The browser inside the window
The thing the agent is building and the agent itself are one click apart.
Click an element, and the agent gets a selector
Turn on inspect, click something on the page, and the app works out how to name that one thing to the agent — the exact way developers name a button or a field in code, so there is no ambiguity about which one you meant. It picks the most stable name available: the one somebody put there on purpose for tests, or the element’s own unique name, and only failing both of those, where it sits on the page. That goes into the session you are working in, along with the words on it and the address of the page, without you typing anything.
The page itself is never trusted. A web page can say anything about itself, so the part of the app that is inside the page only reports plain facts, and every decision — what is a safe name, what has to be made harmless, what is allowed to reach a terminal at all — is made outside it, against a fixed list of things that are allowed. Nothing a page invents can get through.
Your own sites, at any screen size
It finds the sites you are actually running on this machine rather than guessing at the usual address. Device presets and zoom are there for checking a layout, screenshots are one click, and a flow recorder turns what you did on the page into steps you can hand to the agent.
Being signed in to something survives closing the app, tabs can be kept separate from each other, and if the site you are building sits behind a Google sign-in you can bring your sign-in across from Chrome instead of doing it twice.
An agent can drive the page, and hand it back
When the agent clicks something, it does what a careful person does: find the thing, check it is actually on screen, wait until it has stopped moving, make sure nothing is sitting on top of it, and only then click. It never decides what to click by looking at a picture of the page — screenshots are there to show you what happened, not to guess from.
There is one page and the two of you take turns on it. The moment you interact with the page yourself, the agent’s next command is refused — and while you hold it, every command is refused, reads included. That is deliberate and it is the whole reason the rule is not limited to clicks and typing: a screenshot taken while you are entering a password is the leak, and you cannot redact what was never produced.