Multiple agents running agent-browser appear to hijack each other

[seannetlife]

I was running multiple agents that triggered agent-browser. I then saw error logs in one referencing the site I expected another agent to be visiting.

Performed this multiple times to confirm that it is the case.

Is there a config/flag to help avoid this?

[amannhq]

@ctate
I would like work on this.

This is how the current flow is woking:

  Agent A (Rust CLI)                      Agent B (Rust CLI)
       |                                       |
       |  connect("default")                   |  connect("default")
       v                                       v
  ~/.agent-browser/default.sock  <------>  same socket
       |
       v
  Node.js Daemon Process  (one per session name)
       |
       v
  BrowserManager instance  (singleton within daemon)
       |
       +-- browser: Browser | null
       +-- contexts: BrowserContext[]
       +-- pages: Page[]                    <-- shared flat array
       +-- activePageIndex: number          <-- SINGLE global cursor
       +-- activeFrame: Frame | null        <-- SINGLE global frame
       +-- consoleMessages: ConsoleMessage[] <-- shared log sink
       +-- pageErrors: PageError[]          <-- shared error sink
       +-- refMap: RefMap                   <-- shared snapshot refs
       +-- trackedRequests: TrackedRequest[] <-- shared request log

The Rust CLI (cli/src/connection.rs) spawns one Node.js daemon
per session name. The daemon (src/daemon.ts) creates one BrowserManager
instance. Every socket connection to that daemon shares the same manager.

Each session name maps to exactly one Unix socket. The default session name is
"default" (cli/src/flags.rs, line 55):

session: env::var("AGENT_BROWSER_SESSION").unwrap_or_else(|_| "default".to_string()),

CLI Side: Daemon Startup

File: cli/src/connection.rs, lines 207-235

pub fn ensure_daemon(session: &str, ...) -> Result<DaemonResult, String> {
    // Check if daemon is running AND responsive
    if is_daemon_running(session) && daemon_ready(session) {
        thread::sleep(Duration::from_millis(150));
        if daemon_ready(session) {
            return Ok(DaemonResult { already_running: true });  // REUSE existing daemon
        }
    }
    // ... spawn new daemon ...
}

When a second agent calls agent-browser with the same session name (or no
--session flag, defaulting to "default"), ensure_daemon finds the existing
daemon already running and returns already_running: true. Both agents now talk
to the same daemon process through the same socket file.

3.3 Daemon Side: Single Manager, Multiple Sockets

File: src/daemon.ts, line 300

const manager: Manager = isIOS ? new IOSManager() : new BrowserManager();

One BrowserManager is instantiated per daemon. Then on line 320:

const server = net.createServer((socket) => {
    // ...
    const response = await executeCommand(parseResult.command, manager as BrowserManager);
    // ...
});

Every incoming socket connection executes commands against the same manager
reference. There is no per-connection state, no connection ID, no isolation
of any kind within a daemon.

---

I tried with two agents on the same session share activePageIndex.
A navigate from Agent B overwrites Agent A's page.

# Kill any existing daemons, clean slate
pkill -f "node.*daemon.js" 2>/dev/null; sleep 1
rm -f ~/.agent-browser/*.sock ~/.agent-browser/*.pid 2>/dev/null

# Agent A opens example.com (no --session flag, defaults to "default")
./bin/agent-browser-darwin-arm64 open https://example.com --json
# => {"success":true,"data":{"title":"Example Domain","url":"https://example.com/"}}

# Verify Agent A's page
./bin/agent-browser-darwin-arm64 get url --json
# => {"success":true,"data":{"url":"https://example.com/"}}

# Agent B opens httpbin.org (SAME default session, SAME daemon, SAME BrowserManager)
./bin/agent-browser-darwin-arm64 open https://httpbin.org/html --json
# => {"success":true,"data":{"title":"","url":"https://httpbin.org/html"}}

# Agent A checks URL again -- expects example.com
./bin/agent-browser-darwin-arm64 get url --json
# => {"success":true,"data":{"url":"https://httpbin.org/html"}}
#    ^^^ WRONG. Agent A's page was replaced.

