Windows browser.proxy blocked: local listener owner could not be verified after clean WSL reinstall

Environment

• Windows Companion: 2026.7.1-3
• Gateway: 2026.6.34
• WSL: OpenClawGateway, WSL 2
• Gateway: ws://127.0.0.1:18789
• Windows Node: online and paired
• Enabled capability: Browser only

Problem

Browser control fails with:

Browser control authentication was blocked because the local listener owner could not be verified.

Clean reinstall performed

1. Exported and verified the old WSL backup.
2. Unregistered the OpenClawGateway WSL distribution.
3. Uninstalled Windows Companion.
4. Removed %APPDATA%\OpenClawTray, including old gateway records and device identities.
5. Restarted Windows.
6. Confirmed zero WSL distributions, zero OpenClaw processes, and port 18789 unused.
7. Installed the signed x64 Companion 2026.7.1-3 installer.
8. Selected “Install a local gateway (WSL).”
9. Enabled Browser only. System, Canvas, Screen capture, Camera, Location, TTS, and STT were disabled.
10. Allowed Companion to create a new Ubuntu 24.04 OpenClawGateway.
11. Did not restore the old backup.

Verified working

• Gateway service is running.
• Port 18789 is listening.
• Gateway RPC is OK.
• Windows Node is online and paired.
• browser.proxy is approved and effective.
• No browser proxy allowlist entry is missing.

Actual result

{
  "ok": false,
  "checks": [
    {
      "name": "gateway",
      "ok": false,
      "detail": "GatewayClientRequestError: Browser control authentication was blocked because the local listener owner could not be verified."
    }
  ]
}

Diagnostics also report:

• Gateway endpoint 18789 is listening.
• Browser proxy host 18791 is not listening.
• node.invoke fails for browser.proxy.
• Missing browser proxy allowlist: none.

Expected result

The Windows Browser proxy host should start and allow the paired local WSL Gateway to invoke browser.proxy.

Additional note

A node reapproval request is pending, but it includes System commands even though System capability is intentionally disabled. The effective approved commands already include browser.proxy.

A sanitized diagnostics bundle is attached.

openclaw-diagnostics-20260905-130804.txt

Start by tracing the reported node.invoke path for browser.proxy, using the gateway on port 18789 and the Windows browser proxy host expected on port 18791. Compare the local listener owner verification with the clean-install diagnostics and pending node reapproval details. Done means the proxy host starts, owner verification succeeds, and the paired WSL gateway can invoke browser.proxy.