Repository navigation
🤖 fix: turn off the agent-browser stream before the sandbox recipe sends the token - #7910
Conversation
…nds the token agent-browser starts a credential-less WebSocket stream per session. The recipe now opens about:blank, turns the stream off, checks that it is off, and only then sends the token URL. The skill states the Chrome DevTools port limit. AGENTS.md says not to open credential URLs directly.
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
🟢 e2e stories (Haiku): 14 passed22 agent steps · 7 replayed from cache · 15 model calls · 47.1k tokens (23% cached) All 14 tests in 9 files
e2e 0.20.0 · 1m 15s · web · run artifacts 🟢 e2e Electron stories (Haiku): 3 passed3 agent steps · 3 model calls · 7.9k tokens (22% cached) All 3 tests in 3 files
e2e 0.20.0 · 20.8s · electron · run artifacts 🟢 e2e agent repros (Haiku): no tests selectedSpend: $0.00 of the $1.00 cap (proxy ledger) e2e 0.20.0 · 5.8s · 2 targets (web, phone) · run artifacts |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b972058141
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…-attachment Codex review on #7910. The bash tool drops AGENT_BROWSER_SESSION between calls, so the recipe passes --session on every command and the text says to do the same later. The Xum Browser tab attaches a session by itself and turns its stream on, so the text says to close the tab and the recipe checks the stream again after the page loads. The limit names the Windows daemon port.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c2adfcf1bd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex review on #7910. A failing close no longer prints that the session was closed.
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Summary
The
dev-server-sandboxskill's recipe opens the sandbox inagent-browserwith the token in the URL.agent-browser0.33.2 starts a WebSocket stream on a loopback port for every session, and that stream accepts mouse and keyboard input with no credential. Any local account could drive the authenticated page (and open a terminal in the sandbox). The recipe now turns the stream off before the token goes in. A second open port, Chrome's own DevTools port, stays open: it is documented in the skill as a limit.Background
#7908 made the first browser open argv-free and silent. It left the stream open. Root found that
nobodygets HTTP 101 on a session's stream port, and asked for the fix.While I tested this I found that
stream disabledoes not make the page safe.agent-browserstarts Chrome with--remote-debugging-port=0, andnobodycan use that port with no credential too (see Validation). A launch with--remote-debugging-pipemakes Chrome exit ("pipe file descriptors are not open"), soagent-browserhas no way to drop the TCP port. This PR closes the stream and states the DevTools port as a limit. How to handle that port is a separate decision for the maintainer.Implementation
.xum/skills/dev-server-sandbox/SKILL.md:S=xum-sandboxand passes--session "$S"on every command (the bash tool does not keepAGENT_BROWSER_SESSIONbetween calls, so later commands need--session xum-sandboxtoo). It opensabout:blank, runsstream disable, and checks--json stream statusfor"enabled":false. Only then does it build the token URL and pipe it toagent-browser batchon stdin, as before. After the page loads it checks the stream again: if it came back on, the recipe closes the session and exits 1 (and says so when the close itself fails). If the first check fails, nothing is sent and the recipe exits 1 with a message. A failed batch still prints its output withtoken=<redacted>and exits 1.closeor an idle timeout (a new daemon starts with the stream on), and states the limit: Chrome's DevTools port has no credential, and on Windows the daemon's command port has none either. On a host with other accounts, usecurlorxum apiand do not open the authenticated page.docs/AGENTS.md(Browser Automation): one paragraph that says not toopena URL that carries a credential, and points to the recipe. The built-in skill content is regenerated.Other places checked (grep for
agent-browserandtoken=over tracked files, including.xum/skills,.agents/skills,docs,tests/bugbash,scripts,workflowsandsrc):.xum/skills/dev-server-sandbox/SKILL.mddocs/AGENTS.mdagent-browser open <url>.xum/skills/dev-desktop-sandbox/SKILL.mdworkflows/track1-implementation.js,workflows/track2-rlm-implementation.jstests/bugbash,scriptsagent-browser.agents/skills/dogfood,.agents/skills/electronvercel-labs/agent-browser(pinned byskills-lock.json)src/node/services/browser, the Browser tabValidation
I ran the recipe as written (extracted from the skill) against
make dev-server-sandboxwith a token ofXq+9/aZ=_proof&k#z, and probed asnobody(sudo -n -u nobody):nobodywithHTTP/1.1 101 Switching Protocols.agent-browserrecorded the stream port just beforestream disable(the page isabout:blankthen):nobodygot 101 on it. After the recipe,nobodygotConnection refusedon that port, andstream statussaidStreaming disabled. The session's daemon had no TCP listener left.stream disableclosed a client that was already connected (the client saw the server close).[agent-browser] launched browser), with 0 hits for the raw and the URL-encoded token. The page loaded authenticated (the first-run provider dialog, not "Authentication Required") and its URL had no token.agent-browser(they log the calls): the stream cannot be turned off (exit 1, no batch call, 0 token hits), the stream turns on after the batch (exit 1, session closed), the batch echoes the URL with exit 0 (nothing printed) and with exit 1 (token=<redacted>, exit 1). Every call carried--session.nobody: the session's Chrome port still answeredGET /json/versionwith HTTP 200. In a separate check,nobodyalso finished the CDP WebSocket handshake and got a reply toTarget.getTargets.Risks
agent-browsersession. A session that follows this recipe has no stream, so a Xum app on the same host cannot show it.ensureSessionAttachableinAgentBrowserSessionDiscoveryService, and the tab attaches by itself). The skill says to close the tab first, and the recipe's second check catches a re-enable after the page loads but cannot prevent one in the short gap between the checks.Generated with
xum• Model:anthropic:claude-sonnet-5-5• Thinking:xhigh• Cost:$38.49