Managed Deep Agents v0.10:浏览器使用与异步子代理

LangChain Blog · 原文 2026-10-29 · 译文 2026-10-30 · 难度 入门
精读 · 译文(非本站原创)
来自资源池 · LangChain Blog ↗ · 原文:Managed Deep Agents v0.10: Browser Use and Async Subagents ↗ · 版权归 LangChain Blog 所有 · 译文为个人学习的非官方翻译,以原文为准;如权利方有疑虑可联系公众号「疯了再说」删除
导读 · MDA v0.10:浏览器工具四件套+登录交接保密码;子代理后台跑不阻塞

为什么精读这篇两个能力各补上一块拼图:browser_handoff 让「agent 用网站但不碰你的凭证」有了产品级答案(密码永不进模型消息与轨迹);async 子代理是 Design Agent 文里幕僚模式的产品化落地(定义里加一个 async 布尔字段)。DataDome 数据(9 月 agent 浏览器请求单月 4.7 倍)给「无 API 世界」的规模做了注脚。

  • 浏览器使用:订票/退订/理赔都发生在为人点击而建的网站上、常常没有 API;curl 拿到的是 JavaScript 渲染前的 HTML 且点不了任何东西——agent 需要真浏览器;个人 agent(Instinct/Meta Muse)已证明浏览解锁更大用例集,DataDome 看到 agent 浏览器请求 9 月单月涨 4.7 倍;coding agent 也需要(验证改动真的渲染且能用)
  • 接入方式:项目根声明 browser = define_browser(scope 设 thread, idle_ttl_seconds 600),浏览器跑在专属 LangSmith 沙箱,自动获得四工具——browser_snapshot(读无障碍树并给元素编 ID)/browser_run(按快照 ID 导航交互,支持 JS 与批量动作)/browser_screenshot/browser_handoff
  • 作用域:默认每会话一个浏览器(跨轮复用、不带其他线程的 cookie 与登录);scope 设为 user 则每个登录用户一个、登录跨其全部会话保留(agent 只让用户对每个网站登录一次)
  • browser_handoff(招牌):多数浏览器 agent 卡在登录墙或两步验证——agent 调 browser_handoff(reason) 把窗口交给真人,Slack/Studio 原生渲染交接链接+「交还」按钮,自定义客户端可自渲染交接 artifact;用户登录后交还,agent 检查登录是否成功继续干活;交接立即返回(agent 可先干别的),链接 15 分钟过期——「你的密码永不进模型的消息与轨迹」
  • 异步子代理:此前子代理内联跑(调用即等待),快查没问题但长任务把对话人晾着、编排 agent 被阻塞——v0.10 在子代理定义加 async 即后台运行:长任务后台跑、主 agent 继续与你对话,可问进度可改道,子代理完成时结果回到对话
  • 其他:回复回到发起请求的 Slack 线程(含定时运行与迟归的子代理);线程内 Stop 按钮取消其运行;新增 runtime.thread 与 resolveUser;connectors.mcp() 等旧接口移除
7 段 · 约 4 分钟

Managed Deep Agents v0.10 is out today. It adds browser use, so your agent can work on websites that have no API, and async subagents, which run long tasks in the background while your agent keeps talking with you. In this post, we cover why agents need each one and how to turn it on, then the rest of the release.

Managed Deep Agents v0.10 今天发布:新增浏览器使用(agent 能在没 API 的网站上干活)与异步子代理(长任务后台跑,主 agent 继续跟你聊)。这篇讲两者为什么需要、怎么开启,以及版本其余内容。

Give your agent a browser · 给 agent 一台浏览器

Booking travel, canceling a subscription, or filing a claim all happen on sites built for people clicking through pages, and there's often no API an agent can call. While agents can reason through how to complete the task, they can't take action on websites without an API. Fetching the page with curl doesn't get far either, it produces HTML before any JavaScript renders the page and the agent can't click anything. Personal agents like Instinct and Meta's Muse can browse websites to unlock a broader set of use cases, and DataDome saw agentic browser requests jump 4.7x in September alone. Coding agents need a browser too, to check that a change to an app actually renders and works.

订机票、退订阅、理赔都发生在「为人点页面」而建的网站上,往往没有 API 可调。agent 能推理出怎么完成任务,但没 API 就无法在网站上行动;用 curl 抓页面也走不远——拿到的是 JavaScript 渲染之前的 HTML,什么也点不了。Instinct、Meta 的 Muse 这类个人 agent 已靠浏览网站解锁更大的用例集,DataDome 光 9 月一个月就看到 agent 浏览器请求涨了 4.7 倍。coding agent 同样需要浏览器——验证对应用的改动真的渲染且能用。

To turn it on, declare a browser at your project root: # browser.py from managed_deepagents import define_browser; browser = define_browser(scope 设 thread, idle_ttl_seconds 600). Managed Deep Agents runs the browser in its own LangSmith sandbox and adds the following browser tools to your agent automatically. browser_snapshot reads the page's accessibility tree and assigns element IDs. browser_run navigates and interacts, through JavaScript or batches of actions against snapshot IDs. browser_screenshot captures the page, optionally saving the image to the sandbox. browser_handoff gives a person control of the window.

开启方式:项目根声明 browser = define_browser(scope 设 thread, idle_ttl_seconds 600)。浏览器跑在专属的 LangSmith 沙箱里,以下浏览器工具自动加给 agent:**browser_snapshot**(读页面无障碍树并给元素编 ID)、**browser_run**(按快照 ID 导航与交互,支持 JavaScript 或批量动作)、**browser_screenshot**(截屏,可选存图进沙箱)、**browser_handoff**(把窗口交给真人控制)。

By default, each conversation gets its own browser, which is reused across turns and starts with no cookies or logins from other threads. With scope="user", each signed-in person gets one browser whose logins carry across all of their conversations, so the agent only asks them to sign in to a site once.

默认每个会话一个浏览器:跨轮复用,且不带其他线程的 cookie 或登录。scope 设为 user 则每个登录用户一个浏览器,登录跨其全部会话保留——agent 只请用户对每个网站登录一次。

Hand the browser to a person · 把浏览器交给真人

Most browser agents stop at a login wall or a two-factor prompt. With browser_handoff, the agent hands the window to you instead, so your password never ends up in the model's messages or traces. The agent calls browser_handoff(reason) and explains why it needs you. Your agent channels — like Slack and Studio — will show a link to allow users of your agents to hand off browser control natively, which opens a link to interact with the remote browser and a Hand back button. Custom clients can render the handoff artifact themselves. Once you sign in and hand control back, the agent checks the page to see whether the login worked and continues. Handoff returns immediately, so the agent can do other work while it waits. Handoff links expire after 15 minutes. Handoffs let your agent use a webpage for you, without seeing your credentials.

多数浏览器 agent 卡在登录墙或两步验证。browser_handoff 让 agent 改为把窗口交给你——**你的密码永远不会出现在模型的消息或轨迹里**。agent 调 browser_handoff(reason) 并解释为什么需要你;agent 渠道(Slack、Studio)会原生显示交接链接,点开即与远端浏览器交互,还有一个「交还」按钮;自定义客户端可自行渲染交接 artifact。你登录并交还控制权后,agent 检查页面确认登录成功、继续干活。交接调用立即返回,等待期间 agent 可以干别的;交接链接 15 分钟过期。交接让你的 agent 替你使用网页,而看不到你的凭证。

