feat(android): read-only workspace Files browser with preview and share by steipete · Pull Request #100776 · openclaw/openclaw

steipete · 2026-07-06T09:01:45Z

Related: #100705
Builds on the gateway RPCs landed by #100738 and is now based directly on main.

What Problem This Solves

Android operators cannot see what an agent produced or changed in its workspace. Checking a generated file, log, or edited config from the phone requires shell access to the gateway host.

Why This Change Was Made

Adds a read-only Files browser backed by the new agents.workspace.list / agents.workspace.get RPCs from #100738, following the existing shell patterns: a Tab.Files detail tab (shell Back semantics preserved; directory drill-down and preview unwind screen-locally through a BackHandler before the shell's single-slot Back origin) plus a Files metric card on the Home overview. Listing pages through the gateway's offset/totalEntries contract with a "Load more" row. Text previews reuse the chat renderer's ChatCodeBlock; images reuse the chat renderer's asynchronous base64 decoder, with malformed payloads degrading to a no-preview state. The browser subtree resets from the same session/default-agent facts used by runtime routing so paths cannot cross agents. Export writes each share into a unique directory under the workspace-files/ FileProvider cache path, preventing an older URI grant from observing a later same-basename export. Gateway RPC access follows the runtime-owned pattern: suspend wrappers on NodeRuntime with kotlinx JSON parsing kept in WorkspaceFiles.kt; protocol paths are treated as opaque identifiers (never trimmed). Strictly read-only.

User Impact

Android users can browse the active agent's workspace, preview text and image files, and share/export a file through the system share sheet.

Evidence

:app:compilePlayDebugKotlin green; WorkspaceFilesTest (parser contract incl. pagination fields, text/image payloads, malformed payload rejection) and ShellScreenLogicTest (updated for the Files card) pass locally.
Exact-head Blacksmith Testbox tbx_01kww1zy68f1gdbfd1xezvv7ag: :app:compilePlayDebugKotlin plus focused WorkspaceFilesTest and ShellScreenLogicTest green (exitCode: 0, 2m50s Gradle / 3m26s wrapper).
pnpm native:i18n:sync run for the new user-visible strings.
Maintainer review fixed cross-agent browser state retention and main-thread image decode. Codex autoreview found and fixed same-basename FileProvider URI reuse; fresh re-review on the final rebased main delta is clean.
Added an apps/android/CHANGELOG.md Unreleased entry and regenerated both the native i18n inventory and docs map after the rebase.

chatgpt-codex-connector · 2026-07-06T09:13:16Z

💡 Codex Review

openclaw/src/gateway/server-methods/workspace-fs.ts

Lines 87 to 88 in bc4d61a

    
           .replaceAll("\\", "/") 
        
           .split("/")

Preserve backslashes in echoed workspace paths

On POSIX workspaces, \ is a legal filename character, and agents.workspace.list emits dirent.name verbatim in each entry path. When the Android browser echoes that path back to agents.workspace.get, this normalizer rewrites every backslash into a path separator, so an entry such as report\draft.txt is fetched as report/draft.txt and will either fail to open or resolve to a different file. Preserve protocol paths as returned by the listing, or escape true separators separately, so listed files remain openable.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

clawsweeper · 2026-07-06T09:50:32Z

Codex review: needs real behavior proof before merge. Reviewed July 6, 2026, 5:55 AM ET / 09:55 UTC.

Summary
The PR adds an Android read-only workspace Files tab and overview card, runtime wrappers for agents.workspace.list/get, text/image preview and share UI, a FileProvider cache path, tests, docs, and native i18n inventory updates.

PR surface: Docs +4, Other +686. Total +690 across 10 files.

Reproducibility: not applicable. as a bug reproduction: this is a feature PR adding a mobile workspace Files browser. The review is source- and CI-based against the PR head and the stacked Gateway API branch.

Review metrics: 2 noteworthy metrics.

Generated checks failing: 2 failing. native-i18n and check-docs both report generated artifact drift that must be refreshed before merge.
Open prerequisite PR: 1 open prerequisite. This Android PR is stacked on feat(gateway): read-only agents.workspace list/get browsing RPCs #100738, which owns the security-sensitive workspace file-read RPCs.

Stored data model
Persistent data-model change detected: persistent cache schema: apps/android/app/src/main/res/xml/file_paths.xml. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #100705
Summary: This PR is the Android implementation candidate for the broader mobile read-only workspace file browser request, with the Gateway RPC PR as a prerequisite and the iOS PR as the sibling client surface.

