feat(workspaces): add secure preview widget by 100yenadmin · Pull Request #101354 · openclaw/openclaw

100yenadmin · 2026-07-07T04:21:36Z

What Problem This Solves

Workspaces has no first-class preview panel for inspecting an allowed development server or deployed page without leaving the operator workspace.

Why This Change Was Made

This adds builtin:preview to the current Workspaces registry and schema. The preview keeps a distinct, owner-approved saved widget contract while sharing the iframe plumbing and URL policy with builtin:iframe-embed. It fails closed for disallowed origins, preserves the existing iframe sandbox ceiling (allow-scripts, never allow-same-origin), sends no referrer, and reloads without reaching into contentWindow.

Resolved bindings.value URLs take precedence when declared, unrelated bindings do not suppress props.url, and viewport selection lives in the owning workspace view state so rerenders preserve it.

User Impact

Workspace authors can preview an allowed URL, reload it, and switch between desktop, tablet, and mobile viewports. Disallowed origins render an explicit blocked state. Loading a remote preview makes the browser contact that origin directly, so it can observe ordinary network metadata such as IP address and user agent.

Visual Proof

Current main — preview kind unavailable:

Candidate — allowed same-origin preview plus blocked external origin:

Candidate — mobile viewport:

Artifact manifest

Evidence

Final rebased head: a7da1103db68126c3f9fa4a36a81e89930d25fcf.
Focused Vitest: 58 assertions passed across widget, workspace view, schema, cell, and browser E2E surfaces.
E2E covers allowed bound URL, blocked external URL, viewport persistence, and reload.
All 20 generated locale bundles synchronized; repository locale checks and hosted changed gates passed.
Hosted changed gate: Blacksmith Testbox run.
Fresh branch autoreview: clean, no accepted/actionable findings.
git diff --check: clean.

Thanks @100yenadmin for the original implementation and Workspaces design.

100yenadmin · 2026-07-07T04:21:38Z

Refile of #101334, which was auto-closed to make PR room — same branch and commit, nothing changed.

On the dependency-guard check: this PR is stacked on the not-yet-merged Wave 1 (#101098), so its cumulative diff against main includes Wave 1's single new-plugin pnpm-lock.yaml importer entry. This PR adds no new dependency (it touches only ui/ + regenerated i18n bundles); it clears once Wave 1 lands or with the head-SHA authorization noted on the Wave 1 PRs. Green locally: UI dashboard suite (100 tests), ui:i18n:check, pnpm ui:build, oxlint.

chatgpt-codex-connector · 2026-07-07T04:21:39Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

github-actions · 2026-07-07T04:22:09Z

Dependency graph guard cleared

This PR no longer has blocked dependency graph changes. A future dependency graph change requires a fresh /allow-dependencies-change comment after the guard blocks that new head SHA.

Current SHA: a7da1103db68126c3f9fa4a36a81e89930d25fcf

clawsweeper · 2026-07-07T04:59:04Z

Codex review: needs real behavior proof before merge. Reviewed July 13, 2026, 8:40 AM ET / 12:40 UTC.

Summary
Adds a builtin:preview Workspaces widget with gated iframe loading, reload and viewport controls, schema and renderer registration, styling, English copy, and focused tests.

PR surface: Source +207, Tests +92, Other -1. Total +298 across 9 files.

Reproducibility: not applicable. as a bug reproduction: current main clearly lacks dedicated preview chrome, while already supporting the underlying iframe-embed capability.

Review metrics: 1 noteworthy metric.

Persisted widget contract: 1 added, 0 changed, 0 removed. A new builtin kind becomes part of saved workspace documents and should have an intentional long-term compatibility story before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #101138
Summary: This PR is the phase-one implementation candidate for the dedicated preview-widget issue; the roadmap is broader and the earlier PR was replaced by this refile.

