pw browse

Open a local browser whose traffic exits from a remote resource

Synopsis

The pw browse command starts a local SOCKS5 proxy tunnelled to a resource (like pw forward -D) and launches a Chromium-based browser configured to send all of its traffic, including DNS lookups, through that proxy. Pages load exactly as they would from the resource itself, while the browser and everything attached to it stay local.

This is how to reach sites that are only routable from the resource's network while still using local devices such as smart card (CAC/PIV) readers, hardware tokens, and webcams. TLS is end to end between the local browser and the site, so client-certificate authentication works without installing anything on the remote system.

The browser runs with its own profile, named after the resource and given a distinct theme color, so it opens as a separate window from your everyday browser and none of your normal browsing is routed through the resource. A pw browse start tab showing the connection details stays open next to the page you asked for. Closing the browser window shuts down the tunnel; the tunnel reconnects on its own if the SSH connection drops while the browser is open.

The resource defaults to your user workspace. A single argument that looks like a URL or hostname (for example https://intranet.example.internal or intranet.example.internal) is treated as the page to open; anything else is the resource.

Hosts passed with --direct bypass the proxy and are reached straight from your machine. Use it for public sign-in or certificate-authentication endpoints that the resource's network cannot reach. Patterns follow Chromium's proxy bypass rules, so *.example.mil matches every subdomain.

Google Chrome, Chromium, Brave, and Microsoft Edge are detected automatically. Pass --browser to use a different Chromium-based binary.

Resource names can be specified in the following formats:

pw://username/name - full format with explicit username
pw://name - managed cluster by name in your organization
name - short format where username defaults to your username
workspace - your user workspace
worker/id - compute node running one of your workers, as listed by pw workers ls

pw browse [flags] [resource] [url]

Examples

  pw browse
  pw browse https://intranet.example.internal
  
  # Open a browser that exits from my-cluster
  pw browse my-cluster
  
  # Open an internal site directly
  pw browse my-cluster https://intranet.example.internal
  
  # Use a specific browser binary
  pw browse --browser /usr/bin/chromium my-cluster
  
  # Pin the proxy to a fixed local port so other programs can share it
  pw browse --port 1080 my-cluster
  
  # Reach a public certificate-authentication endpoint directly instead of through the cluster
  pw browse --direct "*.auth.example.mil" my-cluster https://intranet.example.internal

Options

      --browser string       Path to a Chromium-based browser binary (default: auto-detect)
      --direct stringArray   Host or pattern that bypasses the proxy and connects directly from this machine (repeatable)
  -h, --help                 help for browse
      --keepalive int        Interval in seconds between keepalive messages; an unresponsive connection is torn down and reconnected (0 to disable) (default 30)
      --port int             Local SOCKS5 proxy port (default: a free ephemeral port)
      --profile-dir string   Browser profile directory (default: a per-resource directory under ~/.local/state/pw/browse)

Options inherited from parent commands

      --context string         The context to use. Overrides PW_CONTEXT environment variable and current context from config.
      --platform-host string   The Parallel Works ACTIVATE platform host to use. Overrides PW_PLATFORM_HOST environment variable and the current context's server.
  -v, --verbose                Enable verbose logging

pw browse

pw browse

Synopsis

Examples

Options

Options inherited from parent commands

SEE ALSO