@heylemon/lemonade 0.2.6 → 0.2.8

package/dist/agents/system-prompt.js

@@ -175,7 +175,7 @@ export function buildAgentSystemPrompt(params) {
         web_search: "Search the web (Brave API)",
         web_fetch: "Fetch and extract readable content from a URL",
         // Channel docking: add login tools here when a channel needs interactive linking.
-        browser: "Control web browser",
+        browser: "Control Lemonade's dedicated browser (never the user's personal browser)",
         canvas: "Present/eval/snapshot the Canvas",
         nodes: "List/describe/notify/camera/screen on paired nodes",
         cron: "Manage cron jobs and wake events (use for reminders; when scheduling a reminder, write the systemEvent text as something that will read like a reminder when it fires, and mention that it is a reminder depending on the time gap between setting and firing; include recent context in reminder text if appropriate)",
@@ -317,7 +317,7 @@ export function buildAgentSystemPrompt(params) {
                 "- apply_patch: apply multi-file patches",
                 `- ${execToolName}: run shell commands (supports background via yieldMs/background)`,
                 `- ${processToolName}: manage background exec sessions`,
-                "- browser: control lemonade's dedicated browser",
+                "- browser: control Lemonade's dedicated browser (never the user's personal browser)",
                 "- canvas: present/eval/snapshot the Canvas",
                 "- nodes: list/describe/notify/camera/screen on paired nodes",
                 "- cron: manage cron jobs and wake events (use for reminders; when scheduling a reminder, write the systemEvent text as something that will read like a reminder when it fires, and mention that it is a reminder depending on the time gap between setting and firing; include recent context in reminder text if appropriate)",
@@ -341,25 +341,38 @@ export function buildAgentSystemPrompt(params) {
         "For screenshots of native macOS windows: use Peekaboo (`peekaboo image`) via exec if the skill is available.",
         "",
         "## URLs & Quick Open",
-        "When the user wants to *see* a page, video, or search result — open it in their browser. Don't over-automate simple requests.",
         "",
         "### Decision tree",
-        "1. User wants to *view* something (website, video, search results) → `open` the URL via exec.",
+        "1. Service has a `lemon-*` CLI tool (Gmail, Calendar, Drive, Docs, Sheets, Slides, Notion, Slack, YouTube) → **always use the CLI tool**. Never open these in a browser or via URI.",
         "2. User wants an *answer* from the web → use `web_search` (+ `web_fetch` if needed).",
-        "3. User wants to *interact* with a page (fill forms, click buttons, scrape data) → use the `browser` tool.",
-        "",
-        "### Opening URLs (macOS)",
-        "Use `exec` with the macOS `open` command to launch URLs in the user's default browser:",
-        '- `open "https://example.com"` — opens in default browser.',
-        '- `open -a "Google Chrome" "https://example.com"` — opens in a specific browser.',
-        'This is the fastest path for simple requests like "open YouTube" or "show me Amazon".',
-        "",
-        "### Common search/action URIs",
-        "Build the URL directly instead of navigating and typing into search boxes:",
+        "3. User wants to *interact* with a page (fill forms, click buttons, scrape data) → use Lemonade's dedicated `browser` tool.",
+        "4. User wants to *view* a general website (no CLI tool exists) → use Lemonade's dedicated `browser` tool to navigate there.",
+        "",
+        "### Integration CLI tools (always preferred)",
+        "For connected services, use the CLI — it's faster, already authenticated, and doesn't require a browser:",
+        "| Service | CLI tool | Example |",
+        "|---------|----------|---------|",
+        '| Gmail | `lemon-gmail` | `lemon-gmail search "from:boss subject:urgent"` |',
+        "| Calendar | `lemon-calendar` | `lemon-calendar list today` |",
+        '| Drive | `lemon-drive` | `lemon-drive search "quarterly report"` |',
+        '| Docs | `lemon-docs` | `lemon-docs create "Meeting Notes"` |',
+        '| Sheets | `lemon-sheets` | `lemon-sheets search "budget"` |',
+        '| Slides | `lemon-slides` | `lemon-slides search "deck"` |',
+        '| Notion | `lemon-notion` | `lemon-notion search "project plan"` |',
+        "| Slack | `lemon-slack` or `message` tool | `message channel:slack ...` |",
+        '| YouTube | `lemon-youtube` | `lemon-youtube search "tutorial"` |',
+        "**Never open** `mail.google.com`, `calendar.google.com`, `drive.google.com`, `docs.google.com`, `sheets.google.com`, `slides.google.com`, `notion.so`, `app.slack.com`, or `youtube.com` in any browser. Use the CLI.",
+        '**Creating documents:** Use `lemon-docs create "Title"`, `lemon-sheets create "Title"`, etc. Do NOT open `docs.new`, `sheets.new`, or any `.new` domain.',
+        "",
+        "### Browser tool (Lemonade's dedicated browser only)",
+        "For general websites without a CLI tool, use Lemonade's dedicated `browser` tool (Playwright-managed).",
+        '**Never open URLs in the user\'s personal browser.** Do not use `exec open "URL"`, `open -a "Google Chrome"`, or AppleScript to launch URLs. All web browsing goes through the `browser` tool with `profile="lemonade"`.',
+        "",
+        "### Common search/action URIs (via browser tool)",
+        "Use browser_navigate with these URLs for general web tasks (non-integration sites only):",
         "| Task | URI pattern |",
         "|------|------------|",
         "| Google search | `https://google.com/search?q={query}` |",
-        "| YouTube search | `https://youtube.com/results?search_query={query}` |",
         "| Google Maps search | `https://maps.google.com/maps?q={query}` |",
         "| Google Maps directions | `https://maps.google.com/maps/dir/{from}/{to}` |",
         "| Amazon search | `https://amazon.com/s?k={query}` |",
@@ -372,33 +385,13 @@ export function buildAgentSystemPrompt(params) {
         "| LinkedIn search | `https://linkedin.com/search/results/all/?keywords={query}` |",
         "URL-encode the query (`%20` for spaces or use `+`).",
         "",
-        "### Quick-create shortcuts (.new domains)",
-        "These instantly create a new document/resource in the user's browser:",
-        "| Task | URL |",
-        "|------|-----|",
-        "| New Google Doc | `https://docs.new` |",
-        "| New Google Sheet | `https://sheets.new` |",
-        "| New Google Slides | `https://slides.new` |",
-        "| New Google Form | `https://forms.new` |",
-        "| New Google Meet | `https://meet.new` |",
-        "| New Google Calendar event | `https://cal.new` |",
-        "| New Google Drawing | `https://drawings.new` |",
-        "| New Google Site | `https://sites.new` |",
-        "| New GitHub repo | `https://repo.new` |",
-        "| New GitHub gist | `https://gist.new` |",
-        "| New CodePen | `https://pen.new` |",
-        "| New Figma file | `https://figma.new` |",
-        "| New Notion page | `https://notion.new` |",
-        "| New Linear issue | `https://linear.new` |",
-        "These are faster than using CLI tools when the user just wants to open a blank document in their browser.",
-        "",
         "### Examples",
-        '- "search YouTube for funny cats" → `open "https://youtube.com/results?search_query=funny+cats"`',
-        '- "show me flights to Tokyo" → `open "https://google.com/travel/flights?q=flights+to+tokyo"`',
-        '- "open amazon" → `open "https://amazon.com"`',
-        '- "find Italian restaurants near me" → `open "https://maps.google.com/maps?q=italian+restaurants+near+me"`',
-        '- "create a new doc" → `open "https://docs.new"`',
-        '- "start a Google Meet" → `open "https://meet.new"`',
+        '- "search YouTube for funny cats" → `lemon-youtube search "funny cats"` (CLI, not browser)',
+        '- "show me flights to Tokyo" → `browser` navigate to `https://google.com/travel/flights?q=flights+to+tokyo`',
+        '- "open amazon" → `browser` navigate to `https://amazon.com`',
+        '- "find Italian restaurants near me" → `browser` navigate to `https://maps.google.com/maps?q=italian+restaurants+near+me`',
+        '- "create a new doc" → `lemon-docs create "Untitled"` (CLI, not browser)',
+        '- "check my email" → `lemon-gmail list` (CLI, not browser)',
         '- "what is the capital of France?" → use `web_search` (user wants the answer, not a page)',
         "",
         "## IDE & Coding Agent Control",

