Open the OpenBao login in pinned Playwright Chromium.

The Windows default browser presented a signed-in Firefox session. The
launcher now starts coulomb-social's headed Playwright Chromium with a new
empty profile.

Assistant: grok
Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd

scripts/operator-browser/xdg-open

@@ -1,9 +1,11 @@
 #!/usr/bin/env python3
-"""Open the approved OpenBao login in a new empty browser profile.
+"""Open the approved OpenBao login in a new empty Playwright Chromium profile.
 
-The default Windows session is not used. A previous login stayed signed in
-there as another account, so this launcher creates a fresh profile each time.
+The Windows default browser is not used. A previous login opened Firefox,
+which was already signed in as another account. This launcher uses the
+headed Chromium binary pinned by coulomb-social's Playwright install.
 """
+import json
 import os
 import subprocess
 import sys
@@ -12,8 +14,9 @@ from pathlib import Path
 from urllib.parse import parse_qs, urlsplit
 
 
-EDGE = "/mnt/c/Program Files (x86)/Microsoft/Edge/Application/msedge.exe"
-CHROME = "/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe"
+BROWSERS_JSON = Path(
+    "/home/worsch/coulomb-social/scripts/node_modules/playwright-core/browsers.json"
+)
 
 
 def allowed(url):
@@ -38,19 +41,38 @@ def allowed(url):
         return False
 
 
-def browser_path():
-    for candidate in (EDGE, CHROME):
-        if Path(candidate).is_file():
-            return candidate
+def chromium_executable(browsers_json, cache_root):
+    try:
+        spec = json.loads(Path(browsers_json).read_text(encoding="utf-8"))
+    except (OSError, UnicodeError, json.JSONDecodeError):
+        return ""
+    browsers = spec.get("browsers") if isinstance(spec, dict) else None
+    if not isinstance(browsers, list):
+        return ""
+    revision = ""
+    for item in browsers:
+        if isinstance(item, dict) and item.get("name") == "chromium":
+            revision = str(item.get("revision") or "")
+            break
+    if not revision.isdecimal():
+        return ""
+    candidate = Path(cache_root) / f"chromium-{revision}" / "chrome-linux64" / "chrome"
+    if candidate.is_file() and os.access(candidate, os.X_OK):
+        return str(candidate)
     return ""
 
 
+def browser_path():
+    return chromium_executable(BROWSERS_JSON, Path.home() / ".cache/ms-playwright")
+
+
 def launch_argv(browser, profile_dir, url):
     return [
         browser,
         f"--user-data-dir={profile_dir}",
         "--no-first-run",
         "--no-default-browser-check",
+        "--disable-sync",
         "--new-window",
         url,
     ]
@@ -71,51 +93,29 @@ def main():
     if len(sys.argv) != 2 or not allowed(sys.argv[1]):
         stamp("rejected")
         return 1
+    if not os.environ.get("DISPLAY") and not os.environ.get("WAYLAND_DISPLAY"):
+        stamp("no-display")
+        return 1
     browser = browser_path()
     if not browser:
         stamp("no-browser")
         return 1
     profile = Path(tempfile.mkdtemp(prefix="operator-browser-"))
     os.chmod(profile, 0o700)
+    command = launch_argv(browser, str(profile), sys.argv[1])
     try:
-        windows_profile = subprocess.run(
-            ["wslpath", "-w", str(profile)],
-            capture_output=True,
-            check=False,
-            timeout=10,
-        )
-        if windows_profile.returncode != 0:
-            return 1
-        profile_dir = windows_profile.stdout.decode().strip()
-        if not profile_dir or any(char in profile_dir for char in "\r\n"):
-            return 1
-        command = launch_argv(browser, profile_dir, sys.argv[1])
-        payload = "\n".join(command) + "\n"
-        opened = subprocess.run(
-            [
-                "/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe",
-                "-NoProfile",
-                "-NonInteractive",
-                "-Command",
-                "$ErrorActionPreference='Stop'; "
-                "$lines=@([Console]::In.ReadToEnd().Split(\"`n\") | "
-                "Where-Object { $_ -ne '' }); "
-                "if ($lines.Count -lt 2) { exit 1 }; "
-                "Start-Process -FilePath $lines[0] -ArgumentList $lines[1..($lines.Count-1)]",
-            ],
-            input=payload.encode(),
+        subprocess.Popen(
+            command,
+            stdin=subprocess.DEVNULL,
             stdout=subprocess.DEVNULL,
             stderr=subprocess.DEVNULL,
-            timeout=20,
+            start_new_session=True,
         )
-        if opened.returncode != 0:
-            stamp("open-failed")
-            return 1
-        stamp("opened")
-        return 0
-    except (OSError, subprocess.SubprocessError):
+    except OSError:
         stamp("open-failed")
         return 1
+    stamp("opened")
+    return 0
 
 
 if __name__ == "__main__":