fix(browser): recover answers after recoverable CDP disconnect

[piyushbag]

Summary

Fixes recoverable CDP client disconnects that previously stranded completed browser answers as permanently running.

When the target-level DevTools WebSocket drops mid-run, Oracle used to treat every disconnect as "Chrome window closed," keep the session running, and skip the auto-reattach path that already exists for assistant-timeout. In #326 the browser and page target were still alive, ChatGPT finished the answer, and Oracle never harvested it.

Approach

1. Probe DevTools liveness (/json/version + optional target list) after a CDP client disconnect.
2. If Chrome/target is still reachable, surface recoverableDisconnect instead of a closed-window message.
3. On connection-lost with recoverableDisconnect: true, attempt a one-shot resumeBrowserSession auto-reattach by default; keep the existing "session stays running + guidance" fallback when resume fails.
4. On non-recoverable disconnects (Chrome closed, or target list unverified after a specific target id): keep session running + guidance, but skip auto-reattach (fail closed; no futile resume loop).
5. If autoReattachIntervalMs is configured and the disconnect is recoverable, retain multi-attempt polling (hard-capped).

Runtime proof (merge readiness)

Platform parity table

Proof	Platform	Result
Classification (cdp-disconnect-proof.mjs)	macOS arm64 + Google Chrome	PROOF_OK
Classification (cdp-disconnect-proof.mjs)	Linux arm64 Docker (node:24-bookworm + Chromium)	PROOF_OK
Classification CI job	ubuntu-latest + Chromium (cdp-disconnect-proof-linux)	added in this PR
Authenticated forced-disconnect E2E	macOS (lldb fd close)	E2E_PROOF_OK → completed
Authenticated forced-disconnect E2E	Linux Docker Debian + Chromium + Xvfb (gdb fd close)	E2E_PROOF_OK → completed

Issue #326 was reported on Ubuntu. Classification + liveness probing is platform-neutral HTTP against DevTools; Linux Docker and the new Ubuntu CI job cover that residual.

1) Classification proof (no ChatGPT login)

Script: node scripts/cdp-disconnect-proof.mjs
Linux helper: bash scripts/run-cdp-disconnect-proof-linux.sh

Redacted macOS transcript (2026-07-17):

[…] platform: darwin/arm64 chromePath=/Applications/Google Chrome.app/...
[…] case-1-result: {"endpointReachable":true,"targetFound":true,"recoverable":true,"userMessage":"Chrome DevTools client disconnected before oracle finished; the browser target appears still alive."}
[…] case-2-result: {"endpointReachable":false,"targetFound":null,"recoverable":false,"userMessage":"Chrome window closed before oracle finished. Please keep it open until completion."}
PROOF_OK both disconnect outcomes demonstrated against real Chrome CDP

Redacted Linux Docker transcript (2026-07-17, Debian bookworm + Chromium):

[…] platform: linux/arm64 chromePath=/usr/bin/chromium
[…] case-1-result: {"endpointReachable":true,"targetFound":true,"recoverable":true,"userMessage":"Chrome DevTools client disconnected before oracle finished; the browser target appears still alive."}
[…] case-2-result: {"endpointReachable":false,"targetFound":null,"recoverable":false,"userMessage":"Chrome window closed before oracle finished. Please keep it open until completion.","error":"fetch failed"}
PROOF_OK both disconnect outcomes demonstrated against real Chrome CDP

2) Full browser E2E (forced disconnect → auto-reattach → completed)

Script: scripts/oracle-e2e-cdp-disconnect-proof.mjs

Flow used:

1. Export ChatGPT cookies via scripts/export-chatgpt-cookies.mjs (session=true).
2. Launch Oracle browser mode with --browser-inline-cookies-file + --browser-model-strategy current.
3. After promptSubmitted, forcibly close Oracle's established CDP sockets while Chrome stays up (macOS: lldb; Linux: gdb).
4. SessionRunner reports recoverable disconnect, runs one-shot auto-reattach, harvests the answer, marks session completed.

Redacted transcript excerpt (2026-07-17, macOS):

[…] runtime ready port=<port> target=<id>… status=running
[…] forcing CDP detach by closing Oracle pid=<pid> fds=[…] on port=<port>
[…] Oracle CDP sockets closed; Chrome/target still reachable
ERROR: Chrome DevTools client disconnected before oracle finished; the browser target appears still alive.
Chrome disconnected before completion; keeping session running for reattach.
Auto-reattach will try up to 1 attempt(s).
Auto-reattach attempt 1...
Auto-reattach succeeded; session marked completed.

E2E_PROOF_OK
{
  "finalStatus": "completed",
  "forcedDetach": true,
  "sawAutoReattach": true,
  "sawRecoverableMessage": true
}

Redacted Linux Docker transcript excerpt (2026-07-17, Debian bookworm + Chromium + Xvfb):

[…] platform=Linux aarch64 chrome=/usr/bin/chromium
[…] runtime ready port=<port> target=<id>… status=running
[…] forcing CDP detach by closing Oracle pid=<pid> fds=[…] on port=<port>
[…] Oracle CDP sockets closed; Chrome/target still reachable
ERROR: Chrome DevTools client disconnected before oracle finished; the browser target appears still alive.
Chrome disconnected before completion; keeping session running for reattach.
Auto-reattach will try up to 1 attempt(s).
Auto-reattach attempt 1...
Auto-reattach succeeded; session marked completed.

E2E_PROOF_OK
{
  "finalStatus": "completed",
  "forcedDetach": true,
  "sawAutoReattach": true,
  "sawRecoverableMessage": true
}

Also includes a small fix: inline-cookie expiration normalization no longer treats Unix-second expiries (~1.7e9) as milliseconds (which was zeroing ChatGPT session cookies to 1970 and causing false login failures).

3) Cookie export permissions

scripts/export-chatgpt-cookies.mjs now writes through writeOwnerOnlyFile, which always enforces mode 0600 after write (including overwrite of an existing permissive destination). Focused coverage: tests/scripts/write-owner-only-file.test.ts.

Local verification:

new 600
overwrite 600
PERM_PROOF_OK

Availability / fail-closed notes

• Default connection-lost recovery is one-shot (maxAttempts: 1) unless autoReattachIntervalMs is explicitly configured.
• Non-recoverable disconnects do not enter auto-reattach.
• Failed resume leaves the session running with reattach guidance (manual recovery still possible).
• merge-risk: availability remains inherent to disconnect recovery; mitigated by classification + bounded retries + Linux classification parity.

Test plan

• pnpm exec vitest run tests/browser/cdpLiveness.test.ts tests/cli/sessionRunner.test.ts (includes one-shot bound + non-recoverable skip)
• pnpm exec vitest run tests/browser/cookies.test.ts (Unix-second expiry case)
• pnpm exec vitest run tests/scripts/write-owner-only-file.test.ts
• pnpm run typecheck / build
• macOS node scripts/cdp-disconnect-proof.mjs → PROOF_OK
• Linux Docker bash scripts/run-cdp-disconnect-proof-linux.sh → PROOF_OK
• ORACLE_BROWSER_COOKIES_FILE=… node scripts/oracle-e2e-cdp-disconnect-proof.mjs → E2E_PROOF_OK (macOS)
• bash scripts/run-oracle-e2e-cdp-disconnect-linux.sh → E2E_PROOF_OK (Linux Docker + Xvfb + gdb)
• CI job cdp-disconnect-proof-linux added for ubuntu-latest

Fixes #326

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 18, 2026, 3:34 PM ET / 19:34 UTC.

Summary
The branch classifies whether a CDP disconnect left Chrome and its target alive, performs bounded browser-session reattachment only for confirmed recoverable cases, and adds related proof, cookie-expiration, and secure cookie-export coverage.

Reproducibility: yes. at source level: the prior path treated every CDP client disconnect as a closed Chrome window, while the PR supplies focused tests and real Chrome/Chromium forced-disconnect scripts for the recoverable-target scenario. I did not execute the live browser harness during this read-only review.

Review metrics: 3 noteworthy metrics.

• Patch surface: 18 files affected; 1,430 added, 17 removed. The focused runtime fix also includes proof harnesses, test coverage, and one CI job, so maintainers should review the supporting operational surface.
• Runtime proof: 2 authenticated forced-disconnect E2E environments. The PR reports successful recovery to completed status on macOS Chrome and Linux Chromium, covering the reporter's Linux context.
• Automation change: 1 CI workflow job added. The Ubuntu Chromium classification smoke makes the new liveness branch continuously observable outside the contributor's local setup.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P2] Let the required platform checks finish on the current head before merging.

Risk before merge

• [P2] Merging changes the browser disconnect failure mode: a false-positive liveness classification could trigger an unnecessary resume attempt, although the target-presence check, non-recoverable skip, and default one-shot bound materially limit that availability risk.

Maintainer options:

1. Land bounded recovery (recommended)
   Accept the constrained availability tradeoff after required checks pass: recovery is limited to confirmed live targets and defaults to one reattach attempt.
2. Keep manual-only recovery
   Decline automatic reattachment and retain only the existing session-running guidance if maintainers do not want recovery to alter disconnect behavior.

Next step before merge

• [P2] No mechanical repair is indicated; this is ready for routine maintainer review and normal checks on the current head.

Security
Cleared: The PR's cookie-export helper now secures the destination descriptor before writing cookie bytes and verifies owner-only permissions; no remaining concrete security or supply-chain concern was found in the reviewed change set.

Review details

Best possible solution:

Merge the bounded recovery path after the required checks complete, retaining confirmed-target gating for automatic reattachment and the existing running-session guidance fallback when recovery cannot finish.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level: the prior path treated every CDP client disconnect as a closed Chrome window, while the PR supplies focused tests and real Chrome/Chromium forced-disconnect scripts for the recoverable-target scenario. I did not execute the live browser harness during this read-only review.

Is this the best way to solve the issue?

Yes. Distinguishing endpoint and target liveness, then attempting one bounded reattach only for a confirmed live target, is narrower and safer than treating every disconnect as either terminal or indefinitely retryable.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 8e3456e7f2dc.

Label changes

Label changes:

• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• remove rating: 🦞 diamond lobster: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.

Label justifications:

• P1: Completed browser answers can remain unharvested and sessions remain running after a recoverable CDP disconnect.
• merge-risk: 🚨 availability: The PR changes browser-runtime disconnect handling and session completion recovery, even though it constrains retries and fails closed when target liveness is unverified.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (logs): Redacted macOS and Linux live-browser transcripts demonstrate the changed behavior after a forced CDP disconnect: confirmed live target, automatic reattachment, and final completed session status.
• proof: sufficient: Contributor real behavior proof is sufficient. Redacted macOS and Linux live-browser transcripts demonstrate the changed behavior after a forced CDP disconnect: confirmed live target, automatic reattachment, and final completed session status.

Evidence reviewed

What I checked:

• Recoverable-disconnect implementation: The added liveness helper probes the DevTools endpoint and, when a target ID is known, requires that target to be present before classifying a disconnect as recoverable. (src/browser/cdpLiveness.ts:1, 068d5e48cd7d)
• Browser error classification: The browser runner converts the client disconnect into a connection-lost error carrying recoverability and runtime metadata rather than unconditionally reporting that Chrome closed. (src/browser/index.ts:1161, 068d5e48cd7d)
• Bounded recovery path: The session runner skips automatic recovery for non-recoverable disconnects and uses a single attempt by default when the target was confirmed alive; configured polling remains bounded by the existing path. (src/cli/sessionRunner.ts:597, 068d5e48cd7d)
• Regression coverage: Focused tests cover target-liveness classification, skipping non-recoverable reattachment, a one-shot recoverable attempt, Unix-second cookie expiry preservation, and owner-only cookie-file writes. (tests/cli/sessionRunner.test.ts:1308, 068d5e48cd7d)
• Real behavior proof: The PR body provides redacted macOS and Linux forced-disconnect transcripts showing a live Chrome target, one-shot reattachment, and final session status completed; the new Linux CI smoke also exercises Chromium CDP classification. (scripts/oracle-e2e-cdp-disconnect-proof.mjs:1, 068d5e48cd7d)
• Repository release-note policy followed: The branch history includes a commit removing the contributor CHANGELOG entry, consistent with the repository policy that release-owned CHANGELOG.md should not be edited by normal PRs. (CHANGELOG.md:4, 95a5bee4c5cb)

Likely related people:

• steipete: Authored the current PR head commit that completes the recovery proof and is directly engaged on the final browser-recovery branch state. (role: recent area contributor; confidence: high; commits: 068d5e48cd7d; files: src/browser/index.ts, src/cli/sessionRunner.ts, scripts/oracle-e2e-cdp-disconnect-proof.mjs)
• LeoLin990405: Authored the merged remote-CDP recovery work in the related recovery area, including persisted conversation targeting and reattachment behavior that this fix builds on. (role: adjacent feature contributor; confidence: medium; commits: d3a7df0f137b; files: src/browser/index.ts, src/cli/sessionRunner.ts)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (11 earlier review cycles; latest 8 shown)

• reviewed 2026-07-17T14:54:45.186Z sha 0baf9ba :: needs changes before merge. :: [P1] Enforce owner-only permissions on exported session cookies
• reviewed 2026-07-17T15:35:37.758Z sha 0baf9ba :: needs changes before merge. :: [P1] Enforce owner-only permissions on exported session cookies
• reviewed 2026-07-17T15:49:20.313Z sha 7acd849 :: needs changes before merge. :: [P1] Secure the cookie file before writing secret bytes
• reviewed 2026-07-17T15:58:37.995Z sha 545b17e :: needs maintainer review before merge. :: none
• reviewed 2026-07-17T16:23:30.744Z sha 7b8409a :: needs maintainer review before merge. :: none
• reviewed 2026-07-17T16:38:45.575Z sha c0b02c2 :: needs maintainer review before merge. :: none
• reviewed 2026-07-17T16:48:37.117Z sha b35a636 :: needs maintainer review before merge. :: none
• reviewed 2026-07-17T17:30:06.290Z sha b35a636 :: needs maintainer review before merge. :: none

[piyushbag]

Posted merge-readiness proof for both disconnect outcomes against real Chrome CDP.

• Script: node scripts/cdp-disconnect-proof.mjs (added in latest commit)
• Case 1 (client WS drop, Chrome/target alive): recoverable=true, still-alive user message
• Case 2 (Chrome killed): recoverable=false, closed-window user message
• Session harvest after recoverable disconnect remains covered by sessionRunner unit tests

Updated the PR body with the redacted transcript.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The durable review comment was published and its verdict was queued for target-serialized routing.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29589180647
• Updated: 2026-07-17T14:46:46.895Z

[piyushbag]

@clawsweeper re-review

Full browser E2E proof is now on the branch:

1. scripts/cdp-disconnect-proof.mjs → PROOF_OK (recoverable vs closed Chrome classification)
2. scripts/oracle-e2e-cdp-disconnect-proof.mjs → E2E_PROOF_OK

Live run forced a mid-flight CDP socket drop while Chrome stayed alive; Oracle kept the session reattachable, auto-reattach harvested the answer, and marked the session completed (Auto-reattach succeeded; session marked completed.).

Redacted excerpt is in the PR body. Also fixed inline-cookie Unix-second expiration mangling that was breaking ChatGPT cookie reuse during the E2E setup.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The durable review comment was published and its verdict was queued for target-serialized routing.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29592770404
• Updated: 2026-07-17T15:38:31.607Z

[piyushbag]

@clawsweeper re-review

Addressed the P1 cookie-export permission finding:

1. scripts/export-chatgpt-cookies.mjs now writes via writeOwnerOnlyFile, which always enforces owner-only mode 0600 after write (including overwrite of an existing permissive file).
2. Focused regression: tests/scripts/write-owner-only-file.test.ts covers new-file create and overwrite of a deliberately 0644 destination.
3. Local check: (mode & 0o777) === 0o600 for both paths (PERM_PROOF_OK).
4. Focused suite + typecheck still green.

Head: 7acd849.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The durable review comment was published and its verdict was queued for target-serialized routing.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29594315390
• Updated: 2026-07-17T16:02:25.057Z

[piyushbag]

@clawsweeper re-review

Addressed the P1 descriptor-before-write finding on cookie export:

1. writeOwnerOnlyFile now opens/truncates the destination, fchmods the descriptor to 0600, verifies mode, then writes secret bytes (no more write-then-chmod race on an existing permissive file).
2. Final post-close 0600 check retained; Windows still skips POSIX mode enforcement.
3. Regression: overwrite of a deliberate 0644 file probes mode+content before write and asserts owner-only empty destination (secret not present while permissive).
4. Focused suite + typecheck green:
   • pnpm exec vitest run tests/scripts/write-owner-only-file.test.ts (3 passed)
   • pnpm run typecheck

Head: 545b17e.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The durable review comment was published and its verdict was queued for target-serialized routing.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29595985580
• Updated: 2026-07-17T16:26:45.946Z

[piyushbag]

@clawsweeper re-review

Linux/Ubuntu classification parity + fail-closed recovery:

• Docker Debian/Chromium PROOF_OK (linux/arm64) via scripts/run-cdp-disconnect-proof-linux.sh
• CI job cdp-disconnect-proof-linux on ubuntu-latest
• Auto-reattach only when recoverableDisconnect: true; non-recoverable skips resume
• One-shot default bound covered by regression tests

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The durable review comment was published and its verdict was queued for target-serialized routing.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29596983776
• Updated: 2026-07-17T16:42:12.427Z

[piyushbag]

@clawsweeper re-review

Authenticated Linux forced-disconnect E2E now passes:

• Debian bookworm + Chromium + Xvfb + gdb fd close
• Recoverable disconnect → one-shot auto-reattach → session completed
• Harness: scripts/run-oracle-e2e-cdp-disconnect-linux.sh
• Opt-in only: ORACLE_CHROME_NO_SANDBOX=1 for container Chromium

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The durable review comment was published and its verdict was queued for target-serialized routing.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29597626980
• Updated: 2026-07-17T16:51:26.548Z

[piyushbag]

@clawsweeper re-review

Fail-closed liveness tightening for the remaining availability residual:

• isRecoverableChromeDisconnect now requires a confirmed live target (or endpoint-only check with no target id)
• Target-list probe errors after a specific target id are non-recoverable (no optimistic auto-reattach)

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The durable review comment was published and its verdict was queued for target-serialized routing.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29600297177
• Updated: 2026-07-17T17:33:41.370Z