feat(desktop): browser profiles for the preview browser

[juliusmarminge]

Adds profiles to the desktop preview browser so tabs can keep separate cookies and site data. This is the bottom of the remaining stack; the browser-access setting is already merged.

Default preserves existing login storage. Incognito uses an in-memory partition. Other profiles use a separate partition namespace with unambiguous environment/profile scoping. A tab keeps its chosen profile for its lifetime.

Settings supports creating, renaming, choosing a default, and removing profiles. Removal waits for cookie/cache cleanup across all known environments and retains the profile if cleanup fails. Existing tabs remain open after removal and are labeled “Removed profile.” The Browser menu supports opening a chosen profile, including touch input.

Validation: focused profile, preview, settings-hydration, and partition-isolation tests; web/desktop typechecks; scoped formatting and lint. Latest CI results are shown below. Earlier desktop behavior was verified by the maintainer; this audit did not run another GUI pass.

Compatibility: Default partitions are unchanged. Data created in custom profiles by an earlier unmerged version of this stack is not migrated from the collision-prone partition mapping.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

Note

Add browser profiles to the preview browser

• Introduces BrowserProfile contracts with built-in default and incognito profiles, and adds settings UI to create, rename, delete, and set the default profile
• Updates BrowserSession to support a profile namespace and ephemeral (in-memory) partitions for incognito mode, keeping legacy partitions disjoint
• Updates PreviewManager and IPC handlers to pass profileId through snapshots, config requests, and partition-scoped clearing operations
• Updates web components like RightPanelTabs to open specific profiles via a submenu, and keys previewWebviewConfigAtom by (environmentId, profileId)
• Risk: DesktopPreviewBridge.clearCookies, clearCache, and getPreviewConfig now require (environmentId, profileId?) instead of taking no arguments or just environmentId

📊 Macroscope summarized f666480. 27 files reviewed, 4 issues evaluated, 4 issues filtered, 0 comments posted

🗂️ Filtered Issues

apps/web/src/browser/previewWebviewConfigState.ts — 0 comments posted, 1 evaluated, 1 filtered

• line 77: parseConfigKey splits at the first NUL even though EnvironmentId is only a trimmed non-empty string and permits control characters. For an environment ID such as "env\u0000x", configKey produces a key which is parsed as environment "env" and profile "x\u0000..."; the webview configuration request is then made for the wrong environment/profile (and its profile value violates the profile-ID contract), so that environment cannot open its preview with the intended partition. [ Already posted ]

apps/web/src/components/settings/IntegrationsSettings.tsx — 0 comments posted, 2 evaluated, 2 filtered

• line 628: removeProfile clears the partition before it removes the profile while deliberately leaving its tabs open. An open tab can receive a response or run script that writes cookies/cache after clearBrowserProfileData resolves but before/after the settings update, leaving persistent data in the now-unreachable removed profile partition even though removal reports success. [ Already posted ]
• line 629: After destructive cleanup succeeds, removeProfile invokes updateSettings and immediately reports success, but client persistence is fire-and-forget and explicitly catches write failures. If setClientSettings fails (for example, storage/IPC failure), the profile reappears after restart with its cookies/cache already erased, while the UI had claimed removal succeeded. [ Already posted ]

packages/contracts/src/settings.ts — 0 comments posted, 1 evaluated, 1 filtered

• line 208: browserProfiles has no Schema.isMaxLength(BROWSER_PROFILE_MAX_COUNT) check. A hand-edited settings file (or a settings update outside the add-profile UI) with 25 or more individually valid profiles decodes successfully, even though the UI and exported limit cap profiles at 24; all excess profiles are then resolved and displayed/used. [ Out of scope (post-validation triage) ]

---

Note

Medium Risk
Changes Electron session partitioning and breaks the preview IPC surface for clear/config calls; incorrect scope mapping could mix or strand login data, though legacy Default partitions are explicitly preserved.

Overview
Adds named browser profiles so preview tabs can keep isolated cookies and storage, with built-in Default (legacy partition unchanged) and Incognito (ephemeral Chromium partition).

Contracts & server: New BrowserProfile types and client settings (browserProfiles, browserDefaultProfileId). Preview open/snapshots carry optional profileId through navigate and status updates so tabs don't silently switch partitions.

Desktop:resolvePartitionScope maps (environmentId, profileId) to partition scope (JSON tuple for non-default profiles), persistence, and a profile- partition namespace disjoint from legacy defaults. getPreviewConfig, clearCookies, and clearCache IPC now take environmentId and optional profileId; per-profile clears load the session first so cleanup works after restart. BrowserSession supports ephemeral partitions and partition-scoped clears.

Web UI: Integrations settings to create/rename/remove profiles (removal clears data across environments), default profile picker, and a Browser add-menu submenu to open a specific profile. Preview chrome shows the active profile and scopes "clear cookies/cache" to that tab's profile. Open paths (openPreviewSession, file/link opens) apply hydrated default profileId; webview config is cached per environment + profile.

^{Reviewed by Cursor Bugbot for commit f666480. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 904d0a95-7510-4028-b553-9dcda458780c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.1 KiB	−168 B (−1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.2 KiB	−172 B (−2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	54.7 KiB	−910 B (−1.6%)	66.4 KiB	✅
Codex	Live turn messages	10	8	−2 (−20.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.1 KiB	−8 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.2 KiB	−11 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: 04efa79 · PR result: f666480 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Reviewed the web UI changes (RightPanelTabs, PreviewChromeRow/PreviewView, PreviewMoreMenu, IntegrationsSettings, menu.tsx) against the shared primitive contracts. Two consistency findings, both inline.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a cross-layer browser-profile capability that changes session partitioning, cookie/login isolation, storage deletion, and the default profile used for implicit preview opens. Its new configurable product default and sensitive browser-storage behavior warrant human review.

No code changes detected at f666480. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Two findings in the changed web UI. The MenuSubTrigger icon treatment added in this revision fixes the alignment of the new Browser sub-trigger, but the selector it uses also matches the trailing chevron on the two existing icon-less sub-triggers and overrides their ms-auto.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new profile badge in the preview chrome row: the truncate cap doesn't actually ellipsize because Badge is a flex container. Everything else in scope (the MenuSubTrigger icon-column fix, the MenuGroup/MenuGroupLabel wrapping in PreviewMoreMenu, the profile list rows reusing SettingsRow/ITEM_ROW_INNER_CLASSNAME/DraftInput/Button/AlertDialog, and the Select for the default profile) follows the existing primitives and settings conventions.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One convention finding: the new browserProfile module (and its test) uses the consolidated import { Schema } from "effect" form instead of the subpath namespace import used by the rest of packages/contracts. Everything else in the diff (service interfaces on BrowserSession/PreviewManager, Schema.TaggedErrorClass errors with structural attributes, make/layer shape, dependency acquisition) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[juliusmarminge]

Adds profiles to the desktop preview browser so tabs can keep separate cookies and site data. This is the bottom of the remaining stack; the browser-access setting is already merged.

Default preserves existing login storage. Incognito uses an in-memory partition. Other profiles use a separate partition namespace with unambiguous environment/profile scoping. A tab keeps its chosen profile for its lifetime.

Settings supports creating, renaming, choosing a default, and removing profiles. Removal waits for cookie/cache cleanup across all known environments and retains the profile if cleanup fails. Existing tabs remain open after removal and are labeled “Removed profile.” The Browser menu supports opening a chosen profile, including touch input.

Validation: focused profile, preview, settings-hydration, and partition-isolation tests; web/desktop typechecks; scoped formatting and lint. Latest CI results are shown below. Earlier desktop behavior was verified by the maintainer; this audit did not run another GUI pass.

Compatibility: Default partitions are unchanged. Data created in custom profiles by an earlier unmerged version of this stack is not migrated from the collision-prone partition mapping.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

Note

Add browser profiles to the preview browser

• Introduces BrowserProfile contracts with built-in default and incognito profiles, and adds settings UI to create, rename, delete, and set the default profile
• Updates BrowserSession to support a profile namespace and ephemeral (in-memory) partitions for incognito mode, keeping legacy partitions disjoint
• Updates PreviewManager and IPC handlers to pass profileId through snapshots, config requests, and partition-scoped clearing operations
• Updates web components like RightPanelTabs to open specific profiles via a submenu, and keys previewWebviewConfigAtom by (environmentId, profileId)
• Risk: DesktopPreviewBridge.clearCookies, clearCache, and getPreviewConfig now require (environmentId, profileId?) instead of taking no arguments or just environmentId

📊 Macroscope summarized f666480. 27 files reviewed, 4 issues evaluated, 4 issues filtered, 0 comments posted

🗂️ Filtered Issues

apps/web/src/browser/previewWebviewConfigState.ts — 0 comments posted, 1 evaluated, 1 filtered

• line 77: parseConfigKey splits at the first NUL even though EnvironmentId is only a trimmed non-empty string and permits control characters. For an environment ID such as "env\u0000x", configKey produces a key which is parsed as environment "env" and profile "x\u0000..."; the webview configuration request is then made for the wrong environment/profile (and its profile value violates the profile-ID contract), so that environment cannot open its preview with the intended partition. [ Already posted ]

apps/web/src/components/settings/IntegrationsSettings.tsx — 0 comments posted, 2 evaluated, 2 filtered

• line 628: removeProfile clears the partition before it removes the profile while deliberately leaving its tabs open. An open tab can receive a response or run script that writes cookies/cache after clearBrowserProfileData resolves but before/after the settings update, leaving persistent data in the now-unreachable removed profile partition even though removal reports success. [ Already posted ]
• line 629: After destructive cleanup succeeds, removeProfile invokes updateSettings and immediately reports success, but client persistence is fire-and-forget and explicitly catches write failures. If setClientSettings fails (for example, storage/IPC failure), the profile reappears after restart with its cookies/cache already erased, while the UI had claimed removal succeeded. [ Already posted ]

packages/contracts/src/settings.ts — 0 comments posted, 1 evaluated, 1 filtered

• line 208: browserProfiles has no Schema.isMaxLength(BROWSER_PROFILE_MAX_COUNT) check. A hand-edited settings file (or a settings update outside the add-profile UI) with 25 or more individually valid profiles decodes successfully, even though the UI and exported limit cap profiles at 24; all excess profiles are then resolved and displayed/used. [ Out of scope (post-validation triage) ]

---

Note

Medium Risk
Changes Electron session partitioning and breaks the preview IPC surface for clear/config calls; incorrect scope mapping could mix or strand login data, though legacy Default partitions are explicitly preserved.

Overview
Adds named browser profiles so preview tabs can keep isolated cookies and storage, with built-in Default (legacy partition unchanged) and Incognito (ephemeral Chromium partition).

Contracts & server: New BrowserProfile types and client settings (browserProfiles, browserDefaultProfileId). Preview open/snapshots carry optional profileId through navigate and status updates so tabs don't silently switch partitions.

Desktop:resolvePartitionScope maps (environmentId, profileId) to partition scope (JSON tuple for non-default profiles), persistence, and a profile- partition namespace disjoint from legacy defaults. getPreviewConfig, clearCookies, and clearCache IPC now take environmentId and optional profileId; per-profile clears load the session first so cleanup works after restart. BrowserSession supports ephemeral partitions and partition-scoped clears.

Web UI: Integrations settings to create/rename/remove profiles (removal clears data across environments), default profile picker, and a Browser add-menu submenu to open a specific profile. Preview chrome shows the active profile and scopes "clear cookies/cache" to that tab's profile. Open paths (openPreviewSession, file/link opens) apply hydrated default profileId; webview config is cached per environment + profile.

^{Reviewed by Cursor Bugbot for commit f666480. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 904d0a95-7510-4028-b553-9dcda458780c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.1 KiB	−168 B (−1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.2 KiB	−172 B (−2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	54.7 KiB	−910 B (−1.6%)	66.4 KiB	✅
Codex	Live turn messages	10	8	−2 (−20.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.1 KiB	−8 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.2 KiB	−11 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: 04efa79 · PR result: f666480 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Reviewed the web UI changes (RightPanelTabs, PreviewChromeRow/PreviewView, PreviewMoreMenu, IntegrationsSettings, menu.tsx) against the shared primitive contracts. Two consistency findings, both inline.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a cross-layer browser-profile capability that changes session partitioning, cookie/login isolation, storage deletion, and the default profile used for implicit preview opens. Its new configurable product default and sensitive browser-storage behavior warrant human review.

No code changes detected at f666480. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Two findings in the changed web UI. The MenuSubTrigger icon treatment added in this revision fixes the alignment of the new Browser sub-trigger, but the selector it uses also matches the trailing chevron on the two existing icon-less sub-triggers and overrides their ms-auto.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new profile badge in the preview chrome row: the truncate cap doesn't actually ellipsize because Badge is a flex container. Everything else in scope (the MenuSubTrigger icon-column fix, the MenuGroup/MenuGroupLabel wrapping in PreviewMoreMenu, the profile list rows reusing SettingsRow/ITEM_ROW_INNER_CLASSNAME/DraftInput/Button/AlertDialog, and the Select for the default profile) follows the existing primitives and settings conventions.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One convention finding: the new browserProfile module (and its test) uses the consolidated import { Schema } from "effect" form instead of the subpath namespace import used by the rest of packages/contracts. Everything else in the diff (service interfaces on BrowserSession/PreviewManager, Schema.TaggedErrorClass errors with structural attributes, make/layer shape, dependency acquisition) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[juliusmarminge]

Adds profiles to the desktop preview browser so tabs can keep separate cookies and site data. This is the bottom of the remaining stack; the browser-access setting is already merged.

