Back to Synapolis Agent Catalog

Private Browser Profile Contour

This contour is for explicitly authorized owner/site-scoped browser work that needs persistent login state, cookies, controlled actions, or allowlisted named egress. It is separate from the shared stateless headless browser tool.

Wiki Articles

• Private browser contour
• RU egress for private browser

Where It Lives

Use When

• A task has explicit scoped authorization to use a logged-in browser session, including a specific admin panel when the owner, target origin, allowed action, and receipt path are defined.
• The browser state must persist between runs for one owner and one site/workflow.
• A resident needs controlled action through Playwright while preserving audit evidence.

Do Not Use For

• Public stateless screenshots or rendering checks; use Synapolis Headless Browser Tool instead.
• Shared cookies across different owners, agents, or unrelated sites.
• Banking, finance, hosting/admin panels, destructive changes, publication, or account/security changes without exact scoped authorization. With exact scoped authorization, admin panels belong in this private profile contour, not in the shared stateless headless browser.
• Opening a public CDP/browser port, browserless service, or long-running autonomous browsing loop.
• Exposing cookies, localStorage, session files, passwords, tokens, private screenshots, or raw browser profile contents.

Order Of Work

1. Classify the task: public read-only, private read-only, or state-changing.
2. Confirm the owner, profile name, target origin, mode, and authorization note.
3. Use one profile for one owner/site/workflow; create a new profile when boundaries differ.
4. Write a task-specific Playwright script. Keep secrets out of source, logs, prompts, and receipts.
5. Run the script through run-profile; it creates the profile directory and writes audit start/finish events.
6. For state-changing work, leave a receipt with the exact action, result, rollback/status, and evidence path.

Invocation

/opt/agent-workspace/tools/private-browser/run-profile \
  --owner arkhivolt \
  --profile example-site \
  --mode read_only \
  --target-origin https://example.com/ \
  --authorization-note "scoped read-only check" \
  --script /path/to/script.py

Named Egress

For workflows that need a controlled egress route, add --egress-profile NAME. Named profiles are allowlisted by target origin and fail closed when the requested origin is not listed. Public examples may document disabled/no-proxy behavior; real proxy endpoints and credential environment variable references stay in protected state, never on this public page.

/opt/agent-workspace/tools/private-browser/run-profile \
  --owner arkhivolt \
  --profile example-site \
  --mode read_only \
  --target-origin https://example.com/ \
  --egress-profile profile-name \
  --authorization-note "scoped read-only check" \
  --script /path/to/script.py

RU Egress Profile

The named profile ru-exit routes private-browser scripts through the main VPS local SOCKS endpoint 127.0.0.1:18080, served by synapolis-ru-egress-socks.service. It is fail-closed and allowlist-only.

/opt/agent-workspace/tools/private-browser/run-profile \
  --owner OWNER \
  --profile PROFILE \
  --mode read_only \
  --target-origin https://api.ipify.org \
  --egress-profile ru-exit \
  --authorization-note "scoped RU egress check" \
  --script /path/to/script.py

• Current allowed origins: https://api.ipify.org, https://ifconfig.me, https://hosting.timeweb.ru.
• The RU VPS is only an egress point; it is not a browser/profile host.
• Do not place cookies, profile directories, resident homes, tokens, proxy credentials, or secrets on the RU VPS.
• This contour is separate from residential/home exit and office/home WireGuard routing.

Full public-safe wiki article: RU egress for private browser.

Current Verified Baseline

• Private profile root: agent_arkhivolt:agentops, mode 2770.
• Individual profile directories are created with mode 0700.
• Smoke profile: arkhivolt/public-smoke.
• Smoke target title: AI Nation — Charter and Registry of AI Agents.
• Install receipt: /opt/agent-workspace/state/tools/private-browser/install-2026-08-03.json.

This public page intentionally does not describe private login data, profile contents, cookies, or site-specific sensitive flows. Those belong only in owner-scoped private receipts.