@oh-my-pi/pi-coding-agent 17.3.3 → 17.3.5

package/src/session/turn-recovery.ts

@@ -74,6 +74,11 @@ const EMPTY_STOP_MAX_RETRIES = 3;
 const SIBLING_UNBLOCK_BUFFER_MS = 1_000;
 const NON_WHITESPACE_RE = /\S/;
 const USAGE_PREFLIGHT_BLOCKED_PREFIX = "Usage preflight blocked:";
+const STREAM_STALL_ERROR_RE = /stream stall/i;
+const HTTP2_STREAM_RESET_ERROR_RE =
+	/stream closed with error code\s+nghttp2_(?:internal_error|refused_stream)|nghttp2_(?:internal_error|refused_stream)|HTTP2(?:StreamReset|RefusedStream)/i;
+const IMMUTABLE_ANTHROPIC_THINKING_ERROR_PATTERN =
+	/messages\.\d+\.content\.\d+.*\b(?:thinking|redacted_thinking)\b.*\blatest assistant message cannot be modified\b/is;
 
 function hasNonWhitespace(value: string): boolean {
 	return NON_WHITESPACE_RE.test(value);
@@ -404,8 +409,8 @@ export class TurnRecovery {
 		return this.#handleUnexpectedAssistantStop(message);
 	}
 
-	/** Removes a persisted failed assistant turn after its persistence slot settles. */
-	dropPersistedAssistantTurn(message: AssistantMessage): Promise<void> {
+	/** Removes a persisted failed assistant turn after its persistence slot settles; returns the dropped branch entry id. */
+	dropPersistedAssistantTurn(message: AssistantMessage): Promise<string | undefined> {
 		return this.#dropPersistedAssistantTurn(message);
 	}
 
@@ -674,15 +679,33 @@ export class TurnRecovery {
 		this.#emptyStopRetryCount++;
 		if (this.#emptyStopRetryCount > EMPTY_STOP_MAX_RETRIES) {
 			const attempts = this.#emptyStopRetryCount - 1;
-			const finalError = providerEmptyOutput
-				? "Assistant returned no final output after retry cap; try switching models"
-				: "Assistant returned empty stop after retry cap; try switching models or `/shake images` to remove archived frames";
+			const outputTokens = assistantMessage.usage.output;
+			const outputTokensExcludingKnownReasoning = Math.max(
+				0,
+				outputTokens - (assistantMessage.usage.reasoningTokens ?? 0),
+			);
+			let finalError: string;
+			if (providerEmptyOutput) {
+				finalError = "Assistant returned no final output after retry cap; try switching models";
+			} else if (outputTokensExcludingKnownReasoning > 0 && assistantMessage.content.length === 0) {
+				// Billed non-reasoning output on a truly zero-block stop means content was
+				// generated and then dropped downstream (a filter/refusal flattened to
+				// `finish_reason: "stop"` by a proxy, or a lossy API translation) — the
+				// context/`/shake images` hint is wrong here, so name the billed output
+				// instead. Known reasoning-only usage is not evidence that deliverable
+				// content was dropped, and thinking-only stops retain a thinking block.
+				finalError = `Assistant returned an empty stop after retry cap, but the provider billed ${outputTokens} output token${outputTokens === 1 ? "" : "s"} for it; content was generated and then dropped before delivery, which usually points to a provider-side content filter or a lossy API translation rather than a context problem`;
+			} else {
+				finalError =
+					"Assistant returned empty stop after retry cap; try switching models or `/shake images` to remove archived frames";
+			}
 			assistantMessage.errorMessage = finalError;
 			if (providerEmptyOutput) assistantMessage.errorId = AIError.create();
 			logger.warn(finalError, {
 				attempts,
 				model: assistantMessage.model,
 				provider: assistantMessage.provider,
+				outputTokens,
 			});
 			await this.#host.emitSessionEvent({
 				type: "auto_retry_end",
@@ -697,10 +720,14 @@ export class TurnRecovery {
 			// provider usage can anchor the next prompt at the full failed-request size
 			// and re-trigger compaction at the same boundary. Remove every capped
 			// empty output; toolUse orphans still need this for Anthropic history.
-			await this.dropPersistedAssistantTurn(assistantMessage);
+			await this.#dropAssistantTurnDurably(assistantMessage);
 			return "terminal";
 		}
-		this.discardAssistantTurn(assistantMessage);
+		// The reparented leaf must be durably persisted before the retry continues:
+		// the loader rebuilds the active branch from the last physical entry, so an
+		// in-memory-only reparent lets the empty stop resurface on reload or after
+		// a mid-retry process kill.
+		await this.#dropAssistantTurnDurably(assistantMessage);
 		this.#host.agent.appendMessage({
 			role: "developer",
 			content: [{ type: "text", text: this.#emptyStopRetryReminder() }],
@@ -823,9 +850,19 @@ export class TurnRecovery {
 	 * replays the failed turn, while no-recovery paths leave the persisted entry
 	 * (and the user-visible transcript line) in place.
 	 */
-	async #dropPersistedAssistantTurn(assistantMessage: AssistantMessage): Promise<void> {
+	async #dropPersistedAssistantTurn(assistantMessage: AssistantMessage): Promise<string | undefined> {
 		await this.#host.waitForSessionMessagePersistence(assistantMessage);
-		this.discardAssistantTurn(assistantMessage);
+		return this.discardAssistantTurn(assistantMessage);
+	}
+
+	/**
+	 * Drop the failed turn from active context and the persisted branch, then
+	 * durably persist the reparented leaf so the empty stop cannot resurface on
+	 * reload or after a mid-retry process kill.
+	 */
+	async #dropAssistantTurnDurably(assistantMessage: AssistantMessage): Promise<void> {
+		const droppedEntryId = await this.#dropPersistedAssistantTurn(assistantMessage);
+		if (droppedEntryId) await this.#host.sessionManager.discardEntryDurably(droppedEntryId);
 	}
 
