Venture day build for issue #84 — board pick: openai/codex#40046 ("Hidden file-input fallback for agent browsers"), closed not planned.
ventures/browser-upload-bridge/: a single MCP tool upload_file(target, path) that attaches to an already-running browser over CDP and pushes a task-scoped file into a <input type=file> — via a direct Playwright locator (works even when the input is hidden, including inside a same-origin iframe) or a filechooser-intercept fallback for inputs with no stable selector at all. Policy guard: uploads must resolve inside UPLOAD_BRIDGE_ROOT; every call is receipt-logged.
demo.js: real end-to-end run — throwaway headless Chrome, the real MCP server, the real MCP client SDK, five fixture flows (drag-drop zone, custom button, form submit, iframe, no-stable-selector case) plus a deliberate outside-root rejection, each verified by reading the page's own DOM back out through an independent CDP connection. Recorded in demo.txt.
test_bridge.js: unit tests for the policy guard (root containment, symlink escape, directories, missing files, fail-closed with no root).
site/index.html: self-contained launch page, "field notebook" visual identity (warm paper tones, inline-SVG hand-annotated diagram, monospace margin notes), one above-the-fold signup form posting to /api/signup, honest pricing (free + 2 early-access tiers), honest limits section. Verified with headless-Chrome screenshots at desktop and phone width (see PR description notes below).
Venture day build for issue #84 — board pick: [openai/codex#40046](https://github.com/openai/codex/issues/40046) ("Hidden file-input fallback for agent browsers"), closed not planned.
- `ventures/browser-upload-bridge/`: a single MCP tool `upload_file(target, path)` that attaches to an already-running browser over CDP and pushes a task-scoped file into a `<input type=file>` — via a direct Playwright locator (works even when the input is hidden, including inside a same-origin iframe) or a filechooser-intercept fallback for inputs with no stable selector at all. Policy guard: uploads must resolve inside `UPLOAD_BRIDGE_ROOT`; every call is receipt-logged.
- `demo.js`: real end-to-end run — throwaway headless Chrome, the real MCP server, the real MCP client SDK, five fixture flows (drag-drop zone, custom button, form submit, iframe, no-stable-selector case) plus a deliberate outside-root rejection, each verified by reading the page's own DOM back out through an independent CDP connection. Recorded in `demo.txt`.
- `test_bridge.js`: unit tests for the policy guard (root containment, symlink escape, directories, missing files, fail-closed with no root).
- `site/index.html`: self-contained launch page, "field notebook" visual identity (warm paper tones, inline-SVG hand-annotated diagram, monospace margin notes), one above-the-fold signup form posting to `/api/signup`, honest pricing (free + 2 early-access tiers), honest limits section. Verified with headless-Chrome screenshots at desktop and phone width (see PR description notes below).
Zero upstream Codex changes.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---
_Migrated from matcha/notplanned#2 (open, 2026-10-12) on 2026-10-14._
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Venture day build for issue #84 — board pick: openai/codex#40046 ("Hidden file-input fallback for agent browsers"), closed not planned.
ventures/browser-upload-bridge/: a single MCP toolupload_file(target, path)that attaches to an already-running browser over CDP and pushes a task-scoped file into a<input type=file>— via a direct Playwright locator (works even when the input is hidden, including inside a same-origin iframe) or a filechooser-intercept fallback for inputs with no stable selector at all. Policy guard: uploads must resolve insideUPLOAD_BRIDGE_ROOT; every call is receipt-logged.demo.js: real end-to-end run — throwaway headless Chrome, the real MCP server, the real MCP client SDK, five fixture flows (drag-drop zone, custom button, form submit, iframe, no-stable-selector case) plus a deliberate outside-root rejection, each verified by reading the page's own DOM back out through an independent CDP connection. Recorded indemo.txt.test_bridge.js: unit tests for the policy guard (root containment, symlink escape, directories, missing files, fail-closed with no root).site/index.html: self-contained launch page, "field notebook" visual identity (warm paper tones, inline-SVG hand-annotated diagram, monospace margin notes), one above-the-fold signup form posting to/api/signup, honest pricing (free + 2 early-access tiers), honest limits section. Verified with headless-Chrome screenshots at desktop and phone width (see PR description notes below).Zero upstream Codex changes.
🤖 Generated with Claude Code
Migrated from matcha/notplanned#2 (open, 2026-10-12) on 2026-10-14.