fix(console): secret picker errors name the field and stay visible

[freeqaz]

Problem

Three lows from the live walk on oce-dogfood-b and the form-field lanes (#2907, #2918), all in the Secret picker (secret-picker.mjs):

• 1987: Create Agent's model credential picker is labelled "API key Secret" or "Service account token Secret", but its required error said "Model credential Secret is required.", a field the page does not show. The authentication source form said "API key Secret is required." under a field labelled "Service account token Secret".
• 1988: the picker opens its list on focus. When the console's own check (validateFields) moves focus to a required picker, the list covers the new error under the field until Escape.
• 1989 (D648): a Create Secret refusal other than a name conflict (seen live: 409 NAMESPACE_NOT_READY on a provisioning Namespace; also 400/403/404/429) disabled the submit while it ran, so focus dropped to the page body behind the open dialog.

Change

• Error names the shown label. The required message is built from the label node the page shows, so a form that renames the field by method gets "API key Secret is required." or "Service account token Secret is required.". A shown error follows a renamed label when the method changes. No caller changes.
• No list on the check's focus. A picker that shows its error (aria-invalid="true") does not open its list on focus. Click (new listener), typing and ArrowDown still open it, as before. A valid picker still opens on focus as today.
• Refusal keeps focus in the dialog. After any refusal other than a name conflict (which still focuses Name), the refusal block takes focus with revealStatus(feedback, dialog), in view. An unknown outcome is handled the same way.
• Storybook: new Pages / Create Agent / Model credential Secret required and Pages / Create Agent / Create Secret refused; form-field-workflow.md steps 6-8 updated (the list no longer needs Escape).

Presentation only: no API or authorization change.

Verification

• New tests (headless Chromium, real API fixture):
  • console-form-fields.test.mjs: Create Agent's required Secret error names its field and stays in sight (1440 and 390). It checks the error text for both methods, a closed list with the error on top (elementFromPoint), and that click, ArrowDown and typing still open the list. A refused Create Secret keeps focus in the dialog on the refusal, in view, for 409 NAMESPACE_NOT_READY, 403 and 429 (1440 and 390), and a name conflict still focuses Name.
  • console-form-fields-2.test.mjs: the authentication source form names "Service account token Secret" in its required error, with the list closed.
  • Updated the feat(console): form field pattern with linked help and errors #2907 test that pinned "Model credential Secret is required." and relied on focus opening the list (it now clicks).
• All 6 new or updated tests fail on main and pass with the change.
• Both touched files ran 20/20 at 2 CPUs (21 tests each run).
• Wider regression: the 11 browser files that use Secret pickers (agent detail 1 and 2, draft guards, agents 1 and 2, presets, channels, form fields 1 and 2, runtime credentials, saves) passed 304/304.
• prettier and eslint are clean on the touched files.
• After merging main (3110ba7c7, which moved both touched test files): both touched files ran 3/3 at 2 CPUs (25 tests per run).
• Open PRs: a 3-way merge-tree of this head against the 16 open PRs that touch console, Storybook or browser-test files (fix(console): match Chromium's break points for long Agent names #2916, fix(console): let the create preflight carry any configuration both creates accept #2833, feat: add per-agent sandbox network policies and denial review #2599, feat: admit explicit Gateway identities and show native people in OCC #2596, feat(console): stop and delete Agents from the Agents list #2524, RFC and implementation: managed outbound HTTPS for dedicated Gateways #2518, fix(console): distinguish stale runtime status from loss of access #2505, fix(console): keep followed logs steady and report the first output #2502, Add OCE policy simulation and tester for network and plugin actions #2445, fix: preserve native plugin permissions across Harness selection and admission #2258, fix(console): grant Agent access to accepted Configuration Secrets #2255, Support custom Installation profiles and readable Preset starters #2253, feat(auth): sign people in to occ with a device code (rfc-0019) #1619, feat: assign configured OpenClaw roles to Agent users #906, docs(specs): propose rfc-0019 for repository options without a repository driver #878, feat: add Agent workload tags #115) shows the same conflict count as main for each: zero new conflict hunks.

