fix(browser): bridge LPB_AGENT_BROWSER_* → AGENT_BROWSER_* + repair chrome exec bits

agent-browser reads the bare AGENT_BROWSER_* names, not LPB_ — so the
container-safe defaults in lpb.conf.env (notably --no-sandbox) silently
never reached the browser, and Chrome could not launch in a container.

start.sh:
- bridge each LPB_AGENT_BROWSER_* to AGENT_BROWSER_* (shell env > LPB_ >
  container-safe fallback; ARGS falls back to the full safe set, since
  Chrome cannot launch without --no-sandbox)

lpb.conf.env:
- LPB_AGENT_BROWSER_ARGS now comma-separated (agent-browser parses
  --args as a comma/newline list; was space-separated)

install-browser:
- extract member-by-member and restore Unix modes (CPython's
  extractall() drops exec bits, leaving chrome 0644 → PermissionError
  errno 13 on every launch)
- self-heal existing trees: restore exec bits on chrome,
  chrome_crashpad_handler (its PermissionError kills Chrome at startup
  before DevTools starts), headless_shell
- merge the container-safe arg set into an existing ~/.agent-browser/
  config.json (previously skipped when the file existed, so an old or
  user config silenced the defaults); corrupted configs are replaced
- verify_installation reports a clean error instead of crashing with a
  PermissionError traceback

Tests: +6 install-browser (exec-bit restore on extract, self-heal incl.
crashpad handler, config create/merge/corrupt, verify non-executable),
+4 env-bridge (AGENT_BROWSER_* fallback/promotion/priority/default).
Also fixed test isolation: the agent-install success test now mocks
Path.home instead of writing to the real ~/.agent-browser.

Verified live: re-ran the fixed installer in this container — exec bits
restored, config merged, --- AGENT_BROWSER_PAGE_CONTENT nonce=89388e76bdb6c8333382237273b27f84 origin=https://example.com/ ---
# Example Domain

This domain is for use in documentation examples without needing permission. Avoid use in operations.

Learn more
--- END_AGENT_BROWSER_PAGE_CONTENT nonce=89388e76bdb6c8333382237273b27f84 ---
succeeds. 50/50 + 80/80 + 22/22, pre-commit gate green.

doc/env-vars.md: note that LPB_AGENT_BROWSER_* is bridged to
AGENT_BROWSER_* at container start.

Author: lpb-docs

doc/env-vars.md

@@ -47,6 +47,12 @@ If a value from `.env` doesn't seem to apply, check shell env first:
 | `LPB_PERSIST_GH_CONFIG` | — | Persist gh CLI auth into the state volume |
 | `LPB_OPENROUTER_BASE_URL` | — | Optional overflow provider (not needed with Lemonade) |
 
+> **Browser var bridging:** agent-browser (CLI / MCP server) reads the
+> `AGENT_BROWSER_*` names, not `LPB_*`. `start.sh` bridges each
+> `LPB_AGENT_BROWSER_*` to `AGENT_BROWSER_*` (shell env > LPB_ > container-safe
+> fallback), so the container-safe Chrome args — notably `--no-sandbox`,
+> required to launch Chrome inside a container — always take effect.
+
 ## API Keys
 
 | Variable | Used by |

lpb.conf.env

@@ -52,7 +52,9 @@ LPB_AGENT_BROWSER_SESSION=${PI_WORKTREE_ID}
 # --no-first-run     : skip first-run setup dialog
 # --disable-gpu      : avoid GPU issues without GPU passthrough
 # --disable-crashpad : crash dumps not useful in containers
-LPB_AGENT_BROWSER_ARGS=--no-sandbox --no-first-run --disable-gpu --disable-crashpad
+# Comma-separated — agent-browser parses --args as comma/newline lists;
+# start.sh bridges this to AGENT_BROWSER_ARGS (the name agent-browser reads).
+LPB_AGENT_BROWSER_ARGS=--no-sandbox,--no-first-run,--disable-gpu,--disable-crashpad
 # Max output length to prevent context flooding
 LPB_AGENT_BROWSER_MAX_OUTPUT=4000
 # LLM safety markers in content extraction

scripts/test_env_bridge.sh

@@ -255,6 +255,48 @@ r=$(_bridge_only '
 ')
 [[ "$r" == "exa1:c71" ]] && pass "7d: multiple LPB_ vars bridged" || fail "7d: expected exa1:c71, got $r"
 
+# ─── 8. AGENT_BROWSER_* Bridge (agent-browser reads bare names) ──────────────
+# agent-browser does NOT read LPB_AGENT_BROWSER_* — start.sh bridges the
+# LPB_ names to AGENT_BROWSER_* with container-safe fallbacks (notably
+# --no-sandbox, required for Chrome to launch in a container).
+
+echo ""
+echo "=== 8. AGENT_BROWSER_* Bridge ==="
+
+_agent_bridge_test() {
+    local agent_block unset_list setup var
+    agent_block=$(sed -n '/^export AGENT_BROWSER_ARGS=/,/^export AGENT_BROWSER_SESSION=/p' "$SUPPORT_SCRIPT")
+    [[ -n "$agent_block" ]] || { echo "UNSET-BLOCK-MISSING"; return; }
+    unset_list='
+unset AGENT_BROWSER_ARGS AGENT_BROWSER_MAX_OUTPUT AGENT_BROWSER_CONTENT_BOUNDARIES AGENT_BROWSER_CONFIRM_ACTIONS AGENT_BROWSER_IDLE_TIMEOUT_MS AGENT_BROWSER_SESSION
+unset LPB_AGENT_BROWSER_ARGS LPB_AGENT_BROWSER_MAX_OUTPUT LPB_AGENT_BROWSER_CONTENT_BOUNDARIES LPB_AGENT_BROWSER_CONFIRM_ACTIONS LPB_AGENT_BROWSER_IDLE_TIMEOUT_MS LPB_AGENT_BROWSER_SESSION
+'
+    setup="$1"
+    var="${2:-AGENT_BROWSER_ARGS}"
+    bash -c "
+        $unset_list
+        $setup
+        $agent_block
+        echo \"\${$var:-UNSET}\"
+    "
+}
+
+r=$(_agent_bridge_test '')
+if [[ "$r" == *"--no-sandbox"* && "$r" == *"--disable-gpu"* ]]; then
+    pass "8a: container-safe fallback when nothing set"
+else
+    fail "8a: expected container-safe args, got '$r'"
+fi
+
+r=$(_agent_bridge_test 'export LPB_AGENT_BROWSER_ARGS=--custom,--flags')
+[[ "$r" == "--custom,--flags" ]] && pass "8b: LPB_ bridges to AGENT_BROWSER_" || fail "8b: expected --custom,--flags, got '$r'"
+
+r=$(_agent_bridge_test 'export AGENT_BROWSER_ARGS=shell-wins; export LPB_AGENT_BROWSER_ARGS=lpb-loses')
+[[ "$r" == "shell-wins" ]] && pass "8c: shell env > LPB_" || fail "8c: expected shell-wins, got '$r'"
+
+r=$(_agent_bridge_test '' 'AGENT_BROWSER_MAX_OUTPUT')
+[[ "$r" == "4000" ]] && pass "8d: MAX_OUTPUT fallback default" || fail "8d: expected 4000, got '$r'"
+
 # ─── Summary ─────────────────────────────────────────────────────────────────
 
 echo ""

scripts/test_localpibox_install_browser.py

@@ -6,6 +6,9 @@
 from testharness import run_lpbx_suite, _quiet_console
 
 import io
+import json
+import os
+import shutil
 from unittest import mock
 import importlib
 
@@ -24,11 +27,63 @@ def test_install_browser_skips_existing_chrome(tmpdir):
     with mock.patch.object(ib, "CHROME_BASE", tmpdir), \
          mock.patch.object(ib, "fetch_stable_chrome_version", return_value=version):
         (tmpdir / f"chrome-{version}" / "chrome-linux64").mkdir(parents=True)
-        (tmpdir / f"chrome-{version}" / "chrome-linux64" / "chrome").touch()
+        chrome = (tmpdir / f"chrome-{version}" / "chrome-linux64" / "chrome")
+        chrome.touch()
+        chrome.chmod(0o755)  # properly installed → pure skip
         assert ib.install_chrome(cons) == 0
         assert "already installed" in cons.err.getvalue()
 
 
+def test_install_browser_chrome_extract_restores_exec_bit(tmpdir):
+    """zipfile extraction must leave the chrome binary executable.
+
+    CPython's extractall() drops Unix modes, so install_chrome extracts
+    member-by-member and chmods from the zip entry mode.
+    """
+    import zipfile as _zip
+    cons = _quiet_console()
+    version = "99.0.0.1"
+    zip_path = tmpdir / "chrome-linux64.zip"
+    with _zip.ZipFile(zip_path, "w") as zf:
+        zi = _zip.ZipInfo("chrome-linux64/chrome")
+        zi.external_attr = 0o755 << 16
+        zf.writestr(zi, "#!/bin/sh\n")
+        zi2 = _zip.ZipInfo("chrome-linux64/manifest.json")
+        zi2.external_attr = 0o644 << 16
+        zf.writestr(zi2, "{}")
+
+    def fake_retrieve(url, dest):
+        shutil.copy(zip_path, dest)
+
+    with mock.patch.object(ib, "CHROME_BASE", tmpdir), \
+         mock.patch.object(ib, "fetch_stable_chrome_version", return_value=version), \
+         mock.patch.object(ib.urllib.request, "urlretrieve", side_effect=fake_retrieve):
+        assert ib.install_chrome(cons) == 0
+    bin_path = tmpdir / f"chrome-{version}" / "chrome-linux64" / "chrome"
+    assert bin_path.is_file(), "chrome not extracted"
+    assert os.access(bin_path, os.X_OK), "chrome binary must be executable after extract"
+    assert os.stat(bin_path).st_mode & 0o777 == 0o755, "exec bit must come from the zip entry"
+
+
+def test_install_browser_chrome_non_executable_repaired(tmpdir):
+    """An existing chrome tree without exec bits (older installs) self-heals —
+    including chrome_crashpad_handler (its PermissionError 13 kills Chrome
+    at startup before DevTools starts)."""
+    cons = _quiet_console()
+    version = "99.0.0.1"
+    chrome = tmpdir / f"chrome-{version}" / "chrome-linux64" / "chrome"
+    crashpad = tmpdir / f"chrome-{version}" / "chrome-linux64" / "chrome_crashpad_handler"
+    chrome.parent.mkdir(parents=True)
+    chrome.touch()  # 0644 — the broken state
+    crashpad.touch()
+    with mock.patch.object(ib, "CHROME_BASE", tmpdir), \
+         mock.patch.object(ib, "fetch_stable_chrome_version", return_value=version):
+        assert ib.install_chrome(cons) == 0
+    assert os.access(chrome, os.X_OK), "chrome exec bit must be restored"
+    assert os.access(crashpad, os.X_OK), "crashpad handler exec bit must be restored"
+    assert "exec bits restored" in cons.err.getvalue()
+
+
 def test_install_browser_verify_no_chrome(tmpdir):
     cons = _quiet_console()
     with mock.patch.object(ib, "CHROME_BASE", tmpdir), \
@@ -38,6 +93,19 @@ def test_install_browser_verify_no_chrome(tmpdir):
         assert "Chrome binary not found" in cons.err.getvalue()
 
 
+def test_install_browser_verify_non_executable_chrome(tmpdir):
+    """verify must report a clean error (not crash) when chrome is 0644."""
+    cons = _quiet_console()
+    version = "99.0.0.1"
+    chrome = tmpdir / f"chrome-{version}" / "chrome-linux64" / "chrome"
+    chrome.parent.mkdir(parents=True)
+    chrome.touch()  # 0644 — real exec attempt raises PermissionError
+    with mock.patch.object(ib, "CHROME_BASE", tmpdir), \
+         mock.patch.object(ib, "which", return_value=None):
+        assert ib.verify_installation(cons) == 1
+        assert "not executable" in cons.err.getvalue()
+
+
 def test_install_browser_agent_install_missing_binary(tmpdir):
     cons = _quiet_console()
     with mock.patch.object(ib, "which", return_value=None):
@@ -56,12 +124,62 @@ class FakeResult:
         return FakeResult()
 
