Auto-merge upstream openclaw/openclaw

Author: friuns2

CHANGELOG.md

@@ -108,6 +108,9 @@ Docs: https://docs.openclaw.ai
 - Config/plugins: use plugin-owned command alias metadata when `plugins.allow` contains runtime command names like `dreaming`, and point users at the owning plugin instead of stale plugin-not-found guidance. (#64242) Thanks @feiskyer.
 - Agents/Gemini: strip orphaned `required` entries from Gemini tool schemas so provider validation no longer rejects tools after schema cleanup or union flattening. (#64284) Thanks @xxxxxmax.
 - Assistant text: strip Qwen-style XML tool call payloads from visible replies so web and channel messages no longer show raw `<tool_call><function=...>` output. (#64214) Thanks @MoerAI.
+- Daemon/gateway: prevent systemd restart storms on configuration errors by exiting with `EX_CONFIG` and adding generated unit restart-prevention guards. (#63913) Thanks @neo1027144-creator.
+- Agents/exec: prevent gateway crash ("Agent listener invoked outside active run") when a subagent exec tool produces stdout/stderr after the agent run has ended or been aborted. (#62821) Thanks @openperf.
+- Browser/tabs: route `/tabs/action` close/select through the same browser endpoint reachability and policy checks as list/new (including Playwright-backed remote tab operations), reject CDP HTTP redirects on probe requests, and sanitize blocked-endpoint error responses so tab list/focus/close flows fail closed without echoing raw policy details back to callers. (#63332)
 
 ## 2026.4.9
 

extensions/browser/src/browser/cdp.helpers.test.ts

@@ -0,0 +1,53 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { SsrFBlockedError } from "../infra/net/ssrf.js";
+
+vi.mock("./cdp-proxy-bypass.js", () => ({
+  getDirectAgentForCdp: vi.fn(() => null),
+  withNoProxyForCdpUrl: vi.fn(async (_url: string, fn: () => Promise<unknown>) => await fn()),
+}));
+
+const { assertCdpEndpointAllowed, fetchCdpChecked } = await import("./cdp.helpers.js");
+const { BrowserCdpEndpointBlockedError } = await import("./errors.js");
+
+describe("fetchCdpChecked", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it("disables automatic redirect following for CDP HTTP probes", async () => {
+    const fetchSpy = vi.fn().mockResolvedValue(
+      new Response(null, {
+        status: 302,
+        headers: { Location: "http://127.0.0.1:9222/json/version" },
+      }),
+    );
+    vi.stubGlobal("fetch", fetchSpy);
+
+    await expect(fetchCdpChecked("https://browser.example/json/version", 50)).rejects.toThrow(
+      "CDP endpoint redirects are not allowed",
+    );
+
+    const init = fetchSpy.mock.calls[0]?.[1];
+    expect(init?.redirect).toBe("manual");
+  });
+});
+
+describe("assertCdpEndpointAllowed", () => {
+  it("rethrows SSRF policy failures as BrowserCdpEndpointBlockedError so mapping can distinguish endpoint vs navigation", async () => {
+    await expect(
+      assertCdpEndpointAllowed("http://10.0.0.42:9222", { dangerouslyAllowPrivateNetwork: false }),
+    ).rejects.toBeInstanceOf(BrowserCdpEndpointBlockedError);
+  });
+
+  it("does not wrap non-SSRF failures", async () => {
+    await expect(
+      assertCdpEndpointAllowed("file:///etc/passwd", { dangerouslyAllowPrivateNetwork: false }),
+    ).rejects.not.toBeInstanceOf(BrowserCdpEndpointBlockedError);
+  });
+
+  it("leaves navigation-target SsrFBlockedError alone for callers that never hit the endpoint helper", () => {
+    // Sanity check that raw SsrFBlockedError is still its own class and is not
+    // accidentally converted by the endpoint helper import.
+    expect(new SsrFBlockedError("blocked")).toBeInstanceOf(SsrFBlockedError);
+  });
+});

extensions/browser/src/browser/cdp.helpers.ts

@@ -1,11 +1,16 @@
 import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/text-runtime";
 import WebSocket from "ws";
 import { isLoopbackHost } from "../gateway/net.js";
-import { type SsrFPolicy, resolvePinnedHostnameWithPolicy } from "../infra/net/ssrf.js";
+import {
+  SsrFBlockedError,
+  type SsrFPolicy,
+  resolvePinnedHostnameWithPolicy,
+} from "../infra/net/ssrf.js";
 import { rawDataToString } from "../infra/ws.js";
 import { redactSensitiveText } from "../logging/redact.js";
 import { getDirectAgentForCdp, withNoProxyForCdpUrl } from "./cdp-proxy-bypass.js";
 import { CDP_HTTP_REQUEST_TIMEOUT_MS, CDP_WS_HANDSHAKE_TIMEOUT_MS } from "./cdp-timeouts.js";
+import { BrowserCdpEndpointBlockedError } from "./errors.js";
 import { resolveBrowserRateLimitMessage } from "./rate-limit-message.js";
 
 export { isLoopbackHost };
@@ -62,9 +67,19 @@ export async function assertCdpEndpointAllowed(
   if (!["http:", "https:", "ws:", "wss:"].includes(parsed.protocol)) {
     throw new Error(`Invalid CDP URL protocol: ${parsed.protocol.replace(":", "")}`);
   }
-  await resolvePinnedHostnameWithPolicy(parsed.hostname, {
-    policy: ssrfPolicy,
-  });
+  try {
+    await resolvePinnedHostnameWithPolicy(parsed.hostname, {
+      policy: ssrfPolicy,
+    });
+  } catch (err) {
+    // Rethrow SSRF policy failures against the CDP endpoint itself as a
+    // browser-endpoint-scoped error so the route mapping does not confuse
+    // them with navigation-target policy blocks.
+    if (err instanceof SsrFBlockedError) {
+      throw new BrowserCdpEndpointBlockedError({ cause: err });
+    }
+    throw err;
+  }
 }
 
 export function redactCdpUrl(cdpUrl: string | null | undefined): string | null | undefined {
@@ -231,9 +246,15 @@ export async function fetchCdpChecked(
   const t = setTimeout(ctrl.abort.bind(ctrl), timeoutMs);
   try {
     const headers = getHeadersWithAuth(url, (init?.headers as Record<string, string>) || {});
+    // Block redirects on all CDP HTTP paths (not just probes) because a
+    // redirect to an internal host is an SSRF vector regardless of whether
+    // the call is /json/version, /json/list, /json/activate, or /json/close.
     const res = await withNoProxyForCdpUrl(url, () =>
-      fetch(url, { ...init, headers, signal: ctrl.signal }),
+      fetch(url, { ...init, headers, redirect: "manual", signal: ctrl.signal }),
     );
+    if (res.status >= 300 && res.status < 400) {
+      throw new Error("CDP endpoint redirects are not allowed");
+    }
     if (!res.ok) {
       if (res.status === 429) {
         // Do not reflect upstream response text into the error surface (log/agent injection risk)

extensions/browser/src/browser/errors.test.ts

@@ -1,5 +1,12 @@
 import { describe, expect, it } from "vitest";
-import { BrowserValidationError, toBrowserErrorResponse } from "./errors.js";
+import { SsrFBlockedError } from "../infra/net/ssrf.js";
+import {
+  BROWSER_ENDPOINT_BLOCKED_MESSAGE,
+  BROWSER_NAVIGATION_BLOCKED_MESSAGE,
+  BrowserCdpEndpointBlockedError,
+  BrowserValidationError,
+  toBrowserErrorResponse,
+} from "./errors.js";
 