 	/**
@@ -917,7 +954,7 @@ export class TurnRecovery {
 	 * the Gemini header-runaway interrupt, which must not replay a partial,
 	 * loop-fueling thinking block.
 	 */
-	discardAssistantTurn(assistantMessage: AssistantMessage): void {
+	discardAssistantTurn(assistantMessage: AssistantMessage): string | undefined {
 		this.removeAssistantMessageFromActiveContext(assistantMessage);
 
 		const branch = this.#host.sessionManager.getBranch();
@@ -939,7 +976,7 @@ export class TurnRecovery {
 						this.#isSameAssistantMessage(entry.message as AssistantMessage, assistantMessage),
 				);
 		if (!branchEntry) {
-			return;
+			return undefined;
 		}
 		this.#host.withBashBranchTransition(() => {
 			if (branchEntry.parentId === null) {
@@ -948,6 +985,7 @@ export class TurnRecovery {
 				this.#host.sessionManager.branch(branchEntry.parentId);
 			}
 		});
+		return branchEntry.id;
 	}
 
 	#isSameAssistantMessage(left: AssistantMessage, right: AssistantMessage): boolean {
@@ -1030,6 +1068,14 @@ export class TurnRecovery {
 	isRetryableError(message: AssistantMessage): boolean {
 		if (message.stopReason !== "error") return false;
 		if (this.#isUsagePreflightBlocked(message)) return false;
+		const model = this.#host.model();
+		const immutableAnthropicThinkingError =
+			model?.api === "anthropic-messages" &&
+			(message.errorStatus === 400 ||
+				message.errorId === 400 ||
+				message.errorMessage?.startsWith("400 ") === true) &&
+			IMMUTABLE_ANTHROPIC_THINKING_ERROR_PATTERN.test(message.errorMessage ?? "");
+		if (immutableAnthropicThinkingError) return false;
 
 		const id = this.#classifyRetryMessage(message);
 		// Context overflow is handled by compaction, not retry.
@@ -1103,10 +1149,10 @@ export class TurnRecovery {
 	}
 
