Wallfacer

On this page

What It Can OpenAvailabilitySigning In Without Exposing the PasswordWhat You SeeRelated

The Agent's Browser

Wallfacer keeps a headless Chromium open inside the agent's VM for the length of a session. The agent opens a page, reads what is on it, clicks and types, and captures what it sees. Cookies, logins, and in-page navigation carry from one step to the next, so a multi-step flow such as signing up for a service or logging in and reaching the page behind the login works the way it would for a person.

This is the agent's own browser. It is not the Web Preview panel, which is the embedded view you use to look at a service running in the VM.

What It Can Open

Two kinds of target:

  • Any page on the open web, given a URL. https://trello.com/signup and trello.com/signup both work; a bare host is read as https.
  • A service of the agent's own environment, named as it appears in the manifest, with an optional path. The agent names the service rather than a port, and the transcript records which service it opened.

A sandbox-local address passed as a URL is refused, and the refusal points at the service form instead. That covers localhost, private and link-local IP ranges including the cloud metadata endpoint, and the .local and .internal suffixes. The refusal is about naming: the environment's own services are reachable, through the argument that says so.

Browsing grants the agent no network access it did not already have. A session's shell has outbound network, so the browser is a way to see and drive a page, not a new door out of the VM.

Availability

Every coding session has it, whether or not the environment declares a web service. Nothing in the manifest turns it on, and an environment that serves no pages of its own can still browse the web.

Signing In Without Exposing the Password

When a page asks for a credential the agent holds on the account keychain, the agent fills the field by naming the credential. The value goes from the VM into the form without passing through the model or the session transcript. Time-based codes work the same way: one is minted at the moment the field needs it.

Granting the credential is the whole setup. An agent that names a credential it was not granted is refused.

What You See

Each capture the agent takes carries a permanent shareable URL. Agents embed those in pull request test plans to show a reviewer the page they verified, and paste them into chat when you ask what something looks like. Captures from a browsing session and single-shot service renders both appear this way.

The steps in between are in the session transcript: the page opened, the element acted on, the result read back.

Related