Launch Agents with native editing and an embedded Chromium browser

[benfavre]

shelldeck --agents and shelldeck://agents open the production Agents interface with the existing account, settings and conversations. Normal launches and Open full ShellDeck restore the full application. Initial, secondary and simultaneous cold launches reuse one authenticated primary; startup failures return a nonzero status. Login and Dev authorization remain authoritative.

Local and SSH files open in the native middle-pane editor. Conversation, Editor and the live Chromium browser retain their tabs, forms and session-specific profiles when switching panes. Reopening Agents restores focus while preserving open confirmation, workflow, review and delivery dialogs. Native destinations such as Terminal restore the full shell, and close confirmation includes active agent runs.

Local Codex, Claude Code and configured ACP runs receive scoped browser observation tools. Explicit browser consent plus writable run permissions enables control. Private per-run MCP capabilities are revoked on completion, Stop, browser close and logout; SSH-hosted agents do not receive local browser capabilities. The separate CEF helper handles rendering, keyboard/IME, related popups, dialogs and explicit uploads/downloads. Clipboard support currently covers plain text; rich clipboard data and DOM paste events remain documented limitations.

Linux desktop actions, Windows installer shortcuts and macOS launch commands use the same executable. Browser bundles preserve versioned resources, public runtime permissions and macOS framework symlinks. Real AppImage validation exposed missing NSS modules loaded dynamically; packaging now deploys those modules, verifies the exact bundled engine and every loader, and runs the complete native browser fixture before compression in release CI.

Validation: the isolated application/core/UI suites passed 822 tests, including the new launch, authentication, visibility and close-confirmation regressions. Eight packaging contracts, the actual production CLI suite, strict workspace Clippy and formatting checks passed. The unsigned AppImage built successfully; its compressed entry point advertises --agents, and its native browser passes forms, Unicode input, dialogs, uploads/downloads, popup/opener and profile-persistence workflows with no external library-path override. Its SHA-256 is 9d37ff83b7fe4932cdaf4673620860765e34a7ef3dc736a4868465d7e7b1cc2a.

All seven CI jobs and both dependency security checks passed on 251596b, including native Linux/macOS/Windows browser builds and core launch/concurrency tests on macOS and Windows. Signing/notarization remain release-pipeline checks.

Usage and evidence: docs/agents-launch.md, docs/native-browser.md, docs/testing/native-browser-qa-2026-10-15.md, and docs/testing/agent-editor-qa-2026-10-15.md.