agent-browser: add 0.39.1 (archetype C, fedora final) #32

Merged

chad merged 1 commit from glen/agent-browser into main

2026-10-21 12:47:03 -04:00

glen commented

2026-10-21 12:44:35 -04:00

Collaborator

Step 2 of the npm-through-bubblebox migration: agent-browser as an archetype-C package (the npm package is just a wrapper around this same native binary).

fedora:44 final, not scratch — its daemon spawns Chrome-for-Testing, which needs the full X/GBM/NSS/GTK fontstack. The browser itself is NOT baked in: agent-browser install downloads it into user state on first run (~170 MB; that in-sandbox download is the needs-human-verify item — noted in smoke.toml).
Daemon persistence verified live on bee (isolated store, engine 0.4.1): daemon + Chrome outlive each per-command bwrap sandbox (socket via writable_run in $XDG_RUNTIME_DIR); warm invocations 0.03s vs 1.4s cold, same daemon pid across three invocations, clean shutdown leaves nothing behind. Entrypoint documents why NO /persist bind: the daemon must see ~/.agent-browser at the same path outside the sandbox.
Pinned + verified — v0.39.1 gnu binary, sha256 from GitHub's release-asset digest; verified in-build.
Smoke — --version tripwire + --help only. Doctor deliberately excluded: verified on a pristine HOME that doctor counts "no Chrome downloaded" as a FAIL (rc=1), which a bare-sandbox gate can never satisfy since we ship no browser.
Full verify on bee: lint + build + smoke + footprint 692 MB (gate 750, deno/vicinae-style justification) — all pass. Fresh-eyes review round complete: both should-fixes (pristine-HOME evidence, /persist rationale) and both nits (engine-version pin on the daemon claim, honest download wording) addressed.

After merge: publish dispatch → think profile PR (joins railway) → then the host image can drop nodejs (separate PR). dsh remains the optional third step.

Step 2 of the npm-through-bubblebox migration: agent-browser as an archetype-C package (the npm package is just a wrapper around this same native binary). - **fedora:44 final, not scratch** — its daemon spawns Chrome-for-Testing, which needs the full X/GBM/NSS/GTK fontstack. The browser itself is NOT baked in: `agent-browser install` downloads it into user state on first run (~170 MB; that in-sandbox download is the needs-human-verify item — noted in smoke.toml). - **Daemon persistence verified live on bee** (isolated store, engine 0.4.1): daemon + Chrome outlive each per-command bwrap sandbox (socket via `writable_run` in `$XDG_RUNTIME_DIR`); warm invocations 0.03s vs 1.4s cold, same daemon pid across three invocations, clean shutdown leaves nothing behind. Entrypoint documents why NO `/persist` bind: the daemon must see `~/.agent-browser` at the same path outside the sandbox. - **Pinned + verified** — v0.39.1 gnu binary, sha256 from GitHub's release-asset digest; verified in-build. - **Smoke** — `--version` tripwire + `--help` only. Doctor deliberately excluded: verified on a pristine HOME that doctor counts "no Chrome downloaded" as a **FAIL** (rc=1), which a bare-sandbox gate can never satisfy since we ship no browser. - **Full verify on bee**: lint + build + smoke + footprint 692 MB (gate 750, deno/vicinae-style justification) — all pass. Fresh-eyes review round complete: both should-fixes (pristine-HOME evidence, /persist rationale) and both nits (engine-version pin on the daemon claim, honest download wording) addressed. After merge: publish dispatch → think profile PR (joins railway) → then the host image can drop `nodejs` (separate PR). dsh remains the optional third step.

glen added 1 commit

2026-10-21 12:44:35 -04:00

agent-browser: add 0.39.1 (archetype C, fedora final)

verify / verify (pull_request) Successful in 1m32s

Details

4056ce1cfc

Upstream native Rust binary (gnu flavor — Chrome-for-Testing is
glibc-linked), sha256-verified against the GitHub release-asset digest:
6906d3a2a67b05809932a93d99e53d1132373f0a52a617b2d6032dbb954df6fc

fedora:44 final (not scratch like railway/): the daemon spawns
Chrome-for-Testing, which needs the full X/GBM/NSS/font runtime — the
lib set is Chrome's documented Linux deps, headless edition. No browser
shipped in the image; 'agent-browser install' downloads it into user
state on first run (that in-sandbox download was not exercised —
needs-human-verify on first adopter run, noted in smoke.toml).

Daemon persistence verified on bee (isolated store, engine 0.4.1): the
daemon + Chrome outlive each per-command bwrap sandbox (socket in
$XDG_RUNTIME_DIR via writable_run); warm commands 0.03s vs 1.4s cold,
same daemon pid across invocations. Smoke: --version tripwire + --help
banner only — doctor deliberately EXCLUDED: on a pristine HOME it
reports missing Chrome as a FAIL (rc=1), which a bare-sandbox gate can
never satisfy since the image ships no browser.