feat(desktop): browser profiles for the preview browser

[juliusmarminge]

Adds profiles to the desktop preview browser so tabs can keep separate cookies and site data. This is the bottom of the remaining stack; the browser-access setting is already merged.

Default preserves existing login storage. Incognito uses an in-memory partition. Other profiles use a separate partition namespace with unambiguous environment/profile scoping. A tab keeps its chosen profile for its lifetime.

Settings supports creating, renaming, choosing a default, and removing profiles. Removal waits for cookie/cache cleanup across all known environments and retains the profile if cleanup fails. Existing tabs remain open after removal and are labeled “Removed profile.” The Browser menu supports opening a chosen profile, including touch input.

Validation: focused profile, preview, settings-hydration, and partition-isolation tests; web/desktop typechecks; scoped formatting and lint. Latest CI results are shown below. Earlier desktop behavior was verified by the maintainer; this audit did not run another GUI pass.

Compatibility: Default partitions are unchanged. Data created in custom profiles by an earlier unmerged version of this stack is not migrated from the collision-prone partition mapping.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

Note

Add browser profiles for the preview browser with per-profile partition isolation

• Adds browser profile contracts in browserProfile.ts with built-in Default and Incognito profiles, plus user-defined persistent profiles capped at a contract maximum
• Extends BrowserSession partition derivation in BrowserSession.ts to support persistent, ephemeral, and profile-namespaced partitions, with escaping that prevents collisions from lone UTF-16 surrogates and backslash sequences
• Adds profile management and default-profile selection UI in IntegrationsSettings.tsx; removing a user profile clears its cookies and cache across all environments first
• Propagates profileId through preview open, navigate, and status snapshots in Manager.ts, through webview config caching keyed by environment+profile in previewWebviewConfigState.ts, and through all desktop IPC handlers in preview.ts
• Surfaces a browser-profile submenu in RightPanelTabs.tsx where mouse clicks open the default profile directly and touch opens the submenu for selection
• Risk: getPartition in BrowserSession.ts changes partition format for non-default profiles using a JSON tuple scope; existing sessions opened before this change remain on the legacy bare-environment persistent partition, and default-profile partitions are kept compatible with that legacy format

^{Macroscope summarized 1a5aa85.}

---

Note

Medium Risk
Changes Electron partition derivation and cookie/cache clearing semantics; default profile behavior is preserved, but wrong scoping could leak or wipe the wrong profile’s storage.

Overview
Adds browser profiles so preview tabs can use separate Chromium session partitions (cookies, cache, logins). Built-in Default keeps the legacy bare-environment partition; Incognito uses a non-persistent partition; custom profiles get a namespaced partition with collision-safe scope encoding.

Contracts & server: New profile types and client settings (browserProfiles, browserDefaultProfileId). Preview open/snapshots carry optional profileId through navigate and status updates so a tab does not silently switch partitions.

Desktop: resolvePartitionScope maps environment + profile to partition scope; getPreviewConfig and clear-cookie/cache IPC take environmentId and optional profileId, with per-profile clears loading the session first so data is actually removed after restart.

Web: Settings to add/rename/remove profiles and pick a default (incognito excluded as default). New tabs and link/file opens send configured profileId; webview config is cached per environment+profile. UI: profile submenu on “Add browser,” profile badge in preview chrome, and profile-scoped clear actions in the more menu.

Note: Default partitions stay compatible; custom profiles from an earlier partition scheme are not migrated per the PR description.

^{Reviewed by Cursor Bugbot for commit 1a5aa85. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 904d0a95-7510-4028-b553-9dcda458780c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.2 KiB	13.3 KiB	+64 B (+0.5%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+6 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.4 KiB	+58 B (+0.9%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.6 KiB	+88 B (+0.2%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−29 B (−0.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−9 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−20 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	9	−1 (−10.0%)	21	✅

Baseline: 28ddaf7 · PR result: 1a5aa85 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Reviewed the web UI changes (RightPanelTabs, PreviewChromeRow/PreviewView, PreviewMoreMenu, IntegrationsSettings, menu.tsx) against the shared primitive contracts. Two consistency findings, both inline.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a substantial cross-layer browser-profile capability with new persistent/ephemeral storage partitions, profile-aware webview configuration, settings CRUD, and destructive profile-data cleanup. It also adds a configurable default profile for new tabs, so the resulting product-default and data-isolation behavior requires human review.

No code changes detected at 1a5aa85. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Two findings in the changed web UI. The MenuSubTrigger icon treatment added in this revision fixes the alignment of the new Browser sub-trigger, but the selector it uses also matches the trailing chevron on the two existing icon-less sub-triggers and overrides their ms-auto.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new profile badge in the preview chrome row: the truncate cap doesn't actually ellipsize because Badge is a flex container. Everything else in scope (the MenuSubTrigger icon-column fix, the MenuGroup/MenuGroupLabel wrapping in PreviewMoreMenu, the profile list rows reusing SettingsRow/ITEM_ROW_INNER_CLASSNAME/DraftInput/Button/AlertDialog, and the Select for the default profile) follows the existing primitives and settings conventions.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One convention finding: the new browserProfile module (and its test) uses the consolidated import { Schema } from "effect" form instead of the subpath namespace import used by the rest of packages/contracts. Everything else in the diff (service interfaces on BrowserSession/PreviewManager, Schema.TaggedErrorClass errors with structural attributes, make/layer shape, dependency acquisition) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

🟡 Medium components/RightPanelTabs.tsx:937

When the panel has no surfaces, users cannot open Incognito or a custom browser profile directly; RightPanelEmptyState only invokes onAddBrowser, which always creates the default-profile tab. The profile submenu is mounted only when props.surfaces.length > 0, so users must first create an unwanted default tab to reach it. Make the profile choices available from the empty-panel launcher as well.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @apps/web/src/components/RightPanelTabs.tsx around line 937:

When the panel has no surfaces, users cannot open Incognito or a custom browser profile directly; `RightPanelEmptyState` only invokes `onAddBrowser`, which always creates the default-profile tab. The profile submenu is mounted only when `props.surfaces.length > 0`, so users must first create an unwanted default tab to reach it. Make the profile choices available from the empty-panel launcher as well.