feat(browser-agent): Add tag-based profile resolution and security checks

Profile Resolution:
- Integrated ProfileManager into OpenAI Playwright Executor
- Added _resolve_profile_from_script() method with centralized resolution
- Resolution priority: CLI --user-data-dir > --profile > session.profile_name >
  session.required_tags > temporary profile > error
- Tag matching uses AND logic (profile must have ALL required tags)
- Most recently used profile selected when multiple profiles match

Security:
- Validates profile directory exists before browser launch
- Fails with helpful error if no profile found and allow_temp_profile: false
- Clear logging at each step of profile resolution
- Guides users on how to create profiles with required tags

CLI Enhancements:
- Added --profile flag for profile name lookup
- Added --list-profiles flag to list available profiles
- Improved help text with examples and priority documentation

Example Fixes:
- Fixed 'type' vs 'action' field usage across all example scripts
- Updated escalation test to use example.com (more reliable than Google)
- Fixed execute_js script syntax (removed invalid 'return')

Template Updates:
- Added required_tags and allow_temp_profile to bt_broadband template
- Updated workflow examples to demonstrate tag-based selection
- Added profile selection documentation to README

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: guyernest

lambda/tools/local-browser-agent/examples/README_PROGRESSIVE_EXAMPLES.md

@@ -35,8 +35,8 @@ This directory contains example scripts demonstrating the Progressive Escalation
 **Migration from Nova Act**:
 | Old (Nova Act) | New (Progressive) | Improvement |
 |----------------|-------------------|-------------|
-| `action: "act_with_schema"` | `type: "extract"` + `method: "vision"` | Explicit, predictable |
-| `action: "act"` for navigation | `type: "navigate"` | Clearer intent |
+| `action: "act_with_schema"` | `action: "extract"` + `method: "vision"` | Explicit, predictable |
+| `action: "act"` for navigation | `action: "navigate"` | Clearer intent |
 | Single agent call for clicks | Progressive escalation chain | 10x faster, free |
 
