feat(ios): read-only workspace Files browser on the Agents surface by steipete · Pull Request #100767 · openclaw/openclaw

steipete · 2026-07-06T08:46:34Z

Related: #100705
Builds on the gateway RPCs landed by #100738 and is now based directly on main.

What Problem This Solves

iOS operators cannot see what an agent produced or changed in its workspace. Checking a generated file, log, or edited config from the phone requires shell access to the gateway host.

Why This Change Was Made

Adds a read-only Files section to the Agents surface, backed by the new agents.workspace.list / agents.workspace.get RPCs from #100738. It follows the existing section patterns: a new AgentRoute.files destination with an operations tile on the Agents overview, a files sidebar destination on iPad, and a Control-hub entry on iPhone. Directory drill-down uses destination links compatible with the existing typed owner stacks plus offset pagination ("Load More" against the gateway's totalEntries). Text previews reuse the chat renderer's syntax highlighting (ChatCodeHighlightCache, now public in OpenClawChatUI); images decode from the base64 payload. Export mirrors the transcript-export flow with a validated basename, unique temp URL, and UIActivityViewController share sheet. Reloads clear prior preview bytes before fetching a new agent/path. All text uses branded OpenClawType typography. The browser is strictly read-only.

User Impact

iPhone and iPad users can browse the selected agent's workspace, preview text and image files, and share/export a file — without leaving the app.

Evidence

Simulator build green including the strict SwiftFormat/SwiftLint build phases (pnpm ios:build, Debug, iPhone 17 sim).
RootTabsPresentationTests updated for the new sidebar destination. Local simulator test execution is currently blocked on this machine by an xcodebuild power-assertion failure (Failed to prevent system sleep during UI testing, IOPM error −536870211, reproduced on an unmodified checkout path); relying on CI for the test lane.
pnpm native:i18n:sync run for the new user-visible strings.
Maintainer review fixed typed-stack navigation across the overview, iPhone Control hub, and iPad sidebar; stale preview retention on failed agent/path reloads; share-export isolation; and explicit request-parameter encoding before dispatch. Fresh Codex autoreview on the final rebased main delta is clean.
Added an apps/ios/CHANGELOG.md Unreleased entry.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3c9835192a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

clawsweeper · 2026-07-06T09:41:32Z

Codex review: needs real behavior proof before merge. Reviewed July 6, 2026, 12:24 PM ET / 16:24 UTC.

Summary
This PR adds an iOS read-only Files section under Agents that uses agents.workspace.list and agents.workspace.get to browse directories, preview text/images, and export files, with navigation entries, i18n/docs updates, and chat highlighter reuse.

PR surface: Docs +2, Other +510. Total +512 across 12 files.

Reproducibility: yes. from source inspection: opening the Files screen while disconnected makes GatewayNodeSession.request throw, and the directory list task key does not observe gateway connection or scene state to retry. I did not run a simulator reproduction in this read-only review.

Review metrics: 1 noteworthy metric.

Workspace RPCs consumed: 2 methods used. The iOS browser consumes agents.workspace.list and agents.workspace.get, so maintainers should review it against the approved workspace file-read boundary.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #100705
Summary: This PR is the iOS client candidate for the canonical mobile read-only workspace browser issue; the merged gateway and Android PRs are sibling implementation pieces, while broader workspace-management items only partially overlap.

Members:

canonical: [Feature]: Mobile apps: read-only workspace file browser (browse, preview, share) #100705 - The PR body links the mobile read-only workspace browser issue and implements its iOS slice.
fixed_by_candidate: feat(gateway): read-only agents.workspace list/get browsing RPCs #100738 - The merged gateway PR provides the read-only agents.workspace.list/get RPCs required by this iOS client.
fixed_by_candidate: feat(android): read-only workspace Files browser with preview and share #100776 - The merged Android PR is the parallel mobile client implementation for the same canonical feature.
partial_overlap: Add read-only workspace file browser to Android app #100813 - The open third-party PR overlaps the mobile workspace browser feature but also touches broader surfaces and is not the viable replacement for this iOS-focused branch.
partial_overlap: [Feature]: Full Workspace File Management API for Remote/Container Deployments #61368 - The issue requests full workspace file management, including writes, while this PR intentionally implements a read-only mobile slice.
1 more in the report.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🌊 off-meta tidepool
Patch quality: 🧂 unranked krab
Result: blocked by patch quality or review findings.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P2] Fix the Files screen refresh key or connectivity observer so offline-first loads retry after gateway reconnect.
Rerun or wait for the failing check-test-types job to produce a clean exact-head result.
[P2] Capture simulator or device proof of browse, text/image preview, and share after the fix.

Risk before merge

[P1] Merging intentionally gives the iOS app preview/share access to any workspace text or image returned by the merged operator.read RPCs; maintainers should be comfortable with that mobile security boundary before landing.

Maintainer options:

Fix Reconnect Reload, Then Merge On Approved Read Scope (recommended)
Patch the Files screen to reload after gateway reconnects and merge only with proof that the iOS UI stays read-only on the already-merged workspace RPC contract.
Accept Current Mobile Read/Share Surface
Maintainers may choose to accept the existing build evidence and the intentional mobile exposure of workspace previews/shares without additional scope changes.
Pause The iOS Client
If the mobile share surface needs more security review, leave this PR open until the workspace-read policy is narrowed or reconfirmed.

Next step before merge

[P1] A narrow SwiftUI refresh-key repair is clear enough for an automated fix attempt while leaving the gateway RPC/security scope unchanged.

Security
Cleared: No supply-chain change or concrete client-side security defect was found; the sensitive mobile workspace preview/share surface remains an intentional merge risk for maintainer acceptance.

Review findings

[P2] Reload the Files view after gateway reconnects — apps/ios/Sources/Design/AgentWorkspaceFilesScreen.swift:87-89

Review details

Best possible solution:

Keep the read-only iOS client on the merged gateway RPCs, add connectivity/scene-aware reload behavior, then verify browse, preview, and share on simulator or device before merge.

Do we have a high-confidence way to reproduce the issue?

Yes, from source inspection: opening the Files screen while disconnected makes GatewayNodeSession.request throw, and the directory list task key does not observe gateway connection or scene state to retry. I did not run a simulator reproduction in this read-only review.

Is this the best way to solve the issue?

No, not yet. The overall feature is the right iOS client layer for the merged read-only RPCs, but the implementation needs the same connectivity-aware refresh behavior used by sibling operator screens before it is the best merge path.

Full review comments:

[P2] Reload the Files view after gateway reconnects — apps/ios/Sources/Design/AgentWorkspaceFilesScreen.swift:87-89
The directory list only starts from .task(id: "\(agentId)|\(path)"); if the user opens Files while the gateway is offline or connecting, request throws, errorText is set, and a later isOperatorGatewayConnected change does not rerun the task. Include connection/scene state in the refresh key or observe connectivity like the sibling operator screens. Late note: this same task key was visible on the earlier reviewed head, but this cycle is where I caught the reconnect path.
Confidence: 0.9
Late finding: first raised on code an earlier review cycle already covered.

Overall correctness: patch is incorrect
Overall confidence: 0.88

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 7853aa35a46c.

Label changes

Label justifications:

P2: This is a normal-priority iOS feature PR with one concrete new-flow blocker and no evidence of a shipped outage.
merge-risk: 🚨 security-boundary: The PR exposes mobile preview and share flows for agent workspace file contents returned by operator.read RPCs.
rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: The external contributor proof gate is not applied because this PR carries the protected maintainer label; simulator/device proof would still be useful after the reconnect fix.

Evidence reviewed

PR surface:

Docs +2, Other +510. Total +512 across 12 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	0	0	0	0
Tests	0	0	0	0
Docs	2	2	0	+2
Config	0	0	0	0
Generated	0	0	0	0
Other	10	576	66	+510
Total	12	578	66	+512

Acceptance criteria:

[P1] pnpm native:i18n:check.
[P1] pnpm ios:build.
[P1] Run or obtain simulator/device proof for opening Files while offline/connecting, reconnecting, then successfully browsing, previewing, and sharing.

What I checked:

