Reliable browser use, with a fast path.
Browser Runtime runs real browser tasks without asking a frontier model for every click. Browser mechanics, safety, verification and recovery are deterministic systems; models are used only where judgement or writing is actually required.
npm install @mlola/browser-runtime
export TYPESAFE_API_KEY="..." # fast-path key: https://typesafe.ai
npx @mlola/browser-cli browser doctor
npx @mlola/browser-cli browser run \
--goal "Download my latest invoice" \
--url https://billing.example.com/invoices
One step
One observation. One decision. One typed action.
The loop is deliberately boring: every step is observable, every effect is verified, and no model has direct authority over the browser.
Step 1
Observe
One atomic observation per step: controls, labels, values, geometry and page state in a single pass, with no screenshot in the normal loop.
Step 2
Decide
One request to the fast path: the model picks one operation and its target from the list that is actually compatible.
Step 3
Policy
Risk is classified in code: payments, deletions, sends, secrets. Risky actions need approval or a human takeover.
Step 4
Execute
A typed action runs after freshness, visibility and occlusion checks. Model output never becomes a selector or code.
Step 5
Verify
“Done” is a claim. Independent evidence confirms it: an artifact, a URL, DOM state, a runtime event, or a human.
Model routing
Four tiers, each with a job.
The frontier model is a fallback, not the default path. What decides cost is how many routine steps the fast path handles, and that is measured on every run.
Fast path
Routine decisions: operation and target. One request per step, with its latency measured every time.
Planner
Only for long-horizon work: laying out subgoals and handling dead ends.
Text helper
Used only when a value must be written; otherwise your own wording is reused as it is.
Human
Login, OTP, CAPTCHA and risky decisions: the runtime pauses and hands over control.
Guarantees
Safe by rule, and able to prove it.
Safety
Boundaries are code, not prompt requests.
- Typed actions only: no selector, coordinate or JavaScript ever comes from a model
- Risk can only be raised by the target's context; a model cannot lower it
- Passwords, OTP and card data require a takeover and never enter model state or traces
- Page content that reads like an instruction is quarantined, not negotiated
- Actions with an unknown effect (submits, uploads) are never retried without observing again
Evidence
Verifiable, recoverable, auditable.
- Every step is verified against the next observation
- An append-only local event log you can replay and audit
- A deterministic eval corpus: core, matrix, security, regression, stress
- Every real bug is reduced to a permanent regression case
- Per-run metrics: fast-path share, latency, cost, human interventions
Status
Version 1 runs today.
It drives Chrome through Playwright, with a profile the runtime manages or by attaching to a browser you already have open. The npm packages are published, with the CLI and a local daemon.
It also drives the Chrome you already use, through the extension: an isolated Agent Window, and a tab of yours is borrowed only after you approve. Capabilities are advertised honestly: what the attached browser cannot do is refused, not imitated.