diff --git a/.agent/workflows/gitbucket_api.md b/.agent/workflows/gitbucket_api.md
index 96935c1..88872fc 100644
--- a/.agent/workflows/gitbucket_api.md
+++ b/.agent/workflows/gitbucket_api.md
@@ -98,7 +98,24 @@
 ### 3. Orchestration Workflow
 - **List All**: `GET /api/v3/repos/owner/repo/issues` to see the current backlog.
 - **Detailed Context**: `GET .../issues/<ID>/comments` to read the history of an ongoing task.
-- **Finish**: Post a final summary comment and (optionally) use the browser subagent to close the issue in the UI.
+- **Finish**: Post a final summary comment and use the browser subagent to close the issue in the UI.
+
+### 4. UI-Only Actions (Browser Setup)
+For actions that the API cannot handle (like closing an issue in certain configurations), use the `browser_subagent`.
+
+// turbo
+#### Establish Browser Bridge (Dev Container)
+If the browser is unreachable (e.g., `ECONNREFUSED 127.0.0.1:9222`), ensure port 9222 is forwarded in VS Code and run:
+```bash
+sudo apt-get install -y socat
+# Bridge container port 9222 to host machine
+socat TCP-LISTEN:9222,fork,reuseaddr TCP:host.docker.internal:9222 &
+# Verify connection
+curl -s http://127.0.0.1:9222/json/version
+```
+
+#### Authentication
+Retrieve login credentials (username/password) from the **Snippet Vault** (`.env.ai`) using the `git clone` or raw fetch methods described above before attempting any browser-based login.
 
 ## Security Best Practices
 - **Private Only**: Never store credentials in "Public" or "Secret" snippets.