Skip to content

feat(dashboard): widget capabilities — net CSP, host tools, hardened shared sandbox#111687

Merged
steipete merged 14 commits into
mainfrom
claude/dashboard-capabilities
Jul 20, 2026
Merged

feat(dashboard): widget capabilities — net CSP, host tools, hardened shared sandbox#111687
steipete merged 14 commits into
mainfrom
claude/dashboard-capabilities

Conversation

@steipete

@steipete steipete commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What Problem This Solves

Dashboard widgets render but have no safe reach: no network for a self-updating weather card, no gateway data, no automation triggers, and prompt sends always need per-click confirmation. This PR is the capability layer of the session-dashboard program (design: docs/web/dashboard-architecture.md): declared, operator-granted, byte-and-revision-bound widget capabilities.

Why This Change Was Made

  • One hardened host: board HTML widgets move onto the shared double-iframe sandbox (dedicated origin) generalized from MCP Apps, with parent frame-src against self-navigation exfiltration.
  • Modeled WebRTC residual: current Chromium does not implement CSP webrtc 'block', so scriptable widgets retain WebRTC data-channel egress. This accepted tradeoff is documented in the dashboard architecture: the same residual already ships for inline chat widgets and the MCP Apps host; sensitive OpenClaw data requires an operator-granted, byte-frozen data:read capability; Permissions-Policy blocks camera and microphone. A DOM API guard is follow-up defense-in-depth, not the boundary.
  • net = CSP: granted widgets get exactly their declared HTTPS origins as connect-src; pending/rejected get 'none'.
  • Host tools over one ticket-bound MessagePort, grants authoritative gateway-side: openclaw.prompt.send (user-activation; confirm skipped only with granted prompt), openclaw.state.emit (8 KB cap, 5s coalescing, rate-limited), openclaw.data.read (allowlisted sessions/usage/cron/agents/health bindings via board.data.read), openclaw.cron.trigger (exact cron.trigger:<jobId> grants via board.action).
  • Capability chips and grant summaries in the board UI distinguish net origins from tools.

User Impact

The full agent-built live dashboard loop: declare net/tools on show_widget, operator one-tap grant (revision-bound), widget fetches its API on an interval / reads gateway data / triggers cron — all inside the sandbox with server-side enforcement.

Evidence

Exact head 07aeb637811: Blacksmith Testbox tbx_01kxztfe7zbmnppaewartkp7ek passed the sandbox HTTP/CSP, MCP UI resource, and real Chromium dashboard E2E shards (16 tests); the landing repair also passed 12 focused widget-host tests, targeted lint, docs-map/MDX/format checks, and a clean autoreview. Broad evidence is reused from the patch-equivalent feature stack: 8,176 gateway + 4,906 UI tests green, check-changed clean, protocol/native generation + Linux SDK baseline verified; earlier rounds included a 390-test focused matrix, Chromium exploit + dashboard E2E, and dual autoreviews. New RPCs (board.prompt.authorize, board.data.read, board.action) are registered with release-train entries.

@steipete
steipete requested a review from a team as a code owner July 20, 2026 05:55
@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation app: android App: android app: web-ui App: web-ui gateway Gateway runtime docker Docker and sandbox tooling agents Agent runtime and tooling size: XL maintainer Maintainer-authored PR labels Jul 20, 2026
@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. labels Jul 20, 2026
@clawsweeper

clawsweeper Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed July 20, 2026, 5:19 AM ET / 09:19 UTC.

Summary
The branch adds operator-granted dashboard-widget network and host-tool capabilities through a shared sandbox host, three Gateway RPCs, protocol/native models, and Control UI capability UI and bridge code.

PR surface: Source +2250, Tests +2110, Docs +21, Other +150. Total +4531 across 68 files.

Reproducibility: not applicable. This PR introduces a new dashboard capability model rather than fixing a reported existing-behavior failure. The relevant validation is after-fix runtime proof of the new granted and denied flows.

Review metrics: 2 noteworthy metrics.

