openclaw

Files

T

Matt Van Horn e883d0b556 fix(browser): add IP validation, fix upgrade handler for non-loopback bind

- Zod schema: validate relayBindHost with ipv4/ipv6 instead of bare string
- Upgrade handler: allow non-loopback connections when bindHost is explicitly
  non-loopback (e.g. 0.0.0.0 for WSL2), keeping loopback-only default
- Test: verify actual bind address via relay.bindHost instead of just checking
  reachability on 127.0.0.1 which passes regardless
- Expose bindHost on ChromeExtensionRelayServer type for inspection

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-08 19:15:21 +00:00

routes

fix(browser): honor profile attachOnly for loopback CDP (#31429 )

2026-03-02 00:49:57 -08:00

bridge-auth-registry.ts

…

bridge-server.auth.test.ts

CI: restore main detect-secrets scan (#38438 )

2026-03-07 10:06:35 -08:00

bridge-server.ts

fix(security): harden sandbox novnc observer flow

2026-03-01 22:44:28 +00:00

browser-utils.test.ts

fix: preserve loopback ws cdp tab ops (#31085 ) (thanks @shrey150)

2026-03-08 18:48:51 +00:00

cdp-proxy-bypass.test.ts

refactor: dedupe agent and reply runtimes

2026-03-02 19:57:33 +00:00

cdp-proxy-bypass.ts

refactor(net): unify proxy env checks and guarded fetch modes

2026-03-02 16:24:26 +00:00

cdp-timeouts.test.ts

refactor: split browser context/actions and unify CDP timeout policy

2026-03-02 16:02:39 +00:00

cdp-timeouts.ts

refactor: split browser context/actions and unify CDP timeout policy

2026-03-02 16:02:39 +00:00

cdp.helpers.ts

fix: preserve loopback ws cdp tab ops (#31085 ) (thanks @shrey150)

2026-03-08 18:48:51 +00:00

cdp.test.ts

fix(browser): rewrite 0.0.0.0 and [::] wildcard addresses in CDP WebSocket URLs

2026-03-08 19:07:23 +00:00

cdp.ts

fix(browser): rewrite 0.0.0.0 and [::] wildcard addresses in CDP WebSocket URLs

2026-03-08 19:07:23 +00:00

chrome-extension-background-utils.test.ts

fix(browser): derive relay auth token from gateway token in Chrome extension

2026-02-23 18:56:14 +00:00

chrome-extension-manifest.test.ts

…

chrome-extension-options-validation.test.ts

refactor(browser): share relay token + options validation tests

2026-02-24 04:23:22 +00:00

chrome-user-data-dir.test-harness.ts

…

chrome.default-browser.test.ts

…

chrome.executables.ts

…

chrome.profile-decoration.ts

…

chrome.test.ts

test+docs: comprehensive coverage and generic framing

2026-03-08 18:48:10 +00:00

chrome.ts

chore: remove vendor-specific references from code comments

2026-03-08 18:48:10 +00:00

client-actions-core.ts

…

client-actions-observe.ts

…

client-actions-state.ts

refactor: dedupe agent and browser cli helpers

2026-03-03 00:15:00 +00:00

client-actions-types.ts

…

client-actions-url.ts

…

client-actions.ts

…

client-fetch.loopback-auth.test.ts

fix(test): restore long dep for full vitest gate

2026-03-07 21:23:06 +00:00

client-fetch.ts

fix(browser): keep dispatcher context with no-retry hints

2026-03-07 20:45:06 +00:00

client.test.ts

…

client.ts

…

config.test.ts

fix(browser): preserve wss:// cdpUrl in legacy default profile resolution

2026-03-08 18:48:10 +00:00

config.ts

fix(infra): make browser relay bind address configurable

2026-03-08 19:15:21 +00:00

constants.ts

fix(browser): default to openclaw profile when unspecified (#32031 )

2026-03-02 18:34:37 +00:00

control-auth.auto-token.test.ts

Gateway: add SecretRef support for gateway.auth.token with auth-mode guardrails (#35094 )

2026-03-05 12:53:56 -06:00

control-auth.test.ts

…

control-auth.ts

Gateway: add SecretRef support for gateway.auth.token with auth-mode guardrails (#35094 )

2026-03-05 12:53:56 -06:00

control-service.ts

…

csrf.ts

…

extension-relay-auth.secretref.test.ts

Gateway: add SecretRef support for gateway.auth.token with auth-mode guardrails (#35094 )

