OpenClaw Main Lets CLI Clients Continue Dashboard Sessions by URL

OpenClaw has merged a new browser-to-terminal continuation path into main. Operators can copy a Control UI session URL—or use supported Gateway shorthand or a bare session reference—and hand it to the TUI or attach command without reconstructing a WebSocket URL, full session key or environment-variable handoff.

This is not transcript export. The CLI resolves and continues the same Gateway-owned session, subject to the target Gateway’s authentication, origin and ownership checks.

Supported entry points

PR #120893 adds one typed target parser and wires it into three forms:

openclaw tui <url|host/ref|ref>
openclaw attach <url|host/ref|ref>
openclaw <url>

The bare-root URL form routes through the TUI path. Targets can represent a dashboard session URL, a Gateway host plus reference, or a bare reference resolved against the applicable Gateway context.

The merged implementation also distinguishes several failure classes that previously collapsed into generic connection or resolution errors: an older Gateway that lacks the target contract, a missing session, an unreachable named origin, a revoked device token and existing TLS pin failures.

Those errors matter operationally. “Not found on this Gateway” and “could not authenticate to the intended Gateway” should not produce the same recovery advice.

Gateway-owned and local TUI sessions are different

The new official concept guide makes a crucial distinction:

• a targeted CLI continuation resolves a session through the Gateway and operates on shared Gateway state;
• an embedded local TUI session remains local to that process and is not made shareable merely by copying a browser URL; and
• attachment grants are separate capabilities with their own lifetime and authentication boundary.

Do not describe every terminal view as “the same session” unless the session owner is actually the same Gateway. Similar transcript text is not proof of shared live ownership.

Security properties to preserve

A session URL is a locator, not a substitute for authorization. The CLI still needs valid access to the named Gateway. Origin-aware resolution prevents a short reference copied from one Gateway from silently selecting a similarly named session on another.

The attach flow resolves the target before requesting an attachment grant and passes the grant through the child environment. The guide notes that printed configuration grants remain alive until expiry, so output from --print-config should be handled as sensitive capability material even when it is not a long-lived device token.

The merged source also keeps resolved target details private rather than reflecting them into ordinary assistant-visible history.

Interpretation: browser-to-terminal handoff improves ergonomics, but it also makes URLs more operationally valuable. Treat links and attach output according to the access they can initiate, not according to whether they look like secrets.

Safe rollout test

Use two disposable Gateways and uniquely named sessions:

1. open a session in Gateway A’s Control UI and copy its canonical URL;
2. continue it with the supported TUI URL form;
3. write a harmless marker from the terminal and confirm the same Gateway-owned session updates in the browser;
4. repeat with the attach flow and verify grant expiry behavior;
5. try the same short reference against Gateway B and require origin-aware refusal or an unambiguous, explicitly selected result;
6. revoke the device token and confirm the error identifies authentication rather than “session missing”;
7. test an older Gateway and confirm version-skew guidance is actionable; and
8. test an invalid TLS pin and ensure the new target parser does not weaken that failure.

Do not use a production incident session as the first test. Attachment can expose a live coding or terminal context to the child harness.

Automation guidance

If scripts adopt session URLs:

• store the intended Gateway origin separately from human-readable labels;
• reject redirects or rewritten hosts that escape the allowed origin set;
• avoid logging full attach configuration or bearer material;
• reconcile the resolved session identity before issuing mutating commands; and
• treat timeouts as ambiguous until the Gateway session state is checked.

A continuation command can fail after resolution but before the terminal is visibly attached. Retrying should not assume the first attempt performed no stateful work.

Bottom line

The new target grammar makes Control UI, TUI and attach workflows feel like clients of one session system rather than separate islands. Use it only with a containing build, preserve Gateway-origin and grant boundaries, and prove the handoff against two Gateways before automating it.