vrr/openclaw
2
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-10-30 03:55:38 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 30
openclaw/docs/network.md
Peter Steinberger 6f88c26dcf
refactor(canvas)!: retire A2UI widgets and content-kind hooks (#182109) 
* refactor(canvas)!: retire A2UI widgets and content-kind hooks

Remove both renderers, their routes and build pipeline, and the generic
registered board-widget API. Preserve HTML, native plugin widgets, and MCP Apps.

Doctor takes a fresh standard backup before deleting stored A2UI widgets and
records the count and HTML replacement guidance. The candidate Doctor owns this
repair so existing update drivers can continue through the migration.

Advance the closed board schema to protocol v5 with v4 node/probe negotiation,
and preserve v4 pairing metadata in the client fallback. Calls using the retired
show_widget kind receive actionable argument-validation guidance.

BREAKING CHANGE: A2UI widgets and registerBoardWidgetContentKind are removed;
stored A2UI widgets are deleted after backup during Doctor/update. General
clients must support protocol v5.

* test: align retirement proof with protocol v5

* fix(protocol): preserve v4 node features through the v5 cutover

* fix(doctor): preserve retired third-party widget sources

* test(ui): settle context meter before measuring pixels
2026-10-23 21:52:01 -07:00

2.5 KiB
Raw Blame History

summary read_when title
Network hub: gateway surfaces, pairing, discovery, and security
You need the network architecture + security overview
You are debugging local vs tailnet access or pairing
You want the main list of networking docs
Network

This hub links the core docs for how OpenClaw connects, pairs, and secures devices across localhost, LAN, and tailnet.

Core model

Most operations flow through the Gateway (openclaw gateway), a single long-running process that owns channel connections and the WebSocket control plane.

  • Loopback first: the Gateway WS defaults to ws://127.0.0.1:18789. Non-loopback binds refuse to start without a valid gateway auth path: shared-secret token/password auth, or a correctly configured non-loopback trusted-proxy deployment.
  • One Gateway per host is recommended. For isolation, run multiple gateways with isolated profiles and ports (Multiple Gateways).
  • Hosted widget documents are served on the same port as the Gateway (/__openclaw__/canvas/), protected by Gateway auth when bound beyond loopback.
  • Remote access is typically an SSH tunnel or Tailscale VPN (Remote Access).

Key references:

Pairing + identity

Local trust:

  • Direct local loopback connects (no forwarded/proxy headers) can be auto-approved for pairing to keep same-host UX smooth.
  • OpenClaw also has a narrow backend/container-local self-connect path for trusted shared-secret helper flows.
  • Tailnet and LAN clients, including same-host tailnet binds, still require explicit pairing approval.

Discovery + transports

Nodes + transports

Security

Related