diff --git a/content/docs/index.mdx b/content/docs/index.mdx index af4ba17..780432a 100644 --- a/content/docs/index.mdx +++ b/content/docs/index.mdx @@ -93,7 +93,7 @@ Read **[Core concepts](/concepts)** for each building block in detail. }, { title: "Integrations", - description: "GitHub, Vercel, Slack, Linear, Figma, webhooks and self-hosted workers.", + description: "GitHub, Vercel, Slack, Linear, Figma, webhooks and devices on your own network.", href: "/integrations", }, { diff --git a/content/docs/integrations/desktop-app.mdx b/content/docs/integrations/desktop-app.mdx index 8bdf94c..d156e7a 100644 --- a/content/docs/integrations/desktop-app.mdx +++ b/content/docs/integrations/desktop-app.mdx @@ -6,17 +6,18 @@ description: "Run Stunt Double as a Mac app, and let actors browse with your com # Desktop app -The desktop app is Stunt Double in its own Mac window. It can also turn your -Mac into a worker, so actors browse with this computer's Chrome, including its -VPN access and machine-credential sign-ins. +The desktop app is Stunt Double in its own Mac window. It can also make your +Mac a [device](/integrations/self-hosted-workers), so actors browse with this +computer's Chrome, including its VPN access and machine-credential sign-ins. ## Before you start - **macOS.** macOS 10.15 or later, on Apple silicon or Intel. - **Chrome.** Google Chrome installed, if you want to use the Mac as a - worker. -- **Plan.** The app itself works on any plan. Using it as a worker needs the - Workers entitlement, which comes with the Enterprise plan. + device. +- **Plan.** The app itself works on any plan. Using the Mac as a device needs + the Startup plan or above, with devices switched on by an owner or admin in + **Settings**, then **Devices**. ## Install it @@ -27,40 +28,49 @@ VPN access and machine-credential sign-ins. The app updates itself when a new version ships. -## Use this Mac as a worker +## Use this Mac as a device -1. In the app, open **Settings**, then **Workers**. -2. Find **Use this device as a worker** and click **Enable this device**. -3. The card changes to **Connected using this machine's browser.** The - worker shows in the list as **Your device**. -4. Assign actors to it. Open an actor, find **Self-hosted worker** and choose - this device under **Worker**. +1. In the app, open **Go**, then **This Device** (Cmd+D). The device console + opens in its own window. +2. Click **Set up this Mac**. The console shows **Connected** once the Mac + checks in. +3. Choose where each actor's browser runs. Open an actor, go to its **Manage** + tab and, under **Where this actor's browser runs**, choose this Mac or + **Any device in this workspace**. -The browser runs inside the app, not as a window on your desktop. Click **Open -device console** to watch what an actor is doing, sign in to an internal site -or take control of the browser. Sign-ins you make there persist for later -runs. +The browser runs inside the app, not as a window on your desktop. Use the +device console to watch what an actor is doing, sign in to an internal site or +take control of the browser. Sign-ins you make there persist for later runs. -Enabling is remembered. When the app restarts, including after an update, the -worker reconnects by itself. +Setting up is remembered. When the app restarts, including after an update, +the Mac reconnects by itself. Quitting the app closes its browser. -To stop, click **Disable** on the same card. +To stop, click **Disable this device** in the console. A run already in +progress stops with it. ## Troubleshooting -**There is no "Use this device as a worker" card.** The card only shows inside -the desktop app, in a workspace with the Workers entitlement. +**This Device asks you to install Google Chrome.** The device drives Chrome. +Install it, then click **Set up this Mac** again. -**The card asks you to install Google Chrome.** The worker drives Chrome. -Install it, then click **Enable this device** again. +**The console says this Mac is paired with another workspace.** A Mac belongs +to one workspace at a time. Click **Move to** and confirm to move it here. +Runs in the other workspace stop using it. -**The card offers "Pair with" your workspace.** This Mac is paired with a -different workspace, or its worker was deleted. Click **Pair with** to pair it -here. +**The console says "This device is no longer paired".** The device was removed +from the workspace, or its key no longer works. Click **Pair again**. -**The card says to update the app.** That version cannot manage a worker yet. -Update the app and reopen **Workers**. +**The console says "Not reaching Stunt Double".** The app is running, but +Stunt Double has not heard from it for over a minute. Check the Mac is online, +then click **Reconnect**. -**A run fails because the browser profile is in use.** Only one browser can -use the profile at a time. Close any Stunt Double worker running on the same -Mac from the command line, or a sign-in window left open, and try again. +**The console says to update the app.** That version cannot run a device yet. +Update the app and reopen **This Device**. + +**A run says the browser was suspended by security software.** Endpoint +security on the Mac froze Chrome before it could start. Ask your IT team to +allow Stunt Double to launch Google Chrome. + +**A run says the browser profile is in use.** Only one Chrome can use the +device's profile at a time. Close any Chrome window still open on that +profile, such as a sign-in window, and try again. diff --git a/content/docs/integrations/index.mdx b/content/docs/integrations/index.mdx index 5d71abf..b792379 100644 --- a/content/docs/integrations/index.mdx +++ b/content/docs/integrations/index.mdx @@ -107,18 +107,18 @@ and picks up wherever they left off. ## Every integration -| Integration | What it does | Who sets it up | What Stunt Double requests | -| -------------------------------------------------------- | ------------------------------------------------------------------------------ | -------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| [GitHub](/integrations/github) | Actor pull request reviews, PR comments, automations on GitHub events | Anyone connects; an owner or admin turns it on | OAuth: `read:user`, `user:email`, `repo`. GitHub App: access to the repositories you choose | -| [Vercel](/integrations/vercel) | Automations on deployment events | Anyone connects, or install from the Vercel Marketplace | The permissions the Vercel integration asks for at install | -| [Figma](/integrations/figma) | Design context for actors, automations on file events | Anyone connects; an owner or admin turns it on | `current_user:read`, `file_content:read`, `file_metadata:read`, `file_comments:read`, `file_comments:write` | -| [Figma plugin](/integrations/figma-plugin) | Design reviews, checklists, feedback and actor chat inside Figma | Each designer, from Figma | A plugin token valid for 90 days. The plugin only talks to stuntdouble.io | -| [Linear](/integrations/linear) | The Stunt Double agent on Linear issues, automations on issue events | Anyone connects; an owner or admin turns it on and picks the agent's actor | `read`, `write`, `issues:create`, `comments:create`, `app:assignable`, `app:mentionable` | -| [Slack](/integrations/slack) | Design reviews in threads, notifications, a workspace agent in direct messages | An owner or admin adds it to the workspace | `channels:read`, `groups:read`, `channels:history`, `groups:history`, `chat:write`, `chat:write.customize`, `mcp:connect`, `commands`, `users:read`, `app_mentions:read`, `incoming-webhook`, `assistant:write`, `im:history`, `im:write` | -| [Webhooks](/integrations/webhooks) | Start an automation from any system that can send an HTTP request | Anyone who can edit automations | A secret per automation, sent as `X-Webhook-Secret` | -| [Feedback widget](/integrations/feedback-widget) | Collect comments on your live site into a project | Project members; owners and admins set workspace limits | A project key that identifies the project, limited to your allowed domains | -| [Self-hosted workers](/integrations/self-hosted-workers) | Run actors on your own network, against sites the public internet cannot reach | Owners and admins, on Enterprise | A worker API key, shown once | -| [Desktop app](/integrations/desktop-app) | Use your Mac as a worker | Owners and admins, where workers are available | Your Stunt Double sign-in | +| Integration | What it does | Who sets it up | What Stunt Double requests | +| ------------------------------------------------ | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| [GitHub](/integrations/github) | Actor pull request reviews, PR comments, automations on GitHub events | Anyone connects; an owner or admin turns it on | OAuth: `read:user`, `user:email`, `repo`. GitHub App: access to the repositories you choose | +| [Vercel](/integrations/vercel) | Automations on deployment events | Anyone connects, or install from the Vercel Marketplace | The permissions the Vercel integration asks for at install | +| [Figma](/integrations/figma) | Design context for actors, automations on file events | Anyone connects; an owner or admin turns it on | `current_user:read`, `file_content:read`, `file_metadata:read`, `file_comments:read`, `file_comments:write` | +| [Figma plugin](/integrations/figma-plugin) | Design reviews, checklists, feedback and actor chat inside Figma | Each designer, from Figma | A plugin token valid for 90 days. The plugin only talks to stuntdouble.io | +| [Linear](/integrations/linear) | The Stunt Double agent on Linear issues, automations on issue events | Anyone connects; an owner or admin turns it on and picks the agent's actor | `read`, `write`, `issues:create`, `comments:create`, `app:assignable`, `app:mentionable` | +| [Slack](/integrations/slack) | Design reviews in threads, notifications, a workspace agent in direct messages | An owner or admin adds it to the workspace | `channels:read`, `groups:read`, `channels:history`, `groups:history`, `chat:write`, `chat:write.customize`, `mcp:connect`, `commands`, `users:read`, `app_mentions:read`, `incoming-webhook`, `assistant:write`, `im:history`, `im:write` | +| [Webhooks](/integrations/webhooks) | Start an automation from any system that can send an HTTP request | Anyone who can edit automations | A secret per automation, sent as `X-Webhook-Secret` | +| [Feedback widget](/integrations/feedback-widget) | Collect comments on your live site into a project | Project members; owners and admins set workspace limits | A project key that identifies the project, limited to your allowed domains | +| [Devices](/integrations/self-hosted-workers) | Run actors from a Mac on your own network, against sites the public internet cannot reach | An owner or admin turns devices on, on Startup and above; each member sets up their own Mac | Your Stunt Double sign-in, in the desktop app | +| [Desktop app](/integrations/desktop-app) | Stunt Double in a Mac window, and the way to use your Mac as a device | Anyone | Your Stunt Double sign-in | MCP clients (Claude, Claude Code, Cursor, Windsurf, ChatGPT) request `mcp:read`, `mcp:write` and `mcp:run`. Their setup is in the [MCP section](/mcp). diff --git a/content/docs/integrations/self-hosted-workers.mdx b/content/docs/integrations/self-hosted-workers.mdx index c2311b6..5acc952 100644 --- a/content/docs/integrations/self-hosted-workers.mdx +++ b/content/docs/integrations/self-hosted-workers.mdx @@ -1,14 +1,15 @@ --- -title: "Self-hosted workers" +title: "Devices" icon: "worker" -description: "Test products that only exist inside your network, with a worker that dials out from behind your firewall." +description: "Test products that only exist inside your network, with actors that browse from a Mac on that network." --- -# Self-hosted workers +# Devices -Your staging site sits behind a VPN, so a hosted browser cannot reach it. A -self-hosted worker runs on a machine inside your network and drives the -browser from there. It connects out to Stunt Double, so you open no inbound +Your staging site sits behind a VPN, so a cloud browser cannot reach it. A +device is a Mac running the Stunt Double app, inside your network. Actors set +to run on it browse with that Mac's Chrome, its VPN, its internal DNS and its +saved sign-ins. The app connects out to Stunt Double, so you open no inbound ports. For a full walkthrough, read @@ -16,105 +17,119 @@ For a full walkthrough, read ## What it does -- **Reach internal products.** Actors assigned to a worker browse from your - network, so they can open staging, intranet and local dev servers. -- **Outbound only.** The worker connects to Stunt Double. Nothing connects in. -- **Domain controls.** Each worker can be limited to the domains actors need. -- **Mixed fleets.** Actors without a worker keep using Stunt Double's cloud - browser, so one workspace can use both. +- **Reach internal products.** Actors on a device open staging, intranet and + local dev servers, the same way the person at that Mac can. +- **Outbound only.** The app connects to Stunt Double. Nothing connects in. +- **Domain controls.** Each device can be limited to the domains actors need. +- **Mixed workspaces.** Actors set to the cloud keep using Stunt Double's + cloud browser, so one workspace can use both. ## Before you start -- **Plan.** Self-hosted workers are on the Enterprise plan only. On other - plans, **Settings**, then **Workers**, shows **Enterprise feature**. -- **Role.** Only workspace owners and admins can set workers up. -- **A host.** A machine inside your network with Docker that can reach both - the product you want to test and `app.stuntdouble.io`. +- **Plan.** Devices are available on the Startup plan and above. On other plans, + **Settings**, then **Devices**, explains what they do and how to upgrade. + You see the same prompt when you point an actor at an address that only + works inside a network. +- **Role.** A workspace owner or admin turns devices on. Once they are on, any + member can set up their own Mac. +- **A Mac.** macOS on Apple silicon or Intel, with Google Chrome installed, + that can reach both the product you want to test and `app.stuntdouble.io`. ## Set it up -1. In [app.stuntdouble.io](https://app.stuntdouble.io), open **Settings**, - then **Workers**. The page is marked **Experimental**. -2. Turn on **Enable for this workspace**. -3. Click **Add worker**, enter a **Name** (and a description if you like), - then click **Create worker**. -4. Copy the Docker command shown under **Recommended: Docker**. The API key in - it is shown once, so copy it before you dismiss the panel. -5. Run the command on your host. It looks like this, with your own key: - - ```bash - # Run the worker (auto-restarts on failure; auto-updates via watchtower) - docker run -d --name sd-worker --restart unless-stopped \ - --label com.centurylinklabs.watchtower.enable=true \ - -e SD_WORKER_API_KEY= \ - ghcr.io/stunt-double/worker:latest - - # Enable auto-updates (one-time per machine; safe to re-run) - docker rm -f sd-watchtower 2>/dev/null; docker pull ghcr.io/nicholas-fedor/watchtower:1.19.0 && docker run -d --name sd-watchtower --restart unless-stopped \ - -v /var/run/docker.sock:/var/run/docker.sock \ - ghcr.io/nicholas-fedor/watchtower:1.19.0 --label-enable --cleanup --interval 300 - ``` - - The second command installs Watchtower, which pulls and restarts the worker - when a new `:latest` ships. Skip it if you would rather update by hand. - -6. Back on **Workers**, the worker's status changes to **Connected** once it - checks in. Enter an internal URL and click **Test connection**. The test - runs in the worker's browser, so a pass means actors can reach that URL. -7. Assign actors to it. Open an actor, find **Self-hosted worker** and choose - it under **Worker**. Pick **Any self-hosted worker** to use whichever one is - online when a run starts. - -For docker compose or other container setups, expand **API key only** to copy -the bare key and set it as `SD_WORKER_API_KEY` yourself. - -### Sites behind a VPN or machine-credential SSO - -The panel also shows a command for **System browser mode**. Instead of a -headless browser in a container, the worker opens that machine's own Chrome -with a dedicated profile, so the company VPN, device certificates and proxy -settings all apply. Run it on the machine that has VPN access, not inside -Docker, and sign in to your VPN portal or SSO once in the window that opens. -On a Mac, the [desktop app](/integrations/desktop-app) does the same with one -click. +1. **Turn devices on.** An owner or admin opens **Settings**, then + **Devices**, and switches on **Use devices in this workspace**. +2. **Install the app.** On the Mac, download the + [desktop app](/integrations/desktop-app), open it and sign in. +3. **Set up this Mac.** Open **Go**, then **This Device** (Cmd+D), and click + **Set up this Mac**. The device console shows **Connected** once the Mac + checks in, and the Mac appears under **Settings**, then **Devices**. +4. **Choose where each actor's browser runs.** Open an actor, go to its + **Manage** tab and find **Where this actor's browser runs**. Choose one of: + - **Stunt Double cloud**, for public sites. + - **Any device in this workspace**, to use whichever device is online when + a run starts. + - **A named device**, to always use that Mac. + +To check a device can reach a site before a run depends on it, enter the +address under **Test connection** in **Settings**, then **Devices**. The test +runs in the device's browser, so a pass means actors can reach that address. + +## How runs pick a browser + +The same rules apply however a run starts: the Run button, an automation, the +MCP server, the Figma plugin, the assistant, Slack, Linear or an interview. + +- **An actor set to a device never runs in the cloud.