The JSON-array branch of parse_curl_cookies dropped every field except
name/value, so importing a full cookie export (httpOnly session tokens,
per-domain cookies spanning multiple hosts, secure/sameSite/expiry) could
not reconstruct a usable auth state — a single --domain override cannot
cover an export that spans .chatgpt.com, .openai.com, etc.
Pass through url/domain/path/secure/httpOnly/sameSite/expires when present,
accepting common aliases from DevTools / EditThisCookie exports
(http_only, same_site, no_restriction, expirationDate). Bare {name,value}
exports are unchanged. Added a round-trip test.
- README + README.zh: new Anti-detection subsections — "Human-like input
(behavioural stealth)" (curved trajectories / jitter / cadence / eased
scroll-drag, adaptive per-page escalation, off|fast|human) with the
trajectory contrast table, and "Silent operation" (background tabs, no
foreground stealing, focus-emulated). Added AGENT_BROWSER_HUMANIZE to the
tuning-knobs table.
- skill core: agents told operation is silent by default and how/when to use
--humanize (leave on auto; force human for known behavioural targets).
Driving the user's real Chrome should not yank their view around. Now the agent
operates entirely in the background:
- New tabs are created with `background: true` (CreateTargetParams) so opening
one never foregrounds it (the ab-connect extension already used active:false;
this covers the raw-CDP path too).
- Dropped the two AUTO `Page.bringToFront` calls (auto-connect fresh tab, and the
internal active-page switch). The explicit `bringToFront` command is untouched —
surfacing a tab stays opt-in.
- enable_domains now sets `Emulation.setFocusEmulationEnabled(true)` so a
backgrounded agent tab still renders (screenshots work), isn't render-throttled,
and reports document.hasFocus()/visibilityState='visible' — which also removes
the "tab is hidden the whole session" bot tell.
Verified headless: hasFocus=true/visible while backgrounded; click + screenshot
still work. Default behaviour, no flag.
Completes the humanize suite:
- Clicks land on a jittered point inside the element's box (Fast/Human) instead
of its exact centre. `resolve_element_center` now also returns the element
width/height (box_model_dims); the CSS-selector path reports zero size → land
on centre (no jitter, no regression). Jitter is clamped to the inner box so the
click never misses.
- Wheel scrolls split into eased, jittered segments (humanize::scroll_segments,
unit-tested) instead of one instant jump.
- Drag follows the curved trajectory at Fast/Human (linear 10-step at Off).
Off is unchanged throughout. 9/9 unit tests; verified headless — jittered click
still lands (→ iana.org), segmented scroll moves the page.
- Typing: type_text_into_active_context now uses variable, human-like
inter-keystroke gaps from humanize::keystroke_delays when no explicit --delay
is given (Fast/Human); Off stays instant. Explicit --delay still wins.
- CLI: `--humanize off|fast|human` surfaces AGENT_BROWSER_HUMANIZE so the
session's daemon (a child that inherits this env) applies it, overriding the
adaptive detector. Invalid values warn and are ignored.
Verified headless: `--humanize human` + type lands "hello world" correctly.
Deferred: in-bbox landing jitter (helper ready, needs bbox threaded) + wheel/drag
easing.
After each navigation, probe the loaded page for known behavioural anti-bot
vendor fingerprints — cookies (_abck/Akamai, _px/PerimeterX, datadome,
reese84/Imperva, …), script URLs, and window globals — and escalate this
session to HumanizeLevel::Human when one is present, else fall back to the Off
baseline. So ordinary sites run at full speed (instant clicks) and only pages
actually guarded by behavioural detection pay for human-like motion.
`AGENT_BROWSER_HUMANIZE` still forces a fixed level and short-circuits the probe.
Best-effort: a failed probe leaves the level unchanged. Verified end-to-end
(headless --launch): a HUMANIZE=human click on example.com traverses the curved
trajectory and lands correctly (→ iana.org), identical outcome to Off.