  • Core Gateway methods: 3 added. The new board.prompt.authorize, board.data.read, and board.action methods extend the public Gateway contract and require compatibility ownership.
  • Capability authority classes: 2 added. Network-origin CSP authority and host-tool authority are independently declared and operator-granted, increasing the review surface beyond ordinary dashboard rendering.

Stored data model
Persistent data-model change detected: persistent cache schema: ui/src/lib/board/provider.mcp-app.test.ts, persistent cache schema: ui/src/lib/board/provider.test.ts, serialized state: src/agents/mcp-app-sandbox.ts, serialized state: src/boards/sqlite-board-codec.ts, serialized state: ui/src/e2e/session-dashboard.e2e.test.ts, unknown-data-model-change: packages/gateway-protocol/src/schema/board.ts, and 2 more. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🦐 gold shrimp
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Attach redacted browser-runtime evidence for a granted network or host-tool action and a denied or revoked action.
  • Refresh the branch against current main and revalidate the exact merge result.
  • Obtain explicit maintainer approval for the new sandbox and Gateway API contract.

Proof guidance:

  • [P1] Needs real behavior proof before merge: The PR body reports Testbox, Chromium, and focused tests, but the supplied PR material has no inspectable redacted recording, terminal/live output, log, or linked artifact directly showing the after-fix granted and denied widget capability flows. Add proof with private endpoints, tokens, and identifiers redacted; updating the PR body should trigger a fresh review, or a maintainer can comment @clawsweeper re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

  • [P1] Merging introduces a new operator-granted browser capability boundary spanning CSP, MessagePort routing, Gateway authorization, and three public core RPCs; tests alone do not establish the real granted and denied behavior or the intended long-term contract.
  • [P1] The branch is currently reported as dirty against main, so the merge result must be rebased or otherwise refreshed before validating the exact landing behavior.

Maintainer options:

  1. Refresh and prove the security boundary (recommended)
    Rebase or otherwise refresh the branch, then attach redacted browser-runtime evidence for a granted network/tool path and a denied or revoked path before merge.
  2. Pause for contract narrowing
    If maintainers do not want these Gateway methods and sandbox-host semantics to become the stable dashboard contract, split or narrow the feature before further merge review.

Next step before merge

  • [P1] This maintainer-labeled feature needs a human decision on the public capability and security contract; missing runtime proof cannot be repaired automatically on the contributor's setup.

Maintainer decision needed

  • Question: Should OpenClaw adopt this shared sandbox and operator-granted widget capability model—including the three new core Gateway methods—as the supported dashboard security contract?
  • Rationale: The patch defines a durable cross-process browser authority boundary and public protocol surface; code review alone cannot determine whether this is the desired product and security contract.
  • Likely owner: steipete — The supplied commits and assignment connect steipete most directly to the proposed dashboard capability design, though current-main ownership evidence was unavailable.
  • Options:
    • Approve the capability contract after proof (recommended): Accept the shared sandbox and new board RPCs once the branch is refreshed and redacted granted/denied runtime evidence confirms the intended containment.
    • Narrow the first release: Limit the initial capability set or keep selected host tools behind the existing per-click interaction flow until the long-term contract is separately approved.

Security
Needs attention: No discrete exploitable defect is established from the supplied diff excerpts, but the new sandbox, CSP, MessagePort, ticket, and Gateway authorization boundary needs explicit security-contract approval and runtime evidence.

Review details

Best possible solution:

Land only after maintainers explicitly approve the dashboard capability and Gateway API contract, the branch is refreshed against current main, and redacted browser-runtime evidence shows both a granted capability path and denial/revocation containment.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR introduces a new dashboard capability model rather than fixing a reported existing-behavior failure. The relevant validation is after-fix runtime proof of the new granted and denied flows.

Is this the best way to solve the issue?

Unclear: the shared-host approach is a plausible consolidation, but the permanent capability and Gateway API contract requires maintainer approval and real browser evidence before it can be judged the best solution.

AGENTS.md: unclear because the file could not be read completely.

