Browser

Pond can show a worktree's dev server next to its terminal. An agent can also drive that page through MCP tools. The browser is for the agent's own work, not for general browsing.

The tile

• One page per worktree, with no tabs. It opens next to the agent's terminal on the stage.
• Found from the terminal. When a terminal prints a dev-server URL, the helper reports its origin once. The terminal header and the worktree card then offer a preview.
• Its own storage. The page has its own website data. Your Safari logins are never in it.
• Links out. A link to an address outside the worktree's own addresses opens in your default browser.
• Pond's scripts are separate. The element picker, the outline and the console hook run in their own JavaScript world. They share the page's DOM, not its globals.

The error panel pastes a line starting with [Pond error] into the agent's terminal. The picker's prompt sends a message starting with Pond pick:. Pond never presses Return on its own. The one Return it sends is the one you press in the picker's prompt: the helper sends the paste and then Return as a separate key write, and refuses it while a draft sits in the input box or a dialog is up.

The MCP server

When browser tools are on for a session, Claude Code starts pond browser-mcp --agent <id> as a stdio MCP server. It is a thin proxy. Every call goes over browser.sock to Pond.app, and the proxy keeps no state and writes no file.

Before Pond.app reads anything from browser.sock, it checks the caller:

• the caller runs as your user;
• its code is Pond's own signed pond binary;
• the agent named in the request is live, according to pond-ptyd;
• the calling process runs under that agent's terminal.

So pond browser-mcp --agent <other id>, typed in one agent's shell, is refused for any other agent.

The socket has no control operations. Nothing on it can grant access or answer a sheet.

The guard

Every page an agent drives goes through one gate, WebKit's navigation policy, before any main-frame navigation or new window.

• Origins. An agent may use only the worktree's own dev addresses. Any other origin, a LAN address included, needs your click on a sheet that names it. Return denies. Allow once and Allow for this task have no keyboard shortcut. A task grant ends with the task, and the cookies it set are removed.
• Consequences. Away from localhost, a click or Enter on a control labelled with a word such as pay, buy, send or delete asks you first.
• Secrets. Away from localhost, an agent cannot type into password fields.
• Files. Agents cannot download. A file:// page must sit inside the worktree, checked after resolving links.
• Your input. If you click or type in the page, the agent pauses for 3 seconds. The bar shows which agent is using the page, with a Stop button.
• No self-approval. Grants come only from your click on a Pond sheet, never from the socket or the CLI.

Turning it off

Browser tools for new tasks are a sealed setting. If the setting cannot be verified, it reads as off. pond task new --no-browser leaves the server out of one session, so the tools do not exist there.