Context

The canvas host at /__openclaw__/canvas/ serves a test page (index.html inside the canvas-host dist and the default ~/.openclaw/canvas/index.html) with Hello / Time / Photo / Dalek buttons. The page status shows:

Bridge: missing · iOS=no · Android=no
Failed to send action: dalek

when opened in any desktop web browser.

Root cause

The test page checks for three bridges:

const hasIOS = () => !!(window.webkit?.messageHandlers?.openclawCanvasA2UIAction)
const hasAndroid = () => !!(window.openclawCanvasA2UIAction?.postMessage)
const hasHelper = () => typeof window.openclawSendUserAction === "function"

None are injected in a regular browser context, so every button falls through with Failed to send action: <name>. By design, the A2UI action path only works when the canvas is loaded inside an iOS/Android native OpenClaw node.

Request

Expose window.openclawSendUserAction in the web canvas bundle too, with the action routed back to the Gateway via the existing WebSocket (or a dedicated HTTP POST /__openclaw__/canvas/action). This would let the canvas be useful from:

• canvas.newth.io style reverse-proxied deployments (behind Cloudflare Access / equivalent)
• Desktop dev loops where the author doesn't want to round-trip through an iOS/Android node just to test a button
• Embedded views (iframe from Control UI, dashboards, etc.)

Suggested shape

// Injected by canvas-host when running without a native bridge
window.openclawSendUserAction = ({ name, surfaceId, sourceComponentId, context }) => {
  const payload = { name, surfaceId, sourceComponentId, context, source: 'web' }
  // POST to same-origin endpoint; Gateway auth already established by browser
  fetch('/__openclaw__/canvas/action', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify(payload),
    credentials: 'same-origin',
  }).then(r => r.ok ? dispatchStatus({ ok: true, id: payload.name })
                    : dispatchStatus({ ok: false, error: `HTTP ${r.status}` }))
  return true
}

Auth: the Gateway already guards /__openclaw__/ with the gateway token (verified: hitting the canvas URL without the Authorization: Bearer header returns 401). So the endpoint inherits auth for free.

Version

• OpenClaw v2026.4.15
• macOS Sonoma (arm64), served via openclaw gateway launchd agent
• Reproduced in Chrome 147 and Safari 18