Behavioural stealth: a click that teleports the cursor to an element's exact
centre with no approach path and zero press/release delay is a tell that
advanced anti-bot vendors (Akamai/PerimeterX/DataDome) flag, even though our CDP
events are isTrusted.
New `native::humanize` module — pure, unit-tested motion maths (cubic-Bézier
eased trajectories, in-bounds landing jitter, variable keystroke cadence, and an
anti-bot vendor detector) plus a small daemon-wide runtime (current level + last
cursor + per-action seed). `dispatch_click` now moves along a curved,
decelerating path from the last cursor position and dwells before releasing.
Three levels off|fast|human. Default is Off → byte-for-byte the old teleport, so
nothing changes until opted in. `AGENT_BROWSER_HUMANIZE=human` forces it now;
the adaptive per-navigation detector (set_detected_level) and type/wheel/drag
coverage land next. 8/8 unit tests; fmt + clippy clean.
Release binaries / Build macOS ARM64 (push) Has been cancelled
Release binaries / Build macOS x64 (push) Has been cancelled
Release binaries / Build Linux ARM64 (push) Has been cancelled
Release binaries / Build Linux musl ARM64 (push) Has been cancelled
Release binaries / Build Linux musl x64 (push) Has been cancelled
Release binaries / Build Linux x64 (push) Has been cancelled
Release binaries / Build Windows x64 (push) Has been cancelled
Release binaries / Attach binaries to GitHub Release (push) Has been cancelled
Ships the post-fork.34 skill updates into the binary's embedded `skills get core`:
- lead extension setup with the one-click Chrome Web Store install
- nudge agents to file UX feedback at the GitHub issues page
- when an agent hits the "Allow remote debugging?" dialog, self-check the version
and upgrade a stale (<fork.30) build / remove a shadowing npm-pnpm copy
Plus the README opening rewrite (hook-first vs Claude-in-Chrome / web-access /
Playwright) and Chinese README — docs only, ride along.
Other users will hit the same "古董二进制" problem — an agent-browser-stealth
predating the relay-preference (fork.30) ignores the extension relay and pops
Chrome 136+'s "Allow remote debugging?" dialog. So when an agent hits that dialog,
the skill now says to:
1. check `agent-browser --version`; if < 0.27.0-fork.30, upgrade via install.sh
(the npm registry lags — Releases are source of truth), and remove any stale
npm/pnpm copy that shadows it (a tool bundling its own pinned copy needs that
upgraded too);
2. otherwise install the Store extension.
Stops the "keep retrying the raw port" loop.
Add a prominent callout near the top of the core skill asking agents that hit a
rough edge (confusing error, stale @ref, occluded click, flaky wait, missing
feature) to open a quick issue at
https://github.com/leeguooooo/agent-browser-stealth/issues with the command and
expected-vs-actual. Agent-filed friction is the cheapest, highest-signal way to
sharpen the tool (the Hermes dogfood runs already proved this).
The comparison read like a checklist (Runtime.enable leak, permissions footprint
— proof, not pitch). Reframe the opening around the visceral wins:
- headline: "Give your AI agent the browser you already live in"
- pain→relief lead: no fresh Chrome, no re-login, no captcha walls; you watch it
work and take the wheel on 2FA; undetectable because it IS your browser (0% bot)
- three plain "why not just use X?" lines (Playwright/browser-use, Claude in
Chrome, raw debug port) instead of a wall of checkmarks
- the honest feature matrix moves into a collapsible "Full feature comparison".
Mirrored in README.zh.md.
Reader fact-checked the table — three rows overclaimed:
- CreepJS: all real-Chrome tools (Claude in Chrome, web-access, us) score ~0%; it
is NOT a win vs them. Reframe as "real-browser fingerprint" (✅ for all three,
❌ for Playwright/Puppeteer); note ours is the measured one.
- Runtime.enable leak: mark Claude in Chrome "—" (not independently tested) rather
than ✅; web-access/Playwright leak, ours is off by default (rebrowser-verified).
