> ## Documentation Index
> Fetch the complete documentation index at: https://kernel.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Foreman

> Give your Foreman agent a Kernel cloud browser

export const CopyPromptButton = props => {
  const {label = 'copy prompt'} = props || ({});
  const [copied, setCopied] = useState(false);
  const prompt = props && props.prompt || `# Setup Kernel

## Prerequisites
- Read the kernel-cli skill at https://github.com/kernel/skills/blob/main/plugins/kernel-cli/skills/kernel-cli/SKILL.md for reference on commands and capabilities.

## Steps

1. **Check if Kernel CLI is installed:**
   - Run \`kernel --version\`.
   - If not found, install via \`brew install kernel/tap/kernel\`.
   - If found, run \`brew upgrade kernel/tap/kernel\` to ensure latest version.
   - Verify with \`kernel --version\` and confirm >= v0.16.0.

2. **Check authentication:**
   - Run \`kernel auth\`.
   - If authenticated, done.
   - If not, run \`kernel login\` and tell the user to complete the browser flow.
     Poll \`kernel auth\` every 5 seconds, up to 5 minutes.
     If it times out, stop and ask the user for help.

3. **Create a browser and open Live View:**
   - Run a Kernel CLI command that creates a browser session and goes to \`https://www.kernel.sh/docs/browsers/live-view\`
   - Capture the returned \`browser_live_view_url\`.
   - Open that URL in the user's browser.
   - Tell the user they can use the live view immediately.
   - If browser creation fails, stop and ask the user for help.`;
  const handleCopy = useCallback(async () => {
    try {
      await navigator.clipboard.writeText(prompt);
      setCopied(true);
      setTimeout(() => setCopied(false), 2000);
    } catch {
      const textarea = document.createElement('textarea');
      textarea.value = prompt;
      textarea.style.position = 'fixed';
      textarea.style.opacity = '0';
      document.body.appendChild(textarea);
      textarea.select();
      document.execCommand('copy');
      document.body.removeChild(textarea);
      setCopied(true);
      setTimeout(() => setCopied(false), 2000);
    }
  }, []);
  return <button onClick={handleCopy} style={{
    display: 'inline-flex',
    alignItems: 'center',
    justifyContent: 'center',
    gap: '0.5rem',
    width: '100%',
    maxWidth: '352px',
    height: '56px',
    padding: '0 32px',
    fontSize: '0.9375rem',
    fontWeight: 500,
    letterSpacing: '0.01em',
    color: '#fff',
    backgroundColor: '#111',
    border: '1px solid rgba(255, 255, 255, 0.08)',
    cursor: 'pointer',
    textDecoration: 'none',
    transition: 'text-decoration 0.15s ease',
    fontFamily: 'inherit'
  }} onMouseEnter={e => {
    e.currentTarget.style.textDecoration = 'underline';
  }} onMouseLeave={e => {
    e.currentTarget.style.textDecoration = 'none';
  }}>
      {copied ? <>
          <svg width="16" height="16" viewBox="0 0 16 16" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round">
            <polyline points="3.5 8.5 6.5 11.5 12.5 4.5" />
          </svg>
          copied!
        </> : <>
          <svg width="16" height="16" viewBox="0 0 16 16" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round">
            <rect x="5.5" y="5.5" width="8" height="8" rx="1.5" />
            <path d="M10.5 5.5V3.5C10.5 2.67 9.83 2 9 2H3.5C2.67 2 2 2.67 2 3.5V9C2 9.83 2.67 10.5 3.5 10.5H5.5" />
          </svg>
          {label}
        </>}
    </button>;
};

## Overview

[Foreman](https://ask-foreman.dev) is a free, open-source software factory: specialized AI agents classify, plan, implement, and review work pulled from GitHub issues, Linear, CI failures, and more, then push draft PRs for a human to approve. Nothing ships without you — Foreman stops at the draft PR.

Foreman is built on [Vercel Eve](https://vercel.com/eve), so it mounts extensions the same way any Eve agent does.

### Foreman + Kernel

Mounting Kernel's [Eve extension](/docs/integrations/vercel/eve-extension) gives Foreman's implementation agent a real cloud browser, so it can go beyond reading code to reproduce bugs and verify fixes in flows that only break behind authentication:

* **Sign-in, not just code review** — the agent drives an authenticated browser session to reproduce the bug the way a signed-in user would hit it.
* **Per-user identity** — each teammate authenticates through their own Vercel Connect consent, so the browser acts as them rather than a shared credential.
* **An approval gate** — Foreman parks its first browser action per session for the person driving it, before it acts inside a logged-in session.

