Repository navigation
Conversation
…check Browsers have no per-tool LLM setting; enterprises steer browser AI traffic with a PAC file pushed by MDM or GPO. The daemon now reports, per device, the PAC that browser machine policy sets: absent, found with its URL, or differs between browsers. - agent: Chrome, Edge, Chromium and Firefox policy readers for Linux (policy files) and Windows (registry; HKCU only when running as the user); the PAC URL is fetched directly and identified by SHA-256 and size, never its content; policy directories are watched - proto: Inventory.browser_pacs = 3, Inventory.pac_fetches = 4 - controller: migration 0004_browser_pacs; optional browserEgress.compliance.pacUrl in the controller configuration, evaluated at read time (compliant or not, with the reason); PAC versions grouped by URL and hash on the overview - UI: fleet device column, device card and overview tiles; desktop app card - README section, regenerated schemas Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Linux: merge the proxy keys across policy files the way Chrome merges policies, so ProxyMode and ProxyPacUrl in different files still give a PAC; the same key with different values is still a conflict - Linux: a policy directory that can't be read is reported instead of looking like "no policy" - inventory refresh: resync the file watch after every scan, not only when the inventory changed, so a policy file in a directory created empty first is seen without waiting for the interval (regression test) - fleet UI: when browsers set different PACs, the device page lists each PAC URL with its hash or fetch error Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Chromium policy files may contain comments and trailing commas, as Chromium's loader accepts them (JSON_PARSE_CHROMIUM_EXTENSIONS | JSON_ALLOW_TRAILING_COMMAS); the Firefox reader stays strict JSON - a conflict between legacy ProxyMode/ProxyPacUrl values no longer hides a ProxySettings dictionary, which overrides them - Linux Firefox: only the file Firefox uses counts (/etc/firefox/policies/policies.json when it exists, otherwise the install's distribution/ file), so a Proxy section in an ignored file can't be reported Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…dev#160 agentdesktop-dev#160 added 0004_usage.sql; the browser PAC tables move to 0005_browser_pacs.sql. No content change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
LutzLange
force-pushed
the
browser-pac-reporting
branch
from
October 15, 2026 18:16
74e64d9 to
1a59355
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
agentdesktop points AI tools at the LLM gateway, but the same models are one browser tab away. Enterprises steer browser AI traffic with a PAC file pushed by MDM or GPO, and nobody sees per device whether it landed. This adds that report. Related: #154 (security posture in the desktop view).
What it does
PAC absent,PAC found <url>, ordiffers(browsers disagree), read from Chrome, Edge, Chromium and Firefox machine policy: Linux policy files, Windows registry (HKCUonly when the daemon runs as the user). Shown inagentdesktop discover, the desktop app and the fleet UI. Nothing is configured.controller.yaml:Transport:
Inventory.browser_pacs = 3andInventory.pac_fetches = 4; older controllers ignore them. No new dependencies (Windows adds theWin32_System_Registryfeature ofwindows-sys).Tested
Notes for review
0005_browser_pacs.sql(rebased on add usage and cost metrics #160, which took0004).Possible follow-up
This is meant as a first PR. A second one could add the other half for fleets without MDM (Linux, Windows) and for standalone use: agentdesktop writing the browser PAC policy itself, with the existing managed-file ownership and removal, verified by this report. Happy to hear whether that would fit before starting on it.
🤖 Generated with Claude Code