coulomb/reuse-surface
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
reuse-surface/registry/capabilities/capability.infotech.isolated-login-browser.md
tegwick 3a97eaeca0
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
ci / validate-registry (push) Failing after 52s
Details
Record that the WSL login opener is cmd.exe. 
The attended OpenBao page reached Firefox because hashicorp/cap does not
call xdg-open on WSL.

Assistant: grok
Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd
2026-11-02 10:08:41 +01:00

5.6 KiB
Raw Blame History

id name summary owner status domain tags maturity external_evidence discovery availability relations evidence consumer_guidance promotion_history
capability.infotech.isolated-login-browser Isolated Login Browser Headed empty-profile Chromium for one attended login. It uses the Chromium binary pinned by coulomb-social Playwright 1.62.1 (revision 1234, Chrome for Testing 151.0.7922.34) and a new user-data directory. It is not the Windows default browser and not the rapp-playwright headless service. reuse-surface draft infotech
attended-login
browser
chromium
empty-profile
playwright
discovery availability
current target confidence rationale
D2 D3 medium The boundary is one visible login page in a fresh profile. The remote headless browser is a neighboring capability and is excluded.
current target confidence rationale
A2 A3 medium The launcher is source in railiance-platform and calls the already installed Playwright Chromium cache. It is not a published installable command.
completeness reliability
level confidence basis satisfied_expectations broken_expectations out_of_scope_expectations
C1 low scope_vs_intent_and_consumer_expectations
A headed Chromium from the coulomb-social Playwright pin can be named and started with a fresh profile.
An attended OpenBao login has not completed in this profile.
Headless screenshots, keyboard trials, or a hosted browser service.
Credential custody, password entry, or one-time-code handling by the launcher.
level confidence basis known_reliability_risks
R1 low consumer_quality_signals
Two earlier login attempts opened the signed-in Windows default browser and timed out before the owner command.
The cache binary must match the coulomb-social Playwright pin or the launcher refuses to start.
A desktop display is required. There is no Windows-browser fallback.
intent includes excludes assumptions use_cases research_memos
Give an operator a visible browser with no saved account when a login must not reuse the workstation's default browser session.
Headed Chromium selected from coulomb-social's Playwright browsers pin.
A new empty profile for each allowed Keycloak login URL.
The local OpenBao OIDC callback on port 8250.
The Windows default browser, including Firefox and Edge.
rapp-playwright and any remote headless browser.
Reading, storing, or typing credentials.
The workstation already has the pinned Chromium in the Playwright cache.
DISPLAY or WAYLAND_DISPLAY is available to the login process.
Open the platform-root OpenBao login without an existing disposable-account session.
current_level target_level current_artifacts target_artifacts consumption_modes
A2 A3
../railiance-platform/scripts/operator-browser/cmd.exe
../railiance-platform/scripts/operator-browser/xdg-open
../railiance-platform/scripts/openbao-attended-exec.py
../coulomb-social/scripts/node_modules/playwright-core/browsers.json
A small installable command whose only job is the empty-profile login window.
informational
source adaptation
cli
depends_on supports related_to
capability.infotech.headless-browser
documentation tests consumer_feedback bug_reports incidents
../railiance-platform/docs/backup-credential-recovery.md
../railiance-platform/tests/test_operator_browser.py
2026-11-02: the attended OpenBao window was Firefox, the Windows default. A later login also opened a Firefox tab because OpenBao calls `cmd.exe /c start` on WSL and never reaches xdg-open. The empty profile was not used. The login still completed after the old session expired.
recommended_for not_recommended_for known_limitations
One attended login that must show the one-time-code page and return to localhost.
Screenshot or keyboard trials. Use capability.infotech.headless-browser.
Any flow that should reuse the operator's normal signed-in browser.
The launcher allowlists only the OpenBao Keycloak callback.
Closing the blank proof window is not a completed login.

Isolated Login Browser

Overview

This is the visible browser for a purpose-specific login. It starts the Chromium binary already installed for coulomb-social's Playwright tests, with a new empty profile, on the workstation display. The founder sees the identity page and completes the one-time code.

capability.infotech.headless-browser is the remote screenshot service. It does not show a local login page and cannot receive the OpenBao callback on localhost:8250.

Assessment notes

Discovery

The included behavior is one allowlisted Keycloak URL. Saved Windows sessions and headless trials are outside it.

Availability

Call python3 scripts/openbao-attended-exec.py from railiance-platform. The wrapper places scripts/operator-browser first on PATH. On WSL, OpenBao runs cmd.exe /c start, so that directory provides cmd.exe for the allowlisted login URL.

Completeness

The browser selection and empty profile exist. A finished platform-root login in that window is still outstanding, so the core use case is not complete.

Reliability

The attended login still opened a Firefox tab on 2026-11-02 because the WSL opener never called xdg-open. This entry stays fragile until one real login completes in the pinned Chromium.