Devin Robison 1b3a1246d0 Block reset-profile on lower-privilege browser request surfaces (#54618) ...

* Block reset-profile on lower-privilege browser request surfaces

* add missing tests

* Fix tests

* Test fix

2026-03-25 13:36:59 -06:00

..

routes

refactor: dedupe test helpers and harnesses

2026-03-24 21:41:46 +00:00

bridge-auth-registry.ts

fix(security): enforce sandbox bridge auth

2026-02-14 13:17:41 +01:00

bridge-server.auth.test.ts

CI: restore main detect-secrets scan (#38438)

2026-03-07 10:06:35 -08:00

bridge-server.ts

fix(security): harden sandbox novnc observer flow

2026-03-01 22:44:28 +00:00

browser-utils.test.ts

!refactor(browser): remove Chrome extension path and add MCP doctor migration (#47893)

2026-03-15 23:56:08 -07:00

cdp-proxy-bypass.test.ts

refactor: dedupe agent and reply runtimes

2026-03-02 19:57:33 +00:00

cdp-proxy-bypass.ts

refactor(net): unify proxy env checks and guarded fetch modes

2026-03-02 16:24:26 +00:00

cdp-timeouts.test.ts

refactor: split browser context/actions and unify CDP timeout policy

2026-03-02 16:02:39 +00:00

cdp-timeouts.ts

fix(gateway): harden supervised lock and browser attach readiness

2026-03-23 08:42:00 -07:00

cdp.helpers.ts

!refactor(browser): remove Chrome extension path and add MCP doctor migration (#47893)

2026-03-15 23:56:08 -07:00

cdp.test.ts

refactor(browser): scope CDP sessions and harden stale target recovery

2026-03-08 19:52:33 +00:00

cdp.ts

fix(browser): rewrite 0.0.0.0 and [::] wildcard addresses in CDP WebSocket URLs

2026-03-08 19:07:23 +00:00

chrome-mcp.snapshot.test.ts

feat(browser): add chrome MCP existing-session support

2026-03-13 20:10:08 +00:00

chrome-mcp.snapshot.ts

fix(browser): harden existing-session driver validation and session lifecycle (#45682)

2026-03-13 20:21:47 -07:00

chrome-mcp.test.ts

Browser: support non-Chrome existing-session profiles via userDataDir (#48170)

2026-03-16 14:21:22 +01:00

chrome-mcp.ts

Browser: support non-Chrome existing-session profiles via userDataDir (#48170)

2026-03-16 14:21:22 +01:00

chrome-user-data-dir.test-harness.ts

refactor(browser): dedupe control-server test harness

2026-02-22 17:54:51 +00:00

chrome.default-browser.test.ts

fix: cover macOS Edge osascript fallback path (#48561) (thanks @zoherghadyali)

2026-03-25 15:47:04 +05:30

chrome.executables.ts

fix(browser): add Edge LaunchServices bundle IDs for macOS default browser detection

2026-03-25 15:47:04 +05:30

chrome.launch-args.test.ts

test: align chrome launch args fixture with current browser profile type

2026-03-22 15:37:19 -07:00

chrome.profile-decoration.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

chrome.test.ts

test: harden channel suite isolation

2026-03-23 12:57:43 +00:00

chrome.ts

fix(browser): add ChildProcessWithoutNullStreams cast for @types/node compat

2026-03-22 18:39:24 -07:00

client-actions-core.ts

fix(browser): normalize batch act dispatch for selector and batch support (#45457)

2026-03-13 15:10:55 -07:00

client-actions-observe.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

client-actions-state.ts

refactor: dedupe agent and browser cli helpers

2026-03-03 00:15:00 +00:00

client-actions-types.ts

feat(browser): expand browser control surface

2026-01-12 17:32:44 +00:00

client-actions-url.ts

refactor(browser): share client-actions url helpers

2026-02-15 18:22:10 +00:00

client-actions.ts

feat(browser): expand browser control surface

2026-01-12 17:32:44 +00:00

client-fetch.loopback-auth.test.ts

test: speed up browser suites

2026-03-24 17:49:25 +00:00

client-fetch.ts

fix(browser): surface 429 rate limit errors with actionable hints (#40491)

2026-03-11 00:49:31 +03:00

client.test.ts

fix(browser): normalize batch act dispatch for selector and batch support (#45457)

2026-03-13 15:10:55 -07:00

client.ts

Browser: support non-Chrome existing-session profiles via userDataDir (#48170)

2026-03-16 14:21:22 +01:00

config.test.ts

Browser: support non-Chrome existing-session profiles via userDataDir (#48170)

2026-03-16 14:21:22 +01:00

config.ts

Browser: support non-Chrome existing-session profiles via userDataDir (#48170)

2026-03-16 14:21:22 +01:00

constants.ts

fix(browser): default to openclaw profile when unspecified (#32031)

2026-03-02 18:34:37 +00:00

control-auth.auto-token.test.ts

test: harden channel suite isolation

2026-03-23 11:09:12 +00:00

control-auth.test.ts

test(browser): dedupe auth mode no-token assertions

2026-02-19 08:25:12 +00:00

control-auth.ts

Gateway: add SecretRef support for gateway.auth.token with auth-mode guardrails (#35094)

2026-03-05 12:53:56 -06:00

control-service.ts

refactor: harden browser runtime profile handling

2026-03-09 00:25:43 +00:00

csrf.ts

fix(browser): annotate csrf middleware type

2026-02-14 15:54:29 +01:00

errors.ts

test: harden channel suite isolation

2026-03-23 11:09:12 +00:00

form-fields.ts

refactor(browser): unify fill field normalization

2026-02-26 22:17:58 +01:00

http-auth.ts

refactor(browser): centralize http auth

2026-02-14 13:30:11 +01:00

navigation-guard.test.ts

fix(browser): enforce redirect-hop SSRF checks

2026-03-09 05:41:36 +00:00

navigation-guard.ts

fix(browser): enforce redirect-hop SSRF checks

2026-03-09 05:41:36 +00:00

output-atomic.ts

follow-up: align ingress, atomic paths, and channel tests with credential semantics (#33733)

2026-03-03 20:29:46 -06:00

paths.test.ts

refactor: dedupe agent and browser cli helpers

2026-03-03 00:15:00 +00:00

paths.ts

fix(browser): harden writable output paths

2026-03-01 23:25:13 +00:00

profile-capabilities.ts

!refactor(browser): remove Chrome extension path and add MCP doctor migration (#47893)

2026-03-15 23:56:08 -07:00

profiles-service.test.ts

test: speed up browser and gateway suites

2026-03-24 17:27:02 +00:00

profiles-service.ts

Browser: support non-Chrome existing-session profiles via userDataDir (#48170)

2026-03-16 14:21:22 +01:00

profiles.test.ts

test: optimize gateway infra memory and security coverage

2026-02-21 21:44:50 +00:00

profiles.ts

chore: Enable typescript/no-explicit-any rule.

2026-02-02 16:18:09 +09:00

proxy-files.test.ts

fix(browser): restore proxy attachment media size cap (#43684)

2026-03-12 01:04:31 -04:00

proxy-files.ts

fix(browser): restore proxy attachment media size cap (#43684)

2026-03-12 01:04:31 -04:00

pw-ai-module.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

pw-ai-state.ts

perf(test): reduce hot-suite import and setup overhead

2026-02-13 20:26:39 +00:00

pw-ai.e2e.test.ts

test: move integration-heavy suites to e2e lane

2026-03-02 05:33:07 +00:00

pw-ai.ts

fix(browser): normalize batch act dispatch for selector and batch support (#45457)

2026-03-13 15:10:55 -07:00

pw-role-snapshot.test.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

pw-role-snapshot.ts

fix(browser): harden existing-session driver validation and session lifecycle (#45682)

2026-03-13 20:21:47 -07:00

pw-session.browserless.live.test.ts

refactor: unify minimax model and failover live policies

2026-03-23 00:02:35 -07:00

pw-session.connections.test.ts

refactor(browser): scope CDP sessions and harden stale target recovery

2026-03-08 19:52:33 +00:00

pw-session.create-page.navigation-guard.test.ts

fix(browser): enforce redirect-hop SSRF checks

2026-03-09 05:41:36 +00:00

pw-session.get-page-for-targetid.extension-fallback.test.ts

!refactor(browser): remove Chrome extension path and add MCP doctor migration (#47893)

2026-03-15 23:56:08 -07:00

pw-session.mock-setup.ts

fix(ci): add explicit mock types in pw-session mock setup

2026-02-22 08:05:12 +00:00

pw-session.page-cdp.test.ts

!refactor(browser): remove Chrome extension path and add MCP doctor migration (#47893)

2026-03-15 23:56:08 -07:00

pw-session.page-cdp.ts

!refactor(browser): remove Chrome extension path and add MCP doctor migration (#47893)

2026-03-15 23:56:08 -07:00

pw-session.test.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

pw-session.ts

!refactor(browser): remove Chrome extension path and add MCP doctor migration (#47893)

2026-03-15 23:56:08 -07:00

pw-tools-core.activity.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

pw-tools-core.clamps-timeoutms-scrollintoview.test.ts

test: speed up browser pw-tools-core suites

2026-03-24 20:39:13 +00:00

pw-tools-core.downloads.ts

follow-up: align ingress, atomic paths, and channel tests with credential semantics (#33733)

2026-03-03 20:29:46 -06:00

pw-tools-core.interactions.batch.test.ts

test: speed up browser pw-tools-core suites

2026-03-24 20:39:13 +00:00

pw-tools-core.interactions.evaluate.abort.test.ts

test: harden channel suite isolation

2026-03-23 11:09:12 +00:00

pw-tools-core.interactions.set-input-files.test.ts

test: harden channel suite isolation

2026-03-23 12:57:43 +00:00

pw-tools-core.interactions.ts

browser: drop headless/remote MCP attach modes, simplify existing-session to autoConnect-only (#46628)

2026-03-14 15:54:22 -07:00

pw-tools-core.last-file-chooser-arm-wins.test.ts

test: speed up browser pw-tools-core suites

2026-03-24 20:39:13 +00:00

pw-tools-core.responses.ts

fix: harden browser existing-session flows

2026-03-13 23:56:48 +00:00

pw-tools-core.screenshots-element-selector.test.ts

test: speed up browser suites

2026-03-24 17:49:25 +00:00

pw-tools-core.shared.ts

fix(browser): normalize batch act dispatch for selector and batch support (#45457)

2026-03-13 15:10:55 -07:00

pw-tools-core.snapshot.navigate-guard.test.ts

fix(browser): enforce redirect-hop SSRF checks

2026-03-09 05:41:36 +00:00

pw-tools-core.snapshot.ts

fix(browser): enforce redirect-hop SSRF checks

2026-03-09 05:41:36 +00:00

pw-tools-core.state.ts

refactor: harden browser relay CDP flows

2026-03-08 23:46:10 +00:00

pw-tools-core.storage.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

pw-tools-core.test-harness.ts

fix(browser): retry relay navigation after frame detach

2026-03-02 06:14:52 +00:00

pw-tools-core.trace.ts

fix(security): unify root-bound write hardening

2026-03-02 17:12:33 +00:00

pw-tools-core.ts

refactor(browser): split pw tools + agent routes

2026-01-14 05:39:44 +00:00

pw-tools-core.waits-next-download-saves-it.test.ts

test: speed up browser pw-tools-core suites

2026-03-24 20:39:13 +00:00

request-policy.test.ts

Block reset-profile on lower-privilege browser request surfaces (#54618)

2026-03-25 13:36:59 -06:00

request-policy.ts

Block reset-profile on lower-privilege browser request surfaces (#54618)

2026-03-25 13:36:59 -06:00

resolved-config-refresh.ts

Browser: support non-Chrome existing-session profiles via userDataDir (#48170)

2026-03-16 14:21:22 +01:00

runtime-lifecycle.ts

refactor: harden browser runtime profile handling

2026-03-09 00:25:43 +00:00

safe-filename.ts

refactor(shared): extract reused path and normalization helpers

2026-03-02 05:20:19 +00:00

screenshot.test.ts

test: move browser and web auto-reply local suites out of e2e

2026-02-22 11:05:26 +00:00

screenshot.ts

refactor(media): share image resize side grid and quality steps

2026-02-18 18:25:25 +00:00

server-context.availability.ts

fix(browser): reuse running loopback browser after probe miss

2026-03-23 10:05:26 -07:00

server-context.chrome-test-harness.ts

refactor(browser): dedupe control-server test harness

2026-02-22 17:54:51 +00:00

server-context.constants.ts

refactor(browser): split server context and unify CDP transport

2026-03-02 15:43:05 +00:00

server-context.ensure-browser-available.waits-for-cdp-ready.test.ts

ci: stabilize sharded channel lanes

2026-03-24 00:21:50 +00:00

server-context.existing-session.test.ts

Tests: fix fresh-main regressions (#53011)

