[codex] Add Control UI sidebar session shortcuts by steipete · Pull Request #82810 · openclaw/openclaw

steipete · 2026-05-17T00:49:14Z

Summary

Move settings-only destinations into the Settings workspace and keep Channels out of the main Control sidebar.
Add recent session shortcuts and a one-click New session action to the sidebar.
Simplify Cron Jobs with collapsed filters, an empty state, and modal job creation while keeping Advanced job available.
Speed up scoped settings pages by letting /communications render from the config snapshot before the schema refresh and by caching burst schema responses.

Real behavior proof

Behavior addressed: Control UI sidebar/navigation cleanup, beginner-friendly Cron Jobs creation, and slow /communications settings load.
Real environment tested: local dev Control UI at http://127.0.0.1:3002 connected to the local OpenClaw gateway.
Exact steps or command run after this patch: Opened http://127.0.0.1:3002/communications in the browser against the running local gateway and inspected the Control UI performance events after reload.
Evidence after fix: Console output from the real dev browser showed control-ui.refresh duration ~902ms and control-ui.render duration 134ms for /communications with activeSection:"messages"; before the patch the same page rendered the heavier Channels settings first and render timing was about 2937ms.
Observed result after fix: /communications became usable in about a second in the real dev UI, while Channels remained available as a tab and as the dedicated /channels page.
What was not tested: a live authenticated gateway cron add through the real browser session, because the headless browser lacks the local gateway token and hit the login/protocol gate.

Verification

Exact steps or command run after this patch: OPENCLAW_VITEST_MAX_WORKERS=1 pnpm test src/gateway/server-methods/config.test.ts ui/src/ui/app-settings.refresh-active-tab.node.test.ts ui/src/ui/views/config.browser.test.ts -- --reporter=verbose --testTimeout=15000
Observed result after fix: gateway config cache tests and UI settings/config tests passed, including the deferred schema rejection regression.
Exact steps or command run after this patch: OPENCLAW_VITEST_MAX_WORKERS=1 pnpm test ui/src/i18n/test/translate.test.ts -- --reporter=verbose --testTimeout=15000
Observed result after fix: UI shard passed, including shipped-locale structural parity for the new cron strings.
Exact steps or command run after this patch: pnpm check:changed in Testbox run tbx_01krszrfxwxwga3q37y67vse26
Observed result after fix: changed gate passed in Testbox.
Exact steps or command run after this patch: git diff --check && node scripts/check-changelog-attributions.mjs
Observed result after fix: whitespace and changelog attribution checks passed.
Exact steps or command run after this patch: /Users/steipete/Projects/agent-scripts/skills/codex-review/scripts/codex-review --mode branch
Observed result after fix: codex-review clean; no accepted/actionable findings.

clawsweeper · 2026-05-17T00:50:23Z

Codex review: needs real behavior proof before merge.

Summary
The branch reorganizes Control UI settings/sidebar navigation, adds sidebar recent-session and new-session shortcuts, simplifies Cron Jobs creation, defers scoped settings schema refreshes, and adds a short-lived gateway config schema cache.

Reproducibility: yes. for the review findings: current PR head source shows the time-only schema cache feeding redaction, the sidebar helper reading persisted collapse state instead of rendered navCollapsed, and non-English cron locale entries still in English. I did not run the UI or gateway in this read-only review.

Real behavior proof
Needs stronger real behavior proof before merge: The PR body has copied /communications timing output, but it does not demonstrate the visible sidebar shortcuts or Cron creation flow, and live authenticated cron add is explicitly untested. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, ask a maintainer to comment @clawsweeper re-review.

Next step before merge
Protected maintainer-labeled PR with a security-sensitive schema-cache finding and insufficient real behavior proof needs author or maintainer update before merge.

Security
Needs attention: The diff introduces a config-redaction risk by caching schema uiHints on a fixed TTL without validating schema inputs.

Review findings

[P1] Key schema cache to schema inputs — src/gateway/server-methods/config.ts:281-288
[P2] Use rendered collapse state for sidebar sessions — ui/src/ui/app-render.ts:266-269
[P3] Regenerate translated cron strings — ui/src/i18n/locales/de.ts:1221-1259

Review details

Best possible solution:

Keep the PR open until the schema cache is keyed to real schema inputs or removed, sidebar sessions use the computed rendered collapse state, locale output is regenerated correctly, and proof covers the visible sidebar and Cron flows.

Do we have a high-confidence way to reproduce the issue?

Yes for the review findings: current PR head source shows the time-only schema cache feeding redaction, the sidebar helper reading persisted collapse state instead of rendered navCollapsed, and non-English cron locale entries still in English. I did not run the UI or gateway in this read-only review.

Is this the best way to solve the issue?

No. The UI direction may be acceptable, but the schema cache should use a real schema/config fingerprint or be removed, and sidebar rendering should reuse the computed collapse state.

