@phnx-labs/agents-cli 1.20.50 → 1.20.52

package/dist/lib/browser/drivers/ssh.d.ts

@@ -25,26 +25,44 @@ export declare function connectSSH(endpoint: string, profile: BrowserProfile): P
  */
 export declare function encodePowerShell(script: string): string;
 /**
- * The PowerShell that launches the browser on a Windows remote. Two hard
+ * The PowerShell that launches the browser on a Windows remote. Three hard
  * requirements shaped this:
  *   1. The browser must OUTLIVE the ssh session. Windows OpenSSH terminates
  *      the session's job tree on disconnect, which reaps both `start /B` and
- *      `Start-Process` children (verified against a real box). WMI
- *      `Win32_Process.Create` spawns under the WMI provider service instead,
- *      so the process survives after we drop the ssh connection and reconnect
- *      over the CDP tunnel.
- *   2. A distinct `--user-data-dir` so a fresh instance bound to the debugging
+ *      `Start-Process` children (verified against a real box). A scheduled
+ *      task runs under the Task Scheduler service, so the process survives
+ *      after we drop the ssh connection and reconnect over the CDP tunnel.
+ *   2. The browser must run in the user's INTERACTIVE session. The previous
+ *      WMI `Win32_Process.Create` launch also survived disconnect, but it
+ *      spawned Edge in session 0 (the services session): the CDP socket bound
+ *      and accepted, yet the DevTools server never initialized — every
+ *      /json/version probe hung forever and DevToolsActivePort was never
+ *      written (verified against a real box, Edg/150). A scheduled task
+ *      registered and started by the logged-on user runs in that user's
+ *      interactive session, where DevTools comes up normally.
+ *   3. A distinct `--user-data-dir` so a fresh instance bound to the debugging
  *      port comes up even when the user already has Edge open.
  * CreateProcess ignores App Paths, so we resolve the real `.exe` from the
- * registry at runtime rather than relying on a bare `msedge` name.
+ * registry at runtime rather than relying on a bare `msedge` name. The task is
+ * unregistered immediately after start — the browser keeps running; nothing
+ * lingers in the scheduler.
  */
 export declare function buildWindowsLaunchScript(browserType: string, port: number, customBinary?: string): string;
-/** The PowerShell that kills whatever holds the CDP port on a Windows remote. */
+/**
+ * The PowerShell that kills whatever holds the CDP port on a Windows remote.
+ * Tree-kill (`taskkill /T`), not `Stop-Process`: Chromium is multi-process, and
+ * killing only the port-owning main process orphans its children. The orphans
+ * keep the profile's SingletonLock, so every later launch against the same
+ * `--user-data-dir` delegates to the zombie tree, exits, and never binds the
+ * CDP port — `browser start --host` then fails until someone hand-cleans the
+ * box (found live on win-mini by the #561 e2e suite).
+ */
 export declare function buildWindowsKillScript(port: number): string;
 /**
  * Build the remote command that launches the browser detached with a CDP port.
  * POSIX backgrounds the `.app` binary with `… &`; Windows resolves the exe and
- * spawns it via WMI (encoded PowerShell) so it survives the ssh session.
+ * starts it via an interactive one-shot scheduled task (encoded PowerShell)
+ * so it survives the ssh session AND serves CDP (session 0 never does).
  */
 export declare function buildLaunchCmd(remoteOs: RemoteOs, browserType: string, port: number, customBinary?: string): string;
 /**
@@ -57,7 +75,7 @@ export declare function ensureRemoteBrowser(user: string, host: string, browserT
 export declare function restartRemoteBrowser(user: string, host: string, browserType: string, port: number, remoteOs: RemoteOs, customBinary?: string): Promise<void>;
 /**
  * Kill the remote browser holding the CDP port. Invoked on stop/cleanup so the
- * WMI-spawned (Windows) / detached (posix) browser process is not orphaned when
+ * task-launched (Windows) / detached (posix) browser process is not orphaned when
  * the ssh tunnel is torn down — killing only the tunnel left it running on
  * win-mini after every `browser stop`. Best-effort: never rejects.
