---
title: "Browser Tools"
description: "Security wrapper over the upstream agent-browser skill, adding URL blocklisting, rate limiting, robots.txt enforcement, and scraping guardrails. Use when automating browser workflows that need safety limits."
canonical: "https://orchestkit.yonyon.ai/docs/reference/skills/browser-tools"
---

# Browser Tools

Security wrapper over the upstream agent-browser skill, adding URL blocklisting, rate limiting, robots.txt enforcement, and scraping guardrails. Use when automating browser workflows that need safety limits.

<span className="badge badge-gray">Reference</span> <span className="badge badge-yellow">medium</span>

> **Auto-activated** — this skill loads automatically when Claude detects matching context.

<ContextualSkillSidebar slug="browser-tools" />

> **Browser Tools** Security wrapper over the upstream agent-browser skill, adding URL blocklisting, rate limiting, robots.txt enforcement, and scraping guardrails. Use when automating browser workflows that need safety limits.


# Browser Tools — Security Wrapper

OrchestKit security wrapper for `agent-browser`. **For command reference and usage patterns, use the upstream `agent-browser` skill directly.** This skill adds safety guardrails only.

> **Command docs**: Refer to the upstream `agent-browser` skill for the full command reference (50+ commands: interaction, wait, capture, extraction, storage, semantic locators, tabs, debug, mobile, network, cookies, state, vault).

## Upstream coverage (do not restate)

These topics belong to the vendor. Read them at the source; do not copy them back into this skill.

| Topic | First-party source |
|-------|--------------------|
| CLI command reference, snapshot and ref loop, waits, auth options, eval, config file | `agent-browser` skill · https://github.com/vercel-labs/agent-browser/blob/main/skills/agent-browser/SKILL.md |
| Electron and desktop-app automation over CDP (`connect`, `--cdp`, webviews, tabs) | https://github.com/vercel-labs/agent-browser/blob/main/skill-data/electron/SKILL.md |
| Slack workspace navigation and extraction recipes | https://github.com/vercel-labs/agent-browser/blob/main/skill-data/slack/SKILL.md |
| Running headless in a Vercel Sandbox microVM (deps, snapshots, cron) | `vercel:vercel-sandbox` skill · https://github.com/vercel-labs/agent-browser/blob/main/skill-data/vercel-sandbox/SKILL.md |
| Exploratory QA sweep with repro evidence (issue taxonomy, report template) | `dogfood` skill · https://github.com/vercel-labs/agent-browser/blob/main/skill-data/dogfood/SKILL.md |
| Named `.localhost` dev URLs | `ork:portless` skill · https://github.com/vercel-labs/portless |

**Our delta over all of the above**: `references/ork-delta.md`, covering where the safety hook does and does not apply, the shared rate-limit budget, and the local-URL policy.

## Decision Tree

```bash
# Fallback decision tree for web content
# 1. Try WebFetch first (fast, no browser overhead)
# 2. If empty/partial -> Try Tavily extract/crawl
# 3. If SPA or interactive -> use agent-browser
# 4. If login required -> authentication flow + state save
# 5. If dynamic -> wait @element or wait --text
```

## Local Dev URLs

Use **Portless** (`npm i -g portless`) for stable local dev URLs instead of guessing ports. When Portless is running, navigate to `myapp.localhost` instead of `localhost:3000`. Our safety hook already allows `*.localhost` subdomains via `ORCHESTKIT_AGENT_BROWSER_ALLOW_LOCALHOST`.

```bash
# With Portless: stable, named URLs
agent-browser open "https://myapp.localhost"

# Without: fragile port guessing
agent-browser open "http://localhost:3000"  # which app is this?
```

## New in 2026-04 to 2026-08 (agent-browser 0.23 to 0.35.1)

**0.35.1:** `diff snapshot` ref numbering resets per diff, refs are invalidated across
navigations, and the previous refs survive a failed diff. The streaming `url` event
narrowed to the active tab's main frame: it now emits for full-document, History API and
fragment navigation, rebinds after an active-tab change, and ignores child-frame and
background-tab navigation.

**0.35.0:** `--ca-cert &lt;path&gt;` (also `AGENT_BROWSER_CA_CERT`, and `caCert` in config/MCP)
imports a PEM bundle or DER certificate into an isolated NSS trust store, the targeted
alternative to `--ignore-https-errors` behind an SSL-inspecting proxy: hostname, validity
and unrelated-authority checks stay on. The CA persists across commands in a session and
`--no-ca-cert` clears it. Linux-only, needs `certutil`, and is rejected with `--profile`,
`--cdp`, `--auto-connect`, providers, Lightpanda or `--ignore-https-errors`. Also adds the
bundled `protected-vercel-deployments` skill for reaching SSO-protected Vercel deployments
via short-lived Trusted Sources OIDC tokens instead of a static bypass secret.

**0.34.0:** persistent session-to-tab binding for shared Chrome sessions. Named
`--cdp`/`--auto-connect` sessions remember their CDP target across daemon restarts, CDP
target ids work as tab refs, and `--pin-tab` makes the binding strict so an externally
closed tab returns a stable `tab_gone` error instead of silently retargeting. JSON output
gains `data.targetId` and optional `data.lastUrl`. Also fixes parallel sessions hijacking
each other's tabs.

> Corrected 2026-08-28. This section previously credited 0.34.0 with `pushstate`,
> `removeinitscript`, `--enable react-devtools`, `profiler`, `plugin add|list|show|run`,
> `confirm`/`deny`, `--webgpu` and the MCP `--tools` surface. Checked against the upstream
> CHANGELOG, `pushstate` and `--init-script` landed in 0.27.0, the plugin system and the
> MCP `--tools &lt;profiles&gt;` surface in 0.28.0, and `--webgpu` in 0.31.2; `removeinitscript`
> and `confirm`/`deny` appear nowhere in it. Only `--pin-tab`/`--no-pin-tab` was actually
> 0.34.0. The rest of this file already dated `pushstate` to v0.27 in two other places,
> so the file contradicted itself.

**Accessibility audits (0.33.0):**
- **`agent-browser a11y [url]`** — axe-core accessibility audit as a CLI command and a matching MCP tool. Filter by WCAG tag, scope to a selector, and get iframe-aware text or JSON results. The audit engine is embedded, so it runs offline and is CSP-safe (no third-party script injection into the page under test).
- Pairs with the `accessibility-specialist` agent and the `testing-e2e` axe-core guidance: use this for a fast pre-commit sweep, and Playwright + axe for assertions inside a suite.

**Session restore + read (0.30 → 0.31.1):**
- **`agent-browser read [url]` (0.30.0)** — agent-readable text extraction as a CLI command and MCP tool. URL reads prefer Markdown (try `.md` and nearby `llms.txt`), support outlines, filters, raw and JSON output, headers, and domain/output safeguards; omit the URL to read the rendered active-tab DOM with current browser state.
- **Restore workflow (0.31.0)** — `--restore` / `--restore-save`, restore-validation flags, worktree-scoped `session id` / `session info`, and `--namespace` give agent runs stable, isolated, auto-restored browser state without hand-managing state files. Session lifecycle hardened with daemon/browser compatibility checks and safer auto-save that won't overwrite good state after a failed restore.
- **`wait --url` glob patterns (0.30.1)** — `wait --url` / `waitforurl` honor globs like `**/dashboard` against the full active URL.
- **React renderer fix (0.31.1)** — the `react` commands now pick the react-dom renderer instead of hardcoding renderer id 1, fixing an empty tree read on Next.js 16.3 Turbopack.

**Sandbox helpers (0.29):**
- **`@agent-browser/sandbox`** — companion helper package for running agent-browser headless inside a Vercel Sandbox / eve ephemeral env (provisions Chrome + the native daemon for you, no host browser needed). Hook's URL/rate/robots checks still apply to whatever the sandboxed session navigates to.

**Built-in MCP server (0.28):**
- **`agent-browser --mcp`** — runs agent-browser as a Model Context Protocol server over stdio, exposing typed tools (open/snapshot/find/click/extract/...) with paginated capability discovery. Lets you wire browser automation MCP-native — directly into an MCP client — without going through the CLI Bash wrapper. Note: MCP-native sessions bypass the `agent-browser-safety` PreToolUse Bash hook (the hook only intercepts `agent-browser` Bash commands), so apply URL/rate/robots policy at the MCP-client layer when using this path.

**React introspection + perf observability (0.27):**
- **`react tree` / `react inspect &lt;fiberId&gt;` / `react renders start|stop` / `react suspense`** — first-class React DevTools integration via a vendored MIT-licensed hook embedded in the binary (zero runtime deps). Component-tree visibility, per-fiber props/hooks/state inspection, render profiling with mount/re-render counts and change details, Suspense boundary classification with root-cause grouping. Hook treats fiber state dumps as sensitive — gitignore captures.
- **`vitals [url]`** — reports Core Web Vitals (LCP, CLS, TTFB, FCP, INP) plus React hydration phases for any page. Useful for perf gates in CI.
- **`pushstate &lt;url&gt;`** — client-side SPA navigation without a full page load. Pairs with `react renders` to measure SPA route transitions without resetting profiling state.
- **`--init-script &lt;path&gt;` (repeatable, env `AGENT_BROWSER_INIT_SCRIPTS`)** + **`--enable &lt;feature&gt;` (repeatable, env `AGENT_BROWSER_ENABLE`)** — register scripts before first navigation; `--enable react-devtools` is built-in. Hook treats arbitrary init scripts as code-execution surface — same trust model as `skills get`.
- **`network route --resource-type &lt;csv&gt;`** — filter intercepted requests by CDP resource type (document, script, xhr, fetch, image, ...). Lets you mock only API calls without breaking page assets.
- **`cookies set --curl &lt;file&gt;`** — auto-detects JSON, cURL, and Cookie-header formats for bulk cookie import. Hook still treats cookie-set as auth-state injection.
- **Dashboard behind a reverse proxy** — observability dashboard now works from proxied origins via same-origin proxy. Enables path-based routing for shared dev environments.
- Fixed `doctor` generating duplicate check IDs when invoked multiple times in the same process.
- npm publishing moved to GitHub Actions OIDC trusted publishing — no manually managed npm tokens upstream.

