@oh-my-pi/pi-coding-agent 17.2.2 → 17.2.3

package/src/tools/browser/registry.ts

@@ -1,5 +1,5 @@
 import * as path from "node:path";
-import { logger, withTimeout } from "@oh-my-pi/pi-utils";
+import { isCompiledBinary, logger, withTimeout, workerHostEntry } from "@oh-my-pi/pi-utils";
 import type { Subprocess } from "bun";
 import type { Browser, CDPSession } from "puppeteer-core";
 import { ToolAbortError, ToolError } from "../tool-errors";
@@ -8,11 +8,13 @@ import type { CmuxKind } from "./cmux/rpc";
 import { CmuxSocketClient } from "./cmux/socket-client";
 import {
 	BROWSER_PROTOCOL_TIMEOUT_MS,
+	DEFAULT_VIEWPORT,
 	launchHeadlessBrowser,
 	loadPuppeteer,
 	removeUserDataDir,
 	type UserAgentOverride,
 } from "./launch";
+import { ensureSharedBrowser } from "./shared-daemon";
 
 export type PuppeteerBrowserKind =
 	| { kind: "headless"; headless: boolean }
@@ -41,8 +43,10 @@ export interface PuppeteerBrowserHandle extends BrowserHandleCommon {
 	browser: Browser;
 	cdpUrl?: string;
 	pid?: number;
-	/** OMP-owned temp Chromium profile directory removed on dispose (headless launches). */
+	/** OMP-owned temp Chromium profile directory removed on dispose (process-local headless launches). */
 	userDataDir?: string;
+	/** Broker daemon backing this handle; dispose disconnects instead of closing, kill routes to the broker. */
+	sharedDaemon?: { name: string; projectDir: string };
 	subprocess?: Subprocess;
 	stealth: { browserSession: CDPSession | null; override: UserAgentOverride | null };
 }
@@ -63,6 +67,8 @@ export interface ReleaseBrowserOptions {
 }
 
 const browsers = new Map<string, BrowserHandle>();
+/** In-flight opens by browser key, so concurrent acquisitions share one launch instead of storming Chromium. */
+const pendingOpens = new Map<string, Promise<BrowserHandle>>();
 
 function browserKey(kind: BrowserKind): string {
 	switch (kind.kind) {
@@ -86,37 +92,51 @@ export interface AcquireBrowserOptions {
 
 export async function acquireBrowser(kind: BrowserKind, opts: AcquireBrowserOptions): Promise<BrowserHandle> {
 	const key = browserKey(kind);
-	const existing = browsers.get(key);
-	if (existing) {
-		if ("client" in existing) return existing;
-		if (existing.browser.connected) return existing;
-		browsers.delete(key);
-		await disposeBrowserHandle(existing, { kill: false });
-	}
-	// Short-circuit before launching: the tool wrapper's `untilAborted` only
-	// rejects its outer promise on abort; without this check `openBrowserHandle`
-	// would still fire and its result would land in `browsers` below.
-	if (opts.signal?.aborted) throw new ToolAbortError("Browser open aborted");
+	for (;;) {
+		const existing = browsers.get(key);
+		if (existing) {
+			if ("client" in existing) return existing;
+			if (existing.browser.connected) return existing;
+			browsers.delete(key);
+			await disposeBrowserHandle(existing, { kill: false });
+			continue;
+		}
+		// Short-circuit before launching: the tool wrapper's `untilAborted` only
+		// rejects its outer promise on abort; without this check `openBrowserHandle`
+		// would still fire and its result would land in `browsers` below.
+		if (opts.signal?.aborted) throw new ToolAbortError("Browser open aborted");
 