** If its device is + offline, or no device is online for an actor set to any device, the run + stops and says so. It does not fall back to a cloud browser. +- **A cloud actor never opens an internal site.** If the project is marked + internal, or the address only works inside a network (a private IP range, + for example), the run stops up front and asks you to choose a device for + the actor. + +## Move a Mac to another workspace + +A Mac belongs to one workspace at a time. To move it, open the workspace you +want it in, then open **This Device**. The console shows that the Mac is paired +with another workspace. Click **Move to** and confirm. Runs in the old +workspace stop using it from then on. ## Control what it can reach -Each worker has an **Access** setting: +Each device has an **Access** setting under **Settings**, then **Devices**: -- **Allow all domains.** The default. The worker may reach any host. +- **Allow all domains.** The default. The device may reach any host. - **Allow specific domains.** Only the hosts you list, and their subdomains. - **Block specific domains.** Any host except the ones you list, and their subdomains. -On a network where reach matters, switch to **Allow specific domains** and -list only what actors need. +The setting applies to every request the browser makes, including redirects, +popups and page resources, not only the addresses an actor types. On a network +where reach matters, switch to **Allow specific domains** and list only what +actors need. The workspace policy under **Settings**, then **Security**, +applies on top. -## Remove a worker +## Remove a device -Delete the worker from **Workers**. Actors assigned to it are unassigned and -go back to the cloud browser. Then stop the container on your host: - -```bash -docker rm -f sd-worker -``` +Remove the Mac from **Settings**, then **Devices**. Actors set to it go back +to the Stunt Double cloud. To stop a Mac without removing it, click **Disable +this device** in its device console. ## Troubleshooting -**The worker stays Offline.** Check the container is running -(`docker ps`) and read its logs (`docker logs sd-worker`). The host needs -outbound HTTPS to `app.stuntdouble.io`. +**The device shows Offline.** Open the Stunt Double app on that Mac. A device +is online only while the app is running and checking in. If the app is open +and the console says **Not reaching Stunt Double**, check the Mac is online +and has outbound HTTPS to `app.stuntdouble.io`, then click **Reconnect**. + +**The console says "This device is no longer paired".** The device was removed +from the workspace, or its key no longer works. Click **Pair again**. + +**A run says devices need the Startup plan.** Devices are available on the +Startup plan and above. Upgrade from **Settings**, then **Billing**. + +**You need a custom deployment.** If the Mac app does not fit how your network +works, for example you want the relay running in your own cloud, the +Enterprise plan includes custom deployments. Contact us to talk it through. + +**A run says devices are turned off.** Your plan includes devices, but +devices are switched off. An owner or admin can switch them on in +**Settings**, then **Devices**. -**Test connection says "No response from worker. Is it running?"** The worker -has not checked in. Start the container, wait for **Connected**, then test -again. +**A run says the address needs a device.** The actor runs in the cloud, but +the site only works inside your network. Choose a device for the actor on its +**Manage** tab. -**Test connection fails on your internal URL.** The worker is up but cannot -reach that host. Check DNS and routing from the host, and the worker's -**Access** setting. +**A run says the browser was suspended by security software.** Something on +the Mac, most likely endpoint security, froze Chrome before it could start. +Ask your IT team to allow Stunt Double to launch Google Chrome. -**You lost the API key.