Members:

canonical: Dashboard: preview widget — live URL embed, dev-server preview, browser-backed inspection #101138 - The open issue defines phase one as URL embed, reload, and viewport controls and explicitly names this PR as its implementation.
partial_overlap: Modular Dashboard — Wave 2+ roadmap (tracking) #101136 - The roadmap tracks this preview work as one component of a much broader Workspaces program.
superseded: Dashboard: preview widget — embed a live URL with reload + viewport controls #101334 - The contributor states this PR is a refile of the auto-closed earlier branch.
partial_overlap: [Feature]: Browser Preview Panel in Dashboard #27574 - That closed request sought a broader live browser-inspection surface, while this PR only embeds a URL with local controls.
adjacent_distinct: feat(workspaces): add agent-composable Workspaces #104139 - That merged PR supplies the Workspaces foundation and existing iframe capability but does not implement this preview chrome.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🦐 gold shrimp
Result: blocked until stronger real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Get maintainer confirmation on one canonical embed/preview widget contract.
[P1] Fix resolved binding consumption and persist viewport selection in owned UI state.
[P1] Attach a redacted final-head Workspaces recording covering success and blocked paths.

Proof guidance:

[P1] Needs stronger real behavior proof before merge: An earlier recording was associated with a pre-final revision, but the video label was removed before the final force-push and the current body contains only test/lint evidence; add a redacted recording from head 101e1323354e494503fdedfaa8758ead70dc8a3f showing allowed load, reload, viewport switching, and blocked URLs, then update the PR body to trigger review or ask a maintainer for @clawsweeper re-review.

Risk before merge

[P1] Merging a second persisted URL-embed kind commits OpenClaw to two overlapping workspace contracts; later consolidation could require document migration and compatibility handling.
[P1] The final head has no inspectable after-fix recording demonstrating allowed loading, blocked URLs, reload, and viewport switching in a real Workspaces setup.

Maintainer options:

Consolidate the widget contract (recommended)
Refactor the preview chrome into the existing iframe embed path, fix binding and state ownership, and provide final-head browser proof before merge.
Accept a permanent preview kind
Explicitly approve the parallel persisted kind and require upgrade-contract tests plus final-head behavior proof before landing.
Pause until the distinction is justified
Close or defer this branch if reload and viewport chrome alone do not justify a second persisted widget contract.

Next step before merge

[P1] A maintainer must first choose the permanent widget contract; after that, the contributor has concrete binding, state-ownership, and final-head proof work.

Maintainer decision needed

Question: Should Workspaces permanently expose builtin:preview as a distinct saved widget kind, or should preview controls extend the existing builtin:iframe-embed contract?
Rationale: Both designs are technically possible, but choosing a persisted widget identity is a long-lived product and compatibility decision that automation cannot safely make.
Likely owner: steipete — The current Workspaces integration and widget contract entered main through their merged implementation.
Options:
- Consolidate before merge (recommended): Extend the existing iframe widget with typed optional preview controls so saved workspaces retain one URL-embed contract.
- Sponsor a distinct kind: Approve builtin:preview as a permanent separate contract and require focused compatibility tests, renderer fixes, and current-head proof.
- Defer the preview tier: Keep the existing iframe widget unchanged and pause this PR until later browser or dev-server capabilities justify a distinct builtin.

Security
Cleared: The patch reuses the existing external-URL gate, retains allow-scripts without allow-same-origin, uses no-referrer, and introduces no dependency or executable supply-chain change.

Review findings

[P1] Consolidate the existing URL-embed capability — extensions/workspaces/src/schema.ts:68
[P2] Render the resolved binding value — ui/src/lib/workspace/widgets/preview.ts:28-31
[P2] Keep viewport selection in owned state — ui/src/lib/workspace/widgets/preview.ts:51

Review details

Best possible solution:

Keep one canonical URL-embed contract—preferably extending iframe-embed with explicitly modeled preview controls—then consume resolved binding data, move viewport selection into owned state, and attach redacted final-head browser proof.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a bug reproduction: current main clearly lacks dedicated preview chrome, while already supporting the underlying iframe-embed capability.

Is this the best way to solve the issue?

No. A separate persisted kind is not yet proven better than extending the existing embed widget, and the proposed renderer currently ignores resolved bindings and keeps viewport selection outside owned state.

Full review comments:

[P1] Consolidate the existing URL-embed capability — extensions/workspaces/src/schema.ts:68
Current main already persists and renders builtin:iframe-embed through the same URL gate and sandbox. Adding another saved kind solely for reload and viewport chrome creates two sources of truth and a future migration burden; extend the existing widget with typed preview controls, or obtain explicit maintainer approval for a permanently distinct contract.
Confidence: 0.91
[P2] Render the resolved binding value — ui/src/lib/workspace/widgets/preview.ts:28-31
The builtin renderer receives the resolved workspace value as its second argument, but this implementation discards it and reads only widget.props.url. A preview bound through the normal data-binding path therefore stays missing or stale instead of showing the resolved URL.
Confidence: 0.98
[P2] Keep viewport selection in owned state — ui/src/lib/workspace/widgets/preview.ts:51
Viewport selection is initialized inside this pure render function and then maintained through DOM-local mutation. Any workspace rerender reconstructs the template from defaultViewport, snapping the user's tablet or mobile selection back; store this state in the owning controller/component keyed by widget.
Confidence: 0.9

Overall correctness: patch is incorrect
Overall confidence: 0.9

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 265f79e60721.

Label changes

Label changes:

add proof: 🎥 video: Contributor real behavior proof includes video or recording evidence. An earlier recording was associated with a pre-final revision, but the video label was removed before the final force-push and the current body contains only test/lint evidence; add a redacted recording from head 101e1323354e494503fdedfaa8758ead70dc8a3f showing allowed load, reload, viewport switching, and blocked URLs, then update the PR body to trigger review or ask a maintainer for @clawsweeper re-review.
add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
remove rating: 🦪 silver shellfish: Current PR rating is rating: 🧂 unranked krab, so this older rating label is no longer current.

Label justifications:

P2: This is a bounded Workspaces feature with normal user-facing value, but it has product-contract and correctness blockers rather than urgent runtime impact.
merge-risk: 🚨 compatibility: The new builtin:preview identifier creates a second persisted URL-embed contract that may require migration if maintainers later consolidate the overlap.
rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: An earlier recording was associated with a pre-final revision, but the video label was removed before the final force-push and the current body contains only test/lint evidence; add a redacted recording from head 101e1323354e494503fdedfaa8758ead70dc8a3f showing allowed load, reload, viewport switching, and blocked URLs, then update the PR body to trigger review or ask a maintainer for @clawsweeper re-review.
proof: 🎥 video: Contributor real behavior proof includes video or recording evidence. An earlier recording was associated with a pre-final revision, but the video label was removed before the final force-push and the current body contains only test/lint evidence; add a redacted recording from head 101e1323354e494503fdedfaa8758ead70dc8a3f showing allowed load, reload, viewport switching, and blocked URLs, then update the PR body to trigger review or ask a maintainer for @clawsweeper re-review.

Evidence reviewed

PR surface:

Source +207, Tests +92, Other -1. Total +298 across 9 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	6	208	1	+207
Tests	2	93	1	+92
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	1	0	1	-1
Total	9	301	3	+298

What I checked:

Existing supported capability: Current main already provides builtin:iframe-embed with the same URL-policy evaluator and sandbox ceiling; the new preview kind adds chrome around that existing embed capability rather than establishing a separate runtime boundary. (ui/src/lib/workspace/widgets/iframe-embed.ts:25, 265f79e60721)
New persisted contract: The branch adds builtin:preview to the Workspaces document schema, making the distinction part of saved workspace data and therefore costly to consolidate after release. (extensions/workspaces/src/schema.ts:68, 101e1323354e)
Resolved value bypassed: renderPreview names its renderer input _value and instead evaluates widget.props.url, so a URL delivered through the normal resolved binding path is ignored. (ui/src/lib/workspace/widgets/preview.ts:31, 101e1323354e)
Transient viewport state: The selected viewport starts from defaultViewport inside each pure render call; DOM-local selection is therefore replaced when the owning workspace rerenders. (ui/src/lib/workspace/widgets/preview.ts:51, 101e1323354e)
Locale policy: The scoped Control UI policy says English is the source of truth and generated non-English bundles normally refresh after merge, so the earlier locale-bundle finding should not be repeated. (ui/AGENTS.md:247, 265f79e60721)
Current Workspaces provenance: The current Workspaces implementation was merged through feat(workspaces): add agent-composable Workspaces #104139 at commit 0af8467, making that integration history the primary owner boundary for this new builtin. (ui/src/lib/workspace/widgets/iframe-embed.ts, 0af846713749)