2026-03-23 09:54:50 -07:00

server-context.hot-reload-profiles.test.ts

test: harden channel suite isolation

2026-03-23 11:09:12 +00:00

server-context.loopback-direct-ws.test.ts

refactor(browser): scope CDP sessions and harden stale target recovery

2026-03-08 19:52:33 +00:00

server-context.remote-profile-tab-ops.suite.ts

test: speed up browser suites

2026-03-24 17:49:25 +00:00

server-context.remote-profile-tab-ops.test.ts

refactor(browser): dedupe browser and cli command wiring

2026-03-02 21:31:36 +00:00

server-context.remote-tab-ops.harness.ts

refactor: split browser context/actions and unify CDP timeout policy

2026-03-02 16:02:39 +00:00

server-context.remote-tab-ops.test.ts

refactor(browser): dedupe browser and cli command wiring

2026-03-02 21:31:36 +00:00

server-context.reset.test.ts

test: harden channel suite isolation

2026-03-23 11:09:12 +00:00

server-context.reset.ts

!refactor(browser): remove Chrome extension path and add MCP doctor migration (#47893)

2026-03-15 23:56:08 -07:00

server-context.selection.ts

Browser: support non-Chrome existing-session profiles via userDataDir (#48170)

2026-03-16 14:21:22 +01:00

server-context.tab-ops.ts

Browser: support non-Chrome existing-session profiles via userDataDir (#48170)

2026-03-16 14:21:22 +01:00

server-context.tab-selection-state.suite.ts

test(memory): clear browser and plugin caches between cases

2026-03-24 10:05:32 -07:00

server-context.tab-selection-state.test.ts

refactor(browser): dedupe browser and cli command wiring

2026-03-02 21:31:36 +00:00

server-context.ts

fix: harden remote cdp probes

2026-03-15 08:23:01 -07:00

server-context.types.ts

fix(browser): add browser session selection

2026-03-14 03:46:44 +00:00

server-lifecycle.test.ts

test: harden channel suite isolation

2026-03-23 11:09:12 +00:00

server-lifecycle.ts

!refactor(browser): remove Chrome extension path and add MCP doctor migration (#47893)

2026-03-15 23:56:08 -07:00

server-middleware.ts

refactor(browser): share common server middleware

2026-02-15 04:46:10 +00:00

server.agent-contract-form-layout-act-commands.test.ts

test: harden threaded shared-worker suites

2026-03-24 08:37:00 +00:00

server.agent-contract-snapshot-endpoints.test.ts

test: harden threaded shared-worker suites

2026-03-24 08:37:00 +00:00

server.agent-contract.test-harness.ts

test: harden threaded shared-worker suites

2026-03-24 08:37:00 +00:00

server.auth-fail-closed.test.ts

fix: stop browser server tests from launching real chrome

2026-03-23 03:15:02 -07:00

server.auth-token-gates-http.test.ts

test: speed up browser control suites

2026-03-24 23:45:33 +00:00

server.control-server.test-harness.ts

test: harden channel suite isolation

2026-03-23 12:57:43 +00:00

server.evaluate-disabled-does-not-block-storage.test.ts

test: speed up browser suites

2026-03-24 17:49:25 +00:00

server.post-tabs-open-profile-unknown-returns-404.test.ts

test: harden threaded shared-worker suites

2026-03-24 08:37:00 +00:00

server.ts

refactor: harden browser runtime profile handling

2026-03-09 00:25:43 +00:00

session-tab-registry.test.ts

fix(browser): close tracked tabs on session cleanup (#36666)

2026-03-05 16:40:52 -08:00

session-tab-registry.ts

fix(browser): close tracked tabs on session cleanup (#36666)

2026-03-05 16:40:52 -08:00

snapshot-roles.ts

fix(browser): harden existing-session driver validation and session lifecycle (#45682)

2026-03-13 20:21:47 -07:00

target-id.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

test-fetch.ts

test: harden threaded shared-worker suites

2026-03-24 08:37:00 +00:00

test-port.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

trash.ts

refactor(security): unify secure id paths and guard weak patterns

2026-02-22 10:16:19 +01:00

url-pattern.test.ts

test: expand browser existing-session coverage

2026-03-14 00:22:45 +00:00

url-pattern.ts

fix: harden browser existing-session flows

2026-03-13 23:56:48 +00:00