fix(browser): time out remote tab enumeration - #80147

Summary

• Fixes browser: listPagesViaPlaywright lacks timeout protection, causing all HTTP requests to 500 when CDP connection hangs #58968 by bounding remote CDP Playwright tab enumeration with the existing remote CDP timeout budget.
• Evicts the scoped cached/in-flight Playwright connection on enumeration timeout so the next request can reconnect instead of reusing a stuck pipe.
• Adds regression coverage for a stuck page-target lookup and verifies remote profile tab listing passes the resolved timeout into the Playwright path.

Problem

Remote CDP profiles use a persistent Playwright connection for tab listing because HTTP /json/list is ephemeral for those providers. When that Playwright-backed enumeration stalls, browser requests can hang behind the stuck CDP operation instead of failing fast.

Root Cause

createProfileTabOps().readTabs() passed only cdpUrl and SSRF policy to listPagesViaPlaywright(). The lower-level Playwright enumeration path had no operation-level timeout around connectBrowser(), getAllPages(), or per-page target/title/url reads, and a stuck scoped connection could remain cached or in-flight.

Architectural Reasoning

The fix reuses the existing browser remote CDP timeout contract rather than adding a new config key. Remote tab listing now uses max(remoteCdpTimeoutMs, remoteCdpHandshakeTimeoutMs), which matches the existing distinction between HTTP discovery and WebSocket handshake budgets. Timeout cleanup goes through the existing scoped Playwright disconnect helper, preserving per-CDP URL isolation and avoiding hidden coupling to other browser profiles.

Real behavior proof

• Behavior or issue addressed: Remote CDP Playwright tab enumeration now returns a bounded timeout error instead of waiting indefinitely on a stalled CDP discovery/enumeration path.
• Real environment tested: Windows 11 worktree, Node v22.15.0, pnpm 10.33.2, branch hemant/issue-triage-20260509, commit 9aba9b405ae5c4601211fd0b2b428d9640425b8b.
• Exact steps or command run after this patch: Started a real loopback HTTP endpoint that accepts CDP discovery connections and deliberately never responds; called production listPagesViaPlaywright() through node --import tsx with timeoutMs: 100 and an SSRF policy allowing loopback/private access; closed the scoped Playwright connection and destroyed the held socket after the call.
• Evidence after fix:

$ node --import tsx - < hanging-cdp-smoke.mjs
{"ok":true,"error":"Playwright page enumeration timed out after 100ms","elapsedMs":309}

• Observed result after fix: The production browser module returned Playwright page enumeration timed out after 100ms and the script exited cleanly instead of hanging on the held CDP request.
• What was not tested: I did not use a real remote Chrome host because the failure mode is a stalled CDP endpoint; the local loopback endpoint exercises the same production timeout path with deterministic cleanup. Full pnpm test extensions/browser still has unrelated Windows environment failures noted below.

Testing

• pnpm test extensions/browser/src/browser/pw-session.connections.test.ts extensions/browser/src/browser/server-context.remote-profile-tab-ops.playwright.test.ts
• pnpm exec oxfmt --check --threads=1 extensions/browser/src/browser/pw-session.ts extensions/browser/src/browser/server-context.tab-ops.ts extensions/browser/src/browser/pw-session.connections.test.ts extensions/browser/src/browser/server-context.remote-profile-tab-ops.playwright.test.ts
• pnpm tsgo:extensions from O:\ subst drive to avoid the repo path-with-spaces launcher bug
• pnpm tsgo:extensions:test from O:\
• pnpm lint:extensions from O:\
• pnpm check:changelog-attributions
• git diff --check upstream/main...HEAD
• pnpm check:changed --staged exited 0 with no lane output

Full pnpm test extensions/browser was also run locally. It failed on unrelated Windows environment assumptions: local browser auto-detection / missing supported browser launch fixtures and existing /tmp path expectations being normalized to C:\tmp. The two touched regression test files pass.

Risk Analysis

Risk is medium because this touches async browser/CDP lifecycle behavior. The change is scoped to remote Playwright tab enumeration, does not alter local managed browser JSON tab listing, and does not change navigation, action, or screenshot behavior. On timeout, OpenClaw drops only the scoped Playwright connection for that CDP URL and leaves the actual remote browser tabs intact.

Backward Compatibility

No config, API, or response-shape changes. Existing browser.remoteCdpTimeoutMs and browser.remoteCdpHandshakeTimeoutMs now also bound remote Playwright tab enumeration.

Screenshots / Logs

The real behavior proof above is terminal output from the after-fix smoke; no UI screenshot is applicable.