Codex review notes: model internal, reasoning high; reviewed against 9056c43368d6.

Label changes

Label changes:

  • add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
  • remove rating: 🧂 unranked krab: Current PR rating is rating: 🦪 silver shellfish, so this older rating label is no longer current.

Label justifications:

  • P2: This is a significant new dashboard and Gateway capability surface, but the supplied evidence does not establish an active urgent regression.
  • merge-risk: 🚨 compatibility: The branch adds three core Gateway methods and protocol/native-client fields that become an ongoing compatibility contract.
  • merge-risk: 🚨 security-boundary: The branch changes sandbox isolation, CSP-derived network authority, ticket-bound messaging, and Gateway-side authorization for untrusted widget code.
  • rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body reports Testbox, Chromium, and focused tests, but the supplied PR material has no inspectable redacted recording, terminal/live output, log, or linked artifact directly showing the after-fix granted and denied widget capability flows. Add proof with private endpoints, tokens, and identifiers redacted; updating the PR body should trigger a fresh review, or a maintainer can comment @clawsweeper re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed

PR surface:

Source +2250, Tests +2110, Docs +21, Other +150. Total +4531 across 68 files.

View PR surface stats
Area Files Added Removed Net
Source 43 2931 681 +2250
Tests 19 2527 417 +2110
Docs 3 30 9 +21
Config 0 0 0 0
Generated 0 0 0 0
Other 3 154 4 +150
Total 68 5642 1111 +4531

Security concerns:

  • [medium] Validate the new sandbox authority boundary in a real browser — src/agents/sandbox-host.ts:1
    The patch centralizes untrusted widget isolation and adds ticket-bound host-tool access; before merge, maintainers need redacted real-browser evidence covering granted authority and denied or revoked authority, not only test assertions.
    Confidence: 0.86

What I checked:

  • New privileged capability boundary: The branch adds declared network origins and tool capabilities to board widgets, then routes authorization through the shared sandbox and Gateway board handlers; this is a new operator-granted authority model rather than a narrow bug repair. (packages/gateway-protocol/src/schema/board.ts:34, 5c7d4f8b8b8a)
  • New core RPC contract: Three new core Gateway methods—board.prompt.authorize, board.data.read, and board.action—are registered with protocol validation and client/native surface updates, so compatibility and ownership need maintainer-visible acceptance. (src/gateway/methods/core-descriptors.ts:443, 5c7d4f8b8b8a)
  • Shared browser security surface: The new shared sandbox host centralizes CSP construction, iframe proxying, and WebRTC guarding for both MCP Apps and dashboard widgets; this consolidation is security-sensitive and warrants browser-runtime proof rather than tests alone. (src/agents/sandbox-host.ts:1, 5c7d4f8b8b8a)
  • Prior review continuity: The latest completed ClawSweeper review had no code findings but required inspectable real behavior proof. The supplied PR body asserts Testbox and Chromium coverage, but the supplied material contains no linked recording, terminal output, redacted log, or artifact that directly demonstrates the granted and denied browser paths. (d4b89d53ff08)
  • Current merge state: The GitHub context reports the branch as dirty against current main, so the exact three-way merge result must be refreshed before any landing decision. (9056c43368d6)

Likely related people:

  • steipete: The supplied PR history attributes all seven branch commits to steipete, and the timeline shows steipete assigned the item; no independent current-main ownership trail was available in the supplied review material. (role: recent area contributor and assigned decision participant; confidence: low; commits: b40fd8be40c7, 5c7d4f8b8b8a; files: src/boards/board-store.ts, src/gateway/server-methods/board.ts, ui/src/lib/board/widget-sandbox-host.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.
Review history (3 earlier review cycles)
  • reviewed 2026-07-20T06:26:33.063Z sha d4b89d5 :: needs real behavior proof before merge. :: none
  • reviewed 2026-07-20T07:08:55.957Z sha d4b89d5 :: needs real behavior proof before merge. :: none
  • reviewed 2026-07-20T08:31:53.007Z sha 5c7d4f8 :: needs real behavior proof before merge. :: none