-	const handle = await openBrowserHandle(kind, opts);
-	// The launch may resolve AFTER the caller has already aborted (the outer
-	// `untilAborted` rejects immediately on abort but does not cancel the
-	// inner promise, and `launchHeadlessBrowser` does not accept a signal).
-	// Without this branch the completed handle sits in `browsers` at
-	// refCount:0 forever — no tab ever takes a hold, `releaseBrowser` never
-	// fires, and `releaseAllTabs` walks `tabs`, not `browsers`, so the
-	// orphaned Chromium/app process / puppeteer handle survives to process
-	// exit. (Issue #3963.)
-	if (opts.signal?.aborted) {
-		await disposeBrowserHandle(handle, { kill: kind.kind === "spawned" }).catch(err => {
-			logger.debug("Failed to dispose orphan browser after abort", {
-				error: err instanceof Error ? err.message : String(err),
+		// Single-flight per key: a concurrent caller already opening this browser
+		// wins; everyone else waits and re-reads the registry. Without this, N
+		// simultaneous opens each launch a Chromium and the last write wins,
+		// leaking the rest as unreferenced process trees.
+		const pending = pendingOpens.get(key);
+		if (pending) {
+			await pending.catch(() => undefined);
+			continue;
+		}
+		const open = openBrowserHandle(kind, opts).finally(() => pendingOpens.delete(key));
+		pendingOpens.set(key, open);
+		const handle = await open;
+		// The launch may resolve AFTER the caller has already aborted (the outer
+		// `untilAborted` rejects immediately on abort but does not cancel the
+		// inner promise, and `launchHeadlessBrowser` does not accept a signal).
+		// Without this branch the completed handle sits in `browsers` at
+		// refCount:0 forever — no tab ever takes a hold, `releaseBrowser` never
+		// fires, and `releaseAllTabs` walks `tabs`, not `browsers`, so the
+		// orphaned Chromium/app process / puppeteer handle survives to process
+		// exit. (Issue #3963.)
+		if (opts.signal?.aborted) {
+			await disposeBrowserHandle(handle, { kill: kind.kind === "spawned" }).catch(err => {
+				logger.debug("Failed to dispose orphan browser after abort", {
+					error: err instanceof Error ? err.message : String(err),
+				});
 			});
-		});
-		throw new ToolAbortError("Browser open aborted");
+			throw new ToolAbortError("Browser open aborted");
+		}
+		browsers.set(key, handle);
+		return handle;
 	}
-	browsers.set(key, handle);
-	return handle;
 }
 
 export function normalizeConnectedCdpUrl(rawCdpUrl: string): string {
@@ -142,6 +162,14 @@ async function openBrowserHandle(kind: BrowserKind, opts: AcquireBrowserOptions)
 		};
 	}
 	if (kind.kind === "headless") {
+		// Every real omp process (session, subagent, worker — anything with a CLI
+		// worker host) MUST go through the project-shared broker-owned Chromium:
+		// per-process launches are what produced launch storms and orphaned
+		// process trees. The process-local launch survives only for hosts that
+		// cannot spawn the broker (bun test, SDK embedding without a CLI entry).
+		if (isCompiledBinary() || workerHostEntry() !== null) {
+			return await openSharedHeadlessHandle(kind, opts);
+		}
 		const { browser, userDataDir } = await launchHeadlessBrowser({
 			headless: kind.headless,
 			viewport: opts.viewport,
@@ -257,6 +285,21 @@ async function disposeBrowserHandle(handle: BrowserHandle, opts: ReleaseBrowserO
 		return;
 	}
 	if (handle.kind.kind === "headless") {
+		if (handle.sharedDaemon) {
+			// The broker owns the Chromium; this process only drops its CDP
+			// connection. `kill` is scoped to spawned-app browsers — stopping the
+			// shared daemon here would tear down every other session's tabs. The
+			// daemon dies with the last omp client in the project (broker idle
+			// teardown), or via an explicit hub stop.
+			if (handle.browser.connected) {
+				try {
+					handle.browser.disconnect();
+				} catch (err) {
+					logger.debug("Failed to disconnect from shared browser", { error: (err as Error).message });
+				}
+			}
+			return;
+		}
 		if (handle.browser.connected) {
 			// Puppeteer's `browser.close()` resolves only once the Chromium
 			// process fully exits. A wedged Chromium (a known Windows failure
@@ -297,6 +340,56 @@ async function disposeBrowserHandle(handle: BrowserHandle, opts: ReleaseBrowserO
 	if (opts.kill && handle.pid !== undefined) await gracefulKillTreeOnce(handle.pid);
 }
 
