browser_execute: per-call console arg, drop global monkey-patch

Fixes cubic P2 finding on PR #41. Two overlapping execute() calls
clobbered each other's global console.log/error/warn/info patches
and corrupted the originals process-wide via a stale 'finally'
restore. Cases this hits: server-mode multi-session, sub-agent
sessions, parallel browser_execute tool calls in one assistant turn
(AI SDK runs those via Promise.all), TUI tabs sharing a daemon.

Fix: bind a per-call { log, error, warn, info } object as the second
AsyncFunction argument. JS scope chain resolves console.log() in the
snippet to the function parameter before reaching the global, so
existing snippets keep working byte-identically and the global
console is never mutated. Also concurrency-safe by construction --
no shared state between calls.

Test 'overlapping execute calls do not clobber each other's console
capture' is a regression guard: verified to fail on the old impl
(empty output captures + 'bye from B' leaking to stderr) and pass
on the new one.

Author: bcode

packages/bcode-browser/src/browser-execute.ts

@@ -3,10 +3,12 @@
 // Executes a JavaScript snippet in-process against a per-opencode-session
 // `Session` (the CDP transport from `./cdp/session.ts`). No subprocess, no
 // daemon, no Unix socket, no `uv` — we wrap the snippet with
-// `new AsyncFunction("session", code)` and run it.
+// `new AsyncFunction("session", "console", code)` and run it.
 //
 // Snippet scope (Phase H hard rule #3 — workspace-as-plain-code):
 //   `session`        — the live CDP `Session`, persistent across calls.
+//   `console`        — per-call capture object shadowing the global. Same
+//                      `{log, error, warn, info}` API as the real console.
 //   standard JS globals.
 //
 // Nothing is auto-loaded. To reuse code from a previous snippet the agent
@@ -16,13 +18,17 @@
 // wrapper supplies `ctx.workspaceDir` so `.ts` files written under it can be
 // addressed by absolute path; this resolver creates the dir on first use.
 //
-// Output capture: console.log calls inside the snippet stream via a
-// monkey-patch around `console.log`/`console.error`/`console.warn`/
-// `console.info`. The originals are restored in a `finally` block — even if
-// the snippet throws, even on timeout. See
-// `memory/browsercode/phase_h_eval_feasibility_findings.md` for the verified
-// pattern (compiled-mode `bun build --compile` works on Linux x64; AsyncFunction
-// + dynamic import survive bunfs).
+// Output capture: a per-call `console` object (`{log, error, warn, info}`)
+// is bound into the snippet's lexical scope as the second AsyncFunction
+// argument. JavaScript's scope chain resolves `console.log(...)` to the
+// function parameter before reaching the global, so existing snippets keep
+// working byte-identically while the global `console` stays untouched.
+// This is concurrency-safe: two overlapping `execute` calls (different
+// opencode sessions in the same process, parallel tool calls within one
+// session, etc.) each get their own capture buffer with no global state to
+// clobber. See `memory/browsercode/phase_h_eval_feasibility_findings.md`
+// for the verified eval pattern (compiled-mode `bun build --compile` works
+// on Linux x64; AsyncFunction + dynamic import survive bunfs).
 //
 // Cancellation: JS Promises are not preemptively cancellable. A snippet
 // without `await` yield-points (e.g. `for (let i = 0; i < 1e9; i++) {}`)
@@ -44,7 +50,8 @@ const MAX_TIMEOUT_MS = 10 * 60 * 1000
 
 export const parameters = Schema.Struct({
   code: Schema.String.annotate({
-    description: "JavaScript source. Wrapped in an async function with `session` (CDP Session) bound.",
+    description:
+      "JavaScript source. Wrapped in an async function with `session` (CDP Session) and `console` (per-call capture; same `log/error/warn/info` API) bound.",
   }),
   timeout: Schema.optional(Schema.Number).annotate({
     description: `Timeout in milliseconds. Default ${DEFAULT_TIMEOUT_MS}, max ${MAX_TIMEOUT_MS}.`,
@@ -117,37 +124,21 @@ export const make = Effect.fn("BrowserExecute.make")(function* (dataDir: string)
       yield* Effect.promise(() => fs.mkdir(ctx.workspaceDir, { recursive: true }))
 
       const wrapped = yield* Effect.try({
-        try: () => new AsyncFunction("session", args.code),
+        try: () => new AsyncFunction("session", "console", args.code),
         catch: (err) => new Error(`syntax error in browser_execute snippet: ${err}`),
       })
 
       let output = ""
-      const realLog = console.log
-      const realErr = console.error
-      const realWarn = console.warn
-      const realInfo = console.info
       const tee = (...a: unknown[]) => {
         output += a.map((x) => (typeof x === "string" ? x : serialize(x))).join(" ") + "\n"
         if (ctx.onChunk) Effect.runFork(ctx.onChunk(output))
       }
-      console.log = tee
-      console.error = tee
-      console.warn = tee
-      console.info = tee
+      const snippetConsole = { log: tee, error: tee, warn: tee, info: tee }
 
       const ran = yield* Effect.tryPromise({
-        try: () => wrapped(session),
+        try: () => wrapped(session, snippetConsole),
         catch: (err) => new Error(`browser_execute snippet threw: ${err instanceof Error ? err.stack ?? err.message : String(err)}`),
-      }).pipe(
-        Effect.ensuring(
-          Effect.sync(() => {
-            console.log = realLog
-            console.error = realErr
-            console.warn = realWarn
-            console.info = realInfo
-          }),
-        ),
-      )
+      })
 
       return { output, result: serialize(ran) } satisfies ExecuteResult
     }).pipe(

packages/bcode-browser/test/browser-execute.test.ts

@@ -130,3 +130,51 @@ test.skipIf(!enabled)("syntax error in snippet surfaces a clean failure", async
     ),
   ).rejects.toThrow(/syntax error/)
 })
+
+// Concurrency safety: two overlapping execute() calls (different sessionIDs)
+// must each capture their own console output without leaking into each other
+// or into the real global console. No Chrome required — the snippets never
+// touch `session`. Regression guard for the global-monkey-patch bug fixed
+// by the per-call `console` argument shadowing the global.
+test("overlapping execute calls do not clobber each other's console capture", async () => {
+  const realLogBefore = console.log
+  const aWorkspace = await fs.mkdtemp(path.join(os.tmpdir(), "bcode-conc-a-"))
+  const bWorkspace = await fs.mkdtemp(path.join(os.tmpdir(), "bcode-conc-b-"))
+  const aData = await fs.mkdtemp(path.join(os.tmpdir(), "bcode-data-a-"))
+  const bData = await fs.mkdtemp(path.join(os.tmpdir(), "bcode-data-b-"))
+
+  const run = (label: string, dataDirX: string, workspace: string) =>
+    Effect.runPromise(
+      Effect.scoped(
+        Effect.gen(function* () {
+          const impl = yield* BrowserExecute.make(dataDirX)
+          return yield* impl.execute(
+            {
+              // Yield once so both snippets' bodies are mid-execution at the same
+              // time; under the old global-patch impl, B's tee would shadow A's
+              // and the `finally` chain would corrupt both captures + the global.
+              code: `await new Promise((r) => setTimeout(r, 50));
+                     console.log("hello from ${label}");
+                     await new Promise((r) => setTimeout(r, 50));
+                     console.log("bye from ${label}");
+                     return ${JSON.stringify(label)};`,
+            },
+            { sessionID: `concurrency-${label}`, workspaceDir: workspace },
+          )
+        }),
+      ),
+    )
+
+  const [a, b] = await Promise.all([run("A", aData, aWorkspace), run("B", bData, bWorkspace)])
+
+  expect(a.output).toBe("hello from A\nbye from A\n")
+  expect(b.output).toBe("hello from B\nbye from B\n")
+  expect(JSON.parse(a.result)).toBe("A")
+  expect(JSON.parse(b.result)).toBe("B")
+  // Global console must be untouched.
+  expect(console.log).toBe(realLogBefore)
+
+  await Promise.all(
+    [aWorkspace, bWorkspace, aData, bData].map((d) => fs.rm(d, { recursive: true, force: true })),
+  )
+})