fix: enable browser tools with full profile by amknight · Pull Request #76557 · openclaw/openclaw

amknight · 2026-05-03T08:17:02Z

Summary

tools.profile: "full" semantically meant no filtering by relying on an absent profile policy, and plugin optional-tool allowlist helpers did not understand the "*" wildcard even though adjacent manifest allowlist logic already did.

This PR:

makes the full core tool profile explicit with allow: ["*"]
teaches optional plugin tool allowlist checks to accept "*"
adds regression coverage for browser availability under the full profile and wildcard plugin allowlists

Tests

Reported by the local fanout worker:

13 focused test files passed
232 tests passed
pnpm exec oxfmt --check passed on changed files

Local orchestration report

A local, uncommitted fanout report exists at:

/Users/aknight/Development/worktrees/openclaw-issues/_runs/20260503T072204Z/reports/issue-76507.md

clawsweeper · 2026-05-03T08:18:41Z

Codex review: passed.

Summary
The PR makes tools.profile: "full" resolve to a wildcard allowlist, teaches plugin optional-tool allowlist checks to honor *, and updates regression tests, docs, and the changelog for browser tool availability.

Reproducibility: yes. source-level reproduction is high confidence: current main makes full resolve to no explicit allowlist and the optional plugin allowlist helpers do not accept *. I did not run a live browser session in this read-only review.

Next step before merge
No repair job is needed; the automerge path can rely on exact-head checks and mergeability because this review found no actionable patch defect.

Security
Cleared: The diff is limited to profile/plugin allowlist logic, tests, docs, and changelog, with no dependency, workflow, secret, package, or supply-chain changes.

Review details

Best possible solution:

Land this PR through the exact-head automerge/maintainer gate after required checks remain green; the wildcard policy change is the narrow generic fix.

Do we have a high-confidence way to reproduce the issue?

Yes, source-level reproduction is high confidence: current main makes full resolve to no explicit allowlist and the optional plugin allowlist helpers do not accept *. I did not run a live browser session in this read-only review.

Is this the best way to solve the issue?

Yes. Reusing the existing wildcard allowlist contract is narrower and more maintainable than adding browser-specific exceptions, and the PR covers both core profile resolution and plugin optional-tool filtering.

What I checked:

Current main leaves full profile implicit: CORE_TOOL_PROFILES.full is {}, and resolveCoreToolProfilePolicy returns undefined when a profile has no allow or deny list, so current main does not produce an explicit full-profile allowlist. (src/agents/tool-catalog.ts:334, 9772ce6ce975)
Current main optional plugin helper lacks wildcard handling: isOptionalToolAllowed and isOptionalToolEntryPotentiallyAllowed return false for empty allowlists and only match exact tool/plugin entries or group:plugins; they do not accept * on main. (src/plugins/tools.ts:94, 9772ce6ce975)
Wildcard is already a core allowlist contract: The manifest tool allowlist path already treats * as granting all manifest-declared plugin tools, and the shared glob matcher compiles * as an all-tools match. (src/plugins/tools.ts:303, 9772ce6ce975)
Browser is a plugin-owned tool on the affected path: The browser plugin declares contracts.tools: ["browser"] and registers the browser agent tool through the plugin API, so the fix belongs in the generic profile/plugin resolver rather than a browser-only special case. (extensions/browser/openclaw.plugin.json:8, 9772ce6ce975)
PR diff is focused on the policy gap: The PR changes full to allow: ["*"], adds wildcard checks to both optional plugin allowlist helpers, and adds focused source, test, docs, and changelog coverage for [Bug]: Browser tool missing from agent tool list with tools.profile: full (regression in 2026.5.2) #76507. (src/agents/tool-catalog.ts:331, b5329de33c0b)
Exact-head PR state and checks: The GitHub API reports this PR open, non-draft, mergeable clean, labeled clawsweeper:automerge, and exact head b5329de33c0b1b670c438a0d51baff53c4a3e071; check-runs across both result pages showed no failing conclusions. (b5329de33c0b)

Likely related people:

vincentkoc: Local blame on the current full profile table and plugin tool allowlist helpers points to the recent static runtime asset refactor that owns these central lines on main. (role: recent maintainer; confidence: high; commits: c7bbb3f9af36; files: src/agents/tool-catalog.ts, src/plugins/tools.ts, extensions/browser/openclaw.plugin.json)
shakkernerd: The linked bug context identifies recent manifest contract and manifest availability changes on the plugin tool eligibility path, which are directly adjacent to this PR's resolver change. (role: adjacent feature-history owner; confidence: medium; commits: 7641783d6b0e, 3cf1dd982ba0, e6825fceaa04; files: src/plugins/tools.ts, src/plugins/manifest-tool-availability.ts, extensions/browser/openclaw.plugin.json)
steipete: Prior review context ties earlier optional plugin tools and browser plugin runtime packaging work to the same tool exposure surface. (role: feature-history owner; confidence: medium; commits: 6da6582cedf7, 197510f69302; files: src/plugins/tools.ts, extensions/browser/plugin-registration.ts)

Codex review notes: model gpt-5.5, reasoning high; reviewed against 9772ce6ce975.

amknight · 2026-05-03T10:49:26Z

/clawsweeper re-review

clawsweeper · 2026-05-03T10:50:19Z

🦞🦞
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.

amknight · 2026-05-03T11:07:41Z

/clawsweeper automerge

clawsweeper · 2026-05-03T11:08:44Z

🦞🦞
ClawSweeper merged this PR after the passing review.

