sync: auto-sync from GURU-BEAST-ROG at 2026-05-25 13:13:02

Author: Mike Swanson
Machine: GURU-BEAST-ROG
Timestamp: 2026-05-25 13:13:02

session-logs/2026-05-25-beast-chrome-fetch-and-identity-audit.md

@@ -0,0 +1,127 @@
+# Session Log — 2026-05-25 — BEAST: Discord bot real-Chrome web fetch + identity audit
+
+## User
+- **User:** Mike Swanson (mike)
+- **Machine:** GURU-BEAST-ROG
+- **Role:** admin
+- **Session span:** 2026-05-22 (after the 12:48 PT save) → 2026-05-25, one continuous interactive
+  coordinator session on BEAST. Namespaced because GURU-5070 already authored
+  `session-logs/2026-05-25-session.md` today.
+
+## Session Summary
+Continued the BEAST Discord-bot work. After confirming the Claude-in-Chrome extension is installed
+and bridged on BEAST, built the bot a real-Chrome web-fetch capability for bot-blocked sites, then
+(today) answered a cross-machine identity-verification audit and reported back via the coord API.
+
+The "is Claude in Chrome working on this unit?" question was answered by inspecting files/registry
+only (no browser launch, per the unattended-host posture): the extension `Claude in Chrome (Beta)
+v1.0.70` (`fcoeoabgfenejglbffodgkkbkcdhcgfn`) is installed and enabled, and the Anthropic native
+messaging host (`com.anthropic.claude_browser_extension`, installed by the Claude desktop app under
+`%APPDATA%\Claude\ChromeNativeHost\`) is registered with the extension whitelisted — so the agentic
+bridge is fully wired.
+
+Mike then directed: when the bot needs to search (e.g. estimates) and a site is bot-blocked, use
+Chrome. The key constraint surfaced during build: the bot is a Claude Agent SDK session and cannot
+drive the *agentic* Claude-in-Chrome extension (that's desktop-app/interactive). Its only
+browser-capable path is its Bash tool. The simple `chrome --headless --dump-dom` is broken on Chrome
+148 (returns empty), and no automation tooling was installed. Per Mike's choice, installed Playwright
+into the bot venv and used `channel="chrome"` to drive the installed Chrome 148 headlessly (no
+Chromium download). Wrote `projects/discord-bot/scripts/web-fetch-chrome.py` (JS rendering,
+anti-automation flags, UA de-"Headless"-ed, isolated profile, bounded output), tested it on static +
+JS-rendered + UA-check targets, wired it into `DISCORD_CLAUDE.md` as a WebFetch→real-Chrome fallback,
+reconciled the headless rule (forbid *visible/interactive* browser windows; permit headless fetch),
+and recorded the dependency in `requirements.txt`. The helper was later enhanced (another session)
+with a `--zip` option that pre-sets the Amazon/Best Buy delivery ZIP (default 85715, Tucson).
+
+A 2026-05-23 sync flagged repo cruft (garbled path-as-filename files and leaked `.claude/` temp
+artifacts) that other machines' `git add -A` had committed; by 2026-05-25 those were resolved
+upstream — `sync.sh` now carries a `purge_garbled_paths()` guard and the junk was cleaned.
+
+Today (2026-05-25), a coord check-in from GURU-5070 asked every machine to verify its identity.
+GURU-BEAST-ROG passed all four checks (identity.json correct, hostname match, git config matches
+users.json, present in mike.known_machines). Replied to GURU-5070 via coord, and flagged that the
+73 pulled commits carried two author names — "Mike Swanson" (61) and "Mike-Swanson" (12) — implying
+another machine has a hyphenated `git config user.name`.
+
+## Key Decisions
+- **Bot uses headless Chrome via Playwright, not the agentic extension.** The Claude-in-Chrome
+  extension is driven by the desktop app interactively; the SDK-agent bot can't invoke it. Headless
+  Chrome via Bash achieves the same goal (get past bot blocks) and runs unattended.
+- **Playwright with `channel="chrome"`, no `playwright install`.** Reuses the already-installed
+  Chrome 148 — no ~hundreds-of-MB Chromium download, and tracks the system Chrome version.
+- **Anti-detection touches in the helper:** strip `--enable-automation`/`AutomationControlled`,
+  and rewrite the UA to drop "HeadlessChrome" (derived from the live UA so it survives Chrome
+  upgrades) — because the use case is specifically bot-blocked sites.
+- **Reconciled the headless rule rather than contradicting it:** forbid visible/interactive browser
+  windows and OAuth sign-in (no one at the console); explicitly permit the headless fetch.
+- **Namespaced today's session log** instead of appending to GURU-5070's 87 KB
+  `2026-05-25-session.md` — avoids rebase conflicts on a concurrently-edited file.
+- **Inspected Chrome status via files/registry only, never launched it** — BEAST is the unattended
+  bot host (Chrome was already running under a human's session).
+
+## Problems Encountered
+- **`chrome --headless --dump-dom` broke on Chrome 148** — exit 0 but empty output (old headless mode
+  gone). Resolved by using Playwright/CDP instead.
+- **No browser-automation tooling installed** (no Playwright/Puppeteer/Selenium) — installed
+  `playwright>=1.60.0` into the bot venv.
+- **`HeadlessChrome` UA tell** — Playwright's default UA flagged the request as a bot. Resolved by
+  rewriting the context UA to `Chrome/148...` (verified via httpbin).
+- **Helper landed in a different commit than expected** — a background auto-sync swept the untracked
+  `web-fetch-chrome.py` into `51d5556` (my own untracked-detection fix working), so my manual commit
+  `ee86542` carried only the modified files. Net: all tracked + pushed.
+- **Repo cruft from other machines (2026-05-23)** — garbled filenames + `.claude/` temp artifacts via
+  `git add -A`. Not mine to delete; flagged. Resolved upstream by 2026-05-25 (`purge_garbled_paths()`).
+
+## Configuration Changes
+- `projects/discord-bot/scripts/web-fetch-chrome.py` — NEW. Headless real-Chrome fetcher via
+  Playwright `channel="chrome"`; `--selector`/`--html`/`--max-chars`/`--wait-until`/`--settle-ms`/
+  `--timeout-ms`/`--zip` options. (`--zip` added by a later session.)
+- `projects/discord-bot/DISCORD_CLAUDE.md` — added "Web Research / Bot-Blocked Sites" section;
+  refined the headless rule to permit headless fetching while forbidding visible/interactive browsers.
+- `projects/discord-bot/requirements.txt` — added `playwright>=1.60.0` (note: no `playwright install`
+  needed; uses system Chrome).
+- `projects/discord-bot/.venv/` — `playwright` 1.60.0 installed (gitignored; recorded in requirements).
+- No edits to `.claude/identity.json`, `users.json`, or `sync.sh` this session (the `users.json`
+  fixes and `sync.sh` `purge_garbled_paths()` came from other machines).
+
+## Credentials & Secrets
+- None created or rotated. Discord bot token remains at vault `projects/discord-bot/bot-token.sops.yaml`
+  field `credentials.bot_token` (value not reproduced). No vault paths decrypted this session.
+
+## Infrastructure & Servers
+- **Machine:** GURU-BEAST-ROG (BEAST), Windows 11. hostname == COMPUTERNAME == GURU-BEAST-ROG.
+- **Chrome:** 148.0.7778.168 at `C:\Program Files\Google\Chrome\Application\chrome.exe`.
+- **Claude-in-Chrome extension:** `fcoeoabgfenejglbffodgkkbkcdhcgfn`, "Claude in Chrome (Beta)" v1.0.70,
+  Default profile, web-store, enabled.
+- **Native host:** `com.anthropic.claude_browser_extension` (HKCU) → manifest + `chrome-native-host.exe`
+  under `C:\Users\guru\AppData\Roaming\Claude\ChromeNativeHost\` (installed by Claude desktop app).
+- **Bot service:** `ClaudeToolsDiscordBot` (NSSM); model `claude-sonnet-4-6`; cwd `C:/Users/guru/ClaudeTools`;
+  bot venv python `projects/discord-bot/.venv/Scripts/python.exe`.
+- **Coord API:** `http://172.16.3.30:8001/api/coord`. Session id `GURU-BEAST-ROG/claude-main`.
+- **mike.known_machines (as synced):** GURU-5070, Mikes-MacBook-Air, GURU-BEAST-ROG, GURU-KALI
+  (DESKTOP-0O8A1RL retired/removed).
+
+## Commands & Outputs
+- Install: `projects/discord-bot/.venv/Scripts/python.exe -m pip install playwright` → 1.60.0.
+- Fetch helper (as the bot runs it):
+  `projects/discord-bot/.venv/Scripts/python.exe projects/discord-bot/scripts/web-fetch-chrome.py "<url>" [--selector <css>] [--html] [--max-chars N] [--zip 85715]`
+  - Verified: static page, JS-rendered page (`quotes.toscrape.com/js`), UA = `Chrome/148.0.0.0`.
+- `nssm restart ClaudeToolsDiscordBot` — used after each `DISCORD_CLAUDE.md` change; confirmed
+  "[OK] Bot is ready and listening for mentions".
+- Coord reply: `POST http://172.16.3.30:8001/api/coord/messages` → 201, id
+  `ac1e3767-f085-4c83-8d74-fbd9cc821d63`; unread after = 0.
+
+## Pending / Incomplete Tasks
+- **Hyphenated git author** — some machine has `git config user.name = "Mike-Swanson"` (12 of 73
+  pulled commits). Handed to GURU-5070's identity sweep via coord reply; not this machine.
+- **`/sync` doc vs `sync.sh`** — doc still says "stage by name, never `git add -A`" while the script
+  uses `git add -A` (now mitigated by `purge_garbled_paths()` but not eliminated). Left for decision.
+- Bot's real-Chrome fetch is live but only lightly tested against true bot-blocked sites; Mike was
+  testing it in Discord.
+
+## Reference Information
+- Commits: `ee86542` (real-Chrome fallback: rules + requirements), `51d5556` (helper, auto-synced).
+- Helper: `projects/discord-bot/scripts/web-fetch-chrome.py`. Rules: `projects/discord-bot/DISCORD_CLAUDE.md`
+  ("Web Research / Bot-Blocked Sites").
+- Coord reply id: `ac1e3767-f085-4c83-8d74-fbd9cc821d63` (to GURU-5070/claude-main).
+- Extension id `fcoeoabgfenejglbffodgkkbkcdhcgfn`; native host `com.anthropic.claude_browser_extension`.