openclaw/docs/web/control-ui/feature-reference.md

doc-schema-version, summary, read_when, title, sidebarTitle

doc-schema-version	summary	read_when	title	sidebarTitle
1	What the Control UI can do today, grouped by capability with its Gateway RPC names	Checking whether a capability exists in the Control UI Looking up the Gateway RPC behind a Control UI feature	Feature and RPC reference	Feature and RPC reference

Control UI capabilities grouped by area, each with the Gateway RPC methods behind it.

Feature and RPC reference

- Subagent transcripts hide author avatars in the main chat view. Assistant and peer sender names remain visible; your name is hidden when no other human participant is known. - Chat with the model via Gateway WS (`chat.history`, `chat.send`, `chat.abort`, `chat.inject`). Archived sessions keep the composer disabled and show a banner with an **Unarchive** action before the conversation can continue. - Thinking controls and `/think` use the selected model's published choices and default. A model with no choices offers no effort control or default. Missing capability metadata is shown as unknown, without guessed levels; an explicit command still uses server validation. Saved overrides and matching inherited choices remain separate from the active fallback model. - Opening or refreshing chat requests up to 80 recent messages. Each background warming pass reads at most two inactive sessions sequentially, with up to 20 messages per session, after presented chat loads finish. Automatic warming waits for a visible conversation on the current page; dashboard-only views still warm the session you hover or keyboard-focus. Hover and keyboard intent use a short delay without waiting for browser idle time or another session's cooldown; the intended session's own cooldown still applies. Scrolling back requests up to 1,000 older messages per page and prefetches the next page. Per-message text caps and response-byte limits can reduce these counts. - A previous run's error banner clears when Chat adopts a new run or history confirms a newer successful run. Retiring the banner does not erase recorded diagnostics. A late error from the same run can remain visible beside its delivered answer; reconnecting or refreshing metadata alone does not establish recovery. - Run error banners preserve diagnostic file paths while masking credentials. Expand **Details** to read a long error and use **Copy error** to copy the complete displayed diagnostic. After reopening a chat, recorded failures before a reply supply the diagnostic for their exact run instead of the shortened session-list summary. - A saved assistant answer replaces its live stream without waiting for the run to finish. Refreshing history or reconnecting while that reply finishes does not add another copy of the saved answer. Later streamed continuations remain visible. Remote workspace reconciliation can keep the working indicator and Stop control active after the answer appears; a later reconciliation failure remains visible beside the answer. - Scroll up to read earlier messages without following incoming output. Messages from another participant preserve your position, even at the end; typing indicators do not move the transcript. Sending a message from this pane, submitting a transcript command such as `/help`, or using the down-arrow button returns to the latest message, including when the composer or progress card resizes. Scrolling manually interrupts that movement or a restored scroll position; keys handled by text fields or media controls do not. Messages continue to reserve their space as full text, images, and tool output load. - Session and GitHub hover cards close when their source pane is hidden or retired, including when you use browser Back or Forward. - Links to `github.com` in chat messages — yours and the agent's — show issue and pull-request references as compact chips with an issue or pull-request icon. Bare item URLs show `#number`, including links to files, commits, comments, and diff anchors; matching `#number` or `owner/repo#number` labels also become chips. A code span that contains nothing but a GitHub URL is treated like a bare URL, so backtick-quoted links get the same chip, tooltip, and hover card. The tooltip preserves the exact destination, and the hover card opens that same link. Repository file URLs show the filename. Nested tree URLs show the owner, repository, and final path segment with an ellipsis for the omitted path; this also covers branch names containing slashes without guessing where the branch ends. Their full destinations remain in the tooltip. Other GitHub paths retain the owner and repository in their URL label. All keep the GitHub mark, and custom labels stay unchanged. Icons are bundled, never fetched from the network, and decorative only: they are skipped for image-only links such as badges, never appear inside code blocks or code spans with other text, are not read by screen readers, and are not part of copied text. - In assistant messages, sessions whose checkout has a GitHub remote also turn references