[backport release/v0.20.0] fix web clone browser startup without project installs

[open-design-release-bot]

Backport of #7000 plus its security/lifecycle follow-up #7066 to release/v0.20.0.

Why

Website clone was spending minutes trying to install Playwright inside every project even though Open Design already has a daemon capable of launching a system Chrome-family browser. That failed frequently, inflated task time, and did not cover the important od CLI path where the Electron client is not running.

The first broker implementation fixed startup but exposed Chrome's unrestricted daemon-privileged CDP endpoint and raced profile cleanup after SIGKILL. The latest head includes the constrained broker and Windows-safe cleanup required by the blocking review.

What users will see

Website clone uses an available local Chrome-family browser without installing Playwright or packaging another Chromium. It works through the real od CLI even when the Electron window is not running.

file://, loopback, link-local, metadata, private-network, and DNS-to-private targets are rejected at the daemon boundary. Browser shutdown waits for process exit and retries profile cleanup for Windows-style file locking.

Surface area

• UI — new page / dialog / panel / menu item / setting / empty state in apps/web or apps/desktop (including Electron menu bar)
• Keyboard shortcut — new or changed
• CLI / env var — new od subcommand or flag, new tools-dev / tools-pack flag, or new OD_* env var
• API / contract — new /api/* endpoint, new SSE event, or changed shape in packages/contracts
• Extension point — new entry under skills/, design-systems/, design-templates/, or craft/, or change to the skills protocol
• i18n keys — added new translation keys
• New top-level dependency — adding any new entry to the root package.json
• Default behavior change — changes what existing users experience without opting in
• None — internal refactor, docs, tests, or translation update only

The test-only OD_BROWSER_ALLOW_PRIVATE_NETWORK_FOR_TESTS switch is read only at daemon startup for the hermetic E2E fixture; agent requests cannot opt into it. No runtime dependency, Playwright install, packaged Chromium, or client bundle bytes were added.

Screenshots

Not applicable: no UI surface changes.

Bug fix verification

• Red specs: e2e/specs/web-clone/main.spec.ts and apps/daemon/tests/browser-session-security.test.ts.
• On the original/main implementation, the lifecycle spec exposed a raw ws://127.0.0.1:.../devtools/browser/... URL. The backport head now returns only an opaque session ID and denies raw/general CDP operations.
• Negative coverage includes file://, loopback, link-local/metadata, RFC1918, DNS-to-private resolution, exact-IP proxy enforcement, a child that ignores SIGTERM, and Windows-style EPERM cleanup retries.

Validation

• pnpm guard
• pnpm typecheck
• pnpm --filter @open-design/daemon exec vitest run tests/browser-session-security.test.ts --reporter=dot — 10 passed
• pnpm --filter @open-design/e2e exec vitest run -c vitest.config.ts specs/web-clone/main.spec.ts --reporter=dot — 3 passed; real od CLI, daemon browser, staged recon-site.mjs, 1440/768/390 captures, zero console/page errors
• Main follow-up branch full daemon suite — 679 files passed, 2 skipped; 8,676 tests passed, 6 skipped
• Main follow-up packaged tests — 279 passed, 8 skipped
• CI on the backport head is required to pass before merge.

[open-design-release-bot]

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin backport-7000-to-release/v0.20.0
git worktree add --checkout .worktree/backport-7000-to-release/v0.20.0 backport-7000-to-release/v0.20.0
cd .worktree/backport-7000-to-release/v0.20.0
git reset --hard HEAD^
git cherry-pick -x 3c183acf79e1730bf0c84c768c9f147472197330
git push --force-with-lease

[github-actions]

🚀 Landing page preview

This PR is deployed to a Cloudflare Pages preview — not staging or production:

• Stable alias: https://pr-7048.open-design-landing-staging.pages.dev
• This build: https://d4b34a76.open-design-landing-staging.pages.dev
  Updated for commit fcff27d.

[PerishCode]

The daemon broker solves the browser-startup failure, but the current boundary grants the sandbox unrestricted daemon-privileged browser control and has an unsafe forced-shutdown cleanup path. Both need to be addressed before this backport merges.

_{🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.}

[lefarcen]

🧪 This PR has user-visible runtime changes, so it needs a manual QA pass before merge — please hold off self-merging for now; we'll loop QA in once it's merge-ready.

Also, please fill in the PR body with the missing review context before the next pass: Why, What users will see, Surface area, Bug fix verification, and Validation.

[lefarcen]

The current blockers are already captured in @PerishCode's review and inline comment above — especially the browser-session boundary and the forced-shutdown/profile cleanup path. Once those are addressed on this head, we can take another pass.

💡 To drive this PR to merge hands-free, paste this to your AI coding agent (Claude Code / Codex / opencode / Cursor …):
Take over nexu-io/open-design#7048 until it merges — read https://raw.githubusercontent.com/nexu-io/looper/main/skills/pr-takeover/SKILL.md and follow it.

[PerishCode]

@app/open-design-release-bot I reviewed every changed range in the daemon browser broker, network policy and exact-IP proxy, route lifecycle, staged Website Clone CDP adapter, asset harvesting changes, E2E coverage, and packaged-resource checks. The earlier raw-CDP privilege boundary and forced-shutdown cleanup blockers are resolved on this head: callers receive only project-scoped opaque sessions with an operation allowlist, private and rebinding destinations are blocked at both CDP and proxy boundaries, and browser teardown waits and retries profile removal. Daemon typechecking passed locally, change-specific daemon coverage is present, and the live daemon, E2E, workspace, and static CI lanes are green. Thank you for carrying the security and lifecycle follow-up through the release backport—this is a much safer and better-validated implementation.

_{🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.}