Source: clawsweeper[bot]
Feedback: structured ClawSweeper verdict: pass (sha=b5329de33c0b1b670c438a0d51baff53c4a3e071)
Merge status: merged by ClawSweeper automerge
Merged at: 2026-05-03T11:12:31Z
Merge commit: 1e4098134aa8

What merged:

The PR makes tools.profile: "full" resolve to a wildcard allowlist, teaches plugin optional-tool allowlist checks to honor *, and updates regression tests, docs, and the changelog for browser tool availability.
Reproducibility: yes. source-level reproduction is high confidence: current main makes full resolve to no ... plugin allowlist helpers do not accept *. I did not run a live browser session in this read-only review.

Automerge notes:

PR branch already contained follow-up commit before automerge: docs: update full profile description and add changelog for [Bug]: Browser tool missing from agent tool list with tools.profile: full (regression in 2026.5.2) #76507

The automerge loop is complete.

Automerge progress:

2026-05-03 11:08:43 UTC review queued [`b5329de33c0b`](https://github.com/openclaw/openclaw/commit/b5329de33c0b1b670c438a0d51baff53c4a3e071) (queued)
2026-05-03 11:12:19 UTC review passed [`b5329de33c0b`](https://github.com/openclaw/openclaw/commit/b5329de33c0b1b670c438a0d51baff53c4a3e071) (structured ClawSweeper verdict: pass (sha=b5329de33c0b1b670c438a0d51baff53c4a3e...)
2026-05-03 11:12:32 UTC merged [`b5329de33c0b`](https://github.com/openclaw/openclaw/commit/b5329de33c0b1b670c438a0d51baff53c4a3e071) (merged by ClawSweeper automerge)

Summary: - The PR makes `tools.profile: "full"` resolve to a wildcard allowlist, teaches plugin optional-tool allowlist checks to honor `*`, and updates regression tests, docs, and the changelog for browser tool availability. - Reproducibility: yes. source-level reproduction is high confidence: current main makes `full` resolve to no ... plugin allowlist helpers do not accept `*`. I did not run a live browser session in this read-only review. Automerge notes: - PR branch already contained follow-up commit before automerge: docs: update full profile description and add changelog for openclaw#76507 Validation: - ClawSweeper review passed for head b5329de. - Required merge gates passed before the squash merge. Prepared head SHA: b5329de Review: openclaw#76557 (comment) Co-authored-by: Alex Knight <aknight@atlassian.com>

Summary: - The PR makes `tools.profile: "full"` resolve to a wildcard allowlist, teaches plugin optional-tool allowlist checks to honor `*`, and updates regression tests, docs, and the changelog for browser tool availability. - Reproducibility: yes. source-level reproduction is high confidence: current main makes `full` resolve to no ... plugin allowlist helpers do not accept `*`. I did not run a live browser session in this read-only review. Automerge notes: - PR branch already contained follow-up commit before automerge: docs: update full profile description and add changelog for #76507 Validation: - ClawSweeper review passed for head b5329de33c0b1b670c438a0d51baff53c4a3e071. - Required merge gates passed before the squash merge. Prepared head SHA: b5329de33c0b1b670c438a0d51baff53c4a3e071 Review: openclaw/openclaw#76557 (comment) Co-authored-by: Alex Knight <aknight@atlassian.com>

Summary: - The PR makes `tools.profile: "full"` resolve to a wildcard allowlist, teaches plugin optional-tool allowlist checks to honor `*`, and updates regression tests, docs, and the changelog for browser tool availability. - Reproducibility: yes. source-level reproduction is high confidence: current main makes `full` resolve to no ... plugin allowlist helpers do not accept `*`. I did not run a live browser session in this read-only review. Automerge notes: - PR branch already contained follow-up commit before automerge: docs: update full profile description and add changelog for openclaw#76507 Validation: - ClawSweeper review passed for head b5329de. - Required merge gates passed before the squash merge. Prepared head SHA: b5329de Review: openclaw#76557 (comment) Co-authored-by: Alex Knight <aknight@atlassian.com>

fix: enable browser tools with full profile (#76507)

ba5cd16

openclaw-barnacle Bot added agents Agent runtime and tooling size: S maintainer Maintainer-authored PR labels May 3, 2026

amknight marked this pull request as ready for review May 3, 2026 10:42

docs: update full profile description and add changelog for #76507

b5329de

openclaw-barnacle Bot added the docs Improvements or additions to documentation label May 3, 2026

clawsweeper Bot added the clawsweeper:automerge Maintainer opted this PR into bounded ClawSweeper-reviewed automerge label May 3, 2026

clawsweeper Bot merged commit 1e40981 into main May 3, 2026
105 of 106 checks passed

clawsweeper Bot deleted the ak/issue-76507-bug-browser-tool-missing-from-agent-tool-list-wi branch May 3, 2026 11:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: enable browser tools with full profile#76557

fix: enable browser tools with full profile#76557
clawsweeper[bot] merged 2 commits into
mainfrom
ak/issue-76507-bug-browser-tool-missing-from-agent-tool-list-wi

amknight commented May 3, 2026

Uh oh!

clawsweeper Bot commented May 3, 2026 •

edited

Loading

Uh oh!

amknight commented May 3, 2026

Uh oh!

clawsweeper Bot commented May 3, 2026

Uh oh!

amknight commented May 3, 2026

Uh oh!

clawsweeper Bot commented May 3, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

amknight commented May 3, 2026

Summary

Tests

Local orchestration report

Uh oh!

clawsweeper Bot commented May 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

amknight commented May 3, 2026

Uh oh!

clawsweeper Bot commented May 3, 2026

Uh oh!

amknight commented May 3, 2026

Uh oh!

clawsweeper Bot commented May 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

clawsweeper Bot commented May 3, 2026 •

edited

Loading

clawsweeper Bot commented May 3, 2026 •

edited

Loading