Repository navigation
Conversation
…after a refusal On an Installation whose Sandbox Driver lacks per-Agent network policy, the Policy denials tab read the Sandbox logs (400) and suggestions (409), showed both refusals and then a full editor; a member also got Retry policy read and Refresh suggestions after 403s (finding 2060, dogfood D655). The tab now reads the policy first: with no capability it shows one sentence and makes neither read. A 403 on the policy or suggestions read offers no retry.
replaceChildren stringifies null, so the omitted Retry and Refresh controls rendered the word null. Spread them in only when offered, and assert no stray text in the member test.
… not the tab's start Same behavior as the previous commits (one unsupported sentence, no logs or suggestions read without per-Agent network policy, no retry after a 403), restructured so the change stays inside readLogs, loadSuggestions and loadPolicy and leaves the tab's start-up block untouched: open #2980 rewrites that block.
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
…p following refused suggestions The draft Policy tab reads no logs or suggestions, so it never reached the unsupported check and still offered the editor. loadPolicy now shows it. Follow no longer re-requests suggestions after a 403.
clawsweeper
Bot
added
clawsweeper:intake:bug
|
Codex review: needs maintainer review before merge. What this changesThe console hides unavailable policy controls and suppresses policy retry controls after permission refusals. Example: Open Policy denials for an Agent whose Installation has no Sandbox Driver.
Review scores
ProductKind: Bug fix · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review Keep this PR open: it addresses a source-verifiable console bug that remains on main, and no discrete correctness defect was found in the introduced changes. Priority: P2 Before mergeNone. FindingsNone. Tests
Agent review detailsHow this fits togetherThe Agent policy console consumes separately authorized policy, recommendation, and runtime-log endpoints and renders denial records and policy controls. flowchart TB
A[Agent policy tab] --> B[Policy API and IAM]
B --> C[Capability response]
C -->|Unsupported| D[Availability notice]
C -->|Supported or read failed| E[Independent log and suggestion reads]
E --> F[Denials and policy controls]
Technical reviewBest possible solution: Keep capability handling in the existing policy view while preserving separate server-side permissions for logs, suggestions, and mutations. Do we have a high-confidence way to reproduce the issue? Current-main source exposes the reported unsupported editor and refusal retry controls, supported by before screenshots and targeted regression cases; no target code was executed during this read-only review. Is this the best way to solve the issue? The focused console repair uses the API's existing capability response, preserves independent permissions after failed policy reads, and adds no competing API or persistence owner. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against 698112e67e0a. Provenance checked
TestingProof path: shipped entry point. SecurityNone. EvidenceWhat I checked:
Likely related people:
LabelsLabel changes:
Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment Reviewed October 19, 2026, 9:48 PM ET / October 20, 2026, 01:48 UTC. |
1 participant
Problem
Dogfood D655 (board finding 2060, low). On oce-dogfood-b (Kubernetes Compute, no Sandbox Driver), the new Policy denials tab (#2599):
runtime/logs?source=sandbox(400, "no such runtime log source") and the policy recommendations (409), showed both refusals, and then a full editor (Enable editing, rules, Review, Apply) under "This Sandbox Driver does not support per-Agent network policy.";Change
Console only (
agents/sandbox-policy.mjs); no API change.capability: null, the API's own answer), the tab shows one status sentence ("This Sandbox Driver does not support per-Agent network policy. Policy denials, suggestions and Agent network rules are not available for this Agent.") and makes neither read. The draft Policy tab, which reads neither anyway, shows the same sentence instead of the editor. A refused or failed policy read leaves the logs and suggestions to their own permissions, as before.policy-workflow.mdsay so.The gate sits inside
readLogs,loadSuggestionsandloadPolicy, not in the tab's start-up block, so it adds no conflict with open #2980, which rewrites that block.Verification
tests/browser/console-agent-draft-guards.test.mjs(real controller and IAM; the policy console case uses the real OpenShell Sandbox Driver capability):capability: null); one status sentence, no editor/refresh/add buttons, no alert, and no/runtime/logsor/recommendationsrequest; the draft tab shows the same sentence without Enable policy editing.loadPolicyline). Whole file 30/30.console-agent-draft-guards.test.mjs20/20 runs (30/30 tests each) on the final sources.git merge-tree, conflict hunks in the touched files) for every open PR touching them (fix(console): stop inviting members to create namespaces they cannot create #2983, feat: add Gateway managed mode to Agent deployments #2982, feat: share discoverable Driver configuration definitions #2980, Restore the validated Console destination after session expiry #2979, fix(console): header layout and compact Namespace selector #2977, feat(console): warm-quiet shell: sidebar surface, nav marker, account row, phone top bar #2974, fix(console): let the create preflight carry any configuration both creates accept #2833, feat(console): show the authorized native Gateway people roster #2596, feat(console): stop and delete Agents from the Agents list #2524, RFC and implementation: managed outbound HTTPS for dedicated Gateways #2518, fix(console): distinguish stale runtime status from loss of access #2505, fix(console): keep followed logs steady and report the first output #2502, Add OCE policy simulation and tester for network and plugin actions #2445, fix: preserve native plugin permissions across Harness selection and admission #2258, fix(console): grant Agent access to accepted Configuration Secrets #2255, Support custom Installation profiles and readable Preset starters #2253, feat(auth): sign people in to occ with a device code (rfc-0019) #1619, feat: assign configured OpenClaw roles to Agent users #906): identical to main, including feat: share discoverable Driver configuration definitions #2980.Screenshots (real controller; Policy denials tab of an active revision)
Storybook: Pages/Agent detail → Sandbox policy capability unavailable.
Risks