actionagent 1.8.1 → 1.9.0

data/app/services/action_agent/local_sandbox_claude_login.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+
+require "rbconfig"
+
+module ActionAgent
+  module LocalSandboxClaudeLogin
+    # The config directory is outside app/, so git, manifests and publishing
+    # never enumerate it. The CLI alone reads and writes its credentials.
+    def start_claude_login(sandbox)
+      workspace, = checkout_workspace!(sandbox)
+      directory = workspace.join("claude-login")
+      claude_logout(sandbox)
+      FileUtils.mkdir_p(directory, mode: 0o700)
+      env = sandbox_login_environment(workspace)
+      script = File.expand_path("../../../lib/action_agent/claude_login_process.rb", __dir__)
+      timeout = (ActionAgent.claude_code_login_timeout || 300).to_f.clamp(1, 600)
+      pid = spawn_group(env, RbConfig.ruby, script, directory.to_s, ActionAgent.claude_code_command.to_s, timeout.to_s,
+        chdir: workspace, in: File::NULL, out: File::NULL, err: File::NULL)
+      update_state(workspace) do |state|
+        state["claude_login_pid"] = pid
+        record_process_start(state, pid)
+      end
+      Process.detach(pid)
+      # Until the supervisor writes its own state, the flow reads as
+      # starting, not as no sign-in at all. Never over a newer state.
+      begin
+        File.write(directory.join("status.json"), JSON.generate(status: "starting"), mode: "wx", perm: 0o600)
+      rescue Errno::EEXIST
+        nil
+      end
+      { status: "starting", logged_in: false, auth_method: nil }
+    end
+
+    def submit_claude_login_code(sandbox, code)
+      unless code.is_a?(String) && code.match?(/\A[^\s\x00-\x1f\x7f]{1,2048}\z/)
+        raise self.class::Error, "Paste the single-use code from Claude's authorization page"
+      end
+      workspace, = checkout_workspace!(sandbox)
+      directory = workspace.join("claude-login")
+      update_state(workspace) do |state|
+        flow = claude_login_flow(workspace)
+        unless flow[:status] == "awaiting_code" && !state["claude_login_submitted"]
+          raise self.class::Error, "This sign-in is no longer waiting for a code; start again"
+        end
+        # The one-use flag is persisted; the code itself is only ever in the
+        # request and the pipe. All workers serialize on the workspace lock.
+        state["claude_login_submitted"] = true
+        File.open(directory.join("code.pipe"), File::WRONLY | File::NONBLOCK | File::NOFOLLOW) do |pipe|
+          pipe.write("#{code}\n")
+        end
+      end
+      { status: "submitted", logged_in: false, auth_method: nil }
+    rescue Errno::ENOENT, Errno::ENXIO, Errno::EPIPE
+      raise self.class::Error, "The sign-in expired; start again"
+    end
+
+    def claude_login_status(sandbox)
+      workspace, app = checkout_workspace!(sandbox)
+      flow = claude_login_flow(workspace)
+      if %w[starting awaiting_code submitted].include?(flow[:status])
+        state = read_state(workspace)
+        pid = state["claude_login_pid"]
+        return flow.merge(logged_in: false, auth_method: nil) if pid && group_identity(pid, sandbox.session_id, state) == :ours
+        return { status: "expired", logged_in: false, auth_method: nil }
+      end
+      reject_subscription_overrides!(app)
+
+      output, status = capture(sandbox_login_environment(workspace),
+        [ ActionAgent.claude_code_command.to_s, "auth", "status", "--json" ],
+        chdir: app, limit: 64 * 1024, timeout: self.class::LOGIN_STATUS_TIMEOUT)
+      login = status&.success? ? self.class.parse_login_status(output) : self.class::LOGGED_OUT
+      logged_in = login[:logged_in] && login[:auth_method] == "claude.ai"
+      # Permission changes never read the credential. Do not follow a link.
