maddal17/antigravity-tab-guard

Zero-trust Chrome Extension (Manifest V3) that isolates AI coding agent browser sessions (Google Antigravity, chrome-devtools-mcp, Cursor, Claude Code) into a dedicated, color-coded "Antigravity" Chrome Tab Group and performs deterministic cleanup upon task completion—without stealing focus, touching personal tabs, or leaving ghost Saved Tab Groups on your Bookmarks Bar.
## Why This Exists
The Chrome DevTools Protocol (CDP) operates at Chromium's engine/target layer (Target, Page, DOM) and intentionally exposes no API for Chrome UI Tab Groups (chrome.tabGroups exists exclusively inside the Chrome Extensions layer). As a result, CDP-based agents scatter debug tabs across your active window or leave orphan targets behind.
Existing agent browser extensions typically bridge this gap by opening localhost WebSocket servers, requesting host permissions, or injecting content scripts—introducing serious attack surfaces.
Antigravity Tab Group Guard solves this with a zero-network, zero-host-permission, out-of-band birth-URI handshake.
## Architecture
[AI Agent / chrome-devtools-mcp]
├── 1. Bootstrap (Background): open new tab at about:blank#antigravity
│ └──► [Antigravity Tab Group Guard (MV3 Service Worker)]
│ ├─ Verifies clean openerless birth (blocks webpage spoofing)
│ ├─ Moves tab to right edge & groups under "Antigravity"
│ └─ Auto-captures child popups opened by the session
├── 2. Execute: navigate to target URL, inspect DOM, capture screenshots
│ └──► (Dragging a tab out of the group transfers ownership to you)
└── 3. Teardown: navigate to about:blank#antigravity-done & close tab
└──► [Antigravity Tab Group Guard]
├─ Explicitly ungroups before close (zero Saved Tab Group residue)
├─ Cascade-closes any child popups
└─ User tabs remain permanently locked & untouched
## Security Design & Threat Model
Built after reviewing public vulnerabilities and failure modes across commercial and open-source browser agent extensions:
| Threat / Failure Mode | Root Cause in Typical Extensions | Mitigation in antigravity-tab-guard |
| Webpage Prompt/Command Injection (e.g. ShadowPrompt / ClaudeBleed) | Wildcard externally_connectable origins, injected content_scripts, or trusting message origin over sender context. | Zero content_scripts, zero externally_connectable, zero web_accessible_resources, and strict internal sender verification. |
| Local Bridge Hijacking (SSRF / CSWSH) | Listening on ws://127.0.0.1: without mutual authentication. | Zero network listeners and browser-enforced offline CSP (connect-src 'none'). |
| The "Lethal Trifecta" (Data Exfiltration) | Combining , scripting/debugger/cookies, and network access. | Zero host_permissions, no scripting/debugger/cookies permissions, and zero runtime npm dependencies. |
| MV3 Service Worker Idle Amnesia | Storing managed tab IDs only in volatile JS memory wiped after 30s idle. | Serialized async mutex backed by chrome.storage.session surviving worker suspension and restarts. |
| Saved Tab Groups Ghost Clutter | Calling tabs.remove directly causes Chrome Sync to archive closed groups onto the Bookmarks Bar. | Explicitly ungroups managed tabs right before removal so Chrome deletes the group cleanly. |