Members:

canonical: [Feature]: Mobile apps: read-only workspace file browser (browse, preview, share) #100705 - The PR body links the feature request and implements the Android portion of the requested mobile workspace browser.
same_root_cause: feat(gateway): read-only agents.workspace list/get browsing RPCs #100738 - This PR is stacked on the Gateway RPC PR that supplies the read-only workspace list/get API used by Android.
same_root_cause: feat(ios): read-only workspace Files browser on the Agents surface #100767 - The iOS PR implements the sibling mobile Files browser on the same stacked Gateway API.
partial_overlap: [Feature]: Full Workspace File Management API for Remote/Container Deployments #61368 - The linked broader workspace-management issue covers full CRUD/API direction, while this PR intentionally implements only the Android read-only slice.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🌊 off-meta tidepool
Patch quality: 🦐 gold shrimp
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Run the native i18n sync and docs map generator, then commit the refreshed artifacts.
Resolve the workspace file-read authorization decision in feat(gateway): read-only agents.workspace list/get browsing RPCs #100738 before merging this client UI.

Risk before merge

[P1] Merging the Android surface before feat(gateway): read-only agents.workspace list/get browsing RPCs #100738 settles the workspace file-read authorization model could expose preview/share affordances for sensitive agent workspace contents through mobile clients.
[P1] The PR currently leaves generated source artifacts stale: native i18n and docs map checks both fail on the merge commit.

Maintainer options:

Land Only After Gateway Scope Approval (recommended)
Resolve the file-read authorization decision in the stacked Gateway PR, then refresh this Android branch and merge it with matching docs/tests.
Accept Existing Scope Deliberately
Maintainers can accept the security boundary as proposed, but should make that approval explicit before this mobile preview/share surface lands.
Pause The Android Stack
If the workspace-read API direction is not ready, keep this PR paused rather than landing a client UI for an unsettled Gateway contract.

Next step before merge

[P1] Manual review is needed because the branch is protected, stacked on an unresolved security-sensitive Gateway PR, and has generated-artifact blockers that should be fixed before maintainer approval.

Maintainer decision needed

Question: Should the Android Files browser be accepted once feat(gateway): read-only agents.workspace list/get browsing RPCs #100738 lands, or must it wait for a higher-scope or dedicated workspace file-read authorization model?
Rationale: The Android implementation is tied to a new arbitrary workspace read/preview surface, so the safe merge order depends on maintainer security intent for the underlying Gateway RPC.
Likely owner: steipete — They own this protected PR and the linked feature request and have recent Android/docs history in this area.
Options:
- Approve After Gateway Boundary Is Fixed (recommended): Refresh the generated artifacts here, land the Gateway RPC only with the approved authorization boundary, then retarget and merge the Android surface.
- Accept Read-Scope Mobile Browsing: Proceed only if security owners explicitly accept that existing read-scoped operator clients may browse and share previewable workspace files.
- Pause Android Surface: Keep this PR open but paused until the broader workspace file API direction is settled.

Security
Needs attention: The Android diff is security-sensitive because it exposes preview/share UI for files returned by the unresolved workspace file-read Gateway API.

Review findings

[P2] Regenerate the native string inventory — apps/android/app/src/main/java/ai/openclaw/app/ui/WorkspaceFilesScreen.kt:127
[P2] Regenerate the docs map for the new Android heading — docs/platforms/android.md:292

Review details

Best possible solution:

Land the Android Files browser only after the generated artifacts are refreshed and the stacked Gateway PR's file-read security boundary is approved or adjusted.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a bug reproduction: this is a feature PR adding a mobile workspace Files browser. The review is source- and CI-based against the PR head and the stacked Gateway API branch.

Is this the best way to solve the issue?

No, not merge-ready yet. The Android implementation shape is plausible, but generated artifacts must be refreshed and the workspace file-read security boundary in the prerequisite Gateway PR needs maintainer approval first.

Full review comments:

[P2] Regenerate the native string inventory — apps/android/app/src/main/java/ai/openclaw/app/ui/WorkspaceFilesScreen.kt:127
This new screen adds user-visible Android copy, but the native-i18n check fails with inventory drift and asks for pnpm native:i18n:sync. Please refresh and commit apps/.i18n/native-source.json so the native source inventory matches the new Files UI strings.
Confidence: 0.93
[P2] Regenerate the docs map for the new Android heading — docs/platforms/android.md:292
Adding this Workspace files heading changes the generated docs map, and check-docs fails with docs/docs_map.md is out of date. Please run the docs map generator and commit the regenerated map with this docs change.
Confidence: 0.95

Overall correctness: patch is incorrect
Overall confidence: 0.9

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 24bca38cdaad.

