Browser automation with capability-scoped tokens and a checkpoint before every irreversible click.

Every bearer is bound to one principal, an explicit capability set, and a 90-day TTL. A caller with authority:admin can issue new principals, but only a subset of its own capabilities, never authority:admin itself — and the server persists a SHA-256 hash of the bearer, never the plaintext. CDP and MCP connections are re-checked against the same capability set as HTTP, at dispatch, including long-lived sessions.

Mutating calls carry an idempotency-key; a duplicate returns idempotencyConflict (409) instead of re-running the command. Boundary actions (form submit, a followed link) go further: the runtime refuses to run one unless a checkpoint already names its exact commandId/attemptId — autoCheckpoint does this automatically, so a network retry can't double-submit.

Checkpoints record workflow, session, page, restart URL, and replayable inputs before boundary work. If the runtime can't prove an outcome after a loss, recovery status returns NeedsReconciliation instead of silently replaying the action. Event reads are cursor-based, so a resumed client either continues exactly where it left off or gets an EventGap — never a silent skip.

BrowserRuntimeClient (Node ≥ 22) sets the auth, interface-version, and correlation headers on every request and exposes typed calls for sessions, commands, checkpoints, recovery, and the event stream.

The same tool surface is reachable over stdio or streamable HTTP (POST /v1/mcp), and each tool — navigate, intent_fill, checkpoint_save, and the rest — is only advertised to a principal once it holds the required capability.

A separate, bearer-gated Chromium DevTools listener (default 127.0.0.1:9222) for Playwright/Puppeteer primitives — unlike a plain CDP endpoint, a connection still needs session:write and page:write before it can drive anything.