[freeqaz]

Problem

Policy denials on a version without a Sandbox (#3657) says "This Agent version runs without a Sandbox, so no policy denials are recorded for it." It still shows "Denials in the loaded window: none recorded", Refresh denials, Follow, the filter, and Refresh suggestions when suggestions are readable. None of these can show anything for that version, and they leave large empty bands.

Change

When the viewed version has no Sandbox log source, from its snapshot or from the API's RUNTIME_LOGS_SOURCE_UNAVAILABLE answer, Policy denials hides the loaded-window count, the Refresh denials and Follow controls, the filter and Refresh suggestions. The reason line stays. A version with a Sandbox keeps every control. The draft and "Sandbox Driver does not support per-Agent network policy" views are unchanged.

Verification

• console-agent-detail-2.test.mjs ("an Agent reader meets no refused read …"): on the current version without a Sandbox, the reason shows and no count, Refresh denials, Refresh suggestions, Follow or filter control appears. This fails on main.
• console-agent-draft-guards.test.mjs ("Policy denials reads the Sandbox log …"): a version a Sandbox Driver provisioned keeps Refresh denials, Follow and the filter visible. This guards the other branch and passes on main and here.
• Both tests pass 20/20 at 2 CPUs. Both files pass in full (107 tests) in a remote test VM with a private network namespace. eslint and prettier pass.
• Before/after media: not captured. No Storybook story covers the no-Sandbox state yet. The browser tests are simulated UI proof.

Risks

Low. Only a hidden toggle on existing nodes in one branch. The Follow timers are also cleared there, as before.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs changes before merge.

What this changes

Hide policy-denial counts and controls when the viewed Agent version has no Sandbox log source.

Example: An Agent reader opens Policy denials for a Dedicated Codex version without a Sandbox.

• Before: The explanation appears alongside an empty count, Refresh denials, Follow, and a filter.
• After: The explanation remains while the unusable denial controls are hidden.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	A useful, focused repair has a small rendering-order defect, missing required Storybook coverage, and no required visual evidence.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is not required for maintainer- or bot-authored pull requests.
Patch quality	🦐 gold shrimp (3/6)	2 actionable review findings remain.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Partial
User problem: A version that cannot record policy denials still presents empty counts and controls that cannot produce useful results.
Reason: The maintainer-authored direction removes misleading controls through their existing owner, although one advertised fallback ordering remains incomplete.

Merge readiness

⛔ Needs changes before merge - 2 items remain

Keep this PR open: it addresses real Console clutter, but the API-error fallback can retain Refresh suggestions, and required Storybook coverage is missing.

Priority: P3
Reviewed head: d5abed30d0810deb4df6308e28e82cd3e02b6e6c

Before merge

• Rerender suggestions when the log response establishes absence (P3) - When the snapshot answer is inconclusive, logs and suggestions proceed independently. If the suggestion request settles first, renderSuggestions creates Refresh suggestions while noSandboxLog is false. A later RUNTIME_LOGS_SOURCE_UNAVAILABLE response sets the flag and calls showNoSandboxDenials, which never rerenders suggestions. The button therefore remains visible until clicked, contrary to the advertised fallback behavior. Update the suggestion controls in the same transition and cover this response ordering.
• Add the no-Sandbox state to the existing Storybook workflow (P3) - This changes the Policy denials page without updating its matching stories, scenarios or workflow instructions. The PR explicitly confirms that no story covers this state. AGENTS.md requires those updates for Console changes, and the existing policy scenarios cannot demonstrate the new no-Sandbox result. Add an explicit no-Sandbox scenario alongside the Sandbox-backed control and update the policy walkthrough.

Findings

• [P3] Rerender suggestions when the log response establishes absence — apps/controller/src/console/agents/sandbox-policy.mts:230-232
• [P3] Add the no-Sandbox state to the existing Storybook workflow — apps/controller/src/console/agents/sandbox-policy.mts:230-232

Tests

• Missing end-to-end proof: Supply before/after desktop screenshots and an uploaded walkthrough showing hidden controls for a no-Sandbox version and preserved controls for a Sandbox-backed version.

Agent review details

How this fits together

The Console combines revision metadata and policy-read permissions with independently authorized log and suggestion responses to render the Agent’s Policy denials tab.

flowchart TD
  A[Agent revision snapshot] --> C[Policy denials renderer]
  B[Policy read permission] --> C
  C --> D[Sandbox log API]
  C --> E[Policy suggestions API]
  D --> F[Denial controls or explanation]
  E --> F

Loading

Technical review

Best possible solution:

Update both denial and suggestion controls when absence becomes known, and cover that state in the existing Storybook workflow.

