YM-OpenClaw

Summary¶

The JS-shim path (webauthn.useNativeCdpDomain: false) reaches OpenClaw's managed browser through a single explicit webauthn.cdpUrl, which until now accepted only a ws(s):// URL or an http(s):// base queried at /json/version.

Chrome 144+ can expose a permission-gated listener whose HTTP discovery surface returns 404. In that configuration the owner-approved browser WebSocket is recorded only in the profile's DevToolsActivePort file, and both existing forms fail: the HTTP base cannot be queried, and a hardcoded ws:// URL goes stale because the port and browser id rotate on every browser restart.

Scope¶

• Accept a file:///.../DevToolsActivePort URL as a third form of webauthn.cdpUrl.
• Read the two-line file, validate the port and the /devtools/browser/<id> endpoint, and connect to the resolved ws://127.0.0.1:<port><path>.
• Reject a URL matching none of the three accepted forms instead of letting it fail obscurely inside the HTTP discovery path.
• Keep the connection scoped to one explicit config rather than port scanning. Chrome still owns the user approval prompt.

Notes¶

Follows the Identity Vault browser-integration stopgap described in docs/browser-integration.md; the core page-script hook remains the cleaner long-term option.

Regression coverage is pure-function over a temporary DevToolsActivePort file: pass-through, successful resolution, and rejection of an out-of-range port and a non-browser endpoint path.