package/dist/agents/tools/browser-tool.js

@@ -143,8 +143,8 @@ export function createBrowserTool(opts) {
         label: "Browser",
         name: "browser",
         description: [
-            "Control the browser via Lemonade's browser control server (status/start/stop/profiles/tabs/open/snapshot/screenshot/actions).",
-            'Profiles: use profile="lemonade" (default, isolated Lemonade-managed browser) or profile="chrome" (user\'s Chrome browser tabs).',
+            "Control Lemonade's dedicated browser via the browser control server (status/start/stop/tabs/open/snapshot/screenshot/actions).",
+            "Always use profile=\"lemonade\" (Lemonade's dedicated, isolated browser). Never use the user's personal browser.",
             "NEVER ask the user to click any extension icon or toolbar button. Just use the browser tools directly — they auto-connect.",
             'When a node-hosted browser proxy is available, the tool may auto-route to it. Pin a node with node=<id|name> or target="node".',
             "When using refs from snapshot (e.g. e12), keep the same tab: prefer passing targetId from the snapshot response into subsequent actions (act/click/type/etc).",

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.2.6",
-  "commit": "80887609891b389ba300be9cfe0a533a54f2d4a9",
-  "builtAt": "2026-02-22T16:28:19.422Z"
+  "version": "0.2.8",
+  "commit": "6c4da878a64650fe76bb87fe50bb3f927e0803e4",
+  "builtAt": "2026-02-23T03:21:34.505Z"
 }

package/dist/canvas-host/a2ui/.bundle.hash

@@ -1 +1 @@
-6a2102ad373b5c2a8630cff043867bfb4dea9f4c9d5e6b87ac2817e328058b0f
+623501c2b7c89888f7ad88c7e32239e05753751e4d9b227608e441ee9bc813ca

package/dist/gateway/openai-http.js

@@ -49,7 +49,7 @@ function buildAgentPrompt(messagesUnknown) {
         if (!role || !content)
             continue;
         if (role === "system" || role === "developer") {
-            systemParts.push(content);
+            systemParts.push(`<client_instruction>\n${content}\n</client_instruction>`);
             continue;
         }
         const normalizedRole = role === "function" ? "tool" : role;

package/dist/gateway/openresponses-http.js

@@ -109,7 +109,7 @@ export function buildAgentPrompt(input) {
             if (!content)
                 continue;
             if (item.role === "system" || item.role === "developer") {
-                systemParts.push(content);
+                systemParts.push(`<client_instruction>\n${content}\n</client_instruction>`);
                 continue;
             }
             const normalizedRole = item.role === "assistant" ? "assistant" : "user";
@@ -288,11 +288,12 @@ export async function handleOpenResponsesHttpRequest(req, res, opts) {
                                 },
                                 limits: limits.files,
                             });
+                            const safeName = file.filename.replace(/[<>"&\n\r]/g, "_");
                             if (file.text?.trim()) {
-                                fileContexts.push(`<file name="${file.filename}">\n${file.text}\n</file>`);
+                                fileContexts.push(`<file name="${safeName}">\n${file.text}\n</file>`);
                             }
                             else if (file.images && file.images.length > 0) {
-                                fileContexts.push(`<file name="${file.filename}">[PDF content rendered to images]</file>`);
+                                fileContexts.push(`<file name="${safeName}">[PDF content rendered to images]</file>`);
                             }
                             if (file.images && file.images.length > 0) {
                                 images = images.concat(file.images);
@@ -332,9 +333,13 @@ export async function handleOpenResponsesHttpRequest(req, res, opts) {
     const prompt = buildAgentPrompt(payload.input);
     const fileContext = fileContexts.length > 0 ? fileContexts.join("\n\n") : undefined;
     const toolChoiceContext = toolChoicePrompt?.trim();
-    // Handle instructions + file context as extra system prompt
+    // Handle instructions + file context as extra system prompt.
+    // Client-supplied instructions are wrapped in tags to prevent prompt injection.
+    const wrappedInstructions = payload.instructions
+        ? `<client_instruction>\n${payload.instructions}\n</client_instruction>`
+        : undefined;
     const extraSystemPrompt = [
-        payload.instructions,
+        wrappedInstructions,
         prompt.extraSystemPrompt,
         toolChoiceContext,
         fileContext,

package/dist/gateway/skills-http.js

@@ -57,7 +57,19 @@ export async function handleSkillsHttpRequest(req, res, opts) {
         .replace(/^\/api\/skills\/?/, "")
         .split("/")
         .filter(Boolean);
-    const skillName = pathParts[0] ? decodeURIComponent(pathParts[0]) : undefined;
+    const rawSkillName = pathParts[0] ? decodeURIComponent(pathParts[0]) : undefined;
+    // Validate skill name to prevent path traversal
+    const SAFE_SKILL_NAME_RE = /^[a-z0-9][a-z0-9_-]*$/;
+    const skillName = rawSkillName && SAFE_SKILL_NAME_RE.test(rawSkillName) ? rawSkillName : undefined;
+    if (rawSkillName && !skillName) {
+        sendJson(res, 400, {
+            error: {
+                message: "Invalid skill name. Use only lowercase letters, numbers, hyphens, and underscores.",
+                type: "invalid_request_error",
+            },
+        });
+        return true;
+    }
     try {
         if (!skillName) {
             // /api/skills
@@ -85,8 +97,9 @@ export async function handleSkillsHttpRequest(req, res, opts) {
         }
     }
     catch (err) {
+        console.error("[skills-http] Internal error:", err);
         sendJson(res, 500, {
-            error: { message: String(err), type: "internal_error" },
+            error: { message: "An internal error occurred", type: "internal_error" },
         });
         return true;
     }

package/docs/IntegrationAndBrowserRules.md

@@ -2,26 +2,27 @@
 
 Reference for the agent: when to use integrations vs browser, and how to avoid invalid IDs or wrong tools.
 
-## Browser mode (dedicated vs user's browser)
+## Browser mode (dedicated browser only)
 
-Your system prompt may include **{{BROWSER_INSTRUCTIONS}}** — follow them.
+Lemonade uses its own dedicated browser (Playwright-managed, separate from the user's personal browser). **Never open URLs in the user's personal browser.**
 
-- **Dedicated browser mode:** You have a dedicated browser (separate from the user's). Use **only** the browser_* tools (browser_navigate, browser_click, browser_type, browser_snapshot, etc.). Do **not** use `open -a "Google Chrome"` or any shell command to open URLs. Do **not** use AppleScript to open URLs. The browser_* tools control the dedicated browser; nothing else does.
-- **User's browser mode:** The user has granted control of their browser (e.g. Google Chrome, Brave). Use that browser for web tasks: AppleScript `tell application "BrowserName"` or shell `open -a "BrowserName" "URL"` to open URLs. The browser_* tools also control that same browser. Always use the browser name given in your prompt (e.g. "Google Chrome", "Brave Browser").
+- Use **only** the browser_* tools (browser_navigate, browser_click, browser_type, browser_snapshot, etc.) for all web browsing.
+- Do **not** use `open "URL"`, `open -a "Google Chrome"`, or any shell/AppleScript command to open URLs in the user's browser.
+- Always use `profile="lemonade"` (the default, isolated Lemonade-managed browser).
 
-## Browser profiles for connected services
+## Browser profiles
 
-When browser automation is needed for a service the user has connected via OAuth (Gmail, Calendar, Notion, etc.), prefer the `chrome` profile — it uses the user's real Chrome browser, which is already logged into their services. Use `profile="chrome"` in browser tool calls. Only fall back to `profile="lemonade"` if Chrome isn't available. The `lemonade` profile also caches sessions: when a new integration is connected, the service URL is automatically opened there.
+- **`lemonade` profile** (default, always use): Lemonade's dedicated Playwright browser. Isolated from the user's personal browsing. Session cookies persist between uses.
+- Do **not** use `profile="chrome"`. The user's personal browser should never be accessed or controlled by Lemonade.
 
-## Direct URI actions (no integration needed)
+## General web browsing (via dedicated browser)
 
-Many common actions can be done instantly with direct URLs — no Composio integration required. Use these before falling back to an integration or browser automation.
+For sites without a `lemon-*` CLI, use the `browser` tool to navigate. Never use `exec open` or the user's personal browser.
 
-**Search:**
+**Search URIs (via browser_navigate):**
 | Service | URL pattern |
 |---------|-------------|
 | Google | `https://www.google.com/search?q=QUERY` |
-| YouTube | `https://www.youtube.com/results?search_query=QUERY` |
 | Amazon | `https://www.amazon.com/s?k=QUERY` |
 | Wikipedia | `https://en.wikipedia.org/wiki/Special:Search/QUERY` |
 | Google Maps | `https://www.google.com/maps/search/QUERY` |
@@ -32,16 +33,15 @@ Many common actions can be done instantly with direct URLs — no Composio integ
 | Twitter/X | `https://x.com/search?q=QUERY` |
 | LinkedIn | `https://www.linkedin.com/search/results/all/?keywords=QUERY` |
 
-**Open directly (no search needed):**
-| Action | URL |
-|--------|-----|
-| YouTube video | `https://www.youtube.com/watch?v=VIDEO_ID` |
-| Google Doc | `https://docs.google.com/document/d/DOC_ID` |
-| Google Sheet | `https://docs.google.com/spreadsheets/d/SHEET_ID` |
-| Notion page | `https://notion.so/PAGE_ID` |
-| GitHub repo | `https://github.com/OWNER/REPO` |
+**Do NOT use browser for these — use CLI tools instead:**
+| Service | Use CLI instead |
+|---------|----------------|
+| YouTube search | `lemon-youtube search QUERY` |
+| Google Doc | `lemon-docs` CLI |
+| Google Sheet | `lemon-sheets` CLI |
+| Notion page | `lemon-notion` CLI |
 
-**macOS apps via URI:**
+**macOS native apps via URI (exec open is OK for native apps, not web):**
 | App | Example |
 |-----|---------|
 | Apple Maps | `maps://?q=QUERY` |
@@ -49,12 +49,12 @@ Many common actions can be done instantly with direct URLs — no Composio integ
 | FaceTime | `facetime://PHONE_OR_EMAIL` |
 | Messages | `imessage://PHONE_OR_EMAIL` |
 
-URL-encode spaces as `%20` in query parameters. Use the `exec` tool with `open "URL"` on macOS to open these in the default browser or app. For actions like "search Amazon for headphones" or "find this on YouTube", just construct the URL and open it — don't ask the user to connect an integration.
+URL-encode spaces as `%20` in query parameters. Native macOS app URIs (`maps://`, `music://`, `imessage://`, `facetime://`) can use `exec open` since they open native apps, not web browsers.
 
 ## Browser vs integrations
 
 - **Always use CLI/integration tools** for: Gmail, Google Calendar, Google Drive, Google Docs, Google Sheets, Notion, Slack, YouTube. The CLI is faster, already authenticated, and more reliable.
-- **Browser fallback is ONLY for when the CLI tool itself is broken:** binary not found, "command not found", connection refused, service genuinely not connected. These are infrastructure failures.
+- **Browser fallback is ONLY for when the CLI tool itself is broken:** binary not found, "command not found", connection refused, service genuinely not connected. These are infrastructure failures. When falling back, use Lemonade's dedicated browser (`profile="lemonade"`), never the user's personal browser.
 - **Browser fallback is NOT for when a CLI operation returns no results:** "user not found", "file not found", "channel not found", empty search results. These are normal outcomes — retry with different input, list available items, or ask the user for clarification.
 - If an integration is **not** connected: offer the connect link (`lemon://connect?provider=<id>`) so the user can connect with one tap. **Do not run** `open "lemon://connect?..."` in the terminal — the Lemon app opens the connection page when it sees the URL in your reply.
 
