feat(fe): describe the browser a session was created from

[sea-snake]

Design: #4224. Overview: #4230. Nothing imports this until the sign-in in #4273.

Settings shows which browsers hold a session so the user can end one they do not recognise, and each entry needs to be something they will recognise. The client is the only party that can see what it is running on, so it is the one that has to say.

describeBrowser resolves the four things the record holds (#4242) — a brand, an operating system, a form factor, and the hardware model where one is reported — rather than composing a label out of them.

Resolving rather than naming is the point. A composed label fixes the wording at the moment of sign-in: a browser that registered before "Chrome OS" became "ChromeOS" would read the old name for as long as its record existed, and the agent it was parsed from is not kept, so nothing could re-derive it. With tokens the wording lives where the list is read (#4249), so renaming a product — or teaching this table to recognise a browser it used to miss — reaches every stored record instead of only the browsers that sign in afterwards.

Two sources, because neither covers the field alone. The user agent carries the brand and the system on every engine, and its table stays ordered most specific first, because every later token appears inside the earlier ones' agents: matching Chrome first would claim every Chromium-based browser, and every Chromium agent carries Safari/ as well. Client hints are Chromium-only — Safari and Firefox expose nothing at all — so they supply only what no agent can: the hardware model, which a reduced Android agent reports as the literal string K, and a form factor the browser states rather than one inferred. Only the plural formFactors is asked for; the singular shape Chromium shipped first is not, because only current browsers are a concern. A stated Watch, XR, Automotive or EInk resolves to Unknown: the canister names desktops, mobiles and tablets, and calling a watch a phone is worse than naming it as none of them.

A browser that hides reads as the one it imitates. Brave ships a plain Chrome agent on purpose and strips the hints that would give it away, so it reads as Chrome — which is what the agent says, and the honest answer rather than a gap. Asking navigator.brave.isBrave() would name it, at the cost of a check per browser this frontend has heard of, which is the hardcoded list this table exists to avoid. A browser that does name itself in its agent, Vivaldi or DuckDuckGo, travels as the token it gave rather than resolving to Chrome, without needing a row of its own.

An unrecognised browser or system is carried as the token that arrived, capped to what the canister accepts, because that row is the one this list exists to surface. maxTouchPoints is consumed here rather than stored: an iPad in desktop mode sends a Mac agent and exposes no hints, so it is the only thing that tells it from a Mac.

Tests: describeBrowser.test.ts (37) — the 20 real user-agent strings, one per rung of both ladders, including the iPad and Mac pair separated only by maxTouchPoints; the model used when present and absent when empty or refused; a stated form factor, the four that resolve to Unknown, and a tablet stated beside one of them; a browser that hides itself reading as the one it imitates; and an unrecognised token capped to 64 bytes.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to c83b3e0.

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/6d3e3b61-710b-4b2b-9c0b-43458b6314b6?scanId=9576586e-81d5-4fff-9252-431d9d7472da&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► src/frontend/src/lib/utils/describeBrowser.ts     Implement Vercel OAuth Flow

[Copilot]

🟡 Changes recommended

Brave and singular form-factor hints are unsupported, and Unicode truncation can corrupt tokens.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds browser metadata resolution for future session/device management.

Changes:

• Resolves browser, OS, form factor, and hardware model.
• Caps stored tokens and adds UA/client-hint tests.

File summaries

File	Description
describeBrowser.ts	Implements browser description resolution.
describeBrowser.test.ts	Tests user agents, hints, and limits.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 3
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.