Tab Debt
38-case agent eval, injection included
A browser extension with an agent inside: once a day it reads your open tabs, works out why you opened each one, and proposes a plan you approve.
01 Problem
Tabs pile up because closing them feels like losing something. A tool that closes tabs for you has to be right about intent — finished, to read later, a task, part of a project — and it must never close the wrong thing, even when a web page tries to talk the model into it.
02 Approach
Free rules run first: protected tabs, duplicates, followed-up searches, confirmation and error pages. Only unclear tabs reach a short, bounded agent loop with three tools (read_page, find_related, submit_plan). The agent can only propose; a separate executor is the only code that closes or saves, and it re-checks every tab itself. It runs free on Chrome’s built-in on-device model, or on the user’s own key (OpenRouter, Anthropic, OpenAI, Gemini). Page text reaches the model only inside a marked untrusted block and is checked for injected instructions. A once-a-day “Finishing up?” nudge learns your usual finish time from tab events.
03 Result
A working MV3 extension with a side-panel review, a morning “here’s where you left off” brief, undo for every review, and Chrome Web Store assets ready. An eval suite of 38 labelled tabs — two of them prompt-injection pages — fails the run on any injection leak, too many unsafe closes, or low accuracy. Unit tests cover rules, tracker, agent and executor, and end-to-end tests drive a real Chromium.
04 What didn’t work
Only the OpenAI-compatible provider path is tested end to end so far; Anthropic, OpenAI and Gemini are wired through the AI SDK but still need a real-key check. Search is keyword-based, and Chrome may refuse to open the side panel straight from a notification, so the review waits for the next icon click.