{"slug": "lightpanda-session-bridge-hand-real-logins-to-headless-ai-agents", "title": "Lightpanda Session Bridge – Hand real logins to headless AI agents", "summary": "Raknaos released Lightpanda Session Bridge, an open-source tool that transfers authenticated browser sessions from Chrome, Comet, or Edge into the Lightpanda headless browser via CDP, enabling AI agents to operate on real logins without exposing credentials. The tool filters and validates cookies and local storage, blocks identity provider domains, and claims 9x faster speeds and 16x less memory than Chrome.", "body_md": "**[Live Showcase Website](https://raknaos.github.io/lightpanda-session-bridge/)** · **[Read Article on DEV.to](https://dev.to/raknaos/handing-real-logins-to-headless-ai-agents-building-the-lightpanda-session-bridge-17je)** · **[Architecture](#-architecture)** · **[Quickstart](#-quickstart)** · **[Security Standard](#-security-guarantees)** · [Python SDK](#-python-sdk)\n\nSeamlessly bridge real-world authenticated web sessions (Google OAuth, Passkeys, SSO, 2FA) from your primary browser (Chrome / Comet / Edge) into a fast, isolated **Lightpanda** headless browser runtime in a single click. **Zero credentials typed, zero secrets exposed to LLMs.**\n\nModern web services (SaaS consoles, API dashboards, cloud providers) protect their dashboards with Google OAuth, multi-factor authentication, and bot mitigations.\n\nAutonomous AI agents using headless browsers cannot easily log in themselves without requiring sensitive credentials, passwords, or handling complex OTP prompts.\n\n**Lightpanda Session Bridge** solves this fundamental friction:\n\n1. **You log in naturally** in your favorite desktop browser (using your actual Google account or Passkey).\n2. **Click the Bridge extension** (or run the CLI tool): your session cookies and local storage are filtered, validated, and injected over CDP into Lightpanda.\n3. **Your AI agents operate autonomously** in the background on the real authenticated session at 9x the speed of Chrome and with 16x less memory.\n\n- **🛡️ Strict Origin Scoping:** Loopback addresses, private networks, identity provider root domains (`accounts.google.com` ,`login.microsoftonline.com` ,`auth0.com` ,`github.com` ) are permanently blocked. Only target SaaS domains (e.g.,`a6api.com` ,`mail.google.com` ,`console.cloud.google.com` ) are admitted.\n- **🍪 RFC 6265bis Compliance (`__Host-` / `__Secure-`):** Domain attributes on domain-locked cookies are automatically normalized to guarantee zero rejection by Lightpanda's CDP parser.\n- **⚡ CDP Enum Translation:** Automatic translation of Chromium's lowercase`sameSite` strings (`no_restriction` ,`lax` ) into strict PascalCase enum tags (`Strict` ,`Lax` ,`None` ) preventing`-31998 InvalidEnumTag` errors.\n- **🔑 Zero Secret Leakage:** No passwords, refresh tokens, or API keys are ever stored in disk logs or transmitted in chat histories.\n\n```\nflowchart LR\n    subgraph Host [\"Your Desktop Browser (Comet / Chrome)\"]\n        A[User authenticates via Google OAuth / 2FA] --> B[Lightpanda Bridge Extension MV3]\n    end\n\n    subgraph Guard [\"Loopback Guard Relay (:8765)\"]\n        B -- HTTP POST Encrypted JSON --> C[Python Bridge Server]\n        C -- Origin & Domain Validation --> D[RFC Normalizer]\n    end\n\n    subgraph Runtime [\"Headless Execution (WSL2 :9222)\"]\n        D -- CDP WebSocket Transport --> E[Lightpanda Zig/V8 Kernel]\n        E --> F[(Isolated Memory Profile)]\n    end\n\n    subgraph Agents [\"Autonomous AI Coding Agents\"]\n        G[Hermes / Claude / Codex Agent] -->|lightpanda_client.py| E\n    end\n```\n\n| Requirement | Why | Install | \n|---|---|---|\n| **WSL2 with Ubuntu** | Lightpanda runs natively in Linux | `wsl --install -d Ubuntu` | \n| **Lightpanda binary** (in WSL,`~/lightpanda` ) | Headless CDP browser engine | Inside WSL: `curl -fsSL https://pkg.lightpanda.io/install.sh \\| bash` (see[lightpanda.io](https://lightpanda.io) ) | \n| **Python 3.10+** | Relay server & SDK | [python.org](https://www.python.org/downloads/) | \n| **Python dependencies** | `websocket-client` for CDP | `pip install -r requirements.txt` | \n\n**Windows Firewall:** when WSL2 launches Lightpanda, accept the firewall prompt so `127.0.0.1:9222` stays reachable from Windows.