[freeqaz]

Problem

Two lows from the live walk on oce-dogfood-b (nora, a reader without update or operate, at 1440x900):

• 1991 (D650): a refused Configuration save (real PATCH 403) showed its danger block with role="status", not an alert. It was not focused (focus stayed on Save Configuration) and at 1440 it started at y=851, cut off by the fold.
• 1992 (D651): Run diagnostics stayed enabled for a reader without operate, while Stop and Delete on the same page were disabled with "Your access does not include…". Its 403 alert landed about 160 px below the button; at 1440, after a pointer click, it was off screen (top 1006), so nothing visibly changed.

Change

• Configuration save refusal (1991): when the save ends in a refusal that Reload cannot fix (a 403, 400, 404 or 429, or a failed read before the PATCH; no Reload shown), the feedback line becomes role="alert" before its text is written, takes focus and scrolls into view (revealStatus). Before, these focused Save, described by the line. A conflict or unknown outcome still focuses Reload draft (finding 1481); its refusal now also scrolls into view while the reader is still in the editor. The line goes back to role="status" for the next save's progress, after an edit or Cancel, and for the navigation note.
• Run diagnostics (1992): the version diagnostics panel takes the caller's permission answer (permissions.operate), read the same way as for Stop Agent. When it is false, the button is disabled and an info status block says "Your access does not include running diagnostics for this Agent.". An unknown answer keeps the button. A 403 that still happens scrolls its alert into view below the button, which keeps focus (since fix(console): keep focus while diagnostics run #2779).
• Storybook: new Pages / Agent detail / Edit Configuration refused, Current observations for a reader without operate and Current observations refused; status-block-workflow.md steps 11-13.

Presentation only: the API's checks are unchanged, and "can operate" comes from the existing GET …/permissions answer that Stop uses.

Verification

• New tests in tests/browser/console-status-block.test.mjs (headless Chromium, real API fixture, real policy for the reader):
  • a reader's refused Configuration save is a focused alert, fully on screen and painted in the danger tokens (1440 and 390), and the line is a status again after an edit;
  • Run diagnostics is disabled with its info reason for a reader without operate, and no diagnostics POST is sent;
  • a refused Run diagnostics (403) brings its alert on screen with the button scrolled to the bottom and pressed by pointer, and the button keeps focus and stays on screen (1440 and 390).
• All 5 fail on main and pass with the change. On main the 1440 alert sat at top 1061 with a 900 px viewport.
• console-status-block.test.mjs ran 20/20 at 2 CPUs (13 tests each run) on the final code, and the save-refusal, drafts-kept, JSON-feedback and saves files passed again with it (86/86).
• Wider regression: save refusals, agent state, agent detail 1 and 2, saves, drafts kept, JSON error feedback, button hierarchy, status block and draft guards passed 241/241.
• prettier and eslint are clean on the touched files.
• Open PRs: a 3-way merge-tree of this head against the 16 open PRs that touch console, Storybook or browser-test files (fix(console): match Chromium's break points for long Agent names #2916, fix(console): let the create preflight carry any configuration both creates accept #2833, feat: add per-agent sandbox network policies and denial review #2599, feat(console): show the authorized native Gateway people roster #2596, feat(console): stop and delete Agents from the Agents list #2524, RFC and implementation: managed outbound HTTPS for dedicated Gateways #2518, fix(console): distinguish stale runtime status from loss of access #2505, fix(console): keep followed logs steady and report the first output #2502, Add OCE policy simulation and tester for network and plugin actions #2445, fix: preserve native plugin permissions across Harness selection and admission #2258, fix(console): grant Agent access to accepted Configuration Secrets #2255, Support custom Installation profiles and readable Preset starters #2253, feat(auth): sign people in to occ with a device code (rfc-0019) #1619, feat: assign configured OpenClaw roles to Agent users #906, docs(specs): propose rfc-0019 for repository options without a repository driver #878, feat: add Agent workload tags #115) shows the same conflict count as main for each: zero new conflict hunks (including feat: add per-agent sandbox network policies and denial review #2599, feat(console): show the authorized native Gateway people roster #2596, RFC and implementation: managed outbound HTTPS for dedicated Gateways #2518, Add OCE policy simulation and tester for network and plugin actions #2445 and feat: assign configured OpenClaw roles to Agent users #906 in detail.mjs).

Media (Storybook, committed in 4d56b3b and removed before squash)

Edit Configuration refused (403): before, a status line under Save with focus left on Save; after, a focused alert in view

	1440	390
before
after

Reader without operate: before, Run diagnostics enabled; after, disabled with its reason

	1440	390
before
after

Run diagnostics refused (403), button at the bottom of the screen and pressed by pointer: before, the alert stays below the fold; after, it comes into view and the button keeps focus

	1440	390
before
after

Stories: Pages / Agent detail / Edit Configuration refused, Current observations for a reader without operate, Current observations refused. Before shots are the same stories on main's detail.mjs.

Recording: walkthrough (1280x800, webm): the refused Configuration save as a focused alert, Run diagnostics disabled for a reader, and a refused Run diagnostics coming into view. Committed in 1bd5b00 and removed before squash.

Risks

Low. A reader whose permission answer denies operate can no longer press Run diagnostics; the API would have refused it anyway. Findings 1991, 1992; UX plan P3 (danger is an alert) and C1.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR brings refused Configuration saves and diagnostics into view and disables diagnostics when Agent operate permission is explicitly denied.

Example: A read-only user saves Configuration JSON at a 1440×900 viewport.

