fix(browser): validate discovered CDP websocket URLs by eleqtrizit · Pull Request #91747 · openclaw/openclaw

eleqtrizit · 2026-06-09T18:47:09Z

Summary

Fixes the browser remote CDP raw /json/list fallback so discovered per-tab WebSocket endpoints are checked against the existing CDP endpoint policy before being returned to downstream tab consumers.

Changes

Validate each selectable normalized discovered webSocketDebuggerUrl with assertCdpEndpointAllowed() before returning tab.wsUrl.
Keep browser-internal target filtering before endpoint validation so non-selectable targets remain ignored.
Add regression coverage for strict CDP policy rejecting a blocked discovered WebSocket endpoint.
Update fallback test fixtures to use the harness-approved remote CDP host instead of a DNS-only example host.

Validation

node scripts/run-vitest.mjs run extensions/browser/src/browser/server-context.remote-profile-tab-ops.fallback.test.ts
node scripts/run-vitest.mjs run extensions/browser/src/browser/server-context.remote-profile-tab-ops.fallback.test.ts extensions/browser/src/browser/cdp.helpers.internal.test.ts extensions/browser/src/browser/chrome.loopback-ssrf.integration.test.ts
git diff --check
.agents/skills/autoreview/scripts/autoreview --mode local

Notes

AI-assisted change.
CHANGELOG.md was not updated.
USER.md worklog was appended locally and intentionally left out of the commit.
Real behavior proof: targeted browser-extension regression tests exercise the affected remote CDP fallback path through the repo test harness; no live remote browser provider was used.

clawsweeper · 2026-06-09T18:49:17Z

Codex review: needs maintainer review before merge. Reviewed June 9, 2026, 8:09 PM ET / 00:09 UTC.

Summary
The PR validates raw CDP discovered WebSocket endpoints from /json/list, /json/new, and Playwright termination cleanup with the existing SSRF policy, plus focused regression tests.

PR surface: Source +21, Tests +215. Total +236 across 10 files.

Reproducibility: yes. Current main source shows raw CDP fallback paths returning discovered WebSocket URLs without endpoint validation, and the PR proof demonstrates the after-fix blocked result against a local CDP-compatible endpoint.

Review metrics: 1 noteworthy metric.

Strict CDP checks: 3 enforcement points added. The PR changes strict-mode behavior for raw CDP list, raw CDP create, and cleanup discovery paths that previously trusted discovered WebSocket URLs.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

[P1] Strict-mode users whose approved CDP HTTP endpoint advertises a private or link-local per-tab WebSocket will now fail closed instead of using that tab; this is the intended security boundary but can break existing remote CDP setups.

Maintainer options:

Accept strict-mode fail-closed validation (recommended)
Merge after maintainer acceptance that strict SSRF policy rejects discovered per-tab WebSocket URLs outside the allowed CDP host, even when the CDP HTTP endpoint itself is reachable.
Require a compatibility escape hatch
If maintainers need to preserve providers that advertise private WebSocket hosts, require an explicit documented opt-in or provider-specific proof before merge.

Next step before merge

No automated repair is needed; the remaining action is maintainer acceptance of a protected-label, compatibility-sensitive strict-SSRF behavior change.

Security
Cleared: The diff strengthens an existing browser CDP SSRF boundary and does not add dependencies, workflow changes, or new code-execution surfaces.

Review details

Best possible solution:

Land the targeted validation after maintainers explicitly accept the strict-mode fail-closed upgrade impact and keep the existing SSRF policy as the single source of truth.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main source shows raw CDP fallback paths returning discovered WebSocket URLs without endpoint validation, and the PR proof demonstrates the after-fix blocked result against a local CDP-compatible endpoint.

Is this the best way to solve the issue?

Yes. Reusing assertCdpEndpointAllowed() at each discovery boundary is the narrowest maintainable fix; the only unresolved question is maintainer acceptance of the fail-closed compatibility effect.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 48ec58a5844f.

