fix(browser): preserve authenticated picker errors

[steipete]

Summary

• preserve the original model-picker error after ChatGPT login has already been verified
• stop appending cookie/login guidance to authenticated missing-model failures
• retain detected picker options and structured browser-error details

Proof

• pnpm vitest run tests/browser/index.test.ts — 58 passed
• pnpm run check
• pnpm run build
• built-library smoke preserved the exact error object and picker message, with mentionsCookies: false
• independent Codex autoreview found no actionable defect

I also attempted the full browser repro locally. This machine has neither an initialized Oracle manual-login profile nor applicable ChatGPT cookies, so it correctly failed at authentication before reaching the picker. The reporter's authenticated repro remains the live evidence for the downstream picker path.

Relates to #344. The separate compatibility decision—reject retired GPT-5.2 browser aliases or remap them to current models—is intentionally left unchanged.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 2, 2026, 1:28 PM ET / 17:28 UTC.

ClawSweeper review

What this changes

The PR preserves the original ChatGPT model-picker error after authentication succeeds, preventing an unrelated cookie/login hint while retaining the detected picker diagnostics.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

This owner-authored PR is still necessary: current main appends cookie/login guidance to a model-picker error even after its login check has completed. The proposed branch removes that misleading wrapper while preserving the original picker diagnostics; no discrete correctness or security defect was found in the patch. It should remain open for maintainer review and completion of the pending platform checks.

Priority: P2
Reviewed head: dba6679e3c5f7a778f95648ad620df539ac36322

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	The narrow patch directly corrects the confirmed error wrapper and includes focused regression coverage; merge readiness still depends on the pending platform checks.
Proof confidence	🌊 off-meta tidepool	Not applicable: This is an owner-authored PR, so the external-contributor proof gate does not apply; its body nevertheless provides focused test, build, and built-library smoke evidence. A redacted authenticated terminal transcript would be useful supplemental confirmation of the exact picker path.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This is an owner-authored PR, so the external-contributor proof gate does not apply; its body nevertheless provides focused test, build, and built-library smoke evidence. A redacted authenticated terminal transcript would be useful supplemental confirmation of the exact picker path.
Evidence reviewed	6 items	Current-main behavior: Current main waits for login before model selection, then catches any selection error and appends the cookie/login hint when no cookies were applied; this can misdiagnose an authenticated missing-model failure. Proposed correction: The PR replaces that catch wrapper with an Error-preserving normalization after the existing login wait, so the model picker’s original message and structured Error instance survive unchanged. Focused regression coverage: The added test constructs the model-selection failure, verifies the same error object is retained, confirms the available-picker label remains present, and confirms cookie/login wording is absent.
Findings	None	None.
Security	None	None.

How this fits together

Oracle browser mode starts or attaches to Chrome, verifies the ChatGPT session, then selects the requested model before submitting the prompt. When picker selection fails, this path determines whether the CLI returns the picker’s available-model diagnostics or incorrectly redirects the operator toward login setup.

flowchart LR
  A[Browser CLI request] --> B[ChatGPT session check]
  B --> C[Prompt-ready browser tab]
  C --> D[Model picker selection]
  D --> E{Requested model found?}
  E -->|Yes| F[Submit prompt]
  E -->|No| G[Preserve picker diagnostics]
  G --> H[CLI error output]

Loading

Before merge

• Resolve merge risk (P1) - At review time, the macOS build was queued and the Windows build was in progress; recheck required checks on commit dba6679e3c5f7a778f95648ad620df539ac36322 before merging.
• Complete next step (P2) - This owner-authored PR has no discrete automated repair to perform; a maintainer should review the clean narrow patch after the pending platform checks settle on the exact head.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Patch scope	3 files affected; 24 added, 6 removed	The change is narrowly confined to browser error handling, one focused regression test, and the unreleased changelog.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Keep the successful-login boundary intact and merge the narrow error-preservation change once the exact PR head has completed its required platform checks.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Keep the successful-login boundary intact and merge the narrow error-preservation change once the exact PR head has completed its required platform checks.

Do we have a high-confidence way to reproduce the issue?

Yes, from source: waitForLogin completes before model selection, while current main then conditionally appends cookie guidance to any picker failure. A live authenticated account was not available in this review environment, so this is source-reproducible rather than a completed live reproduction.

Is this the best way to solve the issue?

Yes. Removing the post-authentication cookie-hint wrapper is the narrowest maintainable repair because the model-picker action already produces the useful unavailable-model message and available-option diagnostics.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 332cc86dab79.

Labels

Label justifications:

• P2: This corrects a bounded but misleading browser-mode diagnostic after authenticated model selection fails.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is an owner-authored PR, so the external-contributor proof gate does not apply; its body nevertheless provides focused test, build, and built-library smoke evidence. A redacted authenticated terminal transcript would be useful supplemental confirmation of the exact picker path.

Evidence

What I checked:

• Current-main behavior: Current main waits for login before model selection, then catches any selection error and appends the cookie/login hint when no cookies were applied; this can misdiagnose an authenticated missing-model failure. (src/browser/index.ts:1459, 332cc86dab79)
• Proposed correction: The PR replaces that catch wrapper with an Error-preserving normalization after the existing login wait, so the model picker’s original message and structured Error instance survive unchanged. (src/browser/index.ts:1480, dba6679e3c5f)
• Focused regression coverage: The added test constructs the model-selection failure, verifies the same error object is retained, confirms the available-picker label remains present, and confirms cookie/login wording is absent. (tests/browser/index.test.ts:76, dba6679e3c5f)
• Related issue boundary: The linked report identifies this misleading hint as a separate minor problem while its broader retired-model alias decision remains open; the PR deliberately fixes only the diagnostic portion. (src/browser/actions/modelSelection.ts:88, 332cc86dab79)
• Release and main status: The proposed fix commit is not an ancestor of the checked-out current main, and the latest supplied release commit predates the PR; this remains unmerged and unreleased work. (CHANGELOG.md:3, f2f20b565a86)
• History inspection limitation: The locally available diff and commit objects were inspected, but deeper blame and pickaxe history required a missing promisor object and could not fetch because the configured GitHub remote could not resolve.

Likely related people:

• steipete: Local file history identifies Peter Steinberger as the author of recent browser lifecycle work, and the provided metadata maps the current repository owner to this proposed browser error-path change; the partial clone prevented a fuller line-blame trail. (role: recent browser-area contributor; confidence: medium; commits: 3242500d5b67; files: src/browser/index.ts, tests/browser/index.test.ts)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Recheck the queued macOS and in-progress Windows builds on the current PR head before merge.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (5 earlier review cycles)

• reviewed 2026-08-02T05:49:28.587Z sha f2f20b5 :: needs maintainer review before merge. :: none
• reviewed 2026-08-02T10:20:04.452Z sha f2f20b5 :: needs maintainer review before merge. :: none
• reviewed 2026-08-02T12:20:12.071Z sha f2f20b5 :: needs maintainer review before merge. :: none
• reviewed 2026-08-02T13:56:15.542Z sha f2f20b5 :: needs maintainer review before merge. :: none
• reviewed 2026-08-02T16:19:10.418Z sha f2f20b5 :: needs maintainer review before merge. :: none