+      credential = workspace.join("claude", ".credentials.json")
+      File.chmod(0o600, credential) if credential.file? && !credential.symlink?
+      { status: logged_in ? "connected" : flow[:status], logged_in: logged_in, auth_method: logged_in ? "claude.ai" : nil }
+    end
+
+    def claude_logout(sandbox)
+      workspace = workspace_for(session_id!(sandbox.session_id))
+      logout_claude_workspace(workspace)
+      true
+    end
+
+    private
+
+    # Project settings are untrusted, and may otherwise silently select API
+    # billing instead of the subscription the user explicitly chose.
+    def reject_subscription_overrides!(app)
+      %w[settings.json settings.local.json].each do |name|
+        path = app.join(".claude", name)
+        next unless path.exist? || path.symlink?
+        raise self.class::Error, "Claude project settings must not be symlinks" if path.symlink? || app.join(".claude").symlink?
+        data = JSON.parse(File.read(path, 64 * 1024))
+        overrides = data.fetch("env", {}).keys.grep(/\A(?:ANTHROPIC_|CLAUDE_CODE_OAUTH_TOKEN\z)/)
+        if data.key?("apiKeyHelper") || overrides.any?
+          raise self.class::Error, "Remove Claude project authentication overrides before using a subscription"
+        end
+      end
+    rescue JSON::ParserError, TypeError, NoMethodError
+      raise self.class::Error, "Claude project settings must be valid JSON without authentication overrides"
+    end
+
+    def claude_login_flow(workspace)
+      path = workspace.join("claude-login", "status.json")
+      return { status: "disconnected" } unless path.file? && !path.symlink?
+
+      data = JSON.parse(File.read(path, 8192))
+      status = data["status"].to_s
+      result = { status: %w[starting awaiting_code submitted completed failed expired cancelled].include?(status) ? status : "failed" }
+      if status == "awaiting_code" && data["authorize_url"].to_s.match?(%r{\Ahttps://(?:claude\.ai|platform\.claude\.com)/oauth/authorize\?[^\s]+\z})
+        result[:authorize_url] = data["authorize_url"]
+      end
+      result
+    rescue JSON::ParserError, Errno::ENOENT
+      { status: "disconnected" }
+    end
+
+    def sandbox_login_environment(workspace)
+      config = workspace.join("claude")
+      home = workspace.join("claude-home")
+      [ config, home ].each do |directory|
+        raise self.class::Error, "Claude configuration must be a private directory" if directory.symlink?
+        FileUtils.mkdir_p(directory, mode: 0o700)
+        File.chmod(0o700, directory)
+      end
+      self.class.sanitized_environment.merge(
+        "HOME" => home.to_s, "XDG_CONFIG_HOME" => home.join(".config").to_s,
+        "CLAUDE_CONFIG_DIR" => config.to_s, "DISABLE_AUTOUPDATER" => "1",
+        self.class::SESSION_ID_ENV => workspace.basename.to_s
+      )
+    end
+
+    def logout_claude_workspace(workspace)
+      return unless workspace.directory?
+
+      state = read_state(workspace)
+      pid = state["claude_login_pid"]
+      stop_groups([ pid ]) if pid && group_identity(pid, workspace.basename.to_s, state) == :ours
+      if workspace.join("claude").directory? && !workspace.join("claude").symlink?
+        capture(sandbox_login_environment(workspace), [ ActionAgent.claude_code_command.to_s, "auth", "logout" ],
+          chdir: workspace, limit: 1024, timeout: self.class::LOGIN_STATUS_TIMEOUT)
+      end
+    ensure
+      if workspace&.directory?
+        %w[claude claude-home claude-login].each { |name| FileUtils.rm_rf(workspace.join(name)) }
+        update_state(workspace) { |current| current.delete("claude_login_pid"); current.delete("claude_login_submitted") }
+      end
+    end
+  end
+end

