ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-12 21:53:00 -06:00
Code Issues Packages Projects Releases Wiki Activity

docs: document control ui owner handoff

Browse Source
This commit is contained in:
Shakker
2026-08-06 01:14:44 +01:00
parent c56ad42525
commit 47591e7b11
6 changed files with 30 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/cli/dashboard.md
+5 -4
View File
@@ -8,9 +8,10 @@ title: "Dashboard"
# `openclaw dashboard`
Open the Control UI with a short-lived, one-time browser pairing link. A successful handoff leaves
that browser with its own durable device credential, so reopening the dashboard does not depend on
the shared Gateway token.
Open the Control UI with a short-lived, one-time owner pairing link. A successful handoff gives that
signed browser a durable administrator device credential, so reopening the dashboard does not depend
on the shared Gateway token. Opening a fresh handoff in the same browser can also repair a previously
limited device credential.
```bash
openclaw dashboard
@@ -43,7 +44,7 @@ Notes:
- Resolves configured `gateway.auth.token` SecretRefs when possible.
- `browserUrl` carries a single-use, ten-minute bootstrap in the URL fragment. The Control UI strips
it immediately, binds it to the browser's signed device identity, and stores only the resulting
per-device credential.
administrator per-device credential. Another browser profile cannot inherit or replay that grant.
- Follows `gateway.tls.enabled`: TLS-enabled gateways print/open `https://` Control UI URLs and connect over `wss://`.
- For `lan` or a wildcard `custom` bind, same-host launches always use loopback because a wildcard is not a browser destination. Plaintext `tailnet` and `custom` binds also use `127.0.0.1` so the browser has a secure context; TLS-enabled specific hosts keep the configured address so certificate names match.
- Before delivering an authenticated loopback URL for a specific-interface bind, the command probes the configured interface and verifies that it and `127.0.0.1` are owned by the same Gateway process. Ambiguous listener ownership fails closed with status guidance.
docs/cli/onboard.md
+7 -5
View File
@@ -145,11 +145,13 @@ are matched through your configured model and ClawHub search, and the step can
be disabled with [`wizard.appRecommendations`](/gateway/configuration-reference#wizard).
In a macOS, Linux, or Windows desktop session, it then opens the authenticated
Control UI dashboard and waits up to 60 seconds for the browser client to
connect. On headless Linux or over SSH, it prints a prominent copy-pasteable
dashboard URL, including an SSH port-forward command for a loopback Gateway,
and waits up to five minutes. A successful connection continues in the browser;
an unreachable Gateway or a timeout falls back to the same terminal hatch as
before. Pass `--tui` to skip the browser handoff and force that terminal hatch.
connect. The short-lived handoff gives that exact signed browser a durable
administrator credential. On headless Linux or over SSH, it prints a prominent
copy-pasteable dashboard URL, including an SSH port-forward command for a
loopback Gateway, and waits up to five minutes. A successful connection
continues in the browser; an unreachable Gateway or a timeout falls back to the
same terminal hatch as before. Pass `--tui` to skip the browser handoff and
force that terminal hatch.
If applying setup fails, onboarding falls back to the conversational OpenClaw
chat to finish interactively. Channels, agents,
plugins, and other optional features remain OpenClaw chat territory: run