@steipete/oracle 0.17.3 → 0.18.0

package/dist/bin/oracle-cli.js

@@ -227,7 +227,7 @@ program
     .addOption(new Option("--copy-markdown", "Copy the assembled markdown bundle to the clipboard; pair with --render to print it too.").default(false))
     .addOption(new Option("--copy").hideHelp().default(false))
     .option("-s, --slug <words>", "Custom session slug (3-5 words).")
-    .option("-m, --model <model>", "Model to target (gpt-5.5-pro default). GPT-5.6 aliases gpt-5.6 and gpt-5.6-sol work with the OpenAI API or ChatGPT browser. Browser mode also supports current GPT-5.5/GPT-5.4 targets and legacy Pro aliases; retired GPT-5.2 base/Instant/Thinking aliases are API-only. Other API targets include gpt-5.1-codex, gpt-5.2, gpt-5.2-instant, Gemini, Claude, and custom model IDs.", normalizeModelOption)
+    .option("-m, --model <model>", "Model to target (gpt-5.5-pro default). GPT-5.6 aliases gpt-5.6 and gpt-5.6-sol work with the OpenAI API or ChatGPT browser. In browser mode, generic Pro aliases follow the current GPT-5.6 Sol target; use explicit gpt-5.5-pro to pin GPT-5.5. Retired GPT-5.2 base/Instant/Thinking aliases are API-only. Other API targets include gpt-5.1-codex, gpt-5.2, gpt-5.2-instant, Gemini, Claude, and custom model IDs.", normalizeModelOption)
     .addOption(new Option("--models <models>", 'Comma-separated API model list to query in parallel (e.g., "gpt-5.5-pro,gemini-3-pro").')
     .argParser(collectModelList)
     .default([]))
@@ -331,6 +331,7 @@ program
     .addOption(new Option("--browser-cookie-names <names>", "Comma-separated cookie allowlist for sync.").hideHelp())
     .addOption(new Option("--browser-inline-cookies <jsonOrBase64>", "Inline cookies payload (JSON array or base64-encoded JSON).").hideHelp())
     .addOption(new Option("--browser-inline-cookies-file <path>", "Load inline cookies from file (JSON or base64 JSON).").hideHelp())
+    .addOption(new Option("--browser-cookie-sync", "Copy cookies from live Chrome (opt-in; token rotation may invalidate that session)."))
     .addOption(new Option("--browser-no-cookie-sync", "Skip copying cookies from Chrome.").hideHelp())
     .addOption(new Option("--browser-manual-login", "Skip cookie copy; reuse a persistent automation profile and wait for manual ChatGPT login.").hideHelp())
     .addOption(new Option("--browser-manual-login-profile-dir <path>", "Persistent Chrome profile directory for manual-login browser runs.").hideHelp())
@@ -393,6 +394,7 @@ program
     .option("--token <value>", "Access token clients must provide (random if omitted).")
     .option("--manual-login", "Use a dedicated Chrome profile for manual login (recommended when cookie sync is unavailable).", false)
     .option("--manual-login-profile-dir <path>", "Chrome profile directory for manual login (default ~/.oracle/browser-profile).")
+    .option("--browser-cookie-sync", "Copy cookies from this host's live Chrome profile instead of using the dedicated profile.", false)
     .action(async (commandOptions) => {
     const { serveRemote } = await import("../src/remote/server.js");
     await serveRemote({
@@ -401,6 +403,7 @@ program
         token: commandOptions.token,
         manualLoginDefault: commandOptions.manualLogin,
         manualLoginProfileDir: commandOptions.manualLoginProfileDir,
+        cookieSyncDefault: commandOptions.browserCookieSync,
     });
 });
 const projectSourcesCommand = program
@@ -422,6 +425,7 @@ function addProjectSourcesCommonOptions(command) {
         .option("--browser-cookie-path <path>", "Explicit Chrome cookie DB path.")
         .option("--browser-inline-cookies <json>", "Inline ChatGPT cookies JSON.")
         .option("--browser-inline-cookies-file <path>", "File containing ChatGPT cookies JSON.")
+        .option("--browser-cookie-sync", "Copy cookies from live Chrome (opt-in; token rotation may invalidate that session).")
         .option("--browser-no-cookie-sync", "Skip copying cookies from Chrome.")
         .option("--browser-keep-browser", "Keep Chrome running after completion.", false)
         .option("--browser-hide-window", "Hide Chrome window after launch on macOS.", false)
@@ -1334,6 +1338,7 @@ async function runRootCommand(options) {
             ...options,
             remoteHost: remoteHost ?? undefined,
             model: activeModel,
+            browserRequestedModel: cliModelArg,
             browserModelLabel: resolveBrowserModelLabel(cliModelArg, activeModel),
         });
         return resolvedOptions.browserResumeConversationUrl
@@ -1981,6 +1986,10 @@ function printDebugHelp(cliName) {
             "--browser-cookie-wait <ms|s|m>",
             "Wait before retrying cookie sync when Chrome cookies are empty or locked.",
         ],
+        [
+            "--browser-cookie-sync",
+            "Copy cookies from live Chrome (opt-in; token rotation may invalidate that session).",
+        ],
         ["--browser-no-cookie-sync", "Skip copying cookies from your main profile."],
         [
             "--browser-manual-login",

