fix(browser): honor profile attachOnly for loopback CDP by vincentkoc · Pull Request #31429 · openclaw/openclaw

vincentkoc · 2026-03-02T07:34:21Z

Summary

Describe the problem and fix in 2–5 bullets:

Problem: attachOnly was only read from top-level browser.attachOnly; profile-level browser.profiles.<name>.attachOnly was ignored.
Why it matters: loopback proxy CDP profiles (for example localhost + reverse proxy/tunnel) could still trigger local launch/port checks and fail with Port <n> is already in use.
What changed: added attachOnly to profile schema/types, resolved per-profile attach-only with fallback to global, and switched browser availability checks/status output to use profile-level resolved value.
What did NOT change (scope boundary): no change to remote CDP behavior or launch logic when profile/global attachOnly are both false.

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

User-visible / Behavior Changes

browser.profiles.<name>.attachOnly is now supported and takes precedence over top-level browser.attachOnly for that profile.
Browser status endpoint now reports attach-only based on the selected profile's resolved setting.

Security Impact (required)

New permissions/capabilities? (No)
Secrets/tokens handling changed? (No)
New/changed network calls? (No)
Command/tool execution surface changed? (No)
Data access scope changed? (No)
If any Yes, explain risk + mitigation:

Repro + Verification

Environment

OS: macOS
Runtime/container: Node 22 + pnpm
Model/provider: N/A
Integration/channel (if any): Browser CDP
Relevant config (redacted): browser profile with loopback cdpUrl and attachOnly: true

Steps

Configure browser.attachOnly=false and browser.profiles.remote.attachOnly=true with loopback cdpUrl.
Request browser availability/start for that profile when CDP endpoint is not reachable.
Confirm attach-only error path is used and no local launch is attempted.

Expected

Profile is treated as attach-only without requiring global attachOnly.

Actual

Verified via tests; profile-level attach-only is honored and launch path is skipped.

Evidence

Attach at least one:

Failing test/log before + passing after
Trace/log snippets
Screenshot/recording
Perf numbers (if relevant)

Human Verification (required)

What you personally verified (not just CI), and how:

Verified scenarios: profile-level attachOnly fallback/override in config resolution and runtime ensure path.
Edge cases checked: global attachOnly fallback still applies when profile override is absent.
What you did not verify: full Nginx + Cloudflare tunnel live environment.

Compatibility / Migration

Backward compatible? (Yes)
Config/env changes? (No)
Migration needed? (No)
If yes, exact upgrade steps:

Failure Recovery (if this breaks)

How to disable/revert this change quickly: remove profile-level attachOnly and use top-level browser.attachOnly only.
Files/config to restore: browser config profile entries.
Known bad symptoms reviewers should watch for: profile unexpectedly launching locally despite attachOnly: true.

Risks and Mitigations

List only real risks for this PR. Add/remove entries as needed. If none, write None.

Risk: Existing configs that used unsupported browser.profiles.<name>.attachOnly silently may change behavior now.
- Mitigation: behavior change is intentional and scoped to explicit profile opt-in; tests cover override/fallback resolution.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2fddb4e5bc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

src/browser/server-context.ts

greptile-apps · 2026-03-02T07:59:50Z

Greptile Summary

This PR adds profile-level attachOnly configuration support, allowing individual browser profiles to override the global browser.attachOnly setting. The implementation follows a clean fallback pattern where profile-specific settings take precedence over global settings.

Key changes:

Added attachOnly?: boolean to BrowserProfileConfig type and schema
Profile resolution uses profile.attachOnly ?? resolved.attachOnly for proper fallback
Updated runtime checks to use resolved profile-level value instead of global setting
Added comprehensive test coverage for both fallback and override scenarios

Implementation quality:

Type-safe with proper optional-to-required resolution pattern
Backwards compatible (optional field with sensible defaults)
Clean separation between config (optional) and resolved (required) types
Well-tested with clear test cases covering the core scenarios

Confidence Score: 5/5

This PR is safe to merge with minimal risk
The change is well-contained, backwards compatible, and follows existing patterns in the codebase. The resolution logic using nullish coalescing (??) correctly handles the fallback from profile to global config. Test coverage validates both the override and fallback paths, and the change only affects the browser launch decision logic which is already well-tested.
No files require special attention

_{Last reviewed commit: 2fddb4e}

vincentkoc · 2026-03-02T08:44:39Z

Addressed this review point in latest commits:

Moved attach-only/remote websocket-failure handling ahead of the loopback ownership error path in ensureBrowserAvailable.
Added regression coverage for the exact HTTP reachable + WS handshake fails + attachOnly=true + loopback scenario, asserting we surface the attach-only websocket error (not Port ... is in use).

Validation run:

pnpm vitest run src/browser/server-context.remote-tab-ops.test.ts

* main: (212 commits) fix(ci): annotate feishu hoisted mock type fix(ci): align strict nullable typing across channels and ui refactor(tests): dedupe macos ipc smoke setup blocks refactor(tests): dedupe ios gateway and deeplink fixtures refactor(tests): dedupe openclawkit chat test helpers test(runtime): trim timer-heavy regression suites test(config): reuse fixtures for faster validation test(cli): reduce update/program suite overhead refactor(tests): dedupe ios defaults and setup-code helpers refactor(tests): dedupe swift gateway and chat fixtures Diffs: extend image quality configs and add PDF as a format option (openclaw#31342) refactor(scripts): dedupe installer CLI verification refactor(extensions): dedupe channel config, onboarding, and monitors refactor(core): extract shared usage, auth, and display helpers refactor(ui): dedupe state, views, and usage helpers refactor(scripts): dedupe guard checks and smoke helpers fix(browser): honor profile attachOnly for loopback CDP (openclaw#31429) [AI-assisted] test: fix typing and test fixture issues (openclaw#31444) chore(tsgo/lint): fix CI errors fix(browser): support configurable CDP auto-port range start (openclaw#31352) ...

* config(browser): allow profile attachOnly field * config(schema): accept profile attachOnly * browser(config): resolve per-profile attachOnly * browser(runtime): honor profile attachOnly checks * browser(routes): expose profile attachOnly in status * config(labels): add browser profile attachOnly label * config(help): document browser profile attachOnly * test(config): cover profile attachOnly resolution * test(browser): cover profile attachOnly runtime path * test(config): include profile attachOnly help target * changelog: note profile attachOnly override * browser(runtime): prioritize attachOnly over loopback ownership error * test(browser): cover attachOnly ws-failure ownership path

vincentkoc added 11 commits March 1, 2026 23:33

config(browser): allow profile attachOnly field

6a487cb

config(schema): accept profile attachOnly

77e5f26

browser(config): resolve per-profile attachOnly

5cfcd14

browser(runtime): honor profile attachOnly checks

9115ce6

browser(routes): expose profile attachOnly in status

89c6e82

config(labels): add browser profile attachOnly label

f2917fe

config(help): document browser profile attachOnly

93e9344

test(config): cover profile attachOnly resolution

044d1f0

test(browser): cover profile attachOnly runtime path

e785f45

test(config): include profile attachOnly help target

8918028

changelog: note profile attachOnly override

d75f9f5

vincentkoc mentioned this pull request Mar 2, 2026

[Bug]: attachOnly + localhost CDP fails when port is in use by proxy #20595

Closed

openclaw-barnacle bot added size: S maintainer Maintainer-authored PR labels Mar 2, 2026

vincentkoc added 2 commits March 1, 2026 23:47

Merge branch 'main' into vincentkoc-code/fix-profile-attachonly-20595

c2f84e6

Merge branch 'main' into vincentkoc-code/fix-profile-attachonly-20595

2fddb4e

vincentkoc marked this pull request as ready for review March 2, 2026 07:52

chatgpt-codex-connector bot reviewed Mar 2, 2026

View reviewed changes

src/browser/server-context.ts Show resolved Hide resolved

Merge branch 'main' into vincentkoc-code/fix-profile-attachonly-20595

894a569

vincentkoc added 2 commits March 2, 2026 00:44

browser(runtime): prioritize attachOnly over loopback ownership error

3928dd3

test(browser): cover attachOnly ws-failure ownership path

0e128fa

vincentkoc merged commit 5d53b61 into openclaw:main Mar 2, 2026
26 checks passed

This was referenced Mar 2, 2026

fix(browser): skip port check when attachOnly is enabled #20611

Closed

Unable to use browser container openclaw-rocks/k8s-operator#214

Closed

vabole mentioned this pull request Mar 2, 2026

ops: decision needed for upstream sync (1 disputed files) vabole/openclaw#5

Closed

1 task

github-actions bot mentioned this pull request Mar 2, 2026

📡 Upstream Digest — 2026-03-02 10:36 UTC curtismercier/openclaw-mods#161

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(browser): honor profile attachOnly for loopback CDP#31429

fix(browser): honor profile attachOnly for loopback CDP#31429
vincentkoc merged 16 commits intoopenclaw:mainfrom
vincentkoc:vincentkoc-code/fix-profile-attachonly-20595

vincentkoc commented Mar 2, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

Uh oh!

greptile-apps bot commented Mar 2, 2026

Uh oh!

vincentkoc commented Mar 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

vincentkoc commented Mar 2, 2026

Summary

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

User-visible / Behavior Changes

Security Impact (required)

Repro + Verification

Environment

Steps

Expected

Actual

Evidence

Human Verification (required)

Compatibility / Migration

Failure Recovery (if this breaks)

Risks and Mitigations

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

greptile-apps bot commented Mar 2, 2026

Greptile Summary

Confidence Score: 5/5

Uh oh!

vincentkoc commented Mar 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant