feat(desktop): browser profiles for the preview browser

[juliusmarminge]

Adds profiles to the desktop preview browser so tabs can keep separate cookies and site data. This is the bottom of the remaining stack; the browser-access setting is already merged.

Default preserves existing login storage. Incognito uses an in-memory partition. Other profiles use a separate partition namespace with unambiguous environment/profile scoping. A tab keeps its chosen profile for its lifetime.

Settings supports creating, renaming, choosing a default, and removing profiles. Removal waits for cookie/cache cleanup across all known environments and retains the profile if cleanup fails. Existing tabs remain open after removal and are labeled “Removed profile.” The Browser menu supports opening a chosen profile, including touch input.

Validation: focused profile, preview, settings-hydration, and partition-isolation tests; web/desktop typechecks; scoped formatting and lint. Latest CI results are shown below. Earlier desktop behavior was verified by the maintainer; this audit did not run another GUI pass.

Compatibility: Default partitions are unchanged. Data created in custom profiles by an earlier unmerged version of this stack is not migrated from the collision-prone partition mapping.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

Note

Add browser profiles to the preview browser

• Introduces BrowserProfile contracts with built-in default and incognito profiles, and adds settings UI to create, rename, delete, and set the default profile
• Updates BrowserSession to support a profile namespace and ephemeral (in-memory) partitions for incognito mode, keeping legacy partitions disjoint
• Updates PreviewManager and IPC handlers to pass profileId through snapshots, config requests, and partition-scoped clearing operations
• Updates web components like RightPanelTabs to open specific profiles via a submenu, and keys previewWebviewConfigAtom by (environmentId, profileId)
• Risk: DesktopPreviewBridge.clearCookies, clearCache, and getPreviewConfig now require (environmentId, profileId?) instead of taking no arguments or just environmentId

^{Macroscope summarized fe5480b.}

---

Note

Medium Risk
Touches Electron session partitions and cookie/cache clearing semantics; legacy Default scope is preserved but IPC and storage-isolation behavior changes need careful regression on login persistence and multi-profile clears.

Overview
Adds browser profiles so preview tabs can use separate cookies and site data, wired end-to-end from contracts through desktop Electron sessions to the web UI.

Partitioning (desktop): New resolvePartitionScope keeps the Default profile on the legacy bare environmentId scope; other profiles use a JSON-encoded scope plus a profile- partition namespace so scopes like a::b vs environment a + profile b stay distinct. Incognito uses non-persistent partitions. getPreviewConfig, clearCookies, and clearCache now take environmentId and optional profileId; per-profile clears load the session first so data is actually removed after restart. BrowserSession supports targeted clears and recognizes ephemeral partition prefixes.

Server & contracts: Preview sessions carry optional profileId (fixed at tab open); the server manager preserves it across navigate and status updates. Client settings add browserProfiles and browserDefaultProfileId, with built-in Default/Incognito synthesized in resolveBrowserProfiles.

Web UX: Integrations settings to create/rename/remove profiles (removal clears data across connected environments), pick a default (not incognito), profile submenu when adding a browser tab, profile badge and scoped clear actions in preview chrome, and default profile resolution on all open-preview paths. Breaking for bridge callers: clearCookies / clearCache / getPreviewConfig now require environmentId (and accept optional profileId).

^{Reviewed by Cursor Bugbot for commit fe5480b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 904d0a95-7510-4028-b553-9dcda458780c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−7 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−4 B (−0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	55.6 KiB	−44 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	11	10	−1 (−9.1%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−3 B (−0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+11 B (+0.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−14 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	11	10	−1 (−9.1%)	21	✅

Baseline: 5e63aea · PR result: fe5480b · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Reviewed the web UI changes (RightPanelTabs, PreviewChromeRow/PreviewView, PreviewMoreMenu, IntegrationsSettings, menu.tsx) against the shared primitive contracts. Two consistency findings, both inline.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a cross-layer browser-profile capability that changes session partitioning, cookie/login isolation, storage deletion, and the default profile used for implicit preview opens. Its new configurable product default and sensitive browser-storage behavior warrant human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Two findings in the changed web UI. The MenuSubTrigger icon treatment added in this revision fixes the alignment of the new Browser sub-trigger, but the selector it uses also matches the trailing chevron on the two existing icon-less sub-triggers and overrides their ms-auto.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new profile badge in the preview chrome row: the truncate cap doesn't actually ellipsize because Badge is a flex container. Everything else in scope (the MenuSubTrigger icon-column fix, the MenuGroup/MenuGroupLabel wrapping in PreviewMoreMenu, the profile list rows reusing SettingsRow/ITEM_ROW_INNER_CLASSNAME/DraftInput/Button/AlertDialog, and the Select for the default profile) follows the existing primitives and settings conventions.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One convention finding: the new browserProfile module (and its test) uses the consolidated import { Schema } from "effect" form instead of the subpath namespace import used by the rest of packages/contracts. Everything else in the diff (service interfaces on BrowserSession/PreviewManager, Schema.TaggedErrorClass errors with structural attributes, make/layer shape, dependency acquisition) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Two UI-consistency findings in the changed web code; details inline.

^{Posted via Macroscope — UI Consistency}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit 2d10153. Configure here.}

[macroscopeapp]

One finding: the remove-profile tooltip that explains why removal is unavailable can never be shown, because its trigger is the disabled button itself.

^{Posted via Macroscope — UI Consistency}