Run subagents in the background · 子代理后台跑

Subagents let an agent hand a focused task to a helper with its own context window. Previously in Managed Deep Agents, subagents ran inline, so the agent called one and waited for its answer. This works for a quick lookup, and still is a supported pattern. But for a long task backed by a synchronous agent, or where multiple agents need to be fanned out, the person talking to the agent waits too, and additional interactions with the orchestrator agent are blocked. With Managed Deep Agents v0.10, you can run subagents asynchronously, without blocking the orchestrator agent, by adding async to a subagent definition: from managed_deepagents import define_deep_agent; agent = define_deep_agent(name="research-assistant", model="openai:gpt-5.5", subagents=[{ "name": "researcher", "description": "Researches a topic in the background.", "system_prompt": "Research the topic…", "async": True }]). A long job can go to a subagent that runs in the background while your agent keeps talking with you. You can ask the agent to check on the job or change its course, and the result comes back to the conversation when the subagent finishes.

子代理让 agent 把聚焦任务交给有独立上下文窗口的帮手。此前 Managed Deep Agents 里子代理是内联跑的:agent 调一个就等一个的答案——快查没问题(仍是受支持的模式),但长任务或需要扇出多个 agent 时,与 agent 对话的人也被晾着、与编排 agent 的其他交互全部阻塞。v0.10 在子代理定义(如 model=openai:gpt-5.5 的 research-assistant 下挂 researcher)里加 async 即可异步运行、不阻塞编排 agent:define_deep_agent 的 subagents 列表里给子代理定义加 async 字段——长任务交给后台子代理,主 agent 继续与你对话;你可以问进度、改方向,子代理完成时结果回到对话。

The rest of the release · 版本其余内容

Thread origins and stopping runs: Replies go back to the Slack thread a request started in, including replies from a scheduled run or from a subagent that finished later. A Stop button in the thread cancels its runs. Also new in this release: runtime.thread and resolveUser, and the removal of connectors.mcp() and other older interfaces.

回复回到请求发起的 Slack 线程——包括定时运行的回复与迟归的子代理;线程内的 Stop 按钮可取消其运行。本版还新增 runtime.thread 与 resolveUser,并移除了 connectors.mcp() 等旧接口。

回忆挑战

先不看答案自己回忆——讲不出来再回正文找。考的是关系,不是标签。

1browser_handoff 与「把密码告诉 agent 让它登录」相比,安全模型的本质区别是什么?

区别在凭证的暴露面:把密码给 agent,密码就进入模型消息、轨迹日志、缓存——每一层都是新的泄露面,且 agent 的后续行为都以持有凭证为前提。handoff 模式下凭证只存在于浏览器与用户之间:agent 交出窗口、拿到的是「已登录的会话」这个结果而非凭证本身,密码不出现在模型上下文与 LangSmith 轨迹里。这是权能分离:代理获得使用权,人类保留认证权——与公司 harness 里 OBO 的思路同构。

2浏览器 scope 的 thread 与 user 两档,分别适合什么场景?选错的代价是什么?

thread(默认)适合隔离优先的场景:每会话独立浏览器、无跨线程 cookie——安全边界清晰,代价是每个新会话都要重新登录。user 适合体验优先:一人一浏览器、登录跨其全部会话保留——agent 只请用户登录一次;代价是会话间共享状态(一个会话里的登录/cookie 对其他会话可见),多项目或不可信会话混用时边界模糊。选错的代价分别是「烦死人的重复登录」或「不该共享的状态被共享」。

3async 子代理解决「人被晾着」的问题——对照 Design Agent 文的幕僚模式,v0.10 把哪些手工部分变成了产品能力?

Design Agent 文里幕僚模式是自建的:主 agent 自己管 start_task/check_tasks/cancel/resume/report_progress/schedule_wakeup 六件工具与项目文件夹协调。v0.10 把其中「派活后不等」与「结果回对话」做成了平台能力——子代理定义加 async 字段即后台运行,完成时结果自动回到对话(回发起线程),不再需要手工搭队列与唤醒机制。剩下的(怎么拆任务、简报怎么写、文件所有权)仍是应用层的活——平台收编机制,判断留给开发者。