after moving all to cipher

worker-toolkit-stocks-in-the-future/scripts/build-workspace.sh

@@ -62,6 +62,33 @@ WORKSPACE="$TASK_DIR/environment/workspace"
 echo "Building workspace for $TASK_SLUG"
 echo "  Commit: $COMMIT"
 
+# `browser = true` in task.toml gives the trial Playwright + Chromium. The build has no way
+# to read task.toml — a Dockerfile can only see its build context — so the answer is written
+# here as a file the Dockerfile COPYs.
+#
+# ALWAYS write it, including the "0" case: the COPY is unconditional, and a missing source
+# fails the build. Accepts `true` and `"true"`, since the quoted form is a plausible hand-edit
+# and rejecting it would silently give a task no browser after its author asked for one.
+BROWSER_OPTIN=0
+if [ -f "$TASK_DIR/task.toml" ] &&
+    grep -qE '^[[:space:]]*browser[[:space:]]*=[[:space:]]*"?true"?[[:space:]]*$' "$TASK_DIR/task.toml"; then
+    BROWSER_OPTIN=1
+fi
+mkdir -p "$TASK_DIR/environment"
+printf '%s\n' "$BROWSER_OPTIN" > "$TASK_DIR/environment/browser-optin"
+# Not every member's image ships a browser, and the Explore container has one either way — so
+# a task can ask for a browser it will not get. Say so here rather than let it pass silently.
+if [ "$BROWSER_OPTIN" = "1" ]; then
+    if grep -q "COPY browser-optin" "$TASK_DIR/environment/Dockerfile" 2>/dev/null; then
+        echo "  Browser: Playwright + Chromium (browser = true)"
+    else
+        echo "  WARNING: browser = true, but this task's Dockerfile has no browser. The agent" >&2
+        echo "           will get the Read tool and no Chromium. Either drop the flag, or use a" >&2
+        echo "           member whose image ships one:" >&2
+        echo "           grep -l 'COPY browser-optin' task-shared/Dockerfile.*" >&2
+    fi
+fi
+
 # Resolve commit
 RESOLVED_SHA=$(git -C "$REPO_DIR" rev-parse "$COMMIT")
 echo "  Resolved SHA: $RESOLVED_SHA"