Module builder 

BrowserAgentBuilder — assembles a SOTA browser agent from the harness capabilities (spec §5.10, the capstone that ties the module together).

Everything else in crate::browser is a focused, independently-tested capability: snapshot distillation (super::distill), stale-uid+snapshot reliability (super::harness), action verification (super::verify), settle ([super::settle]), plan/replan (super::plan), completion judging (super::judge), the domain allowlist (super::guard), destructive-action confirmation (super::confirm), and the injection heuristic (super::inject). This builder wires the always-on, structural pieces onto a live agent:

1. Connects the bundled chrome-devtools MCP preset (connect_preset) → Vec<Arc<dyn Tool>>.
2. Wraps every interaction tool in ReliableInteractionTool so mutating actions force a fresh snapshot and retry once on a stale uid.
3. Installs a deny-by-default DomainAllowlistGuard (the cheapest, highest- value safety control — it stops the dangerous first step of the lethal trifecta).
4. Sets a research-informed system prompt (BROWSER_SYSTEM_PROMPT) that encodes the loop invariants the SOTA literature converged on.

The remaining capabilities are loop policies a caller drives turn-by-turn (verify after each act, settle before each read, judge at the end, confirm destructive clicks, scan results for injection) — they are pure functions by design so the agent loop, not a hidden harness, stays in control. The builder exposes them via config and the public re-exports rather than burying them.

Testability: the assembly is split so the load-bearing wiring is unit-testable without a browser — browser_guardrails and wrap_browser_tools are pure and exercised with mocks; BrowserAgentBuilder::connect (which spawns real Chrome) is the thin async shell, covered by a #[ignore] live test.

Structs

BrowserAgentBuilder

Fluent builder assembling a browser AgentRunner from the harness pieces.

Constants

BROWSER_SYSTEM_PROMPT

System prompt encoding the SOTA browser-agent loop invariants (Agent-E “change observation”, Online-Mind2Web/WebJudge completion checking, Plan-and-Act replanning, Manus goal-recitation, lethal-trifecta safety). It is appended to / used as the agent’s instructions so the model drives the pure-capability functions correctly.

Functions

browser_guardrails

Build the always-on guardrail stack for a browser agent: a deny-by-default DomainAllowlistGuard over allow_hosts, plus any extra guardrails the caller supplied. Returned as Vec<Arc<dyn Guardrail>> ready for AgentRunnerBuilder::guardrails.

filter_tools

Keep only tools whose name is in allow. An empty allow keeps everything (no filtering). This is the dominant input-token lever for an MCP browser agent: the chrome-devtools preset exposes ~26 tools whose definitions are re-sent on every turn, while a task typically needs under ten.

wrap_browser_tools

Wrap raw MCP tools for browser reliability: every interaction tool becomes a ReliableInteractionTool (forces includeSnapshot on mutations, retries once on a stale uid). Non-mutating tools pass through unchanged. Pure and testable without a browser.