[bkudiess]

What Problem This Solves

Read agent-created boards and reports in Companion without opening the browser for routine viewing.

User Impact

User impact: a standalone, pinnable Dashboards reader provides an agent-scoped searchable/sortable gallery, tabs, live refresh, native reports/charts/tables, ticketed HTML (including HTML-only boards), website links and Open chat.

This is not a builder or a replacement for the web Control UI. Editing, permission grants, privileged widget actions and MCP-app hosting remain web-only; unsupported states stay explicit. Open in web opens the web gallery, not the exact board; Copy session key supplies its stable identity. That route is source-verified upstream, not proved against an installed Gateway.

Existing custom and explicitly empty pin choices survive. Scopes with no saved choice default to Dashboards; an old empty choice erased by an earlier release cannot be recovered, so those users must unpin once.

Why This Change Was Made

Keep daily board consumption native without chasing the web editor. Static gallery cards avoid per-card board requests and WebViews; websites use validated external links, while saved HTML remains readable in the bounded sandbox host. The gallery loads at most 5,000 rows and shows loaded counts honestly. See reader contracts and limits.

Feature contribution by @bkudiess; subsequent integration/readiness work preserves that contribution.

Evidence

Candidate b1e1e6f passed Build and Test, attempt 1, including required CI Gate, and CodeQL, attempt 1. Native, Tray and fixture logs identify tested merge 390c858, parents 9d36f5c + b1e1e6f, whose tree ab0da767ec53969b11c4963dac804ce6270c18df equals the candidate tree.

Independent implementation/proof-plan rubber-duck reviews covered inset ownership, retained state, responsive report layout and native capture prerequisites. The historical 108-path Opus/Astra review at 4851 found defects subsequently repaired, not a clean whole-head verdict. Separate bounded P0-P3 reviews covered all ten integration conflicts and this owner-fence implementation/proof plan, with no findings. No new whole-head dual or independent security review is claimed.

The owner repair rejects unfinished old-connection HTML at queued completion and final delivery, including before a deferred view update. Acknowledged same-document WebViews and valid selected/visited tabs remain; a changed Gateway origin replaces the document. No additional authorization RPC or blanket page remount was added. All five new native boundary cases passed.

The temporary shared reader-timeout observer only appends bounded diagnostics to existing failures. Original assertions/deadlines remain; passing CI does not establish a root-cause fix for the prior reader-top flake.

Change Type

• Bug fix
• Feature
• Refactor
• Docs or instructions
• Tests or validation
• Security hardening
• Chore or infrastructure

Scope

• Tray or WinUI UX
• Windows node capability
• Local MCP or winnode
• Gateway, connection, or pairing
• Setup or onboarding
• Permissions, privacy, or security
• Tests, CI, or docs

Required proof pools

• windows-winui-interactive: navigation, focus, layout, scrolling, widget states and accessibility. Current candidate has hosted x64 mounted and real-app fixture proof, including the five owner/HTTP/bridge cases; this is not complete Windows 11 ARM64 or production Release/High Contrast acceptance.
• windows-11-arm64: native ARM64 WebView2/runtime behavior. Merged-source UI compilation passed; complete current-head Debug/production-shaped Release runtime acceptance is not verified.
• windows-wsl-gateway-e2e: real board-read/ticket authority and installed-Gateway web handoff remain unverified. Generic hosted WSL results and synthetic board fixtures do not close this boundary.

Validation

Local commands ran against a frozen isolated clone matching the b1e1e6f candidate (2,409 source hashes), with fresh test builds and isolated settings roots. $ownedResults denotes that run's task-owned output directory, with its private absolute location redacted.

Recorded invocation	Executed result
.\build.ps1	All 5 targets passed
dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-build --no-restore --blame-hang --blame-hang-timeout 5m --blame-hang-dump-type none --logger "trx;LogFileName=Shared.trx" --results-directory "$ownedResults"	5,615 passed, 28 ordinary opt-in skips, 0 failed
dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-build --no-restore --blame-hang --blame-hang-timeout 5m --blame-hang-dump-type none --logger "trx;LogFileName=Tray.trx" --results-directory "$ownedResults" --filter "FullyQualifiedName!=OpenClaw.Tray.Tests.SettingsManagerIsolationTests.OpenClawTrayDataDirRedirectsSettingsAwayFromRealAppData"	6,126 passed, 0 skipped/failed; partial local run
dotnet build .\tests\OpenClaw.Tray.UITests\OpenClaw.Tray.UITests.csproj -c Debug -p:UseSharedCompilation=false -nodeReuse:false -m:2 -r win-arm64 -p:DevBuild=false -p:RequireSignedCleanupHost=false	0 warnings/errors; compilation only, no native execution or signing claim

The excluded case independently reads normal OS-roaming settings. It was privacy-blocked locally, with no repository/CI filter change. The new tab-state-without-old-content regression and origin-bound document identity assertion passed. Documentation, skill and skill-validator checks passed.

