- CLI/plugins: keep bare plugin and parent-command help on the lightweight path, avoiding plugin registry discovery before rendering help.

- CLI tables: preserve muted/color styling on wrapped continuation lines after multiline cells, keeping `openclaw plugins list` descriptions readable.

- Process execution: collapse case-insensitive duplicate child environment keys on Windows so caller-provided overrides such as `PATH` cannot be shadowed by host `Path`.

- Browser CLI: request the existing `operator.admin` gateway scope explicitly for browser control commands, avoiding unnecessary scope-upgrade approval loops. Fixes #81555. (#81716) Thanks @joshavant.

- iOS: restore first-use Contacts, Calendar, and Reminders permission prompts and add Privacy & Access status/actions in Settings. Thanks @BunsDev.

- Canvas: return not found for malformed percent-encoded Canvas/A2UI/document asset paths and keep decoded parent traversal blocked before path normalization.

- Telegram: allow trusted local Bot API media files whose filenames start with dots instead of falling back to remote download.

OpenClawPluginToolContext,

OpenClawPluginToolFactory,

} from "openclaw/plugin-sdk/plugin-entry";

import {

BROWSER_REQUEST_GATEWAY_METHOD,

BROWSER_REQUEST_GATEWAY_SCOPE,

} from "./src/browser-gateway-contract.js";

import { BrowserToolSchema } from "./src/browser-tool.schema.js";

const BROWSER_CLI_DESCRIPTOR = {

{ commands: ["browser"], descriptors: [BROWSER_CLI_DESCRIPTOR] },

);

api.registerGatewayMethod(

"browser.request",

BROWSER_REQUEST_GATEWAY_METHOD,

async (opts) => {

const { handleBrowserGatewayRequest } = await import("./register.runtime.js");

return await handleBrowserGatewayRequest(opts);

},

{

scope: "operator.admin",

scope: BROWSER_REQUEST_GATEWAY_SCOPE,

},

);

api.registerService(createLazyBrowserPluginService());

export const BROWSER_REQUEST_GATEWAY_METHOD = "browser.request" as const;

export const BROWSER_REQUEST_GATEWAY_SCOPE = "operator.admin" as const;

export const BROWSER_REQUEST_GATEWAY_SCOPES = [BROWSER_REQUEST_GATEWAY_SCOPE] as const;

import { beforeEach, describe, expect, it, vi } from "vitest";

import type { callGatewayFromCli } from "./core-api.js";

type CallGatewayFromCliArgs = Parameters<typeof callGatewayFromCli>;

const gatewayMocks = vi.hoisted(() => ({

callGatewayFromCli: vi.fn(async () => ({ ok: true })),

}));

vi.mock("./core-api.js", () => ({

callGatewayFromCli: gatewayMocks.callGatewayFromCli,

}));

const { callBrowserRequest } = await import("./browser-cli-shared.js");

describe("callBrowserRequest", () => {

beforeEach(() => {

gatewayMocks.callGatewayFromCli.mockClear();

});

it("requests the browser.request admin scope explicitly", async () => {

await callBrowserRequest(

{ json: true },

{ method: "GET", path: "/status", query: { profile: "openclaw" } },

{ progress: true },

);

const call = gatewayMocks.callGatewayFromCli.mock.calls[0] as unknown as

| CallGatewayFromCliArgs

| undefined;

const extra = call?.[3];

expect(extra).toEqual({ progress: true, scopes: ["operator.admin"] });

});

});

import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";

import {

BROWSER_REQUEST_GATEWAY_METHOD,

BROWSER_REQUEST_GATEWAY_SCOPES,

} from "../browser-gateway-contract.js";

import { callGatewayFromCli, type GatewayRpcOpts } from "./core-api.js";

export type BrowserParentOpts = GatewayRpcOpts & {

: undefined;

const timeout = typeof resolvedTimeout === "number" ? String(resolvedTimeout) : opts.timeout;

const payload = await callGatewayFromCli(

"browser.request",

BROWSER_REQUEST_GATEWAY_METHOD,

{ ...opts, timeout },

{

method: params.method,

body: params.body,

timeoutMs: resolvedTimeout,

},

{ progress: extra?.progress },

{ progress: extra?.progress, scopes: [...BROWSER_REQUEST_GATEWAY_SCOPES] },

);

if (payload === undefined) {

throw new Error("Unexpected browser.request response");