such as `PR #141270`, `pull request #123`, `pull #123`, `issue #123`, and `fixes`/`closes`/`resolves #123` into chips with hover cards. Bold and italic formatting between a keyword and its number, such as `PR **#123**`, preserves the item kind. Bare `#N` references require at least four digits with no leading zero; references inside code, existing links, or headings stay unchanged. Unqualified references use the session checkout repository. A repository-qualified form such as `owner/repo PR #123` or `PR owner/repo#123` works without a checkout; `owner/repo#123` uses an issue link. A known project display name or repository basename immediately before the keyword, such as `Release Tools PR #123`, selects that repository for that reference only. Names match case-insensitively at identifier boundaries, across bold/italic formatting and surrounding quotes or punctuation. The UI uses only the registered projects already returned by `projects.list` and the current session repository; it does not search GitHub or guess an owner. Project origins remain restricted to `operator.write`. Ambiguous names and known projects with missing, hidden, or non-GitHub origins remain plain text rather than falling back to the checkout. Unknown quoted names, explicit `repo`/`repository`/`project` qualifiers, and CamelCase or internal-dot/underscore identifiers also remain plain; ordinary prose such as `Original PR #123` and `Follow-up PR #123` still uses the checkout. Other unknown natural-language names are not inferred. Checkout-based links wait for the authorized project catalog to load; if that read fails, they stay plain rather than briefly linking a named project to the wrong repository. Explicit `owner/repo` references and URLs still work. Existing explicit links always retain their authored destination. - Hovering or keyboard-focusing a public GitHub issue or pull request link shows its state, title, author, recent activity, comments, and change statistics. Visible chat links warm up to eight distinct previews per mounted conversation and Gateway connection, one background request at a time, so cards can open with their data already cached. Hidden conversations, background tabs, and disconnected Gateways pause warming. Canceled work resumes when visible again, and reconnecting starts a fresh warming budget for the new connection; other links still load on hover or keyboard focus. Warming and hover share the same cache and pending request. Inline item chips consume that same fetched state: unknown and draft items stay neutral, open items are green, merged pull requests are purple, and closed pull requests are red. Chip state is scoped to the exact repository and item under the current connection and agent; it never settles publication for a different workspace. The connected Gateway fetches and caches public metadata without changing the link target, including when the UI uses a remote Gateway. The card's title and repository reference open the exact link you hovered or focused, including comment fragments and query parameters, even when another link to the same item has already filled the cache. Previews use the selected agent's configured GitHub identity, inheriting the system identity when there is no agent override. Without a managed identity, they retain the explicit Control UI GitHub credential, then the shared Gateway process-environment fallback; public previews still work anonymously without credentials. Configured managed identities never silently switch accounts, and authenticated previews remain restricted to public repositories. Signing into GitHub in your browser or connecting a personal GitHub account does not select the preview identity. Preview requests remain silent until one preview has successfully appeared in the current page, Gateway connection, and agent identity context. That success is shared across preview providers: later uncached links can show a loading skeleton. Client, connection, or identity changes reset the gate, and it is never persisted across page reloads. Failures show the Gateway’s explanation, including rate limits, authentication or access problems, and timeouts. Cached session details remain visible with that notice; reopening a failed preview shows the cached failure during the 30-second backoff without another request. Leaving a link while its request is pending cancels that activation, and stale responses cannot enable loaders in a new context. Supported links inside the preview provider suppress competing title tooltips from the initial hover or focus, including while the preview runtime loads. The original link, its accessible name, and the browser’s destination-URL display remain unchanged. - Talk through browser realtime sessions. OpenAI supports browser WebRTC and Gateway-relayed provider WebSockets, Google Live uses a constrained one-use browser token over WebSocket, and backend-only realtime voice plugins use Gateway relay. Video-capable browser sessions can choose a device-local camera in Settings or flip cameras from the live preview; the browser captures JPEG frames for the realtime provider without streaming camera video through the Gateway. Client-owned provider sessions start with `talk.client.create`; Gateway relay sessions start with `talk.session.create`. The relay keeps provider credentials on the Gateway while the browser streams microphone PCM through `talk.session.appendAudio`, forwards provider delegations or `openclaw_agent_consult` tool calls through Gateway policy and the larger configured OpenClaw model, and routes active-run voice steering through `talk.client.steer` or `talk.session.steer`. Browser WebRTC GPT-Live delegates on the Gateway-owned sideband, but each delegation has the same spoken-confirmation gate and browser-owned `talk.client.steer` lifecycle; a newer spoken task can also supersede the running delegation. Gateway-relayed GPT-Live uses the normal relay consult and steering path. Configure the realtime provider, model, and speaker voice on **Settings → Talk**, whose pickers come from `talk.catalog` and show whether the selection is ready to use. - Stream tool calls and live tool output cards in Chat (agent events). Tool activity renders as kind-aware rows: shell commands show the syntax-highlighted command with terminal-style output; supported edit and write calls show bounded inline diffs with source syntax highlighting, line numbers when available, and `+added -removed` stats; and consecutive calls collapse into bounded operation counts such as "13 commands · 6 reads · 9 edits", with failed, blocked, and unknown outcomes called out. These are operation counts, not distinct-file counts or claims that changes succeeded. While a run is live, the newest running call names the group header. Expand a row to inspect its remaining arguments and raw output. - Tool activity counts distinct calls, not start/update/result events, repeated history or live projections, or Gateway observation RPCs. Nested calls count independently, even when their names and arguments match. Expand the activity to see each call; read and edit counts can include repeated attempts on the same file. - Tool activity automatically displays a short purpose description supplied by the acting agent when available, with commands and results expandable underneath. Calls without descriptions keep deterministic labels. Viewing activity makes no additional model calls. The former `gateway.controlUi.toolTitles` option is retired; `openclaw doctor --fix` removes it from existing configs. - Start or dismiss ephemeral model-suggested follow-up tasks. **Start in a new session** opens the proposed task in the suggested folder without requiring Git or creating a worktree. The new session asks the user before using a worktree if the task needs one later. - Activity tab with browser-local, redaction-first summaries of live tool activity from existing `session.tool` / tool event delivery. - Channels: built-in plus bundled/external plugin channels status, QR login, and per-channel config (`channels.status`, `web.login.*`, `config.patch`). - Channel probe refreshes keep the previous snapshot visible while slow provider checks finish, and label partial snapshots when a probe or audit exceeds its UI budget. - Threads (a workspace page at `/sessions`, with a **Worktrees** tab alongside it): list configured-agent sessions by default, pin frequent root sessions, rename them, archive or restore sessions, fall back from stale unconfigured agent session keys, and apply per-session model/thinking/fast/verbose/trace/reasoning overrides (`sessions.list`, `sessions.patch`). A three-way **Active / Archived / All** filter controls both this page and the sidebar; All dims archived rows and labels them explicitly. Archived sessions keep their transcripts and remain shelved until explicitly unarchived or deleted. Sessions archived automatically at the active-session cap can also be deleted automatically when the session store exceeds its disk budget; manually archived and legacy sessions stay protected. Rows show an unread dot for active sessions with activity since they were last read, with mark-unread/mark-read actions (`sessions.patch { unread }`), and a Fork action that branches the transcript into a new session (`sessions.create { parentSessionKey, fork: true }`). Overview tiles above the table summarize the loaded roster (session count, live runs, unread sessions, total tokens, and archived count when available), each row carries a kind glyph with a live-run dot, status renders as a plain dot plus label, and the Tokens column shows a context-window usage meter when the session reports token and context sizes. Row management actions live in a per-row menu (kebab button or right-click) mirroring the sidebar's session menu, and the row drawer carries the agent runtime and run duration alongside the other session details. - Native Claude and Codex sidebar catalogs stream one host at a time, then reconcile after node connectivity changes, on page focus, and at most every 30 seconds while visible. Catalog changes trigger a faster follow-up pass, so sessions created in the native tools appear without reloading the Control UI. Claude Desktop rows also retain their local custom-group label when present; OpenClaw reads that mapping from Desktop's local store and never writes it. - Session grouping: a Group by control organizes the sessions table into sections by custom groups, channel, kind, agent, or date. Custom groups persist per session via `sessions.patch` (`category`), so sessions started from message channels (Discord, Telegram, WhatsApp, ...) can be categorized too; assign groups by dragging rows onto a section, or with the per-row group selector, and create groups with the New group action. - Memory (a tab on the Agents page, scoped to the selected agent): dreaming status, enable/disable toggle, and Dream Diary reader (`doctor.memory.status`, `doctor.memory.dreamDiary`, `config.patch`). When the `memory-wiki` plugin is enabled, the Diary view adds **Imported Insights** and **Memory Wiki** sub-tabs that browse imported source chats and the compiled wiki — clustered synthesis, entity, and concept pages plus annotated sources and reports, with claims, open questions, contradictions, and inline page previews (`wiki.importInsights`, `wiki.overview`, `wiki.get`). - Import Memory (`/memory-import`, reached from the Agents page's Memory tab): preview and copy local Claude Code auto-memory, Codex consolidated memory, or Hermes memory files into the selected agent workspace (`migrations.memory.plan`, `migrations.memory.apply`). - Onboarding memory offer: when the Control UI opens in [onboarding mode](/web/urls#other-special-documents-and-startup-modes), a one-page dialog offers to import detected memories with the same plan/apply flow; skipping leaves the settings page as the later entry point. - Automations (cron jobs): stat cards (automation count, failing count, scheduler state, next wake) above an Automations/Run history tab switch; the Automations tab lists jobs in a filterable table (All/Active/Paused, search, schedule and last-run filters, per-row action menu) with starter suggestions below, and the Run history tab shows recent runs across all automations (`cron.*`). - Plugins: browse the installed inventory and curated store, search ClawHub, install and remove plugin code, and enable or disable installed plugins (`plugins.*`). **Install** starts immediately and accepts the staged plugin’s declared capabilities without changing your hook and model permissions. Configured install-policy warnings still require an explicit acknowledgment. Catalog categories remain available while you search. MCP server rows edit `mcp.servers` through the config methods. - Skills: status, enable/disable, install, API key updates (`skills.*`). - Devices: one inventory joins paired device records, the node catalog, and live presence (`device.pair.list`, `node.list`, `system-presence`). The Gateway host is pinned first; paired clients show connection status, roles, tokens, capabilities, and commands. Duplicate pairings collapse into an expandable group, and **Clean up N stale** bulk-removes admin-confirmed offline duplicates that were auto-approved (silent local, trusted-CIDR, or SSH-verified) or predate approval provenance. Paired rows have an **Actions** menu to copy its device ID, **Edit alias** (a non-empty operator label of up to 64 characters, preserving the device ID and client-reported name), remove its pairing (`node.pair.remove`, `device.pair.remove`), or approve/reject a pending node re-approval (`node.pair.approve`/`reject`). Device pairing requests retain their visible **Approve** and **Reject** buttons (`device.pair.*`), and mobile setup codes can be created from the same card. **Details** groups device identity, IP, scopes, token rotation/revocation, and commands into labeled facts. Resource meters show Gateway host load, memory, disk, and uptime from `system.info`, and node meters appear when the node reports `hostStats`. Offline nodes with a retained snapshot show muted last-known meters with the snapshot age. The connected page refreshes host stats every 60 seconds and alongside quiet node reloads; node stats also refresh on `node.hostStats` events. Capability chips explain each capability on hover. **Desktop** opens that machine in a standalone desktop window (the docked Desktop panel stays hidden on Settings routes) and appears only when the Gateway reports an available desktop environment. Desktop sharing starts enabled on desktop nodes. On a Mac, change it under **Settings → This Mac → Capabilities → Desktop sharing**; the app reconnects automatically. CLI nodes use `desktop.host.enabled` and need a restart after config changes. An existing node may reconnect with a pending reapproval for the new command, which you approve from the row’s **Actions** menu or with `openclaw nodes approve `. No extra Gateway allow entry is needed; an explicit deny still blocks streaming. The node needs macOS Screen Sharing or an authenticated loopback VNC server. A dashed Desktop chip explains this setup when only the command is advertised.

- Exec approvals: edit gateway or node allowlists and ask policy for `exec host=gateway/node` (`exec.approvals.*`).

- View/edit `~/.openclaw/openclaw.json` (`config.get`, `config.set`). - Settings show effective defaults in controls and placeholders without repeating “Using default” beneath every field. Customized fields retain their default reference; reset behavior is unchanged. - Settings navigation starts with Ask OpenClaw, Profile, Appearance, and Notifications up top; Connections (Gateway, Channels, Communications, Talk, Devices); Agents & Tools (Agents, Labs, Models, MCP, Memory, Automation); Privacy & Security (Security, Secrets, Approvals); and System (Infrastructure, Advanced, Debug, Logs, About). Language leads the Appearance page, model defaults live on Models, and Gateway host details live on Gateway. - Privacy & Security: curated rows for gateway auth, exec policy, browser enablement, tool profile, device auth, and mobile pairing, above the schema-backed `security`/`approvals` sections. - Secrets (`/settings/secrets`) manages team-scoped secret and environment entries through `secrets.store.*`. Environment values remain visible, secret values are never returned after saving, Bulk Add accepts quoted multiline dotenv values, and mutation actions are hidden when the connected Gateway does not advertise them. - Approvals includes newest-first, 30-day history for resolved exec, plugin, and system-agent requests. Filter by kind or page through older rows to review the decision, reason, source session, and resolver attribution recorded by the Gateway. - Labs exposes Code Mode, Tool Search for all models, Custom plugin UI, Host Desktop, and Cloud Worker Desktop. Code Mode defaults off; turning it on writes `tools.codeMode.enabled: "auto"`, which engages only for models marked as preferred Code Mode performers. Changes save without restarting the Gateway. Code Mode and Tool Search apply to future agent runs; plugin UI and desktop availability update in connected pages. Swarm and CLI agents are available by default, with their existing configuration opt-outs and tool permissions. - Swarm and tool-loop detection live in **Settings → Agent Defaults → Tools**. CLI agents live in **Settings → Infrastructure → Gateway**. Message audit metadata lives in **Settings → Advanced → Logging** and remains off by default; restart the Gateway after changing it. Lean local-model mode remains an advanced troubleshooting setting under **Settings → Agent Defaults → Agents**. - Notifications: browser web-push status, subscribe/unsubscribe, and a test send. - Advanced: every config section without a curated home, plus the raw JSON5 editor. - **Advanced → Setup** is collapsed by default. Expand it to edit discovery access and app recommendation consent or inspect read-only setup history. Internal bookkeeping fields are absent from the form; the raw JSON5 editor remains unchanged. - In **Advanced → Communication → Channels**, use **Channel settings** to show one messaging channel at a time, including custom channel plugins. **Other** groups shared channel defaults and model overrides. Switching groups does not change the saved configuration. - **Models** (`/settings/model-providers`) is the home for model defaults and provider connections. **Defaults for all agents** keeps the model, utility model, fallback, thinking, and fast-mode controls together. The shared Settings sidebar selects the agent shown in **Provider access**, which can be filtered by provider name; global defaults remain unscoped. **Connect provider** opens a searchable provider-first dialog; saving credentials does not change the active model. Its **On this Gateway** option reuses setup discovery for existing connections, local preparation, installable plugins, and custom endpoints. Using a model there explicitly changes the selected agent, not global defaults. First-run onboarding retains its activation and recovery flow; saved non-first-run Model Setup links open Connect provider on Models. Same-connection rescans keep existing results visible and report refresh failures without discarding them. Activation waits for the Gateway to apply the verified configuration; if it cannot apply it in place, setup shows that a restart is required. Verification stays unavailable until the saved configuration is active and pending restart work has finished, including after reconnecting or reopening the page. Setup keeps your selected model and displays the Gateway's reason; after the restart, use **Try again** or **Verify & use selected model** if the page has not continued automatically. - Agents: a settings page (**Settings → Agents**, `/settings/agents`) with an **Agent defaults** row for the shared template plus per-agent tabs (Overview, Files, Tools, Skills, Channels, Automations, Memory). The Overview tab edits the agent's identity — display name, emoji, and an avatar image that is downscaled and size-bounded in the browser before `agents.update`. It also sets the agent's primary model and ordered fallback chain from the model catalog. Fallbacks are one field: chosen models show as removable chips in priority order, the dropdown lists catalog models not already in the chain, and typing filters it. Enter adds the highlighted option. To keep an unlisted `provider/model` reference exactly as typed, choose its **Add** row or press comma. Leaving the field or pressing Escape discards unconfirmed search text. Saving stores configured identity fields and mirrors them to the workspace `IDENTITY.md`; configured values take precedence over manual edits to the same file fields. The Tools tab shows the effective GitHub execution account and keeps per-agent overrides under advanced admin settings, with device authorization and one-use PAT setup. Common personal and System connections live on Profile. - Profile: a settings page with the default agent's identity, the authenticated person's editable profile and verified sign-in identity, separate Git co-author consent, and My GitHub/System GitHub connections. **Usage