---
title: "Halon's browser"
description: "How Halon opens your site in a real browser on a desktop and a phone screen, follows the steps a person takes, and asks before a page sends anything."
canonical: https://firefight.app/docs/ai/browser
---

# Halon's browser

Halon has a real browser in its sandbox, where it opens a page the way a person does. It uses it when a question is about what people see, such as "the checkout button does nothing" or "the login page is blank", and after a change, to confirm a page works.

The browser works in chats and in investigations, wherever Halon has a [terminal](https://firefight.app/docs/ai/terminal.md). Each check shows as a **Check in browser** step with the address it opened.

## What Halon sees

Halon opens the page on a desktop screen and on a phone screen, unless one is enough. For each screen it reports:

| What | Details |
|---|---|
| Status | The HTTP status of the page and the address it ended at, with any query string hidden |
| Timings | How long the page took to answer, to be ready and to finish loading |
| Console | Errors and warnings the page logged, and errors its scripts threw |
| Failed requests | Requests the page made that failed or answered with an error, with their method, address and status |
| Page | Its title, and the text near anything that went wrong |
| Screenshot | A picture of the screen as Halon saw it |

The screenshots show under the step in the chat, under the step on an investigation's page, and as images in the Slack thread under Halon's answer. They are deleted with the chat, and only people who can see that chat or investigation can open them.

## Following steps

Halon can follow a short path on the page, up to 12 steps:

| Step | What it does |
|---|---|
| Go to | Opens another address |
| Click | Clicks a button, link or menu by its visible text, its label, or its role and name |
| Fill | Types into a field found by its label or placeholder |
| Press | Presses a key, such as Enter or Escape |
| Wait for text | Waits until some text appears |
| Expect text | Checks that some text is on the page, and fails the step when it is not |

A report like "the checkout button does nothing" is checked by clicking that button and expecting what should follow, so you see which step failed and what the console and requests said at that moment.

## Asking before a page sends anything

Looking around never asks. Opening pages, following links, opening menus and searching run at once. A page also loads as it does for anyone, so what the page sends on its own while it loads, such as the request that fetches its products or an analytics call, goes through. Those requests are listed in what Halon reports, under **Sent by the page on its own while it loaded**.

A step that would send data stops the path before anything is sent. That is submitting a form, clicking a button that sends something, such as **Place order**, or typing into a field that sends what you type. The browser blocks the request itself, so nothing reaches your site. Halon says what the step would send, with password and card fields hidden, and asks you before sending it.

When it asks, **Details** shows the screenshot of the page and each field the step would send, and you answer with **Approve** or **Cancel**. **Allow for the rest of this chat** is never offered, so every send is asked about on its own. Confirming sends exactly the request you were shown, to the same address with the same query, and with the same fields and values. If the page would now send anything else, such as another amount or another address, the browser stops again and sends nothing. Halon then shows you what the page sends now and asks you again.

Sending needs **Let Halon send forms in its browser** (`browser.update`), which admins and owners hold and members need granted, see [Permissions](https://firefight.app/docs/gateway/permissions#halons-browser). [Approval rules](https://firefight.app/docs/gateway/approvals.md) can hold a send like any other change. An investigation, a watch and a scheduled plan never send.

## Test logins

For pages behind a login, an admin saves a test account per site under **Halon → Test logins** with **New test login**. Everyone else sees which sites have a test login and when its password was saved, but not the username, and cannot change one.

| Field | What it is |
|---|---|
| Site address | The site, such as `https://shop.example.com` |
| Login page | Where the login form is, when it is not the site address (optional) |
| Username | The test account's username or email |
| Password | The test account's password |
| Name | How the login is listed (optional, the site's host when empty) |

A site has one test login. When Halon checks a page on that site with the login, Firefight signs the browser in first. Halon never sees the password, and it never reaches a chat, Slack or [Activity](https://firefight.app/docs/gateway/activity.md). After it is saved, the password is never shown again, and the list says only when it was saved. To change it, edit the login and type a new one, or leave it empty to keep the saved one. Deleting a login asks first, and Halon's browser then stops signing in there.

Use a test account made for this, not a person's account, since Halon can use it in any member's chat.

:::note
A request that one of Halon's steps sets off always stops for your confirmation, even while the page is still loading.
:::

## After a fix and in watches

- **A fix can end with a page check.** An investigation's fix may end with a **Page check** step, which opens the page once the steps before it are done. It passes when the page loaded without an error status and every step went through, with no console errors and no request that failed or answered with a server error. Otherwise it fails, saying what went wrong. Its screenshots show under the step. See [Fixes](https://firefight.app/docs/ai/investigations#fixes).
- **A watch can wait for a page.** Ask Halon to keep checking a page until it loads with no console errors, and it starts a [watch](https://firefight.app/docs/ai/watching.md) that looks at the page on one screen size.
- **A plan's check can be a look.** When Halon checks that a change worked, opening the page counts as that check.

## Limits

| Limit | Value |
|---|---|
| Steps in one check | 12 |
| Pages one screen size loads | 10 |
| Time for one check | 2 minutes |
| Pages your workspace loads in an hour | 300 |

The browser opens only `http` and `https` addresses, downloads nothing, uploads no files and runs no extensions. Addresses on a private network are not opened unless whoever runs your Firefight install allows them. It sees your site from the sandbox's one region, which Halon names.

## Where it is recorded

Every check is in [Activity](https://firefight.app/docs/gateway/activity.md) as `browser.read`, and every send as `browser.update`, under Halon with the access of the person who asked in a chat, such as Halon, for Maya Ortiz, under Halon in an investigation, and under whoever applied a fix for its page check. A test login's password is never recorded.