Problem. The assistant panel connects the browser automatically whenever the user can chat with an agent and a website is open (paused starts false). Whether the tool is on is decided by the agent's owner. The grant follows the user from site to site because it is keyed on the webview, not the website. Anyone running an agent or agent server the user chats with can read and act in the user's signed-in sites.

Fix.

Default to disconnected. The panel asks "Allow <agent> on <server host> to read and act on <website>?".

The grant is scoped to one session, one server, and a set of approved origins. The main process refuses commands when the page's origin is not approved.

When the page moves to a new origin, the panel asks again.

Only offer browser access for agents the user owns.

Branch: feat/integrated-browser