OpenClaw Main Adds Live Cloud Desktops and One-Click CLI Agent Terminals

OpenClaw has merged two connected Labs workflows into main: operators can observe and explicitly take control of a Crabbox cloud-worker desktop, while supported Codex and Claude Code catalog targets can be launched in the embedded terminal directly from the new-session page.

Both features are off by default and capability-gated. They improve visibility and reduce setup friction, but they also concentrate remote-desktop, terminal and worktree authority in the Control UI. Enable them as privileged operations features, not cosmetic preferences.

Availability boundary: these are merged main changes. Check the containing package before looking for the settings or protocol methods.

Cloud workers become observable

PR #120727 connects Crabbox’s loopback VNC desktop to the Gateway’s pinned SSH path. The Gateway forwards the desktop to a local Unix socket, exposes it through an authenticated WebSocket proxy with a one-shot token, and renders it in a lazy-loaded noVNC panel.

The upstream contract is specific:

• cloudWorkers.desktop must be enabled in Labs;
• the Crabbox profile must opt into desktop provisioning with desktop: true;
• worker.desktop.observe is advertised only while the feature is enabled;
• connections begin view-only;
• take-control is explicit and server-enforced to one controller; and
• the VNC password is fetched over SSH for each tunnel, held in memory, registered for redaction and not placed in a URL.

Windows Gateway hosts return an unsupported error for this path.

That design avoids exposing the worker’s VNC listener directly. It does not make the desktop low-risk. The observer sees whatever the agent sees, and take-control can manipulate the leased machine.

Action: restrict Control UI and Gateway credentials to operators already authorised for the worker. Confirm tunnel teardown on panel close, lease end and Gateway restart. Never publish the local proxy through a second reverse proxy without re-evaluating origin, authentication and token-replay boundaries.

CLI agents join the new-session picker

PR #120949 adds the default-off gateway.cliAgents.enabled gate. When enabled, the new-session picker asks the selected agent’s advertised catalog for create-capable targets and can show entries such as Codex and Claude Code.

The gate alone does not invent a new session type or bypass provider contracts. If the Gateway does not advertise the catalog method, or no catalog can create a session, the ordinary model-picker experience remains.

PR #121020 then adds an admin-scoped sessions.catalog.startTerminal method. It requires both the CLI-agents gate and Gateway terminal support, preserves sandbox refusal, and routes provider plans through the same terminal admission and session-manager path as terminal.open.

Codex and Claude provide local start plans. Paired-node starts are not silently emulated; the provider returns an instruction to choose the Gateway host. Callers remain responsible for provisioning the requested working directory.

“Start in terminal” joins the page

PR #121126 completes the user path. A secondary Start in terminal action appears only when the Labs gate, terminal gate and selected catalog capability all permit it.

The action can create a requested managed worktree first, starts the catalog target with the chosen agent, folder, host and trimmed prompt, then attaches the returned server session to the terminal panel. Empty prompts are supported. The existing plain Start path is unchanged.

The distinction matters: one button starts the ordinary OpenClaw session flow; the other launches a terminal-backed CLI process. Operators should know which custody model they are choosing before granting it a repository and worktree.

Rollout checklist

Use a non-production worker and disposable repository first:

1. enable one Labs feature at a time;
2. confirm the desktop method is absent while its gate is off;
3. open an observer and prove keyboard/mouse input is blocked until take-control;
4. attempt a second controller and confirm the server refuses competing control;
5. terminate the worker lease and verify the WebSocket and SSH tunnel close;
6. enable CLI agents and confirm only create-capable catalogs appear;
7. start a harmless session with and without a managed worktree;
8. verify the terminal attaches to the returned server session and the selected directory is correct; and
9. test an unsupported node or sandbox target and require a visible refusal rather than a fallback launch.

Audit logs should distinguish desktop observation, control acquisition, worktree creation and terminal process launch. A single “session opened” event is not enough evidence for this authority chain.

Bottom line

OpenClaw’s new Labs paths make remote agent work less opaque and less fiddly. The right rollout is still conservative: preserve view-only defaults, tightly scope who can take control, keep VNC behind the Gateway tunnel, and treat terminal-backed CLI sessions as privileged processes with explicit repository and worktree ownership.