Browser: hosted-session safety + Patchright stealth (supersedes #166, closes #168)

[yyy900]

Summary

Rebuilds #166 on top of current main (that branch had drifted 40 commits behind and no longer merged cleanly), wires its main feature up on the hosted agent, and folds in the Patchright swap from #168.

Four things, one per commit group:

1. Per-session tabs + hosted-session safety (ported from Make browser tools safe for hosted sessions #166). Serialize BrowserAutomation's public calls onto one Playwright-owning worker thread so a shared instance is safe to call from any host() thread, and give each chat session its own tab in the shared login context so concurrent panels stop navigating over one another. Idle tabs are reclaimed by TTL and an LRU backstop, restoring a reclaimed session's last URL on next use. Also brings the portable login state (save_state/seed_state), BROWSER_PROXY egress, frame-aware selector clicks, the bounded screenshot payload, and the opt-in human_jitter / bind_browser_session plugins.

2. Enable the isolation on the hosted agent + binding cleanups. bind_browser_session is what routes each session to its own tab, but nothing registered it — so on a co ai deploy every chat panel still shared one tab, the exact bug the machinery fixes. create_coding_agent (co ai's agent definition, which already encodes hosted-runtime decisions like removing the stdin-blocking login helper) now registers the plugin, with a test that keeps it wired. Session routing stays an opt-in plugin — it only matters when one browser is shared across hosted sessions, and the agents that do that enable it (co ai here, linkedin-agent-3 in prod, the new template below). Cleanups on the machinery: the binding moves off a module-level threading.local onto the BrowserAutomation instance (no shared module state; test suites drop their reset fixtures), the plugin handler is renamed so it no longer shadows the browser method it calls, and tab_idle_ttl / max_tabs become documented constructor kwargs instead of private attributes deployments poke.

3. Replace Playwright with Patchright (closes [FEATURE] Replace Playwright with Patchright for built-in anti-bot stealth #168). Patchright is a stealth-patched, API-compatible drop-in that removes the Runtime.enable / Console.enable CDP leaks and navigator.webdriver at the driver level — below where flags and init scripts operate, which is what Cloudflare / DataDome / Kasada actually fingerprint.

   • Swap the import (sync API is identical, so only the import line changes).
   • Drop the navigator.webdriver add_init_script shim — Patchright hides it at the driver level, and init-script injection is itself a timing-detectable tell.
   • Trim browser_config.py from the 53-flag browser-use mirror down to run-environment flags only. Patchright owns anti-detection now and its docs warn that over-configuring launch args can defeat the patches; this also removes the standing "keep in sync with browser-use" burden.
   • Rename PLAYWRIGHT_AVAILABLE → BROWSER_AVAILABLE (it no longer gates Playwright).
   • Update pyproject.toml, the browser template requirements, and the co-ai Dockerfile (patchright install --with-deps chrome).

4. hosted-browser template (co init/create --template hosted-browser). The production shape proven by the live LinkedIn agent, packaged: one shared stealth browser (persistent login profile, headed under Xvfb) served to many sessions via a host(create_agent) factory with bind_browser_session for per-session tabs; site workflows as .co/skills; credentials/2FA through ask_user; CAPTCHA = report-and-stop; memory bounds for small deploy boxes (tab TTL/cap kwargs + a browser idle reaper). python agent.py "task" gives a local one-shot mode for developing skills (keeps wait_for_manual_login for first login; the hosted path removes it because stdin never answers behind host()).

Verification

• pytest tests/unit tests/e2e/cli/test_cli_init.py — 2019 passed, 5 skipped (environment: PIL/Windows/TUI extras).
• Live end-to-end: BrowserAutomation launches real Chrome through Patchright, navigates to a live page, and navigator.webdriver reads false with the init script removed — confirming the driver-level patch works and the shim removal is safe.

Scope notes

• The standalone raw-Playwright demos under examples/ are left as-is. They script Playwright directly (not BrowserAutomation), aren't packaged or tested, and are named/titled "playwright"; a half-swap would be incoherent and a rename is out of scope. The SDK path that actually does anti-bot is fully migrated.
• channel="chrome" and no_viewport=True (Patchright's other recommendations) are deferred: executable_path already pins real Chrome, and the screenshot-bounding logic depends on the deterministic 1920×1200 viewport. Worth revisiting as a deploy-time tuning pass.
• Pre-existing: the template enumerations in docs/cli/{create,init,README}.md already don't list co-ai; they don't list hosted-browser either. Left for a docs pass.

Supersedes #166.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.