[torrmal]

This adds the anton side of the shared browser (ENG-3188, ENG-3296).

The user's MindsHub browser instance (br-<hash>, mindshub_services#239) is a real Chromium they watch beside the chat and can take over at any time. This PR gives anton a browser tool to work in it with them.

What the model gets

The tool is browser, with these actions:

Action	What it does
open	Opens the browser, optionally at a URL, and lists signed-in sites. Each site shows whether cookies are still present.
run	Works toward a one-sentence goal. inputs holds values to type, e.g. {"search": "MacBook Air"}.
page, act, screenshot	Reads the page as [17] button "Add to Cart" lines, takes one step, or returns an annotated image.
hand_to_user	The user signs in, solves a CAPTCHA or confirms something in the browser, then chooses Done.
note_login	Records the site and an account hint in the browser profile and as a global profile memory. Never a credential.
close	Closes the browser and keeps the profile.

The tool prompt and a new built-in browser skill cover:

• connectors first;
• only sites the user named;
• never ask for or type a password;
• hand over for sign-ins and payments;
• confirm before buying, sending, deleting or submitting;
• report only what the page shows.

Jev drives run

Each step is one /v1/decisions call. The new jev.decide is a generic sibling of classify, and it never raises. It asks four questions:

• next_action: one of 9 options
• target: which element, from a shortlist of about 40, ranked by overlap with the goal and whether it's on screen
• needs_user
• risky

An input_key question is added when inputs are given.

What happens with each answer:

• Acts directly: a confident click, scroll, select or back. type and select only use a value from inputs.
• Goes back to the model, with the page and the steps taken:
  • a sign-in wall;
  • an action or target below browser_jev_min_p (default 0.8);
  • a type with no matching input;
  • two steps that changed nothing;
  • the step limit;
  • Jev missing, which also covers every non-MindsHub provider.
• Asks the user first: a step with risky ≥ 0.5.

browser_jev controls the rollout and defaults to shadow. In shadow, run only reads the page and records Jev's pick. The model's next act is compared against it and logged as the browser_jev_shadow event (agree on action and target, plus both probabilities). on lets Jev act, and off never calls it.

Wiring

• ChatSessionConfig.browser is a BrowserConfig(base_url, profile="main"). When it's set, the tool is registered. Hosts set it; the CLI falls back to ANTON_BROWSER_URL.
• Credentials are resolved on each call: the MindsHub provider's current key if there is one, otherwise minds_api_key. The worker accepts either for the instance's owner (mindshub_services#241).
• Cloud pod:
  • TurnRequestV1.browser carries {base_url, profile}.
  • The allowlist gains browser only when that field parses.
  • The pod authenticates with its existing turn key.
  • StreamBrowserSession goes out on the wire as {"kind": "browser", ...}.
• StreamBrowserSession(session_id, view_url, expires_at) is emitted when the tool first opens the browser. view_url is a one-hour embed URL from the worker's /_embed, so hosts can split the screen.
• Root cause: five new sentinels: browser_bad_input, browser_stale_element, browser_unauthorized, browser_unreachable, browser_error.

Related PRs

• mindshub_services#239 (the browser agent) and gdrive connector with google picker api #241 (bearer gate, embed tokens, sites registry)
• mindsdb/scratchpad-controller#83 (passes browser through to the pod)
• cowork-server and cowork follow: provisioning, the setting, response.browser_session_opened, and the split pane

Testing

• tests/test_browser_tool.py: 26 tests, run against a fake instance served through httpx.MockTransport, with a fake Jev and a fake elicitor. They cover:
  • page formatting, the shortlist and parsing;
  • open emitting the viewer and listing sites;
  • credential fallback;
  • single steps, bad and stale steps;
  • run taking confident steps, handing back when unsure or when it needs text, stopping at sign-in walls, asking before a risky step, and stopping when steps change nothing;
  • no-Jev, shadow-agreement and off modes;
  • hand-over followed by automatic note_login and the memory write;
  • screenshots, auth errors, jev.decide, and the config and contract wiring.
• Full suite: 4605 passed. Five test_cloud_turn_process tests fail in my local environment, and the same five fail on a clean staging checkout too.
• ruff check passes, and uv lock --check is clean.
• Not yet verified: a live run against a real instance. That's next, in the PR environment.

🤖 Generated with Claude Code