Peter Steinberger 93775ef6a4 fix(browser): enforce redirect-hop SSRF checks

2026-03-09 05:41:36 +00:00

..

routes

refactor: harden browser runtime profile handling

2026-03-09 00:25:43 +00:00

bridge-auth-registry.ts

fix(security): enforce sandbox bridge auth

2026-02-14 13:17:41 +01:00

bridge-server.auth.test.ts

CI: restore main detect-secrets scan (#38438)

2026-03-07 10:06:35 -08:00

bridge-server.ts

fix(security): harden sandbox novnc observer flow

2026-03-01 22:44:28 +00:00

browser-utils.test.ts

refactor(browser): scope CDP sessions and harden stale target recovery

2026-03-08 19:52:33 +00:00

cdp-proxy-bypass.test.ts

refactor: dedupe agent and reply runtimes

2026-03-02 19:57:33 +00:00

cdp-proxy-bypass.ts

refactor(net): unify proxy env checks and guarded fetch modes

2026-03-02 16:24:26 +00:00

cdp-timeouts.test.ts

refactor: split browser context/actions and unify CDP timeout policy

2026-03-02 16:02:39 +00:00

cdp-timeouts.ts

refactor: split browser context/actions and unify CDP timeout policy

2026-03-02 16:02:39 +00:00

cdp.helpers.ts

fix: preserve loopback ws cdp tab ops (#31085) (thanks @shrey150)

2026-03-08 18:48:51 +00:00

cdp.test.ts

refactor(browser): scope CDP sessions and harden stale target recovery

2026-03-08 19:52:33 +00:00

cdp.ts

fix(browser): rewrite 0.0.0.0 and [::] wildcard addresses in CDP WebSocket URLs

2026-03-08 19:07:23 +00:00

chrome-extension-background-utils.test.ts

refactor: harden browser relay CDP flows

2026-03-08 23:46:10 +00:00

chrome-extension-manifest.test.ts

fix(browser): harden extension relay worker recovery

2026-02-22 19:08:38 +01:00

chrome-extension-options-validation.test.ts

refactor(browser): share relay token + options validation tests

2026-02-24 04:23:22 +00:00

chrome-user-data-dir.test-harness.ts

refactor(browser): dedupe control-server test harness

2026-02-22 17:54:51 +00:00

chrome.default-browser.test.ts

test: dedupe repeated test fixtures and assertions

2026-02-22 18:37:25 +00:00

chrome.executables.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

chrome.profile-decoration.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

chrome.test.ts

test+docs: comprehensive coverage and generic framing

2026-03-08 18:48:10 +00:00

chrome.ts

chore: remove vendor-specific references from code comments

2026-03-08 18:48:10 +00:00

client-actions-core.ts

refactor(browser): share download request helper

2026-02-18 18:54:27 +00:00

client-actions-observe.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

client-actions-state.ts

refactor: dedupe agent and browser cli helpers

2026-03-03 00:15:00 +00:00

client-actions-types.ts

feat(browser): expand browser control surface

2026-01-12 17:32:44 +00:00

client-actions-url.ts

refactor(browser): share client-actions url helpers

2026-02-15 18:22:10 +00:00

client-actions.ts

feat(browser): expand browser control surface

2026-01-12 17:32:44 +00:00

client-fetch.loopback-auth.test.ts

fix(test): restore long dep for full vitest gate

2026-03-07 21:23:06 +00:00

client-fetch.ts

fix(browser): keep dispatcher context with no-retry hints

2026-03-07 20:45:06 +00:00

client.test.ts

refactor: harden browser relay CDP flows

2026-03-08 23:46:10 +00:00

client.ts

refactor: harden browser runtime profile handling

2026-03-09 00:25:43 +00:00

config.test.ts

refactor(browser): scope CDP sessions and harden stale target recovery

2026-03-08 19:52:33 +00:00

config.ts

fix(infra): make browser relay bind address configurable

2026-03-08 19:15:21 +00:00

constants.ts

fix(browser): default to openclaw profile when unspecified (#32031)

