Support existing-session browser CDP endpoints by lifuyue · Pull Request #91736 · openclaw/openclaw

lifuyue · 2026-06-09T16:29:53Z

Summary

Allow driver: "existing-session" browser profiles to use cdpUrl as a Chrome DevTools MCP endpoint.
Preserve auto-connect behavior for userDataDir-only profiles, while endpoint profiles use Chrome MCP --browserUrl / --wsEndpoint and surface the endpoint in status/CLI output.
Improve Chrome MCP connection diagnostics for endpoint failures and DevToolsActivePort auto-connect failures.
Update browser docs and CLI docs to document the existing-session endpoint path.

Verification

PATH=/root/openclaw-repro-56118/node-v24.15.0-linux-x64/bin:$PATH NODE_OPTIONS="--max-old-space-size=768" node scripts/run-vitest.mjs extensions/browser/src/browser/profiles-service.test.ts extensions/browser/src/browser/server-context.existing-session.test.ts extensions/browser/src/browser/chrome-mcp.test.ts extensions/browser/src/cli/browser-cli-manage.test.ts
- Result: 4 files passed, 87 tests passed.
PATH=/root/openclaw-repro-56118/node-v24.15.0-linux-x64/bin:$PATH node_modules/.bin/oxlint --threads=1 extensions/browser/src/browser/chrome-mcp.ts extensions/browser/src/browser/chrome-mcp.test.ts extensions/browser/src/browser/config-mutations.ts extensions/browser/src/browser/profiles-service.ts extensions/browser/src/browser/profiles-service.test.ts extensions/browser/src/browser/server-context.ts extensions/browser/src/browser/server-context.existing-session.test.ts extensions/browser/src/browser/routes/basic.ts extensions/browser/src/cli/browser-cli-manage.ts extensions/browser/src/cli/browser-cli-manage.test.ts
- Result: 0 warnings, 0 errors.
git diff --check
- Result: passed.
pnpm docs:list
- Result: exited 0 after listing docs; local ignored design spec was not committed.

Real behavior proof

Behavior addressed: existing-session browser profiles can attach through a configured DevTools endpoint instead of failing in Chrome MCP auto-connect when DevToolsActivePort is missing.

Real environment tested: remote Ubuntu host under /root/openclaw-repro-56118, Chrome for Testing 149.0.7827.55 running headless with --remote-debugging-port=9222 and user data dir /root/openclaw-repro-56118/chrome-profile.

Exact steps or command run after this patch: used the node browser proxy entrypoint against an isolated OPENCLAW_CONFIG_PATH=/root/openclaw-repro-56118/state-verify/openclaw.json containing:

{
  "browser": {
    "profiles": {
      "chrome-port": {
        "driver": "existing-session",
        "attachOnly": true,
        "cdpUrl": "http://127.0.0.1:9222",
        "color": "#00AA00"
      }
    },
    "defaultProfile": "chrome-port"
  }
}

Evidence after fix: Copied terminal output from the remote OpenClaw checkout after this patch, using the isolated OPENCLAW_CONFIG_PATH=/root/openclaw-repro-56118/state-verify/openclaw.json profile that points chrome-port at http://127.0.0.1:9222:

[browser/server] Browser control listening on http://127.0.0.1:18791/ (auth=token)
server http://127.0.0.1:18791
cdp Chrome/149.0.7827.55 ws-ok
profiles_status 200
profiles [{"name":"chrome-port","transport":"chrome-mcp","driver":"existing-session","cdpUrl":"http://127.0.0.1:9222"},{"name":"openclaw","transport":"cdp","driver":"openclaw","cdpUrl":"http://127.0.0.1:18800"},{"name":"user","transport":"chrome-mcp","driver":"existing-session","cdpUrl":null}]
tabs_status 200
tabs {"running":true,"firstUrl":"about:blank"}

Observed result after fix: the same browser that reproduced #56118 attaches successfully when represented as existing-session + cdpUrl.

What was not tested: full Gateway source startup on the 1.6 GiB repro machine, because earlier source startup/build attempts exhausted resources. The verification uses the same browser proxy/node-host path that exercises the Chrome MCP adapter behind the Gateway route.

clawsweeper · 2026-06-09T16:32:01Z

Codex review: needs maintainer review before merge. Reviewed June 9, 2026, 11:48 PM ET / 03:48 UTC.

