fix:disable-agent-sandbox-at-runtime

scripts/browser-automation-regression.cjs

@@ -174,11 +174,14 @@ if (!process.versions.electron) {
     await rejected({ action: 'open', url: 'javascript:alert(1)' }, /HTTP/)
     await rejected({ action: 'open', url: 'http://user:password@localhost/' }, /HTTP/)
     check('file, script and credential URLs are refused', BrowserWindow.getAllWindows().length === 0)
-    await rejected({ action: 'open', url: fixture.base + '/page' }, /批准/, ctx('denied', { permissionMode: 'default-sandbox', approve: async () => false }))
-    check('default permission refusal creates no browser', BrowserWindow.getAllWindows().length === 0)
     const blocked = await host.executeTurnTool('browser', { action: 'open', url: fixture.base + '/page' },
       { ...ctx('mode-denied'), agentMode: 'plan', emit() {} })
     check('plan mode cannot bypass the shared tool gate', !blocked.ok && BrowserWindow.getAllWindows().length === 0)
+    const hostBrowserContext = ctx('host-browser', { permissionMode: 'default-sandbox', approve: async () => false })
+    const hostBrowser = await ok({ action: 'open', url: fixture.base + '/page' }, hostBrowserContext)
+    check('host browser opens without sandbox approval', BrowserWindow.getAllWindows().length === 1)
+    await ok({ action: 'close', tabId: hostBrowser.data.tabId }, hostBrowserContext)
+    check('host browser close releases the unapproved tab', BrowserWindow.getAllWindows().length === 0)
     const first = await ok({ action: 'open', url: fixture.base + '/page' })
     const id = first.data.tabId
     check('real hidden Chromium returns the rendered page and interactive refs', first.data.text.includes('BROWSER_FIXTURE') && first.data.elements.some(element => element.name === 'Apply'))
@@ -220,8 +223,9 @@ if (!process.versions.electron) {
     await rejected({ action: 'click', tabId: id, ref: oldRef }, /ref/)
     check('refs from previous documents cannot trigger new-page controls', true)
     let approvals = 0
-    await ok({ action: 'open', url: fixture.base + '/page' }, ctx('approved', { permissionMode: 'default-sandbox', approve: async () => { approvals++; return true } }))
-    check('default permission supports explicit approval', approvals === 1)
+    const noApproval = await ok({ action: 'open', url: fixture.base + '/page' }, ctx('approved', { permissionMode: 'default-sandbox', approve: async () => { approvals++; return true } }))
+    check('legacy sandbox approval callback is never invoked', approvals === 0)
+    await ok({ action: 'close', tabId: noApproval.data.tabId }, ctx('approved'))
     const cancellation = new AbortController(), started = Date.now()
     setTimeout(() => cancellation.abort(), 150)
     await rejected({ action: 'open', url: fixture.base + '/hang' }, /取消/, ctx('cancelled-open', { signal: cancellation.signal }))