Follow [Foreman's guide for adding the Kernel browser](https://ask-foreman.dev/recipes/add-the-kernel-browser) for the full recipe, including the shadowed connection and tool allowlist.

## Quickstart prompt

Paste this into your coding agent to add the Kernel browser to your Foreman repo. It registers the `@onkernel/eve-extension` mount, wires it to Vercel Connect instead of an API key, shadows the browser connection with an approval gate, and holds the tool allowlist to the seven tools it ships with.

<div style={{ display: 'flex', alignItems: 'center', gap: '1rem', flexWrap: 'wrap' }}>
  <CopyPromptButton
    prompt={`Help me customize the eve Software Factory template. I want to add KERNEL so the agent can drive a cloud browser, including signing in to sites through KERNEL's managed auth.

Ground truth first: read AGENTS.md in the repository root, read agent/extensions/github.ts as the in-repo example of an extension mount, and read https://www.kernel.sh/docs/integrations/vercel/eve-extension plus node_modules/eve/docs/extensions.md before writing code. Do not hand-write the mount if the registry provides it.

1. Run: eve add extension/kernel
This installs @onkernel/eve-extension and writes a mount under agent/extensions/. The extension needs eve 0.25 or later and Node 24; the template ships both, but confirm in package.json rather than assuming. Show me the generated file before changing it.
2. Configure the mount with Vercel Connect, not an API key: kernel({ connect: "kernel/kernel-mcp" }). Leave KERNEL_API_KEY unset everywhere, and tell me if you find it already set, because the extension falls back to it. If the generated file points at the older domain-based connector (mcp.onkernel.com/eve-extension), prefer the current registry form and say so.
3. Convert the mount into a directory so the browser connection can carry an approval gate: agent/extensions/kernel/extension.ts holds the mount, and agent/extensions/kernel/connections/browser.ts shadows the extension's built-in browser connection. Use defineMcpClientConnection from eve/connections with url https://mcp.onkernel.com/mcp, auth connect("kernel/kernel-mcp") from @vercel/connect/eve, approval once() from eve/tools/approval, and tools.allow set to exactly the seven tools the extension mounts by default: manage_browsers, execute_playwright_code, computer_action, manage_auth_connections, manage_profiles, manage_proxies, manage_replays. Use allow, not block, so tools the server adds later stay undiscovered too.
4. Do not add browser_curl, manage_credentials, exec_command, or manage_browser_pools to the allowlist. The extension ships them off to limit an autonomous agent's blast radius, and nothing in this factory needs them.
5. Tell me the setup commands I need to run myself, and do not run them:
vercel link, vercel connect create kernel --name kernel-mcp --connection-method mcp, vercel connect attach kernel/kernel-mcp.
Tell me the --connection-method flag needs Vercel CLI 58.8.0 or later.
6. Important: connect("kernel/kernel-mcp") is per-user consent, so each person authorizes in their own browser before their first tool call. Unattended factory runs (the factory label and the red-CI fix loop) have nobody to complete that flow. Confirm this in the eve connections docs, then tell me plainly which of Foreman's surfaces can and cannot use the browser.
7. Do not mount this extension under agent/subagents/. Stations run in task mode and cannot park for a consent prompt, an approval card, or a sign-in hand-off. If I ask for it later, explain the failure mode before doing it.
8. Explain the approval choice back to me instead of copying by reflex. once() parks the first browser action of a session for the person driving it, and agent/connections/linear.ts shows the predicate alternative. Say why a connection whose tools act inside logged-in sessions warrants a gate that this repo's read-oriented connections do not carry.

Finish by running pnpm validate and confirming 0 errors and 0 warnings, then run npx eve info and show me the kernel mount in the discovered surface with only the seven allowed tools. Do not deploy.

Full recipe, with the reasoning behind each step: https://ask-foreman.dev/recipes/add-the-kernel-browser`}
  />

  <a
    href="https://ask-foreman.dev/recipes/add-the-kernel-browser"
    target="_blank"
    rel="noopener noreferrer"
    style={{
display: 'inline-flex',
alignItems: 'center',
gap: '0.5rem',
height: '56px',
padding: '0 24px',
fontSize: '0.9375rem',
fontWeight: 500,
letterSpacing: '0.01em',
color: 'inherit',
border: '1px solid currentColor',
opacity: 0.7,
textDecoration: 'none',
fontFamily: 'inherit',
}}
  >
    view the recipe ↗
  </a>
</div>

## Related

* [Eve Extension](/docs/integrations/vercel/eve-extension)
* [Vercel Marketplace Integration](/docs/integrations/vercel/marketplace)
* [Managed Auth](/docs/auth/overview)