Label changes

Label changes:

add P2: This is a normal-priority Android feature PR with clear operator value and merge blockers, but it is not a shipped outage or setup blocker.
add merge-risk: 🚨 security-boundary: The PR adds mobile preview/share UI for workspace file contents and depends on an unresolved Gateway file-read authorization boundary.
add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: The contributor proof gate is not applied because this is protected by the maintainer label; Android CI build/tests passed, but no live device preview/share proof was reviewed.

Label justifications:

P2: This is a normal-priority Android feature PR with clear operator value and merge blockers, but it is not a shipped outage or setup blocker.
merge-risk: 🚨 security-boundary: The PR adds mobile preview/share UI for workspace file contents and depends on an unresolved Gateway file-read authorization boundary.
rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: The contributor proof gate is not applied because this is protected by the maintainer label; Android CI build/tests passed, but no live device preview/share proof was reviewed.

Evidence reviewed

PR surface:

Docs +4, Other +686. Total +690 across 10 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	0	0	0	0
Tests	0	0	0	0
Docs	1	4	0	+4
Config	0	0	0	0
Generated	0	0	0	0
Other	9	740	54	+686
Total	10	744	54	+690

Security concerns:

[medium] Resolve workspace file-read scope before Android merge — apps/android/app/src/main/java/ai/openclaw/app/NodeRuntime.kt:2799
The Android runtime calls agents.workspace.get and the UI can share returned file contents, so this PR should not land until the stacked Gateway PR's authorization and confinement model is approved.
Confidence: 0.88

What I checked:

Android Files UI added: PR head adds WorkspaceFilesScreen with directory listing, preview, load-more, and share behavior that calls the new ViewModel/runtime workspace methods. (apps/android/app/src/main/java/ai/openclaw/app/ui/WorkspaceFilesScreen.kt:72, 73b999c6db34)
Runtime calls stacked Gateway RPCs: PR head adds Android runtime methods that call agents.workspace.list and agents.workspace.get for the active agent. (apps/android/app/src/main/java/ai/openclaw/app/NodeRuntime.kt:2776, 73b999c6db34)
Gateway prerequisite is open and security-sensitive: The stacked Gateway PR adds the underlying workspace list/get handlers and descriptors, with agents.workspace.get returning workspace file content from the agent workspace. (src/gateway/server-methods/agents-workspace.ts:168, 9029e911ef42)
Native i18n check fails: CI reports native app i18n inventory drift detected and asks to run pnpm native:i18n:sync and commit apps/.i18n/native-source.json. (apps/android/app/src/main/java/ai/openclaw/app/ui/WorkspaceFilesScreen.kt:127, 73b999c6db34)
Docs map check fails: CI reports docs/docs_map.md is out of date after the new Android docs heading was added. Public docs: docs/platforms/android.md. (docs/platforms/android.md:292, 73b999c6db34)
Android focused CI passed: The PR's Android test and build checks completed successfully, including android-test-play and android-build-play. (73b999c6db34)

Likely related people:

steipete: They opened the protected PR and linked feature issue, and recent current-main history shows Android shell/docs work in the same mobile operator area. (role: feature requester and recent Android/docs contributor; confidence: high; commits: 851156af3b35, fcd7eb6130ed, 91f188301d9c; files: apps/android/app/src/main/java/ai/openclaw/app/ui/ShellScreen.kt, docs/platforms/android.md)
vincentkoc: Recent current-main history touches NodeRuntime.kt, including refactor and native i18n inventory work adjacent to this PR's runtime wrapper additions. (role: recent Android runtime contributor; confidence: medium; commits: c9abc7588493, 2fa44455298a; files: apps/android/app/src/main/java/ai/openclaw/app/NodeRuntime.kt)
IWhatsskill: Recent current-main history includes Android home overview layout and native i18n inventory changes adjacent to the Files overview card addition. (role: adjacent Android shell contributor; confidence: medium; commits: b550c829b264, 978b425f9859; files: apps/android/app/src/main/java/ai/openclaw/app/ui/ShellScreen.kt, apps/.i18n/native-source.json)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

… share

…nstead of crashing

steipete · 2026-07-06T16:14:23Z

Land-ready review complete on the final Android head.

Retargeted to main after feat(gateway): read-only agents.workspace list/get browsing RPCs #100738 landed; final diff is Android-only.
Browser state now resets from the active-agent routing facts, large image decode reuses the chat renderer's off-main-thread path, and every FileProvider share uses a unique cache directory so older grants cannot observe later same-basename exports.
Exact-head Blacksmith Testbox tbx_01kww1zy68f1gdbfd1xezvv7ag: :app:compilePlayDebugKotlin, WorkspaceFilesTest, and ShellScreenLogicTest green (exitCode: 0).
Native i18n inventory and docs map checks are clean; apps/android/CHANGELOG.md and platform docs are updated.
Final Codex autoreview: clean. Exact-head hosted workflow: https://github.com/openclaw/openclaw/actions/runs/28805104592

steipete · 2026-07-06T16:16:06Z

Merged via squash.

