OpenClaw Main Repairs Tab Copilot Sharing Across Reloads and Disabled Heartbeats

OpenClaw has merged three repairs for the Chrome extension’s Tab Copilot path. Together they address a shared tab that never wakes, a page question that cannot extract page content and a fresh browser instance that cannot create a replacement Copilot session.

These fixes are on main. The supplied upstream records do not identify a containing package, so an installed version should not be assumed fixed merely because the pull requests are merged.

Disabled heartbeats must not disable shared-tab work

PR #116790 fixes page-share dispatch when heartbeat.every is set to "0m". A share can still arrive while periodic heartbeats are disabled; the scheduler therefore needs an explicit wake signal for that queued work.

The final patch also preserves scoped-agent routing. The upstream report describes a share queued for a scoped session such as agent:ops:main: waking the configured default agent would target the wrong owner. The wake now leaves agent derivation to the queued session rather than substituting the default.

Operator impact: disabling routine heartbeat traffic must not silently turn browser sharing into polling-by-accident. Test both the default agent and every scoped agent that can own a shared tab.

Tab-bound runs can now use the documented extraction path

PR #116779 allows action=extract in tab-bound Browser Copilot runs. Before the fix, an agent could be instructed to use extraction for a question about the shared page and then be rejected before dispatch with browser action "extract" is unavailable in a tab-bound run.

This is deliberately a trust-boundary change, not a licence to broaden browser authority. A tab-bound run should remain bound to the shared tab and the actions its policy permits. The acceptance test is that extraction works inside that boundary—not that arbitrary navigation, cross-tab control or unrelated browser capabilities become available.

Reloaded extensions no longer collide with archived sessions

PR #116784 fixes session creation after an extension reload, update or browser restart. The durable Copilot registry survives in chrome.storage.local, while the browser-instance marker in chrome.storage.session resets. Upstream reports that the previous session could be archived while still retaining a globally unique Browser copilot Gateway label, preventing the fresh session from claiming it.

The merged repair derives unique Copilot session labels so the replacement browser instance can start without stealing identity from another live session.

Staging checklist

Use a disposable browser profile and a page with no sensitive account state:

1. set periodic heartbeats to disabled through the supported configuration path;
2. share a tab to the default agent and confirm one queued turn wakes promptly;
3. repeat with a non-default scoped agent and confirm only that session handles the share;
4. ask a page-content question that requires extract and verify the result comes from the shared tab;
5. reload the extension, restart the browser and update the extension in separate trials;
6. after each trial, confirm a fresh Copilot session starts, the prior session remains archived and labels are unique; and
7. verify no other tab becomes readable or controllable.

Do not use a live banking, email or administrative tab for this test. The Chrome extension relay can act with the authority of the attached browser context.

Incident handling on older builds

If a shared tab appears inert, do not repeatedly resubmit a side-effecting request. Inspect the intended agent session, queued turn and extension lifecycle first. A missing reply may mean work is queued under the correct owner but was never awakened; a reload failure may instead be a stale-label collision.

If page extraction is rejected, record the exact action and tab-bound policy rather than broadening browser permissions as a workaround.

Evidence and limits

The official merged PR and commit records supplied by the repository collector establish the three failures and landed changes. Browser extraction of the GitHub pages returned HTTP 403 during verification, and the configured search backend was unavailable. OpenClaw Academy did not attach a live Chrome profile or execute the extension lifecycle matrix.

Relevant collector source IDs are 35093/34946, 35099/34948 and 35111/34959.

Bottom line

Tab Copilot now has a coherent lifecycle contract on main: a share wakes even without periodic heartbeats, page extraction works inside the shared-tab boundary, and a replacement extension instance receives a fresh session identity. Stage all three boundaries before trusting browser sharing for unattended work.