sap-browser-automation

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

SAP Browser Automation

SAP浏览器自动化

Use this skill as the shared browser layer for SAP-specific skills. It owns surface selection, authentication bootstrap, isolated Edge/CDP startup, state reuse, target verification, evidence, recovery, and cleanup. The consuming skill still owns the SAP action boundaries: story edits, planning writeback, model changes, Datasphere deployment, SQL execution, and test acceptance.

将此技能用作SAP专属技能的共享浏览器层。它负责界面选择、认证启动、隔离式Edge/CDP启动、状态复用、目标验证、证据留存、故障恢复及清理工作。调用该技能的上层技能仍需负责SAP操作边界相关工作：报表编辑、计划回写、模型修改、Datasphere部署、SQL执行及测试验收。

Related Skills

When to Use This Skill

何时使用此技能

Use this skill whenever an agent must interact with an authenticated SAP web UI, select or inspect a browser target, start Edge with loopback CDP, reuse an approved Edge profile, transfer scoped browser state to an already-installed compatible client, or recover from browser bootstrap/authentication failure. Do not use it for code-only, API-only, CLI-only, or database-native tasks that do not need visible browser state.

当Agent需要与已认证的SAP Web UI交互、选择或检查浏览器目标、启动带环回CDP的Edge、复用已批准的Edge配置文件、将限定范围的浏览器状态传输至已安装的兼容客户端，或从浏览器启动/认证失败中恢复时，使用此技能。请勿将其用于无需可见浏览器状态的纯代码、纯API、纯CLI或原生数据库任务。

Quick Reference

快速参考

Need	Route
Manual SSO in the current browser	In-app Browser, then visible signed-in verification
Enterprise Edge or no Playwright installation	Fresh isolated Edge with copied profile and loopback CDP
Independent compatible browser context	Existing Playwright plus scoped `storageState` or CDP state transfer
Missing auth or failed browser bootstrap	User-assisted login, recovery, or specification-only handoff

需求	方案
当前浏览器中的手动SSO	内嵌浏览器，然后进行可见登录验证
企业版Edge或未安装Playwright	全新隔离式Edge（复制配置文件并启用环回CDP）
独立兼容浏览器上下文	现有Playwright加上限定范围的 `storageState` 或CDP状态传输
缺失认证或浏览器启动失败	用户协助登录、恢复或仅交付规格说明

Operating contract

操作约定

Prefer a connector, API, CLI, or database-native check when it can answer the request without a browser.
Try the in-app Browser first when it is available and the task needs authenticated visible UI.
Ask the user to authenticate manually in the in-app Browser when its target redirects to SSO. Use its secure authentication capability; never ask for passwords or OTPs in chat.
After in-app verification, use the fresh Edge path for reliable automation when the task needs CDP, enterprise extensions, or a reusable profile.
Ask explicit permission before reusing the user's authenticated normal Edge profile or closing Edge.
Copy only after Edge is closed, and copy to an isolated profile path. Treat the copy, cookies, tokens, local storage, and storage-state files as credentials.
Bind CDP to
```
127.0.0.1
```
; never expose the port, WebSocket endpoint, profile, or auth state to a network, repository, log, screenshot, or Oracle review.
Verify the tenant, host, path, title, authenticated DOM, and target page before interaction. Never guess the first tab or target ID.
Default to read-only actions. The consuming SAP skill must explicitly authorize writes, publishing, deployment, planning, model, permission, or destructive actions.
Browser startup, CDP attachment, or a successful login redirect is not evidence that the requested SAP task completed.

Load the focused references only when needed:

```
references/edge-cdp-control.md
```
for Edge launch, CDP discovery, target selection, and recovery.
```
references/auth-state-bootstrap.md
```
for copying an authenticated Edge profile, exporting scoped state when available, and injecting it into compatible clients.
```
references/in-app-browser-auth.md
```
for manual in-app authentication and capability boundaries.
Run
```
scripts/edge-profile.ps1
```
for deterministic profile cloning, launch, status, and stop operations.
Run
```
scripts/cdp-agent.mjs
```
for target discovery, inspection, interaction, screenshots, and authentication-state transfer. It requires Node.js 22 or newer and no npm packages.

当无需浏览器即可响应请求时，优先使用连接器、API、CLI或原生数据库检查方式。
当内嵌浏览器可用且任务需要已认证的可见UI时，优先尝试使用内嵌浏览器。
当内嵌浏览器目标重定向至SSO时，请用户通过内嵌浏览器完成手动登录。使用其安全认证功能；切勿在聊天中索要密码或一次性验证码（OTP）。
内嵌浏览器验证通过后，若任务需要CDP、企业扩展或可复用配置文件，使用全新Edge路径以实现可靠自动化。
在复用用户已认证的常规Edge配置文件或关闭Edge前，需明确征得用户许可。
仅在Edge关闭后进行复制操作，并复制至隔离的配置文件路径。将复制的配置文件、Cookie、令牌、本地存储及存储状态文件视为凭据。
将CDP绑定至
```
127.0.0.1
```
；切勿将端口、WebSocket端点、配置文件或认证状态暴露至网络、代码库、日志、截图或Oracle审核流程中。
交互前验证租户、主机、路径、标题、已认证DOM及目标页面。切勿猜测第一个标签页或目标ID。
默认使用只读操作。调用该技能的SAP技能必须明确授权写入、发布、部署、计划、模型修改、权限变更或破坏性操作。
浏览器启动、CDP连接或登录重定向成功并不代表请求的SAP任务已完成。

仅在需要时加载指定参考文档：

```
references/edge-cdp-control.md
```
：Edge启动、CDP发现、目标选择及故障恢复。
```
references/auth-state-bootstrap.md
```
：复制已认证的Edge配置文件、导出限定范围的状态（若可用）并将其注入兼容客户端。
```
references/in-app-browser-auth.md
```
：手动内嵌浏览器认证及能力边界。
运行
```
scripts/edge-profile.ps1
```
：实现确定性配置文件克隆、启动、状态查询及停止操作。
运行
```
scripts/cdp-agent.mjs
```
：目标发现、检查、交互、截图及认证状态传输。要求Node.js 22或更高版本，无需npm包。

Standard workflow

标准工作流

1. Classify the task and choose a surface

1. 任务分类并选择操作界面

Record the target application, tenant/host, requested URL, read/write intent, evidence required, and whether the user approved profile reuse. Use this order:

Existing non-browser tool if sufficient.
In-app Browser for visible authenticated UI and manual SSO.
Fresh isolated Edge with loopback CDP for enterprise browser behavior and reusable authentication.
Already-installed Playwright connected over CDP or using local storage state.
Approved desktop/manual assistance or a specification-only handoff.

Do not install Playwright, browser binaries, MCP servers, or extensions in an enterprise environment unless the user explicitly requests and approves that change. If Playwright is unavailable, Edge/CDP remains the primary automation surface.

记录目标应用、租户/主机、请求URL、读写意图、所需证据及用户是否批准复用配置文件。按以下优先级选择：

若现有非浏览器工具足够，优先使用。
内嵌浏览器：用于可见已认证UI及手动SSO场景。
带环回CDP的全新隔离式Edge：用于企业浏览器行为及可复用认证场景。
已安装的Playwright：通过CDP连接或使用本地存储状态。
已批准的桌面/手动协助或仅交付规格说明。

除非用户明确请求并批准，否则请勿在企业环境中安装Playwright、浏览器二进制文件、MCP服务器或扩展。若Playwright不可用，Edge/CDP仍是主要自动化界面。

2. Authenticate in the in-app Browser

2. 在内嵌浏览器中完成认证

Open the target using the installed Browser skill. Inspect visible state. If the page requires SSO, pause for the user to complete the login manually through the supported secure auth flow. Verify a positive signed-in signal on the target domain and retain a screenshot or equivalent evidence when allowed.

Do not extract cookies, local storage, session storage, profile databases, passwords, or tokens from the in-app Browser. Its session is independent from Edge. If it cannot expose an authenticated page after manual login, record the failure and continue to the approved Edge path.

This route runs inside Codex or Claude Desktop. Its runtime validation is deferred to those desktop environments and is not part of the standalone Edge/CDP acceptance tests.

使用已安装的浏览器技能打开目标页面。检查可见状态。若页面需要SSO，暂停流程等待用户通过支持的安全认证流手动完成登录。验证目标域上的登录成功信号，若允许则留存截图或等效证据。

切勿从内嵌浏览器中提取Cookie、本地存储、会话存储、配置文件数据库、密码或令牌。其会话与Edge相互独立。若手动登录后仍无法显示已认证页面，记录失败并继续使用已批准的Edge路径。

此流程在Codex或Claude Desktop中运行，其运行时验证由这些桌面环境负责，不属于独立Edge/CDP验收测试的一部分。

3. Capture live Edge state, then bootstrap fresh Edge

3. 捕获Edge实时状态，然后启动全新Edge

Before touching the user's normal Edge profile, state the intended scope and ask for confirmation:

I will capture the approved SAP session from the currently authenticated Edge target, close normal Edge, and clone its selected profile into an isolated automation directory. May I continue?

If the user declines, ask them to authenticate once in the isolated profile. If they approve:

Identify the normal Edge user-data root, selected
```
Default
```
or
```
Profile N
```
, target URL, tenant host, target path/title, approved SAP origin, and local temporary state-file path.
While normal Edge is still running and visibly authenticated, open
```
edge://inspect/#remote-debugging
```
and enable Allow remote debugging for this browser instance.
Run
```
scripts/cdp-agent.mjs export-auth
```
against the normal user-data directory. Require host, path, and/or title filters that resolve exactly one approved page. Repeat
```
--origin
```
for approved SAP or identity-provider cookie scopes.
Close normal Edge and verify no
```
msedge.exe
```
process still owns the source profile.
Run
```
scripts/edge-profile.ps1 -Action CloneLaunch
```
with the selected profile name and a new or empty automation root. The helper preserves
```
Profile N
```
, refuses non-empty clone destinations, launches with
```
--remote-debugging-port=0
```
, and verifies the listener discovered through
```
DevToolsActivePort
```
.
Run
```
scripts/cdp-agent.mjs inspect
```
and verify tenant, path, title, visible signed-in state, and page readiness.
If cloning lost volatile state, run
```
scripts/cdp-agent.mjs import-auth
```
against the isolated target, reload, and repeat the authenticated-state inspection.
If authentication still fails, ask the user to log in once in the isolated profile. Reuse it later with
```
scripts/edge-profile.ps1 -Action LaunchExisting
```
; never clone over a populated automation root.

The complete Windows commands, path checks, CDP probes, and recovery matrix are in

references/edge-cdp-control.md

and

references/auth-state-bootstrap.md

在操作用户的常规Edge配置文件前，说明预期范围并请求确认：

我将从当前已认证的Edge目标中捕获已批准的SAP会话，关闭常规Edge，并将其选定的配置文件克隆至隔离的自动化目录。是否继续？

若用户拒绝，请他们在隔离配置文件中完成一次登录。若用户批准：

识别常规Edge用户数据根目录、选定的
```
Default
```
或
```
Profile N
```
、目标URL、租户主机、目标路径/标题、已批准的SAP源及本地临时状态文件路径。
在常规Edge仍运行且已登录的状态下，打开
```
edge://inspect/#remote-debugging
```
并启用允许此浏览器实例进行远程调试。
针对常规用户数据目录运行
```
scripts/cdp-agent.mjs export-auth
```
。要求使用主机、路径和/或标题过滤器，确保仅匹配一个已批准页面。对已批准的SAP或身份提供商Cookie范围重复使用
```
--origin
```
参数。
关闭常规Edge并验证无
```
msedge.exe
```
进程仍占用源配置文件。
使用选定的配置文件名称及新的或空的自动化根目录运行
```
scripts/edge-profile.ps1 -Action CloneLaunch
```
。该工具会保留
```
Profile N
```
，拒绝非空克隆目标，以
```
--remote-debugging-port=0
```
启动，并通过
```
DevToolsActivePort
```
验证监听器是否已发现。
运行
```
scripts/cdp-agent.mjs inspect
```
并验证租户、路径、标题、可见登录状态及页面就绪情况。
若克隆丢失了易失性状态，针对隔离目标运行
```
scripts/cdp-agent.mjs import-auth
```
，重新加载页面并再次检查已认证状态。
若认证仍失败，请用户在隔离配置文件中登录一次。后续可使用
```
scripts/edge-profile.ps1 -Action LaunchExisting
```
复用该配置文件；切勿克隆至已填充的自动化根目录。

完整的Windows命令、路径检查、CDP探测及恢复矩阵记录在

references/edge-cdp-control.md

和

references/auth-state-bootstrap.md

中。

4. Operate the verified target

4. 操作已验证的目标

Use the isolated Edge instance directly. Run

scripts/cdp-agent.mjs --help

for the complete command surface. The bundled driver supports deterministic targets, inspection/snapshot, navigation, evaluation, selector or coordinate clicks, text entry, key presses, screenshots, and auth-state export/import without Playwright. Use an existing Playwright installation only when the consuming task needs it; do not install it for this workflow.

Authentication transfer uses CDP

Storage.getCookies

and

Storage.setCookies

plus page-scoped

localStorage

and

sessionStorage

. Recheck SSO redirects, SameSite behavior, certificates, and visible readiness after import. The in-app Browser remains a separate session.

