feat(browser): ship camofox v1.17.0 in compose, verified on a real instance

- compose: camofox service on by default (internal only, volume umt-camofox,
  healthcheck, CAMOFOX_REPLICAS=0 to skip); app depends on it with
  service_started/required=false and auto-registers camofox-env from
  BROWSER_PROVIDER_URL / BROWSER_ACCESS_KEY / BROWSER_ENABLED
- docker/camofox/Dockerfile: builds upstream tag v1.17.0 (389c996); fixes the
  upstream Dockerfile (missing postinstall.js before npm ci, sh -c not
  forwarding SIGTERM so logins were never persisted on restart)
- adapter fixes from the real container: coordinate click via evaluate +
  selector, focus typing with mode=keyboard, password values redacted from
  ARIA snapshots/extract, downloads field names, 410 after browser restart
  treated as lost tab; navigate reopens a tab in the same session
- verified-capability table keyed by upstream version (1.17.0 all ten);
  other versions stay unverified; probe reports auth failures
- settings: browser providers block (create/edit/delete/probe, capability
  table); API POST/PATCH/DELETE /browser/providers, POST .../probe
- scripts/browser-verify: umtbr stack + mock NexusPHP run of REQ 4.7.4 items
- docs: runbook browser §1/§7 (real-instance record), deploy §2.1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docker-compose.yml

@@ -1,9 +1,12 @@
-# 生产/试运行部署:只有两个服务 —— app(单容器:API + worker(io 组)+ worker:agent + web 静态,单端口 4380)+ postgres。
+# 生产/试运行部署:app(单容器:API + worker(io 组)+ worker:agent + web 静态,单端口 4380)+ postgres
+# + camofox(浏览器服务,原站视图 / Agent 浏览器能力用;只在内网,不映射端口;挂了不影响 app)。
 # 用法(详见 docs/runbook/deploy.md):
 #   cp docker/compose.env.example .env      # 按注释生成 SECRET_MASTER_KEY / POSTGRES_PASSWORD
 #   docker compose --env-file .env.deploy up -d --build
 #   docker compose logs app | grep -i setup  # 首次启动打印一次性 setup token
 # 开发只起数据库用 docker-compose.dev.yml。
+# 不要自带浏览器:.env 里 CAMOFOX_REPLICAS=0 + BROWSER_ENABLED=false;接自有 camofox:改 BROWSER_PROVIDER_URL
+# (见 docs/runbook/browser.md §1)。
 name: umt
 
 x-logging: &logging
@@ -30,6 +33,50 @@ services:
     stop_grace_period: 30s
     logging: *logging
 
+  # camofox-browser(jo-inc/camofox-browser v1.17.0,commit 389c996):上游不发布镜像,按锁定的 tag 从源码构建
+  # (docker/camofox/Dockerfile,修了上游 v1.17.0 Dockerfile 的构建错误)。本机已有同名镜像时 `up` 不会重新构建。
+  camofox:
+    build:
+      context: docker/camofox
+      additional_contexts:
+        upstream: https://github.com/jo-inc/camofox-browser.git#v1.17.0
+      args:
+        APT_MIRROR: ${APT_MIRROR:-}
+    image: ${CAMOFOX_IMAGE:-camofox-browser:1.17.0}
+    restart: unless-stopped
+    deploy:
+      # 0 = 不起浏览器服务(同时设 BROWSER_ENABLED=false)
+      replicas: ${CAMOFOX_REPLICAS:-1}
+    environment:
+      CAMOFOX_PORT: "9377"
+      # 设置后除 /health 外全部接口要求 Authorization: Bearer <key>;app 用同一个值
+      CAMOFOX_ACCESS_KEY: ${CAMOFOX_ACCESS_KEY:-}
+      # 登录状态(cookies + localStorage)按 userId 存 /root/.camofox/profiles,随卷持久化
+      CAMOFOX_PROFILE_DIR: /root/.camofox/profiles
+      # 上游缺省把崩溃报告发到它的中继服务;这里关掉
+      CAMOFOX_CRASH_REPORT_ENABLED: "false"
+      # 不装缺省扩展(uBlock Origin):每次启动浏览器都要从 addons.mozilla.org 下载,内网 / 国内网络下失败重试拖慢启动
+      CAMOFOX_DISABLE_DEFAULT_ADDONS: "true"
+      # 无请求多久回收会话(回收时落盘登录状态,下次打开恢复)/ 浏览器空闲多久退出(省内存,下次请求再启动)
+      SESSION_TIMEOUT_MS: ${CAMOFOX_SESSION_TIMEOUT_MS:-1800000}
+      BROWSER_IDLE_TIMEOUT_MS: ${CAMOFOX_BROWSER_IDLE_TIMEOUT_MS:-300000}
+      MAX_SESSIONS: ${CAMOFOX_MAX_SESSIONS:-8}
+      CAMOFOX_LOCALE: ${CAMOFOX_LOCALE:-}
+      CAMOFOX_TIMEZONE: ${CAMOFOX_TIMEZONE:-}
+    volumes:
+      - umt-camofox:/root/.camofox
+    # Firefox 多进程需要较大的 /dev/shm(上游 Makefile 用 2g)
+    shm_size: 2gb
+    mem_limit: ${CAMOFOX_MEM_LIMIT:-2g}
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:9377/health"]
+      interval: 30s
+      timeout: 5s
+      start_period: 30s
+      retries: 3
+    stop_grace_period: 20s
+    logging: *logging
+
   app:
     build:
       context: .
@@ -41,6 +88,10 @@ services:
     depends_on:
       postgres:
         condition: service_healthy
+      # 只要求已启动,不等健康:浏览器服务挂了 app 照常运行,界面标"浏览器不可用"
+      camofox:
+        condition: service_started
+        required: false
     environment:
       NODE_ENV: production
       DATABASE_URL: postgres://umt:${POSTGRES_PASSWORD}@postgres:5432/umt
@@ -55,6 +106,10 @@ services:
       WORKER_AGENT_CONCURRENCY: ${WORKER_AGENT_CONCURRENCY:-2}
       # 手动按路径整理时递归遍历的文件数上限
       ORGANIZE_WALK_MAX_FILES: ${ORGANIZE_WALK_MAX_FILES:-5000}
+      # 浏览器服务:缺省指向上面的 camofox;接自有实例改成它的地址与访问凭据;false = 停用
+      BROWSER_PROVIDER_URL: ${BROWSER_PROVIDER_URL:-http://camofox:9377}
+      BROWSER_ACCESS_KEY: ${BROWSER_ACCESS_KEY:-${CAMOFOX_ACCESS_KEY:-}}
+      BROWSER_ENABLED: ${BROWSER_ENABLED:-true}
     ports:
       - "${UMT_BIND:-0.0.0.0}:${UMT_PORT:-4380}:4380"
     volumes:
@@ -69,3 +124,4 @@ services:
 volumes:
   umt-pg-data:
   umt-data:
+  umt-camofox: