Files
hermes-agent/plugins/browser/browser_use/provider.py

189 lines
7.7 KiB
Python

"""Browser Use cloud browser provider (plugin form).
Browser Use is the only browser backend with dual auth: a direct
``BROWSER_USE_API_KEY`` for self-billed users, or the managed Nous tool gateway
(bills sessions to a Nous subscription). Dispatch order: direct key first,
managed gateway second, unless ``tool_gateway.browser: gateway`` flips it.
Config: ``browser.cloud_provider: "browser-use"``; ``tool_gateway.browser``.
Auth: ``BROWSER_USE_API_KEY`` (https://browser-use.com) or a managed Nous
gateway entry configured via ``hermes setup``.
"""
from __future__ import annotations
import logging
import threading
import uuid
from typing import Any, Dict, Optional
import requests
from agent.secret_scope import get_secret
from plugins.browser._common import CloudBrowserProvider
logger = logging.getLogger(__name__)
# Idempotency keys for managed-mode session creation: the gateway returns 409
# "already in progress" on retried POSTs, so we forward the original key.
# Cleared on success or terminal failure.
_pending_create_keys: Dict[str, str] = {}
_pending_create_keys_lock = threading.Lock()
_BASE_URL = "https://api.browser-use.com/api/v3"
_DEFAULT_MANAGED_TIMEOUT_MINUTES = 5
_DEFAULT_MANAGED_PROXY_COUNTRY_CODE = "us"
def _get_or_create_pending_create_key(task_id: str) -> str:
with _pending_create_keys_lock:
existing = _pending_create_keys.get(task_id)
if existing:
return existing
created = f"browser-use-session-create:{uuid.uuid4().hex}"
_pending_create_keys[task_id] = created
return created
def _clear_pending_create_key(task_id: str) -> None:
with _pending_create_keys_lock:
_pending_create_keys.pop(task_id, None)
def _should_preserve_pending_create_key(response: requests.Response) -> bool:
"""Keep the idempotency key when the failure is retryable: any 5xx, or a 409
whose error message says the original request is still in flight. Any other
4xx (auth, bad request) will not succeed on retry, so the key is dropped."""
if response.status_code >= 500:
return True
if response.status_code != 409:
return False
try:
payload = response.json()
except Exception:
return False
if not isinstance(payload, dict):
return False
error = payload.get("error")
if not isinstance(error, dict):
return False
return "already in progress" in str(error.get("message") or "").lower()
class BrowserUseBrowserProvider(CloudBrowserProvider):
"""Browser Use (https://browser-use.com) cloud browser backend."""
provider_id = "browser-use"
label = "Browser Use"
release_method = "patch"
release_path = "/browsers/{session_id}"
# Hidden from the hermes tools picker: the "Browser Use" row activates the
# CLI backend (tools/browser_use_cli.py). This provider stays registered for
# the Nous gateway path and un-migrated legacy cloud_provider configs.
setup_tag = None
def is_available(self) -> bool:
return self._get_config_or_none(refresh_token=False) is not None
def _get_config_or_none(self, *, refresh_token: bool = True) -> Optional[Dict[str, Any]]:
# Lazy import: managed_tool_gateway pulls in the Nous auth stack, which
# direct-API-key users never need.
from tools.managed_tool_gateway import peek_nous_access_token, resolve_managed_tool_gateway
from tools.tool_backend_helpers import NOUS_MANAGED_PROVIDER, read_selection
def _managed_config() -> Optional[Dict[str, Any]]:
# Keep availability scans off the synchronous OAuth refresh path.
managed = resolve_managed_tool_gateway(
"browser-use", token_reader=None if refresh_token else peek_nous_access_token
)
if managed is None:
return None
return {
"api_key": managed.nous_user_token,
"base_url": managed.gateway_origin.rstrip("/"),
"managed_mode": True,
}
api_key = get_secret("BROWSER_USE_API_KEY")
selected = read_selection("browser")
direct = {"api_key": api_key, "base_url": _BASE_URL, "managed_mode": False}
# Strict selection: "nous" (or legacy use_gateway: true) → managed gateway
# ONLY; any other stored selection → direct key ONLY (no silent managed
# fallback); never-configured → direct key when present, else managed.
if selected == NOUS_MANAGED_PROVIDER:
return _managed_config()
if selected is not None:
return direct if api_key else None
return direct if api_key else _managed_config()
def _get_config(self) -> Dict[str, Any]:
from tools.tool_backend_helpers import (
NOUS_MANAGED_PROVIDER, managed_nous_tools_enabled, read_selection, selection_error,
)
config = self._get_config_or_none()
if config is not None:
return config
selected = read_selection("browser")
if selected == NOUS_MANAGED_PROVIDER:
raise ValueError(selection_error(
"browser", NOUS_MANAGED_PROVIDER,
"the Nous Tool Gateway is not available (not entitled or unreachable)",
))
if selected is not None:
raise ValueError(selection_error("browser", selected, "BROWSER_USE_API_KEY is not set"))
if managed_nous_tools_enabled():
raise ValueError(
"Browser Use requires either a direct BROWSER_USE_API_KEY "
"credential or a managed Browser Use gateway configuration."
)
raise ValueError("Browser Use requires a direct BROWSER_USE_API_KEY credential.")
def _headers(self, config: Dict[str, Any]) -> Dict[str, str]:
return {"Content-Type": "application/json", "X-Browser-Use-API-Key": config["api_key"]}
def _release_body(self, config: Dict[str, Any]) -> Dict[str, object]:
return {"action": "stop"}
def create_session(self, task_id: str) -> Dict[str, object]:
config = self._get_config()
managed_mode = bool(config.get("managed_mode"))
headers = self._headers(config)
if managed_mode:
headers["X-Idempotency-Key"] = _get_or_create_pending_create_key(task_id)
# Keep gateway-backed sessions short so billing authorization does not
# default to a long Browser-Use timeout for a task-scoped browser.
payload = (
{"timeout": _DEFAULT_MANAGED_TIMEOUT_MINUTES, "proxyCountryCode": _DEFAULT_MANAGED_PROXY_COUNTRY_CODE}
if managed_mode else {}
)
# Managed mode propagates network errors raw so callers can retry with
# the preserved idempotency key; direct mode wraps them.
response = self._post_create(
f"{config['base_url']}/browsers", headers, payload, wrap_errors=not managed_mode
)
if not response.ok and managed_mode and not _should_preserve_pending_create_key(response):
_clear_pending_create_key(task_id)
self._check_created(response)
session_data = response.json()
if managed_mode:
_clear_pending_create_key(task_id)
session_name = self._session_name(task_id)
logger.info("Created Browser Use session %s", session_name)
return {
"session_name": session_name,
"bb_session_id": session_data["id"],
"cdp_url": session_data.get("cdpUrl") or session_data.get("connectUrl") or "",
# Sessions have a fixed server-side lifetime; preserve the API's
# authority so the dispatcher retires an expired CDP endpoint.
"expires_at": session_data.get("timeoutAt"),
"features": {"browser_use": True},
"external_call_id": response.headers.get("x-external-call-id") if managed_mode else None,
}