Actual output on 2026-02-15 (v0.10.0, local build):

[Agent A] Opening example.com...
{"success":true,"data":{"title":"Example Domain","url":"https://example.com/"},"error":null}

[Agent A] Checking URL:
{"success":true,"data":{"url":"https://example.com/"},"error":null}

[Agent B] Opening httpbin.org on SAME default session...
{"success":true,"data":{"title":"","url":"https://httpbin.org/html"},"error":null}

[Agent A] Checking URL again (SHOULD be example.com, but...):
{"success":true,"data":{"url":"https://httpbin.org/html"},"error":null}

>>> RESULT: Agent A's page was overwritten by Agent B.
>>> Both share activePageIndex=0, navigate() replaced the page.

Why it happens: Both calls use getPage() which returns
this.pages[this.activePageIndex] (line 254). Since there is one page and
activePageIndex is 0, Agent B's navigate replaces the same Page object
that Agent A was using.

---

Console messages and errors from ALL pages in a session
accumulate in a single shared array. Agent A sees Agent B's logs.

# Start fresh
./bin/agent-browser-darwin-arm64 close 2>/dev/null; sleep 1

# Agent A opens example.com and writes to console
./bin/agent-browser-darwin-arm64 open https://example.com --json
./bin/agent-browser-darwin-arm64 eval \
  'console.log("AGENT_A_SECRET_LOG"); console.error("AGENT_A_ERROR_ON_EXAMPLE_DOT_COM")' --json

# Agent B opens httpbin in a new tab (same session!) and writes to console
./bin/agent-browser-darwin-arm64 tab new --json
./bin/agent-browser-darwin-arm64 navigate https://httpbin.org/html --json
./bin/agent-browser-darwin-arm64 eval \
  'console.log("AGENT_B_LOG_ON_HTTPBIN"); console.error("AGENT_B_ERROR_ON_HTTPBIN")' --json

# Agent A requests console messages
./bin/agent-browser-darwin-arm64 console --json

Actual output on 2026-02-15 (v0.10.0, local build):

[Agent A] Requesting console messages (should only see own, but...):
  [log] AGENT_A_SECRET_LOG
  [error] AGENT_A_ERROR_ON_EXAMPLE_DOT_COM
  [log] AGENT_B_LOG_ON_HTTPBIN
  [error] AGENT_B_ERROR_ON_HTTPBIN
  Total messages: 4

>>> RESULT: Agent A sees Agent B's logs from httpbin.org.

The issue is a design problem, not a bug in any single
function. The daemon was built for single client use but accepts multiple socket
connections. Every piece of mutable state in BrowserManager is session global
with no per-connection partitioning and I think we should isolate this processes properly.

The workaround (--session <unique-name>) provides complete isolation today by
forcing separate daemon processes. The long term fix requires either automatic
session derivation (so agents never accidentally share) or per connection state
tracking within the daemon.

[seannetlife]

awesome, thank you @amannhq

i'll utilise the new session flag capability in the interim

💜

[amannhq]

@ctate I will be raising a PR on this soon.

[kanoliban]

Hit this exact issue — single user, single Chrome, single agent. The agent uses agent-browser --cdp to connect to my real Chrome via DevToolsActivePort. When I open a new tab or switch profiles while the agent is working, open <url> navigates my active tab instead of staying in its own.

Workaround: Wrote a wrapper that creates a dedicated agent tab on first invocation and tab <N> switches back to it before every command. Tracks the tab index in /tmp/agent-chrome-tab-{port}. Works but fragile — index shifts if tabs are closed externally (exactly what #892 fixes with stable IDs).

What would solve this upstream: PR #892's --tab <id> with stable IDs is the right fix. Being able to do agent-browser --tab <id> open <url> and have it target that tab without switching the active tab (PR #883) would eliminate the problem entirely.

Would happily drop the wrapper once either PR lands.