Agent Browser v0.1.0-rc.1 (source-only release candidate)

Drive it from TypeScript

npm install aether-browser

The client and CLI for this release are published as aether-browser — zero runtime dependencies, TypeScript types included, Node 18+. withSession guarantees the session is ended even if your callback throws. Source in clients/node.

Docs site: https://aetherai3.github.io/agent-browser/

---

Agent Browser v0.1.0-rc.1 is a source-first, self-hosted release candidate. It is not a hosted service, and it is not a production release.

Self-hosted Chrome for AI agents: drive one browser session through a closed HTTP API, and watch or take over that exact same session through noVNC.

Distribution is source-only

This release publishes source only. No Chrome-containing OCI image, image tar, filesystem layer, or reusable layer cache is distributed. You build the image yourself from this checkout, which is what the documented quickstart does.

The SBOM and third-party notice bundle captured during release evidence are inventory and transparency records. They do not by themselves grant redistribution authorization for Google Chrome.

Quickstart

Requires Docker Engine on Linux with Docker Compose v2.

docker compose up --build

Then open the live browser view at http://127.0.0.1:6080/vnc.html and check the API:

curl -fsS http://127.0.0.1:8092/browser/health | jq .

The first build installs a hash-locked Python environment and uses Patchright to install the then-current Google Chrome Stable package, so it can take several minutes.

What is in this candidate

• A closed v0.1 API surface for session create/end, navigation, snapshot, and bounded interaction. There is no arbitrary-endpoint, JavaScript, DevTools, shell, or credential-import escape hatch.
• Separate controller and observer authorization roles.
• One owned session at a time, with fail-closed capacity rejection.
• Egress policy that refuses direct SSRF targets and refuses redirects out of policy.
• Downloads are non-persistent and popups are bounded rather than silently allowed.
• A noVNC surface for live human observation and takeover of the same session.
• Deterministic teardown: process, profile, and container cleanup.

Naming

This is the first candidate published as Agent Browser by Aether AI. The Python package is agent_browser, the distribution is agent-browser, and the runtime environment prefix is AGENT_BROWSER_*.

An earlier candidate was briefly published under the working name "Aether Browser" before the rename settled. It was withdrawn rather than kept alongside this one, so this is the only release and it carries the final naming throughout. If you pulled that earlier tag, re-pull this one and rename any AETHER_BROWSER_* variables you had set.

Evidence

Every runtime proof for this candidate is bound to runtime commit 0ff618ae70a9640fe1d43e893cdc15a422a5f710.

• Isolated acceptance against the exact built image returned PASS over 33 checks, covering image binding, --network none pod isolation, session authority, interaction, refusals, noVNC/RFB readiness, same-display visual binding, and cleanup.
• The documented Linux Compose quickstart was reproduced from a clean checkout.
• The strict repository gate passed on the tagged commit, with ci and all five release-evidence jobs green.

Human-readable records: docs/RELEASE_EVIDENCE.md and docs/DEMO_EVIDENCE.md. The machine-readable attestation is committed at release/evidence/manifest.json and attached to this release.

The demo video in the README is an eight-second silent montage of stills generated from the accepted image. It is illustrative. The acceptance record, not the video, is the proof.

Supply-chain hardening

The privileged release workflows check out a statically trusted ref (github.sha, already proven by the ref-proof job to be the exact refs/heads/main tip) rather than an indirect job output, so a privileged run cannot execute an unproved tree and poison default-branch Actions caches. This closed five High CodeQL findings (actions/cache-poisoning/poisonable-step) before this candidate was cut.

At the tagged commit there are no open CodeQL, Dependabot, or secret-scanning alerts. No workflow uses pull_request_target; the one self-hosted job is workflow_dispatch only, so forks cannot reach it. All actions are SHA-pinned, every job is time-bounded, all checkouts use persist-credentials: false, and no ${{ }} expression is interpolated into a run: block.

Security posture and limits

• Read docs/SECURITY-MODEL.md before exposing anything.
• The v0.1 noVNC surface is unauthenticated and is intended for numeric loopback on a machine you control. The Compose quickstart binds user-facing listeners to loopback for this reason. Do not expose it to a network.
• Grype ran against the exact image with --fail-on high --only-fixed and did not block the build, meaning no fixed high-or-higher findings. That is not a claim that the image is free of vulnerabilities: of the recorded findings, 12 carry an available fix, 520 have no released fix, and 330 are marked will-not-fix by the Debian-derived base. Re-scan any image you build and apply your own risk policy.
• Evidence covers a single local, network-isolated container run. It does not demonstrate hosted or multi-tenant operation, remote network security, sustained load, or availability.
• Rebuilding this source later may resolve a newer Chrome Stable version than the one recorded in the evidence.

Feedback

This is a release candidate and the API may change before v0.1.0. Issues and design discussion are welcome, including the open client-library and worker-pool issues.