Harim Choi blog
← All posts
Aug 16, 2026 · 2 min

Bau Browser

Agentic Browser · a local-first desktop where users control private data and agent authority

Agentic Browser · Agent Safety

Built with TypeScript · Electron · MCP · Qwen3.5-4B · SQLite

Bau Browser architecture from desktop browser and scoped PageGraph through bound draft, host compiler, propose approve execute flow, browser or MCP action, receipts, postconditions, and decision log
Executable values and authority remain in the trusted host, not in model output

WHY

Chrome felt heavier and less controllable than the browsing workflow I wanted, and adding an agent raised a second problem: users could not easily see where browsing data went or which actions the agent was allowed to take. I wanted a desktop browser that kept personal data local and made agent permissions, approvals, and execution records visible to the user.

Action binding 36/36

Correct action and arguments on new-domain tasks

Out-of-scope actions 0

User-defined origin and action scope enforced

Safety gate 12/12

Recovery and verification cases passed

HOW

The model proposes identifiers; the host owns executable authority

The browser keeps page understanding, action compilation, user approval, execution, and audit records as separate contracts.

  1. 01 Observe

    Build a PageGraph and TaskSpec from the active origin without granting an action yet.

  2. 02 Bound draft

    Let the local model choose trusted target, verb, effect, and binding identifiers, not raw executable values.

  3. 03 Compile and approve

    Reconstruct arguments from host-owned bindings, validate scope, and show the proposed action to the user.

  4. 04 Execute and receipt

    Run only the approved action, verify postconditions, and write receipts and the DecisionLog.

RESULT

Native Bau Browser desktop capture using a synthetic product-comparison fixture
Native desktop capture · synthetic fixture

Contribution

  • Built the Electron browser surface, scoped agent contracts, host compiler, two-phase HITL, MCP boundary, receipts, postconditions, and SQLite decision log.
  • Designed and trained the compact Qwen3.5-4B bound-draft pilot, then evaluated the frozen 36-case synthetic gate across exactness, compilation, binding, safety, and forbidden actions.

Evidence

Private project