Feature deep dive
Building is half the job. The other half is opening the app, signing up, reading the code from the email, paying with a test card, and checking the console. Jack gives agents that half: a Chromium window they drive while you see the cursor glide, an allowlist you extend with one click, test credentials they use but never read, a mailbox that hands back the verification code, and a Playwright spec at the end that any CI can replay.
The browser opens from the globe icon on the right rail, or automatically the first time an agent calls a browser tool. The toolbar has back, forward, reload, an editable URL and an activity chip such as "agent clicked Login", so you can follow without reading the transcript. On the page, a cursor drawn by Jack moves to every element the agent clicks, types into or selects, with a ring on the click. One browser per workspace: the backend agent starts npm run dev, the frontend agent smoke-tests it, you see one surface.
It is a window, docked to Jack's right edge by default and undockable, because an embedded tab stole your caret and lost state when popped out. Cookies and storage are partitioned per workspace; your real browser profile is never touched.
[ref=eNN] handles, screenshot to disk, console messages, failed requests.
Navigation is allowlisted: localhost, 127.0.0.1 and *.local out of the box. Anything else shows an in-page interstitial with Allow example.com. Page content is untrusted input by design; the agent is told so, and the permission cards still stand between it and anything destructive.
Settings → Test vault holds entries such as a test identity, a Stripe test card or a staging login, attached to workspaces. Fields are fixture (visible, like the card number) or secret (masked, never returned to the agent). The agent types with secretRef: 'vault:staging-user.password'; the host fills the value inside the browser driver and registers it with a redactor, so every snapshot, console line and wait result shows [vault:staging-user.password] instead. A usage tab logs entry, field, session, tool and page, never values.
Settings → Mailboxes points at a mailbox service, self-hosted on a Cloudflare Worker today. The agent asks for an address like acme-signup-7f3a@test.example, uses it in the form, then waits. Jack returns the first matching mail with subject, text, extracted codes and links. Extraction is weighted, so "Order 100200 confirmed, your verification code is 483920" picks the right number. Mail that arrived before the wait call is still served, because the clock starts at address generation.
When the flow works, jack_browser_export_test writes the recorded actions as a plain @playwright/test spec under tests/smoke/. It runs with npx playwright test anywhere. Secrets become process.env.JACK_VAULT_STAGING_USER__PASSWORD, with the variable name copyable from Settings for your CI. The spec then shows up in the Services panel with a Play in Jack button that replays it in the workspace browser with the agent cursor, step by step, and reports passed, failed at step N, or stopped.
:3000 before it navigates.No. The agent browser is a Chromium window inside Jack with an isolated cookie and storage partition per workspace. It never sees your logins, extensions or history. The escape hatch of running a Playwright MCP server against your Chrome profile is exactly what this replaces.
Only hosts on the workspace allowlist: localhost, 127.0.0.1 and .local by default. Any other navigation shows an interstitial inside the page with a one-click Allow for that host. Sub-resources such as a CDN stylesheet are not filtered, so a dev page renders as it would in Chrome.
No. Reading the tab (snapshot, screenshot, console, network errors) is on by default. Driving it (navigate, click, type, press, select, wait, export) is off until you enable Allow agent to drive the browser tab in Settings → Privacy. Once enabled, individual clicks are not each behind a card, because ten cards for a ten-step smoke test is not supervision.
With the test vault. Fields marked secret never enter the model's context. The agent types with secretRef vault:entry.field, the host resolves the value inside the browser driver and registers it with a redactor, so every text output of every browser tool shows [vault:entry.field] instead. Screenshots are not redacted; the tool description and Settings say so.
With the test mailbox. The agent mints a disposable address, hands it to the app under test, then calls a wait tool. Jack returns the first matching message with subject, text and the extracted codes and links, wrapped in a notice that it is untrusted content from an external sender.
A plain @playwright/test spec under tests/smoke/
Two measured symptoms: clicking inside an embedded webview stole the caret from what you were typing in chat, and popping the browser out reloaded the page and lost the smoke-test state. The browser is now its own window docked to Jack's right edge, following its position and minimize, undockable into a free window.
Not yet. The headless node has no browser driver, so the browser tools and the rail button are absent for remote workspaces rather than half-working.