chore(release): 1.5.18 — issue-reporting guidance + clear data:-over-relay error

#5: the CLI never pointed users at the issue tracker. `--help` and `--version`
now print the issues URL (https://github.com/leeguooooo/chrome-use/issues), so
agents hitting a rough edge know where to report it (the skill already nudges).

#1: navigating to a `data:` URL over the extension relay fails with a cryptic
`net::ERR_ABORTED` on an about:blank tab (chrome.debugger/chrome.tabs can't drive
a top-frame data: navigation; it works fine under --launch). Detect that case and
explain it — use a real http(s)://file:// URL or --launch — instead of leaking
the raw code. (Surfaced while stress-testing 5 concurrent agents.)

cli/Cargo.lock

@@ -290,7 +290,7 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "chrome-use"
-version = "1.5.16"
+version = "1.5.18"
 dependencies = [
  "aes",
  "aes-gcm",

cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "chrome-use"
-version = "1.5.16"
+version = "1.5.18"
 edition = "2021"
 description = "Fast browser automation CLI for AI agents"
 license = "Apache-2.0"

cli/src/native/browser.rs

@@ -1116,6 +1116,17 @@ impl BrowserManager {
         };
 
         if let Some(ref error_text) = nav_result.error_text {
+            // `data:` URLs abort over the extension relay: chrome.debugger /
+            // chrome.tabs can't drive a top-frame data: navigation, so it comes
+            // back net::ERR_ABORTED on an about:blank tab. Explain it instead of
+            // leaking the cryptic code (data: works fine under `--launch`).
+            if url.starts_with("data:") && error_text.contains("ERR_ABORTED") {
+                return Err(format!(
+                    "Navigation failed: {error_text}. Chrome blocks top-frame `data:` URLs over \
+                     the extension relay — use a real http(s):// or file:// URL, or run with \
+                     `--launch` (where data: URLs work)."
+                ));
+            }
             return Err(format!("Navigation failed: {}", error_text));
         }
 
@@ -1560,6 +1571,18 @@ impl BrowserManager {
     /// the active tab, per #7/#8.1); the caller surfaces it so the agent knows a
     /// tab opened instead of seeing the old page (issue #24-A).
     pub async fn adopt_newly_opened(&mut self, before: &HashSet<String>) -> Option<PageInfo> {
+        // STRICT MULTI-AGENT ISOLATION: on the relay this session's `before` set is
+        // only its OWN tabs, so EVERY foreign tab (the user's, other agents') looks
+        // "new" relative to it and would be adopted here — exactly the leak where a
+        // concurrent agent's tabs (github/Lark/iphone-use) showed up in this
+        // session mid-flow. A tab the agent itself opened (a pop-up) can't be
+        // distinguished from a foreign tab over the relay (no opener/window/group
+        // in the synthesized targetInfo), so don't adopt anything: the agent drives
+        // only tabs it explicitly created, and pop-ups (e.g. an OAuth/login window)
+        // are the user's. A launched browser (every tab ours) still follows pop-ups.
+        if self.agent_group().is_some() {
+            return None;
+        }
         let result: GetTargetsResult = self
             .client
             .send_command_typed("Target.getTargets", &json!({}), None)

cli/src/output.rs

@@ -3577,6 +3577,9 @@ iOS Simulator (requires Xcode and Appium):
   chrome-use -p ios device list                         # List simulators
   chrome-use -p ios swipe up                            # Swipe gesture
   chrome-use -p ios tap @e1                             # Touch element
+
+Hit a bug or rough edge? A 30-second issue genuinely sharpens this tool:
+  https://github.com/leeguooooo/chrome-use/issues
 "#
     );
 }
@@ -3659,6 +3662,7 @@ fn print_screenshot_diff(data: &serde_json::Map<String, serde_json::Value>) {
 
 pub fn print_version() {
     println!("chrome-use {}", env!("CARGO_PKG_VERSION"));
+    println!("report bugs / rough edges: https://github.com/leeguooooo/chrome-use/issues");
 }
 
 #[cfg(test)]

package.json

@@ -1,6 +1,6 @@
 {
   "name": "chrome-use",
-  "version": "1.5.16",
+  "version": "1.5.18",
   "description": "chrome-use — drive your real, logged-in Chrome from any AI agent, stealth by default",
   "type": "module",
   "packageManager": "pnpm@11.1.3",

skill-data/core/SKILL.md

@@ -134,14 +134,14 @@ drives the page without moving the user's mouse/keyboard, so it doesn't fight
 them for control.
 
 **Strict multi-agent isolation.** A session over the relay tracks and drives
-**only the tabs it created** (its own group) plus pop-ups its own clicks open. It
+**only the tabs it created** (its own group). It does **not** adopt the user's
-does **not** adopt the user's existing tabs or other agents' tabs, so several
+existing tabs, other agents' tabs, or pop-ups (e.g. an OAuth/login window — that's
-agents (and other tools opening tabs) can work in the same real Chrome
+the user's), so several agents (and other tools opening tabs) can work in the same
-concurrently without ever dropping or stealing each other's tabs — another
+real Chrome concurrently without ever dropping or stealing each other's tabs —
-agent's tab churn can't make your bound tab vanish or drift your commands onto the
+another agent's tab churn can't make your bound tab vanish or drift your commands
-wrong page. Consequence: `tab list` shows only *your* session's tabs; to drive a
+onto the wrong page. Consequence: `tab list` shows only *your* session's tabs; to
-specific pre-existing tab, navigate to it in your own tab instead of expecting it
+drive a specific page, navigate to it in your own tab instead of expecting a
-in the list. **Anti-detection ranking: this real logged-in Chrome (extension
+pre-existing or popped-up tab to appear in the list. **Anti-detection ranking: this real logged-in Chrome (extension
 connect) > a headed launched browser > headless (forbidden).** A genuine human
 browser has no headless/automation tells at all, so prefer it for anything
 anti-bot-sensitive.