fix(browser): reject partial fetch proxy

Author: MagMueller

packages/bcode-browser/src/fetch-use.ts

@@ -28,19 +28,25 @@ export class Service extends Context.Service<Service, {
   readonly fetch: (url: string, opts: { timeoutMs: number }) => Effect.Effect<FetchResult, Error>
 }>()("@browser-use/FetchUse") {}
 
-export const makeLayer = (options: { endpoint: string; apiKey: string; proxyToken: string }) =>
+export const makeLayer = (options: { proxyUrl: string; apiKey: string; proxyToken: string }) =>
   Layer.effect(
     Service,
     Effect.gen(function* () {
       const http = yield* HttpClient.HttpClient
+      const hasProxySetting = options.proxyUrl.length > 0 || options.proxyToken.length > 0
+      const proxyEnabled = options.proxyUrl.length > 0 && options.proxyToken.length > 0
+      const directEnabled = !hasProxySetting && options.apiKey.length > 0
       return Service.of({
-        enabled: options.proxyToken.length > 0 || options.apiKey.length > 0,
+        enabled: proxyEnabled || directEnabled,
         fetch: (url, { timeoutMs }) =>
           Effect.gen(function* () {
-            const auth = options.proxyToken
+            if (!proxyEnabled && !directEnabled) {
+              return yield* Effect.fail(new Error("fetch-use credentials are missing or partially configured"))
+            }
+            const auth = proxyEnabled
               ? { Authorization: `Bearer ${options.proxyToken}` }
               : { "X-Browser-Use-API-Key": options.apiKey }
-            const request = yield* HttpClientRequest.post(options.endpoint).pipe(
+            const request = yield* HttpClientRequest.post(proxyEnabled ? options.proxyUrl : DEFAULT_ENDPOINT).pipe(
               HttpClientRequest.setHeaders({ "Content-Type": "application/json", ...auth }),
               HttpClientRequest.bodyJson({ url, timeout_ms: timeoutMs }),
             )
@@ -62,7 +68,7 @@ export const makeLayer = (options: { endpoint: string; apiKey: string; proxyToke
   )
 
 export const layer = makeLayer({
-  endpoint: process.env.BROWSER_USE_FETCH_URL ?? DEFAULT_ENDPOINT,
+  proxyUrl: process.env.BROWSER_USE_FETCH_URL ?? "",
   apiKey: process.env.BROWSER_USE_API_KEY ?? "",
   proxyToken: process.env.BROWSER_USE_FETCH_TOKEN ?? "",
 })

packages/bcode-browser/test/fetch-use.test.ts

@@ -53,7 +53,7 @@ test("scoped proxy token uses bearer auth instead of the API-key header", async
     }).pipe(
       Effect.provide(
         FetchUse.makeLayer({
-          endpoint: server.url.toString(),
+          proxyUrl: server.url.toString(),
           apiKey: "",
           proxyToken: "v4rt_test",
         }).pipe(Layer.provide(FetchHttpClient.layer)),
@@ -69,3 +69,19 @@ test("scoped proxy token uses bearer auth instead of the API-key header", async
     server.stop(true)
   }
 })
+
+test.each([
+  { proxyUrl: "https://proxy.example/fetch", proxyToken: "", apiKey: "bu_secret" },
+  { proxyUrl: "", proxyToken: "v4rt_secret", apiKey: "bu_secret" },
+])("partial proxy configuration fails closed", async (options) => {
+  const result = await Effect.gen(function* () {
+    const service = yield* FetchUse.Service
+    expect(service.enabled).toBe(false)
+    return yield* Effect.flip(service.fetch("https://example.com", { timeoutMs: 1_000 }))
+  }).pipe(
+    Effect.provide(FetchUse.makeLayer(options).pipe(Layer.provide(FetchHttpClient.layer))),
+    Effect.runPromise,
+  )
+
+  expect(result.message).toContain("partially configured")
+})