Default preserves existing login storage. Incognito uses an in-memory partition. Other profiles use a separate partition namespace with unambiguous environment/profile scoping. A tab keeps its chosen profile for its lifetime.

Settings supports creating, renaming, choosing a default, and removing profiles. Removal waits for cookie/cache cleanup across all known environments and retains the profile if cleanup fails. Existing tabs remain open after removal and are labeled “Removed profile.” The Browser menu supports opening a chosen profile, including touch input.

Validation: focused profile, preview, settings-hydration, and partition-isolation tests; web/desktop typechecks; scoped formatting and lint. Latest CI results are shown below. Earlier desktop behavior was verified by the maintainer; this audit did not run another GUI pass.

Compatibility: Default partitions are unchanged. Data created in custom profiles by an earlier unmerged version of this stack is not migrated from the collision-prone partition mapping.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

Note

Add browser profiles to the preview browser

• Introduces BrowserProfile contracts with built-in default and incognito profiles, and adds settings UI to create, rename, delete, and set the default profile
• Updates BrowserSession to support a profile namespace and ephemeral (in-memory) partitions for incognito mode, keeping legacy partitions disjoint
• Updates PreviewManager and IPC handlers to pass profileId through snapshots, config requests, and partition-scoped clearing operations
• Updates web components like RightPanelTabs to open specific profiles via a submenu, and keys previewWebviewConfigAtom by (environmentId, profileId)
• Risk: DesktopPreviewBridge.clearCookies, clearCache, and getPreviewConfig now require (environmentId, profileId?) instead of taking no arguments or just environmentId

📊 Macroscope summarized f666480. 27 files reviewed, 4 issues evaluated, 4 issues filtered, 0 comments posted

🗂️ Filtered Issues

apps/web/src/browser/previewWebviewConfigState.ts — 0 comments posted, 1 evaluated, 1 filtered

• line 77: parseConfigKey splits at the first NUL even though EnvironmentId is only a trimmed non-empty string and permits control characters. For an environment ID such as "env\u0000x", configKey produces a key which is parsed as environment "env" and profile "x\u0000..."; the webview configuration request is then made for the wrong environment/profile (and its profile value violates the profile-ID contract), so that environment cannot open its preview with the intended partition. [ Already posted ]

apps/web/src/components/settings/IntegrationsSettings.tsx — 0 comments posted, 2 evaluated, 2 filtered

• line 628: removeProfile clears the partition before it removes the profile while deliberately leaving its tabs open. An open tab can receive a response or run script that writes cookies/cache after clearBrowserProfileData resolves but before/after the settings update, leaving persistent data in the now-unreachable removed profile partition even though removal reports success. [ Already posted ]
• line 629: After destructive cleanup succeeds, removeProfile invokes updateSettings and immediately reports success, but client persistence is fire-and-forget and explicitly catches write failures. If setClientSettings fails (for example, storage/IPC failure), the profile reappears after restart with its cookies/cache already erased, while the UI had claimed removal succeeded. [ Already posted ]

packages/contracts/src/settings.ts — 0 comments posted, 1 evaluated, 1 filtered

• line 208: browserProfiles has no Schema.isMaxLength(BROWSER_PROFILE_MAX_COUNT) check. A hand-edited settings file (or a settings update outside the add-profile UI) with 25 or more individually valid profiles decodes successfully, even though the UI and exported limit cap profiles at 24; all excess profiles are then resolved and displayed/used. [ Out of scope (post-validation triage) ]

---

Note

Medium Risk
Changes Electron session partitioning and breaks the preview IPC surface for clear/config calls; incorrect scope mapping could mix or strand login data, though legacy Default partitions are explicitly preserved.

Overview
Adds named browser profiles so preview tabs can keep isolated cookies and storage, with built-in Default (legacy partition unchanged) and Incognito (ephemeral Chromium partition).

Contracts & server: New BrowserProfile types and client settings (browserProfiles, browserDefaultProfileId). Preview open/snapshots carry optional profileId through navigate and status updates so tabs don't silently switch partitions.

Desktop:resolvePartitionScope maps (environmentId, profileId) to partition scope (JSON tuple for non-default profiles), persistence, and a profile- partition namespace disjoint from legacy defaults. getPreviewConfig, clearCookies, and clearCache IPC now take environmentId and optional profileId; per-profile clears load the session first so cleanup works after restart. BrowserSession supports ephemeral partitions and partition-scoped clears.

Web UI: Integrations settings to create/rename/remove profiles (removal clears data across environments), default profile picker, and a Browser add-menu submenu to open a specific profile. Preview chrome shows the active profile and scopes "clear cookies/cache" to that tab's profile. Open paths (openPreviewSession, file/link opens) apply hydrated default profileId; webview config is cached per environment + profile.

^{Reviewed by Cursor Bugbot for commit f666480. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 904d0a95-7510-4028-b553-9dcda458780c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.1 KiB	−168 B (−1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.2 KiB	−172 B (−2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	54.7 KiB	−910 B (−1.6%)	66.4 KiB	✅
Codex	Live turn messages	10	8	−2 (−20.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.1 KiB	−8 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.2 KiB	−11 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: 04efa79 · PR result: f666480 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Reviewed the web UI changes (RightPanelTabs, PreviewChromeRow/PreviewView, PreviewMoreMenu, IntegrationsSettings, menu.tsx) against the shared primitive contracts. Two consistency findings, both inline.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a cross-layer browser-profile capability that changes session partitioning, cookie/login isolation, storage deletion, and the default profile used for implicit preview opens. Its new configurable product default and sensitive browser-storage behavior warrant human review.

No code changes detected at f666480. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Two findings in the changed web UI. The MenuSubTrigger icon treatment added in this revision fixes the alignment of the new Browser sub-trigger, but the selector it uses also matches the trailing chevron on the two existing icon-less sub-triggers and overrides their ms-auto.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new profile badge in the preview chrome row: the truncate cap doesn't actually ellipsize because Badge is a flex container. Everything else in scope (the MenuSubTrigger icon-column fix, the MenuGroup/MenuGroupLabel wrapping in PreviewMoreMenu, the profile list rows reusing SettingsRow/ITEM_ROW_INNER_CLASSNAME/DraftInput/Button/AlertDialog, and the Select for the default profile) follows the existing primitives and settings conventions.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One convention finding: the new browserProfile module (and its test) uses the consolidated import { Schema } from "effect" form instead of the subpath namespace import used by the rest of packages/contracts. Everything else in the diff (service interfaces on BrowserSession/PreviewManager, Schema.TaggedErrorClass errors with structural attributes, make/layer shape, dependency acquisition) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[juliusmarminge]

Adds profiles to the desktop preview browser so tabs can keep separate cookies and site data. This is the bottom of the remaining stack; the browser-access setting is already merged.

Default preserves existing login storage. Incognito uses an in-memory partition. Other profiles use a separate partition namespace with unambiguous environment/profile scoping. A tab keeps its chosen profile for its lifetime.

Settings supports creating, renaming, choosing a default, and removing profiles. Removal waits for cookie/cache cleanup across all known environments and retains the profile if cleanup fails. Existing tabs remain open after removal and are labeled “Removed profile.” The Browser menu supports opening a chosen profile, including touch input.

Validation: focused profile, preview, settings-hydration, and partition-isolation tests; web/desktop typechecks; scoped formatting and lint. Latest CI results are shown below. Earlier desktop behavior was verified by the maintainer; this audit did not run another GUI pass.

Compatibility: Default partitions are unchanged. Data created in custom profiles by an earlier unmerged version of this stack is not migrated from the collision-prone partition mapping.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

Note

Add browser profiles to the preview browser

• Introduces BrowserProfile contracts with built-in default and incognito profiles, and adds settings UI to create, rename, delete, and set the default profile
• Updates BrowserSession to support a profile namespace and ephemeral (in-memory) partitions for incognito mode, keeping legacy partitions disjoint
• Updates PreviewManager and IPC handlers to pass profileId through snapshots, config requests, and partition-scoped clearing operations
• Updates web components like RightPanelTabs to open specific profiles via a submenu, and keys previewWebviewConfigAtom by (environmentId, profileId)
• Risk: DesktopPreviewBridge.clearCookies, clearCache, and getPreviewConfig now require (environmentId, profileId?) instead of taking no arguments or just environmentId

📊 Macroscope summarized f666480. 27 files reviewed, 4 issues evaluated, 4 issues filtered, 0 comments posted

🗂️ Filtered Issues

apps/web/src/browser/previewWebviewConfigState.ts — 0 comments posted, 1 evaluated, 1 filtered

• line 77: parseConfigKey splits at the first NUL even though EnvironmentId is only a trimmed non-empty string and permits control characters. For an environment ID such as "env\u0000x", configKey produces a key which is parsed as environment "env" and profile "x\u0000..."; the webview configuration request is then made for the wrong environment/profile (and its profile value violates the profile-ID contract), so that environment cannot open its preview with the intended partition. [ Already posted ]

apps/web/src/components/settings/IntegrationsSettings.tsx — 0 comments posted, 2 evaluated, 2 filtered

• line 628: removeProfile clears the partition before it removes the profile while deliberately leaving its tabs open. An open tab can receive a response or run script that writes cookies/cache after clearBrowserProfileData resolves but before/after the settings update, leaving persistent data in the now-unreachable removed profile partition even though removal reports success. [ Already posted ]
• line 629: After destructive cleanup succeeds, removeProfile invokes updateSettings and immediately reports success, but client persistence is fire-and-forget and explicitly catches write failures. If setClientSettings fails (for example, storage/IPC failure), the profile reappears after restart with its cookies/cache already erased, while the UI had claimed removal succeeded. [ Already posted ]

packages/contracts/src/settings.ts — 0 comments posted, 1 evaluated, 1 filtered

• line 208: browserProfiles has no Schema.isMaxLength(BROWSER_PROFILE_MAX_COUNT) check. A hand-edited settings file (or a settings update outside the add-profile UI) with 25 or more individually valid profiles decodes successfully, even though the UI and exported limit cap profiles at 24; all excess profiles are then resolved and displayed/used. [ Out of scope (post-validation triage) ]

---

Note

Medium Risk
Changes Electron session partitioning and breaks the preview IPC surface for clear/config calls; incorrect scope mapping could mix or strand login data, though legacy Default partitions are explicitly preserved.

Overview
Adds named browser profiles so preview tabs can keep isolated cookies and storage, with built-in Default (legacy partition unchanged) and Incognito (ephemeral Chromium partition).

Contracts & server: New BrowserProfile types and client settings (browserProfiles, browserDefaultProfileId). Preview open/snapshots carry optional profileId through navigate and status updates so tabs don't silently switch partitions.

Desktop:resolvePartitionScope maps (environmentId, profileId) to partition scope (JSON tuple for non-default profiles), persistence, and a profile- partition namespace disjoint from legacy defaults. getPreviewConfig, clearCookies, and clearCache IPC now take environmentId and optional profileId; per-profile clears load the session first so cleanup works after restart. BrowserSession supports ephemeral partitions and partition-scoped clears.

Web UI: Integrations settings to create/rename/remove profiles (removal clears data across environments), default profile picker, and a Browser add-menu submenu to open a specific profile. Preview chrome shows the active profile and scopes "clear cookies/cache" to that tab's profile. Open paths (openPreviewSession, file/link opens) apply hydrated default profileId; webview config is cached per environment + profile.

^{Reviewed by Cursor Bugbot for commit f666480. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 904d0a95-7510-4028-b553-9dcda458780c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.1 KiB	−168 B (−1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.2 KiB	−172 B (−2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	54.7 KiB	−910 B (−1.6%)	66.4 KiB	✅
Codex	Live turn messages	10	8	−2 (−20.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.1 KiB	−8 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.2 KiB	−11 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: 04efa79 · PR result: f666480 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Reviewed the web UI changes (RightPanelTabs, PreviewChromeRow/PreviewView, PreviewMoreMenu, IntegrationsSettings, menu.tsx) against the shared primitive contracts. Two consistency findings, both inline.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a cross-layer browser-profile capability that changes session partitioning, cookie/login isolation, storage deletion, and the default profile used for implicit preview opens. Its new configurable product default and sensitive browser-storage behavior warrant human review.

No code changes detected at f666480. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Two findings in the changed web UI. The MenuSubTrigger icon treatment added in this revision fixes the alignment of the new Browser sub-trigger, but the selector it uses also matches the trailing chevron on the two existing icon-less sub-triggers and overrides their ms-auto.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new profile badge in the preview chrome row: the truncate cap doesn't actually ellipsize because Badge is a flex container. Everything else in scope (the MenuSubTrigger icon-column fix, the MenuGroup/MenuGroupLabel wrapping in PreviewMoreMenu, the profile list rows reusing SettingsRow/ITEM_ROW_INNER_CLASSNAME/DraftInput/Button/AlertDialog, and the Select for the default profile) follows the existing primitives and settings conventions.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One convention finding: the new browserProfile module (and its test) uses the consolidated import { Schema } from "effect" form instead of the subpath namespace import used by the rest of packages/contracts. Everything else in the diff (service interfaces on BrowserSession/PreviewManager, Schema.TaggedErrorClass errors with structural attributes, make/layer shape, dependency acquisition) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[juliusmarminge]

Adds profiles to the desktop preview browser so tabs can keep separate cookies and site data. This is the bottom of the remaining stack; the browser-access setting is already merged.

Default preserves existing login storage. Incognito uses an in-memory partition. Other profiles use a separate partition namespace with unambiguous environment/profile scoping. A tab keeps its chosen profile for its lifetime.

Settings supports creating, renaming, choosing a default, and removing profiles. Removal waits for cookie/cache cleanup across all known environments and retains the profile if cleanup fails. Existing tabs remain open after removal and are labeled “Removed profile.” The Browser menu supports opening a chosen profile, including touch input.

Validation: focused profile, preview, settings-hydration, and partition-isolation tests; web/desktop typechecks; scoped formatting and lint. Latest CI results are shown below. Earlier desktop behavior was verified by the maintainer; this audit did not run another GUI pass.

Compatibility: Default partitions are unchanged. Data created in custom profiles by an earlier unmerged version of this stack is not migrated from the collision-prone partition mapping.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

Note

Add browser profiles to the preview browser

• Introduces BrowserProfile contracts with built-in default and incognito profiles, and adds settings UI to create, rename, delete, and set the default profile
• Updates BrowserSession to support a profile namespace and ephemeral (in-memory) partitions for incognito mode, keeping legacy partitions disjoint
• Updates PreviewManager and IPC handlers to pass profileId through snapshots, config requests, and partition-scoped clearing operations
• Updates web components like RightPanelTabs to open specific profiles via a submenu, and keys previewWebviewConfigAtom by (environmentId, profileId)
• Risk: DesktopPreviewBridge.clearCookies, clearCache, and getPreviewConfig now require (environmentId, profileId?) instead of taking no arguments or just environmentId

📊 Macroscope summarized f666480. 27 files reviewed, 4 issues evaluated, 4 issues filtered, 0 comments posted

🗂️ Filtered Issues

apps/web/src/browser/previewWebviewConfigState.ts — 0 comments posted, 1 evaluated, 1 filtered

• line 77: parseConfigKey splits at the first NUL even though EnvironmentId is only a trimmed non-empty string and permits control characters. For an environment ID such as "env\u0000x", configKey produces a key which is parsed as environment "env" and profile "x\u0000..."; the webview configuration request is then made for the wrong environment/profile (and its profile value violates the profile-ID contract), so that environment cannot open its preview with the intended partition. [ Already posted ]

apps/web/src/components/settings/IntegrationsSettings.tsx — 0 comments posted, 2 evaluated, 2 filtered

• line 628: removeProfile clears the partition before it removes the profile while deliberately leaving its tabs open. An open tab can receive a response or run script that writes cookies/cache after clearBrowserProfileData resolves but before/after the settings update, leaving persistent data in the now-unreachable removed profile partition even though removal reports success. [ Already posted ]
• line 629: After destructive cleanup succeeds, removeProfile invokes updateSettings and immediately reports success, but client persistence is fire-and-forget and explicitly catches write failures. If setClientSettings fails (for example, storage/IPC failure), the profile reappears after restart with its cookies/cache already erased, while the UI had claimed removal succeeded. [ Already posted ]

packages/contracts/src/settings.ts — 0 comments posted, 1 evaluated, 1 filtered

• line 208: browserProfiles has no Schema.isMaxLength(BROWSER_PROFILE_MAX_COUNT) check. A hand-edited settings file (or a settings update outside the add-profile UI) with 25 or more individually valid profiles decodes successfully, even though the UI and exported limit cap profiles at 24; all excess profiles are then resolved and displayed/used. [ Out of scope (post-validation triage) ]

---

Note

Medium Risk
Changes Electron session partitioning and breaks the preview IPC surface for clear/config calls; incorrect scope mapping could mix or strand login data, though legacy Default partitions are explicitly preserved.

Overview
Adds named browser profiles so preview tabs can keep isolated cookies and storage, with built-in Default (legacy partition unchanged) and Incognito (ephemeral Chromium partition).

Contracts & server: New BrowserProfile types and client settings (browserProfiles, browserDefaultProfileId). Preview open/snapshots carry optional profileId through navigate and status updates so tabs don't silently switch partitions.

Desktop:resolvePartitionScope maps (environmentId, profileId) to partition scope (JSON tuple for non-default profiles), persistence, and a profile- partition namespace disjoint from legacy defaults. getPreviewConfig, clearCookies, and clearCache IPC now take environmentId and optional profileId; per-profile clears load the session first so cleanup works after restart. BrowserSession supports ephemeral partitions and partition-scoped clears.

Web UI: Integrations settings to create/rename/remove profiles (removal clears data across environments), default profile picker, and a Browser add-menu submenu to open a specific profile. Preview chrome shows the active profile and scopes "clear cookies/cache" to that tab's profile. Open paths (openPreviewSession, file/link opens) apply hydrated default profileId; webview config is cached per environment + profile.

^{Reviewed by Cursor Bugbot for commit f666480. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 904d0a95-7510-4028-b553-9dcda458780c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.1 KiB	−168 B (−1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.2 KiB	−172 B (−2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	54.7 KiB	−910 B (−1.6%)	66.4 KiB	✅
Codex	Live turn messages	10	8	−2 (−20.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.1 KiB	−8 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.2 KiB	−11 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: 04efa79 · PR result: f666480 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Reviewed the web UI changes (RightPanelTabs, PreviewChromeRow/PreviewView, PreviewMoreMenu, IntegrationsSettings, menu.tsx) against the shared primitive contracts. Two consistency findings, both inline.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a cross-layer browser-profile capability that changes session partitioning, cookie/login isolation, storage deletion, and the default profile used for implicit preview opens. Its new configurable product default and sensitive browser-storage behavior warrant human review.

No code changes detected at f666480. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Two findings in the changed web UI. The MenuSubTrigger icon treatment added in this revision fixes the alignment of the new Browser sub-trigger, but the selector it uses also matches the trailing chevron on the two existing icon-less sub-triggers and overrides their ms-auto.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new profile badge in the preview chrome row: the truncate cap doesn't actually ellipsize because Badge is a flex container. Everything else in scope (the MenuSubTrigger icon-column fix, the MenuGroup/MenuGroupLabel wrapping in PreviewMoreMenu, the profile list rows reusing SettingsRow/ITEM_ROW_INNER_CLASSNAME/DraftInput/Button/AlertDialog, and the Select for the default profile) follows the existing primitives and settings conventions.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One convention finding: the new browserProfile module (and its test) uses the consolidated import { Schema } from "effect" form instead of the subpath namespace import used by the rest of packages/contracts. Everything else in the diff (service interfaces on BrowserSession/PreviewManager, Schema.TaggedErrorClass errors with structural attributes, make/layer shape, dependency acquisition) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[juliusmarminge]

Adds profiles to the desktop preview browser so tabs can keep separate cookies and site data. This is the bottom of the remaining stack; the browser-access setting is already merged.

Default preserves existing login storage. Incognito uses an in-memory partition. Other profiles use a separate partition namespace with unambiguous environment/profile scoping. A tab keeps its chosen profile for its lifetime.

Settings supports creating, renaming, choosing a default, and removing profiles. Removal waits for cookie/cache cleanup across all known environments and retains the profile if cleanup fails. Existing tabs remain open after removal and are labeled “Removed profile.” The Browser menu supports opening a chosen profile, including touch input.

Validation: focused profile, preview, settings-hydration, and partition-isolation tests; web/desktop typechecks; scoped formatting and lint. Latest CI results are shown below. Earlier desktop behavior was verified by the maintainer; this audit did not run another GUI pass.

Compatibility: Default partitions are unchanged. Data created in custom profiles by an earlier unmerged version of this stack is not migrated from the collision-prone partition mapping.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

Note

Add browser profiles to the preview browser

• Introduces BrowserProfile contracts with built-in default and incognito profiles, and adds settings UI to create, rename, delete, and set the default profile
• Updates BrowserSession to support a profile namespace and ephemeral (in-memory) partitions for incognito mode, keeping legacy partitions disjoint
• Updates PreviewManager and IPC handlers to pass profileId through snapshots, config requests, and partition-scoped clearing operations
• Updates web components like RightPanelTabs to open specific profiles via a submenu, and keys previewWebviewConfigAtom by (environmentId, profileId)
• Risk: DesktopPreviewBridge.clearCookies, clearCache, and getPreviewConfig now require (environmentId, profileId?) instead of taking no arguments or just environmentId

📊 Macroscope summarized f666480. 27 files reviewed, 4 issues evaluated, 4 issues filtered, 0 comments posted

🗂️ Filtered Issues

apps/web/src/browser/previewWebviewConfigState.ts — 0 comments posted, 1 evaluated, 1 filtered

• line 77: parseConfigKey splits at the first NUL even though EnvironmentId is only a trimmed non-empty string and permits control characters. For an environment ID such as "env\u0000x", configKey produces a key which is parsed as environment "env" and profile "x\u0000..."; the webview configuration request is then made for the wrong environment/profile (and its profile value violates the profile-ID contract), so that environment cannot open its preview with the intended partition. [ Already posted ]

apps/web/src/components/settings/IntegrationsSettings.tsx — 0 comments posted, 2 evaluated, 2 filtered

• line 628: removeProfile clears the partition before it removes the profile while deliberately leaving its tabs open. An open tab can receive a response or run script that writes cookies/cache after clearBrowserProfileData resolves but before/after the settings update, leaving persistent data in the now-unreachable removed profile partition even though removal reports success. [ Already posted ]
• line 629: After destructive cleanup succeeds, removeProfile invokes updateSettings and immediately reports success, but client persistence is fire-and-forget and explicitly catches write failures. If setClientSettings fails (for example, storage/IPC failure), the profile reappears after restart with its cookies/cache already erased, while the UI had claimed removal succeeded. [ Already posted ]

packages/contracts/src/settings.ts — 0 comments posted, 1 evaluated, 1 filtered

• line 208: browserProfiles has no Schema.isMaxLength(BROWSER_PROFILE_MAX_COUNT) check. A hand-edited settings file (or a settings update outside the add-profile UI) with 25 or more individually valid profiles decodes successfully, even though the UI and exported limit cap profiles at 24; all excess profiles are then resolved and displayed/used. [ Out of scope (post-validation triage) ]

---

Note

Medium Risk
Changes Electron session partitioning and breaks the preview IPC surface for clear/config calls; incorrect scope mapping could mix or strand login data, though legacy Default partitions are explicitly preserved.

Overview
Adds named browser profiles so preview tabs can keep isolated cookies and storage, with built-in Default (legacy partition unchanged) and Incognito (ephemeral Chromium partition).

Contracts & server: New BrowserProfile types and client settings (browserProfiles, browserDefaultProfileId). Preview open/snapshots carry optional profileId through navigate and status updates so tabs don't silently switch partitions.

Desktop:resolvePartitionScope maps (environmentId, profileId) to partition scope (JSON tuple for non-default profiles), persistence, and a profile- partition namespace disjoint from legacy defaults. getPreviewConfig, clearCookies, and clearCache IPC now take environmentId and optional profileId; per-profile clears load the session first so cleanup works after restart. BrowserSession supports ephemeral partitions and partition-scoped clears.

Web UI: Integrations settings to create/rename/remove profiles (removal clears data across environments), default profile picker, and a Browser add-menu submenu to open a specific profile. Preview chrome shows the active profile and scopes "clear cookies/cache" to that tab's profile. Open paths (openPreviewSession, file/link opens) apply hydrated default profileId; webview config is cached per environment + profile.

^{Reviewed by Cursor Bugbot for commit f666480. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 904d0a95-7510-4028-b553-9dcda458780c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.1 KiB	−168 B (−1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.2 KiB	−172 B (−2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	54.7 KiB	−910 B (−1.6%)	66.4 KiB	✅
Codex	Live turn messages	10	8	−2 (−20.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.1 KiB	−8 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.2 KiB	−11 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: 04efa79 · PR result: f666480 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Reviewed the web UI changes (RightPanelTabs, PreviewChromeRow/PreviewView, PreviewMoreMenu, IntegrationsSettings, menu.tsx) against the shared primitive contracts. Two consistency findings, both inline.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a cross-layer browser-profile capability that changes session partitioning, cookie/login isolation, storage deletion, and the default profile used for implicit preview opens. Its new configurable product default and sensitive browser-storage behavior warrant human review.

No code changes detected at f666480. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Two findings in the changed web UI. The MenuSubTrigger icon treatment added in this revision fixes the alignment of the new Browser sub-trigger, but the selector it uses also matches the trailing chevron on the two existing icon-less sub-triggers and overrides their ms-auto.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new profile badge in the preview chrome row: the truncate cap doesn't actually ellipsize because Badge is a flex container. Everything else in scope (the MenuSubTrigger icon-column fix, the MenuGroup/MenuGroupLabel wrapping in PreviewMoreMenu, the profile list rows reusing SettingsRow/ITEM_ROW_INNER_CLASSNAME/DraftInput/Button/AlertDialog, and the Select for the default profile) follows the existing primitives and settings conventions.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One convention finding: the new browserProfile module (and its test) uses the consolidated import { Schema } from "effect" form instead of the subpath namespace import used by the rest of packages/contracts. Everything else in the diff (service interfaces on BrowserSession/PreviewManager, Schema.TaggedErrorClass errors with structural attributes, make/layer shape, dependency acquisition) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[juliusmarminge]

Adds profiles to the desktop preview browser so tabs can keep separate cookies and site data. This is the bottom of the remaining stack; the browser-access setting is already merged.

Default preserves existing login storage. Incognito uses an in-memory partition. Other profiles use a separate partition namespace with unambiguous environment/profile scoping. A tab keeps its chosen profile for its lifetime.

Settings supports creating, renaming, choosing a default, and removing profiles. Removal waits for cookie/cache cleanup across all known environments and retains the profile if cleanup fails. Existing tabs remain open after removal and are labeled “Removed profile.” The Browser menu supports opening a chosen profile, including touch input.

Validation: focused profile, preview, settings-hydration, and partition-isolation tests; web/desktop typechecks; scoped formatting and lint. Latest CI results are shown below. Earlier desktop behavior was verified by the maintainer; this audit did not run another GUI pass.

Compatibility: Default partitions are unchanged. Data created in custom profiles by an earlier unmerged version of this stack is not migrated from the collision-prone partition mapping.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

Note

Add browser profiles to the preview browser

• Introduces BrowserProfile contracts with built-in default and incognito profiles, and adds settings UI to create, rename, delete, and set the default profile
• Updates BrowserSession to support a profile namespace and ephemeral (in-memory) partitions for incognito mode, keeping legacy partitions disjoint
• Updates PreviewManager and IPC handlers to pass profileId through snapshots, config requests, and partition-scoped clearing operations
• Updates web components like RightPanelTabs to open specific profiles via a submenu, and keys previewWebviewConfigAtom by (environmentId, profileId)
• Risk: DesktopPreviewBridge.clearCookies, clearCache, and getPreviewConfig now require (environmentId, profileId?) instead of taking no arguments or just environmentId

📊 Macroscope summarized f666480. 27 files reviewed, 4 issues evaluated, 4 issues filtered, 0 comments posted

🗂️ Filtered Issues

apps/web/src/browser/previewWebviewConfigState.ts — 0 comments posted, 1 evaluated, 1 filtered

• line 77: parseConfigKey splits at the first NUL even though EnvironmentId is only a trimmed non-empty string and permits control characters. For an environment ID such as "env\u0000x", configKey produces a key which is parsed as environment "env" and profile "x\u0000..."; the webview configuration request is then made for the wrong environment/profile (and its profile value violates the profile-ID contract), so that environment cannot open its preview with the intended partition. [ Already posted ]

apps/web/src/components/settings/IntegrationsSettings.tsx — 0 comments posted, 2 evaluated, 2 filtered

• line 628: removeProfile clears the partition before it removes the profile while deliberately leaving its tabs open. An open tab can receive a response or run script that writes cookies/cache after clearBrowserProfileData resolves but before/after the settings update, leaving persistent data in the now-unreachable removed profile partition even though removal reports success. [ Already posted ]
• line 629: After destructive cleanup succeeds, removeProfile invokes updateSettings and immediately reports success, but client persistence is fire-and-forget and explicitly catches write failures. If setClientSettings fails (for example, storage/IPC failure), the profile reappears after restart with its cookies/cache already erased, while the UI had claimed removal succeeded. [ Already posted ]

packages/contracts/src/settings.ts — 0 comments posted, 1 evaluated, 1 filtered

• line 208: browserProfiles has no Schema.isMaxLength(BROWSER_PROFILE_MAX_COUNT) check. A hand-edited settings file (or a settings update outside the add-profile UI) with 25 or more individually valid profiles decodes successfully, even though the UI and exported limit cap profiles at 24; all excess profiles are then resolved and displayed/used. [ Out of scope (post-validation triage) ]

---

Note

Medium Risk
Changes Electron session partitioning and breaks the preview IPC surface for clear/config calls; incorrect scope mapping could mix or strand login data, though legacy Default partitions are explicitly preserved.

Overview
Adds named browser profiles so preview tabs can keep isolated cookies and storage, with built-in Default (legacy partition unchanged) and Incognito (ephemeral Chromium partition).

Contracts & server: New BrowserProfile types and client settings (browserProfiles, browserDefaultProfileId). Preview open/snapshots carry optional profileId through navigate and status updates so tabs don't silently switch partitions.

Desktop:resolvePartitionScope maps (environmentId, profileId) to partition scope (JSON tuple for non-default profiles), persistence, and a profile- partition namespace disjoint from legacy defaults. getPreviewConfig, clearCookies, and clearCache IPC now take environmentId and optional profileId; per-profile clears load the session first so cleanup works after restart. BrowserSession supports ephemeral partitions and partition-scoped clears.

Web UI: Integrations settings to create/rename/remove profiles (removal clears data across environments), default profile picker, and a Browser add-menu submenu to open a specific profile. Preview chrome shows the active profile and scopes "clear cookies/cache" to that tab's profile. Open paths (openPreviewSession, file/link opens) apply hydrated default profileId; webview config is cached per environment + profile.

^{Reviewed by Cursor Bugbot for commit f666480. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 904d0a95-7510-4028-b553-9dcda458780c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.1 KiB	−168 B (−1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.2 KiB	−172 B (−2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	54.7 KiB	−910 B (−1.6%)	66.4 KiB	✅
Codex	Live turn messages	10	8	−2 (−20.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.1 KiB	−8 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.2 KiB	−11 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: 04efa79 · PR result: f666480 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Reviewed the web UI changes (RightPanelTabs, PreviewChromeRow/PreviewView, PreviewMoreMenu, IntegrationsSettings, menu.tsx) against the shared primitive contracts. Two consistency findings, both inline.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a cross-layer browser-profile capability that changes session partitioning, cookie/login isolation, storage deletion, and the default profile used for implicit preview opens. Its new configurable product default and sensitive browser-storage behavior warrant human review.

No code changes detected at f666480. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Two findings in the changed web UI. The MenuSubTrigger icon treatment added in this revision fixes the alignment of the new Browser sub-trigger, but the selector it uses also matches the trailing chevron on the two existing icon-less sub-triggers and overrides their ms-auto.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new profile badge in the preview chrome row: the truncate cap doesn't actually ellipsize because Badge is a flex container. Everything else in scope (the MenuSubTrigger icon-column fix, the MenuGroup/MenuGroupLabel wrapping in PreviewMoreMenu, the profile list rows reusing SettingsRow/ITEM_ROW_INNER_CLASSNAME/DraftInput/Button/AlertDialog, and the Select for the default profile) follows the existing primitives and settings conventions.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One convention finding: the new browserProfile module (and its test) uses the consolidated import { Schema } from "effect" form instead of the subpath namespace import used by the rest of packages/contracts. Everything else in the diff (service interfaces on BrowserSession/PreviewManager, Schema.TaggedErrorClass errors with structural attributes, make/layer shape, dependency acquisition) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[juliusmarminge]

Adds profiles to the desktop preview browser so tabs can keep separate cookies and site data. This is the bottom of the remaining stack; the browser-access setting is already merged.

Default preserves existing login storage. Incognito uses an in-memory partition. Other profiles use a separate partition namespace with unambiguous environment/profile scoping. A tab keeps its chosen profile for its lifetime.

Settings supports creating, renaming, choosing a default, and removing profiles. Removal waits for cookie/cache cleanup across all known environments and retains the profile if cleanup fails. Existing tabs remain open after removal and are labeled “Removed profile.” The Browser menu supports opening a chosen profile, including touch input.

Validation: focused profile, preview, settings-hydration, and partition-isolation tests; web/desktop typechecks; scoped formatting and lint. Latest CI results are shown below. Earlier desktop behavior was verified by the maintainer; this audit did not run another GUI pass.

Compatibility: Default partitions are unchanged. Data created in custom profiles by an earlier unmerged version of this stack is not migrated from the collision-prone partition mapping.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

Note

Add browser profiles to the preview browser

• Introduces BrowserProfile contracts with built-in default and incognito profiles, and adds settings UI to create, rename, delete, and set the default profile
• Updates BrowserSession to support a profile namespace and ephemeral (in-memory) partitions for incognito mode, keeping legacy partitions disjoint
• Updates PreviewManager and IPC handlers to pass profileId through snapshots, config requests, and partition-scoped clearing operations
• Updates web components like RightPanelTabs to open specific profiles via a submenu, and keys previewWebviewConfigAtom by (environmentId, profileId)
• Risk: DesktopPreviewBridge.clearCookies, clearCache, and getPreviewConfig now require (environmentId, profileId?) instead of taking no arguments or just environmentId

📊 Macroscope summarized f666480. 27 files reviewed, 4 issues evaluated, 4 issues filtered, 0 comments posted

🗂️ Filtered Issues

apps/web/src/browser/previewWebviewConfigState.ts — 0 comments posted, 1 evaluated, 1 filtered

• line 77: parseConfigKey splits at the first NUL even though EnvironmentId is only a trimmed non-empty string and permits control characters. For an environment ID such as "env\u0000x", configKey produces a key which is parsed as environment "env" and profile "x\u0000..."; the webview configuration request is then made for the wrong environment/profile (and its profile value violates the profile-ID contract), so that environment cannot open its preview with the intended partition. [ Already posted ]

apps/web/src/components/settings/IntegrationsSettings.tsx — 0 comments posted, 2 evaluated, 2 filtered

• line 628: removeProfile clears the partition before it removes the profile while deliberately leaving its tabs open. An open tab can receive a response or run script that writes cookies/cache after clearBrowserProfileData resolves but before/after the settings update, leaving persistent data in the now-unreachable removed profile partition even though removal reports success. [ Already posted ]
• line 629: After destructive cleanup succeeds, removeProfile invokes updateSettings and immediately reports success, but client persistence is fire-and-forget and explicitly catches write failures. If setClientSettings fails (for example, storage/IPC failure), the profile reappears after restart with its cookies/cache already erased, while the UI had claimed removal succeeded. [ Already posted ]

packages/contracts/src/settings.ts — 0 comments posted, 1 evaluated, 1 filtered

• line 208: browserProfiles has no Schema.isMaxLength(BROWSER_PROFILE_MAX_COUNT) check. A hand-edited settings file (or a settings update outside the add-profile UI) with 25 or more individually valid profiles decodes successfully, even though the UI and exported limit cap profiles at 24; all excess profiles are then resolved and displayed/used. [ Out of scope (post-validation triage) ]

---

Note

Medium Risk
Changes Electron session partitioning and breaks the preview IPC surface for clear/config calls; incorrect scope mapping could mix or strand login data, though legacy Default partitions are explicitly preserved.

Overview
Adds named browser profiles so preview tabs can keep isolated cookies and storage, with built-in Default (legacy partition unchanged) and Incognito (ephemeral Chromium partition).

Contracts & server: New BrowserProfile types and client settings (browserProfiles, browserDefaultProfileId). Preview open/snapshots carry optional profileId through navigate and status updates so tabs don't silently switch partitions.

Desktop:resolvePartitionScope maps (environmentId, profileId) to partition scope (JSON tuple for non-default profiles), persistence, and a profile- partition namespace disjoint from legacy defaults. getPreviewConfig, clearCookies, and clearCache IPC now take environmentId and optional profileId; per-profile clears load the session first so cleanup works after restart. BrowserSession supports ephemeral partitions and partition-scoped clears.

Web UI: Integrations settings to create/rename/remove profiles (removal clears data across environments), default profile picker, and a Browser add-menu submenu to open a specific profile. Preview chrome shows the active profile and scopes "clear cookies/cache" to that tab's profile. Open paths (openPreviewSession, file/link opens) apply hydrated default profileId; webview config is cached per environment + profile.

^{Reviewed by Cursor Bugbot for commit f666480. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 904d0a95-7510-4028-b553-9dcda458780c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.1 KiB	−168 B (−1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.2 KiB	−172 B (−2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	54.7 KiB	−910 B (−1.6%)	66.4 KiB	✅
Codex	Live turn messages	10	8	−2 (−20.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.1 KiB	−8 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.2 KiB	−11 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: 04efa79 · PR result: f666480 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Reviewed the web UI changes (RightPanelTabs, PreviewChromeRow/PreviewView, PreviewMoreMenu, IntegrationsSettings, menu.tsx) against the shared primitive contracts. Two consistency findings, both inline.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a cross-layer browser-profile capability that changes session partitioning, cookie/login isolation, storage deletion, and the default profile used for implicit preview opens. Its new configurable product default and sensitive browser-storage behavior warrant human review.

No code changes detected at f666480. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Two findings in the changed web UI. The MenuSubTrigger icon treatment added in this revision fixes the alignment of the new Browser sub-trigger, but the selector it uses also matches the trailing chevron on the two existing icon-less sub-triggers and overrides their ms-auto.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new profile badge in the preview chrome row: the truncate cap doesn't actually ellipsize because Badge is a flex container. Everything else in scope (the MenuSubTrigger icon-column fix, the MenuGroup/MenuGroupLabel wrapping in PreviewMoreMenu, the profile list rows reusing SettingsRow/ITEM_ROW_INNER_CLASSNAME/DraftInput/Button/AlertDialog, and the Select for the default profile) follows the existing primitives and settings conventions.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One convention finding: the new browserProfile module (and its test) uses the consolidated import { Schema } from "effect" form instead of the subpath namespace import used by the rest of packages/contracts. Everything else in the diff (service interfaces on BrowserSession/PreviewManager, Schema.TaggedErrorClass errors with structural attributes, make/layer shape, dependency acquisition) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}