In-app agent browser
Claude can now drive a browser inside Geode, using the same embedded web view that powers Web Viewer tabs — instead of launching a separate Chrome.
The point isn’t new capability. It’s that the external browser CLI spawned its own Chrome plus a supervising daemon per session, and nothing counted those processes, reclaimed them, or refused to start one more when the machine was already out of headroom. While this was being tested, the same machine was running 38 Chrome processes and 42 daemons leaked across four sessions, the oldest three hours old. The in-app browser drops from 2 renderer processes to 1 the moment a session closes.
How it reads a page
An accessibility snapshot rather than screenshots or raw HTML — just the things a person could actually interact with:
- textbox "What needs doing?" [ref=e1]
- button "Submit the form" [ref=e2]
- link "Documentation" [ref=e3]Claude reads that and hands back a ref. No coordinate guessing, no brittle selectors. Hidden and disabled elements are omitted, so every ref is something you could have clicked yourself.
Refs are scoped to a snapshot epoch, and the check runs in the same injected call as the action — so a page that navigates between the check and the click gets refused rather than acted on by accident.
Resource limits, because that was the whole problem
Sessions are capped (2 by default, 4 max), reaped after 5 minutes idle, recycled after 30 minutes, and closed when their thread is deleted or the plugin unloads. Geode already measured file-descriptor pressure but only ever reported it; a sandboxed page process needs a spare descriptor at launch or it dies as a bare “exit code 6”, so the browser now refuses to start a session when the app is running low.
Watching it work
Open Agent Browser from the command palette shows live frames, the page, session age, and a stop button. It streams only while visible, and closing it never closes Claude’s session.
Safety
Its own cookie jar, separate from your Web Viewer tabs. Page text arrives wrapped as untrusted data rather than instructions. Typing a stored secret into a page is refused. file:, javascript: and cloud metadata addresses are blocked; private network access is opt-in.
Limits
Geode desktop only — it needs process diagnostics Obsidian doesn’t expose, and mobile has no embedded web view. Top frame only; no iframes, file uploads, or multiple tabs. It can’t drive Electron desktop apps, evade bot detection, or use cloud browsers — the agent-browser CLI still covers those.
Off by default. Settings → Tools → Agent browser, then reload.
Full notes: #569