Managed browser

Managed browser lets Autonomic Agents and Trace AI read an allowlisted web UI when no integration API exists. The model calls browser_* tools. Login secrets stay in the process keystore.

Enable it

1. Set MANAGED_BROWSER_ENABLED=true on the API.
2. Run @backend-next/browser-worker. BROWSER_WORKER_TRANSPORT=http posts to BROWSER_WORKER_URL (local compose publishes http://browser-worker:3300). BROWSER_WORKER_TRANSPORT=redis enqueues tf:browser_automation_jobs. Only the browser-worker process consumes that list, one command at a time. The processflow worker does not.
3. Confirm the tenant plan includes the managed_browser feature. free and starter do not. basic, premium, enterprise, and system do. Until that is true, managed-browser is omitted from the skill catalog and browser_* tools are not attached.

Register a target

Tenant administrators open Browser targets and create or edit a target with an HTTPS base_url. Path prefixes (one per line) limit navigation. An empty prefix list allows any path on that origin. Pinned agent ids restrict the target to those autonomic agents; an empty pin list lets Trace and any agent that lists the target use it. Login recipes are JSON steps pasted on the same form. A fill step that needs a secret uses keystore_process_id and keystore_key. Do not put passwords in the recipe or in the agent mandate. Each browser tool call uses the mcp.tool.browser timeout (BROWSER_TOOL_TIMEOUT_MS, default 60 seconds). Successful and failed calls log managed_browser.action with a failure class and session age. Snapshot text redacts payment-card numbers that pass the Luhn check, US Social Security numbers, and Finnish personal identity codes. When REDIS_HOST is set, each target allows max_actions_per_run actions per hour (default 200).

[
  { "type": "goto", "url": "https://www.saucedemo.com/" },
  { "type": "fill", "selector": "#user-name", "keystore_process_id": "<process_id>", "keystore_key": "username" },
  { "type": "fill", "selector": "#password", "keystore_process_id": "<process_id>", "keystore_key": "password" },
  { "type": "click", "selector": "#login-button" }
]

Grant an agent

On the agent, add the target to Allowed browser targets. An empty list means that agent cannot open a browser target. Put managed-browser in the agent's platform_skill_ids so each wake loads the skill and receives browser_open_target, browser_snapshot, browser_navigate, browser_extract_table, browser_fill, browser_click, browser_select, browser_submit, and browser_close.

The agent calls browser_open_target with that target id, then snapshot or extract. Form fields use a ref from the latest snapshot. browser_submit is rejected until the agent calls browser_snapshot after the latest fill, click, or select. The agent must not type credentials into browser_fill.

A later wake receives <autonomic_browser_session> with the open browser_session_id so the agent continues that session instead of opening another one.

ProcessFlow step

A process step with step_type browser_session_step opens the target, runs the login recipe, then runs configuration.actions. The process worker calls POST /api/v1/browser-targets/session-step. Sync runs in the API call ManagedBrowserToolService directly. {{field}} reads process input. The step closes the session unless keep_open is true. A recipe that returns needs_human fails the step; MFA stays on an autonomic run. Do not put passwords or keystore_key in the step.

{
  "browser_target_id": "<browser_target_id>",
  "actions": [
    { "command": "snapshot" },
    { "command": "navigate", "path": "/reports" },
    { "command": "extract_table" }
  ]
}

What is still operator-owned

Chromium runs only in the browser-worker image (backend-next/browser-worker/Dockerfile), not in the API image. Keep-warm defaults to 30 seconds; after that the worker saves cookies and storage and closes Chromium until the next tool call on the same browser_session_id.

MFA

A login recipe step { "type": "needs_human" } stops the recipe and leaves the session in needs_human. The agent should return need_human and ask for the code in the run note. Resume starts the next wake with that note and the same browser session. The agent then browser_fills the code. There is no live browser view in this release.