# Zyquo Atlas — AI Browser Research (Phase 0.A) Compiled 2026-07-30 from several intensive web-research sessions across the current AI-browser landscape, page-extraction techniques, AI-UX patterns, streaming engineering, and browser-AI security. This document is the **design contract for every AI feature** in Phases 3 and 6 — each feature below traces to a pattern documented here. Sources are cited inline; where a claim rested only on low-quality SEO content it is marked *[unverified]*. --- ## 0. Category state (July 2026) and what it means for Atlas Three facts shape the design: 1. **The AI-sidebar-only browser is not a business.** Arc went to maintenance mode (May 2025; The Browser Company acquired by Atlassian, Oct 2025). OpenAI is **shutting down ChatGPT Atlas on 2026-08-09**, concluding "the browser is a feature, not the destination." SigmaOS — a native SwiftUI+WebKit browser, *exactly Atlas's stack* — is effectively abandoned. → **The browser must be excellent as a browser first** (Atlas's Phase 2 gate is correct); AI is a multiplier, not the product. (Engadget, TechCrunch 2026-07-09, r/macapps.) 2. **Indirect prompt injection is the unsolved, category-defining security problem.** Brave demonstrated exploits in Comet (twice), Opera Neon, and Fellou; a plain "summarize this page" click exfiltrated a user's email + OTP in Comet. On-device models do **not** fix it. → **Atlas is read-oriented, not agentic** — a defensible, safer position — but even read-only AI is exploitable (§7). (brave.com/blog: comet-prompt-injection, unseeable-prompt-injections, prompt-injection-flaw-opera-neon, indirect-prompt-injection.) 3. **Agentic is where vendors went; grounded reading is where users get value.** Every agent-mode review reports impressive demos, unreliable multi-step execution, and heavy fallback to the reliable features (summarize, chat-with-page, compare tabs). → **Atlas invests in reliable reading tools + massive customization + BYO-key model choice**, the three gaps left by the failed/paywalled incumbents. **Naming note:** OpenAI's retiring product was also "Atlas." Zyquo Atlas docs disambiguate as *Zyquo Atlas* throughout (never "Atlas" alone in user-facing text). --- ## 1. Landscape — functional patterns per product ### Arc / Arc Max (The Browser Company) — "AI as small, keystroke-invoked utilities" The most important reference: AI as invisible utilities, each one interaction with a shortcut, output where you already are. - **Ask on Page:** hold **⌘F** — the find bar becomes an ask box; answer inline. Overloads an existing muscle-memory shortcut ("find" and "ask about this page" are the same intent at different fidelities). **Adopt.** - **5-Second Previews:** hover a link (Shift+hover off search pages) → floating popover summarizing the *destination* page. - **Tidy Tab Titles / Tidy Downloads / Tidy Tabs:** zero-UI AI applied to chores; users don't perceive it as "AI." Tidy Tabs only touches ephemeral tabs, never pinned. - **Failure evidence to engineer against:** "Ask on Page told me it encountered an error 3 of 4 times"; "5-second previews don't give much beyond the page title." → **Extraction fragility is the #1 cause of perceived AI failure.** (Arc Max help; HN 37753840.) ### Dia (Browser Company/Atlassian) — "the URL bar is the chat box" - **Intent-detecting address bar:** classifies input as navigate / search / ask, "mostly based on length and syntax." Documented failure: "sometimes I'm trying to google something and get thrown into an AI chat against my intention." Keyboard overrides: Ctrl+⌘+Return forces chat, Shift+⌘+Return forces search. - **Skills:** saved prompts invoked by **`/shortcut`** in chat, created via a Natural-Language Skill Builder, shared in a public gallery. One power user built 50+ (`/summary`, `/research`, `/newsletter`…). **Strongest signal in the landscape that user-authored slash-prompts are the killer feature — and it's cheap.