     with mock.patch.object(ib, "which", return_value="/bin/agent-browser"), \
-         mock.patch.object(ib.subprocess, "run", side_effect=fake_run):
+         mock.patch.object(ib.subprocess, "run", side_effect=fake_run), \
+         mock.patch.object(ib.Path, "home", return_value=tmpdir):
         assert ib.install_agent_browser(cons) == 0
     assert calls == [
         ["agent-browser", "install"],
         ["agent-browser", "install", "--with-deps"],
     ]
+    # container-safe config created in the (mocked) home
+    data = json.loads((tmpdir / ".agent-browser" / "config.json").read_text())
+    for arg in ("--no-sandbox", "--no-first-run", "--disable-gpu", "--disable-crashpad"):
+        assert arg in data["args"].split(","), f"missing {arg}: {data['args']}"
+
+
+def test_install_browser_config_merges_existing(tmpdir):
+    """An existing config.json must keep user args + other keys, and gain
+    the missing container-safe args (no duplicates)."""
+    cons = _quiet_console()
+    (tmpdir / ".agent-browser").mkdir()
+    config = tmpdir / ".agent-browser" / "config.json"
+    config.write_text(json.dumps({"args": "--headless=new", "hideScrollbars": False}))
+
+    def fake_run(args, **kwargs):
+        class FakeResult:
+            returncode = 0
+        return FakeResult()
+
+    with mock.patch.object(ib, "which", return_value="/bin/agent-browser"), \
+         mock.patch.object(ib.subprocess, "run", side_effect=fake_run), \
+         mock.patch.object(ib.Path, "home", return_value=tmpdir):
+        assert ib.install_agent_browser(cons) == 0
+    data = json.loads(config.read_text())
+    args = data["args"].split(",")
+    assert "--headless=new" in args, f"lost user arg: {data['args']}"
+    assert "--no-sandbox" in args, f"missing --no-sandbox: {data['args']}"
+    assert args.count("--no-sandbox") == 1, f"duplicated: {data['args']}"
+    assert data["hideScrollbars"] is False, "other keys must be preserved"
+
+
+def test_install_browser_config_replaces_unreadable(tmpdir):
+    """A corrupted config.json is overwritten (safe set wins, no crash)."""
+    cons = _quiet_console()
+    (tmpdir / ".agent-browser").mkdir()
+    config = tmpdir / ".agent-browser" / "config.json"
+    config.write_text("{not json")
+
+    def fake_run(args, **kwargs):
+        class FakeResult:
+            returncode = 0
+        return FakeResult()
+
+    with mock.patch.object(ib, "which", return_value="/bin/agent-browser"), \
+         mock.patch.object(ib.subprocess, "run", side_effect=fake_run), \
+         mock.patch.object(ib.Path, "home", return_value=tmpdir):
+        assert ib.install_agent_browser(cons) == 0
+    data = json.loads(config.read_text())
+    assert "--no-sandbox" in data["args"].split(",")
 
 
 def main() -> int:

support/install-browser.py

@@ -16,6 +16,7 @@
 
 import argparse
 import json
+import os
 import sys
 import tempfile
 import urllib.request
@@ -35,6 +36,9 @@
 
 CHROME_BASE = Path("/home/lpb/.agent-browser/browsers")
 SYSTEM_CHROME = Path("/opt/google/chrome/chrome")
+# Executable binaries inside the chrome-linux64/ payload (everything else
+# is data/libs). Used to self-heal trees extracted without exec bits.
+CHROME_EXECUTABLES = {"chrome", "chrome_crashpad_handler", "headless_shell"}
 LAST_KNOWN_URL = (
     "https://googlechromelabs.github.io/chrome-for-testing/"
     "last-known-good-versions-with-downloads.json"
@@ -63,6 +67,36 @@ def chrome_binary(version: str) -> Path:
     return chrome_dir_for(version) / "chrome-linux64" / "chrome"
 
 
+def _ensure_executable(path: Path, cons: Console | None = None) -> None:
+    """Restore the exec bit that Python's zipfile extractall drops.
+
+    Chrome-for-Testing zips ship 0755 entries, but CPython's extractall()
+    does not restore Unix modes — left alone, the binary is 0644 and every
+    launch dies with PermissionError (errno 13).
+    """
+    if path.is_file() and not os.access(path, os.X_OK):
+        path.chmod(path.stat().st_mode | 0o755)
+        if cons:
+            cons.warn(f"Restored missing exec bit on {path}")
+
+
+def _restore_exec_bits(chrome_root: Path, cons: Console | None = None) -> int:
+    """Self-heal an extracted Chrome tree: restore exec bits on the known
+    binaries. Returns the number of files fixed. Chrome crashes at startup
+    if chrome_crashpad_handler is not executable (PermissionError 13)."""
+    fixed = 0
+    for sub in (chrome_root, chrome_root / "chrome-linux64"):
+        if not sub.is_dir():
+            continue
+        for f in sub.iterdir():
+            if f.name in CHROME_EXECUTABLES and f.is_file() and not os.access(f, os.X_OK):
+                f.chmod(f.stat().st_mode | 0o755)
+                fixed += 1
+    if fixed and cons:
+        cons.warn(f"Restored missing exec bits on {fixed} Chrome binary(ies) under {chrome_root}")
+    return fixed
+
+
 def install_chrome(cons: Console) -> int:
     cons.info("Downloading latest Chrome for Testing...")
     try:
@@ -72,8 +106,15 @@ def install_chrome(cons: Console) -> int:
         return 1
     cons.info(f"Chrome version: {version}")
 