  */

package/dist/lib/browser/drivers/ssh.js

@@ -5,8 +5,11 @@ import { getPortOccupant } from '../chrome.js';
 import { parseEndpointUrl } from '../profiles.js';
 import { writeProfileRuntime, clearProfileRuntime } from '../runtime-state.js';
 // shellQuote lives in the shared ssh-exec helper (single choke point); re-export
-// so existing importers of `shellQuote` from this module keep working.
-import { shellQuote } from '../../ssh-exec.js';
+// so existing importers of `shellQuote` from this module keep working. SSH_OPTS
+// is the shared hardened baseline (BatchMode + ConnectTimeout + keepalive) —
+// reuse it so the raw-ssh spawns below fail fast on an unreachable host instead
+// of hanging on the default ~127s TCP timeout, rather than re-listing options.
+import { shellQuote, SSH_OPTS } from '../../ssh-exec.js';
 export { shellQuote };
 // The `ssh -L` tunnel spawn is shared with `agents computer --host`; it lives in
 // the single ssh-tunnel helper. Calling it with no options preserves this
@@ -168,18 +171,27 @@ export function encodePowerShell(script) {
     return `powershell -NoProfile -EncodedCommand ${encodePwshBase64(script)}`;
 }
 /**
- * The PowerShell that launches the browser on a Windows remote. Two hard
+ * The PowerShell that launches the browser on a Windows remote. Three hard
  * requirements shaped this:
  *   1. The browser must OUTLIVE the ssh session. Windows OpenSSH terminates
  *      the session's job tree on disconnect, which reaps both `start /B` and
- *      `Start-Process` children (verified against a real box). WMI
- *      `Win32_Process.Create` spawns under the WMI provider service instead,
- *      so the process survives after we drop the ssh connection and reconnect
- *      over the CDP tunnel.
- *   2. A distinct `--user-data-dir` so a fresh instance bound to the debugging
+ *      `Start-Process` children (verified against a real box). A scheduled
+ *      task runs under the Task Scheduler service, so the process survives
+ *      after we drop the ssh connection and reconnect over the CDP tunnel.
+ *   2. The browser must run in the user's INTERACTIVE session. The previous
+ *      WMI `Win32_Process.Create` launch also survived disconnect, but it
+ *      spawned Edge in session 0 (the services session): the CDP socket bound
+ *      and accepted, yet the DevTools server never initialized — every
+ *      /json/version probe hung forever and DevToolsActivePort was never
+ *      written (verified against a real box, Edg/150). A scheduled task
+ *      registered and started by the logged-on user runs in that user's
+ *      interactive session, where DevTools comes up normally.
+ *   3. A distinct `--user-data-dir` so a fresh instance bound to the debugging
  *      port comes up even when the user already has Edge open.
  * CreateProcess ignores App Paths, so we resolve the real `.exe` from the
- * registry at runtime rather than relying on a bare `msedge` name.
+ * registry at runtime rather than relying on a bare `msedge` name. The task is
+ * unregistered immediately after start — the browser keeps running; nothing
+ * lingers in the scheduler.
  */
 export function buildWindowsLaunchScript(browserType, port, customBinary) {
     let exeStmts;
@@ -211,21 +223,42 @@ export function buildWindowsLaunchScript(browserType, port, customBinary) {
     // source — a test asserts CDP is never opened to `*`.
     return [
         ...exeStmts,
-        `$cl = '"' + $exe + '" --remote-debugging-port=${port}` +
+        // First-run / default-browser modals block automation (same rationale as
+        // the local launcher in chrome.ts), and the crash-restore bubble is worse
+        // here: `browser stop` hard-kills the remote process, so the NEXT launch
+        // against the same --user-data-dir marks the profile crashed and session
+        // restore swaps the initial page target — closing its CDP websocket while
+        // a command is pending (reproduced live: Page.captureScreenshot rejected
+        // with "CDP connection closed" on every reused-profile launch).
+        `$args = '--remote-debugging-port=${port}` +
             ` --remote-allow-origins=http://127.0.0.1:${port}` +
+            ` --no-first-run --no-default-browser-check` +
+            ` --hide-crash-restore-bubble --disable-session-crashed-bubble` +
             ` --disable-background-timer-throttling --user-data-dir="' + $env:TEMP + '\\agents-browser-${port}"'`,
-        `Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{ CommandLine = $cl } | Out-Null`,
+        `$action = New-ScheduledTaskAction -Execute $exe -Argument $args`,
+        `Register-ScheduledTask -TaskName 'agents-browser-${port}' -Action $action -Force | Out-Null`,
+        `Start-ScheduledTask -TaskName 'agents-browser-${port}'`,
+        `Unregister-ScheduledTask -TaskName 'agents-browser-${port}' -Confirm:$false`,
     ].join('; ');
 }
-/** The PowerShell that kills whatever holds the CDP port on a Windows remote. */
+/**
+ * The PowerShell that kills whatever holds the CDP port on a Windows remote.
+ * Tree-kill (`taskkill /T`), not `Stop-Process`: Chromium is multi-process, and
+ * killing only the port-owning main process orphans its children. The orphans
+ * keep the profile's SingletonLock, so every later launch against the same
+ * `--user-data-dir` delegates to the zombie tree, exits, and never binds the
+ * CDP port — `browser start --host` then fails until someone hand-cleans the
+ * box (found live on win-mini by the #561 e2e suite).
+ */
 export function buildWindowsKillScript(port) {
     return (`Get-NetTCPConnection -LocalPort ${port} -State Listen -ErrorAction SilentlyContinue ` +
-        `| ForEach-Object { Stop-Process -Id $_.OwningProcess -Force -ErrorAction SilentlyContinue }`);
+        `| ForEach-Object { taskkill /PID $_.OwningProcess /T /F 2>$null } | Out-Null`);
 }
 /**
  * Build the remote command that launches the browser detached with a CDP port.
  * POSIX backgrounds the `.app` binary with `… &`; Windows resolves the exe and
- * spawns it via WMI (encoded PowerShell) so it survives the ssh session.
+ * starts it via an interactive one-shot scheduled task (encoded PowerShell)
+ * so it survives the ssh session AND serves CDP (session 0 never does).
  */
 export function buildLaunchCmd(remoteOs, browserType, port, customBinary) {
     if (remoteOs === 'windows') {
@@ -266,10 +299,12 @@ export async function ensureRemoteBrowser(user, host, browserType, port, remoteO
         // ignored and this resolved on close regardless of exit code, so failures
         // were swallowed and only re-emerged 8s later as a generic
         // "SSH tunnel failed to establish".
+        // Options BEFORE the target (matching `sshExec`): OpenSSH's BSD getopt on
+        // macOS stops at the first non-option, so any `-o` after `user@host` would
+        // be swallowed into the remote command instead of applied.
         const child = spawn('ssh', [
+            ...SSH_OPTS,
             `${user}@${host}`,
-            '-o',
-            'BatchMode=yes',
             remoteCmd,
         ], { stdio: ['ignore', 'ignore', 'pipe'], windowsHide: true });
         let stderr = '';
@@ -319,7 +354,7 @@ export async function restartRemoteBrowser(user, host, browserType, port, remote
 }
 /**
  * Kill the remote browser holding the CDP port. Invoked on stop/cleanup so the
- * WMI-spawned (Windows) / detached (posix) browser process is not orphaned when
+ * task-launched (Windows) / detached (posix) browser process is not orphaned when
  * the ssh tunnel is torn down — killing only the tunnel left it running on
  * win-mini after every `browser stop`. Best-effort: never rejects.
  */
@@ -328,7 +363,11 @@ export function killRemoteBrowser(user, host, remoteOs, port) {
 }
 function runSSHCommand(user, host, cmd) {
     return new Promise((resolve) => {
-        const child = spawn('ssh', [`${user}@${host}`, '-o', 'BatchMode=yes', cmd], {
+        // Reuse the shared hardened baseline so a hung TCP SYN to an unreachable
+        // host is bounded by ConnectTimeout (the local 3s kill below only bounds a
+        // connected-but-slow command, not the connect itself). Options precede the
+        // target — see ensureRemoteBrowser.