package/dist/src/browser/actions/thinkingTime.js

@@ -1,6 +1,35 @@
 import { MENU_CONTAINER_SELECTOR, MENU_ITEM_SELECTOR, MODEL_BUTTON_SELECTOR, } from "../constants.js";
 import { logDomFailure } from "../domDebug.js";
 import { buildClickDispatcher } from "./domEvents.js";
+import { BrowserAutomationError } from "../../oracle/errors.js";
+export class ThinkingTierUnavailableError extends BrowserAutomationError {
+    requestedLevel;
+    requestedLabel;
+    optionLabel;
+    notice;
+    confirmedTarget;
+    constructor(requestedLevel, requestedLabel, optionLabel, notice, confirmedTarget) {
+        const message = `Thinking time: ${optionLabel ?? requestedLabel} is unavailable on this account (${notice ?? "no reason given"}); refusing to submit without confirmed ${confirmedTarget}.`;
+        super(message, {
+            stage: "thinking-tier-unavailable",
+            requestedLevel,
+            requestedLabel,
+            optionLabel,
+            notice,
+            confirmedTarget,
+        });
+        this.name = "ThinkingTierUnavailableError";
+        this.requestedLevel = requestedLevel;
+        this.requestedLabel = requestedLabel;
+        this.optionLabel = optionLabel;
+        this.notice = notice;
+        this.confirmedTarget = confirmedTarget;
+    }
+}
+function confirmedThinkingTarget(level, capitalizedLevel, targetModelKind, observedModelKind) {
+    const strictModelKind = targetModelKind ?? observedModelKind;
+    return level === "pro" ? "Pro" : strictModelKind === "pro" ? "Pro Extended" : capitalizedLevel;
+}
 const BROWSER_THINKING_LOG_PREFIX = "[browser] Thinking time:";
 function formatBrowserThinkingLog(message) {
     return `${BROWSER_THINKING_LOG_PREFIX} ${message.replace(/^Thinking time:\s*/, "")}`;
@@ -43,6 +72,18 @@ export async function ensureThinkingTime(Runtime, level, logger, desiredModel) {
         case "switched":
             logger(formatBrowserThinkingLog(result.label ?? capitalizedLevel));
             return;
+        case "option-disabled": {
+            await logDomFailure(Runtime, logger, "thinking-option-disabled");
+            logPickerDiagnostic(result, logger);
+            if (strictProEffort) {
+                throw new ThinkingTierUnavailableError(level, capitalizedLevel, result.label ?? null, result.notice ?? null, confirmedThinkingTarget(level, capitalizedLevel, targetModelKind, observedModelKind));
+            }
+            // A non-strict caller goes on to submit, so this log must not borrow the
+            // strict error's "refusing to submit" wording: the request really is sent,
+            // at whatever effort ChatGPT already had selected.
+            logger(formatBrowserThinkingLog(`${result.label ?? capitalizedLevel} is unavailable on this account (${result.notice ?? "no reason given"}); keeping the effort already selected in ChatGPT.`));
+            return;
+        }
         case "chip-not-found":
         case "menu-not-found":
         case "option-not-found":
@@ -97,6 +138,9 @@ export async function ensureThinkingTimeIfAvailable(Runtime, level, logger, desi
             case "switched":
                 logger(formatBrowserThinkingLog(result.label ?? capitalizedLevel));
                 return true;
+            case "option-disabled":
+                logger(formatBrowserThinkingLog(`${result.label ?? capitalizedLevel} is unavailable on this account (${result.notice ?? "no reason given"}); keeping the effort already selected in ChatGPT.`));
+                return false;
             case "chip-not-found":
             case "menu-not-found":
             case "option-not-found":
@@ -292,6 +336,21 @@ function buildThinkingTimeExpression(level, desiredModel) {
         .replace(/\\s+/g, ' ')
         .trim()
         .slice(0, maxLength);
+    const isOptionDisabled = (node) => {
+      if (!node || typeof node.getAttribute !== 'function') return false;
+      // data-disabled is Radix's valueless-presence convention, but an explicit
+      // "false" must not read as disabled: that would refuse a perfectly usable
+      // tier and report it as unavailable.
+      const dataDisabled = node.getAttribute('data-disabled');
+      const dataDisabledOn = dataDisabled !== null && String(dataDisabled).toLowerCase() !== 'false';
+      return (
+        node.getAttribute('aria-disabled') === 'true' ||
+        dataDisabledOn ||
+        (node.getAttribute('data-state') || '').toLowerCase() === 'disabled' ||
+        Boolean(node.disabled) ||
+        node.getAttribute('disabled') !== null
+      );
+    };
     const describeNode = (el) => {
       if (!el || typeof el.getAttribute !== 'function') return null;
       let rect = null;
@@ -314,7 +373,10 @@ function buildThinkingTimeExpression(level, desiredModel) {
         ariaChecked: el.getAttribute('aria-checked'),
         ariaSelected: el.getAttribute('aria-selected'),
         ariaHaspopup: el.getAttribute('aria-haspopup'),
+        ariaDisabled: el.getAttribute('aria-disabled'),
+        dataDisabled: el.getAttribute('data-disabled'),
         dataState: el.getAttribute('data-state'),
+        disabled: isOptionDisabled(el),
