachedMcpSnapshot;
   return deriveCapabilityStatus(true, features, mcpSnapshot, baseUrl).warning;
 }
 
diff --git a/packages/chrome-extension/src/sidepanel/sidepanel-assets.test.ts b/packages/chrome-extension/src/sidepanel/sidepanel-assets.test.ts
index 52a69786b62..63674199f12 100644
--- a/packages/chrome-extension/src/sidepanel/sidepanel-assets.test.ts
+++ b/packages/chrome-extension/src/sidepanel/sidepanel-assets.test.ts
@@ -4,6 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
+import { createHash, createHmac } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -19,6 +20,26 @@ const packageRoot = path.resolve(
 // accepts classic scripts: an import/export statement added to a public/*.js
 // file surfaces here as a SyntaxError in a test, not as a build error.
 
+// The panel verifies its stored pairing credential against the daemon on every
+// tick before it reveals the shell, so the fixtures answer the challenge the
+// way a paired daemon does.
+const PAIRING_CREDENTIAL_ID = 'test-credential';
+const PAIRING_SECRET = 'test-secret';
+
+function pairingVerifyResponse(init?: RequestInit): {
+  ok: boolean;
+  json: () => Promise<{ proof: string }>;
+} {
+  const { challenge } = JSON.parse(String(init?.body ?? '{}')) as {
+    challenge: string;
+  };
+  const key = createHash('sha256').update(PAIRING_SECRET).digest();
+  const proof = createHmac('sha256', key)
+    .update(`qwen-extension-daemon:${challenge}`)
+    .digest('base64url');
+  return { ok: true, json: async () => ({ proof }) };
+}
+
 describe('side panel capability status assets', () => {
   afterEach(() => {
     vi.restoreAllMocks();
@@ -68,20 +89,36 @@ describe('side panel capability status assets', () => {
       <main id="welcome"><h1 id="welcome-title"></h1><p id="welcome-desc"></p></main>
       <code id="cmd"></code><button id="cmd-row"></button>
       <button id="copy"></button><span id="copy-label"></span>
+      <form id="pair-form" class="pair hidden"><input id="pair-code" /></form>
+      <span class="status__text"></span>
       <div id="capability-warning" class="hidden"></div>
     `;
     vi.stubGlobal('chrome', {
-      runtime: { id: 'test-extension' },
-      storage: { local: { get: vi.fn().mockResolvedValue({}) } },
+      runtime: {
+        id: 'test-extension',
+        sendMessage: vi.fn(async () => undefined),
+      },
+      storage: {
+        local: {
+          get: vi.fn().mockResolvedValue({
+            'qwen.daemon': {
+              extensionPairingCredential: `${PAIRING_CREDENTIAL_ID}.${PAIRING_SECRET}`,
+            },
+          }),
+        },
+      },
     });
     vi.stubGlobal('QwenCapabilityStatus', { deriveCapabilityStatus });
 
     let daemonState: 'down' | 'chat-only' = 'down';
     vi.stubGlobal(
       'fetch',
-      vi.fn(async (input: RequestInfo | URL) => {
+      vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
         if (daemonState === 'down') throw new Error('daemon unavailable');
         const url = String(input);
+        if (url.endsWith('/extension/pairing/verify')) {
+          return pairingVerifyResponse(init);
+        }
         return {
           ok: true,
           json: async () =>
@@ -137,11 +174,24 @@ describe('side panel capability status assets', () => {
       <main id="welcome"><h1 id="welcome-title"></h1><p id="welcome-desc"></p></main>
       <code id="cmd"></code><button id="cmd-row"></button>
       <button id="copy"></button><span id="copy-label"></span>
+      <form id="pair-form" class="pair hidden"><input id="pair-code" /></form>
+      <span class="status__text"></span>
       <div id="capability-warning" class="hidden"></div>
     `;
     vi.stubGlobal('chrome', {
-      runtime: { id: 'test-extension' },
-      storage: { local: { get: vi.fn().mockResolvedValue({}) } },
+      runtime: {
+        id: 'test-extension',
+        sendMessage: vi.fn(async () => undefined),
+      },
+      storage: {
+        local: {
+          get: vi.fn().mockResolvedValue({
+            'qwen.daemon': {
+              extensionPairingCredential: `${PAIRING_CREDENTIAL_ID}.${PAIRING_SECRET}`,
+            },
+          }),
+        },
+      },
     });
     const deriveSpy = vi.fn(deriveCapabilityStatus);
     vi.stubGlobal('QwenCapabilityStatus', {
@@ -150,8 +200,11 @@ describe('side panel capability status assets', () => {
 
     vi.stubGlobal(
       'fetch',
-      vi.fn(async (input: RequestInfo | URL) => {
+      vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
         const url = String(input);
+        if (url.endsWith('/extension/pairing/verify')) {
+          return pairingVerifyResponse(init);
+        }
         return {
           ok: true,
           json: async () =>
@@ -208,11 +261,24 @@ describe('side panel capability status assets', () => {
       <main id="welcome"><h1 id="welcome-title"></h1><p id="welcome-desc"></p></main>
       <code id="cmd"></code><button id="cmd-row"></button>
       <button id="copy"></button><span id="copy-label"></span>
+      <form id="pair-form" class="pair hidden"><input id="pair-code" /></form>
+      <span class="status__text"></span>
       <div id="capability-warning" class="hidden"></div>
     `;
     vi.stubGlobal('chrome', {
-      runtime: { id: 'test-extension' },
-      storage: { local: { get: vi.fn().mockResolvedValue({}) } },
+      runtime: {
+        id: 'test-extension',
+        sendMessage: vi.fn(async () => undefined),
+      },
+      storage: {
+        local: {
+          get: vi.fn().mockResolvedValue({
+            'qwen.daemon': {
+              extensionPairingCredential: `${PAIRING_CREDENTIAL_ID}.${PAIRING_SECRET}`,
+            },
+          }),
+        },
+      },
     });
     vi.stubGlobal('QwenCapabilityStatus', { deriveCapabilityStatus });
 
@@ -221,8 +287,11 @@ describe('side panel capability status assets', () => {
       | { ok: true; value: Record<string, unknown> } = { ok: false };
     vi.stubGlobal(
       'fetch',
-      vi.fn(async (input: RequestInfo | URL) => {
+      vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
         const url = String(input);
+        if (url.endsWith('/extension/pairing/verify')) {
+          return pairingVerifyResponse(init);
+        }
         if (url.endsWith('/capabilities')) {
           return {
             ok: true,
@@ -333,10 +402,15 @@ describe('side panel capability status assets', () => {
       <main id="welcome"><h1 id="welcome-title"></h1><p id="welcome-desc"></p></main>
       <code id="cmd"></code><button id="cmd-row"></button>
       <button id="copy"></button><span id="copy-label"></span>
+      <form id="pair-form" class="pair hidden"><input id="pair-code" /></form>
+      <span class="status__text"></span>
       <div id="capability-warning" class="hidden"></div>
     `;
     vi.stubGlobal('chrome', {
-      runtime: { id: 'test-extension' },
+      runtime: {
+        id: 'test-extension',
+        sendMessage: vi.fn(async () => undefined),
+      },
       storage: { local: { get: vi.fn().mockResolvedValue({}) } },
     });
     vi.stubGlobal('QwenCapabilityStatus', { deriveCapabilityStatus });
@@ -371,19 +445,35 @@ describe('side panel capability status assets', () => {
       <main id="welcome"><h1 id="welcome-title"></h1><p id="welcome-desc"></p></main>
       <code id="cmd"></code><button id="cmd-row"></button>
       <button id="copy"></button><span id="copy-label"></span>
+      <form id="pair-form" class="pair hidden"><input id="pair-code" /></form>
+      <span class="status__text"></span>
       <div id="capability-warning" class="hidden"></div>
     `;
     vi.stubGlobal('chrome', {
-      runtime: { id: 'test-extension' },
-      storage: { local: { get: vi.fn().mockResolvedValue({}) } },
+      runtime: {
+        id: 'test-extension',
+        sendMessage: vi.fn(async () => undefined),
+      },
+      storage: {
+        local: {
+          get: vi.fn().mockResolvedValue({
+            'qwen.daemon': {
+              extensionPairingCredential: `${PAIRING_CREDENTIAL_ID}.${PAIRING_SECRET}`,
+            },
+          }),
+        },
+      },
     });
     vi.stubGlobal('QwenCapabilityStatus', { deriveCapabilityStatus });
 
     let mcpOk = true;
     vi.stubGlobal(
       'fetch',
-      vi.fn(async (input: RequestInfo | URL) => {
+      vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
         const url = String(input);
+        if (url.endsWith('/extension/pairing/verify')) {
+          return pairingVerifyResponse(init);
+        }
         if (url.endsWith('/capabilities')) {
           return {
             ok: true,
@@ -437,15 +527,23 @@ describe('side panel capability status assets', () => {
       <main id="welcome"><h1 id="welcome-title"></h1><p id="welcome-desc"></p></main>
       <code id="cmd"></code><button id="cmd-row"></button>
       <button id="copy"></button><span id="copy-label"></span>
+      <form id="pair-form" class="pair hidden"><input id="pair-code" /></form>
+      <span class="status__text"></span>
       <div id="capability-warning" class="hidden"></div>
     `;
     let storedBaseUrl = 'http://127.0.0.1:4170';
     vi.stubGlobal('chrome', {
-      runtime: { id: 'test-extension' },
+      runtime: {
+        id: 'test-extension',
+        sendMessage: vi.fn(async () => undefined),
+      },
       storage: {
         local: {
           get: vi.fn().mockImplementation(async () => ({
-            'qwen.daemon': { baseUrl: storedBaseUrl },
+            'qwen.daemon': {
+              baseUrl: storedBaseUrl,
+              extensionPairingCredential: `${PAIRING_CREDENTIAL_ID}.${PAIRING_SECRET}`,
+            },
           })),
         },
       },
@@ -454,8 +552,11 @@ describe('side panel capability status assets', () => {
 
     vi.stubGlobal(
       'fetch',
-      vi.fn(async (input: RequestInfo | URL) => {
+      vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
         const url = String(input);
+        if (url.endsWith('/extension/pairing/verify')) {
+          return pairingVerifyResponse(init);
+        }
         if (url.endsWith('/capabilities')) {
           return {
             ok: true,
diff --git a/packages/cli/src/serve/acp-http/transport.test.ts b/packages/cli/src/serve/acp-http/transport.test.ts
index 4acacab11fa..09e64b0aedc 100644
--- a/packages/cli/src/serve/acp-http/transport.test.ts
+++ b/packages/cli/src/serve/acp-http/transport.test.ts
@@ -11590,6 +11590,9 @@ describe('ACP WebSocket transport security', () => {
           ? {
               cdpTunnelOverWs: true,
               cdpTunnelRegistry: new CdpTunnelRegistry(),
+              // These cases drive CDP-tunnel registration; the bridge presents
+              // no pairing credential, so the daemon accepts the extension.
+              verifyExtensionPairingCredential: () => true,
             }
           : {}),
       });
@@ -11866,7 +11869,7 @@ describe('ACP WebSocket transport security', () => {
       command: process.execPath,
       args: expect.arrayContaining([
         '--wsEndpoint',
-        `ws://127.0.0.1:${port}/cdp`,
+        expect.stringContaining(`ws://127.0.0.1:${port}/cdp?access_token=`),
       ]),
     });
 
diff --git a/packages/cli/src/serve/process-env-guard.test.ts b/packages/cli/src/serve/process-env-guard.test.ts
index eb73a8b0bdd..f0631f0cb80 100644
--- a/packages/cli/src/serve/process-env-guard.test.ts
+++ b/packages/cli/src/serve/process-env-guard.test.ts
@@ -192,7 +192,9 @@ const allowedProcessEnvAccesses = normalizeAllowances([
         'contents, not just the path, and a second read could see a different value. The whole-object read copies the ' +
         'daemon environment into the TLS trust probe child. NODE_TLS_REJECT_UNAUTHORIZED is read to skip the ' +
         'worker TLS trust check when it disables verification: workers inherit the variable unscrubbed and dial ' +
-        'via fetch, which honors it, so the strict probe would flag an outage that never happens.',
+        'via fetch, which honors it, so the strict probe would flag an outage that never happens. A second ' +
+        'whole-object read resolves the CDP MCP adapter command that decides whether the Chrome extension ' +
+        'browser-automation tunnel is active by default.',
       accesses: {
         'computed:EXTERNAL_TOOL_GUARD_TOKEN_ENV': 1,
         'computed:QWEN_SERVE_CDP_TUNNEL_OVER_WS_ENV': 1,
@@ -207,7 +209,7 @@ const allowedProcessEnvAccesses = normalizeAllowances([
         'key:QWEN_SERVE_NO_MCP_POOL': 1,
         'key:QWEN_SERVE_NO_PERSISTENT_REGISTRATION': 1,
         'key:VITEST_WORKER_ID': 1,
-        whole: 6,
+        whole: 7,
       },
     },
   ],
diff --git a/packages/web-shell/client/main-boot.test.tsx b/packages/web-shell/client/main-boot.test.tsx
index c48cbc3f99d..b5eccf27046 100644
--- a/packages/web-shell/client/main-boot.test.tsx
+++ b/packages/web-shell/client/main-boot.test.tsx
@@ -30,6 +30,7 @@ vi.mock('./components/WorkspaceSessionProvider', () => ({
 }));
 vi.mock('./config/daemon', () => ({
   getDaemonBaseUrl: () => '',
+  getExtensionPairingCredential: () => undefined,
   // No token in the URL, so boot blocks on the postMessage handshake — the
   // window in which the watchdog's grace period can expire.
   getDaemonToken: () => null,

From 3939ad9ebc0e8c6ee1997b74eef8a76292a08d67 Mon Sep 17 00:00:00 2001
From: yiliang114 <effortyiliang@gmail.com>
Date: Sun, 13 Sep 2026 04:49:48 +0800
Subject: [PATCH 12/13] fix(web-shell): add the pairing credential to the
 daemon mock in main.test.tsx
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

main.tsx reads getExtensionPairingCredential() at startup, so every spec
that mocks ./config/daemon has to expose it. main-boot.test.tsx already
did; main.test.tsx did not, and vi.mock turned the missing export into an
unhandled rejection that failed the workspace even though all 310 files
and 7644 tests reported as passed:

  Error: [vitest] No "getExtensionPairingCredential" export is defined on
  the "./config/daemon" mock.
   ❯ main main.tsx:367:38
   ❯ main.test.tsx:54:1

Add the same one-line stub the other spec uses.
---
 packages/web-shell/client/main.test.tsx | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/web-shell/client/main.test.tsx b/packages/web-shell/client/main.test.tsx
index ef01db8dad5..1313e8200a1 100644
--- a/packages/web-shell/client/main.test.tsx
+++ b/packages/web-shell/client/main.test.tsx
@@ -45,6 +45,7 @@ vi.mock('./components/WorkspaceSessionProvider', () => ({
 vi.mock('./config/daemon', () => ({
   getDaemonBaseUrl: () => '',
   getDaemonToken: () => 'token',
+  getExtensionPairingCredential: () => undefined,
   hasReloadSurvivableDaemonToken: () => testState.tokenSurvivesReload,
   persistDaemonToken: vi.fn(),
   removeDaemonTokenFromUrl: vi.fn(),

From c1bb688665ac7d0c341d353f3d5aa9e39e7977a7 Mon Sep 17 00:00:00 2001
From: yiliang114 <effortyiliang@gmail.com>
Date: Sun, 13 Sep 2026 05:25:41 +0800
Subject: [PATCH 13/13] test(chrome-extension): assert the packaging contract
 the branch ships

The three chrome-extension packaging cases added by this PR were written
against an earlier design that the same PR superseded, and they had never
run: the unit job aborted in the web-shell workspace before reaching
test:scripts. With that abort fixed they fail:

  AssertionError: expected undefined to be defined
   scripts/tests/chrome-extension-package.test.js:34
  TypeError: (0 , scanZip) is not a function
  AssertionError: expected '0.23.3.65535' to be '0.23.3'

Package-extension.js spawns the POSIX zip binary, artifact-scan.js
exports scanZipArtifact (returning { file, signature } findings), and
sync-extension.js writes the four-component Chrome version through
toChromeManifestVersion. Point the cases at those, and assert the
packaging wiring where it exists: the CI workflow step that runs
`npm -w packages/chrome-extension run package`.
---
 .../tests/chrome-extension-package.test.js    | 71 +++++++++++--------
 1 file changed, 40 insertions(+), 31 deletions(-)

diff --git a/scripts/tests/chrome-extension-package.test.js b/scripts/tests/chrome-extension-package.test.js
index 19c2ebda4ce..73d1a084add 100644
--- a/scripts/tests/chrome-extension-package.test.js
+++ b/scripts/tests/chrome-extension-package.test.js
@@ -4,19 +4,23 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { readFileSync, writeFileSync } from 'node:fs';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { mkdtemp, rm } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
-import { execFileSync } from 'node:child_process';
+import { execFileSync, spawnSync } from 'node:child_process';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { describe, expect, it } from 'vitest';
-import { scanZip } from '../../packages/chrome-extension/scripts/artifact-scan.js';
+import { scanZipArtifact } from '../../packages/chrome-extension/scripts/artifact-scan.js';
+import { toChromeManifestVersion } from '../../packages/chrome-extension/scripts/manifest-version.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const root = path.resolve(__dirname, '../..');
 
+const zipAvailable = () =>
+  spawnSync('zip', ['--version'], { stdio: 'ignore' }).status === 0;
+
 describe('chrome extension package scripts', () => {
   it('keeps the build script portable for Windows npm lifecycle runs', () => {
     const packageJson = JSON.parse(
@@ -31,38 +35,41 @@ describe('chrome extension package scripts', () => {
     );
     expect(packageJson.scripts.package).toContain('package-extension.js');
     expect(packageJson.scripts.package).not.toContain('zip -r');
-    expect(packageJson.devDependencies.archiver).toBeDefined();
 
-    const packageScript = readFileSync(
-      path.join(root, 'packages/chrome-extension/scripts/package-extension.js'),
+    const workflow = readFileSync(
+      path.join(root, '.github/workflows/ci.yml'),
       'utf8',
     );
-    expect(packageScript).toContain("archiver('zip'");
-    expect(packageScript).not.toContain("execFile('zip'");
-
-    const rootPackageJson = JSON.parse(
-      readFileSync(path.join(root, 'package.json'), 'utf8'),
-    );
-    expect(rootPackageJson.scripts['test:release']).toContain(
-      'npm -w packages/chrome-extension run package',
-    );
+    expect(workflow).toContain('npm -w packages/chrome-extension run package');
   });
 
-  it('rejects forbidden stale entries in the final extension archive', async () => {
-    const tempDir = await mkdtemp(path.join(os.tmpdir(), 'qwen-ext-scan-'));
-    const archive = path.join(tempDir, 'extension.zip');
-    try {
-      writeFileSync(
-        archive,
-        'central-directory: node_modules/chrome-devtools-mcp/index.js',
-      );
-      await expect(scanZip(archive)).resolves.toEqual([
-        `${archive}: chrome-devtools-mcp`,
-      ]);
-    } finally {
-      await rm(tempDir, { recursive: true, force: true });
-    }
-  });
+  it.skipIf(!zipAvailable())(
+    'rejects forbidden dependency signatures inside the packaged archive',
+    async () => {
+      const tempDir = await mkdtemp(path.join(os.tmpdir(), 'qwen-ext-scan-'));
+      const source = path.join(tempDir, 'extension');
+      const archive = path.join(tempDir, 'extension.zip');
+      try {
+        mkdirSync(source);
+        writeFileSync(
+          path.join(source, 'index.js'),
+          "require('node_modules/chrome-devtools-mcp/index.js');",
+        );
+        execFileSync('zip', [archive, 'index.js'], {
+          cwd: source,
+          stdio: 'ignore',
+        });
+        await expect(scanZipArtifact(archive)).resolves.toEqual([
+          {
+            file: `${archive}:index.js`,
+            signature: 'node_modules/chrome-devtools-mcp',
+          },
+        ]);
+      } finally {
+        await rm(tempDir, { recursive: true, force: true });
+      }
+    },
+  );
 
   it('keeps the pinned official id aligned with the manifest key', () => {
     const manifest = JSON.parse(
@@ -114,7 +121,9 @@ describe('chrome extension package scripts', () => {
           'utf8',
         ),
       );
-      expect(manifest.version).toBe(packageJson.version);
+      expect(manifest.version).toBe(
+        toChromeManifestVersion(packageJson.version),
+      );
     } finally {
       await rm(tempDir, { recursive: true, force: true });
     }