data/app/services/action_agent/mcp_client.rb

@@ -43,8 +43,12 @@ module ActionAgent
     end
 
     # Returns { text:, is_error: } — the tool result's text content.
-    def call_tool(name, arguments = {})
-      Rails.logger.debug("[MCPClient] call #{name} args=#{arguments.inspect[0, 200]}")
+    # +log_arguments+ false keeps the argument values out of the debug log,
+    # which then names only their keys: for a call that carries a
+    # credential.
+    def call_tool(name, arguments = {}, log_arguments: true)
+      logged = log_arguments ? arguments.inspect[0, 200] : "[FILTERED] #{arguments.to_h.keys.inspect}"
+      Rails.logger.debug("[MCPClient] call #{name} args=#{logged}")
       ensure_session!
       response = post(
         { jsonrpc: "2.0", id: next_id, method: "tools/call",

data/app/services/action_agent/mcp_recording_middleware.rb

@@ -1,91 +1,121 @@
 # frozen_string_literal: true
 
 module ActionAgent
-  # Middleware for recording MCP tool calls during browser automation
+  # Used to record an agent's browser tool calls on a session recording.
   #
-  # This middleware intercepts Playwright MCP tool calls and records them
-  # to a SessionRecording for playback and debugging.
+  # #intercept wraps one tool call. A Playwright MCP browser tool call is
+  # stored as an `action` RecordingEvent: the tool, its parameters with the
+  # typed values masked (BrowserToolRedaction) and +secrets+ scrubbed, its
+  # outcome and its duration. Any other tool passes straight through and is
+  # not recorded.
   #
-  # Usage:
-  #   middleware = MCPRecordingMiddleware.new(session_recording: recording)
-  #
-  #   # Process a tool call
-  #   result = middleware.intercept(tool_call) do
-  #     # Execute the actual MCP tool
-  #     mcp_client.call_tool(tool_call)
+  #   middleware = MCPRecordingMiddleware.new(agent_run: run, secrets: -> { owner_credentials })
+  #   result = middleware.intercept(tool_name: "browser_type", parameters: arguments) do
+  #     mcp_client.call_tool("browser_type", arguments)
   #   end
   #
+  # The recording is the one given, else the live recording of the sandbox
+  # session or agent run, created on the first browser call. Failing to
+  # record is logged and never changes the call's result or exception.
   class MCPRecordingMiddleware
-    # Map of Playwright MCP tool names to our action types
+    # The browser tools of Playwright MCP, as the browser sidecar pins it, and
+    # the action type each is recorded as. Listing console messages or
+    # network requests is not recorded.
     PLAYWRIGHT_TOOLS = {
       "browser_navigate" => "navigate",
+      "browser_navigate_back" => "navigate",
+      "browser_navigate_forward" => "navigate",
+      "browser_reload" => "navigate",
+      "browser_tabs" => "navigate",
       "browser_click" => "click",
+      "browser_check" => "click",
+      "browser_uncheck" => "click",
+      "browser_mouse_click_xy" => "click",
       "browser_type" => "type",
+      "browser_press_sequentially" => "type",
       "browser_fill_form" => "form_fill",
       "browser_press_key" => "key_press",
+      "browser_keydown" => "key_press",
+      "browser_keyup" => "key_press",
       "browser_snapshot" => "snapshot",
       "browser_take_screenshot" => "snapshot",
       "browser_hover" => "hover",
+      "browser_mouse_move_xy" => "hover",
       "browser_select_option" => "select",
       "browser_file_upload" => "file_upload",
       "browser_handle_dialog" => "dialog",
       "browser_evaluate" => "evaluate",
       "browser_wait_for" => "wait",
       "browser_drag" => "drag",
-      "browser_scroll" => "scroll"
+      "browser_drop" => "drag",
+      "browser_mouse_drag_xy" => "drag",
+      "browser_mouse_wheel" => "scroll"
     }.freeze
 
-    attr_reader :recording_service
+    ERROR_LIMIT = 1000
+
+    def self.browser_tool?(tool_name)
+      PLAYWRIGHT_TOOLS.key?(tool_name.to_s)
+    end
 
