Jenny took the pen on Omar's real whiteboard and streamed the whole thing to his phone — he watched every stroke land, live, from across the room.
This is a real, honest writeup of a test that actually ran on 07.26.26 — the goal, the exact workflow so it repeats, the walls we hit and how we got past them, what got drawn, the genuine gaps, and what it proves. It is a working instance of the live-shared-session idea — the same hands-plus-phone-stream, minus Zoom, one human in the loop.
Have Jenny take the pen on Omar's own Whimsical whiteboard and actually draw on it — text, shapes, arrows, a checklist — while Omar watches it happen live on his phone through a simple web link. Not a screenshot after the fact. Not a canned demo. Jenny's hands on the real board, streamed in near real-time to a device he's holding across the room.
Why it matters: if Jenny can drive a real, logged-in creative tool and a human can watch live from anywhere, that's the whole "watch a specialist work live" delivery experience — proven on an ordinary board, with ordinary parts, no model call anywhere in the pipe.
One real signed-in Chrome, opened with a debugging port. Jenny attaches to that same browser and drives it. A tiny local server screenshots the board a few times a second and serves it; a Cloudflare tunnel turns that into a phone-friendly link. Follow the arrows top to bottom.
Launched with --user-data-dir=yt-digest\.chrome-whimsical and --remote-debugging-port=9222 plus anti-throttle flags so it keeps repainting. This is the actual Chrome that holds the live Whimsical login.
chromium.connectOverCDP('http://127.0.0.1:9222') hooks onto the exact open page and clicks, types and draws — these are her hands on the board.
scripts/coview/stream9222.jsAttaches to :9222, screenshots the board ~2.5 frames/sec into memory, and serves a mobile watch page on :8130.
scripts/coview/coview-tunnel.ps1Runs cloudflared tunnel --url http://localhost:8130, scrapes the printed https://<random>.trycloudflare.com URL, writes it to state/coview-url.txt.
The watch page auto-refreshes the latest frame a few times a second. Omar sees every stroke Jenny makes, in near real-time, from across the room.
All pure plumbing: real Chrome, Playwright, a screenshot loop, a tunnel. No model call anywhere in this pipe. The brain is the live interactive session; everything above just moves pixels and clicks.
These are the concrete moves, in order. The one human step (sign-in) is called out plainly — it's the piece that makes the whole thing work, and the reason it's a durable pattern rather than a fragile hack.
Use the dedicated Whimsical profile and open the debugging port so tools can attach. Anti-throttle flags keep it repainting even when it's not the focused window.
Omar RDP'd into the VM from his phone and clicked through the Whimsical / Google sign-in by hand. This one human action is what clears Google's 2FA and its anti-automation wall — a machine cannot. Once done, the session persists in that profile for weeks.
Playwright connects to the already-open, already-signed-in page — no new browser, no re-login — and drives it: toolbar tools, keyboard shortcuts, the Shapes picker, the color palette.
A second attach, just for capture — screenshots the board a few frames a second and serves a phone-friendly watch page on port 8130.
The tunnel wraps port 8130 in a public trycloudflare.com URL and writes it to a file. Omar opens that on his phone and watches Jenny work.
This is the valuable part. Getting a machine into a logged-in creative tool is exactly where these things usually die. Here's every wall, honestly, and the move that cleared it.
The obvious first move — lift the login cookies out of the real Chrome profile and drop them into a Playwright browser — does not work on modern Chrome. Its app-bound cookie encryption locks cookies to the genuine Chrome binary; a copied profile can't decrypt them.
Cleared by: stop copying cookies. Drive the real Chrome directly over CDP instead of trying to clone its session into a different browser.
The purpose-built .chrome-whimsical profile had been signed in before — but the session had lapsed and it was logged out. So even attaching to the right Chrome landed on a login screen.
Cleared by: a fresh sign-in was needed — which led straight into Wall 3.
Trying to sign in programmatically hit two hard security walls at once: Google's 2FA cannot be bypassed by a script, and Google threw its anti-automation block — "this browser or app may not be secure." These are working-as-intended defenses, not bugs to route around.
Cleared by: don't fight the security wall — put a real human on the other side of it for ten seconds (the fix below).
Omar RDP'd into the VM from his phone and signed into Whimsical by hand. A genuine human interaction sails straight past both the 2FA prompt and the "may not be secure" automation block — because it isn't automation. Jenny then attached to that now-logged-in real Chrome over CDP and drove it.
The durable pattern: the human does the one thing only a human can do — prove they're human, once — and the agent does everything after. Sign-in is a one-time human handshake; the drive is fully automated. The session then persists for weeks, so future edits need no login at all.
Every one of these was drawn live on Omar's board (whimsical.com/launchai/P9FyAGTnHMqrv4ZMc9bR74) and screenshot-verified as it landed — Omar watched each appear on his phone.
A representative sketch of the finished board — the real board holds the same elements, screenshot-verified as each landed.
The interaction model, learned live: Whimsical is driven with toolbar tools + keyboard shortcuts (R = rectangle, O = circle), a Shapes button that opens a component picker, arrow and pen tools on the left rail, and fill-color set from the selection toolbar's color palette. That map is now known and repeatable.
Two things didn't come out perfect. We name them plainly — the honesty is the point.
The one-time human sign-in persists in the profile. Future edits need no login at all — until the cookie naturally expires (roughly weeks out). The human handshake is rare, not per-session.
Real logged-in tool, agent's hands on it, streamed to a phone, watched in near real-time — the whole loop ran and delivered. Not a mockup; a working session.
This is the live-shared-session idea minus Zoom — the same Playwright-hands + phone-stream, with one human in the loop. The architecture just got a real proof point.
The one-line version: put a human on the security wall for ten seconds, and the agent can drive any logged-in tool afterward — while anyone, anywhere, watches it happen live on a phone. Pure plumbing, proven parts, no model call in the pipe.
This test is a live proof point for two published blueprints — the co-view + drive is the same substrate underneath both.
One human sign-in, an agent's hands on a real board, a live stream to a phone across the room. Honest about its two rough edges, proven on everything that matters.