Full review comments:

[P1] Key schema cache to schema inputs — src/gateway/server-methods/config.ts:281-288
The new cache returns a previous ConfigSchemaResponse for five seconds without checking whether runtime config or plugin metadata changed outside these write handlers. Because config.get redacts snapshots with schema.uiHints, stale hints can miss newly sensitive plugin-defined fields; key the cache to schema/config identity or remove it.
Confidence: 0.86
[P2] Use rendered collapse state for sidebar sessions — ui/src/ui/app-render.ts:266-269
When the saved sidebar preference is collapsed and the drawer is opened, the shell uses a drawer-aware navCollapsed value but the new session shortcut renderer still reads the persisted setting. That hides the New session label and recent sessions while the rest of the drawer is expanded; pass the computed value into the helper and cover this case.
Confidence: 0.9
[P3] Regenerate translated cron strings — ui/src/i18n/locales/de.ts:1221-1259
The generated locale bundle marks the new cron strings as translated, but the non-English bundle still shows English copy. Rerun or fix the i18n generation so shipped non-English locales do not display these new cron labels in English.
Confidence: 0.78

Overall correctness: patch is incorrect
Overall confidence: 0.88

Security concerns:

[medium] Avoid stale schema redaction hints — src/gateway/server-methods/config.ts:281
Config snapshot redaction depends on schema.uiHints; caching the schema response for five seconds without detecting runtime config or plugin metadata changes can temporarily expose fields that newly became sensitive.
Confidence: 0.82

What I checked:

Protected PR state: Provided GitHub context shows this PR is open, unmerged, based on current main, and labeled maintainer, app: web-ui, gateway, impact:session-state, and impact:security; cleanup should keep it open for review rather than close it. (d15acd41c224)
PR head keeps a time-only schema cache: Current PR head returns a cached ConfigSchemaResponse until expiresAtMs without checking schema/config/plugin metadata identity, then config.get redacts snapshots with the cached schema.uiHints. (src/gateway/server-methods/config.ts:281, d15acd41c224)
Current main intentionally avoids this cache: Current main directly calls loadGatewayRuntimeConfigSchema() and documents that this path cannot easily be cached without invalidation callbacks. (src/gateway/server-methods/config.ts:261, 422a1374e02b)
Schema inputs include runtime config and plugin metadata: loadGatewayRuntimeConfigSchema() builds schema data from getRuntimeConfig() plus the current or loaded plugin metadata registry, so schema hints are tied to runtime/plugin state. (src/config/runtime-schema.ts:25, 422a1374e02b)
Redaction depends on schema hints: redactConfigSnapshot() documents that provided uiHints determine sensitivity and passes those hints through to object/raw redaction. (src/config/redact-snapshot.ts:401, 422a1374e02b)
Sidebar helper ignores rendered drawer collapse state: PR head computes drawer-aware navCollapsed for the shell, but renderSidebarSessions() still reads state.settings.navCollapsed, so a drawer opened from a saved-collapsed preference hides the new session label and recent sessions. (ui/src/ui/app-render.ts:266, d15acd41c224)

Likely related people:

vincentkoc: Current-main blame for the gateway config schema loader and the Control UI drawer-aware collapse state points to commit d62e443 authored by Vincent Koc; older provenance is limited in this checkout. (role: recent area contributor; confidence: medium; commits: d62e443b36c3; files: src/gateway/server-methods/config.ts, ui/src/ui/app-render.ts)

Remaining risk / open question:

I did not run the UI or gateway in this read-only review; the findings are source-inspection based.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 422a1374e02b.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3074d394ac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-05-17T04:14:04Z

+  if (configSchemaResponseCache && configSchemaResponseCache.expiresAtMs > now) {
+    return configSchemaResponseCache.response;


Invalidate cached schema when config changes externally

This cache returns a previously computed ConfigSchemaResponse for up to 5 seconds without checking whether schema inputs changed outside config.set/config.patch/config.apply (for example, manual config edits or plugin/runtime metadata refreshes). During that window, config.get and config.schema can use stale uiHints, and redaction in redactConfigSnapshot(..., schema.uiHints) may miss newly sensitive plugin-defined fields. Please key this cache to a schema/config version signal (or snapshot hash) instead of time-only reuse.

Useful? React with 👍 / 👎.

steipete · 2026-05-17T05:06:57Z

Verification before merge:

Behavior addressed: Control UI sidebar/session/settings/cron simplification and Communications load-speed work.
Real environment tested: local macOS dev checkout plus GitHub Actions on PR head d15acd4.
Exact steps or command run after this patch:

/Users/steipete/Projects/agent-scripts/skills/codex-review/scripts/codex-review --mode branch
pnpm ui:build && pnpm ui:i18n:check
OPENCLAW_VITEST_MAX_WORKERS=1 pnpm test extensions/telegram/src/message-cache.test.ts -- --reporter=verbose --testTimeout=15000
git diff --check
Evidence after fix: GitHub check rollup clean for PR head d15acd4; run 25981897808 has check/check-lint/check-prod-types/check-test-types/build-artifacts success.
Observed result after fix: PR is MERGEABLE/CLEAN with no blocking checks.
What was not tested: no fresh manual browser screenshot after the final rebase; earlier browser proof covered the visible Control UI flows.

