@oh-my-pi/pi-coding-agent 16.1.10 → 16.1.11

package/src/session/session-context.ts

@@ -7,6 +7,8 @@ import { type CompactionEntry, EPHEMERAL_MODEL_CHANGE_ROLE, type SessionEntry }
 export interface SessionContext {
 	messages: AgentMessage[];
 	thinkingLevel?: string;
+	/** Configured thinking selector (`"auto"` or a concrete level) from the latest change. */
+	configuredThinkingLevel?: string;
 	serviceTier?: ServiceTier;
 	/** Model roles: { default: "provider/modelId", small: "provider/modelId", ... } */
 	models: Record<string, string>;
@@ -134,6 +136,7 @@ export function buildSessionContext(
 
 	// Extract settings and find compaction
 	let thinkingLevel: string | undefined = "off";
+	let configuredThinkingLevel: string | undefined;
 	let serviceTier: ServiceTier | undefined;
 	const models: Record<string, string> = {};
 	let compaction: CompactionEntry | null = null;
@@ -154,6 +157,7 @@ export function buildSessionContext(
 	for (const entry of path) {
 		if (entry.type === "thinking_level_change") {
 			thinkingLevel = entry.thinkingLevel ?? "off";
+			configuredThinkingLevel = entry.configured ?? entry.thinkingLevel ?? undefined;
 		} else if (entry.type === "model_change") {
 			// New format: { model: "provider/id", role?: string }
 			if (entry.model) {
@@ -388,6 +392,7 @@ export function buildSessionContext(
 		messages,
 		cacheMissExplainedAt: options?.transcript ? cacheMissExplainedAt : undefined,
 		thinkingLevel,
+		configuredThinkingLevel,
 		serviceTier,
 		models,
 		injectedTtsrRules,

package/src/session/session-entries.ts

@@ -37,6 +37,12 @@ export interface SessionMessageEntry extends SessionEntryBase {
 export interface ThinkingLevelChangeEntry extends SessionEntryBase {
 	type: "thinking_level_change";
 	thinkingLevel?: string | null;
+	/**
+	 * The user-configured selector at the time of this change: `"auto"` when auto
+	 * mode was active, otherwise the concrete level. Absent on entries written
+	 * before auto-mode persistence existed; readers fall back to `thinkingLevel`.
+	 */
+	configured?: string | null;
 }
 
 export interface ModelChangeEntry extends SessionEntryBase {

package/src/session/session-manager.ts

@@ -1158,11 +1158,13 @@ export class SessionManager {
 		return entry.id;
 	}
 
-	appendThinkingLevelChange(thinkingLevel?: string): string {
+	/** Append a thinking level change as child of current leaf, then advance leaf. Returns entry id. */
+	appendThinkingLevelChange(thinkingLevel?: string, configured?: string): string {
 		const entry: ThinkingLevelChangeEntry = {
 			type: "thinking_level_change",
 			...this.#freshEntryFields(),
 			thinkingLevel: thinkingLevel ?? null,
+			configured: configured ?? null,
 		};
 		this.#recordEntry(entry);
 		return entry.id;

package/src/task/worktree.ts

@@ -5,6 +5,7 @@ import * as path from "node:path";
 import * as natives from "@oh-my-pi/pi-natives";
 import { getWorktreeDir, hashPath, logger, Snowflake } from "@oh-my-pi/pi-utils";
 import * as git from "../utils/git";
+import * as jj from "../utils/jj";
 import { mapWithConcurrencyLimit } from "./parallel";
 
 const { IsoBackendKind } = natives;
@@ -28,12 +29,19 @@ export interface WorktreeBaseline {
 }
 
 export async function getRepoRoot(cwd: string): Promise<string> {
-	const repoRoot = await git.repo.root(cwd);
-	if (!repoRoot) {
-		throw new Error("Git repository not found for isolated task execution.");
+	// Pure-jj check runs first so a jj workspace nested under an unrelated
+	// outer Git checkout is rejected at its own root rather than silently
+	// mutating the surrounding Git tree behind jj's back.
+	if (await jj.isPureJjRepo(cwd)) {
+		throw new Error(
+			"Isolated task execution requires a Git checkout, but this workspace is pure Jujutsu (`.jj/` without a colocated `.git/`). Run `jj git init --colocate` to add a Git checkout, or set `task.isolation.mode: none` to disable task isolation.",
+		);
 	}
 