Label changes

Label justifications:

P1: The PR addresses a browser CDP SSRF policy bypass affecting strict-mode users and the browser control security boundary.
merge-risk: 🚨 compatibility: Existing remote CDP setups can fail closed if their reachable HTTP endpoint advertises a per-tab WebSocket on a host that strict SSRF policy blocks.
rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): Contributor-supplied terminal proof shows after-fix strict-policy rejection for both raw /json/list and /json/new discovered link-local WebSocket URLs, with private values redacted.
proof: sufficient: Contributor real behavior proof is sufficient. Contributor-supplied terminal proof shows after-fix strict-policy rejection for both raw /json/list and /json/new discovered link-local WebSocket URLs, with private values redacted.

Evidence reviewed

PR surface:

Source +21, Tests +215. Total +236 across 10 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	5	27	6	+21
Tests	5	221	6	+215
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	10	248	12	+236

What I checked:

Current main gap: Current main fetches raw /json/list, normalizes webSocketDebuggerUrl, and returns selectable tabs without applying assertCdpEndpointAllowed() to the discovered per-tab WebSocket URL. (extensions/browser/src/browser/server-context.tab-ops.ts:234, 48ec58a5844f)
PR raw list/create validation: The PR head validates selectable raw /json/list WebSocket URLs before returning tabs, and validates the raw /json/new created target WebSocket URL before aliasing the new tab. (extensions/browser/src/browser/server-context.tab-ops.ts:247, 1f8597805430)
PR termination cleanup validation: The PR passes the SSRF policy into termination-path /json/list discovery and validates the target WebSocket URL before opening the best-effort cleanup socket. (extensions/browser/src/browser/pw-session.ts:1534, 1f8597805430)
Existing helper contract: assertCdpEndpointAllowed() already covers http, https, ws, and wss, allows loopback only through the scoped CDP policy exception, and maps blocked SSRF resolution to BrowserCdpEndpointBlockedError. (extensions/browser/src/browser/cdp.helpers.ts:75, 1f8597805430)
Regression coverage: New and updated tests cover blocked discovered WebSocket URLs from raw tab listing, raw tab creation, and Playwright termination cleanup without opening a socket. (extensions/browser/src/browser/server-context.remote-profile-tab-ops.fallback.test.ts:116, 1f8597805430)
Security docs contract: Browser strict SSRF policy is documented to block private/internal destinations unless explicitly opted in, which matches the new fail-closed behavior for discovered CDP WebSocket endpoints. Public docs: docs/gateway/security/index.md. (docs/gateway/security/index.md:1173, 48ec58a5844f)

Likely related people:

Shakker: Current blame in this checkout attributes the central browser CDP tab ops, termination cleanup, and CDP endpoint helper lines to the same recent commit; history depth is shallow, so this is a routing hint rather than full ownership proof. (role: recent area contributor; confidence: medium; commits: d48778994fb2; files: extensions/browser/src/browser/server-context.tab-ops.ts, extensions/browser/src/browser/pw-session.ts, extensions/browser/src/browser/cdp.helpers.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

eleqtrizit · 2026-06-09T19:23:52Z

Behavioral proof

This addresses the ClawSweeper asks from the latest review:

/json/new is now covered by the same discovered WebSocket endpoint validation as /json/list.
I ran a redacted runtime proof against a real local CDP-compatible HTTP endpoint, not just the Vitest harness.

Proof setup:

Started a local CDP-style HTTP endpoint on 127.0.0.1.
Configured strict browser SSRF policy: dangerouslyAllowPrivateNetwork=false.
Exercised production createProfileTabOps() against the raw CDP fallback path.
Disabled the optional Playwright helper load for this proof so the run reaches the raw /json/list and /json/new CDP fallback code paths that this PR changes.
The endpoint advertised link-local discovered WebSocket URLs for both list and create responses.