+        const child = spawn('ssh', [...SSH_OPTS, `${user}@${host}`, cmd], {
             stdio: 'ignore',
             windowsHide: true,
         });

package/dist/lib/browser/login-detection.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Best-effort login-state detection for browser profiles.
+ *
+ * Reads a profile's Chromium cookie store (presence only — never decrypts the
+ * Keychain-encrypted values) to tell which login-gated services have a live
+ * session in that profile. Powers the `agents browser start` guardrail (warn
+ * when an agent opens a logged-out profile for a login-gated URL) and the
+ * `agents browser profiles logins` view.
+ *
+ * Everything here is advisory: any failure (missing DB, locked file, unknown
+ * schema) degrades to "no known session" and NEVER throws to callers — browser
+ * start must not slow down or break because cookie inspection hiccuped.
+ */
+/** A login-gated service signature: host substrings + the auth-cookie names
+ *  whose presence indicates a live session, plus optional login metadata. */
+interface ServiceSignature {
+    hosts: string[];
+    cookies: string[];
+    /**
+     * Where an interactive login for this service starts, and the bundle key
+     * PREFIX its credentials live under. By convention a profile's `--secrets`
+     * bundle holds `<PREFIX>_USERNAME` / `<PREFIX>_PASSWORD` (see
+     * `credKeysForService`). The prefix is explicit — never string-munged from the
+     * service id — so e.g. `x` → `X`, `google` → `GOOGLE`.
+     */
+    login?: {
+        loginUrl: string;
+        keyPrefix: string;
+    };
+}
+/**
+ * Known login-gated services. Presence of ANY listed cookie on a matching host
+ * (unexpired, or a session cookie) = logged in. Deliberately conservative: a
+ * service absent from this map simply never triggers a warning — we do not
+ * guess. Each cookie name here is the definitive authenticated-session token for
+ * that service (e.g. LinkedIn's `li_at` is only set for a signed-in member;
+ * visitor cookies like `bcookie`/`JSESSIONID` are NOT auth). Services whose
+ * session is not reliably expressed as a recognizable cookie (e.g. Attio, whose
+ * only same-site cookies are third-party analytics) are deliberately omitted so
+ * we never emit a false "logged out" warning. Extend as needed.
+ */
+export declare const AUTH_SIGNATURES: Record<string, ServiceSignature>;
+/**
+ * The bundle keys a profile's `--secrets` bundle should hold to log into
+ * `service`: `<PREFIX>_USERNAME` / `<PREFIX>_PASSWORD`. Null for services with no
+ * login metadata. Feed a resolved value to the page with
+ * `agents browser type <ref> --secret <bundle>/<KEY>` (never printed).
+ */
+export declare function credKeysForService(service: string): {
+    user: string;
+    pass: string;
+} | null;
+/** The interactive login URL for a service, or null. */
+export declare function loginUrlForService(service: string): string | null;
+export interface CookieRow {
+    host_key: string;
+    name: string;
+}
+/**
+ * Pure core: given a profile's (already expiry-filtered) cookie rows, return the
+ * services with a live session. Exported for direct unit testing without disk.
+ */
+export declare function detectServices(rows: CookieRow[]): string[];
+/** Map a URL to a known login-gated service key, or null. */
+export declare function serviceForUrl(url: string): string | null;
+/** A saved-login row from Chromium `Login Data` (username plaintext; password
+ *  encrypted and never read). */
+export interface LoginRow {
+    origin_url: string;
+    username_value: string;
+    signon_realm: string;
+}
+/**
+ * Map a profile's saved logins to service → account username (identity, not
+ * session). Best-effort; `{}` if `Login Data` is unreadable. The first non-empty
+ * username per service wins.
+ */
+export declare function accountsForProfile(profileName: string): Promise<Record<string, string>>;
+/**
+ * For each service with a LIVE session in the profile (cookie-gated), the
+ * account it is signed in as (from saved logins). Intersecting with live
+ * sessions means a stale saved-login for a service you've since logged out of
+ * never shows.
