Control OpenClaw AI assistant from Windows system tray

🦞 OpenClaw Windows Hub

A native Windows companion suite for OpenClaw - the AI-powered personal assistant.

Made with 🦞 love by Scott Hanselman and Molty

Projects

This monorepo contains the Windows hub, shared client libraries, and CLI utilities:

🚀 Quick Start

End-user installer? Download the latest stable x64 or ARM64 installer from the OpenClaw Windows docs, or see docs/SETUP.md for step-by-step installation (no build required).

Managed WSL gateway? Local setup creates a locked-down app-owned OpenClawGateway distro. See docs/WSL_GATEWAY_ADMIN.md for editing openclaw.json as the openclaw user and using root for protected-file administration.

Direct downloads from the latest OpenClaw release:

• OpenClawCompanion-Setup-x64.exe
• OpenClawCompanion-Setup-arm64.exe
• OpenClawCompanion-SHA256SUMS.txt

Prerequisites

• Windows 10 (20H2+) or Windows 11
• .NET 10.0 SDK - https://dotnet.microsoft.com/download/dotnet/10.0
• Node.js LTS with npm (for WinUI build assets)
• Windows 10 SDK (for WinUI build) - install via Visual Studio or standalone
• WebView2 Runtime - pre-installed on modern Windows, or get from https://developer.microsoft.com/microsoft-edge/webview2

Developer / Agent Setup

Use the setup script to install or verify local Windows build prerequisites:

# Install missing prerequisites with winget, trust the checkout, and verify setup
.\scripts\setup-dev.ps1

# Check only; do not install packages or change git safe.directory
.\scripts\setup-dev.ps1 -CheckOnly

# Setup and run the required build/test validation
.\scripts\setup-dev.ps1 -RunValidation

Build

Use the build script to check prerequisites and build:

# Check prerequisites
.\build.ps1 -CheckOnly

# Build all projects
.\build.ps1

# Build specific project
.\build.ps1 -Project WinUI

Or build directly with dotnet:

# Build all (use build.ps1 for best results)
dotnet build

# Build WinUI (requires runtime identifier for WebView2 support)
dotnet build src/OpenClaw.Tray.WinUI/OpenClaw.Tray.WinUI.csproj -r win-arm64  # ARM64
dotnet build src/OpenClaw.Tray.WinUI/OpenClaw.Tray.WinUI.csproj -r win-x64    # x64

# Build MSIX package (for camera/mic consent prompts)
dotnet build src/OpenClaw.Tray.WinUI -r win-arm64 -p:PackageMsix=true  # ARM64 MSIX
dotnet build src/OpenClaw.Tray.WinUI -r win-x64 -p:PackageMsix=true    # x64 MSIX

Run Tray App

# Build and launch the unpackaged WinUI tray app
.\run-app-local.ps1

# If you already built, skip rebuild and launch the existing Debug output
.\run-app-local.ps1 -NoBuild

# Run isolated from your normal tray settings so multiple worktrees can run together
.\run-app-local.ps1 -Isolated

# Alpha update testing from a Release build
.\run-app-local.ps1 -Configuration Release -Isolated -UpdateChannel alpha

# Optional: launch through WinAppCLI with Package.appxmanifest
.\run-app-local.ps1 -UseWinApp -NoBuild

The default path starts the unpackaged executable directly. -UseWinApp requires
Microsoft WinAppCLI (winget install Microsoft.WinAppCLI) and is only needed when
you want manifest/MSIX-adjacent launch validation.

Run CLI WebSocket Validator

Use the CLI to validate gateway connectivity and chat.send outside the tray UI.

# Show help
dotnet run --project src/OpenClaw.Cli -- --help

# Use tray settings from %APPDATA%\OpenClawTray\settings.json and send one message
dotnet run --project src/OpenClaw.Cli -- --message "quick send validation"

# Loop sends and also probe sessions/usage/nodes APIs
dotnet run --project src/OpenClaw.Cli -- --repeat 5 --delay-ms 1000 --probe-read --verbose

# Override gateway URL/token for isolated testing
dotnet run --project src/OpenClaw.Cli -- --url ws://127.0.0.1:18789 --token "<token>" --message "override test"

📦 OpenClaw.Tray (Molty)

Modern Windows 11-style system tray companion that connects to your local OpenClaw gateway.

Features

• 🦞 Lobster branding - Pixel-art lobster tray icon with status colors
• 🎨 Modern UI - Windows 11 flyout menu with dark/light mode support
• 💬 Quick Send - Send messages via global hotkey (Ctrl+Alt+Shift+C)
• 🔄 Auto-updates - Automatic updates from GitHub Releases
• 🌐 Web Chat - Embedded chat window with WebView2
• 📊 Live Status - Real-time sessions, channels, and usage display
• 🧭 Command Center - Dense gateway, channel, usage, node, pairing, and allowlist diagnostics from one window
• ⚡ Activity Stream - Command Center page for live session, usage, node, and notification events
• 🔔 Toast Notifications - Clickable Windows notifications with smart categorization
• 📡 Channel Control - Start/stop Telegram & WhatsApp from the menu
• 🖥️ Node Observability - Node inventory with online/offline state and copyable summary
• ⏱ Cron Jobs - Quick access to scheduled tasks
• 🚀 Auto-start - Launch with Windows
• ⚙️ Settings - Full configuration page
• 🎯 First-run onboarding - 6-screen setup wizard (connection, permissions, chat, configuration)

Quick Send scope requirement

Quick Send uses the gateway chat.send method and requires the operator device to have operator.write scope.