-	return repoRoot;
+	const repoRoot = await git.repo.root(cwd);
+	if (repoRoot) return repoRoot;
+
+	throw new Error("Git repository not found for isolated task execution.");
 }
 
 const GIT_NO_INDEX_NULL_PATH = process.platform === "win32" ? "NUL" : "/dev/null";

package/src/thinking.ts

@@ -32,7 +32,7 @@ const THINKING_LEVEL_METADATA: Record<ThinkingLevel, ThinkingLevelMetadata> = {
 	[ThinkingLevel.High]: { value: ThinkingLevel.High, label: "high", description: "Deep reasoning (~16k tokens)" },
 	[ThinkingLevel.XHigh]: {
 		value: ThinkingLevel.XHigh,
-		label: "max",
+		label: "xhigh",
 		description: "Maximum reasoning (~32k tokens)",
 	},
 };

package/src/tools/acp-bridge.ts

@@ -0,0 +1,66 @@
+/**
+ * Shared ACP client bridge routing for file-write sites.
+ *
+ * When an ACP client (e.g. Zed) advertises the `fs.writeTextFile` capability,
+ * all write-mode tools must route through it so the editor's open buffer is
+ * updated immediately. Internal artifacts ('/Users/theo/.omp/agent/sessions/-Projects-oh-my-pi/2026-06-10T09-11-41-506Z_019eb0cd-3ec2-7000-92aa-1b82aa4d78f0/local' plan files, other scheme
+ * URLs) are always written directly to disk — those are OMP-owned and should
+ * never be pushed into the editor.
+ */
+import type { ToolSession } from ".";
+import { invalidateFsScanAfterWrite } from "./fs-cache-invalidation";
+import { isInternalUrlPath } from "./path-utils";
+import { resolvePlanPath } from "./plan-mode-guard";
+import { ToolError } from "./tool-errors";
+
+/**
+ * Return `true` when an ACP client bridge write is appropriate for this path.
+ *
+ * Returns `false` for internal-URL paths (e.g. `'/Users/theo/.omp/agent/sessions/-Projects-oh-my-pi/2026-06-10T09-11-41-506Z_019eb0cd-3ec2-7000-92aa-1b82aa4d78f0/local/PLAN.md'`) and for the
+ * active plan file while plan mode is enabled — both are OMP-internal artifacts
+ * that must stay off the editor's buffer.
+ */
+export function shouldRouteWriteThroughBridge(
+	session: ToolSession,
+	requestedPath: string,
+	absolutePath: string,
+): boolean {
+	if (isInternalUrlPath(requestedPath)) return false;
+
+	const state = session.getPlanModeState?.();
+	if (!state?.enabled || !isInternalUrlPath(state.planFilePath)) return true;
+
+	return absolutePath !== resolvePlanPath(session, state.planFilePath);
+}
+
+/**
+ * Try to route a file write through the ACP client bridge.
+ *
+ * Performs the full guard check, bridge call (wrapped in {@link ToolError}),
+ * FS-scan cache invalidation, and session mutation-version bump.
+ *
+ * Returns `true` when the bridge was used and the caller must skip the
+ * writethrough path. Returns `false` when the bridge is unavailable or the
+ * path should not be routed through it.
+ */
+export async function routeWriteThroughBridge(
+	session: ToolSession,
+	requestedPath: string,
+	absolutePath: string,
+	content: string,
+): Promise<boolean> {
+	if (!shouldRouteWriteThroughBridge(session, requestedPath, absolutePath)) return false;
+
+	const bridge = session.getClientBridge?.();
+	if (!bridge?.capabilities.writeTextFile || !bridge.writeTextFile) return false;
+
+	try {
+		await bridge.writeTextFile({ path: absolutePath, content });
+	} catch (error) {
+		throw new ToolError(error instanceof Error ? error.message : String(error));
+	}
+
+	invalidateFsScanAfterWrite(absolutePath);
+	session.bumpFileMutationVersion?.(absolutePath);
+	return true;
+}

package/src/tools/browser/cmux/cmux-tab.ts

@@ -434,6 +434,12 @@ export class CmuxTab {
 		return new CmuxElementHandle(this, selector);
 	}
 
+	async waitForSelector(selector: string, opts?: { timeout?: number }): Promise<CmuxElementHandle> {
+		const timeoutMs = opts?.timeout ?? this.#runContext?.timeoutMs ?? 30_000;
+		await this.#waitForSelector(selector, timeoutMs);
+		return new CmuxElementHandle(this, selector);
+	}
+
 	async evaluate<TResult, TArgs extends unknown[]>(
 		fn: string | ((...args: TArgs) => TResult | Promise<TResult>),
 		...args: TArgs
@@ -549,6 +555,37 @@ export class CmuxTab {
 		throw new ToolError(`tab.waitForUrl() timed out after ${timeoutMs}ms`);
 	}
 
+	async waitForNavigation(opts?: { waitUntil?: WaitUntil; timeout?: number }): Promise<null> {
+		const timeoutMs = opts?.timeout ?? this.#runContext?.timeoutMs ?? 30_000;
+		// Cmux has no native "next navigation" wait — snapshot the current URL via a fresh
+		// `browser.url.get` (never the possibly-stale `#lastUrl`), then poll for a change
+		// from it (mirroring headless `page.waitForNavigation` intent) and optionally settle
+		// on the requested load state. Start it BEFORE the click/submit that navigates; after
+		// a completed nav it times out like puppeteer does.
+		const baseline = (await this.#request("browser.url.get", {}, Math.min(timeoutMs, 5_000))) as CmuxUrlGetResult;
+		const startUrl = typeof baseline.url === "string" && baseline.url.length > 0 ? baseline.url : this.#lastUrl;
+		if (typeof baseline.url === "string" && baseline.url.length > 0) this.#lastUrl = baseline.url;
+		const deadline = Date.now() + timeoutMs;
+		while (Date.now() <= deadline) {
+			const result = (await this.#request("browser.url.get", {}, Math.min(timeoutMs, 5_000))) as CmuxUrlGetResult;
+			if (typeof result.url === "string" && result.url.length > 0) {
+				this.#lastUrl = result.url;
+				if (result.url !== startUrl) {
+					if (opts?.waitUntil) {
+						await this.#request(
+							"browser.wait",
+							{ load_state: mapWaitUntil(opts.waitUntil), timeout_ms: timeoutMs },
+							timeoutMs,
+						);
+					}
+					return null;
+				}
+			}
+			await Bun.sleep(200);
+		}
+		throw new ToolError(`tab.waitForNavigation() timed out after ${timeoutMs}ms`);
+	}
+
 	async drag(from: DragTarget, to: DragTarget): Promise<void> {
 		const start = await this.#dragPoint(from);
 		const end = await this.#dragPoint(to);

package/src/tools/browser/tab-worker.ts

@@ -82,17 +82,85 @@ const INTERACTIVE_AX_ROLES = new Set([
 
 const LEGACY_SELECTOR_PREFIXES = ["p-aria/", "p-text/", "p-xpath/", "p-pierce/"] as const;
 
+const SELECTOR_HANDLER_PREFIXES = [
+	"aria/",
+	"text/",
+	"xpath/",
+	"pierce/",
+	"aria-ref=",
+	"aria-ref/",
+	"ariaref/",
+	"p-",
+] as const;
+
+/**
+ * Playwright-only selector engines/pseudos puppeteer cannot parse. Without this guard a
+ * `tab.click(":has-text(...)")` would wait the full action timeout and fail opaquely;
+ * fail fast instead with a pointer to the puppeteer-native alternative. Skipped for
+ * explicit query-handler prefixes (`text/`, `aria/`, …) whose payload is literal text.
+ */
+const PLAYWRIGHT_ONLY_SELECTOR_RE =
+	/:has-text\(|:text\(|:text-is\(|:text-matches\(|:visible\b|:hidden\b|:nth-match\(|:near\(|:above\(|:below\(|:right-of\(|:left-of\(/;
+
 type DialogPolicy = "accept" | "dismiss";
 type DragTarget = string | { readonly x: number; readonly y: number };
 type ActionabilityResult = { ok: true; x: number; y: number } | { ok: false; reason: string };
 
