From da39ad394e58748656e75de091c31974829de81b Mon Sep 17 00:00:00 2001
From: PieMH <pdondiw@gmail.com>
Date: Sun, 18 Oct 2026 22:55:07 +0200
Subject: [PATCH 1/5] Browser panel tabs: tab strip on one shared profile,
 popups open a new tab, tab tools for Claude

Every tab is its own WebView2 on the panel's one CoreWebView2Environment. window.open and target=_blank open a new tab in front (still gated by SchemeAllowed, max 20 tabs). The Browser tool gains tabs, new_tab, switch_tab and close_tab; the other tools act on the front tab, captured once per call, with both page checks on that tab.
---
 src/CCWrapper/Terminal/BrowserMcp.cs          |  53 ++++-
 src/CCWrapper/Terminal/Smoke.cs               |  37 ++-
 src/CCWrapper/Theme.xaml                      |  31 +++
 src/CCWrapper/Views/BrowserPanel.Driver.cs    | 145 ++++++++----
 src/CCWrapper/Views/BrowserPanel.xaml         |  18 +-
 src/CCWrapper/Views/BrowserPanel.xaml.cs      | 220 +++++++++++++++---
 .../Terminal/BrowserMcpTests.cs               |  39 +++-
 .../CCWrapper.Tests/Views/PanelLogicTests.cs  |  65 ++++++
 8 files changed, 510 insertions(+), 98 deletions(-)

diff --git a/src/CCWrapper/Terminal/BrowserMcp.cs b/src/CCWrapper/Terminal/BrowserMcp.cs
index d75631f..6f6f9f9 100644
--- a/src/CCWrapper/Terminal/BrowserMcp.cs
+++ b/src/CCWrapper/Terminal/BrowserMcp.cs
@@ -9,7 +9,9 @@ namespace CCWrapper.Terminal;
 /// limit is abandoned (its token cancelled) and the next one may start while it lingers. A failure throws, and the
 /// exception's message is what Claude reads, so make it say what went wrong ("No element matches #login").</summary>
 /// <remarks>A <c>target</c> that is all ASCII digits is a ref number from the latest <see cref="SnapshotAsync"/>; anything
-/// else is a CSS selector, and the first element it matches is used. A ref that no longer exists throws.</remarks>
+/// else is a CSS selector, and the first element it matches is used. A ref that no longer exists throws.
+/// <para>The panel has tabs of its own, each with an id (1, 2, 3…, never reused). Every member but the four tab members acts on
+/// the front tab; a page's target=_blank or window.open opens a new tab in front.</para></remarks>
 public interface IBrowserDriver
 {
     /// <summary>Opens <paramref name="url"/> and waits for the page to load. Returns a short text for Claude, e.g. the final
@@ -37,6 +39,18 @@ public interface IBrowserDriver
     /// <summary>Calls one Chrome DevTools Protocol method on the page (<paramref name="paramsJson"/> is a JSON object) and
     /// returns its JSON result.</summary>
     Task<string> DevToolsAsync(string method, string paramsJson, CancellationToken ct);
+
+    /// <summary>The open tabs as text: id, title and URL of each, and which one is in front.</summary>
+    Task<string> TabsAsync(CancellationToken ct);
+
+    /// <summary>Opens a new tab in front, loads <paramref name="url"/> in it and waits for the page to load.</summary>
+    Task<string> NewTabAsync(string url, CancellationToken ct);
+
+    /// <summary>Brings tab <paramref name="id"/> to front. An unknown id throws.</summary>
+    Task<string> SwitchTabAsync(int id, CancellationToken ct);
+
+    /// <summary>Closes tab <paramref name="id"/>; closing the last one leaves one blank tab. An unknown id throws.</summary>
+    Task<string> CloseTabAsync(int id, CancellationToken ct);
 }
 
 /// <summary>The MCP server of the Browser tool, without its transport: one newline-delimited JSON-RPC 2.0 message in, zero
@@ -136,6 +150,10 @@ async Task<string> CallAsync(JsonNode? id, JsonObject? p, CancellationToken ct)
                 }), (a, c) => DevToolsRefusal(a.Method) is { } why
                     ? Task.FromException<string>(new InvalidOperationException(why))
                     : driver.DevToolsAsync(a.Method, a.Params, c)),
+                "tabs" => c => TextResult(driver.TabsAsync(c)),
+                "new_tab" => Run(args["url"] is null ? "about:blank" : Arg(args, "url"), driver.NewTabAsync),
+                "switch_tab" => Run(Id(args), driver.SwitchTabAsync),
+                "close_tab" => Run(Id(args), driver.CloseTabAsync),
                 var name => throw new ArgumentException("Unknown tool: " + name),
             };
         }
@@ -163,6 +181,9 @@ JsonValue v when v.GetValueKind() == JsonValueKind.Number => v.ToJsonString(),
         _ => throw new ArgumentException($"Missing or invalid '{key}'."),
     };
 
+    static int Id(JsonObject args) => args["id"] is JsonValue v && v.GetValueKind() == JsonValueKind.Number && v.TryGetValue(out int id)
+        ? id : throw new ArgumentException("Missing or invalid 'id': a tab id (an integer) from the tabs tool.");
+
     static Func<CancellationToken, Task<JsonObject>> Run<T>(T args, Func<T, CancellationToken, Task<string>> call) => c => TextResult(call(args, c));
 
     static string? Text(JsonNode? node) => node is JsonValue v && v.TryGetValue(out string? s) ? s : null;
@@ -184,35 +205,49 @@ static string Result(JsonNode? id, JsonNode result) =>
     static string Error(JsonNode? id, int code, string message) =>
         new JsonObject { ["jsonrpc"] = "2.0", ["id"] = id?.DeepClone(), ["error"] = new JsonObject { ["code"] = code, ["message"] = message } }.ToJsonString();
 
+    const string TabId = """{ "type": "integer", "description": "A tab id from the tabs tool." }""";
+
     const string Target = """{ "type": "string", "description": "A ref number from the latest snapshot (e.g. \"12\"), or a CSS selector." }""";
 
     const string Tools = $$"""
         [
           { "name": "navigate",
-            "description": "Open a URL in CCWrapper's Browser panel (the browser inside this app, beside the terminal) and wait for it to load.",
+            "description": "Open a URL in the front tab of CCWrapper's Browser panel (the browser inside this app, beside the terminal) and wait for it to load. The panel has tabs: every tool but tabs, new_tab, switch_tab and close_tab acts on the front tab, and a link or window.open that opens a new window opens a new tab in front.",
             "inputSchema": { "type": "object", "properties": { "url": { "type": "string", "description": "The address to open, e.g. https://example.com." } }, "required": ["url"] } },
           { "name": "snapshot",
-            "description": "Read the current page as text: headings, text, links, buttons and form fields, each element you can click or type into tagged with a ref number like [12]. Take a new snapshot after the page changes: each one renumbers the refs.",
+            "description": "Read the front tab's page as text: headings, text, links, buttons and form fields, each element you can click or type into tagged with a ref number like [12]. Take a new snapshot after the page changes: each one renumbers the refs.",
             "inputSchema": { "type": "object", "properties": {} } },
           { "name": "click",
-            "description": "Click an element of the current page.",
+            "description": "Click an element of the front tab's page. If it opens a new tab, that tab comes to front and the result says so.",
             "inputSchema": { "type": "object", "properties": { "target": {{Target}} }, "required": ["target"] } },
           { "name": "type",
-            "description": "Replace the value of an input, textarea or editable element with text, as if typed. Set submit to press Enter afterwards.",
+            "description": "Replace the value of an input, textarea or editable element of the front tab's page with text, as if typed. Set submit to press Enter afterwards.",
             "inputSchema": { "type": "object", "properties": { "target": {{Target}},
               "text": { "type": "string", "description": "The text to type." },
               "submit": { "type": "boolean", "description": "Press Enter after typing. Default false." } }, "required": ["target", "text"] } },
           { "name": "screenshot",
-            "description": "Capture the visible part of the current page as a PNG image.",
+            "description": "Capture the visible part of the front tab's page as a PNG image.",
             "inputSchema": { "type": "object", "properties": {} } },
           { "name": "evaluate",
-            "description": "Run a JavaScript expression in the current page and return its value as JSON. A returned Promise is awaited.",
+            "description": "Run a JavaScript expression in the front tab's page and return its value as JSON. A returned Promise is awaited.",
             "inputSchema": { "type": "object", "properties": { "expression": { "type": "string", "description": "The JavaScript expression, e.g. document.title." } }, "required": ["expression"] } },
           { "name": "devtools",
-            "description": "Call a Chrome DevTools Protocol method on the current page (e.g. Emulation.setDeviceMetricsOverride, Network.getResponseBody) and return its JSON result. For what the other tools cannot do. {{DevToolsLimits}}",
+            "description": "Call a Chrome DevTools Protocol method on the front tab's page (e.g. Emulation.setDeviceMetricsOverride, Network.getResponseBody) and return its JSON result. For what the other tools cannot do. {{DevToolsLimits}}",
             "inputSchema": { "type": "object", "properties": {
               "method": { "type": "string", "description": "The CDP method, Domain.method." },
-              "params": { "type": "object", "description": "The method's parameters. Default {}." } }, "required": ["method"] } }
+              "params": { "type": "object", "description": "The method's parameters. Default {}." } }, "required": ["method"] } },
+          { "name": "tabs",
+            "description": "List the Browser panel's tabs: the id, title and URL of each, and which one is in front (the one the other tools act on). A tab showing a page that is not a web address lists as (not a web page).",
+            "inputSchema": { "type": "object", "properties": {} } },
+          { "name": "new_tab",
+            "description": "Open a new tab in front and load a URL in it; the other tools then act on it. At most 20 tabs.",
+            "inputSchema": { "type": "object", "properties": { "url": { "type": "string", "description": "The address to open, e.g. https://example.com. Default about:blank." } } } },
+          { "name": "switch_tab",
+            "description": "Bring a tab to front, so the other tools act on it.",
+            "inputSchema": { "type": "object", "properties": { "id": {{TabId}} }, "required": ["id"] } },
+          { "name": "close_tab",
+            "description": "Close a tab. Closing the last tab leaves one blank tab.",
+            "inputSchema": { "type": "object", "properties": { "id": {{TabId}} }, "required": ["id"] } }
         ]
         """;
 }
diff --git a/src/CCWrapper/Terminal/Smoke.cs b/src/CCWrapper/Terminal/Smoke.cs
index abeaf2e..5475384 100644
--- a/src/CCWrapper/Terminal/Smoke.cs
+++ b/src/CCWrapper/Terminal/Smoke.cs
@@ -81,12 +81,13 @@ static async Task<bool> TalkAsync(Process relay)
         var list = await Ask("""{"jsonrpc":"2.0","id":2,"method":"tools/list"}""");
         var call = await Ask("""{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"snapshot","arguments":{}}}""");
         return init?["result"]?["serverInfo"]?["name"]?.GetValue<string>() == "ccwrapper-browser"
-            && list?["result"]?["tools"]?.AsArray().Count == 7
+            && list?["result"]?["tools"]?.AsArray().Count == 11
             && call?["id"]?.GetValue<int>() == 3
             && call?["result"]?["content"]?[0]?["text"]?.GetValue<string>() == "smoke-snapshot";
     }
 
-    // The real Browser panel in a throwaway profile: snapshot refs, typing, clicking and evaluating on a data: page.
+    // The real Browser panel in a throwaway profile: snapshot refs, typing, clicking and evaluating on a data: page; then tabs:
+    // a window.open that becomes a tab with its opener's window object, new_tab, switch_tab and close_tab.
     static async Task<bool> PanelAsync()
     {
         var dir = Path.Combine(Path.GetTempPath(), "ccw-smoke-browser");
@@ -99,14 +100,15 @@ static async Task<bool> PanelAsync()
             ShowInTaskbar = false, ShowActivated = false,
         }.Show();
         var run = PanelStepsAsync(panel);
-        if (await Task.WhenAny(run, Task.Delay(TimeSpan.FromSeconds(40))) == run && await run) return true;
+        if (await Task.WhenAny(run, Task.Delay(TimeSpan.FromSeconds(60))) == run && await run) return true;
         Console.Error.WriteLine("smoke: the Browser panel steps failed");
         return false;
     }
 