statistics** opens the usage view rather than loading all usage statistics into Profile. - MCP has a dedicated settings page with server rows (transport, enablement, OAuth/filter/parallel summaries), direct add/enable/disable/remove controls, common operator commands, and the scoped `mcp` config editor. The Plugins page remains the home for one-click connectors and discovery. - Models lists every configured model provider with its brand icon, auth state (`models.authStatus`), model availability (`models.list`), live plan/quota/billing data where the provider reports it (`usage.status`), and local session spend for the last 30 days (`sessions.usage`). The local spend detail counts messages with usage records. The page and its pickers read model choices already published by the Gateway without starting discovery. After sign-in, starter choices remain available while “checking models…” reports account discovery; completed discovery updates an open picker. **Refresh** updates credential state before requesting fresh provider inventory, and **Retry** requests discovery again after a failure. Usage loads independently. If the Gateway is preparing model authentication, the page shows an unavailable-status warning rather than treating it as a lost connection or a sign-out. Auth-status diagnostics do not block chat bootstrap. - Model choices in Agents, Automations, Models, and command-palette search show catalog refresh failures, including failures without an individual provider error. Command-palette model results and warnings appear without waiting for other search categories; selecting a model result opens Models settings. Returned choices remain usable; an empty returned list does not restore obsolete choices from an older view. Successful recovery clears the warning. Catalog updates preserve unsaved settings and automation drafts. - Skills-only metadata updates preserve cached model choices and authentication status. Catalog discovery settlement refreshes model choices without rereading unchanged authentication; credential/configuration changes, reconnects, and credential expiry windows still refresh the affected facts. - When the catalog reports results for individual auth profiles, one ready profile takes precedence over a rejected or unavailable sibling. Provider-wide catalog failures remain visible on the provider card. - Gateway: a settings page (under **Connections**) owning this browser's own Gateway link — Gateway URL, one **Gateway secret** field for a token or password, and default session key — plus the latest handshake snapshot (status, uptime, tick interval, last channels refresh). The offline login gate handles the disconnected case; this page edits the connection while connected. After a successful token-mode connection, the secret is remembered in session storage for the current browser tab and Gateway only. Passwords stay in memory and are never persisted. - Apply and restart with validation (`config.apply`), then wake the last active session. - Writes include a base-hash guard to prevent clobbering concurrent edits. - If a save or apply is rejected by configuration validation before writing, Settings shows **Settings not applied** with the Gateway's reason. Current settings stay unchanged, and your draft remains editable for correction and retry. Connection failures, permission denials, concurrent edits, and write recovery keep their separate error handling. - Writes (`config.set`/`config.apply`/`config.patch`) preflight active SecretRef resolution for refs in the submitted config payload; unresolved active submitted refs are rejected before write. - Form saves discard stale redacted placeholders that cannot be restored from the saved config, while preserving redacted values that still map to saved secrets. - Sensitive string fields that are empty or contain only whitespace remain editable after reloading. Concrete secrets stay masked by default; entries containing stored secrets cannot be renamed in the form. In plugin-declared credential fields, administrators can explicitly reveal a saved literal for the selected field and current config revision (`plugins.credentials.inspect`). This does not resolve secret references or environment values. - Schema and form rendering come from `config.schema` / `config.schema.lookup`, including field `title`/`description`, matched UI hints, immediate child summaries, docs metadata on nested object/wildcard/array/composition nodes, plus plugin and channel schemas when available. Raw JSON editor is available only when the snapshot has a safe raw round-trip; otherwise Control UI forces Form mode. - Raw JSON editor "Reset to saved" preserves the raw-authored shape (formatting, comments, `$include` layout) instead of re-rendering a flattened snapshot, so external edits survive a reset when the snapshot can safely round-trip. - Structured SecretRef object values render read-only in form text inputs, to prevent accidental object-to-string corruption.

The session timeline's range handles support Tab, arrow keys to move one recorded point, and Home/End to select a boundary. Each handle has an accessible label and current time.

- Session-derived token and estimated-cost analysis stays separate from provider billing.
- Session rows and selected details show saved conversation names, including generated titles. Explicit renames take precedence; unnamed sessions show their keys.
- The Sessions card counts the rows currently shown: up to 50 in **All**, or matching sessions selected on this Usage page in **Recently viewed**. The total is the loaded session count for the agent scope; the separate selected-session comparison does not increase the shown count.
- Filter sessions with the provider, model, channel, or tool menus, or type case-insensitive `key:value` terms. Values within one category match as alternatives. Toggling a menu option preserves the other filters and their quoted text.
