diff --git a/containers/Dockerfile b/containers/Dockerfile
index 6249528..51d5753 100644
--- a/containers/Dockerfile
+++ b/containers/Dockerfile
@@ -88,10 +88,10 @@ RUN npm install -g retire@latest && \
     npm install -g tree-sitter-cli@latest && \
     npm install -g agent-browser@0.26.0
 
-USER pentester
 ENV AGENT_BROWSER_EXECUTABLE_PATH=/usr/bin/chromium
 ENV AGENT_BROWSER_USER_AGENT="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
-ENV AGENT_BROWSER_ARGS="--disable-blink-features=AutomationControlled --exclude-switches=enable-automation --disable-features=IsolateOrigins,site-per-process,Translate,BlinkGenPropertyTrees --no-first-run --no-default-browser-check --window-size=1920,1080 --lang=en-US,en --disable-infobars --disable-notifications --disable-save-password-bubble --disable-session-crashed-bubble"
+ENV AGENT_BROWSER_ARGS="--disable-blink-features=AutomationControlled,--no-first-run,--no-default-browser-check,--lang=en-US"
+ENV AGENT_BROWSER_SCREENSHOT_DIR=/workspace/.agent-browser-screenshots
 RUN /home/pentester/.npm-global/bin/agent-browser doctor --offline --quick
 
 RUN set -eux; \
diff --git a/containers/docker-entrypoint.sh b/containers/docker-entrypoint.sh
index 6824e3b..f8e179b 100644
--- a/containers/docker-entrypoint.sh
+++ b/containers/docker-entrypoint.sh
@@ -90,6 +90,8 @@ sudo -u pentester certutil -N -d sql:/home/pentester/.pki/nssdb --empty-password
 sudo -u pentester certutil -A -n "Testing Root CA" -t "C,," -i /app/certs/ca.crt -d sql:/home/pentester/.pki/nssdb
 echo "✅ CA added to browser trust store"
 
+mkdir -p /workspace/.agent-browser-screenshots
+
 echo "✅ Container ready"
 
 cd /workspace
diff --git a/docs/advanced/configuration.mdx b/docs/advanced/configuration.mdx
index 4d51f3c..a40b9fc 100644
--- a/docs/advanced/configuration.mdx
+++ b/docs/advanced/configuration.mdx
@@ -41,10 +41,6 @@ Configure Strix using environment variables or a config file.
   API key for Perplexity AI. Enables real-time web search during scans for OSINT and vulnerability research.
 </ParamField>
 
-<ParamField path="STRIX_DISABLE_BROWSER" default="false" type="boolean">
-  Disable browser automation tools.
-</ParamField>
-
 <ParamField path="STRIX_TELEMETRY" default="1" type="string">
   Global telemetry default toggle. Set to `0`, `false`, `no`, or `off` to disable both PostHog and OTEL unless overridden by per-channel flags below.
 </ParamField>
diff --git a/strix/skills/tooling/agent_browser.md b/strix/skills/tooling/agent_browser.md
index 4682ade..9ef810d 100644
--- a/strix/skills/tooling/agent_browser.md
+++ b/strix/skills/tooling/agent_browser.md
@@ -18,6 +18,10 @@ wired via ``http_proxy`` / ``https_proxy`` env vars — **do not pass
 captures all page traffic. Localhost (CDP) traffic is excluded via
 ``NO_PROXY=localhost,127.0.0.1``.
 
+Default viewport is 1280×720. For sites that gate behavior on real
+desktop dimensions (responsive breakpoints, bot fingerprinting), run
+``agent-browser viewport 1920 1080`` once per session.
+
 ## The core loop
 
 ```bash
@@ -37,7 +41,7 @@ next ref interaction.
 ```bash
 # Take a screenshot of a page
 agent-browser open https://example.com
-agent-browser screenshot home.png
+agent-browser screenshot
 agent-browser close
 
 # Search, click a result, and capture it
@@ -48,7 +52,7 @@ agent-browser press Enter
 agent-browser wait --load networkidle
 agent-browser snapshot -i                      # refs now reflect results
 agent-browser click @e5                        # click a result
-agent-browser screenshot result.png
+agent-browser screenshot
 ```
 
 The browser stays running across commands so these feel like a single
@@ -241,15 +245,22 @@ shell command alone does **not** put the image into your context —
 chain it with the SDK ``view_image`` tool to actually see it:
 
 ```bash
-exec_command:  agent-browser screenshot /workspace/page.png
-view_image:    {"path": "/workspace/page.png"}
+exec_command:  agent-browser screenshot
+view_image:    {"path": "<path printed on stdout>"}
 ```
 
+Default output directory is ``/workspace/.agent-browser-screenshots/``,
+which ``view_image`` can read. Prefer the no-arg form (the CLI prints
+the full path on stdout — pass that to ``view_image``). If you need a
+specific filename, keep it inside that directory or a sibling hidden
+dir under ``/workspace``. Never write screenshots to ``/tmp`` —
+``view_image`` rejects anything outside the workspace root.
+
 ```bash
-agent-browser screenshot                        # temp path, printed on stdout
-agent-browser screenshot page.png               # specific path (relative to cwd)
-agent-browser screenshot --full full.png        # full scroll height
-agent-browser screenshot --annotate map.png     # numbered labels + legend keyed to snapshot refs
+agent-browser screenshot                        # path printed on stdout
+agent-browser screenshot /workspace/.agent-browser-screenshots/page.png
+agent-browser screenshot --full                 # full scroll height
+agent-browser screenshot --annotate             # numbered labels + legend keyed to snapshot refs
 ```
 
 `--annotate` is designed for multimodal models: each label `[N]` maps
@@ -262,6 +273,12 @@ tokens; screenshots cost more. Use `snapshot` first; reach for
 layout questions, captchas, custom widgets where the accessibility
 tree is incomplete).
 
+If ``view_image`` errors back at you (rejected image, "vision not
+supported", or similar), you are running on a text-only model — stop
+calling it and stop taking screenshots. Drive the page entirely from
+`snapshot -i` refs, `eval` for any DOM/JS state you need to read, and
+`text @ref` / `get text` for content extraction.
+
 ### Handle multiple pages via tabs
 
 ```bash