Repository navigation
fix(browser): stop host-wide preview failures and recover CDP sessions - #70
Merged
Merged
Conversation
…ser host The broker disconnected the automation host on any unanswered request, failing every pending call from every thread and leaving agents with "no automation host" until it re-registered. The 500ms status read sent after each action could trigger it on any busy page. - Wait timeoutMs plus a 1s grace (upstream pingdotgg#17693) so the host's own timeout reply wins the race. - Never evict on background status reads (updateCurrentTab: false). - Evict only when the host went silent since the request was delivered; a host answering other calls keeps its connection. - Forward a sanitized failure reason from the web host so PreviewAutomationExecutionError says why it failed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ording warmup - Reattach a tab's CDP session when Chromium drops the debugger on its own, instead of failing every later command (upstream pingdotgg#17525). - Fail cleanly when a guest is already destroyed (from upstream pingdotgg#14727). - Bound the recording warmup capture so a stalled capturePage cannot hold the tab lock forever (upstream pingdotgg#20085). - Fold the sanitized cause of a PreviewOperationError into the IPC failure text, so renderer and agent see e.g. a capture timeout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…stroy them Electron destroys a webview's guest when its element moves, so following the server's list order blanked tabs and dropped their debugger sessions mid-automation (upstream pingdotgg#13799). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The automation host lives in the main renderer, so a killed renderer left agents with no browser host and a white window (upstream pingdotgg#20300). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Release a crashed guest's debugger session so in-flight commands reject, fail fast with a reload hint until the page reloads, bound CDP domain enabling to 5s, and cap reattach attempts per guest. - The web host answers every request within its budget, so one slow operation can no longer look like a dead host. - Only responses count as host liveness; focus updates travel on a separate RPC. - Sanitizer covers Bearer/Basic values, JSON and key=value credentials, URL userinfo, spaced macOS paths and Windows forward-slash paths, without redacting ordinary words. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
github-actions
Bot
added
vouch:trusted
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Collaborator
Author
Verification (local, no remote CI)Full per-package suites vs origin/main
Tests that fail on origin/main and pass here:
Real runtime (isolated dev desktop, CDP fault injection):
Independent review: no blocking issues. The 3 mediums (sanitizer coverage, crash stall, slow-host eviction) and the liveness, over-redaction and typing lows are fixed in bde4f9c and c55e111. Not changed: the killed-renderer reload is not gated on quitting. It stays bounded at 3 per 60s and re-checks Not proven at runtime: the broker path end to end through MCP. It needs a provider session, so it is covered by unit tests only. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The built-in browser failed host-wide: one slow call made the server drop the whole automation host, failing every thread's pending calls with
PreviewAutomationExecutionErrorand then "No preview automation host is available" until it reconnected. The error never said why. Audit:audits/2026-10-21-browser-stability-upstream-audit.mdin the Control Plane project folder.What
PreviewAutomationBroker.ts): wait the request budget plus 1s grace (upstream fix(server): keep preview browser connected after operation timeouts pingdotgg/t3code#17693). Never evict on the 500ms background status read sent after each action. Evict only when the host has sent no response since the request was delivered. Other threads keep working on a healthy host.PreviewAutomationExecutionErrornow carries a sanitizedreason(e.g.capturePage ... TimeoutError: Operation timed out after '1s'). Paths, URL queries/userinfo and credential values are redacted (packages/shared/src/previewFailureReason.ts).killed(upstream fix(desktop): reload the main renderer after it is killed pingdotgg/t3code#20300), within the existing 3-per-60s cap.Not imported: the upstream server-browser rewrite (pingdotgg#15328), the reverted pingdotgg#19931 / pingdotgg#19377, and other P1 items.
Verification
reason: killed, recovering: trueand the bridge returned.Known limit
Background (not on screen) tab screenshots can still time out in the real app. They now report the reason instead of a bare error, and no longer take the host down. Tracked as follow-up (upstream pingdotgg#19912, pingdotgg#17015).