- Selecting days narrows token and cost totals to those days within the active session filters. Daily charts and exports retain that session scope. Provider/model/tool queries select matching sessions, including all usage within each matched session; hour filters select sessions active in those hours.
- Whole-session totals count each tool call, including repeated uses of the same tool in one assistant message. Drag the handles in a session’s usage timeline to inspect an interval; its counts use assistant invocations in the loaded conversation. Tool results do not add calls. Tool-only assistant messages remain visible in the loaded conversation.
- Interval message and tool-call counts use timestamped entries in the loaded conversation. Messages include only user and assistant roles. Loaded history can be incomplete; unavailable or undated data does not establish a complete interval total. Conversation search and role filters do not change these summaries. Clear the interval to restore the session summary counts.
- Select **Local** or **UTC** for hourly charts and peak error hours. Historical hour labels stay tied to the selected time zone, including when you view them across a daylight-saving transition.
- Provider cards call `usage.status` and show live plan names, quota windows, balances, spend, and budgets reported by configured provider plugins.
- A provider usage failure does not block the session/cost dashboard; unavailable provider cards show their own error state.
- Session/cost totals keep the previous committed values visible during a background refresh. The page reads the new totals when the Gateway announces a completed refresh, including after returning to a hidden tab. Sessions without a committed rollup show that usage is still being computed.
- If a background refresh fails, the page keeps any committed totals and shows a paused notice for the affected agent scope. The failure stays with that agent across filter changes and navigation; another agent's refresh does not clear it. Use **Refresh** to try again. Session refresh notifications do not restart provider-card retry limits.
- Changing the date range, agent, session scope, or time zone hides the previous query's session/cost totals until the new query loads. A failed refresh of the same query keeps its last totals visible. Provider billing cards remain separate from these filters.
- **Refresh** also reloads the selected session's timeline, conversation, and system-prompt breakdown.
- If a selected session is deleted and recreated, its new details replace the old ones and clear the previous timeline interval without clearing your session selection. An unfinished drag on the old timeline cannot change the new interval. Refreshing the same instance retains its selected interval. Context details from a different session instance show an error and can be retried with **Refresh**.
- The overview loads session summaries first. Full system-prompt breakdowns load when you select a session; the `has:context` filter still works before opening details.
- Sessions CSV and JSON exports include only selected sessions that match the active filters; with no selection, they include all matching sessions. JSON exports keep the displayed usage snapshot and load prompt details for the same session instance. If that session has been replaced, refresh Usage and export again.

- **Systems** shows the selected machine's one-minute load average, used memory, and available disk space with the same interactive history graphs as System busyness. Each reported disk volume gets a separate graph labeled by mount path, with history kept separate when disks reorder, appear, or disappear. The Gateway reports individual mounted volumes; connected nodes currently report only their home volume. Hover over a graph to inspect earlier readings. Load is shown alongside logical core count; it is not a CPU utilization percentage. History builds from up to 120 distinct reports per machine while Systems is open and resets after a reporting gap or Gateway reconnect. Nodes normally report once a minute; repeated polls do not add duplicate points. Offline or stale readings are muted and labeled with their last report time, and missing metrics show a dash. - Debug: status/health/models snapshots collected on opening or choosing Refresh, live command lanes and heartbeat, event log, and manual RPC calls. The System busyness overlay reads CPU, memory, event-loop delay, and per-disk free-space graphs through the lightweight `system.info` request every ten seconds while visible. It shares reads with open Settings pages on the same connection. The Gateway page also shows each mounted local storage volume separately, labeled by its mount path. Disk snapshots refresh every thirty seconds; memory-backed filesystems and hidden macOS system volumes are excluded. - Minimize System busyness to keep a small widget in the bottom-right corner with three live history graphs: CPU, Gateway ping, and process memory (RSS). The CPU headline always measures the Gateway process (`100%` equals one logical CPU), with a smaller **Host** percentage for whole-machine utilization. Its sparkline stacks measured main-thread and tracked-worker CPU with estimated other-thread CPU when those counters are available. Hover, keyboard-focus, or tap the CPU tile to read the breakdown and units; tap again, press Escape, or interact outside to dismiss it. Unavailable counters show a dash, not zero. Ping measures the round-trip time of the existing `system.info` request. While minimized, the widget polls only