Agents

Live browser

Watch the agent's browser as it works, and take control for logins, 2FA, SSO pop-ups, or to show it what you mean.

When a sandboxed project has the browser on, every task gets one shared Chromium that both the agent and you can see. The Browser button on a running agent opens a window that streams that browser live, and lets you take control of it.

Before you begin#

The project has browser.enabled: true and runs in Docker or Cloudflare. See Browser testing and previews.
The agent is running. The window says The agent hasn't opened a page yet until it does.

Watch#

Press Browser in Live Agents. The window shows the current page, its address and how many tabs are open. While the agent's next browser action is waiting on you, the window shows The agent is waiting to run ….

The page title, tab names and address are what the browser in the sandbox reports, and the agent controls that browser, so the window marks them Reported by the sandbox, not verified. SI Fabrik strips control and bidirectional-text characters from them, and nothing in the window opens URLs on your Mac.

Take control#

Take Control
Press Take Control. Your clicks, typing, scrolling and URL changes go to that same browser, and you can use Back, Forward, Reload and the address field. While you have control, the agent's browser actions wait.
Do what you need
Sign in, pass a 2FA prompt or an SSO pop-up, or walk through the flow you want the agent to test.
Hand Back
Type an optional Note for the agent, then press Hand Back. The agent's waiting action isn't run, because the page has changed. Instead the agent gets your note and the current URL, and takes a fresh look before continuing.

Taking and handing back control are logged and added to the run's transcript.

The agent sees what you type

The agent shares the browser, so anything you type while in control is visible to it. Use test accounts, not your own passwords; the window reminds you. For repeat sign-ins, save a test login instead.

The window is a picture drawn by the sandbox: its address, and anything in it that looks like a Mac dialog or password prompt, can be faked. The take-control banner says so.

How it's isolated#

The browser obeys the sandbox's network allowlist; localhost is always reachable.
Its DevTools port is bound to 127.0.0.1 inside the sandbox. SI Fabrik reaches it through docker exec or the Cloudflare bridge's authenticated exec, so it's never exposed on a network and other sandboxes can't reach it.
Each run starts with a fresh profile. Nothing carries over between runs.

When the run ends, the window shows Browser session ended and why.