mirror of
https://github.com/openclaw/openclaw.git
synced 2026-07-16 15:11:39 +00:00
* feat(browser): restore driver "extension" via loopback Chrome extension relay Reintroduces browser profile driver "extension" (removed in 2026.3.22) as a loopback relay that drives the user's signed-in Chrome through an MV3 extension instead of the remote-debugging port. This avoids Chrome's blocking "Allow remote debugging?" prompt, which cannot be clicked when the operator drives OpenClaw from a phone. Automated tabs live in an "OpenClaw" tab group (the consent boundary), mirroring the Codex/Claude-in-Chrome model. - relay bridge synthesizes the CDP browser target surface for Playwright connectOverCDP and forwards session-scoped commands to chrome.debugger - relay server binds loopback only; both sides authenticate with a token derived (HMAC-SHA256) from gateway auth, so the raw credential never reaches Chrome; extension origin + loopback Host checks guard the upgrade - built-in "chrome" profile; distinct relay ports per extension profile; relay reconciles on auth rotation / cdpPort change and prunes removed profiles - doctor + status surface the extension transport; doctor keeps repairing the retired relay endpoint URL on legacy "extension" profiles Refs #53599 * feat(browser): bundle the OpenClaw MV3 Chrome extension Thin MV3 extension (chrome-extension/): a WebSocket client to the loopback relay plus chrome.debugger forwarding and OpenClaw tab-group management. All CDP target synthesis lives server-side in the relay bridge, so the extension stays a dumb transport (the removed 2026.3 extension put that logic in a 1000-line untestable service worker). Popup handles pairing and per-tab share toggle; `openclaw browser extension path|pair` load and pair it. A build copy hook stages it into dist so the load path is stable. Refs #53599 * docs(browser): document the Chrome extension profile Adds docs/tools/chrome-extension for the restored extension driver (install, pair, tab-group consent model, security posture) and wires it into the browser docs profile section and nav. Refs #53599 * feat(browser): make the extension relay work on remote browser nodes Derives the relay auth token from a host-local secret in the credentials dir (created on first use) instead of gateway auth. Each machine that runs a browser — the gateway host and every browser node host — owns its own token, so the extension pairs with whichever machine hosts its Chrome and no gateway credential travels to a node. The node host already runs the shared browser control bootstrap, so this is all that was missing for cross-machine control. Also removes the "relay needs gateway auth before it can start" failure mode: startup and `openclaw browser extension pair` ensure the secret exists. Refs #53599 * fix(browser): harden relay secret creation and satisfy CI lint/typecheck - Make the host-local relay secret creation atomic (O_CREAT|O_EXCL + adopt the winner on EEXIST) so the gateway service and `extension pair` CLI cannot mint divergent tokens on a fresh host (would 401 until restart); credentials dir created mode 0700. (adversarial review finding) - Resolve type-aware oxlint findings across the relay + extension: unknown catch vars, addEventListener over ws.on* in the MV3 worker, void async listeners, drop useless returns/spreads, Object.assign over map-spread, safe ws frame decode (Buffer[]/ArrayBuffer), toSorted. - Add extensionRelayDefaultPort/extensionRelayPorts to remaining test config literals; type the extension relay-core module (.d.ts, excluded from dist); regenerate docs_map. * fix(browser): satisfy OpenGrep security policy on the relay - Hash both operands before timingSafeEqual so token comparison has no length short-circuit (GHSA-JJ6Q-RRRF-H66H). - Bound the relay WebSocketServer with maxPayload (64 MiB, headroom for CDP screenshots/bodies) against oversized frames (GHSA-VW3H-Q6XQ-JJM5). - Rewrite the config test env helper to avoid the skill-env-host-injection shape (GHSA-82G8-464F-2MV7); it is a test-only env swap.
79 lines
2.7 KiB
JavaScript
79 lines
2.7 KiB
JavaScript
// Popup: pairing, connection status, and per-tab share toggle.
|
|
|
|
const statusDot = document.getElementById("statusDot");
|
|
const pairSection = document.getElementById("pairSection");
|
|
const connectedSection = document.getElementById("connectedSection");
|
|
const pairingInput = document.getElementById("pairingString");
|
|
const pairButton = document.getElementById("pairButton");
|
|
const unpairButton = document.getElementById("unpairButton");
|
|
const shareButton = document.getElementById("shareButton");
|
|
const statusLine = document.getElementById("statusLine");
|
|
const errorLine = document.getElementById("error");
|
|
|
|
const STATE_LABEL = {
|
|
on: "Connected to OpenClaw",
|
|
connecting: "Connecting…",
|
|
error: "Relay unreachable — is the OpenClaw gateway running?",
|
|
off: "Not connected",
|
|
};
|
|
|
|
async function activeTab() {
|
|
const [tab] = await chrome.tabs.query({ active: true, lastFocusedWindow: true });
|
|
return tab ?? null;
|
|
}
|
|
|
|
async function refresh() {
|
|
const status = await chrome.runtime.sendMessage({ type: "getStatus" });
|
|
statusDot.className = `dot ${status.state}`;
|
|
pairSection.classList.toggle("hidden", status.paired);
|
|
connectedSection.classList.toggle("hidden", !status.paired);
|
|
if (!status.paired) {
|
|
return;
|
|
}
|
|
const label = STATE_LABEL[status.state] ?? STATE_LABEL.off;
|
|
statusLine.textContent = `${label} · ${status.sharedTabCount} tab${status.sharedTabCount === 1 ? "" : "s"} shared`;
|
|
const tab = await activeTab();
|
|
if (tab?.id === undefined) {
|
|
shareButton.classList.add("hidden");
|
|
return;
|
|
}
|
|
const { shared } = await chrome.runtime.sendMessage({ type: "isTabShared", tabId: tab.id });
|
|
shareButton.classList.remove("hidden");
|
|
shareButton.textContent = shared ? "Stop sharing this tab" : "Share this tab with OpenClaw";
|
|
shareButton.dataset.tabId = String(tab.id);
|
|
}
|
|
|
|
async function onPair() {
|
|
errorLine.classList.add("hidden");
|
|
const result = await chrome.runtime.sendMessage({
|
|
type: "pair",
|
|
pairingString: pairingInput.value,
|
|
});
|
|
if (!result.ok) {
|
|
errorLine.textContent = result.error ?? "Pairing failed.";
|
|
errorLine.classList.remove("hidden");
|
|
return;
|
|
}
|
|
await refresh();
|
|
}
|
|
|
|
async function onUnpair() {
|
|
await chrome.runtime.sendMessage({ type: "unpair" });
|
|
await refresh();
|
|
}
|
|
|
|
async function onToggleShare() {
|
|
const tabId = Number.parseInt(shareButton.dataset.tabId ?? "", 10);
|
|
if (Number.isFinite(tabId)) {
|
|
await chrome.runtime.sendMessage({ type: "toggleShareTab", tabId });
|
|
}
|
|
await refresh();
|
|
}
|
|
|
|
pairButton.addEventListener("click", () => void onPair());
|
|
unpairButton.addEventListener("click", () => void onUnpair());
|
|
shareButton.addEventListener("click", () => void onToggleShare());
|
|
|
|
void refresh();
|
|
setInterval(() => void refresh(), 2000);
|