Runtime proof command:

node --import tsx --loader ./.codex-proof/pw-ai-unavailable-loader.mjs ./.codex-proof/cdp-ssrf-proof.ts

Runtime proof output:

CDP SSRF behavioral proof
configured cdpUrl: http://127.0.0.1:42391/chrome?token=<redacted>
strict policy: dangerouslyAllowPrivateNetwork=false
advertised list websocket: ws://169.254.169.254/devtools/page/T_LIST
list result: blocked with BrowserCdpEndpointBlockedError
advertised created websocket: ws://169.254.169.254/devtools/page/T_NEW
create result: blocked with BrowserCdpEndpointBlockedError
requests observed:
- GET /chrome/json/list?token=<redacted>
- GET /chrome/json/version?token=<redacted>
- PUT /chrome/json/new?token=<redacted>&url=about%3Ablank

Additional validation:

node scripts/run-vitest.mjs run extensions/browser/src/browser/server-context.remote-profile-tab-ops.fallback.test.ts

Result:

Test Files  1 passed (1)
Tests       12 passed (12)

node scripts/run-vitest.mjs run extensions/browser/src/browser/server-context.remote-profile-tab-ops.fallback.test.ts extensions/browser/src/browser/cdp.helpers.internal.test.ts extensions/browser/src/browser/chrome.loopback-ssrf.integration.test.ts

Result:

Test Files  3 passed (3)
Tests       42 passed (42)

git diff --check upstream/main...HEAD

Result: passed.

The temporary proof files were removed after the run. CHANGELOG.md was not updated.

eleqtrizit · 2026-06-09T19:57:35Z

@clawsweeper re-review

clawsweeper · 2026-06-09T19:57:42Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27232132575
Updated: 2026-06-09T20:10:28.874Z

eleqtrizit · 2026-06-09T20:30:26Z

@clawsweeper re-review

clawsweeper · 2026-06-09T20:30:29Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Failed
Detail: The targeted re-review did not finish cleanly. Check the workflow run for details.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27233932104
Updated: 2026-06-09T20:49:52.981Z

…o-base-to-string

eleqtrizit · 2026-06-09T20:49:55Z

Summary of Checks Performed

Relevance

The issue was confirmed as a legitimate CDP SSRF policy bypass — in scope per SECURITY.md, not yet fixed on main, and fixable with a targeted backward-compatible change using existing SSRF infrastructure. The vulnerability allows a policy-approved CDP HTTP endpoint to return a webSocketDebuggerUrl pointing to a blocked private/link-local endpoint (e.g., AWS metadata), bypassing the existing SSRF boundary. All reviewers verified the vulnerable code path on current origin/main.

Compatibility

The change reuses the existing assertCdpEndpointAllowed() helper (which already supports http, https, ws, and wss protocols) without adding any new config options, public APIs, CLI flags, gateway protocol fields, plugin manifest changes, or docs surfaces. No migration, no new defaults, no breaking changes. Operators with dangerouslyAllowPrivateNetwork: true are unaffected. The fix aligns the raw CDP fallback paths with sibling CDP discovery paths that already validate discovered WebSocket URLs. Boundary inventory scripts report no import violations.

ClawSweeper

ClawSweeper reviewed the PR and identified two concerns: the sibling /json/new fallback path and missing real behavior proof. Both were addressed — the /json/new path received the same SSRF validation, and a real behavioral proof was run against a local CDP endpoint exercising both raw CDP fallback paths with strict SSRF policy, confirming both paths correctly reject blocked discovered WebSocket URLs with BrowserCdpEndpointBlockedError.

Code Reviews Completed

Multiple code reviews verified the fix across several dimensions: security boundary correctness, code quality, backward compatibility, test coverage, sibling path parity, downstream consumer analysis, error handling, and CI validation. All reviews confirmed the core fix is sound, targeted, and well-implemented. A lint issue (oxlint no-base-to-string in a test file) was identified during CI and fixed.