** - **Chat-with-all-tabs** via `@tabname` / `@history` mentions (mentioned tabs render as a stacked pile); **Quick Insert** pushes AI output into the current field. - **Regressions users resent:** no fuzzy ⌘T command bar (replaced by chat), no Spaces, no Boosts. "Power users miss the keyboard launcher more than the sidebar." → **Ship the palette AND the ask, not one replacing the other.** (miskakyto.fi; SupaSidebar; TechCrunch.) ### Perplexity Comet — the agentic sidebar, most-tested, most-exploited - **Assistant sidebar** (⌘A); **one-click page summary** (icon next to Assistant); **@tab** cross-tab context; agentic tasks with **blue frames on pages it touches** and a visible step list. - **Failure evidence:** `@tab` targeting "inconsistent or a bit buggy" (→ use a picker with chips, not fuzzy text); the agent "only analyzed the snippet, not the full page, so it missed the deeper answer" and a reviewer asked for "**a visible list of the pages it reviewed**" (→ Atlas's citation requirement); long agent chains "often fail halfway." - **Security:** the canonical exploit — "summarize this page" fed page content to the LLM **without distinguishing user instructions from untrusted content**; hidden Reddit-comment instructions exfiltrated email + OTP with no further input. (cybernews; brave.com/blog.) ### Brave Leo — the privacy-first, BYO-model reference (closest sibling to Atlas) Study hardest; its stance maps onto Atlas's constraints almost exactly. - Sidebar + full-page + address-bar; **no account, no login**; reads pages, **PDFs, Google Docs/Sheets, YouTube transcripts, images**. - **Skills (best-documented `/`-command design):** type `/` → **New** → fields for **model + shortcut + prompt** (per-skill model binding); or **"Save as skill"** from a good answer's `…` menu (creation-from-success). Built-ins `/summarize` `/explain` `/improve`. **Adopt this creation flow verbatim.** - **Model catalog + BYOM:** free & premium model tiers, "Automatic" routing default, default at `brave://settings/leo-ai`, and **connect local models via Ollama or your own API endpoint** — "rare among browser-native AI tools." - **Privacy gold standard:** no chats/context/logs in the cloud, no training, account-free; reverse proxy strips IP. - **Agentic (opt-in, off by default):** isolated profile; a **second alignment-checker model firewalled from page content**; all agent work in a visible tab; memory writes shown and undoable; **explicitly rejects per-site permission prompts** ("low-signal repeated prompts train users to ignore warnings"). → **Don't build a nag-wall.** (Brave help; brave.com/blog/ai-browsing, leo-skills.) ### Microsoft Edge Copilot Mode — "whole-browser AI toggle" + granular consent - **One toggle** switches the whole browser into/out of Copilot Mode (visible chrome change). - **Unified new-tab box** (chat+search+navigate); **multi-tab context** with permission; **Actions** (agentic, opt-in, US-only); **Journeys** (past browsing auto-grouped into topical "storylines" as new-tab cards — reviewers' most-liked feature). - **Best-documented consent model:** Edge **classifies each query** as needing page context or not; non-contextual queries send only query + URL + title + history; contextual queries prompt for **active-tab** access. → **Adopt the query-classifier privacy architecture.** (Edge blog 2025-07-28, 2025-10-23; Microsoft Q&A.) ### Opera (Aria → Opera AI) & Neon - **Aria command line ⌘/** (ask without leaving the page); explicit **Page-Context mode**; NL tab commands. - **The Aria→Opera AI rebuild is instructive:** moved access from left sidebar to a top-right button, from overlay-on-content to a **side panel**; made it **context-aware by default** with a per-chat revoke toggle; **retired the Command Line and Compose mode** because "a context-aware chat subsumes them." → **Don't build Compose as a separate surface.