Current-head hosted lane	Raw result
Native UI	1,136 passed, 9 policy skips, 0 failed; all 119 Dashboard mounted cases passed, including 5/5 new owner/ticket/hostile-port cases with no skips
Unfiltered Tray	6,127/6,127 plus 31/31 Dev cases; the exact locally privacy-blocked case passed in both. This does not retroactively make the local run unfiltered
Gateway fixture	108/108 UI, 55/55 profile, 1/1 released-profile, no skips; all four Dashboard real-app scenarios passed

Hosted wrapper invocations

These recorded invocations and their expanded execution are retained in the linked job logs.

./scripts/Invoke-CiTest.ps1 -Project tests/OpenClaw.Tray.UITests -ResultsDirectory TestResults\TrayUI -TrxFileName OpenClaw.Tray.UITests.trx -Runtime win-x64 -Filter "Category!=Accessibility&Category!=NativeOnboardingProof&Category!=GatewayFixture&Category!=AnimationPreferenceEnabled&Category!=AnimationPreferenceDisabled" -HangTimeoutSeconds 300 -CollectNativeFailureMetadata -CaptureHostExit
./scripts/Invoke-CiTest.ps1 -Project tests/OpenClaw.Tray.Tests -ResultsDirectory TestResults\Tray -TrxFileName OpenClaw.Tray.Tests.trx -Runtime win-x64
./scripts/test-gateway-fixture.ps1 -AppPath .\src\OpenClaw.Tray.WinUI\bin\Debug\net10.0-windows10.0.22621.0\win-x64\OpenClaw.Tray.WinUI.exe -ArtifactsDirectory .\TestResults\GatewayFixture -TestTimeoutSeconds 1200 -Screenshots -NativeInputProof -NoBuild

Real Behavior Proof

• Environment tested: local Windows ARM64 managed/build validation and hosted Windows x64 native UI plus isolated synthetic Gateway fixtures.
• PR head or commit tested: b1e1e6f; hosted merge390c8586, identical treeab0da767 as recorded above.
• Exact steps or command run: full local commands and hosted wrapper invocations above; job logs retain expanded execution.
• Evidence after fix: actual HTTP rejection and authorized recovery; genuine proxy-ready messages arriving after connection change but before held Reactor updates; completed-document/tab retention; real transferred MessagePort closure and no privileged host effects.
• Observed result: all five new native cases passed without skips, broader Dashboard119 and real-app4 passed, full hosted Tray including the privacy case passed.
• Screenshot or artifact links verified? (Yes/No/N/A) Yes: the three linked jobs' uploaded test artifacts were downloaded and raw TRX inspected. This is artifact/result verification, not a new manual screenshot acceptance.
• Not verified or blocked: real Gateway authorization/revocation traces and installed web handoff; complete current-head ARM64 Release/High Contrast/signed-installed upgrade acceptance. Synthetic native tests do not establish these boundaries. No executed pre-fix native failure is claimed.

Security Impact

• New permissions or capabilities? (Yes/No) No native grants, node commands or widget actions.
• Secrets or tokens handling changed? (Yes/No) Yes: short-lived Gateway view tickets are consumed for HTML reads.
• New or changed network calls? (Yes/No) Yes: board/session reads, ticketed HTML and the Gateway sandbox.
• Command or tool execution surface changed? (Yes/No) No: the reader does not execute widget bridge actions or host MCP apps.
• Data access scope changed? (Yes/No) Yes: boards/reports from the active authenticated Gateway are displayed.
• If any answer is Yes, explain the risk and mitigation: treat HTML as untrusted. Validate content-specific origins/routes, enforce size/time bounds, disable document redirects/cookies and loopback proxy inheritance, isolate WebView storage, check relay source/origin, close offered ports, and retain visible pending/rejected/unsupported states. Each delivery starts a fresh render-ack deadline. The pinned upstream contract rechecks authorization immediately before returning HTTP bytes, not continuously until rendering; there is no separate render-revalidation RPC. Windows separately fences unfinished work against local owner changes. Five passing synthetic native cases cover rejected fetches, connection replacement and hostile port disposal; real-Gateway traces remain unverified.

