@felan-ai/ext-browser

Portable Felan browser automation backed by the reviewed agent-browser 0.37.1 CLI. The package does not vendor the upstream Rust daemon or Chrome. It probes the exact reviewed CLI on Felan's AgentRuntime and otherwise remains safely unavailable.

Tool

The extension registers the ordinary browser tool and, when its host supplies authorization, a separate browser_authorize control-plane tool.

browser_authorize supports authorize, status, and revoke. Authorization defaults to an interactive local consent choice and opens a fresh strict pinned tab in the existing Chrome session. The local TUI can persist always-allow through browser settings; changing it back to ask restores the prompt for later authorizations. The host supplies a transient validated loopback CDP endpoint. After authorization, the attached browser accepts the native CLI command surface, including authenticated browser state and advanced diagnostics. Felan replaces its session, namespace, configuration, output, and connection options before dispatch. Direct connect, --cdp, and --auto-connect arguments cannot replace the leased connection.

The browser tool has two operations:

• skill runs the installed CLI's skills get <name> command. Start with core, use full: true for the complete command reference, and request a specialized skill such as electron, slack, dogfood, or vercel-sandbox when appropriate. Skill content is retrieved at runtime so it remains matched to the installed CLI version rather than being copied into Felan's prompt.
• run accepts literal CLI argument tokens, for example ['open', 'https://example.com'], ['snapshot', '-i'], or ['fill', '@e3', 'value']. The operation never accepts shell syntax. Felan owns the session, namespace, idle-timeout, JSON, content-boundary, and output-limit options, plus domain/action policy and local-file-access controls. Each tool operation also uses a freshly written Felan-owned config, so ambient project/global agent-browser configuration and plugins are not loaded; permitted options must be passed explicitly or supplied by the host environment. Sessions are namespaced to the Felan session, CLI JSON output is bounded, and page/CLI output is marked as untrusted data.

Install, upgrade, repair, plugin, MCP/stream/dashboard server, chat, action-confirmation, raw skill, and cross-session close commands are not available through the model tool. batch remains unavailable so each browser call is visible to the agent runtime. Installation and policy confirmation are host-owned and explicit.

Use a bare ['screenshot'] (optionally with flags) when the selected model accepts image input. Felan stages that screenshot at a random path in session storage, validates PNG/JPEG/GIF/WebP magic bytes, bounds the read to 20 MiB, resizes it to at most 2,000 pixels per side and 4 MiB of encoded data, and returns native image content. Text-only models or unreadable/invalid staged images receive a bounded text fallback instead. Model-selected screenshot paths remain text-only and are never opened automatically.

The owned browser session is closed during session shutdown. Revocation and shutdown disconnect an attached session without closing the user's Chrome. CDP attachment remains browser-level authority. The initial authorization observation and lease protect the connection, but Felan does not probe the daemon or target before and after every command. A live authorized attachment may read sensitive browser data or execute page JavaScript, so authorize it only when that access is intended. The requested origin is only the initial destination, and attached navigation may cross HTTP(S) origins. Felan makes one connection attempt per approval and retries setup only after an explicit user action.

A managed CLI install sets a one-hour daemon idle timeout; it does not install Chrome. Run the explicit agent-browser install action when a local Chrome for Testing binary is needed.

Runtime dependency and onboarding

The local TUI checks for the exact reviewed CLI during interactive startup. If it is unavailable, /dependencies and the first-run dependency wizard offer a confirmed managed installation or disabling the Browser extension. The managed installer downloads the pinned npm archive into Felan agent storage, verifies its SHA-512 integrity and platform native binary SHA-256 digest, extracts the bundled version-matched skills without lifecycle scripts, and verifies the CLI version. A readiness marker is written only after verification, and managed binary integrity is checked again before discovery executes it. Concurrent installers use separate candidate directories, and discovery considers only fully verified candidates. Installation never runs from non-interactive startup or a model tool call.

Cloud and other non-interactive hosts should preinstall the reviewed CLI in the active runtime or disable this extension in their host configuration.

Development

pnpm --filter @felan-ai/ext-browser build
pnpm --filter @felan-ai/ext-browser type-check
pnpm --filter @felan-ai/ext-browser test

See NOTICE for upstream attribution and the reviewed immutable release details.

Package boundary and security

The extension owns literal-argv validation, session namespacing, bounded output, version-matched skill retrieval, screenshot validation, and safe text/image fallbacks. Hosts own credentials, attachment authorization, dependency installation, and browser policy. Page content, CLI output, and bundled skill text are untrusted. Existing-browser attachment requires browser_authorize; noninteractive hosts fail closed.

Related documentation

• Browser workflow
• Runtime and security
• Runtime dependencies

Attribution

The integration is reviewed against agent-browser 0.37.1. The package does not vendor its daemon or Chrome. See NOTICE and LICENSE for the immutable upstream release, digests, and TypeBox attribution.