Likely related people:

steipete: Authored and merged the current agent-composable Workspaces foundation, including the owner boundary and existing iframe widget behavior this PR extends. (role: Workspaces integration author and merger; confidence: high; commits: 0af846713749; files: extensions/workspaces/src/schema.ts, ui/src/lib/workspace/widgets/iframe-embed.ts, ui/src/lib/workspace/widgets/index.ts)
100yenadmin: Designed the modular Workspaces roadmap and authored the preview implementation and its earlier stacked predecessor, providing strong domain context beyond this single PR. (role: original feature designer and adjacent area contributor; confidence: medium; commits: 50d76070fb83, 101e1323354e; files: ui/src/lib/workspace/widgets/preview.ts, ui/src/lib/workspace/widgets/widgets.test.ts, extensions/workspaces/src/schema.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (13 earlier review cycles; latest 8 shown)

reviewed 2026-07-07T23:44:09.325Z sha b23a3b2 :: needs real behavior proof before merge. :: [P2] Use the resolved binding value for the preview URL | [P2] Persist the selected preview viewport across renders | [P3] Remove the root carve scratch document
reviewed 2026-07-07T23:53:43.029Z sha b23a3b2 :: needs real behavior proof before merge. :: [P2] Use the resolved binding value for the preview URL | [P2] Persist the selected preview viewport across renders | [P3] Remove the root carve scratch document
reviewed 2026-07-08T04:28:01.609Z sha b23a3b2 :: needs real behavior proof before merge. :: [P2] Use the resolved binding value for the preview URL | [P2] Keep the selected viewport in dashboard state | [P3] Remove the root carve scratch document
reviewed 2026-07-09T23:26:38.158Z sha 8584dbf :: needs real behavior proof before merge. :: [P2] Use the resolved binding value for the preview URL | [P2] Keep the selected viewport in dashboard state | [P3] Remove the root carve scratch document
reviewed 2026-07-10T08:35:30.145Z sha 46c8741 :: needs real behavior proof before merge. :: [P2] Use the resolved binding value for the preview URL | [P2] Keep the selected viewport in dashboard state | [P1] Move dashboard persistence into SQLite | [P3] Remove the root carve scratch document
reviewed 2026-07-13T02:58:31.378Z sha 727af42 :: needs real behavior proof before merge. :: [P1] Consolidate the existing URL-embed capability | [P2] Render the resolved binding value | [P2] Keep viewport selection in owned state | [P2] Synchronize the generated locale bundles
reviewed 2026-07-13T07:35:00.082Z sha 4abeebd :: needs real behavior proof before merge. :: [P1] Consolidate the existing URL-embed capability | [P2] Render the resolved binding value | [P2] Keep viewport selection in owned state | [P2] Synchronize the generated locale bundles
reviewed 2026-07-13T09:46:00.482Z sha 8069aa0 :: needs real behavior proof before merge. :: [P1] Consolidate the existing URL-embed capability | [P2] Render the resolved binding value | [P2] Keep viewport selection in owned state | [P2] Synchronize the generated locale bundles

steipete · 2026-07-17T01:28:27Z

Merged via squash.

Prepared head SHA: a7da1103db68126c3f9fa4a36a81e89930d25fcf
Landed commit: 368941ae7a10cfa9df0af71ee8576de98ec80293

* feat(workspaces): add secure preview widget * fix(workspaces): type preview reload assertion * fix(workspaces): harden preview widget * fix(workspaces): honor preview URL binding ownership * chore(workspaces): remove unused widget exports --------- Co-authored-by: Eva <[email protected]> Co-authored-by: Peter Steinberger <[email protected]>

100yenadmin requested a review from a team as a code owner July 7, 2026 04:21

100yenadmin mentioned this pull request Jul 7, 2026

Modular Dashboard — Wave 2+ roadmap (tracking) #101136

Open

24 tasks

openclaw-barnacle Bot added app: web-ui App: web-ui size: XL labels Jul 7, 2026

github-actions Bot added the dependencies-changed PR changes dependency-related files label Jul 7, 2026

clawsweeper Bot mentioned this pull request Jul 7, 2026

[Feature]: Browser Preview Panel in Dashboard #27574

Closed

github-actions Bot mentioned this pull request Jul 7, 2026

🦞 OpenClaw 生态日报 2026-07-08 huajiao1998/big_model_radar#19

Open

clawsweeper Bot added the merge-risk: 🚨 session-state 🚨 May lose, corrupt, stale, or mis-associate session, agent, or context state. label Jul 10, 2026

