← Commit history
native-browser-safety: document code-enforced background/focus-steal auto-revert + userRequestedForeground gate (ext 0.0.22)
2 files changed
+15−1
package.json+1−1@@ -1,6 +1,6 @@ { "slug": "adom-browser-extension",- "version": "0.3.24",+ "version": "0.3.25", "type": "app", "title": "Adom Native Browser Extension (Chrome + Edge)", "description": "Drive your real, logged-in Chrome/Edge from the Adom ecosystem: the nbrowser_* native-browser bridge (counterpart to pup). Multi-profile driving, a read-only credential-library query over the browser's own saved logins (Chrome + Edge), and hands-free vendor login automation, so chip CAD / datasheets download past every login wall in your real signed-in session.",
skills/native-browser-safety/SKILL.md+14@@ -69,6 +69,20 @@ opens and navigations, drive `chrome://` pages only when the user is not mid-tas surface a window. (Observed live: a `desktop_navigate` to `chrome://extensions` left the window at `z:0` even though no `bring_to_front` was called and the window was opened `focused:false`.) +**The bridge now ENFORCES all of this in code (ext >= 0.0.22) - you cannot shove a window in front of+the user even by accident.** `open_window`/`open_tab` open in the background regardless of a stray+`focused:true`/`active:true` (those legacy flags are IGNORED); `switch_window`/`focus` never raise; and+after every open/navigate/switch/state change the bridge checks the z-order - if a driven window landed+topmost, it is **auto-sent back to the background** (focus returned to the user's previous window, or the+window minimized if the user was in another app) and the response carries a `_warning` ++`focusAutoReverted:true`. Each auto-correction is logged as a `focus_violation` event+(`nbrowser_events`) so the user can see when a thread tried to steal focus. The ONLY way to legitimately+raise a window is `userRequestedForeground:true`, and you pass it **only when the user explicitly asked+to watch live** - never to "make sure it worked" or because a background open felt slow. And **never**+fall back to an OS-level launch (`launch_process` / `Start-Process` / `msedge`/`chrome --new-window`) or+`desktop_bring_to_front` to open or surface a window - that is the exact rude behavior the enforcement+exists to stop; if a background open is ever blocked, hand the user a shareable link instead.+ ## The "debugging this browser" bar is expected, not a bug CDP verbs (`click`, `type`, `screenshot`, `eval`, ...) attach `chrome.debugger`, which makes Chrome show the yellow `"Adom for Chrome & Edge" started debugging this browser` bar. The bridge