All Checks Completed

Check	Result
Unit tests — CDP fallback SSRF regression	✅ Passed (12 tests)
Unit tests — CDP helpers + Chrome SSRF integration	✅ Passed (42 tests, 3 files)
Real behavioral proof — local CDP endpoint	✅ Both `/json/list` and `/json/new` blocked with `BrowserCdpEndpointBlockedError`
`git diff --check`	✅ Passed
Auto-review (`autoreview --mode local`)	✅ Clean, no actionable findings
Import boundary checks	✅ No violations
CI — `preflight`	✅ Passed
CI — `security-fast`	✅ Passed
CI — `check-prod-types`	✅ Passed
CI — `check-test-types`	✅ Passed
CI — `check-guards`	✅ Passed
CI — `check-lint`	✅ Passed (after fix)
CI — `check-additional-extension-bundled`	✅ Passed (after fix)
CI — `check-dependencies`	✅ Passed
CI — Node core test shards (80+)	✅ Passed
CI — Agentic test shards	✅ Passed
CI — Extension boundary lanes	✅ Passed
Code review — security boundary correctness	✅ All CDP discovery paths now validated
Code review — backward compatibility	✅ No breaking changes
Code review — sibling path parity	✅ Playwright, `/json/list`, `/json/new`, `cdp.ts`, `chrome.ts` all consistent
Code review — downstream consumer analysis	✅ Validation at tab-listing layer protects all consumers

Abbreviations

Abbreviation	Definition
CDP	Chrome DevTools Protocol — the protocol used to control Chromium browser tabs
SSRF	Server-Side Request Forgery — an attack that tricks a server into making requests to internal/private resources
CI	Continuous Integration — automated test and validation pipeline
LOC	Lines of Code
GHSA	GitHub Security Advisory
CVE	Common Vulnerabilities and Exposures — a standard for identifying security vulnerabilities

eleqtrizit · 2026-06-10T00:03:05Z

Behavioral proof

This addresses the latest ClawSweeper review ask: the production Playwright termination cleanup callers now pass the existing ssrfPolicy into forceDisconnectPlaywrightForTarget, and the tests prove the click abort, evaluate abort, and navigation retry paths preserve that policy.

Behavior addressed: strict browser CDP SSRF policy must apply to discovered WebSocket endpoints from raw CDP fallback paths and to best-effort Playwright termination cleanup.

Real environment tested: local CDP-compatible HTTP endpoint bound on 127.0.0.1, with the local endpoint explicitly allowlisted and strict policy enabled. The endpoint advertised link-local WebSocket URLs for both raw tab listing and raw tab creation. The optional Playwright module was made unavailable only for this proof so the run exercised the raw CDP fallback code paths changed by this PR.

Exact command run after this patch:

node --loader ./.codex-proof/pw-ai-unavailable-loader.mjs --import tsx --input-type=module <runtime proof script>

Evidence after fix:

CDP SSRF behavioral proof
configured cdpUrl: http://127.0.0.1:32817/chrome?token=<redacted>
strict policy: dangerouslyAllowPrivateNetwork=false; allowedHostnames includes 127.0.0.1
optional Playwright module: unavailable for raw fallback proof
advertised list websocket: ws://169.254.169.254/devtools/page/T_LIST
list result: blocked with BrowserCdpEndpointBlockedError
advertised created websocket: ws://169.254.169.254/devtools/page/T_NEW
create result: blocked with BrowserCdpEndpointBlockedError
requests observed:
- GET /chrome/json/list?token=<redacted>
- GET /chrome/json/version?token=<redacted>
- PUT /chrome/json/new?token=<redacted>&url=about%3Ablank

Observed result after fix: the policy-approved local CDP HTTP endpoint was reachable, but both advertised link-local discovered WebSocket URLs were rejected with BrowserCdpEndpointBlockedError before being returned or used.

Additional focused validation after the ClawSweeper fix:

node scripts/run-vitest.mjs run extensions/browser/src/browser/pw-tools-core.interactions.evaluate.abort.test.ts extensions/browser/src/browser/pw-tools-core.snapshot.navigate-guard.test.ts extensions/browser/src/browser/pw-tools-core.browser-ssrf-guard.test.ts extensions/browser/src/browser/pw-session.termination-cdp-ssrf.test.ts

Test Files  4 passed (4)
Tests       19 passed (19)

node scripts/run-vitest.mjs run extensions/browser/src/browser/pw-session.termination-cdp-ssrf.test.ts extensions/browser/src/browser/pw-tools-core.interactions.evaluate.abort.test.ts extensions/browser/src/browser/pw-tools-core.snapshot.navigate-guard.test.ts

Test Files  3 passed (3)
Tests       9 passed (9)

node scripts/run-vitest.mjs run extensions/browser/src/browser/server-context.remote-profile-tab-ops.fallback.test.ts extensions/browser/src/browser/cdp.helpers.internal.test.ts extensions/browser/src/browser/chrome.loopback-ssrf.integration.test.ts extensions/browser/src/browser/pw-tools-core.browser-ssrf-guard.test.ts

Test Files  4 passed (4)
Tests       52 passed (52)

git diff --check upstream/main...HEAD
git diff --check
.agents/skills/autoreview/scripts/autoreview --mode local

Results: both diff checks passed; autoreview reported no accepted/actionable findings.

What was not tested: no external hosted browser provider was used. The proof uses a local CDP-compatible endpoint so the advertised blocked WebSocket behavior is deterministic and redacted. Temporary proof files were removed after the run. CHANGELOG.md was not updated, and USER.md remains uncommitted.

eleqtrizit · 2026-06-10T00:03:08Z

@clawsweeper re-review

clawsweeper · 2026-06-10T00:03:11Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27243867004
Updated: 2026-06-10T00:10:11.942Z

* fix(browser): validate discovered cdp websocket urls * fix(browser): validate cdp tab creation websockets * fix(browser): guard termination cdp websocket * fix(browser): use .toString() instead of String() to satisfy oxlint no-base-to-string * fix(browser): avoid cdp termination assertion stringification * fix(browser): preserve cdp ssrf policy

…26.6.6) (#1040) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666) [Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6) ##### Highlights - Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#91529](openclaw/openclaw#91529), [#91618](openclaw/openclaw#91618), [#91615](openclaw/openclaw#91615), [#91619](openclaw/openclaw#91619), [#91741](openclaw/openclaw#91741), [#91745](openclaw/openclaw#91745), [#91746](openclaw/openclaw#91746), [#91748](openclaw/openclaw#91748), [#91749](openclaw/openclaw#91749), [#91750](openclaw/openclaw#91750), [#91751](openclaw/openclaw#91751), [#91752](openclaw/openclaw#91752), [#91763](openclaw/openclaw#91763), [#89938](openclaw/openclaw#89938)) Thanks [@joshavant](https://github.com/joshavant), [@pgondhi987](https://github.com/pgondhi987), [@mmaps](https://github.com/mmaps), [@eleqtrizit](https://github.com/eleqtrizit), [@shakkernerd](https://github.com/shakkernerd), and [@drobison00](https://github.com/drobison00). - Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#91189](openclaw/openclaw#91189), [#88682](openclaw/openclaw#88682), [#89588](openclaw/openclaw#89588), [#90212](openclaw/openclaw#90212), [#91876](openclaw/openclaw#91876), [#91874](openclaw/openclaw#91874), [#91904](openclaw/openclaw#91904), [#91478](openclaw/openclaw#91478), [#91915](openclaw/openclaw#91915)) Thanks [@codysai001](https://github.com/codysai001), [@alexzhu0](https://github.com/alexzhu0), [@joelnishanth](https://github.com/joelnishanth), [@snowzlm](https://github.com/snowzlm), [@obviyus](https://github.com/obviyus), and [@sallyom](https://github.com/sallyom). - iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#91335](openclaw/openclaw#91335), [#91449](openclaw/openclaw#91449), [#88969](openclaw/openclaw#88969), [#88530](openclaw/openclaw#88530), [#91783](openclaw/openclaw#91783), [#91785](openclaw/openclaw#91785)) Thanks [@omarshahine](https://github.com/omarshahine), [@jmissig](https://github.com/jmissig), and [@colmbrogan](https://github.com/colmbrogan). - Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#91422](openclaw/openclaw#91422), [#89851](openclaw/openclaw#89851), [#91736](openclaw/openclaw#91736), [#91747](openclaw/openclaw#91747), [#91451](openclaw/openclaw#91451), [#80143](openclaw/openclaw#80143)) Thanks [@pgondhi987](https://github.com/pgondhi987), [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@lifuyue](https://github.com/lifuyue), [@eleqtrizit](https://github.com/eleqtrizit), [@LiuwqGit](https://github.com/LiuwqGit), and [@HemantSudarshan](https://github.com/HemantSudarshan). - Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#91531](openclaw/openclaw#91531), [#91538](openclaw/openclaw#91538), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583), [#91598](openclaw/openclaw#91598)) - Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#91830](openclaw/openclaw#91830), [#91882](openclaw/openclaw#91882), [#91590](openclaw/openclaw#91590), [#88630](openclaw/openclaw#88630), [#88768](openclaw/openclaw#88768), [#91696](openclaw/openclaw#91696)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@joshavant](https://github.com/joshavant), [@bdjben](https://github.com/bdjben), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). ##### Changes - CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#89834](openclaw/openclaw#89834), [#90883](openclaw/openclaw#90883)) Thanks [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia). - Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#91256](openclaw/openclaw#91256), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583)) Thanks [@amknight](https://github.com/amknight). - Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#91574](openclaw/openclaw#91574), [#91591](openclaw/openclaw#91591), [#90004](openclaw/openclaw#90004), [#90927](openclaw/openclaw#90927), [#90838](openclaw/openclaw#90838)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@brokemac79](https://github.com/brokemac79), and [@lonexreb](https://github.com/lonexreb). - Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#91324](openclaw/openclaw#91324), [#89138](openclaw/openclaw#89138), [#90457](openclaw/openclaw#90457), [#91837](openclaw/openclaw#91837), [#91851](openclaw/openclaw#91851)) Thanks [@osolmaz](https://github.com/osolmaz), [@mushuiyu886](https://github.com/mushuiyu886), [@ai-hpc](https://github.com/ai-hpc), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#91423](openclaw/openclaw#91423), [#91557](openclaw/openclaw#91557), [#89909](openclaw/openclaw#89909)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh), [@Solvely-Colin](https://github.com/Solvely-Colin), and [@baskduf](https://github.com/baskduf). - Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#90782](openclaw/openclaw#90782), [#89978](openclaw/openclaw#89978), [#91580](openclaw/openclaw#91580), [#91531](openclaw/openclaw#91531)) Thanks [@RomneyDa](https://github.com/RomneyDa) and [@ai-hpc](https://github.com/ai-hpc). ##### Fixes - Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#85679](openclaw/openclaw#85679), [#91450](openclaw/openclaw#91450), [#91566](openclaw/openclaw#91566), [#91840](openclaw/openclaw#91840), [#91590](openclaw/openclaw#91590), [#91361](openclaw/openclaw#91361), [#91895](openclaw/openclaw#91895)) Thanks [@openperf](https://github.com/openperf), [@yetval](https://github.com/yetval), [@joshavant](https://github.com/joshavant), [@wangmiao0668000666](https://github.com/wangmiao0668000666), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#89151](openclaw/openclaw#89151), [#91422](openclaw/openclaw#91422), [#91425](openclaw/openclaw#91425), [#91529](openclaw/openclaw#91529), [#90212](openclaw/openclaw#90212)) Thanks [@joelnishanth](https://github.com/joelnishanth), [@pgondhi987](https://github.com/pgondhi987), [@joshavant](https://github.com/joshavant), and [@snowzlm](https://github.com/snowzlm). - Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#85823](openclaw/openclaw#85823), [#89659](openclaw/openclaw#89659), [#91684](openclaw/openclaw#91684), [#91649](openclaw/openclaw#91649), [#90263](openclaw/openclaw#90263), [#91686](openclaw/openclaw#91686), [#90426](openclaw/openclaw#90426)) Thanks [@itsuzef](https://github.com/itsuzef), [@ladygege](https://github.com/ladygege), [@jacobtomlinson](https://github.com/jacobtomlinson), [@fuller-stack-dev](https://github.com/fuller-stack-dev), and [@shushushv](https://github.com/shushushv). - Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#90666](openclaw/openclaw#90666), [#90678](openclaw/openclaw#90678)) Thanks [@ai-hpc](https://github.com/ai-hpc). - Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#87105](openclaw/openclaw#87105), [#91551](openclaw/openclaw#91551), [#91219](openclaw/openclaw#91219), [#91614](openclaw/openclaw#91614), [#91740](openclaw/openclaw#91740), [#91978](openclaw/openclaw#91978)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev) and [@scotthuang](https://github.com/scotthuang). - Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#91390](openclaw/openclaw#91390), [#91709](openclaw/openclaw#91709), [#91507](openclaw/openclaw#91507), [#91567](openclaw/openclaw#91567), [#88630](openclaw/openclaw#88630), [#91696](openclaw/openclaw#91696)) Thanks [@hxy91819](https://github.com/hxy91819), [@brokemac79](https://github.com/brokemac79), [@RomneyDa](https://github.com/RomneyDa), [@joshavant](https://github.com/joshavant), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). - Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#91581](openclaw/openclaw#91581), [#91599](openclaw/openclaw#91599), [#91547](openclaw/openclaw#91547), [#91591](openclaw/openclaw#91591)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev), [@sallyom](https://github.com/sallyom), and [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#91480](openclaw/openclaw#91480)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#80082](openclaw/openclaw#80082)) Thanks [@davelutztx](https://github.com/davelutztx). - Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#91550](openclaw/openclaw#91550)) Thanks [@joshavant](https://github.com/joshavant). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040