 /**
- * Per-op ceiling for puppeteer-internal helpers that should resolve quickly
- * (`observe`, `screenshot`, `extract`). Kept below the default 30s cell budget so a
- * single stalled helper fails fast with a named error and leaves budget for the rest
- * of the cell. Effective cap is `min(cellBudget, QUICK_OP_TIMEOUT_MS)`.
+ * Per-op fail-fast ceilings for `tab.*` helpers. All are kept strictly under the cell
+ * budget (`timeoutMs - OP_DEADLINE_SLACK_MS`) so a stalled helper rejects with a named,
+ * attributable error that leaves recovery budget — never the opaque whole-cell
+ * "Browser code execution timed out" path that consumed the entire run.
+ *
+ * - `QUICK_OP_TIMEOUT_MS`: page-coupled reads that should resolve fast (`observe`,
+ *   `screenshot`, `extract`, `ariaSnapshot`).
+ * - `ACTION_OP_TIMEOUT_MS`: interactive point actions (`click`, `fill`, `type`, …) and
+ *   the default for wait helpers when no explicit `{ timeout }` is given.
+ *
+ * `goto` and `evaluate` stay uncapped (`Number.POSITIVE_INFINITY`): navigation and user
+ * code legitimately use the full cell budget.
  */
 const QUICK_OP_TIMEOUT_MS = 20_000;
+const ACTION_OP_TIMEOUT_MS = 15_000;
+/** Headroom subtracted from the cell budget so a per-op deadline fires before it. */
+const OP_DEADLINE_SLACK_MS = 1_000;
+
+export interface OpTimeouts {
+	/** Largest per-op deadline allowed — strictly below the cell budget. */
+	budgetBound: number;
+	/** Ceiling for quick page reads. */
+	quickOpMs: number;
+	/** Ceiling for interactive actions + default for waits. */
+	actionOpMs: number;
+}
+
+/** Resolve the per-op fail-fast ceilings for a given cell budget. */
+export function resolveOpTimeouts(cellTimeoutMs: number): OpTimeouts {
+	const budgetBound = Math.max(1, cellTimeoutMs - OP_DEADLINE_SLACK_MS);
+	return {
+		budgetBound,
+		quickOpMs: Math.min(budgetBound, QUICK_OP_TIMEOUT_MS),
+		actionOpMs: Math.min(budgetBound, ACTION_OP_TIMEOUT_MS),
+	};
+}
+
+/**
+ * Effective timeout for a wait helper (`waitFor*`). A positive explicit `{ timeout }` is
+ * honored but clamped to the cell budget so it still fails fast + named; raising the tool
+ * `timeout` raises that cap, so a longer budget stays meaningful. No `{ timeout }` → the
+ * action ceiling. Puppeteer's `{ timeout: 0 }` / `Infinity` ("disable") maps to the largest
+ * bounded wait (`budgetBound`) — the harness never permits an unbounded wait. Garbage input
+ * (negative, `NaN`) falls back to the action ceiling rather than the longest wait.
+ */
+export function resolveWaitTimeout(cellTimeoutMs: number, explicit?: number): number {
+	const { budgetBound, actionOpMs } = resolveOpTimeouts(cellTimeoutMs);
+	if (explicit === undefined) return actionOpMs;
+	// Puppeteer "disable" sentinels — still bounded by the budget here.
+	if (explicit === 0 || explicit === Number.POSITIVE_INFINITY) return budgetBound;
+	// Positive finite → honored + clamped. Negative/NaN garbage → default, not the longest wait.
+	if (Number.isFinite(explicit) && explicit > 0) return Math.min(explicit, budgetBound);
+	return actionOpMs;
+}
 
 interface ScreenshotOptions {
 	selector?: string;
@@ -121,7 +189,7 @@ interface TabApi {
 	press(key: KeyInput, opts?: { selector?: string }): Promise<void>;
 	scroll(deltaX: number, deltaY: number): Promise<void>;
 	drag(from: DragTarget, to: DragTarget): Promise<void>;
-	waitFor(selector: string): Promise<ElementHandle>;
+	waitFor(selector: string, opts?: { timeout?: number }): Promise<ElementHandle>;
 	evaluate<TResult, TArgs extends unknown[]>(
 		fn: string | ((...args: TArgs) => TResult | Promise<TResult>),
 		...args: TArgs
@@ -134,12 +202,29 @@ interface TabApi {
 		pattern: string | RegExp | ((response: HTTPResponse) => boolean | Promise<boolean>),
 		opts?: { timeout?: number },
 	): Promise<HTTPResponse>;
+	waitForSelector(
+		selector: string,
+		opts?: { timeout?: number; visible?: boolean; hidden?: boolean },
+	): Promise<ElementHandle | null>;
+	waitForNavigation(opts?: {
+		waitUntil?: "load" | "domcontentloaded" | "networkidle0" | "networkidle2";
+		timeout?: number;
+	}): Promise<HTTPResponse | null>;
 	id(n: number): Promise<ElementHandle>;
 	ref(id: string): Promise<ElementHandle>;
 }
 
