@@ -68,12 +68,24 @@ async function run(): Promise<void> {
       entryPoints: ['src/preload/index.ts'],
       outfile: 'dist/preload.cjs',
     })
-    await Promise.all([mainCtx.watch(), preloadCtx.watch()])
+    // Separate from the main-window preload: this one is injected into
+    // untrusted pages in the built-in browser and must stay minimal.
+    const browserPreloadCtx = await context({
+      ...common,
+      entryPoints: ['src/preload/browser/index.ts'],
+      outfile: 'dist/browser-preload.cjs',
+    })
+    await Promise.all([mainCtx.watch(), preloadCtx.watch(), browserPreloadCtx.watch()])
     return
   }
   await Promise.all([
     build({ ...common, entryPoints: ['src/main/index.ts'], outfile: 'dist/main.cjs' }),
     build({ ...common, entryPoints: ['src/preload/index.ts'], outfile: 'dist/preload.cjs' }),
+    build({
+      ...common,
+      entryPoints: ['src/preload/browser/index.ts'],
+      outfile: 'dist/browser-preload.cjs',
+    }),
   ])
 }
 
 
@@ -57,6 +57,7 @@ describe('executeTool', () => {
           onPageState: vi.fn(),
           onTabsState: vi.fn(),
           onSessionStatus: vi.fn(),
+          onFillAvailability: vi.fn(),
         },
         () => win
       )
@@ -108,6 +109,7 @@ describe('executeTool', () => {
           onPageState: vi.fn(),
           onTabsState: vi.fn(),
           onSessionStatus: vi.fn(),
+          onFillAvailability: vi.fn(),
         },
         () => win
       )
@@ -151,7 +153,12 @@ describe('credential protection', () => {
   async function openPage() {
     const win = new BrowserWindow()
     driver.initDriver(
-      { onPageState: vi.fn(), onTabsState: vi.fn(), onSessionStatus: vi.fn() },
+      {
+        onPageState: vi.fn(),
+        onTabsState: vi.fn(),
+        onSessionStatus: vi.fn(),
+        onFillAvailability: vi.fn(),
+      },
       () => win
     )
     await driver.executeTool('browser_open_tab', {})
 
@@ -15,12 +15,14 @@
  * is bounded by a watchdog so the Sim side always gets a response instead of
  * waiting out its own timeout against silence.
  */
-import type {
-  BrowserKnownSessionsState,
-  BrowserPageState,
-  BrowserPanelAction,
-  BrowserTabsState,
-  BrowserToolName,
+import {
+  BROWSER_DATA_KINDS,
+  type BrowserDataKind,
+  type BrowserKnownSessionsState,
+  type BrowserPageState,
+  type BrowserPanelAction,
+  type BrowserTabsState,
+  type BrowserToolName,
 } from '@sim/browser-protocol'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
@@ -53,6 +55,7 @@ import {
 } from '@/main/browser-agent/page-functions'
 import * as session from '@/main/browser-agent/session'
 import { checkAgentUrl } from '@/main/browser-agent/url-guard'
+import { clearCredentials, fillCoordinator, initFillCoordinator } from '@/main/browser-credentials'
 import type { ConfigStore } from '@/main/config'
 
 const logger = createLogger('BrowserAgentDriver')
@@ -76,6 +79,8 @@ export interface DriverCallbacks {
   onPageState: (state: BrowserPageState) => void
   onTabsState: (state: BrowserTabsState) => void
   onSessionStatus: (alive: boolean) => void
+  /** Whether the active tab shows a login form Sim holds a credential for. */
+  onFillAvailability: (available: boolean) => void
 }
 
 let driverCallbacks: DriverCallbacks | null = null
@@ -185,13 +190,23 @@ export function initDriver(
 ): void {
   driverCallbacks = callbacks
   knownSessions = config ? new BrowserKnownSessionRegistry(config) : null
+  initFillCoordinator({
+    getActiveContents: () => session.activeTab()?.view.webContents ?? null,
+    onAvailabilityChanged: (available) => callbacks.onFillAvailability(available),
+  })
   session.initSession(
     {
       onSessionClosed: () => {
         driverCallbacks?.onSessionStatus(false)
       },
       onTabCreated: instrumentTab,
-      onActiveTabChanged: pushPageState,
+      onTabNavigated: (contents) => fillCoordinator()?.noteNavigation(contents),
+      onTabClosed: (contents) => fillCoordinator()?.forget(contents),
+      onActiveTabChanged: (contents) => {
+        pushPageState(contents)
+        // The fill affordance belongs to whichever page is in front.
+        void fillCoordinator()?.refreshAvailability()
+      },
       onTabsChanged: pushTabsState,
       onTabThemeChanged: (contents, theme) => {
         void cdp.setColorScheme(contents, theme).catch((error) => {
@@ -223,13 +238,32 @@ export async function getKnownSessions(): Promise<BrowserKnownSessionsState> {
 }
 