** Also ships **answer→image snapshot to clipboard** and **AI wallpaper generation** (relevant to Atlas theming). Neon ($20/mo) is agentic (Neon Do, composable Cards) — and was prompt-injection-exploited via an `opacity:0` element. (blogs.opera.com migration post; brave.com/blog/prompt-injection-flaw-opera-neon.) ### SigmaOS — same stack (SwiftUI+WebKit), a cautionary tale - Native SwiftUI on WebKit; Airis gave **structured summaries + key points + follow-up Q&A** and early model choice (GPT-4o/Perplexity/Claude). - **Why it died for users:** removed traditional bookmarks and **broke redirect-based SSO** for every institutional workflow ("bookmarks are deferred execution triggers for auth flows"); limited extensions; no security updates. → **Atlas must-dos:** keep plain bookmarks that store+navigate a URL verbatim; **Phase-7-test redirect SSO/OAuth on WKWebView** (Okta/SAML/Google/Entra/library proxies); natively cover top extension jobs (ad/tracker block, autofill, reader, per-site CSS); rely on WKWebView inheriting Safari's security cadence. (sigmaos.com; Product Hunt reviews; r/macapps.) ### Chrome — Gemini in Chrome + built-in on-device APIs - **Best multi-tab UX:** current tab shared by default (toggleable); **add up to 10 more via a picker or `@`-mention with fuzzy search**; checkmarks in the picker; **a tab whose content is in use shows a "glowing underline" on the tab itself** — the best "content leaving device" indicator in the industry. **Adopt the on-the-tab indicator.** - **Ask-AI-about-history** ("the site with the walnut desk"); **Skills** (save+reuse multi-tab prompt workflows); **select-from-screen** prompting (compare two selected products); menu-bar/global invoke with a configurable shortcut; **auto-browse** with a well-specified confirm/take-over safety taxonomy. - **Built-in on-device APIs (Gemini Nano):** Translator/Language-Detector/**Summarizer** stable; Writer/Rewriter/Proofreader/Prompt in trial. → The **task taxonomy** Google settled on — *summarize, translate, detect-language, write, rewrite, proofread* — is the right set of primitive `AIActions` for a browser. A local tier (Apple Foundation Models / MLX / Ollama) is a legitimate *future* option for hover-summaries. (Google blog; developer.chrome.com/docs/ai; Chrome at I/O 2026.) ### ChatGPT Atlas (retiring 2026-08-09) — most feature-complete; best primary docs - **Two writing surfaces, sharply distinguished** (adopt the framing verbatim): *"The sidebar is for bigger questions and page-level context. Inline editing is for precise small improvements to the text you're actively typing."* Inline: highlight in a field → click the logo → ask → **replace in place** (Insert fallback). - **Selection implicitly joins chat context** ("highlight a paragraph and Atlas includes it automatically"); **Saved Prompts** recalled via `@` / bookmarks bar; **semantic ⌘F** ("no exact match → find similar"); **per-site visibility toggle in the address bar** ("when off, ChatGPT can't view page content"); **Agent Mode capability sandbox** (no code execution, no filesystem, no passwords/autofill, pages not added to history, logged-out mode, isolated clipboard). - **Criticisms to design against:** the "anti-web browser" critique (AI content substituted for real links — "zero links to Taylor Swift's actual website") → **AI answers must be additive to prominent, plural, clickable real sources**; "tainted memories" CSRF made memory a persistent injection sink → **memory writes visible + undoable**; keyboard/ customization poverty → **precisely the gap Atlas fills.