 **Key improvements**:
@@ -106,7 +106,7 @@ This directory contains example scripts demonstrating the Progressive Escalation
 ### New Format (Progressive Escalation)
 ```json
 {
-  "type": "fill",
+  "action": "fill",
   "description": "Fill customer name field",
   "escalation_chain": [
     {
@@ -245,7 +245,7 @@ python openai_playwright_executor.py \
 
    // New
    {
-     "type": "click",
+     "action": "click",
      "description": "Click Next button",
      "escalation_chain": [
        {"method": "playwright_locator", "locator": {"strategy": "text", "value": "Next"}},
@@ -261,7 +261,7 @@ python openai_playwright_executor.py \
 
    // New
    {
-     "type": "fill",
+     "action": "fill",
      "escalation_chain": [
        {"method": "playwright_locator", "locator": {"strategy": "selector", "value": "input[type='email']"}},
        {"method": "vision_find_element", "prompt": "Find the email field"}
@@ -276,7 +276,7 @@ python openai_playwright_executor.py \
    {"action": "act_with_schema", "prompt": "Extract book titles", "schema": {...}}
 
    // New
-   {"type": "extract", "method": "vision", "prompt": "Extract book titles", "schema": {...}}
+   {"action": "extract", "method": "vision", "prompt": "Extract book titles", "schema": {...}}
    ```
 
 6. **Add wait steps after navigation**:
@@ -287,11 +287,67 @@ python openai_playwright_executor.py \
 
 7. **Add screenshots for debugging**:
    ```json
-   {"type": "screenshot", "save_to": "01_step_name.png"}
+   {"action": "screenshot", "save_to": "01_step_name.png"}
    ```
 
 ---
 
+## Browser Profile Selection
+
+Scripts can specify which browser profile to use for authenticated sessions.
+
+### Session Configuration
+
+Add a `session` block to your script to specify profile requirements:
+
+```json
+{
+  "name": "My Script",
+  "session": {
+    "profile_name": "My-Profile",
+    "required_tags": ["example.com", "authenticated"],
+    "allow_temp_profile": false,
+    "clone_for_parallel": false
+  },
+  "steps": [...]
+}
+```
+
+### Profile Resolution Priority
+
+1. **Command-line `--user-data-dir`**: Explicit path (highest priority)
+2. **Command-line `--profile`**: Profile name lookup
+3. **Script `session.profile_name`**: Exact name match
+4. **Script `session.required_tags`**: Tag-based matching (AND logic)
+5. **Temporary profile**: If `allow_temp_profile: true` (default)
+6. **Error**: If no profile found and temp not allowed
+
+### Tag Matching Logic
+
+- **AND logic by default**: Profile must have ALL required tags
+- **Most recently used**: Selected when multiple profiles match
+- **Case-sensitive**: Tags are compared exactly
+
+### Security Recommendation
+
+For scripts that require authenticated sessions, always set:
+```json
+"session": {
+  "required_tags": ["domain.com", "authenticated"],
+  "allow_temp_profile": false
+}
+```
+
+This prevents accidental execution without the correct profile.
+
+### List Available Profiles
+
+```bash
+python openai_playwright_executor.py --list-profiles
+```
+
+---
+
 ## Best Practices Summary
 
 1. **Always escalate progressively**: Playwright first, vision last
@@ -301,6 +357,7 @@ python openai_playwright_executor.py \
 5. **Add screenshots**: At key stages for debugging
 6. **Structured schemas**: Clear prompts, required fields
 7. **Cost-conscious**: Aim for <$0.02 per run, <5 vision calls
+8. **Use profile tags**: Set `required_tags` and `allow_temp_profile: false` for authenticated scripts
 
 ---
 

lambda/tools/local-browser-agent/examples/bt_broadband_password_manager.json

@@ -16,17 +16,17 @@
             "state": "networkidle"
         },
         {
-            "type": "screenshot",
+            "action": "screenshot",
             "description": "Screenshot of initial page",
             "save_to": "01_initial_page.png"
         },
         {
-            "type": "execute_js",
+            "action": "execute_js",
             "description": "Check page state - DOM method (fastest)",
             "script": "(function() { var title = document.title.toLowerCase(); return { title: document.title, url: window.location.href, isLoginPage: title.includes('secure authentication') || title.includes('login') || title.includes('sign in'), hasLoginForm: !!document.querySelector('input[type=\"password\"]'), hasSearchForm: !!document.querySelector('input[name=\"postcode\"], input[id*=\"postcode\"], input[placeholder*=\"postcode\"]') }; })()"
         },
         {
-            "type": "extract",
+            "action": "extract",
             "description": "Identify page type using vision (if DOM unclear)",
             "method": "vision",
             "prompt": "Analyze this BT Wholesale webpage and determine: 1) Is this a login/authentication page (might show 'Secure Authentication'), a search/checker page, or results page? 2) What is the main call-to-action? 3) Are there any error messages or notices visible?",
@@ -59,7 +59,7 @@
             }
         },
         {
-            "type": "fill",
+            "action": "fill",
             "description": "Enter username (if on login page)",
             "escalation_chain": [
                 {
@@ -89,7 +89,7 @@
             "value": "nterizakis"
         },
         {
-            "type": "click",
+            "action": "click",
             "description": "Click Next/Continue button after username",
             "escalation_chain": [
                 {
@@ -126,7 +126,7 @@
             ]
         },
         {
-            "type": "wait",
+            "action": "wait",
             "description": "Wait for password field to appear",
             "locator": {
                 "strategy": "selector",
@@ -140,17 +140,17 @@
             "state": "networkidle"
         },
         {
-            "type": "screenshot",
+            "action": "screenshot",
             "description": "Screenshot of password page",
             "save_to": "01b_after_username.png"
         },
         {
-            "type": "wait",
+            "action": "wait",
             "description": "Wait for browser autofill to complete",
             "duration": 2000
         },
         {
-            "type": "click",
+            "action": "click",
             "description": "Click password field to activate password manager",
             "escalation_chain": [
                 {
@@ -164,28 +164,28 @@
             ]
         },
         {
-            "type": "wait",
+            "action": "wait",
             "description": "Wait for password manager dropdown to appear",
             "duration": 1000
         },
         {
-            "type": "press",
+            "action": "press",
             "description": "Select password from manager (Arrow Down + Enter)",
             "keys": ["ArrowDown", "Enter"],
             "delay": 500
         },
         {
-            "type": "wait",
+            "action": "wait",
             "description": "Wait for password to fill from manager",
             "duration": 1500
