Persist Chrome profile across restarts via Postgres snapshot

Hugging Face Spaces have an ephemeral filesystem, so the Chrome
user-data dir (cookies / logins) is wiped on every restart and rebuild.
Snapshot it into Postgres (Neon) instead:

- profilesync: a small Go tool that tar+gzips /home/chrome/data into a
Postgres bytea blob (backup) and extracts it back (restore). Cache/junk
dirs are excluded so the blob stays small. Connection comes from the
DATABASE_URL env var — the credential is never hardcoded.
- Dockerfile: build the profilesync binary and ship it in /opt/profilesync.
- start_hf.sh: restore the profile on boot, back it up on shutdown (after
Chrome closes its files) and every 5 min as a safety net. All guarded by
DATABASE_URL, so the Space still runs fine without the secret.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -1,9 +1,15 @@
-# Build the 3-tab monitor server (GPT / Gemini / Flow live view) from source.
+# Build the navigator monitor server (GPT / Gemini / Flow live view) from source.
 FROM golang:1.22-bookworm AS monitor-build
 WORKDIR /src
 COPY monitor/ ./
 RUN go mod tidy && CGO_ENABLED=0 go build -ldflags="-s -w" -o /monitor .
 
+# Build the profile-sync tool that snapshots the Chrome profile to Postgres (Neon).
+FROM golang:1.22-bookworm AS profilesync-build
+WORKDIR /src
+COPY profilesync/ ./
+RUN go mod tidy && CGO_ENABLED=0 go build -ldflags="-s -w" -o /profilesync .
+
 FROM akashyadav758/chrome:latest
 
 USER root
@@ -16,6 +22,9 @@ COPY flow-agent/Flow-extension /opt/flow-extension
 # 3-tab monitor binary (replaces the single-view base monitor)
 COPY --from=monitor-build /monitor /opt/monitor3/monitor
 
+# Profile-sync binary (Chrome profile <-> Postgres snapshot)
+COPY --from=profilesync-build /profilesync /opt/profilesync/profilesync
+
 # Install Chrome for Testing (unbranded). Branded google-chrome-stable (>=128)
 # silently ignores --load-extension, so unpacked extensions never load. CfT is the
 # unbranded build of the same Chrome version where --load-extension still works.
@@ -29,8 +38,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends unzip && \
 
 # Set correct permissions and ownership
 RUN rm -rf /opt/flow-extension/_metadata && \
-    chown -R 1000:1000 /opt/gpt-extension /opt/gemini-extension /opt/flow-extension /opt/chrome-linux64 /opt/monitor3 && \
-    chmod -R 755 /opt/gpt-extension /opt/gemini-extension /opt/flow-extension /opt/chrome-linux64 /opt/monitor3
+    chown -R 1000:1000 /opt/gpt-extension /opt/gemini-extension /opt/flow-extension /opt/chrome-linux64 /opt/monitor3 /opt/profilesync && \
+    chmod -R 755 /opt/gpt-extension /opt/gemini-extension /opt/flow-extension /opt/chrome-linux64 /opt/monitor3 /opt/profilesync
 
 # Replace the start script with the non-root version
 COPY --chmod=755 start_hf.sh /start.sh

profilesync/go.mod

@@ -0,0 +1,12 @@
+module profilesync
+
+go 1.22
+
+require github.com/jackc/pgx/v5 v5.6.0
+
+require (
+	github.com/jackc/pgpassfile v1.0.0 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
+	golang.org/x/crypto v0.17.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
+)

profilesync/go.sum

@@ -0,0 +1,28 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
+github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
+github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgx/v5 v5.6.0 h1:SWJzexBzPL5jb0GEsrPMLIsi/3jOo7RHlzTjcAeDrPY=
+github.com/jackc/pgx/v5 v5.6.0/go.mod h1:DNZ/vlrUnhWCoFGxHAG8U2ljioxukquj7utPDgtQdTw=
+github.com/jackc/puddle/v2 v2.2.1 h1:RhxXJtFG022u4ibrCSMSiu5aOq1i77R3OHKNJj77OAk=
+github.com/jackc/puddle/v2 v2.2.1/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
+golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
+golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