         text: redactDiagnosticText(el.textContent, 80),
         rect,
       };
@@ -590,6 +652,77 @@ function buildThinkingTimeExpression(level, desiredModel) {
       }
       return matchesLevel(normalizedLabel);
     };
+    const nonEmptyNotice = (value) => {
+      const text = redactDiagnosticText(value, 160);
+      return text || null;
+    };
+    // The notice must be ROW-OWNED, and preferably this hover's own.
+    //
+    // NOTE: no backticks in this comment — it lives inside the injected template
+    // literal, where a backtick would terminate the string.
+    //
+    // A document-wide role=tooltip scan is what this must never become: novelty is
+    // not causality, and an unrelated control with an armed open-delay can mount its
+    // tooltip inside this hover's window. Every pass below is anchored on the row.
+    //
+    // Preference order, strongest provenance first:
+    //   1. an id this hover ADDED whose target is role=tooltip — Radix keeps an
+    //      application-supplied description and APPENDS its tooltip id when opening,
+    //      so the delta is what separates the real notice from a permanent blurb;
+    //   2. any other id this hover added;
+    //   3. an already-associated role=tooltip target, for a tooltip that was open
+    //      before the probe arrived;
+    //   4. the row's static title, only once the poll has expired.
+    //
+    // Passes 3 and 4 are row-owned but NOT causal: a page that permanently points a
+    // disabled row at generic role=tooltip help, or gives it a generic title, will
+    // have that text reported. That is accepted deliberately — the value is an opaque
+    // notice for a human or a caller to interpret, not a parsed reset time — and the
+    // verified live target has neither at rest.
+    const describedIds = (option) =>
+      (option?.getAttribute?.('aria-describedby') || '').split(/\\s+/).filter(Boolean);
+    const isTooltipNode = (node) => node?.getAttribute?.('role') === 'tooltip';
+    const readDisabledNotice = (option, priorIds, allowTitle) => {
+      const ids = describedIds(option);
+      const prior = priorIds instanceof Set ? priorIds : new Set();
+      const fresh = ids.filter((id) => !prior.has(id));
+      for (const pass of [
+        fresh.filter((id) => isTooltipNode(document.getElementById?.(id))),
+        fresh,
+        ids.filter((id) => isTooltipNode(document.getElementById?.(id))),
+      ]) {
+        for (const id of pass) {
+          const notice = nonEmptyNotice(document.getElementById?.(id)?.textContent);
+          if (notice) return notice;
+        }
+      }
+      if (!allowTitle) return null;
+      return nonEmptyNotice(option?.getAttribute?.('title'));
+    };
+    const waitForDisabledNotice = async (option, priorIds) => {
+      const deadline = performance.now() + 400;
+      while (performance.now() < deadline) {
+        const notice = readDisabledNotice(option, priorIds, false);
+        if (notice) return notice;
+        await sleep(50);
+      }
+      // Only now may a static title speak: the association had its full window.
+      return readDisabledNotice(option, priorIds, true);
+    };
+    // Opening a tooltip stacks another Radix dismissable layer over the menu, and
+    // the topmost layer eats the Escape. One blind Escape therefore leaves the
+    // effort menu open, which matters for the non-strict caller that goes on to
+    // submit. Dismiss, let the layer unmount, and only Escape again while a menu is
+    // still there — never two unconditional Escapes, which could close an unrelated
+    // outer surface.
+    const closeMenusAfterTooltip = async () => {
+      closeOpenMenus();
+      for (let attempt = 0; attempt < 3; attempt += 1) {
+        await sleep(50);
+        if (!Array.from(document.querySelectorAll(MENU_CONTAINER_SELECTOR)).some(isVisible)) return;
+        closeOpenMenus();
+      }
+    };
     const selectAndVerify = async (trigger, findOption, modelKindOverride = null) => {
       const triggerModelKind =
         modelKindOverride ||
@@ -615,6 +748,22 @@ function buildThinkingTimeExpression(level, desiredModel) {
       }
       if (!option) return failure('option-not-found', { modelKind: triggerModelKind });
       const label = option.textContent?.trim?.() || null;
+      if (isOptionDisabled(option)) {
+        // Captured BEFORE the hover: the ids already here describe the row for other
+        // reasons and cannot be this hover's reason.
+        const priorIds = new Set(describedIds(option));
+        dispatchHoverSequence(option);
+        const notice = await waitForDisabledNotice(option, priorIds);
+        const result = failure('option-disabled', {
+          // The label is page text that reaches logs and diagnostics, so it is
+          // redacted like every other reported string.
+          label: redactDiagnosticText(option.textContent, 80) || null,
+          notice,
+          modelKind: triggerModelKind,
+        });
+        await closeMenusAfterTooltip();
+        return result;
+      }
       if (optionIsSelected(option)) {
         closeOpenMenus();
         return { status: 'already-selected', label };

package/dist/src/browser/config.js

@@ -35,7 +35,7 @@ export const DEFAULT_BROWSER_CONFIG = {
     autoReattachDelayMs: 0,
     autoReattachIntervalMs: 0,
     autoReattachTimeoutMs: 120_000,
-    cookieSync: true,
+    cookieSync: false,
     cookieNames: DEFAULT_CHATGPT_COOKIE_NAMES,
     cookieSyncWaitMs: 0,
     inlineCookies: null,
@@ -70,7 +70,6 @@ export function resolveBrowserConfig(config) {
         DEFAULT_MODEL_STRATEGY;
     const isWindows = process.platform === "win32";
     const manualLogin = config?.manualLogin ?? (isWindows ? true : DEFAULT_BROWSER_CONFIG.manualLogin);
-    const cookieSyncDefault = isWindows ? false : DEFAULT_BROWSER_CONFIG.cookieSync;
     const resolvedProfileDir = resolveManualLoginProfileDir(config?.manualLoginProfileDir, process.env.ORACLE_BROWSER_PROFILE_DIR);
     const researchMode = normalizeResearchMode(config?.researchMode);
     const archiveConversations = normalizeArchiveMode(config?.archiveConversations);
@@ -92,7 +91,7 @@ export function resolveBrowserConfig(config) {
         autoReattachDelayMs: config?.autoReattachDelayMs ?? DEFAULT_BROWSER_CONFIG.autoReattachDelayMs,
         autoReattachIntervalMs: config?.autoReattachIntervalMs ?? DEFAULT_BROWSER_CONFIG.autoReattachIntervalMs,
         autoReattachTimeoutMs: config?.autoReattachTimeoutMs ?? DEFAULT_BROWSER_CONFIG.autoReattachTimeoutMs,
-        cookieSync: config?.cookieSync ?? cookieSyncDefault,
+        cookieSync: config?.cookieSync ?? DEFAULT_BROWSER_CONFIG.cookieSync,
         cookieNames: config?.cookieNames ?? DEFAULT_BROWSER_CONFIG.cookieNames,
         cookieSyncWaitMs: config?.cookieSyncWaitMs ?? DEFAULT_BROWSER_CONFIG.cookieSyncWaitMs,
         inlineCookies: config?.inlineCookies ?? DEFAULT_BROWSER_CONFIG.inlineCookies,

package/dist/src/browser/index.js

@@ -32,7 +32,7 @@ import { captureBrowserDiagnostics } from "./domDebug.js";
 import { archiveChatGptConversation, resolveBrowserArchiveDecision, } from "./actions/archiveConversation.js";
 import { assertManualLoginProfileReadyForRun, defaultManualLoginProfileDir, formatManualLoginSetupCommand, isManualLoginProfileInitialized, resolveManualLoginWaitMs, } from "./manualLoginProfile.js";
 import { describeBrowserControlPlan, formatBrowserControlPlan } from "./controlPlan.js";
-import { shouldSyncBrowserCookies } from "./policies.js";
+import { CHROME_COOKIE_SYNC_WARNING, shouldSyncBrowserCookies } from "./policies.js";
 import { createConversationUrlMonitor, } from "./conversationUrlMonitor.js";
 import { extractStableConversationIdFromUrl as extractConversationIdFromUrl, isStableConversationUrl as isConversationUrl, } from "./conversationUrl.js";
 export { CHATGPT_URL, DEFAULT_MODEL_STRATEGY, DEFAULT_MODEL_TARGET } from "./constants.js";
@@ -874,6 +874,7 @@ export async function runBrowserMode(options) {
                 logger("Manual login mode: seeding persistent profile with cookies from your Chrome profile.");
             }
             if (!config.inlineCookies) {
+                logger(CHROME_COOKIE_SYNC_WARNING);
                 logger("Heads-up: macOS may prompt for your Keychain password to read Chrome cookies; use --copy or --render for manual flow.");
             }
             else {
@@ -902,7 +903,7 @@ export async function runBrowserMode(options) {
         else {
             logger(manualLogin
                 ? "Skipping Chrome cookie sync (--browser-manual-login enabled); reuse the opened profile after signing in."
-                : "Skipping Chrome cookie sync (--browser-no-cookie-sync)");
+                : "Skipping Chrome cookie copy (disabled by default; use --browser-cookie-sync to opt in).");
         }
         await clearStaleChatGptConversationCookies(Network, Target, logger, {
             preserveConversationIds: [

package/dist/src/browser/policies.js

@@ -24,6 +24,7 @@ export function buildAttachmentPlan(sections, { inlineFiles, bundleRequested, ma
         shouldBundle,
     };
 }
+export const CHROME_COOKIE_SYNC_WARNING = "Warning: copying cookies from a live Chrome profile can invalidate that browser's ChatGPT session when tokens rotate. Prefer --browser-manual-login or inline cookies when possible.";
 export function shouldSyncBrowserCookies(config, { manualLogin, profileIsPreSigned = manualLogin, }) {
     const explicitManualLoginSync = manualLogin && config.manualLoginCookieSync === true;
     return config.cookieSync && (!profileIsPreSigned || explicitManualLoginSync);
@@ -36,8 +37,11 @@ export function buildCookiePlan(config) {
             description: `Cookies: inline payload (${config.inlineCookies.length}) via ${source}.`,
         };
     }
-    if (config?.cookieSync === false) {
-        return { type: "disabled", description: "Cookies: sync disabled (--browser-no-cookie-sync)." };
+    if (config?.cookieSync !== true) {
+        return {
+            type: "disabled",
+            description: "Cookies: Chrome copy disabled (use --browser-manual-login, inline cookies, or --browser-cookie-sync).",
+        };
     }
     const allowlist = config?.cookieNames && config.cookieNames.length > 0
         ? config.cookieNames.join(", ")

package/dist/src/browser/projectSourcesRunner.js

@@ -13,7 +13,7 @@ import { assertManualLoginProfileReadyForRun, defaultManualLoginProfileDir, form
 import { openProjectSourcesTab, uploadProjectSources, waitForProjectSourcesReady, waitForProjectSourcesListSettled, } from "./actions/projectSources.js";
 import { normalizeProjectSourcesUrl } from "../projectSources/url.js";
 import { buildProjectSourcesUploadPlan, diffAddedProjectSources } from "../projectSources/plan.js";
-import { shouldSyncBrowserCookies } from "./policies.js";
+import { CHROME_COOKIE_SYNC_WARNING, shouldSyncBrowserCookies } from "./policies.js";
 export async function runBrowserProjectSources(request) {
     const startedAt = Date.now();
     const logger = ((message) => request.log?.(message));
@@ -253,9 +253,12 @@ async function applyProjectSourcesCookies({ config, network, manualLogin, logger
     if (!cookieSyncEnabled) {
         logger(manualLogin
             ? "Skipping Chrome cookie sync (--browser-manual-login enabled); reuse the opened profile after signing in."
-            : "Skipping Chrome cookie sync (--browser-no-cookie-sync)");
+            : "Skipping Chrome cookie copy (disabled by default; use --browser-cookie-sync to opt in).");
         return 0;
     }
+    if (!config.inlineCookies) {
+        logger(CHROME_COOKIE_SYNC_WARNING);
+    }
     const cookieCount = await syncCookies(network, config.url, config.chromeProfile, logger, {
         allowErrors: config.allowCookieErrors ?? false,
         filterNames: config.cookieNames ?? undefined,

package/dist/src/browser/reattach.js

@@ -12,7 +12,7 @@ import { cleanupStaleProfileState } from "./profileState.js";
 import { readDevToolsActivePortInfo } from "./detect.js";
 import { pickTarget, extractConversationIdFromUrl, buildConversationUrl, withTimeout, openConversationFromSidebar, openConversationFromSidebarWithRetry, waitForLocationChange, readConversationTurnIndex, buildPromptEchoMatcher, recoverPromptEcho, alignPromptEchoMarkdown, } from "./reattachHelpers.js";
 import { waitForDeepResearchCompletion } from "./actions/deepResearch.js";
-import { shouldSyncBrowserCookies } from "./policies.js";
+import { CHROME_COOKIE_SYNC_WARNING, shouldSyncBrowserCookies } from "./policies.js";
 export async function resumeBrowserSession(runtime, config, logger, deps = {}) {
     const recoverSession = deps.recoverSession ??
         (async (runtimeMeta, configMeta) => resumeBrowserSessionViaNewChrome(runtimeMeta, configMeta, logger, deps));
@@ -220,6 +220,9 @@ async function resumeBrowserSessionViaNewChrome(runtime, config, logger, deps) {
     }
     let appliedCookies = 0;
     if (shouldSyncBrowserCookies(resolved, { manualLogin })) {
+        if (!resolved.inlineCookies) {
+            logger(CHROME_COOKIE_SYNC_WARNING);
+        }
         const sync = deps.syncCookies ?? syncCookies;
         try {
             appliedCookies = await sync(Network, resolved.url, resolved.chromeProfile, logger, {

package/dist/src/cli/browserConfig.js

@@ -13,6 +13,12 @@ const DEFAULT_BROWSER_ATTACHMENT_TIMEOUT_MS = 45_000;
 const DEFAULT_BROWSER_RECHECK_TIMEOUT_MS = 120_000;
 const DEFAULT_BROWSER_AUTO_REATTACH_TIMEOUT_MS = 120_000;
 const DEFAULT_CHROME_PROFILE = "Default";
+const CURRENT_CHATGPT_PRO_ALIASES = new Set([
+    "gpt-5-pro",
+    "gpt-5.1-pro",
+    "gpt-5.2-pro",
+    "gpt-5.4-pro",
+]);
 // Ordered array: most specific models first to ensure correct selection.
 // The browser label is passed to the model picker which fuzzy-matches against ChatGPT's UI.
 const BROWSER_MODEL_LABELS = [
@@ -52,11 +58,8 @@ export function normalizeChatGptModelForBrowser(model) {
         return normalized;
     }
     // Pro variants: resolve to the latest Pro model in ChatGPT.
-    if (normalized === "gpt-5-pro" ||
-        normalized === "gpt-5.1-pro" ||
-        normalized === "gpt-5.2-pro" ||
-        normalized === "gpt-5.4-pro") {
-        return "gpt-5.5-pro";
+    if (isCurrentChatGptProAlias(normalized)) {
+        return "gpt-5.6-sol";
     }
     // Explicit model variants: keep as-is (they have their own browser labels)
     if (normalized === "gpt-5.2-thinking" || normalized === "gpt-5.2-instant") {
@@ -68,6 +71,18 @@ export function normalizeChatGptModelForBrowser(model) {
     }
     return model;
 }
+export function isCurrentChatGptProAlias(model) {
+    return CURRENT_CHATGPT_PRO_ALIASES.has(model?.trim().toLowerCase() ?? "");
+}
+export function resolveDefaultBrowserThinkingTime({ model, requestedModel, modelStrategy, }) {
+    const strategy = normalizeBrowserModelStrategy(modelStrategy) ?? DEFAULT_MODEL_STRATEGY;
+    if (strategy !== "select")
+        return undefined;
+    const normalizedModel = normalizeChatGptModelForBrowser(model);
+    return isCurrentChatGptProAlias(requestedModel ?? model) || normalizedModel === "gpt-5.5-pro"
+        ? "pro"
+        : undefined;
+}
 export async function buildBrowserConfig(options) {
     if (options.copyProfile && options.browserKeepBrowser) {
         throw new Error("--copy-profile cannot be combined with --browser-keep-browser: the copied profile is a throwaway that is deleted after the run, so it must not be retained.");
@@ -85,11 +100,14 @@ export async function buildBrowserConfig(options) {
     const normalizedOverride = desiredModelOverride?.toLowerCase() ?? "";
     const baseModel = options.model.toLowerCase();
     const isChatGptModel = baseModel.startsWith("gpt-") && !baseModel.includes("codex");
-    const normalizedBrowserModel = normalizeChatGptModelForBrowser(options.model);
     const shouldUseOverride = !isChatGptModel && normalizedOverride.length > 0 && normalizedOverride !== baseModel;
     const modelStrategy = normalizeBrowserModelStrategy(options.browserModelStrategy) ?? DEFAULT_MODEL_STRATEGY;
     const thinkingTime = normalizeThinkingTimeLevel(options.browserThinkingTime) ??
-        (modelStrategy === "select" && normalizedBrowserModel === "gpt-5.5-pro" ? "pro" : undefined);
+        resolveDefaultBrowserThinkingTime({
+            model: options.model,
+            requestedModel: options.browserRequestedModel,
+            modelStrategy,
+        });
     assertBrowserModelAvailable(options.model, modelStrategy);
     const cookieNames = parseCookieNames(options.browserCookieNames ?? process.env.ORACLE_BROWSER_COOKIE_NAMES);
     let inline = await resolveInlineCookies({
@@ -99,7 +117,9 @@ export async function buildBrowserConfig(options) {
         envFile: process.env.ORACLE_BROWSER_COOKIES_FILE,
         cwd: process.cwd(),
     });
-    if (inline?.source?.startsWith("home:") && options.browserNoCookieSync !== true) {
+    const chromeCookieSyncRequested = options.browserNoCookieSync !== true &&
+        (options.browserCookieSync === true || options.browserManualLoginCookieSync === true);
+    if (inline?.source?.startsWith("home:") && chromeCookieSyncRequested) {
         inline = undefined;
     }
     let remoteChrome;
@@ -161,11 +181,13 @@ export async function buildBrowserConfig(options) {
         cookieSyncWaitMs: options.browserCookieWait
             ? parseBrowserDuration(options.browserCookieWait, "--browser-cookie-wait", 0)
             : undefined,
-        cookieSync: options.browserNoCookieSync
-            ? false
-            : options.browserManualLoginCookieSync === true
-                ? true
-                : undefined,
+        cookieSync: inline?.cookies?.length
+            ? true
+            : options.browserNoCookieSync
+                ? false
+                : options.browserCookieSync === true || options.browserManualLoginCookieSync === true
+                    ? true
+                    : undefined,
         cookieNames,
         inlineCookies: inline?.cookies,
         inlineCookiesSource: inline?.source ?? null,
@@ -173,7 +195,7 @@ export async function buildBrowserConfig(options) {
         keepBrowser: options.browserKeepBrowser ? true : undefined,
         manualLogin: options.browserManualLogin === undefined ? undefined : options.browserManualLogin,
         manualLoginProfileDir: options.browserManualLoginProfileDir ?? undefined,
-        manualLoginCookieSync: options.browserManualLoginCookieSync,
+        manualLoginCookieSync: inline?.cookies?.length ? true : options.browserManualLoginCookieSync,
         copyProfileSource: options.copyProfile ?? undefined,
         hideWindow: options.browserHideWindow ? true : undefined,
         desiredModel,
@@ -206,6 +228,7 @@ function validateAttachRunningOptions(options, { attachRunning, hasInlineCookies
     const conflicts = [
         options.browserChromeProfile ? "--browser-chrome-profile" : null,
         options.browserCookiePath ? "--browser-cookie-path" : null,
+        options.browserCookieSync ? "--browser-cookie-sync" : null,
         options.browserNoCookieSync ? "--browser-no-cookie-sync" : null,
         options.browserHeadless ? "--browser-headless" : null,
         options.browserHideWindow ? "--browser-hide-window" : null,