2026-03-02 18:34:37 +00:00

control-auth.auto-token.test.ts

Gateway: add SecretRef support for gateway.auth.token with auth-mode guardrails (#35094)

2026-03-05 12:53:56 -06:00

control-auth.test.ts

test(browser): dedupe auth mode no-token assertions

2026-02-19 08:25:12 +00:00

control-auth.ts

Gateway: add SecretRef support for gateway.auth.token with auth-mode guardrails (#35094)

2026-03-05 12:53:56 -06:00

control-service.ts

refactor: harden browser runtime profile handling

2026-03-09 00:25:43 +00:00

csrf.ts

fix(browser): annotate csrf middleware type

2026-02-14 15:54:29 +01:00

errors.ts

refactor: harden browser runtime profile handling

2026-03-09 00:25:43 +00:00

extension-relay-auth.secretref.test.ts

Gateway: add SecretRef support for gateway.auth.token with auth-mode guardrails (#35094)

2026-03-05 12:53:56 -06:00

extension-relay-auth.test.ts

Gateway: add SecretRef support for gateway.auth.token with auth-mode guardrails (#35094)

2026-03-05 12:53:56 -06:00

extension-relay-auth.ts

Gateway: add SecretRef support for gateway.auth.token with auth-mode guardrails (#35094)

2026-03-05 12:53:56 -06:00

extension-relay.bind-host.test.ts

refactor(browser): scope CDP sessions and harden stale target recovery

2026-03-08 19:52:33 +00:00

extension-relay.test.ts

fix: make browser relay bind address configurable (#39364) (thanks @mvanhorn)

2026-03-08 19:15:21 +00:00

extension-relay.ts

fix: make browser relay bind address configurable (#39364) (thanks @mvanhorn)

2026-03-08 19:15:21 +00:00

form-fields.ts

refactor(browser): unify fill field normalization

2026-02-26 22:17:58 +01:00

http-auth.ts

refactor(browser): centralize http auth

2026-02-14 13:30:11 +01:00

navigation-guard.test.ts

fix(browser): enforce redirect-hop SSRF checks

2026-03-09 05:41:36 +00:00

navigation-guard.ts

fix(browser): enforce redirect-hop SSRF checks

2026-03-09 05:41:36 +00:00

output-atomic.ts

follow-up: align ingress, atomic paths, and channel tests with credential semantics (#33733)

2026-03-03 20:29:46 -06:00

paths.test.ts

refactor: dedupe agent and browser cli helpers

2026-03-03 00:15:00 +00:00

paths.ts

fix(browser): harden writable output paths

2026-03-01 23:25:13 +00:00

profile-capabilities.ts

refactor: harden browser runtime profile handling

2026-03-09 00:25:43 +00:00

profiles-service.test.ts

refactor: harden browser runtime profile handling

2026-03-09 00:25:43 +00:00

profiles-service.ts

refactor: harden browser runtime profile handling

2026-03-09 00:25:43 +00:00

profiles.test.ts

test: optimize gateway infra memory and security coverage

2026-02-21 21:44:50 +00:00

profiles.ts

chore: Enable typescript/no-explicit-any rule.