Media (Storybook fixtures on the merged head)

These are the author's Storybook screenshots and walkthrough. We reproduced the three states at 1440 × 900 and 390 × 844 in Chromium, with the picker from dd92bd62a6dd for the before comparison and the PR at 3110ba7c75f5 for the after comparison. We checked the field label and error, whether the list obscured the error, and where focus landed after the simulated refusal. The captures show Console behavior with fixture data. They do not exercise live Secret creation or storage.

Model credential Secret required (Create Agent, Service Accounts): before, the open list covers the field's error; after, the error names the shown field ("Service account token Secret is required.") and the list stays closed

	1440	390
before
after

Authentication source required fields: before, the list opens over the error; after, it stays closed

	1440	390
before
after

Create Secret refused (409 NAMESPACE_NOT_READY): before, focus is on Name, not the refusal; after, the refusal has focus inside the dialog

	1440	390
before
after

Stories: Pages / Create Agent / Model credential Secret required, Pages / Create Agent / Create Secret refused, Pages / Agent detail / Authentication source required fields.

Recording: walkthrough (1280x800, webm): Create Agent's Service account token Secret error with the list closed, the label and error following the method ("API key Secret is required."), click and ArrowDown opening the list, then the Create Secret refusal taking focus in the dialog.

Risks

Low. Keyboard readers who Tab into a picker that shows its error now press ArrowDown or type to open the list; one without an error still opens on focus. Findings 1987, 1988, 1989; UX plan C3 follow-up. Finding 1993 (Share Agent explainer) is left for #906, which rewrites access.mjs.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs changes before merge.

What this changes

Secret-picker validation names the visible field, keeps its error unobscured, and focuses creation refusals inside the dialog.

Example: Create Research assistant using Service Accounts without selecting a Secret.

• Before: The error names Model credential Secret, and the automatically opened list covers it.
• After: Service account token Secret is required appears beneath the focused field with the list closed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused repair with meaningful browser coverage and directly inspected UI screenshots; the attachment handoff remains a merge requirement.
Proof confidence	🐚 platinum hermit (4/6) ✨ media proof bonus	Sufficient (screenshot): Inspected Storybook screenshots exercise the actual picker UI and show corrected labels, unobscured errors at 1440 and 390 pixels, and focused refusal feedback inside the dialog; they establish simulated UI behavior only. Recording inspection was blocked by reviewer infrastructure, which does not invalidate the visible evidence.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: Credential errors can name a different field, disappear beneath its options, or leave keyboard focus behind an open refusal dialog.
Reason: The collaborator-authored direction addresses observed accessibility and recovery defects without adding configuration or changing authorization.

Merge readiness

⛔ Needs changes before merge - 1 item remains

This PR fixes concrete Secret-picker usability defects with a focused shared-component change; no introduced correctness or security defect was found.

Priority: P2
Reviewed head: 3110ba7c75f5e54f83f4f65ffa848715287a34b6

Before merge

• Complete next step - Upload the existing screenshots and walkthrough as native GitHub attachments in Verification, and confirm they open and show the final UI, as AGENTS.md requires.

Findings

None.

Agent review details

How this fits together

The console’s shared Secret picker serves Agent creation and credential editing, translating selections, validation results, and Secret API responses into bindings and accessible feedback.

flowchart TD
  A[Agent creation form] --> C[Shared Secret picker]
  B[Credentials form] --> C
  C --> D[Field validation helpers]
  C --> E[Namespace Secret API]
  E --> F[Creation dialog feedback]
  D --> G[Visible accessible errors]
  F --> G

Loading

Technical review

Best possible solution:

Land the focused shared-picker repair after the existing native-media handoff is completed.

Do we have a high-confidence way to reproduce the issue?

Current-main source exposes the reported paths, and before screenshots corroborate the obscured validation error; no target code was executed during this review.