package/dist/src/cli/browserDefaults.js

@@ -76,6 +76,9 @@ export function applyBrowserDefaultsFromConfig(options, config, getSource) {
     if (isUnset("browserCookieWait") && typeof browser.cookieSyncWaitMs === "number") {
         options.browserCookieWait = String(browser.cookieSyncWaitMs);
     }
+    if (!attachRunningRequested && isUnset("browserCookieSync") && browser.cookieSync !== undefined) {
+        options.browserCookieSync = browser.cookieSync;
+    }
     if (!attachRunningRequested && isUnset("browserHeadless") && browser.headless !== undefined) {
         options.browserHeadless = browser.headless;
     }

package/dist/src/cli/dryRun.js

@@ -110,6 +110,7 @@ export async function runBrowserPreview({ runOptions, cwd, version, previewMode,
     log(chalk.cyan(headerLine));
     logBrowserControlPlan(browserConfig, log, "preview");
     logBrowserFollowUpSummary(runOptions.browserFollowUps, log, "preview");
+    logBrowserCookieStrategy(browserConfig, log, "preview");
     logBrowserFileSummary(artifacts, log, "preview");
     if (previewMode === "json" || previewMode === "full") {
         const attachmentSummary = artifacts.attachments.map((attachment) => ({

package/dist/src/cli/projectSources.js

@@ -74,9 +74,11 @@ export async function buildProjectSourcesBrowserConfig({ options, projectUrl, co
     const manualLoginCookieSync = flagConfig.manualLoginCookieSync ?? configuredBrowser.manualLoginCookieSync;
     const cookieSync = flagConfig.cookieSync === false
         ? false
-        : manualLogin
-            ? manualLoginCookieSync === true
-            : configuredBrowser.cookieSync;
+        : flagConfig.cookieSync === true
+            ? true
+            : manualLogin
+                ? manualLoginCookieSync === true
+                : configuredBrowser.cookieSync === true;
     return {
         ...configuredBrowser,
         ...flagConfig,