2026-02-02 16:18:09 +09:00

proxy-files.ts

refactor(browser): share proxy file helpers

2026-02-14 15:39:45 +00:00

pw-ai-module.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

pw-ai-state.ts

perf(test): reduce hot-suite import and setup overhead

2026-02-13 20:26:39 +00:00

pw-ai.e2e.test.ts

test: move integration-heavy suites to e2e lane

2026-03-02 05:33:07 +00:00

pw-ai.ts

perf(test): reduce hot-suite import and setup overhead

2026-02-13 20:26:39 +00:00

pw-role-snapshot.test.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

pw-role-snapshot.ts

refactor: extract shared dedupe helpers for runtime paths

2026-02-23 05:43:43 +00:00

pw-session.browserless.live.test.ts

perf(test): use expect.poll in browserless live test

2026-02-18 22:06:44 +00:00

pw-session.connections.test.ts

refactor(browser): scope CDP sessions and harden stale target recovery

2026-03-08 19:52:33 +00:00

pw-session.create-page.navigation-guard.test.ts

fix(browser): enforce redirect-hop SSRF checks

2026-03-09 05:41:36 +00:00

pw-session.get-page-for-targetid.extension-fallback.test.ts

refactor: harden browser relay CDP flows

2026-03-08 23:46:10 +00:00

pw-session.mock-setup.ts

fix(ci): add explicit mock types in pw-session mock setup

2026-02-22 08:05:12 +00:00

pw-session.page-cdp.test.ts

refactor: harden browser relay CDP flows

2026-03-08 23:46:10 +00:00

pw-session.page-cdp.ts

refactor: harden browser relay CDP flows

2026-03-08 23:46:10 +00:00

pw-session.test.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

pw-session.ts

fix(browser): enforce redirect-hop SSRF checks

2026-03-09 05:41:36 +00:00

pw-tools-core.activity.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

pw-tools-core.clamps-timeoutms-scrollintoview.test.ts

test(browser): table-drive scroll and click error rewrites

2026-02-21 23:58:33 +00:00

pw-tools-core.downloads.ts

follow-up: align ingress, atomic paths, and channel tests with credential semantics (#33733)

2026-03-03 20:29:46 -06:00

pw-tools-core.interactions.evaluate.abort.test.ts

test: dedupe and optimize test suites

2026-02-19 15:19:38 +00:00

pw-tools-core.interactions.set-input-files.test.ts

refactor: dedupe agent and browser cli helpers

2026-03-03 00:15:00 +00:00

pw-tools-core.interactions.ts

refactor(browser): dedupe playwright interaction helpers

2026-03-03 02:53:13 +00:00

pw-tools-core.last-file-chooser-arm-wins.test.ts

fix(browser): revalidate upload paths at use time

2026-02-26 00:40:56 +01:00

pw-tools-core.responses.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

pw-tools-core.screenshots-element-selector.test.ts

refactor: dedupe agent and browser cli helpers

2026-03-03 00:15:00 +00:00

pw-tools-core.shared.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

pw-tools-core.snapshot.navigate-guard.test.ts

fix(browser): enforce redirect-hop SSRF checks

2026-03-09 05:41:36 +00:00

pw-tools-core.snapshot.ts

fix(browser): enforce redirect-hop SSRF checks

2026-03-09 05:41:36 +00:00

pw-tools-core.state.ts

refactor: harden browser relay CDP flows

2026-03-08 23:46:10 +00:00

pw-tools-core.storage.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

pw-tools-core.test-harness.ts

fix(browser): retry relay navigation after frame detach

2026-03-02 06:14:52 +00:00

pw-tools-core.trace.ts

fix(security): unify root-bound write hardening

2026-03-02 17:12:33 +00:00

pw-tools-core.ts

refactor(browser): split pw tools + agent routes

2026-01-14 05:39:44 +00:00

pw-tools-core.waits-next-download-saves-it.test.ts

follow-up: align ingress, atomic paths, and channel tests with credential semantics (#33733)

2026-03-03 20:29:46 -06:00

resolved-config-refresh.ts

refactor: harden browser runtime profile handling

2026-03-09 00:25:43 +00:00

runtime-lifecycle.ts

refactor: harden browser runtime profile handling

2026-03-09 00:25:43 +00:00

safe-filename.ts

refactor(shared): extract reused path and normalization helpers

2026-03-02 05:20:19 +00:00

screenshot.test.ts

test: move browser and web auto-reply local suites out of e2e

2026-02-22 11:05:26 +00:00

screenshot.ts

refactor(media): share image resize side grid and quality steps

2026-02-18 18:25:25 +00:00

server-context.availability.ts

refactor: harden browser runtime profile handling

2026-03-09 00:25:43 +00:00

server-context.chrome-test-harness.ts

refactor(browser): dedupe control-server test harness

2026-02-22 17:54:51 +00:00

server-context.constants.ts

refactor(browser): split server context and unify CDP transport

2026-03-02 15:43:05 +00:00

server-context.ensure-browser-available.waits-for-cdp-ready.test.ts

refactor: dedupe agent and browser cli helpers

2026-03-03 00:15:00 +00:00

server-context.ensure-tab-available.prefers-last-target.test.ts

refactor(browser): scope CDP sessions and harden stale target recovery

2026-03-08 19:52:33 +00:00

server-context.hot-reload-profiles.test.ts

refactor: harden browser runtime profile handling

2026-03-09 00:25:43 +00:00

server-context.loopback-direct-ws.test.ts

refactor(browser): scope CDP sessions and harden stale target recovery

2026-03-08 19:52:33 +00:00

server-context.remote-profile-tab-ops.suite.ts

fix(browser): enforce redirect-hop SSRF checks

2026-03-09 05:41:36 +00:00

server-context.remote-profile-tab-ops.test.ts

refactor(browser): dedupe browser and cli command wiring

2026-03-02 21:31:36 +00:00

server-context.remote-tab-ops.harness.ts

refactor: split browser context/actions and unify CDP timeout policy

2026-03-02 16:02:39 +00:00

server-context.remote-tab-ops.test.ts

refactor(browser): dedupe browser and cli command wiring

2026-03-02 21:31:36 +00:00

server-context.reset.test.ts

refactor(browser): scope CDP sessions and harden stale target recovery

2026-03-08 19:52:33 +00:00

server-context.reset.ts

refactor: harden browser runtime profile handling

2026-03-09 00:25:43 +00:00

server-context.selection.ts

refactor: harden browser runtime profile handling

2026-03-09 00:25:43 +00:00

server-context.tab-ops.ts

fix(browser): enforce redirect-hop SSRF checks

2026-03-09 05:41:36 +00:00

server-context.tab-selection-state.suite.ts

refactor: dedupe agent and browser cli helpers

2026-03-03 00:15:00 +00:00

server-context.tab-selection-state.test.ts

refactor(browser): dedupe browser and cli command wiring

2026-03-02 21:31:36 +00:00

server-context.ts

refactor: harden browser runtime profile handling

2026-03-09 00:25:43 +00:00

server-context.types.ts

refactor: harden browser runtime profile handling

2026-03-09 00:25:43 +00:00

server-lifecycle.test.ts

refactor: harden browser relay CDP flows

2026-03-08 23:46:10 +00:00

server-lifecycle.ts

refactor: harden browser relay CDP flows

2026-03-08 23:46:10 +00:00

server-middleware.ts

refactor(browser): share common server middleware

2026-02-15 04:46:10 +00:00

server.agent-contract-form-layout-act-commands.test.ts

refactor(browser): unify fill field normalization

2026-02-26 22:17:58 +01:00

server.agent-contract-snapshot-endpoints.test.ts

test: fix gate regressions

2026-02-24 04:39:53 +00:00

server.agent-contract.test-harness.ts

refactor(channels): dedupe transport and gateway test scaffolds

2026-02-16 14:59:31 +00:00

server.auth-fail-closed.test.ts

test(integration): dedupe messaging, secrets, and plugin test suites

2026-03-02 07:13:11 +00:00

server.auth-token-gates-http.test.ts

perf(test): speed up browser test suites

2026-02-14 14:25:54 +00:00

server.control-server.test-harness.ts

refactor(browser): dedupe control-server test harness

2026-02-22 17:54:51 +00:00

server.evaluate-disabled-does-not-block-storage.test.ts

test(integration): dedupe messaging, secrets, and plugin test suites

2026-03-02 07:13:11 +00:00

server.post-tabs-open-profile-unknown-returns-404.test.ts

refactor: harden browser runtime profile handling

2026-03-09 00:25:43 +00:00

server.ts

refactor: harden browser runtime profile handling

2026-03-09 00:25:43 +00:00

session-tab-registry.test.ts

fix(browser): close tracked tabs on session cleanup (#36666)

2026-03-05 16:40:52 -08:00

session-tab-registry.ts

fix(browser): close tracked tabs on session cleanup (#36666)

2026-03-05 16:40:52 -08:00

target-id.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

test-port.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

trash.ts

refactor(security): unify secure id paths and guard weak patterns

2026-02-22 10:16:19 +01:00