@steipete
steipete force-pushed the claude/dashboard-capabilities branch from d4b89d5 to 5c7d4f8 Compare July 20, 2026 08:28
@openclaw-barnacle openclaw-barnacle Bot added the scripts Repository scripts label Jul 20, 2026
@steipete steipete self-assigned this Jul 20, 2026
@openclaw-barnacle openclaw-barnacle Bot reopened this Jul 20, 2026
@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels Jul 20, 2026
@steipete
steipete force-pushed the claude/dashboard-capabilities branch from 5c7d4f8 to b972032 Compare July 20, 2026 13:14
@steipete
steipete merged commit 154a49a into main Jul 20, 2026
200 of 203 checks passed
@steipete
steipete deleted the claude/dashboard-capabilities branch July 20, 2026 13:54
@steipete

steipete commented Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

Landed in 154a49a78b050820408fb93d2070acc422944e81 from exact source head 07aeb637811c5a69cdb6cc735e2320ad2b9a5501.

Proof:

  • openclaw/ci-gate passed on exact head 07aeb637811 in CI run 29745837326, attempt 2. The first attempt had two unrelated order/load flakes; both isolated suites passed locally (session-accessor.sqlite-active-events: 8/8, Control UI refresh nudge: 16/16), then the failed CI shards passed on rerun.
  • Blacksmith Testbox tbx_01kxztfe7zbmnppaewartkp7ek passed the sandbox HTTP/CSP, MCP UI resource, and real Chromium dashboard E2E shards (16 tests) on the rebased feature patch. The final landing repair additionally passed 12 focused widget-host tests, targeted lint, docs-map/MDX/format checks, and a clean autoreview.
  • Broad feature evidence was reused because the final delta only removed the labeled best-effort DOM guard, documented the accepted residual, regenerated the docs map, and removed one unused catch binding. It did not change the capability, Gateway RPC, protocol/native, or storage contracts already covered by the recorded 8,176 gateway + 4,906 UI tests, 390-test focused matrix, protocol/native generation, and Linux SDK baseline. The exact-head CI gate supplied the final integration proof after those narrow edits.

Security decision: WebRTC data-channel egress is an explicitly accepted modeled residual. Current Chromium does not implement CSP webrtc 'block'; the same residual already ships for inline chat widgets and the MCP Apps host. Sensitive OpenClaw data reaches widget content only through an operator-granted, byte-frozen data:read capability, while Permissions-Policy blocks camera and microphone. A DOM API guard is defense-in-depth, not the boundary. This decision is documented in docs/web/dashboard-architecture.md and referenced from docs/tools/show-widget.md; operator may veto/gate as follow-up.

@github-actions github-actions Bot mentioned this pull request Jul 20, 2026
Open
@steipete steipete mentioned this pull request Jul 20, 2026
Merged
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 21, 2026
@steipete
feat(dashboard): widget capabilities — net CSP, host tools, hardened …
1571c0c 
…shared sandbox (openclaw#111687)

* feat(boards): enforce widget capability grants

* feat(ui): expose dashboard widget capabilities

* test(dashboard): align rebased gateway contracts

* refactor(dashboard): finish capability alignment

* chore: internalize unused board sandbox exports

* test(dashboard): bind grants to widget instances

* fix(dashboard): close widget authority lifetime gaps

* refactor(ui): preserve modular widget frame ownership

* test(ui): preserve explicit MCP App lease refresh

* test(ui): use shared dashboard sandbox server

* fix(ui): settle widget requests on reconnect

* fix(ui): retry transient widget document loads

* refactor(dashboard): document WebRTC egress residual

* fix(dashboard): clear landing checks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@steipete steipete

Labels

agents Agent runtime and tooling app: android App: android app: web-ui App: web-ui docker Docker and sandbox tooling docs Improvements or additions to documentation gateway Gateway runtime maintainer Maintainer-authored PR merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. P2 Normal backlog priority with limited blast radius. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. scripts Repository scripts size: XL status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@steipete