feat(browser): add explicit runtime policy controls

tests/unit/utils/browser/browser-policy.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, it } from 'bun:test';
+import {
+  resolveBrowserExposure,
+  resolveBrowserLaunchFlagResolution,
+} from '../../../../src/utils/browser/browser-policy';
+
+describe('browser policy', () => {
+  it('strips browser launch flags and records the override', () => {
+    expect(resolveBrowserLaunchFlagResolution(['glm', '--browser', 'check app'])).toEqual({
+      override: 'force-enable',
+      argsWithoutFlags: ['glm', 'check app'],
+    });
+    expect(resolveBrowserLaunchFlagResolution(['glm', '--no-browser', 'check app'])).toEqual({
+      override: 'force-disable',
+      argsWithoutFlags: ['glm', 'check app'],
+    });
+  });
+
+  it('rejects conflicting browser launch flags', () => {
+    expect(() => resolveBrowserLaunchFlagResolution(['--browser', '--no-browser'])).toThrow(
+      'Use either `--browser` or `--no-browser`, not both.'
+    );
+  });
+
+  it('resolves browser exposure from saved policy and one-run overrides', () => {
+    expect(resolveBrowserExposure({ enabled: true, policy: 'auto' })).toMatchObject({
+      exposeByDefault: true,
+      exposeForLaunch: true,
+    });
+    expect(resolveBrowserExposure({ enabled: true, policy: 'manual' })).toMatchObject({
+      exposeByDefault: false,
+      exposeForLaunch: false,
+    });
+    expect(
+      resolveBrowserExposure({ enabled: true, policy: 'manual' }, 'force-enable')
+    ).toMatchObject({
+      exposeByDefault: false,
+      exposeForLaunch: true,
+    });
+    expect(
+      resolveBrowserExposure({ enabled: true, policy: 'auto' }, 'force-disable')
+    ).toMatchObject({
+      exposeByDefault: true,
+      exposeForLaunch: false,
+    });
+  });
+});

tests/unit/utils/browser/browser-status.test.ts

@@ -98,11 +98,13 @@ describe('browser status', () => {
       config.browser = {
         claude: {
           enabled: true,
+          policy: 'auto',
           user_data_dir: '',
           devtools_port: 9222,
         },
         codex: {
           enabled: true,
+          policy: 'auto',
         },
       };
     });
@@ -138,11 +140,13 @@ describe('browser status', () => {
       config.browser = {
         claude: {
           enabled: true,
+          policy: 'auto',
           user_data_dir: '/config-browser',
           devtools_port: 9333,
         },
         codex: {
           enabled: true,
+          policy: 'auto',
         },
       };
     });
@@ -185,11 +189,13 @@ describe('browser status', () => {
       config.browser = {
         claude: {
           enabled: true,
+          policy: 'auto',
           user_data_dir: '',
           devtools_port: 9222,
         },
         codex: {
           enabled: true,
+          policy: 'auto',
         },
       };
     });
@@ -227,11 +233,13 @@ describe('browser status', () => {
       config.browser = {
         claude: {
           enabled: true,
+          policy: 'auto',
           user_data_dir: '/tmp/browser-profile',
           devtools_port: 9222,
         },
         codex: {
           enabled: true,
+          policy: 'auto',
         },
       };
     });
@@ -294,11 +302,13 @@ describe('browser status', () => {
       config.browser = {
         claude: {
           enabled: true,
+          policy: 'auto',
           user_data_dir: '/tmp/config-browser',
           devtools_port: 9222,
         },
         codex: {
           enabled: true,
+          policy: 'auto',
         },
       };
     });