         },
         {
-            "type": "execute_js",
+            "action": "execute_js",
             "description": "Verify password was filled by password manager",
             "script": "(function() { var pwdField = document.querySelector('input[type=\"password\"]'); return { passwordFilled: pwdField ? pwdField.value.length > 0 : false, passwordLength: pwdField ? pwdField.value.length : 0, hasPasswordField: !!pwdField }; })()"
         },
         {
-            "type": "click",
+            "action": "click",
             "description": "Click Next button on password page",
             "escalation_chain": [
                 {
@@ -220,7 +220,7 @@
             "state": "networkidle"
         },
         {
-            "type": "wait",
+            "action": "wait",
             "description": "Wait for SSO redirect to complete (BT portal)",
             "duration": 3000
         },
@@ -230,17 +230,17 @@
             "state": "networkidle"
         },
         {
-            "type": "screenshot",
+            "action": "screenshot",
             "description": "Screenshot after login and SSO redirect",
             "save_to": "02_after_login.png"
         },
         {
-            "type": "execute_js",
+            "action": "execute_js",
             "description": "Verify we're on BT wholesale portal",
             "script": "(function() { var url = window.location.href; var hash = window.location.hash; return { url: url, hash: hash, onBTWholesale: url.includes('bbactotl.btwholesale.com') || url.includes('btwholesale'), currentPage: hash }; })()"
         },
         {
-            "type": "navigate",
+            "action": "navigate",
             "description": "Navigate to Address Checker page",
             "url": "https://bbactotl.btwholesale.com/bbac-ui/totl/totlSearch/#/ADSL/AddressHome"
         },
@@ -250,22 +250,22 @@
             "state": "networkidle"
         },
         {
-            "type": "screenshot",
+            "action": "screenshot",
             "description": "Screenshot of Address Checker page",
             "save_to": "02b_address_checker.png"
         },
         {
-            "type": "execute_js",
+            "action": "execute_js",
             "description": "Verify Address Checker page loaded",
             "script": "(function() { var url = window.location.href; var hash = window.location.hash; var postcodeInput = document.querySelector('input[name*=\"postcode\"], input[id*=\"postcode\"], input[placeholder*=\"postcode\" i]'); return { url: url, hash: hash, hasPostcodeField: !!postcodeInput, postcodeFieldVisible: postcodeInput ? window.getComputedStyle(postcodeInput).display !== 'none' : false, pageTitle: document.title }; })()"
         },
         {
-            "type": "wait",
+            "action": "wait",
             "description": "Wait for Address Checker form to be ready",
             "duration": 2000
         },
         {
-            "type": "fill",
+            "action": "fill",
             "description": "Enter postcode in search field",
             "escalation_chain": [
                 {
@@ -304,7 +304,7 @@
             "value": "{{postcode}}"
         },
         {
-            "type": "click",
+            "action": "click",
             "description": "Click search/check availability button",
             "escalation_chain": [
                 {
@@ -346,12 +346,12 @@
             "state": "networkidle"
         },
         {
-            "type": "screenshot",
+            "action": "screenshot",
             "description": "Screenshot after search",
             "save_to": "02_after_search.png"
         },
         {
-            "type": "extract",
+            "action": "extract",
             "description": "Check if address selection is needed",
             "method": "vision",
             "prompt": "Look at this page after postcode search. Answer: 1) Does it show a list of addresses to select from? 2) Does it show broadband packages directly? 3) Is there an error or 'no results' message?",
@@ -383,7 +383,7 @@
             }
         },
         {
-            "type": "click",
+            "action": "click",
             "description": "Select matching address from list",
             "escalation_chain": [
                 {
@@ -420,7 +420,7 @@
             ]
         },
         {
-            "type": "click",
+            "action": "click",
             "description": "Click the submit/continue button after selecting the address",
             "escalation_chain": [
                 {
@@ -470,7 +470,7 @@
             "state": "networkidle"
         },
         {
-            "type": "wait",
+            "action": "wait",
             "description": "Wait for JavaScript redirect to complete (address details page)",
             "duration": 3000
         },
@@ -480,12 +480,12 @@
             "state": "networkidle"
         },
         {
-            "type": "screenshot",
+            "action": "screenshot",
             "description": "Screenshot of packages page",
             "save_to": "03_packages.png"
         },
         {
-            "type": "extract",
+            "action": "extract",
             "description": "Extract all broadband packages with conditional logic",
             "method": "vision",
             "prompt": "Extract broadband availability information from the results page following these steps: 1. ALWAYS CAPTURE (if visible):   - ALK (Access Line Key) - usually displayed near top  - Exchange Code - BT exchange identifier 2. CHECK FEATURED PRODUCTS SECTION:  Look for a section called 'Featured Products'.   Search for a row/line containing 'WBC FTTP'. 3. IF 'WBC FTTP' IS FOUND:  - Set fttp_avail = true   - From the WBC FTTP row, capture 'Downstream Line Rate' (this is the SOADSL DSL speed in Mbps).   Then navigate to OTHER SECTIONS:   a) OTHER OFFERINGS section:     - Check if ANY row has 'Service Availability' field = 'Enabled'    - If found, set sogea_avail = true, otherwise false.   b) ONT DETAILS section:  - Find the LAST row in this section   - Capture: 'Reference' field (this is ont_reference)   - Capture: 'ONT Serial Number' field (this is ont_serial_no)    - Capture: 'Port Service ID' field (this is port_service_id)   c) PREMISE ENVIRONMENT section:      - Capture: 'Recommended Minimum SVR NLP' field (this is install_type)    - Valid values are typically 'Standard' or 'Premium'. 4. IF 'WBC FTTP' IS NOT FOUND:   - Set fttp_avail = false  - Leave all FTTP-related fields blank (install_type, sogea_avail, soadsl_dsl_speed, ont_reference, ont_serial_no, port_service_id). IMPORTANT: fttp_avail is REQUIRED and must always be set to true or false based on whether WBC FTTP is present in Featured Products.",
@@ -534,7 +534,7 @@
             }
         },
         {
-            "type": "screenshot",
+            "action": "screenshot",
             "description": "Final screenshot for verification",
             "save_to": "04_final.png"
         }