+ */
+export declare function loginsWithAccountsForProfile(profileName: string): Promise<Array<{
+    service: string;
+    username?: string;
+}>>;
+/** Services with a live session in the given profile (best-effort; [] if none
+ *  detected or the cookie store is unreadable). */
+export declare function loginsForProfile(profileName: string): Promise<string[]>;
+/** Profile names that have a live session for the given service. */
+export declare function profilesLoggedInto(service: string): Promise<string[]>;
+export {};

package/dist/lib/browser/login-detection.js

@@ -0,0 +1,274 @@
+/**
+ * Best-effort login-state detection for browser profiles.
+ *
+ * Reads a profile's Chromium cookie store (presence only — never decrypts the
+ * Keychain-encrypted values) to tell which login-gated services have a live
+ * session in that profile. Powers the `agents browser start` guardrail (warn
+ * when an agent opens a logged-out profile for a login-gated URL) and the
+ * `agents browser profiles logins` view.
+ *
+ * Everything here is advisory: any failure (missing DB, locked file, unknown
+ * schema) degrades to "no known session" and NEVER throws to callers — browser
+ * start must not slow down or break because cookie inspection hiccuped.
+ */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import Database from '../sqlite.js';
+import { getBrowserRuntimeDir, listProfiles } from './profiles.js';
+/**
+ * Known login-gated services. Presence of ANY listed cookie on a matching host
+ * (unexpired, or a session cookie) = logged in. Deliberately conservative: a
+ * service absent from this map simply never triggers a warning — we do not
+ * guess. Each cookie name here is the definitive authenticated-session token for
+ * that service (e.g. LinkedIn's `li_at` is only set for a signed-in member;
+ * visitor cookies like `bcookie`/`JSESSIONID` are NOT auth). Services whose
+ * session is not reliably expressed as a recognizable cookie (e.g. Attio, whose
+ * only same-site cookies are third-party analytics) are deliberately omitted so
+ * we never emit a false "logged out" warning. Extend as needed.
+ */
+export const AUTH_SIGNATURES = {
+    linkedin: {
+        hosts: ['linkedin.com'],
+        cookies: ['li_at'],
+        login: { loginUrl: 'https://www.linkedin.com/login', keyPrefix: 'LINKEDIN' },
+    },
+    google: {
+        hosts: ['google.com'],
+        cookies: ['SID', 'SAPISID', '__Secure-1PSID', '__Secure-3PSID'],
+        login: { loginUrl: 'https://accounts.google.com/', keyPrefix: 'GOOGLE' },
+    },
+    x: {
+        hosts: ['x.com', 'twitter.com'],
+        cookies: ['auth_token'],
+        login: { loginUrl: 'https://x.com/login', keyPrefix: 'X' },
+    },
+    reddit: {
+        hosts: ['reddit.com'],
+        cookies: ['reddit_session', 'token_v2'],
+        login: { loginUrl: 'https://www.reddit.com/login', keyPrefix: 'REDDIT' },
+    },
+    github: {
+        hosts: ['github.com'],
+        cookies: ['user_session'],
+        login: { loginUrl: 'https://github.com/login', keyPrefix: 'GITHUB' },
+    },
+};
+/**
+ * The bundle keys a profile's `--secrets` bundle should hold to log into
+ * `service`: `<PREFIX>_USERNAME` / `<PREFIX>_PASSWORD`. Null for services with no
+ * login metadata. Feed a resolved value to the page with
+ * `agents browser type <ref> --secret <bundle>/<KEY>` (never printed).
+ */
+export function credKeysForService(service) {
+    const login = AUTH_SIGNATURES[service]?.login;
+    if (!login)
+        return null;
+    return { user: `${login.keyPrefix}_USERNAME`, pass: `${login.keyPrefix}_PASSWORD` };
+}
+/** The interactive login URL for a service, or null. */
+export function loginUrlForService(service) {
+    return AUTH_SIGNATURES[service]?.login?.loginUrl ?? null;
+}
+/**
+ * Current time as microseconds since 1601-01-01 (Chromium's `expires_utc`
+ * epoch), as a BigInt. Chromium expiries routinely exceed 2^53, so this is
+ * bound into SQL as a BigInt and the comparison happens IN SQLite — the huge
+ * integer never marshals back to JS (node:sqlite throws RangeError if it does).
