Browser automation (Playwright / agent-browser)

When it applies

The in-scope target (scope.txt, tradecraft-scope-roe) needs a real browser, not raw HTTP: multi-step or JS-heavy login flows, pages that render client-side, payloads that must go through the UI (XSS into a live DOM, CSRF flows), evidence screenshots, or scraping behind a session. For pure request replay use Burp/curl instead; honor bug-bounty rate limits in roe.md — automation multiplies request volume.

Why it works

A scripted browser executes the app's JavaScript, holds cookies/session like a real user, and sees the post-render DOM — so guards that defeat raw HTTP (JS challenges, dynamic forms) just work. The agent-browser CLI exposes the accessibility tree as stable @eN element refs, which survive layout changes better than CSS selectors; the Playwright Node API adds network interception, storage extraction, and screenshots for everything the CLI can't do.