** (OpenAI release notes; Wikipedia.) ### Others Claude in Chrome/Cowork (extension; two permission modes + site-level grants); Fellou (**plan-preview-before-execute** — best agentic-transparency idea); Zen/Orion/Vivaldi/Brave as Arc-refugee destinations chosen for **customization, not AI** (validates Atlas pillar #1). Market share: no provider is a safe sole bet (ChatGPT ~53%, Gemini ~27%, Claude ~8% of gen-AI traffic, Jun 2026) — the strongest argument for **multi-provider/BYO-key**. --- ## 2. Page content extraction for LLMs (the technical heart of `Content/`) Extraction failure *is* AI failure in the user's mind (Arc evidence, §1). Budget disproportionately here. ### Readability & the extractor landscape - **Mozilla Readability.js** (Apache-2.0, the Firefox Reader engine): `_grabArticle()` scores nodes (1 base + 1/comma + ≤3 for length + ±25 class/id weight), propagates to ancestors, scales by `(1 − linkDensity)`, takes top `nbTopCandidates=5`, appends qualifying siblings, and retries with relaxed flags until ≥ `charThreshold=500` chars. Returns `{title, content(HTML), textContent, excerpt, byline, siteName, lang, publishedTime}`. **`parse()` mutates the DOM — always `document.cloneNode(true)` first** in a live WKWebView. `isProbablyReaderable(document)` is the cheap **article-vs-app gate**. Does NOT sanitize output — treat page-derived strings as untrusted (injection surface). - **Defuddle** (MIT, kepano): browser-first, more forgiving than Readability, standardizes code/math/footnotes, and **emits Markdown directly** (`markdown: true`) — skipping a separate Turndown step. Other refs: trafilatura (Python, server-only), Postlight (unmaintained), dom-distiller (uses render signals). - **2026 benchmark reality:** extractors converge on articles (F1 ≈ 0.93) but diverge on structured/app pages (F1 0.41–0.84). **The article path is solved; invest in the fallback.** - **Decision:** primary extractor = **Defuddle** (MIT, browser-first, native Markdown); keep **Readability** as A/B fallback and `isProbablyReaderable` as the gate. Both run on a clone so the live page is untouched. (github.com/mozilla/readability, kepano/defuddle; arxiv 2605.21097.) ### Fallback ladder when extraction fails (Gmail, dashboards, SPAs) 1. `isProbablyReaderable` gate; post-hoc check (extracted < `charThreshold` or < ~20% of `body.innerText`) → treat as failed. 2. **`document.body.innerText`** — layout-aware "what the user can see" (excludes `display:none`, inserts render-accurate breaks). Annotate `extractionQuality: .rawText`. 3. **Structured visible-text TreeWalker** → pseudo-Markdown (h1–h6→`#`, li→`-`, table→pipes, a→links), skipping `display:none`/zero-rect nodes. 4. **Accessibility-tree-style walk** for app pages (role + accessible name + state). Raw HTML dumps are an anti-pattern. 5. Last resort: title + URL + meta description, with the UI saying "couldn't read this page." ### Why Markdown, and structure preservation Markdown cuts tokens ~60–80% vs HTML; headings survive as `##` lines (chunk boundaries + citation anchors), lists/tables keep semantics, links keep `[text](url)` for "answer with sources." `PageContext.markdown` is canonical; keep `plainText` for token estimates and a heading index `[(headingPath, charRange)]` for chunking + citations. (Turndown with `headingStyle:'atx'`, `codeBlockStyle:'fenced'` if converting Readability HTML.) ### WKWebView mechanics - **Isolate everything in a named `WKContentWorld`** (`ZyquoAtlasContent`): the extractor reads the DOM/selection/computed-styles (shared across worlds) but never collides with or is observed by page JS. Message handlers registered in that world can't be spoofed by the page. **Exception:** the `history.pushState` hook (SPA detection) must run in `.page` because it wraps the page's own binding. - **Pull:** `callAsyncJavaScript` (named args auto-serialize; body may `await`; resolves Promises) — but **`evaluateJavaScript` crashes on an `undefined` result**, so every injected entry point ends with a value and is wrapped `try/catch → {ok, ...}`. Cap extraction in JS (~300–600 KB), send one JSON object; never stream the DOM across the bridge. - **Push:** world-scoped `WKScriptMessageHandler` for selection-changed, SPA-navigation, and a MutationObserver `contentVersion` counter. - **Selection:** `window.getSelection()`; `getRangeAt(0).getBoundingClientRect()` positions the floating toolbar (account for `webView.pageZoom`); send ±N chars of surrounding text + nearest heading for grounding; debounce `selectionchange` ~200 ms; post `{text, rect, isEditable}` (isEditable drives Rewrite-vs-Explain). Cross-origin iframes need per-frame observers (`forMainFrameOnly:false`) aggregated natively. - **SPA navigation** fires no `WKNavigationDelegate` callbacks — detect via **KVO on `webView.url` + a `pushState/replaceState/popstate` hook + MutationObserver**, all three; each invalidates the `PageContext` cache and cancels in-flight AI for the old context. - **App-page data paths:** special-case YouTube (transcript), PDF (PDFKit text), Google Docs (full-document script/selection) rather than DOM scraping (Chrome reads the Workspace API for shared Docs — same lesson). --- ## 3. Chunking, context & long pages - **2026 long-context calculus:** frontier windows are 200K–2.5M tokens, but effective context is ~50–65% of advertised (context rot), and filling big windows is slow + costly. **A web page is almost never "long" in 2026 terms** (a long article ≈ 5–15K tokens; brutal pages rarely pass 100K after boilerplate stripping). - **Default = STUFF the whole page** for any Cloud model with ≥128K context. `Summarizer` budget rule: `if estTokens(page) < 0.6 × model.contextWindow − reservedOutput → stuff; else → map-reduce`. Map-reduce survives only for (i) small/cheap models chosen for hover-summaries, (ii) pathological pages, (iii) **multi-tab compare** (N pages × 15K). Map runs chunks concurrently; **stream only the reduce phase** to the UI (map partials shown as progress "Reading section 3/9…"). **Refine is never used** (sequential → bad streaming UX; page content isn't narrative enough to need it). - **Chunker** over `PageContext.markdown`: split on heading boundaries (carry `headingPath`); large sections → ~600-token Q&A chunks with ~50-token overlap; tiny sections merge; token estimate `chars/4`. Each `Chunk {id, headingPath, text, charRange, firstWords}` — `charRange`/`firstWords` power citation + highlight. Summarize chunks are coarser (2–4K, no overlap). - **Chat-with-page retrieval:** **stuff by default**; when over budget or multi-tab, a tiny **Swift BM25** (k1=1.2, b=0.75, ~80 LOC) scores chunks against the question + recent turns, taking top-k within budget + always the lead section. **No local embeddings in v1** (the benchmark deltas don't justify the complexity for single-page scope) — leave a `RelevanceSelector` protocol hook. This matches what Brave Leo ships (stuff/truncate, no per-page vector DB). (firecrawl chunking benchmarks; Brave Leo deepwiki.) --- ## 4. AI surfaces & UX patterns (Phase 3/6 feature contract) Every Phase 3/6 AI surface, with the pattern it traces to: 1. **Smart omnibox (`OmniIntent`)** — graduated ladder, not a mode switch: URL → navigate (always, immediately); fuzzy palette (tabs/history/bookmarks/actions); web search; **ask** (streamed answer + prominent plural sources, in an anchored overlay, never navigating away). Show the resolved mode inline before commit; bias to navigate/search; force-ask via modifier (Dia keys); user-settable default. **Ship the palette AND the ask** (Dia's lesson). 2. **⌘F as the AI front door** — exact → fuzzy → **semantic** → **ask-about-page** (Arc Ask-on-Page + OpenAI semantic find, combined; no one has shipped the full ladder). 3. **Chat-with-page sidebar** (right, ~360pt, collapsible; ⌘⇧A) — per-tab `PageContext` context and per-tab history; model chip (all Cloud models) + Automatic/sticky/default; quick-action row (Summarize, Key points, Translate, Ask selection); **numbered `[§n]` citations that scroll-to-highlight** the source section on click. 4. **Selection floating toolbar** — on text selection: Explain / Summarize / Translate / Rewrite / Ask; short results in an anchored popover, long results hand off to the sidebar with the selection as context (Edge "transition to panel"); selection also implicitly joins chat context (OpenAI). Support multiple/element selections later (Chrome I/O 2026). 5. **Inline writing assist in web text fields** — distinct from the sidebar (OpenAI framing): highlight in a `