+ * 11644473600000 = ms between 1601-01-01 and 1970-01-01.
+ */
+function chromeNowMicrosBigInt() {
+    return (BigInt(Date.now()) + 11644473600000n) * 1000n;
+}
+function hostMatches(hostKey, host) {
+    return hostKey === host || hostKey === '.' + host || hostKey.endsWith('.' + host);
+}
+/**
+ * Pure core: given a profile's (already expiry-filtered) cookie rows, return the
+ * services with a live session. Exported for direct unit testing without disk.
+ */
+export function detectServices(rows) {
+    const services = [];
+    for (const [service, sig] of Object.entries(AUTH_SIGNATURES)) {
+        const found = rows.some((r) => sig.cookies.includes(r.name) && sig.hosts.some((h) => hostMatches(r.host_key, h)));
+        if (found)
+            services.push(service);
+    }
+    return services;
+}
+/** Map a URL to a known login-gated service key, or null. */
+export function serviceForUrl(url) {
+    let host;
+    try {
+        host = new URL(url).hostname;
+    }
+    catch {
+        return null;
+    }
+    for (const [service, sig] of Object.entries(AUTH_SIGNATURES)) {
+        if (sig.hosts.some((h) => host === h || host.endsWith('.' + h)))
+            return service;
+    }
+    return null;
+}
+/**
+ * Locate candidate Chromium DBs for a profile at the given relative paths. The
+ * live runtime dir is keyed by the composite `<profile>@<endpoint>` name, so we
+ * scan the browser cache root for `<profile>` and `<profile>@*` dirs and return
+ * every matching DB found, most-recently-modified first.
+ */
+function profileDbCandidates(profileName, relPaths) {
+    const root = getBrowserRuntimeDir();
+    let entries;
+    try {
+        entries = fs.readdirSync(root);
+    }
+    catch {
+        return [];
+    }
+    const dirs = entries.filter((e) => e === profileName || e.startsWith(profileName + '@'));
+    const found = [];
+    for (const d of dirs) {
+        for (const rel of relPaths) {
+            const p = path.join(root, d, ...rel);
+            try {
+                found.push({ p, mtime: fs.statSync(p).mtimeMs });
+            }
+            catch {
+                /* not present */
+            }
+        }
+    }
+    return found.sort((a, b) => b.mtime - a.mtime).map((f) => f.p);
+}
+function cookieDbCandidates(profileName) {
+    return profileDbCandidates(profileName, [
+        ['chrome-data', 'Default', 'Cookies'],
+        ['chrome-data', 'Default', 'Network', 'Cookies'],
+    ]);
+}
+function loginDbCandidates(profileName) {
+    return profileDbCandidates(profileName, [['chrome-data', 'Default', 'Login Data']]);
+}
+/**
+ * Open a Chromium SQLite store safely: copy the DB (and any WAL/SHM sidecars) to
+ * a temp dir first so a running browser's lock never blocks us and we never
+ * touch the live file, run `fn`, then clean up. Returns `fallback` on any error.
+ */
+function withCopiedDb(dbPath, fn, fallback) {
+    let tmpDir = null;
+    try {
+        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agents-browserdb-'));
+        const tmpDb = path.join(tmpDir, 'db');
+        fs.copyFileSync(dbPath, tmpDb);
+        for (const suffix of ['-wal', '-shm']) {
+            if (fs.existsSync(dbPath + suffix))
+                fs.copyFileSync(dbPath + suffix, tmpDb + suffix);
+        }
+        const db = new Database(tmpDb);
+        try {
+            return fn(db);
+        }
+        finally {
+            db.close();
+        }
+    }
+    catch {
+        return fallback;
+    }
+    finally {
+        if (tmpDir) {
+            try {
+                fs.rmSync(tmpDir, { recursive: true, force: true });
+            }
+            catch {
+                /* temp cleanup best-effort */
+            }
+        }
+    }
+}
+/** Read (expiry-filtered) cookie rows from a Chromium cookie DB. [] on failure. */
+function readCookieRows(dbPath) {
+    return withCopiedDb(dbPath, (db) => {
+        // Filter expiry in SQL (session cookies have expires_utc = 0; otherwise it
+        // must be in the future) and select only text columns, so the huge
+        // microsecond integer never crosses into JS.