2026-03-05 12:53:56 -06:00

extension-relay-auth.test.ts

Gateway: add SecretRef support for gateway.auth.token with auth-mode guardrails (#35094 )

2026-03-05 12:53:56 -06:00

extension-relay-auth.ts

Gateway: add SecretRef support for gateway.auth.token with auth-mode guardrails (#35094 )

2026-03-05 12:53:56 -06:00

extension-relay.test.ts

fix(browser): add IP validation, fix upgrade handler for non-loopback bind

2026-03-08 19:15:21 +00:00

extension-relay.ts

fix(browser): add IP validation, fix upgrade handler for non-loopback bind

2026-03-08 19:15:21 +00:00

form-fields.ts

refactor(browser): unify fill field normalization

2026-02-26 22:17:58 +01:00

http-auth.ts

…

navigation-guard.test.ts

fix(browser): fail closed navigation guard with env proxy

2026-03-02 16:06:31 +00:00

navigation-guard.ts

refactor(net): unify proxy env checks and guarded fetch modes

2026-03-02 16:24:26 +00:00

output-atomic.ts

follow-up: align ingress, atomic paths, and channel tests with credential semantics (#33733 )

2026-03-03 20:29:46 -06:00

paths.test.ts

refactor: dedupe agent and browser cli helpers

2026-03-03 00:15:00 +00:00

paths.ts

fix(browser): harden writable output paths

2026-03-01 23:25:13 +00:00

profiles-service.test.ts

refactor: dedupe agent and browser cli helpers

2026-03-03 00:15:00 +00:00

profiles-service.ts

fix(browser): support configurable CDP auto-port range start (#31352 )

2026-03-01 23:50:50 -08:00

profiles.test.ts

…

profiles.ts

…

proxy-files.ts

…

pw-ai-module.ts

…

pw-ai-state.ts

…

pw-ai.e2e.test.ts

test: move integration-heavy suites to e2e lane

2026-03-02 05:33:07 +00:00

pw-ai.ts

…

pw-role-snapshot.test.ts

…

pw-role-snapshot.ts

…

pw-session.browserless.live.test.ts

…

pw-session.create-page.navigation-guard.test.ts

…

pw-session.get-page-for-targetid.extension-fallback.test.ts

…

pw-session.mock-setup.ts

…

pw-session.test.ts

…

pw-session.ts

fix: preserve loopback ws cdp tab ops (#31085 ) (thanks @shrey150)

2026-03-08 18:48:51 +00:00

pw-tools-core.activity.ts

…

pw-tools-core.clamps-timeoutms-scrollintoview.test.ts

…

pw-tools-core.downloads.ts

follow-up: align ingress, atomic paths, and channel tests with credential semantics (#33733 )

2026-03-03 20:29:46 -06:00

pw-tools-core.interactions.evaluate.abort.test.ts

…

pw-tools-core.interactions.set-input-files.test.ts

refactor: dedupe agent and browser cli helpers

2026-03-03 00:15:00 +00:00

pw-tools-core.interactions.ts

refactor(browser): dedupe playwright interaction helpers

2026-03-03 02:53:13 +00:00

pw-tools-core.last-file-chooser-arm-wins.test.ts

fix(browser): revalidate upload paths at use time

2026-02-26 00:40:56 +01:00

pw-tools-core.responses.ts

…

pw-tools-core.screenshots-element-selector.test.ts

refactor: dedupe agent and browser cli helpers

2026-03-03 00:15:00 +00:00

pw-tools-core.shared.ts

…

pw-tools-core.snapshot.navigate-guard.test.ts

fix(browser): retry relay navigation after frame detach

2026-03-02 06:14:52 +00:00

pw-tools-core.snapshot.ts

fix(browser): retry relay navigation after frame detach

2026-03-02 06:14:52 +00:00

pw-tools-core.state.ts

…

pw-tools-core.storage.ts

…

pw-tools-core.test-harness.ts

fix(browser): retry relay navigation after frame detach

2026-03-02 06:14:52 +00:00

pw-tools-core.trace.ts

fix(security): unify root-bound write hardening

2026-03-02 17:12:33 +00:00

pw-tools-core.ts

…

pw-tools-core.waits-next-download-saves-it.test.ts

follow-up: align ingress, atomic paths, and channel tests with credential semantics (#33733 )

2026-03-03 20:29:46 -06:00

resolved-config-refresh.ts

…

safe-filename.ts

refactor(shared): extract reused path and normalization helpers

2026-03-02 05:20:19 +00:00

screenshot.test.ts

…

screenshot.ts

…

server-context.availability.ts

fix(infra): make browser relay bind address configurable

2026-03-08 19:15:21 +00:00

server-context.chrome-test-harness.ts

…

server-context.constants.ts

refactor(browser): split server context and unify CDP transport

2026-03-02 15:43:05 +00:00

server-context.ensure-browser-available.waits-for-cdp-ready.test.ts

refactor: dedupe agent and browser cli helpers

2026-03-03 00:15:00 +00:00

server-context.ensure-tab-available.prefers-last-target.test.ts

fix: wait for extension relay tab reconnects (#32461 ) (thanks @AaronWander)

2026-03-08 19:11:58 +00:00

server-context.hot-reload-profiles.test.ts

…

server-context.loopback-direct-ws.test.ts

fix: preserve loopback ws cdp tab ops (#31085 ) (thanks @shrey150)

2026-03-08 18:48:51 +00:00

server-context.remote-profile-tab-ops.suite.ts

refactor(browser): dedupe browser and cli command wiring

2026-03-02 21:31:36 +00:00

server-context.remote-profile-tab-ops.test.ts

refactor(browser): dedupe browser and cli command wiring

2026-03-02 21:31:36 +00:00

server-context.remote-tab-ops.harness.ts

refactor: split browser context/actions and unify CDP timeout policy

2026-03-02 16:02:39 +00:00

server-context.remote-tab-ops.test.ts

refactor(browser): dedupe browser and cli command wiring

2026-03-02 21:31:36 +00:00

server-context.reset.test.ts

refactor: dedupe agent and browser cli helpers

2026-03-03 00:15:00 +00:00

server-context.reset.ts

refactor: split browser context/actions and unify CDP timeout policy

2026-03-02 16:02:39 +00:00

server-context.selection.ts

fix(browser): wait for extension tabs after relay drop (#32331 )

2026-03-08 19:11:58 +00:00

server-context.tab-ops.ts

fix: preserve loopback ws cdp tab ops (#31085 ) (thanks @shrey150)

2026-03-08 18:48:51 +00:00

server-context.tab-selection-state.suite.ts

refactor: dedupe agent and browser cli helpers

2026-03-03 00:15:00 +00:00

server-context.tab-selection-state.test.ts

refactor(browser): dedupe browser and cli command wiring

2026-03-02 21:31:36 +00:00

server-context.ts

refactor: split browser context/actions and unify CDP timeout policy

2026-03-02 16:02:39 +00:00

server-context.types.ts

…

server-lifecycle.test.ts

…

server-lifecycle.ts

fix(infra): make browser relay bind address configurable

2026-03-08 19:15:21 +00:00

server-middleware.ts

…

server.agent-contract-form-layout-act-commands.test.ts

refactor(browser): unify fill field normalization

2026-02-26 22:17:58 +01:00

server.agent-contract-snapshot-endpoints.test.ts

test: fix gate regressions

2026-02-24 04:39:53 +00:00

server.agent-contract.test-harness.ts

…

server.auth-fail-closed.test.ts

test(integration): dedupe messaging, secrets, and plugin test suites

2026-03-02 07:13:11 +00:00

server.auth-token-gates-http.test.ts

…

server.control-server.test-harness.ts

…

server.evaluate-disabled-does-not-block-storage.test.ts

test(integration): dedupe messaging, secrets, and plugin test suites

2026-03-02 07:13:11 +00:00

server.post-tabs-open-profile-unknown-returns-404.test.ts

fix(browser): update existing tests for ws/wss protocol support

2026-03-08 18:48:10 +00:00

server.ts

fix(browser): fail closed browser auth bootstrap

2026-03-01 21:40:16 +00:00

session-tab-registry.test.ts

fix(browser): close tracked tabs on session cleanup (#36666 )

2026-03-05 16:40:52 -08:00

session-tab-registry.ts

fix(browser): close tracked tabs on session cleanup (#36666 )

2026-03-05 16:40:52 -08:00

target-id.ts

…

test-port.ts

…

trash.ts

…