Repository navigation
fix(engine): launch Chrome with only the env it needs - #7629
Conversation
Every Chrome HyperFrames starts (render, GPU probe, HDR capture, startup diagnosis, version and shell probes, CLI browsers, inspector) now gets an allowlisted environment from @hyperframes/core/chrome-env instead of the whole process env. HYPERFRAMES_CHROME_ENV_PASSTHROUGH names any extra variable a host needs. Refs #7623 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
Edit accuracy: accurate 267 (base branch 267), smooth 90 of thoseThe gate passes. Quarantined, measured but not gated (8)
Unstable (1)
|
![heygengenesis[bot]](https://avatars.githubusercontent.com/in/2913576?s=60&v=4){kind=small}
There was a problem hiding this comment.
Verdict: APPROVE · 0 blocker · 1 important · 1 nit · 57972de3
Rule 2 sweep: every production Chrome start (engine render/GPU probe/HDR/diagnosis/shellStarts, CLI launchOwnedBrowser/preflight, inspector) is filtered; openBrowser (the user's own browser) correctly isn't. CI green; merges cleanly with main and #7630.
— Genesis
| return await new Promise<string>((resolve) => { | ||
| let stderr = ""; | ||
| const child = spawn(executablePath, startupArgs(args, profile), { | ||
| env: buildChromeLaunchEnv(), |
There was a problem hiding this comment.
nit: the docstring says this replays "the failed launch's flags", but the env is a fresh buildChromeLaunchEnv() from process.env, not the failed attempt's env. For an engine launch, launchEnv may have removed WAYLAND_DISPLAY (WSL) or the Vulkan pins (SwiftShader), and the diagnosis Chrome gets them back. This is the env counterpart of #7630's args fix. Passing the attempt's env through explainChromeLaunchFailure would close it; fine as a follow-up.
The CLI GPU probe filters its env twice, which dropped the names HYPERFRAMES_CHROME_ENV_PASSTHROUGH adds, so the probe and the render saw different envs. Keep the passthrough variable itself. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Chrome launches with only the env it needs. Every Chrome HyperFrames starts now gets an allowlisted environment instead of the whole process env, and renders come out unchanged. Refs #7623
Claude Opus 5.5
What
@hyperframes/core/chrome-env: one exportedCHROME_ENV_ALLOWLISTand a purebuildChromeLaunchEnv(env). Names match case-insensitively, since Windows treats them that way and proxy vars come in both cases. A trailing*is a prefix.launchEnv, which keeps its WAYLAND_DISPLAY and SwiftShader Vulkan handling)shellStartsprobelaunchOwnedBrowser, which covers every CLI browser and the CLI GPU probechrome --versionHYPERFRAMES_CHROME_ENV_PASSTHROUGHtakes a comma list of extra names, for hosts whose GPU driver or proxy auth needs a variable the list lacks. Driver variables have no closed set (RADV_*,ANV_*,KRB5CCNAMEfor Negotiate proxies). Documented indocs/packages/cli.mdxnext toHYPERFRAMES_CHROME_SANDBOX.Why
Chrome inherited everything the CLI, producer or Lambda handler held. It needs a small, known set of variables.
Allowlist
PATH HOME USER LOGNAME TMPDIR TMP TEMPLANG LANGUAGE LC_* TZ TZDIR LOCALE_ARCHIVEDISPLAY WAYLAND_DISPLAY XAUTHORITY XDG_* DBUS_SESSION_BUS_ADDRESSFONTCONFIG_FILE FONTCONFIG_PATHFONTCONFIG_PATH; tests pinFONTCONFIG_FILELD_LIBRARY_PATHMESA_* LIBGL_* GALLIUM_* VK_* __GLX_* __EGL_* __GL_* __NV_* DRI_PRIME EGL_PLATFORM LIBVA_*HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY AUTO_PROXY SOCKS_SERVER SOCKS_VERSION SSL_CERT_FILE SSL_CERT_DIRCHROME_DEVEL_SANDBOXSYSTEMROOT WINDIR SYSTEMDRIVE PROGRAMFILES* PROGRAMW6432 COMMONPROGRAM* PROGRAMDATA ALLUSERSPROFILE PUBLIC APPDATA LOCALAPPDATA USERPROFILE USERNAME USERDOMAIN HOMEDRIVE HOMEPATH COMPUTERNAME COMSPEC PATHEXT OS PROCESSOR_ARCHITECTURE NUMBER_OF_PROCESSORS__CF_USER_TEXT_ENCODING(plus HOME/TMPDIR/USER above)HYPERFRAMES_*,PRODUCER_*,NODE_OPTIONS,LD_PRELOAD,npm_*and the rest are not passed: Chrome's process tree reads none of them. The node side still reads them from its own env.How
launchEnvused to returnundefined(inherit) unless it had to drop WAYLAND_DISPLAY or the Vulkan pins. Now it always returns the filtered env, with the same two adjustments. The helper lives in core because engine, CLI and inspector all depend on it, and inspector does not depend on engine.Related work
Refs #7623. Open-PR file overlap: #7622 edits
launchOwnedBrowserinpackages/cli/src/browser/launch.ts, about 5 lines from this hunk, and should merge cleanly. #7413 edits other functions inpackages/cli/src/browser/preflight.ts. #7433 adds a different core subpath, sopackage.jsonandpackage-subpaths.jsonmay need a trivial rebase. Several open PRs touch other sections ofdocs/packages/cli.mdx. #7630 (sandbox-retry diagnosis) edits different hunks ofbrowserManager.tsandlaunch.ts, and the two branches merge cleanly together.Test plan
chromeEnv.test.ts(27). Credential-shaped names are dropped, each category is kept, lower-case proxies and Windows-cased names match, and the passthrough adds exactly the named vars. Alsolaunch.env.test.ts(CLI browsers are filtered, including a caller's ownenv), and the engine Vulkan and WSL env tests are updated to the always-filtered env.process.env(1), Vulkan pins kept for SwiftShader (1), CLI launch unfiltered (2).hyperframes renderof thecss-spinner-render-compatfixture with this branch's CLI and with a main build. Decoded frames are identical (same framemd5 over all 150 frames, PSNR inf).HYPERFRAMES_BROWSER_PATHrecorded the variable names each Chrome start received. The render ran withAWS_SECRET_ACCESS_KEY,GITHUB_TOKEN,DATABASE_URLandOPENAI_API_KEYset. On main, all 8 Chrome starts saw all of them. On this branch, the 8 starts saw onlyDBUS_SESSION_BUS_ADDRESS HOME LANG LOGNAME PATH USER XDG_DATA_DIRS XDG_RUNTIME_DIR. The shim run is also what found the preflight--versionprobe.tsc --noEmitfor core/engine/cli/inspector,fallow audit, comment ratchet, package-subpaths, workspace-contracts, package-cycles, cli-process-ownership, cli-lazy-deps.Not covered here: dev-only launches (studio's Vite thumbnail plugin,
verifyStaticPageused by a repo script, test and e2e harnesses) keep their env.— Rames Jusso
🤖 Generated with Claude Code