feat(desktop): one browser session and extension system for every pane

Merged
KI
12h ago
+523-390

Links

  • Plan: plans/20261030-browser-pane-passkeys.md (security table row "Agents read autofill" updated)

Summary

  • Panes agents open now use the same session as every other browser pane (persist:browser), so they get the user's extensions, extension toolbar and logins.
  • The browser bridge no longer refuses the user's own panes: agents can list, drive, CDP-attach and wake any browser pane.

Why / Context

Extensions should work across every browser pane. #9221 put agent-opened panes in a separate persist:browser-agent session with no Web Store extensions, so sessions' browsers had no extensions and started signed out.

How It Works

  • Removed AGENT_BROWSER_PARTITION / PANE_PARTITIONS; webviews, UA setup, shims preload, internal extension load, downloads and clear-data use BROWSER_PARTITION only. The extension host already serves that session, so agent panes become extension tabs with no extra code.
  • The pane agent flag is gone: no pane acts differently based on who opened it. One hidden-webview eviction pool for every pane (agent use still counts as use), no openUrlAgent route param, and pane-layout snapshots drop browser.agent.
  • Bridge: removed isAgentPane and the 403 / CDP 1008 refusals. list includes every pane, and wakeBrowser rebuilds any unloaded browser pane, not only agent ones.
  • Cookies: the pane's CDP session refuses every cookie read/write command (Network.*Cookies, Storage.*Cookies, clearDataForOrigin with cookies, Cookie/Set-Cookie headers in Network/Fetch commands) and strips cookie headers and cookie lists from Network/Fetch events (cdp-cookie-guard.ts). import-login stays the only way to add cookies.
  • Agents may sign in with the user's password manager when asked (skill); /panes now requires a workspaceId.
  • Toolbar shows pinned extensions + Extensions menu on agent panes too.
  • Login-import dialog copy now says cookies go into the in-app browser (all 17 locales translated).
  • superset plugin's browser and panes skills no longer say user panes are off-limits; the safety section names password managers and autofilled passwords.

Manual QA Checklist

  • Install an extension in a user pane; superset browser open from an agent shows it in the agent pane's toolbar and it runs there
  • Agent pane is signed in to sites the user is signed in to
  • superset browser list shows user-opened panes; eval / screenshot / CDP work on them
  • An evicted pane (user or agent) is rebuilt on an agent command
  • Clear browsing data still works

Testing

  • bun run typecheck (desktop): clean
  • bun test on src/main/lib/browser, BrowserPane, and _authenticated/components: 701 pass, 0 fail (bridge tests updated: agents reach the user's pane; eviction wake works for a user pane)
  • bun run check:i18n, bun run check:plugins: pass
  • Not verified in the running app yet.

Known Limitations

  • The old persist:browser-agent data (including cookies imported into it before) stays on disk; nothing reads it anymore.

Risks / Rollout

  • Risk: security trade-off by design. CDP can no longer read or write cookies, but eval can still read document.cookie (non-HttpOnly only). Agents now act in the user's signed-in session next to their password manager, and eval/CDP could read an autofilled field. Only the skill's instructions guard against that.
  • Rollback: revert this PR; agent panes go back to the isolated session.

Summary by cubic

Every browser pane, user- or agent-opened, now runs in one shared persist:browser session, so agent-opened panes get the user's extensions, extension toolbar, and signed-in sessions instead of starting logged out.

  • Agents can list, drive, CDP-attach, and wake any browser pane; the pane agent flag and its separate hidden-webview eviction pool are gone. Pane listing now requires a workspaceId.
  • CDP can no longer read or write cookies: cookie commands are refused and cookie headers and lists are stripped from network events. import-login stays the only way to add cookies.
  • Clicking a pane's extension button makes that pane the active tab first, so popups act on the right pane; a newly registered pane no longer takes the active tab.
  • An extension's new tab never claims a pane a browser open request created, and a pane resolved through resolveOpenRequest is skipped by the extension's waiter.
  • The browser skill lets an agent sign in with the user's password manager when asked, as long as it never reads the filled value back; only those instructions guard against misuse.
  • The old persist:browser-agent data stays on disk but nothing reads it; revert this PR to restore the isolated session.

Summary by CodeRabbit

  • New Features
    • Browser controls, extensions, and browser tools are available across workspace browser panes. Activating an extension selects the pane it applies to.
    • Browser panes share a signed-in session, making imported cookies, logins, and extensions available across panes.
  • Updates
    • Cookie-import notices and browser guidance describe the shared in-app browser and provide updated sign-in and sensitive-data guidance.
    • Browser tools block cookie access and changes, and remove cookie details from supported network information.
    • Clearing browsing data applies to the shared in-app browser session.