[williamloo-scale]

Stacked on #446.

Live and replayed websites.

• Live sites. @website(domains=[...], live=True, allow_hosts=[...]) declares a real site: its server serves only health, the data plane and the card (which advertises live and allow_hosts). @session returns the cookies a browser adds to start signed in; self.setting(name) reads a credential the deploy passes.
• browser/v1 (urn:agentenv:browser/v1): cookies/set and cookies/clear, operations of the same extension main's WebsiteBrowserEnvironment (feat(computer): WebsiteBrowserEnvironment, the base class for website browsers #449) declares with its build, clock and window; sign_in_browser picks a browser that offers cookies/set, so a website browser joins once it serves them (M5.11). The Playwright MCP browser serves them, writing its storage state and, through DevTools, any running context. Answers and errors never repeat a cookie's value.
• sign_in_browser step. Calls each live site's session and hands the cookies to the browser; reset_env signs in again. A deploy with a live site is marked reproducible=False with its live_websites, checked against the computer's allowlist.
• Website env settings. A website env's settings are its container's environment variables. A secret-looking setting must be a secret:/env: reference, resolved only into the compose file. The gateway's own variables, the role key among them, can't be set.
• Replay. python -m agentenv_protocol.website.replay capture URL... writes WARC 1.1; ReplayWebsite serves a capture for any host, with @api routes taking precedence. Example in examples/website/replay/.

Before merging

• The browser image's protocol floor rises to 0.1.405, the first release with website.browser, so it needs that release.
• website.session is now the decorator, which shadows the module.
• No run against a real browser or a real live site yet.

Test

Unit suite: 12,870 passed (one GitHub-clone test from main, which hangs on the local machine on main too, deselected).

🤖 Generated with Claude Code

Confidence Score: 5/5

The PR appears safe to merge; the wildcard cookie-clearing issue is fixed.

Summary

Adds live website declarations, browser sign-in, website settings, and WARC capture and replay.

• Live sites can sign a browser in and mark runs as non-reproducible.
• Website deployments can pass settings into the site container.
• Captured websites can be served again with custom API routes.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Session["Live site's session"] --> SignIn["sign_in_browser"]
  SignIn --> Clear["Clear old cookies"]
  Clear --> Set["Set new cookies"]
  Set --> Saved["Saved browser state"]
  Set --> Running["Running browser"]
  WARC["WARC capture"] --> Replay["ReplayWebsite"]
  Replay --> Pages["Captured pages and assets"]

Loading

_{Reviews (18) · Last reviewed commit: "fix(website): a wildcard site domain cov..." · Reviewed by Greptile}

[earakely-scale]

Website settings: suggest following the computer-app model

This PR makes a website env's settings bare environment variables of its container: self.setting(name) reads one, a setting whose name looks like a secret's must be a secret: / env: reference, and RESERVED_SETTINGS keeps them off the provider's own variables.

Computer apps already have a settings model for the same job (agentenv_protocol/computer/app.py):

• the class declares class Settings(BaseModel), and a SecretStr field is a secret;
• its JSON schema is stored with the env (AppDeclaration.settings), and put checks values against it;
• the server receives every value in one JSON variable keyed by environment_name (AGENTENV_APP_SETTINGS), validated into self.settings as it starts.

Suggest websites do the same, implemented in the website package (no imports from computer/):

• WebsiteEnvironment.Settings, read as self.settings, so a live site's credentials are SecretStr fields rather than names that look secret;
• values validated as the server starts, so a bad or missing value fails the deploy with the validation error, as an app's does, and at put too wherever the schema is known;
• one JSON variable, so settings can't collide with the provider's own variables (DATABASE_URL, WEBSITE_ROLE_KEY, and now WEBSITE_SESSION_SECRET from feat(website)!: WebsiteEnvironment serves a site on the website/v1 contract, and a conformance check tests any server (FD-4683) #428), and RESERVED_SETTINGS isn't needed.

For the rebase: #428 now validates @website(domains=...) with host_problem (moved down from this PR), drops health= in favour of ready with @website(ready_timeout_s=...), and answers session with {cookies, local_storage}, each cookie with max_age (see the resolved thread on #428).