Do we have a high-confidence way to reproduce the issue?

Current-main source retains the controls after establishing no Sandbox log, and the supplied browser comparison reports the corresponding failure; no target code was executed during this read-only review.

Is this the best way to solve the issue?

Reusing the existing renderer and hidden attributes is appropriately small, but the API-error transition must also update already-rendered suggestion controls.

Full review comments:

• [P3] Rerender suggestions when the log response establishes absence — apps/controller/src/console/agents/sandbox-policy.mts:230-232
  When the snapshot answer is inconclusive, logs and suggestions proceed independently. If the suggestion request settles first, renderSuggestions creates Refresh suggestions while noSandboxLog is false. A later RUNTIME_LOGS_SOURCE_UNAVAILABLE response sets the flag and calls showNoSandboxDenials, which never rerenders suggestions. The button therefore remains visible until clicked, contrary to the advertised fallback behavior. Update the suggestion controls in the same transition and cover this response ordering.
  Confidence: 0.96
• [P3] Add the no-Sandbox state to the existing Storybook workflow — apps/controller/src/console/agents/sandbox-policy.mts:230-232
  This changes the Policy denials page without updating its matching stories, scenarios or workflow instructions. The PR explicitly confirms that no story covers this state. AGENTS.md requires those updates for Console changes, and the existing policy scenarios cannot demonstrate the new no-Sandbox result. Add an explicit no-Sandbox scenario alongside the Sandbox-backed control and update the policy walkthrough.
  Confidence: 0.99

Overall correctness: patch is correct
Overall confidence: 0.95

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 426fee0f8be0.

Provenance checked

• No-Sandbox denial rendering keeps the original intent (17e0c43: fix(console): skip the policy denials log read for a version without a sandbox #3657 skips unavailable Sandbox reads and explains why no denials exist.)
• Existing controls and suggestion rendering keeps the original intent (c8f73c8: Type sandbox policy review and confirm saved rules before applying #3195 moved the editor to typed source while preserving independently authorized reads and guarded policy application.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

Acceptance criteria:

• node --test tests/browser/console-agent-detail-2.test.mjs tests/browser/console-agent-draft-guards.test.mjs
• pnpm lint
• pnpm format:check
• pnpm check:workspace

What I checked:

• Pinned introduced change: The introduced diff changes only the existing renderer and two browser tests; production changes add 24 lines and remove 9. (apps/controller/src/console/agents/sandbox-policy.mts:222, d5abed30d081)
• Current main retains the reported clutter: Current main writes the none-recorded count and retains the denial controls when showNoSandboxDenials runs. (apps/controller/src/console/agents/sandbox-policy.mts:208, 426fee0f8be0)
• Fallback rendering order: The log error sets noSandboxLog and calls showNoSandboxDenials without rerendering suggestions; the new Refresh suggestions condition is evaluated only by renderSuggestions. (apps/controller/src/console/agents/sandbox-policy.mts:435, d5abed30d081)
• Supplied verification and discussion: The complete PR body reports browser comparisons and passing suites, explicitly states that media was not captured and no no-Sandbox Storybook story exists, and the two discussion comments contain review-status messages. (d5abed30d081)
• Applicable repository policy: The full root policy requires matching Console stories, scenarios and workflow instructions, plus uploaded screenshots and a walkthrough; no nested AGENTS.md files govern the changed paths, and no maintainer-notes directory exists. (AGENTS.md, d5abed30d081)
• Preceding fix and feature ownership: fix(console): skip the policy denials log read for a version without a sandbox #3657 introduced snapshot-based suppression of unavailable reads; feat: add per-agent sandbox network policies and denial review #2599 introduced policy-denial review, and Type sandbox policy review and confirm saved rules before applying #3195 preserved validated save/apply behavior. (apps/controller/src/console/agents/sandbox-policy.mts, 426fee0f8be0)

Likely related people:

• Free Wortley: Raw commit 838787d adds apps/controller/src/console/agents/sandbox-policy.mts:24 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 838787d33c4a; files: apps/controller/src/console/agents/sandbox-policy.mts)

Labels

Label changes:

• add P3: This removes unusable diagnostic controls and empty space without blocking Agent execution or changing enforcement.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P3: This removes unusable diagnostic controls and empty space without blocking Agent execution or changing enforcement.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 25, 2026, 3:25 PM ET / 19:25 UTC.