 	/**
-	 * Classify a reasonless abort or stream stall whose emitted tool calls all
-	 * have results. The failed assistant/tool-result pair stays in context so
-	 * continuation cannot replay completed side effects; synthetic results tell
-	 * the next turn that an unexecuted call must be reissued.
+	 * Classify a reasonless abort, idle stream stall, or HTTP/2 stream reset whose
+	 * emitted tool calls all have results. The failed assistant/tool-result pair
+	 * stays in context so continuation cannot replay completed side effects;
+	 * synthetic results tell the next turn that an unexecuted call must be reissued.
 	 */
 	classifyResolvedInterruptedToolTurn(message: AssistantMessage): "reasonless-abort" | "stream-stall" | undefined {
 		const id = this.#classifyRetryMessage(message);
@@ -1118,20 +1164,28 @@ export class TurnRecovery {
 			!this.#host.isDisposed() &&
 			!this.#host.streamingEditAbortTriggered() &&
 			((message.stopReason === "aborted" && AIError.is(id, AIError.Flag.Abort)) || genericAbort);
+		const errorMessage = message.errorMessage ?? "";
 		const streamStall =
+			message.stopReason === "error" && STREAM_STALL_ERROR_RE.test(errorMessage) && AIError.retriable(id);
+		const transportReset =
 			message.stopReason === "error" &&
-			message.errorMessage?.toLowerCase().includes("stream stall") === true &&
-			AIError.retriable(id);
-		if (!reasonlessAbort && !streamStall) return undefined;
+			HTTP2_STREAM_RESET_ERROR_RE.test(errorMessage) &&
+			AIError.retriable(id) &&
+			!this.#host.abortInProgress() &&
+			!this.#host.isDisposed() &&
+			!this.#host.streamingEditAbortTriggered();
+		if (!reasonlessAbort && !streamStall && !transportReset) return undefined;
 		if (reasonlessAbort && genericAbort) message.errorId = AIError.create(AIError.Flag.Abort);
 
-		// The Cursor server-execution marker gate applies only to the stream-stall
+		// The Cursor server-execution marker gate applies only to the idle stream-stall
 		// path: an unmarked/unresolved Cursor block there means the server has not
 		// finished executing, so resuming would race it. A reasonless abort instead
 		// ends the turn and the agent loop pairs every un-run call (Cursor's unmarked
 		// `todo`/MCP blocks included) with a synthetic `executed: false` result, so
 		// the tool-result reconciliation below is the safety gate and the marker is
-		// irrelevant.
+		// irrelevant. An HTTP/2 RST_STREAM / NGHTTP2_* close also ends the Connect
+		// stream, so there is no in-flight server exec to race — unmarked MCP/todo
+		// blocks are safe to continue once every emitted call has a result.
 		const resolvedToolCallIds: string[] = [];
 		for (const block of message.content) {
 			if (block.type !== "toolCall") continue;
@@ -1536,11 +1590,32 @@ export class TurnRecovery {
 		if (!role) return false;
 
 		const ceiling = this.#host.thinkingLevelCeiling();
+		const latestAssistant = this.#host.agent.state.messages.findLast(
+			(message): message is AssistantMessage => message.role === "assistant" && message !== failedMessage,
+		);
 		for (const selector of this.findRetryFallbackCandidates(role, currentSelector)) {
 			if (this.isRetryFallbackSelectorSuppressed(selector)) continue;
 			const resolved = resolveModelOverride([selector.raw], this.#host.modelRegistry, this.#host.settings);
 			const candidate = resolved.model ?? this.#host.modelRegistry.find(selector.provider, selector.id);
 			if (!candidate) continue;
+			// Anthropic signatures and redacted blocks are model-bound, while the
+			// latest assistant response must remain byte-identical. A same-provider
+			// model switch can satisfy neither constraint, so keep retrying the
+			// source model or consider a later cross-provider candidate whose
+			// message transform can safely demote the foreign thinking.
+			if (
+				candidate.api === "anthropic-messages" &&
+				latestAssistant?.api === "anthropic-messages" &&
+				latestAssistant.provider === candidate.provider &&
+				latestAssistant.model !== candidate.id &&
+				latestAssistant.content.some(
+					block =>
+						(block.type === "thinking" && Boolean(block.thinkingSignature?.trim())) ||
+						block.type === "redactedThinking",
+				)
+			) {
+				continue;
+			}
 			// A candidate whose effort floor exceeds the per-spawn ceiling would be
 			// clamped UP past the cap by its model floor — skip it entirely.
 			if (ceiling !== undefined && !modelSupportsEffortCeiling(candidate, ceiling)) continue;
@@ -1603,6 +1678,13 @@ export class TurnRecovery {
 		if (this.#isUsagePreflightBlocked(message)) return false;
 		const model = this.#host.model();
 		if (!model) return false;
+		const immutableAnthropicThinkingError =
+			model.api === "anthropic-messages" &&
+			(message.errorStatus === 400 ||
+				message.errorId === 400 ||
+				message.errorMessage?.startsWith("400 ") === true) &&
+			IMMUTABLE_ANTHROPIC_THINKING_ERROR_PATTERN.test(message.errorMessage ?? "");
+		if (immutableAnthropicThinkingError) return false;
 		const retrySettings = this.#host.settings.getGroup("retry");
 		if (!retrySettings.enabled || !retrySettings.modelFallback) return false;
 		if (this.isClassifierRefusal(message)) return false;