**Diagnostic tooling + stable IDs (0.26):**
- `agent-browser doctor` — one-shot environment + Chrome + daemon + config + security + provider + network check. Flags: `--offline`, `--quick`, `--fix`, `--json`. Run before opening an issue to attach a structured snapshot.
- **Stable tab identifiers** — tabs now use stable string IDs (`t1`, `t2`, ...) with optional memorable labels via `--label`. Survives daemon restart; replaces brittle index-based references.
- **`core` skill expanded** — comprehensive built-in usage guide covering snapshot-ref-act loops, reading, interaction, waiting, and troubleshooting.
- **Config JSON Schema** — `$schema` reference enables IDE auto-completion and validation against `https://agent-browser.dev/schema.json`.
- Fixed `--state` flag not loading saved cookies/localStorage at launch; `--help` now leads with the skills section.

**Skill discovery & chat (0.25):**
- `agent-browser skills list/get &lt;name&gt;` — discover and install capability packs on-demand. Hook treats first-party skills as trusted; warns on arbitrary third-party skill fetches.
- `agent-browser chat` — single-shot or REPL natural-language driving over the same daemon. Hook pipes transcripts through the same URL/rate/robots checks as scripted commands.

**Accessibility-first locators (0.24):**
- `find` / `getByRole` — semantic locator via CDP accessibility tree (role + name) instead of brittle CSS/ref selectors. Prefer these in new scripts; they survive markup churn and are the locator path assumed by `chat`.
- `snapshot --urls` — emits resolved URLs alongside refs, removing a round-trip for link-extraction flows.
- `--annotate` — overlays ref IDs / role labels on screenshots for debugging.

**Cloud providers (0.25):**
- `--provider agentcore` — AWS Bedrock AgentCore cloud browser. Hook treats remote providers as egress surfaces — same URL/robots rules apply, but network routing is disabled (remote scope).
- Browserless + AgentCore both honor `AGENT_BROWSER_PROVIDER` env var.

**Dashboard (0.25):**
- Embedded dashboard bundled with the binary — no separate install. Open via `agent-browser dashboard` or the `inspect` CDP link. Still flagged as local-proxy attack surface by the hook.

**Auto-dialog dismissal (0.23.1):**
- alert / beforeunload dialogs auto-dismissed by default. Opt out with `--no-auto-dialog` when a test needs to assert dialog content.

## What's New (v0.17 → v0.22.2)

**Breaking changes** — update scripts now:
- `--full` / `-f` moved from global to command-level (v0.21): use `screenshot --full`, NOT `--full screenshot`
- Auth encryption format changed (v0.17): saved auth states from v0.16.x may not load
- Auto-dialog dismissal (v0.23.1): alert/beforeunload dialogs are auto-dismissed by default, opt out with `--no-auto-dialog`

**New commands:**

| Command | Version | Security Note |
|---------|---------|---------------|
| `clipboard read/write/copy/paste` | v0.19 | `read` accesses host clipboard — hook warns |
| `inspect` / `get cdp-url` | v0.18 | Opens local DevTools proxy — hook warns |
| `batch --json [--bail]` | v0.21 | Batch execute commands from stdin |
| `network har start/stop [file]` | v0.21 | HAR captures auth tokens — hook warns, treat output as sensitive |
| `network request &lt;id&gt;` | v0.22 | View full request/response detail |
| `network requests --type/--method/--status` | v0.22 | Filter network requests |
| `dialog dismiss` / `dialog status` | v0.17/v0.22 | Dismiss or check browser dialogs |
| `upgrade` | v0.21.1 | Self-update (auto-detects npm/Homebrew/Cargo) |
| `find` / `getByRole` | v0.24 | Semantic locators via CDP a11y tree |
| `snapshot --urls` / `--annotate` | v0.24 | URL-expanded snapshots, ref overlays |
| `skills list/get` | v0.25 | Capability pack discovery — hook warns on third-party |
| `chat` (single-shot / REPL) | v0.25 | NL driving; transcripts go through same safety checks |
| `dashboard` | v0.25 | Embedded debug UI — local proxy attack surface |
| `react tree` / `react inspect` / `react renders` / `react suspense` | v0.27 | React DevTools introspection — fiber state may contain sensitive props |
| `vitals [url]` | v0.27 | Core Web Vitals + React hydration phases |
| `pushstate &lt;url&gt;` | v0.27 | SPA client-side navigation without full reload |

**New flags:**

| Flag | Scope | Version |
|------|-------|---------|
| `--engine lightpanda` | global | v0.17 |
| `--screenshot-dir/quality/format` | screenshot | v0.19 |
| `--provider browserless` | global | v0.19 |
| `--idle-timeout &lt;duration&gt;` | global | v0.20.14 |
| `--user-data-dir &lt;path&gt;` | Chrome | v0.21 |
| `set viewport W H [scale]` | viewport | v0.17.1 (retina) |
| `--provider agentcore` | global | v0.25 (AWS Bedrock AgentCore) |
| `--annotate` | screenshot | v0.24 |
| `--no-auto-dialog` | global | v0.23.1 |
| `--init-script &lt;path&gt;` (repeatable) | global | v0.27 |
| `--enable &lt;feature&gt;` (repeatable) | global | v0.27 (built-in: `react-devtools`) |
| `--resource-type &lt;csv&gt;` | network route | v0.27 |
| `--curl &lt;file&gt;` | cookies set | v0.27 (auto-detects JSON/cURL/Cookie-header) |
| `--mcp` | global | v0.28 (run as a stdio MCP server with typed tools) |

**Platform support:** Brave auto-discovery (v0.20.7), Alpine Linux musl (v0.20.2), Lightpanda engine (v0.17), Browserless.io provider (v0.19), cross-origin iframe traversal (v0.22), AWS Bedrock AgentCore (v0.25).

**Native Rust rewrite (v0.20):** agent-browser is now 100% native Rust — the old Node.js/Playwright daemon (the "sidecar") is **gone**. It drives Chrome directly over CDP, so there is **no Node runtime, no Playwright, and no separate browser-driver process** to install or keep alive. Result: 99x smaller install (710→7 MB), 18x less memory (143→8 MB), 1.6x faster cold start.

## Safety Guardrails (6 rules + the agent-browser-safety hook)

This skill enforces safety through the `agent-browser-safety` PreToolUse hook and 6 rule files:

### Hook: agent-browser-safety

The hook intercepts all `agent-browser` Bash commands and enforces:

| Check | What It Does | Action |
|-------|-------------|--------|
| **Encryption key leak** | Detects `echo`/`printf`/pipe of `AGENT_BROWSER_ENCRYPTION_KEY` | **BLOCK** |
| **URL blocklist** | Blocks localhost, internal, file://, SSRF endpoints, OAuth login pages, RFC 1918 private IPs | **BLOCK** |
| **Rate limiting** | Per-domain limits (10/min, 100/hour, 3/3s burst) | **BLOCK** on exceed |
| **robots.txt** | Fetches and caches robots.txt, blocks disallowed paths | **BLOCK** |
| **Sensitive actions** | Detects delete/remove clicks, password fills, payment submissions | **WARN** + native confirmation |
| **Network routes** | Validates `network route` target URLs against blocklist | **BLOCK** |
| **User-agent spoofing** | Warns when `--user-agent` flag is used | **WARN** |
| **File access** | Warns when `--allow-file-access` flag is used | **WARN** |
| **DevTools inspect** | `inspect` / `get cdp-url` opens local CDP proxy — new attack surface (v0.18+) | **WARN** |
| **Clipboard read** | `clipboard read` accesses host clipboard without prompt (v0.19+) | **WARN** |
| **HAR capture** | `network har stop` dumps full request/response bodies incl. auth tokens (v0.21+) | **WARN** |
| **Skill install** | `skills get` fetches third-party capability packs — treat as code install (v0.25+) | **WARN** |
| **Chat transcripts** | `chat` REPL logs may capture sensitive page text — pipe through same URL rules (v0.25+) | **WARN** |
| **Remote provider** | `--provider agentcore/browserless` sends traffic to cloud endpoints; routing disabled remotely | **WARN** |
| **Init scripts** | `--init-script &lt;path&gt;` registers arbitrary JS before first navigation — code-execution surface (v0.27+) | **WARN** |
| **React fiber dumps** | `react tree`/`react inspect` may expose sensitive props/state from prod apps; gitignore captures (v0.27+) | **WARN** |

### Security Rules (in `rules/`)

| Category | Rules | Priority |
|----------|-------|----------|
| Ethics & Security | `browser-scraping-ethics.md`, `browser-auth-security.md` | CRITICAL |
| Local Dev | `browser-portless-local-dev.md` | HIGH |
| Reliability | `browser-rate-limiting.md` | HIGH |
| Debug & Device | `browser-debug-recording.md`, `browser-mobile-testing.md` | HIGH |

Snapshot, ref lifecycle, iframe traversal, batch and diff workflows are upstream's (see the coverage table above); the parts we actually add are in `references/ork-delta.md`.

### Configuration

Rate limits and behavior are configurable via environment variables:

| Env Var | Default | Purpose |
|---------|---------|---------|
| `AGENT_BROWSER_RATE_LIMIT_PER_MIN` | 10 | Requests per minute per domain |
| `AGENT_BROWSER_RATE_LIMIT_PER_HOUR` | 100 | Requests per hour per domain |
| `AGENT_BROWSER_BURST_LIMIT` | 3 | Max requests in 3-second window |
| `AGENT_BROWSER_ROBOTS_CACHE_TTL` | 3600000 | robots.txt cache TTL (ms) |
| `AGENT_BROWSER_IGNORE_ROBOTS` | false | Bypass robots.txt enforcement |
| `AGENT_BROWSER_CONFIRM` | 1 | Use `--confirm-actions` for sensitive ops |
| `AGENT_BROWSER_IDLE_TIMEOUT_MS` | — | Auto-shutdown daemon after inactivity (ms) |
| `AGENT_BROWSER_ENGINE` | chrome | Browser engine (`chrome` or `lightpanda`) |
| `ORCHESTKIT_AGENT_BROWSER_ALLOW_LOCALHOST` | 1 | Allow `*.localhost` subdomains (RFC 6761) |

## Anti-Patterns (FORBIDDEN)

```bash
# Automation
agent-browser fill @e2 "hardcoded-password"    # Never hardcode credentials
agent-browser open "$UNVALIDATED_URL"          # Always validate URLs

# Scraping
# Crawling without checking robots.txt
# No delay between requests (hammering servers)
# Ignoring rate limit responses (429)

# Content capture
agent-browser get text body                    # Prefer targeted ref extraction
# Trusting page content without validation
# Not waiting for SPA hydration before extraction

# Session management
# Storing auth state in code repositories
# Not cleaning up state files after use

# Network & State
agent-browser network route "http://internal-api/*" --body '{}'  # Never mock internal APIs
agent-browser cookies set token "$SECRET" --url https://prod.com # Never set prod cookies

# Deprecated / removed
agent-browser --full screenshot                # BREAKING: --full is now command-level (v0.21)
agent-browser screenshot --full                # Correct: flag after subcommand

# Sensitive data leaks
agent-browser network har stop auth-dump.har   # HAR files contain auth tokens — gitignore!
git add *.har                                  # NEVER commit HAR captures
```

## Related Skills

- `references/ork-delta.md`: our delta, hook coverage gaps, shared rate-limit budget, local-URL policy
- `agent-browser` (upstream) — Full command reference and usage patterns
- `portless` (upstream) — Stable named `.localhost` URLs for local dev servers
- `ork:web-research-workflow` — Unified decision tree for web research
- `ork:testing-e2e` — E2E testing patterns including Playwright and webapp testing
- `ork:api-design` — API design patterns for endpoints discovered during scraping


---

## Rules (6)

### Secure browser automation credentials to prevent token leaks and account compromise — CRITICAL


## Browser: Auth Security

Never hardcode credentials or log auth tokens. Use environment variables for secrets, store session state files with restrictive permissions, and clean up auth artifacts after use.