 describe("browser error mapping", () => {
   it("maps blocked browser targets to conflict responses", () => {
@@ -20,4 +27,22 @@ describe("browser error mapping", () => {
       message: "bad input",
     });
   });
+
+  it("sanitizes navigation-target SSRF policy errors without leaking raw policy details", () => {
+    expect(
+      toBrowserErrorResponse(
+        new SsrFBlockedError("Blocked hostname or private/internal/special-use IP address"),
+      ),
+    ).toEqual({
+      status: 400,
+      message: BROWSER_NAVIGATION_BLOCKED_MESSAGE,
+    });
+  });
+
+  it("maps CDP endpoint policy blocks to a distinct endpoint-scoped message", () => {
+    expect(toBrowserErrorResponse(new BrowserCdpEndpointBlockedError())).toEqual({
+      status: 400,
+      message: BROWSER_ENDPOINT_BLOCKED_MESSAGE,
+    });
+  });
 });

extensions/browser/src/browser/errors.ts

@@ -1,6 +1,9 @@
 import { SsrFBlockedError } from "../infra/net/ssrf.js";
 import { InvalidBrowserNavigationUrlError } from "./navigation-guard.js";
 
+export const BROWSER_ENDPOINT_BLOCKED_MESSAGE = "browser endpoint blocked by policy";
+export const BROWSER_NAVIGATION_BLOCKED_MESSAGE = "browser navigation blocked by policy";
+
 export class BrowserError extends Error {
   status: number;
 
@@ -11,6 +14,18 @@ export class BrowserError extends Error {
   }
 }
 
+/**
+ * Raised when a browser CDP endpoint (the cdpUrl itself) fails the
+ * configured SSRF policy. Distinct from a blocked navigation target so
+ * callers see "fix your browser endpoint config" rather than "fix your
+ * navigation URL".
+ */
+export class BrowserCdpEndpointBlockedError extends BrowserError {
+  constructor(options?: ErrorOptions) {
+    super(BROWSER_ENDPOINT_BLOCKED_MESSAGE, 400, options);
+  }
+}
+
 export class BrowserValidationError extends BrowserError {
   constructor(message: string, options?: ErrorOptions) {
     super(message, 400, options);
@@ -76,7 +91,12 @@ export function toBrowserErrorResponse(err: unknown): {
     return { status: 409, message: err.message };
   }
   if (err instanceof SsrFBlockedError) {
-    return { status: 400, message: err.message };
+    // SsrFBlockedError from this point is from a navigation-target check
+    // (assertBrowserNavigationAllowed / resolvePinnedHostnameWithPolicy on a
+    // requested URL). CDP endpoint blocks are rethrown as
+    // BrowserCdpEndpointBlockedError by assertCdpEndpointAllowed and handled
+    // by the BrowserError branch above.
+    return { status: 400, message: BROWSER_NAVIGATION_BLOCKED_MESSAGE };
   }
   if (
     err instanceof InvalidBrowserNavigationUrlError ||

extensions/browser/src/browser/pw-session.ts

@@ -14,6 +14,7 @@ import { SsrFBlockedError, type SsrFPolicy } from "../infra/net/ssrf.js";
 import { withNoProxyForCdpUrl } from "./cdp-proxy-bypass.js";
 import {
   appendCdpPath,
+  assertCdpEndpointAllowed,
   fetchJson,
   getHeadersWithAuth,
   normalizeCdpHttpBaseForJsonEndpoints,
@@ -424,12 +425,15 @@ function observeBrowser(browser: Browser) {
   }
 }
 
