VectorBrainDownload VectorOxide is a real browser pane inside VectorBrain. What the agent reads is the page in front of you, in the session you signed into, and it asks before it touches anything.
VectorOxide’s real start screen, running on example data. The kept pages are invented.
pane.read returns the page’s text and numbers its buttons, links and fields itself, fresh on every read. A click names a number from the read just before it.
At most 120 elements and 32,000 characters per read. A longer page is read in part, and the answer says so.
find the first Saturday crossing
A click, a fill, a key press or a scroll stops for you, whatever your trust level. The card names the element in the page’s own words and shows where a link really goes.
Shown here on example data. On the one live run so far the standing grant was on, so this card has not yet been seen on a real site.
Up to 12 tabs, each its own webview on one shared profile. Every agent command means the tab in front, so it never works in a tab you cannot see.
Zoom is kept per site, 25% to 500%. Ask pins the page to your next message; Save and Capture keep it in the project.
Screenshot: the pane with a real page loaded.
Needs the running app rather than the capture harness, because the webview is native. Not captured yet.
A fill aimed at a password field is refused. An approval stores its input as it will run, so a password in one would sit in the app’s database while you decided.
You sign in yourself, and the agent then works inside that session.
On 2026-09-13 the agent opened a live page, read it, clicked through, filled a four-field form and submitted it, in the pane, in real time. Four runs, journal rows 59461 to 59585.
The standing autonomy grant was on, so none of those clicks stopped to ask.
Screen recording: the 2026-09-13 run, in the pane.
The agent opening a page, reading it, clicking through, filling a four-field form and submitting, in real time. Not recorded yet. The caption will say whether the standing autonomy grant was on or off when it was made.
pane.open, pane.read, pane.act and pane.capture count as outside data. Once a run uses one, it can make a new document but cannot change what exists, delete or run anything until your next message. And the pane’s webview carries none of the app’s code, so a page loaded in it cannot call the app at all.
vb-cmd-pane/src/pane.rsThe taint ruleAn address is checked before the pane hears it, and every navigation the page makes for itself is checked again. A plain-http hop is retried over https. The one loopback address it opens is a dev server this app started.
vb-cmd-pane/src/lib.rs · navigation_allowed, secure_formThe dev server, when it codesSave writes the page’s words into the project’s web/ folder, which the agent can only read back through a command that marks the run external. Capture photographs what you see into media/, and only you can press it.
vb-cmd-browser · browser.save; vb-cmd-pane · pane.captureThe agent can also read a page away from you, in a separate logged-out engine. Click and fill exist only in this pane, where you can see them happen.
vb-cmd-browser; vb-cmd-paneDeliberately absent. Even the start screen’s icons are letters on a colour made from the address, so opening it tells nine sites nothing.
vb-cmd-pane/src/lib.rs · MAX_TABSvb-cmd-pane/src/lib.rs · MAX_ELEMENTSvb-cmd-pane/src/lib.rs · MAX_TEXTvb-cmd-pane/src/lib.rs · MAX_FILLvb-cmd-pane/src/lib.rs · ACTIONSui/src/Browser.tsx · ZOOM_STEPSvb-app/src/pane.rsvb-cmd-pane/src/lib.rs · CAPTURE_CAPYes. The pane is one shared browser profile, so the agent reads and acts inside the session you opened. It cannot sign in for you: a fill aimed at a password field is refused, and you type your own passwords.
Not unless you say so. Every click, fill, key press and scroll stops for approval at every trust level. You can lift that for the rest of the app session with a box on the card, or grant standing autonomy in Settings, Trust. Only a person can grant either.
That run can no longer change anything that already exists, delete or run anything. It can still read, answer and write what it found as something new: a Canvas document, or a .md, .txt or .csv file under the project’s web/ folder, both marked as from the web. Your next message starts a new run without the restriction. The taint rule
No. The pane’s webview carries no capability and no script of the app’s, so a page loaded in it cannot reach the command bus. That was probed in the running app rather than assumed.
No. Every pane command acts on the tab in front. An agent that wants another page opens a new tab, which comes to the front where you see it.
Not yet. The live run on 2026-09-13 had the standing autonomy grant on, so none of its clicks stopped to ask. The card on this page is drawn from example data.
Windows. The pane is a WebView2 webview, and driving it works on Windows only today. Platform details
One pane, one session, and every click on a card you can read before it happens.