package/src/session/unexpected-stop-classifier.ts

@@ -1,4 +1,4 @@
-import { type AssistantMessage, completeSimple } from "@oh-my-pi/pi-ai";
+import { type AssistantMessage, completeSimple, retryTransientCompletion } from "@oh-my-pi/pi-ai";
 import { logger, prompt } from "@oh-my-pi/pi-utils";
 
 import type { ModelRegistry } from "../config/model-registry";
@@ -16,13 +16,21 @@ const CLASSIFIER_SYSTEM_PROMPT = prompt.render(unexpectedStopClassifierPrompt);
  */
 const ANSWER_MAX_TOKENS = 16;
 /**
- * Online classifier budget. Sized to survive backends that ignore
- * `disableReasoning` (e.g. Qwen3 via llama.cpp catalogued `reasoning: false`
- * but still emitting thinking): the yes/no keyword needs to land after any
- * unavoidable thinking preamble. `maxTokens` is a hard cap — non-thinking
- * completions still return in a single word (issue #4355).
+ * Online classifier budget. Sized against two independent constraints:
+ *   - Backends that ignore `disableReasoning` still emit a thinking preamble
+ *     (e.g. Qwen3 via llama.cpp catalogued `reasoning: false` but still thinking;
+ *     Anthropic via LiteLLM/Vertex, whose `openai-completions` route downgrades a
+ *     disabled request to the lowest reasoning effort instead of turning thinking
+ *     off). The yes/no keyword must have room to land after that preamble
+ *     (issue #4355).
+ *   - Anthropic-dialect proxies reject `max_tokens <= thinking.budget_tokens`. The
+ *     pinned lowest effort maps to at least Anthropic's 1024-token minimum budget,
+ *     so the cap MUST comfortably exceed 1024 or the request 400s with
+ *     `max_tokens must be greater than thinking.budget_tokens` (issue #8610).
+ * `maxTokens` is a hard cap — non-thinking completions still return in a single
+ * word.
  */
-const REASONING_SAFE_MAX_TOKENS = 1024;
+const ONLINE_REASONING_SAFE_MAX_TOKENS = 4096;
 
 export interface ClassifyUnexpectedStopDeps {
 	settings: Settings;
@@ -86,21 +94,25 @@ async function classifyOnline(text: string, deps: ClassifyUnexpectedStopDeps): P
 		throw new Error(`unexpected-stop: no API key for ${model.provider}/${model.id}`);
 	}
 	const metadata = deps.metadataResolver?.(model.provider);
-	const maxTokens = REASONING_SAFE_MAX_TOKENS;
+	const maxTokens = ONLINE_REASONING_SAFE_MAX_TOKENS;
 
-	const response = await completeSimple(
-		model,
-		{
-			systemPrompt: [CLASSIFIER_SYSTEM_PROMPT],
-			messages: [{ role: "user", content: text, timestamp: Date.now() }],
-		},
-		{
-			apiKey: deps.registry.resolver(model, deps.sessionId),
-			maxTokens,
-			disableReasoning: true,
-			metadata,
-			signal: deps.signal,
-		},
+	const response = await retryTransientCompletion(
+		() =>
+			completeSimple(
+				model,
+				{
+					systemPrompt: [CLASSIFIER_SYSTEM_PROMPT],
+					messages: [{ role: "user", content: text, timestamp: Date.now() }],
+				},
+				{
+					apiKey: deps.registry.resolver(model, deps.sessionId),
+					maxTokens,
+					disableReasoning: true,
+					metadata,
+					signal: deps.signal,
+				},
+			),
+		{ signal: deps.signal },
 	);
 
