Summary

• Fixes [Bug]: Browser tool silently discards downloads and throws "Download is starting" error when using CDP connection #48045.
• Behavior or issue addressed: Browser /navigate attachment responses in Playwright/CDP mode now complete as successful downloads instead of surfacing the navigation abort as a tool failure or dropping the file silently.
• Why it matters / User impact: CDP-backed browser workflows that navigate directly to CSV/PDF/export URLs can now receive structured download metadata and a saved file, while rejected/private attachment targets cannot leave managed download bytes behind.
• Intended outcome: allowed attachment navigations return { url, download }; rejected captured download URLs fail before saveAs writes managed bytes.
• Fix classification: Root Cause.
• Maintainer-ready confidence: High; the update is limited to the Playwright browser /navigate seam, managed download capture, and focused test-harness support, with RED/GREEN coverage for the ClawSweeper security-boundary finding.
• What is intentionally out of scope / scope boundary: browser navigation allow/deny policy changes, unrelated Playwright session behavior, non-download navigations, and extensions outside the browser /navigate path.
• What did NOT change: this does not change public browser API shape beyond the existing additive download result, does not change config, schema, protocol, migration, default behavior, allowlist behavior, or unrelated browser tools.
• What does success look like: allowed attachment downloads return metadata and saved bytes; rejected captured download URLs reject before persistence; existing non-download navigation behavior remains covered.
• What should reviewers focus on: the beforeSave ordering between captured download metadata, assertBrowserNavigationResultAllowed, and saveAs.
• Related open PR scan: this is an existing PR repair for fix(browser): downloads complete over CDP connections #89416 rather than a new competing PR; the current daily-fix scan found fix(browser): downloads complete over CDP connections #89416 as the only author-action PR in the user's open PR set.

Linked context

Closes #48045.

Related: ClawSweeper review on this PR requested blocked attachment-download persistence ordering coverage and targeted validation.

This was requested by ClawSweeper through the status: waiting on author review signal.

Root Cause

• Root cause: /navigate owned the Playwright page.goto() lifecycle, but attachment downloads caused Playwright to abort navigation with Download is starting or URL-matched net::ERR_ABORTED before navigateViaPlaywright could return useful download metadata.
• Follow-up root cause from ClawSweeper review: the new capture path saved managed bytes before the captured download URL passed assertBrowserNavigationResultAllowed, so a policy-denied attachment could leave rejected bytes in managed storage.
• Current author follow-up root cause: the timer-backed download capture promise was only awaited on the download-starting path. Ordinary non-download navigation could cancel the waiter after page.goto() settled, but if the capture timeout rejected first, the rejected promise was left unobserved and surfaced as an unhandled rejection.
• Why this is root-cause fix: the invariant is that browser navigation policy must approve a target before OpenClaw stores bytes for that target. createManagedDownloadCaptureForPage now accepts a beforeSave hook, builds URL/filename candidate metadata, runs the existing navigation result policy check first, and only calls saveAs after policy approval. The /navigate path passes that hook at the point where it arms the download capture, so allowed downloads still succeed and blocked downloads reject before persistence instead of being cleaned up after the fact. The /navigate path now also observes the armed capture promise immediately, so later download-starting handling still awaits real captured downloads while ordinary non-download success/error paths cannot leave a timed-out waiter rejection unhandled.
• Patch quality notes: the change does not broaden allowed URLs or change SSRF policy; it only moves the existing result validation ahead of managed persistence for captured navigation downloads. Timeout handling remains bounded by the existing navigation timeout, the catch blocks only distinguish timeout/policy-denial/download-starting cases, and rejected downloads still close the blocked navigation target.

Real behavior proof (required for external PRs)

• Behavior or issue addressed: Browser /navigate to a Content-Disposition: attachment URL in Playwright/CDP mode returns success download metadata and writes the file instead of failing the tool call.
• Real environment tested: Local Linux host with real headless Chrome launched through a CDP debugging port, plus a local HTTP server returning Content-Disposition: attachment; filename=proof.txt.
• Exact steps or command run after this patch: pnpm exec tsx cdp-navigate-download-proof.ts was run from the task worktree against the patched navigateViaPlaywright path.
• Evidence after fix (screenshot, recording, terminal capture, console output, redacted runtime log, linked artifact, or copied live output): The live CDP proof connected through CDP, called the patched navigateViaPlaywright, received download.triggered: true and suggestedFilename: proof.txt, wrote the managed download bytes, and read back the saved file content.
• Observed result after fix: The saved file content matched openclaw cdp navigate download proof\n, proving the attachment navigation returned success metadata and wrote the downloaded bytes in a real CDP browser session.
• What was not tested: Blacksmith Testbox execution was not available locally because the crabbox binary failed its basic --version/--help sanity checks before project checks started.
• Proof limitations or environment constraints: This live proof covers the allowed attachment download path. The latest ClawSweeper follow-up was about rejected-download persistence ordering, which is covered in the focused regression tests below.
• Before evidence (optional but encouraged): Before this PR, Playwright surfaced attachment navigation as Download is starting or URL-matched net::ERR_ABORTED, so /navigate returned an error or no download metadata.