PR head Files reload key omits connectivity: AgentWorkspaceDirectoryList runs .task(id:) only on agentId|path, so a failed initial request does not automatically rerun when gateway connection state changes. (apps/ios/Sources/Design/AgentWorkspaceFilesScreen.swift:87, bffd01f61abe)
Earlier reviewed head had the same reload gap: The same agentId|path task key existed on the earlier reviewed head, so the reconnect finding is a late discovery against already-visible code. (apps/ios/Sources/Design/AgentWorkspaceFilesScreen.swift:111, a4c5af1fe460)
Sibling iOS operator screens include connection and scene in refresh keys: Current main's Workboard screen keys refreshes on connected/offline, active/inactive scene state, and selected scope, which is the pattern the Files screen should follow. (apps/ios/Sources/Design/IPadWorkboardScreen.swift:559, 7853aa35a46c)
Disconnected requests fail synchronously: GatewayNodeSession.request throws not connected when there is no channel, matching the Files screen's permanent error path after an offline first load. (apps/shared/OpenClawKit/Sources/OpenClawKit/GatewayNodeSession.swift:392, 7853aa35a46c)
Gateway workspace RPC prerequisite is merged: The server-side read-only agents.workspace.list/get PR is merged, so this branch is no longer blocked by an open gateway prerequisite. (30e5dfcf0295)
Workspace RPC security contract is read-only operator scope: Current main documents agents.workspace.list/get as operator.read, workspace-relative, confined, size-capped, text/image-only, and without write operations. Public docs: docs/gateway/protocol.md. (docs/gateway/protocol.md:430, 7853aa35a46c)

Likely related people:

steipete: They authored the merged gateway workspace RPC commit and Android sibling that this iOS client builds on, and this PR is part of the same feature cluster. (role: feature owner and recent workspace-RPC contributor; confidence: high; commits: 30e5dfcf0295, 61a29a78364a, 7853aa35a46c; files: src/gateway/server-methods/agents-workspace.ts, src/gateway/methods/core-descriptors.ts, apps/shared/OpenClawKit/Sources/OpenClawProtocol/GatewayModels.swift)
Vincent Koc: Current-main blame/log history shows the iOS navigation shell and GatewayNodeSession.request paths used by this feature were recently introduced or carried forward in their commit. (role: recent iOS shell and Swift gateway-session contributor; confidence: medium; commits: 1f49d94bb296; files: apps/ios/Sources/Design/AgentProTab.swift, apps/ios/Sources/RootTabs.swift, apps/shared/OpenClawKit/Sources/OpenClawKit/GatewayNodeSession.swift)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (1 earlier review cycle)

reviewed 2026-07-06T09:47:41.653Z sha a4c5af1 :: needs real behavior proof before merge. :: [P2] Use a stack path that can store file routes | [P2] Regenerate the native i18n inventory

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 70c4d17b10

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-06T16:06:45Z

+        .task(id: "\(self.agentId)|\(self.path)") {
+            await self.reload()
+        }


Retry file loads when the gateway connects

When the Files screen is opened while the operator gateway is still offline or connecting, this task runs once, records Could not load this folder., and then never reruns when appModel.isOperatorGatewayConnected flips to true because the task id only includes agentId|path and the view body does not observe gateway connectivity. This leaves the new Files tab stuck on the offline error after startup/reconnect until the user manually pulls to refresh; include connection/scene phase in the refresh key like the sibling operator surfaces or observe connectivity and reload.

Useful? React with 👍 / 👎.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bffd01f61a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-06T16:22:01Z

+        if let result = await self.fetchPage(offset: 0) {
+            self.entries = result.entries
+            self.totalEntries = result.totalentries
+        }


Clear stale directory entries on reload failure

When a directory has already loaded and a later full reload fails (for example after disconnecting, reconnecting to a gateway where the agent/path is rejected, or pulling to refresh while offline), the directory state is only overwritten in this success branch, so the error banner is shown above the previous agent/path's entries and those stale rows remain tappable. Clear entries/totalEntries in the reload failure path so a failed live read cannot present old workspace contents as current.

Useful? React with 👍 / 👎.

steipete · 2026-07-06T16:47:38Z

Land-ready review complete on the final iOS head.

Retargeted to main after feat(gateway): read-only agents.workspace list/get browsing RPCs #100738 landed; final diff is iOS-only.
Replaced incompatible value-based navigation with destination links across Agents overview, iPhone Control hub, and iPad sidebar; pushed routes retain Back/share chrome.
Cleared prior preview bytes before agent/path reloads, validated and isolated every share export, and made throwing request encoding explicit before RPC dispatch.
SwiftFormat lint and native i18n inventory check are clean; apps/ios/CHANGELOG.md and platform docs are updated.
Final Codex autoreview: clean. Exact-head hosted workflow after the Android and baseline type-fix landings: https://github.com/openclaw/openclaw/actions/runs/28807133004

Known gap: local simulator tests remain blocked by the documented machine-wide xcodebuild power-assertion failure. The full simulator build was previously green; the exact-head hosted iOS lane is the final native proof.

steipete · 2026-07-06T17:03:47Z

Merged via squash.

