41 lines
2.2 KiB
Markdown
41 lines
2.2 KiB
Markdown
|
# AI browser control
|
||
|
|
|
||
|
|
Central `agents.enabled` controls the entire local interface. Actions also require
|
||
|
|
individual policy scopes and approved destinations; changes and expiry are checked
|
||
|
|
again around asynchronous work. Revocation aborts active requests and stops access.
|
||
|
|
|
||
|
|
Implemented application controls: list sessions, open/activate/close/group tabs,
|
||
|
|
navigate, read approved visible content, inspect non-sensitive form values and
|
||
|
|
selectors, scroll, click, type, use the approved AI gateway, read/change permitted
|
||
|
|
appearance settings, organize personal bookmarks, and propose/apply AI library
|
||
|
|
organization when separately enabled. Company bookmarks and locked settings retain
|
||
|
|
their central restrictions. `inspect` and `scroll` are opt-in scopes.
|
||
|
|
|
||
|
|
Use the trusted local Electron helper with an absolute DPAPI pairing file and a
|
||
|
|
JSON action file:
|
||
|
|
|
||
|
|
```powershell
|
||
|
|
npx electron scripts/agent-client.cjs --connection C:/path/agent-connection.json --request C:/path/action.json
|
||
|
|
```
|
||
|
|
|
||
|
|
Example action:
|
||
|
|
|
||
|
|
```json
|
||
|
|
{"action":"inspect","args":{"sessionId":"managed-session-id"}}
|
||
|
|
```
|
||
|
|
|
||
|
|
The helper unwraps the pairing capability through Windows DPAPI. The local channel
|
||
|
|
uses pinned Ed25519 and ML-DSA-87 identities, ML-KEM-1024 key establishment and
|
||
|
|
AES-256-GCM request/reply protection, with one-use challenges and HMAC-SHA384 proofs bound to the exact body, route, timestamp and nonce. The capability token is never sent on the wire. Plaintext action
|
||
|
|
requests and successful plaintext replies are rejected. Never copy pairing secrets
|
||
|
|
into chat, source files or ordinary logs. Restart/revoke requires fresh pairing.
|
||
|
|
|
||
|
|
OpenTelemetry measures authorization, audit, action dispatch, result projection and
|
||
|
|
encryption separately in debug mode. Durable security events remain distinct from
|
||
|
|
operational traces. Administrators independently control diagnostics and SIEM
|
||
|
|
export; ECS/CEF forwarding can be stopped centrally without deleting queued audit.
|
||
|
|
|
||
|
|
This remains under heavy development. A shared local capability is not yet a full
|
||
|
|
per-agent identity/consent system. History, safe screenshots, frame-aware controls,
|
||
|
|
select menus and other richer interactions need additional typed actions and tests.
|
||
|
|
Arbitrary JavaScript, cookies and secret extraction are not control APIs.
|