</Step>

</Steps>

## Lifecycle Scripts

## Lifecycle scripts

Bun blocks dependency lifecycle scripts unless explicitly trusted. For this repo, the commonly blocked scripts are not required:

If no proxy env vars are set, direct egress is used. If proxy config is malformed, OpenClaw logs a warning and falls back to direct fetch.

## Mention Detection in Groups

## Mention detection in groups

When `requireMention: true` is set for a group chat, OpenClaw now transcribes audio **before** checking for mentions. This allows voice notes to be processed even when they contain mentions.

- When media is present, the web sender resolves local paths or URLs using the same pipeline as `openclaw message send`.

- Multiple media entries are sent sequentially if provided.

## Inbound Media to Commands (Pi)

## Inbound media to commands (Pi)

- When inbound web messages include media, OpenClaw downloads to a temp file and exposes templating variables:

- `{{MediaUrl}}` pseudo-URL for the inbound media.

System control (launchd/systemd) lives on the Gateway host. See [Gateway](/gateway).

## Connection Runbook

## Connection runbook

Android node app ⇄ (mDNS/NSD + WebSocket) ⇄ **Gateway**

<Check>Tests pass (`pnpm test -- <bundled-plugin-root>/my-plugin/`)</Check>

<Check>`pnpm check` passes (in-repo plugins)</Check>

## Beta Release Testing

## Beta release testing

1. Watch for GitHub release tags on [openclaw/openclaw](https://github.com/openclaw/openclaw/releases) and subscribe via `Watch` > `Releases`. Beta tags look like `v2026.3.N-beta.1`. You can also turn on notifications for the official OpenClaw X account [@openclaw](https://x.com/openclaw) for release announcements.

2. Test your plugin against the beta tag as soon as it appears. The window before stable is typically only a few hours.

**Methodology:** MITRE ATLAS + Data Flow Diagrams

**Framework:** [MITRE ATLAS](https://atlas.mitre.org/) (Adversarial Threat Landscape for AI Systems)

### Framework Attribution

### Framework attribution

This threat model is built on [MITRE ATLAS](https://atlas.mitre.org/), the industry-standard framework for documenting adversarial threats to AI/ML systems. ATLAS is maintained by [MITRE](https://www.mitre.org/) in collaboration with the AI security community.

{"error":"Error: Failed to start Chrome CDP on port 18800 for profile \"openclaw\"."}

```

### Root Cause

### Root cause

On Ubuntu (and many Linux distros), the default Chromium installation is a **snap package**. Snap's AppArmor confinement interferes with how OpenClaw spawns and monitors the browser process.

curl -s http://127.0.0.1:18791/tabs

```

### Config Reference

### Config reference

| Option | Description | Default |

| -------------------------------- | -------------------------------------------------------------------- | ----------------------------------------------------------- |

}

```

## How To Use It

## How to use it

Ask naturally and make the analysis intent explicit:

If you are writing a native plugin, start with [Building Plugins](/plugins/building-plugins)

and the [Plugin SDK Overview](/plugins/sdk-overview).

## Package Entrypoints

## Package entrypoints

Native plugin npm packages must declare `openclaw.extensions` in `package.json`.

Each entry must stay inside the package directory and resolve to a readable

See [Tailscale](/gateway/tailscale) for HTTPS setup guidance.

## Content Security Policy

## Content security policy

The Control UI ships with a tight `img-src` policy: only **same-origin** assets, `data:` URLs, and locally generated `blob:` URLs are allowed. Remote `http(s)` and protocol-relative image URLs are rejected by the browser and do not issue network fetches.