[yummybomb]

Stacked on #112.

Summary

--browser local runs bench trials in a Chromium on your own machine instead of a Kernel browser, so sites see your IP and a real browser. This is for the many tool PRs on sites whose bot protection blocks Kernel browsers.

• Isolation. Each trial gets a throwaway profile with the xwebmcp extension loaded (all-site access granted up front in a copied manifest), the WebMCP flag set in Local State, and its own XWEBMCP_HOME. Chrome passes that home to the native host through its environment, so trials running in parallel never share a bridge.
• Tools. The runner builds xwebmcp from this checkout (or uses --xwebmcp), and registers the same pinned batch it sends to Kernel through the extension's addCustomTools bridge call. It then injects into the open tab with refreshTab and waits for the tools to go live.
• Agent. xwebmcp mcp provides list_tools and invoke_tool, and Chrome DevTools MCP everything else, with their own allowlist.local.txt, mcp.local.json and prompts/system.local.md. Control can't install tools: install_tool and the tab tools aren't allowed.
• Smoke gate. It now checks the agent's declared tools against a real treatment browser, since a local browser's MCP servers connect to it.
• Reporting and limits. The report header names local runs and the Chromium version. --stealth and signed-in domains are Kernel-only. --headless is for machines without a display.

Testing

• node --test "bench/**/*.test.mjs": 74 pass. New tests cover a Kernel run resumed with --browser local, which keeps using Kernel browsers (it used to switch to local ones), and the extension id, the per-browser MCP config, the local allowlist, the local browser prompt line, and transcript parsing of xwebmcp mcp calls and the extension's tool_ref format.
• By hand, in headless Chromium 154 on Linux:
  • A test tool registered, went live and returned the page title.
  • Three browsers started in parallel each saw and invoked only their own tool.
  • No processes or temp profiles were left behind.
• Real runs on Haiku 5.5 at low thinking from a Linux VM, headless. These exercised the plumbing but measured little: the VM has a datacenter IP, and most sites blocked headless Chromium from it (Target's "press & hold" check, an HTTP 406 from Frontier, a JetBlue CAPTCHA). Alaska worked in both arms; treatment used search_flights and answered in 23s against control's 63s.
• Kernel-browser runs still worked after the refactor: the Blue Bottle and Delta checkout intents (now in bench: checkout intents graded from the page, with a submission guard #118) passed in both arms.
• Not tested on macOS. Chromium reads per-user native messaging host manifests from <user-data-dir>/NativeMessagingHosts there as on Linux (chrome::DIR_USER_NATIVE_MESSAGING in chrome_paths.cc), so the runner writes the manifest only into each trial's profile and changes nothing in ~/Library.

Review fixes

• Bridge answers are decoded as UTF-8 across socket reads, so a character split between two reads no longer turns into U+FFFD, and an unreadable answer rejects that call instead of reaching the runner's uncaught-exception handler and stopping the run.
• The native host manifest goes only into the trial profile on macOS too (see above), instead of overwriting the user's manifests in ~/Library/Application Support.
• A resumed local run warns when Chromium or xwebmcp changed since it started.
• local.mjs gains removeCustomTool for the control sign-in check from Add bench: A/B harness for pi agents with and without xwebmcp tools #112. Checked in headless Chromium 154: a tool registered, went live, returned non-ASCII output through the bridge, and was removed.

Later fixes

• A bridge call whose connection closes without an answer now fails at once instead of waiting out its 130s timeout (regression test added; checked again in headless Chromium).
• The start-page tool listing from Add bench: A/B harness for pi agents with and without xwebmcp tools #112 goes through the browser backend, so local runs use the extension bridge for it.
• Re-run locally in headless Chromium 154 with openai/gpt-5.4-mini, 1 pair of ipwho-country-asn: both arms correct.
• Rebased onto Add bench: A/B harness for pi agents with and without xwebmcp tools #112 directly, now that bench: checkout intents and per-tool failure reporting #115 is folded into Add bench: A/B harness for pi agents with and without xwebmcp tools #112 and bench: checkout intents graded from the page, with a submission guard #118. Only the end-state reading it refactored for bench: checkout intents and per-tool failure reporting #115 dropped out.