 	if (response.stopReason === "error") {

package/src/system-prompt.ts

@@ -27,7 +27,6 @@ import systemPromptTemplate from "./prompts/system/system-prompt.md" with { type
 import { normalizeConcurrencyLimit } from "./task/parallel";
 import { usesCodexTaskPrompt } from "./task/prompt-policy";
 import { type ActiveRepoContext, resolveActiveRepoContext } from "./utils/active-repo-context";
-import { formatLocalCalendarDate } from "./utils/local-date";
 import { normalizePromptPath } from "./utils/prompt-path";
 import { AGENTS_MD_LIMIT, buildWorkspaceTree, type WorkspaceTree } from "./workspace-tree";
 
@@ -784,8 +783,6 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 		}
 	}
 
-	const date = formatLocalCalendarDate();
-	const dateTime = date;
 	const promptCwd = normalizePromptPath(resolvedCwd);
 	const activeRepoContextPrompt = renderActiveRepoContextPrompt(activeRepoContext);
 
@@ -870,8 +867,6 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 		skills: filteredSkills,
 		rules: rules ?? [],
 		alwaysApplyRules: injectedAlwaysApplyRules,
-		date,
-		dateTime,
 		cwd: promptCwd,
 		additionalWorkspaceRoots: additionalWorkspaceRoots.filter(d => path.resolve(d) !== path.resolve(resolvedCwd)),
 		model: includeModelInPrompt ? (model ?? "") : "",

package/src/task/executor.ts

@@ -2803,19 +2803,6 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 	const progress = monitor.progress;
 	let unsubscribe: (() => void) | null = null;
 	let reviveSession: AgentReviver | null = null;
-	// Adopted (kept-alive) subagents flip registry status from session events on
-	// later turns: revive/wake → running, turn drained → idle. The subscription
-	// intentionally survives this run; a disposed session emits nothing, so it
-	// needs no teardown.
-	const installRegistryStatusSync = (target: AgentSession): void => {
-		target.subscribe(event => {
-			if (event.type === "agent_start") {
-				AgentRegistry.global().setStatus(id, "running", target);
-			} else if (event.type === "agent_end") {
-				AgentRegistry.global().setStatus(id, "idle", target);
-			}
-		});
-	};
 	const installIrcWakeTurnMonitor = (target: AgentSession): void => {
 		attachIrcWakeTurnMonitor(target, {
 			id,
@@ -3162,7 +3149,9 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 			sessionCreatedAt = performance.now();
 
 			monitor.setActiveSession(session);
-			installRegistryStatusSync(session);
+			// Run-state notifications precede deferrable wire-level `agent_end`,
+			// so adopted keep-alive lifecycle cannot get stuck during prompt unwind.
+			AgentRegistry.global().syncSessionStatus(id, session);
 			if (sessionFile !== null && worktree === undefined) {
 				// Lifecycle reviver: park closed the JSONL writer, so reopening takes
 				// the single-writer lock cleanly and restores the full message history
@@ -3178,7 +3167,7 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 					const { session: revived } = await createAgentSession(
 						buildSubagentSessionOptions(reopened, expectedAgentRef),
 					);
-					installRegistryStatusSync(revived);
+					AgentRegistry.global().syncSessionStatus(id, revived);
 					installIrcWakeTurnMonitor(revived);
 					return revived;
 				};

package/src/task/persisted-revive.ts

@@ -155,12 +155,9 @@ export function createPersistedSubagentReviverFactory(
 			await session.setActiveToolsByName([...init.tools, ...session.getMountedXdevToolNames()]);
 			// Cold revives must drive registry status themselves — createAgentSession
 			// doesn't wire this generically (the live path does it in the executor).
-			// Without it the idle-TTL timer never clears on a turn and the lifecycle
-			// could park the agent mid-run.
-			session.subscribe(event => {
-				if (event.type === "agent_start") registry.setStatus(ref.id, "running", session);
-				else if (event.type === "agent_end") registry.setStatus(ref.id, "idle", session);
-			});
+			// The internal run-state signal precedes deferrable public `agent_end`,
+			// keeping idle-TTL ownership synchronized even while prompts unwind.
+			registry.syncSessionStatus(ref.id, session);
 			// Persisted files predate an agent-source field, so cold-revived frames
 			// report the runtime-neutral `user` source; name comes from the ref.
 			const wakeAgent: AgentDefinition = {