+/**
+ * Attach to the project-shared broker-owned Chromium. Failures surface as
+ * `ToolError` — a CLI-host process never silently falls back to a private
+ * Chromium, so a broken broker cannot quietly recreate per-process launch
+ * storms.
+ */
+async function openSharedHeadlessHandle(
+	kind: Extract<PuppeteerBrowserKind, { kind: "headless" }>,
+	opts: AcquireBrowserOptions,
+): Promise<PuppeteerBrowserHandle> {
+	const vp = opts.viewport ?? DEFAULT_VIEWPORT;
+	try {
+		const shared = await ensureSharedBrowser({
+			projectDir: opts.cwd,
+			headless: kind.headless,
+			viewport: vp,
+			signal: opts.signal,
+		});
+		if (!shared) {
+			throw new ToolError(
+				"Shared browser daemon unavailable (broker start or Chromium launch failed); check `hub ps` for omp.browser.* daemons and ~/.omp/logs for details",
+			);
+		}
+		const puppeteer = await loadPuppeteer();
+		const browser = await puppeteer.connect({
+			browserWSEndpoint: shared.wsEndpoint,
+			defaultViewport: kind.headless
+				? {
+						width: vp.width,
+						height: vp.height,
+						deviceScaleFactor: vp.deviceScaleFactor ?? DEFAULT_VIEWPORT.deviceScaleFactor,
+					}
+				: null,
+			protocolTimeout: BROWSER_PROTOCOL_TIMEOUT_MS,
+		});
+		return {
+			key: browserKey(kind),
+			kind,
+			browser,
+			sharedDaemon: { name: shared.daemonName, projectDir: shared.projectDir },
+			refCount: 0,
+			stealth: { browserSession: null, override: null },
+		};
+	} catch (err) {
+		if (err instanceof ToolAbortError || err instanceof ToolError) throw err;
+		if (opts.signal?.aborted) throw new ToolAbortError("Browser open aborted");
+		throw new ToolError(`Shared browser attach failed: ${err instanceof Error ? err.message : String(err)}`);
+	}
+}
+
 /** Test-only accessor for the module-global browsers map. */
 export function getBrowsersMapForTest(): ReadonlyMap<string, BrowserHandle> {
 	return browsers;