profilesync/main.go

@@ -0,0 +1,220 @@
+// profilesync persists the Chrome user-data profile across Hugging Face Space
+// restarts/rebuilds by snapshotting it into a Postgres (Neon) bytea blob.
+//
+//	profilesync restore  — pull the latest snapshot and extract it (run at boot)
+//	profilesync backup   — tar+gzip the profile and upsert it (run on shutdown / periodically)
+//
+// The connection string comes from the DATABASE_URL env var (a Space secret) — it
+// is never hardcoded. Cache/junk directories are excluded so the blob stays small
+// enough for Neon's free tier; only login state (cookies, Local Storage, IndexedDB,
+// Login Data, …) is kept.
+package main
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"errors"
+	"io"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+)
+
+const (
+	profileDir = "/home/chrome/data" // Chrome --user-data-dir
+	baseName   = "data"              // archive top-level dir
+)
+
+func main() {
+	log.SetFlags(0)
+	log.SetPrefix("[profilesync] ")
+
+	if len(os.Args) < 2 {
+		log.Fatal("usage: profilesync [backup|restore]")
+	}
+	mode := os.Args[1]
+
+	dsn := os.Getenv("DATABASE_URL")
+	if dsn == "" {
+		log.Println("DATABASE_URL not set — skipping")
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
+	defer cancel()
+
+	conn, err := pgx.Connect(ctx, dsn)
+	if err != nil {
+		log.Fatalf("connect: %v", err)
+	}
+	defer conn.Close(ctx)
+
+	if _, err := conn.Exec(ctx, `CREATE TABLE IF NOT EXISTS chrome_profile (
+		id         int PRIMARY KEY DEFAULT 1,
+		updated_at timestamptz DEFAULT now(),
+		data       bytea
+	)`); err != nil {
+		log.Fatalf("create table: %v", err)
+	}
+
+	switch mode {
+	case "backup":
+		if err := backup(ctx, conn); err != nil {
+			log.Fatalf("backup: %v", err)
+		}
+	case "restore":
+		if err := restore(ctx, conn); err != nil {
+			log.Fatalf("restore: %v", err)
+		}
+	default:
+		log.Fatalf("unknown mode %q (want backup|restore)", mode)
+	}
+}
+
+// skipSegment reports whether a path segment is cache/junk we never persist.
+func skipSegment(name string) bool {
+	if strings.Contains(name, "Cache") || strings.HasPrefix(name, "Singleton") {
+		return true
+	}
+	switch name {
+	case "Crashpad", "component_crx_cache", "optimization_guide_model_store",
+		"GraphiteDawnCache", "BrowserMetrics", "Safe Browsing", "LOCK", "LOG.old":
+		return true
+	}
+	return false
+}
+
+func backup(ctx context.Context, conn *pgx.Conn) error {
+	if _, err := os.Stat(profileDir); err != nil {
+		log.Printf("profile dir %s missing — nothing to back up", profileDir)
+		return nil
+	}
+
+	var buf bytes.Buffer
+	gz := gzip.NewWriter(&buf)
+	tw := tar.NewWriter(gz)
+
+	walkErr := filepath.Walk(profileDir, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return nil // skip unreadable entries
+		}
+		rel, err := filepath.Rel(profileDir, path)
+		if err != nil || rel == "." {
+			return nil
+		}
+		for _, seg := range strings.Split(rel, string(os.PathSeparator)) {
+			if skipSegment(seg) {
+				if info.IsDir() {
+					return filepath.SkipDir
+				}
+				return nil
+			}
+		}
+		if !info.IsDir() && !info.Mode().IsRegular() {
+			return nil // skip sockets/symlinks/etc.
+		}
+		hdr, err := tar.FileInfoHeader(info, "")
+		if err != nil {
+			return nil
+		}
+		hdr.Name = filepath.ToSlash(filepath.Join(baseName, rel))
+		if info.IsDir() {
+			hdr.Name += "/"
+		}
+		if err := tw.WriteHeader(hdr); err != nil {
+			return err
+		}
+		if info.IsDir() {
+			return nil
+		}
+		f, err := os.Open(path)
+		if err != nil {
+			return nil // file vanished or locked — skip it
+		}
+		defer f.Close()
+		io.Copy(tw, f)
+		return nil
+	})
+	if walkErr != nil {
+		return walkErr
+	}
+	if err := tw.Close(); err != nil {
+		return err
+	}
+	if err := gz.Close(); err != nil {
+		return err
+	}
+
+	if _, err := conn.Exec(ctx,
+		`INSERT INTO chrome_profile (id, data, updated_at) VALUES (1, $1, now())
+		 ON CONFLICT (id) DO UPDATE SET data = EXCLUDED.data, updated_at = now()`,
+		buf.Bytes()); err != nil {
+		return err
+	}
+	log.Printf("backed up %d KB (compressed) to Postgres", buf.Len()/1024)
+	return nil
+}
+
+func restore(ctx context.Context, conn *pgx.Conn) error {
+	var data []byte
+	err := conn.QueryRow(ctx, `SELECT data FROM chrome_profile WHERE id = 1`).Scan(&data)
+	if errors.Is(err, pgx.ErrNoRows) {
+		log.Println("no snapshot yet — fresh start")
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if len(data) == 0 {
+		log.Println("empty snapshot — fresh start")
+		return nil
+	}
+
+	gz, err := gzip.NewReader(bytes.NewReader(data))
+	if err != nil {
+		return err
+	}
+	defer gz.Close()
+	tr := tar.NewReader(gz)
+
+	root := filepath.Dir(profileDir) // /home/chrome ; "data/..." lands at /home/chrome/data/...
+	cleanRoot := filepath.Clean(root)
+	var n int
+	for {
+		hdr, err := tr.Next()
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		if err != nil {
+			return err
+		}
+		target := filepath.Join(root, filepath.Clean(hdr.Name))
+		if target != cleanRoot && !strings.HasPrefix(target, cleanRoot+string(os.PathSeparator)) {
+			continue // guard against path traversal
+		}
+		switch hdr.Typeflag {
+		case tar.TypeDir:
+			os.MkdirAll(target, 0o755)
+		case tar.TypeReg:
+			os.MkdirAll(filepath.Dir(target), 0o755)
+			f, err := os.OpenFile(target, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, os.FileMode(hdr.Mode)&0o777)
+			if err != nil {
+				return err
+			}
+			if _, err := io.Copy(f, tr); err != nil {
+				f.Close()
+				return err
+			}
+			f.Close()
+			n++
+		}
+	}
+	log.Printf("restored %d files from Postgres snapshot", n)
+	return nil
+}