• Before: The refusal remained a status message with focus on Save Configuration and could appear below the fold.
• After: The refusal becomes a focused alert and scrolls into view.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A useful, focused repair supported by direct visual evidence and meaningful browser regression cases, with proof scoped to console behavior.
Proof confidence	🐚 platinum hermit (4/6) ✨ media proof bonus	Sufficient (screenshot): Inspected desktop and mobile Storybook screenshots exercise the changed console rendering and show focused Configuration refusals, disabled diagnostics with a permission reason, and visible diagnostics refusals; this establishes simulated UI behavior, while recording inspection was limited by reviewer infrastructure.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: Readers can miss refused saves and diagnostics responses, and can activate diagnostics despite an explicit permission denial.
Reason: The change addresses observed console failures using established accessibility and permission patterns; maintainer authorship supplies direction approval.

Merge readiness

✅ Ready for maintainer review

Keep open: this PR addresses concrete console accessibility and permission-feedback bugs, with no introduced correctness or security defect found.

Priority: P2
Reviewed head: 9667c3cc883f47140ece0f4dd6a01c6c50fbb551

Before merge

None.

Findings

None.

Agent review details

How this fits together

The Agent detail console consumes existing permission summaries and API responses, then renders controls, accessible feedback, and focus changes; server authorization remains unchanged.

flowchart LR
  User[Console user] --> Detail[Agent detail]
  Detail --> Permissions[Permission summary API]
  Permissions --> Controls[Enabled or disabled controls]
  Detail --> Operations[Configuration and diagnostics APIs]
  Operations --> IAM[Exact resource authorization]
  Operations --> Feedback[Visible accessible feedback]

Loading

Technical review

Best possible solution:

Keep the focused alert and permission-aware diagnostics changes within the existing Agent detail and shared status owners.

Do we have a high-confidence way to reproduce the issue?

Current-main source establishes both faulty paths, and supplied before/after screenshots support the Configuration focus change; no target code or tests were run during this read-only review.

Is this the best way to solve the issue?

The patch is a focused repair using existing permission and feedback owners, preserving server authorization, conflict recovery, and the diagnostics waiting delay.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against cf2cc2ec3c77.

Provenance checked

• Configuration save completion focus changes intended behavior with a stated reason (e8df024: Save failures focus Reload draft or Save so keyboard users retain a useful next action.)
• Diagnostics focus and waiting behavior keeps the original intent (4ff0803: Delay transient waiting feedback and preserve focus unless the reader remains on the operation.)
• Configuration progress and refusal presentation changes intended behavior with a stated reason (7474d8b: Use shared tone-based status blocks while keeping progress feedback distinct from errors.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Introduced production changes: The pinned diff reuses revealStatus and the existing caller permission promise, preserves conflict recovery, and adds scrolling only on the relevant refusal paths. (apps/controller/src/console/agents/detail.mjs:4422, 9667c3cc883f)
• Current main still exhibits the source path: Fetched main retains the diagnostics button without the operate-permission condition and Configuration refusal completion through focusSaveOutcome without the new alert reveal. (apps/controller/src/console/agents/detail.mjs:903, cf2cc2ec3c77)
• Existing server permission contract: diagnoseAgentDeployment reads the exact revision and requires Agent operate and read authorization before invoking diagnostics; the PR changes only console presentation of that existing contract. (packages/occ/src/index.ts:3074, 9667c3cc883f)
• Meaningful browser regression coverage: Five added cases cover desktop and mobile Configuration refusal visibility and focus, denied diagnostics availability, and desktop and mobile diagnostics refusal scrolling; the reader cases use the existing real Console/API/IAM fixture. (tests/browser/console-status-block.test.mjs:402, 9667c3cc883f)
• Inspected visual evidence: Inspected the prepared Configuration before/after screenshots and the linked diagnostics after screenshots at 1440 and 390 pixels. They show the focused Configuration refusal, disabled diagnostics with its reason, and visible diagnostics refusal. These are simulated Storybook UI demonstrations. The linked recording could not be inspected: the manifest prepared only four images, scratch writes failed with a read-only filesystem, ffmpeg and ffprobe were unavailable, and no browser playback tool was exposed. (4d56b3bfd594)
• Prior intent and feature history: Read the discussion and implementation intent in Keep keyboard focus when a Configuration save finishes late #2705, fix(console): keep focus while diagnostics run #2779, fix(console): hold the diagnostics waiting line for 250 ms #2795, and fix(console): finish moving errors and notices to the status block #2912. The patch retains their moved-focus protection, delayed diagnostics waiting state, and shared status presentation. Local follow-history reached an unavailable creation-era object; the relevant later feature history was readable. (apps/controller/src/console/agents/detail.mjs:998, cf2cc2ec3c77)

Likely related people:

• Free Wortley: Raw commit 4ff0803 adds apps/controller/src/console/agents/detail.mjs:847 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 4ff080301bd2; files: apps/controller/src/console/agents/detail.mjs)
• stevenlee-oai: Raw commit 7c3ecbf adds apps/controller/src/console/agents/detail.mjs:333 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 7c3ecbfce4fa; files: apps/controller/src/console/agents/detail.mjs)
• Kevin: Raw commit 370570d adds apps/controller/src/console/agents/detail.mjs:907 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 370570d78872; files: apps/controller/src/console/agents/detail.mjs)

Review metrics

Metric	Value	Why it matters
Production and regression scope	Production +52/−5 lines; browser tests +147/−1 lines; five new regression cases	The test growth protects distinct permission, focus, and viewport behavior without adding production test seams.

Labels

Label changes:

• add P2: Incorrect refusal presentation and an enabled operation that will be denied create limited console usability and accessibility friction.
• add proof: sufficient: Contributor real behavior proof is sufficient.
• add proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: Incorrect refusal presentation and an enabled operation that will be denied create limited console usability and accessibility friction.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.
• proof: sufficient: Contributor real behavior proof is sufficient.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 19, 2026, 5:52 AM ET / 09:52 UTC.