ProtectedconstructorThe remote-browser sessions this process currently hosts (read-only snapshot).
ProtectedBaseThe single underlying RemoteBrowserEngineBase instance whose BaseEngine cache holds the
provider registry. Composed (not inherited) so the startup manager warms exactly one cache; all
metadata reads on this engine delegate here.
Returns true once the composed base cache is loaded.
All cached MJ: AI Remote Browser Providers rows.
StaticInstanceThe singleton accessor. Keyed by THIS class's name in the Global Object Store (via BaseSingleton), distinct from RemoteBrowserEngineBase.Instance — which this engine composes rather than inherits.
Drives an autonomous, goal-driven browser run for an agent session: the caller sets a high-level
goal ("log into this site and download the latest invoice") and the resolved control strategy plans +
executes it — instead of the caller issuing granular actions. Lazily starts the browser if needed,
then dispatches by resolveControlStrategy: 'ComputerUse' runs MJ's computer-use loop against
the live session (IRemoteBrowserSession.RunComputerUseGoal); 'NativeAI' delegates to the
backend's own AI harness (IRemoteBrowserSession.InvokeNativeAIControl).
Progress + barge-in flow through opts.OnProgress / opts.Signal (a realtime voice session narrates
the former and aborts on the latter). See plans/realtime/computer-use-remote-browser-blend.md.
The AIAgentSession id.
The natural-language goal.
Strategy preference, start url, step cap, model overrides, model-blind context, progress + signal.
The goal outcome.
Loads (or refreshes) the composed base's provider metadata cache. Delegates to
RemoteBrowserEngineBase.Config. Idempotent — a no-op when already loaded unless
forceRefresh.
OptionalforceRefresh: booleanWhen true, reloads even if already loaded.
OptionalcontextUser: UserInfoRequired server-side for proper data isolation.
Optionalprovider: IMetadataProviderOptional explicit metadata provider (multi-provider scenarios).
Ends a live session: closes the session handle, disconnects the driver, and removes the live registry entry. Tolerant of teardown errors (logged, never rethrown) and idempotent — ending a session this process no longer holds is a benign no-op.
The session id to end.
true when a live session was found and torn down, false when none was held.
Tears down the remote-browser session lazily started for an AIAgentSession (if any) and forgets
the mapping. Idempotent — ending an agent session that never started a browser is a benign no-op.
Called from the Remote Browser channel plugin's close/dispose hooks so any browser a session opened
is always released when the session ends.
The AIAgentSession id whose browser to end.
true when a live browser was found and torn down, false when none was held.
The Global Object Store is a place to store global objects that need to be shared across the application. Depending on the execution environment, this could be the window object in a browser, or the global object in a node environment, or something else in other contexts. The key here is that in some cases static variables are not truly shared because it is possible that a given class might have copies of its code in multiple paths in a deployed application. This approach ensures that no matter how many code copies might exist, there is only one instance of the object in question by using the Global Object Store.
Returns the live session handle for an id, or undefined when this process holds no such session.
The engine-generated session id.
The live handle, or undefined.
Returns the live remote-browser session bound to an AIAgentSession, or undefined when this
process holds no browser for it (never started, or already torn down).
The AIAgentSession id.
The live session, or undefined.
Grants the input floor to the requested party, transferring the wheel.
'Human' succeeds only in Collaborative AND only after a RequestControl
(the request→grant handshake). The outstanding request is cleared on grant.'Agent' always succeeds (the agent reclaiming the wheel is unconditional).The session to grant control on.
The party to grant the floor to.
true when the grant took effect, false when rejected by the mode / missing request /
unknown session.
Deferred-startup entry point (per IStartupSink). Warms the ONE composed base cache by
delegating to RemoteBrowserEngineBase.Config; mirrors AIBridgeEngine.HandleStartup.
OptionalcontextUser: UserInfoThe boot/system user context.
Optionalprovider: IMetadataProviderOptional metadata provider override (multi-provider scenarios).
Pipes the session's live viewport screencast to a frame sink — the documented seam the bridge ScreenOut track (screen-sharing the browser into a meeting) or a console panel consumes.
Capability-gated by the backend's ScreenStreaming flag: the engine refuses to call
IRemoteBrowserSession.StartScreencast on a backend that does not advertise it (the first
of the two-layer gate; the driver's own RequireFeature is the second). Each encoded
RemoteBrowserScreencastFrame is forwarded to the supplied sink in order.
The session whose viewport to stream.
The consumer of encoded frames (the ScreenOut track / a console panel).
A promise that resolves once the screencast has started.
