# Canvas

## Overview

The Canvas feature in OpenClaw is a lightweight visual workspace for HTML/CSS/JS, A2UI, and small interactive UI surfaces embedded in the macOS app using `WKWebView`.

## Key Storage & Access

Canvas files are stored in `~/Library/Application Support/OpenClaw/canvas/<session>/` and served through a custom `openclaw-canvas://` URL scheme that prevents directory traversal attacks.

## Core Capabilities

The agent can control Canvas through several operations:

- Display or hide the panel
- Navigate to local paths or external URLs
- Execute JavaScript commands
- Generate snapshot images

## A2UI Integration

The system supports A2UI v0.8 server-to-client messages including `surfaceUpdate`, `dataModelUpdate`, and `deleteSurface`. The newer `createSurface` (v0.9) remains unsupported.

## Agent Triggering

Canvas content can initiate new agent runs using deep links formatted as `openclaw://agent?message=<text>`, with confirmation prompts unless a valid key is supplied.

## Security Features

Canvas scheme blocks directory traversal; files must live under the session root. External URLs require explicit navigation permissions.