189 lines
7.7 KiB
Python
189 lines
7.7 KiB
Python
"""Browser Use cloud browser provider (plugin form).
|
|
|
|
Browser Use is the only browser backend with dual auth: a direct
|
|
``BROWSER_USE_API_KEY`` for self-billed users, or the managed Nous tool gateway
|
|
(bills sessions to a Nous subscription). Dispatch order: direct key first,
|
|
managed gateway second, unless ``tool_gateway.browser: gateway`` flips it.
|
|
|
|
Config: ``browser.cloud_provider: "browser-use"``; ``tool_gateway.browser``.
|
|
Auth: ``BROWSER_USE_API_KEY`` (https://browser-use.com) or a managed Nous
|
|
gateway entry configured via ``hermes setup``.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import logging
|
|
import threading
|
|
import uuid
|
|
from typing import Any, Dict, Optional
|
|
|
|
import requests
|
|
|
|
from agent.secret_scope import get_secret
|
|
from plugins.browser._common import CloudBrowserProvider
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
# Idempotency keys for managed-mode session creation: the gateway returns 409
|
|
# "already in progress" on retried POSTs, so we forward the original key.
|
|
# Cleared on success or terminal failure.
|
|
_pending_create_keys: Dict[str, str] = {}
|
|
_pending_create_keys_lock = threading.Lock()
|
|
|
|
_BASE_URL = "https://api.browser-use.com/api/v3"
|
|
_DEFAULT_MANAGED_TIMEOUT_MINUTES = 5
|
|
_DEFAULT_MANAGED_PROXY_COUNTRY_CODE = "us"
|
|
|
|
|
|
def _get_or_create_pending_create_key(task_id: str) -> str:
|
|
with _pending_create_keys_lock:
|
|
existing = _pending_create_keys.get(task_id)
|
|
if existing:
|
|
return existing
|
|
created = f"browser-use-session-create:{uuid.uuid4().hex}"
|
|
_pending_create_keys[task_id] = created
|
|
return created
|
|
|
|
|
|
def _clear_pending_create_key(task_id: str) -> None:
|
|
with _pending_create_keys_lock:
|
|
_pending_create_keys.pop(task_id, None)
|
|
|
|
|
|
def _should_preserve_pending_create_key(response: requests.Response) -> bool:
|
|
"""Keep the idempotency key when the failure is retryable: any 5xx, or a 409
|
|
whose error message says the original request is still in flight. Any other
|
|
4xx (auth, bad request) will not succeed on retry, so the key is dropped."""
|
|
if response.status_code >= 500:
|
|
return True
|
|
if response.status_code != 409:
|
|
return False
|
|
try:
|
|
payload = response.json()
|
|
except Exception:
|
|
return False
|
|
if not isinstance(payload, dict):
|
|
return False
|
|
error = payload.get("error")
|
|
if not isinstance(error, dict):
|
|
return False
|
|
return "already in progress" in str(error.get("message") or "").lower()
|
|
|
|
|
|
class BrowserUseBrowserProvider(CloudBrowserProvider):
|
|
"""Browser Use (https://browser-use.com) cloud browser backend."""
|
|
|
|
provider_id = "browser-use"
|
|
label = "Browser Use"
|
|
release_method = "patch"
|
|
release_path = "/browsers/{session_id}"
|
|
# Hidden from the hermes tools picker: the "Browser Use" row activates the
|
|
# CLI backend (tools/browser_use_cli.py). This provider stays registered for
|
|
# the Nous gateway path and un-migrated legacy cloud_provider configs.
|
|
setup_tag = None
|
|
|
|
def is_available(self) -> bool:
|
|
return self._get_config_or_none(refresh_token=False) is not None
|
|
|
|
def _get_config_or_none(self, *, refresh_token: bool = True) -> Optional[Dict[str, Any]]:
|
|
# Lazy import: managed_tool_gateway pulls in the Nous auth stack, which
|
|
# direct-API-key users never need.
|
|
from tools.managed_tool_gateway import peek_nous_access_token, resolve_managed_tool_gateway
|
|
from tools.tool_backend_helpers import NOUS_MANAGED_PROVIDER, read_selection
|
|
|
|
def _managed_config() -> Optional[Dict[str, Any]]:
|
|
# Keep availability scans off the synchronous OAuth refresh path.
|
|
managed = resolve_managed_tool_gateway(
|
|
"browser-use", token_reader=None if refresh_token else peek_nous_access_token
|
|
)
|
|
if managed is None:
|
|
return None
|
|
return {
|
|
"api_key": managed.nous_user_token,
|
|
"base_url": managed.gateway_origin.rstrip("/"),
|
|
"managed_mode": True,
|
|
}
|
|
|
|
api_key = get_secret("BROWSER_USE_API_KEY")
|
|
selected = read_selection("browser")
|
|
direct = {"api_key": api_key, "base_url": _BASE_URL, "managed_mode": False}
|
|
|
|
# Strict selection: "nous" (or legacy use_gateway: true) → managed gateway
|
|
# ONLY; any other stored selection → direct key ONLY (no silent managed
|
|
# fallback); never-configured → direct key when present, else managed.
|
|
if selected == NOUS_MANAGED_PROVIDER:
|
|
return _managed_config()
|
|
if selected is not None:
|
|
return direct if api_key else None
|
|
return direct if api_key else _managed_config()
|
|
|
|
def _get_config(self) -> Dict[str, Any]:
|
|
from tools.tool_backend_helpers import (
|
|
NOUS_MANAGED_PROVIDER, managed_nous_tools_enabled, read_selection, selection_error,
|
|
)
|
|
|
|
config = self._get_config_or_none()
|
|
if config is not None:
|
|
return config
|
|
selected = read_selection("browser")
|
|
if selected == NOUS_MANAGED_PROVIDER:
|
|
raise ValueError(selection_error(
|
|
"browser", NOUS_MANAGED_PROVIDER,
|
|
"the Nous Tool Gateway is not available (not entitled or unreachable)",
|
|
))
|
|
if selected is not None:
|
|
raise ValueError(selection_error("browser", selected, "BROWSER_USE_API_KEY is not set"))
|
|
if managed_nous_tools_enabled():
|
|
raise ValueError(
|
|
"Browser Use requires either a direct BROWSER_USE_API_KEY "
|
|
"credential or a managed Browser Use gateway configuration."
|
|
)
|
|
raise ValueError("Browser Use requires a direct BROWSER_USE_API_KEY credential.")
|
|
|
|
def _headers(self, config: Dict[str, Any]) -> Dict[str, str]:
|
|
return {"Content-Type": "application/json", "X-Browser-Use-API-Key": config["api_key"]}
|
|
|
|
def _release_body(self, config: Dict[str, Any]) -> Dict[str, object]:
|
|
return {"action": "stop"}
|
|
|
|
def create_session(self, task_id: str) -> Dict[str, object]:
|
|
config = self._get_config()
|
|
managed_mode = bool(config.get("managed_mode"))
|
|
|
|
headers = self._headers(config)
|
|
if managed_mode:
|
|
headers["X-Idempotency-Key"] = _get_or_create_pending_create_key(task_id)
|
|
|
|
# Keep gateway-backed sessions short so billing authorization does not
|
|
# default to a long Browser-Use timeout for a task-scoped browser.
|
|
payload = (
|
|
{"timeout": _DEFAULT_MANAGED_TIMEOUT_MINUTES, "proxyCountryCode": _DEFAULT_MANAGED_PROXY_COUNTRY_CODE}
|
|
if managed_mode else {}
|
|
)
|
|
|
|
# Managed mode propagates network errors raw so callers can retry with
|
|
# the preserved idempotency key; direct mode wraps them.
|
|
response = self._post_create(
|
|
f"{config['base_url']}/browsers", headers, payload, wrap_errors=not managed_mode
|
|
)
|
|
if not response.ok and managed_mode and not _should_preserve_pending_create_key(response):
|
|
_clear_pending_create_key(task_id)
|
|
self._check_created(response)
|
|
|
|
session_data = response.json()
|
|
if managed_mode:
|
|
_clear_pending_create_key(task_id)
|
|
session_name = self._session_name(task_id)
|
|
logger.info("Created Browser Use session %s", session_name)
|
|
|
|
return {
|
|
"session_name": session_name,
|
|
"bb_session_id": session_data["id"],
|
|
"cdp_url": session_data.get("cdpUrl") or session_data.get("connectUrl") or "",
|
|
# Sessions have a fixed server-side lifetime; preserve the API's
|
|
# authority so the dispatcher retires an expired CDP endpoint.
|
|
"expires_at": session_data.get("timeoutAt"),
|
|
"features": {"browser_use": True},
|
|
"external_call_id": response.headers.get("x-external-call-id") if managed_mode else None,
|
|
}
|