-    def initialize(session_recording: nil, sandbox_session: nil, agent_run: nil)
+    # +secrets+ is an Array of values to scrub from what is stored, or a
+    # callable returning one, called on the first browser call only.
+    def initialize(session_recording: nil, sandbox_session: nil, agent_run: nil, secrets: [])
       @recording = session_recording
       @sandbox_session = sandbox_session
       @agent_run = agent_run
-
-      # Create or find recording if not provided
-      @recording ||= find_or_create_recording
-      @recording_service = SessionRecordingService.new(@recording) if @recording
+      @secrets = secrets
     end
 
-    # Intercept an MCP tool call and record it
+    # Runs the block, the tool call, and returns its result. A browser tool
+    # call is recorded once it returns or raises.
     def intercept(tool_name:, parameters:)
-      action_type = PLAYWRIGHT_TOOLS[tool_name]
-
-      # If not a Playwright tool, just execute and return
-      unless action_type
-        return yield if block_given?
-        return nil
-      end
+      action_type = PLAYWRIGHT_TOOLS[tool_name.to_s]
+      return (yield if block_given?) unless action_type
 
-      # Execute the tool
+      started_at = Time.current
       result = nil
-      screenshot = nil
       error = nil
-
       begin
         result = yield if block_given?
-
-        # Extract screenshot from result if present
-        screenshot = extract_screenshot(result)
-      rescue => e
-        error = e.message
+      rescue StandardError => e
+        error = e
         raise
       ensure
-        # Record the action
-        record_action(action_type, tool_name, parameters, result, screenshot, error)
+        record_action_event(tool_name.to_s, action_type, parameters, result, error, started_at)
       end
-
       result
     end
 
+    # The recording this middleware writes to, or nil when there is none and
+    # none could be started.
+    def recording
+      return @recording if @recording || @recording_resolved
+
+      @recording_resolved = true
+      @recording = find_or_create_recording
+    rescue StandardError => e
+      Rails.logger.warn("[ActionAgent] could not start a session recording: #{e.class}: #{e.message}")
+      nil
+    end
+
+    # True once a recording has been found or started; never starts one.
+    def recording_started?
+      @recording.present?
+    end
+
+    def recording_service
+      @recording_service ||= recording && SessionRecordingService.new(recording)
+    end
+
     # Convenience method for recording a navigation
     def record_navigate(url:, screenshot: nil)
-      @recording_service&.navigate(url: url, screenshot: screenshot)
+      recording_service&.navigate(url: url, screenshot: screenshot)
     end
 
     # Convenience method for recording a click
     def record_click(selector:, screenshot: nil, element_description: nil)
-      @recording_service&.click(
+      recording_service&.click(
         selector: selector,
         screenshot: screenshot,
         metadata: { element: element_description }.compact
@@ -94,12 +124,12 @@ module ActionAgent
 
     # Convenience method for recording text input
     def record_type(selector:, text:, screenshot: nil)
-      @recording_service&.type(selector: selector, text: text, screenshot: screenshot)
+      recording_service&.type(selector: selector, text: text, screenshot: screenshot)
     end
 
     # Record current page state for handoff
     def capture_for_handoff(url:, cookies: nil, local_storage: nil, form_values: nil)
-      @recording_service&.capture_handoff_state(
+      recording_service&.capture_handoff_state(
         url: url,
         cookies: cookies,
         local_storage: local_storage,
@@ -109,12 +139,12 @@ module ActionAgent
 
     # Complete the recording
     def complete!
-      @recording_service&.complete!
+      recording_service&.complete!
     end
 
     # Fail the recording
     def fail!(error_message = nil)
-      @recording_service&.fail!(error_message)
+      recording_service&.fail!(error_message)
     end
 
     private
@@ -122,120 +152,49 @@ module ActionAgent
     def find_or_create_recording
       if @sandbox_session
         SessionRecording.recording.find_by(sandbox_session: @sandbox_session) ||
-          SessionRecording.start!(sandbox_session: @sandbox_session)
+          SessionRecording.start!(sandbox_session: @sandbox_session, source: "agent")
       elsif @agent_run
         SessionRecording.recording.find_by(agent_run: @agent_run) ||
-          SessionRecording.start!(agent_run: @agent_run)
+          SessionRecording.start!(agent_run: @agent_run, source: "agent")
       end
     end
 
-    def record_action(action_type, tool_name, parameters, result, screenshot, error)
-      return unless @recording_service
-
-      metadata = {
-        tool_name: tool_name,
-        parameters: parameters,
-        error: error
+    def record_action_event(tool_name, action_type, parameters, result, error, started_at)
+      finished_at = Time.current
+      target = recording
+      return unless target
+
+      arguments = (parameters || {}).to_h.deep_stringify_keys
+      failure = error&.message || result_error(result)
+      data = {
+        "tool_name" => tool_name,
+        "action_type" => action_type,
+        "parameters" => SecretScrubber.scrub(BrowserToolRedaction.redact_arguments(tool_name, arguments), secrets),
+        "status" => failure ? "error" : "done",
+        "error" => failure && SecretScrubber.scrub(
+          BrowserToolRedaction.redact_text(tool_name, failure.to_s.truncate(ERROR_LIMIT), arguments), secrets
+        ),
+        "duration_ms" => ((finished_at - started_at) * 1000).round,
+        "trace_id" => @agent_run&.trace_id
       }.compact
 
-      case action_type
-      when "navigate"
-        @recording_service.navigate(
-          url: parameters["url"],
-          screenshot: screenshot
-        )
-      when "click"
-        @recording_service.click(
-          selector: parameters["ref"] || parameters["selector"],
-          screenshot: screenshot,
-          metadata: metadata.merge(
-            element: parameters["element"],
-            button: parameters["button"]
-          ).compact
-        )
-      when "type"
-        @recording_service.type(
-          selector: parameters["ref"] || parameters["selector"],
-          text: parameters["text"],
-          screenshot: screenshot,
-          metadata: metadata
-        )
-      when "form_fill"
-        @recording_service.fill_form(
-          fields: parameters["fields"] || [],
-          screenshot: screenshot
-        )
-      when "key_press"
-        @recording_service.key_press(
-          key: parameters["key"],
-          screenshot: screenshot
-        )
-      when "snapshot"
-        # For snapshots, extract DOM if available
-        dom = extract_dom(result)
-        @recording_service.capture_snapshot(
-          screenshot: screenshot,
-          dom: dom,
-          full_page: parameters["fullPage"]
-        )
-      when "hover"
-        @recording_service.hover(
-          selector: parameters["ref"] || parameters["selector"],
-          screenshot: screenshot
-        )
-      when "select"
-        @recording_service.select_option(
-          selector: parameters["ref"] || parameters["selector"],
-          values: parameters["values"] || [],
-          screenshot: screenshot
-        )
-      when "file_upload"
-        @recording_service.file_upload(
-          paths: parameters["paths"] || [],
-          screenshot: screenshot
-        )
-      when "dialog"
-        @recording_service.dialog(
-          accept: parameters["accept"],
-          text: parameters["promptText"],
-          screenshot: screenshot
-        )
-      when "evaluate"
-        @recording_service.evaluate(
-          function: parameters["function"],
-          result: result,
-          screenshot: screenshot
-        )
-      else
-        # Generic recording for other actions
-        @recording&.record_action!(
-          action_type: action_type,
-          selector: parameters["ref"] || parameters["selector"],
-          value: parameters.to_json,
-          screenshot: screenshot,
-          metadata: metadata
-        )
-      end
+      target.record_server_event!(kind: "action", data: data, started_at: started_at, finished_at: finished_at)
+    rescue StandardError => e
+      Rails.logger.warn("[ActionAgent] browser action #{tool_name} not recorded: #{e.class}: #{e.message}")
     end
 
-    def extract_screenshot(result)
-      return nil unless result.is_a?(Hash) || result.respond_to?(:[])
+    # A tool that fails without raising answers with an error key.
+    def result_error(result)
+      return nil unless result.respond_to?(:key?)
 
