Skip to content

Browser toolbox A: BrowserToolbox CRD, controller, and sandboxed pod - #24

Open
josephschorr wants to merge 2 commits into
mainfrom
pr/browser-a
Open

josephschorr wants to merge 2 commits into
mainfrom
pr/browser-a

Conversation

@josephschorr

Copy link
Copy Markdown
Member

Introduces the BrowserToolbox CRD and the per-session headless-Chrome pod: the CRD types and AgentClass references, suffix-by-label host policy with hardened canonicalization, the first-party chromium image and the apbrowsergate policy-CONNECT/DevTools proxy, the pod/token/NetworkPolicy builders and their reconcile (reap/wake/status), and the chromedp observation tools offered from the runner.

This is part of the stacked browser toolbox series (A→E), to be reviewed and merged bottom-up. This PR is the base of the stack.

Draft: the integration + e2e execution legs (envtest + SpiceDB) are pending — the local box is under sustained load. Full build, go vet -tags=integration/e2e, manifest-drift, and all changed packages under -race are green. The gate will run and this will be marked ready before merge.

@vercel

vercel Bot commented Oct 11, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
openagentprimitives Ready Ready Preview Oct 11, 2026 4:02am UTC

Request Review

Adds the BrowserToolbox CRD with its AgentClass references and resolved-browser session status types, suffix-by-label host-policy matching with hardened canonicalization (incl. the mapped-address SSRF guard), the CLI tool kind, and AgentClass validation of browser toolbox references.
Adds the first-party chromium image and the apbrowsergate policy-CONNECT/DevTools proxy, the per-session pod/policy/token/NetworkPolicy builders and their reconcile (reap/wake/status), the per-cluster-kind Chrome sandbox decision, and the chromedp observation tools offered from the runner — with the testbrowser fixture, e2e wiring, and bronze bundles.
@josephschorr

Copy link
Copy Markdown
Member Author

CI note: the only failing check is e2e, from a single pre-existing bronze bundle — TestBronzethread/browser-readonly-catalog — tracked in #30. It is not a regression from this stack: the test harness is unchanged, and it fails identically on every phase PR including this base, whose browser code carries none of the later fixes. The feature never ran e2e on CI before (developed on worktree branches). Every other suite is green: unit, integration, format, frontend, site, toolchain-images, and all other e2e scenarios incl. steelthread.

This branch was successfully deployed

1 active deployment
Preview — be66a8be Deployed Oct 11, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant