Summary

• add an in-app, read-only artifact viewer for code, text, Markdown, PDF, DOCX, and uploaded HTML files
• replace document download-only cards with an accessible open action while preserving downloads and existing image/audio/video behavior
• add desktop side-pane and mobile full-screen presentation with focus restoration, Escape handling, loading states, and pane-local fallbacks
• classify using stored upload MIME metadata plus the original filename because unsafe upload types are served as application/octet-stream
• add the viewer dependencies, embedded production assets, documentation, and browser coverage

Viewer behavior

• code and text render as inert escaped source; known languages up to 256 KiB are highlighted in a terminable worker, while larger files use escaped plain-text fallback
• Markdown supports sanitized preview and source modes through the existing marked and DOMPurify pipeline
• PDF supports one-page-at-a-time navigation, page counts, and zoom using the existing pdfjs-dist integration
• DOCX converts semantically in-browser with Mammoth and sanitizes the resulting HTML
• uploaded HTML is sanitized, placed in an empty-sandbox iframe.srcdoc, and constrained by a CSP that permits only inline styles and local data:/blob: assets
• unsupported files show metadata and a download fallback without execution

Safety contract

• text, code, Markdown, and HTML previews are limited to 2 MiB
• syntax highlighting is isolated from the UI thread in a terminable worker with a 2-second timeout and 2 MiB output cap; files above 256 KiB remain escaped source without syntax parsing
• PDF thumbnail and viewer canvases are checked before allocation: each DPR-scaled backing dimension is capped at 8,192 pixels and the backing store at 16 megapixels, with download fallback for pages outside the policy
• DOCX conversion is limited to 16 MiB; PDF preview uses the existing 64 MiB upload ceiling
• previews use same-origin authenticated fetches, abort on close/switch, and release worker/PDF resources
• HTML scripts, forms, frames, external links/resources, and network-bearing CSS references are removed before rendering; server download headers and CSP are unchanged
• v1 is read-only and does not add artifact storage, editing, collaboration, or CRDT state
• no database, OpenAPI, SDK, or public transport contract changes

Verification

• pnpm check
• pnpm coverage — 86.5% total Go coverage
• pnpm exec playwright test tests/e2e/artifact-viewer.spec.ts — 6 passed, covering classification, worker highlighting, near-limit escaped fallback and cancellation, Markdown source/preview, normal PDF page/zoom, PDF canvas dimension and pixel budgets, oversized-page download fallback, bounded DOCX conversion, hostile-HTML isolation, oversized/malformed fallbacks, mobile sizing, and message.updated
• CAPTURE_ARTIFACT_PROOF=1 pnpm exec playwright test tests/e2e/artifact-viewer.spec.ts -g "opens safe code" — 1 passed and produced live HTML-isolation diagnostics
• CAPTURE_PDF_LIMIT_PROOF=1 pnpm exec playwright test tests/e2e/artifact-viewer.spec.ts -g "shows local fallbacks" — 1 passed and produced live oversized-PDF allocation diagnostics
• production web/SDK build and embedded asset refresh completed through the E2E web server
• browser visual inspection completed for the desktop side pane, mobile full-screen layout, HTML isolation, and PDF canvas-limit fallback

Real behavior proof

These captures come from the local OpenClaw → ClickClack delivery path and the running viewer.

Oversized PDF canvas allocation

The crafted fixture is a small valid PDF with a 20,000 × 20,000-point page. Browser-observed diagnostics show the configured 8,192-pixel dimension ceiling and 16-megapixel budget, zero viewer canvases allocated, and the authenticated download fallback visibly available.

Uploaded HTML isolation

The hostile fixture attempts script execution, form submission, nested framing, external navigation, image loading, stylesheet import, and CSS URL loading. Browser-observed diagnostics show an empty sandbox token list, an absent script marker, zero requests to the sentinel host, no scripts/forms/frames in the preview DOM, and stripped external URL references.

Reproduction details: docs/artifact-viewer-security-proof.md

Behavior while testing PR

Current behavior before merging PR

Out of scope

• OpenClaw sendMedia delivery remains a separate companion PR
• collaborative Markdown, mutable uploads, revisioned artifacts, and Jot/CRDT storage remain follow-up work

Follow-up review fixes

• Capture pdfScale before the asynchronous PDF page load so zoom changes restart rendering immediately.
• Remember when an artifact was opened from a thread and navigate back to the parent conversation when the artifact closes, keeping the URL consistent with the visible view.

Validation after these fixes: pnpm typecheck, pnpm lint, and pnpm fmt:ts:check all pass.