** It is only shown once. Delete the worker and create -a new one. +**A run says the browser profile is in use.** Only one Chrome can use the +device's profile at a time. Close any Chrome window still open on that +profile, such as a sign-in window, and try again. A browser left behind by an +earlier session of the app is closed for you. -**Settings shows "Enterprise feature".** Workers need the Enterprise plan. -Contact us to upgrade. +**A run says the address is not permitted.** The device's **Access** setting, +or the workspace policy in **Settings**, then **Security**, blocks that host. +Add it to the allowed list or remove it from the blocked list. diff --git a/content/docs/stuntkit/index.mdx b/content/docs/stuntkit/index.mdx index 580ed45..754bdad 100644 --- a/content/docs/stuntkit/index.mdx +++ b/content/docs/stuntkit/index.mdx @@ -13,8 +13,7 @@ icons, spelling and accessibility packages behind the product. It is licensed under Apache-2.0, at [github.com/stunt-double/stuntkit](https://github.com/stunt-double/stuntkit). StuntKit packages are published to GitHub Packages, which asks for a token even -for public packages. The self-hosted worker ships as the Docker image -`ghcr.io/stunt-double/worker:latest`. +for public packages. ## What's in it @@ -63,9 +62,9 @@ for public packages. The self-hosted worker ships as the Docker image - **Build your own browser agent.** Add `@stunt-double/browser-toolset` to an agent loop, connect it to Playwright, a hosted browser or a CDP client, and turn on the guards. See [Give an AI agent a safe browser](/stuntkit/browser-toolset). -- **Run Stunt Double sessions on your own infrastructure.** The self-hosted - worker image runs actors inside your network, so they can reach staging and - internal tools. See [Test a product behind your firewall](/tutorials/self-hosted-worker). +- **Run Stunt Double sessions on your own network.** A Mac running the + Stunt Double app runs actors inside your network, so they can reach staging + and internal tools. See [Test a product behind your firewall](/tutorials/self-hosted-worker). - **Make a site work for agents.** Drop the `@stunt-double/wao` script into a page to repair the accessibility tree agents read. - **Match the product in your own UI.** Use `@stunt-double/icons` for the diff --git a/content/docs/tutorials/index.mdx b/content/docs/tutorials/index.mdx index 69ac985..4bd0486 100644 --- a/content/docs/tutorials/index.mdx +++ b/content/docs/tutorials/index.mdx @@ -1,6 +1,6 @@ --- title: "Tutorials" -description: "Step-by-step guides for getting the most out of every part of Stunt Double: actors, checklists, interviews, workflows, Slack, self-hosted workers, and the API." +description: "Step-by-step guides for getting the most out of every part of Stunt Double: actors, checklists, interviews, workflows, Slack, devices, and the API." --- # Tutorials @@ -69,7 +69,7 @@ your usage grows. icon: 'worker', title: '8. Test a product behind your firewall', description: - 'Run actors against an internal product with a self-hosted worker, no inbound firewall changes required.', + 'Run actors against an internal product from a Mac on your network, no inbound firewall changes required.', href: '/tutorials/self-hosted-worker', }, { diff --git a/content/docs/tutorials/self-hosted-worker/index.mdx b/content/docs/tutorials/self-hosted-worker/index.mdx index 7c7a332..ba0bdc6 100644 --- a/content/docs/tutorials/self-hosted-worker/index.mdx +++ b/content/docs/tutorials/self-hosted-worker/index.mdx @@ -1,70 +1,74 @@ --- title: "Test behind a firewall" icon: "worker" -description: "Run actors against an internal product with a self-hosted worker, no inbound firewall changes required." +description: "Run actors against an internal product from a Mac on your network, no inbound firewall changes required." --- # Test a product behind your firewall If the product you want to test is only reachable inside your network, a -hosted browser session can't reach it. A self-hosted worker runs on your side -of the firewall instead, so actors can reach an internal product without -opening anything up. - - - Self-hosted workers are part of the Enterprise plan, and only a workspace - owner or admin can turn them on and add workers. The page is marked - **Experimental** in the app. +cloud browser can't reach it. A device is a Mac on your side of the firewall +running the Stunt Double app, so actors browse from there without