Fix browser_navigate failing with 'No usable sandbox!' on Ubuntu 23.10+

[gek0v]

Problem

Chrome fails to start under Ubuntu 23.10+ with AppArmor restrictions, showing 'No usable sandbox!' error.

Root Causes

1. Wrong environment variable: Code used AGENT_BROWSER_CHROME_FLAGS, but agent-browser 0.26+ expects AGENT_BROWSER_ARGS
2. Wrong argument format: agent-browser --args expects comma-separated values, not space-separated
3. Injection at wrong point: cmd_parts was built before browser_env was fully configured

Solution

• Detect AppArmor user namespace restrictions via /proc/sys/kernel/apparmor_restrict_unprivileged_userns
• Use AGENT_BROWSER_ARGS env var instead of deprecated AGENT_BROWSER_CHROME_FLAGS
• Inject --args with comma-separated flags for agent-browser 0.26+
• Fix injection point to occur after browser_env is fully configured

Testing

Verified working on Ubuntu 24.04 with AppArmor enabled, agent-browser 0.26.0.

Fixes #15765

[alt-glitch]

Related to #20014 (same AGENT_BROWSER_ARGS vs AGENT_BROWSER_CHROME_FLAGS fix). Also related to merged #19747 which introduced the sandbox bypass logic.

[nextgenthemes]

I am in Ubuntu 26.04 manually installed chromium-browser. My browser requests time out, with and without this patch. Hermes then tries to use curl to check for response code and gets 200. And it used some python thing to read HTML from a site I think.

(The installation script wanted to install "Playwright Chromium" before I manually installed it, that has its own issues because first it seemed stuck without actually showing anything, it lacks some verbose or error output. Then I find out that Playwright does not support 26.04 yet, but you can install it with an overwrite env var, did that, install script was stuck AGAIN on the next step that wants to install "Playwright Chromium". I then just manually installed chromium-browser from the Ubuntu sources and the installation script detected it. So it's very flawed in many aspects, if the normal Ubuntu packaged Chromium works it should just ask for sudo to install that, it should have verbose error output and show what its actually doing. I feel like I am using Ansible when I run the installation script, but it's a bash script.)

[teknium1]

Automated hermes-sweeper review: this browser sandbox-bypass change is already implemented on current main.

Evidence:

• tools/browser_tool.py:2012 now contains the root/AppArmor userns detection block for the No usable sandbox case.
• tools/browser_tool.py:2020 respects both AGENT_BROWSER_ARGS and legacy AGENT_BROWSER_CHROME_FLAGS as opt-outs before auto-injecting anything.
• tools/browser_tool.py:2042 sets the real agent-browser variable, AGENT_BROWSER_ARGS, to the comma-separated flags --no-sandbox,--disable-dev-shm-usage.
• Commit 8ed2ef6f46e9642acfba57b4b8da893a574ecfd0 switched the bypass from the unused AGENT_BROWSER_CHROME_FLAGS/space-separated form to AGENT_BROWSER_ARGS/comma-separated form.
• Commit 4695d2716f60da89152bdc9dfa7d96e54ea7c22e completed the opt-out gate and documented AGENT_BROWSER_ARGS in .env.example and the browser docs.

I also read the prior discussion. The later Ubuntu 26.04 timeout/install report appears to describe broader browser installation/runtime issues that still may deserve separate tracking, but this PR's specific sandbox/env-var fix is present on main.