 /**
- * Everything the embedded browser remembers about the signed-in user, cleared
- * as one unit on sign-out. Lives here because the browsing-trail registry and
- * the session profile are owned by different modules.
+ * Cookies, site storage, cache, and the remembered browsing trail.
+ *
+ * Saved passwords are deliberately NOT touched. "Clear browsing data" is about
+ * signing out of websites, and a user who wanted to erase their password vault
+ * would have to say so separately — silently taking their credentials with it
+ * would be a destructive surprise.
+ */
+export async function clearBrowsingData(
+  kinds: readonly BrowserDataKind[] = BROWSER_DATA_KINDS
+): Promise<void> {
+  // The remembered browsing trail is the local mirror of the cookie jar, so it
+  // goes when cookies do and stays when they do not.
+  if (kinds.includes('cookies')) knownSessions?.clear()
+  await session.clearAgentData(kinds)
+}
+
+/**
+ * Everything the embedded browser holds for the signed-in user, including the
+ * credential vault. This is the Sim sign-out path: a different account signing
+ * in on the same machine must not inherit the previous user's sessions or
+ * passwords.
  */
 export async function clearBrowserProfile(): Promise<void> {
   knownSessions?.clear()
   await session.clearProfileStorage()
+  await clearCredentials()
 }
 
 function str(params: Record<string, unknown>, key: string): string | undefined {
 
@@ -61,6 +61,8 @@ async function freshSession(
       onTabsChanged: vi.fn(),
       onTabThemeChanged: vi.fn(),
       onDownloadBlocked: vi.fn(),
+      onTabNavigated: vi.fn(),
+      onTabClosed: vi.fn(),
       ...eventOverrides,
     },
     () => win,
@@ -671,6 +673,8 @@ describe('browser-agent session', () => {
         onTabsChanged: vi.fn(),
         onTabThemeChanged: vi.fn(),
         onDownloadBlocked: vi.fn(),
+        onTabNavigated: vi.fn(),
+        onTabClosed: vi.fn(),
       },
       () => replacement
     )
@@ -1160,3 +1164,60 @@ describe('reopening a closed tab', () => {
     expect((reopened?.view as unknown as MockView).webContents.loadURL).not.toHaveBeenCalled()
   })
 })
+
+describe('importAgentCookies', () => {
+  /** Points the mocked partition at a cookie jar and returns its `set` spy. */
+  async function withCookieJar(
+    set: ReturnType<typeof vi.fn>
+  ): Promise<typeof import('@/main/browser-agent/session')> {
+    vi.mocked(electronSession.fromPartition).mockReturnValue({
+      cookies: { set },
+    } as unknown as ReturnType<typeof electronSession.fromPartition>)
+    vi.resetModules()
+    return import('@/main/browser-agent/session')
+  }
+
+  const cookie = (name: string) => ({
+    url: 'https://example.com/',
+    name,
+    value: 'v',
+    path: '/',
+    secure: true,
+    httpOnly: true,
+    sameSite: 'lax' as const,
+  })
+
+  it('writes every cookie into the dedicated browser profile', async () => {
+    const set = vi.fn(async () => {})
+    const session = await withCookieJar(set)
+
+    const result = await session.importAgentCookies([cookie('a'), cookie('b')])
+
+    expect(result).toEqual({ imported: 2, failed: 0 })
+    expect(electronSession.fromPartition).toHaveBeenCalledWith('persist:sim-browser-agent')
+    expect(set).toHaveBeenCalledTimes(2)
+    expect(set).toHaveBeenNthCalledWith(1, cookie('a'))
+  })
+
+  it('counts a rejected cookie without losing the rest', async () => {
+    // Chromium refuses cookies whose attributes are inconsistent. That
+    // rejection must cost one cookie, not the whole import.
+    const set = vi.fn(async (details: { name: string }) => {
+      if (details.name === 'bad') throw new Error('Failed to set cookie')
+    })
+    const session = await withCookieJar(set)
+
+    const result = await session.importAgentCookies([cookie('a'), cookie('bad'), cookie('c')])
+
+    expect(result).toEqual({ imported: 2, failed: 1 })
+    expect(set).toHaveBeenCalledTimes(3)
+  })
+
+  it('does nothing when there is nothing to import', async () => {
+    const set = vi.fn(async () => {})
+    const session = await withCookieJar(set)
+
+    await expect(session.importAgentCookies([])).resolves.toEqual({ imported: 0, failed: 0 })
+    expect(set).not.toHaveBeenCalled()
+  })
+})
@@ -1,4 +1,6 @@
+import { join } from 'node:path'
 import {
+  type BrowserDataKind,
   type BrowserOmniboxFocusMode,
   type BrowserTabState,
   type BrowserTabsState,
@@ -7,7 +9,7 @@ import {
 } from '@sim/browser-protocol'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
-import type { BrowserWindow, Input, Session, WebContents } from 'electron'
+import type { BrowserWindow, CookiesSetDetails, Input, Session, WebContents } from 'electron'
 import { session as electronSession, nativeTheme, WebContentsView } from 'electron'
 import { attachAgentContextMenu } from '@/main/browser-agent/context-menu'
 import type { BrowserCookieSignal } from '@/main/browser-agent/known-sessions'
@@ -46,6 +48,13 @@ export interface AgentSessionEvents {
   onSessionClosed: () => void
   /** A newly created tab's WebContents, for the driver to instrument. */
   onTabCreated: (contents: WebContents) => void
+  /**
+   * A tab navigated, including in-page. Anything bound to the previous
+   * document — notably a pending credential fill — must be invalidated.
+   */
+  onTabNavigated: (contents: WebContents) => void
+  /** A tab's WebContents is going away, so per-tab state can be dropped. */
+  onTabClosed: (contents: WebContents) => void
   /** The active tab changed (new tab, switch, close). */
   onActiveTabChanged: (contents: WebContents) => void
   /** The tab list or active tab changed. */
@@ -213,6 +222,37 @@ export async function listAgentCookieSignals(): Promise<BrowserCookieSignal[]> {
   return cookies.flatMap(({ domain }) => (typeof domain === 'string' ? [{ domain }] : []))
 }
 
+/**
+ * Writes imported cookies into the dedicated profile.
+ *
+ * Electron's cookie API is deliberately the only writer: Chromium owns the
+ * destination store's format, and editing that SQLite file directly would
+ * couple Sim to internals it does not control and risk corrupting the profile.
+ * It is also the enforcement point — Chromium rejects a cookie whose
+ * attributes are inconsistent (`SameSite=None` without `Secure`, a domain the
+ * URL cannot set), so a row that would only import under weaker terms fails
+ * here and is counted rather than being quietly relaxed.
+ *
+ * Failures are per-cookie: one rejected cookie must not cost the user the
+ * rest. Nothing about a cookie is logged.
+ */
+export async function importAgentCookies(
+  cookies: CookiesSetDetails[]
+): Promise<{ imported: number; failed: number }> {
+  const jar = electronSession.fromPartition(AGENT_PARTITION).cookies
+  let imported = 0
+  let failed = 0
+  for (const cookie of cookies) {
+    try {
+      await jar.set(cookie)
+      imported += 1
+    } catch {
+      failed += 1
+    }
+  }
+  return { imported, failed }
+}
+
 /**
  * Default-deny hardening for the agent partition: no permission grants of any
  * kind, and downloads are cancelled (and surfaced to the driver) rather than
@@ -291,6 +331,10 @@ function createTabView(): WebContentsView {
       sandbox: true,
       webSecurity: true,
       webviewTag: false,
+      // A minimal, isolated preload that reports login-form presence and
+      // performs user-authorized credential fills. It exposes nothing to the
+      // page, and runs in the top-level frame only.
+      preload: join(__dirname, 'browser-preload.cjs'),
       // Throttled by default: a hidden tab should idle. The one exception is
       // the active tab while a tool waits on it, applied explicitly by
       // applyActiveTabThrottling — never blanket across every tab.
@@ -373,6 +417,13 @@ function createTabView(): WebContentsView {
   // user-driven navigations that do not pass through the driver.
   contents.on('did-navigate', persistPinnedTabs)
   contents.on('did-navigate-in-page', persistPinnedTabs)
+  // Both document loads and same-document route changes invalidate anything
+  // bound to the previous page: a single-page app can replace a login form
+  // with another site's UI without ever loading a new document.
+  contents.on('did-start-navigation', () => events?.onTabNavigated(contents))
+  contents.on('did-navigate', () => events?.onTabNavigated(contents))
+  contents.on('did-navigate-in-page', () => events?.onTabNavigated(contents))
+  contents.on('destroyed', () => events?.onTabClosed(contents))
 
   events?.onTabCreated(contents)
   return view
@@ -840,6 +891,40 @@ export async function clearProfileStorage(): Promise<void> {
   await ses.clearCache()
 }
 
+/**
+ * Site storage other than cookies. Named explicitly rather than by omission so
+ * a new Chromium storage type is not silently swept into "site data" — the
+ * whole-profile wipe is the one that deliberately takes everything.
+ */
+const SITE_DATA_STORAGES = [
+  'filesystem',
+  'indexdb',
+  'localstorage',
+  'shadercache',
+  'websql',
+  'serviceworkers',
+  'cachestorage',
+] as const
+
+/**
+ * Erases selected kinds of browsing data without ending the session.
+ *
+ * Unlike {@link clearProfileStorage} this leaves tabs open and the pinned strip
+ * intact: the user asked to clear data, not to close their browser. Saved
+ * passwords live in a separate vault and are never touched here.
+ */
+export async function clearAgentData(kinds: readonly BrowserDataKind[]): Promise<void> {
+  const ses = electronSession.fromPartition(AGENT_PARTITION)
+  const storages: string[] = []
+  if (kinds.includes('cookies')) storages.push('cookies')
+  if (kinds.includes('site-data')) storages.push(...SITE_DATA_STORAGES)
+
+  if (storages.length > 0) {
+    await ses.clearStorageData({ storages } as Parameters<Session['clearStorageData']>[0])
+  }
+  if (kinds.includes('cache')) await ses.clearCache()
+}
+
 export function listTabs(): BrowserTabState[] {
   restorePinnedTabs()
   return tabs