feat: pin the agent to a chosen browser profile (#16)

* feat: pin the agent to a chosen browser profile (#15)

Harness tabs were created with a bare Target.createTarget, which places
them in Chrome's defaultBrowserContextId — and that value follows window
focus. Which profile the agent acted as therefore depended on which
browser window the user last clicked, so the same task could run as a
work account on one run and a personal account on the next.

/browser-profile lists the connected browser's profiles as "Name (email)"
and pins one to ~/.pi/agent/browser-harness.json, so the choice outlives
the session. The same picker appears on first browser_setup when nothing
is pinned; with no interactive UI, or on cancel, setup continues with a
note and the previous behavior.

Chrome offers no direct route to another profile: Target.createTarget
rejects a foreign browserContextId, and openerId does not inherit the
opener's context. The window is opened through the browser's own command
line (--profile-directory, handed to the running browser by Chromium's
ProcessSingleton) and identified by a unique file:// sentinel page, since
a bare about:blank#token argument is discarded. Further tabs come from
window.open evaluated with userGesture: true — the only CDP-reachable way
to place a tab in a non-default browser context — correlated by a unique
token so concurrent isolated tabs stay distinct. A failed handshake is
reported, never silently redirected to another profile.

All four tab-creation sites now funnel through cdp/target-factory, so
open_urls and the isolated tabs behind web_search / read_page cannot run
with a different profile's cookies than the visible tabs.

Also fixed along the way: snap Chromium is discovered, Windows uses
%LOCALAPPDATA%, browsers launched with an explicit --user-data-dir are
found, the running browser is chosen by ranking candidates against the
connected user-data-dir rather than taking the first process found, and
an installed-but-closed browser no longer reads as running.

CI runs the profile suites and a real-browser end-to-end test on ubuntu,
macOS, and Windows — profile discovery is the one part of the harness
whose behavior genuinely differs per OS.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: single-flight harness window creation

Isolated tabs run concurrently (browser_read_page is registered
unserialized), so several could each find "no harness window" and create
one — two blank windows before this feature, two LAUNCHED profile windows
after it. ensureHarnessWindow now shares one in-flight creation per
client.

Sharing introduces a second hazard: freshlyCreated is a claim on the seed
tab, and if every waiter received it, they would all drive the same tab.
Only the caller that started the creation keeps the claim; the rest open
their own tab beside it.

Covered by test/manual/profile-concurrency-test.ts (five concurrent
isolated tabs, pinned and unpinned: distinct targets, one window, correct
profile), wired into CI on Linux only — the coordination is pure JS and
identical across platforms.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: tilde expansion differs by purpose on Windows

CI on windows-latest caught this: join("~", "x") yields "~\x" there, and
expandTilde only handled "~/".

The two uses are not the same, so they no longer share a helper. The
agent dir stays byte-compatible with pi's own expandTildePath ("~/" only,
every platform) — being more lenient would put the pin file somewhere pi
never looks. $CHROME_USER_DATA_DIR is ours to interpret, so it accepts
"~\" as well, which is what a Windows user would type.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

1 files changed, 21 insertions, 53 deletions

diff --git a/src/setup.ts b/src/setup.ts
index 40f501c..8c04030 100644
--- a/src/setup.ts
+++ b/src/setup.ts
@@ -4,11 +4,12 @@
  * users and a tool (browser_setup) for the agent to self-recover.
  */
 
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
-import { execSync } from "node:child_process";
+import type { ExtensionAPI, ExtensionContext } from "@mariozechner/pi-coding-agent";
 import type { BrowserClient } from "./client";
 import { ensureDaemon } from "./daemon/spawn";
 import { DAEMON_SOCKET_PATH } from "./daemon/protocol";
+import { isBrowserRunning } from "./profile/browser-process";
+import { promptForProfileIfUnset } from "./profile/command";
 
 // ── Public: register the /browser-setup slash command ──────────────────────
 
@@ -16,7 +17,7 @@ export function registerSetupCommand(pi: ExtensionAPI, client: BrowserClient): v
   pi.registerCommand("browser-setup", {
     description: "Connect pi to your Chrome browser",
     handler: async (_args, ctx) => {
-      const result = await performSetup(client);
+      const result = await performSetup(client, ctx);
       if (result.success) {
         ctx.ui.notify(result.data, "info");
       } else {
@@ -32,9 +33,9 @@ export type SetupResult = { success: true; data: string } | { success: false; er
 
