OpenClaw Main Replaces Tab Copilot with an Automatic Chrome Extension Bootstrap

OpenClaw has merged a substantial Chrome extension reset into main: the old prompt box, page-sharing and Tab Copilot flows are retired, while browser automation pairs automatically to a local Gateway through a tightly scoped native-messaging bootstrap.

“Zero-click” describes pairing after installation, not silent extension installation. Chrome still requires an operator to enable Developer mode and load the unpacked extension once.

Availability: the feature is on main; verify the containing package before following the new workflow.

The extension now has one job

PR #121586 and the official docs define the extension as browser-control infrastructure. It exposes eligible signed-in tabs through the built-in chrome browser profile. It no longer provides chat, page sharing, a side panel or a tab copilot.

That is a breaking workflow change for anyone relying on the retired interface. Existing automation users also need to understand the new default: fresh automatic pairings use All tabs access. Existing valid pairings keep their stored mode.

Operators can instead select Selected tabs, where membership in an OpenClaw tab group becomes the access boundary. Incognito and internal Chrome pages remain excluded; file URLs require Chrome’s separate permission.

What automatic bootstrap actually does

On macOS and Linux, openclaw browser extension install copies the bundled extension to a stable OpenClaw-owned path, derives the deterministic extension ID from that exact path and pre-registers an origin-locked native host before asking the operator to load the extension.

The one unavoidable browser step remains:

1. open chrome://extensions;
2. enable Developer mode;
3. choose Load unpacked; and
4. select the printed stable path while the installer is running.

The native host then returns one locally generated pairing response to the exact authorised extension origin. The documented implementation uses bounded, versioned framing and exits after one request. It rejects unsafe ownership, permissions, symlinks, wildcard origins and foreign same-name registrations.

Windows keeps manual pairing because current Chromium requires a Windows executable for native-host launch and the merged path does not install an unproven script shim.

Migration trap: retired Copilot state

The new extension preserves rather than silently discards a pre-upgrade Copilot recovery state. If Settings says automation is paused to protect that state, operators must first confirm old work is finished, then explicitly disconnect/disable automatic setup and choose Use local OpenClaw to establish the new automation pairing.

Chrome also caches an initial missing-native-host result for the life of the browser process. If the extension attempted setup before the host was installed, restart Chrome once; repeatedly clicking retry cannot clear that cache.

Security decision: All tabs or selected tabs

All-tabs mode is convenient for away-from-desk automation, but it gives the extension debugger access to every eligible ordinary tab in that Chrome profile unless the current tab is paused. That can include authenticated business systems.

Recommendation: use a dedicated Chrome profile and Selected-tabs mode unless broad access is an explicit requirement. The isolated OpenClaw-managed browser remains the safer default when existing logged-in sessions are unnecessary.

Acceptance checklist

Use a clean browser profile and synthetic accounts:

1. run extension status and record only non-secret health fields;
2. install the host before loading the extension;
3. verify Chrome records the expected unpacked realpath and deterministic ID;
4. switch to Selected tabs, move one harmless tab into and out of the OpenClaw group, and prove access follows immediately;
5. confirm incognito, internal pages and an unapproved ordinary tab remain absent;
6. pause one tab and require current debugger attachment to end;
7. remove or corrupt the owned native host and require a bounded failure without credentials in logs;
8. test restart recovery; and
9. on upgrade from Tab Copilot, archive any needed output before explicitly discarding retired recovery state.

Do not paste the manual pairing string into tickets, chat or shell history; treat it as a password.

Bottom line

The new bootstrap removes fragile copy-and-paste pairing and sharply narrows the extension’s product surface. It does not narrow tab authority by default. Separate browser profiles and Selected-tabs access are still the sensible production posture.