Add browser manager and explicit browser selection#454
Open
gregpr07 wants to merge 15 commits into
Open
Conversation
⛔ Skill review blockedAn automated security review found 1 finding(s) across 1 file(s).
Skill authorship is restricted to maintainers. Please do not attempt to self-fix — a maintainer will review and follow up. |
![github-advanced-security[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
1 issue found across 5 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="src/browser_harness/auth.py">
<violation number="1" location="src/browser_harness/auth.py:457">
P2: TTY API-key entry can crash on aborted input because `EOFError` from `getpass` is not handled. Convert prompt failures to `AuthError` so CLI exits cleanly with error status.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
Contributor
There was a problem hiding this comment.
6 issues found and verified against the latest diff
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="tests/unit/test_run_manager_mode.py">
<violation number="1" location="tests/unit/test_run_manager_mode.py:42">
P2: All three tests leak BH_MANAGER_MODE into os.environ — run.main() calls setdefault('BH_MANAGER_MODE', '1') but no test cleans it up. Can cause test-order-dependent failures in any test that reads BH_MANAGER_MODE.</violation>
</file>
Tip: instead of fixing issues one by one fix them all with cubic
Re-trigger cubic
Contributor
There was a problem hiding this comment.
4 issues found across 34 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/release.yml">
<violation number="1" location=".github/workflows/release.yml:16">
P1: Release workflow uses mutable action tags instead of immutable commit SHAs, creating CI/CD supply-chain risk for PyPI publishing.</violation>
</file>
<file name="install.md">
<violation number="1" location="install.md:14">
P2: Install instructions use unconditional `rm -rf` on generic skill directory names, risking deletion of legitimate user skills</violation>
</file>
<file name="src/browser_harness/manager_client.py">
<violation number="1" location="src/browser_harness/manager_client.py:97">
P2: `stop_manager_if_running` ignores the response from `send_request` and unconditionally returns `True` on successful transport, misleading callers if the daemon rejects shutdown.</violation>
</file>
<file name="src/browser_harness/local_profiles.py">
<violation number="1" location="src/browser_harness/local_profiles.py:86">
P2: Changing profile_config_path() to return settings.json risks silent data loss because set_default_profile_id() overwrites the entire file without reading existing content. The docs describe settings.json as "selected local Chrome profile and future preferences", indicating it is a shared settings document. Future preferences stored there will be clobbered on every profile change.</violation>
</file>
Tip: Review your code locally with the cubic CLI to iterate faster.
Fix all with cubic | Re-trigger cubic
| contents: read | ||
| id-token: write | ||
| steps: | ||
| - uses: actions/checkout@v4 |
Contributor
There was a problem hiding this comment.
P1: Release workflow uses mutable action tags instead of immutable commit SHAs, creating CI/CD supply-chain risk for PyPI publishing.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/release.yml, line 16:
<comment>Release workflow uses mutable action tags instead of immutable commit SHAs, creating CI/CD supply-chain risk for PyPI publishing.</comment>
<file context>
@@ -0,0 +1,25 @@
+ contents: read
+ id-token: write
+ steps:
+ - uses: actions/checkout@v4
+ - uses: actions/setup-python@v5
+ with:
</file context>
| uv tool install -e . | ||
| command -v browser-harness | ||
| uv tool install browser-harness | ||
| for root in "${CODEX_HOME:-$HOME/.codex}/skills" "$HOME/.agents/skills"; do |
Contributor
There was a problem hiding this comment.
P2: Install instructions use unconditional rm -rf on generic skill directory names, risking deletion of legitimate user skills
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At install.md, line 14:
<comment>Install instructions use unconditional `rm -rf` on generic skill directory names, risking deletion of legitimate user skills</comment>
<file context>
@@ -1,176 +1,79 @@
-uv tool install -e .
-command -v browser-harness
+uv tool install browser-harness
+for root in "${CODEX_HOME:-$HOME/.codex}/skills" "$HOME/.agents/skills"; do
+ rm -rf "$root/browser-harness" "$root/browser" "$root/browser-use"
+done
</file context>
| except (FileNotFoundError, ConnectionRefusedError, TimeoutError, OSError, ValueError, KeyError, TypeError): | ||
| return False | ||
| try: | ||
| manager_runtime.send_request(sock, token, {"meta": "shutdown"}) |
Contributor
There was a problem hiding this comment.
P2: stop_manager_if_running ignores the response from send_request and unconditionally returns True on successful transport, misleading callers if the daemon rejects shutdown.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/browser_harness/manager_client.py, line 97:
<comment>`stop_manager_if_running` ignores the response from `send_request` and unconditionally returns `True` on successful transport, misleading callers if the daemon rejects shutdown.</comment>
<file context>
@@ -87,6 +87,24 @@ def _manager_socket_alive(path: Path) -> bool:
+ except (FileNotFoundError, ConnectionRefusedError, TimeoutError, OSError, ValueError, KeyError, TypeError):
+ return False
+ try:
+ manager_runtime.send_request(sock, token, {"meta": "shutdown"})
+ return True
+ except (OSError, ValueError, AttributeError):
</file context>
|
|
||
|
|
||
| def profile_config_path() -> Path: | ||
| return config_dir() / "settings.json" |
Contributor
There was a problem hiding this comment.
P2: Changing profile_config_path() to return settings.json risks silent data loss because set_default_profile_id() overwrites the entire file without reading existing content. The docs describe settings.json as "selected local Chrome profile and future preferences", indicating it is a shared settings document. Future preferences stored there will be clobbered on every profile change.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/browser_harness/local_profiles.py, line 86:
<comment>Changing profile_config_path() to return settings.json risks silent data loss because set_default_profile_id() overwrites the entire file without reading existing content. The docs describe settings.json as "selected local Chrome profile and future preferences", indicating it is a shared settings document. Future preferences stored there will be clobbered on every profile change.</comment>
<file context>
@@ -77,18 +79,14 @@ def payload(self) -> dict:
def profile_config_path() -> Path:
+ return config_dir() / "settings.json"
+
+
</file context>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by cubic
Adds manager mode with explicit browser ids and isolated runtimes: create with browser_new("private" | "cloud"), then select with browser(id) before using page helpers. Also adds PyPI packaging with
uvinstall, abrowser-harness skillcommand, XDG-based workspace paths, cloud auth login/import with leaner status, a repo-local./browser-harnesslauncher, tighter diagnostics and JS evaluation, and opt‑out telemetry.New Features
uv tool install browser-harness;browser-harness skillprints the canonical skill body; materializesSKILL.mdin packages for non-symlink installs; new docs/browser-connection.md; shorter install guide.${XDG_CONFIG_HOME:-~/.config}/browser-harness/; override withBH_HOME,BH_CONFIG_DIR, orBH_RUNTIME_DIR; manager endpoint viaBH_MANAGER_ROOT/BH_MANAGER_SOCKET../browser-harnesslauncher runs the working tree without a venv and uses a checkout-specific manager root under /tmp; newbrowser-harness-managerentrypoint.BH_TELEMETRY=0orBROWSER_HARNESS_TELEMETRY=0.Migration
${XDG_CONFIG_HOME:-~/.config}/browser-harness/agent-workspace/; adjust any hard-coded references or setBH_CONFIG_DIR/BH_HOME.browser-harness auth login(supports device code and stdin), orbrowser-harness auth importonce.Written for commit 07e56f7. Summary will update on new commits.