2.2 KiB
AI browser control
Central agents.enabled controls the entire local interface. Actions also require
individual policy scopes and approved destinations; changes and expiry are checked
again around asynchronous work. Revocation aborts active requests and stops access.
Implemented application controls: list sessions, open/activate/close/group tabs,
navigate, read approved visible content, inspect non-sensitive form values and
selectors, scroll, click, type, use the approved AI gateway, read/change permitted
appearance settings, organize personal bookmarks, and propose/apply AI library
organization when separately enabled. Company bookmarks and locked settings retain
their central restrictions. inspect and scroll are opt-in scopes.
Use the trusted local Electron helper with an absolute DPAPI pairing file and a JSON action file:
npx electron scripts/agent-client.cjs --connection C:/path/agent-connection.json --request C:/path/action.json
Example action:
{"action":"inspect","args":{"sessionId":"managed-session-id"}}
The helper unwraps the pairing capability through Windows DPAPI. The local channel uses pinned Ed25519 and ML-DSA-87 identities, ML-KEM-1024 key establishment and AES-256-GCM request/reply protection, with one-use challenges and HMAC-SHA384 proofs bound to the exact body, route, timestamp and nonce. The capability token is never sent on the wire. Plaintext action requests and successful plaintext replies are rejected. Never copy pairing secrets into chat, source files or ordinary logs. Restart/revoke requires fresh pairing.
OpenTelemetry measures authorization, audit, action dispatch, result projection and encryption separately in debug mode. Durable security events remain distinct from operational traces. Administrators independently control diagnostics and SIEM export; ECS/CEF forwarding can be stopped centrally without deleting queued audit.
This remains under heavy development. A shared local capability is not yet a full per-agent identity/consent system. History, safe screenshots, frame-aware controls, select menus and other richer interactions need additional typed actions and tests. Arbitrary JavaScript, cookies and secret extraction are not control APIs.