* feat(control-ui): add sidebar session shortcuts * fix(control-ui): simplify cron job creation * style(control-ui): pad settings config chrome * fix(control-ui): fold cron advanced creation into dialog * fix(control-ui): filter sidebar recent sessions * fix(control-ui): clean up chat loading state * fix(control-ui): add settings nav content gutter * fix(control-ui): inherit settings nav icon color * fix(control-ui): polish sidebar new session button * fix(control-ui): speed up communications settings load * fix(control-ui): add cron strings to locale maps * fix(control-ui): refresh i18n metadata for sidebar strings * fix(control-ui): refresh chat raw-copy baseline

openclaw-barnacle Bot added app: web-ui App: web-ui size: L maintainer Maintainer-authored PR labels May 17, 2026

clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. P2 Normal backlog priority with limited blast radius. labels May 17, 2026

openclaw-barnacle Bot added size: XL and removed size: L labels May 17, 2026

clawsweeper Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 17, 2026

github-actions Bot mentioned this pull request May 17, 2026

🦞 OpenClaw 生态日报 2026-05-17 ivanweng2077/big_model_radar#55

Open

clawsweeper Bot added the impact:session-state Session, memory, transcript, context, or agent state can drift or corrupt. label May 17, 2026

openclaw-barnacle Bot added the gateway Gateway runtime label May 17, 2026

steipete marked this pull request as ready for review May 17, 2026 04:07

chatgpt-codex-connector Bot reviewed May 17, 2026

View reviewed changes

clawsweeper Bot added the impact:security Security boundary, credential, authz, sandbox, or sensitive-data risk. label May 17, 2026

steipete force-pushed the codex/control-ui-sidebar-sessions branch from bf5296a to 0be57a0 Compare May 17, 2026 04:44

openclaw-barnacle Bot added the channel: telegram Channel integration: telegram label May 17, 2026

steipete added 13 commits May 17, 2026 05:59

feat(control-ui): add sidebar session shortcuts

6319981

fix(control-ui): simplify cron job creation

3bcfb61

style(control-ui): pad settings config chrome

b699ec6

fix(control-ui): fold cron advanced creation into dialog

5e8e1d1

fix(control-ui): filter sidebar recent sessions

6b8de6c

fix(control-ui): clean up chat loading state

84c1ad5

fix(control-ui): add settings nav content gutter

e1aede8

fix(control-ui): inherit settings nav icon color

cef506a

fix(control-ui): polish sidebar new session button

e30b265

fix(control-ui): speed up communications settings load

f9770ff

fix(control-ui): add cron strings to locale maps

1b53080

fix(control-ui): refresh i18n metadata for sidebar strings

8234429

fix(control-ui): refresh chat raw-copy baseline

d15acd4

steipete force-pushed the codex/control-ui-sidebar-sessions branch from ac1306f to d15acd4 Compare May 17, 2026 05:01

openclaw-barnacle Bot removed the channel: telegram Channel integration: telegram label May 17, 2026

steipete merged commit 84ec0c2 into main May 17, 2026
116 of 117 checks passed

steipete deleted the codex/control-ui-sidebar-sessions branch May 17, 2026 05:07

This was referenced May 17, 2026

fix(ui-cron): keep new-job form in normal flow #47582

Closed

ui: fix cron workspace form sticky offset using CSS variable #55978

Closed

feat(session-sidebar): improve UX - context meter, New Chat button, 7-day history #61176

Closed

This was referenced Jun 19, 2026

fix(ui): change silent cron quick-create sessionTarget to isolated #95074

Closed

fix(ui): set payloadKind to systemEvent for silent cron preset (fixes #95073) #95097

Closed

fix(cron): set sessionTarget to isolated for silent quick-create preset #95115

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

[codex] Add Control UI sidebar session shortcuts#82810

[codex] Add Control UI sidebar session shortcuts#82810
steipete merged 13 commits into
mainfrom
codex/control-ui-sidebar-sessions

steipete commented May 17, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 17, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot May 17, 2026

Uh oh!

steipete commented May 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		if (configSchemaResponseCache && configSchemaResponseCache.expiresAtMs > now) {
		return configSchemaResponseCache.response;

Uh oh!

Uh oh!

Conversation

steipete commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Real behavior proof

Verification

Uh oh!

clawsweeper Bot commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 17, 2026

Choose a reason for hiding this comment

Uh oh!

steipete commented May 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

steipete commented May 17, 2026 •

edited

Loading

clawsweeper Bot commented May 17, 2026 •

edited

Loading