package/src/tools/ask.ts

@@ -716,7 +716,7 @@ function formatQuestionResult(result: QuestionResult): string {
 			? `${result.id}: [${result.selectedOptions.join(", ")}]${suffix}`
 			: `${result.id}: ${result.selectedOptions[0]}${suffix}`;
 	}
-	return `${result.id}: (cancelled)${noteSuffix}`;
+	return result.multi ? `${result.id}: []${noteSuffix}` : `${result.id}: (cancelled)${noteSuffix}`;
 }
 
 function formatSingleQuestionResponse(result: {
@@ -753,7 +753,8 @@ function formatSingleQuestionResponse(result: {
 				: `User added note: ${result.note}`,
 		);
 	}
-	return responseParts.length > 0 ? responseParts.join("\n") : "User cancelled the selection";
+	if (responseParts.length > 0) return responseParts.join("\n");
+	return result.multi ? "User did not select any options" : "User cancelled the selection";
 }
 
 // =============================================================================
@@ -949,9 +950,15 @@ export class AskTool implements AgentTool<typeof askSchema, AskToolDetails> {
 				}
 				if (params.questions.length === 1) {
 					const result = results[0];
+					// An empty multi-select submission is a valid "select none"
+					// answer (#8265 review); only a truly empty single-select
+					// result counts as cancellation.
 					if (
 						!result ||
-						(!result.timedOut && result.selectedOptions.length === 0 && result.customInput === undefined)
+						(!result.timedOut &&
+							!result.multi &&
+							result.selectedOptions.length === 0 &&
+							result.customInput === undefined)
 					) {
 						context.abort();
 						throw new ToolAbortError("Ask tool was cancelled by the user");

package/src/tools/browser/attach.ts

@@ -1,5 +1,6 @@
 import * as net from "node:net";
 import { Process, ProcessStatus } from "@oh-my-pi/pi-natives";
+import type { Socket } from "bun";
 import type { Browser, Page } from "puppeteer-core";
 import { ToolError, throwIfAborted } from "../tool-errors";
 
@@ -29,31 +30,92 @@ export async function findFreeCdpPort(): Promise<number> {
 	return promise;
 }
 
+/**
+ * Loopback HTTP/1.1 GET that never routes through a proxy, resolving to the
+ * response status code (or null when the endpoint is unreachable, aborted,
+ * malformed, or slow past `timeoutMs`).
+ *
+ * Chrome's DevTools endpoint listens on loopback and speaks plain HTTP/1.1.
+ * Both `fetch` and Bun's `node:http` honor `HTTP_PROXY`/`HTTPS_PROXY` and
+ * forward even `127.0.0.1` requests to the proxy unless `NO_PROXY` covers them,
+ * so a local proxy that 502s internal addresses makes a healthy daemon look
+ * dead and the CDP readiness checks tear it down (issue #8567). Talking to the
+ * socket over raw TCP sidesteps proxy env entirely.
+ */
+export async function probeCdpStatus(
+	url: string,
+	opts: { timeoutMs: number; signal?: AbortSignal },
+): Promise<number | null> {
+	let target: URL;
+	try {
+		target = new URL(url);
+	} catch {
+		return null;
+	}
+	if (opts.signal?.aborted) return null;
+	const port = target.port ? Number(target.port) : 80;
+	const requestPath = `${target.pathname}${target.search}` || "/";
+	const { promise, resolve } = Promise.withResolvers<number | null>();
+	let socket: Socket<undefined> | undefined;
+	let settled = false;
+	const finish = (status: number | null) => {
+		if (settled) return;
+		settled = true;
+		clearTimeout(timer);
+		opts.signal?.removeEventListener("abort", onAbort);
+		try {
+			socket?.end();
+		} catch {
+			// socket already torn down
+		}
+		resolve(status);
+	};
+	const onAbort = () => finish(null);
+	const timer = setTimeout(() => finish(null), opts.timeoutMs);
+	opts.signal?.addEventListener("abort", onAbort, { once: true });
+	let buffered = "";
+	try {
+		socket = await Bun.connect({
+			hostname: target.hostname,
+			port,
+			socket: {
+				open(s) {
+					s.write(`GET ${requestPath} HTTP/1.1\r\nHost: ${target.hostname}:${port}\r\nConnection: close\r\n\r\n`);
+				},
+				data(_s, chunk) {
+					buffered += chunk.toString("latin1");
+					const match = /^HTTP\/\d(?:\.\d)? (\d{3})/.exec(buffered);
+					if (match) finish(Number(match[1]));
+				},
+				error() {
+					finish(null);
+				},
+				close() {
+					finish(null);
+				},
+			},
+		});
+	} catch {
+		finish(null);
+	}
+	return promise;
+}
+
 /** Poll `${cdpUrl}/json/version` until it responds with 200, with abort + timeout support. */
 export async function waitForCdp(cdpUrl: string, timeoutMs: number, signal?: AbortSignal): Promise<void> {
 	const deadline = Date.now() + timeoutMs;
-	let lastErr: unknown;
 	const probeUrl = `${cdpUrl.replace(/\/+$/, "")}/json/version`;
+	let lastStatus: number | null = null;
 	while (Date.now() < deadline) {
 		throwIfAborted(signal);
-		const probeTimeout = AbortSignal.timeout(2000);
-		const probeSignal = signal ? AbortSignal.any([signal, probeTimeout]) : probeTimeout;
-		try {
-			const res = await fetch(probeUrl, { signal: probeSignal });
-			if (res.ok) {
-				await res.body?.cancel();
-				return;
-			}
-			lastErr = new Error(`HTTP ${res.status}`);
-			await res.body?.cancel();
-		} catch (err) {
-			if (signal?.aborted) throwIfAborted(signal);
-			lastErr = err;
-		}
+		const status = await probeCdpStatus(probeUrl, { timeoutMs: 2000, signal });
+		if (status !== null && status >= 200 && status < 300) return;
+		lastStatus = status;
 		await Bun.sleep(150);
 	}
+	throwIfAborted(signal);
 	throw new ToolError(
-		`Timed out waiting for CDP endpoint ${cdpUrl}${lastErr instanceof Error ? `: ${lastErr.message}` : ""}`,
+		`Timed out waiting for CDP endpoint ${cdpUrl}${lastStatus !== null ? `: HTTP ${lastStatus}` : ""}`,
 	);
 }
 
@@ -81,15 +143,8 @@ function findCdpPortInArgs(args: string[]): number | null {
 
 /** One-shot probe: returns true when `/json/version` answers 200 within the timeout. */
 async function probeCdpAt(port: number, signal?: AbortSignal): Promise<boolean> {
-	const probeTimeout = AbortSignal.timeout(1500);
-	const probeSignal = signal ? AbortSignal.any([signal, probeTimeout]) : probeTimeout;
-	try {
-		const res = await fetch(`http://127.0.0.1:${port}/json/version`, { signal: probeSignal });
-		await res.body?.cancel();
-		return res.ok;
-	} catch {
-		return false;
-	}
+	const status = await probeCdpStatus(`http://127.0.0.1:${port}/json/version`, { timeoutMs: 1500, signal });
+	return status !== null && status >= 200 && status < 300;
 }
 
 /**

package/src/tools/browser/launch.ts

@@ -121,23 +121,36 @@ async function loadBrowsers(): Promise<typeof BrowsersNs> {
 }
 
