Vibing on Gargantuan Code

Disabling Chromium’s Password Manager with AI

For most developers, the idea of modifying the Chromium codebase—the open-source engine behind Google Chrome and Microsoft Edge—is deeply intimidating. It is a sprawling metropolis of C++ code, millions of lines built over more than a decade. Navigating this architecture is typically a task reserved for senior engineers who have spent months, if not years, learning its highways and byways.

However, the development landscape is changing. With a foundational set of coding skills and the right application of new AI development tools, you can effectively navigate and modify these massive projects far earlier in your career.

This guide provides a practical, non-trivial walkthrough of this new workflow. Our goal is to modify Chromium to add a command-line flag that completely disables the built-in password manager. We will not just ask a chatbot to "write code." We will use Claude Code, Anthropic’s terminal-based agent, to iteratively plan, implement, and test changes directly within the source tree. We will then use Cursor, an AI-native code editor, for surgical reviews, debugging, and understanding the agent's output.

Think of this as a tutorial on a modern development paradigm. The objective is not just to disable a feature; it's to learn the techniques for using AI agents to explore and refactor foreign codebases without getting lost.

The Prerequisites

Before we begin, a realistic assessment of the requirements is necessary. Chromium is a resource-intensive project.

• Hardware: You will need a machine running Linux or macOS with at least 16GB of RAM (32GB is strongly recommended) and roughly 100GB of free disk space. Compiling Chromium from source is a lengthy process.
• Skills: You should be comfortable with the command line, understand basic Git workflows (clone, commit, branch), and have at least a reading-level knowledge of a C-family language. If you understand JavaScript or Python, you can follow the logic.
• Tooling Access:
  • Claude Code: This is a command-line interface (CLI) tool that requires an Anthropic API key, which usually necessitates a paid subscription.
  • Cursor: This AI-powered editor can be used for free with your own API keys or through its own subscription plan.

Phase 1: The Setup – Establishing a Baseline

The most common point of failure when working with Chromium is simply getting the initial build to compile successfully.

1. Get the Code
Google maintains a specific set of scripts called depot_tools to manage the Chromium repository and its many dependencies. Do not just git clone the main repository. You must follow the official Chromium 'Get the Code' guide for your operating system to ensure the environment is configured correctly.

2. The Initial Build
Before making a single change, you must confirm you have a working baseline. This step is non-negotiable.
In your terminal, navigate to the src directory created by depot_tools and run:

# Install all required build dependencies (Linux example)
./build/install-build-deps.sh

# Generate the build configuration files
gn gen out/Default

# Compile the 'chrome' target (this can take 1-4 hours)
ninja -C out/Default chrome

Once this marathon compile finishes, run ./out/Default/chrome. If a generic Chromium browser window appears, your environment is correctly configured, and you are ready to begin modifying the code.

Phase 2: Configuring the AI Agent – Setting the Rules of Engagement

We are using Claude Code, a specialized agent designed to operate directly in your terminal. Unlike a web-based chatbot, it can read your local files, execute commands like grep and ninja, and analyze the output to inform its next step.

To prevent the AI from wandering aimlessly through millions of files (which would be slow and expensive), we must give it a rigid set of instructions and constraints.

First, install and initialize the Claude Code CLI in your Chromium src directory:

pip install claude-code
claude init

This creates a CLAUDE.md file, which acts as the agent's "system prompt"—its long-term memory and rulebook for this project. This file is the single most important tool for keeping the agent focused. Let's configure it with specific, actionable rules:

# Project: Chromium Password Manager Flag

**Goal:**
Implement a new command-line flag, `--disable-password-manager`. When this flag is active, Chromium MUST NOT offer to save new passwords and MUST NOT autofill existing passwords. The feature should be completely inert, both logically and from the user's perspective.

**Constraints & Knowledge:**
- The codebase is massive. Do not use broad, recursive file searches (`grep -r "password" .`) unless absolutely necessary. Start your investigation in targeted directories.
- Key areas of interest are `components/password_manager/core/` for core logic, `chrome/browser/ui/passwords/` for UI elements, and `chrome/common/chrome_switches.cc` for flag definitions.
- Before claiming a task is complete, you MUST verify the code compiles by running `ninja -C out/Default chrome`.
- All C++ code must adhere to Chromium's style guide. Analyze existing files in the same directory to match patterns for naming, includes, and comments.
- Do not modify unrelated systems like Autofill for addresses or credit cards. Your scope is limited to the password manager.

This detailed configuration prevents the agent from making costly mistakes and ensures its actions are aligned with our precise goal.

Phase 3: The Iterative Loop – Directing the Agent

This is where the workflow diverges significantly from traditional development. Instead of you hunting down files, you will instruct Claude to enter an investigative and implementation loop.

