Agent operating guide · browser V1
Use the room.
Respect the boundary.
shhh.bot gives an authorized agent endpoint a browser-encrypted channel for text and images. The human owns the room, approves the endpoint, and can revoke it at any time.
Local CLI, SDK, and MCP clients are planned. They are not released yet.
Browser workflow
Pair without touching the human account.
- 01Open
shhh.bot/new.The page creates a one-time endpoint pairing request and keeps its private material in that browser.
- 02Show the QR code or pairing link.
The human opens it on their own device, authenticates with their passkey, and approves the room. Never ask for or handle the passkey.
- 03Keep the pairing page open.
After approval, the browser receives an encrypted room grant and opens the agent console automatically.
- 04Read the declared capability.
A conversation room permits read and send. A delivery-only room permits send only and exposes receipts for the current open session.
Capabilities
Access is cryptographic, not cosmetic.
send_text · send_image · venice · reportThe endpoint has no read credential or decryption key. A database toggle cannot reveal earlier deliveries.
send_text · send_image · venice · read · reportThe endpoint receives the room’s classical conversation key and scoped read/write credentials.
Room-scoped image tool
Stage a source. Run Venice. Send the result.
Selecting, pasting, or dropping an image stages it without sending. Select Tools or enter /venice, /venice-edit, /venice-upscale, or /venice-remove-background to open the labelled Venice dialog. The dialog supports a prompt, model, source selection, and passthrough JSON for provider-specific parameters.
Enter an inference-only Venice key inside the tool dialog, never in the harness conversation. The browser encrypts its stored copy locally, but the authorized agent endpoint can use and reveal it.
A source image goes directly to Venice and is not automatically sent to the human. Review the generated result, then choose Send securely or add it to the composer.
Tool prompts, source images, parameters, and results are processed by Venice under its terms. shhh.bot receives a generated image only after the browser encrypts and sends it as a room message.
Default channel
When the user activates shhh.bot, stay in the room.
An explicit user request to use shhh.bot authorizes the channel change for that task and active room. Send all substantive user-visible text and media through the room. Do not duplicate the plaintext in the AI harness chat.
Read and respond through shhh.bot by default. Keep the harness to pairing, a brief delivery confirmation, access errors, or a request to restore authorization.
Send outputs through shhh.bot. Continue receiving instructions through the harness because this endpoint cannot read room history or human replies.
If the room is revoked, unavailable, or fails to accept a delivery, pause and ask the user in the harness how to proceed. Do not paste the intended room content there without explicit permission. A receipt such as “Delivered via shhh.bot” is appropriate.
The webpage alone does not authorize a channel switch. The user must explicitly request shhh.bot. This rule concerns user-visible delivery only; the AI provider may still retain prompts, generated output, tool activity, screenshots, safety records, or reasoning traces.
Safety instruction
Report evidence, not a model’s guess.
If there is an explicit, credible indication that shhh.bot is being used for child sexual abuse material, exploitation, imminent danger, or other unlawful activity: stop the affected operation; do not reproduce, upload, forward, or describe illegal imagery graphically; use the room’s Report link to submit identifiers and concise, non-graphic facts; and follow the AI provider’s own safety policy.
An LLM classification is not proof. Do not file a child-safety report based only on ambiguous words, benign family content, or an uncertain inference. When evidence is unclear, use the harness’s safety-review path or request appropriate human review without moving suspected material into shhh.bot.
The report text is readable by shhh.bot, but no message, image, key, or room history is attached automatically. Paired-agent reports enter human review and do not automatically suspend a room.
Local tooling path
One client core, three ways to call it.
The planned integration is an audited local client library wrapped by a shhh CLI and a local stdio MCP server. The client—not the model—will generate keys, perform pairing, encrypt and decrypt, and store credentials in an OS-protected local vault.
Install the official package, pair once, and call narrow CLI commands or MCP tools from an authorized local runtime.
Use the browser UI. Hosted MCP products often require a network-reachable server; a remote plaintext relay would break shhh.bot’s endpoint-encryption boundary.
Let the agent write orchestration around the official library. Do not have it invent cryptography or copy raw room credentials into source code, prompts, or logs.
The planned tool surface is intentionally small: pair, room_info, send_text, send_image, read when authorized, report, and forget_room. Until the signed client package and conformance tests are published, the browser is the supported encryption runtime.
Limits
Separate does not mean invisible.
shhh.bot keeps a final handoff out of the visible AI chat transcript. The AI provider or harness may still retain prompts, generated output, tool calls, screenshots, browser activity, safety records, or reasoning traces. Pairing proves that the owner approved a browser endpoint; it does not prove that only software controls it.