fix(browser): validate discovered cdp websocket urls

3449049

openclaw-barnacle Bot added size: S maintainer Maintainer-authored PR labels Jun 9, 2026

fix(browser): validate cdp tab creation websockets

ad51349

eleqtrizit self-assigned this Jun 9, 2026

fix(browser): guard termination cdp websocket

9219035

openclaw-barnacle Bot added size: M and removed size: S labels Jun 9, 2026

fix(browser): use .toString() instead of String() to satisfy oxlint n…

9c8491c

…o-base-to-string

clawsweeper Bot added the rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. label Jun 9, 2026

clawsweeper Bot removed the status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. label Jun 9, 2026

fix(browser): avoid cdp termination assertion stringification

aa00373

fix(browser): preserve cdp ssrf policy

1f85978

eleqtrizit merged commit ade5ac0 into openclaw:main Jun 10, 2026
169 of 175 checks passed

github-actions Bot mentioned this pull request Jun 10, 2026

📡 Upstream Digest — 2026-06-10 16:54 UTC curtismercier/openclaw-mods#1053

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(browser): validate discovered CDP websocket URLs#91747

fix(browser): validate discovered CDP websocket URLs#91747
eleqtrizit merged 6 commits into
openclaw:mainfrom
eleqtrizit:740

eleqtrizit commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

eleqtrizit commented Jun 10, 2026

Uh oh!

eleqtrizit commented Jun 10, 2026

Uh oh!

clawsweeper Bot commented Jun 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

eleqtrizit commented Jun 9, 2026

Summary

Changes

Validation

Notes

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eleqtrizit commented Jun 9, 2026

Behavioral proof

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eleqtrizit commented Jun 9, 2026

Summary of Checks Performed

Relevance

Compatibility

ClawSweeper

Code Reviews Completed

All Checks Completed

Abbreviations

Uh oh!

eleqtrizit commented Jun 10, 2026

Behavioral proof

Uh oh!

eleqtrizit commented Jun 10, 2026

Uh oh!

clawsweeper Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

clawsweeper Bot commented Jun 10, 2026 •

edited

Loading