Codex review: needs maintainer review before merge.

Summary
Adds a SPA-side WebView2 bridge module, wires it into the OpenClawApp lifecycle, adds bridge/input-history tests, and records the Control UI/Windows change in the changelog.

Reproducibility: not applicable. this is a feature PR rather than a bug report. Current main lacks the SPA bridge, and the PR tests plus inspected WebView2 recording give high-confidence evidence for the proposed behavior.

Real behavior proof
Sufficient (recording): The supplied MP4 proof was inspected and shows after-fix WebView2 draft injection updating the composer, repeated dispatch/reopen behavior without visible duplication, and regular-browser window.chrome?.webview returning undefined.

Next step before merge
No automated repair is needed; the remaining action is normal maintainer review and merge handling for a clean external feature PR.

Security
Cleared: No concrete security or supply-chain concern found; the diff only touches Control UI TypeScript/tests and CHANGELOG.md, adds no dependencies or workflows, and validates a narrow WebView2 message shape before mutating the composer.

Greptile Summary

This PR wires a WebView2 native bridge into the SPA lifecycle, adding app-native-bridge.ts with initNativeBridge/sendToNative/isWebView2, and integrating it into OpenClawApp.connectedCallback / disconnectedCallback. The implementation is minimal, well-validated, and covered by a thorough test suite.

The surface is correctly scoped to draft-text (inbound) and ready (outbound), listener registration is ordered before the handshake, and cleanup is consistently handled.

Confidence Score: 4/5

Safe to merge — no logic errors or security issues; one minor style note about redundant getWebview() lookup.

The change is small, well-tested, and handles all the relevant edge cases (no-op outside WebView2, cleanup on disconnect, malformed message guards). Only a P2 style observation remains.

No files require special attention.

This is a comment left during a code review.
Path: ui/src/ui/app-native-bridge.ts
Line: 57

Comment:
**Redundant `getWebview()` lookup via `sendToNative`**

`initNativeBridge` already has a confirmed non-null `bridge` reference, but calling `sendToNative` causes a second `getWebview()` / `window.chrome?.webview` lookup for the same handshake. Consider posting directly on `bridge` to make the intent explicit:

```suggestion
  bridge.postMessage({ type: "ready" });
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "feat(ui): wire WebView2 bridge — draft-t..." | Re-trigger Greptile}

I dug into the CI failures and they don't come from the bridge itself. Both visible errors (Node dist test shards failed and Core support boundary shard failed in build-artifacts) pointed to the same shard: checks-node-core-support-boundary.

The root cause was a stale fixture in test/openclaw-npm-postpublish-verify.test.ts that was missing the mirroredRootRuntimeDependencies field now expected by the validator. That was fixed directly on main in bdbce3b1 (fix(ci): align postpublish mirror fixtures), shortly after this PR's CI run.

I've rebased the branch onto current main to pick up that fix. No functional changes to the bridge code or its tests.

@BunsDev sorry for the noise. The root cause was on my side: sendToNative was calling ?.postMessage without a lint suppress and unicorn/require-post-message-target-origin is heuristic, it flags any .postMessage with a single argument regardless of receiver type, so there was no clean way around it without an explicit disable comment.

Pushing a fix now that adds the suppress in sendToNative and restores listener-first ordering with a single ready handshake. All 15 bridge tests pass.

Maintainer update: I pushed 0224a826 to rebase this branch onto current main, add the missing CHANGELOG.md entry, and apply the repo formatter's import/line-wrap cleanup on the rebased files.

Verification:

• pnpm test ui/src/ui/app-native-bridge.test.ts passed locally: 15/15 tests.
• pnpm exec oxfmt --check --threads=1 ui/src/ui/app-native-bridge.ts ui/src/ui/app-native-bridge.test.ts ui/src/ui/app.ts CHANGELOG.md passed locally.
• node scripts/run-oxlint.mjs --tsconfig config/tsconfig/oxlint.core.json ui/src/ui/app-native-bridge.ts ui/src/ui/app-native-bridge.test.ts ui/src/ui/app.ts passed locally.
• Blacksmith Testbox pnpm check:changed passed.
• Exact-head CI is green for 0224a826.

Remaining blocker: Real behavior proof still fails because this external PR does not include an after-fix proof section from a real OpenClaw/WebView2 setup. Please add a Real behavior proof section to the PR body with a real WebView2 host smoke result for the draft-text injection path, cleanup/reconnect path, and regular-browser no-op path. Unit tests/CI are good supplemental evidence, but they do not satisfy this gate by themselves.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/25535423195
• Updated: 2026-05-08T03:48:56.710Z

Hey @BunsDev apologies for the delay. I've now added the full test plan checkboxes and a screen recording as real behavior proof (see the updated PR body). CI is green. Let me know if anything else is needed.