Compatibility and Migration

• Backward compatible? (Yes/No) Yes for preserved settings/pin choices; board rendering requires the supported Gateway board contract and reports unsupported/failure states explicitly.
• Config or environment changes? (Yes/No) Yes: Dashboards becomes the default pin only for scopes with no saved choice; no new user environment variable is required.
• Migration needed? (Yes/No) No manual data migration.
• If yes, list the exact upgrade steps: N/A. Old releases could erase empty pin choices; affected users can unpin once to save an explicit empty list. Synthetic schema-v1 pin tests are not a signed installed-upgrade proof.

Review Conversations

• I replied to or resolved every bot review conversation addressed by this PR.
• I left unresolved only conversations that still need maintainer judgment.

Live refresh at b1e1e6f found zero inline threads; no formal approval or bot reply is implied. The durable old-head ClawSweeper review was substantively reconciled against current source and executed proof: deadline fixed; obsolete hero test removed; icon tests unchanged from main; fetch-time authorization distinguished from the repaired and natively tested local owner fence; compatibility and live-Gateway limits retained above.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

Adds a native dashboard gallery and read-only board viewer with reports, ticketed HTML widgets, browser links, and sidebar navigation.

Example: The main agent has an Ops overview board showing 99.97% uptime and 128 closed tickets.

• Before: Users read the board in the Gateway web interface.
• After: Users can open the board from Companion's Dashboards page and read its HTML and native report widgets.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	Useful owner-directed feature with repaired prior findings, but a recovery defect and unresolved authority evidence prevent readiness.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Product

Kind: Feature · Worth it: Yes · Fix scope: Complete
User problem: Windows users lack a native place to find and read agent-created boards.
Reason: The collaborator-authored direction supplies a focused reader, deliberately deferring editing and privileged actions to the existing web interface.

Merge readiness

⛔ Blocked before merge - 5 items remain

Keep this maintainer-authored feature open: the native reader remains absent from main, and a widget recovery defect needs repair before merging.

Priority: P2
Reviewed head: e14d1ae8ba01b7e5380e75f0eb787375818703b2

Before merge

• Add real behavior proof - Authority-chain proof required: the inspected screenshots demonstrate an earlier native implementation, and the full body explicitly leaves current-candidate proof open. Supply current-head native reader evidence and real Gateway traces showing the intended ticket reaches its sandbox, another session's or revoked ticket cannot deliver HTML, and hostile bridge offers cause no host effects; redact credentials, IPs and non-public endpoints. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.
• Restart the render deadline when delivering a retried document (P2) - When the sandbox becomes ready but document fetching takes longer than the initial deadline through a timeout or repeated 503 responses, the one-shot timer fires with _proxyReady=true and _renderId=null and does nothing. A later successful retry reaches DeliverDocument, which assigns a render ID without restarting the timer. If that document never produces sandbox-resource-loaded, for example because an allowed resource stalls its load, the card stays in the Slow spinner without the intended error and Retry action. Arm the render deadline at delivery and cover late fetch recovery followed by a missing acknowledgement. This logic was already visible at previously reviewed head 5c9e960 and was missed in that review.
• Resolve security concern: Verify authority at the document-delivery boundary - Origin validation and closing bridge ports support isolation, but the supplied evidence does not establish that another session's ticket or revoked access cannot deliver HTML into the sandbox; no concrete bypass is claimed.
• Resolve merge risk - Before merge, the author must resolve whether board-ticket authority remains valid at sandbox delivery after access is revoked or reassigned.
• Add data-model compatibility proof - The review found that existing stored data may not work after upgrade. Show that existing data still loads and works with this change.

Findings

• [P2] Restart the render deadline when delivering a retried document — src/OpenClaw.Tray.WinUI/Dashboards/BoardWidgetWebHost.cs:378-381
• [medium] Verify authority at the document-delivery boundary — src/OpenClaw.Tray.WinUI/Dashboards/BoardWidgetWebHost.cs:381

Tests

• Low-value test tests/OpenClaw.Tray.Tests/Dashboards/DashboardModelsTests.cs: Remove BackdropResource_FadesVerticallyToTransparentBeforeItsBottom: DashboardHeroBrush has no production consumer after adoption of PageHero, so this test protects retired presentation.
• Low-value test tests/OpenClaw.Tray.Tests/Presentation/PageHeroIconCatalogTests.cs: Remove the duplicate catalog URI cases already covered by WorkspaceSettingsLayoutTests.HeroIcon_ReusesExistingSidebarAsset and the source-expression assertion that only pins page.IconUri spelling.
• Missing end-to-end proof: Current-head native rendering, delayed-document timeout recovery, real Gateway allowed/denied/revoked ticket delivery, and latest-stable pin upgrade behavior are not demonstrated.

Agent review details

How this fits together

Workspace hosts the reader; authenticated Gateway session and board responses become native cards and reports, while ticketed HTML passes through a separate-origin WebView2 sandbox.

flowchart LR
Workspace --> DashboardsPage
DashboardsPage --> GatewayClient
GatewayClient --> Gateway
GatewayClient --> NativeReports
GatewayClient --> DocumentLoader
DocumentLoader --> WebViewSandbox

Loading

Technical review

Best possible solution:

Keep the reader on existing Gateway and Workspace owners, and arm a fresh render deadline whenever the widget host delivers HTML.

Do we have a high-confidence way to reproduce the issue?

The timeout defect is traceable through document retries, the one-shot deadline and late delivery; no target code was executed during this read-only review.

Is this the best way to solve the issue?

The bounded native reader is a reasonable feature using existing navigation and connection owners; recovery needs a delivery-scoped deadline, and obsolete or duplicate test coverage should be removed.

Full review comments:

• [P2] Restart the render deadline when delivering a retried document — src/OpenClaw.Tray.WinUI/Dashboards/BoardWidgetWebHost.cs:378-381
  When the sandbox becomes ready but document fetching takes longer than the initial deadline through a timeout or repeated 503 responses, the one-shot timer fires with _proxyReady=true and _renderId=null and does nothing. A later successful retry reaches DeliverDocument, which assigns a render ID without restarting the timer. If that document never produces sandbox-resource-loaded, for example because an allowed resource stalls its load, the card stays in the Slow spinner without the intended error and Retry action. Arm the render deadline at delivery and cover late fetch recovery followed by a missing acknowledgement. This logic was already visible at previously reviewed head 5c9e960 and was missed in that review.
  Confidence: 0.9
  Late finding: first raised on code an earlier review cycle already covered.

Overall correctness: patch is incorrect
Overall confidence: 0.88

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 1c223f14f6b6.

Merge-risk options

Maintainer options:

1. Verify the retained HTML boundary (recommended)
   The author supplies production-path authorization evidence before the ticketed HTML reader lands.
2. Defer HTML hosting
   Keep the PR draft, or narrow the reader to native reports and browser handoff until the HTML boundary is verified.

Provenance checked

• Sidebar pin defaults and persistence changes intended behavior with a stated reason (7967d50: Provide local, per-Gateway shortcuts to selected native pages while preserving stored choices.)
• Reactor dependency and Markdown adaptation changes intended behavior with a stated reason (a4dd026: Preview.16 supplied the upstream session-switch crash workaround and Markdown layout; the PR explicitly adopts official preview.17 and adapts its link callback.)
• Schema-guided Config layout keeps the original intent (9de9b5b: Provide schema navigation, permission-aware editing, JSON preview and a persistent save workflow; the adaptive changes retain these controls and state.)
• Gateway fixture cleanup keeps the original intent (3e74082: Explore the real app with isolated synthetic Gateway data and owned-process cleanup; added browser cleanup retains that ownership boundary.)
• Session model-change logging keeps the original intent (cd4acf0: Track session model changes; detached gallery parsing now avoids logging an initial assignment as a change without altering the assigned model.)

Testing

Proof path: unit tests only.

Security

Needs attention: Source isolation controls are present, but final-delivery ticket authorization remains unverified.

Evidence

Security concerns:

• [medium] Verify authority at the document-delivery boundary — src/OpenClaw.Tray.WinUI/Dashboards/BoardWidgetWebHost.cs:381
  Origin validation and closing bridge ports support isolation, but the supplied evidence does not establish that another session's ticket or revoked access cannot deliver HTML into the sandbox; no concrete bypass is claimed.
  Confidence: 0.98

What I checked:

• Pinned introduction and main behavior: The pinned main-to-head diff introduces the native Dashboards owners and route; main's existing pin catalog has no Dashboards destination. (src/OpenClaw.Tray.WinUI/Presentation/PinnedPages.cs:35, e14d1ae8ba01)
• Previous findings repaired: Loopback document requests now select a no-proxy client, and gallery owners subscribe to authoritative SessionsUpdated events with coalescing and disposal fences. (src/OpenClaw.Shared/Dashboards/BoardWidgetDocumentLoader.cs:65, e14d1ae8ba01)
• Render deadline can expire before delivery: The deadline is one-shot and does nothing when the proxy is ready but no render is pending; later document delivery assigns a render ID without restarting that deadline. (src/OpenClaw.Tray.WinUI/Dashboards/BoardWidgetWebHost.cs:378, e14d1ae8ba01)
• Late finding verified: The delivery and deadline logic is unchanged from the previously reviewed head; blame attributes these lines to the initial feature commit. (src/OpenClaw.Tray.WinUI/Dashboards/BoardWidgetWebHost.cs:374, 21bc4ae1f820)
• Proof inspected: The full REST body and discussion were read, and all four prepared screenshots were inspected locally. They show earlier native gallery, board, empty and disconnected states; the body explicitly identifies them as historical and leaves current-candidate native and Gateway authorization proof outstanding. (e14d1ae8ba01)
• Current-head CI support: REST check metadata showed successful Core/CLI, Tray/setup/integration, packaging and WSL E2E checks, with UI/accessibility still running and security jobs skipped. These checks do not establish the changed board-ticket authority path. A later metadata refresh was blocked by the network proxy. (.github/workflows/ci.yml, e14d1ae8ba01)

Likely related people:

• Barbara Kudiess: Raw commit 7967d50 adds src/OpenClaw.Tray.WinUI/Presentation/PinnedPages.cs:26 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 7967d509886f; files: src/OpenClaw.Tray.WinUI/Presentation/PinnedPages.cs)

Preflight source

Source unknown. Source comparison at the observed PR snapshot only. Completion is self-reported; body, policy, tests, execution, and report bytes are not verified.

Review metrics

Metric	Value	Why it matters
Source and test delta	src +7489/-111; tests +6662/-198	The new reader spans protocol, native rendering and sandbox lifetimes, which justify distinct policy, transport and mounted-control coverage.

Labels

Label changes:

• add merge-risk: 🚨 compatibility: Pin defaults and empty-list persistence change upgrade behavior; the author explicitly accepts defaulting previously erased choices, but upgrade proof remains incomplete.
• add proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence.

Label justifications:

• P2: This is an optional native reading feature with a contained widget recovery defect.
• merge-risk: 🚨 security-boundary: Ticketed board HTML crosses from the authenticated Gateway into a separate-origin sandbox, with final-effect authorization unresolved.
• merge-risk: 🚨 compatibility: Pin defaults and empty-list persistence change upgrade behavior; the author explicitly accepts defaulting previously erased choices, but upgrade proof remains incomplete.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Add final-effect proof for another session's ticket and prove revocation invalidates delivery before sandbox I/O.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (1 earlier review cycle)

• reviewed 2026-10-27T19:16:35.679Z sha 5c9e960 :: needs real behavior proof before merge. :: [P1] [P1] Keep loopback widget tickets off the process proxy | [P2] [P2] Refresh dashboard rows when their sessions change

Reviewed November 9, 2026, 6:09 PM ET / 23:09 UTC (Revision 2).

[bkudiess]

Current dashboard UI proof: 14 owned-window captures in Light and Dark from the real ARM64 app against synthetic read-only boards. Windows OCR verifies rendered HTML (99.97% uptime), native reports, approval/error copy and tab states; Axe scans cover the populated gallery and board. The focused run executed 3 tests with zero failures/skips, including same-origin website cookie/localStorage isolation. These captures use the production source at 5c9e960, unchanged under src/ by ee9a20f (the follow-up adds proof tests/harness only). This is not a high-contrast, real-Gateway, process-crash or working-MCP-app proof claim. The MCP app shown is the explicitly deferred Step 3 placeholder.

[bkudiess]

Updated native dashboard proof: working HTML, native report and public HTTPS website widget; Light/Dark, production-shaped ARM64 Release, and real Windows Aquatic contrast mode. Visual inspection exposed a fixture SVG using a background token for ink. The added pixel guard failed before the fixture-only fix (luminance range 2, required 64) and passed afterward (216–223) in both app themes. No app/framework workaround was added. Windows was restored to None after approval. Debug selected proof: 4 passed, 0 skipped; Release fixture: 1 passed, 0 skipped; contrast fixture: 1 passed, 0 skipped (each fixture case exercises two themes). Website content comes from the reserved public documentation page, in a fresh private profile, not a production Gateway. MCP apps shown in the separate tabs captures remain Step 3 placeholders.

[roboclaw-bot]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/42718297141
• Updated: 2026-11-09T23:11:01.295Z