Is this the best way to solve the issue?

The patch repairs the existing shared owner using established validation and focus helpers while preserving selection, keyboard access, and name-conflict recovery.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 3484c9d715aa.

Provenance checked

• Required Secret validation keeps the original intent (e47b14a: fix(console): use Secret pickers when creating new revisions #420 consolidated Namespace Secret selection and explicit binding saves across revision workflows.)
• Searchable picker focus behavior changes intended behavior with a stated reason (9c5fc77: Improve Secret creation and searchable credential selection #463 introduced searchable credential selection; this PR explains why automatic opening must be suppressed when validation focuses an invalid field.)
• Dialog restoration and conflict recovery keeps the original intent (5d05753: fix(console): guide rejected credentials and gate staged auth on deploy #722 prevented restored focus from reopening the list; the patch preserves that guard and existing conflict focus.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Pinned production change: The introduced diff derives validation text from the existing label, suppresses automatic list opening for invalid fields, and reuses revealStatus for creation refusals. (apps/controller/src/console/agents/secret-picker.mjs:391, 3110ba7c75f5)
• Current-main behavior: Fetched main retains the captured-label validation message, unconditional focus opening outside dialog restoration, and no refusal-focus action for non-conflict errors; the central fixes remain necessary. (apps/controller/src/console/agents/secret-picker.mjs:387, 3484c9d715aa)
• Behavioral browser coverage: Added browser cases exercise both authentication labels, unobscured errors, pointer and keyboard opening, refusal focus, and retained name-conflict focus through the production console; refusal responses are injected at the HTTP boundary. (tests/browser/console-form-fields.test.mjs:475, 3110ba7c75f5)
• Inspected visual evidence: Prepared desktop and mobile screenshots show the corrected Service account token Secret error with the list closed. Historical GitHub screenshot blobs also show the authentication error and focused creation refusal inside the dialog; these are simulated Storybook UI evidence. (1a58165ef542)
• Outstanding attachment requirement: AGENTS.md requires native GitHub screenshots and a recording before merging UI changes. Verification still links Gist media, and the author explicitly leaves native upload to a maintainer in fix(console): secret picker errors name the field and stay visible #2922 (comment). (AGENTS.md:455, 3110ba7c75f5)
• Related change has a distinct scope: fix(console): a provisioning Namespace says so before Create #2924 adds advance provisioning guidance while preserving draft creation; it does not replace this PR’s field-label, list visibility, or refusal-focus fixes. (ad895023fabb)

Labels

Label changes:

No label changes.

Label justifications:

• P2: Misnamed or obscured field errors and misplaced dialog focus create recoverable friction in Agent credential setup.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.
• proof: sufficient: Contributor real behavior proof is sufficient.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (3 earlier review cycles)

• reviewed 2026-10-19T09:34:34.735Z sha f87ac2b :: needs maintainer review before merge. :: none
• reviewed 2026-10-19T09:42:40.975Z sha 6375aa9 :: needs changes before merge. :: none
• reviewed 2026-10-19T10:00:54.950Z sha d70cc91 :: needs changes before merge. :: none

Reviewed October 19, 2026, 5:36 PM ET / 21:36 UTC (Revision 4).

[freeqaz]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/39232357569
• Updated: 2026-10-19T09:44:58.397Z

[freeqaz]

Thanks. The only before-merge item is the native-attachment upload. This host can't upload native GitHub attachments, so the media follows the maintainers' committed-media flow: the screenshots (1a58165ef) and the walkthrough recording (7a1bdaf3c) are committed under .pr-media/2922/, linked by SHA in Verification, and removed again before the squash (the head has no .pr-media/). I'm leaving the native upload to a maintainer and not landing this while the verdict is "needs changes".

[freeqaz]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/39234550137
• Updated: 2026-10-19T10:02:53.431Z

[freeqaz]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/39329000169
• Updated: 2026-10-19T21:38:12.621Z

[freeqaz-openai]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.