Skip to content

feat: persistent profile mode for enterprise SSO (BROWSE_PROFILE_DIR)#485

Open
haha1903 wants to merge 1 commit intogarrytan:mainfrom
haha1903:feat/persistent-profile-mode
Open

feat: persistent profile mode for enterprise SSO (BROWSE_PROFILE_DIR)#485
haha1903 wants to merge 1 commit intogarrytan:mainfrom
haha1903:feat/persistent-profile-mode

Conversation

@haha1903
Copy link

Summary

  • Add opt-in persistent browser profile support via BROWSE_PROFILE_DIR env var
  • When set, uses chromium.launchPersistentContext() instead of chromium.launch() + newContext(), which preserves SSO sessions, device certs, and browser extensions across commands
  • Add BROWSE_CHANNEL env var to use system Chrome/Edge instead of bundled Chromium
  • Automatically removes Playwright defaults (--disable-extensions, --use-mock-keychain, --password-store=basic) that break enterprise auth flows

This enables headless access to enterprise sites protected by macOS Platform SSO, Intune device compliance, and Azure AD Conditional Access — without any UI popups or manual login.

Default behavior is completely unchanged. Only activates when BROWSE_PROFILE_DIR is set.

Usage

export BROWSE_PROFILE_DIR=~/.gstack/browse-chrome-profile
export BROWSE_CHANNEL=chrome
$B goto https://internal-site.example.com
$B text  # works with SSO, no login needed

How it works

Playwright's bundled Chromium launches with --disable-extensions and --use-mock-keychain by default, which disables macOS Platform SSO Extension and blocks real Keychain access. Enterprise SSO (Azure AD, Okta, etc.) relies on these OS-level hooks.

launchPersistentContext() with a dedicated profile dir + ignoreDefaultArgs for the SSO-breaking flags is the same approach used by Google's Chrome DevTools MCP (via Puppeteer). This PR brings the same capability to Playwright.

Changes

File Change
browse/src/browser-manager.ts buildLaunchConfig() helper, persistent profile launch path, guards for close(), isHealthy(), recreateContext(), handoff()
browse/src/meta-commands.ts status shows persistent mode info

Test plan

  • Default mode: $B goto https://example.com works as before (no env vars set)
  • Enterprise mode: set BROWSE_PROFILE_DIR + BROWSE_CHANNEL=chrome, verify SSO-protected sites load
  • $B status shows Mode: persistent-profile when active
  • $B handoff works in persistent mode (close + relaunch headed)
  • useragent command returns graceful message in persistent mode

🤖 Generated with Claude Code

Add opt-in persistent browser profile support via two new env vars:
- BROWSE_PROFILE_DIR: path to persistent profile dir, triggers
  launchPersistentContext() with SSO-friendly defaults
- BROWSE_CHANNEL: use system Chrome/Edge instead of bundled Chromium

When BROWSE_PROFILE_DIR is set, Playwright's SSO-breaking defaults
(--disable-extensions, --use-mock-keychain, --password-store=basic)
are automatically removed, enabling macOS Platform SSO, Intune device
compliance, and Azure AD Conditional Access to work headlessly.

Default behavior (bundled Chromium, ephemeral context) is unchanged.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant