# Agent Browser Isolation

A hard safety rule for every Adom agent that drives a browser.

> **Never navigate, reload, or close a browser tab or window you did not create.
> Open your own isolated window and act only on the tab IDs you captured.**

## Why

The native-browser bridge (`nbrowser_*`, the `adom-browser-extension`) drives the
user's **real, signed-in Chrome or Edge**. Those tabs hold their live work:
other running AI/agent threads, half-filled forms, authenticated sessions,
drafts. Navigating an existing tab destroys that state with **no undo**. This
rule exists because it has happened: an agent redirected a user's active tab and
wiped the state of every other Claude thread they had open.

## The safe pattern

1. `nbrowser_open_window { url }` and record the returned `sessionId`, `tabId`,
   `windowId` as **yours**.
2. Pass an explicit `tabId` you created on every navigate / eval / reload /
   close. Never act on "the active tab."
3. Before any mutating call, confirm the target is one you opened.
4. Close only the windows you opened.

## Prefer pup when you do not need the user's login

For public pages or dashboards you host, use **pup** (`browser_open_window`, a
separate disposable Chrome). Then you never touch the user's real browser at
all. Use the native bridge only when you truly need their real login or
human-trust, and stay strictly inside the window you opened.

## What never to do

- `nbrowser_navigate` / `browser_navigate` on a tab you did not open.
- Navigate or reload the user's active or pre-existing tabs.
- Reuse one of the user's tabs as your workspace.
- Close tabs or windows you did not create.

See [SKILL.md](SKILL.md) for the full agent-facing checklist.