Repository navigation
Conversation
…create A person who does not administer the Installation got a filled Create Namespace button and an empty state inviting creation; the 403 came only after submit (finding 2059, dogfood D654). The API has no advisory Installation permission answer, so the console now uses the signals it already has: the Installation-access probe makes Create Namespace a secondary action with ask-an-administrator copy for non-administrators (a role may still grant creation), and a real 403 disables the button with its reason until the page reloads.
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
Review follow-up for #2983: the refusal sentence is a status only when it answers the attempt just closed, not on every later render; the test now proves Refresh rerendered (a second list read, a new node) and covers Escape after a refusal on a reloaded page; the guide's wording says a non-administrator needs a role that grants creation.
clawsweeper
Bot
added
the
clawsweeper:intake:bug
clawsweeper
Bot
added
clawsweeper:intake:needs-environment
|
Codex review: needs maintainer review before merge. What this changesThis PR reduces creation prompts for non-administrators and disables Namespace creation after an actual permission denial until browser reload. Example: A member without create permission submits the Namespace name “Support” and closes the refused form.
Review scores
ProductKind: Bug fix · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review Keep this PR open: it addresses misleading Namespace creation prompts that remain on current main, and no actionable code defects were found. Priority: P2 Before mergeNone. FindingsNone. Tests
Agent review detailsHow this fits togetherThe console renders Namespaces from authenticated API responses; creation passes through the existing controller, IAM authorization, storage, and audit path. flowchart TB
A[Signed-in member] --> B[Namespaces console]
B --> C[Namespace API]
C --> D[Controller and IAM]
D -->|Authorized| E[Namespace storage and audit]
D -->|403 denial| F[Console refusal state]
Technical reviewBest possible solution: Retain the focused console repair and existing server authorization boundary. Do we have a high-confidence way to reproduce the issue? Current-main source shows the unconditional primary creation prompt and no retained denial; supplied before screenshots corroborate it, and the author reports base-failing browser regressions. Is this the best way to solve the issue? This is a focused repair using existing signals, preserves create-only roles, and avoids treating Installation administration as an exact create-permission answer. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against 4ebee7b51f50. Provenance checked
TestingProof path: shipped entry point. SecurityNone. EvidenceWhat I checked:
Likely related people:
LabelsLabel changes:
Label justifications:
Rank-up movesOptional improvements that raise the rating; they are not merge blockers.
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment HistoryReviewed October 19, 2026, 10:53 PM ET / October 20, 2026, 02:53 UTC (Revision 3). |
|
@clawsweeper re-review |
|
🦞👀 Re-review progress:
|
clawsweeper
Bot
added
clawsweeper:intake:bug
The 403 sentence pushed platform-console.md past the 2,500-word docs check. Say it in fewer words and tighten the /backends sentence beside it.
|
@clawsweeper re-review |
|
🦞👀 Re-review progress:
|
clawsweeper
Bot
added
clawsweeper:intake:bug
Problem
Dogfood D654 (board finding 2059, medium): a member with no Namespace-create right opens Namespaces and sees a filled Create Namespace button and an empty state that says "Create a Namespace to get started". The 403 arrives only after she types a name and submits. After she closes the refused form, the page still offers the same button.
The API has no advisory Installation-scope permission answer (unlike
GET /namespaces/{id}/permissionsfor Agent create), so the console cannot know in advance whether a non-administrator holds a Namespace create grant.Change
Uses only signals the console already has. No API or IAM change.
/observabilityaccess probe answered 403): Create Namespace is a secondary button instead of the filled primary, and the empty state says "Ask an administrator for access to an existing Namespace, or create one if your role allows it." The button stays usable, because a role can grant Namespace creation without Installation administration (the create-only creator path from fix(console): check namespace names at the field and keep focus after creation #2969 still works).The server part (an Installation-scope advisory permissions read, so the console can gate creation exactly before any attempt) is filed as a follow-up board finding instead of changed here.
Verification
node --test tests/browser/console-namespace-create.test.mjs(real controller + IAM, in-memory storage): 7/7 pass. On main sources the two changed tests fail (2 of 7): "a creator who cannot read Namespaces..." (button was primary) and "a member is not invited to create, and a real IAM denial disables Create Namespace" (filled button, invitation copy, button still enabled after the refusal).console-namespace-create.test.mjs20/20 runs green, 7 tests each, on d617573 and again on a076198.git merge-treeof this head against each of the 17 open PRs touching these files (feat: add Gateway managed mode to Agent deployments #2982, feat: share discoverable Driver configuration definitions #2980, Restore the validated Console destination after session expiry #2979, fix(console): header layout and compact Namespace selector #2977, feat(console): warm-quiet shell: sidebar surface, nav marker, account row, phone top bar #2974, fix(console): let the create preflight carry any configuration both creates accept #2833, feat(console): show the authorized native Gateway people roster #2596, feat(console): stop and delete Agents from the Agents list #2524, Draft implementation: managed outbound HTTPS for dedicated Gateways #2518, fix(console): distinguish stale runtime status from loss of access #2505, fix(console): keep followed logs steady and report the first output #2502, Add OCE policy simulation and tester for network and plugin actions #2445, fix: preserve native plugin permissions across Harness selection and admission #2258, fix(console): grant Agent access to accepted Configuration Secrets #2255, Support custom Installation profiles and readable Preset starters #2253, feat(auth): sign people in to occ with a device code (rfc-0019) #1619, feat: assign configured OpenClaw roles to Agent users #906) gives the same conflicted set as against main: no new conflict.Screenshots (real controller + IAM fixture, member without grants and administrator)
Storybook: Pages/Namespaces → Empty for a member, Create refused, then closed.
Risks