Repository navigation
feat: add browser-only Cloudflare price agent and saved sessions - #187
kevinaimonster wants to merge 3 commits into
Conversation
kevinaimonster
changed the title
kevinaimonster
changed the title
jerelvelarde
left a comment
jerelvelarde
left a comment
There was a problem hiding this comment.
Reviewed 3afeb0492ea0a48c5682531fab7c3c33bf553a47.
The checkpoint recovery work is useful, but this is a standalone Cloudflare/DeepSeek application with separate auth, state, UI, dependencies and deployment, not an adapter into OpenMuse’s task/action system. I recommend maintaining it externally and replacing this PR with a focused integration proposal or link unless maintainers explicitly choose to own this second app. Security: owner token checks, origin checks, bounded private checkpoints, sanitized rendering and URL/protocol restrictions are present; hostname screening is explicitly not DNS pinning. A blocking write-authority gap remains: model-driven clicks/Enter can submit authenticated forms without a persisted approval. Verification: all 28 existing unit/protocol tests plus one additional simulated Buy now dispatch test passed (29 total); the latter confirms the unwanted dispatch. This is mocked protocol evidence, not a real purchase or live-browser security test. The author also records incomplete real-browser acceptance; CI/deployment were not used to waive that limitation.
Local execution used read-only, network-disabled Linux containers with synthetic data and Node 24.17.0. Root dependency fixtures came from main’s manifest rather than the lockfile; exact-head GitHub CI covers locked full checks where green. No production credentials were supplied.
| ) { | ||
| throw new DemoError("本 demo 只查询价格，不执行订单提交或支付"); | ||
| } | ||
| await element.click(); |
There was a problem hiding this comment.
[P1] Gate model-triggered submissions instead of relying on button labels. A BUTTON type=submit labeled Buy now passes this small denylist and is clicked immediately; the protocol fixture reproduces elementClicks=1 with no approval. browser_key also sends Enter without this check, so even a blocked payment button can be activated from a focused form. Because checkpoints restore authenticated cookies, these actions can make real account changes despite the price-only prompt. Require an explicit persisted approval for consequential actions, or constrain the agent to read-only interactions and leave form submission to manual takeover; add submit/Enter regressions.
|
Thanks for the work on browser checkpoint recovery and for documenting the verification limits. Closing this PR as a scope decision: it introduces a separate Cloudflare/DeepSeek application with its own authentication, state, UI, dependencies and deployment, rather than a focused integration with OpenMuse's existing task and action system. Maintaining this as an external demo, with a smaller integration proposal or documentation link, would be a better fit. The security finding from the review of 3afeb04 also remains unresolved: model-driven clicks and Enter can submit authenticated forms without a persisted approval. The offline protocol fixture dispatched a submit button labeled “Buy now” despite the price-only policy. A button-label denylist and model instructions do not enforce that boundary, particularly when checkpoints restore authenticated cookies. Real-browser acceptance of the current policy and checkpoint lifecycle also remains incomplete, as noted in the PR. Review details: #187 (review) A future focused proposal should establish the integration scope, enforce approval for consequential actions (or keep agent interactions read-only with manual takeover), and include the missing browser acceptance evidence. |
What changed
Add a private Cloudflare browser agent demo with multi-turn DeepSeek Flash conversations, a remote Chrome view, exact-text price evidence, and per-conversation browser checkpoints. An operator can save and close a browser, reconnect to an existing session, or restore cookies and current-origin web storage into a new browser.
The model receives seven browser actions and one price-evidence tool. Unknown tools and invalid navigation URLs are rejected before browser creation. Intercepted requests reject local/internal protocols, agent interactions validate the current page, and clicks reject file inputs, explicit download links and non-web links. There are no filesystem, shell, desktop-control or arbitrary JavaScript tools. These checks complement the model instructions; they do not claim to sandbox every manual Live View operation or browser-initiated download.
The standalone HTML architecture diagram maps the deployed modules and provides step-by-step highlighting of the model/tool loop and the separate Live View stream. Agents SDK and our tool executor run in the Worker's SQLite Durable Object; Puppeteer controls Chrome in Browser Run. The optional local Node proxy only forwards authenticated HTTP. The document compares this with local-agent/CDP, Quick Actions/REST, MCP, and the separate Docker/OpenMuse computer setup.
Checkpoint credentials remain in private SQLite rows, separate from synchronized Agent state and model messages. Failed or oversized saves retain the previous checkpoint, failed restoration closes its incomplete browser, and a provider 429 stops the loop without discarding the checkpoint. The main OpenMuse runtime is unchanged; this example has its own dependencies and manual deployment.
Verification
npm run check, all 28 unit tests, a Worker deployment dry run, root Biome checking of 189 files, JavaScript syntax checking, diff whitespace checks and a known-environment-credential scan passed.c3dc1ab5-a684-4c85-b58a-800b889c7469. A real cloud DeepSeek turn refused listing server files/readingfile:///etc/passwd, and no browser was launched. The subsequent public catalogue browsing check was blocked by Cloudflare HTTP 429 at browser creation. Real-browser acceptance of this policy and the checkpoint lifecycle remains incomplete. No browser was left running by the check, and no billing-plan change was made.Original remote-browser observation, showing a fictional product page; this is not visual acceptance of the chat UI or architecture HTML:
Integration limits
Requires Workers, SQLite Durable Objects, Browser Run access, a DeepSeek key and a private owner token. This is a single-owner demo, not a deployed 2000-tenant authentication and scheduling service. No public
/agents/*route is exposed. Live View URLs are temporary bearer credentials issued only after application authentication.A checkpoint covers one current page and its origin's storage, up to 512 KiB. It excludes other tabs, IndexedDB, downloads, history, cache and JavaScript memory; website sessions may expire. An already closed browser without a checkpoint cannot be recovered retroactively. Hostname validation is not DNS pinning or a replacement for provider isolation. Browser placement is Cloudflare-managed and Tokyo residency is not guaranteed. CI does not deploy.