Commit Graph

377 Commits

Author SHA1 Message Date
Peter Steinberger
a617cd7b79 fix(test): restore long dep for full vitest gate 2026-03-07 21:23:06 +00:00
Peter Steinberger
9b4a114eb6 fix(browser): keep dispatcher context with no-retry hints
Landed from #39090 by @NewdlDewdl.

Co-authored-by: NewdlDewdl <rohin.agrawal@gmail.com>
2026-03-07 20:45:06 +00:00
Vincent Koc
e4d80ed556 CI: restore main detect-secrets scan (#38438)
* Tests: stabilize detect-secrets fixtures

* Tests: fix rebased detect-secrets false positives

* Docs: keep snippets valid under detect-secrets

* Tests: finalize detect-secrets false-positive fixes

* Tests: reduce detect-secrets false positives

* Tests: keep detect-secrets pragmas inline

* Tests: remediate next detect-secrets batch

* Tests: tighten detect-secrets allowlists

* Tests: stabilize detect-secrets formatter drift
2026-03-07 10:06:35 -08:00
Vignesh Natarajan
06a229f98f fix(browser): close tracked tabs on session cleanup (#36666) 2026-03-05 16:40:52 -08:00
Josh Avant
72cf9253fc Gateway: add SecretRef support for gateway.auth.token with auth-mode guardrails (#35094) 2026-03-05 12:53:56 -06:00
Sid
8d48235d3a fix(browser): remove deprecated --disable-blink-features=AutomationControlled flag
- Removes OpenClaw's default `--disable-blink-features=AutomationControlled` Chrome launch switch to avoid unsupported-flag warnings in newer Chrome (#35721).
- Preserves compatibility for older Chrome via `browser.extraArgs` override behavior (source analysis: #35770, #35728, #35727, #35885).
- Synthesis attribution: thanks @Sid-Qin, @kevinWangSheng, @ningding97, @Naylenv, @clawbie.

Source PR refs: #35734, #35770, #35728, #35727, #35885

Co-authored-by: Sid-Qin <Sid-Qin@users.noreply.github.com>
Co-authored-by: kevinWangSheng <kevinWangSheng@users.noreply.github.com>
Co-authored-by: ningding97 <ningding97@users.noreply.github.com>
Co-authored-by: Naylenv <Naylenv@users.noreply.github.com>
Co-authored-by: clawbie <clawbie@users.noreply.github.com>
Co-authored-by: Takhoffman <Takhoffman@users.noreply.github.com>
2026-03-05 09:22:47 -06:00
Josh Avant
1c200ca7ae follow-up: align ingress, atomic paths, and channel tests with credential semantics (#33733)
Merged via squash.

Prepared head SHA: c290c2ab6a3c3309adcbc4dc834f3c10d2ae1039
Co-authored-by: joshavant <830519+joshavant@users.noreply.github.com>
Co-authored-by: joshavant <830519+joshavant@users.noreply.github.com>
Reviewed-by: @joshavant
2026-03-03 20:29:46 -06:00
Peter Steinberger
3460aa4dee refactor(browser): dedupe playwright interaction helpers 2026-03-03 02:53:13 +00:00
Peter Steinberger
67e3eb85d7 refactor(tests): dedupe browser and config cli test setup 2026-03-03 01:15:09 +00:00
Peter Steinberger
fd3ca8a34c refactor: dedupe agent and browser cli helpers 2026-03-03 00:15:00 +00:00
Peter Steinberger
a282b459b9 fix(ci): remove unused chrome ws type import 2026-03-02 23:31:42 +00:00
Tak Hoffman
e2483a5381 Browser: fix ws RawData type import for dts build 2026-03-02 17:24:34 -06:00
Peter Steinberger
7365aefa19 fix(ci): resolve chrome websocket raw-data typing 2026-03-02 23:18:06 +00:00
Vincent Koc
8f3eb0f7b4 fix(browser): use CDP command probe for cdpReady health (#31421)
* fix(browser): validate cdp command channel health

* test(browser): cover stale cdp command channel readiness

* changelog: note cdp command-channel readiness check

* browser(cdp): detach ws message listener on health-probe cleanup
2026-03-02 15:10:28 -08:00
Peter Steinberger
3cb851be90 test: micro-optimize heavy gateway/browser/telegram suites 2026-03-02 22:29:04 +00:00
Peter Steinberger
3beb1b9da9 test: speed up heavy suites with shared fixtures 2026-03-02 21:58:35 +00:00
Peter Steinberger
067855e623 refactor(browser): dedupe browser and cli command wiring 2026-03-02 21:31:36 +00:00
Peter Steinberger
d01e04bcec test(perf): reduce heavy fixture and guardrail overhead 2026-03-02 21:07:52 +00:00
Peter Steinberger
9617ac9dd5 refactor: dedupe agent and reply runtimes 2026-03-02 19:57:33 +00:00
Mark L
1727279598 fix(browser): default to openclaw profile when unspecified (#32031) 2026-03-02 18:34:37 +00:00
Peter Steinberger
0ebe0480fa test(perf): replace relay fixed sleeps with condition waits 2026-03-02 17:55:47 +00:00
Peter Steinberger
34ff873a7e test(perf): trim fixed waits in relay and startup tests 2026-03-02 17:30:33 +00:00
Peter Steinberger
104d32bb64 fix(security): unify root-bound write hardening 2026-03-02 17:12:33 +00:00
Peter Steinberger
c973b053a5 refactor(net): unify proxy env checks and guarded fetch modes 2026-03-02 16:24:26 +00:00
Peter Steinberger
ea204e65a0 fix(browser): fail closed navigation guard with env proxy 2026-03-02 16:06:31 +00:00
Peter Steinberger
17c434f2f3 refactor: split browser context/actions and unify CDP timeout policy 2026-03-02 16:02:39 +00:00
Peter Steinberger
663c1858b8 refactor(browser): split server context and unify CDP transport 2026-03-02 15:43:05 +00:00
Peter Steinberger
9eb70d2725 fix: add proxy-bypass regression + changelog (#31469) (thanks @widingmarcus-cyber) 2026-03-02 13:56:30 +00:00
Marcus Widing
2bec80cd97 fix: preserve user-configured NO_PROXY when loopback already covered
Only restore env vars when we actually modified them (noProxyDidModify
flag). Prevents silently deleting a user's NO_PROXY that already
contains loopback entries. Added regression test.
2026-03-02 13:56:30 +00:00
Marcus Widing
dd8c76110f fix: remove isFirst guard from NO_PROXY restore, add reverse-exit test
Fix Greptile review: when call A exits before call B, the isFirst flag
on B is false, so the restore condition (refCount===0 && isFirst) was
never true and NO_PROXY leaked permanently.

Remove '&& isFirst' so any last exiter (refCount===0) restores the
original env vars. Added explicit reverse-exit-order regression test.
2026-03-02 13:56:30 +00:00
Marcus Widing
158709ff62 fix: make withNoProxyForLocalhost reentrant-safe, fix [::1] check
Address Greptile review feedback:
- Replace snapshot/restore pattern with reference counter to prevent
  permanent NO_PROXY env-var leak under concurrent async calls
- Include [::1] in the alreadyCoversLocalhost guard
- Add concurrency regression test
2026-03-02 13:56:30 +00:00
Marcus Widing
c96234b51d fix: bypass proxy for CDP localhost connections (#31219)
When HTTP_PROXY / HTTPS_PROXY / ALL_PROXY environment variables are set,
CDP connections to localhost/127.0.0.1 can be incorrectly routed through
the proxy (e.g. via global-agent or undici proxy dispatcher), causing
browser control to fail.

Fix:
- New cdp-proxy-bypass module with utilities for direct localhost connections
- WebSocket (ws) CDP connections: pass explicit http.Agent to bypass any
  global proxy agent patching
- fetch-based CDP probes: wrap in withNoProxyForLocalhost() to temporarily
  set NO_PROXY for the duration of the call
- Playwright connectOverCDP: wrap in withNoProxyForLocalhost() since
  Playwright reads env vars internally
- 13 new tests covering getDirectAgentForCdp, hasProxyEnv, and
  withNoProxyForLocalhost (env save/restore, error recovery)
2026-03-02 13:56:30 +00:00
Peter Steinberger
1184d39e1d fix: extend managed-tab cap regressions + changelog (#29724) (thanks @pandego) 2026-03-02 13:55:09 +00:00
pandego
e303b356ba fix(browser): detach tab-cap listing from openTab return path 2026-03-02 13:55:09 +00:00
pandego
22ec577d80 fix(browser): require managed runtime ownership for tab cap cleanup 2026-03-02 13:55:09 +00:00
pandego
9b938f2bf6 fix(browser): skip tab cap cleanup for attach-only profiles 2026-03-02 13:55:09 +00:00
pandego
c7bf54b914 fix(browser): scope tab cap to local profile and detach cleanup closes 2026-03-02 13:55:09 +00:00
pandego
c350dc8a7b fix(browser): keep tab-cap cleanup best-effort on list errors 2026-03-02 13:55:09 +00:00
pandego
b47dc73b70 fix(browser): cap managed profile tabs to prevent renderer buildup 2026-03-02 13:55:09 +00:00
Peter Steinberger
99ee26d534 fix: add timeout cleanup regression for browser CDP readiness (#29538) (thanks @AaronWander) 2026-03-02 13:53:21 +00:00
AaronWander
8bccb0032a fix(browser): bound post-launch CDP wait by elapsed time (#21149) 2026-03-02 13:53:21 +00:00
AaronWander
d06cc77f38 fix(browser): wait for CDP readiness after start (#21149) 2026-03-02 13:53:21 +00:00
Vincent Koc
5d53b61d9e fix(browser): honor profile attachOnly for loopback CDP (#31429)
* config(browser): allow profile attachOnly field

* config(schema): accept profile attachOnly

* browser(config): resolve per-profile attachOnly

* browser(runtime): honor profile attachOnly checks

* browser(routes): expose profile attachOnly in status

* config(labels): add browser profile attachOnly label

* config(help): document browser profile attachOnly

* test(config): cover profile attachOnly resolution

* test(browser): cover profile attachOnly runtime path

* test(config): include profile attachOnly help target

* changelog: note profile attachOnly override

* browser(runtime): prioritize attachOnly over loopback ownership error

* test(browser): cover attachOnly ws-failure ownership path
2026-03-02 00:49:57 -08:00
Vincent Koc
22be0c5801 fix(browser): support configurable CDP auto-port range start (#31352)
* config(browser): add cdpPortRangeStart type

* config(schema): validate browser.cdpPortRangeStart

* config(labels): add browser.cdpPortRangeStart label

* config(help): document browser.cdpPortRangeStart

* browser(config): resolve custom cdp port range start

* browser(profiles): allocate ports from resolved CDP range

* test(browser): cover cdpPortRangeStart config behavior

* test(browser): cover cdpPortRangeStart profile allocation

* test(browser): include CDP range fields in remote tab harness

* test(browser): include CDP range fields in ensure-tab harness

* test(browser): include CDP range fields in bridge auth config

* build(browser): add resolved CDP range metadata

* fix(browser): fallback CDP port allocation to derived range

* test(browser): cover missing resolved CDP range fallback

* fix(browser): remove duplicate resolved CDP range fields

* fix(agents): provide resolved CDP range in sandbox browser config

* chore(browser): format sandbox bridge resolved config

* chore(browser): reformat sandbox imports to satisfy oxfmt
2026-03-01 23:50:50 -08:00
Vincent Koc
5b55c23948 fix(browser): evict stale extension relay targets from cache (#31362)
* fix(browser): prune stale extension relay targets

* test(browser): cover relay stale target pruning

* changelog: note extension relay stale target fix
2026-03-01 23:18:49 -08:00
Peter Steinberger
45888276a3 test(integration): dedupe messaging, secrets, and plugin test suites 2026-03-02 07:13:11 +00:00
Veast
281494ae52 fix(browser): include Chrome stderr and sandbox hint in CDP startup error (#29355)
* fix(browser): include Chrome stderr and sandbox hint in CDP startup error (#29312)

When Chrome fails to start and CDP times out, the error message previously
contained no diagnostic information, making it impossible to determine why
Chrome couldn't start (e.g. missing --no-sandbox in containers, GPU issues,
shared memory errors).

This change:
- Collects Chrome's stderr output and includes up to 2000 chars in the error
- On Linux, if noSandbox is not set, appends a hint to try browser.noSandbox: true

Closes #29312

* chore(browser): format chrome startup diagnostics

* fix(browser): detach stderr listener after Chrome starts to prevent memory leak

Named the anonymous listener so it can be removed via proc.stderr.off()
once CDP is confirmed reachable. Also clears the stderrChunks array on
success so the buffered data is eligible for GC.

Fixes the unbounded memory growth reported in code review: a long-lived
Chrome process emitting periodic warnings would keep appending to
stderrChunks indefinitely since the listener was never removed.

Addresses review comment from chatgpt-codex-connector on PR #29355.

* changelog: note cdp startup diagnostics improvement

---------

Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
Co-authored-by: 派尼尔 <painier@openclaw.ai>
2026-03-01 23:08:52 -08:00
Benedikt Schackenberg
d03928bb69 test: Add tests for headless/noSandbox profile preference
Cover all cases requested in review:
1. headless=true → defaultProfile = 'openclaw'
2. noSandbox=true → defaultProfile = 'openclaw'
3. both false → defaultProfile = 'chrome' (existing behavior)
4. explicit defaultProfile config overrides preference logic
5. custom profiles work in headless mode

Fixes: #14895
2026-03-02 06:48:01 +00:00
Benedikt Schackenberg
3e3b49cb94 fix(browser): prefer openclaw profile in headless/noSandbox environments
In headless or noSandbox server environments (like Ubuntu Server), the
Chrome extension relay cannot work because there is no GUI browser to
attach to. Previously, the default profile was 'chrome' (extension relay)
which caused snapshot/screenshot operations to fail with:

  'Chrome extension relay is running, but no tab is connected...'

This fix prefers the 'openclaw' profile (Playwright native mode) when
browser.headless=true or browser.noSandbox=true, while preserving the
'chrome' default for GUI environments where extension relay works.

Fixes: https://github.com/openclaw/openclaw/issues/14895

🤖 AI-assisted (Claude), fully tested: pnpm build && pnpm check && pnpm test
2026-03-02 06:48:01 +00:00
stone-jin
04b3a51d3a fix(browser): preserve debugger attachment across relay disconnects during navigation reattach 2026-03-02 06:38:21 +00:00