CDP_PORT="${OPENCLAW_BROWSER_CDP_PORT:-9222}"

CDP_SOURCE_RANGE="${OPENCLAW_BROWSER_CDP_SOURCE_RANGE:-}"

CDP_AUTH_TOKEN="${OPENCLAW_BROWSER_CDP_AUTH_TOKEN:-}"

VNC_PORT="${OPENCLAW_BROWSER_VNC_PORT:-5900}"

NOVNC_PORT="${OPENCLAW_BROWSER_NOVNC_PORT:-6080}"

ENABLE_NOVNC="${OPENCLAW_BROWSER_ENABLE_NOVNC:-1}"

local pids=()

local pid

for pid in "${WEBSOCKIFY_PID:-}" "${X11VNC_PID:-}" "${SOCAT_PID:-}" "${CHROME_PID:-}" "${XVFB_PID:-}"; do

for pid in "${WEBSOCKIFY_PID:-}" "${X11VNC_PID:-}" "${CDP_RELAY_PID:-}" "${CHROME_PID:-}" "${XVFB_PID:-}"; do

if [[ -n "${pid:-}" ]]; then

pids+=("$pid")

fi

exit 1

fi

echo "[sandbox] CDP ready. Starting socat..."

echo "[sandbox] CDP ready. Starting relay..."

if [[ -z "${CDP_SOURCE_RANGE}" ]]; then

echo "[sandbox-browser] WARNING: CDP_SOURCE_RANGE unset; socat CDP relay will not start." >&2

echo "[sandbox-browser] Set OPENCLAW_BROWSER_CDP_SOURCE_RANGE to an explicit CIDR to enable CDP access." >&2

if [[ -z "${CDP_AUTH_TOKEN}" ]]; then

echo "[sandbox-browser] WARNING: CDP auth token unset; CDP relay will not start." >&2

else

SOCAT_LISTEN_ADDR="TCP-LISTEN:${CDP_PORT},fork,reuseaddr,bind=0.0.0.0"

SOCAT_LISTEN_ADDR="${SOCAT_LISTEN_ADDR},range=${CDP_SOURCE_RANGE}"

socat "${SOCAT_LISTEN_ADDR}" "TCP:127.0.0.1:${CHROME_CDP_PORT}" &

SOCAT_PID=$!

echo "[sandbox] socat started (PID: ${SOCAT_PID})"

OPENCLAW_BROWSER_CHROME_CDP_PORT="${CHROME_CDP_PORT}" python3 - <<'PY' &

import base64

import hmac

import ipaddress

import os

import select

import socket

import socketserver

import sys

import time

LISTEN_PORT = int(os.environ["OPENCLAW_BROWSER_CDP_PORT"])

UPSTREAM_PORT = int(os.environ["OPENCLAW_BROWSER_CHROME_CDP_PORT"])

AUTH_TOKEN = os.environ["OPENCLAW_BROWSER_CDP_AUTH_TOKEN"]

SOURCE_RANGE = os.environ.get("OPENCLAW_BROWSER_CDP_SOURCE_RANGE", "").strip()

MAX_HEADER_BYTES = 65536

HEADER_READ_TIMEOUT_SECONDS = 5.0

try:

SOURCE_NETWORK = ipaddress.ip_network(SOURCE_RANGE, strict=False) if SOURCE_RANGE else None

except ValueError:

print(f"[sandbox-browser] ERROR: invalid CDP source range: {SOURCE_RANGE}", file=sys.stderr)

raise SystemExit(1)

EXPECTED_BASIC = "Basic " + base64.b64encode(f"openclaw:{AUTH_TOKEN}".encode()).decode()

EXPECTED_BEARER = "Bearer " + AUTH_TOKEN

def source_allowed(host):

if SOURCE_NETWORK is None:

return True

try:

return ipaddress.ip_address(host) in SOURCE_NETWORK

except ValueError:

return False

def has_auth(header_bytes):

try:

text = header_bytes.decode("iso-8859-1")

except UnicodeDecodeError:

return False

for line in text.split("\r\n")[1:]:

name, sep, value = line.partition(":")

if sep and name.strip().lower() == "authorization":

auth = value.strip()

basic_ok = hmac.compare_digest(auth, EXPECTED_BASIC)

bearer_ok = hmac.compare_digest(auth, EXPECTED_BEARER)

return basic_ok or bearer_ok

return False

def read_headers(conn, deadline):

data = b""

while b"\r\n\r\n" not in data:

remaining = deadline - time.monotonic()

if remaining <= 0:

return b""

conn.settimeout(remaining)

try:

chunk = conn.recv(4096)

except socket.timeout:

return b""

if not chunk:

return b""

data += chunk

if len(data) > MAX_HEADER_BYTES:

return b""

return data

def relay(left, right):

sockets = [left, right]

try:

while sockets:

readable, _, _ = select.select(sockets, [], [])

for src in readable:

dst = right if src is left else left

data = src.recv(65536)

if not data:

return

dst.sendall(data)

finally:

for sock in (left, right):

try:

sock.shutdown(socket.SHUT_RDWR)

except OSError:

pass

try:

sock.close()

except OSError:

pass

class Handler(socketserver.BaseRequestHandler):

def handle(self):

client_host = self.client_address[0]

if not source_allowed(client_host):

return

header_deadline = time.monotonic() + HEADER_READ_TIMEOUT_SECONDS

header_bytes = read_headers(self.request, header_deadline)

if not header_bytes:

return

if not has_auth(header_bytes):

self.request.sendall(

b"HTTP/1.1 401 Unauthorized\r\n"

b'WWW-Authenticate: Basic realm="OpenClaw CDP"\r\n'

b"Connection: close\r\n"

b"Content-Length: 0\r\n\r\n"

)

return

upstream = socket.create_connection(("127.0.0.1", UPSTREAM_PORT), timeout=5)

upstream.settimeout(None)

self.request.settimeout(None)

upstream.sendall(header_bytes)

relay(self.request, upstream)

class Server(socketserver.ThreadingTCPServer):

allow_reuse_address = True

daemon_threads = True

with Server(("0.0.0.0", LISTEN_PORT), Handler) as server:

print("[sandbox] CDP relay started", flush=True)

server.serve_forever()

PY

CDP_RELAY_PID=$!

echo "[sandbox] CDP relay started (PID: ${CDP_RELAY_PID})"

fi

if [[ "${ENABLE_NOVNC}" == "1" && "${HEADLESS}" != "1" ]]; then