package/src/tools/browser/shared-daemon.ts

@@ -0,0 +1,190 @@
+/**
+ * Shared automation Chromium owned by the per-project daemon broker.
+ *
+ * Instead of every omp process launching (and sometimes orphaning) a private
+ * Chromium, the headless browser kind attaches to one broker-supervised Chrome
+ * per project directory — sessions and subagents each open their own tabs in
+ * it. The broker stops the daemon when the last omp client in the project
+ * exits, so Chrome can never outlive omp, and concurrent acquisitions across
+ * processes converge on a single launch instead of a launch storm.
+ */
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { logger } from "@oh-my-pi/pi-utils";
+import { type DaemonBrokerClient, daemonClientForProject } from "../../launch/client";
+import { daemonRuntimeDir } from "../../launch/paths";
+import type { DaemonSnapshot } from "../../launch/protocol";
+import { throwIfAborted } from "../tool-errors";
+import { resolveSharedBrowserLaunchSpec } from "./launch";
+
+/** Chrome prints this on stderr once the CDP listener is up; the broker's ready probe captures the line. */
+const READY_LOG_PATTERN = String.raw`DevTools listening on ws://\S+`;
+const READY_TIMEOUT_MS = 30_000;
+const STOP_TIMEOUT_MS = 5_000;
+const PROBE_TIMEOUT_MS = 1_500;
+/** describe→start rounds before giving up; bounds cross-process start races and wedged-Chrome replacement. */
+const ENSURE_ATTEMPTS = 3;
+
+/** Broker-owned browser endpoint one omp process can attach to. */
+export interface SharedBrowserEndpoint {
+	wsEndpoint: string;
+	daemonName: string;
+	/** Canonical project directory owning the broker (used to address later stop requests). */
+	projectDir: string;
+}
+
+/** Stable broker daemon name for the shared automation browser. */
+export function sharedBrowserDaemonName(headless: boolean): string {
+	return headless ? "omp.browser.headless" : "omp.browser.headed";
+}
+
+function wsEndpointOf(snapshot: DaemonSnapshot | undefined): string | undefined {
+	return snapshot?.readyMatch?.match(/ws:\/\/\S+/)?.[0];
+}
+
+/** CDP liveness probe: the ws endpoint host must answer /json/version. */
+async function probeEndpoint(wsEndpoint: string): Promise<boolean> {
+	let host: string;
+	try {
+		host = new URL(wsEndpoint).host;
+	} catch {
+		return false;
+	}
+	try {
+		const res = await fetch(`http://${host}/json/version`, { signal: AbortSignal.timeout(PROBE_TIMEOUT_MS) });
+		await res.body?.cancel();
+		return res.ok;
+	} catch {
+		return false;
+	}
+}
+
+/** Snapshot the daemon, treating "unknown daemon" as absent. */
+async function describeQuietly(
+	client: DaemonBrokerClient,
+	name: string,
+	signal?: AbortSignal,
+): Promise<DaemonSnapshot | undefined> {
+	try {
+		const result = await client.request({ op: "describe", name }, signal);
+		return result.op === "describe" ? result.daemon : undefined;
+	} catch (error) {
+		throwIfAborted(signal);
+		logger.debug("Shared browser describe failed", {
+			name,
+			error: error instanceof Error ? error.message : String(error),
+		});
+		return undefined;
+	}
+}
+
+/** Block until the daemon reports ready; undefined on timeout or pre-ready exit. */
+async function waitReady(
+	client: DaemonBrokerClient,
+	name: string,
+	signal?: AbortSignal,
+): Promise<DaemonSnapshot | undefined> {
+	try {
+		const result = await client.request({ op: "wait", name, for: "ready", timeoutMs: READY_TIMEOUT_MS }, signal);
+		if (result.op !== "wait" || result.timedOut) return undefined;
+		return result.daemon;
+	} catch (error) {
+		throwIfAborted(signal);
+		logger.debug("Shared browser ready wait failed", {
+			name,
+			error: error instanceof Error ? error.message : String(error),
+		});
+		return undefined;
+	}
+}
+
+/** Best-effort stop before replacing a wedged or endpoint-less daemon. */
+async function stopQuietly(client: DaemonBrokerClient, name: string, signal?: AbortSignal): Promise<void> {
+	try {
+		await client.request({ op: "stop", name, timeoutMs: STOP_TIMEOUT_MS }, signal);
+	} catch (error) {
+		throwIfAborted(signal);
+		logger.debug("Shared browser stop failed", {
+			name,
+			error: error instanceof Error ? error.message : String(error),
+		});
+	}
+}
+
+/**
+ * Ensure the project-shared automation Chromium is running and reachable,
+ * launching it under the daemon broker when needed. Idempotent across
+ * processes: losers of the start race adopt the winner's endpoint on the next
+ * describe round. Returns null when the shared path is unavailable (no
+ * resolvable Chromium, broker failure, or a daemon that never becomes
+ * reachable); callers fall back to a process-local launch.
+ */
+export async function ensureSharedBrowser(opts: {
+	projectDir: string;
+	headless: boolean;
+	viewport?: { width: number; height: number };
+	signal?: AbortSignal;
+}): Promise<SharedBrowserEndpoint | null> {
+	const client = await daemonClientForProject(opts.projectDir);
+	const name = sharedBrowserDaemonName(opts.headless);
+	// Stable profile under the broker's runtime dir: reused across launches, and
+	// never contended by pre-daemon Chromiums that used throwaway temp profiles.
+	const userDataDir = path.join(daemonRuntimeDir(client.projectDir), `${name}.profile`);
+	const launch = await resolveSharedBrowserLaunchSpec({
+		headless: opts.headless,
+		userDataDir,
+		viewport: opts.viewport,
+	});
+	if (!launch) return null;
+	await fs.mkdir(userDataDir, { recursive: true });
+	for (let attempt = 0; attempt < ENSURE_ATTEMPTS; attempt++) {
+		throwIfAborted(opts.signal);
+		const existing = await describeQuietly(client, name, opts.signal);
+		if (existing && existing.state !== "exited" && existing.state !== "failed") {
+			const settled = existing.readyAt !== undefined ? existing : await waitReady(client, name, opts.signal);
+			const wsEndpoint = wsEndpointOf(settled);
+			if (wsEndpoint && (await probeEndpoint(wsEndpoint))) {
+				return { wsEndpoint, daemonName: name, projectDir: client.projectDir };
+			}
+			// Live record but unreachable Chrome (wedged, or readiness never
+			// matched): replace it rather than handing out a dead endpoint.
+			await stopQuietly(client, name, opts.signal);
+			continue;
+		}
+		try {
+			const started = await client.request(
+				{
+					op: "start",
+					spec: {
+						name,
+						application: launch.executablePath,
+						args: launch.args,
+						env: {},
+						cwd: client.projectDir,
+						pty: false,
+						ready: { log: READY_LOG_PATTERN, timeoutMs: READY_TIMEOUT_MS },
+						restart: "no",
+						persist: false,
+						detached: false,
+					},
+				},
+				opts.signal,
+			);
+			if (started.op !== "start") continue;
+			const wsEndpoint = started.readyTimedOut ? undefined : wsEndpointOf(started.daemon);
+			if (wsEndpoint && (await probeEndpoint(wsEndpoint))) {
+				return { wsEndpoint, daemonName: name, projectDir: client.projectDir };
+			}
+			await stopQuietly(client, name, opts.signal);
+		} catch (error) {
+			throwIfAborted(opts.signal);
+			// Lost a cross-process start race ("already starting/ready"); the next
+			// describe round adopts the winner's endpoint.
+			logger.debug("Shared browser start contention", {
+				name,
+				error: error instanceof Error ? error.message : String(error),
+			});
+		}
+	}
+	return null;
+}