- Multi-agent: web-access CAN run parallel sub-agents (shared browser), so not ❌.
The real differentiator is per-session ISOLATED, command-scoped tab groups.
Added footnotes spelling out the caveats. Same fixes in README.zh.md.
- README opens with a head-to-head vs Claude in Chrome / web-access (raw CDP) /
Playwright·Puppeteer·browser-use: the only tool that drives your own logged-in
Chrome, from any agent, with no consent popup, undetectably (CreepJS 0%), and
multi-agent — addresses the recurring "why not just use <alternative>" question.
- add README.zh.md (简体中文) with a language switcher in both files.
The extension is live on the Web Store, so make the one-click, no-popup extension
path the recommended setup (native messaging — no debug port, no token, no "Allow
remote debugging?" dialog, restart-stable). Demote the raw --remote-debugging-port
method to a collapsed "Alternative" that notes it pops the consent dialog.
Release binaries / Build macOS ARM64 (push) Has been cancelled
Release binaries / Build macOS x64 (push) Has been cancelled
Release binaries / Build Linux ARM64 (push) Has been cancelled
Release binaries / Build Linux musl ARM64 (push) Has been cancelled
Release binaries / Build Linux musl x64 (push) Has been cancelled
Release binaries / Build Linux x64 (push) Has been cancelled
Release binaries / Build Windows x64 (push) Has been cancelled
Release binaries / Attach binaries to GitHub Release (push) Has been cancelled
Ships the post-publish changes now that agent-browser-stealth is live on the
Chrome Web Store (knfcmbamhjmaonkfnjhldjedeobeafmk):
- force-install (.mobileconfig) targets the Store extension id (5d202c0)
- skill leads extension setup with the one-click Store install; agents that hit
the "Allow remote debugging?" dialog now tell the user to install the Store
build instead of retrying the raw-port path (bc96229)
- native-messaging host already allow-lists both the Store and Load-unpacked ids
The extension is now live on the Web Store
(knfcmbamhjmaonkfnjhldjedeobeafmk). Update the skill so agents:
- install from the Store (one-click, restart-stable, auto-updating) as the
primary path, with Load-unpacked demoted to a dev fallback (it can be disabled
on Chrome restart, silently dropping the relay).
- when they DO hit the "Allow remote debugging?" dialog (relay not live → raw-port
fallback), stop retrying and tell the user to install the Store extension once,
rather than repeatedly popping the consent dialog.
agent-browser-stealth is now published (id knfcmbamhjmaonkfnjhldjedeobeafmk). The
.mobileconfig force-install pulls from the Web Store update server, which serves
the extension under its STORE id — so the forcelist must use STORE_EXTENSION_ID,
not the local Load-unpacked id. (The native-messaging host already allows both
ids.)
Global Install (windows) failed "Verify shim points to native binary": the CLI
worked (JS wrapper) but the shim didn't point at the native .exe. Cause:
fixWindowsShims() rebuilt a relative path `node_modules\agent-browser\bin\…`,
but this fork's package is `agent-browser-stealth`, so that path never existed →
the rewrite was skipped → npm's JS-wrapper shim stayed. Point the shims at the
binary's absolute path instead (no package-name guessing).
Also: npm frequently creates the .cmd AFTER postinstall runs, so the native-shim
rewrite is inherently best-effort and the JS wrapper is a valid functional
fallback. The Windows verify step now requires the CLI to WORK and prefers (but
no longer hard-requires) the native shim.
These jobs ran for the first time once the Windows matrix hang was fixed:
- Global Install: `npm pack` runs the `prepare` script (`husky`), but husky isn't
installed in that job (no devDeps) → "husky: not found", exit 127. Guard it:
`prepare: husky || true` (husky's recommended pattern for envs without devDeps;
still installs hooks for local dev when husky is present).
- Windows Integration: `agent-browser open` defaults to auto-connect and looked
for an existing Chrome on a debug port, which a fresh CI runner lacks → "Could
not connect". A CI smoke test should spawn its own browser: use `--launch`.
e2e_save_state_cross_domain navigated to httpbin.org as "domain A", which is an
unreliable external service — when it was slow/unreachable in CI the page didn't
load on that origin, so its localStorage origin was missing from the saved state
and the test failed intermittently. Cookies/localStorage are set client-side via
CDP, so the page just needs to load reliably: use example.org (IANA-reserved,
like example.com) instead. Match full hostnames so the two example.* origins
don't alias. Verified locally: passes deterministically.
The Rust (windows) matrix job hung for hours (GitHub's 6h default) because the
`doctor_offline_quick_json_emits_valid_payload` integration test spawns the real
CLI and `doctor --offline --quick` does not exit on Windows while its stdout is
captured — so `Command::output()` blocks forever. (The 767-test main suite and
the `doctor --help` test both pass on Windows; only this check hangs. macOS/Linux
matrix is unaffected.) This was masked until now because fail-fast used to cancel
the Windows job whenever the macOS lightpanda test failed first.
- skip that one test on Windows (`#[cfg_attr(windows, ignore = …)]`) with a note
to investigate the Windows doctor exit/pipe behavior; still runs on Linux/macOS.
- add `timeout-minutes: 30` to the rust-cross matrix and native-e2e jobs so a
hung test fails fast with a readable log instead of running to the 6h default.
Release binaries / Build macOS ARM64 (push) Has been cancelled
Release binaries / Build macOS x64 (push) Has been cancelled
Release binaries / Build Linux ARM64 (push) Has been cancelled
Release binaries / Build Linux musl ARM64 (push) Has been cancelled
Release binaries / Build Linux musl x64 (push) Has been cancelled
Release binaries / Build Linux x64 (push) Has been cancelled
Release binaries / Build Windows x64 (push) Has been cancelled
Release binaries / Attach binaries to GitHub Release (push) Has been cancelled
- invalid CSS selector now errors "Invalid selector '<sel>': <reason>" instead of
the misleading "Element not found" — the coordinate path (resolve_by_selector)
now also inspects exception_details, matching resolve_element_object_id.
- `wait --url ""` is rejected at parse time ("needs a non-empty pattern") rather
than silently matching any URL. Unit test added.
Not changed: verb-less `find role X` defaulting to a click. That default is a
deliberate, tested decision (test_find_role_default_subaction_click_when_no_action);
changing it to locate-and-report is a design choice left to the maintainer.
Release binaries / Build macOS ARM64 (push) Has been cancelled
Release binaries / Build macOS x64 (push) Has been cancelled
Release binaries / Build Linux ARM64 (push) Has been cancelled
Release binaries / Build Linux musl ARM64 (push) Has been cancelled
Release binaries / Build Linux musl x64 (push) Has been cancelled
Release binaries / Build Linux x64 (push) Has been cancelled
Release binaries / Build Windows x64 (push) Has been cancelled
Release binaries / Attach binaries to GitHub Release (push) Has been cancelled
- wait --url: the arg parser never read `--timeout`, so a non-matching pattern
waited the large default and wedged the daemon. Parse it. Also: matching was a
literal substring (`includes`) so globs never matched — convert `**`/`*`/`?`
globs to an anchored regex. And `poll_until_true` now bounds each probe with a
timeout and tolerates transient navigation errors, so a hung `Runtime.evaluate`
can never block past the deadline (un-wedges the daemon).
- find role <role> [--name]: the query was `[role="X"], X`, which matches a
literal <X> tag / explicit attribute but NOT implicit-role elements — so
`find role link` (<a href>) and `find role heading` (<h1>) never matched. Add a
proper ARIA-role → implicit-element map and broaden accessible-name matching
(aria-label/title/alt/value/text).
- click on a syntactically-invalid selector returned `✓ Done`: querySelector
throws, and Runtime.evaluate returned the thrown DOMException as an objectId
that was clicked as if it were the element. Check exception_details → error.
- output: a title-less page now prints `✓ <url>` instead of an empty title line.
- docs(skill): tab refs are `t2`, not `2` (SKILL.md, electron).
Verified live (isolated launch): wait --url glob matches instantly; non-matching
honors --timeout (2s) and leaves the daemon responsive; find role link/heading
match; invalid selector errors. Unit tests added for the glob + role map + parse.
- assets/how-it-works.png: CLI → extension (native messaging) → your real Chrome
- assets/architecture.png: tab groups / service worker / native messaging / CLI
- comparison table vs raw-CDP-port tools (web-access) and chrome.debugger
(Claude in Chrome): the extension never triggers Chrome 136+'s "Allow remote
debugging?" consent dialog, keeps Runtime.enable off (rebrowser clean), scores
0% on CreepJS, and gives per-session tab groups for concurrent agents.
Release binaries / Build macOS ARM64 (push) Has been cancelled
Release binaries / Build macOS x64 (push) Has been cancelled
Release binaries / Build Linux ARM64 (push) Has been cancelled
Release binaries / Build Linux musl ARM64 (push) Has been cancelled
Release binaries / Build Linux musl x64 (push) Has been cancelled
Release binaries / Build Linux x64 (push) Has been cancelled
Release binaries / Build Windows x64 (push) Has been cancelled
Release binaries / Attach binaries to GitHub Release (push) Has been cancelled
- extension: popup status page (paired/not-paired) so the listing has standalone
UI; renamed agent-browser-stealth + new icon (earlier in this line)
- store: upload zip strips manifest "key" (the Web Store forbids it); the unpacked
dir + .crx keep it. Submitted for review (item knfcmbamhjmaonkfnjhldjedeobeafmk).
- connect: native-messaging allowed_origins lists BOTH the local Load-unpacked id
(ciiljdlhd…) and the store-assigned id (knfc…), so either install path pairs.
- ci: launch-based jobs opt into AGENT_BROWSER_ALLOW_HEADLESS for display-less
runners (fixes Native E2E); + version-sync/dashboard/fmt/clippy/flaky-test repairs.
- docs: skill documents both install methods (Load unpacked now, Web Store later).
Store upload strips manifest 'key', so the published build gets id
knfcmbamhjmaonkfnjhldjedeobeafmk (not the local ciiljdlhd). Add a
STORE_EXTENSION_ID const and list both origins in allowed_origins so either the
local Load-unpacked build or the store build can reach the native host.
The Chrome Web Store rejects uploads whose manifest contains a "key" field
("manifest must not contain 'key'") — it assigns its own id. pack-extension.sh
intentionally kept "key" in the zip, so every upload failed. Now the script
stages a copy and removes "key" for the zip only; the unpacked DIR and the signed
.crx keep "key" so local Load-unpacked + managed force-install stay pinned to
ciiljdlhd…. After the first store upload, add the store-assigned id to the
native-messaging allowed_origins (connect.rs EXTENSION_ID) so the store build pairs.
The biggest Web Store rejection risk for a CLI-bridge extension is "non-functional
without external software." Give ab-connect a visible standalone UI: a branded
popup that shows whether the native-messaging link to the local agent-browser CLI
is live (Connected + attached tab count, or Not paired with the install hint),
plus a one-line privacy statement (no tracking, no remote server) and a repo link.
- manifest: action.default_popup = popup.html; bump 0.4.0 -> 0.4.1
- background.js: track hostConnected; respond to {type:'ab-status'} from the popup
and nudge a reconnect on open
- popup.html/popup.js: dark/cyan branded status page (MV3-CSP-safe: external JS,
no inline handlers), with a safety timeout so it never hangs on "Checking…"
- repacked ab-connect.zip/.crx
This fork forbids headless by default (always-headed for stealth, fork.27), but
CI runners have no display, so launched Chrome failed to start — every Native E2E
test errored at 'Chrome Launch attempt failed'. Opt the launch-based jobs into the
documented AGENT_BROWSER_ALLOW_HEADLESS=1 escape (designed for display-less
servers). global-install doesn't launch Chrome, so it's untouched.
