---
name: agent-browser-isolation
description: HARD SAFETY RULE. Read before ANY browser-driving call (nbrowser_* native bridge or browser_* pup). Never navigate, reload, or close a tab/window you did not create. The native bridge controls the user's REAL Chrome/Edge, full of their live work and other running AI threads; redirecting an existing tab destroys it with no undo. Open your own isolated window and act only on tab IDs you captured. Triggers: nbrowser, browser_navigate, drive the browser, native browser, control my chrome/edge, open a tab, scrape vendor, chip-fetcher, automate a login.
---

# Agent Browser Isolation — never hijack the user's tabs

**Read this before any browser-driving call** (`nbrowser_*` native bridge, or
`browser_*` pup). It is a hard safety rule, not a style preference.

## The rule (non-negotiable)

> **Never navigate, reload, go back/forward, close, or otherwise act on a
> browser tab or window you did not yourself create in this session. Operate
> ONLY inside a window you opened, targeting tab IDs you captured. When unsure
> whether a tab is yours, do nothing to it.**

## Why this is critical

The native-browser bridge (`nbrowser_*`, the `adom-browser-extension`) controls
the user's **real, signed-in Chrome or Edge** — the same browser they work in
all day. Those tabs hold live, often unsaved, irreplaceable state:

- **other AI / agent threads running right now** (including other Claude Code
  sessions — navigating one mid-run destroys its state, and yes, that can be the
  very thread you are running in),
- half-filled forms, checkout flows, authenticated dashboards,
- drafts, research, logins mid-handshake.

Redirecting even **one** existing tab can wipe work the user cannot get back.
There is no undo. Treat every pre-existing tab as sacred.

## The safe pattern (do this, every time)

1. **Open your own window** and capture the IDs it returns:
   ```
   nbrowser_open_window { url }   ->  { sessionId, tabId, windowId }
   ```
   Record `sessionId`, `tabId`, `windowId` as *yours*. (Pup equivalent:
   `browser_open_window { sessionId, profile, url }` — pup is a separate Chrome
   you own.)
2. **Always pass an explicit `tabId` you created** on every `navigate` / `eval`
   / `reload` / `screenshot` / `close`. Never operate on "the active tab" — the
   active tab is usually the user's, not yours.
3. **Keep a set of the IDs you created.** Before any mutating call, assert the
   target is in that set. If it is not, stop.
4. **Close only what you opened** (`nbrowser_close_window { sessionId }` for your
   own session). Never close the user's last window in a profile (the extension
   dies) and never close their tabs.

## Prefer pup when you do not need their login

If the task does **not** require the user's real cookies/session (rendering a
public page, a dashboard you host, a vendor page that is not bot-walled), use
**pup** (`browser_open_window` — a separate, disposable Chrome) instead of the
native bridge. Then you never touch their real browser at all. Reach for the
native bridge only when you genuinely need their real login or human-trust
(e.g. a Cloudflare-walled vendor site), and even then stay strictly inside your
own freshly opened window.

## Never do any of these

- `nbrowser_navigate` / `browser_navigate` on a tab you did not open.
- Navigate or reload the user's **active** tab, or any pre-existing tab.
- Reuse one of the user's existing tabs as your workspace.
- `close_tab` / `close_window` on anything you did not create.
- Assume a `navigate` "lands somewhere safe" — with no owned `tabId` it hits the
  active tab, which is the user's.

## If you already have a window open from earlier in the session

Re-confirm it is still **yours** (its `windowId` / `tabId` match what you
recorded) before driving it. Sessions can drift; the bridge's "active session"
is not a guarantee that the tab in front is the one you opened. When in doubt,
open a fresh window.

## One-line summary

Your browser workspace is the window **you** opened. Everything else on the
user's screen is their live work: read nothing into it, write nothing to it,
navigate none of it.