fix(sandbox): use one-time noVNC observer tokens

This commit is contained in:
Peter Steinberger
2026-02-21 13:56:49 +01:00
parent b43aadc34c
commit 8c1518f0f3
11 changed files with 463 additions and 27 deletions

View File

@@ -495,7 +495,7 @@ Notes:
- Headful (Xvfb) reduces bot blocking vs headless.
- Headless can still be used by setting `agents.defaults.sandbox.browser.headless=true`.
- No full desktop environment (GNOME) is needed; Xvfb provides the display.
- noVNC observer access is password-protected by default; OpenClaw provides an auto-connect URL with the password query parameter.
- noVNC observer access is password-protected by default; OpenClaw provides a short-lived observer token URL instead of sharing the raw password in the URL.
Use config: