The weaker of agent-browser's two safety flags is the one that survives a restart

Run any command against a session whose daemon has exited, and the client spawns a replacement. The client exports AGENT_BROWSER_ALLOWED_DOMAINS only for the command doing the spawning, and only when that command carried the flag ^[5]. DaemonState::new reads the filter from that variable and nothing else, at actions.rs:696-701 ^[4]. A reconnect that does not repeat the flag therefore builds a daemon whose filter is None ^[8].

That leaves the files on disk. {session}.config is a fingerprint of other daemon options, and allowed_domains is not among the hashed fields ^[6]. The five remaining sidecars, .engine, .provider, .extensions, .port and .stream, are deleted at startup ^[7][17]. Whatever the previous filter was, the reconnect path cannot read it back ^[18].

The allowlist is not the only thing that goes. ensure_state_replay_supported_by_active_domain_filter refuses --state and storageState while a filter is active, and with None it permits them again ^[9]. restrict_webrtc is derived from the same list, and the list is hashed into the launch hash, so the relaunched browser comes back without the WebRTC restriction ^[10].

The repository already contains the fix, in the file for the other flag. --pin-tab is the weaker boundary, and it was made restart-proof with a sidecar file ^[11]. The atomic writes and the fsync went to the tab pin. The header comment on cli/src/native/tab_binding.rs says that once a session is created with --pin-tab, subsequent commands and daemon restarts keep the strict semantics without repeating the flag, and that because a lost or corrupt binding silently drops that safety boundary, writes are atomic (temp file + rename), owner-only, and fsynced, with both save and load reporting failures instead of swallowing them ^[12]. tab_binding::load runs when the daemon state is built, at actions.rs:683, and --allowed-domains has no equivalent load ^[13].

Tests do not catch this because every end-to-end test of the domain filter mutates the filter ^[15]. A test that changes the allowlist inside a live process exercises the half that works. The handler a client would poll reports session, engine, launch hash and the whole restore-* family, but not the active allowlist ^[14]. The symptom in the original report was exit code 0 and nothing printed ^[16].

This transfers to your own CLI if it has a per-session daemon, a flag documented as sticky until explicitly dropped, and a cold-start constructor that reads the boundary from somewhere only one command writes. Where does the state constructor get the boundary on a cold start, and can any command other than the spawning one set it? The post says it includes a five-question procedure for any daemon-shaped CLI; the published text breaks off before the questions ^[19].