Summary

Chrome Browser Relay extension handshake is rejected with origin not allowed on Windows/local gateway even when the extension origin is explicitly present in gateway.controlUi.allowedOrigins.

Environment

• OpenClaw: 2026.3.8 (3caab92)
• OS: Windows 11 (10.0.26200)
• Gateway mode: local
• Gateway bind: lan
• Gateway URL used by extension: http://127.0.0.1:18789
• Chrome detected locally at: C:\Program Files\Google\Chrome\Application\chrome.exe
• Extension origin observed in logs: chrome-extension://pfhemcnpfilapbppdkfemikblgnnikdp

Reproduction

1. Install/load the OpenClaw Chrome extension.
2. In extension options, configure the gateway URL as http://127.0.0.1:18789 and the correct gateway token.
3. Ensure the local gateway is running.
4. Add the extension origin to config:

{
  "gateway": {
    "controlUi": {
      "allowedOrigins": [
        "http://localhost:18789",
        "http://127.0.0.1:18789",
        "chrome-extension://pfhemcnpfilapbppdkfemikblgnnikdp"
      ]
    }
  }
}

5. Restart the gateway.
6. Click the extension on a Chrome tab to attach.

Expected

The extension handshake should be accepted and the tab should become attachable (ON), or at least progress past origin validation.

Actual

The extension shows ! / fails to attach, and the gateway repeatedly logs origin not allowed for the extension origin.

Evidence

Relevant gateway log lines:

warn gateway/ws {"cause":"origin-mismatch","handshake":"failed","host":"127.0.0.1:18789","origin":"chrome-extension://pfhemcnpfilapbppdkfemikblgnnikdp","reason":"origin not allowed"}

I also confirmed in the built runtime code that the failing branch points to gateway.controlUi.allowedOrigins:

• checkBrowserOrigin(...) lowercases/compares allowedOrigins
• the error string is: origin not allowed (open the Control UI from the gateway host or allow it in gateway.controlUi.allowedOrigins)

What was already ruled out

• Bad config write / BOM issue: config was patched via OpenClaw config.patch, not PowerShell file writing.
• Config persistence: C:\Users\kevin\.openclaw\openclaw.json contains the extension origin exactly.
• Restart failure: gateway restart completed successfully after the patch.
• Wrong URL shape: extension successfully connects to the local gateway URL http://127.0.0.1:18789; wss://... was not used for the final repro.
• Wrong field according to docs: local docs for tools/chrome-extension.md and web/control-ui.md both point at gateway.controlUi.allowedOrigins.

Suspicion

This looks like one of:

1. a regression/bug where the extension websocket handshake is not actually using the live gateway.controlUi.allowedOrigins value,
2. a second/hidden origin allowlist path for extension clients,
3. a Windows-specific/local-gateway issue in the Chrome relay path.

Nice-to-have diagnostics

If useful, I can provide a sanitized full config excerpt and a longer log window, but the key symptom is reproducible with the exact extension origin already allowlisted.