NB - Native Browser Bridge

@@ -158,3 +158,54 @@ degraded mode that fails silently or begs constantly both lose the install. Post-launch minimize (ShowWindow SW_MINIMIZE returns focus to the user automatically) + a taskbar flash is the pattern - the user opens the window when THEY are ready. foreground:true stays gated behind foregroundReason + notify, exactly like the extension path.++## ⭐ Opening native browser windows without ABE — the hard lessons (John, 2026-07-19)+Spent a whole session flailing at "open a background Edge window in the live profile" and killed the+user's AI thread TWICE. Everything below is what it actually took, and what NOT to do.++**A plain `--new-window` launch into an already-running browser just ADDS a window. It does not restart+the browser.** Edge is no different from Chrome here. If you think "opening a window is dangerous," you+are about to overcomplicate a two-line problem. The real bugs were mundane:+1. **Quote your launch args as an ARRAY, never an embedded-quote string.** `Start-Process msedge+   -ArgumentList '--profile-directory="Default" ...'` passes LITERAL quotes to Chromium, corrupting the+   `Default` profile match and breaking the singleton handshake → the launcher can't attach to the+   running instance and things go sideways. Use `-ArgumentList @('--profile-directory=Default',+   '--new-window', $url)` (or AD `launch_process` with an args array) so each arg is quoted correctly.+2. **Never guess which window you just opened by a racy diff and then MINIMIZE/CLOSE it.** That is how+   you grab the workspace window instead. Snapshot the exact pre-launch hwnd set, exclude a PROTECTED+   set (the workspace/editor window — match titles like `- Editor -|Hydrogen|code-server|claude.ai`+   for the right browser brand — plus any other thread's live session hwnd), and only act on a window+   that is genuinely new AND not protected. To background a KNOWN window, target its exact hwnd with+   `ShowWindow(hwnd, SW_MINIMIZE=6)` — no diffing.++**Do NOT build a footgun and then pull the trigger.** I added a `confirmLiveProfile:true` override to a+guard whose entire point was "do not open into the live profile," then passed it on the user's live+profile and killed the thread a second time. If a guard is worth having, it should not have an escape+you'll reach for. The live-profile hazard is ONLY the minimize/close mis-targeting — solve that directly+(protected-hwnd exclude) rather than refusing the whole feature.++**Verify `node --check server.js` PASSES before EVERY release.** I shipped 0.1.34 and 0.1.36 with syntax+errors because the release commands ran after a failed check in the same `&&` chain wasn't actually+gating them. A syntax error = the bridge won't spawn = native browser is DOWN for the user. Make syntax+verification a hard, separate gate: `node --check server.js || exit 1` on its own line.++**Never demo a destructive-capable op against the user's LIVE working profile.** John's workspace runs+inside Edge's only profile; every Edge open I did was aimed at the very session he was using. If there is+no safe surface to prove something on, say "I can't safely prove this on your machine" — do not gamble.++**Isolated `--user-data-dir` on a work machine is NOT clean.** A fresh Edge profile auto-signs-in the+Windows work account and pops Microsoft's "we're syncing your data across devices" first-run dialog.+It's confined to that throwaway user-data-dir (delete it after), and it does NOT flip sync on the real+Default profile — but it looks alarming to the user. Prefer not launching extra browser instances on the+user's machine at all when you can avoid it.++**Diagnostics gotchas:** `Get-Process msedge | MainWindowTitle` is unreliable for a multi-window browser+(one process, one MainWindow) — use `EnumWindows` + `GetWindowText` to truly enumerate windows. And+`$pid` is a READ-ONLY PowerShell automatic variable (the shell's own PID) — never assign to it; your+"pid" readouts will be garbage. When checking "did I just kill a window", enumerate windows directly;+`desktop_list_windows` returning 0 during AD churn is "can't see", not "gone".++**The honest product truth to keep surfacing:** for the user's REAL signed-in session, opening a window+via **ABE** (`chrome.windows.create` FROM INSIDE the running browser — no process launch at all) is+strictly safer than any external launch. Extension-free `open_os_window` is the graceful-degradation+wedge; ABE is the clean path. Say so.