[ShunmeiCho]

Ordinary remote browser runs now stop if their dedicated tab cannot be created or attached. Previously, the connection helper could fall back to a default target, leaving subsequent navigation pointed at an unrelated conversation.

Add opt-in fallbackToDefault: false and enable it for ordinary remote runs. Strict calls without a target URL create about:blank; callers that omit the option retain their existing helper behavior. Cleanup remains scoped to newly created targets.

Real Chrome evidence

Protocol and scope · candidate results · baseline results · reproduction script

This uses an independent temporary Chrome 137/Linux profile and real HTTP/WebSocket transport. A loopback proxy injects target-creation HTTP 500 or a new target's WS-handshake HTTP 502; it does not mock the CDP client. The matrix covers a fresh profile and the same running browser after another protected page exists.

Scenario, in both setups	Baseline be6c92a	Candidate 7f8e619
Creation failure	Connects to protected sentinel	Rejects; zero sentinel WS connections
Attachment failure	Connects to protected sentinel	Rejects; closes only newly created target
Normal connection/cleanup	Dedicated target works	Dedicated target works; only its own target closes

Candidate passes all six cases. The identical strict assertions fail on the four baseline fallback cases. Records include module hashes, actual WS target counts, unchanged sentinel URL/nonce/DOM hashes, zero sentinel navigations, and restored target sets. Success also executes and verifies a title update on the new target. Cleanup completes before the final success marker. No ChatGPT login or model request is involved.

Compatibility and validation

Accepting the change means ordinary runs that previously depended on accidental default-tab fallback will now fail before navigation. Operators should fix dedicated-target access, or use explicit --browser-tab when reuse is intentional. Maintainer acceptance of that behavior remains outstanding; this evidence does not establish authenticated-profile migration, other OSes or the separate browser-level WS endpoint path.

Regression tests cover creation/attachment failure, strict omitted-URL behavior, success cleanup, and the actual runBrowserMode call path. Typecheck/lint/format and non-live suites were checked, including the post-build MCP rerun. Complementary to #445 (shared-process/lease lifecycle) and #431 (attachment navigation/dispatch checks); no dependency on those PRs or #448.

Restack verification

Rebased independently onto main at 7481937. Current head: 8e49a38. The diff contains only the two production files and lifecycle test file; all three are byte-identical to the previously proven head 84f98b8. CHANGELOG coverage and contributor thanks are consolidated in #455.

Fresh validation: 33 lifecycle tests passed; typecheck, lint and formatting passed. Branch autoreview against origin/main is scoped-clean through P2. The independently repeated real Chrome proof remains applicable because the code is unchanged. Exact-head CI is recorded in the final proof comment. No merge performed.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T18:47:24.617198Z	7f8e619	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 5, 2026, 6:16 PM ET / 22:16 UTC.

ClawSweeper review

What this changes

Ordinary remote browser runs stop when their dedicated Chrome tab cannot be created or attached, with five regression tests covering isolation and cleanup.

Merge readiness

⛔ Blocked before merge - 1 item remains

Still useful and ready for normal landing consideration: current main retains the unsafe fallback, no blocking patch defect was found, and the owner's independent Chrome verification and explicit acceptance resolve the previous compatibility blocker.

Priority: P2
Reviewed head: 8e49a387dc812188dcd44647bbde9af04190bfd3

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, sound patch with strong real-transport proof and an explicitly accepted compatibility tradeoff.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (logs): The supplied contributor results and independent owner verification exercise the production remote connection helper with real Chrome HTTP/WebSocket transport across fresh and reused browsers. Creation and attachment faults cause rejection with zero protected-tab connections or navigation; success modifies only the dedicated target and restores the target set. The captured restack statement reports unchanged files; older objects and linked JSON were unavailable to this reviewer.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (logs): The supplied contributor results and independent owner verification exercise the production remote connection helper with real Chrome HTTP/WebSocket transport across fresh and reused browsers. Creation and attachment faults cause rejection with zero protected-tab connections or navigation; success modifies only the dedicated target and restores the target set. The captured restack statement reports unchanged files; older objects and linked JSON were unavailable to this reviewer.
Evidence reviewed	9 items	Verified scope and clean checkout: The checkout matches the pinned original head, whose raw parent is the supplied main revision. The complete introduced diff changes three files; final git status was empty. Current main still permits fallback: After dedicated-target creation or attachment fails, current main reaches CDP({ host, port }). The PR adds rejection before that default-target connection. Runner boundary and explicit reuse: The ordinary-run branch enables strict isolation before domain setup, navigation, or submission. Explicit browserTabRef takes the separate existing-tab branch. Failed acquisition leaves no client or target for runner cleanup to manipulate.
Findings	None	None.
Security	None	None.

How this fits together

Oracle's remote browser runner connects prompts and attachments to an existing Chrome process through the Chrome DevTools Protocol. Its connection helper selects the tab that subsequent navigation and prompt submission will control.

flowchart TD
  A[Remote browser request] --> B{Explicit tab selected?}
  B -->|Yes| C[Attach selected tab]
  B -->|No| D[Create and attach dedicated tab]
  D -->|Failure| E[Stop before navigation]
  D -->|Success| F[Navigate and submit prompt]
  C --> F
  F --> G[Clean up owned target]

Loading

Before merge

• Resolve merge risk (P2) - Existing ordinary remote runs that depended on default-tab fallback will stop before navigation; operators must restore dedicated-target access or explicitly select a tab. The owner has accepted this compatibility change.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	production +14/-5; tests +98/-0	The small production increase enforces remote-tab isolation, supported by five focused regression cases.

Merge-risk options

Maintainer options:

1. Retain the accepted isolation behavior (recommended)
   Land the refusal behavior already accepted by the owner, retaining explicit --browser-tab reuse for operators who intentionally target an existing conversation.

Technical review

Best possible solution:

Preserve the owner-approved dedicated-tab contract, retain explicit tab reuse, and keep release-note coverage consolidated in #455.

Do we have a high-confidence way to reproduce the issue?

Yes: current-main source shows failed dedicated-target acquisition falling through to default-target attachment before runner navigation. Recorded baseline fault tests corroborate that mechanism; this review did not execute it.

Is this the best way to solve the issue?

Yes: the patch applies the existing strict-isolation pattern at the remote connection boundary while preserving explicit reuse and legacy helper defaults. The owner has accepted the intentional failure-mode change.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 748193758d54.

Labels

Label justifications:

• P2: This is a bounded fix for wrong-tab control after remote target acquisition fails.
• merge-risk: 🚨 compatibility: Merging deliberately stops ordinary runs that previously continued through default-tab fallback, a tradeoff explicitly accepted by the owner.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (logs): The supplied contributor results and independent owner verification exercise the production remote connection helper with real Chrome HTTP/WebSocket transport across fresh and reused browsers. Creation and attachment faults cause rejection with zero protected-tab connections or navigation; success modifies only the dedicated target and restores the target set. The captured restack statement reports unchanged files; older objects and linked JSON were unavailable to this reviewer.
• proof: sufficient: Contributor real behavior proof is sufficient. The supplied contributor results and independent owner verification exercise the production remote connection helper with real Chrome HTTP/WebSocket transport across fresh and reused browsers. Creation and attachment faults cause rejection with zero protected-tab connections or navigation; success modifies only the dedicated target and restores the target set. The captured restack statement reports unchanged files; older objects and linked JSON were unavailable to this reviewer.

