feat: add browser-only Cloudflare price agent and saved sessions

[kevinaimonster]

What changed

Add a private Cloudflare browser agent demo with multi-turn DeepSeek Flash conversations, a remote Chrome view, exact-text price evidence, and per-conversation browser checkpoints. An operator can save and close a browser, reconnect to an existing session, or restore cookies and current-origin web storage into a new browser.

The model receives seven browser actions and one price-evidence tool. Unknown tools and invalid navigation URLs are rejected before browser creation. Intercepted requests reject local/internal protocols, agent interactions validate the current page, and clicks reject file inputs, explicit download links and non-web links. There are no filesystem, shell, desktop-control or arbitrary JavaScript tools. These checks complement the model instructions; they do not claim to sandbox every manual Live View operation or browser-initiated download.

The standalone HTML architecture diagram maps the deployed modules and provides step-by-step highlighting of the model/tool loop and the separate Live View stream. Agents SDK and our tool executor run in the Worker's SQLite Durable Object; Puppeteer controls Chrome in Browser Run. The optional local Node proxy only forwards authenticated HTTP. The document compares this with local-agent/CDP, Quick Actions/REST, MCP, and the separate Docker/OpenMuse computer setup.

Checkpoint credentials remain in private SQLite rows, separate from synchronized Agent state and model messages. Failed or oversized saves retain the previous checkpoint, failed restoration closes its incomplete browser, and a provider 429 stops the loop without discarding the checkpoint. The main OpenMuse runtime is unchanged; this example has its own dependencies and manual deployment.

Verification

• npm run check, all 28 unit tests, a Worker deployment dry run, root Biome checking of 189 files, JavaScript syntax checking, diff whitespace checks and a known-environment-credential scan passed.
• Simulated browser-protocol tests execute the serialized page callbacks and cover checkpoint lifecycle/isolation plus the browser-only dispatcher, local navigation before launch, installed request interception, a manually changed local page, file controls and non-web links. These tests do not establish real Chrome behavior.
• Architecture HTML checks passed for HTTP serving and all seven interactive steps/highlight updates. Visual browser acceptance was not run.
• The browser-only revision is deployed to the existing demo, version c3dc1ab5-a684-4c85-b58a-800b889c7469. A real cloud DeepSeek turn refused listing server files/reading file:///etc/passwd, and no browser was launched. The subsequent public catalogue browsing check was blocked by Cloudflare HTTP 429 at browser creation. Real-browser acceptance of this policy and the checkpoint lifecycle remains incomplete. No browser was left running by the check, and no billing-plan change was made.
• The original deployment had verified actual model calls, multi-turn catalogue browsing, an official pricing-page read, Live View URL issuance and stop/close. The earlier checkpoint revision also passed fifteen local Miniflare HTTP checks. Those historical checks do not substitute for real-browser acceptance of the current revision.
• Main server/mobile/container suites were not run. Remote CI status is separate; no merge has been performed.

Original remote-browser observation, showing a fictional product page; this is not visual acceptance of the chat UI or architecture HTML:

Integration limits

Requires Workers, SQLite Durable Objects, Browser Run access, a DeepSeek key and a private owner token. This is a single-owner demo, not a deployed 2000-tenant authentication and scheduling service. No public /agents/* route is exposed. Live View URLs are temporary bearer credentials issued only after application authentication.

A checkpoint covers one current page and its origin's storage, up to 512 KiB. It excludes other tabs, IndexedDB, downloads, history, cache and JavaScript memory; website sessions may expire. An already closed browser without a checkpoint cannot be recovered retroactively. Hostname validation is not DNS pinning or a replacement for provider isolation. Browser placement is Cloudflare-managed and Tokyo residency is not guaranteed. CI does not deploy.