feat: auto-start sandbox browser

docs/gateway/configuration.md

@@ -1354,7 +1354,9 @@ Legacy: `perSession` is still supported (`true` → `scope: "session"`,
           vncPort: 5900,
           noVncPort: 6080,
           headless: false,
-          enableNoVnc: true
+          enableNoVnc: true,
+          autoStart: true,
+          autoStartTimeoutMs: 12000
         },
         prune: {
           idleHours: 24,  // 0 disables idle pruning

docs/gateway/sandboxing.md

@@ -19,6 +19,8 @@ and process access when the model does something dumb.
 ## What gets sandboxed
 - Tool execution (`bash`, `read`, `write`, `edit`, `process`, etc.).
 - Optional sandboxed browser (`agents.defaults.sandbox.browser`).
+  - By default, the sandbox browser auto-starts (ensures CDP is reachable) when the browser tool needs it.
+    Configure via `agents.defaults.sandbox.browser.autoStart` and `agents.defaults.sandbox.browser.autoStartTimeoutMs`.
 
 Not sandboxed:
 - The Gateway process itself.