-function normalizeSelector(selector: string): string {
+export function normalizeSelector(selector: string): string {
 	if (!selector) return selector;
+	if (
+		!SELECTOR_HANDLER_PREFIXES.some(prefix => selector.startsWith(prefix)) &&
+		PLAYWRIGHT_ONLY_SELECTOR_RE.test(selector)
+	) {
+		throw new ToolError(
+			`Playwright-only selector ${JSON.stringify(selector)} is not supported by the browser tool. ` +
+				`Use a puppeteer text selector ("text/Allow all"), an aria selector ("aria/Name"), CSS, or "xpath/...".`,
+		);
+	}
 	if (selector.startsWith("p-") && !LEGACY_SELECTOR_PREFIXES.some(prefix => selector.startsWith(prefix))) {
 		throw new ToolError(
 			`Unsupported selector prefix. Use CSS or puppeteer query handlers (aria/, text/, xpath/, pierce/). Got: ${selector}`,
@@ -761,8 +846,15 @@ export class WorkerCore {
 		try {
 			return await fn(opSignal);
 		} catch (err) {
-			// Per-op deadline fired (not the cell budget, not an explicit abort) → named, actionable error.
-			if (opTimeout?.aborted && !cellSignal.aborted) {
+			// Fail fast with a named, attributable error instead of the opaque whole-cell timeout:
+			// our per-op deadline fired, or puppeteer's own (equal) timeout fired first — having
+			// already torn down the CDP action via the op signal, so no work is left dangling.
+			// Cell-budget aborts and uncapped helpers (goto/evaluate) keep their native errors.
+			if (
+				capped &&
+				!cellSignal.aborted &&
+				(opTimeout?.aborted || (err instanceof Error && err.name === "TimeoutError"))
+			) {
 				throw new ToolError(`${label} timed out after ${perOpTimeoutMs}ms`);
 			}
 			throw err;
@@ -781,7 +873,8 @@ export class WorkerCore {
 		active: ActiveRun,
 	): TabApi {
 		const page = this.#requirePage();
-		const quickOpMs = Math.min(timeoutMs, QUICK_OP_TIMEOUT_MS);
+		const { quickOpMs, actionOpMs } = resolveOpTimeouts(timeoutMs);
+		const waitMs = (explicit?: number): number => resolveWaitTimeout(timeoutMs, explicit);
 		const INF = Number.POSITIVE_INFINITY;
 		const op = <T>(label: string, perOpMs: number, fn: (sig: AbortSignal) => Promise<T>): Promise<T> =>
 			this.#runOp(active, label, signal, perOpMs, fn);
@@ -844,7 +937,7 @@ export class WorkerCore {
 					return content;
 				}),
 			click: selector =>
-				op(`tab.click(${JSON.stringify(selector)})`, INF, async sig => {
+				op(`tab.click(${JSON.stringify(selector)})`, actionOpMs, async sig => {
 					if (parseAriaRefSelector(selector) !== null) {
 						const handle = await this.#resolveAriaRef(selector);
 						try {
@@ -855,12 +948,12 @@ export class WorkerCore {
 						return;
 					}
 					const resolved = normalizeSelector(selector);
-					if (resolved.startsWith("text/")) await clickQueryHandlerText(page, resolved, timeoutMs, sig);
-					else await untilAborted(sig, () => page.locator(resolved).setTimeout(timeoutMs).click());
+					if (resolved.startsWith("text/")) await clickQueryHandlerText(page, resolved, actionOpMs, sig);
+					else await untilAborted(sig, () => page.locator(resolved).setTimeout(actionOpMs).click({ signal: sig }));
 				}),
 			type: (selector, text) =>
-				op(`tab.type(${JSON.stringify(selector)})`, INF, async sig => {
-					const handle = await this.#resolveActionHandle(selector, timeoutMs, sig);
+				op(`tab.type(${JSON.stringify(selector)})`, actionOpMs, async sig => {
+					const handle = await this.#resolveActionHandle(selector, actionOpMs, sig);
 					try {
 						await untilAborted(sig, () => handle.type(text, { delay: 0 }));
 					} finally {
@@ -868,7 +961,7 @@ export class WorkerCore {
 					}
 				}),
 			fill: (selector, value) =>
-				op(`tab.fill(${JSON.stringify(selector)})`, INF, async sig => {
+				op(`tab.fill(${JSON.stringify(selector)})`, actionOpMs, async sig => {
 					if (parseAriaRefSelector(selector) !== null) {
 						const handle = await this.#resolveAriaRef(selector);
 						try {
@@ -886,22 +979,46 @@ export class WorkerCore {
 						return;
 					}
 					await untilAborted(sig, () =>
-						page.locator(normalizeSelector(selector)).setTimeout(timeoutMs).fill(value),
+						page.locator(normalizeSelector(selector)).setTimeout(actionOpMs).fill(value, { signal: sig }),
 					);
 				}),
 			press: (key, opts) =>
-				op(`tab.press(${JSON.stringify(key)})`, INF, async sig => {
+				op(`tab.press(${JSON.stringify(key)})`, actionOpMs, async sig => {
 					const selector = opts?.selector;
 					if (selector) await untilAborted(sig, () => page.focus(normalizeSelector(selector)));
 					await untilAborted(sig, () => page.keyboard.press(key));
 				}),
 			scroll: (deltaX, deltaY) =>
-				op("tab.scroll()", INF, sig => untilAborted(sig, () => page.mouse.wheel({ deltaX, deltaY }))),
-			drag: (from, to) => op("tab.drag()", INF, sig => this.#drag(from, to, sig)),
-			waitFor: selector =>
-				op(`tab.waitFor(${JSON.stringify(selector)})`, INF, sig =>
-					this.#resolveActionHandle(selector, timeoutMs, sig),
-				),
+				op("tab.scroll()", actionOpMs, sig => untilAborted(sig, () => page.mouse.wheel({ deltaX, deltaY }))),
+			drag: (from, to) => op("tab.drag()", actionOpMs, sig => this.#drag(from, to, sig)),
+			waitFor: (selector, opts) => {
+				const w = waitMs(opts?.timeout);
+				return op(`tab.waitFor(${JSON.stringify(selector)})`, w, sig =>
+					this.#resolveActionHandle(selector, w, sig),
+				);
+			},
+			waitForSelector: (selector, opts) => {
+				const w = waitMs(opts?.timeout);
+				return op(`tab.waitForSelector(${JSON.stringify(selector)})`, w, async sig => {
+					if (parseAriaRefSelector(selector) !== null) return this.#resolveAriaRef(selector);
+					return (await untilAborted(sig, () =>
+						page.waitForSelector(normalizeSelector(selector), {
+							timeout: w,
+							visible: opts?.visible,
+							hidden: opts?.hidden,
+							signal: sig,
+						}),
+					)) as ElementHandle | null;
+				});
+			},
+			waitForNavigation: opts => {
+				const w = waitMs(opts?.timeout);
+				return op("tab.waitForNavigation()", w, sig =>
+					untilAborted(sig, () =>
+						page.waitForNavigation({ waitUntil: opts?.waitUntil ?? "load", timeout: w, signal: sig }),
+					),
+				);
+			},
 			evaluate: (fn, ...args) =>
 				op("tab.evaluate()", INF, sig =>
 					untilAborted(sig, () =>
@@ -911,8 +1028,8 @@ export class WorkerCore {
 					),
 				) as never,
 			scrollIntoView: selector =>
-				op(`tab.scrollIntoView(${JSON.stringify(selector)})`, INF, async sig => {
-					const handle = await this.#resolveActionHandle(selector, timeoutMs, sig);
+				op(`tab.scrollIntoView(${JSON.stringify(selector)})`, actionOpMs, async sig => {