If Quick Send fails with missing scope: operator.write, Molty now copies identity + remediation guidance to your clipboard, including:

• operator role and client.id used by the tray app
• gateway-reported operator device id (if provided)
• currently granted scopes (if provided)

For this specific error (missing scope: operator.write), the cause is an operator token scope issue. Update the token used by the tray app so it includes operator.write, then retry Quick Send.

If Quick Send fails with pairing required / NOT_PAIRED, that is a device approval issue. Approve the tray device in gateway pairing approvals, reconnect, and retry.

Menu Sections

• Status - Gateway connection status with click-to-view details
• Command Center - Hub with diagnostics, channel health, usage, sessions, nodes, and copyable repair commands
• Sessions - Active agent sessions with preview and per-session controls
• Usage - Provider/cost summary with quick jump to activity details
• Channels - Telegram/WhatsApp status with toggle control
• Nodes - Online/offline node inventory and copyable summary
• Recent Activity - Timestamped event stream for sessions, usage, nodes, and notifications
• Actions - Dashboard, Web Chat, Quick Send, Activity Stream, History
• Support & Debug - Logs, config, diagnostics folder, redacted support context, browser setup, port/capability/node/channel/activity summaries, and managed SSH tunnel restart
• Settings - Configuration and auto-start

Mac Parity Status

Comparing against openclaw-menubar (macOS Swift menu bar app):

Windows-Only Features

These features are available in Windows but not in the Mac app:

🔌 Node Mode (Agent Control)

When Node Mode is enabled in Settings, your Windows PC becomes a node that the OpenClaw agent can control - just like the Mac app! The agent can:

Packaged installs declare camera, microphone, and location capabilities. Windows may ask for consent the first time a node capability uses one of those protected resources.

Node Setup

1. Enable Node Mode in Settings (enabled by default)

2. First connection creates a pairing request on the gateway

3. Approve the device on your gateway:

   openclaw devices list          # Find your Windows device
   openclaw devices approve <id>  # Approve it
   

4. Configure gateway allowCommands - Add the commands you want to allow under gateway.nodes in ~/.openclaw/openclaw.json:

   {
     "gateway": {
       "nodes": {
         "allowCommands": [
           "system.notify",
           "system.run",
           "system.run.prepare",
           "system.which",
           "system.execApprovals.get",
           "system.execApprovals.set",
           "canvas.present",
           "canvas.hide",
           "canvas.navigate",
           "canvas.eval",
           "canvas.snapshot",
           "canvas.a2ui.push",
           "canvas.a2ui.pushJSONL",
           "canvas.a2ui.reset",
           "screen.snapshot",
           "camera.list",
           "camera.snap",
           "camera.clip",
           "location.get",
           "device.info",
           "device.status",
           "tts.speak"
         ]
       }
     }
   }
   

   ⚠️ Important: The gateway has a server-side allowlist. Commands must be listed explicitly - wildcards like canvas.* don't work! Privacy-sensitive commands such as screen.record and agent-driven audio playback via tts.speak should only be added to allowCommands when you explicitly want to allow them.

5. Test it from your Mac/gateway:

    # Show a notification
    openclaw nodes notify --node <id> --title "Hello" --body "From Mac!"
    
    # Open a canvas window
    openclaw nodes canvas present --node <id> --url "https://example.com"
    
    # Execute JavaScript (note: CLI sends "javaScript" param)
    openclaw nodes canvas eval --node <id> --javaScript "document.title"
    
    # Render A2UI JSONL in the canvas (pass the file contents as a string)
    openclaw nodes canvas a2ui push --node <id> --jsonl "$(cat ./ui.jsonl)"
    
    # Take a screenshot
    openclaw nodes invoke --node <id> --command screen.snapshot --params '{"screenIndex":0,"format":"png"}'
   
    # Record a short screen clip (requires explicitly allowing screen.record on the gateway)
    openclaw nodes screen record --node <id> --duration 3000 --fps 10 --screen 0 --no-audio --out /tmp/openclaw-windows-screen-record-test.mp4 --json
   
    # List cameras
    openclaw nodes invoke --node <id> --command camera.list
   
    # Take a photo (NV12/MediaCapture fallback)
    openclaw nodes invoke --node <id> --command camera.snap --params '{"deviceId":"<device-id>","format":"jpeg","quality":80}'
   
    # Speak text aloud on the Windows node (requires TTS enabled in Settings and tts.speak allowed on the gateway)
    openclaw nodes invoke --node <id> --command tts.speak --params '{"text":"Hello from OpenClaw","provider":"windows"}'
   
    # Execute a command on the Windows node
    openclaw nodes invoke --node <id> --command system.run --params '{"command":"Get-Process | Select -First 5","shell":"powershell","timeoutMs":10000}'
   
    # View exec approval policy
    openclaw nodes invoke --node <id> --command system.execApprovals.get
   
    # Update exec approval policy (add custom rules)
    openclaw nodes invoke --node <id> --command system.execApprovals.set --params '{"rules":[{"pattern":"echo *","action":"allow"},{"pattern":"*","action":"deny"}],"defaultAction":"deny"}'
   

   📷 Camera permission: Desktop builds rely on Windows Privacy settings. Packaged MSIX builds will show the system consent prompt.

   🔒 Exec Policy: system.run is gated by an approval policy on the Windows node at %LOCALAPPDATA%\OpenClawTray\exec-policy.json (schema: { "defaultAction": "...", "rules": [...] }). This is separate from gateway-side ~/.openclaw/exec-approvals.json.

   Rules are matched against the full command line. Known wrapper payloads such as cmd /c ..., powershell -Command ..., pwsh -EncodedCommand ..., and bash -c ... are also evaluated before execution. Dangerous environment overrides like PATH, PATHEXT, NODE_OPTIONS, GIT_SSH_COMMAND, LD_*, and DYLD_* are rejected.

Command Center diagnostics

Open the status detail/Command Center from the tray menu or with openclaw://commandcenter. It shows:

• channel health from gateway health events, including node-mode health received without a separate operator connection

• active sessions, usage/cost data, node inventory, declared commands, and Mac parity notes

• allowlist diagnostics that separate safe companion commands from privacy-sensitive opt-ins like screen.record, camera.snap, and camera.clip

• copyable repair commands for safe allowlist fixes and pending pairing approval

• recent activity and node invoke results through the Activity Stream, storing command names/status/duration only (not payloads, screenshots, recordings, or secrets)

  openclaw nodes invoke --node <id> --command system.execApprovals.set --params '{"rules":[{"pattern":"powershell.exe","action":"allow"},{"pattern":"pwsh.exe","action":"allow"},{"pattern":"echo *","action":"allow"},{"pattern":"*","action":"deny"}],"defaultAction":"deny"}'
  

  🔐 Web Chat secure context: Remote web chat requires https:// (or localhost). If using a self-signed cert, trust it in Windows (Trusted Root Certification Authorities) or use an SSH tunnel to localhost.

Node Status in Tray Menu

The tray menu shows node connection status:

• 🔌 Node Mode section appears when enabled
• ⏳ Waiting for approval... - Device needs approval on gateway
• ✅ Paired & Connected - Ready to receive commands
• Click the device ID to copy it for the approval command

Deep Links

OpenClaw registers the openclaw:// URL scheme for automation and integration:

Deep links work even when Molty is already running - they're forwarded via IPC.

📦 OpenClaw.Shared

Shared library containing:

• OpenClawGatewayClient - WebSocket client for gateway protocol
• IOpenClawLogger - Logging interface
• Data models (SessionInfo, ChannelHealth, etc.)
• Channel control (start/stop channels via gateway)

Development

Project Structure

openclaw-windows-node/
├── src/
│   ├── OpenClaw.Shared/           # Shared gateway library
│   └── OpenClaw.Tray.WinUI/       # System tray app (WinUI 3)
├── tests/
│   ├── OpenClaw.Shared.Tests/     # Shared library tests
│   └── OpenClaw.Tray.Tests/       # Tray app helper tests
├── docs/
│   └── images/                    # Screenshots
├── openclaw-windows-node.slnx     # Solution file
├── README.md
├── LICENSE
└── .gitignore

Configuration

Settings are stored in:

• Settings: %APPDATA%\OpenClawTray\settings.json
• Logs: %LOCALAPPDATA%\OpenClawTray\openclaw-tray.log
• Easy-button setup summary: %LOCALAPPDATA%\OpenClawTray\Logs\Setup\easy-setup-latest.txt
• Easy-button setup JSONL: %LOCALAPPDATA%\OpenClawTray\Logs\Setup\easy-setup-latest.jsonl

Default gateway: ws://localhost:18789

First Run

On first run, Molty launches a guided onboarding wizard that walks you through setup:

1. Welcome - introduces OpenClaw and starts the setup flow
2. Connection - choose Local gateway, Remote gateway, or configure later. Paste a setup code or enter gateway URL and token manually. Tests the connection with Ed25519 device authentication.
3. Wizard - gateway-driven configuration steps (AI provider selection, personality setup, communication channels). Steps are defined by your gateway.
4. Permissions - reviews Windows system permissions (notifications, camera, microphone, screen capture, location) and links to system settings to grant them.
5. Chat - meet your agent in a live chat powered by the gateway's web UI.
6. Ready - summary of available features, option to launch at startup, and a Finish button.

For detailed setup instructions, see docs/SETUP.md. For the full onboarding architecture, see docs/ONBOARDING_WIZARD.md.