Module browser_owner 

Which agent owns which agent-opened browser pane (docs/specs/SPEC_AGENT_DRIVEN_BROWSER_PANES_2026_10_07.md §3).

An agent may drive a browser pane only if it opened that pane with OpenBrowser. The authority is this in-memory map, written only by ui_handlers::handle_ui_browser_open after verifying the caller’s signed identity. The block’s browser:owner_agent meta key mirrors it for the “Driven by” badge, and both must agree:

• a client that writes the meta key itself gains nothing, since the map has no entry for it;
• a duplicated pane copies the meta key but gets a new block id, which the map doesn’t know;
• the human’s Take over clears the meta key; the client-write guard (guard_client_meta_write) then drops the map entry, so ownership ends for good, and no client can set the key at all;
• deleting the block drops its entry (wcore::delete_block);
• after srv restarts the map is empty, so agents reopen their panes.

Enums

Denied 🔒

Why a caller may not drive a pane. Not an authentication failure: the caller’s identity was already verified.

Constants

OWNER_META_KEY 🔒

Block meta key mirroring the owner, for the frontend.

Functions

changed 🔒

Woken whenever the set of owned panes changes, or the host needs the whole set again (it registered). See browser_host_sync.

check 🔒

May agent_id drive pane? block is the pane’s block as stored (None if it no longer exists) and recorded its entry in the owner map.

forget 🔒

Drop block_id’s owner: the pane was deleted or taken over.

guard_client_meta_write 🔒

Guard for meta updates that come from a client (the setmeta WebSocket command and the UpdateObjectMeta service call), not from srv itself. browser:owner_agent is srv’s to write: a client may only clear it, which is the human’s Take over and ends that pane’s ownership for good. Setting or changing it is refused, so a taken-over agent can’t write itself back. browser:attention (the hand-off and approval banner) is srv’s alone: a client that could write it could keep a real request’s id and change what the banner tells the human they’re approving.

owned_panes 🔒

Every pane an agent owns. The host keeps a copy, to decide inside on_before_popup which of a pane’s popups open in-app (SPEC_BROWSER_PANE_NATIVE_POPUPS_AGENT_DRIVEN_2026_10_08.md §3); it is only a hint there, since who may drive what is always checked here.

owner_of 🔒

owners 🔒

record 🔒

Record agent_id as the owner of block_id. Only OpenBrowser calls this.

srv_only_keys 🔒

Meta keys only srv writes, from its own records: who drives a pane, the banner that asks the person something, what opened a popup, and the sites a pane is limited to.

strip_srv_only_keys 🔒

Remove srv-only keys from the meta a client gives a NEW block (pane.open over RPC or HTTP, object.CreateBlock). Removed rather than refused, so duplicating a pane still works: the copy is an ordinary pane, without an owner, a banner, or a claim to be a popup. srv’s own callers (OpenBrowser, the popup route) set these keys after this check, through open_pane directly. Returns the keys it removed.