stardust: nothing checks that scripts the agent writes use browser.mjs

Open
  • Is something wrong?
#579 3 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
62/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
javascript, node.js, playwright
Domain
devtools, testing

Research direction

Start with skills/stardust/scripts/ledger.mjs and trace the phase-end path for ledger.mjs <skill> <phase> end; the issue identifies this as the likely place to add a scan. Check how project files are distinguished from stardust/scripts/, and compare the Playwright patterns with evals/lint/browser-front-door.mjs. Done means phase end warns once for each relevant project script that imports playwright or calls .launch(, while leaving skill scripts and test files out of scope.

Written by the indexing model from the issue text.

Description

ai-generated enhancement

Status

  • In #573: the Setup rule with its recipe, and option 1 below as an advisory warning (ledger.mjs … end names the scripts under stardust/, written in the phase, that import Playwright themselves).
  • Open, for a separate PR: a check at run time. Two field checks showed what the scan misses: scripts under /tmp, scripts that take the browser from browser.mjs and then navigate on their own, and scripts written and run inside one phase.
  • Proposed design: mark every browser the front door starts, record unmarked launches, let the skill react. See https://github.com/adobe/skills/issues/579#issuecomment-6821490943

Summary

#573 makes skills/stardust/scripts/browser.mjs the one entry to the browser, and evals/lint/browser-front-door.mjs enforces it for the scripts under skills/. Nothing checks the scripts the agent writes in a project. For those, #573 has a prose rule in the master Setup, and prose can be ignored.

Evidence

A recorded hands-off replica run on the head of #573 (field check: https://github.com/adobe/skills/pull/573#issuecomment-6791087686):

  • The agent wrote 12 Playwright scripts under stardust/.work/ and stardust/dynamics/. All imported playwright and called chromium.launch().
  • Four of them opened the source site: two section probes, the dynamics flow replay and a mobile drawer capture.
  • At that time the rule sat in the validate-and-fix loop of skills/stardust/SKILL.md, with an example for local pages. #573 has since moved it to Setup step 7.

Why it matters

  • On a bot-protected source, such a script skips the real-Chrome identity, the per-host pacing and the block-page detection. It can read a block page as if it were the source, or add unpaced requests to a site that is already rate limiting.
  • The design note in #573 (plugins/stardust/notes/browser-front-door/README.md) describes a second stage: a remote browser records the source and local Chrome replays it. A script that bypasses browser.mjs would reach the source from the local address, not from the recording.

Options

  1. Scan at phase end. skills/stardust/scripts/ledger.mjs <skill> <phase> end already warns when a journal section is missing. It could also scan stardust/ (outside stardust/scripts/) for files that import playwright or call .launch(, and print one warning per file. Every phase ends with that command, and the script is already in every project.
    • For: small, no new script to copy, runs in the normal flow.
    • Against: it reports after the script ran.
  2. Ship the lint to projects. Move the rules of evals/lint/browser-front-door.mjs into a script under skills/stardust/scripts/ that takes directories, and run it from rollout/scripts/done-check.mjs.
    • For: one rule set for plugin and project.
    • Against: a new script and a new gate, and it reports even later.
  3. Detect at run time. A Node preload (NODE_OPTIONS=--import …) that prints one stderr line when chromium.launch() or connect*() is called and browser.mjs did not make the call.
    • For: it reports at the moment of the bypass, for any script.
    • Against: the operator must set it, and the preload must find the project's Playwright.

Option 1 looks like the smallest useful step.

Not in scope

  • Scripts under skills/: the lint in #573 covers them.
  • Test files, which may start browsers directly.
Dominant language
JavaScript
Stars
324
Forks
99
Avg merge
2d 7h
Merged PRs (30d)
121

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from adobe/skills

All issues in adobe/skills

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.