     static async Task<bool> PanelStepsAsync(IBrowserDriver panel)
     {
-        const string html = "<h1>Smoke</h1><a href='#x'>link</a><input name=q placeholder=Q><button onclick=\"document.title='clicked:'+document.querySelector('input').value\">Go</button>";
+        const string html = "<h1>Smoke</h1><a href='#x'>link</a><input name=q placeholder=Q><button onclick=\"document.title='clicked:'+document.querySelector('input').value\">Go</button>"
+            + "<button id=pop onclick=\"window.w=window.open('about:blank')\">Pop</button>";
         await panel.NavigateAsync("data:text/html," + Uri.EscapeDataString(html), default);
         var snap = await panel.SnapshotAsync(default);
         var button = System.Text.RegularExpressions.Regex.Match(snap, @"\[(\d+)\] button ""Go""");
@@ -117,7 +119,28 @@ static async Task<bool> PanelStepsAsync(IBrowserDriver panel)
         var title = await panel.EvaluateAsync("document.title", default);
         try { await panel.ClickAsync("999", default); return false; }
         catch (InvalidOperationException ex) when (ex.Message.StartsWith("No element matches")) { }
-        return title == "\"clicked:hello\"";
+        if (title != "\"clicked:hello\"") return false;
+        return await TabStepsAsync(panel);
+    }
+
+    static async Task<bool> TabStepsAsync(IBrowserDriver panel)
+    {
+        if (!(await panel.ClickAsync("#pop", default)).Contains("Tab 2 is now in front") || !(await panel.TabsAsync(default)).Contains("Tab 2 (front): ")) return false;
+        await panel.SwitchTabAsync(1, default);
+        if (await panel.EvaluateAsync("!!window.w && !window.w.closed", default) != "true") return false; // the popup tab kept its opener link
+        var opened = await panel.NewTabAsync("data:text/html," + Uri.EscapeDataString("<title>Two</title><h1>Second</h1>"), default);
+        if (!opened.StartsWith("Opened tab 3 in front. Loaded") || await panel.EvaluateAsync("document.title", default) != "\"Two\"") return false;
+        await panel.SwitchTabAsync(1, default);
+        await panel.SwitchTabAsync(3, default);
+        var tabs = await panel.TabsAsync(default);
+        if (!tabs.Contains("Tab 1: clicked:hello - data:") || !tabs.Contains("Tab 3 (front): Two - data:")) return false;
+        await panel.CloseTabAsync(3, default);
+        await panel.CloseTabAsync(2, default);
+        var left = await panel.TabsAsync(default);
+        if (left.Contains("Tab 2") || left.Contains("Tab 3") || !left.Contains("Tab 1 (front)")) return false;
+        try { await panel.SwitchTabAsync(3, default); return false; }
+        catch (InvalidOperationException ex) when (ex.Message.StartsWith("There is no tab 3")) { }
+        return (await panel.SnapshotAsync(default)).Contains("# Smoke");
     }
 
     sealed class SmokeDriver : IBrowserDriver
@@ -129,5 +152,9 @@ sealed class SmokeDriver : IBrowserDriver
         public Task<byte[]> ScreenshotAsync(CancellationToken ct) => throw new NotSupportedException();
         public Task<string> EvaluateAsync(string expression, CancellationToken ct) => throw new NotSupportedException();
         public Task<string> DevToolsAsync(string method, string paramsJson, CancellationToken ct) => throw new NotSupportedException();
+        public Task<string> TabsAsync(CancellationToken ct) => throw new NotSupportedException();
+        public Task<string> NewTabAsync(string url, CancellationToken ct) => throw new NotSupportedException();
+        public Task<string> SwitchTabAsync(int id, CancellationToken ct) => throw new NotSupportedException();
+        public Task<string> CloseTabAsync(int id, CancellationToken ct) => throw new NotSupportedException();
     }
 }
diff --git a/src/CCWrapper/Theme.xaml b/src/CCWrapper/Theme.xaml
index 1818967..dcf18b7 100644
--- a/src/CCWrapper/Theme.xaml
+++ b/src/CCWrapper/Theme.xaml
@@ -332,6 +332,37 @@
         </Setter>
     </Style>
 
+    <!-- A Browser panel tab: title and close button, left aligned; the checked one is the front tab -->
+    <Style x:Key="BrowserTab" TargetType="RadioButton">
+        <Setter Property="Foreground" Value="{StaticResource Muted}" />
+        <Setter Property="Height" Value="28" />
+        <Setter Property="MaxWidth" Value="200" />
+        <Setter Property="Margin" Value="0,0,2,0" />
+        <Setter Property="Padding" Value="10,0,2,0" />
+        <Setter Property="Cursor" Value="Hand" />
+        <Setter Property="Template">
+            <Setter.Value>
+                <ControlTemplate TargetType="RadioButton">
+                    <Border x:Name="Bd" Background="Transparent" BorderBrush="Transparent" BorderThickness="1" CornerRadius="6" Padding="{TemplateBinding Padding}">
+                        <ContentPresenter VerticalAlignment="Center" />
+                    </Border>
+                    <ControlTemplate.Triggers>
+                        <Trigger Property="IsMouseOver" Value="True">
+                            <Setter Property="Foreground" Value="{StaticResource Text}" />
+                        </Trigger>
+                        <Trigger Property="IsChecked" Value="True">
+                            <Setter TargetName="Bd" Property="Background" Value="{StaticResource Hover}" />
+                            <Setter Property="Foreground" Value="{StaticResource Text}" />
+                        </Trigger>
+                        <Trigger Property="IsKeyboardFocused" Value="True">
+                            <Setter TargetName="Bd" Property="BorderBrush" Value="{StaticResource Accent}" />
+                        </Trigger>
+                    </ControlTemplate.Triggers>
+                </ControlTemplate>
+            </Setter.Value>
+        </Setter>
+    </Style>
+
     <!-- On/off switch: accent track with the knob right when on. No animation. -->
     <Style x:Key="Switch" TargetType="ToggleButton">
         <Setter Property="Width" Value="52" />
diff --git a/src/CCWrapper/Views/BrowserPanel.Driver.cs b/src/CCWrapper/Views/BrowserPanel.Driver.cs
index e0b4ef2..ac7609f 100644
--- a/src/CCWrapper/Views/BrowserPanel.Driver.cs
+++ b/src/CCWrapper/Views/BrowserPanel.Driver.cs
@@ -7,42 +7,42 @@
 
 namespace CCWrapper.Views;
 
-/// <summary>The Browser tool's hands: Claude's calls drive this panel's own WebView2, in-process (no remote debugging port).</summary>
+/// <summary>The Browser tool's hands: Claude's calls drive this panel's own WebView2s, in-process (no remote debugging port).
+/// Every tool but the tab tools acts on the front tab.</summary>
 public partial class BrowserPanel : IBrowserDriver
 {
     static readonly TimeSpan LoadLimit = TimeSpan.FromSeconds(30), StartLimit = TimeSpan.FromSeconds(20), ActionLimit = TimeSpan.FromSeconds(3);
 
-    readonly TaskCompletionSource _ready = new(TaskCreationOptions.RunContinuationsAsynchronously);
-
     public Task<string> NavigateAsync(string url, CancellationToken ct)
     {
         url = NormalizeUrl(url);
-        return SchemeAllowed(url) ? NavigateAllowedAsync(url, ct)
-            : Task.FromException<string>(new InvalidOperationException($"Refused {url}: the navigate tool opens only http, https, blob, about:blank and data addresses."));
+        return OpenRefusal("navigate", url) is { } why ? Task.FromException<string>(new InvalidOperationException(why))
+            : OnUi(ct, core => LoadAsync(core, url, ct), anyPage: true);
     }
 
-    Task<string> NavigateAllowedAsync(string url, CancellationToken ct) => OnUi(ct, async core =>
+    async Task<string> LoadAsync(CoreWebView2 core, string url, CancellationToken ct)
     {
-        var done = await AfterAsync(() => { Navigate(url); return Task.CompletedTask; }, LoadLimit, certain: true, ct);
+        var done = await AfterAsync(core, () => { core.Navigate(url); return Task.CompletedTask; }, LoadLimit, certain: true, ct);
         return done is null ? $"Still loading after 30 s: {core.Source}"
             : done.IsSuccess ? $"Loaded {core.Source} (title: {core.DocumentTitle})"
             : $"Could not load {url}: {done.WebErrorStatus}";
-    }, anyPage: true);
+    }
 
     public Task<string> SnapshotAsync(CancellationToken ct) =>
-        OnUi(ct, async _ => (string)(await Js(BrowserScripts.Snapshot))["value"]!);
+        OnUi(ct, async core => (string)(await Js(core, BrowserScripts.Snapshot))["value"]!);
 
     public Task<string> ClickAsync(string target, CancellationToken ct) => OnUi(ct, async core =>
     {
-        await AfterAsync(async () =>
+        var front = _tabs.Front;
+        await AfterAsync(core, async () =>
         {
-            if ((await Js(BrowserScripts.Call(BrowserScripts.Click, BrowserScripts.Selector(target), target)))["value"] is not JsonArray at) return;
+            if ((await Js(core, BrowserScripts.Call(BrowserScripts.Click, BrowserScripts.Selector(target), target)))["value"] is not JsonArray at) return;
             double x = (double)at[0]!, y = (double)at[1]!;
-            await Mouse("mouseMoved", x, y);
-            await Mouse("mousePressed", x, y);
-            await Mouse("mouseReleased", x, y);
+            await Mouse(core, "mouseMoved", x, y);
+            await Mouse(core, "mousePressed", x, y);
+            await Mouse(core, "mouseReleased", x, y);
         }, ActionLimit, certain: false, ct);
-        return $"Clicked {target}. URL: {core.Source}";
+        return $"Clicked {target}. URL: {core.Source}{FrontNote(front)}";
     });
 
     public Task<string> TypeAsync(string target, string text, bool submit, CancellationToken ct) => OnUi(ct, async core =>
@@ -50,18 +50,22 @@ public Task<string> TypeAsync(string target, string text, bool submit, Cancellat
         async Task Enter()
         {
             foreach (var type in new[] { "keyDown", "keyUp" })
-                await Cdp("Input.dispatchKeyEvent", new JsonObject
+                await Cdp(core, "Input.dispatchKeyEvent", new JsonObject
                 {
                     ["type"] = type, ["key"] = "Enter", ["code"] = "Enter", ["windowsVirtualKeyCode"] = 13, ["text"] = type == "keyDown" ? "\r" : "",
                 });
         }
-        await Js(BrowserScripts.Call(BrowserScripts.Focus, BrowserScripts.Selector(target), target));
-        if (text.Length > 0) await Cdp("Input.insertText", new JsonObject { ["text"] = text });
-        else await Js("document.execCommand('delete')"); // insertText of nothing would leave the old value
-        if (submit) await AfterAsync(Enter, ActionLimit, certain: false, ct);
-        return $"Typed {text.Length} characters into {target}{(submit ? " and pressed Enter" : "")}. URL: {core.Source}";
+        var front = _tabs.Front;
+        await Js(core, BrowserScripts.Call(BrowserScripts.Focus, BrowserScripts.Selector(target), target));
+        if (text.Length > 0) await Cdp(core, "Input.insertText", new JsonObject { ["text"] = text });
+        else await Js(core, "document.execCommand('delete')"); // insertText of nothing would leave the old value
+        if (submit) await AfterAsync(core, Enter, ActionLimit, certain: false, ct);
+        return $"Typed {text.Length} characters into {target}{(submit ? " and pressed Enter" : "")}. URL: {core.Source}{FrontNote(front)}";
     });
 
+    // A click that opened a new tab (target=_blank, window.open) moved the front.
+    string FrontNote(int before) => _tabs.Front == before ? "" : $" Tab {_tabs.Front} is now in front; the other tools act on it (tabs lists the tabs).";
+
     public Task<byte[]> ScreenshotAsync(CancellationToken ct) => OnUi(ct, async core =>
     {
         using var png = new MemoryStream();
@@ -69,9 +73,9 @@ public Task<byte[]> ScreenshotAsync(CancellationToken ct) => OnUi(ct, async core
         return png.ToArray();
     });
 
-    public Task<string> EvaluateAsync(string expression, CancellationToken ct) => OnUi(ct, async _ =>
+    public Task<string> EvaluateAsync(string expression, CancellationToken ct) => OnUi(ct, async core =>
     {
-        var result = await Js(expression);
+        var result = await Js(core, expression);
         return result["type"]?.ToString() == "undefined" ? "undefined" : result["value"]?.ToJsonString() ?? "null";
     });
 
@@ -81,38 +85,94 @@ public Task<string> DevToolsAsync(string method, string paramsJson, Cancellation
         return core.CallDevToolsProtocolMethodAsync(method, paramsJson);
     });
 