 // ── Shared setup logic (used by both the command and the tool) ─────────────
 
-export async function performSetup(client: BrowserClient): Promise<SetupResult> {
+export async function performSetup(client: BrowserClient, ctx?: ExtensionContext): Promise<SetupResult> {
   // Step 1: Check Chrome is running
-  const chromeRunning = checkChromeRunning();
+  const chromeRunning = await isBrowserRunning();
   if (!chromeRunning) {
     return { success: false, error: "No browser instance running. Please open your browser and then run /browser-setup." };
   }
@@ -45,7 +46,13 @@ export async function performSetup(client: BrowserClient): Promise<SetupResult>
     return { success: false, error: `Could not start the browser daemon. Check ${DAEMON_SOCKET_PATH}.` };
   }
 
-  // Step 3: Connect to Chrome DevTools
+  // Step 3: Ask which profile to work in, the first time only. Enumeration
+  // reads DevToolsActivePort + Local State from disk, so it works before the
+  // connection exists. Declining leaves the pre-profile behavior untouched —
+  // this must never block setup.
+  const profileNote = await promptForProfileIfUnset(client, ctx);
+
+  // Step 4: Connect to Chrome DevTools
   const startResult = await client.start();
   if (!startResult.success) {
     const msg = startResult.error.message;
@@ -73,7 +80,7 @@ export async function performSetup(client: BrowserClient): Promise<SetupResult>
     return { success: false, error: `Connection failed: ${msg}` };
   }
 
-  // Step 4: Verify with test navigation
+  // Step 5: Verify with test navigation
   const tabResult = await client.newTab("https://github.com");
   if (!tabResult.success) {
     return { success: false, error: `Browser connected but test navigation failed: ${tabResult.error.message}` };
@@ -85,52 +92,13 @@ export async function performSetup(client: BrowserClient): Promise<SetupResult>
   }
 
   const pageUrl = info.success && !("dialog" in info.data) ? info.data.url : "github.com";
-  return { success: true, data: `Browser connected ✓\nNavigated to: ${pageUrl}` };
+  const lines = ["Browser connected ✓", `Navigated to: ${pageUrl}`];
+  if (profileNote) lines.push(profileNote);
+  return { success: true, data: lines.join("\n") };
 }
 
 // ── Chrome process detection ───────────────────────────────────────────────
-
-function checkChromeRunning(): boolean {
-  try {
-    if (process.platform === "darwin") {
-      // ps -o comm= returns the full executable path on modern macOS, e.g.
-      // "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser". We check
-      // for a known Chromium-family name anywhere in the path (case-insensitive),
-      // excluding helper/renderer/gpu/crashpad/updater subprocesses that linger
-      // after the user quits the browser.
-      const out = execSync("ps -A -o comm=", { timeout: 5000 }).toString().toLowerCase();
-      const lines = out.split("\n").map((l) => l.trim()).filter(Boolean);
-      const browserNames = ["google chrome", "chromium", "microsoft edge", "brave browser"];
-      return lines.some((l) => {
-        if (
-          l.includes("helper") ||
-          l.includes("renderer") ||
-          l.includes("crashpad") ||
-          l.includes(" gpu") ||
-          l.includes("updater")
-        ) return false;
-        return browserNames.some((name) => l.includes(name));
-      });
-    } else if (process.platform === "linux") {
-      const out = execSync("ps -A -o comm=,args=", { timeout: 5000 }).toString().toLowerCase();
-      const lines = out.split("\n").map((l) => l.trim()).filter(Boolean);
-      const browserComms = [
-        "chrome", "chromium", "chromium-browser", "msedge", "microsoft-edge",
-        "google-chrome", "brave", "brave-browser",
-      ];
-      return lines.some((line) => {
-        const parts = line.split(/\s+/);
-        const comm = parts[0] ?? "";
-        if (!comm || !browserComms.includes(comm)) return false;
-        const isSubprocess = line.includes("--type=") && !line.includes("--type=browser");
-        return !isSubprocess;
-      });
-    } else if (process.platform === "win32") {
-      const out = execSync("tasklist", { timeout: 5000 }).toString().toLowerCase();
-      return ["chrome.exe", "msedge.exe", "brave.exe"].some((n) => out.includes(n));
-    }
-  } catch {
-    // best-effort
-  }
-  return false;
-}
+//
+// Detection moved to src/profile/browser-process.ts, which answers the same
+// "is a browser running?" question per platform and additionally reports the
+// executable path and any explicit --user-data-dir that profile selection needs.