-
-
Notifications
You must be signed in to change notification settings - Fork 80.7k
[Feature]: web canvas node support — allow browser tabs to register as A2UI canvas surfaces #66983
Copy link
Copy link
Open
Labels
P2Normal backlog priority with limited blast radius.Normal backlog priority with limited blast radius.clawsweeper:fix-shape-clearClawSweeper found a clear likely implementation shape for this issue.ClawSweeper found a clear likely implementation shape for this issue.clawsweeper:needs-maintainer-reviewClawSweeper marked this issue as needing maintainer review before automation.ClawSweeper marked this issue as needing maintainer review before automation.clawsweeper:needs-product-decisionClawSweeper marked this issue as needing a product or behavior decision.ClawSweeper marked this issue as needing a product or behavior decision.clawsweeper:needs-security-reviewClawSweeper marked this issue as needing security-sensitive review.ClawSweeper marked this issue as needing security-sensitive review.clawsweeper:no-new-fix-prClawSweeper does not recommend queueing a new automated fix PR for this issue.ClawSweeper does not recommend queueing a new automated fix PR for this issue.clawsweeper:source-reproClawSweeper found a high-confidence source-level issue reproduction.ClawSweeper found a high-confidence source-level issue reproduction.enhancementNew feature or requestNew feature or requestimpact:securitySecurity boundary, credential, authz, sandbox, or sensitive-data risk.Security boundary, credential, authz, sandbox, or sensitive-data risk.issue-rating: 🦞 diamond lobsterVery strong issue quality with high-confidence source-level or clear reproduction.Very strong issue quality with high-confidence source-level or clear reproduction.maturity:stableIssue affects a taxonomy feature currently scored M4/M5.Issue affects a taxonomy feature currently scored M4/M5.
Description
Metadata
Metadata
Assignees
Labels
P2Normal backlog priority with limited blast radius.Normal backlog priority with limited blast radius.clawsweeper:fix-shape-clearClawSweeper found a clear likely implementation shape for this issue.ClawSweeper found a clear likely implementation shape for this issue.clawsweeper:needs-maintainer-reviewClawSweeper marked this issue as needing maintainer review before automation.ClawSweeper marked this issue as needing maintainer review before automation.clawsweeper:needs-product-decisionClawSweeper marked this issue as needing a product or behavior decision.ClawSweeper marked this issue as needing a product or behavior decision.clawsweeper:needs-security-reviewClawSweeper marked this issue as needing security-sensitive review.ClawSweeper marked this issue as needing security-sensitive review.clawsweeper:no-new-fix-prClawSweeper does not recommend queueing a new automated fix PR for this issue.ClawSweeper does not recommend queueing a new automated fix PR for this issue.clawsweeper:source-reproClawSweeper found a high-confidence source-level issue reproduction.ClawSweeper found a high-confidence source-level issue reproduction.enhancementNew feature or requestNew feature or requestimpact:securitySecurity boundary, credential, authz, sandbox, or sensitive-data risk.Security boundary, credential, authz, sandbox, or sensitive-data risk.issue-rating: 🦞 diamond lobsterVery strong issue quality with high-confidence source-level or clear reproduction.Very strong issue quality with high-confidence source-level or clear reproduction.maturity:stableIssue affects a taxonomy feature currently scored M4/M5.Issue affects a taxonomy feature currently scored M4/M5.
Type
Fields
Priority
None yet
Summary
A2UI was designed platform-agnostically: the agent sends declarative JSONL, the client renders it using its own native components. The spec explicitly supports React, Lit, Angular, Flutter etc. as renderers. However, OpenClaw's gateway currently only allows canvas commands for iOS, Android, and macOS node clients —
linux,windows, and any web/browser platform are excluded fromnode-command-policy.ts.Problem to solve
There is no way to register a web browser tab as a canvas surface today. A web app that wants to receive
canvas.a2ui.pushJSONLand render A2UI natively using@a2ui/reactis blocked at two levels:Command allowlist: The
linux/windowsplatform defaults excludecanvas.*commands. A browser connecting withplatform: "web"hits theunknownbucket, which does include canvas — but only becauseunknownis a catch-all, not because web is a recognized platform.Node pairing: Node-role clients connecting via a reverse proxy (the real-world case for any browser behind an API gateway) arrive from non-local IPs. The gateway rejects their connect frame before pairing. There is no token-auth bypass for node-role that parallels
dangerouslyDisableDeviceAuthfor operator/control-UI.Proposed solution
webplatform id toPLATFORM_DEFAULTSwithCANVAS_COMMANDS— makes browser canvas nodes an explicit first-class concept, not a fallback throughunknown.dangerouslyDisableDeviceAuth-equivalent for node-role — or extend the existing flag to cover token-authenticated node clients connecting from trusted proxy origins. The shared gateway token should be sufficient proof of ownership for canvas-only nodes behind the operator's own API.docs/platforms/— connect withrole: "node",platform: "web",caps: ["canvas"],commands: ["canvas.a2ui.push", "canvas.a2ui.pushJSONL", "canvas.a2ui.reset"], token auth.Alternatives considered
No response
Impact
Affected: Any developer building a web application that uses OpenClaw as an agent backend and wants to render A2UI surfaces natively in the browser — including web chat UIs, dashboards, and operator consoles that want agent-generated forms and interactive UI without requiring a native mobile or desktop node.
Severity: Blocks the feature entirely — there is no workaround within the current gateway model. The browser cannot register as a canvas node regardless of configuration.
Frequency: Every time a web client attempts to connect as a canvas node. This is not an edge case or intermittent failure — it is a hard architectural rejection.
Consequence: Teams targeting web-first deployments must either abandon native A2UI rendering in the browser, ship a separate mobile/desktop app just to act as a canvas surface, or implement workarounds outside the OpenClaw protocol (e.g. the agent emitting JSONL as plain text which the client parses independently — bypassing the canvas tool entirely and losing the proper A2UI delivery channel). All three options represent significant added complexity or degraded capability relative to what A2UI's own spec explicitly supports.
Evidence/examples
No response
Additional information
A2UI v0.9 and the Google spec explicitly target web as a first-class renderer. Supporting web canvas nodes makes OpenClaw the canonical way to push A2UI to any client — not just native apps.