-    /// <summary>On the UI thread, with the panel in front and its WebView2 started: a TabControl loads only the selected tab.
-    /// Refuses, before and after the body, unless the page shown is a web page (history, an address-bar file: page...); only navigate passes <paramref name="anyPage"/>.</summary>
-    async Task<T> OnUi<T>(CancellationToken ct, Func<CoreWebView2, Task<T>> body, bool anyPage = false) => await await Dispatcher.InvokeAsync(async () =>
+    public Task<string> TabsAsync(CancellationToken ct) => Ui(ct, async () =>
     {
-        if (Parent is TabItem { IsSelected: false } tab)
+        var rows = new List<(int, string?, string?, bool)>();
+        foreach (var (id, tab) in _tabs.All.ToList())
         {
-            tab.IsSelected = true;
+            string? title = "(not started)", url = tab.Pending ?? "about:blank";
+            if (tab.Ready.IsCompletedSuccessfully)
+            {
+                var core = tab.Web.CoreWebView2;
+                title = core.DocumentTitle;
+                try { url = await SourceOf(core).WaitAsync(ActionLimit, ct); }
+                catch (Exception) when (!ct.IsCancellationRequested) { url = null; } // a page that does not answer lists as not a web page
+            }
+            rows.Add((id, title, url, id == _tabs.Front));
+        }
+        return DescribeTabs(rows);
+    });
+
+    public Task<string> NewTabAsync(string url, CancellationToken ct)
+    {
+        url = NormalizeUrl(url);
+        return OpenRefusal("new_tab", url) is { } why ? Task.FromException<string>(new InvalidOperationException(why)) : Ui(ct, async () =>
+        {
+            var tab = AddTab() ?? throw new InvalidOperationException($"The Browser panel already has {BrowserTabs<Tab>.Max} tabs; close one first.");
+            return $"Opened tab {tab.Id} in front. " + await LoadAsync(await Started(tab, ct), url, ct);
+        });
+    }
+
+    public Task<string> SwitchTabAsync(int id, CancellationToken ct) => Ui(ct, () =>
+    {
+        Show(_tabs[id] ?? throw NoTab(id));
+        return Task.FromResult($"Tab {id} is in front; the other tools act on it.");
+    });
+
+    public Task<string> CloseTabAsync(int id, CancellationToken ct) => Ui(ct, () =>
+        Task.FromResult(CloseTab(id) ? $"Closed tab {id}. Tab {_tabs.Front} is in front." : throw NoTab(id)));
+
+    static InvalidOperationException NoTab(int id) => new($"There is no tab {id}; the tabs tool lists the open tabs.");
+
+    /// <summary>On the UI thread, with the panel in front: a TabControl loads only the selected tab.</summary>
+    async Task<T> Ui<T>(CancellationToken ct, Func<Task<T>> body) => await await Dispatcher.InvokeAsync(async () =>
+    {
+        if (Parent is TabItem { IsSelected: false } item)
+        {
+            item.IsSelected = true;
             await Dispatcher.Yield(DispatcherPriority.Loaded); // let the panel lay out, so a screenshot is not a blank frame
         }
-        try { await _ready.Task.WaitAsync(StartLimit, ct); }
-        catch (TimeoutException) { throw new InvalidOperationException("The Browser panel's WebView2 did not start within 20 s."); }
+        return await body().WaitAsync(ct);
+    }, DispatcherPriority.Normal, ct);
+
+    /// <summary>Runs <paramref name="body"/> on the front tab's WebView2, once started. That tab stays the one the call works on even
+    /// if another comes to front meanwhile. Refuses, before and after the body, unless its page is a web page (history, an
+    /// address-bar file: page...); only navigate passes <paramref name="anyPage"/>.</summary>
+    Task<T> OnUi<T>(CancellationToken ct, Func<CoreWebView2, Task<T>> body, bool anyPage = false) => Ui(ct, async () =>
+    {
+        var tab = Front;
+        var core = await Started(tab, ct);
         async Task Check()
         {
-            var source = Web.CoreWebView2.Source;
-            if (source.Length == 0) source = (string?)(await Js("location.href"))["value"] ?? ""; // WebView2 reports no Source for a data: page
-            if (NotAWebPage(source) is { } refusal) throw new InvalidOperationException(refusal);
+            if (_tabs[tab.Id] != tab) return; // the user closed it meanwhile: it shows nothing any more
+            if (NotAWebPage(await SourceOf(core)) is { } refusal) throw new InvalidOperationException(refusal);
         }
         if (!anyPage) await Check();
-        var result = await body(Web.CoreWebView2).WaitAsync(ct);
+        var result = await body(core).WaitAsync(ct);
         if (!anyPage) await Check(); // a history move the body scheduled may have committed a local page meanwhile: never return what it read
         return result;
-    }, DispatcherPriority.Normal, ct);
+    });
+
+    static async Task<CoreWebView2> Started(Tab tab, CancellationToken ct)
+    {
+        try { await tab.Ready.WaitAsync(StartLimit, ct); }
+        catch (TimeoutException) { throw new InvalidOperationException("The Browser panel's WebView2 did not start within 20 s."); }
+        return tab.Web.CoreWebView2;
+    }
+
+    // WebView2 reports no Source for a data: page
+    static async Task<string> SourceOf(CoreWebView2 core) =>
+        core.Source is { Length: > 0 } source ? source : (string?)(await Js(core, "location.href"))["value"] ?? "";
 
-    Task<string> Cdp(string method, JsonObject args) => Web.CoreWebView2.CallDevToolsProtocolMethodAsync(method, args.ToJsonString());
+    static Task<string> Cdp(CoreWebView2 core, string method, JsonObject args) => core.CallDevToolsProtocolMethodAsync(method, args.ToJsonString());
 
-    Task Mouse(string type, double x, double y) => Cdp("Input.dispatchMouseEvent",
+    static Task Mouse(CoreWebView2 core, string type, double x, double y) => Cdp(core, "Input.dispatchMouseEvent",
         new JsonObject { ["type"] = type, ["x"] = x, ["y"] = y, ["button"] = "left", ["buttons"] = type == "mousePressed" ? 1 : 0, ["clickCount"] = 1 });
 
     /// <summary>Runtime.evaluate in the page; the result object ({type, value}). A page exception throws with its message.</summary>
-    async Task<JsonNode> Js(string expression)
+    static async Task<JsonNode> Js(CoreWebView2 core, string expression)
     {
-        var reply = JsonNode.Parse(await Cdp("Runtime.evaluate",
+        var reply = JsonNode.Parse(await Cdp(core, "Runtime.evaluate",
             new JsonObject { ["expression"] = expression, ["returnByValue"] = true, ["awaitPromise"] = true }))!;
         if (reply["exceptionDetails"] is { } ex)
         {
@@ -122,11 +182,10 @@ async Task<JsonNode> Js(string expression)
         return reply["result"]!;
     }
 
-    /// <summary>Runs <paramref name="act"/> and returns how the navigation it started ended, or null if none started (unless
-    /// <paramref name="certain"/>, which waits for one) or it was still loading after <paramref name="limit"/>.</summary>
-    async Task<CoreWebView2NavigationCompletedEventArgs?> AfterAsync(Func<Task> act, TimeSpan limit, bool certain, CancellationToken ct)
+    /// <summary>Runs <paramref name="act"/> and returns how the navigation it started on <paramref name="core"/> ended, or null if none
+    /// started (unless <paramref name="certain"/>, which waits for one) or it was still loading after <paramref name="limit"/>.</summary>
+    static async Task<CoreWebView2NavigationCompletedEventArgs?> AfterAsync(CoreWebView2 core, Func<Task> act, TimeSpan limit, bool certain, CancellationToken ct)
     {
-        var core = Web.CoreWebView2;
         ulong id = 0;
         var started = false;
         var done = new TaskCompletionSource<CoreWebView2NavigationCompletedEventArgs>(TaskCreationOptions.RunContinuationsAsynchronously);
diff --git a/src/CCWrapper/Views/BrowserPanel.xaml b/src/CCWrapper/Views/BrowserPanel.xaml
index 0746aef..365651d 100644
--- a/src/CCWrapper/Views/BrowserPanel.xaml
+++ b/src/CCWrapper/Views/BrowserPanel.xaml
@@ -1,20 +1,26 @@
 <UserControl x:Class="CCWrapper.Views.BrowserPanel"
              xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
-             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
-             xmlns:wv2="clr-namespace:Microsoft.Web.WebView2.Wpf;assembly=Microsoft.Web.WebView2.Wpf">
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml">
     <DockPanel>
-        <Grid DockPanel.Dock="Top" Margin="8,4,8,8">
+        <DockPanel DockPanel.Dock="Top" Margin="8,4,8,4">
+            <Button DockPanel.Dock="Right" Style="{StaticResource Flat}" Width="28" Padding="0" Margin="4,0,0,0" ToolTip="New tab" AutomationProperties.Name="New tab" Click="OnNewTab"><TextBlock Style="{StaticResource Icon}" Text="&#xE710;" FontSize="12" /></Button>
+            <!-- one row of equal tabs that shrink as more open -->
+            <UniformGrid x:Name="Strip" Rows="1" HorizontalAlignment="Left" />
+        </DockPanel>
+        <!-- DataContext: the front tab's WebView2 -->
+        <Grid x:Name="Bar" DockPanel.Dock="Top" Margin="8,0,8,8">
             <Grid.ColumnDefinitions>
                 <ColumnDefinition Width="Auto" />
                 <ColumnDefinition Width="Auto" />
                 <ColumnDefinition Width="Auto" />
                 <ColumnDefinition Width="*" />
             </Grid.ColumnDefinitions>
-            <Button Style="{StaticResource Flat}" Width="30" Padding="0" ToolTip="Back" AutomationProperties.Name="Back" Click="OnBack" IsEnabled="{Binding CanGoBack, ElementName=Web}"><TextBlock Style="{StaticResource Icon}" Text="&#xE72B;" FontSize="13" /></Button>
-            <Button Grid.Column="1" Style="{StaticResource Flat}" Width="30" Padding="0" Margin="2,0,0,0" ToolTip="Forward" AutomationProperties.Name="Forward" Click="OnForward" IsEnabled="{Binding CanGoForward, ElementName=Web}"><TextBlock Style="{StaticResource Icon}" Text="&#xE72A;" FontSize="13" /></Button>
+            <Button Style="{StaticResource Flat}" Width="30" Padding="0" ToolTip="Back" AutomationProperties.Name="Back" Click="OnBack" IsEnabled="{Binding CanGoBack, FallbackValue=False}"><TextBlock Style="{StaticResource Icon}" Text="&#xE72B;" FontSize="13" /></Button>
+            <Button Grid.Column="1" Style="{StaticResource Flat}" Width="30" Padding="0" Margin="2,0,0,0" ToolTip="Forward" AutomationProperties.Name="Forward" Click="OnForward" IsEnabled="{Binding CanGoForward, FallbackValue=False}"><TextBlock Style="{StaticResource Icon}" Text="&#xE72A;" FontSize="13" /></Button>
             <Button Grid.Column="2" Style="{StaticResource Flat}" Width="30" Padding="0" Margin="2,0,6,0" ToolTip="Reload" AutomationProperties.Name="Reload" Click="OnReload"><TextBlock Style="{StaticResource Icon}" Text="&#xE72C;" FontSize="13" /></Button>
             <TextBox x:Name="Address" Grid.Column="3" KeyDown="OnAddressKeyDown" GotKeyboardFocus="OnAddressFocus" />
         </Grid>
-        <wv2:WebView2 x:Name="Web" />
+        <!-- each tab's WebView2; only the front one is visible -->
+        <Grid x:Name="Pages" />
     </DockPanel>
 </UserControl>
diff --git a/src/CCWrapper/Views/BrowserPanel.xaml.cs b/src/CCWrapper/Views/BrowserPanel.xaml.cs
index d3be0b3..85dc03f 100644
--- a/src/CCWrapper/Views/BrowserPanel.xaml.cs
+++ b/src/CCWrapper/Views/BrowserPanel.xaml.cs
@@ -1,15 +1,33 @@
 using System.IO;
 using System.Windows;
+using System.Windows.Automation;
 using System.Windows.Controls;
 using System.Windows.Input;
 using CCWrapper.Core;
+using Microsoft.Web.WebView2.Core;
 using Microsoft.Web.WebView2.Wpf;
 
 namespace CCWrapper.Views;
 
 public partial class BrowserPanel : UserControl
 {
-    string? _pending; // a Navigate() that came before the WebView2 was ready
+    /// <summary>One tab: its own WebView2, started on the panel's one environment, and its header in the strip.</summary>
+    sealed class Tab(WebView2 web, RadioButton header, TextBlock title)
+    {
+        public int Id;
+        public readonly WebView2 Web = web;
+        public readonly RadioButton Header = header;
+        public readonly TextBlock Title = title;
+        public Task Ready = Task.CompletedTask;
+        public string? Pending; // a Navigate() that came before this tab's WebView2 was ready
+    }
+
+    readonly string _profile;
+    readonly BrowserTabs<Tab> _tabs = new();
+    readonly TaskCompletionSource _loaded = new(TaskCreationOptions.RunContinuationsAsynchronously);
+    Task<CoreWebView2Environment>? _env;
+
+    Tab Front => _tabs.FrontTab!;
 
