[devSejung]

What Problem This Solves

PlatformClaw browser users need access to their provisioned OpenClaw agent without receiving unrestricted Gateway credentials or being able to reach another user's agent, sessions, credentials, or administrative methods.

Why This Change Was Made

Adds a control-plane-owned browser Gateway proxy policy that binds every request to the authenticated PlatformClaw browser session and its personal agent. The proxy uses explicit method allowlists, rewrites agent and session scope server-side, projects responses to browser-safe shapes, and records denied access in the existing control-plane audit store. Enterprise policy remains isolated in packages/platformclaw-control-plane instead of modifying OpenClaw Gateway core.

User Impact

Authenticated browser users can use the allowed agent, chat, session, model, and health operations for their own managed agent. They cannot select arbitrary agents, raw model profiles, archived sessions, administrative cron behavior, or diagnostic model catalogs. Knox room routing is unchanged.

Evidence

• Rebased cleanly onto origin/main after PR feat(platformclaw): provision personal agents #8 merged.
• Focused control-plane Vitest: 9 files passed; 81 tests passed; 1 Windows permission-dependent test skipped.
• Package-scoped tsgo typecheck passed.
• Targeted oxlint passed for the new proxy, projection, contract, and export surfaces.
• git diff --check origin/main...HEAD passed.
• Six autoreview passes were completed during implementation and all accepted findings were addressed. No additional pass was run because the repository policy now limits a task to two invocations unless the user explicitly approves more.
• The full lint wrapper could not start its target lint because the existing plugin-SDK boundary preparation fails in packages/net-policy/src/ip.ts; this is outside the PlatformClaw diff. The changed files were linted directly with the repository oxlint configuration.

AI-assisted: yes. The author reviewed the implementation and validation results.