+        const rows = db
+            .prepare('SELECT host_key, name FROM cookies WHERE expires_utc = 0 OR expires_utc > ?')
+            .all(chromeNowMicrosBigInt());
+        return rows.map((r) => ({
+            host_key: String(r.host_key ?? ''),
+            name: String(r.name ?? ''),
+        }));
+    }, []);
+}
+/** Read saved-login rows from a Chromium `Login Data` DB. Skips
+ *  user-blacklisted origins ("never save"). Selects only text columns —
+ *  `password_value` (encrypted) is never touched. [] on failure. */
+function readLoginRows(dbPath) {
+    return withCopiedDb(dbPath, (db) => {
+        const rows = db
+            .prepare('SELECT origin_url, username_value, signon_realm FROM logins WHERE blacklisted_by_user = 0')
+            .all();
+        return rows.map((r) => ({
+            origin_url: String(r.origin_url ?? ''),
+            username_value: String(r.username_value ?? ''),
+            signon_realm: String(r.signon_realm ?? ''),
+        }));
+    }, []);
+}
+/**
+ * Map a profile's saved logins to service → account username (identity, not
+ * session). Best-effort; `{}` if `Login Data` is unreadable. The first non-empty
+ * username per service wins.
+ */
+export async function accountsForProfile(profileName) {
+    const candidates = loginDbCandidates(profileName);
+    if (candidates.length === 0)
+        return {};
+    const rows = readLoginRows(candidates[0]);
+    const out = {};
+    for (const r of rows) {
+        if (!r.username_value)
+            continue;
+        const service = serviceForUrl(r.origin_url) ?? serviceForUrl(r.signon_realm);
+        if (service && !out[service])
+            out[service] = r.username_value;
+    }
+    return out;
+}
+/**
+ * For each service with a LIVE session in the profile (cookie-gated), the
+ * account it is signed in as (from saved logins). Intersecting with live
+ * sessions means a stale saved-login for a service you've since logged out of
+ * never shows.
+ */
+export async function loginsWithAccountsForProfile(profileName) {
+    const active = await loginsForProfile(profileName);
+    if (active.length === 0)
+        return [];
+    const accounts = await accountsForProfile(profileName);
+    return active.map((service) => ({ service, username: accounts[service] }));
+}
+/** Services with a live session in the given profile (best-effort; [] if none
+ *  detected or the cookie store is unreadable). */
+export async function loginsForProfile(profileName) {
+    const candidates = cookieDbCandidates(profileName);
+    if (candidates.length === 0)
+        return [];
+    const rows = readCookieRows(candidates[0]);
+    if (rows.length === 0)
+        return [];
+    return detectServices(rows);
+}
+/** Profile names that have a live session for the given service. */
+export async function profilesLoggedInto(service) {
+    const profiles = await listProfiles();
+    const out = [];
+    for (const p of profiles) {
+        const logins = await loginsForProfile(p.name);
+        if (logins.includes(service))
+            out.push(p.name);
+    }
+    return out;
+}

package/dist/lib/browser/profiles.d.ts

@@ -1,20 +1,29 @@
 import type { BrowserProfile } from './types.js';
 export type { BrowserProfile } from './types.js';
 export declare const DEFAULT_BROWSER_PROFILE_NAME = "default";
+/**
+ * The device-local configured default profile name (set via
+ * `agents browser profiles set-default`), or undefined when unset. When set, it
+ * is the profile `agents browser start` resolves to for BOTH the no-`--profile`
+ * path and an explicit `--profile default`. Stored per-machine — see
+ * `Meta.defaultBrowserProfile`.
+ */
+export declare function getConfiguredDefaultProfileName(): string | undefined;
 export declare function getBrowserRuntimeDir(): string;
 export declare function getProfileRuntimeDir(name: string): string;
 export declare function listProfiles(): Promise<BrowserProfile[]>;
 export declare function getProfile(name: string): Promise<BrowserProfile | null>;
 /**
- * Ensure a `default` profile exists, auto-picking the first installed
- * Chromium-family browser per the platform priority list in chrome.ts.
+ * Resolve the profile `agents browser start` uses when no `--profile` is given.
  *
- * Re-uses an existing `default` profile as-is (we don't second-guess the user
- * if they've already customized it). On first run we walk the priority list
- * (macOS: chrome > brave > edge > chromium > comet; Linux: chrome > chromium >
- * brave > edge; Windows: edge > chrome > brave > comet) and pin the profile to the
- * first match. Throws an actionable error if none of those binaries are
- * installed so the user knows exactly which browsers we'd accept.
+ * Order: (1) the device-local configured default (`agents browser profiles
+ * set-default <name>`) when it names an existing profile; (2) an existing
+ * `default` profile as-is; (3) auto-pick the first installed Chromium-family
+ * browser per the platform priority list in chrome.ts (macOS: chrome > brave >
+ * edge > chromium > comet; Linux: chrome > chromium > brave > edge; Windows:
+ * edge > chrome > brave > comet) and pin a new `default` profile to it. Throws an
+ * actionable error if none of those binaries are installed. A configured default
+ * that no longer exists warns and falls through to (2)/(3) — never a hard fail.
  */
 export declare function ensureDefaultBrowserProfile(): Promise<BrowserProfile>;
 /**

package/dist/lib/browser/profiles.js

@@ -3,6 +3,16 @@ import { getBrowserRuntimeDir as getBrowserRuntimeDirRoot, readMeta, writeMeta,
 import { findBrowserPath, findFirstInstalledBrowser, isPortInUse } from './chrome.js';
 import { DEFAULT_VIEWPORT } from './devices.js';
 export const DEFAULT_BROWSER_PROFILE_NAME = 'default';
+/**
+ * The device-local configured default profile name (set via
+ * `agents browser profiles set-default`), or undefined when unset. When set, it
+ * is the profile `agents browser start` resolves to for BOTH the no-`--profile`
+ * path and an explicit `--profile default`. Stored per-machine — see
+ * `Meta.defaultBrowserProfile`.
+ */
+export function getConfiguredDefaultProfileName() {
+    return readMeta().defaultBrowserProfile || undefined;
+}
 export function getBrowserRuntimeDir() {
     return getBrowserRuntimeDirRoot();
 }
@@ -69,17 +79,26 @@ export async function getProfile(name) {
     return configToProfile(name, config);
 }
 /**
- * Ensure a `default` profile exists, auto-picking the first installed
- * Chromium-family browser per the platform priority list in chrome.ts.
+ * Resolve the profile `agents browser start` uses when no `--profile` is given.
  *
- * Re-uses an existing `default` profile as-is (we don't second-guess the user
- * if they've already customized it). On first run we walk the priority list
- * (macOS: chrome > brave > edge > chromium > comet; Linux: chrome > chromium >
- * brave > edge; Windows: edge > chrome > brave > comet) and pin the profile to the
- * first match. Throws an actionable error if none of those binaries are
- * installed so the user knows exactly which browsers we'd accept.
+ * Order: (1) the device-local configured default (`agents browser profiles
+ * set-default <name>`) when it names an existing profile; (2) an existing
+ * `default` profile as-is; (3) auto-pick the first installed Chromium-family
+ * browser per the platform priority list in chrome.ts (macOS: chrome > brave >
+ * edge > chromium > comet; Linux: chrome > chromium > brave > edge; Windows:
+ * edge > chrome > brave > comet) and pin a new `default` profile to it. Throws an
+ * actionable error if none of those binaries are installed. A configured default
+ * that no longer exists warns and falls through to (2)/(3) — never a hard fail.
  */
 export async function ensureDefaultBrowserProfile() {
+    const configured = getConfiguredDefaultProfileName();
+    if (configured) {
+        const chosen = await getProfile(configured);
+        if (chosen)
+            return chosen;
+        console.warn(`warning: configured default browser profile "${configured}" no longer exists; ` +
+            `falling back to auto-detect. Fix with: agents browser profiles set-default <name>  (or --unset)`);
+    }
     const existing = await getProfile(DEFAULT_BROWSER_PROFILE_NAME);
     if (existing)
         return existing;