     public BrowserPanel() : this(null) { }
 
@@ -17,42 +35,125 @@ public BrowserPanel() : this(null) { }
     public BrowserPanel(string? userDataFolder)
     {
         InitializeComponent();
-        // its own profile per account, so each account keeps its own cookies and parallel windows don't clash
-        Web.CreationProperties = new CoreWebView2CreationProperties
+        // its own profile per account, so each account keeps its own cookies and parallel windows don't clash; every tab shares it
+        _profile = userDataFolder ?? Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
+            "CCWrapper", "WebView2", "browser-" + AppState.Current.Account.Letter);
+        Loaded += (_, _) => _loaded.TrySetResult();
+        AddTab();
+    }
+
+    /// <summary>Called by MainWindow's IAppCommands.OpenInBrowser; keep this signature. Loads in the front tab; works before the WebView2 has started.</summary>
+    public void Navigate(string url)
+    {
+        url = NormalizeUrl(url);
+        Address.Text = url;
+        Load(Front, url);
+    }
+
+    /// <summary>A new blank tab in front, or null at <see cref="BrowserTabs{T}.Max"/> tabs.</summary>
+    Tab? AddTab()
+    {
+        if (_tabs.Full) return null;
+        var title = new TextBlock { Text = "New tab", TextTrimming = TextTrimming.CharacterEllipsis, VerticalAlignment = VerticalAlignment.Center };
+        var close = new Button
         {
-            UserDataFolder = userDataFolder ?? Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
-                "CCWrapper", "WebView2", "browser-" + AppState.Current.Account.Letter),
+            Style = (Style)FindResource("Flat"), Width = 22, Height = 22, MinHeight = 0, Padding = new Thickness(0), Margin = new Thickness(4, 0, 0, 0),
+            ToolTip = "Close tab", Content = new TextBlock { Style = (Style)FindResource("Icon"), Text = "", FontSize = 10 },
         };
-        Web.CoreWebView2InitializationCompleted += (_, e) =>
+        AutomationProperties.SetName(close, "Close tab");
+        Grid.SetColumn(close, 1);
+        var header = new RadioButton
         {
-            if (!e.IsSuccess)
-            {
-                var why = "WebView2 failed to start: " + e.InitializationException?.Message;
-                Address.Text = why;
-                _ready.TrySetException(new InvalidOperationException("The Browser panel's " + why));
-                return;
-            }
-            _ready.TrySetResult();
-            // target=_blank and window.open stay in this single view; a page's window.open('file:...') is dropped, not opened
-            Web.CoreWebView2.NewWindowRequested += (_, n) => { n.Handled = true; if (SchemeAllowed(n.Uri)) Web.CoreWebView2.Navigate(n.Uri); };
-            if (_pending is { } url) Web.CoreWebView2.Navigate(url);
-            _pending = null;
+            Style = (Style)FindResource("BrowserTab"),
+            Content = new Grid { ColumnDefinitions = { new ColumnDefinition(), new ColumnDefinition { Width = GridLength.Auto } }, Children = { title, close } },
         };
-        Web.SourceChanged += (_, _) => { if (!Address.IsKeyboardFocusWithin) Address.Text = Web.Source?.ToString(); };
-        Loaded += async (_, _) =>
+        var tab = new Tab(new WebView2 { Visibility = Visibility.Collapsed }, header, title);
+        tab.Id = _tabs.Add(tab);
+        close.Click += (_, _) => CloseTab(tab.Id);
+        header.Checked += (_, _) => Show(tab);
+        tab.Web.SourceChanged += (_, _) => { if (tab == _tabs.FrontTab && !Address.IsKeyboardFocusWithin) Address.Text = tab.Web.Source?.ToString(); };
+        Strip.Children.Add(header);
+        Pages.Children.Add(tab.Web);
+        Retitle(tab);
+        tab.Ready = StartAsync(tab);
+        Show(tab);
+        return tab;
+    }
+
+    async Task StartAsync(Tab tab)
+    {
+        await _loaded.Task; // nothing starts before the panel is first shown
+        try { await tab.Web.EnsureCoreWebView2Async(await (_env ??= CoreWebView2Environment.CreateAsync(null, _profile))); }
+        catch (Exception ex)
         {
-            try { await Web.EnsureCoreWebView2Async(); } // no-op once started
-            catch (Exception) { } // reported through CoreWebView2InitializationCompleted
-        };
+            var why = "WebView2 failed to start: " + ex.Message;
+            if (tab == _tabs.FrontTab) Address.Text = why;
+            throw new InvalidOperationException("The Browser panel's " + why, ex);
+        }
+        var core = tab.Web.CoreWebView2;
+        core.NewWindowRequested += OnNewWindow;
+        core.DocumentTitleChanged += (_, _) => Retitle(tab);
+        if (tab.Pending is { } url) core.Navigate(url);
+        tab.Pending = null;
     }
 
-    /// <summary>Called by MainWindow's IAppCommands.OpenInBrowser; keep this signature. Works before the WebView2 has started.</summary>
-    public void Navigate(string url)
+    /// <summary>target=_blank and window.open, from any tab: a new tab in front. A page's window.open('file:...') is dropped, not
+    /// opened, and so is one past the tab limit.</summary>
+    async void OnNewWindow(object? sender, CoreWebView2NewWindowRequestedEventArgs e)
     {
-        url = NormalizeUrl(url);
-        Address.Text = url;
-        if (Web.CoreWebView2 is { } core) core.Navigate(url);
-        else _pending = url;
+        if (!SchemeAllowed(e.Uri) || AddTab() is not { } tab) { e.Handled = true; return; }
+        var deferral = e.GetDeferral();
+        try
+        {
+            await tab.Ready.WaitAsync(StartLimit);
+            e.NewWindow = tab.Web.CoreWebView2; // the same environment, not navigated yet: the opener keeps a window object for it
+        }
+        catch (Exception)
+        {
+            e.Handled = true;
+            if (_tabs[tab.Id] == tab) Load(tab, e.Uri);
+        }
+        finally { deferral.Complete(); }
+    }
+
+    // Only once StartAsync has wired NewWindowRequested: before that the URL waits in Pending.
+    static void Load(Tab tab, string url)
+    {
+        if (tab.Ready.IsCompletedSuccessfully) tab.Web.CoreWebView2.Navigate(url);
+        else tab.Pending = url;
+    }
+
+    void Retitle(Tab tab)
+    {
+        var title = tab.Web.CoreWebView2?.DocumentTitle;
+        tab.Title.Text = string.IsNullOrWhiteSpace(title) ? "New tab" : title;
+        tab.Header.ToolTip = tab.Title.Text;
+        AutomationProperties.SetName(tab.Header, tab.Title.Text);
+    }
+
+    void Show(Tab tab)
+    {
+        _tabs.Switch(tab.Id);
+        foreach (var (_, t) in _tabs.All)
+        {
+            t.Web.Visibility = t == tab ? Visibility.Visible : Visibility.Collapsed;
+            t.Header.IsChecked = t == tab;
+        }
+        Bar.DataContext = tab.Web;
+        Address.Text = tab.Web.Source?.ToString() ?? tab.Pending ?? "";
+    }
+
+    /// <summary>Disposes the tab's WebView2; closing the last tab leaves one blank tab. False when there is no tab <paramref name="id"/>.</summary>
+    bool CloseTab(int id)
+    {
+        if (_tabs[id] is not { } tab) return false;
+        _tabs.Remove(id);
+        Strip.Children.Remove(tab.Header);
+        Pages.Children.Remove(tab.Web);
+        tab.Web.Dispose();
+        if (_tabs.FrontTab is { } front) Show(front);
+        else AddTab();
+        return true;
     }
 
     /// <summary>"localhost:3000" -> "http://localhost:3000", "example.com" -> "https://example.com"; anything with a scheme is kept.</summary>
@@ -79,17 +180,70 @@ public static bool SchemeAllowed(string url)
         };
     }
 
+    /// <summary>Null when Claude's <paramref name="tool"/> may open <paramref name="url"/> (already normalized); otherwise the refusal Claude reads.</summary>
+    public static string? OpenRefusal(string tool, string url) => SchemeAllowed(url) ? null
+        : $"Refused {url}: the {tool} tool opens only http, https, blob, about:blank and data addresses.";
+
     /// <summary>Null when Claude's tools may work on the page at <paramref name="source"/>; otherwise the refusal Claude reads.</summary>
     public static string? NotAWebPage(string? source) => SchemeAllowed(source ?? "") ? null
         : $"The Browser panel shows a page that is not a web address ({(source?.IndexOf(':') is > 0 and var c ? source[..c] : "")}:); Claude's tools work only on web pages. Navigate to a web address first.";
 
+    /// <summary>The tabs tool's text, one line per tab. A tab whose page is not a web address shows neither its title nor its URL.</summary>
+    public static string DescribeTabs(IEnumerable<(int Id, string? Title, string? Url, bool Front)> tabs) => string.Join("\n", tabs.Select(t =>
+        $"Tab {t.Id}{(t.Front ? " (front)" : "")}: " + (NotAWebPage(t.Url) is null ? $"{t.Title} - {t.Url}" : "(not a web page)")));
+
     void OnAddressKeyDown(object sender, KeyEventArgs e)
     {
-        if (e.Key == Key.Enter && Address.Text.Trim().Length > 0) { Navigate(Address.Text); Web.Focus(); }
+        if (e.Key == Key.Enter && Address.Text.Trim().Length > 0) { Navigate(Address.Text); Front.Web.Focus(); }
     }
 
     void OnAddressFocus(object sender, KeyboardFocusChangedEventArgs e) => Address.SelectAll();
-    void OnBack(object sender, RoutedEventArgs e) => Web.GoBack();
-    void OnForward(object sender, RoutedEventArgs e) => Web.GoForward();
-    void OnReload(object sender, RoutedEventArgs e) => Web.Reload();
+    void OnBack(object sender, RoutedEventArgs e) => Front.Web.GoBack();
+    void OnForward(object sender, RoutedEventArgs e) => Front.Web.GoForward();
+    void OnReload(object sender, RoutedEventArgs e) { if (Front.Ready.IsCompletedSuccessfully) Front.Web.Reload(); }
+    void OnNewTab(object sender, RoutedEventArgs e) => AddTab();
+}
+
+/// <summary>The Browser panel's tab bookkeeping, without WPF: ids 1, 2, 3… never reused, which tab is in front, at most <see cref="Max"/>.</summary>
+public sealed class BrowserTabs<T> where T : class
+{
+    public const int Max = 20;
+
+    readonly List<(int Id, T Tab)> _all = [];
+    int _last;
+
+    /// <summary>In strip order.</summary>
+    public IReadOnlyList<(int Id, T Tab)> All => _all;
+
+    /// <summary>The front tab's id; 0 when there is none.</summary>
+    public int Front { get; private set; }
+
+    public T? FrontTab => this[Front];
+    public bool Full => _all.Count >= Max;
+    public T? this[int id] => _all.Find(t => t.Id == id).Tab;
+
+    /// <summary>Appends <paramref name="tab"/> in front and returns its id; 0 when full.</summary>
+    public int Add(T tab)
+    {
+        if (Full) return 0;
+        _all.Add((++_last, tab));
+        return Front = _last;
+    }
+
+    public bool Switch(int id)
+    {
+        if (this[id] is null) return false;
+        Front = id;
+        return true;
+    }
+
+    /// <summary>When the front tab goes, the one to its right comes to front, else the one to its left. False when there is no tab <paramref name="id"/>.</summary>
+    public bool Remove(int id)
+    {
+        var i = _all.FindIndex(t => t.Id == id);
+        if (i < 0) return false;
+        _all.RemoveAt(i);
+        if (Front == id) Front = _all.Count == 0 ? 0 : _all[Math.Min(i, _all.Count - 1)].Id;
+        return true;
+    }
 }
diff --git a/tests/CCWrapper.Tests/Terminal/BrowserMcpTests.cs b/tests/CCWrapper.Tests/Terminal/BrowserMcpTests.cs
index efebdb3..425df2f 100644
--- a/tests/CCWrapper.Tests/Terminal/BrowserMcpTests.cs
+++ b/tests/CCWrapper.Tests/Terminal/BrowserMcpTests.cs
@@ -35,6 +35,11 @@ async Task<T> Do<T>(string call, T result)
         public Task<byte[]> ScreenshotAsync(CancellationToken ct) => Do("screenshot", new byte[] { 0x89, 0x50, 0x4e, 0x47 });
         public Task<string> EvaluateAsync(string expression, CancellationToken ct) => Do($"evaluate {expression}", "\"Title\"");
         public Task<string> DevToolsAsync(string method, string paramsJson, CancellationToken ct) => Do($"devtools {method} {paramsJson}", "{}");
+        public Task<string> TabsAsync(CancellationToken ct) => Do("tabs", "Tab 1 (front): T - https://example.com/");
+        public Task<string> NewTabAsync(string url, CancellationToken ct) => Do($"new_tab {url}", "opened");
+        public Task<string> SwitchTabAsync(int id, CancellationToken ct) => id == 99 ? NoTab(id) : Do($"switch_tab {id}", "switched");
+        public Task<string> CloseTabAsync(int id, CancellationToken ct) => id == 99 ? NoTab(id) : Do($"close_tab {id}", "closed");
+        static Task<string> NoTab(int id) => Task.FromException<string>(new InvalidOperationException($"There is no tab {id}"));
     }
 
     readonly FakeDriver _driver = new();
@@ -79,10 +84,11 @@ public async Task Notifications_get_no_reply_and_ping_gets_an_empty_result()
     }
 
     [Fact]
-    public async Task Tools_list_has_seven_tools_with_object_schemas()
+    public async Task Tools_list_has_eleven_tools_with_object_schemas()
     {
         var tools = Parse(await Mcp().HandleAsync("""{"jsonrpc":"2.0","id":1,"method":"tools/list"}"""))["result"]!["tools"]!.AsArray();
-        Assert.Equal(["navigate", "snapshot", "click", "type", "screenshot", "evaluate", "devtools"], tools.Select(t => t!["name"]!.GetValue<string>()));
+        Assert.Equal(["navigate", "snapshot", "click", "type", "screenshot", "evaluate", "devtools", "tabs", "new_tab", "switch_tab", "close_tab"],
+            tools.Select(t => t!["name"]!.GetValue<string>()));
         Assert.All(tools, t =>
         {
             Assert.False(string.IsNullOrWhiteSpace(t!["description"]!.GetValue<string>()));
@@ -100,6 +106,11 @@ public async Task Tools_list_has_seven_tools_with_object_schemas()
     [InlineData("evaluate", """{"expression":"document.title"}""", "evaluate document.title", "\"Title\"")]
     [InlineData("devtools", """{"method":"DOM.getDocument"}""", "devtools DOM.getDocument {}", "{}")]
     [InlineData("devtools", """{"method":"Page.reload","params":{"ignoreCache":true}}""", """devtools Page.reload {"ignoreCache":true}""", "{}")]
+    [InlineData("tabs", "{}", "tabs", "Tab 1 (front): T - https://example.com/")]
+    [InlineData("new_tab", """{"url":"example.com"}""", "new_tab example.com", "opened")]
+    [InlineData("new_tab", "{}", "new_tab about:blank", "opened")]
+    [InlineData("switch_tab", """{"id":2}""", "switch_tab 2", "switched")]
+    [InlineData("close_tab", """{"id":3}""", "close_tab 3", "closed")]
     public async Task Tools_call_passes_arguments_and_returns_text(string tool, string args, string expectedCall, string expectedText)
     {
         var r = Parse(await Mcp().HandleAsync(Call(4, tool, args)))["result"]!;
@@ -124,6 +135,25 @@ public async Task Driver_failure_is_a_tool_error_with_its_message()
         Assert.Equal("No element matches #boom", r["content"]![0]!["text"]!.GetValue<string>());
     }
 
+    [Theory]
+    [InlineData("switch_tab")]
+    [InlineData("close_tab")]
+    public async Task An_unknown_tab_id_is_a_tool_error(string tool)
+    {
+        var r = Parse(await Mcp().HandleAsync(Call(1, tool, """{"id":99}""")))["result"]!;
+        Assert.True(r["isError"]!.GetValue<bool>());
+        Assert.Equal("There is no tab 99", r["content"]![0]!["text"]!.GetValue<string>());
+    }
+
+    [Fact]
+    public async Task Tab_tools_are_off_with_the_switch_too()
+    {
+        _enabled = false;
+        foreach (var (tool, args) in new[] { ("tabs", "{}"), ("new_tab", "{}"), ("switch_tab", """{"id":1}"""), ("close_tab", """{"id":1}""") })
+            Assert.Equal(BrowserMcp.Disabled, Parse(await Mcp().HandleAsync(Call(1, tool, args)))["result"]!["content"]![0]!["text"]!.GetValue<string>());
+        Assert.Empty(_driver.Calls);
+    }
+
     [Fact]
     public async Task A_call_that_never_answers_is_abandoned_and_the_next_call_runs()
     {
@@ -214,6 +244,11 @@ public async Task Turned_off_answers_every_call_without_the_driver()
     [InlineData("""{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"click","arguments":{"target":true}}}""", -32602)]
     [InlineData("""{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"snapshot","arguments":"x"}}""", -32602)]
     [InlineData("""{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"devtools","arguments":{"method":"A.b","params":[1]}}}""", -32602)]
+    [InlineData("""{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"switch_tab","arguments":{}}}""", -32602)]
+    [InlineData("""{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"switch_tab","arguments":{"id":"2"}}}""", -32602)]
+    [InlineData("""{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"close_tab","arguments":{"id":1.5}}}""", -32602)]
+    [InlineData("""{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"close_tab","arguments":{"id":null}}}""", -32602)]
+    [InlineData("""{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"new_tab","arguments":{"url":true}}}""", -32602)]
     public async Task Bad_messages_get_json_rpc_errors(string line, int code)
     {
         var r = Parse(await Mcp().HandleAsync(line));
diff --git a/tests/CCWrapper.Tests/Views/PanelLogicTests.cs b/tests/CCWrapper.Tests/Views/PanelLogicTests.cs
index e5e8dff..c1d61f0 100644
--- a/tests/CCWrapper.Tests/Views/PanelLogicTests.cs
+++ b/tests/CCWrapper.Tests/Views/PanelLogicTests.cs
@@ -128,6 +128,71 @@ public void Browser_tools_refuse_a_page_that_is_not_a_web_address()
         Assert.NotNull(BrowserPanel.NotAWebPage(null));
     }
 
+    [Fact]
+    public void Browser_new_tab_and_navigate_refuse_a_non_web_scheme()
+    {
+        Assert.Null(BrowserPanel.OpenRefusal("new_tab", BrowserPanel.NormalizeUrl("example.com")));
+        Assert.Null(BrowserPanel.OpenRefusal("new_tab", "about:blank"));
+        Assert.Equal("Refused file:///C:/x.txt: the new_tab tool opens only http, https, blob, about:blank and data addresses.",
+            BrowserPanel.OpenRefusal("new_tab", BrowserPanel.NormalizeUrl("file:///C:/x.txt")));
+        Assert.StartsWith("Refused edge://settings: the navigate tool", BrowserPanel.OpenRefusal("navigate", "edge://settings"));
+    }
+
+    [Fact]
+    public void Browser_tab_list_hides_the_title_and_url_of_a_page_that_is_not_a_web_address() =>
+        Assert.Equal("Tab 1: Example - https://example.com/\nTab 3 (front): (not a web page)\nTab 4: (not a web page)\nTab 5: Two - data:text/html,x",
+            BrowserPanel.DescribeTabs([(1, "Example", "https://example.com/", false), (3, "secret.txt", "file:///C:/secret.txt", true),
+                (4, null, null, false), (5, "Two", "data:text/html,x", false)]));
+
+    [Fact]
+    public void Browser_tab_ids_count_up_never_reused_and_the_new_tab_is_in_front()
+    {
+        var tabs = new BrowserTabs<string>();
+        Assert.Equal(0, tabs.Front);
+        Assert.Null(tabs.FrontTab);
+        Assert.Equal([1, 2, 3], new[] { tabs.Add("a"), tabs.Add("b"), tabs.Add("c") });
+        Assert.Equal(("c", 3), (tabs.FrontTab, tabs.Front));
+        Assert.True(tabs.Switch(1));
+        Assert.False(tabs.Switch(9));
+        Assert.Equal(1, tabs.Front);
+        Assert.True(tabs.Remove(3));
+        Assert.False(tabs.Remove(3));
+        Assert.Equal(4, tabs.Add("d"));
+        Assert.Equal(["a", "b", "d"], tabs.All.Select(t => t.Tab));
+        Assert.Null(tabs[3]);
+    }
+
+    [Fact]
+    public void Browser_closing_the_front_tab_brings_its_right_neighbor_else_its_left_and_the_last_leaves_none()
+    {
+        var tabs = new BrowserTabs<string>();
+        tabs.Add("a"); tabs.Add("b"); tabs.Add("c");
+        tabs.Switch(2);
+        tabs.Remove(2);
+        Assert.Equal(3, tabs.Front);
+        tabs.Remove(3);
+        Assert.Equal(1, tabs.Front);
+        tabs.Add("d");
+        tabs.Switch(1);
+        tabs.Remove(4); // not the front one: the front stays
+        Assert.Equal(1, tabs.Front);
+        tabs.Remove(1);
+        Assert.Equal((0, 0), (tabs.Front, tabs.All.Count)); // the panel then opens a blank tab: id 5, not 1
+        Assert.Equal(5, tabs.Add("e"));
+    }
+
+    [Fact]
+    public void Browser_opens_at_most_twenty_tabs()
+    {
+        var tabs = new BrowserTabs<string>();
+        for (var i = 1; i <= 20; i++) Assert.Equal(i, tabs.Add("t"));
+        Assert.True(tabs.Full);
+        Assert.Equal(0, tabs.Add("over"));
+        Assert.Equal((20, 20), (tabs.All.Count, tabs.Front));
+        tabs.Remove(5);
+        Assert.Equal(21, tabs.Add("again"));
+    }
+
     [Theory]
     [InlineData("12", "[data-ccw-ref=\"12\"]")]
     [InlineData("#login", "#login")]

From 50026f1f86c893317f124a33f9d87353816dff12 Mon Sep 17 00:00:00 2001
From: PieMH <pdondiw@gmail.com>
Date: Sun, 18 Oct 2026 22:56:41 +0200
Subject: [PATCH 2/5] Browser panel tabs: README, PRIVACY and CLAUDE.md
 describe tabs and the tab tools

---
 CLAUDE.md  | 8 ++++----
 PRIVACY.md | 2 +-
 README.md  | 8 ++++----
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index e03dc82..58050ac 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -51,12 +51,12 @@ dotnet test
   inside the usage policy. One deletion besides: the right-click Delete of a session removes its transcript
   `<id>.jsonl` and its `<id>\` folder (`SessionCatalog.Delete`), only after a confirm and never while a claude process
   or tab has the session; it refuses any path outside the account's `projects\<dir>\<id>.jsonl`.
-- **The browser tool drives only the Browser panel's WebView2** (its own user-data folder) through in-process CDP. Never the
+- **The browser tool drives only the Browser panel's WebView2** (its own user-data folder) through in-process CDP, one WebView2 per tab on the panel's one profile. Never the
   terminal's WebView2, never a remote debugging port. The pipe is `CurrentUserOnly`, and the only launch flags it adds are
   `--mcp-config` and `--append-system-prompt`. `browserTool` off: new tabs get no flags and `BrowserMcp` refuses calls from open ones.
-  Hardened: each tools/call has a 60 s limit, `navigate` and `window.open` pass only http, https, blob, about:blank and data
-  (`BrowserPanel.SchemeAllowed`), every tool but `navigate` refuses while the panel shows any other page (`OnUi`, checked before and after the body, whatever got it
-  there: history, the address bar), and `devtools` is an allow-list by domain (`BrowserMcp.DevToolsRefusal`) that denies cookies,
+  Hardened: each tools/call has a 60 s limit, `navigate`, `new_tab` and `window.open` (which opens a tab, max 20, else dropped) pass only http, https, blob,
+  about:blank and data (`BrowserPanel.SchemeAllowed`), every tool but `navigate` refuses while the front tab shows any other page (`OnUi` captures the front tab once per call and runs both checks, before and after the body, on that tab, whatever got it
+  there: history, the address bar; `tabs` lists such a tab as "(not a web page)", without title or URL), and `devtools` is an allow-list by domain (`BrowserMcp.DevToolsRefusal`) that denies cookies,
   downloads, local files, new-document scripts, history navigation and the whole Input domain (keyboard, mouse, touch, drag: it would paste the clipboard). `evaluate` runs with the page's own access.
   (PRIVACY.md and the README say so too, keep them in step).
 - **Changes go through Claude Code's own CLI.** Plugins & connectors runs `claude plugin …` and `claude mcp …` hidden
diff --git a/PRIVACY.md b/PRIVACY.md
index b484383..444ba2b 100644
--- a/PRIVACY.md
+++ b/PRIVACY.md
@@ -46,7 +46,7 @@ If you write to the publisher (see Contact), the publisher handles your message
 ### 3. Websites you open
 
 - The Browser panel is a WebView2 browser. It loads only what you open in it, or what Claude opens in it (next point). Those sites see what any website sees, and may set cookies.
-- Claude can use the Browser panel: each session gets it as a local MCP server (`ccwrapper-browser`), unless you turn it off in Settings → CCWrapper (`browserTool` in `app.json`). CCWrapper itself sends nothing new. The pages load only when Claude or you open them, in the panel's profile for the account, which is stored on your computer in `%LOCALAPPDATA%\CCWrapper\WebView2\browser-<letter>`, so those sites see your logins there, and what Claude runs in a page (the `evaluate` and `devtools` tools) acts with them. `devtools` refuses cookie access, downloads, local files, all simulated input (keyboard, mouse, touch and drag, so it cannot paste your clipboard), the page history and scripts that persist across pages. Claude opens only `http`, `https`, `blob`, `about:blank` and `data` addresses, not local files, and its tools refuse to work on a page that is not a web address (for example a `file:` page you opened in the address bar yourself). The tool talks to its CCWrapper window through a named pipe on your own computer that only your Windows user can open. What Claude Code does with a page's text, screenshots or script results is covered in section 2, and Claude Code asks your permission per tool.
+- Claude can use the Browser panel: each session gets it as a local MCP server (`ccwrapper-browser`), unless you turn it off in Settings → CCWrapper (`browserTool` in `app.json`). CCWrapper itself sends nothing new. The pages load only when Claude or you open them, in the panel's profile for the account, which is stored on your computer in `%LOCALAPPDATA%\CCWrapper\WebView2\browser-<letter>`, so those sites see your logins there, and what Claude runs in a page (the `evaluate` and `devtools` tools) acts with them. `devtools` refuses cookie access, downloads, local files, all simulated input (keyboard, mouse, touch and drag, so it cannot paste your clipboard), the page history and scripts that persist across pages. The panel has tabs, all in that one profile; a page's pop-up opens a new tab (at most 20). Claude opens only `http`, `https`, `blob`, `about:blank` and `data` addresses, not local files, and a pop-up to any other address is dropped. Its tools act on the tab in front, can list, open, switch and close tabs (a tab that is not a web page is listed without title or address), and refuse to work on a page that is not a web address (for example a `file:` page you opened in the address bar yourself). All of this holds in every tab. The tool talks to its CCWrapper window through a named pipe on your own computer that only your Windows user can open. What Claude Code does with a page's text, screenshots or script results is covered in section 2, and Claude Code asks your permission per tool.
 - A link in the terminal opens in the Browser panel if it points to your own computer (`localhost`), and in your default browser otherwise. Only `http` and `https` links open.
 - Each account has its own browser profile, stored on your computer (see below).
 
diff --git a/README.md b/README.md
index 2f1a6d7..76c130a 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@
 ![Platform](https://img.shields.io/badge/platform-Windows%2010%20%7C%2011-0078D6)
 ![.NET](https://img.shields.io/badge/.NET-10-512BD4)
 ![License](https://img.shields.io/badge/license-GPL--3.0-blue)
-![Tests](https://img.shields.io/badge/tests-422%20passing-brightgreen)
+![Tests](https://img.shields.io/badge/tests-440%20passing-brightgreen)
 
 Claude Code in a bare PowerShell window works, but it's clumsy. There's no search, you can't paste screenshots or files with Ctrl+V, you can't see your other sessions, and context, usage, file changes and subagents are hard to keep an eye on. If you also juggle **several Claude Code accounts** (work and personal, for example), it gets worse.
 
@@ -91,7 +91,7 @@ Confirmations, warnings and errors use the app's dark theme too.
 **Right panel**
 - **Files:** a tree of every file Claude changed this session, with `+/−` lines in green and red, or the size change for binaries. Click a file to see all of it with the changes highlighted.
 - **Agents:** this session's subagents, running or finished, with model, effort, context and tokens. Click one to see its live transcript.
-- **Browser:** a built-in WebView2 browser for your dev server. Claude browses in it too: every session can navigate, read the page, click, type, take screenshots, run scripts and use DevTools there, and is told to prefer it over another browser. Ask for Chrome by name and it uses Chrome. Scripts and DevTools act with the page's own logins in that profile; DevTools refuses cookie access, downloads, local files, all simulated input (keyboard, mouse, touch and drag, so it cannot paste your clipboard), the page history and scripts that persist across pages. Claude opens only http, https, blob, about:blank and data addresses, never local files, and its tools refuse to work on a page that is not a web address (for example a `file:` page you opened yourself). To turn this off, clear **Let Claude use the Browser panel** in Settings → CCWrapper.
+- **Browser:** a built-in WebView2 browser for your dev server, with tabs (the **+** button opens one, up to 20; tabs are not restored after a restart). A page's pop-up window opens in a new tab. Claude browses in it too: every session can navigate, read the page, click, type, take screenshots, run scripts, use DevTools, and list, open, switch and close tabs there, and is told to prefer it over another browser. Ask for Chrome by name and it uses Chrome. Scripts and DevTools act with the page's own logins in that profile; DevTools refuses cookie access, downloads, local files, all simulated input (keyboard, mouse, touch and drag, so it cannot paste your clipboard), the page history and scripts that persist across pages. Claude opens only http, https, blob, about:blank and data addresses, never local files (a pop-up to any other address is dropped), and its tools refuse to work on a page that is not a web address (for example a `file:` page you opened yourself). Its tools act on the tab in front. To turn this off, clear **Let Claude use the Browser panel** in Settings → CCWrapper.
 
 **Bottom bar**
 - Model, effort and permission-mode switches that drive Claude Code's own `/model`, `/effort` and Shift+Tab.
@@ -187,7 +187,7 @@ CCWrapper is a viewer and a launcher. It doesn't touch your logins.
 - **Check health** in Plugins & connectors runs `claude mcp list`, which connects to every MCP server (and starts the local ones) to see if it answers, as `/mcp` does.
 - **Otherwise it writes only to** `%LOCALAPPDATA%\CCWrapper`: pasted images, the browser profiles, settings backups, `app.json` (CCWrapper's own settings: your update choice, the compact hint and the browser choice), and the live status data described next.
 - **The status line:** if an account has no `statusLine` of its own, each session gets a tiny silent relay (`CCWrapper.StatusRelay.exe`) through `--settings`, which feeds the bottom bar. If you have your own status line, it's left alone.
-- **The Browser tool:** each session also gets that relay as a local MCP server (`ccwrapper-browser`, through `--mcp-config`), and a line in its system prompt (`--append-system-prompt`) to prefer it. The server talks only to its own CCWrapper window, through a local pipe that only your Windows user can open. Pages Claude opens load in the Browser panel's profile for the account, with your logins, and Claude Code asks permission per tool as it does for any MCP tool. Its scripts and DevTools act with those logins, but DevTools refuses cookie access, downloads, local files, all simulated input (keyboard, mouse, touch and drag), the page history and scripts that persist across pages. Claude opens only http, https, blob, about:blank and data addresses, not local files, and its tools refuse to work on a page that is not a web address. Turn it off in Settings → CCWrapper.
+- **The Browser tool:** each session also gets that relay as a local MCP server (`ccwrapper-browser`, through `--mcp-config`), and a line in its system prompt (`--append-system-prompt`) to prefer it. The server talks only to its own CCWrapper window, through a local pipe that only your Windows user can open. Pages Claude opens load in the Browser panel's profile for the account (all tabs share it), with your logins, and Claude Code asks permission per tool as it does for any MCP tool. Its scripts and DevTools act with those logins, but DevTools refuses cookie access, downloads, local files, all simulated input (keyboard, mouse, touch and drag), the page history and scripts that persist across pages. Claude opens only http, https, blob, about:blank and data addresses, not local files, and its tools refuse to work on a page that is not a web address. The same holds for every tab. Turn it off in Settings → CCWrapper.
 - **Its only network call is the update check,** and only in an installed copy, only after you said yes on first start; the switch is in **About**. It asks GitHub for the latest release and downloads it; GitHub sees your IP address and the app version, nothing else is sent. The Browser panel loads only what you or Claude open in it. Details in [PRIVACY.md](PRIVACY.md).
 - **Plan usage is checked with Claude Code's own `/usage`:** a hidden `claude "/usage"` (MCP servers off) runs in the folder of the account's most recent session, and Claude Code saves the result in `.claude.json`. Each check takes a few seconds, adds `/usage` to that folder's prompt history (Up arrow), and runs your startup hooks like any `claude` start, so automatic checks are skipped when the last one is under 10 minutes old. A check that can't finish in 30 seconds (not logged in, a trust question) is stopped and the last numbers stay.
 - Every session is the unmodified `claude.exe`, run under your own login.
@@ -222,7 +222,7 @@ Every step is in the history: `git log --first-parent` shows the merge of each t
 - [xterm.js](https://xtermjs.org/) 6 (the VS Code terminal) in WebView2;
 - [Porta.Pty](https://www.nuget.org/packages/Porta.Pty) for ConPTY;
 - [DiffPlex](https://github.com/mmanela/diffplex) for diffs;
-- xUnit, with 422 tests on synthetic fixtures.
+- xUnit, with 440 tests on synthetic fixtures.
 
 ## Development
 

From 46a1b605d2d86e4001a59da8b2c8369bce3cb590 Mon Sep 17 00:00:00 2001
From: PieMH <pdondiw@gmail.com>
Date: Sun, 18 Oct 2026 23:05:44 +0200
Subject: [PATCH 3/5] Browser panel tabs: window.close closes a popup tab, page
 check fails closed, environment retried, tab strip scrolls, smoke checks a
 refused popup

---
 CLAUDE.md                                  |  2 +-
 src/CCWrapper/Terminal/Smoke.cs            |  5 ++++-
 src/CCWrapper/Theme.xaml                   |  1 +
 src/CCWrapper/Views/BrowserPanel.Driver.cs |  2 +-
 src/CCWrapper/Views/BrowserPanel.xaml      |  8 +++++---
 src/CCWrapper/Views/BrowserPanel.xaml.cs   | 15 +++++++++++++++
 6 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 58050ac..a2917ab 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -55,7 +55,7 @@ dotnet test
   terminal's WebView2, never a remote debugging port. The pipe is `CurrentUserOnly`, and the only launch flags it adds are
   `--mcp-config` and `--append-system-prompt`. `browserTool` off: new tabs get no flags and `BrowserMcp` refuses calls from open ones.
   Hardened: each tools/call has a 60 s limit, `navigate`, `new_tab` and `window.open` (which opens a tab, max 20, else dropped) pass only http, https, blob,
-  about:blank and data (`BrowserPanel.SchemeAllowed`), every tool but `navigate` refuses while the front tab shows any other page (`OnUi` captures the front tab once per call and runs both checks, before and after the body, on that tab, whatever got it
+  about:blank and data (`BrowserPanel.SchemeAllowed`), every page tool but `navigate` refuses while the front tab shows any other page (`OnUi` captures the front tab once per call and runs both checks, before and after the body, on that tab, whatever got it
   there: history, the address bar; `tabs` lists such a tab as "(not a web page)", without title or URL), and `devtools` is an allow-list by domain (`BrowserMcp.DevToolsRefusal`) that denies cookies,
   downloads, local files, new-document scripts, history navigation and the whole Input domain (keyboard, mouse, touch, drag: it would paste the clipboard). `evaluate` runs with the page's own access.
   (PRIVACY.md and the README say so too, keep them in step).
diff --git a/src/CCWrapper/Terminal/Smoke.cs b/src/CCWrapper/Terminal/Smoke.cs
index 5475384..875d66d 100644
--- a/src/CCWrapper/Terminal/Smoke.cs
+++ b/src/CCWrapper/Terminal/Smoke.cs
@@ -108,7 +108,7 @@ static async Task<bool> PanelAsync()
     static async Task<bool> PanelStepsAsync(IBrowserDriver panel)
     {
         const string html = "<h1>Smoke</h1><a href='#x'>link</a><input name=q placeholder=Q><button onclick=\"document.title='clicked:'+document.querySelector('input').value\">Go</button>"
-            + "<button id=pop onclick=\"window.w=window.open('about:blank')\">Pop</button>";
+            + "<button id=pop onclick=\"window.w=window.open('about:blank')\">Pop</button><button id=bad onclick=\"window.open('ftp://example.com/')\">Bad</button>";
         await panel.NavigateAsync("data:text/html," + Uri.EscapeDataString(html), default);
         var snap = await panel.SnapshotAsync(default);
         var button = System.Text.RegularExpressions.Regex.Match(snap, @"\[(\d+)\] button ""Go""");
@@ -128,6 +128,9 @@ static async Task<bool> TabStepsAsync(IBrowserDriver panel)
         if (!(await panel.ClickAsync("#pop", default)).Contains("Tab 2 is now in front") || !(await panel.TabsAsync(default)).Contains("Tab 2 (front): ")) return false;
         await panel.SwitchTabAsync(1, default);
         if (await panel.EvaluateAsync("!!window.w && !window.w.closed", default) != "true") return false; // the popup tab kept its opener link
+        var dropped = await panel.ClickAsync("#bad", default); // an ftp: popup is refused (a file: one never reaches NewWindowRequested): no new tab
+        var listed = await panel.TabsAsync(default);
+        if (dropped.Contains("is now in front") || !listed.Contains("Tab 2") || listed.Contains("Tab 3")) return false;
         var opened = await panel.NewTabAsync("data:text/html," + Uri.EscapeDataString("<title>Two</title><h1>Second</h1>"), default);
         if (!opened.StartsWith("Opened tab 3 in front. Loaded") || await panel.EvaluateAsync("document.title", default) != "\"Two\"") return false;
         await panel.SwitchTabAsync(1, default);
diff --git a/src/CCWrapper/Theme.xaml b/src/CCWrapper/Theme.xaml
index dcf18b7..11d98b2 100644
--- a/src/CCWrapper/Theme.xaml
+++ b/src/CCWrapper/Theme.xaml
@@ -336,6 +336,7 @@
     <Style x:Key="BrowserTab" TargetType="RadioButton">
         <Setter Property="Foreground" Value="{StaticResource Muted}" />
         <Setter Property="Height" Value="28" />
+        <Setter Property="MinWidth" Value="80" />
         <Setter Property="MaxWidth" Value="200" />
         <Setter Property="Margin" Value="0,0,2,0" />
         <Setter Property="Padding" Value="10,0,2,0" />
diff --git a/src/CCWrapper/Views/BrowserPanel.Driver.cs b/src/CCWrapper/Views/BrowserPanel.Driver.cs
index ac7609f..6bc38ef 100644
--- a/src/CCWrapper/Views/BrowserPanel.Driver.cs
+++ b/src/CCWrapper/Views/BrowserPanel.Driver.cs
@@ -144,7 +144,7 @@ Task<T> OnUi<T>(CancellationToken ct, Func<CoreWebView2, Task<T>> body, bool any
         var core = await Started(tab, ct);
         async Task Check()
         {
-            if (_tabs[tab.Id] != tab) return; // the user closed it meanwhile: it shows nothing any more
+            if (_tabs[tab.Id] != tab) throw new InvalidOperationException($"Tab {tab.Id} was closed during the call."); // fail closed: nothing left to check
             if (NotAWebPage(await SourceOf(core)) is { } refusal) throw new InvalidOperationException(refusal);
         }
         if (!anyPage) await Check();
diff --git a/src/CCWrapper/Views/BrowserPanel.xaml b/src/CCWrapper/Views/BrowserPanel.xaml
index 365651d..456d4ab 100644
--- a/src/CCWrapper/Views/BrowserPanel.xaml
+++ b/src/CCWrapper/Views/BrowserPanel.xaml
@@ -3,9 +3,11 @@
              xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml">
     <DockPanel>
         <DockPanel DockPanel.Dock="Top" Margin="8,4,8,4">
-            <Button DockPanel.Dock="Right" Style="{StaticResource Flat}" Width="28" Padding="0" Margin="4,0,0,0" ToolTip="New tab" AutomationProperties.Name="New tab" Click="OnNewTab"><TextBlock Style="{StaticResource Icon}" Text="&#xE710;" FontSize="12" /></Button>
-            <!-- one row of equal tabs that shrink as more open -->
-            <UniformGrid x:Name="Strip" Rows="1" HorizontalAlignment="Left" />
+            <Button x:Name="NewTab" DockPanel.Dock="Right" Style="{StaticResource Flat}" Width="28" Padding="0" Margin="4,0,0,0" ToolTip="New tab" ToolTipService.ShowOnDisabled="True" AutomationProperties.Name="New tab" Click="OnNewTab"><TextBlock Style="{StaticResource Icon}" Text="&#xE710;" FontSize="12" /></Button>
+            <!-- one row of equal tabs that shrink as more open, down to the tab style's MinWidth; then the row scrolls -->
+            <ScrollViewer x:Name="Scroll" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Disabled" SizeChanged="OnStripResized">
+                <StackPanel x:Name="Strip" Orientation="Horizontal" />
+            </ScrollViewer>
         </DockPanel>
         <!-- DataContext: the front tab's WebView2 -->
         <Grid x:Name="Bar" DockPanel.Dock="Top" Margin="8,0,8,8">
diff --git a/src/CCWrapper/Views/BrowserPanel.xaml.cs b/src/CCWrapper/Views/BrowserPanel.xaml.cs
index 85dc03f..dc6df08 100644
--- a/src/CCWrapper/Views/BrowserPanel.xaml.cs
+++ b/src/CCWrapper/Views/BrowserPanel.xaml.cs
@@ -83,6 +83,7 @@ public void Navigate(string url)
     async Task StartAsync(Tab tab)
     {
         await _loaded.Task; // nothing starts before the panel is first shown
+        if (_env is { IsFaulted: true }) _env = null; // a failed start is retried by the next tab, not cached
         try { await tab.Web.EnsureCoreWebView2Async(await (_env ??= CoreWebView2Environment.CreateAsync(null, _profile))); }
         catch (Exception ex)
         {
@@ -92,6 +93,7 @@ async Task StartAsync(Tab tab)
         }
         var core = tab.Web.CoreWebView2;
         core.NewWindowRequested += OnNewWindow;
+        core.WindowCloseRequested += (_, _) => Dispatcher.InvokeAsync(() => CloseTab(tab.Id)); // window.close() of a script-opened tab (an OAuth popup)
         core.DocumentTitleChanged += (_, _) => Retitle(tab);
         if (tab.Pending is { } url) core.Navigate(url);
         tab.Pending = null;
@@ -140,9 +142,22 @@ void Show(Tab tab)
             t.Header.IsChecked = t == tab;
         }
         Bar.DataContext = tab.Web;
+        NewTab.IsEnabled = !_tabs.Full;
+        NewTab.ToolTip = _tabs.Full ? $"At most {BrowserTabs<Tab>.Max} tabs" : "New tab";
+        FitTabs();
+        tab.Header.BringIntoView();
         Address.Text = tab.Web.Source?.ToString() ?? tab.Pending ?? "";
     }
 
+    void OnStripResized(object sender, SizeChangedEventArgs e) => FitTabs();
+
+    // equal widths that fill the strip; the style's MinWidth is the floor, its MaxWidth the ceiling
+    void FitTabs()
+    {
+        var w = Math.Max(0, Scroll.ActualWidth / Math.Max(1, _tabs.All.Count) - 2);
+        foreach (var (_, t) in _tabs.All) t.Header.Width = w;
+    }
+
     /// <summary>Disposes the tab's WebView2; closing the last tab leaves one blank tab. False when there is no tab <paramref name="id"/>.</summary>
     bool CloseTab(int id)
     {

From f9b56f6fd7a0a41e58587fbe3da12ad6b824a45d Mon Sep 17 00:00:00 2001
From: PieMH <pdondiw@gmail.com>
Date: Sun, 18 Oct 2026 23:18:21 +0200
Subject: [PATCH 4/5] Browser panel tabs: only click-opened pop-ups become
 tabs, window.close closes only pop-up tabs, WPF's WebView2 no longer closes
 the window on window.close

---
 CLAUDE.md                                  |  2 +-
 PRIVACY.md                                 |  2 +-
 README.md                                  |  2 +-
 src/CCWrapper/Terminal/Smoke.cs            | 17 ++++++++++++++---
 src/CCWrapper/Views/BrowserPanel.Driver.cs |  1 +
 src/CCWrapper/Views/BrowserPanel.xaml.cs   | 21 ++++++++++++++++-----
 6 files changed, 34 insertions(+), 11 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index a2917ab..860ae74 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -54,7 +54,7 @@ dotnet test
 - **The browser tool drives only the Browser panel's WebView2** (its own user-data folder) through in-process CDP, one WebView2 per tab on the panel's one profile. Never the
   terminal's WebView2, never a remote debugging port. The pipe is `CurrentUserOnly`, and the only launch flags it adds are
   `--mcp-config` and `--append-system-prompt`. `browserTool` off: new tabs get no flags and `BrowserMcp` refuses calls from open ones.
-  Hardened: each tools/call has a 60 s limit, `navigate`, `new_tab` and `window.open` (which opens a tab, max 20, else dropped) pass only http, https, blob,
+  Hardened: each tools/call has a 60 s limit, `navigate`, `new_tab` and `window.open` (which opens a tab only when user-initiated, max 20, else dropped; `window.close()` closes only such pop-up tabs, and `DropControlsCloseHandler` stops WPF's WebView2 closing the whole window on it) pass only http, https, blob,
   about:blank and data (`BrowserPanel.SchemeAllowed`), every page tool but `navigate` refuses while the front tab shows any other page (`OnUi` captures the front tab once per call and runs both checks, before and after the body, on that tab, whatever got it
   there: history, the address bar; `tabs` lists such a tab as "(not a web page)", without title or URL), and `devtools` is an allow-list by domain (`BrowserMcp.DevToolsRefusal`) that denies cookies,
   downloads, local files, new-document scripts, history navigation and the whole Input domain (keyboard, mouse, touch, drag: it would paste the clipboard). `evaluate` runs with the page's own access.
diff --git a/PRIVACY.md b/PRIVACY.md
index 444ba2b..aec7b23 100644
--- a/PRIVACY.md
+++ b/PRIVACY.md
@@ -46,7 +46,7 @@ If you write to the publisher (see Contact), the publisher handles your message
 ### 3. Websites you open
 
 - The Browser panel is a WebView2 browser. It loads only what you open in it, or what Claude opens in it (next point). Those sites see what any website sees, and may set cookies.
-- Claude can use the Browser panel: each session gets it as a local MCP server (`ccwrapper-browser`), unless you turn it off in Settings → CCWrapper (`browserTool` in `app.json`). CCWrapper itself sends nothing new. The pages load only when Claude or you open them, in the panel's profile for the account, which is stored on your computer in `%LOCALAPPDATA%\CCWrapper\WebView2\browser-<letter>`, so those sites see your logins there, and what Claude runs in a page (the `evaluate` and `devtools` tools) acts with them. `devtools` refuses cookie access, downloads, local files, all simulated input (keyboard, mouse, touch and drag, so it cannot paste your clipboard), the page history and scripts that persist across pages. The panel has tabs, all in that one profile; a page's pop-up opens a new tab (at most 20). Claude opens only `http`, `https`, `blob`, `about:blank` and `data` addresses, not local files, and a pop-up to any other address is dropped. Its tools act on the tab in front, can list, open, switch and close tabs (a tab that is not a web page is listed without title or address), and refuse to work on a page that is not a web address (for example a `file:` page you opened in the address bar yourself). All of this holds in every tab. The tool talks to its CCWrapper window through a named pipe on your own computer that only your Windows user can open. What Claude Code does with a page's text, screenshots or script results is covered in section 2, and Claude Code asks your permission per tool.
+- Claude can use the Browser panel: each session gets it as a local MCP server (`ccwrapper-browser`), unless you turn it off in Settings → CCWrapper (`browserTool` in `app.json`). CCWrapper itself sends nothing new. The pages load only when Claude or you open them, in the panel's profile for the account, which is stored on your computer in `%LOCALAPPDATA%\CCWrapper\WebView2\browser-<letter>`, so those sites see your logins there, and what Claude runs in a page (the `evaluate` and `devtools` tools) acts with them. `devtools` refuses cookie access, downloads, local files, all simulated input (keyboard, mouse, touch and drag, so it cannot paste your clipboard), the page history and scripts that persist across pages. The panel has tabs, all in that one profile; a pop-up opened by a click opens a new tab (at most 20), one a page opens on its own is dropped, and a page's `window.close()` closes only a pop-up tab. Claude opens only `http`, `https`, `blob`, `about:blank` and `data` addresses, not local files, and a pop-up to any other address is dropped. Its tools act on the tab in front, can list, open, switch and close tabs (a tab that is not a web page is listed without title or address), and refuse to work on a page that is not a web address (for example a `file:` page you opened in the address bar yourself). All of this holds in every tab. The tool talks to its CCWrapper window through a named pipe on your own computer that only your Windows user can open. What Claude Code does with a page's text, screenshots or script results is covered in section 2, and Claude Code asks your permission per tool.
 - A link in the terminal opens in the Browser panel if it points to your own computer (`localhost`), and in your default browser otherwise. Only `http` and `https` links open.
 - Each account has its own browser profile, stored on your computer (see below).
 
diff --git a/README.md b/README.md
index 76c130a..ba247d6 100644
--- a/README.md
+++ b/README.md
@@ -91,7 +91,7 @@ Confirmations, warnings and errors use the app's dark theme too.
 **Right panel**
 - **Files:** a tree of every file Claude changed this session, with `+/−` lines in green and red, or the size change for binaries. Click a file to see all of it with the changes highlighted.
 - **Agents:** this session's subagents, running or finished, with model, effort, context and tokens. Click one to see its live transcript.
-- **Browser:** a built-in WebView2 browser for your dev server, with tabs (the **+** button opens one, up to 20; tabs are not restored after a restart). A page's pop-up window opens in a new tab. Claude browses in it too: every session can navigate, read the page, click, type, take screenshots, run scripts, use DevTools, and list, open, switch and close tabs there, and is told to prefer it over another browser. Ask for Chrome by name and it uses Chrome. Scripts and DevTools act with the page's own logins in that profile; DevTools refuses cookie access, downloads, local files, all simulated input (keyboard, mouse, touch and drag, so it cannot paste your clipboard), the page history and scripts that persist across pages. Claude opens only http, https, blob, about:blank and data addresses, never local files (a pop-up to any other address is dropped), and its tools refuse to work on a page that is not a web address (for example a `file:` page you opened yourself). Its tools act on the tab in front. To turn this off, clear **Let Claude use the Browser panel** in Settings → CCWrapper.
+- **Browser:** a built-in WebView2 browser for your dev server, with tabs (the **+** button opens one, up to 20; tabs are not restored after a restart). A pop-up a click opens appears in a new tab; pop-ups a page opens on its own are dropped, and a page's `window.close()` closes only pop-up tabs. Claude browses in it too: every session can navigate, read the page, click, type, take screenshots, run scripts, use DevTools, and list, open, switch and close tabs there, and is told to prefer it over another browser. Ask for Chrome by name and it uses Chrome. Scripts and DevTools act with the page's own logins in that profile; DevTools refuses cookie access, downloads, local files, all simulated input (keyboard, mouse, touch and drag, so it cannot paste your clipboard), the page history and scripts that persist across pages. Claude opens only http, https, blob, about:blank and data addresses, never local files (a pop-up to any other address is dropped), and its tools refuse to work on a page that is not a web address (for example a `file:` page you opened yourself). Its tools act on the tab in front. To turn this off, clear **Let Claude use the Browser panel** in Settings → CCWrapper.
 
 **Bottom bar**
 - Model, effort and permission-mode switches that drive Claude Code's own `/model`, `/effort` and Shift+Tab.
diff --git a/src/CCWrapper/Terminal/Smoke.cs b/src/CCWrapper/Terminal/Smoke.cs
index 875d66d..ce63f8d 100644
--- a/src/CCWrapper/Terminal/Smoke.cs
+++ b/src/CCWrapper/Terminal/Smoke.cs
@@ -87,7 +87,8 @@ static async Task<bool> TalkAsync(Process relay)
     }
 
     // The real Browser panel in a throwaway profile: snapshot refs, typing, clicking and evaluating on a data: page; then tabs:
-    // a window.open that becomes a tab with its opener's window object, new_tab, switch_tab and close_tab.
+    // a click's window.open that becomes a tab with its opener's window object, a timer's that is dropped, new_tab, switch_tab,
+    // window.close() (pop-up tabs only) and close_tab.
     static async Task<bool> PanelAsync()
     {
         var dir = Path.Combine(Path.GetTempPath(), "ccw-smoke-browser");
@@ -131,14 +132,24 @@ static async Task<bool> TabStepsAsync(IBrowserDriver panel)
         var dropped = await panel.ClickAsync("#bad", default); // an ftp: popup is refused (a file: one never reaches NewWindowRequested): no new tab
         var listed = await panel.TabsAsync(default);
         if (dropped.Contains("is now in front") || !listed.Contains("Tab 2") || listed.Contains("Tab 3")) return false;
-        var opened = await panel.NewTabAsync("data:text/html," + Uri.EscapeDataString("<title>Two</title><h1>Second</h1>"), default);
+        // a page that opens a window on its own timer, with no click: dropped, so no tab 4 and the front stays
+        var opened = await panel.NewTabAsync("data:text/html," + Uri.EscapeDataString("<title>Two</title><h1>Second</h1><script>setTimeout(() => window.open('https://example.com/'), 100)</script>"), default);
         if (!opened.StartsWith("Opened tab 3 in front. Loaded") || await panel.EvaluateAsync("document.title", default) != "\"Two\"") return false;
+        await Task.Delay(1000);
+        if ((await panel.TabsAsync(default)).Contains("Tab 4")) return false;
         await panel.SwitchTabAsync(1, default);
         await panel.SwitchTabAsync(3, default);
         var tabs = await panel.TabsAsync(default);
         if (!tabs.Contains("Tab 1: clicked:hello - data:") || !tabs.Contains("Tab 3 (front): Two - data:")) return false;
+        // window.close() leaves a tab Claude or the user opened (one history entry, which Chromium lets a script close) and closes a pop-up tab
+        await panel.EvaluateAsync("setTimeout(() => window.close(), 300)", default);
+        await Task.Delay(1000);
+        if (!(await panel.TabsAsync(default)).Contains("Tab 3 (front)")) return false;
+        await panel.SwitchTabAsync(2, default);
+        await panel.EvaluateAsync("setTimeout(() => window.close(), 300)", default);
+        await Task.Delay(1000);
+        if ((await panel.TabsAsync(default)).Contains("Tab 2")) return false;
         await panel.CloseTabAsync(3, default);
-        await panel.CloseTabAsync(2, default);
         var left = await panel.TabsAsync(default);
         if (left.Contains("Tab 2") || left.Contains("Tab 3") || !left.Contains("Tab 1 (front)")) return false;
         try { await panel.SwitchTabAsync(3, default); return false; }
diff --git a/src/CCWrapper/Views/BrowserPanel.Driver.cs b/src/CCWrapper/Views/BrowserPanel.Driver.cs
index 6bc38ef..47f01b6 100644
--- a/src/CCWrapper/Views/BrowserPanel.Driver.cs
+++ b/src/CCWrapper/Views/BrowserPanel.Driver.cs
@@ -90,6 +90,7 @@ public Task<string> TabsAsync(CancellationToken ct) => Ui(ct, async () =>
         var rows = new List<(int, string?, string?, bool)>();
         foreach (var (id, tab) in _tabs.All.ToList())
         {
+            if (_tabs[id] != tab) continue; // closed during an earlier tab's wait
             string? title = "(not started)", url = tab.Pending ?? "about:blank";
             if (tab.Ready.IsCompletedSuccessfully)
             {
diff --git a/src/CCWrapper/Views/BrowserPanel.xaml.cs b/src/CCWrapper/Views/BrowserPanel.xaml.cs
index dc6df08..8155dac 100644
--- a/src/CCWrapper/Views/BrowserPanel.xaml.cs
+++ b/src/CCWrapper/Views/BrowserPanel.xaml.cs
@@ -20,6 +20,7 @@ sealed class Tab(WebView2 web, RadioButton header, TextBlock title)
         public readonly TextBlock Title = title;
         public Task Ready = Task.CompletedTask;
         public string? Pending; // a Navigate() that came before this tab's WebView2 was ready
+        public bool Popup; // opened by a page's user-initiated window.open: the only kind a page's window.close() may close
     }
 
