Problem

gateway.controlUi.allowedOrigins only supports exact origin matching or a global "*" wildcard. Chrome extensions get a unique chrome-extension://<id> origin that changes when:

• Reinstalling the extension
• Switching Chrome profiles
• Loading unpacked from a different path

This forces users to update allowedOrigins every time the extension ID changes.

Proposed Solution

Support scheme-level wildcard patterns like chrome-extension://* in allowedOrigins.

The change in checkBrowserOrigin (src/gateway/origin-check.ts) would be minimal — after the exact match check, add a prefix/pattern match for entries ending with *:

// Current: exact match only
if (allowlist.has("*") || allowlist.has(parsedOrigin.origin)) return { ok: true, matchedBy: "allowlist" };

// Proposed: add wildcard prefix matching
for (const pattern of allowlist) {
  if (pattern.endsWith("*") && parsedOrigin.origin.startsWith(pattern.slice(0, -1))) {
    return { ok: true, matchedBy: "allowlist" };
  }
}

Use Case

Chrome extensions that connect to the OpenClaw gateway via WebSocket (e.g. side panel chat UIs, browser relay extensions). These extensions need stable access regardless of installation context.

Security Consideration

This is opt-in — users explicitly configure the pattern. chrome-extension://* is far more scoped than "*" (which is already supported), as it only allows Chrome extension origins, not arbitrary web pages.