Skip to content

Workspaces: add Living Answers and action forms#101899

Open
100yenadmin wants to merge 3 commits into
openclaw:mainfrom
100yenadmin:feat/dashboard-living-answers
Open

Workspaces: add Living Answers and action forms#101899
100yenadmin wants to merge 3 commits into
openclaw:mainfrom
100yenadmin:feat/dashboard-living-answers

Conversation

@100yenadmin

@100yenadmin 100yenadmin commented Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What Problem This Solves

Agents need a safe way to publish temporary answers into Workspaces and let operators explicitly pin useful results. Workspaces also needs a bounded action form that can send a declared prompt without creating an arbitrary execution surface. The legacy implementation targeted the removed dashboard stack.

Why This Change Was Made

This rebuild adds ephemeral widget expiry and explicit ephemeral: null pinning to current Workspaces, including transactional lazy TTL cleanup that rechecks cached documents. It also adds builtin:action-form with bounded declared fields, single-pass interpolation, explicit confirmation, and a shared dispatch gate limited to one in-flight request and ten requests per minute. Dispatch uses the existing chat.send permission path with deliver: false; it does not add eval, arbitrary RPC, or a new execution authority.

User Impact

Agent-created Living Answers can expire automatically, display a Temporary badge, and be pinned by an operator. Action forms can collect bounded input and submit a confirmed prompt while remaining inside existing agent permissions and rate limits. Expired content is removed consistently even when a cached workspace document is involved.

Evidence

  • Rebased onto upstream main at 843e3c787806389cdaac884300e671fba658dab6 during the final recovery pass; all three commits range-diff identically and keep concrete workspace binding helpers private.
  • The validated implementation suite passed 158 assertions across nine files before the final exact restack, including cached-expiry behavior.
  • Final-head focused proof passed 41 extension assertions plus 59 unaffected UI assertions. Three additional UI suites were blocked before collection because this worktree's shared node_modules still lacks current main's remend dependency; GitHub Actions remains the canonical clean-dependency gate.
  • Scoped oxlint: clean; git diff --check: clean.
  • Local autoreview: exit 0 with no remaining actionable findings.
  • No generated locale output was hand-edited; v1 reuses literal field labels and introduced no generated-locale drift.

@100yenadmin
100yenadmin requested a review from a team as a code owner July 7, 2026 22:47
@100yenadmin

100yenadmin commented Jul 7, 2026

Copy link
Copy Markdown
Contributor Author

On dependency-guard: inherited from the unmerged Wave 1 base (#101098) — no new dependency. Verified by the submitting orchestrator's own gate: extensions/dashboard 94 tests, UI dashboard+plugin+cell 140 tests, ui:build + full type-aware oxlint clean. Note: this stacks on the corrected base where the UI↔gateway widget-mutation + file-binding contracts were fixed (so pin/collapse/hide/move actually work against the real gateway now).

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

@100yenadmin 100yenadmin mentioned this pull request Jul 7, 2026
Open
24 tasks
@github-actions github-actions Bot added the dependencies-changed PR changes dependency-related files label Jul 7, 2026
@github-actions

github-actions Bot commented Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Dependency graph guard cleared

This PR no longer has blocked dependency graph changes. A future dependency graph change requires a fresh /allow-dependencies-change comment after the guard blocks that new head SHA.

  • Current SHA: b3ae66d35bc5f6ad5dd9240d1019f3cf6f919427

@clawsweeper

clawsweeper Bot commented Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: found issues before merge. Reviewed July 13, 2026, 8:40 AM ET / 12:40 UTC.

Summary
Adds expiring and pinnable Workspace widgets plus a confirmed, rate-limited built-in action form that submits prompts through the existing chat.send path.

PR surface: Source +399, Tests +151, Docs +19. Total +569 across 18 files.

Reproducibility: yes. at source level, though not live-reproduced here: submit while disconnected or make chat.send reject, and the resulting promise rejection reaches the action form's empty catch and produces no operator-visible failure.

Review metrics: 2 noteworthy metrics.

  • Persistent model surface: 1 optional widget field added. ephemeral becomes persisted Workspace document data, so schema, mutation, cache, and upgrade behavior must stay aligned.
  • Prompt authority: 0 new gateway methods; 1 existing chat.send path reused. This materially limits security expansion, but maintainers still need to accept the new first-party UI entry point.

Stored data model
Persistent data-model change detected: unknown-data-model-change: extensions/workspaces/src/schema.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🦞 diamond lobster ✨ media proof bonus
Patch quality: 🦐 gold shrimp
Result: needs maintainer review before merge.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P2] Surface disconnected and chat.send rejection failures through the Control UI and add focused coverage.
  • Obtain an explicit Workspaces product-owner decision on shipping the bundled action-form capability.

Risk before merge

  • [P1] Shipping a first-party workspace-authored prompt action establishes a new bundled product capability and long-term UX/security ownership even though it reuses existing chat.send authority.

Maintainer options:

  1. Decide the mitigation before merge
    Keep the additive ephemeral-widget model, but ship action forms only after dispatch rejection is surfaced through the Control UI error/toast path with focused disconnected and chat.send rejection coverage, and after a product owner explicitly accepts the bundled capability.
  2. Pause or close
    Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

  • [P2] A Workspaces product owner should decide whether to sponsor the bundled prompt-action surface; if accepted, the contributor has one narrow dispatch-error repair before ordinary exact-head validation.

Maintainer decision needed

  • Question: Should Workspaces ship a first-party action-form widget that converts workspace-authored templates into operator-confirmed chat prompts?
  • Rationale: The patch can be made technically sound, but accepting a bundled prompt-producing UI surface and its long-term ownership is a product decision that repository policy and tests cannot resolve.
  • Likely owner: steipete — The timeline shows direct engagement with this PR, and the unresolved choice concerns bundled product direction rather than a mechanical code repair.
  • Options:
    • Sponsor after error repair (recommended): Accept the capability, require visible dispatch-error handling and focused failure coverage, then proceed with normal merge validation.
    • Land Living Answers only: Keep ephemeral and pinning support while removing action forms until a narrower product design is approved.
    • Decline bundled actions: Keep prompt-producing forms outside the bundled Workspaces plugin and close or redesign this portion of the proposal.

Security
Cleared: The patch keeps prompt submission behind explicit confirmation, shared rate limits, and existing chat.send permissions without adding eval, arbitrary RPC, dependency execution, or broader credentials.

Review findings

  • [P2] Surface action-form dispatch failures — ui/src/lib/workspace/widgets/action-form.ts:105
Review details

Best possible solution:

Keep the additive ephemeral-widget model, but ship action forms only after dispatch rejection is surfaced through the Control UI error/toast path with focused disconnected and chat.send rejection coverage, and after a product owner explicitly accepts the bundled capability.

Do we have a high-confidence way to reproduce the issue?

Yes at source level, though not live-reproduced here: submit while disconnected or make chat.send reject, and the resulting promise rejection reaches the action form's empty catch and produces no operator-visible failure.

Is this the best way to solve the issue?

Not yet. The shared confirmation and rate-limit gate is the right ownership boundary, but swallowing dispatch rejection is not acceptable, and the bundled action-form direction still needs explicit sponsorship.

Full review comments:

  • [P2] Surface action-form dispatch failures — ui/src/lib/workspace/widgets/action-form.ts:105
    Handle the rejected dispatchPrompt promise instead of swallowing it. The sender throws when the client is disconnected and propagates chat.send failures, so this empty catch leaves the operator with no indication that submission failed; route the rejection through the Control UI error/toast path and cover both failure cases.
    Confidence: 0.97

Overall correctness: patch is incorrect
Overall confidence: 0.88

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 265f79e60721.

Label changes

Label justifications:

  • P2: This is a substantial but bounded Workspaces feature with one normal-priority user-visible failure path and unresolved product sponsorship.
  • rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
  • status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (recording): The provided context records accepted video proof and a successful real-behavior-proof check demonstrating the visible Living Answers and action-form flow; the remaining rejection-path finding is not shown by that happy-path recording.
  • proof: sufficient: Contributor real behavior proof is sufficient. The provided context records accepted video proof and a successful real-behavior-proof check demonstrating the visible Living Answers and action-form flow; the remaining rejection-path finding is not shown by that happy-path recording.
  • proof: 🎥 video: Contributor real behavior proof includes video or recording evidence. The provided context records accepted video proof and a successful real-behavior-proof check demonstrating the visible Living Answers and action-form flow; the remaining rejection-path finding is not shown by that happy-path recording.
Evidence reviewed

PR surface:

Source +399, Tests +151, Docs +19. Total +569 across 18 files.

