let's integreate intercom with newtab by shivammittal274 · Pull Request #327 · browseros-ai/BrowserOS-agent

shivammittal274 · 2026-02-11T17:06:23Z

Summary

let's integreate intercom with newtab

Changes

apps/agent/.env.example                            |   1 +
 apps/agent/entrypoints/app/main.tsx                |  11 +-
 apps/agent/entrypoints/intercom.sandbox/index.html |  17 +++
 apps/agent/entrypoints/intercom.sandbox/main.ts    | 101 +++++++++++++++++
 apps/agent/lib/env.ts                              |   1 +
 apps/agent/lib/intercom/IntercomProvider.tsx       | 119 +++++++++++++++++++++
 apps/agent/lib/intercom/intercom.ts                |  57 ++++++++++
 apps/agent/wxt.config.ts                           |  11 ++
 8 files changed, 314 insertions(+), 4 deletions(-)

Agent Metadata

Total cost: $8.1112
Stages:
- ok setup ($0.0000, 40.1s)
- ok plan ($3.9050, 887.6s)
- ok implement ($4.2062, 1030.6s)

Generated by coding-agent v3

Task ID: -qTW5pyG

github-actions · 2026-02-11T17:06:36Z

Thank you for your contribution! Before we can merge this PR, we need you to sign our Contributor License Agreement.

To sign the CLA, please add a comment to this PR with the following text:

I have read the CLA Document and I hereby sign the CLA

You only need to sign once. After signing, this check will pass automatically.

Troubleshooting

Already signed but still failing? Comment recheck to trigger a re-verification.
Signed with a different email? Make sure your commit email matches your GitHub account email, or add your commit email to your GitHub account.

- - - I have read the CLA Document and I hereby sign the CLA - - - **BrowserOS Coding Agent** seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please [add the email address used for this commit to your account](https://help.github.com/articles/why-are-my-commits-linked-to-the-wrong-user/#commits-are-not-linked-to-any-user).
_{You can retrigger this bot by commenting **recheck** in this Pull Request.}_{Posted by the **CLA Assistant Lite bot**.}

claude · 2026-02-11T17:11:26Z

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

greptile-apps · 2026-02-11T17:29:13Z

Greptile Overview

Greptile Summary

This PR adds an Intercom integration to the extension’s new tab app by wrapping the React tree in an IntercomProvider. The provider renders a fixed-position sandbox iframe (intercom.html) and communicates with it via postMessage to boot Intercom, update identity based on useSessionInfo(), and track open/close events. A new sandbox entrypoint loads the Intercom widget script and forwards basic lifecycle events back to the parent. The manifest config is updated with a sandbox CSP to allow Intercom’s resources, and a new VITE_PUBLIC_INTERCOM_APP_ID env var is introduced.

Confidence Score: 3/5

This PR is mergeable after fixing message validation and initial identity sync reliability.
Core integration approach is reasonable, but current postMessage usage lacks sender/origin validation and the provider can miss syncing identity when session loads before the iframe boots. These are real security/correctness issues to address before merging.
apps/agent/lib/intercom/IntercomProvider.tsx, apps/agent/entrypoints/intercom.sandbox/main.ts

Important Files Changed

Filename	Overview
.gitignore	Adds .agent/ to gitignore; low risk.
apps/agent/.env.example	Adds VITE_PUBLIC_INTERCOM_APP_ID example env var; low risk.
apps/agent/entrypoints/app/main.tsx	Wraps app in IntercomProvider; behavior change is straightforward.
apps/agent/entrypoints/intercom.sandbox/index.html	Adds sandbox HTML entrypoint to load TS module; ensure it’s packaged as intercom.html.
apps/agent/entrypoints/intercom.sandbox/main.ts	Implements Intercom sandbox boot/update via postMessage; currently uses '*' targetOrigin and doesn’t validate sender.
apps/agent/lib/env.ts	Extends env schema with optional VITE_PUBLIC_INTERCOM_APP_ID; low risk.
apps/agent/lib/intercom/IntercomProvider.tsx	Adds provider injecting Intercom sandbox iframe and syncing session identity; has sender/origin validation gaps and may miss initial identity sync if iframe loads late.
apps/agent/lib/intercom/intercom.ts	Adds typed message/event definitions and sandbox event guard; guard only checks type string.
apps/agent/wxt.config.ts	Adds CSP sandbox directives to allow Intercom resources; verify this matches Chrome extension CSP expectations and doesn’t over-broaden policies.

