fix(wework): keep inactive task browsers available

docs/en/wework/browser.md

@@ -8,6 +8,8 @@ The built-in browser opens in the right workspace so you can inspect websites, v
 
 Open the new-tab menu, choose **Browser**, and enter an `http`, `https`, or `file://` address, or a local absolute path. The current page remains loaded when you switch to file or review tabs. `file://` addresses and paths such as `/Users/.../file.html` are useful for previewing local HTML, PDF, image, and text files, and they can also open local folders. Markdown and extensionless text files also render as text. Folders render as read-only index pages where you can enter child folders or open files. When a local file cannot be previewed, Wework cancels the local-file download and shows a short toast.
 
+You can keep multiple task tabs open at the top, and each task owns an independent built-in browser page. After you switch to another task, the previous task's browser keeps running while hidden. AI in that task can continue opening, waiting for, and inspecting pages, and the latest page state appears when you switch back. Browser pages are not shared across tasks. The right workspace currently provides one browser tab per task; it does not provide a browser-internal tab strip.
+
 Background page-state synchronization does not overwrite the address while you are editing it. If a page is already open, leaving the address field without submitting restores the current page URL. If no page is open yet, the unsubmitted address is preserved and restored after switching conversations.
 
 If a Wework dialog, menu, or overlay intersects the right browser area, the browser temporarily hides so the native page cannot cover the main interface. It returns automatically when the overlay closes or moves away.

docs/en/wework/developer-guide/wework-embedded-browser.md

@@ -55,11 +55,14 @@ Browser instances are bound by pane/task label:
 - A new conversation without a runtime task uses the current pane key as a temporary browser label.
 - After sending from a new conversation creates a runtime task, Wework relabels the temporary browser to the new task label.
 - When the user switches tasks, only the browser bound to the active pane/task is visible; pages from other tasks must not leak across panes.
-- MCP open requests initially use the default label. When the current pane becomes inactive, Wework moves its WebView to a task-specific label, and only the active task may claim the default label.
+- Executor injects a task-specific label for an existing runtime task. Only temporary new conversations use the default or pane label, and only the active task may claim the default label.
+- When a top-level task tab becomes inactive, its workbench effects must stay active so the task-specific bridge listener can handle background `open`, `waitFor`, and `inspect` requests. Hide the React surface with `hidden` and keep the native WebView invisible; non-task tabs should not pay this keep-alive cost.
 - When the right browser panel is closed, the native WebView is hidden offscreen and must not cover the chat area, debug panel, or splitter.
 
 This binding keeps the browser the user sees and the browser the agent controls as the same object.
 
+Each pane/task label currently maps to one browser host. Wework can keep multiple top-level task tabs and their independent browsers alive, but there is no browser-internal multi-tab model inside one task. Adding browser-internal tabs must extend bridge routing identity, lifecycle ownership, and the Agent tool protocol instead of reusing another task's host.
+
 A programmatic first open must treat "the panel was requested" and "the native WebView is ready for navigation" as separate phases. The bridge stores pending navigation with a request ID and executes it only after the browser host for that task has nonzero visible bounds and reaches the ready state. If the frontend listener registers after the request, it recovers the event from the pending-request snapshot. The tool may report success only after the native WebView has navigated to the requested URL, not merely because the right panel or a blank WebView was created.
 
 Close requests triggered by task switching or component unmounting must include the expected native label. A stale pane may close only the WebView it created; it must not close an instance that was relabeled or adopted by a replacement pane. An inactive task may prepare a hidden ready browser, but it cannot display that browser over the active task.
@@ -113,7 +116,7 @@ cargo test --manifest-path wework/src-tauri/Cargo.toml embedded_browser
 pnpm --filter wework e2e:desktop:embedded-browser
 ```
 
-`e2e:desktop:embedded-browser` must issue the first bridge `open` from a newly created local task and verify that it completes before the tool timeout, creates exactly one visible native host, and preserves the requested URL. A test that covers only a second open or manually exposes the browser panel first does not exercise the first-open race.
+`e2e:desktop:embedded-browser` must create task A, switch to task B, and then use task A's specific label for the first bridge `open`, `waitFor`, and `inspect`. It verifies that the inactive task completes background navigation before the tool timeout without taking over task B's browser, and that the same page state is visible after switching back to task A. A test that covers only a second open, an active-task open, or a manually exposed browser panel does not exercise the first-open and inactive-task routing races.
 
 When the browser change touches Tauri commands, native WebView behavior, IPC, or the Agent action path, also start an isolated real Tauri session with `pnpm --filter wework ai:verify start` and record evidence for opening a page, inspect, actions, and screenshot. If the full E2E is too slow locally, document why it was not run and make sure CI runs `e2e:desktop:embedded-browser`.
 

docs/zh/wework/browser.md

@@ -14,6 +14,8 @@ Wework 内置浏览器位于右侧工作区，可在处理任务时查看网页
 
 浏览器会保留当前地址、标题和页面状态。切换到文件或审核标签页不会关闭网页。右侧工作区一次保留一个浏览器标签页。`file://` 地址和 `/Users/.../file.html` 这类本机绝对路径适合预览本机 HTML、PDF、图片和文本文件，也可以打开本机目录。Markdown、无扩展名的文本文件也会按文本预览。目录会显示为只读索引页，点击子目录可继续浏览，点击文件会进入对应预览；如果文件类型无法预览，Wework 会取消本地文件下载并弹出一个短暂提示。
 
+顶部可以同时打开多个任务标签页，每个任务都拥有独立的内置浏览器页面。切换到其它任务后，原任务的浏览器会保持隐藏运行；该任务中的 AI 仍可继续打开、等待和检查页面，切回任务时会显示最新页面状态。浏览器页面不会跨任务共享。目前一个任务的右侧工作区仍只提供一个浏览器标签页，不提供浏览器内部的多标签栏。
+
 编辑地址栏时，后台页面状态同步不会覆盖正在输入的地址。如果浏览器已经打开网页，未提交直接离开地址栏时会恢复当前页面的真实地址；如果尚未打开网页，未提交的地址会保留，并在切换会话后恢复。
 
 Wework 弹窗、菜单或浮层与右侧浏览器区域重叠时，浏览器会暂时隐藏，避免原生网页遮挡主界面操作。关闭或移开浮层后，浏览器会自动恢复。

docs/zh/wework/developer-guide/wework-embedded-browser.md

@@ -55,11 +55,14 @@ Agent 面向模型暴露的是浏览器动作工具，而不是底层 WebKit API
 - 未创建运行任务的新对话使用当前 pane key 生成临时浏览器 label。
 - 新对话发送后如果创建了 runtime task，Wework 会把临时浏览器 relabel 到新 task label。
 - 切换任务时，只显示当前 pane/task 绑定的浏览器；其它任务的页面不会跨 pane 泄漏。
-- MCP 打开请求先使用默认 label；当前 pane 失活时，Wework 会把 WebView 迁移到任务专属 label，并且只有活跃任务可以接管默认 label。
+- Executor 为已有 runtime task 注入任务专属 label；临时新对话才使用默认或 pane label，并且只有活跃任务可以接管默认 label。
+- 顶层任务标签页失活时必须继续保留 workbench effect，使任务专属 bridge listener 可以处理后台 `open`、`waitFor` 和 `inspect`。React 表面通过 `hidden` 隐藏，原生 WebView 保持不可见；不要让非任务标签页承担这项保活成本。
 - 浏览器右侧面板关闭时，原生 WebView 会被隐藏到不可见区域，不应覆盖聊天区、debug panel 或分割线。
 
 这种绑定保证“用户看到的浏览器”和“agent 控制的浏览器”是同一个对象。
 
+当前每个 pane/task label 对应一个浏览器宿主。Wework 顶层可以同时保留多个任务标签页及其独立浏览器，但单个任务内部没有浏览器多标签模型；如果新增浏览器内部多标签，必须同时扩展 bridge 路由标识、生命周期和 Agent 工具协议，不能复用另一个任务的宿主模拟。
+
 程序化首次打开必须把“面板已请求打开”和“原生 WebView 已可导航”视为两个不同阶段。bridge 应保存带 request ID 的待处理导航，等任务对应的浏览器宿主获得非零可见尺寸并进入 ready 状态后再执行；监听器晚于请求注册时，前端必须通过待处理请求快照恢复事件。只有原生 WebView 已导航到请求地址后才能向工具返回成功，不能仅因右侧面板或空白 WebView 已创建就报告成功。
 
 任务切换或组件卸载时，关闭请求必须携带预期的原生 label。过期 pane 只能关闭自己创建的 WebView，不能关闭已经迁移或由新 pane 接管的实例。非活跃任务可以提前创建隐藏且 ready 的浏览器，但不能显示在当前任务上方。
@@ -113,7 +116,7 @@ cargo test --manifest-path wework/src-tauri/Cargo.toml embedded_browser
 pnpm --filter wework e2e:desktop:embedded-browser
 ```
 
-`e2e:desktop:embedded-browser` 必须从新建本地任务执行第一次 bridge `open`，验证它在工具超时前完成、只产生一个可见原生宿主，并保留请求 URL。仅验证第二次打开或手工先展开浏览器面板不能覆盖首次打开竞态。
+`e2e:desktop:embedded-browser` 必须在任务 A 创建后切换到任务 B，再使用任务 A 的专属 label 执行第一次 bridge `open`、`waitFor` 和 `inspect`，验证非活跃任务能在工具超时前完成后台导航且不会接管任务 B 的浏览器。切回任务 A 后还要验证同一页面状态可见。仅验证第二次打开、活跃任务打开或手工先展开浏览器面板，不能覆盖首次打开和非活跃任务路由竞态。
 
 浏览器涉及 Tauri 命令、原生 WebView、IPC 或 Agent 操作链路时，还应使用 `pnpm --filter wework ai:verify start` 启动隔离真实 Tauri 会话，并记录打开页面、inspect、动作和截图的验证证据。完整 E2E 太慢时，合并前至少要说明未运行的原因，并确保 CI 中的 `e2e:desktop:embedded-browser` 会覆盖该场景。