View PR surface stats
Area Files Added Removed Net
Source 12 423 24 +399
Tests 5 151 0 +151
Docs 1 19 0 +19
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 18 593 24 +569

What I checked:

  • Dispatch rejection remains suppressed: The action-form submit path still attaches an empty rejection handler to dispatchPrompt, while the supplied current-head context shows that the downstream sender throws when disconnected and propagates chat.send request failures. (ui/src/lib/workspace/widgets/action-form.ts:105, b3ae66d35bc5)
  • Downstream failures are expected: The Workspaces view throws Not connected. when no gateway client exists and otherwise awaits chat.send, so transport or gateway rejection reaches the action-form promise unless explicitly surfaced. (ui/src/pages/plugin/workspace-view.ts:579, b3ae66d35bc5)
  • Prior finding continuity: The latest completed ClawSweeper cycle at b137a92c1f45dd078eed1586cc7c93086d7180df raised the same P2 finding; the only later commit is described as keeping Workspaces helpers private, and the current supplied patch retains the affected action-form path. (ui/src/lib/workspace/widgets/action-form.ts:105, b137a92c1f45)
  • Security controls are bounded: The shared dispatcher enforces one in-flight request, a rolling request limit, and explicit confirmation before invoking the supplied sender; no eval, arbitrary RPC selection, or new gateway authority is introduced. (ui/src/lib/workspace/bridge.ts:111, b3ae66d35bc5)
  • Repository policy applied: The root policy requires owner review for larger product/security behavior, SQLite-backed state, and explicit operator control for risky paths; the scoped plugin and UI policies were also checked. (raw.githubusercontent.com) (AGENTS.md:1, 265f79e60721)

Likely related people:

  • 100yenadmin: Authored this PR, the linked modular Workspaces roadmap, and related Workspaces proposals, giving them strong implementation context beyond this single branch. (role: feature-series contributor; confidence: high; commits: 64450e103463, fac9d167e446, b3ae66d35bc5; files: extensions/workspaces/src/schema.ts, extensions/workspaces/src/store.ts, ui/src/lib/workspace/widgets/action-form.ts)
  • steipete: The PR timeline records an explicit mention and subscription during review, making this the strongest available human routing signal for accepting or narrowing the new Workspaces capability. (role: likely product decision owner; confidence: medium; files: extensions/workspaces/src/schema.ts, ui/src/lib/workspace/widgets/action-form.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.
Review history (12 earlier review cycles; latest 8 shown)
  • reviewed 2026-07-08T04:30:43.742Z sha e68b455 :: needs real behavior proof before merge. :: [P1] Remove or authorize the dependency graph change | [P1] Move dashboard workspace state into SQLite-backed plugin state | [P2] Serve the manifest-approved entrypoint | [P2] Apply sandbox headers to widget-route 404s | [P2] Preserve hidden widgets in the UI model | [P3] Remove the root carve spec
  • reviewed 2026-07-09T18:47:59.795Z sha c25359d :: needs real behavior proof before merge. :: [P1] Remove or authorize the dependency graph change | [P1] Move dashboard workspace state into SQLite-backed plugin state | [P2] Serve the manifest-approved entrypoint | [P2] Apply sandbox headers to widget-route 404s | [P2] Preserve hidden widgets in the UI model | [P2] Surface action-form dispatch failures
  • reviewed 2026-07-09T19:00:10.730Z sha c25359d :: needs real behavior proof before merge. :: [P1] Remove or authorize the dependency graph change | [P1] Move dashboard workspace state into SQLite-backed plugin state | [P2] Serve the manifest-approved entrypoint | [P2] Apply sandbox headers to widget-route 404s | [P2] Preserve hidden widgets in the UI model | [P2] Surface action-form dispatch failures
  • reviewed 2026-07-09T23:28:55.012Z sha be5c599 :: needs real behavior proof before merge. :: [P1] Remove or authorize the dependency graph change | [P1] Move dashboard workspace state into SQLite-backed plugin state | [P2] Serve the manifest-approved entrypoint | [P2] Apply sandbox headers to widget-route 404s | [P2] Preserve hidden widgets in the UI model | [P2] Surface action-form dispatch failures
  • reviewed 2026-07-10T08:51:57.067Z sha 3ba4743 :: needs real behavior proof before merge. :: [P1] Remove or authorize the dependency graph change | [P1] Move dashboard workspace state into SQLite-backed plugin state | [P2] Serve the manifest-approved entrypoint | [P2] Apply sandbox headers to widget-route 404s | [P2] Preserve hidden widgets in the UI model | [P2] Surface action-form dispatch failures
  • reviewed 2026-07-13T03:38:59.785Z sha 91d72db :: needs real behavior proof before merge. :: [P2] Surface action-form dispatch failures
  • reviewed 2026-07-13T07:31:06.013Z sha 87d6064 :: found issues before merge. :: [P2] Surface action-form dispatch failures
  • reviewed 2026-07-13T09:50:06.070Z sha b137a92 :: found issues before merge. :: [P2] Surface action-form dispatch failures

@github-actions github-actions Bot mentioned this pull request Jul 7, 2026
Open
@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. labels Jul 7, 2026
@100yenadmin

100yenadmin commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

Minor robustness (downstream-extraction audit): the action-form submit does ctx.dispatchPrompt(...).then(...).catch(() => {}), and the comment says failures "surface via the shared toast." dispatchRateLimitedPrompt returns an outcome for the rate_limited/declined cases, but a thrown error from sendPrompt (e.g. "Not connected." when client is null, or a chat.send rejection) propagates out and is swallowed by that empty .catch — nothing surfaces to the operator. Not a security issue and the trigger is narrow (genuine dispatch failure), so just flagging: consider routing the thrown-error path to the Control UI's error/toast mechanism, or fixing the comment. (In the extracted Boardstate this was more visible because its demo host has no chat.send at all, so every submit hit the swallow.)

@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels Jul 10, 2026
@100yenadmin 100yenadmin mentioned this pull request Jul 12, 2026
Open
@100yenadmin
100yenadmin force-pushed the feat/dashboard-living-answers branch from 3ba4743 to 91d72db Compare July 13, 2026 02:53
@100yenadmin 100yenadmin changed the title Dashboard: Living Answers + action-form — the chat↔dashboard loop Workspaces: add Living Answers and action forms Jul 13, 2026
@github-actions github-actions Bot removed the dependencies-changed PR changes dependency-related files label Jul 13, 2026
@openclaw-barnacle openclaw-barnacle Bot added dependencies-changed PR changes dependency-related files plugin: workspaces Agent-composable Workspaces plugin size: L and removed size: XL labels Jul 13, 2026
@github-actions github-actions Bot removed the dependencies-changed PR changes dependency-related files label Jul 13, 2026
@clawsweeper clawsweeper Bot added proof: 🎥 video Contributor real behavior proof includes video or recording evidence. and removed merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. labels Jul 13, 2026
@clawsweeper clawsweeper Bot removed merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. proof: 🎥 video Contributor real behavior proof includes video or recording evidence. labels Jul 13, 2026
@100yenadmin
100yenadmin force-pushed the feat/dashboard-living-answers branch from 4999efd to 87d6064 Compare July 13, 2026 07:21
@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. proof: 🎥 video Contributor real behavior proof includes video or recording evidence. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Jul 13, 2026
@100yenadmin
100yenadmin force-pushed the feat/dashboard-living-answers branch from 87d6064 to b137a92 Compare July 13, 2026 09:04
@100yenadmin
100yenadmin force-pushed the feat/dashboard-living-answers branch from b137a92 to b3ae66d Compare July 13, 2026 11:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

app: web-ui App: web-ui P2 Normal backlog priority with limited blast radius. plugin: workspaces Agent-composable Workspaces plugin proof: sufficient ClawSweeper judged the real behavior proof convincing. proof: 🎥 video Contributor real behavior proof includes video or recording evidence. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. size: L status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@100yenadmin