SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

AIClaw 3.5 Gives Desktop AI Agent Element-Indexed Browser Control Without Playwright

0
·95 views

AIClaw, a local-first desktop agent, has released version 3.5 introducing browser automation that lets AI models interact with web pages via a numbered list of interactive elements rather than fragile screen coordinates. The new browser_snapshot tool returns up to 150 indexed elements — including role, visible text, value, and link target — so the model can act on element numbers instead of pixel positions. Ten browser tools are now available, including navigate, click, type, scroll, and extract, all routed through AIClaw's existing approval and session framework without special-casing. Because Electron already bundles Chromium, no external browser binary or Playwright installation is required, and the agent runs in a persistent, isolated BrowserWindow where logins are retained across sessions. Security guardrails include mandatory approval on every new URL navigation, strict-mode prompts for in-page write actions, full isolation from Node and preload scripts, and a restriction that blocks unattended channel sessions from accessing the browser entirely.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Company Names Do Not Establish Identity: 14 Tests Before CRM Import

Prospect files may describe a legal enterprise, one of its establishments, a trading name, a corporate group, or a contact, so similar names alone are unreliable for matching records. Importers that treat name similarity as proof can wrongly merge branches into parents, attach people to the wrong account, or erase separate buyers. The article recommends matching only on evidence that identifies the same entity, routing relationships and ambiguity to review, and never treating a score as certainty. It explains that French identifiers distinguish legal units (SIREN) from establishments (SIRET), so records sharing a SIREN may still describe different locations. The author offers a synthetic 14-case test pack and a conservative triage approach, with identity decided before person-level deduplication.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Dev.to API rate-limit retries cleared only half the time in one developer's pipeline

A developer's comment-reply pipeline hit dev.to API 429 rate-limit errors ten times since August, according to its work log. Counting outcomes showed that in-run retries cleared the limit in five cases and failed in five, with the failures resolved only by later scheduled runs. The script contains no retry or sleep logic; each backoff interval was improvised by whichever run encountered the error and then discarded. The author argues the log cannot distinguish whether retries or simply elapsed time caused the successful recoveries.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Connection Pools Starve When AI Agents Hold Leases During Slow External Calls

An article on DEV Community argues that outages can occur even when database CPU is nearly idle, because connections are held open while waiting on external systems. The author notes that AI agent runtimes, which leave a pooled connection leased during slow LLM or API streams, are a common cause. Using Little's Law, the piece shows that a 20-connection pool handling 2ms queries can sustain about 10,000 requests per second, but drops to roughly 0.7 requests per second when each connection is held for 28 seconds. The result is queuing, timeouts, and HTTP 500 or 503 errors despite low resource utilization. The article argues that vertical scaling does not solve the problem, and that the same pattern affects Redis, HTTP clients, Kafka, and CRM API quotas. It also states that single-threaded unit tests and staging environments typically fail to surface this issue.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Forwarded Headers Behind Tunnels: Why X-Forwarded-For, Proto and Host Can't Be Trusted Blindly

When an application runs behind a tunnel, headers such as X-Forwarded-For, X-Forwarded-Proto and X-Forwarded-Host determine what the app believes about the caller, the protocol and the requested hostname. Misconfiguring trust can cause harmless problems like redirect loops or a rate limiter treating all visitors as one, or more serious ones where an attacker controls values that security checks rely on. Tunnel providers such as ngrok and Cloudflare append client information rather than sanitizing it, so client-supplied values remain in the header. Only entries added by proxies the developer controls should be trusted, and reading the leftmost value is unsafe for security decisions. Redirect loops occur when an app enforcing HTTPS sees plain HTTP because TLS terminates at the edge, and frameworks such as Django and Rails provide proxy-header settings to resolve this.

0 comments Read more at DEV Community