-      # Try different paths where screenshot data might be
-      result["screenshot"] ||
-        result[:screenshot] ||
-        result.dig("data", "screenshot") ||
-        result.dig(:data, :screenshot)
+      result[:error] || result["error"]
     end
 
-    def extract_dom(result)
-      return nil unless result.is_a?(Hash) || result.respond_to?(:[])
-
-      result["dom"] ||
-        result[:dom] ||
-        result["snapshot"] ||
-        result[:snapshot] ||
-        result.dig("data", "dom")
+    def secrets
+      @resolved_secrets ||= Array(@secrets.respond_to?(:call) ? @secrets.call : @secrets)
+    rescue StandardError => e
+      Rails.logger.warn("[ActionAgent] recording secret lookup failed: #{e.class}: #{e.message}")
+      @resolved_secrets = []
     end
   end
 end

data/app/services/action_agent/mcp_tool_dispatcher.rb

@@ -19,23 +19,31 @@ module ActionAgent
   # that sandbox on the agent. Such a key is treated as if the agent had it
   # enabled, and resolves exactly as a saved one does: through
   # SandboxSession.runtime_server_entry, among the agent's owner's sessions,
-  # and only while it is live. Only runtime keys are taken; a catalog server
-  # the agent does not enable stays out of reach.
+  # and only while it is live. The sandbox's browser, "browser:<session_id>",
+  # is reached the same way (SandboxSession.browser_server_entry), and only
+  # this way. Only those keys are taken; a catalog server the agent does not
+  # enable stays out of reach.
   class MCPToolDispatcher
     HTTP_TRANSPORTS = %w[http streamable_http sse].freeze
     class SandboxUnavailable < MCPClient::Error; end
 
     attr_reader :extra_server_keys
 
-    # A runtime explicitly selected for this run must not silently disappear
-    # between enqueue, discovery and a tool call.
+    # A runtime or browser explicitly selected for this run must not silently
+    # disappear between enqueue, discovery and a tool call.
     def ensure_extra_servers_live!
       extra_server_keys.each do |key|
-        sandbox = SandboxSession.for_owner(agent.try(:owner)).find_by(session_id: key.delete_prefix(SandboxSession::RUNTIME_SERVER_PREFIX))
+        if SandboxSession.browser_server_key?(key)
+          next if SandboxSession.browser_server_entry(key, owner: agent.try(:owner))
+
+          raise SandboxUnavailable, "The browser of sandbox #{session_id_of(key)} is no longer running; " \
+            "start it again, or run without it"
+        end
+
+        sandbox = SandboxSession.for_owner(agent.try(:owner)).find_by(session_id: session_id_of(key))
         next if sandbox && (sandbox.ready? || sandbox.running?) && sandbox.runtime_server_entry
 
-        raise SandboxUnavailable, "Sandbox #{key.delete_prefix(SandboxSession::RUNTIME_SERVER_PREFIX)} is no longer running; " \
-          "start it again, or run without it"
+        raise SandboxUnavailable, "Sandbox #{session_id_of(key)} is no longer running; start it again, or run without it"
       end
     end
 
@@ -43,11 +51,17 @@ module ActionAgent
       @agent = agent
       @resolver = EvaluationToolResolver.new(agent)
       @extra_server_keys = Array(extra_server_keys).map { |key| key.to_s.strip }
-        .select { |key| SandboxSession.runtime_server_key?(key) }.uniq
+        .select { |key| SandboxSession.runtime_server_key?(key) || SandboxSession.browser_server_key?(key) }.uniq
       @clients = {}
       @listed_by = {}
     end
 
+    # Whether this run reaches a sandbox's browser, whose tools then replace
+    # AgentToolbox's own browser tools.
+    def browser_attached?
+      extra_server_keys.any? { |key| SandboxSession.browser_server_key?(key) }
+    end
+
     # Whether this tool belongs to one of the agent's own reachable servers —
     # by its name, or because one of them listed it in the last
     # +tool_definitions+.
@@ -123,7 +137,8 @@ module ActionAgent
           end
         rescue MCPClient::Error => e
           if extra_server_keys.include?(key)
-            raise SandboxUnavailable, "Cannot load tools from selected sandbox #{key.delete_prefix(SandboxSession::RUNTIME_SERVER_PREFIX)}: #{e.message}"
+            target = SandboxSession.browser_server_key?(key) ? "the browser of sandbox" : "selected sandbox"
+            raise SandboxUnavailable, "Cannot load tools from #{target} #{session_id_of(key)}: #{e.message}"
           end
           Rails.logger.warn("[MCPToolDispatcher] #{key} tools/list failed: #{e.message}")
           @discovery_errors[key] =
@@ -176,6 +191,10 @@ module ActionAgent
       key.to_s.strip.downcase
     end
 
+    def session_id_of(key)
+      key.delete_prefix(SandboxSession::RUNTIME_SERVER_PREFIX).delete_prefix(SandboxSession::BROWSER_SERVER_PREFIX)
+    end
+
     # The catalog entry for the server that serves this tool, but only when the
     # agent configured that server and the entry carries an http url. Scoping to
     # the agent's own servers is what keeps one agent's tools from reaching
@@ -229,11 +248,15 @@ module ActionAgent
       entry
     end
 
-    # A catalog server, or the app runtime of a checkout sandbox the agent's
-    # owner started (keys "sandbox:<session_id>"). The sandbox lookup is scoped
-    # to the agent's owner, so naming another tenant's session resolves to
-    # nothing.
+    # A catalog server, the app runtime of a checkout sandbox the agent's
+    # owner started (keys "sandbox:<session_id>"), or, for a key this run was
+    # given, that sandbox's browser ("browser:<session_id>"). The sandbox
+    # lookups are scoped to the agent's owner, so naming another tenant's
+    # session resolves to nothing.
     def catalog_entry(key)
+      if SandboxSession.browser_server_key?(key)
+        return extra_server_keys.include?(key) ? SandboxSession.browser_server_entry(key, owner: agent.try(:owner)) : nil
+      end
       return MCPCatalog.find(key) unless SandboxSession.runtime_server_key?(key)
 
       SandboxSession.runtime_server_entry(key, owner: agent.try(:owner))

data/app/services/action_agent/mock_sandbox_backend.rb

@@ -10,7 +10,7 @@ module ActionAgent
       @sandboxes = {}
     end
 
-    def create_sandbox(session, instance_tier: nil)
+    def create_sandbox(session, instance_tier: nil, boot_config: nil)
       tier = instance_tier || SandboxInstanceTier.free_tier
       name = "mock-sandbox-#{SecureRandom.hex(4)}"
 
@@ -39,6 +39,8 @@ module ActionAgent
         # Which variables would be set, never their values.
         @sandboxes[name][:environment_keys] = session.runtime_environment.keys
         @sandboxes[name][:mcp_url] = "http://127.0.0.1:8080/activeagents/mcp"
+        # The spec it would have booted with, secret names without values.
+        @sandboxes[name][:boot_config] = SandboxBootSpec.wrap(boot_config).redacted if boot_config
       end
 
       @sandboxes[name]

data/app/services/action_agent/playwright_mcp_client.rb

@@ -6,7 +6,14 @@ module ActionAgent
   class PlaywrightMCPClient < MCPClient
     DEFAULT_URL = ENV.fetch("PLAYWRIGHT_MCP_URL", "http://host.orb.internal:8931/mcp")
 
+    # @raise [Error] in a multi-tenant install, where one browser would be
+    #   shared by every tenant's runs
     def self.instance
+      if ActionAgent.multi_tenant?
+        raise Error, "The shared Playwright MCP server is not used in a multi-tenant install; " \
+          "a run gets a browser from its sandbox"
+      end
+
       @instance ||= new
     end