start_hf.sh

@@ -5,12 +5,25 @@ cleanup() {
     echo "🛑 Shutting down..."
     pkill -TERM -f chrome-linux64 2>/dev/null || true
     sleep 5
+    # Snapshot the profile (cookies/logins) to Postgres after Chrome has closed
+    # its files, so the next boot restores a consistent login state.
+    if [ -n "$DATABASE_URL" ]; then
+        echo "💾 Backing up Chrome profile to Postgres..."
+        /opt/profilesync/profilesync backup || echo "⚠️  Backup failed"
+    fi
     exit 0
 }
 trap cleanup SIGTERM SIGINT
 
 echo "🚀 Starting Chrome Headless Boot Sequence on Hugging Face Spaces..."
 
+# 0. Restore Chrome profile from Postgres snapshot (survives HF restart/rebuild).
+#    DATABASE_URL is a Space secret — never hardcode the credential here.
+if [ -n "$DATABASE_URL" ]; then
+    echo "📥 Restoring Chrome profile from Postgres..."
+    /opt/profilesync/profilesync restore || echo "⚠️  Restore skipped/failed (first run?)"
+fi
+
 # 1. Structure Detection & Fix
 if [ -d "/home/chrome/data/data/Default" ]; then
     echo "⚠️  Nested structure detected. Fixing..."
@@ -93,6 +106,13 @@ touch /home/chrome/chrome.log
 echo "🔌 Starting CDP Proxy..."
 socat TCP-LISTEN:9223,fork,bind=0.0.0.0 TCP:127.0.0.1:9222 &
 
+# 6b. Periodic profile backup (safety net if HF kills the container without a clean
+#     SIGTERM). Best-effort every 5 minutes; the shutdown trap does the final one.
+if [ -n "$DATABASE_URL" ]; then
+    echo "🗄️  Profile auto-backup every 5 min enabled."
+    ( while sleep 300; do /opt/profilesync/profilesync backup >/dev/null 2>&1 || true; done ) &
+fi
+
 # 7. Launch Chrome Headless
 echo "✨ Launching Chrome Headless..."
 /opt/chrome-linux64/chrome \