feat(deploy): add Agent Browser verification command#35
Conversation
Add `codra deploy verify <url>` to shell out to agent-browser check, validate public URLs, map pass/warn/fail to exit codes, and document the post-deploy verification flow.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 364053c7e0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| }) | ||
| .unwrap_or(authority.len()); | ||
|
|
||
| let host = &authority[..host_end]; |
There was a problem hiding this comment.
When the deploy verifier is used on untrusted or pasted URLs, this parser keeps the entire authority before the port as the host, so https://example.com@127.0.0.1/ passes assert_safe_url because example.com@127.0.0.1 is not recognized as a private IPv4 address. Browsers and HTTP clients interpret the part after @ as the actual host, so this bypasses the new localhost/private-network block and lets agent-browser navigate to loopback/internal services despite the documented safety default.
Useful? React with 👍 / 👎.
| let mut args = vec
When agent-browser is missing, the only recovery command printed here sends users to @talocode/agent-browser, but the Agent Browser installation docs list the global package as agent-browser (npm install -g agent-browser, followed by agent-browser install; see https://agent-browser.dev/installation). In the missing-binary path this leaves users with install guidance that does not install the documented CLI binary, so they cannot recover from the error by following Codra's message.
Useful? React with 👍 / 👎.
| let without_brackets = normalized.trim_matches(&['[', ']'][..]); | ||
| if without_brackets.starts_with("fc") || without_brackets.starts_with("fd") { | ||
| return true; | ||
| } |
There was a problem hiding this comment.
When the target is written as an IPv4-mapped IPv6 literal such as http://[::ffff:127.0.0.1]/ or http://[::ffff:192.168.1.10]/, parse_host hands this function ::ffff:..., but these checks only catch ::1, ULA, and fe8-feb prefixes. Those literals route to loopback/private IPv4 addresses in browsers, so they bypass the new private-network block even though the verifier is supposed to reject localhost/internal targets by default.
Useful? React with 👍 / 👎.
1 participant
Summary
Implements
codra deploy verify <url>on top of the Agent Browser integration template merged in #34.Command
Behavior
Testing
Docs