     readonly string _profile;
@@ -92,18 +93,28 @@ async Task StartAsync(Tab tab)
             throw new InvalidOperationException("The Browser panel's " + why, ex);
         }
         var core = tab.Web.CoreWebView2;
+        DropControlsCloseHandler(core);
         core.NewWindowRequested += OnNewWindow;
-        core.WindowCloseRequested += (_, _) => Dispatcher.InvokeAsync(() => CloseTab(tab.Id)); // window.close() of a script-opened tab (an OAuth popup)
+        core.WindowCloseRequested += (_, _) => { if (tab.Popup) Dispatcher.InvokeAsync(() => CloseTab(tab.Id)); }; // window.close() of a pop-up tab (an OAuth popup); any other tab stays, as Claude's tools work on it
         core.DocumentTitleChanged += (_, _) => Retitle(tab);
         if (tab.Pending is { } url) core.Navigate(url);
         tab.Pending = null;
     }
 
-    /// <summary>target=_blank and window.open, from any tab: a new tab in front. A page's window.open('file:...') is dropped, not
-    /// opened, and so is one past the tab limit.</summary>
+    // WPF's WebView2 closes its whole parent Window on a page's window.close(), the app's too. shortcut: reflection on the Core
+    // assembly's private field; if a package update renames it the handler stays, and the smoke test's window.close step fails.
+    static void DropControlsCloseHandler(CoreWebView2 core)
+    {
+        if (typeof(CoreWebView2).GetField("privateWindowCloseRequested", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)?.GetValue(core) is not EventHandler<object> all) return;
+        foreach (var h in all.GetInvocationList().Where(h => h.Method.Name == "CoreWebView2_WindowCloseRequested")) core.WindowCloseRequested -= (EventHandler<object>)h;
+    }
+
+    /// <summary>target=_blank and window.open by a click, from any tab: a new tab in front. A page's window.open('file:...') is dropped,
+    /// not opened, and so is one the page opened on its own (a timer) or past the tab limit: the front tab must not change unasked.</summary>
     async void OnNewWindow(object? sender, CoreWebView2NewWindowRequestedEventArgs e)
     {
-        if (!SchemeAllowed(e.Uri) || AddTab() is not { } tab) { e.Handled = true; return; }
+        if (!e.IsUserInitiated || !SchemeAllowed(e.Uri) || AddTab() is not { } tab) { e.Handled = true; return; }
+        tab.Popup = true;
         var deferral = e.GetDeferral();
         try
         {
@@ -154,7 +165,7 @@ void Show(Tab tab)
     // equal widths that fill the strip; the style's MinWidth is the floor, its MaxWidth the ceiling
     void FitTabs()
     {
-        var w = Math.Max(0, Scroll.ActualWidth / Math.Max(1, _tabs.All.Count) - 2);
+        var w = Math.Max(0, Scroll.ActualWidth / Math.Max(1, _tabs.All.Count) - 3);
         foreach (var (_, t) in _tabs.All) t.Header.Width = w;
     }
 

From fabe2863b68174cb32f92dd5209457f97deb9344 Mon Sep 17 00:00:00 2001
From: PieMH <pdondiw@gmail.com>
Date: Sun, 18 Oct 2026 23:26:57 +0200
Subject: [PATCH 5/5] Browser panel tabs: a closing pop-up hands the front back
 to its opener; a test guards the WebView2 names the close fix reflects on

---
 README.md                                     |  4 ++--
 src/CCWrapper/Terminal/Smoke.cs               |  3 ++-
 src/CCWrapper/Views/BrowserPanel.xaml.cs      | 22 +++++++++++++++----
 .../CCWrapper.Tests/Views/PanelLogicTests.cs  | 11 ++++++++++
 4 files changed, 33 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index ba247d6..460a110 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@
 ![Platform](https://img.shields.io/badge/platform-Windows%2010%20%7C%2011-0078D6)
 ![.NET](https://img.shields.io/badge/.NET-10-512BD4)
 ![License](https://img.shields.io/badge/license-GPL--3.0-blue)
-![Tests](https://img.shields.io/badge/tests-440%20passing-brightgreen)
+![Tests](https://img.shields.io/badge/tests-441%20passing-brightgreen)
 
 Claude Code in a bare PowerShell window works, but it's clumsy. There's no search, you can't paste screenshots or files with Ctrl+V, you can't see your other sessions, and context, usage, file changes and subagents are hard to keep an eye on. If you also juggle **several Claude Code accounts** (work and personal, for example), it gets worse.
 
@@ -222,7 +222,7 @@ Every step is in the history: `git log --first-parent` shows the merge of each t
 - [xterm.js](https://xtermjs.org/) 6 (the VS Code terminal) in WebView2;
 - [Porta.Pty](https://www.nuget.org/packages/Porta.Pty) for ConPTY;
 - [DiffPlex](https://github.com/mmanela/diffplex) for diffs;
-- xUnit, with 440 tests on synthetic fixtures.
+- xUnit, with 441 tests on synthetic fixtures.
 
 ## Development
 
diff --git a/src/CCWrapper/Terminal/Smoke.cs b/src/CCWrapper/Terminal/Smoke.cs
index ce63f8d..6bc8fe7 100644
--- a/src/CCWrapper/Terminal/Smoke.cs
+++ b/src/CCWrapper/Terminal/Smoke.cs
@@ -148,7 +148,8 @@ static async Task<bool> TabStepsAsync(IBrowserDriver panel)
         await panel.SwitchTabAsync(2, default);
         await panel.EvaluateAsync("setTimeout(() => window.close(), 300)", default);
         await Task.Delay(1000);
-        if ((await panel.TabsAsync(default)).Contains("Tab 2")) return false;
+        var afterPopup = await panel.TabsAsync(default);
+        if (afterPopup.Contains("Tab 2") || !afterPopup.Contains("Tab 1 (front)")) return false; // tab 3 is its strip neighbour, but tab 1 opened it
         await panel.CloseTabAsync(3, default);
         var left = await panel.TabsAsync(default);
         if (left.Contains("Tab 2") || left.Contains("Tab 3") || !left.Contains("Tab 1 (front)")) return false;
diff --git a/src/CCWrapper/Views/BrowserPanel.xaml.cs b/src/CCWrapper/Views/BrowserPanel.xaml.cs
index 8155dac..2b83d40 100644
--- a/src/CCWrapper/Views/BrowserPanel.xaml.cs
+++ b/src/CCWrapper/Views/BrowserPanel.xaml.cs
@@ -21,6 +21,7 @@ sealed class Tab(WebView2 web, RadioButton header, TextBlock title)
         public Task Ready = Task.CompletedTask;
         public string? Pending; // a Navigate() that came before this tab's WebView2 was ready
         public bool Popup; // opened by a page's user-initiated window.open: the only kind a page's window.close() may close
+        public Tab? Opener; // the tab whose page opened this pop-up; it comes back to front when the pop-up closes itself
     }
 
     readonly string _profile;
@@ -95,18 +96,30 @@ async Task StartAsync(Tab tab)
         var core = tab.Web.CoreWebView2;
         DropControlsCloseHandler(core);
         core.NewWindowRequested += OnNewWindow;
-        core.WindowCloseRequested += (_, _) => { if (tab.Popup) Dispatcher.InvokeAsync(() => CloseTab(tab.Id)); }; // window.close() of a pop-up tab (an OAuth popup); any other tab stays, as Claude's tools work on it
+        core.WindowCloseRequested += (_, _) => { if (tab.Popup) Dispatcher.InvokeAsync(() => ClosePopup(tab)); }; // window.close() of a pop-up tab (an OAuth popup); any other tab stays, as Claude's tools work on it
         core.DocumentTitleChanged += (_, _) => Retitle(tab);
         if (tab.Pending is { } url) core.Navigate(url);
         tab.Pending = null;
     }
 
+    // The WebView2 package's private names DropControlsCloseHandler reflects on; PanelLogicTests fails when an update renames them.
+    public const string CloseEventField = "privateWindowCloseRequested";
+    public const string ControlCloseHandler = "CoreWebView2_WindowCloseRequested";
+
     // WPF's WebView2 closes its whole parent Window on a page's window.close(), the app's too. shortcut: reflection on the Core
-    // assembly's private field; if a package update renames it the handler stays, and the smoke test's window.close step fails.
+    // assembly's private field; if a package update renames it the handler stays, the test and the smoke test's window.close step fail.
     static void DropControlsCloseHandler(CoreWebView2 core)
     {
-        if (typeof(CoreWebView2).GetField("privateWindowCloseRequested", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)?.GetValue(core) is not EventHandler<object> all) return;
-        foreach (var h in all.GetInvocationList().Where(h => h.Method.Name == "CoreWebView2_WindowCloseRequested")) core.WindowCloseRequested -= (EventHandler<object>)h;
+        if (typeof(CoreWebView2).GetField(CloseEventField, System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)?.GetValue(core) is not EventHandler<object> all) return;
+        foreach (var h in all.GetInvocationList().Where(h => h.Method.Name == ControlCloseHandler)) core.WindowCloseRequested -= (EventHandler<object>)h;
+    }
+
+    // a pop-up that closes itself while in front hands the front back to the tab that opened it, not to its strip neighbour
+    void ClosePopup(Tab popup)
+    {
+        var wasFront = popup == _tabs.FrontTab;
+        if (!CloseTab(popup.Id) || !wasFront || popup.Opener is not { } opener || _tabs[opener.Id] != opener) return;
+        Show(opener);
     }
 
     /// <summary>target=_blank and window.open by a click, from any tab: a new tab in front. A page's window.open('file:...') is dropped,
@@ -115,6 +128,7 @@ async void OnNewWindow(object? sender, CoreWebView2NewWindowRequestedEventArgs e
     {
         if (!e.IsUserInitiated || !SchemeAllowed(e.Uri) || AddTab() is not { } tab) { e.Handled = true; return; }
         tab.Popup = true;
+        tab.Opener = _tabs.All.Select(t => t.Tab).FirstOrDefault(t => t.Web.CoreWebView2 == sender);
         var deferral = e.GetDeferral();
         try
         {
diff --git a/tests/CCWrapper.Tests/Views/PanelLogicTests.cs b/tests/CCWrapper.Tests/Views/PanelLogicTests.cs
index c1d61f0..9daece0 100644
--- a/tests/CCWrapper.Tests/Views/PanelLogicTests.cs
+++ b/tests/CCWrapper.Tests/Views/PanelLogicTests.cs
@@ -1,3 +1,4 @@
+using System.Reflection;
 using CCWrapper.Data;
 using CCWrapper.Views;
 
@@ -209,4 +210,14 @@ public void Browser_script_arguments_enter_as_json_literals()
         var js = BrowserScripts.Call("(s, t) => s", evil, "t");
         Assert.Equal("((s, t) => s)(\"x\\u0022); alert(1); (\\u0022\\u003C/script\\u003E\\n\",\"t\")", js);
     }
+
+    [Fact]
+    public void WebView2_update_renamed_the_window_close_handler_fix_DropControlsCloseHandler()
+    {
+        var field = typeof(Microsoft.Web.WebView2.Core.CoreWebView2).GetField(BrowserPanel.CloseEventField, BindingFlags.NonPublic | BindingFlags.Instance);
+        Assert.Equal(typeof(EventHandler<object>), field?.FieldType);
+        // not a base of WebView2 in this package: the control's helper class that holds the handler
+        var control = typeof(Microsoft.Web.WebView2.Wpf.WebView2).Assembly.GetType("Microsoft.Web.WebView2.Wpf.WebView2Base");
+        Assert.NotNull(control?.GetMethod(BrowserPanel.ControlCloseHandler, BindingFlags.NonPublic | BindingFlags.Instance));
+    }
 }