Begin with a clear, high-level instruction in your terminal:

claude "Per the instructions in CLAUDE.md, plan and implement the --disable-password-manager flag. Begin by finding the exact C++ locations that check whether Chromium should offer to save a password."

Technique 1: Observing and Guiding the Plan
The agent will first create a plan.md file outlining its strategy. It might look like this:

1. Explore: Use grep in components/password_manager/ for "OfferToSavePassword" to find the primary decision point.
2. Implement Flag: Add a new BASE_FEATURE toggle in components/password_manager/core/common/password_manager_features.cc.
3. Implement Switch: Connect this feature to a command-line switch in chrome/common/chrome_switches.cc.
4. Inject Logic: Add a conditional check for the new feature flag at the decision point found in step 1.
5. Build & Verify: Run ninja to compile the changes.

This plan seems sound. You let it proceed. It modifies the files, and then you instruct it to test its own work.

Technique 2: Using Build Errors as Feedback
After the agent makes its first set of edits, you command it to build:

claude "You have made the initial code changes. Now, attempt to build it."

The agent runs ninja -C out/Default chrome and the build almost certainly fails with a linker error:
undefined reference to password_manager::features::kDisablePasswordManager

This is a classic dependency error. Instead of solving it yourself, use the error as a precise instruction for the agent.

claude "The build failed with a linker error. This means a dependency is missing in a BUILD.gn file. Analyze the error, find the correct BUILD.gn file associated with the code you modified, and add the necessary dependency to link the new feature flag."

The agent will now search for .gn files, identify the correct target, and add the missing line, likely something like "//components/password_manager/core/common:features", to the dependency list. It will then retry the build, which should now pass the linking stage.

Technique 3: Course Correction for Deeper Logic
The build compiles, and the flag prevents the "save password" prompt. But you notice the "Passwords" section in chrome://settings is still visible. The feature is not fully disabled. This requires a new, more specific instruction.

claude "The core logic is disabled, but the UI is not. Investigate files in chrome/browser/ui/passwords/ and chrome/browser/resources/settings/ to find where the password settings UI is controlled. Disable these UI elements when the --disable-password-manager flag is present."

This prompt directs the agent from the C++ backend to the frontend UI code (which might involve HTML, JS, and C++), demonstrating how you can guide it across different parts of the stack.

Technique 4: Stopping and Redirecting a Wayward Agent
At some point, the agent might misinterpret a prompt. While trying to disable the UI, it might start modifying the generic Autofill settings page, affecting addresses and credit cards. This is where you must intervene directly.

First, stop the current operation (usually with Ctrl+C). Then, provide a firm, clarifying instruction:

claude "STOP. You are editing the wrong component. Your changes to the generic Autofill settings are incorrect. Revert those changes. The problem is ONLY with the password manager UI. Focus exclusively on files that reference `PasswordManager` or `passwords_section` within the settings."

This is a critical skill: recognizing when the agent is on the wrong path and using specific, negative constraints ("do not modify," "stop") to put it back on track.

Phase 4: Surgical Review and Refinement with Cursor

Agents are excellent at the "find and replace" style of coding, but they can lack a deep understanding of architectural nuance. Once Claude reports success and the build passes, your role shifts to that of a senior code reviewer.

Open the modified files in Cursor. Instead of just reading the code, use Cursor's AI chat to probe for weaknesses.

• Highlight a C++ change and ask: "Review this code for potential memory leaks, race conditions, or violations of Chromium's threading model. Explain your reasoning."
• Point to the new feature flag and ask: "Does this new flag need to be documented elsewhere? Search the codebase for patterns related to feature_flags.md or other developer documentation and tell me if I need to add an entry."
• Get help with testing: "I need to add a unit test for this new flag. Based on the existing tests in components/password_manager/core/browser/, generate a simple C++ test case that verifies the password-saving logic is skipped when the flag is enabled."

Cursor acts as your expert consultant, helping you validate the agent's work and ensuring it meets the high standards of a project like Chromium.

Phase 5: Final Verification

A passing build and a clean code review are not enough. You must manually test the final product to confirm it meets the goal.

1. Launch your custom build with the new flag:
   bash Copy

   ./out/Default/chrome --disable-password-manager

2. Navigate to several different websites with login forms.
3. Attempt to log in with new credentials.
4. Success Condition: The browser never displays a "Save this password?" prompt.
5. Go to chrome://settings. The "Passwords" section should either be gone entirely or be disabled and empty.

Why This Workflow Matters

The point of this exercise was not just about disabling a password manager. It was about demonstrating a new, powerful way to engage with enormous, unfamiliar codebases. By leveraging an agent for the tedious tasks of exploration, implementation, and iterative fixing, you were able to focus on high-level strategy, direction, and quality control.

You have moved from being a line-by-line coder to being a director of AI tools—a skillset that is rapidly becoming essential for the modern software developer.