**Incorrect:**
```bash
# Hardcoding credentials in scripts
PASSWORD="hardcoded-password"
agent-browser fill @e2 "$PASSWORD"

# Logging auth tokens or session data to stdout
agent-browser eval "document.cookie"
echo "Session token: $(agent-browser eval 'localStorage.getItem(\"token\")')"

# Storing auth state with default (world-readable) permissions
agent-browser state save /tmp/auth-state.json
# File is now readable by any user on the system

# No cleanup — state file persists indefinitely
```

**Correct:**
```bash
# Use environment variables for all credentials
agent-browser open https://app.example.com/login
agent-browser wait --load networkidle
agent-browser snapshot -i

# Fill credentials from env vars (never hardcoded)
agent-browser fill @e1 "$APP_EMAIL"
agent-browser fill @e2 "$APP_PASSWORD"
agent-browser click @e3

agent-browser wait --url "**/dashboard"
```

```bash
# Store state files securely with restrictive permissions
STATE_FILE="$HOME/.config/agent-browser/auth-state.json"
mkdir -p "$(dirname "$STATE_FILE")"

agent-browser state save "$STATE_FILE"
chmod 600 "$STATE_FILE"  # Owner read/write only

# Clean up state files when done
trap 'rm -f "$STATE_FILE"' EXIT
```

```bash
# For 2FA/MFA, use headed mode; handle session expiry gracefully
AGENT_BROWSER_HEADED=1 agent-browser open https://secure-site.com/login
echo "Please complete authentication manually..."
agent-browser wait --url "**/authenticated"
agent-browser state save "$STATE_FILE"
chmod 600 "$STATE_FILE"

# Detect expired sessions and re-authenticate
CURRENT_URL=$(agent-browser get url)
[[ "$CURRENT_URL" == *"/login"* ]] && rm -f "$STATE_FILE"  # Re-trigger login
```

```bash
# Cookie-based session setup (v0.13) — faster than login flows
agent-browser cookies set session_id "$SESSION_TOKEN" \
  --url https://app.example.com \
  --httpOnly --secure
agent-browser open https://app.example.com/dashboard
agent-browser wait --load networkidle

# Verify cookie-based auth worked
CURRENT_URL=$(agent-browser get url)
[[ "$CURRENT_URL" == *"/dashboard"* ]] && echo "Cookie auth successful"
```

```bash
# Token management via storage
agent-browser storage local "authToken"              # Read current token
agent-browser storage local set "authToken" "$TOKEN" # Inject token
agent-browser storage session                        # Check session data
agent-browser storage local clear                    # Cleanup after test
```

```bash
# Cookie management and debugging
agent-browser cookies                    # Read all cookies (debug auth issues)
agent-browser cookies clear              # Clear all cookies (force re-auth)
```

```bash
# Human-in-the-loop for admin actions
agent-browser --confirm-interactive open https://admin.example.com
# Terminal will prompt for confirmation on each action
```

**Key rules:**
- Never hardcode passwords, API keys, or tokens in scripts -- always use environment variables
- Never log, echo, or print auth tokens, cookies, or session data to stdout/stderr
- Set `chmod 600` on all saved state files immediately after creation
- Store state files in a secure directory (`$HOME/.config/`) rather than world-readable `/tmp/`
- Use `trap 'rm -f "$STATE_FILE"' EXIT` to clean up auth artifacts when the script exits
- Use headed mode (`AGENT_BROWSER_HEADED=1`) for 2FA/MFA flows that require manual interaction
- Use `cookies set` with `--httpOnly --secure` flags for cookie-based session injection — faster than replaying login flows
- Always use `--session-name` (not `--session`) for named session persistence
- Use `cookies` to debug auth failures before re-logging in
- Use `storage local clear` and `cookies clear` in cleanup scripts to force fresh authentication
- Use `--confirm-interactive` for admin panel automation to require manual confirmation on actions
- Use `vault store`/`vault load` (v0.15) for encrypted credential persistence — requires `AGENT_BROWSER_ENCRYPTION_KEY`
- Never echo, log, or pipe `AGENT_BROWSER_ENCRYPTION_KEY` — treat it like a password
- Use `--confirm-actions` (v0.15) for native CLI-level action gating on sensitive operations
- Prefer `vault` over `state save` for auth data — vault encrypts at rest, state files are plaintext JSON
- **v0.17 breaking**: auth encryption format changed — saved auth states from v0.16.x native mode may not load; re-authenticate and re-save
- **v0.18+**: `KERNEL_API_KEY` is now optional (was required) — remove if not using external credential injection
- **v0.21+**: HAR captures contain auth tokens — never commit `.har` files, add to `.gitignore`
- **v0.17+**: auth cookies now persist on browser close — clear cookies explicitly if you need a fresh session

Reference: login flows, the auth vault and state files are upstream, see the `agent-browser` skill. Our delta: `references/ork-delta.md`.


### Use browser debug and recording tools safely to avoid leaking sensitive data in traces — HIGH


## Browser: Debug & Recording

Use trace, profiler, and record commands for debugging and bug reports, but always review output files before sharing — they may contain sensitive data (cookies, tokens, form inputs).

**Incorrect:**
```bash
# Recording a login flow — captures credentials in video/trace
agent-browser trace start
agent-browser open https://app.example.com/login
agent-browser fill @e1 "$EMAIL"
agent-browser fill @e2 "$PASSWORD"
agent-browser click @e3
agent-browser trace stop /tmp/trace.json
# /tmp/trace.json now contains your credentials in cleartext

# Dumping console output without filtering
agent-browser console > /tmp/console.log
# May contain auth tokens, API keys logged by the app

# Sharing errors log without review
agent-browser errors > /tmp/errors.log
git add /tmp/errors.log  # Could contain PII in stack traces
```

**Correct:**
```bash
# Record AFTER authentication (load saved state first)
agent-browser vault load my-session
agent-browser trace start
agent-browser open https://app.example.com/dashboard
# ... perform actions to reproduce bug ...
agent-browser trace stop /tmp/trace.json
# Trace captures only post-auth interactions

# Review console output before saving
agent-browser console  # Review in terminal first
# Only redirect to file after confirming no sensitive data

# Profiler for performance debugging (safe — no credentials)
agent-browser profiler start
agent-browser open https://app.example.com/slow-page
agent-browser wait --load networkidle
agent-browser profiler stop /tmp/profile.json
# Profile contains JS execution data, not credentials

# Record for visual bug reports (after auth)
agent-browser record start /tmp/bug-repro.webm
agent-browser click @e5
agent-browser wait --text "Error"
agent-browser record stop
```

## HAR Network Capture (v0.21+)

HAR files capture full request/response bodies including auth tokens, cookies, and POST payloads. Treat them as sensitive.

**Incorrect:**
```bash
agent-browser network har start
agent-browser open https://app.example.com/login
agent-browser fill @e1 "$EMAIL" && agent-browser fill @e2 "$PASSWORD"
agent-browser network har stop /tmp/full-capture.har
git add /tmp/full-capture.har  # Contains credentials in cleartext!
```

**Correct:**
```bash
# Start HAR AFTER authentication
agent-browser vault load my-session
agent-browser network har start
agent-browser open https://app.example.com/api-page
# ... perform actions to debug ...
agent-browser network har stop /tmp/api-debug.har
# Add *.har to .gitignore — never commit
```

## DevTools Inspect (v0.18+)

The `inspect` command opens a local proxy to Chrome DevTools. This is a new attack surface in shared/CI environments.

```bash
agent-browser inspect          # Opens DevTools proxy on local port
agent-browser get cdp-url      # Returns CDP WebSocket URL for external tools
```

## Clipboard Access (v0.19+)

Clipboard commands access the host clipboard without user interaction — relevant for sandboxed environments.

```bash
agent-browser clipboard read   # Reads host clipboard contents
agent-browser clipboard write "text"
agent-browser clipboard copy   # Copy current selection
agent-browser clipboard paste  # Paste clipboard contents
```

**Key rules:**
- Never trace or record login flows — credentials appear in cleartext in output files
- Load auth state via `vault load` before starting a trace/recording session
- Review `console` and `errors` output in terminal before redirecting to files
- Never commit trace, recording, profile, or HAR files to git repositories
- Use `profiler` for performance analysis — it captures execution timing, not credentials
- Store debug output files in `/tmp/` or ephemeral directories, not project directories
- Scrub trace files before sharing: remove cookies, localStorage, and network payloads
- **HAR files contain auth tokens** — add `*.har` to `.gitignore`, treat as sensitive
- **`inspect` opens DevTools** to local network — only use on trusted machines, not CI/shared envs
- **`clipboard read`** accesses host clipboard without prompt — be aware in sandboxed contexts

Reference: trace, record and profiler commands are upstream, see the `agent-browser` skill. Our delta: `references/ork-delta.md` (capture output is credential bearing).


### Scope mobile browser testing to verified devices and emulation profiles — HIGH


## Browser: Mobile Testing

Use device emulation and iOS Simulator connection for mobile testing, but always verify the device context is active and scope tests to target devices.

**Incorrect:**
```bash
# Assuming device emulation without verifying viewport
agent-browser --device "iPhone 15" open https://app.example.com
agent-browser screenshot /tmp/mobile.png
# Did not verify viewport dimensions — may have fallen back to desktop

# Testing "mobile" without actual device emulation
agent-browser open https://app.example.com
agent-browser eval "window.innerWidth"  # Still 1280px — not mobile!

# Connecting to iOS Simulator without checking it's running
agent-browser --ios-simulator open https://app.example.com
# Fails silently or connects to wrong simulator instance
```

**Correct:**
```bash
# Verify device emulation is active
agent-browser --device "iPhone 15" open https://app.example.com
agent-browser wait --load networkidle
agent-browser eval "JSON.stringify({
  width: window.innerWidth,
  height: window.innerHeight,
  userAgent: navigator.userAgent
})"
# Confirm: width=390, height=844, userAgent contains "iPhone"

# Test dark mode rendering
agent-browser --device "iPhone 15" --color-scheme dark open https://app.example.com
agent-browser screenshot /tmp/mobile-dark.png
agent-browser --color-scheme light open https://app.example.com
agent-browser screenshot /tmp/mobile-light.png

# iOS Simulator — verify simulator is booted first
xcrun simctl list devices | grep "Booted"
agent-browser --ios-simulator open https://app.example.com
agent-browser wait --load networkidle
agent-browser snapshot -i

# Multi-device comparison
for device in "iPhone 15" "iPhone SE" "iPad Pro 11"; do
  agent-browser --device "$device" open https://app.example.com
  agent-browser wait --load networkidle
  agent-browser screenshot "/tmp/test-${device// /-}.png"
done
```

**Key rules:**
- Always verify viewport dimensions after `--device` to confirm emulation is active
- Use `--color-scheme dark` and `--color-scheme light` to test both modes
- Check `xcrun simctl list devices | grep Booted` before using `--ios-simulator`
- Test a minimum of 3 device profiles: small phone, large phone, tablet
- Use `diff screenshot` to compare rendering across devices
- Do not rely solely on emulation — iOS Simulator provides higher-fidelity results for iOS-specific issues

Reference: device emulation and iOS Simulator commands are upstream, see the `agent-browser` skill. Our delta: `references/ork-delta.md`.


### Use Portless named URLs instead of raw port numbers for local dev — HIGH


## Browser: Portless Local Dev URLs

Use Portless named `.localhost` URLs instead of guessing port numbers. Named URLs are stable across restarts, self-documenting, and eliminate the #1 source of local dev connection failures.

**Incorrect:**
```bash
# Guessing ports — fragile, ambiguous, breaks across restarts
agent-browser open "http://localhost:3000"        # which app is this?
agent-browser open "http://localhost:8080"        # API? frontend? storybook?
curl http://localhost:5173/api/health             # port changed after restart

# Hardcoding ports in reproduction steps
agent-browser screenshot /tmp/bug.png             # of which service?
agent-browser network log                         # on which port?
```

**Correct:**
```bash
# Discover services first
portless list
# api    → api.localhost    (port 8080)
# app    → app.localhost    (port 3000)
# docs   → docs.localhost   (port 3001)

# Use named URLs — stable, self-documenting
agent-browser open "https://app.localhost"
agent-browser screenshot /tmp/app-bug.png

# API calls with named URLs
curl https://api.localhost/api/health

# Visual debugging with agent-browser + Portless
agent-browser open "https://app.localhost/settings"
agent-browser console                             # check JS errors
agent-browser network log                         # inspect API calls
agent-browser screenshot /tmp/settings-broken.png # evidence for report

# E2E testing with stable base URL
PLAYWRIGHT_BASE_URL="https://app.localhost" npx playwright test
```

## Portless v0.5+ Features

```bash
# portless run — auto-infer project name, inject --port flag
portless run npm run dev
# Starts dev server AND assigns it a named URL automatically

# portless alias — assign named URLs to existing services (not started by portless)
portless alias redis 6379

# portless get — retrieve the URL for a named service
portless get app  # → https://app.localhost

# PORTLESS_URL env var — injected automatically in portless run
# Your app can read process.env.PORTLESS_URL to know its own named URL

# HTTPS by default (since v0.10) — auto-generated TLS certs, served on port 443 with HTTP/2
# Named URLs are https://<name>.localhost (no port). Pre-0.10 used http://<name>.localhost:1355
```

**Key rules:**
- Always run `portless list` before constructing any localhost URL
- Use `*.localhost` URLs in all agent-browser commands, curl calls, and test configs
- Include the Portless service name in screenshots and debug reports for clarity
- Prefer `portless run` (v0.5+) over manual port management — it injects `--port` and `PORTLESS_URL` automatically
- Use `portless alias` (v0.5+) for services not started by portless (databases, queues)
- Use `portless get &lt;name&gt;` (v0.6+) to programmatically retrieve URLs in scripts
- If Portless is not installed, fall back to `lsof -iTCP -sTCP:LISTEN -nP` to discover ports
- The OrchestKit safety hook allows `*.localhost` subdomains via `ORCHESTKIT_AGENT_BROWSER_ALLOW_LOCALHOST`
- Install Portless globally: `npm i -g portless`


### Throttle browser requests to avoid 429 blocks, IP bans, and unreliable results — HIGH


## Browser: Rate Limiting

Add delays between requests, implement exponential backoff on rate-limit responses (429/503), and limit concurrent connections to avoid overwhelming target servers.

**Incorrect:**
```bash
# Rapid-fire requests with no delay
for url in "${URLS[@]}"; do
    agent-browser open "$url"
    agent-browser get text body > "/tmp/$(basename "$url").txt"
done
# No delay, no wait, no rate-limit detection — will trigger 429 blocks
```

**Correct:**
```bash
# Adaptive rate limiting with exponential backoff
DELAY=1

for url in "${URLS[@]}"; do
    agent-browser open "$url"
    agent-browser wait --load networkidle

    STATUS=$(agent-browser eval "
        const h1 = document.querySelector('h1');
        if (h1 && (h1.innerText.includes('429') || h1.innerText.includes('Too Many'))) {
            'rate-limited';
        } else if (document.title.includes('Access Denied')) {
            'blocked';
        } else { 'ok'; }
    ")

    case "$STATUS" in
        "rate-limited")
            DELAY=$((DELAY * 2)); sleep $DELAY; continue ;;
        "blocked")
            echo "Access denied: $url"; continue ;;
        *)
            agent-browser get text body > "/tmp/$(basename "$url").txt"
            DELAY=1 ;;  # Reset delay on success
    esac
    sleep $DELAY
done
```

```bash
# Retry with exponential backoff (max 3 attempts)
fetch_with_retry() {
    local url="$1" output="$2" max_retries=3 retry=0 delay=1
    while [[ $retry -lt $max_retries ]]; do
        if agent-browser open "$url" 2>/dev/null; then
            agent-browser wait --load networkidle
            agent-browser get text body > "$output"
            [[ -s "$output" ]] && return 0
        fi
        ((retry++))
        echo "Retry $retry/$max_retries for: $url (waiting ${delay}s)"
        sleep $delay
        delay=$((delay * 2))
    done
    echo "Failed after $max_retries retries: $url" >> /tmp/failed-urls.txt
    return 1
}
```

```bash
# Block non-essential traffic to reduce request count (v0.13)
# Analytics, tracking, and ad requests waste rate-limit budget
agent-browser network route "*google-analytics*" --abort
agent-browser network route "*facebook.net/tr*" --abort
agent-browser network route "*doubleclick.net*" --abort
agent-browser network route "*hotjar*" --abort

# Extract content without tracker overhead
agent-browser open "$url"
agent-browser wait --load networkidle
agent-browser get text @e5

# Clean up routes after extraction
agent-browser network unroute
```

```bash
# Clear tracked request log between test runs
agent-browser network requests --clear    # Reset tracked request log
```

**Key rules:**
- Always add at least a 1-second delay between consecutive page requests
- Detect rate-limit responses (429, "Too Many Requests", "Access Denied") and back off exponentially
- Reset the backoff delay to baseline after a successful request
- Use a retry function with a max retry count and exponential backoff for failed pages
- Log failed URLs to a separate file instead of silently skipping them
- Block analytics and tracking scripts with `network route --abort` to preserve rate-limit budget and speed up page loads
- Always call `network unroute` after extraction to clean up intercepts
- Use `network requests --clear` between test runs to avoid stale request data
- Use `--allowed-domains` (v0.16) to restrict navigation to approved domains — prevents accidental crawl escapes
- Use `--action-policy &lt;path&gt;` (v0.16) to enforce a JSON policy file governing which actions are permitted
- Use `--max-output &lt;bytes&gt;` (v0.16) to cap command output size — prevents context window blowup from large pages

Reference: `references/ork-delta.md` (the rate-limit budget is per hostname and shared machine-wide).


### Respect robots.txt and terms of service to avoid legal issues and IP bans — CRITICAL


## Browser: Scraping Ethics

Always scrape responsibly: check robots.txt, comply with Terms of Service, identify yourself as an automated agent, and never scrape personal or auth-gated data without explicit permission.

