pw browse

Open a local browser whose traffic exits from a remote resource

Synopsis

The pw browse command starts a local SOCKS5 proxy tunnelled to a resource (like pw forward -D) and launches a browser configured to send all of its traffic, including DNS lookups, through that proxy. Pages load exactly as they would from the resource itself, while the browser and everything attached to it stay local.

This is how to reach sites that are only routable from the resource's network while still using local devices such as smart card (CAC/PIV) readers, hardware tokens, and webcams. TLS is end to end between the local browser and the site, so client-certificate authentication works without installing anything on the remote system.

The browser runs with its own profile, named after the resource and, on Chromium, given a distinct theme color, so it opens as a separate window from your everyday browser and none of your normal browsing is routed through the resource. A pw browse start tab showing the connection details stays open next to the page you asked for. Closing the browser window shuts down the tunnel, except with Firefox on macOS, which keeps running with no windows open; there, Ctrl+C in the terminal is what disconnects. The tunnel reconnects on its own if the SSH connection drops while the browser is open.

While the browser is open, the terminal shows a live dashboard of the tunnel state and every destination the browser has connected to through it, including ones the resource could not reach. Pass -o text for plain log output instead.

The resource defaults to your user workspace. A single argument that looks like a URL or hostname (for example https://intranet.example.internal or intranet.example.internal) is treated as the page to open; anything else is the resource.

Hosts passed with --direct bypass the proxy and are reached straight from your machine. Use it for public sign-in or certificate-authentication endpoints that the resource's network cannot reach. Patterns follow Chromium's proxy bypass rules, so *.example.mil matches every subdomain.

Google Chrome, Chromium, Brave, Microsoft Edge, and Firefox are detected automatically, with Chromium preferred. Pass --browser to pick a different binary.

Resource names can be specified in the following formats:

pw://username/name - full format with explicit username
pw://name - managed cluster by name in your organization
name - short format where username defaults to your username
workspace - your user workspace
worker/id - compute node running one of your workers, as listed by pw workers ls

pw browse [flags] [resource] [url]

Examples

  pw browse
  pw browse https://intranet.example.internal
  
  # Open a browser that exits from my-cluster
  pw browse my-cluster
  
  # Open an internal site directly
  pw browse my-cluster https://intranet.example.internal
  
  # Use a specific browser binary
  pw browse --browser /usr/bin/chromium my-cluster
  pw browse --browser firefox my-cluster
  
  # Pin the proxy to a fixed local port so other programs can share it
  pw browse --port 1080 my-cluster
  
  # Reach a public certificate-authentication endpoint directly instead of through the cluster
  pw browse --direct "*.auth.example.mil" my-cluster https://intranet.example.internal

Options

      --browser string       Path to a Chromium-based or Firefox browser binary (default: auto-detect)
      --direct stringArray   Host or pattern that bypasses the proxy and connects directly from this machine (repeatable)
  -h, --help                 help for browse
      --keepalive int        Interval in seconds between keepalive messages; an unresponsive connection is torn down and reconnected (0 to disable) (default 30)
  -o, --output string        Output format (interactive, text); interactive shows a live dashboard and downgrades to text when stdout is not a terminal (default "interactive")
      --port int             Local SOCKS5 proxy port (default: a free ephemeral port)
      --profile-dir string   Browser profile directory (default: a per-resource directory under ~/.local/state/pw/browse)

Options inherited from parent commands

      --context string         The context to use. Overrides PW_CONTEXT environment variable and current context from config.
      --platform-host string   The Parallel Works ACTIVATE platform host to use. Overrides PW_PLATFORM_HOST environment variable and the current context's server.
  -v, --verbose                Enable verbose logging

pw browse

pw browse

Synopsis

Examples

Options

Options inherited from parent commands

SEE ALSO