package/src/tools/browser.ts

@@ -422,7 +422,7 @@ function describeBrowser(handle: BrowserHandle): string {
 	}
 	switch (handle.kind.kind) {
 		case "headless":
-			return `headless browser (${handle.kind.headless ? "hidden" : "visible"})`;
+			return `headless browser (${handle.kind.headless ? "hidden" : "visible"}${handle.sharedDaemon ? ", shared" : ""})`;
 		case "spawned":
 			return `spawned ${handle.kind.path} (pid ${handle.pid ?? "?"})`;
 		case "connected":

package/src/web/search/providers/codex.ts

@@ -407,6 +407,30 @@ function buildCodexHeaders(
 	return headers;
 }
 
+/**
+ * Extracts a backend error `{code, message}` from a Codex SSE event, tolerating
+ * the envelope shapes the ChatGPT Codex backend emits: top-level `{code,message}`,
+ * a nested `error` object, and a `response.error` object (as in `response.failed`).
+ * Without this the nested shapes collapse to `Codex error (): Unknown error`,
+ * discarding the backend diagnostic — e.g. a regional/model-snapshot rejection (#7200).
+ */
+function extractCodexSseError(rawEvent: Record<string, unknown>): { code: string; message: string } {
+	const candidates: unknown[] = [
+		rawEvent,
+		rawEvent.error,
+		(rawEvent.response as { error?: unknown } | undefined)?.error,
+	];
+	let code = "";
+	let message = "";
+	for (const candidate of candidates) {
+		if (!candidate || typeof candidate !== "object") continue;
+		const record = candidate as Record<string, unknown>;
+		if (!code && typeof record.code === "string" && record.code) code = record.code;
+		if (!message && typeof record.message === "string" && record.message) message = record.message;
+	}
+	return { code, message };
+}
+
 /**
  * Calls the Codex Responses API with web search tool enabled.
  * The caller provides the exact model id to send; retry / fallback policy
@@ -558,13 +582,14 @@ async function callCodexSearch(
 				}
 			}
 		} else if (eventType === "error") {
-			const code = (rawEvent as { code?: string }).code ?? "";
-			const message = (rawEvent as { message?: string }).message ?? "Unknown error";
-			throw new SearchProviderError("codex", `Codex error (${code}): ${message}`, 500);
+			const { code, message } = extractCodexSseError(rawEvent);
+			throw new SearchProviderError("codex", `Codex error (${code}): ${message || "Unknown error"}`, 500);
 		} else if (eventType === "response.failed") {
-			const resp = (rawEvent as { response?: { error?: { message?: string } } }).response;
-			const errorMessage = resp?.error?.message ?? "Request failed";
-			throw new SearchProviderError("codex", `Codex request failed: ${errorMessage}`, 500);
+			const { code, message } = extractCodexSseError(rawEvent);
+			const detail = code
+				? `Codex request failed (${code}): ${message || "Request failed"}`
+				: `Codex request failed: ${message || "Request failed"}`;
+			throw new SearchProviderError("codex", detail, 500);
 		}
 	}