直接使用隔离的Edge实例。运行

scripts/cdp-agent.mjs --help

查看完整命令集。内置驱动支持确定性目标选择、检查/快照、导航、代码评估、选择器或坐标点击、文本输入、按键操作、截图及无需Playwright的认证状态导出/导入。仅当调用任务需要时才使用已安装的Playwright；请勿为此工作流安装Playwright。

认证状态传输使用CDP的

Storage.getCookies

和

Storage.setCookies

方法，以及页面范围的

localStorage

和

sessionStorage

。导入后需重新检查SSO重定向、SameSite行为、证书及可见就绪状态。内嵌浏览器的会话保持独立。

5. Verify readiness and perform the domain action

5. 验证就绪状态并执行领域操作

Before changing anything, verify:

tenant and application identity;
authenticated state, not merely a non-login URL;
correct Story Designer, Modeler, Data Builder, SQL editor, or test target area;
visible readiness markers and absence of blocking errors;
approved host/path and selected target page;
current model/story/widget metadata when the consuming skill requires it.

Capture page-specific evidence and explicit no-data/error states. Do not treat a spinner disappearing, CDP connecting, or a browser window opening as task completion.

在进行任何修改前，验证以下内容：

租户及应用身份；
已认证状态（而非仅仅是非登录URL）；
正确的报表设计器、建模器、数据构建器、SQL编辑器或测试目标区域；
可见就绪标记及无阻塞错误；
已批准的主机/路径及选定的目标页面；
当调用技能需要时，当前模型/报表/组件元数据。

捕获页面特定证据及明确的无数据/错误状态。请勿将加载 spinner 消失、CDP连接成功或浏览器窗口打开视为任务完成。

6. Recover or hand off honestly

6. 故障恢复或如实交付

Use the following fallback sequence:

Retry the selected browser using its documented troubleshooting guidance.
Use the Edge/CDP recovery and
```
DevToolsActivePort
```
fallback.
Ask for one-time manual authentication in the isolated Edge profile.
Use approved desktop/manual assistance if the environment supports it.
If no authenticated target can be verified, stop and provide an implementation-ready specification, the exact missing evidence, and the next manual action.

Report authentication as

verified

missing

expired

blocked

, or

unknown

; never infer success from browser bootstrap alone.

使用以下 fallback 序列：

根据文档中的故障排除指南重试选定的浏览器。
使用Edge/CDP恢复机制及
```
DevToolsActivePort
```
fallback。
请求用户在隔离Edge配置文件中完成一次手动认证。
若环境支持，使用已批准的桌面/手动协助。
若无法验证任何已认证目标，停止操作并提供可直接实现的规格说明、确切缺失的证据及下一步手动操作。

将认证状态报告为

已验证

、

缺失

、

过期

、

被阻止

或

未知

；切勿仅通过浏览器启动成功推断认证成功。

Troubleshooting

故障排除

Common failures are handled in the shared Edge reference: refused or missing CDP endpoints,

discovery responses, wrong targets, SSO redirects, copied profiles that are not authenticated, policy blocks, and runtime/widget errors. When recovery cannot establish a verified authenticated target, stop and hand off the missing evidence rather than guessing or claiming completion.

常见故障处理记录在共享Edge参考文档中：CDP端点被拒绝或缺失、

发现响应、错误目标、SSO重定向、未认证的复制配置文件、策略阻止及运行时/组件错误。若恢复无法建立已验证的已认证目标，停止操作并交付缺失的证据，而非猜测或声称任务完成。

Sources and Verification

来源与验证

The public-source review and the distinction between documented behavior and unverified tenant behavior are recorded in

docs/project/sap-browser-automation-source-review-2026-07-14.md

公开源码审核以及文档化行为与未验证租户行为的区别记录在

docs/project/sap-browser-automation-source-review-2026-07-14.md

中。

Safety and evidence

安全与证据

Profile copies and auth-state files may contain cookies, refresh tokens, saved passwords, history, extensions, and enterprise session data. Keep them in a user-local path with restricted access. Do not place them under the repository, commit them, send them to Oracle, include them in bug reports, or paste their contents into chat. Redact tenant IDs, story IDs, query strings, session-like URL values, cookie values, WebSocket endpoints, and unrelated tabs from evidence.

For any write-capable action, record the approving user, target, intended mutation, before/after verification, and rollback or cleanup status. The consuming SAP skill remains authoritative for whether the action itself is allowed.

配置文件副本及认证状态文件可能包含Cookie、刷新令牌、保存的密码、历史记录、扩展及企业会话数据。请将其存储在用户本地路径并限制访问权限。请勿将其置于代码库下、提交至版本控制、发送至Oracle、包含在 bug 报告中或粘贴至聊天内容里。从证据中编辑掉租户ID、报表ID、查询字符串、类会话URL值、Cookie值、WebSocket端点及无关标签页。

对于任何可写入操作，记录批准用户、目标、预期变更、变更前后验证情况及回滚或清理状态。调用该技能的SAP技能对操作是否允许拥有最终决定权。