CSI-PLN-AI-001 — CSI Browser Agent v0.2.0 Implementation & Pilot Record

Created: August 3, 2026 1:24 AM Document ID: DOC-26 Document Type: Plan Domain: AI Solutions Effective Date: August 3, 2026 Hierarchy: Playbook Languages: English Last Updated: August 3, 2026 11:01 PM Migration Status: Ready Owner: Cyber Space Infocom Remarks: v0.2.0 deployed and integrated with Open WebUI. Read-only production pilot operational; 24-hour stability monitoring and default-enable decision remain pending. Review Date: August 10, 2026 Review Priority: P2 High Status: Under Review Version: 0.2.0

Linked operational baseline

Objective

Provide approved-domain web reading, structured extraction and summarization from Open WebUI without granting autonomous write access to websites or client infrastructure.

Functional requirements

Accept a natural-language read-only web task.
Allow navigation only to explicitly approved domains.
Retrieve page text using Playwright in DOM/text mode.
Extract structured information and return it to Open WebUI.
Use csi-offline-ai:latest through local Ollama.
Record task ID, approved domain, steps, result, duration and failure reason.
Enforce a step limit and execution timeout.

Security requirements

Default deny for domains.
No login, password entry, form submission, download, upload, purchase, delete or message sending in v0.1.
No client infrastructure access.
Agent browser runs in an isolated container as a non-root user.
Secrets are not placed in prompts, logs or source files.
Every future write action requires a separate change record and human approval.

Proposed architecture

flowchart TD
    UI["Open WebUI"] --> API["CSI Browser Agent API"]
    API --> LLM["Ollama"]
    API --> WEB["Playwright Browser"]
    API --> MCP["CSI MCP Gateway"]
    MCP --> N8N["n8n"]
    WEB --> ALLOW["Approved Domains"]

Technical baseline

Service name: csi-browser-agent
Bind address: 127.0.0.1
Proposed port: 3200
Runtime: Docker Compose
Agent code: Node.js/TypeScript
Browser: headless Chromium through Playwright
Model: csi-offline-ai:latest
Ollama endpoint: host 11434
Initial concurrency: one task

Phases

Phase 1 — Preflight and design

[ ] Capture Docker, Compose, architecture, Node and Ollama compatibility.
[ ] Confirm network path from the future container to Ollama.
[ ] Freeze read-only policy and initial domain allowlist.

Phase 2 — Core build

[ ] Create containerized API.
[ ] Implement URL validation and domain allowlist.
[ ] Implement Playwright navigation and text extraction.
[ ] Implement Ollama planning/summarization adapter.
[ ] Add step, timeout and response-size limits.

Phase 3 — Integration

[ ] Expose a controlled tool to Open WebUI.
[ ] Connect through CSI MCP Gateway where appropriate.
[ ] Add n8n only for approved deterministic workflows.

Phase 4 — Validation and handover

[ ] Test allowed and denied domains.
[ ] Test prohibited actions.
[ ] Verify logs contain no secrets.
[ ] Measure CPU, RAM and task duration.
[ ] Document deployment, recovery and rollback.

Acceptance criteria

[ ] A user can request extraction from an approved public page and receive structured output.
[ ] An unapproved domain is rejected before browser navigation.
[ ] Login, form submission, download and destructive instructions are rejected.
[ ] Browser and agent processes run isolated from the host.
[ ] Ollama remains local and no model API key is required.
[ ] Every task produces a sanitized audit record.
[ ] Container survives controlled restart and returns healthy status.

Risks and mitigation

Weak local model planning: keep workflows short, DOM-based and single-task; use deterministic Playwright actions where possible.
Prompt injection from webpages: treat page content as untrusted data; never let page text expand permissions.
Resource pressure: one browser task at a time; hard timeout; memory and CPU limits after baseline testing.
Website changes: prefer structured extraction and cached deterministic actions for repeatable workflows.

Clarifications

Initial approved domain list will be selected during Phase 1.
No public reverse-proxy exposure is approved for v0.1.
Visual/screenshot reasoning is out of scope for the first release.

Progress

Phase 1: Complete — host, Docker, capacity, security and Ollama network path verified
Phase 2: Complete — read-only TypeScript/Playwright service deployed as v0.2.0
Phase 3: Complete — OpenAPI tool integrated with Open WebUI v0.11.0
Phase 4: Validation — functional/security acceptance passed; 24-hour stability monitoring remains
Overall implementation: 95%; production pilot operational

Latest update — 3 August 2026

CSI Browser Agent v0.2.0 is deployed at /home/csi/docker/csi-browser-agent. The service is healthy, OpenAPI discovery works from the host-networked Open WebUI container, and csi-offline-ai:latest successfully invoked read_public_webpage from chat. Approved and denied URL tests, structured audit records, controlled restart and official Ollama documentation retrieval passed. The tool remains manually enabled per chat during the pilot; wildcard internet access and default-enable are not approved.

Deployment and validation record — v0.2.0

Runtime topology

csi-browser-agent — image csi-browser-agent:0.2.0; API bound only to 127.0.0.1:3200.
csi-ollama-bridge — host-network bridge 172.17.0.1:11435 → 127.0.0.1:11434.
csi-browser-agent-audit-init — one-shot permission initializer; exits 0; network_mode:none.
Open WebUI uses host networking and reaches the tool internally at http://127.0.0.1:3200. LAN access to 192.168.1.222:3200 remains unavailable by design.

Security baseline

Main process: non-root pwuser UID/GID 1001; read-only filesystem; all Linux capabilities dropped; no-new-privileges.
Limits: 1536 MB memory, 2 CPUs, 256 PIDs and one concurrent task.
API authorization: Bearer token stored in root-owned .env mode 600.
Default-deny domains, redirect validation, and SSRF protection block loopback, private, link-local and reserved targets.
Non-standard ports are prohibited.
Login, forms, uploads, downloads, purchases, messaging and destructive actions are out of scope.
Audit log: /home/csi/docker/csi-browser-agent/data/audit.jsonl.

Release history and corrective action

v0.1 exposed an audit bind-mount ownership defect: root-owned data caused EACCES and an HTML 500 response.
Manual recovery set data to UID/GID 1001:1001, mode 750.
v0.1.1 added automatic audit initialization and structured audit-failure handling.
v0.2.0 added OpenAPI 3.1 discovery and operation read_public_webpage.
Archive SHA-256: v0.1 31dde953c0ee07cdcb3485ea135e5f2ee9593c63f921730b4295c288807a15ad; v0.1.1 28418473762f35396a8a0064156ed8a4badcb27c38007d0f9afbdf97011f3bc3; v0.2.0 b1a51823fedf36d29c541c6006a28fea73b9809204af3eccb1da5183a795ddea.

Acceptance evidence

GET /health: healthy, version 0.2.0, read-only mode.
Missing/invalid token: HTTP 401.
Allowed https://example.com: HTTP 200, structured success and audit record.
Local Ollama target http://127.0.0.1:11434/api/tags: HTTP 403, rejected before navigation.
OpenAPI: 3.1.0; title CSI Read-Only Browser Agent; operation read_public_webpage.
Open WebUI v0.11.0 invoked the tool successfully from csi-offline-ai:latest.
Official Ollama quickstart read succeeded for https://docs.ollama.com/quickstart; task eea6e5a2-3201-49b7-ac80-2e1d067c9fa4; duration 12619 ms.

Pilot controls

Current allowlist: example.com, docs.openwebui.com, docs.ollama.com with subdomains disabled, plus proxmox.com with subdomains enabled. The proxmox.com change was made after backing up allowed-domains.json; JSON validation, controlled container restart and runtime log confirmation passed. Enable the tool manually per chat. Do not allow wildcards or CSI internal domains without separate security review. The 24-hour stability window started on 3 August 2026 at 02:59 IST using evidence directory /home/csi/browser-agent-evidence-20260803-025911. Closing evidence is due after 4 August 2026 at 02:59 IST, followed by the default-enable decision.

Change history

3 August 2026 — v0.2.0: Production-pilot deployment, security remediation, OpenAPI integration and live tool-use evidence recorded.
3 August 2026 — configuration update: Added proxmox.com with subdomains to the approved-domain policy after configuration backup; JSON validation, controlled restart and runtime log confirmation passed.