100yenadmin mentioned this pull request Jul 12, 2026

Teams: local multi-user Workspaces sharing with exact tab RBAC #105322

Open

100yenadmin force-pushed the feat/dashboard-preview-widget branch from 46c8741 to 3c16a91 Compare July 13, 2026 02:27

100yenadmin changed the title ~~Dashboard: preview widget — embed a live URL with reload + viewport controls~~ Workspaces: add secure preview widget Jul 13, 2026

openclaw-barnacle Bot added scripts Repository scripts plugin: workspaces Agent-composable Workspaces plugin size: M and removed size: XL labels Jul 13, 2026

github-actions Bot removed the dependencies-changed PR changes dependency-related files label Jul 13, 2026

100yenadmin force-pushed the feat/dashboard-preview-widget branch from 727af42 to 4abeebd Compare July 13, 2026 06:42

clawsweeper Bot added the merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. label Jul 13, 2026

100yenadmin force-pushed the feat/dashboard-preview-widget branch from 4abeebd to 8069aa0 Compare July 13, 2026 09:03

clawsweeper Bot removed the proof: 🎥 video Contributor real behavior proof includes video or recording evidence. label Jul 13, 2026

100yenadmin force-pushed the feat/dashboard-preview-widget branch from 8069aa0 to 101e132 Compare July 13, 2026 11:27

steipete force-pushed the feat/dashboard-preview-widget branch from 101e132 to 12a6927 Compare July 17, 2026 00:50

openclaw-barnacle Bot added docs Improvements or additions to documentation size: XL and removed scripts Repository scripts size: M labels Jul 17, 2026

steipete force-pushed the feat/dashboard-preview-widget branch from 12a6927 to 054674d Compare July 17, 2026 01:00

steipete changed the title ~~Workspaces: add secure preview widget~~ feat(workspaces): add secure preview widget Jul 17, 2026

steipete force-pushed the feat/dashboard-preview-widget branch from 054674d to 64cb929 Compare July 17, 2026 01:06

Eva and others added 5 commits July 17, 2026 02:10

feat(workspaces): add secure preview widget

dea0120

fix(workspaces): type preview reload assertion

1db7632

fix(workspaces): harden preview widget

0c9a235

fix(workspaces): honor preview URL binding ownership

acacb0d

chore(workspaces): remove unused widget exports

a7da110

steipete force-pushed the feat/dashboard-preview-widget branch from 64cb929 to a7da110 Compare July 17, 2026 01:11

steipete merged commit 368941a into openclaw:main Jul 17, 2026
114 of 117 checks passed

github-actions Bot mentioned this pull request Jul 17, 2026

📡 Upstream Digest — 2026-07-17 01:55 UTC curtismercier/openclaw-mods#1318

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat(workspaces): add secure preview widget#101354

feat(workspaces): add secure preview widget#101354
steipete merged 5 commits into
openclaw:mainfrom
100yenadmin:feat/dashboard-preview-widget

100yenadmin commented Jul 7, 2026 •

edited by steipete

Loading

Uh oh!

100yenadmin commented Jul 7, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 7, 2026

Uh oh!

github-actions Bot commented Jul 7, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 7, 2026 •

edited

Loading

Uh oh!

Uh oh!

steipete commented Jul 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

100yenadmin commented Jul 7, 2026 • edited by steipete Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Visual Proof

Evidence

Uh oh!

100yenadmin commented Jul 7, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 7, 2026

Uh oh!

github-actions Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency graph guard cleared

Uh oh!

clawsweeper Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

steipete commented Jul 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

100yenadmin commented Jul 7, 2026 •

edited by steipete

Loading

github-actions Bot commented Jul 7, 2026 •

edited

Loading

clawsweeper Bot commented Jul 7, 2026 •

edited

Loading