**Incorrect:**
```bash
# Ignoring robots.txt entirely
agent-browser open https://example.com/private-api/users
agent-browser get text body > /tmp/users.txt

# Spoofing user-agent to appear as a real browser
agent-browser eval "
  Object.defineProperty(navigator, 'userAgent', {
    get: () => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/120'
  });
"

# Scraping auth-gated content without permission
agent-browser state load /tmp/stolen-session.json
agent-browser open https://app.example.com/admin/user-data
agent-browser get text body > /tmp/scraped-pii.txt
```

**Correct:**
```bash
# 1. Check robots.txt BEFORE crawling any site
ROBOTS=$(curl -s "https://docs.example.com/robots.txt")

if echo "$ROBOTS" | grep -q "Disallow: /docs"; then
    echo "Crawling /docs is disallowed by robots.txt"
    exit 1
fi

# 2. Parse and respect crawl-delay directives
CRAWL_DELAY=$(echo "$ROBOTS" | grep -i "Crawl-delay" | head -1 | awk '{print $2}')
DELAY=${CRAWL_DELAY:-1}  # Default to 1 second if not specified

# 3. Use an identifiable user-agent string
# (agent-browser identifies itself by default — do NOT override it)

# 4. Only scrape publicly accessible, non-personal content
agent-browser open "https://docs.example.com/public/guide"
agent-browser wait --load networkidle
agent-browser get text @e5  # Extract specific content area, not full page
```

**Key rules:**
- Always check `robots.txt` before crawling any domain and honor `Disallow` directives
- Respect `Crawl-delay` values; default to at least 1 second between requests
- Never spoof user-agent strings to bypass bot detection -- identify as an automated tool
- Do not scrape personal data, auth-gated content, or content behind paywalls without explicit authorization
- Comply with the site's Terms of Service; when in doubt, do not scrape
- Use targeted extraction (`get text @e#`) instead of full-page dumps to minimize data collection
- Use `--user-agent` (v0.16) only to identify your automation — never to spoof a real browser identity
- Use `--max-output` (v0.16) to limit extracted content size and reduce data over-collection
- Respect `--allowed-domains` (v0.16) to scope crawls — prevents accidentally following links to unrelated sites

Reference: robots.txt enforcement is done by the `agent-browser-safety` hook, see `references/ork-delta.md` for the commands it does and does not cover.



---

## References (6)

### Browser Tools: the OrchestKit delta over agent-browser


# OrchestKit delta: agent-browser

Commands, flags, snapshot and ref loops, Electron CDP attach, Slack navigation,
Vercel Sandbox wiring and the dogfood report workflow are upstream's job. See
the "Upstream coverage (do not restate)" table in `SKILL.md` for where each of
those lives. This file carries only what OrchestKit adds, contradicts, or has
to warn about.

## Assume ZERO safety-hook coverage for any agent-browser run that is not a local Bash command

Why: `src/hooks/src/pretool/bash/agent-browser-safety.ts:471` returns silently
unless the Bash command string matches `agent-browser`. A Vercel Sandbox run
executes the CLI inside the microVM via `sandbox.runCommand(...)`, and `--mcp`
speaks stdio to an MCP client, so neither ever reaches the PreToolUse Bash hook.
URL blocklist, rate limiting and robots.txt enforcement are all absent on those
paths and have to be re-imposed at the sandbox or MCP-client layer. Distilled
from the retired upstream-sandbox reference; no traced incident.
Upstream: `vercel:vercel-sandbox` skill, and
https://github.com/vercel-labs/agent-browser/blob/main/skill-data/vercel-sandbox/SKILL.md

## Reach a new origin with open, goto or navigate if you want it policed

Why: `extractUrl` (same hook file, lines 417-420) matches only
`(navigate|goto|open) &lt;url&gt;`, and the blocklist, rate-limit and robots checks
(lines 489-544) each early-exit when it returns null. So `read &lt;url&gt;`,
`a11y &lt;url&gt;`, `vitals &lt;url&gt;`, `diff url <a> &lt;b&gt;`, `connect &lt;port&gt;` and
`--cdp &lt;port&gt;` skip all three checks: they are policy holes, not approvals.
Distilled from the retired browser-snapshot-workflow rule; no traced
incident.
Upstream: `agent-browser` skill, and
https://github.com/vercel-labs/agent-browser/blob/main/skills/agent-browser/SKILL.md

## Budget navigations per host: the rate limiter is machine-wide, not per session

Why: house limits are 10 per minute, 100 per hour and 3 per 3 seconds per
hostname (issue #318, "Add rate limiting to agent-browser-safety hook"), and
`checkRateLimit` persists timestamps to one `rate-limits.json` under the log
dir keyed only by domain (hook lines 122-215). Parallel sessions, worktrees and
sub-agents therefore draw from the same budget, and a page-by-page sweep of a
single host (the upstream dogfood workflow) hits the per-minute wall long
before it finishes. Raise `AGENT_BROWSER_RATE_LIMIT_PER_MIN` and
`AGENT_BROWSER_RATE_LIMIT_PER_HOUR` deliberately instead of retrying into a
block.
Upstream: `dogfood` skill, and
https://github.com/vercel-labs/agent-browser/blob/main/skill-data/dogfood/SKILL.md

## Local targets are allowed by default; name them with portless, not a port

Why: `ORCHESTKIT_AGENT_BROWSER_ALLOW_LOCALHOST` defaults to on and clears
`localhost`, `127.0.0.1` and `*.localhost` before the blocklist runs (hook
lines 431-437, introduced by commit 48ab54b64, PR #950, the v7.1.0 agent-browser
CLI adoption). Local dev URLs therefore work out of the box, and setting the
variable to `0` re-blocks every one of them at once. (Electron and desktop CDP
attach are unaffected either way: `connect &lt;port&gt;` carries no URL to check.) A named
`https://&lt;app&gt;.localhost` from portless survives a port change and tells the
next reader which app was under test.
Upstream: `ork:portless` skill, and https://github.com/vercel-labs/portless

## Keep page-derived output targeted, verified, and out of the repo

Why: house convention behind the anti-pattern list in `SKILL.md`. Extract
through a ref (`get text @e5`) rather than dumping `get text body`, confirm the
result is non-empty before saving it (a blank capture looks like a successful
one), and treat HAR captures, React fiber dumps and traces as credential
bearing: write them under /tmp and never `git add` them. Distilled from the
retired browser-snapshot-workflow rule; no traced incident.
Upstream: `agent-browser` skill (snapshot, get, network har, react commands), and
https://github.com/vercel-labs/agent-browser/blob/main/skills/agent-browser/SKILL.md


### Upstream Dogfood

&lt;!-- SYNCED from vercel-labs/agent-browser (skills/dogfood/SKILL.md) --&gt;
&lt;!-- Hash: 1cf732e6c7eb668ffac12c97add17459f8b633ffc1c40a111f54456a2a3d9afb --&gt;
&lt;!-- Re-sync: bash scripts/sync-vercel-skills.sh --&gt;


# Dogfood

Systematically explore a web application, find issues, and produce a report with full reproduction evidence for every finding.

## Setup

Only the **Target URL** is required. Everything else has sensible defaults -- use them unless the user explicitly provides an override.

| Parameter | Default | Example override |
|-----------|---------|-----------------|
| **Target URL** | _(required)_ | `vercel.com`, `http://localhost:3000` |
| **Session name** | Slugified domain (e.g., `vercel.com` -> `vercel-com`) | `--session my-session` |
| **Output directory** | `./dogfood-output/` | `Output directory: /tmp/qa` |
| **Scope** | Full app | `Focus on the billing page` |
| **Authentication** | None | `Sign in to user@example.com` |

If the user says something like "dogfood vercel.com", start immediately with defaults. Do not ask clarifying questions unless authentication is mentioned but credentials are missing.

Always use `agent-browser` directly -- never `npx agent-browser`. The direct binary uses the fast Rust client. `npx` routes through Node.js and is significantly slower.

## Workflow

```
1. Initialize    Set up session, output dirs, report file
2. Authenticate  Sign in if needed, save state
3. Orient        Navigate to starting point, take initial snapshot
4. Explore       Systematically visit pages and test features
5. Document      Screenshot + record each issue as found
6. Wrap up       Update summary counts, close session
```

### 1. Initialize

```bash
mkdir -p {OUTPUT_DIR}/screenshots {OUTPUT_DIR}/videos
```

Copy the report template into the output directory and fill in the header fields:

```bash
cp {SKILL_DIR}/templates/dogfood-report-template.md {OUTPUT_DIR}/report.md
```

Start a named session:

```bash
agent-browser --session {SESSION} open {TARGET_URL}
agent-browser --session {SESSION} wait --load networkidle
```

### 2. Authenticate

If the app requires login:

```bash
agent-browser --session {SESSION} snapshot -i
# Identify login form refs, fill credentials
agent-browser --session {SESSION} fill @e1 "{EMAIL}"
agent-browser --session {SESSION} fill @e2 "{PASSWORD}"
agent-browser --session {SESSION} click @e3
agent-browser --session {SESSION} wait --load networkidle
```

For OTP/email codes: ask the user, wait for their response, then enter the code.

After successful login, save state for potential reuse:

```bash
agent-browser --session {SESSION} state save {OUTPUT_DIR}/auth-state.json
```

### 3. Orient

Take an initial annotated screenshot and snapshot to understand the app structure:

```bash
agent-browser --session {SESSION} screenshot --annotate {OUTPUT_DIR}/screenshots/initial.png
agent-browser --session {SESSION} snapshot -i
```

Identify the main navigation elements and map out the sections to visit.

### 4. Explore

Read [references/issue-taxonomy.md](references/issue-taxonomy.md) for the full list of what to look for and the exploration checklist.

**Strategy -- work through the app systematically:**

- Start from the main navigation. Visit each top-level section.
- Within each section, test interactive elements: click buttons, fill forms, open dropdowns/modals.
- Check edge cases: empty states, error handling, boundary inputs.
- Try realistic end-to-end workflows (create, edit, delete flows).
- Check the browser console for errors periodically.

**At each page:**

```bash
agent-browser --session {SESSION} snapshot -i
agent-browser --session {SESSION} screenshot --annotate {OUTPUT_DIR}/screenshots/{page-name}.png
agent-browser --session {SESSION} errors
agent-browser --session {SESSION} console
```

Use your judgment on how deep to go. Spend more time on core features and less on peripheral pages. If you find a cluster of issues in one area, investigate deeper.

### 5. Document Issues (Repro-First)

Steps 4 and 5 happen together -- explore and document in a single pass. When you find an issue, stop exploring and document it immediately before moving on. Do not explore the whole app first and document later.

Every issue must be reproducible. When you find something wrong, do not just note it -- prove it with evidence. The goal is that someone reading the report can see exactly what happened and replay it.

**Choose the right level of evidence for the issue:**

#### Interactive / behavioral issues (functional, ux, console errors on action)

These require user interaction to reproduce -- use full repro with video and step-by-step screenshots:

1. **Start a repro video** _before_ reproducing:

```bash
agent-browser --session {SESSION} record start {OUTPUT_DIR}/videos/issue-{NNN}-repro.webm
```

2. **Walk through the steps at human pace.** Pause 1-2 seconds between actions so the video is watchable. Take a screenshot at each step:

```bash
agent-browser --session {SESSION} screenshot {OUTPUT_DIR}/screenshots/issue-{NNN}-step-1.png
sleep 1
# Perform action (click, fill, etc.)
sleep 1
agent-browser --session {SESSION} screenshot {OUTPUT_DIR}/screenshots/issue-{NNN}-step-2.png
sleep 1
# ...continue until the issue manifests
```

3. **Capture the broken state.** Pause so the viewer can see it, then take an annotated screenshot:

```bash
sleep 2
agent-browser --session {SESSION} screenshot --annotate {OUTPUT_DIR}/screenshots/issue-{NNN}-result.png
```

4. **Stop the video:**

```bash
agent-browser --session {SESSION} record stop
```

5. Write numbered repro steps in the report, each referencing its screenshot.

#### Static / visible-on-load issues (typos, placeholder text, clipped text, misalignment, console errors on load)

These are visible without interaction -- a single annotated screenshot is sufficient. No video, no multi-step repro:

```bash
agent-browser --session {SESSION} screenshot --annotate {OUTPUT_DIR}/screenshots/issue-{NNN}.png
```

Write a brief description and reference the screenshot in the report. Set **Repro Video** to `N/A`.


**For all issues:**

1. **Append to the report immediately.** Do not batch issues for later. Write each one as you find it so nothing is lost if the session is interrupted.

2. **Increment the issue counter** (ISSUE-001, ISSUE-002, ...).

### 6. Wrap Up

Aim to find **5-10 well-documented issues**, then wrap up. Depth of evidence matters more than total count -- 5 issues with full repro beats 20 with vague descriptions.

After exploring:

1. Re-read the report and update the summary severity counts so they match the actual issues. Every `### ISSUE-` block must be reflected in the totals.
2. Close the session:

```bash
agent-browser --session {SESSION} close
```

3. Tell the user the report is ready and summarize findings: total issues, breakdown by severity, and the most critical items.

## Guidance

- **Repro is everything.** Every issue needs proof -- but match the evidence to the issue. Interactive bugs need video and step-by-step screenshots. Static bugs (typos, placeholder text, visual glitches visible on load) only need a single annotated screenshot.
- **Verify reproducibility before collecting evidence.** Before recording video or taking screenshots, verify the issue is reproducible with at least one retry. If it can't be reproduced consistently, it's not a valid issue.
- **Don't record video for static issues.** A typo or clipped text doesn't benefit from a video. Save video for issues that involve user interaction, timing, or state changes.
- **For interactive issues, screenshot each step.** Capture the before, the action, and the after -- so someone can see the full sequence.
- **Write repro steps that map to screenshots.** Each numbered step in the report should reference its corresponding screenshot. A reader should be able to follow the steps visually without touching a browser.
- **Use the right snapshot command.**
  - `snapshot -i` — for finding clickable/fillable elements (buttons, inputs, links)
  - `snapshot` (no flag) — for reading page content (text, headings, data lists)
- **Be thorough but use judgment.** You are not following a test script -- you are exploring like a real user would. If something feels off, investigate.
- **Write findings incrementally.** Append each issue to the report as you discover it. If the session is interrupted, findings are preserved. Never batch all issues for the end.
- **Never delete output files.** Do not `rm` screenshots, videos, or the report mid-session. Do not close the session and restart. Work forward, not backward.
- **Never read the target app's source code.** You are testing as a user, not auditing code. Do not read HTML, JS, or config files of the app under test. All findings must come from what you observe in the browser.
- **Check the console.** Many issues are invisible in the UI but show up as JS errors or failed requests.
- **Test like a user, not a robot.** Try common workflows end-to-end. Click things a real user would click. Enter realistic data.
- **Type like a human.** When filling form fields during video recording, use `type` instead of `fill` -- it types character-by-character. Use `fill` only outside of video recording when speed matters.
- **Pace repro videos for humans.** Add `sleep 1` between actions and `sleep 2` before the final result screenshot. Videos should be watchable at 1x speed -- a human reviewing the report needs to see what happened, not a blur of instant state changes.
- **Be efficient with commands.** Batch multiple `agent-browser` commands in a single shell call when they are independent (e.g., `agent-browser ... screenshot ... && agent-browser ... console`). Use `agent-browser --session \{SESSION\} scroll down 300` for scrolling -- do not use `key` or `evaluate` to scroll.

## References

| Reference | When to Read |
|-----------|--------------|
| [references/issue-taxonomy.md](references/issue-taxonomy.md) | Start of session -- calibrate what to look for, severity levels, exploration checklist |

## Templates

| Template | Purpose |
|----------|---------|
| [templates/dogfood-report-template.md](templates/dogfood-report-template.md) | Copy into output directory as the report file |


### Upstream Electron

&lt;!-- SYNCED from vercel-labs/agent-browser (skills/electron/SKILL.md) --&gt;
&lt;!-- Hash: 805f619998c2a36bef6899dd9dee974fd227afa3f22d08601d8cff097579d331 --&gt;
&lt;!-- Re-sync: bash scripts/sync-vercel-skills.sh --&gt;


# Electron App Automation

Automate any Electron desktop app using agent-browser. Electron apps are built on Chromium and expose a Chrome DevTools Protocol (CDP) port that agent-browser can connect to, enabling the same snapshot-interact workflow used for web pages.

## Core Workflow

1. **Launch** the Electron app with remote debugging enabled
2. **Connect** agent-browser to the CDP port
3. **Snapshot** to discover interactive elements
4. **Interact** using element refs
5. **Re-snapshot** after navigation or state changes

```bash
# Launch an Electron app with remote debugging
open -a "Slack" --args --remote-debugging-port=9222

# Connect agent-browser to the app
agent-browser connect 9222

# Standard workflow from here
agent-browser snapshot -i
agent-browser click @e5
agent-browser screenshot slack-desktop.png
```

## Launching Electron Apps with CDP

Every Electron app supports the `--remote-debugging-port` flag since it's built into Chromium.

### macOS

```bash
# Slack
open -a "Slack" --args --remote-debugging-port=9222

# VS Code
open -a "Visual Studio Code" --args --remote-debugging-port=9223

# Discord
open -a "Discord" --args --remote-debugging-port=9224

# Figma
open -a "Figma" --args --remote-debugging-port=9225

# Notion
open -a "Notion" --args --remote-debugging-port=9226

# Spotify
open -a "Spotify" --args --remote-debugging-port=9227
```

### Linux

```bash
slack --remote-debugging-port=9222
code --remote-debugging-port=9223
discord --remote-debugging-port=9224
```

### Windows

```bash
"C:\Users\%USERNAME%\AppData\Local\slack\slack.exe" --remote-debugging-port=9222
"C:\Users\%USERNAME%\AppData\Local\Programs\Microsoft VS Code\Code.exe" --remote-debugging-port=9223
```

**Important:** If the app is already running, quit it first, then relaunch with the flag. The `--remote-debugging-port` flag must be present at launch time.

## Connecting

```bash
# Connect to a specific port
agent-browser connect 9222

# Or use --cdp on each command
agent-browser --cdp 9222 snapshot -i

# Auto-discover a running Chromium-based app
agent-browser --auto-connect snapshot -i
```

After `connect`, all subsequent commands target the connected app without needing `--cdp`.

## Tab Management

Electron apps often have multiple windows or webviews. Use tab commands to list and switch between them:

```bash
# List all available targets (windows, webviews, etc.)
agent-browser tab

# Switch to a specific tab by index
agent-browser tab 2

# Switch by URL pattern
agent-browser tab --url "*settings*"
```

## Webview Support

Electron `&lt;webview&gt;` elements are automatically discovered and can be controlled like regular pages. Webviews appear as separate targets in the tab list with `type: "webview"`:

```bash
# Connect to running Electron app
agent-browser connect 9222

# List targets -- webviews appear alongside pages
agent-browser tab
# Example output:
#   0: [page]    Slack - Main Window     https://app.slack.com/
#   1: [webview] Embedded Content        https://example.com/widget

# Switch to a webview
agent-browser tab 1

# Interact with the webview normally
agent-browser snapshot -i
agent-browser click @e3
agent-browser screenshot webview.png
```

**Note:** Webview support works via raw CDP connection.

## Common Patterns

### Inspect and Navigate an App

```bash
open -a "Slack" --args --remote-debugging-port=9222
sleep 3  # Wait for app to start
agent-browser connect 9222
agent-browser snapshot -i
# Read the snapshot output to identify UI elements
agent-browser click @e10  # Navigate to a section
agent-browser snapshot -i  # Re-snapshot after navigation
```

### Take Screenshots of Desktop Apps

```bash
agent-browser connect 9222
agent-browser screenshot app-state.png
agent-browser screenshot --full full-app.png
agent-browser screenshot --annotate annotated-app.png
```

### Extract Data from a Desktop App

```bash
agent-browser connect 9222
agent-browser snapshot -i
agent-browser get text @e5
agent-browser snapshot --json > app-state.json
```

### Fill Forms in Desktop Apps

```bash
agent-browser connect 9222
agent-browser snapshot -i
agent-browser fill @e3 "search query"
agent-browser press Enter
agent-browser wait 1000
agent-browser snapshot -i
```

### Run Multiple Apps Simultaneously

Use named sessions to control multiple Electron apps at the same time:

```bash
# Connect to Slack
agent-browser --session slack connect 9222

# Connect to VS Code
agent-browser --session vscode connect 9223

# Interact with each independently
agent-browser --session slack snapshot -i
agent-browser --session vscode snapshot -i
```

## Color Scheme

The default color scheme when connecting via CDP may be `light`. To preserve dark mode:

```bash
agent-browser connect 9222
agent-browser --color-scheme dark snapshot -i
```

Or set it globally:

```bash
AGENT_BROWSER_COLOR_SCHEME=dark agent-browser connect 9222
```

## Troubleshooting

### "Connection refused" or "Cannot connect"

- Make sure the app was launched with `--remote-debugging-port=NNNN`
- If the app was already running, quit and relaunch with the flag
- Check that the port isn't in use by another process: `lsof -i :9222`

### App launches but connect fails

- Wait a few seconds after launch before connecting (`sleep 3`)
- Some apps take time to initialize their webview

### Elements not appearing in snapshot

- The app may use multiple webviews. Use `agent-browser tab` to list targets and switch to the right one

### Cannot type in input fields

- Try `agent-browser keyboard type "text"` to type at the current focus without a selector
- Some Electron apps use custom input components; use `agent-browser keyboard inserttext "text"` to bypass key events

## Supported Apps

Any app built on Electron works, including:

- **Communication:** Slack, Discord, Microsoft Teams, Signal, Telegram Desktop
- **Development:** VS Code, GitHub Desktop, Postman, Insomnia
- **Design:** Figma, Notion, Obsidian
- **Media:** Spotify, Tidal
- **Productivity:** Todoist, Linear, 1Password

If an app is built with Electron, it supports `--remote-debugging-port` and can be automated with agent-browser.


### Upstream Sandbox

&lt;!-- SYNCED from vercel-labs/agent-browser (skills/vercel-sandbox/SKILL.md) --&gt;
&lt;!-- Hash: 7e1b39b7ebb57b9e416722e740a6a21c461d114f1b58aecab40fa1f9e4498e71 --&gt;
&lt;!-- Re-sync: bash scripts/sync-vercel-skills.sh --&gt;


# Browser Automation with Vercel Sandbox

Run agent-browser + headless Chrome inside ephemeral Vercel Sandbox microVMs. A Linux VM spins up on demand, executes browser commands, and shuts down. Works with any Vercel-deployed framework (Next.js, SvelteKit, Nuxt, Remix, Astro, etc.).

## Dependencies

```bash
pnpm add @vercel/sandbox
```

The sandbox VM needs system dependencies for Chromium plus agent-browser itself. Use sandbox snapshots (below) to pre-install everything for sub-second startup.

## Core Pattern

```ts
import { Sandbox } from "@vercel/sandbox";

// System libraries required by Chromium on the sandbox VM (Amazon Linux / dnf)
const CHROMIUM_SYSTEM_DEPS = [
  "nss", "nspr", "libxkbcommon", "atk", "at-spi2-atk", "at-spi2-core",
  "libXcomposite", "libXdamage", "libXrandr", "libXfixes", "libXcursor",
  "libXi", "libXtst", "libXScrnSaver", "libXext", "mesa-libgbm", "libdrm",
  "mesa-libGL", "mesa-libEGL", "cups-libs", "alsa-lib", "pango", "cairo",
  "gtk3", "dbus-libs",
];

function getSandboxCredentials() {
  if (
    process.env.VERCEL_TOKEN &&
    process.env.VERCEL_TEAM_ID &&
    process.env.VERCEL_PROJECT_ID
  ) {
    return {
      token: process.env.VERCEL_TOKEN,
      teamId: process.env.VERCEL_TEAM_ID,
      projectId: process.env.VERCEL_PROJECT_ID,
    };
  }
  return {};
}

async function withBrowser<T>(
  fn: (sandbox: InstanceType<typeof Sandbox>) => Promise<T>,
): Promise<T> {
  const snapshotId = process.env.AGENT_BROWSER_SNAPSHOT_ID;
  const credentials = getSandboxCredentials();

  const sandbox = snapshotId
    ? await Sandbox.create({
        ...credentials,
        source: { type: "snapshot", snapshotId },
        timeout: 120_000,
      })
    : await Sandbox.create({ ...credentials, runtime: "node24", timeout: 120_000 });

  if (!snapshotId) {
    await sandbox.runCommand("sh", [
      "-c",
      `sudo dnf clean all 2>&1 && sudo dnf install -y --skip-broken ${CHROMIUM_SYSTEM_DEPS.join(" ")} 2>&1 && sudo ldconfig 2>&1`,
    ]);
    await sandbox.runCommand("npm", ["install", "-g", "agent-browser"]);
    await sandbox.runCommand("npx", ["agent-browser", "install"]);
  }

  try {
    return await fn(sandbox);
  } finally {
    await sandbox.stop();
  }
}
```

## Screenshot

The `screenshot --json` command saves to a file and returns the path. Read the file back as base64:

```ts
export async function screenshotUrl(url: string) {
  return withBrowser(async (sandbox) => {
    await sandbox.runCommand("agent-browser", ["open", url]);

    const titleResult = await sandbox.runCommand("agent-browser", [
      "get", "title", "--json",
    ]);
    const title = JSON.parse(await titleResult.stdout())?.data?.title || url;

    const ssResult = await sandbox.runCommand("agent-browser", [
      "screenshot", "--json",
    ]);
    const ssPath = JSON.parse(await ssResult.stdout())?.data?.path;
    const b64Result = await sandbox.runCommand("base64", ["-w", "0", ssPath]);
    const screenshot = (await b64Result.stdout()).trim();

    await sandbox.runCommand("agent-browser", ["close"]);

    return { title, screenshot };
  });
}
```

## Accessibility Snapshot

```ts
export async function snapshotUrl(url: string) {
  return withBrowser(async (sandbox) => {
    await sandbox.runCommand("agent-browser", ["open", url]);

    const titleResult = await sandbox.runCommand("agent-browser", [
      "get", "title", "--json",
    ]);
    const title = JSON.parse(await titleResult.stdout())?.data?.title || url;

    const snapResult = await sandbox.runCommand("agent-browser", [
      "snapshot", "-i", "-c",
    ]);
    const snapshot = await snapResult.stdout();

    await sandbox.runCommand("agent-browser", ["close"]);

    return { title, snapshot };
  });
}
```

## Multi-Step Workflows

The sandbox persists between commands, so you can run full automation sequences:

```ts
export async function fillAndSubmitForm(url: string, data: Record<string, string>) {
  return withBrowser(async (sandbox) => {
    await sandbox.runCommand("agent-browser", ["open", url]);

    const snapResult = await sandbox.runCommand("agent-browser", [
      "snapshot", "-i",
    ]);
    const snapshot = await snapResult.stdout();
    // Parse snapshot to find element refs...

    for (const [ref, value] of Object.entries(data)) {
      await sandbox.runCommand("agent-browser", ["fill", ref, value]);
    }

    await sandbox.runCommand("agent-browser", ["click", "@e5"]);
    await sandbox.runCommand("agent-browser", ["wait", "--load", "networkidle"]);

    const ssResult = await sandbox.runCommand("agent-browser", [
      "screenshot", "--json",
    ]);
    const ssPath = JSON.parse(await ssResult.stdout())?.data?.path;
    const b64Result = await sandbox.runCommand("base64", ["-w", "0", ssPath]);
    const screenshot = (await b64Result.stdout()).trim();

    await sandbox.runCommand("agent-browser", ["close"]);

    return { screenshot };
  });
}
```

## Sandbox Snapshots (Fast Startup)

A **sandbox snapshot** is a saved VM image of a Vercel Sandbox with system dependencies + agent-browser + Chromium already installed. Think of it like a Docker image -- instead of installing dependencies from scratch every time, the sandbox boots from the pre-built image.

This is unrelated to agent-browser's *accessibility snapshot* feature (`agent-browser snapshot`), which dumps a page's accessibility tree. A sandbox snapshot is a Vercel infrastructure concept for fast VM startup.

Without a sandbox snapshot, each run installs system deps + agent-browser + Chromium (~30s). With one, startup is sub-second.

### Creating a sandbox snapshot

The snapshot must include system dependencies (via `dnf`), agent-browser, and Chromium:

```ts
import { Sandbox } from "@vercel/sandbox";

const CHROMIUM_SYSTEM_DEPS = [
  "nss", "nspr", "libxkbcommon", "atk", "at-spi2-atk", "at-spi2-core",
  "libXcomposite", "libXdamage", "libXrandr", "libXfixes", "libXcursor",
  "libXi", "libXtst", "libXScrnSaver", "libXext", "mesa-libgbm", "libdrm",
  "mesa-libGL", "mesa-libEGL", "cups-libs", "alsa-lib", "pango", "cairo",
  "gtk3", "dbus-libs",
];

async function createSnapshot(): Promise<string> {
  const sandbox = await Sandbox.create({
    runtime: "node24",
    timeout: 300_000,
  });

  await sandbox.runCommand("sh", [
    "-c",
    `sudo dnf clean all 2>&1 && sudo dnf install -y --skip-broken ${CHROMIUM_SYSTEM_DEPS.join(" ")} 2>&1 && sudo ldconfig 2>&1`,
  ]);
  await sandbox.runCommand("npm", ["install", "-g", "agent-browser"]);
  await sandbox.runCommand("npx", ["agent-browser", "install"]);

  const snapshot = await sandbox.snapshot();
  return snapshot.snapshotId;
}
```

Run this once, then set the environment variable:

```bash
AGENT_BROWSER_SNAPSHOT_ID=snap_xxxxxxxxxxxx
```

A helper script is available in the demo app:

```bash
npx tsx examples/environments/scripts/create-snapshot.ts
```

Recommended for any production deployment using the Sandbox pattern.

## Authentication

On Vercel deployments, the Sandbox SDK authenticates automatically via OIDC. For local development or explicit control, set:

```bash
VERCEL_TOKEN=<personal-access-token>
VERCEL_TEAM_ID=<team-id>
VERCEL_PROJECT_ID=<project-id>
```

These are spread into `Sandbox.create()` calls. When absent, the SDK falls back to `VERCEL_OIDC_TOKEN` (automatic on Vercel).

## Scheduled Workflows (Cron)

Combine with Vercel Cron Jobs for recurring browser tasks:

```ts
// app/api/cron/route.ts  (or equivalent in your framework)
export async function GET() {
  const result = await withBrowser(async (sandbox) => {
    await sandbox.runCommand("agent-browser", ["open", "https://example.com/pricing"]);
    const snap = await sandbox.runCommand("agent-browser", ["snapshot", "-i", "-c"]);
    await sandbox.runCommand("agent-browser", ["close"]);
    return await snap.stdout();
  });

  // Process results, send alerts, store data...
  return Response.json({ ok: true, snapshot: result });
}
```

```json
// vercel.json
{ "crons": [{ "path": "/api/cron", "schedule": "0 9 * * *" }] }
```

## Environment Variables

| Variable | Required | Description |
|---|---|---|
| `AGENT_BROWSER_SNAPSHOT_ID` | No (but recommended) | Pre-built sandbox snapshot ID for sub-second startup (see above) |
| `VERCEL_TOKEN` | No | Vercel personal access token (for local dev; OIDC is automatic on Vercel) |
| `VERCEL_TEAM_ID` | No | Vercel team ID (for local dev) |
| `VERCEL_PROJECT_ID` | No | Vercel project ID (for local dev) |

## Framework Examples

The pattern works identically across frameworks. The only difference is where you put the server-side code:

| Framework | Server code location |
|---|---|
| Next.js | Server actions, API routes, route handlers |
| SvelteKit | `+page.server.ts`, `+server.ts` |
| Nuxt | `server/api/`, `server/routes/` |
| Remix | `loader`, `action` functions |
| Astro | `.astro` frontmatter, API routes |

## Example

See `examples/environments/` in the agent-browser repo for a working app with the Vercel Sandbox pattern, including a sandbox snapshot creation script, streaming progress UI, and rate limiting.


