fix: repair sandbox browser driver lifecycle (#186)

## Summary

- Fixes browser initialization that was blocked by the driver's own
global provider-fetch restriction.
- Gives the driver explicit ownership of Chromium so startup failures
and shutdowns cannot leak browser processes.
- Makes readiness represent a fully initialized Stagehand context and
reduces stale-driver detection from 90 seconds to 5 seconds.
- Disables PTY echo before credentials are delivered over stdin so
secrets cannot enter Daytona session logs.

## Context

Production acceptance QA exposed this incident directly; there is no
separate Linear issue or plan document.

## Architecture

The browser driver now has two explicit transport boundaries:

1. A provider-scoped, response-bounded fetch implementation injected
into Stagehand's AI SDK client.
2. Native loopback CDP transport whose WebSocket endpoint is fetched
with a byte limit and validated against the exact owned Chromium port.

The driver launches Chromium itself, attaches Stagehand through the
validated CDP URL, and retains the launch handle for deterministic
cleanup. The readiness endpoint returns success only after Stagehand and
the browser connection guard are installed.

## Decisions Made

| Decision | Choice | Alternatives Considered | Reasoning |
|---|---|---|---|
| Provider egress enforcement | Inject a restricted fetch into the AI
SDK provider | Replace global fetch and allow-list local CDP | Keeps
provider security policy scoped to provider I/O and cannot interfere
with browser internals |
| Chromium lifecycle | Driver-owned chrome-launcher process | Let
Stagehand launch Chromium | Gives the driver a handle that can always be
killed, including partial initialization failures |
| Readiness | Eager initialization with stateful readiness | Lazy
initialization from health/actions | Prevents the process manager from
accepting an unusable driver |
| Credential delivery | Disable PTY echo before stdin bootstrap | Redact
logs after capture | Prevents secret persistence at the source |

## Edge Cases Handled

| Scenario | Handling |
|---|---|
| CDP response is oversized or points off loopback | Reject before
Stagehand attaches |
| Stagehand fails after Chromium launches | Close Stagehand, kill the
exact Chromium process, log a sanitized diagnostic, and exit non-zero |
| Driver receives SIGINT, SIGTERM, or expires | Close Stagehand and kill
the owned Chromium process |
| Existing driver is stale | Health probe fails after 5 seconds and is
replaced |
| Daytona PTY echoes stdin | Echo is disabled before bootstrap input is
sent |
| Diagnostic contains a request-scoped secret | Exact credentials and
provider-key patterns are redacted before the bounded message is written
|

## How to Review

1. Start with infra/containers/sandbox/browser-driver/server.js for
transport ownership, readiness, and cleanup.
2. Review infra/containers/sandbox/scripts/start-browser-driver.sh for
the credential-delivery boundary.
3. Review packages/agent-core/src/tools/browser/actions.ts for
stale-driver detection.
4. Confirm the lock and sandbox README match the implementation.

## Verification

- [x] pnpm lint
- [x] pnpm typecheck
- [x] pnpm turbo build --force
- [x] pnpm deadcode
- [x] pnpm architecture:check
- [x] pnpm turbo skills:build
- [x] node --check infra/containers/sandbox/browser-driver/server.js
- [x] git diff --check
- [ ] Protected immutable sandbox snapshot build
- [ ] Promote the reviewed snapshot in the agent-worker configuration
- [ ] Repeat the production Pomodoro build and browser verification flow
- [ ] Confirm bootstrap credentials are absent from the new Daytona
session log
- [ ] Confirm driver termination leaves no owned Chromium process

Author: iamjr15

infra/containers/sandbox/README.md

@@ -110,14 +110,16 @@ Stagehand currently resolves `@ai-sdk/provider-utils` 3.0.29. That release conta
 the bounded JSON-response reader that Vercel shipped in 3.0.28. GitHub's current
 `GHSA-866g-f22w-33x8` range nevertheless marks every 3.x version through 3.0.97
 affected, so `npm audit` reports the resulting low-severity transitive paths. The
-driver independently caps every non-streaming provider response and restricts
-Node fetches to the exact selected Anthropic, Google, or OpenAI API hostname,
-containing both that resource-consumption surface and the related download-URL
-SSRF advisory. Chromium navigation remains inside the isolated sandbox and does
-not use this provider transport. Keep the exception visible and reassess it with
-each Stagehand/AI SDK release; do not apply npm's suggested breaking Stagehand
-downgrade. Static checks fail on moderate-or-higher findings across every
-sandbox lock without hiding this low-severity report.
+driver injects a bounded, provider-scoped fetch implementation into Stagehand's
+AI SDK client and restricts it to the exact selected Anthropic, Google, or OpenAI
+API hostname, containing both that resource-consumption surface and the related
+download-URL SSRF advisory. The driver owns Chromium's lifecycle explicitly and
+uses the native transport only for its validated loopback CDP connection;
+Chromium navigation does not use the provider transport. Keep the exception
+visible and reassess it with each Stagehand/AI SDK release; do not apply npm's
+suggested breaking Stagehand downgrade. Static checks fail on
+moderate-or-higher findings across every sandbox lock without hiding this
+low-severity report.
 
 Snapshot publication builds and scans the exact local AMD64 image before pushing it
 to Daytona. Trivy fails on every fixable medium-or-higher vulnerability and every
@@ -137,8 +139,9 @@ user-programmable sandbox. Project commands run as `node`; only the immutable
 launcher may be started through the narrow sudo rule, and that launcher drops to
 the separate `cheatcode-browser` Unix user. The Agent Worker sends the
 request-scoped model key and driver bearer token once over the Daytona session's
-stdin. They are never command arguments, environment variables, workspace files,
-or persisted process metadata. The driver runs from its mode-0700 home with core
+stdin after terminal echo is disabled. They are never command arguments,
+environment variables, workspace files, session logs, or persisted process
+metadata. The driver runs from its mode-0700 home with core
 dumps disabled, deletes provider-key environment names defensively, expires
 after 55 minutes, and requires both the bearer token and run ID. Worker calls
 reach it through a short-lived Daytona-signed port URL; arbitrary workspace code

infra/containers/sandbox/browser-driver/package-lock.json

@@ -10,6 +10,7 @@
   },
   "dependencies": {
     "@browserbasehq/stagehand": "3.7.0",
+    "chrome-launcher": "1.2.1",
     "playwright-core": "1.61.1",
     "zod": "4.4.3"
   },