Sequence Diagram

sequenceDiagram
  participant NewTab as NewTab (app entrypoint)
  participant Provider as IntercomProvider (React)
  participant Intercom as Intercom JS bootstrap
  participant iframe as Sandbox iframe (intercom.sandbox)

  NewTab->>Provider: Render app
  Provider->>Intercom: init(appId)
  Intercom->>iframe: create hidden iframe + inject script
  iframe->>Intercom: postMessage "intercom-ready"
  Provider->>Intercom: update(user/context)
  Intercom-->>NewTab: ready/event callbacks

greptile-apps

_{9 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-11T17:29:16Z

apps/agent/lib/intercom/IntercomProvider.tsx

+import type { FC, PropsWithChildren } from 'react'
+import { useEffect, useRef, useState } from 'react'
+import { useSessionInfo } from '@/lib/auth/sessionStorage'


Sandbox boot may be missed
If sessionInfo resolves before the iframe onLoad fires, the identity sync effect posts intercom:update while iframeWindowRef.current is still null, and there’s no retry after boot. In that scenario, Intercom will boot without user identity until a later session change occurs. Consider sending an intercom:update after intercom:ready (or after handleIframeLoad) when sessionInfo.user is already available.

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/agent/lib/intercom/IntercomProvider.tsx Line: 1:3 Comment: **Sandbox boot may be missed** If `sessionInfo` resolves before the iframe `onLoad` fires, the identity sync effect posts `intercom:update` while `iframeWindowRef.current` is still `null`, and there’s no retry after boot. In that scenario, Intercom will boot without user identity until a later session change occurs. Consider sending an `intercom:update` after `intercom:ready` (or after `handleIframeLoad`) when `sessionInfo.user` is already available. How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-02-11T17:29:18Z

apps/agent/lib/intercom/IntercomProvider.tsx

+  const [isMessengerOpen, setIsMessengerOpen] = useState(false)
+  const { sessionInfo, isLoading } = useSessionInfo()
+
+  const handleIframeLoad = () => {


postMessage accepts any origin
postMessage(..., '*') combined with a sandbox that also posts with '*' means any frame/window can spoof intercom:* messages to this page. Even though the listener checks type, it doesn’t verify event.source === iframeRef.current?.contentWindow (or an expected origin), so a malicious page could toggle state or trigger shutdown/update. Tighten validation to only accept messages from the sandbox iframe window.

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/agent/lib/intercom/IntercomProvider.tsx Line: 27:30 Comment: **postMessage accepts any origin** `postMessage(..., '*')` combined with a sandbox that also posts with `'*'` means any frame/window can spoof `intercom:*` messages to this page. Even though the listener checks `type`, it doesn’t verify `event.source === iframeRef.current?.contentWindow` (or an expected origin), so a malicious page could toggle state or trigger shutdown/update. Tighten validation to only accept messages from the sandbox iframe window. How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-02-11T17:29:18Z

apps/agent/entrypoints/intercom.sandbox/main.ts

+  parent.postMessage(message, '*')
+}
+
+function initIntercomStub() {


postMessage targetOrigin too broad
The sandbox sends events via parent.postMessage(message, '*'), which allows any embedding origin to receive Intercom state events if this page is ever embedded outside the extension context. Since the parent is expected to be the extension page, pass an explicit targetOrigin (or at least validate event.origin on the parent side and restrict event.source).

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/agent/entrypoints/intercom.sandbox/main.ts Line: 13:16 Comment: **postMessage targetOrigin too broad** The sandbox sends events via `parent.postMessage(message, '*')`, which allows any embedding origin to receive Intercom state events if this page is ever embedded outside the extension context. Since the parent is expected to be the extension page, pass an explicit `targetOrigin` (or at least validate `event.origin` on the parent side and restrict `event.source`). How can I resolve this? If you propose a fix, please make it concise.

BrowserOS Coding Agent added 2 commits February 11, 2026 16:34

chore: baseline setup

f640b5c

feat(agent): let's integreate intercom with newtab

5bf1cbf

Task ID: -qTW5pyG

greptile-apps bot reviewed Feb 11, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

let's integreate intercom with newtab#327

let's integreate intercom with newtab#327
shivammittal274 wants to merge 2 commits intomainfrom
feat/-qTW5pyG-lets-integreate-intercom-with-newtab

shivammittal274 commented Feb 11, 2026

Uh oh!

github-actions bot commented Feb 11, 2026

Uh oh!

claude bot commented Feb 11, 2026

Uh oh!

greptile-apps bot commented Feb 11, 2026

Uh oh!

greptile-apps bot left a comment

Uh oh!

greptile-apps bot Feb 11, 2026

Uh oh!

greptile-apps bot Feb 11, 2026

Uh oh!

greptile-apps bot Feb 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

shivammittal274 commented Feb 11, 2026

Summary

Changes

Agent Metadata

Uh oh!

github-actions bot commented Feb 11, 2026

Uh oh!

claude bot commented Feb 11, 2026

Code review

Uh oh!

greptile-apps bot commented Feb 11, 2026

Greptile Overview

Greptile Summary

Confidence Score: 3/5

Important Files Changed

Sequence Diagram

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant