openclaw/dist/extension-pairing-AjY_p-zu.mjs

Multi-channel AI gateway with extensible messaging integrations

import { b as resolveGatewayPort } from "./paths-BP0DYpE8.mjs";
import { s as isLoopbackHost } from "./net-CpjDDLK3.mjs";
import "./ssrf-runtime-CR-jTHeC.mjs";
import "./gateway-config-runtime-CybRSbWh.mjs";
import { a as resolveFirstExtensionProfileName, i as resolveBrowserConfig, s as resolveProfile } from "./config-NGx7eSU6.mjs";
import { t as ensureExtensionRelayToken } from "./relay-auth-il8ZM1pP.mjs";
//#region extensions/browser/src/browser/extension-pairing.ts
/** Gateway route for extension pairing that must wake Browser control. */
const GATEWAY_EXTENSION_RELAY_PATH = "/browser/extension";
/** Resolve a safe Gateway relay URL with the v2-bound route path. */
function buildGatewayExtensionRelayUrl(raw) {
	const url = URL.parse(raw.trim());
	if (!url) throw new Error("--gateway-url must be a valid ws:// or wss:// URL");
	const secure = url.protocol === "wss:";
	const localPlaintext = url.protocol === "ws:" && isLoopbackHost(url.hostname);
	if (!secure && !localPlaintext) throw new Error("--gateway-url must use wss:// (ws:// is allowed only for loopback)");
	if (url.username || url.password || url.search || url.hash) throw new Error("--gateway-url must not include credentials, a query, or a fragment");
	if (url.pathname !== "/") throw new Error("--gateway-url must not include a path prefix; Browser Relay Authentication v2 binds the exact /browser/extension path");
	url.pathname = GATEWAY_EXTENSION_RELAY_PATH;
	return url;
}
/**
* Build the canonical host-owned extension pairing used by both the CLI and
* native bootstrap. A direct remote pairing is opt-in because its key belongs
* to the remote Gateway rather than the browser host.
*/
async function buildBrowserExtensionPairing(params) {
	const resolved = resolveBrowserConfig(params.cfg.browser, params.cfg);
	const profileName = params.profile || resolveFirstExtensionProfileName(resolved);
	const profile = profileName ? resolveProfile(resolved, profileName) : null;
	if (params.profile && profile?.driver !== "extension") throw new Error("Native bootstrap requires an existing extension profile");
	const relayPort = profile?.cdpPort ?? resolved.extensionRelayDefaultPort;
	const token = await (params.ensureToken ?? ensureExtensionRelayToken)();
	const gateway = params.gatewayUrl?.trim();
	const configuredRemote = !gateway && params.cfg.gateway?.mode === "remote" ? params.cfg.gateway.remote?.url?.trim() : "";
	if (!gateway && !configuredRemote && params.cfg.gateway?.tls?.enabled === true) throw new Error("Gateway TLS pairing requires --gateway-url wss://<certificate-host>[:port]");
	const gatewayHint = gateway || configuredRemote || `ws://127.0.0.1:${resolveGatewayPort(params.cfg)}`;
	const relayUrl = gateway || !configuredRemote && params.localTransport === "gateway" ? buildGatewayExtensionRelayUrl(gatewayHint) : new URL(`ws://127.0.0.1:${relayPort}/extension`);
	if (!gateway && params.profile && relayUrl.pathname === GATEWAY_EXTENSION_RELAY_PATH) relayUrl.searchParams.set("profile", params.profile);
	relayUrl.searchParams.set("gateway", gatewayHint);
	return {
		pairingString: `${relayUrl.toString()}#${token}`,
		relayPort,
		topology: gateway ? "direct-remote" : configuredRemote ? "browser-node" : "local"
	};
}
//#endregion
export { buildBrowserExtensionPairing as t };