@@ -108,25 +108,25 @@ This searches AND plays the top result in one atomic command. URL-encode spaces
 
 - Use `lemon-notion` CLI when Notion is connected.
 - For creating or updating content, always resolve parent page or database via search; never guess UUIDs.
-- If not connected, offer `lemon://connect?provider=notion`; fall back to browser if needed.
+- If not connected, offer `lemon://connect?provider=notion`. If CLI is broken, fall back to Lemonade's dedicated browser (`profile="lemonade"`).
 
 ## Gmail
 
 - Use `lemon-gmail` CLI when Gmail is connected.
 - Use message/thread IDs from search or list only.
-- If not connected, offer `lemon://connect?provider=gmail`; fall back to browser if needed.
+- If not connected, offer `lemon://connect?provider=gmail`. If CLI is broken, fall back to Lemonade's dedicated browser (`profile="lemonade"`).
 
 ## Google Calendar
 
 - Use `lemon-calendar` CLI when Calendar is connected.
 - Get `calendarId` and `eventId` from list/search or user; never generate them.
-- If not connected, offer `lemon://connect?provider=googlecalendar`; fall back to browser if needed.
+- If not connected, offer `lemon://connect?provider=googlecalendar`. If CLI is broken, fall back to Lemonade's dedicated browser (`profile="lemonade"`).
 
 ## Google Drive / Docs / Sheets
 
 - Use `lemon-drive`, `lemon-docs`, `lemon-sheets`, `lemon-slides` CLIs when connected.
 - Get file/document/sheet IDs from list/search or from the user (e.g. from a Drive/Docs/Sheets URL); never generate IDs.
-- If not connected, offer the appropriate `lemon://connect?provider=googledrive` (or googledocs, googlesheets); fall back to browser if needed.
+- If not connected, offer the appropriate `lemon://connect?provider=googledrive` (or googledocs, googlesheets). If CLI is broken, fall back to Lemonade's dedicated browser (`profile="lemonade"`).
 
 ## Slack
 
@@ -136,7 +136,7 @@ This searches AND plays the top result in one atomic command. URL-encode spaces
 
 ## YouTube
 
-- Use `lemon-youtube` CLI when YouTube is connected. Prefer the CLI over browser for YouTube tasks (search, transcript, video info).
+- Use `lemon-youtube` CLI when YouTube is connected. Always use the CLI for YouTube tasks (search, transcript, video info).
 - Available commands:
   - `lemon-youtube search <query> [max_results]` — Search videos
   - `lemon-youtube info <url_or_id>` — Get video details (title, description, stats)
@@ -144,7 +144,7 @@ This searches AND plays the top result in one atomic command. URL-encode spaces
   - `lemon-youtube channel info <channel_id>` — Channel statistics
   - `lemon-youtube channel videos <channel_id> [max]` — List channel videos
   - `lemon-youtube status` — Check connection
-- If not connected, offer `lemon://connect?provider=youtube`; fall back to browser if needed.
+- If not connected, offer `lemon://connect?provider=youtube`. If CLI is broken, fall back to Lemonade's dedicated browser (`profile="lemonade"`).
 
 ## Media apps (Spotify, Apple Music)
 
@@ -171,15 +171,17 @@ Open System Settings panes via **URI only** — do not instruct the user to clic
 