Proof continuity after branch update

• The PR branch was updated through GitHub's Update branch flow after the author repair was pushed. Current PR head dc7704290e7307b9364b870a7144f8991142a3f4 is a merge commit with parents 0b7d58903f5e5c0d63f96a4cb847602b620c98f6 (the submitted browser repair/proof head) and e209a56d0b61e5d6c0b5d53b760e813d9849f85b (current main).
• The proof-bearing browser repair commits remain in the PR branch history after the update; the Update branch merge did not replace or remove the /navigate download fix, the blocked-download persistence regression, or the capture-timeout unhandled-rejection regression.
• The original live CDP proof above still applies to the repaired /navigate path because it was run against the submitted repair head and the branch update only merged latest main on top of that repair. The latest main-side update also cleared the unrelated src/agents/model-picker-visibility.ts unused-import blocker that previously prevented a second local submit.
• Bot label note: proof: sufficient was removed after the head changed, but the PR body still carries the real behavior proof and this section ties that proof to the current Update branch head for the next ClawSweeper/maintainer pass.

Tests and validation

Commands run after the latest patch:

node scripts/run-vitest.mjs extensions/browser/src/browser/pw-tools-core.snapshot.navigate-guard.test.ts -t "handles capture timeouts that win before ordinary navigation settles"
node scripts/run-vitest.mjs extensions/browser/src/browser/pw-tools-core.snapshot.navigate-guard.test.ts extensions/browser/src/browser/pw-session.test.ts extensions/browser/src/browser/pw-tools-core.waits-next-download-saves-it.test.ts
node scripts/run-vitest.mjs extensions/browser/src/browser/pw-session.test.ts -t "validates captured navigation downloads before saving managed bytes"
git diff --check origin/main..HEAD
env OPENCLAW_CHECK_CHANGED_REMOTE_CHILD=1 CI=1 PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN=false pnpm check:changed --timed

Regression coverage added or updated:

• Target test file: extensions/browser/src/browser/pw-session.test.ts plus the existing /navigate guard files extensions/browser/src/browser/pw-tools-core.snapshot.navigate-guard.test.ts and extensions/browser/src/browser/pw-tools-core.waits-next-download-saves-it.test.ts.
• Scenario locked in: a captured navigation attachment reports a blocked local URL and the policy hook rejects before persistence. A separate /navigate regression covers a capture timeout winning before ordinary non-download navigation settles, proving the timed-out capture promise is observed rather than reported as an unhandled rejection.
• Why this is the smallest reliable guardrail: the regression asserts the capture promise rejects with the policy error and saveAs is not called, which directly protects the security-boundary invariant that rejected download bytes cannot enter managed storage without adding a broad end-to-end fixture.
• extensions/browser/src/browser/pw-session.test.ts adds validates captured navigation downloads before saving managed bytes, which verifies the capture's policy hook runs before saveAs and rejected downloads do not persist managed bytes.
• extensions/browser/src/browser/pw-tools-core.test-harness.ts mirrors the new beforeSave semantics so existing /navigate tests exercise the same ordering.

What failed before this fix:

FAIL |extension-browser| ../../extensions/browser/src/browser/pw-session.test.ts > pw-session ensurePageState > validates captured navigation downloads before saving managed bytes
AssertionError: promise resolved "{ triggered: true, …(3) }" instead of rejecting

Received: triggered=true, suggestedFilename=export.csv, url=http://127.0.0.1:18080/export.csv, path=[local path redacted]/[uuid]-export.csv

Passing evidence after fix:

RUN  v4.1.7 [local path redacted]

Test Files  1 passed (1)
     Tests  1 passed | 10 skipped (11)
  Duration  33.72s

Test Files  3 passed (3)
     Tests  36 passed (36)
  Duration  39.05s

Test Files  1 passed (1)
     Tests  1 passed | 14 skipped (15)
  Duration  29.46s

Changed-check evidence:

[check:changed] lanes=extensions, extensionTests
[check:changed] summary
   3.05s  ok         conflict markers
   1.62s  ok         changelog attributions
   1.70s  ok         guarded extension wildcard re-exports
   1.47s  ok         plugin-sdk wildcard re-exports
   1.42s  ok         duplicate scan target coverage
   2.31s  ok         dependency pin guard
   2.98s  ok         package patch guard
   203ms  ok         test temp creation report (warning-only)
 104.09s  ok         typecheck extensions
 355.54s  ok         typecheck extension tests
 452.10s  ok         lint extensions
 546.91s  ok         database-first legacy-store guard
   4.33s  ok         media download helper guard
  78.32s  ok         runtime sidecar loader guard
  29.58s  ok         runtime import cycles

Regression Test Plan

• Target test: extensions/browser/src/browser/pw-session.test.ts / validates captured navigation downloads before saving managed bytes.
• Regression scenario: a captured navigation attachment reports a blocked local URL and the policy hook rejects before persistence.
• Expected guardrail: the capture promise rejects with the policy error and saveAs is not called, proving rejected bytes cannot enter managed storage.
• Additional target tests: extensions/browser/src/browser/pw-tools-core.snapshot.navigate-guard.test.ts, extensions/browser/src/browser/pw-session.test.ts, and extensions/browser/src/browser/pw-tools-core.waits-next-download-saves-it.test.ts cover allowed metadata, URL-matched ERR_ABORTED, no-capture rethrow, save failure propagation, and existing route response behavior.

Risk checklist

Did user-visible behavior change? (Yes/No)

Yes. Browser /navigate can now return download metadata for attachment responses instead of surfacing the Playwright navigation abort.

Did config, environment, or migration behavior change? (Yes/No)

No.

Did security, auth, secrets, network, or tool execution behavior change? (Yes/No)

Yes. This touches browser navigation/download security ordering by ensuring captured download URLs pass the existing navigation policy before managed bytes are saved.

What is the highest-risk area?

Risk labels considered: browser, download-handling, SSRF policy, security-boundary, and the large-diff warning caused mostly by regression/test-harness coverage. The highest risk is weakening the browser SSRF/download boundary by treating a blocked or unrelated aborted navigation as a successful managed download, or by persisting rejected attachment bytes before policy validation.

How is that risk mitigated?

The patch only handles Playwright download-starting errors or URL-matched ERR_ABORTED, requires an armed captured download before returning success, validates the captured download URL through the existing browser navigation policy before saveAs, closes blocked navigation targets on policy denial, and adds a regression proving blocked downloads do not call saveAs. The production scope is limited to pw-session.ts and pw-tools-core.snapshot.ts; the rest of the line count is targeted browser regression coverage and harness support.

Current review state

Next action: maintainer/ClawSweeper review of the updated branch after this author follow-up.

Still waiting on author, maintainer, CI, or external proof:

• Author-side code and validation work for the visible ClawSweeper findings is addressed in this update, including the capture-timeout unhandled rejection follow-up.
• The previous remote checks-node-agentic-commands-agent-channel failure was on the old head 286a934bcf5115f52f32037e8ddc95a2ffcf0eaf; this branch has been synced onto current main again after the local repair and needs remote CI to rerun on the pushed head.
• No new external proof gap is introduced by the follow-up; the original live CDP allowed-download proof remains the real behavior proof, and the latest reviewer request was specifically a blocked-download persistence ordering regression.

Bot or reviewer comments addressed:

• RF-001 status: waiting on author: addressed by this follow-up update; label removal is maintainer/bot-owned after review.
• RF-002 Add focused regression for capture timeout winning before page.goto() settles: addressed by handles capture timeouts that win before ordinary navigation settles.
• RF-004/RF-007 Handle capture timeouts on non-download navigations: addressed by observing the armed capture promise immediately after creation while still awaiting it on the download-starting path.
• RF-002 Add blocked attachment-download regression proving no rejected file remains in managed storage: addressed by extensions/browser/src/browser/pw-session.test.ts regression that fails before the repair and passes after it.
• RF-003 Rerun targeted browser vitest files after the repair: addressed; targeted browser vitest passed with 3 files and 35 tests.
• RF-004 Security-boundary merge risk that successful attachment-download path must not leave rejected bytes in managed storage: addressed by validating the captured download candidate before saveAs and by the no-saveAs regression.
• RF-005 Queue focused repair for narrow validation/persistence ordering defect: addressed; the code change is limited to managed download capture ordering and /navigate policy wiring.
• RF-006 Validate blocked downloads before persisting bytes at extensions/browser/src/browser/pw-tools-core.snapshot.ts: addressed by passing beforeSave into createManagedDownloadCaptureForPage from navigateViaPlaywright.
• RF-007 Run targeted vitest command: addressed; node scripts/run-vitest.mjs extensions/browser/src/browser/pw-tools-core.snapshot.navigate-guard.test.ts extensions/browser/src/browser/pw-session.test.ts extensions/browser/src/browser/pw-tools-core.waits-next-download-saves-it.test.ts passed.
• RF-008 Targeted browser vitest command: addressed; node scripts/run-vitest.mjs extensions/browser/src/browser/pw-tools-core.snapshot.navigate-guard.test.ts extensions/browser/src/browser/pw-session.test.ts extensions/browser/src/browser/pw-tools-core.waits-next-download-saves-it.test.ts passed.
• RF-009 Exact captured-download validation command: addressed; node scripts/run-vitest.mjs extensions/browser/src/browser/pw-session.test.ts -t "validates captured navigation downloads before saving managed bytes" passed.
• RF-010 Run git diff --check origin/main..HEAD: addressed; command passed with exit code 0.
• RF-011 Run OPENCLAW_CHECK_CHANGED_REMOTE_CHILD=1 CI=1 PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN=false ... check:changed --timed: addressed; command passed with typecheck, lint, and guard summary all ok.