Summary
The PR allows existing-session browser profiles to use cdpUrl endpoint attachment, reports the endpoint in status/profile output, improves Chrome MCP endpoint diagnostics, and updates browser docs and focused tests.

PR surface: Source +47, Tests +189, Docs +14. Total +250 across 13 files.

Reproducibility: yes. from source inspection: current main rejects createProfile({ driver: "existing-session", cdpUrl }) before writing config, while the lower-level Chrome MCP adapter already knows how to use that endpoint. I did not run the current-main failure path locally because the review is read-only.

Review metrics: 1 noteworthy metric.

Existing-session endpoint config path: 1 validation path relaxed. The PR makes an existing cdpUrl config field accepted for driver: "existing-session" profile creation, so maintainers should notice the endpoint/security-sensitive surface even though it reuses existing validation.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P2] Let required CI or a maintainer smoke cover full Gateway startup if maintainers want proof beyond the browser proxy/node-host route.

Risk before merge

[P1] The supplied real proof exercises the browser proxy/node-host path and Chrome MCP adapter, but not full Gateway source startup on the constrained repro host.
[P1] The separate top-level browser.cdpUrl plus defaultProfile: "user" normalization path remains owned by fix(browser): honor cdpUrl for user default profile #80143, so this PR should stay scoped to per-profile endpoint creation/status.

Maintainer options:

Decide the mitigation before merge
Land the scoped per-profile existing-session endpoint support after normal CI and maintainer review, while keeping top-level browser.cdpUrl normalization separate.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

No automated repair is queued; the PR has no concrete review finding for ClawSweeper to fix, so the remaining work is normal maintainer review and CI.

Security
Cleared: No concrete security or supply-chain regression was found; the newly accepted endpoint path reuses existing URL parsing, SSRF endpoint validation, and redacted output tests.

Review details

Best possible solution:

Land the scoped per-profile existing-session endpoint support after normal CI and maintainer review, while keeping top-level browser.cdpUrl normalization separate.

Do we have a high-confidence way to reproduce the issue?

Yes, from source inspection: current main rejects createProfile({ driver: "existing-session", cdpUrl }) before writing config, while the lower-level Chrome MCP adapter already knows how to use that endpoint. I did not run the current-main failure path locally because the review is read-only.

Is this the best way to solve the issue?

Yes, this is the best scoped fix for this PR: it changes the profile service, status output, diagnostics, and docs while reusing the existing resolver and Chrome MCP argument builder. Folding the separate top-level default-profile normalization issue into this branch would broaden it unnecessarily.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against bf89552e6783.

Label changes

Label changes:

add proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix terminal output from a real remote Ubuntu setup showing endpoint attach, profile status, and tab listing through the browser proxy/node-host path.

Label justifications:

P2: This is a normal-priority browser/profile bug fix with limited blast radius and targeted proof, not an emergency or broad regression.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes after-fix terminal output from a real remote Ubuntu setup showing endpoint attach, profile status, and tab listing through the browser proxy/node-host path.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix terminal output from a real remote Ubuntu setup showing endpoint attach, profile status, and tab listing through the browser proxy/node-host path.

Evidence reviewed

PR surface:

Source +47, Tests +189, Docs +14. Total +250 across 13 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	6	61	14	+47
Tests	4	193	4	+189
Docs	3	19	5	+14
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	13	273	23	+250

What I checked:

Repository policy read: Root AGENTS.md plus the scoped extensions and docs guides were read fully; the relevant policy is to inspect owner boundaries, config compatibility, docs, tests, and dependency contracts for browser/plugin changes. (AGENTS.md:10, bf89552e6783)
Current main still rejects the requested create-profile path: On current main, createBrowserProfilesService throws when driver is existing-session and cdpUrl is provided, so the PR is not already implemented by current main. (extensions/browser/src/browser/profiles-service.ts:104, bf89552e6783)
Current main already has the lower-level Chrome MCP endpoint transport: The Chrome MCP argument builder already maps an existing-session cdpUrl to --browserUrl or --wsEndpoint, which makes the PR's service/status changes the right narrow surface rather than a duplicate transport implementation. (extensions/browser/src/browser/chrome-mcp.ts:336, bf89552e6783)
PR removes the service-level rejection while preserving endpoint validation: The PR head parses and validates cdpUrl for created profiles without special-casing existing-session rejection, then returns the resolved endpoint instead of hiding it for Chrome MCP profiles. (extensions/browser/src/browser/profiles-service.ts:103, d27f0276bcc8)
PR keeps strict SSRF validation for newly accepted endpoint profiles: The added test accepts loopback existing-session cdpUrl creation and rejects a private-network endpoint when strict SSRF mode is enabled, which covers the main security-sensitive validation change. (extensions/browser/src/browser/profiles-service.test.ts:278, d27f0276bcc8)
Endpoint status output is covered with redaction assertions: The PR adds CLI status coverage showing an existing-session endpoint while asserting credentials and long token values are not printed. (extensions/browser/src/cli/browser-cli-manage.test.ts:98, d27f0276bcc8)

Likely related people:

vincentkoc: Authored the merged Chrome MCP existing-session launch configuration work that already maps cdpUrl to Chrome MCP endpoint flags and touched the same runtime/config/doc surfaces. (role: feature owner / recent area contributor; confidence: high; commits: ab1d1a5c9eb6, 5181e4f7c82b; files: extensions/browser/src/browser/chrome-mcp.ts, extensions/browser/src/browser/config.ts, src/config/types.browser.ts)
steipete: Introduced Chrome MCP existing-session support and later moved browser ownership into the bundled browser plugin, making him a strong routing candidate for the broader behavior boundary. (role: original feature owner / adjacent owner; confidence: high; commits: 593964560ba7, 8eeb7f082975; files: extensions/browser/src/browser/chrome-mcp.ts, extensions/browser/src/browser/profiles-service.ts, docs/tools/browser.md)
Radek Sienkiewicz: Added non-Chrome existing-session userDataDir support across the same Chrome MCP profile, CLI, docs, and doctor surfaces that this PR now combines with endpoint profiles. (role: adjacent owner; confidence: medium; commits: 7deb543624e5; files: extensions/browser/src/browser/chrome-mcp.ts, extensions/browser/src/browser/profiles-service.ts, extensions/browser/src/cli/browser-cli-manage.ts)
scotthuang: Current-main blame for the involved browser profile service, resolver, Chrome MCP adapter, and status lines points to a recent broad sync commit, though the commit subject is not browser-specific. (role: recent current-main line provenance; confidence: low; commits: 696c1ecd2068; files: extensions/browser/src/browser/profiles-service.ts, extensions/browser/src/browser/chrome-mcp.ts, extensions/browser/src/browser/config.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

sallyom · 2026-06-10T14:42:55Z

Maintainer review: I’m comfortable merging this as the scoped fix for #56118.

Why I’m confident enough to merge:

The change is additive: existing existing-session profiles without cdpUrl still use Chrome MCP auto-connect, and managed/raw CDP profiles are not rerouted.
The newly accepted endpoint path reuses the existing CDP URL parsing + SSRF validation instead of adding a bypass.
Chrome MCP already supports this contract (--browserUrl for HTTP(S), --wsEndpoint for WS(S)); this PR wires the profile/create/status/docs path to that existing transport behavior.
Status/profile/CLI output redacts endpoint secrets, and the focused tests cover creation, strict SSRF rejection, Chrome MCP args, server profile reporting, diagnostics, and CLI redaction.
CI and the supplied real behavior proof are green for the intended per-profile endpoint attach path.

I’m intentionally keeping #80143 separate for the overlapping but distinct browser.cdpUrl + defaultProfile: "user" inheritance case.

* Support existing-session browser CDP endpoints * Fix browser existing-session test fixture type --------- Co-authored-by: OpenAI Codex <codex@openai.com>