this lightweight status request; active-session lists and lane diagnostics resume with regular polling after expanding. Slow lane or active-session reads do not block fresh vitals. Hidden browser tabs pause overlay polling and refresh when visible again. Expand it to restore the full panel and its collected history, or close it to stop polling. Unavailable diagnostics replace the widget's readings when the connection drops. - The System busyness overlay counts running or queued sessions in the Gateway's current-work listing, including global sessions and sessions outside the first history page. It lists up to 100 session IDs and shows the displayed and total counts when more sessions are active (`sessions.list`). - Lane tables omit disabled, empty lanes, including `hook-dispatch` when HTTP hooks are off. Disabled lanes remain visible while work is running or queued. - The event log includes Control UI refresh/RPC timings, slow chat/config render timings, and browser responsiveness entries for long animation frames or long tasks when the browser exposes those PerformanceObserver entry types. - Raw Gateway event history is captured while Debug or the expanded System busyness overlay subscribes to it, up to 250 events. Closing the last diagnostic view releases those payloads; Live Activity retains its own reduced history independently. - Diagnostic event history belongs to the selected Gateway and authentication context. Applying a different Gateway URL or credential clears the previous history immediately, even if the new connection fails. A reconnect authenticated as a different account also clears it. Reconnects with unchanged authentication preserve history for troubleshooting. - Logs: live tail of gateway file logs with filter/export (`logs.tail`). - Update: run a package/git update plus restart (`update.run`) with a restart report, then poll `update.status` after reconnect to verify the running gateway version. - Scheduler status, automation lists, and run history pause background refreshes while the browser tab is hidden and catch up when you return. Your current filters and unsaved draft stay in place; saves and runs already submitted continue. - A pending edit save can finish after you navigate away without replacing the current editor or showing that save's errors in it. - Keyboard navigation keeps automation form controls visible above the sticky save actions, including when the actions wrap on narrow screens. - Selecting a row opens a full-page detail view with an Active/Paused switch and Run now in the header (run-if-due, clone, and remove in its menu); the Settings tab edits the automation inline (prompt, details, frequency, advanced overrides) and the Run history tab shows that automation's runs. Switching tasks while Run now is pending keeps history attached to the selected task. If an earlier run, pause/resume, or removal reports feedback after you select another automation, the message names the automation you acted on. - Cloning an agent task retains its stored tool allowlist, model fallback list, lightweight-context setting, and external-content setting, including empty lists and explicit `false` values. Fields you change in the copy's form take precedence. The new task is authorized by the current operator; captured execution grants are not copied. - Changing the selected automation or run-history filters clears the previous results and starts at the first page. Refreshing the same history keeps its last results while loading. Load more runs becomes available after the first page finishes loading; if it fails, use Refresh to try again. A successful retry clears the history error without dismissing feedback from other automation actions. - Both Run history views show a recorded delivery-suppression reason alongside the delivery status when available. Intentional suppression remains separate from delivery errors; the history does not infer a reason from a successful run. - Starter automations under the table prefill the create form with an editable prompt and schedule. - New isolated tasks default to internal-only delivery. Select announce explicitly to send a summary to a channel. - Channel/target fields appear when announce is selected; provide an explicit destination when the channel requires one. - Webhook mode uses `delivery.mode = "webhook"` with `delivery.to` set to a valid HTTP(S) webhook URL. - For main-session tasks, webhook and none delivery modes are available. - Advanced edit controls include delete-after-run, clear agent override, cron exact/stagger options, agent model/thinking overrides, and best-effort delivery toggles. - Model suggestions update when the Gateway publishes catalog or configuration changes. A failed read shows an error and keeps the last suggestions for the same agent and connection; the next successful read replaces them without changing your draft. - Saved interval labels retain millisecond precision: a 90-second interval displays as `Every 1m 30s`. Repeat and stagger inputs accept decimal amounts that resolve to whole milliseconds; editing a cron expression preserves its stagger window. - Form validation is inline with field-level errors; invalid values disable the save button until fixed. - Set `cron.webhookToken` to send a dedicated bearer token; if omitted, the webhook is sent without an auth header. - `cron.webhook` is a retired legacy fallback rejected by current config validation. Run `openclaw doctor --fix` to migrate stored jobs that still use `notify: true` to explicit per-job webhook or completion delivery and remove the old key.