+					const handle = await this.#resolveActionHandle(selector, actionOpMs, sig);
 					try {
 						await untilAborted(sig, () =>
 							handle.evaluate(el => {
@@ -927,15 +1044,21 @@ export class WorkerCore {
 					}
 				}),
 			select: (selector, ...values) =>
-				op(`tab.select(${JSON.stringify(selector)})`, INF, sig => this.#select(selector, values, timeoutMs, sig)),
+				op(`tab.select(${JSON.stringify(selector)})`, actionOpMs, sig =>
+					this.#select(selector, values, actionOpMs, sig),
+				),
 			uploadFile: (selector, ...filePaths) =>
-				op(`tab.uploadFile(${JSON.stringify(selector)})`, INF, sig =>
-					this.#uploadFile(selector, filePaths, timeoutMs, sig, session),
+				op(`tab.uploadFile(${JSON.stringify(selector)})`, actionOpMs, sig =>
+					this.#uploadFile(selector, filePaths, actionOpMs, sig, session),
 				),
-			waitForUrl: (pattern, opts) =>
-				op("tab.waitForUrl()", INF, sig => this.#waitForUrl(pattern, opts?.timeout ?? timeoutMs, sig)),
-			waitForResponse: (pattern, opts) =>
-				op("tab.waitForResponse()", INF, sig => this.#waitForResponse(pattern, opts?.timeout ?? timeoutMs, sig)),
+			waitForUrl: (pattern, opts) => {
+				const w = waitMs(opts?.timeout);
+				return op("tab.waitForUrl()", w, sig => this.#waitForUrl(pattern, w, sig));
+			},
+			waitForResponse: (pattern, opts) => {
+				const w = waitMs(opts?.timeout);
+				return op("tab.waitForResponse()", w, sig => this.#waitForResponse(pattern, w, sig));
+			},
 			id: id => this.#resolveCachedHandle(id),
 			ref: id => this.#resolveAriaRef(id),
 		};
@@ -1122,7 +1245,7 @@ export class WorkerCore {
 	async #select(selector: string, values: string[], timeoutMs: number, signal: AbortSignal): Promise<string[]> {
 		const page = this.#requirePage();
 		const handle = (await untilAborted(signal, () =>
-			page.locator(normalizeSelector(selector)).setTimeout(timeoutMs).waitHandle(),
+			page.locator(normalizeSelector(selector)).setTimeout(timeoutMs).waitHandle({ signal }),
 		)) as ElementHandle;
 		try {
 			return (await untilAborted(signal, () =>
@@ -1168,7 +1291,7 @@ export class WorkerCore {
 		if (!filePaths.length) throw new ToolError("tab.uploadFile() requires at least one file path");
 		const page = this.#requirePage();
 		const handle = (await untilAborted(signal, () =>
-			page.locator(normalizeSelector(selector)).setTimeout(timeoutMs).waitHandle(),
+			page.locator(normalizeSelector(selector)).setTimeout(timeoutMs).waitHandle({ signal }),
 		)) as ElementHandle;
 		try {
 			const absolute = filePaths.map(filePath => resolveToCwd(filePath, session.cwd));
@@ -1197,7 +1320,7 @@ export class WorkerCore {
 					const url = (globalThis as unknown as { location: { href: string } }).location.href;
 					return isRe ? new RegExp(m, fl).test(url) : url.includes(m);
 				},
-				{ timeout, polling: 200 },
+				{ timeout, polling: 200, signal },
 				matcher,
 				isRegex,
 				flags,
@@ -1218,7 +1341,7 @@ export class WorkerCore {
 				: pattern instanceof RegExp
 					? response => pattern.test(response.url())
 					: response => response.url().includes(pattern);
-		return (await untilAborted(signal, () => page.waitForResponse(predicate, { timeout }))) as HTTPResponse;
+		return (await untilAborted(signal, () => page.waitForResponse(predicate, { timeout, signal }))) as HTTPResponse;
 	}
 
