With browser.headed and bot_desktop.auto_start on a headless host, the first
local launch picked its target (no screen yet, so a throwaway profile) and
only then started the screen. Chromium opened on the Bot Desktop with a
different cookie jar from the dock's Browser icon. The screen now starts
first, so the launch selects the shared Bot Desktop profile.
Review: https://github.com/NousResearch/hermes-agent/pull/143146#discussion_r4351612954
_LOCAL_SUFFIX, browser_in_sandbox() and is_local_mode() had no production caller; the tests that
patched browser_in_sandbox now pin the real placement seam (runtime.tool_placement) and the
is_local_mode assertion checks is_local_backend, the predicate production uses.
REAL_PROFILE_KEY was process-global: under multiplex any consent-off profile's local session stopped
another profile's live real-profile browser, and a consenting profile reused another's cookie jar.
The key is now hermes-real-profile@<home>; real-profile sessions carry it as launcher_key so the
staleness check applies (they still outlive their sessions until exit / consent-off).
Sessions placed in the terminal sandbox all attach to one in-sandbox Chromium, but teardown of the
session that launched it SIGTERMed it under the others. Sandbox sessions now share a per-profile
launcher key (same in-use check as host profiles; the launch pid + env are kept per key), and
_backend_dead rebuilds once that Chromium is gone, relaunched or behind a new port forward.
Cache keys on one persistent profile share a launcher key; after a crash another key relaunches it and
this key saw a live browser while still holding the dead cdp_url. Dead now also means the live browser's
cdp_url differs from the session's.
- janitor force-reap untracks the session (activity + owner + failures)
before releasing it, so a teardown that keeps failing is not re-reaped
every third cycle forever.
- orphan reap refuses a record without a start-time fingerprint (never
signal on argv alone).
- an operator-pinned browser binary, even a missing one, never triggers the
PM Chromium auto-download.
- local Chromium honours Bot Desktop placement through
runtime.tool_placement(): refused raises, terminal starts the sandbox
screen; neither falls back to a host browser.
- running_instance finds the browser pid by argv on Windows (no
SingletonLock symlink there).
Teknium