The OpenBot Recorder and the OpenBot Browser: teach a Bot by doing it in your own browser

.env.example

@@ -166,6 +166,11 @@ COPILOTKIT_LICENSE_TOKEN=
 # CPK_INTELLIGENCE_SKILLS_REVISION=exact-revision-id
 # See docs/automatic-learning.md for managed/self-hosted setup and permissions.
 
+# OpenBot accepts the OpenBot Recorder extension only from its own extension id. A fork, or a build
+# signed with another key, has another id: list it here, comma separated, each 32 letters from a to
+# p. Any other value stops the server at boot.
+# OPENBOT_RECORDER_EXTRA_EXTENSION_IDS=
+
 # How long a Bot's stream may say nothing before this deployment gives up on the turn, in
 # milliseconds. A Bot is any AG-UI endpoint, which means it will be redeployed mid-answer, its own
 # upstream will time out, and it will sometimes accept a connection and then write nothing at all.
@@ -207,6 +212,11 @@ OPENAI_API_KEY=
 #   BOT_MODEL=openai/gpt-5.5
 #
 # OPENAI_BASE_URL=
+# Behind an OPENAI_BASE_URL that is not OpenAI or Azure, built-in Bots call the endpoint's Chat
+# Completions API, which is what most compatible endpoints serve. A gateway that also serves the
+# Responses API keeps Responses-only features, such as reasoning summaries, with `responses`.
+# `chat` forces Chat Completions; any other value is an error when a built-in Bot runs.
+# COPILOTKIT_OPENAI_API=responses
 
 # Optional dictation, independent of every agent/chat provider. Set provider, base URL,
 # and model together. The endpoint must implement POST /audio/transcriptions under this
@@ -367,6 +377,16 @@ COMPUTER_TOKEN=
 # Optional absolute app-owned data root; defaults to the platform's OpenBot user-data directory.
 # OPENBOT_LOCAL_COMPUTER_DIR=
 
+# The OpenBot browser: each person's own browser, opened from OpenBot with the Recorder already in it
+# and connected. Unset, the supervisor below gives it a computer of its own (on a computer in the cloud
+# it reaches the open web, this OpenBot and the Intelligence gateway, nothing inside the deployment);
+# the one computer every Bot shares never runs it. Set, it runs on this
+# computer instead, as a window on the person's own desktop, while Bots' computers stay where they are:
+# OpenBot Desktop points it at its host-side local Chrome computer, called with COMPUTER_TOKEN. The
+# Recorder in it reaches OpenBot at OPENBOT_PUBLIC_URL (or BETTER_AUTH_URL), which must be https, or
+# http on 127.0.0.1 or [::1] with a port.
+# OPENBOT_BROWSER_URL=http://127.0.0.1:4101
+
 # Which Bot this computer belongs to, and therefore which profile directory it uses.
 # COMPUTER_BOT_ID=shared
 
@@ -426,7 +446,9 @@ MANAGED_AGENT_TOKEN=
 
 # One computer per Bot. Unset, every Bot shares the computer at AGENT_COMPUTER_URL, suitable on a
 # laptop and explicit about being one shared machine. Set, the supervisor gives each Bot a container
-# of its own, with its own /workspace and its own browser profile.
+# of its own, with its own /workspace and its own browser profile. A person's own OpenBot browser
+# runs only on a computer of its own, so it needs this (or OPENBOT_BROWSER_URL above): on the shared
+# computer a Bot's shell could read the person's logins off the disk.
 COMPUTER_SUPERVISOR_URL=
 # Shared with the supervisor. Not the security boundary, its four verbs are, but it keeps anything
 # else that can reach the port from cycling a Bot's computer.

.github/workflows/ci.yml

@@ -140,7 +140,8 @@ jobs:
       - run: >-
           bun test tests/sign-in.test.ts tests/session-cookies.test.ts tests/follows-popup.test.ts
           tests/demonstration-live.test.ts tests/webrtc-proxy.test.ts tests/web-bot-auth-browser.test.ts
-          tests/handoff-page-restore.test.ts tests/enter-text.test.ts
+          tests/handoff-page-restore.test.ts tests/enter-text.test.ts tests/person-browser.test.ts tests/person-browser-computer.test.ts
+          tests/screencast-keys-browser.test.ts
         working-directory: agent-computer
         env:
           OPENBOT_COMPUTER_BROWSER: '1'

.github/workflows/desktop.yml

@@ -9,10 +9,10 @@ name: Desktop
 # it at runtime with an `expect`, so a bad row panics the window rather than failing a type check.
 on:
   pull_request:
-    paths: ["desktop/**", "shared/harnesses.json", "shared/marks/**", "package.json", ".github/workflows/desktop.yml"]
+    paths: ["desktop/**", "shared/harnesses.json", "shared/marks/**", "shared/recorder-extension.json", "package.json", ".github/workflows/desktop.yml"]
   push:
     branches: [main]
-    paths: ["desktop/**", "shared/harnesses.json", "shared/marks/**", "package.json", ".github/workflows/desktop.yml"]
+    paths: ["desktop/**", "shared/harnesses.json", "shared/marks/**", "shared/recorder-extension.json", "package.json", ".github/workflows/desktop.yml"]
   workflow_call:
     secrets:
       OPENBOT_GOOGLE_MODEL_OAUTH_CLIENT_SECRET:
@@ -143,6 +143,18 @@ jobs:
       - name: Rust regression tests
         run: cargo test --locked --lib --bins
         working-directory: desktop/src-tauri
+      # The binary run as the Recorder's browsers run it: the native messaging host Chrome starts, and
+      # the install that writes its manifests. The host name and extension id come from
+      # shared/recorder-extension.json, which the Rust reads at compile time.
+      - name: Recorder native host tests
+        run: cargo test --locked --test recorder_host
+        working-directory: desktop/src-tauri
+      # Only a release build is a GUI-subsystem executable on Windows, and only a release build proves
+      # the debug-only test seam is absent.
+      - name: Recorder native host tests (release)
+        if: matrix.platform.name == 'windows'
+        run: cargo test --locked --release --test recorder_host
+        working-directory: desktop/src-tauri
       # Hosted Windows runners are administrators. Exercise setup again with an actual Users-only
       # account: DISM's feature reads worked as CI's administrator but refused ordinary app users.
       - name: Windows standard-user setup regression

.gitignore

@@ -53,3 +53,6 @@ venv/
 .pytest_cache/
 .ruff_cache/
 .mypy_cache/
+
+# The Recorder extension's signing key never enters the repository (Decision 9).
+extension/**/*.pem