package/dist/src/mcp/tools/consult.js

@@ -24,7 +24,7 @@ import { CONSULT_PRESETS, browserThinkingTimeRawSchema, consultInputSchema } fro
 import { applyConsultPreset } from "../consultPresets.js";
 import { loadUserConfig } from "../../config.js";
 import { resolveNotificationSettings } from "../../cli/notifier.js";
-import { mapModelToBrowserLabel, resolveBrowserModelLabel } from "../../cli/browserConfig.js";
+import { mapModelToBrowserLabel, resolveBrowserModelLabel, resolveDefaultBrowserThinkingTime, } from "../../cli/browserConfig.js";
 import { normalizeThinkingTimeLevel } from "../../oracle/thinkingTime.js";
 // Use raw shapes so the MCP SDK (with its bundled Zod) wraps them and emits valid JSON Schema.
 const consultInputShape = {
@@ -267,11 +267,14 @@ export function buildConsultBrowserConfig({ userConfig, env, runModel, inputMode
         ? true
         : (configuredBrowser.manualLogin ?? process.platform === "win32");
     const configuredThinkingTime = normalizeThinkingTimeLevel(configuredBrowser.thinkingTime);
+    const modelStrategy = browserModelStrategy ?? configuredBrowser.modelStrategy;
     return {
         ...configuredBrowser,
         url: configuredUrl,
         chatgptUrl: configuredUrl,
-        cookieSync: !manualLogin || configuredBrowser.manualLoginCookieSync === true,
+        cookieSync: manualLogin
+            ? configuredBrowser.manualLoginCookieSync === true
+            : configuredBrowser.cookieSync === true,
         headless: configuredBrowser.headless ?? false,
         hideWindow: configuredBrowser.hideWindow ?? false,
         keepBrowser: browserKeepBrowser ?? configuredBrowser.keepBrowser ?? false,
@@ -279,8 +282,14 @@ export function buildConsultBrowserConfig({ userConfig, env, runModel, inputMode
         manualLoginProfileDir: manualLogin
             ? ((envProfileDir || configuredBrowser.manualLoginProfileDir) ?? null)
             : null,
-        thinkingTime: browserThinkingTime ?? configuredThinkingTime ?? undefined,
-        modelStrategy: browserModelStrategy ?? configuredBrowser.modelStrategy,
+        thinkingTime: browserThinkingTime ??
+            configuredThinkingTime ??
+            resolveDefaultBrowserThinkingTime({
+                model: runModel,
+                requestedModel: inputModel,
+                modelStrategy,
+            }),
+        modelStrategy,
         researchMode: browserResearchMode ?? configuredBrowser.researchMode,
         archiveConversations: browserArchive ?? configuredBrowser.archiveConversations,
         desiredModel: desiredModelLabel || mapModelToBrowserLabel(runModel),

package/dist/src/remote/server.js

@@ -192,14 +192,15 @@ export async function createRemoteServer(options = {}, deps = {}) {
             // Preserve an explicit request to leave the completed conversation tab
             // open before the service forces `keepBrowser` for process lifetime.
             const clientRequestedKeepBrowser = payload.browserConfig?.keepBrowser === true;
-            // Remote runs always rely on the host's own Chrome profile; ignore any inline cookie transfer.
+            // Remote runs rely on the host's authentication policy; never accept cookie payloads from clients.
             if (payload.browserConfig) {
                 payload.browserConfig.inlineCookies = null;
                 payload.browserConfig.inlineCookiesSource = null;
-                payload.browserConfig.cookieSync = true;
+                payload.browserConfig.cookieSync = options.cookieSyncDefault === true;
             }
             else {
                 payload.browserConfig = {};
+                payload.browserConfig.cookieSync = options.cookieSyncDefault === true;
             }
             // Enforce manual-login profile when cookie sync is unavailable (e.g., Windows/WSL).
             if (options.manualLoginDefault) {
@@ -293,7 +294,10 @@ export async function createRemoteServer(options = {}, deps = {}) {
 }
 export async function serveRemote(options = {}) {
     const manualProfileDir = options.manualLoginProfileDir ?? path.join(os.homedir(), ".oracle", "browser-profile");
-    const preferManualLogin = options.manualLoginDefault || process.platform === "win32" || isWsl();
+    const preferManualLogin = options.manualLoginDefault ||
+        options.cookieSyncDefault !== true ||
+        process.platform === "win32" ||
+        isWsl();
     let cookies = null;
     let opened = false;
     if (isWsl() && process.env.ORACLE_ALLOW_WSL_SERVE !== "1") {
@@ -303,6 +307,7 @@ export async function serveRemote(options = {}) {
         return;
     }
     if (!preferManualLogin) {
+        console.log("Warning: Chrome cookie copying can invalidate an active ChatGPT session when tokens rotate. Prefer the default dedicated manual-login profile when possible.");
         // Warm-up: ensure this host has a ChatGPT login before accepting runs.
         const result = await loadLocalChatgptCookies(console.log, CHATGPT_URL);
         cookies = result.cookies;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steipete/oracle",
-  "version": "0.17.3",
+  "version": "0.18.0",
   "description": "CLI wrapper around OpenAI Responses API with GPT-5.6 Sol, GPT-5.6, GPT-5.5 Pro, GPT-5.5, GPT-5.4, GPT-5.2, GPT-5.1, and GPT-5.1 Codex high reasoning modes.",
   "keywords": [],
   "homepage": "https://askoracle.sh",