Improve Agent browser recovery and finding severity calibration

[ross0x01]

Summary

• guide cloud Agent mode to diagnose daemon, socket, connection, and browser-not-running failures before repairing and retrying
• correct malformed browser commands or resnapshot stale element references instead of blindly looping, while preferring direct invocations
• calibrate finding severity to the demonstrated weakness, prerequisites, context, and confidentiality/integrity/availability blast radius
• add prompt contract coverage for the intended Agent and sandbox boundaries

Why

The cloud browser prompt covered the normal interaction workflow but did not distinguish infrastructure recovery from command or element-reference errors. The finding-quality contract also needed an explicit calibration rule so ratings track the impact actually proven without discounting complete severe attack chains.

Scope

Prompt and contract-test changes only. The cloud image and structured finding/report behavior are unchanged.

Validation

• corepack pnpm test -- lib/__tests__/system-prompt.test.ts --runInBand (20 tests)
• corepack pnpm typecheck
• corepack pnpm lint (passes with five existing warnings)
• corepack pnpm exec prettier --check lib/system-prompt.ts lib/__tests__/system-prompt.test.ts
• pre-commit full Jest suite (296 suites, 2,923 tests)

Manual verification

• In a cloud Agent chat, run a browser workflow against a test page. For a daemon/socket/browser-not-running error, confirm the Agent diagnoses first, repairs only when indicated, reopens, and retries; for syntax or stale-ref errors, confirm it corrects or resnapshots instead of repeating the same action.
• Ask Agent mode to assess both a demo/public-data weakness and a complete high-impact attack chain. Confirm each rating follows the demonstrated prerequisites and confidentiality/integrity/availability blast radius.

Summary by CodeRabbit

• New Features

  • Added clearer browser recovery guidance for diagnosing failures, correcting commands, and refreshing stale references.
  • Added stricter guidance for calibrating vulnerability severity based on demonstrated impact, sandbox limitations, and required conditions.

• Bug Fixes

  • Improved prompt behavior by limiting browser recovery instructions to cloud agent mode and ensuring finding-quality guidance applies consistently across agent contexts.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hackerai	Ready	Preview, Comment	Jul 24, 2026 1:32pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 24d0809c-e9f7-4918-874d-1987cf955817

📥 Commits

Reviewing files that changed from the base of the PR and between 2fd0b8a and b51224d.

📒 Files selected for processing (2)

• lib/__tests__/system-prompt.test.ts
• lib/system-prompt.ts

---

📝 Walkthrough

Walkthrough

The system prompt adds severity-calibration rules for findings and recovery instructions for browser failures. Tests verify finding-quality guidance in cloud and local agent prompts, and browser recovery guidance only in cloud agent prompts.

Changes

Prompt contracts

Layer / File(s)	Summary
Finding quality calibration lib/system-prompt.ts, lib/__tests__/system-prompt.test.ts	Finding severity must reflect demonstrated impact, prerequisites, sandbox constraints, and proven attack-chain scope; tests cover cloud and local agent prompts.
Browser recovery guidance lib/system-prompt.ts, lib/__tests__/system-prompt.test.ts	Agent-browser instructions now distinguish daemon failures, malformed syntax, and stale element references; tests verify the guidance is cloud-agent-only.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• hackerai-tech/hackerai#600: Added sandbox agent-browser and Chromium instructions with related prompt tests.
• hackerai-tech/hackerai#625: Clarified local and cloud agent-browser availability and installation checks.
• hackerai-tech/hackerai#853: Updated the agent-mode finding-quality prompt contract and tests.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the two main changes: agent browser recovery guidance and finding severity calibration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/agent-prompt-reliability

---

_{Comment @coderabbitai help to get the list of available commands.}