\n\n```\ngit clone https://github.com/Raknaos/lightpanda-session-bridge.git\ncd lightpanda-session-bridge\npip install -r requirements.txt\n./scripts/start-lightpanda.ps1\n```\n\n*Listens on `http://127.0.0.1:9222`. Keep this terminal window open.*\n\n```\n./scripts/start-relay.ps1\n```\n\n*Listens on loopback `http://127.0.0.1:8765`. Keep this terminal window open.*\n\n1. Open `chrome://extensions` (or Comet / Edge extension manager).\n2. Enable **Developer Mode** .\n3. Click **Load unpacked** and select the`extension/` folder.\n4. Pin the 🐼 **Lightpanda Bridge** icon to your toolbar.\n\nOn first use the extension **auto-pairs** with the local relay: the first time you open the popup it fetches the shared secret from the relay's `/v1/bootstrap` endpoint and stores it in its own isolated storage. No manual token copy is needed — just open the popup once with the relay running, then close and reopen it.\n\n**What if the popup shows `relay offline`?** Start the relay (step 3), then reopen the popup. The badge must read **online** before syncing.\n\n**Updating the extension:** because Chrome only auto-updates extensions signed for the Chrome Web Store (or pushed via enterprise policy), the `update_url` manifest points at GitHub Releases as a manual-check channel. To update: download the latest `.zip` from [Releases](https://github.com/Raknaos/lightpanda-session-bridge/releases) and **Load unpacked** it again (your relay secret is stored in the extension, so pairing survives reloads). A Web Store publication is planned.\n\n**Security note:** `/v1/bootstrap` only answers to callers carrying a real `chrome-extension://` Origin — web pages, curl and other local processes are refused (HTTP 403), so the shared secret can only ever reach the official extension.\n\nOnce a session is synchronized, autonomous agents can interact directly with the authenticated page:\n\n``` python\nfrom lightpanda_client import LightpandaClient\n\n# Connect to the running Lightpanda runtime\nclient = LightpandaClient(cdp_ws=\"ws://127.0.0.1:9222/\")\nclient.connect()\n\n# Attach to the synchronized session target\nclient.attach_or_create(\"https://a6api.com/console/log\")\n\n# Evaluate and extract authenticated data in memory\nstats = client.evaluate(\"\"\"(async () => {\n    let res = await fetch('/api/user/self');\n    return await res.json();\n})()\"\"\")\n\nprint(f\"Logged in user: {stats['data']['username']}\")\nclient.close()\n```\n\nRun the unit test suite covering private IP rejection, IdP blocking, and CDP envelope validation:\n\n```\npython -m unittest discover -s tests -v\npython relay/server.py --self-test\n```\n\n- **License:** MIT License.\n- **Upstream Browser Engine:**[Lightpanda.io](https://lightpanda.io) ([GitHub](https://github.com/lightpanda-io/browser) ).\n- **Bridge Authors:** Raknaos & Nous Research.", "url": "https://wpnews.pro/news/lightpanda-session-bridge-hand-real-logins-to-headless-ai-agents", "canonical_source": "https://github.com/Raknaos/lightpanda-session-bridge", "published_at": "2026-09-07 22:17:06+00:00", "updated_at": "2026-09-07 22:30:51.845276+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools"], "entities": ["Lightpanda", "Raknaos", "Chrome", "Comet", "Edge", "Google OAuth", "Lightpanda Session Bridge"], "alternates": {"html": "https://wpnews.pro/news/lightpanda-session-bridge-hand-real-logins-to-headless-ai-agents", "markdown": "https://wpnews.pro/news/lightpanda-session-bridge-hand-real-logins-to-headless-ai-agents.md", "text": "https://wpnews.pro/news/lightpanda-session-bridge-hand-real-logins-to-headless-ai-agents.txt", "jsonld": "https://wpnews.pro/news/lightpanda-session-bridge-hand-real-logins-to-headless-ai-agents.jsonld"}}