-async function connectBrowser(cdpUrl: string): Promise<ConnectedBrowser> {
+async function connectBrowser(cdpUrl: string, ssrfPolicy?: SsrFPolicy): Promise<ConnectedBrowser> {
   const normalized = normalizeCdpUrl(cdpUrl);
   const cached = cachedByCdpUrl.get(normalized);
   if (cached) {
     return cached;
   }
+  // Run SSRF policy check only on cache miss so transient DNS failures
+  // do not break active sessions that already hold a live CDP connection.
+  await assertCdpEndpointAllowed(normalized, ssrfPolicy);
   const connecting = connectingByCdpUrl.get(normalized);
   if (connecting) {
     return await connecting;
@@ -440,7 +444,9 @@ async function connectBrowser(cdpUrl: string): Promise<ConnectedBrowser> {
     for (let attempt = 0; attempt < 3; attempt += 1) {
       try {
         const timeout = 5000 + attempt * 2000;
-        const wsUrl = await getChromeWebSocketUrl(normalized, timeout).catch(() => null);
+        const wsUrl = await getChromeWebSocketUrl(normalized, timeout, ssrfPolicy).catch(
+          () => null,
+        );
         const endpoint = wsUrl ?? normalized;
         const headers = getHeadersWithAuth(endpoint);
         // Bypass proxy for loopback CDP connections (#31219)
@@ -562,8 +568,10 @@ async function findPageByTargetIdViaTargetList(
   pages: Page[],
   targetId: string,
   cdpUrl: string,
+  ssrfPolicy?: SsrFPolicy,
 ): Promise<Page | null> {
   const cdpHttpBase = normalizeCdpHttpBaseForJsonEndpoints(cdpUrl);
+  await assertCdpEndpointAllowed(cdpUrl, ssrfPolicy);
   const targets = await fetchJson<
     Array<{
       id: string;
@@ -578,6 +586,7 @@ async function findPageByTargetId(
   browser: Browser,
   targetId: string,
   cdpUrl?: string,
+  ssrfPolicy?: SsrFPolicy,
 ): Promise<Page | null> {
   const pages = await getAllPages(browser);
   let resolvedViaCdp = false;
@@ -595,7 +604,7 @@ async function findPageByTargetId(
   }
   if (cdpUrl) {
     try {
-      return await findPageByTargetIdViaTargetList(pages, targetId, cdpUrl);
+      return await findPageByTargetIdViaTargetList(pages, targetId, cdpUrl, ssrfPolicy);
     } catch {
       // Ignore fetch errors and fall through to return null.
     }
@@ -609,12 +618,13 @@ async function findPageByTargetId(
 async function resolvePageByTargetIdOrThrow(opts: {
   cdpUrl: string;
   targetId: string;
+  ssrfPolicy?: SsrFPolicy;
 }): Promise<Page> {
   if (isBlockedTarget(opts.cdpUrl, opts.targetId)) {
     throw new BlockedBrowserTargetError();
   }
-  const { browser } = await connectBrowser(opts.cdpUrl);
-  const page = await findPageByTargetId(browser, opts.targetId, opts.cdpUrl);
+  const { browser } = await connectBrowser(opts.cdpUrl, opts.ssrfPolicy);
+  const page = await findPageByTargetId(browser, opts.targetId, opts.cdpUrl, opts.ssrfPolicy);
   if (!page) {
     throw new BrowserTabNotFoundError();
   }
@@ -624,11 +634,12 @@ async function resolvePageByTargetIdOrThrow(opts: {
 export async function getPageForTargetId(opts: {
   cdpUrl: string;
   targetId?: string;
+  ssrfPolicy?: SsrFPolicy;
 }): Promise<Page> {
   if (opts.targetId && isBlockedTarget(opts.cdpUrl, opts.targetId)) {
     throw new BlockedBrowserTargetError();
   }
-  const { browser } = await connectBrowser(opts.cdpUrl);
+  const { browser } = await connectBrowser(opts.cdpUrl, opts.ssrfPolicy);
   const pages = await getAllPages(browser);
   if (!pages.length) {
     throw new Error("No pages available in the connected browser.");
@@ -648,7 +659,7 @@ export async function getPageForTargetId(opts: {
   if (!opts.targetId) {
     return first;
   }
-  const found = await findPageByTargetId(browser, opts.targetId, opts.cdpUrl);
+  const found = await findPageByTargetId(browser, opts.targetId, opts.cdpUrl, opts.ssrfPolicy);
   if (found) {
     if (isBlockedPageRef(opts.cdpUrl, found)) {
       throw new BlockedBrowserTargetError();
@@ -887,7 +898,9 @@ function cdpSocketNeedsAttach(wsUrl: string): boolean {
 async function tryTerminateExecutionViaCdp(opts: {
   cdpUrl: string;
   targetId: string;
+  ssrfPolicy?: SsrFPolicy;
 }): Promise<void> {
+  await assertCdpEndpointAllowed(opts.cdpUrl, opts.ssrfPolicy);
   const cdpHttpBase = normalizeCdpHttpBaseForJsonEndpoints(opts.cdpUrl);
   const listUrl = appendCdpPath(cdpHttpBase, "/json/list");
 
@@ -976,6 +989,7 @@ export async function forceDisconnectPlaywrightForTarget(opts: {
   cdpUrl: string;
   targetId?: string;
   reason?: string;
+  ssrfPolicy?: SsrFPolicy;
 }): Promise<void> {
   const normalized = normalizeCdpUrl(opts.cdpUrl);
   const cur = cachedByCdpUrl.get(normalized);
@@ -996,7 +1010,7 @@ export async function forceDisconnectPlaywrightForTarget(opts: {
   // disconnect Playwright's CDP connection.
   const targetId = normalizeOptionalString(opts.targetId) ?? "";
   if (targetId) {
-    await tryTerminateExecutionViaCdp({ cdpUrl: normalized, targetId }).catch(() => {});
+    await tryTerminateExecutionViaCdp({ cdpUrl: normalized, targetId, ssrfPolicy: opts.ssrfPolicy }).catch(() => {});
   }
 
   // Fire-and-forget: don't await because browser.close() may hang on the stuck CDP pipe.
@@ -1007,15 +1021,18 @@ export async function forceDisconnectPlaywrightForTarget(opts: {
  * List all pages/tabs from the persistent Playwright connection.
  * Used for remote profiles where HTTP-based /json/list is ephemeral.
  */
-export async function listPagesViaPlaywright(opts: { cdpUrl: string }): Promise<
+export async function listPagesViaPlaywright(opts: {
+  cdpUrl: string;
+  ssrfPolicy?: SsrFPolicy;
+}): Promise<
   Array<{
     targetId: string;
     title: string;
     url: string;
     type: string;
   }>
 > {
-  const { browser } = await connectBrowser(opts.cdpUrl);
+  const { browser } = await connectBrowser(opts.cdpUrl, opts.ssrfPolicy);
   const pages = await getAllPages(browser);
   const results: Array<{
     targetId: string;
@@ -1056,7 +1073,7 @@ export async function createPageViaPlaywright(opts: {
   url: string;
   type: string;
 }> {
-  const { browser } = await connectBrowser(opts.cdpUrl);
+  const { browser } = await connectBrowser(opts.cdpUrl, opts.ssrfPolicy);
   const context = browser.contexts()[0] ?? (await browser.newContext());
   ensureContextState(context);
 
@@ -1119,6 +1136,7 @@ export async function createPageViaPlaywright(opts: {
 export async function closePageByTargetIdViaPlaywright(opts: {
   cdpUrl: string;
   targetId: string;
+  ssrfPolicy?: SsrFPolicy;
 }): Promise<void> {
   const page = await resolvePageByTargetIdOrThrow(opts);
   await page.close();
@@ -1131,6 +1149,7 @@ export async function closePageByTargetIdViaPlaywright(opts: {
 export async function focusPageByTargetIdViaPlaywright(opts: {
   cdpUrl: string;
   targetId: string;
+  ssrfPolicy?: SsrFPolicy;
 }): Promise<void> {
   const page = await resolvePageByTargetIdOrThrow(opts);
   try {