Prepared head SHA: e56c2c9c0e8271fab69447d4ee6ed8a51e3571e2
Landed commit: 077e35f3b2a54583ea02282277dfaffb19c0bd8b

…penclaw#100767) * feat(ios): add read-only workspace Files browser to the Agents surface * fix(ios): keep nav bar visible on pushed workspace file routes * fix(ios): make workspace file navigation stack-safe * docs(ios): note workspace file browser * fix(ios): isolate workspace share exports * chore(i18n): refresh iOS Files inventory * refactor(ios): encode workspace requests before dispatch * chore(i18n): refresh iOS inventory after rebase

openclaw-barnacle Bot added docs Improvements or additions to documentation app: ios App: ios size: L maintainer Maintainer-authored PR labels Jul 6, 2026

steipete force-pushed the feat/gateway-workspace-browse-rpcs branch from 9029e91 to fa54358 Compare July 6, 2026 09:04

steipete force-pushed the feat/ios-workspace-file-browser branch from 3c98351 to a4c5af1 Compare July 6, 2026 09:05

chatgpt-codex-connector Bot reviewed Jul 6, 2026

View reviewed changes

Comment thread apps/ios/Sources/Design/AgentWorkspaceFilesScreen.swift Outdated

clawsweeper Bot mentioned this pull request Jul 6, 2026

feat(gateway): read-only agents.workspace list/get browsing RPCs #100738

Merged

This was referenced Jul 6, 2026

feat(android): read-only workspace Files browser with preview and share #100776

Merged

Add read-only workspace file browser to Android app #100813

Closed

steipete self-assigned this Jul 6, 2026

steipete force-pushed the feat/gateway-workspace-browse-rpcs branch 2 times, most recently from 1a4711b to ab567c9 Compare July 6, 2026 15:26

Base automatically changed from feat/gateway-workspace-browse-rpcs to main July 6, 2026 15:41

openclaw-barnacle Bot added app: web-ui App: web-ui gateway Gateway runtime size: XL and removed size: L labels Jul 6, 2026

steipete force-pushed the feat/ios-workspace-file-browser branch from a4c5af1 to 1e66c3f Compare July 6, 2026 15:44

openclaw-barnacle Bot added size: L and removed app: web-ui App: web-ui gateway Gateway runtime size: XL labels Jul 6, 2026

steipete force-pushed the feat/ios-workspace-file-browser branch 2 times, most recently from 05bd471 to 323e9ad Compare July 6, 2026 15:56

steipete force-pushed the feat/ios-workspace-file-browser branch from 323e9ad to 70c4d17 Compare July 6, 2026 16:02

chatgpt-codex-connector Bot reviewed Jul 6, 2026

View reviewed changes

steipete force-pushed the feat/ios-workspace-file-browser branch from 70c4d17 to bffd01f Compare July 6, 2026 16:15

chatgpt-codex-connector Bot reviewed Jul 6, 2026

View reviewed changes

steipete added 8 commits July 6, 2026 12:32

feat(ios): add read-only workspace Files browser to the Agents surface

aaa25c9

fix(ios): keep nav bar visible on pushed workspace file routes

2739ffd

fix(ios): make workspace file navigation stack-safe

bdf9492

docs(ios): note workspace file browser

1fad04b

fix(ios): isolate workspace share exports

6dfffe5

chore(i18n): refresh iOS Files inventory

fa72ee1

refactor(ios): encode workspace requests before dispatch

bbd61f7

chore(i18n): refresh iOS inventory after rebase

e56c2c9

steipete force-pushed the feat/ios-workspace-file-browser branch from bffd01f to e56c2c9 Compare July 6, 2026 16:32

steipete merged commit 077e35f into main Jul 6, 2026
75 checks passed

steipete deleted the feat/ios-workspace-file-browser branch July 6, 2026 16:47

steipete mentioned this pull request Jul 6, 2026

[Feature]: Mobile apps: read-only workspace file browser (browse, preview, share) #100705

Closed

clawsweeper Bot mentioned this pull request Jul 6, 2026

improve(android): align command palette row affordances #101072

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat(ios): read-only workspace Files browser on the Agents surface#100767

feat(ios): read-only workspace Files browser on the Agents surface#100767
steipete merged 8 commits into
mainfrom
feat/ios-workspace-file-browser

steipete commented Jul 6, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

clawsweeper Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 6, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 6, 2026

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

steipete commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

clawsweeper Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

steipete commented Jul 6, 2026 •

edited

Loading

clawsweeper Bot commented Jul 6, 2026 •

edited

Loading