 /**
- * Resolve the Chromium executable puppeteer will launch, honoring
- * PUPPETEER_EXECUTABLE_PATH before system browser detection and lazily
- * downloading Chromium otherwise. The browser is cached under
- * ~/.omp/puppeteer (getPuppeteerDir). Returns undefined when platform
- * detection fails (puppeteer default resolution takes over). Exported so
- * real-browser tests can probe launchability and skip on hosts missing
- * Chrome's system libraries.
+ * Resolve the Chromium executable puppeteer will launch.
+ *
+ * `PUPPETEER_EXECUTABLE_PATH` always wins. On macOS the isolated Chrome for
+ * Testing binary is preferred over a detected system Chrome: a headless
+ * daemon launched from a system `Google Chrome.app` bundle shares its
+ * LaunchServices bundle identity (`com.google.Chrome`), so macOS can deliver
+ * the user's open-URL Apple Events to the daemon and silently swallow their
+ * link clicks (#8673). Chrome for Testing uses a dedicated bundle id
+ * (`com.google.chrome.for.testing`) that is never a user's default handler;
+ * system Chrome is used on macOS only when Chrome for Testing cannot be
+ * obtained. Other platforms keep the download-avoiding system Chrome
+ * preference and fall back to Chrome for Testing. The managed browser is
+ * cached under ~/.omp/puppeteer (getPuppeteerDir). Returns undefined when
+ * platform detection fails (puppeteer default resolution takes over).
+ * Exported so real-browser tests can probe launchability and skip on hosts
+ * missing Chrome's system libraries.
  */
 let chromiumExecutablePromise: Promise<string | undefined> | undefined;
 export async function ensureChromiumExecutable(): Promise<string | undefined> {
 	const envPath = process.env.PUPPETEER_EXECUTABLE_PATH;
 	if (envPath) return envPath;
-	const sysChrome = await resolveSystemChromium();
-	if (sysChrome) return sysChrome;
-	if (chromiumExecutablePromise) return chromiumExecutablePromise;
+	// macOS: never route a background daemon through the user's GUI Chrome
+	// bundle; prefer the isolated Chrome for Testing binary instead (#8673).
+	const preferManagedChromium = process.platform === "darwin";
+	if (!preferManagedChromium) {
+		const sysChrome = await resolveSystemChromium();
+		if (sysChrome) return sysChrome;
+	}
 
-	chromiumExecutablePromise = (async () => {
+	chromiumExecutablePromise ??= (async () => {
 		const browsers = await loadBrowsers();
 		const platform = browsers.detectBrowserPlatform();
 		if (!platform) {
@@ -185,7 +198,23 @@ export async function ensureChromiumExecutable(): Promise<string | undefined> {
 				"Set PUPPETEER_EXECUTABLE_PATH to use an existing Chrome/Chromium binary, or install one manually.",
 		);
 	});
-	return chromiumExecutablePromise;
+
+	try {
+		return await chromiumExecutablePromise;
+	} catch (err) {
+		if (!preferManagedChromium) throw err;
+		// Chrome for Testing could not be obtained on macOS; degrade to the
+		// system Chrome bundle rather than leaving the browser tool unusable.
+		const sysChrome = await resolveSystemChromium();
+		if (!sysChrome) throw err;
+		logger.warn(
+			"Chrome for Testing unavailable; falling back to the system Chrome bundle. On macOS this can let the " +
+				"headless browser daemon capture your link clicks (#8673). Set PUPPETEER_EXECUTABLE_PATH to a " +
+				"dedicated Chromium to avoid this.",
+			{ path: sysChrome, error: (err as Error).message },
+		);
+		return sysChrome;
+	}
 }
 
 let resolvedChromium: string | null | undefined; // undefined = unchecked; null = not found
@@ -430,8 +459,8 @@ export interface SharedBrowserLaunchSpec {
  * Resolve the executable and complete argv for a shared Chromium the daemon
  * broker spawns directly (no puppeteer inside the broker). Mirrors
  * `launchHeadlessBrowser` flag assembly — puppeteer's default args minus the
- * stealth-suppressed set — plus `--remote-debugging-port=0` so every client
- * attaches over CDP. Returns null when no Chromium executable resolves;
+ * stealth-suppressed set — suppresses Puppeteer's unowned startup window, and
+ * exposes CDP on an ephemeral port. Returns null when no executable resolves;
  * callers fall back to a process-local launch.
  */
 export async function resolveSharedBrowserLaunchSpec(opts: {
@@ -451,7 +480,7 @@ export async function resolveSharedBrowserLaunchSpec(opts: {
 	});
 	return {
 		executablePath,
-		args: [...defaults.filter(arg => !ignored.has(arg)), "--remote-debugging-port=0"],
+		args: [...defaults.filter(arg => !ignored.has(arg)), "--no-startup-window", "--remote-debugging-port=0"],
 	};
 }