The problem
AI agents are good at deciding what to do on a website, but the usual way to let them act is a headless "bot" browser. That breaks on logins, two-factor and bot checks, and it's invisible, so you can't see what the agent is doing or stop it before it clicks "Submit".
I wanted the opposite: the agent works in my everyday Chrome, where I'm already signed in, visibly, and it hands control back to me for anything sensitive.
How it works
- The extension reads the page like a person would. It builds a compact, meaningful map of what's on screen (buttons, fields, links) instead of dumping raw HTML. Password and card fields are masked before anything reaches the AI.
- You can see its intent. A ghost cursor moves and targets light up before each click or keystroke, at the speed you choose.
- It finds stubborn elements. When its own heuristics can't locate something, it falls back to the browser's accessibility tree, the same technique the big browser-automation tools use.
- Workflows with a pause button. Repeatable jobs are written as simple YAML steps with retry, skip or abort rules, and "pause for human" steps that hand control back and resume where they left off.
- A private vault. Autofill details live in a local AES-256-GCM encrypted vault, and nothing is typed into a form without the agent choosing the field and the human agreeing.
Decisions
- I pivoted the architecture. The first version was a separate Rust/Tauri browser that imported cookies from Chrome. Moving to an extension inside the user's real Chrome removed the cookie juggling entirely, because you're already signed in to everything.
- Security bugs fixed in the rewrite. Porting the vault surfaced two real crypto flaws in the original: a reused encryption nonce, and a key derived from the computer's name. The new vault uses a random key and a fresh nonce on every save.
- Least privilege. The powerful DevTools permission is attached only for the one operation that needs it (like file uploads), and the relay is a dumb pipe on localhost with no logic to exploit.
Status & next
A working personal tool I use with Claude Code. It's honest about its edges: there's no automated test suite yet, it drives one tab at a time, and form-filling doesn't yet get the accessibility fallback.
Next on the list: record-by-demonstration (do a task once, get a workflow), sending page changes instead of whole-page snapshots, and a vision fallback for canvas-based apps.