Force-closes every live session this process holds whose backend matches a predicate — the janitor seam for orphan reconciliation (e.g. on host drain). Mirrors the bridge engine's import('@memberjunction/ai-bridge-server').AIBridgeEngine.ReconcileOrphans posture: the sweep logic lives here, but the scheduling (boot recovery + periodic timer) is intentionally left to the host so this package carries no timer/IO of its own.
Optionalpredicate: (handle: RemoteBrowserSessionHandle) => booleanOptional filter; when omitted every live session is reconciled. Returning true
marks the session for force-close.
The number of sessions closed.
Requests that a human be granted the input floor.
Honored ONLY in Collaborative mode (the only mode that permits human driving): it records an
outstanding request that GrantControl later satisfies. In AgentOnly and ViewOnly the
request is denied — a human can never take the wheel there.
The session to request control on.
true when the request was accepted (Collaborative), false when denied by the mode or
the session is unknown.
Routes a human takeover input into the backend browser — but ONLY while the human holds the floor.
The arbiter is the gate: in AgentOnly the human never holds the floor (input is dropped); in
ViewOnly the human watches but never drives (input is dropped); in Collaborative input is
routed to IRemoteBrowserSession.RouteHumanInput only while RemoteBrowserSessionHandle.FloorHolder
is 'Human'. This is the runtime enforcement of "observe only, no input routed" / "mediate
agent⇄human" from the control model.
The session to route input into.
The human input event; narrow on input.Kind.
true when the input was routed to the backend, false when the arbiter dropped it
(mode/floor) or the session is unknown.
Starts a live remote-browser session: resolves the provider, validates it + the control mode, resolves and connects the driver, and registers the live handle.
Flow:
Active (a disabled backend cannot start sessions).ClassFactory.CreateInstance(BaseRemoteBrowserProvider, DriverClass).Connect, then register + return the live handle (floor = Agent).The session parameters.
The live RemoteBrowserSessionHandle.
Lazily starts (or returns the already-running) remote-browser session for an AIAgentSession.
Idempotent: a second call for an agent session that already has a live browser returns that same
IRemoteBrowserSession rather than launching a second browser. The provider is resolved by
the explicit providerName when supplied, else the engine's single RemoteBrowserEngineBase.ActiveProviders
entry — assuming EXACTLY ONE Active provider for now (a clear error is thrown for none or ambiguous,
rather than silently picking one).
The AIAgentSession id the browser is bound to.
OptionalcontextUser: UserInfoThe MJ user the browser session runs as (owned + audited by this user).
OptionalproviderName: stringOptional explicit backend name; when omitted the single Active provider is used.
The live session the mutation drives.
When no/ambiguous Active provider can be resolved, or the underlying StartSession fails.
Stops a screencast previously started with PipeScreencastToTrack.
Capability-gated by ScreenStreaming (same as starting). A no-op when the session is unknown.
The session whose screencast to stop.
A promise that resolves once streaming has stopped.
Yields the input floor BACK from the named party to the agent — the inverse of a human grant.
A no-op (returning true) when the named party does not currently hold the floor, so a "human
yields" call is safe even if the agent already reclaimed the wheel. Yielding always returns the
floor to the agent (the resting state across every mode).
The session to yield on.
The party giving up the floor.
true when the floor is (now or already) with the agent, false for an unknown session.
Protected StaticgetReturns the singleton instance of the class. If the instance does not exist, it is created and stored in the Global Object Store. If className is provided it will be used as part of the key in the Global Object Store, otherwise the actual class name will be used. NOTE: the class name used by default is the lowest level of the object hierarchy, so if you have a class that extends another class, the lowest level class name will be used.
OptionalclassName: string
Server-tier engine for the Remote Browser plane — coordination + execution.
Composes RemoteBrowserEngineBase (the ONE metadata cache) and adds everything that actually runs a browser session:
Active, resolves the driver via theClassFactory, validates the control mode against the backend's capabilities, builds the import('@memberjunction/remote-browser-base').RemoteBrowserProviderContext and connects. EndSession tears it down.AgentOnlydenies human control outright,ViewOnlylets humans watch but never drive,Collaborativelets a human grab the wheel via a request→grant handshake. RouteHumanInput routes a human event into the backend ONLY while the human holds the floor.ScreenStreaming) starts the session's screencast and forwards each encoded frame to the supplied sink, which the bridge ScreenOut track (or a console panel) consumes.The engine never constructs the realtime model or the channel plane — those wire AROUND it. Its only coupling is to the IRemoteBrowserSession interface the driver returns, which makes the whole engine unit-testable with a fake driver + fake session.
See
/plans/realtime/realtime-bridges-architecture.md§4d-i — theRemoteBrowserEngineBase/RemoteBrowserEnginepair.