 	async #resolveCachedHandle(id: number): Promise<ElementHandle> {
@@ -1257,7 +1380,7 @@ export class WorkerCore {
 	async #resolveActionHandle(selector: string, timeoutMs: number, sig: AbortSignal): Promise<ElementHandle> {
 		if (parseAriaRefSelector(selector) !== null) return this.#resolveAriaRef(selector);
 		return (await untilAborted(sig, () =>
-			this.#requirePage().locator(normalizeSelector(selector)).setTimeout(timeoutMs).waitHandle(),
+			this.#requirePage().locator(normalizeSelector(selector)).setTimeout(timeoutMs).waitHandle({ signal: sig }),
 		)) as ElementHandle;
 	}
 	#clearElementCache(): void {

package/src/tools/write.ts

@@ -27,6 +27,7 @@ import {
 	readArchiveEntries,
 	writeArchive,
 } from "../utils/zip";
+import { routeWriteThroughBridge } from "./acp-bridge";
 import { truncateForPrompt } from "./approval";
 import { assertEditableFile } from "./auto-generated-guard";
 import {
@@ -143,15 +144,6 @@ function maybeWriteSnapshotHeader(session: ToolSession, absolutePath: string, co
 	return formatHashlineHeader(formatPathRelativeToCwd(absolutePath, session.cwd), tag);
 }
 
-function shouldRouteWriteThroughBridge(session: ToolSession, requestedPath: string, absolutePath: string): boolean {
-	if (isInternalUrlPath(requestedPath)) return false;
-
-	const state = session.getPlanModeState?.();
-	if (!state?.enabled || !isInternalUrlPath(state.planFilePath)) return true;
-
-	return absolutePath !== resolvePlanPath(session, state.planFilePath);
-}
-
 /**
  * Append a trailing note line to the first text block of a tool result.
  * Mutates `result` in place (the result object is owned by this call).
@@ -771,11 +763,6 @@ export class WriteTool implements AgentTool<typeof writeSchema, WriteToolDetails
 		};
 	}
 
-	#routeWriteThroughBridge(absolutePath: string, content: string): Promise<void> | undefined {
-		const bridge = this.session.getClientBridge?.();
-		if (!bridge?.capabilities.writeTextFile || !bridge.writeTextFile) return undefined;
-		return bridge.writeTextFile({ path: absolutePath, content });
-	}
 	async execute(
 		_toolCallId: string,
 		{ path: rawPath, content }: WriteParams,
@@ -882,17 +869,7 @@ export class WriteTool implements AgentTool<typeof writeSchema, WriteToolDetails
 
 			// Try ACP bridge first for editor-visible filesystem paths. Internal
 			// artifacts such as local:// plans are owned by OMP, not the editor.
-			const bridgePromise = shouldRouteWriteThroughBridge(this.session, path, absolutePath)
-				? this.#routeWriteThroughBridge(absolutePath, cleanContent)
-				: undefined;
-			if (bridgePromise !== undefined) {
-				try {
-					await bridgePromise;
-				} catch (error) {
-					throw new ToolError(error instanceof Error ? error.message : String(error));
-				}
-				invalidateFsScanAfterWrite(absolutePath);
-				this.session.bumpFileMutationVersion?.(absolutePath);
+			if (await routeWriteThroughBridge(this.session, path, absolutePath, cleanContent)) {
 				const madeExecutable = await maybeMarkExecutableForShebang(absolutePath, cleanContent);
 				const displayPath = formatPathRelativeToCwd(absolutePath, this.session.cwd);
 				const header = maybeWriteSnapshotHeader(this.session, absolutePath, cleanContent);

package/src/utils/image-loading.ts

@@ -9,9 +9,10 @@ export const SUPPORTED_INPUT_IMAGE_MIME_TYPES = SUPPORTED_IMAGE_MIME_TYPES;
 
 /**
  * Ollama and its local-backend family decode image input through llama.cpp /
- * `stb_image`, which is compiled without WebP support, so a WebP upload fails
- * with an opaque HTTP 400. Detect those models so the resize pipeline encodes
- * to PNG/JPEG instead — the automatic equivalent of `OMP_NO_WEBP=1`.
+ * `stb_image`, which is compiled without WebP support. The first-party Codex
+ * Responses backend also rejects WebP `input_image.image_url` data URLs. Detect
+ * those models so the resize pipeline encodes to PNG/JPEG instead — the
+ * automatic equivalent of `OMP_NO_WEBP=1`.
  */
 export function modelLacksWebpSupport(
 	model: Pick<Model, "provider" | "api" | "imageInputDecoder"> | undefined,
@@ -19,6 +20,8 @@ export function modelLacksWebpSupport(
 	if (!model) return false;
 	return (
 		model.imageInputDecoder === "stb" ||
+		model.api === "openai-codex-responses" ||
+		model.provider === "openai-codex" ||
 		model.provider === "ollama" ||
 		model.provider === "ollama-cloud" ||
 		model.provider === "llama.cpp" ||