### Upstream Slack

&lt;!-- SYNCED from vercel-labs/agent-browser (skills/slack/SKILL.md) --&gt;
&lt;!-- Hash: 7e3dd7895efb597fa84807db66fe7d3fc6fcdf75b794d4ca4662a59a443e722c --&gt;
&lt;!-- Re-sync: bash scripts/sync-vercel-skills.sh --&gt;


# Slack Automation

Interact with Slack workspaces to check messages, extract data, and automate common tasks.

## Quick Start

Connect to an existing Slack browser session or open Slack:

```bash
# Connect to existing session on port 9222 (typical for already-open Slack)
agent-browser connect 9222

# Or open Slack if not already running
agent-browser open https://app.slack.com
```

Then take a snapshot to see what's available:

```bash
agent-browser snapshot -i
```

## Core Workflow

1. **Connect/Navigate**: Open or connect to Slack
2. **Snapshot**: Get interactive elements with refs (`@e1`, `@e2`, etc.)
3. **Navigate**: Click tabs, expand sections, or navigate to specific channels
4. **Extract/Interact**: Read data or perform actions
5. **Screenshot**: Capture evidence of findings

```bash
# Example: Check unread channels
agent-browser connect 9222
agent-browser snapshot -i
# Look for "More unreads" button
agent-browser click @e21  # Ref for "More unreads" button
agent-browser screenshot slack-unreads.png
```

## Common Tasks

### Checking Unread Messages

```bash
# Connect to Slack
agent-browser connect 9222

# Take snapshot to locate unreads button
agent-browser snapshot -i

# Look for:
# - "More unreads" button (usually near top of sidebar)
# - "Unreads" toggle in Activity tab (shows unread count)
# - Channel names with badges/bold text indicating unreads

# Navigate to Activity tab to see all unreads in one view
agent-browser click @e14  # Activity tab (ref may vary)
agent-browser wait 1000
agent-browser screenshot activity-unreads.png

# Or check DMs tab
agent-browser click @e13  # DMs tab
agent-browser screenshot dms.png

# Or expand "More unreads" in sidebar
agent-browser click @e21  # More unreads button
agent-browser wait 500
agent-browser screenshot expanded-unreads.png
```

### Navigating to a Channel

```bash
# Search for channel in sidebar or by name
agent-browser snapshot -i

# Look for channel name in the list (e.g., "engineering", "product-design")
# Click on the channel treeitem ref
agent-browser click @e94  # Example: engineering channel ref
agent-browser wait --load networkidle
agent-browser screenshot channel.png
```

### Finding Messages/Threads

```bash
# Use Slack search
agent-browser snapshot -i
agent-browser click @e5  # Search button (typical ref)
agent-browser fill @e_search "keyword"
agent-browser press Enter
agent-browser wait --load networkidle
agent-browser screenshot search-results.png
```

### Extracting Channel Information

```bash
# Get list of all visible channels
agent-browser snapshot --json > slack-snapshot.json

# Parse for channel names and metadata
# Look for treeitem elements with level=2 (sub-channels under sections)
```

### Checking Channel Details

```bash
# Open a channel
agent-browser click @e_channel_ref
agent-browser wait 1000

# Get channel info (members, description, etc.)
agent-browser snapshot -i
agent-browser screenshot channel-details.png

# Scroll through messages
agent-browser scroll down 500
agent-browser screenshot channel-messages.png
```

### Taking Notes/Capturing State

When you need to document findings from Slack:

```bash
# Take annotated screenshot (shows element numbers)
agent-browser screenshot --annotate slack-state.png

# Take full-page screenshot
agent-browser screenshot --full slack-full.png

# Get current URL for reference
agent-browser get url

# Get page title
agent-browser get title
```

## Sidebar Structure

Understanding Slack's sidebar helps you navigate efficiently:

```
- Threads
- Huddles
- Drafts & sent
- Directories
- [Section Headers - External connections, Starred, Channels, etc.]
  - [Channels listed as treeitems]
- Direct Messages
  - [DMs listed]
- Apps
  - [App shortcuts]
- [More unreads] button (toggles unread channels list)
```

Key refs to look for:
- `@e12` - Home tab (usually)
- `@e13` - DMs tab
- `@e14` - Activity tab
- `@e5` - Search button
- `@e21` - More unreads button (varies by session)

## Tabs in Slack

After clicking on a channel, you'll see tabs:
- **Messages** - Channel conversation
- **Files** - Shared files
- **Pins** - Pinned messages
- **Add canvas** - Collaborative canvas
- Other tabs depending on workspace setup

Click tab refs to switch views and get different information.

## Extracting Data from Slack

### Get Text Content

```bash
# Get a message or element's text
agent-browser get text @e_message_ref
```

### Parse Accessibility Tree

```bash
# Full snapshot as JSON for programmatic parsing
agent-browser snapshot --json > output.json

# Look for:
# - Channel names (name field in treeitem)
# - Message content (in listitem/document elements)
# - User names (button elements with user info)
# - Timestamps (link elements with time info)
```

### Count Unreads

```bash
# After expanding unreads section:
agent-browser snapshot -i | grep -c "treeitem"
# Each treeitem with a channel name in the unreads section is one unread
```

## Best Practices

- **Connect to existing sessions**: Use `agent-browser connect 9222` if Slack is already open. This is faster than opening a new browser.
- **Take snapshots before clicking**: Always `snapshot -i` to identify refs before clicking buttons.
- **Re-snapshot after navigation**: After navigating to a new channel or section, take a fresh snapshot to find new refs.
- **Use JSON snapshots for parsing**: When you need to extract structured data, use `snapshot --json` for machine-readable output.
- **Pace interactions**: Add `sleep 1` between rapid interactions to let the UI update.
- **Check accessibility tree**: The accessibility tree shows what screen readers (and your automation) can see. If an element isn't in the snapshot, it may be hidden or require scrolling.
- **Scroll in sidebar**: Use `agent-browser scroll down 300 --selector ".p-sidebar"` to scroll within the Slack sidebar if channel list is long.

## Limitations

- **Cannot access Slack API**: This uses browser automation, not the Slack API. No OAuth, webhooks, or bot tokens needed.
- **Session-specific**: Screenshots and snapshots are tied to the current browser session.
- **Rate limiting**: Slack may rate-limit rapid interactions. Add delays between commands if needed.
- **Workspace-specific**: You interact with your own workspace -- no cross-workspace automation.

## Debugging

### Check console for errors

```bash
agent-browser console
agent-browser errors
```

### Get current page state

```bash
agent-browser get url
agent-browser get title
agent-browser screenshot page-state.png
```

## Example: Full Unread Check

```bash
#!/bin/bash

# Connect to Slack
agent-browser connect 9222

# Take initial snapshot
echo "=== Checking Slack unreads ==="
agent-browser snapshot -i > snapshot.txt

# Check Activity tab for unreads
agent-browser click @e14  # Activity tab
agent-browser wait 1000
agent-browser screenshot activity.png
ACTIVITY_RESULT=$(agent-browser get text @e_main_area)
echo "Activity: $ACTIVITY_RESULT"

# Check DMs
agent-browser click @e13  # DMs tab
agent-browser wait 1000
agent-browser screenshot dms.png

# Check unread channels in sidebar
agent-browser click @e21  # More unreads button
agent-browser wait 500
agent-browser snapshot -i > unreads-expanded.txt
agent-browser screenshot unreads.png

# Summary
echo "=== Summary ==="
echo "See activity.png, dms.png, and unreads.png for full details"
```

## References

- **Slack docs**: https://slack.com/help
- **Web experience**: https://app.slack.com
- **Keyboard shortcuts**: Type `?` in Slack for shortcut list


### Upstream

&lt;!-- SYNCED from vercel-labs/agent-browser (skills/agent-browser/SKILL.md) --&gt;
&lt;!-- Hash: a7f51582773b122b825aaf2f232e8fead1488a2a141f0916ba45873996d8f6aa --&gt;
&lt;!-- Re-sync: bash scripts/sync-vercel-skills.sh --&gt;


# agent-browser

Fast browser automation CLI for AI agents. Chrome/Chromium via CDP with accessibility-tree snapshots and compact `@eN` element refs.

Install: `npm i -g agent-browser && agent-browser install`

## Start here

This file is a discovery stub, not the usage guide. Before running any `agent-browser` command, load the actual workflow content from the CLI:

```bash
agent-browser skills get core             # start here — workflows, common patterns, troubleshooting
agent-browser skills get core --full      # include full command reference and templates
```

The CLI serves skill content that always matches the installed version, so instructions never go stale. The content in this stub cannot change between releases, which is why it just points at `skills get core`.

## Specialized skills

Load a specialized skill when the task falls outside browser web pages:

```bash
agent-browser skills get electron          # Electron desktop apps (VS Code, Slack, Discord, Figma, ...)
agent-browser skills get slack             # Slack workspace automation
agent-browser skills get dogfood           # Exploratory testing / QA / bug hunts
agent-browser skills get derive-client     # Record a HAR, derive a standalone API client for a site
agent-browser skills get vercel-sandbox    # agent-browser inside Vercel Sandbox microVMs
agent-browser skills get agentcore         # AWS Bedrock AgentCore cloud browsers
```

Run `agent-browser skills list` to see everything available on the installed version.

## Why agent-browser

- Fast native Rust CLI, not a Node.js wrapper
- Works with any AI agent (Cursor, Claude Code, Codex, Continue, Windsurf, etc.)
- Chrome/Chromium via CDP with no Playwright or Puppeteer dependency
- Accessibility-tree snapshots with element refs for reliable interaction
- Sessions, authentication vault, state persistence, video recording
- Specialized skills for Electron apps, Slack, exploratory testing, cloud providers

## Observability Dashboard

The dashboard runs independently of browser sessions on port 4848 and can also be opened through a proxied or forwarded URL such as `https://dashboard.agent-browser.localhost`. Agents should stay on the dashboard origin: session tabs, status, and stream traffic are proxied internally, so session ports do not need to be exposed.