-    if chrome_binary(version).is_file():
-        cons.warn(f"Chrome already installed at {chrome_dir_for(version)}")
+    bin_path = chrome_binary(version)
+    if bin_path.is_file():
+        if os.access(bin_path, os.X_OK) and not _restore_exec_bits(chrome_dir_for(version)):
+            cons.warn(f"Chrome already installed at {chrome_dir_for(version)}")
+            return 0
+        # Self-heal: an earlier install may have extracted without exec bits
+        # (Python's zipfile drops Unix modes) — restore and reuse.
+        _restore_exec_bits(chrome_dir_for(version), cons)
+        cons.warn(f"Chrome already installed at {chrome_dir_for(version)} (exec bits restored)")
         return 0
 
     chrome_dir_for(version).mkdir(parents=True, exist_ok=True)
@@ -84,11 +125,19 @@ def install_chrome(cons: Console) -> int:
         cons.info(f"Downloading {url} ...")
         urllib.request.urlretrieve(url, zip_path)
         with zipfile.ZipFile(zip_path) as zf:
-            zf.extractall(chrome_dir_for(version))
+            # Extract member-by-member and restore Unix modes: extractall()
+            # drops exec bits, leaving the chrome binary unrunnable (0644).
+            for member in zf.infolist():
+                target = zf.extract(member, chrome_dir_for(version))
+                if not member.is_dir():
+                    mode = member.external_attr >> 16
+                    if mode:
+                        os.chmod(target, mode & 0o7777)
     finally:
         zip_path.unlink(missing_ok=True)
 
-    if chrome_binary(version).is_file():
+    if bin_path.is_file():
+        _restore_exec_bits(chrome_dir_for(version), cons)  # belt & braces
         cons.info(f"Chrome extracted to {chrome_dir_for(version)}")
         return 0
     cons.error("Chrome extraction failed")
@@ -123,14 +172,34 @@ def _run_agent(*args: str) -> subprocess.CompletedProcess[str]:
 
     cons.info("agent-browser installed successfully")
 
-    # Container-safe defaults: Chrome needs --no-sandbox in Docker/container
+    # Container-safe defaults: Chrome needs --no-sandbox in a container.
+    # agent-browser reads ~/.agent-browser/config.json (camelCase keys; the
+    # "args" value is a comma-separated launch-arg list). MERGE the safe set
+    # into any existing config instead of skipping it — an existing file
+    # (user-customized, or from an older stack) must not silence the
+    # container-safe defaults.
     config_path = Path.home() / ".agent-browser" / "config.json"
-    if not config_path.is_file():
-        config_path.parent.mkdir(parents=True, exist_ok=True)
-        config_path.write_text(
-            json.dumps({"args": "--no-sandbox"}, indent=2)
-        )
+    existed = config_path.is_file()
+    config = {}
+    if existed:
+        try:
+            loaded = json.loads(config_path.read_text())
+            if isinstance(loaded, dict):
+                config = loaded
+        except (json.JSONDecodeError, OSError):
+            cons.warn(f"Existing {config_path} is unreadable — overwriting")
+    safe_args = ["--no-sandbox", "--no-first-run", "--disable-gpu", "--disable-crashpad"]
+    existing = [a.strip() for a in str(config.get("args", "")).replace("\n", ",").split(",") if a.strip()]
+    merged = existing + [a for a in safe_args if a not in existing]
+    config["args"] = ",".join(merged)
+    config_path.parent.mkdir(parents=True, exist_ok=True)
+    config_path.write_text(json.dumps(config, indent=2) + "\n")
+    if not existed:
         cons.info(f"Created container-safe config: {config_path}")
+    elif merged != existing:
+        cons.info(f"Merged container-safe args into {config_path}")
+    else:
+        cons.info(f"Container-safe args already present in {config_path}")
 
     return 0
 
@@ -145,9 +214,20 @@ def verify_installation(cons: Console) -> int:
 
     if chrome_bin:
         cons.info(f"  Chrome: {chrome_bin}")
-        out, _err, code = run_cmd([str(chrome_bin), "--version"], timeout=30)
-        if code == 0 and out.strip():
-            cons.raw(f"    {out.strip()}")
+        try:
+            out, _err, code = run_cmd([str(chrome_bin), "--version"], timeout=30)
+        except (PermissionError, OSError) as exc:
+            cons.error(
+                f"  Chrome binary not executable ({exc.__class__.__name__}); "
+                f"re-run install-browser to restore permissions"
+            )
+            errors += 1
+        else:
+            if code == 0 and out.strip():
+                cons.raw(f"    {out.strip()}")
+            else:
+                cons.error(f"  Chrome --version failed (exit {code})")
+                errors += 1
     else:
         cons.error("  Chrome binary not found")
         errors += 1