CI's stable toolchain is clippy 1.96, which flags unnecessary_sort_by that local
1.94 did not. hits.sort_by(|a,b| b.date_added.cmp(&a.date_added)) -> sort_by_key
with Reverse.
The fork's CI had never been green. Pre-existing failures:
- version-sync: check-version-sync.js read packages/dashboard/package.json,
which doesn't exist in this fork (workspace is just "."). Drop the dashboard
comparison; check package.json vs cli/Cargo.toml only.
- Dashboard job: `pnpm install --filter dashboard` for a non-existent package.
Remove the job.
- Format check: repo was never `cargo fmt`-clean. Ran cargo fmt (mechanical).
- Clippy -D warnings (newly enforced on Rust 1.94 stable): manual_contains in
commands.rs (.iter().any()->.contains()), question_mark in element.rs
(if-let-Err -> ?), result_large_err on the tungstenite handshake callback in
connect.rs (allow — the Result type is fixed by the accept_hdr_async contract).
- rust-cross: lightpanda::waits_for_ready_without_logs spawns a real process +
binds a socket with timing assumptions; flaky in CI. Marked #[ignore].
Also: skill docs note fork.30's relay-preferred auto-connect (plain
`agent-browser open` is dialog-free once the ab-connect extension is loaded) and
the extension's new "agent-browser-stealth" display name.
Release binaries / Build macOS ARM64 (push) Has been cancelled
Release binaries / Build macOS x64 (push) Has been cancelled
Release binaries / Build Linux ARM64 (push) Has been cancelled
Release binaries / Build Linux musl ARM64 (push) Has been cancelled
Release binaries / Build Linux musl x64 (push) Has been cancelled
Release binaries / Build Linux x64 (push) Has been cancelled
Release binaries / Build Windows x64 (push) Has been cancelled
Release binaries / Attach binaries to GitHub Release (push) Has been cancelled
rebrowser's navigatorWebdriver probe checks Object.getOwnPropertyNames(navigator)
== [] (real Chrome keeps navigator members on Navigator.prototype). The launch-mode
stealth script defined language/languages/userAgentData/contacts as instance
own-properties, leaking them as an automation tell.
- add __abRedefineNavProto(name, getterImpl): redefines a navigator member on the
PROTOTYPE with a native-masked getter toString, then deletes any instance shadow
(mirrors the existing vendor patch). Falls back to instance only if proto is locked.
- convert language/languages/userAgentData to it; make the contacts block prototype-first.
After: Object.getOwnPropertyNames(navigator) == [], values intact, getters native,
rebrowser navigatorWebdriver 🟢, runtimeEnableLeak/pwInitScripts 🟢, sannysoft 0 fails.
Release binaries / Build macOS ARM64 (push) Has been cancelled
Release binaries / Build macOS x64 (push) Has been cancelled
Release binaries / Build Linux ARM64 (push) Has been cancelled
Release binaries / Build Linux musl ARM64 (push) Has been cancelled
Release binaries / Build Linux musl x64 (push) Has been cancelled
Release binaries / Build Linux x64 (push) Has been cancelled
Release binaries / Build Windows x64 (push) Has been cancelled
Release binaries / Attach binaries to GitHub Release (push) Has been cancelled
- stealth(plugins): stop overwriting real native navigator.plugins in headed
mode (the JS fake had a non-native item(), broken uint32 wrap → incolumitas
overflowTest FAIL, and an anachronistic Native Client plugin). Leave native
plugins untouched when present; modernize the headless-escape fallback to the
real 5 PDF-viewer set with masked-native item()/namedItem().
- connect: auto_connect_cdp() now prefers the dialog-free ab-connect relay over
the raw :9222 CDP port, so Chrome 136+'s "Allow remote debugging?" consent
modal no longer fires when the extension relay is live. Gated by a bare-TCP
relay_is_live() probe (+3 unit tests).
- extension: rename ab-connect to "agent-browser-stealth" + new stealth icon set
(16/32/48/128).
- docs(README): hero/shield/fingerprint images, expanded detector results
(CreepJS 0% stealth, incolumitas all-OK, BrowserScan CDP-clean), and a
"Verify it yourself" section. .gitignore: allow assets/ + extension icons.
Update the served skill (skill-data/core, embedded into the binary) for tonight's
changes: --headed is the default and headless is FORBIDDEN (was wrongly 'default
is headless'); each --session on the extension-connect path gets its own colored
tab group with no cross-talk; anti-detection ranking real-Chrome(extension) >
headed-launch > headless(forbidden). Needs a rebuild so standalone installs'
embedded skill reflects it.
Headless Chrome is a bot-detection tell: creepjs scores ~33% headless even with
--headless=new, while a headed window with a real GPU scores 0%. Since this is a
stealth fork, headless is now forbidden — build_chrome_args ignores the headless
LaunchOption and never emits --headless/--enable-unsafe-swiftshader/forced
--window-size. The only escape is AGENT_BROWSER_ALLOW_HEADLESS=1 for genuinely
display-less servers (discouraged — forfeits stealth).
Verified locally: default launch (no env) is headed (webdriver=false,
platform=MacIntel, no --headless flag); creepjs headed = 0% headless vs 33%
headless. chrome.rs: 48 tests pass incl. forbids-headless + escape.
platform_string() feeds the CDP Emulation.setUserAgentOverride 'platform' field,
which sets the LEGACY navigator.platform. It was returning the UA-CH form
("macOS"/"Linux") — but real Chrome reports navigator.platform = "MacIntel" on
macOS and "Linux x86_64" on Linux. "macOS" contradicts the UA's "Intel Mac OS X"
and is a trivial bot-detection tell (platform vs UA mismatch). UA-CH
(navigator.userAgentData.platform via platform_hint) stays "macOS"/"Windows"/
"Linux" — that form is correct there.
Verified locally on bot.sannysoft.com (all rows green incl. navigator.platform=
MacIntel) + eval probes: webdriver false, no Headless in UA, real WebGL
(Apple M3 Metal, not SwiftShader), plugins/permissions consistent.
ROOT CAUSE of per-session command drift on the extension path: the daemon's
liveness check (`is_connection_alive` → `Browser.getVersion`) is a BROWSER-level
command. The relay only answered Target.* locally and forwarded the rest, so
Browser.getVersion went to the extension, which can only do per-tab
chrome.debugger → it errored → CdpClient saw TransportError → connection deemed
DEAD → the daemon closed + reconnected + re-ran discover_and_attach_targets on
EVERY command. Each re-discover rebuilds pages from the relay's minimal
targetInfo and resets active_page_index=0, so eval/get-title/screenshot drifted
to the first tab (about:blank / a foreign focused tab).
Reproduced locally (throwaway Chrome + Extensions.loadUnpacked + fork.24 nm-host):
trace showed discover_and_attach_targets running on every command (pages
before=0) and [ev] active_idx reset to 0.
Fix: relay answers Browser.getVersion locally with a stub version (like
getTargets), so the liveness probe succeeds → connection stays alive → no
reconnect/re-discover → the session's active tab is preserved. Pairs with
fork.24's add_background_page. relay.rs: 10 unit tests.
After connect+grouping worked, follow-up eval/get-title/screenshot drifted to a
foreign tab: on a shared browser, Target.targetCreated events for tabs the user
or OTHER agent sessions open stream in and are drained on every command. The
drain path routed them through add_page(), which sets active_page_index to the
new page — so the session's active tab silently jumped to a foreign tab and its
commands landed there.
Add BrowserManager::add_background_page() (push without touching active, dedup by
target_id) and use it in the event-drain path. Explicit opens (tab new, the
add-and-switch paths) keep using add_page() and still focus the new tab.
Closes the last gap in concurrent multi-agent: each session now drives its OWN
tab regardless of other sessions'/the user's tab activity.
leeguooooo