Persist mac-7 tailnet CDP proxy endpoint

daily/2026-03-18.md

@@ -94,8 +94,11 @@
   - `mac-7` 自动化 Chrome LaunchAgent 已建立：`~/Library/LaunchAgents/com.lingyuzeng.chrome-cdp-mac7.plist`
   - `mac-7` 持久化本地 CDP 监听端口为 `127.0.0.1:9333`
   - `mac-7` 自动化 Chrome profile 路径为 `~/.openclaw/browser/mac7-automation-profile`
-  - `mac-7` 当前还存在一个临时 tailnet 转发监听：`100.64.0.23:9223 -> 127.0.0.1:9222`（Python 代理，当前存活，但不是已确认持久化的正式入口）
-  - `tailscale serve` 当前未配置成功，`tailscale serve status` 显示 `No serve config`
-  - 因此后续引用时应区分：
-    - 稳定本地自动化入口：`mac-7 localhost:9333`
-    - 临时 tailnet 入口：`mac-7 100.64.0.23:9223`
+  - `mac-7` 持久化 tailnet 转发入口已建立：`100.64.0.23:9223 -> 127.0.0.1:9333`
+  - 对应 LaunchAgent：`~/Library/LaunchAgents/com.lingyuzeng.chrome-cdp-tailnet-proxy-mac7.plist`
+  - 对应代理脚本：`~/.openclaw/bin/chrome_cdp_tailnet_proxy.py`
+  - 已验证 `http://100.64.0.23:9223/json/version` 返回 `200 OK`，可直接提供标准 CDP 元数据与 `webSocketDebuggerUrl`
+  - `tailscale serve` 当前仍未使用；正式持久化方案改为 LaunchAgent + Python TCP proxy
+  - 因此后续引用时可直接视为：
+    - 稳定本地自动化入口：`mac-7 127.0.0.1:9333`
+    - 稳定 tailnet 远程入口：`mac-7 100.64.0.23:9223`

shared/long-term/decisions/browser-endpoints-mac5-mac7.md

@@ -44,27 +44,35 @@ mac-7 hosts the dedicated automation Chrome instance.
 - Validation:
   - `http://127.0.0.1:9333/json/version` returns standard CDP metadata and `webSocketDebuggerUrl`
 
-### Current tailnet-facing listener status
+### Persistent tailnet-facing listener
 
-Observed on 2026-03-18:
+Validated on 2026-03-18:
 
 - Tailscale IP on mac-7: `100.64.0.23`
-- A temporary Python TCP proxy was listening on:
-  - `100.64.0.23:9223`
-- That proxy was forwarding toward a Chrome debug port for network reachability testing.
+- Persistent tailnet listener: `100.64.0.23:9223`
+- Forward target: `127.0.0.1:9333`
+- LaunchAgent:
+  - `~/Library/LaunchAgents/com.lingyuzeng.chrome-cdp-tailnet-proxy-mac7.plist`
+- Proxy script:
+  - `~/.openclaw/bin/chrome_cdp_tailnet_proxy.py`
+- Validation:
+  - `http://100.64.0.23:9223/json/version` returns `200 OK`
+  - returned `webSocketDebuggerUrl` is reachable on the tailnet-facing endpoint
 
 ### Important caveat
 
-The `100.64.0.23:9223` listener was observed as a temporary proxy, not yet confirmed as a durable/persistent service managed by LaunchAgent or `tailscale serve`.
+`tailscale serve` is not the active solution here.
 
-Also, `tailscale serve status` showed:
+Observed status:
 
-- `No serve config`
+- `tailscale serve status` => `No serve config`
+
+The durable implementation is instead LaunchAgent + Python TCP proxy.
 
 So future tasks should treat the endpoints as:
 
 - **stable local automation endpoint on mac-7:** `127.0.0.1:9333`
-- **temporary observed tailnet endpoint on mac-7:** `100.64.0.23:9223`
+- **stable tailnet remote endpoint on mac-7:** `100.64.0.23:9223`
 
 ## Usage guidance