 ## Summary table
 
-| Service       | Prefer                    | Fallback                      | IDs |
-|---------------|---------------------------|-------------------------------|-----|
-| Gmail         | `lemon-gmail` CLI         | Browser automation            | From search/list only |
-| Calendar      | `lemon-calendar` CLI      | Browser automation            | From list/search or user |
-| Drive         | `lemon-drive` CLI         | Browser automation            | From list/search or user |
-| Docs          | `lemon-docs` CLI          | Browser automation            | From list/search or user |
-| Sheets        | `lemon-sheets` CLI        | Browser automation            | From list/search or user |
-| Notion        | `lemon-notion` CLI        | Browser automation            | From NOTION_SEARCH only |
-| Slack         | `lemon-slack` CLI         | **NEVER** (CLI only)          | From API/context only |
-| YouTube       | `lemon-youtube` CLI       | Browser automation            | From search/list only |
-| Spotify       | AppleScript ONLY          | —                             | N/A (search by name) |
-| Other sites   | Browser                   | —                             | N/A |
+| Service       | Prefer                    | Fallback (CLI broken only)            | IDs |
+|---------------|---------------------------|---------------------------------------|-----|
+| Gmail         | `lemon-gmail` CLI         | Dedicated browser (`lemonade` profile)| From search/list only |
+| Calendar      | `lemon-calendar` CLI      | Dedicated browser (`lemonade` profile)| From list/search or user |
+| Drive         | `lemon-drive` CLI         | Dedicated browser (`lemonade` profile)| From list/search or user |
+| Docs          | `lemon-docs` CLI          | Dedicated browser (`lemonade` profile)| From list/search or user |
+| Sheets        | `lemon-sheets` CLI        | Dedicated browser (`lemonade` profile)| From list/search or user |
+| Notion        | `lemon-notion` CLI        | Dedicated browser (`lemonade` profile)| From NOTION_SEARCH only |
+| Slack         | `lemon-slack` CLI         | **NEVER** (CLI only)                  | From API/context only |
+| YouTube       | `lemon-youtube` CLI       | Dedicated browser (`lemonade` profile)| From search/list only |
+| Spotify       | AppleScript ONLY          | —                                     | N/A (search by name) |
+| Other sites   | Dedicated browser         | —                                     | N/A |
+
+**Important:** Never use the user's personal browser. All browser fallbacks use Lemonade's dedicated browser with `profile="lemonade"`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heylemon/lemonade",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "AI gateway CLI for Lemon - local AI assistant with integrations",
   "publishConfig": {
     "access": "restricted"

package/skills/browser/SKILL.md

@@ -53,21 +53,15 @@ Before using browser for any of these services, **use the `lemon-*` CLI tool ins
 | `browser_snapshot` | Get page content/structure |
 | `browser_scroll` | Scroll the page |
 
-## Browser Profiles
+## Browser Profile
 
-When a service is connected via OAuth (Gmail, Calendar, Notion, etc.), prefer `profile="chrome"` to leverage existing logged-in sessions in the user's actual Chrome browser.
+Always use `profile="lemonade"` (the default). This is Lemonade's dedicated Playwright browser, isolated from the user's personal browser. Session cookies persist between uses. When a new integration is connected, the service URL is automatically opened here so future visits may be authenticated.
 
-- **`chrome` profile** (preferred for connected services): Uses the user's real Chrome browser. Already logged into services the user normally uses. Use this when performing browser actions on Gmail, Calendar, Notion, LinkedIn, etc.
-- **`lemonade` profile** (isolated): Dedicated Playwright browser. Session cookies persist between uses. When a new integration is connected, the service URL is automatically opened here so future visits may be authenticated.
+**Never use `profile="chrome"` or access the user's personal browser.** All web browsing is done through Lemonade's dedicated browser only.
 
-**Rule:** When the browser is needed for a service the user has connected (e.g. Gmail, Notion), always try `profile="chrome"` first. Only fall back to `profile="lemonade"` if Chrome is not available.
+## Dedicated browser only
 
-## Dedicated vs user's browser
-
-Your system prompt ({{BROWSER_INSTRUCTIONS}}) tells you which mode you're in:
-
-- **Dedicated browser:** Use **only** browser_* tools for web tasks. Do **not** use `open -a "Google Chrome"` or AppleScript to open URLs — the dedicated browser is controlled only via browser_* tools.
-- **User's browser (e.g. Chrome, Brave):** Use the named browser for opening URLs (`open -a "BrowserName" "URL"` or AppleScript `tell application "BrowserName"`). browser_* tools control that same browser.
+Lemonade always uses its own dedicated browser. Do **not** use `open -a "Google Chrome"`, `open "URL"`, or AppleScript to open URLs in the user's personal browser. The dedicated browser is controlled only via browser_* tools.
 
 ## ⚠️ IMPORTANT: No Clicking Required ⚠️