Evidence

What I checked:

• Verified scope and clean checkout: The checkout matches the pinned original head, whose raw parent is the supplied main revision. The complete introduced diff changes three files; final git status was empty. (8e49a387dc81)
• Current main still permits fallback: After dedicated-target creation or attachment fails, current main reaches CDP({ host, port }). The PR adds rejection before that default-target connection. (src/browser/chromeLifecycle.ts:410, 748193758d54)
• Runner boundary and explicit reuse: The ordinary-run branch enables strict isolation before domain setup, navigation, or submission. Explicit browserTabRef takes the separate existing-tab branch. Failed acquisition leaves no client or target for runner cleanup to manipulate. (src/browser/index.ts:3039, 8e49a387dc81)
• Established isolation contract: Remote Chrome documentation promises a dedicated target per run with existing tabs untouched. The CLI reference separately documents --browser-tab for intentional reuse. (docs/browser-mode.md:330, 8e49a387dc81)
• Fault and cleanup regression coverage: Five added tests cover creation failure, omitted URL, attachment failure with owned-target cleanup, successful dedicated-target cleanup, and the actual runBrowserMode failure path. These tests are supplemental to the recorded real Chrome proof; no tests were executed during this read-only review. (tests/browser/chromeLifecycle.test.ts:402, 8e49a387dc81)
• Independent runtime proof and compatibility acceptance: The captured owner comment fix(browser): stop remote runs when isolated tab creation fails #452 (comment) records six macOS/Chrome cases through real HTTP/WebSocket transport: fresh/reused browser, creation failure, attachment failure, and success. Failures produced zero protected-tab WebSocket connections or navigations; success affected only the new target and cleanup restored the target set. The owner explicitly recommends landing and accepts refusal as preserving the documented dedicated-tab contract. (84f98b8f2b6f)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Zhongyue Lin: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (3 earlier review cycles)

• reviewed 2026-09-05T18:48:34.446Z sha 7f8e619 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-05T19:50:34.683Z sha 7f8e619 :: blocked before merge. :: none
• reviewed 2026-09-05T21:08:46.108Z sha 84f98b8 :: blocked before merge. :: none

[steipete]

Maintainer verification at 84f98b8 (production code unchanged from 7f8e619; added contributor credit).

Rebuilt the branch and independently ran the contributor's pinned remote-tab isolation script on macOS/Chrome using real HTTP/WebSocket transport. All six cases passed: fresh/reused browser × target-creation failure, target-attachment failure, normal connection. Failure cases made zero WebSocket connections to protected sentinel tabs and caused zero sentinel navigations. Success changed only the newly created target; cleanup restored the target set. Profile/proxy/browser cleanup passed. Focused Chrome lifecycle tests, typecheck, lint, and built CLI help passed. Branch autoreview against origin/main is scoped-clean through P2.

CI run: https://github.com/steipete/oracle/actions/runs/33991978727. Fork CI was explicitly approved after review; final conclusion will be checked before a land recommendation.

Recommendation: LAND once CI is green. Ordinary remote runs already promise a dedicated tab; refusal preserves that contract, while --browser-tab remains the explicit reuse path. No merge performed.

[steipete]

Exact-head CI is now green: 84f98b8. All four jobs succeeded (Linux, macOS, Windows, Chromium proof).

https://github.com/steipete/oracle/actions/runs/33991978727

Branch autoreview is scoped-clean through P2. The previously posted runtime proof still applies; this head only adds contributor credit. LAND recommendation; awaiting orchestrator merge authorization.

[steipete]

LAND-READY after restack at 8e49a38, independently based on main 7481937.

Exact-head CI succeeded on Linux, macOS, Windows and the Chromium proof job: https://github.com/steipete/oracle/actions/runs/33995209153. Fresh branch autoreview against origin/main is scoped-clean through P2. Local validation: 33 lifecycle tests, typecheck, lint and formatting passed.

The three PR-owned production/test files are byte-identical to 84f98b8. Existing independently repeated Chrome proof therefore remains applicable: #452 (comment). All six fresh/reused creation-failure, attachment-failure and success cases passed with zero protected-tab WebSocket connections/navigation and cleanup limited to owned targets.

CHANGELOG.md has no diff in this PR; #455 owns the complete release notes and thanks @ShunmeiCho. This PR can land independently of #454; merge #455 after both. No merge performed.