Why Browser Agent Handoffs Need More Than a Timeout

Designing a browser handoff system necessitates addressing more than just a simple timeout mechanism. To illustrate, consider a browser agent attempting to save data in an administration interface. At this point, the agent's permission to control the browser may have expired, but it is unclear whether the agent's request is still in transit, the website has already accepted the change, or both. The distinction between these outcomes is crucial and cannot be determined by a mere expiration timestamp.

At SessionDock, my team and I are developing a system that enables the creation of persistent Chromium workspaces and the temporary delegation of control to software agents. The core challenge lies in separating three distinct elements: browser data, permission to act, and the effects of an action. To achieve this, SessionDock's architecture employs slots, each with its own Chromium user-data and download directories.

These directories compartmentalize local browser data, while bindings identify the intended context of each workspace.

A lease grants temporary, exclusive control to an authorized actor, thereby answering different questions than the directories and bindings. For users requiring only two separate logins, this architecture may seem excessive. However, it becomes essential when dealing with controlled reuse by multiple actors, including agents whose work may arrive late. Even in this scenario, application-level conflicts can arise, as two separate slots may access the same product record on a website.

To manage these conflicts, SessionDock's state machine and scheduler incorporate a concept called an epoch, which represents the generation of the current control permission. When an agent receives control, it is assigned an epoch. If a human takes control and the epoch increments to 18, any prior actions carried out under epoch 17 will be rejected. This epoch check ensures that a permission that was once valid does not remain usable simply because an old request eventually arrives.

Implementing this epoch check requires unit tests and is connected to a complete real-browser dispatch path. However, even if an action passed its check before control changed, the epoch increment does not automatically cancel already admitted work. The handoff must account for this work rather than treating the epoch increment as cancellation. Once the website has accepted a change, no later local epoch can undo it.

In the context of a local timeout, it is essential to recognize that a stopped process does not guarantee that work has been undone. The absence of a reply does not identify the specific outcome, such as whether the request never reached the website, the website received it but has not finished processing it, or the website applied the change. Therefore, automatically translating a timed out event into a failed event is not advisable.