The browser is a surface too: rysh's Chrome-driving agent

Half your job lives in browser tabs. rysh's agent drives your own Chrome — logged in, observable, and under a leash.

Be honest about where your work actually happens.

Some of it is in the terminal — builds, deploys, logs, git. But a big, annoying slice of it lives in browser tabs: the admin dashboard with no API, the form you fill every Friday, the competitor's changelog you keep meaning to check, the staging app you click through before every release.

We've spent two years teaching agents to use the shell. Meanwhile the browser — the surface where half the chores live — mostly gets one of two treatments: a chatbot that can talk about web pages, or a brittle Selenium script that breaks the moment a div moves.

rysh treats the browser as what it is: another surface for the same agent engine. The same runtime that powers your terminal panes, your autonomous agents, and your Slack humanoids can also drive a real browser — navigate, click, read pages, extract data, fill forms, take screenshots — while you watch it work from a pane.

Your Chrome, not a puppet profile

The detail that changes everything: rysh's browser agent drives your own Chrome, over the DevTools protocol — not an anonymous, cookie-less automation profile.

That matters more than it sounds:

• You're already logged in. The dashboard behind SSO, the SaaS admin panel, the community forum — the agent sees what you see, because it's your session. No credential-stuffing into a headless puppet, no "log in via script" hacks.
• Your extensions, your settings, your reality. Automation profiles render a different web than the one you use. Driving the real browser means the agent operates on the page as it actually is.
• Identity is scoped when you want it. For recurring automations you can create a dedicated, persistent browser profile — authenticate once by hand, and every future run reuses that session (more on that pattern in the ##auto web post).

The agent never sees your password. You typed it, once, into a real browser window. The agent inherits the session, not the secret.

What it looks like from the pane

A rysh pane is a conversation — shell on one keystroke, agent on the other. When the agent works the browser, the pane becomes your window into it: which page it's on, what it clicked, what it extracted, and its running commentary as it decides what to do next.

That's not a UI garnish; it's the governance model. rysh's whole design bet is that agents you can watch are agents you can trust — the same reason terminal tool calls render in the open and risky operations wait for approval. The browser surface inherits that posture:

• Every step is narrated and visible in the pane while it happens.
• Guardrails live in the task prompt, where the agent obeys them per step: what it may read, what it must never click, when to stop.
• Login walls, captchas, and rate-limit notices are stop conditions, not puzzles. The agent halts and reports; it doesn't try to be clever.

Compare that to the classic RPA experience: a script runs somewhere, something breaks silently, and you find out from an angry email.

Reading pages like a person, not like a selector

Traditional browser automation is coordinate archaeology: record a click path, pray the DOM never changes. It always changes.

An agent reads the page the way you do — semantically. Ask it to "find the export button on the billing page" and it looks for the export button, not for #root > div:nth-child(4) > button. When a layout shifts, it adapts. When it lands on the wrong page, it notices, says so, and changes strategy — we've watched it do exactly that mid-run, unprompted, in real recorded sessions.

That flexibility is why the interesting use cases open up:

• QA walkthroughs — "click through the signup flow on staging and tell me what's broken."
• Research chores — scan a set of sites, collect structured findings into a markdown file you can diff.
• Back-office RPA — the weekly form, the dashboard-to-spreadsheet ritual, the data that lives behind three clicks.
• Recurring discovery — sourcing candidates, watching competitors, tracking listings.

For the recurring ones, you don't re-prompt each time — you write the task down once as a markdown recipe with hard budgets and a definition of done, and it becomes a command. That's ##auto web, and it gets its own post.

One engine, one governance model

Here's the part that separates this from "yet another browser copilot": it's not a separate product bolted on. The browser is one surface of the same engine that runs everything else in rysh.

Practically, that means:

• The same skill-file format that defines a terminal agent or a Slack humanoid defines browser behavior.
• The same budget vocabulary (pages, books, shelves — hard token ceilings, not vibes) leashes browser runs.
• The same observability: it streams into a pane, and panes can be shared with a teammate — view-only or control — like any other pane.
• The same ownership: it runs on your machine, on your Chrome, with your Anthropic key.

You don't adopt a browser bot, then an ops bot, then a support bot, each with its own console and its own idea of permissions. You adopt one engine and point it at surfaces.

The ethics paragraph (non-optional)

A browsing agent on a logged-in session is powerful, so the defaults are conservative and you should keep them that way: discovery and read-work only on other people's platforms — no auto-DMs, no auto-follows, no engagement farming. The agent stops at login walls it doesn't own and at anything that smells like a rate limit. Platform terms bind you, not your tooling; this is a research assistant on your own session, not scraping infrastructure. The step where you contact a human stays human.

Honest scope

• rysh runs on Claude — bring your own Anthropic key. The provider layer is pluggable; Claude is what's wired today. No secret better model.
• rysh is self-hostable — your machine, your keys, your data. It is not open source.
• The browser agent needs a Chromium/Chrome the CLI can drive. Headless runs work on a server; the one-time interactive login for a persistent profile needs a display somewhere, once.
• Agents read pages semantically, which makes them resilient — not infallible. For anything consequential, review outputs before acting on them.

Want agents doing real work across your terminal and your browser — with a leash? We're recruiting design partners: hands-on access, direct line to the founders, your workflow shapes the roadmap. → rysh.ai/design-partner

Next up: ##auto web: autonomous browser recipes in one markdown file · Every pane is a conversation