fix(ui): scope sidebar session active state to chat by vyctorbrzezowski · Pull Request #100918 · openclaw/openclaw

vyctorbrzezowski · 2026-07-06T13:56:22Z

What Problem This Solves

The proposed Control UI sidebar behavior should not make a recent session row look selected while the operator is on Overview, Settings, or another non-chat route. A stored active session can still be useful for returning to Chat, but selected row styling outside Chat makes the non-chat page look like it is scoped to that session.

Why This Change Was Made

This change separates the stored/current session from the visual active state in the sidebar. AppSidebar still preserves the current session key for Chat navigation and session actions, but it only applies sidebar-recent-session--active when the active route is Chat.

The Overview recent-session card also now renders display names directly after resolveSessionDisplayName. That keeps the existing provider-key display-name sanitization, while removing the extra digit blur from ordinary titles such as build numbers or dates.

Related existing PR: #97257 disables the session selection control on non-chat pages. This PR is narrower and only scopes the sidebar row active styling.

User Impact

On non-chat routes, recent sessions remain visible and clickable, but none of them appear selected. Returning to Chat still restores/highlights the stored session, including direct /chat and /chat?session=... navigation.

Overview recent sessions show non-sensitive numeric suffixes normally instead of blurring them.

Evidence

git diff --check
node scripts/run-vitest.mjs ui/src/pages/overview/view.render.test.ts
node scripts/run-vitest.mjs ui/src/e2e/session-management.e2e.test.ts

Notes:

Browser smoke covered /overview, /config as the current Settings route, /chat?session=agent%3Amain%3Amain, and direct /chat in the mocked Control UI E2E.
public_pr_preflight.sh was run, but its default-branch diff check compared against a stale local main branch checked out in another worktree. The branch itself was verified against origin/main immediately before publishing: git rev-list --left-right --count HEAD...origin/main returned 1 0.
The local codex review binary could not run because its bundled vendor executable is missing (ENOENT).

Screenshots

Desktop overview in this PR:

Mobile sidebar overview in this PR:

clawsweeper · 2026-07-06T14:11:08Z

Codex review: needs real behavior proof before merge. Reviewed July 7, 2026, 5:13 AM ET / 09:13 UTC.

Summary
The branch gates sidebar recent-session active styling to Chat routes, removes Overview digit blurring for recent session names, and adds render plus mocked E2E coverage.

PR surface: Source -13, Tests +74. Total +61 across 5 files.

Reproducibility: yes. at source level. Current main applies sidebar active styling from navigation.activeRowKey without a route check, and the PR's Overview exposure is provable from resolveSessionDisplayName fallback names plus the mask removal.

Review metrics: 1 noteworthy metric.

Overview numeric mask: 1 removed. The diff removes the only .blur-digits mask used by Overview recent sessions, which matters because fallback names can include channel/account identifiers.

Stored data model
Persistent data-model change detected: serialized state: ui/src/e2e/session-management.e2e.test.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🦪 silver shellfish
Patch quality: 🧂 unranked krab
Result: blocked until stronger real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Preserve masking for fallback channel/account identifiers while allowing ordinary user-authored numeric titles.
[P1] Add redacted real Control UI proof showing Overview and Settings unhighlighted, Chat highlighted, and identifier masking intact.

Proof guidance:

[P1] Needs stronger real behavior proof before merge: Screenshot proof exists for Overview no-highlight behavior, but it does not show a real non-mocked Control UI setup, Chat highlight restoration, Settings behavior, or identifier masking; add redacted screenshots, a recording, logs, or live output and redact private identifiers. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

[P1] Merging as-is removes the only Overview long-digit mask, so unlabeled direct-channel sessions can expose raw account or channel identifiers that current main obscures.
[P1] The screenshots only show Overview no-highlight behavior and do not prove Chat restoration, Settings behavior, identifier masking, or a real non-mocked Control UI setup.

Maintainer options:

Preserve fallback masking before merge (recommended)
Keep ordinary labels readable but retain masking for fallback channel/account identifiers, then add focused coverage and real Control UI proof.
Split the Overview change out
Narrow this PR to sidebar visual-active behavior and handle Overview numeric display policy in a separate maintainer decision.
Accept the exposure intentionally
Maintainers can accept unmasked fallback identifiers only as an explicit security/UX tradeoff.

Next step before merge

[P1] The remaining path needs a privacy-preserving Overview revision plus contributor real-behavior proof, and the protected maintainer label makes this a human-handled merge decision.

Maintainer decision needed

Question: Should this PR preserve Overview masking for resolver fallback channel/account identifiers while allowing ordinary user-authored numeric titles?
Rationale: The diff changes a privacy-preserving display boundary; accepting unmasked fallback identifiers would be a maintainer security/UX decision rather than a routine sidebar styling fix.
Likely owner: steipete — Peter is tied to the session-control behavior that made the route-scoping issue visible and was explicitly pulled into this PR's discussion timeline.
Options:
- Preserve fallback identifier masking (recommended): Revise the Overview change so friendly labels can show digits while fallback channel/account identifiers remain masked, then require real Control UI proof.
- Split the Overview policy out: Land only the sidebar visual-active fix here and move numeric display policy to a separate maintainer-reviewed PR.
- Accept unmasked fallback identifiers: Maintainers may intentionally remove the mask, but that weakens the current privacy-preserving Overview behavior.

Security
Needs attention: The diff removes a UI mask that currently obscures long numeric identifiers in Overview recent sessions.

Review findings

[P1] Preserve ID masking in Overview recents — ui/src/pages/overview/cards.ts:286

Review details

Best possible solution:

Keep the Chat-route sidebar highlight gate, preserve masking for resolver fallback channel/account identifiers in Overview, and require redacted real Control UI proof before merge.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level. Current main applies sidebar active styling from navigation.activeRowKey without a route check, and the PR's Overview exposure is provable from resolveSessionDisplayName fallback names plus the mask removal.

Is this the best way to solve the issue?

No, not as-is. The sidebar active-row gate is the narrow local fix, but the Overview display change should distinguish user-authored numeric labels from fallback channel/account identifiers instead of removing the mask globally.

Full review comments:

[P1] Preserve ID masking in Overview recents — ui/src/pages/overview/cards.ts:286
This still renders every resolveSessionDisplayName result as plain text. That resolver can fall back to names like Telegram · <identifier> for unlabeled direct-channel rows, while current main masks long digit runs in Overview; please keep the sidebar active-state fix but preserve masking for fallback channel/account IDs.
Confidence: 0.92

Overall correctness: patch is incorrect
Overall confidence: 0.92

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against a2a68d154b1b.

Label changes

Label changes:

add proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. Screenshot proof exists for Overview no-highlight behavior, but it does not show a real non-mocked Control UI setup, Chat highlight restoration, Settings behavior, or identifier masking; add redacted screenshots, a recording, logs, or live output and redact private identifiers.

Label justifications:

P2: This is a bounded Control UI bug-fix PR with a concrete privacy regression in the patch, not a core outage or release-blocking emergency.
merge-risk: 🚨 security-boundary: The PR removes an existing UI mask for long numeric session identifiers and can expose channel/account IDs in Overview recent sessions.
rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🦪 silver shellfish and patch quality is 🧂 unranked krab.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Screenshot proof exists for Overview no-highlight behavior, but it does not show a real non-mocked Control UI setup, Chat highlight restoration, Settings behavior, or identifier masking; add redacted screenshots, a recording, logs, or live output and redact private identifiers. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. Screenshot proof exists for Overview no-highlight behavior, but it does not show a real non-mocked Control UI setup, Chat highlight restoration, Settings behavior, or identifier masking; add redacted screenshots, a recording, logs, or live output and redact private identifiers.

Evidence reviewed

PR surface:

Source -13, Tests +74. Total +61 across 5 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	3	5	18	-13
Tests	2	74	0	+74
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	5	79	18	+61

Security concerns:

[medium] Overview can expose fallback channel IDs — ui/src/pages/overview/cards.ts:286
Removing the digit blur makes fallback direct-session identifiers visible in Overview when no friendly label or displayName exists, weakening an existing privacy-preserving display behavior.
Confidence: 0.9

What I checked:

Repository policy read: Root and scoped UI AGENTS.md were read fully; the review applied the repo's read-beyond-diff, UI security-boundary, and external real-behavior proof guidance. (AGENTS.md:1, a2a68d154b1b)
Current main highlights rows without route scoping: Current main derives active from navigation.activeRowKey and applies sidebar-recent-session--active from that flag, so the central sidebar confusion is still a real current-main behavior. (ui/src/components/app-sidebar.ts:324, a2a68d154b1b)
PR scopes the visual sidebar highlight: The PR adds a Chat-route gate for the visual active state while keeping the stored/current session data available for navigation. (ui/src/components/app-sidebar.ts:317, 26ac7310197f)
Current main masks long Overview digits: Current main wraps long digit runs in .blur-digits, and the stylesheet blurs those spans, preserving a privacy boundary for fallback identifiers. (ui/src/pages/overview/cards.ts:37, a2a68d154b1b)
PR removes the Overview mask: The PR renders resolveSessionDisplayName directly in Overview recent sessions and deletes the only .blur-digits CSS rule. (ui/src/pages/overview/cards.ts:286, 26ac7310197f)
Resolver fallback can contain channel identifiers: resolveSessionDisplayName can fall back to values like Telegram · <identifier> for unlabeled direct-channel keys, so removing the Overview mask can expose long account or channel IDs. (ui/src/lib/session-display.ts:57, a2a68d154b1b)

Likely related people:

vincentkoc: Current-main blame and recent history attribute the current AppSidebar, Overview card, and session-display surfaces to recent UI snapshot/refactor work by Vincent Koc. (role: recent area contributor; confidence: high; commits: 9a872a22d746, 6418e196b123; files: ui/src/components/app-sidebar.ts, ui/src/pages/overview/cards.ts, ui/src/lib/session-display.ts)
steipete: The non-chat session-control confusion is tied to the earlier calm-composer/sidebar session selection change authored by Peter Steinberger, and he was mentioned/subscribed in this PR timeline. (role: introduced adjacent behavior; confidence: medium; commits: 2b30951b8090; files: ui/src/ui/chat/session-controls.ts, ui/src/ui/app-render.ts, ui/src/styles/layout.css)
fuller-stack-dev: The merged related PR recently changed shared session state that feeds sidebar run/activity presentation, adjacent to this sidebar session-row behavior. (role: adjacent sidebar session-state contributor; confidence: medium; commits: 521bf99f179d; files: ui/src/lib/sessions/index.ts, ui/src/pages/chat/run-lifecycle.ts, ui/src/e2e/chat-run-lifecycle.e2e.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (4 earlier review cycles)

reviewed 2026-07-06T14:17:31.821Z sha eb14866 :: needs real behavior proof before merge. :: [P1] Preserve ID masking in Overview recents
reviewed 2026-07-06T14:24:21.149Z sha eb14866 :: needs real behavior proof before merge. :: [P1] Preserve ID masking in Overview recents
reviewed 2026-07-06T14:54:23.047Z sha eb14866 :: needs real behavior proof before merge. :: [P1] Preserve ID masking in Overview recents
reviewed 2026-07-07T08:44:50.998Z sha 26ac731 :: needs real behavior proof before merge. :: [P1] Preserve ID masking in Overview recents

vyctorbrzezowski · 2026-07-06T14:21:19Z

@clawsweeper review

clawsweeper · 2026-07-06T14:21:22Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

vyctorbrzezowski · 2026-07-08T06:27:05Z

Closing this draft because the sidebar active-state fix was folded into #101017.

openclaw-barnacle Bot added app: web-ui App: web-ui size: S labels Jul 6, 2026

vyctorbrzezowski marked this pull request as ready for review July 6, 2026 14:18

fuller-stack-dev mentioned this pull request Jul 7, 2026

fix(ui): clear stale sidebar run state after chat final #101293

Merged

fix(ui): scope sidebar session active state to chat

26ac731

vyctorbrzezowski force-pushed the brzezowski/non-chat-session-state branch from eb14866 to 26ac731 Compare July 7, 2026 08:29

openclaw-barnacle Bot added the maintainer Maintainer-authored PR label Jul 7, 2026

vyctorbrzezowski marked this pull request as draft July 7, 2026 09:10

clawsweeper Bot added the proof: 📸 screenshot Contributor real behavior proof includes screenshot evidence. label Jul 7, 2026

vyctorbrzezowski mentioned this pull request Jul 8, 2026

improve(ui): bring back openclaw brand, remove desktop topbar + breadcrumbs #101017

Merged

vyctorbrzezowski closed this Jul 8, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(ui): scope sidebar session active state to chat#100918

fix(ui): scope sidebar session active state to chat#100918
vyctorbrzezowski wants to merge 1 commit into
openclaw:mainfrom
vyctorbrzezowski:brzezowski/non-chat-session-state

vyctorbrzezowski commented Jul 6, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

vyctorbrzezowski commented Jul 6, 2026

Uh oh!

clawsweeper Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

vyctorbrzezowski commented Jul 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

vyctorbrzezowski commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Screenshots

Uh oh!

clawsweeper Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vyctorbrzezowski commented Jul 6, 2026

Uh oh!

clawsweeper Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vyctorbrzezowski commented Jul 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vyctorbrzezowski commented Jul 6, 2026 •

edited

Loading

clawsweeper Bot commented Jul 6, 2026 •

edited

Loading

clawsweeper Bot commented Jul 6, 2026 •

edited

Loading