you opening +anything up. + + + Devices are available on the Startup plan and above. A workspace owner or admin switches + them on, then any member can set up their own Mac. -## Add a worker +## Turn devices on -1. Open **Settings > Workers** and select **Enable for this workspace**. -2. Select **Add worker**, name it, then **Create worker**. -3. Copy the Docker snippet the app shows. It runs the published image - `ghcr.io/stunt-double/worker:latest` with your worker's API key in - `SD_WORKER_API_KEY`. The key is shown once, so store it somewhere safe - before you close the dialog. The snippet can also add Watchtower to keep - the image up to date. -4. Run it on a machine inside your network, then select **Test connection** - to confirm it reaches Stunt Double and your target product. +Open **Settings > Devices** and switch on **Use devices in this workspace**. +On other plans, this page explains what devices do and how to upgrade. -The worker dials out to Stunt Double rather than waiting for an inbound -connection, so your firewall needs no changes. Your security team can pull -and inspect the image before it runs. +## Set up a Mac -## Control what it can reach +1. On a Mac that can reach your internal product, download the Stunt Double + [desktop app](/integrations/desktop-app), open it and sign in. Google + Chrome needs to be installed. +2. Open **Go > This Device** (Cmd+D) and click **Set up this Mac**. +3. Wait for the device console to show **Connected**. -Each worker has an access setting with three modes: +The app dials out to Stunt Double rather than waiting for an inbound +connection, so your firewall needs no changes. If your product sits behind a +VPN portal or SSO, sign in once in the device console. The sign-in persists +for later runs. -- **Allow all domains**: no restriction. -- **Allow specific domains**: only the domains you list. -- **Block specific domains**: everything except the domains you list. +## Choose where each actor's browser runs -A new worker starts on Allow all domains, so it works as soon as it -connects. To restrict it, switch to Allow specific domains and list only what -your actors need to reach. +Open an actor, go to its **Manage** tab and find **Where this actor's browser +runs**: -## Pin actors and checklists to a worker +- **Stunt Double cloud** for public sites. +- **Any device in this workspace** to use whichever device is online. +- **A named device** to always use that Mac. -Once a worker is connected, assign the actors and checklists that need to -reach your internal product to it. Everything else -keeps running on hosted browser sessions as normal, a workspace can mix both -freely. +An actor set to a device never falls back to the cloud: if its device is +offline, the run stops and tells you. An actor set to the cloud never opens an +internal site: if the project is marked internal, or the address only works +inside your network, the run stops and asks you to choose a device. -## Watch connection status live +## Control what it can reach + +Each device has an access setting in **Settings > Devices** with three modes: + +- **Allow all domains**: no restriction. +- **Allow specific domains**: only the domains you list. +- **Block specific domains**: everything except the domains you list. -The Workers page reflects connection status live: a worker's heartbeat flips -its status without needing a page refresh, so you can tell at a glance -whether it's online before kicking off a run that depends on it. +A new device starts on Allow all domains, so it works as soon as it connects. +To restrict it, switch to Allow specific domains and list only what your +actors need to reach. -## Run a worker on your Mac +## Watch status live -The Stunt Double desktop app for Mac can act as a worker too. With Workers -enabled, open **Settings > Workers**, select **Use this device as a worker**, -then **Enable this device**. +Devices show their status live everywhere they appear: Settings, the actor's +Manage tab and the device console. A Mac that stops checking in turns Offline +within a couple of minutes, so you can tell before starting a run that depends +on it. ## Next steps +- **[Devices reference and troubleshooting](/integrations/self-hosted-workers)** - **[Automate multi-step workflows](/tutorials/building-workflows)** - **[Turn runs into insights](/tutorials/reviewing-runs)**