…26.6.6) (#1040) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666) [Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6) ##### Highlights - Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#91529](openclaw/openclaw#91529), [#91618](openclaw/openclaw#91618), [#91615](openclaw/openclaw#91615), [#91619](openclaw/openclaw#91619), [#91741](openclaw/openclaw#91741), [#91745](openclaw/openclaw#91745), [#91746](openclaw/openclaw#91746), [#91748](openclaw/openclaw#91748), [#91749](openclaw/openclaw#91749), [#91750](openclaw/openclaw#91750), [#91751](openclaw/openclaw#91751), [#91752](openclaw/openclaw#91752), [#91763](openclaw/openclaw#91763), [#89938](openclaw/openclaw#89938)) Thanks [@joshavant](https://github.com/joshavant), [@pgondhi987](https://github.com/pgondhi987), [@mmaps](https://github.com/mmaps), [@eleqtrizit](https://github.com/eleqtrizit), [@shakkernerd](https://github.com/shakkernerd), and [@drobison00](https://github.com/drobison00). - Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#91189](openclaw/openclaw#91189), [#88682](openclaw/openclaw#88682), [#89588](openclaw/openclaw#89588), [#90212](openclaw/openclaw#90212), [#91876](openclaw/openclaw#91876), [#91874](openclaw/openclaw#91874), [#91904](openclaw/openclaw#91904), [#91478](openclaw/openclaw#91478), [#91915](openclaw/openclaw#91915)) Thanks [@codysai001](https://github.com/codysai001), [@alexzhu0](https://github.com/alexzhu0), [@joelnishanth](https://github.com/joelnishanth), [@snowzlm](https://github.com/snowzlm), [@obviyus](https://github.com/obviyus), and [@sallyom](https://github.com/sallyom). - iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#91335](openclaw/openclaw#91335), [#91449](openclaw/openclaw#91449), [#88969](openclaw/openclaw#88969), [#88530](openclaw/openclaw#88530), [#91783](openclaw/openclaw#91783), [#91785](openclaw/openclaw#91785)) Thanks [@omarshahine](https://github.com/omarshahine), [@jmissig](https://github.com/jmissig), and [@colmbrogan](https://github.com/colmbrogan). - Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#91422](openclaw/openclaw#91422), [#89851](openclaw/openclaw#89851), [#91736](openclaw/openclaw#91736), [#91747](openclaw/openclaw#91747), [#91451](openclaw/openclaw#91451), [#80143](openclaw/openclaw#80143)) Thanks [@pgondhi987](https://github.com/pgondhi987), [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@lifuyue](https://github.com/lifuyue), [@eleqtrizit](https://github.com/eleqtrizit), [@LiuwqGit](https://github.com/LiuwqGit), and [@HemantSudarshan](https://github.com/HemantSudarshan). - Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#91531](openclaw/openclaw#91531), [#91538](openclaw/openclaw#91538), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583), [#91598](openclaw/openclaw#91598)) - Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#91830](openclaw/openclaw#91830), [#91882](openclaw/openclaw#91882), [#91590](openclaw/openclaw#91590), [#88630](openclaw/openclaw#88630), [#88768](openclaw/openclaw#88768), [#91696](openclaw/openclaw#91696)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@joshavant](https://github.com/joshavant), [@bdjben](https://github.com/bdjben), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). ##### Changes - CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#89834](openclaw/openclaw#89834), [#90883](openclaw/openclaw#90883)) Thanks [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia). - Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#91256](openclaw/openclaw#91256), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583)) Thanks [@amknight](https://github.com/amknight). - Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#91574](openclaw/openclaw#91574), [#91591](openclaw/openclaw#91591), [#90004](openclaw/openclaw#90004), [#90927](openclaw/openclaw#90927), [#90838](openclaw/openclaw#90838)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@brokemac79](https://github.com/brokemac79), and [@lonexreb](https://github.com/lonexreb). - Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#91324](openclaw/openclaw#91324), [#89138](openclaw/openclaw#89138), [#90457](openclaw/openclaw#90457), [#91837](openclaw/openclaw#91837), [#91851](openclaw/openclaw#91851)) Thanks [@osolmaz](https://github.com/osolmaz), [@mushuiyu886](https://github.com/mushuiyu886), [@ai-hpc](https://github.com/ai-hpc), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#91423](openclaw/openclaw#91423), [#91557](openclaw/openclaw#91557), [#89909](openclaw/openclaw#89909)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh), [@Solvely-Colin](https://github.com/Solvely-Colin), and [@baskduf](https://github.com/baskduf). - Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#90782](openclaw/openclaw#90782), [#89978](openclaw/openclaw#89978), [#91580](openclaw/openclaw#91580), [#91531](openclaw/openclaw#91531)) Thanks [@RomneyDa](https://github.com/RomneyDa) and [@ai-hpc](https://github.com/ai-hpc). ##### Fixes - Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#85679](openclaw/openclaw#85679), [#91450](openclaw/openclaw#91450), [#91566](openclaw/openclaw#91566), [#91840](openclaw/openclaw#91840), [#91590](openclaw/openclaw#91590), [#91361](openclaw/openclaw#91361), [#91895](openclaw/openclaw#91895)) Thanks [@openperf](https://github.com/openperf), [@yetval](https://github.com/yetval), [@joshavant](https://github.com/joshavant), [@wangmiao0668000666](https://github.com/wangmiao0668000666), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#89151](openclaw/openclaw#89151), [#91422](openclaw/openclaw#91422), [#91425](openclaw/openclaw#91425), [#91529](openclaw/openclaw#91529), [#90212](openclaw/openclaw#90212)) Thanks [@joelnishanth](https://github.com/joelnishanth), [@pgondhi987](https://github.com/pgondhi987), [@joshavant](https://github.com/joshavant), and [@snowzlm](https://github.com/snowzlm). - Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#85823](openclaw/openclaw#85823), [#89659](openclaw/openclaw#89659), [#91684](openclaw/openclaw#91684), [#91649](openclaw/openclaw#91649), [#90263](openclaw/openclaw#90263), [#91686](openclaw/openclaw#91686), [#90426](openclaw/openclaw#90426)) Thanks [@itsuzef](https://github.com/itsuzef), [@ladygege](https://github.com/ladygege), [@jacobtomlinson](https://github.com/jacobtomlinson), [@fuller-stack-dev](https://github.com/fuller-stack-dev), and [@shushushv](https://github.com/shushushv). - Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#90666](openclaw/openclaw#90666), [#90678](openclaw/openclaw#90678)) Thanks [@ai-hpc](https://github.com/ai-hpc). - Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#87105](openclaw/openclaw#87105), [#91551](openclaw/openclaw#91551), [#91219](openclaw/openclaw#91219), [#91614](openclaw/openclaw#91614), [#91740](openclaw/openclaw#91740), [#91978](openclaw/openclaw#91978)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev) and [@scotthuang](https://github.com/scotthuang). - Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#91390](openclaw/openclaw#91390), [#91709](openclaw/openclaw#91709), [#91507](openclaw/openclaw#91507), [#91567](openclaw/openclaw#91567), [#88630](openclaw/openclaw#88630), [#91696](openclaw/openclaw#91696)) Thanks [@hxy91819](https://github.com/hxy91819), [@brokemac79](https://github.com/brokemac79), [@RomneyDa](https://github.com/RomneyDa), [@joshavant](https://github.com/joshavant), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). - Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#91581](openclaw/openclaw#91581), [#91599](openclaw/openclaw#91599), [#91547](openclaw/openclaw#91547), [#91591](openclaw/openclaw#91591)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev), [@sallyom](https://github.com/sallyom), and [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#91480](openclaw/openclaw#91480)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#80082](openclaw/openclaw#80082)) Thanks [@davelutztx](https://github.com/davelutztx). - Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#91550](openclaw/openclaw#91550)) Thanks [@joshavant](https://github.com/joshavant). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040

Support existing-session browser CDP endpoints

8d8cfd3

openclaw-barnacle Bot added docs Improvements or additions to documentation gateway Gateway runtime size: M triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels Jun 9, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 10, 2026

Fix browser existing-session test fixture type

d27f027

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 10, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 10, 2026

sallyom self-assigned this Jun 10, 2026

sallyom merged commit ac21e89 into openclaw:main Jun 10, 2026
161 of 163 checks passed

clawsweeper Bot mentioned this pull request Jun 10, 2026

fix(browser): honor cdpUrl for user default profile #80143

Merged

github-actions Bot mentioned this pull request Jun 10, 2026

📡 Upstream Digest — 2026-06-10 16:54 UTC curtismercier/openclaw-mods#1053

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Support existing-session browser CDP endpoints#91736

Support existing-session browser CDP endpoints#91736
sallyom merged 2 commits into
openclaw:mainfrom
lifuyue:codex/fix-existing-session-cdpurl-56118

lifuyue commented Jun 9, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

sallyom commented Jun 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

lifuyue commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Real behavior proof

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sallyom commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

lifuyue commented Jun 9, 2026 •

edited

Loading

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

sallyom commented Jun 10, 2026 •

edited

Loading