Prepared head SHA: 7441f8896c2b530a6aa0eef461b74b40641337ea
Landed commit: 61a29a78364a73d7fd948bcdb3e80a70d3b9247c

…re (openclaw#100776) * feat(android): add read-only workspace Files browser with preview and share * fix(android): degrade malformed base64 image payloads to no-preview instead of crashing * fix(android): keep workspace paths verbatim from the gateway * test(android): cover the overview Files card in shell logic tests * fix(android): reset workspace browser across agents * fix(android): isolate workspace share exports * docs(android): note workspace file browser * chore(i18n): refresh Android Files inventory * docs(android): refresh workspace files map

openclaw-barnacle Bot added docs Improvements or additions to documentation app: android App: android size: L maintainer Maintainer-authored PR labels Jul 6, 2026

steipete force-pushed the feat/gateway-workspace-browse-rpcs branch from 9029e91 to fa54358 Compare July 6, 2026 09:05

steipete force-pushed the feat/android-workspace-file-browser branch from bc4d61a to 73b999c Compare July 6, 2026 09:05

This was referenced Jul 6, 2026

feat(gateway): read-only agents.workspace list/get browsing RPCs #100738

Merged

feat(ios): read-only workspace Files browser on the Agents surface #100767

Merged

github-actions Bot mentioned this pull request Jul 6, 2026

🦞 OpenClaw 生态日报 2026-07-06 loxehate/loxehate.github.io#6

Closed

clawsweeper Bot mentioned this pull request Jul 6, 2026

Add read-only workspace file browser to Android app #100813

Closed

steipete self-assigned this Jul 6, 2026

steipete force-pushed the feat/gateway-workspace-browse-rpcs branch 2 times, most recently from 1a4711b to ab567c9 Compare July 6, 2026 15:26

Base automatically changed from feat/gateway-workspace-browse-rpcs to main July 6, 2026 15:41

openclaw-barnacle Bot added app: web-ui App: web-ui gateway Gateway runtime size: XL and removed size: L labels Jul 6, 2026

steipete force-pushed the feat/android-workspace-file-browser branch from 73b999c to 482d03e Compare July 6, 2026 15:46

openclaw-barnacle Bot added size: L and removed app: web-ui App: web-ui gateway Gateway runtime size: XL labels Jul 6, 2026

feat(android): add read-only workspace Files browser with preview and…

4188f99

… share

steipete added 8 commits July 6, 2026 12:00

fix(android): degrade malformed base64 image payloads to no-preview i…

7f0249a

…nstead of crashing

fix(android): keep workspace paths verbatim from the gateway

1d34d6e

test(android): cover the overview Files card in shell logic tests

bdd1d6b

fix(android): reset workspace browser across agents

b034b98

fix(android): isolate workspace share exports

f09a9c8

docs(android): note workspace file browser

2400d08

chore(i18n): refresh Android Files inventory

a13abbd

docs(android): refresh workspace files map

7441f88

steipete force-pushed the feat/android-workspace-file-browser branch from 482d03e to 7441f88 Compare July 6, 2026 16:00

steipete merged commit 61a29a7 into main Jul 6, 2026
80 checks passed

steipete deleted the feat/android-workspace-file-browser branch July 6, 2026 16:14

github-actions Bot mentioned this pull request Jul 6, 2026

📡 Upstream Digest — 2026-07-06 16:47 UTC curtismercier/openclaw-mods#1223

Open

steipete mentioned this pull request Jul 6, 2026

[Feature]: Mobile apps: read-only workspace file browser (browse, preview, share) #100705

Closed

clawsweeper Bot mentioned this pull request Jul 6, 2026

fix(acp): exec approvals target the matching concurrent prompt #101037

Merged

This was referenced Jul 11, 2026

[AI-assisted] Fix Android workspace filename wrapping #104075

Merged

Android: polish workspace file navigation #104873

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat(android): read-only workspace Files browser with preview and share#100776

feat(android): read-only workspace Files browser with preview and share#100776
steipete merged 9 commits into
mainfrom
feat/android-workspace-file-browser

steipete commented Jul 6, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Jul 6, 2026

Uh oh!

clawsweeper Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

steipete commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

chatgpt-codex-connector Bot commented Jul 6, 2026

💡 Codex Review

Uh oh!

clawsweeper Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

steipete commented Jul 6, 2026 •

edited

Loading

clawsweeper Bot commented Jul 6, 2026 •

edited

Loading