Skip to content

fix: show complete skill instructions in Workshop comparisons - #140300

Merged
obviyus merged 2 commits into
mainfrom
codex/workshop-full-document
Sep 7, 2026
Merged

obviyus merged 2 commits into
mainfrom
codex/workshop-full-document

Conversation

@obviyus

@obviyus obviyus commented Sep 6, 2026 •

Copy link
Copy Markdown
Collaborator

What Problem This Solves

Workshop skill comparisons showed short edit snippets instead of complete instructions, and late changes in long skills could disappear.

Why This Change Was Made

Use the existing diff library for full-document comparison with the shared escaped renderer. Run comparison off the main browser thread and keep current instructions readable while it loads; remove shortened-result and duplicate-document fallbacks.

User Impact

Users can read all instructions, blank lines, additions, and removals in one scrollable view. Frontmatter and supporting files remain outside comparisons; no storage or settings change.

Evidence

Packaged Gateway/browser checks reproduced shortened baseline views and verified complete 41-, 700-, and 3,800-line documents after repair. All four complete-document browser cases and 78 focused UI checks passed. A synthetic large rewrite reduced maximum frame gaps from 1.30–1.43 seconds to 0.167–0.183 seconds; it exceeds normal proposal-creation limits. Failure/retry checks kept current content readable.

@clawsweeper

clawsweeper Bot commented Sep 6, 2026 •

Copy link
Copy Markdown
Contributor

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation app: web-ui App: web-ui labels Sep 6, 2026
@obviyus
obviyus marked this pull request as ready for review September 6, 2026 16:57
@obviyus
obviyus requested a review from a team as a code owner September 6, 2026 16:57
@openclaw-barnacle openclaw-barnacle Bot added size: L maintainer Maintainer-authored PR labels Sep 6, 2026
@github-actions

github-actions Bot commented Sep 6, 2026

Copy link
Copy Markdown
Contributor

Dependency Guard

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

  • pnpm-lock.yaml
  • ui/package.json

Maintainer follow-up:

  • Review whether the dependency changes are intentional.
  • Inspect resolved package deltas when lockfiles or workspace dependency policy changes are present.
  • Treat pnpm-lock.yaml and package-lock.json diffs as dependency security-review surfaces.
  • Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

@github-actions github-actions Bot added the dependencies-changed PR changes dependency-related files label Sep 6, 2026
@github-actions

github-actions Bot commented Sep 6, 2026 •

Copy link
Copy Markdown
Contributor

Dependency graph changes are blocked

OpenClaw does not accept dependency graph changes through PRs unless a repository admin or security explicitly authorizes the current head SHA. Dependency updates are generated internally by maintainers so external PRs cannot change the resolved graph.

Detected dependency graph changes:

  • pnpm-lock.yaml changed.
  • ui/package.json changed dependencies.

Auto-scrub was not attempted because this PR changes package manifest dependency graph fields:

  • ui/package.json changed dependencies.

Dependency graph changes must be reviewed by security or handled by maintainers internally. Please remove lockfile changes manually if they are not needed.

To remove lockfile changes, restore them from the target branch:

git fetch origin
git checkout 'origin/main' -- 'pnpm-lock.yaml'
git commit -m 'chore: remove dependency lockfile change'
git push

If this PR intentionally needs a dependency graph change, ask a repository admin or member of @openclaw/openclaw-secops to comment:

/allow-dependencies-change

The action will approve the current head SHA (06159ccf6c9d5fc555efd46f5c674b2670505d96) when it reruns. A later push requires a fresh approval.

@clawsweeper clawsweeper Bot added P2 Normal backlog priority with limited blast radius. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Sep 6, 2026
@clawsweeper

clawsweeper Bot commented Sep 6, 2026 •

Copy link
Copy Markdown
Contributor

Codex review: blocked before merge. Reviewed September 6, 2026, 10:01 PM ET / September 7, 2026, 02:01 UTC.

ClawSweeper review

What this changes

Workshop compares complete saved and current skill instructions in a browser worker, preserves blank lines, and keeps current instructions readable while comparisons load.

Merge readiness

⛔ Blocked before merge - 4 items remain

The fix remains useful: current main still produces shortened Workshop comparisons. No actionable code defect was found, and the retained packaged-Gateway proof is sufficient; the remaining hold is verification of the dependency and restricted-path authorization.

Priority: P2
Reviewed head: 06159ccf6c9d5fc555efd46f5c674b2670505d96
Owner decision: Required. See Decision needed.

Review scores

Measure Result What it means
Overall readiness 🐚 platinum hermit (4/6) A focused repair with strong retained product evidence and useful regression coverage; approval verification does not reduce patch quality.
Proof confidence 🦞 diamond lobster (5/6) Sufficient (live_output): Retained packaged-Gateway observations exercise Workshop reads, saved-version comparisons, pending content, and successful worker loading, showing complete 41/700/3,800-line results. The central implementation blobs match the previously reviewed head; image retrieval failed on the reviewer side and does not invalidate that runtime evidence.
Patch quality 🐚 platinum hermit (4/6) No actionable review findings were identified.

Verification

Check Result Evidence
Real behavior Verified Sufficient (live_output): Retained packaged-Gateway observations exercise Workshop reads, saved-version comparisons, pending content, and successful worker loading, showing complete 41/700/3,800-line results. The central implementation blobs match the previously reviewed head; image retrieval failed on the reviewer side and does not invalidate that runtime evidence.
Evidence reviewed 8 items Current main still uses bounded comparisons: At fetched main, readSkillWorkshopInstalledSkill still calls computeLineDiff with compactUnchanged enabled. The shared preview limits comparison inputs to 600 lines and rendered output to 400 lines; this PR's complete-document behavior remains distinct.
Complete comparison and guarded publication: The introduced implementation compares complete normalized instruction bodies, retains applied-version matching, and checks inventory, read identity, agent, and client before publishing progress or completed results. Failed comparisons retain readable current content.
Retained real product proof: The captured PR body, sourceRevision c29af18e5de055a4dfc9c364d29e547beead9c260e12ed998d58a22703a7ff9b, reports CI-packaged baseline 7e9a841 versus candidate aa1f00123196485467974c81da7dc5a513d88872. Real CLI-created saved versions and Gateway reads produced exactly 41, 700, and 3,800 current rows; pending content remained readable and the packaged worker returned HTTP 200. This is runtime evidence beyond screenshots or mocked tests. Linked before/after images could not be retrieved by this reviewer.
Findings None None.
Security None None.

How this fits together

The Workshop page reads installed skills and retained applied proposals from the Gateway. It compares their instruction bodies and displays changes for operators reviewing their skills.

flowchart LR
  A[Installed skill] --> C[Workshop reader]
  B[Saved applied proposals] --> C
  C --> D[Validate matching skill]
  D --> E[Browser comparison worker]
  C --> F[Readable current instructions]
  E --> G[Complete inline comparison]
Loading

Decision needed

Question Recommendation
Does the recorded current-head approval satisfy restricted lockfile ownership policy, and is the UI diff importer authorized under the dependency guard? Verify and reconcile the existing approval: Confirm qualifying listed-owner involvement or active organization-owner authority and reconcile dependency authorization for the current head.

Why: The newer approval addresses the prior hold, but its qualifying authority could not be verified and the captured dependency guard remains blocked.

Before merge

  • Resolve merge risk (P1) - The current-head owner-review approval is recorded, but qualifying restricted-path authority and dependency-guard authorization remain unverified.
  • Resolve merge risk (P1) - The reviewer could not retrieve the linked before/after images; the retained runtime observations remain accepted, but the captures were not independently inspected.
  • Complete next step (P2) - Verify the recorded current-head approval against restricted-path ownership policy and reconcile authorization for the UI dependency importer.
  • Resolve maintainer decision - Resolve the maintainer decision shown above before merge.
Agent review details

Security

None.

PR surface

Source +99, Tests +139, Docs +2, Config +1, Other +3. Total +244 across 19 files.

View PR surface stats
Area Files Added Removed Net
Source 12 191 92 +99
Tests 4 224 85 +139
Docs 1 7 5 +2
Config 1 1 0 +1
Generated 0 0 0 0
Other 1 3 0 +3
Total 19 426 182 +244

Review metrics

Metric Value Why it matters
Dependency scope 1 UI importer added; 0 new resolved versions The dependency change exposes an already-pinned package to its importing workspace without introducing a new package resolution.

Merge-risk options

Maintainer options:

  1. Decide the mitigation before merge
    Retain the complete-document worker implementation and shared safe renderer, with the intentional UI dependency importer covered by verified repository authorization.
  2. Pause or close
    Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Retain the complete-document worker implementation and shared safe renderer, with the intentional UI dependency importer covered by verified repository authorization.

Do we have a high-confidence way to reproduce the issue?

Yes: current main's compacted, capped comparison path explains omitted instructions and late edits; the retained packaged baseline observations corroborate it. No runtime reproduction was executed in this review.

Is this the best way to solve the issue?

Yes: a Workshop-specific complete comparison using the existing pinned library preserves bounded chat previews and reuses the safe renderer without adding settings or storage changes.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 77f62904ae7c.

Labels

Label justifications:

  • P2: This repairs incomplete Workshop instruction comparisons with a limited UI blast radius.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): Retained packaged-Gateway observations exercise Workshop reads, saved-version comparisons, pending content, and successful worker loading, showing complete 41/700/3,800-line results. The central implementation blobs match the previously reviewed head; image retrieval failed on the reviewer side and does not invalidate that runtime evidence.
  • proof: sufficient: Contributor real behavior proof is sufficient. Retained packaged-Gateway observations exercise Workshop reads, saved-version comparisons, pending content, and successful worker loading, showing complete 41/700/3,800-line results. The central implementation blobs match the previously reviewed head; image retrieval failed on the reviewer side and does not invalidate that runtime evidence.

Evidence

What I checked:

  • Current main still uses bounded comparisons: At fetched main, readSkillWorkshopInstalledSkill still calls computeLineDiff with compactUnchanged enabled. The shared preview limits comparison inputs to 600 lines and rendered output to 400 lines; this PR's complete-document behavior remains distinct. (ui/src/pages/skill-workshop/proposals.ts, 77f62904ae7c)
  • Complete comparison and guarded publication: The introduced implementation compares complete normalized instruction bodies, retains applied-version matching, and checks inventory, read identity, agent, and client before publishing progress or completed results. Failed comparisons retain readable current content. (ui/src/pages/skill-workshop/proposals.ts:169, 06159ccf6c9d)
  • Retained real product proof: The captured PR body, sourceRevision c29af18e5de055a4dfc9c364d29e547beead9c260e12ed998d58a22703a7ff9b, reports CI-packaged baseline 7e9a841 versus candidate aa1f00123196485467974c81da7dc5a513d88872. Real CLI-created saved versions and Gateway reads produced exactly 41, 700, and 3,800 current rows; pending content remained readable and the packaged worker returned HTTP 200. This is runtime evidence beyond screenshots or mocked tests. Linked before/after images could not be retrieved by this reviewer. (aa1f00123196)
  • Proof continuity across the refresh: Git tree entries match between the previously reviewed head and current head for the comparison function, worker owner, worker entrypoint, proposal controller, collection renderer, and shared highlight directive. The retained package proof is therefore relevant without claiming it was built from the refreshed head. The earlier type-index blob was unavailable for a full historical content comparison. (ui/src/lib/skill-workshop/diff-worker.ts:11, 06159ccf6c9d)
  • Dependency and rendering security: The manifest and lockfile add one UI importer for existing diff 9.0.0 without changing its resolved package or integrity. The worker is a bundled same-origin module, permitted by existing worker-src 'self'. Diff text remains escaped, and the Markdown fallback retains sanitization and disabled remote images. (ui/package.json:40, 06159ccf6c9d)
  • Approval disposition needs verification: The newer approval at fix: show complete skill instructions in Workshop comparisons #140300 (comment) explicitly covers owner-review for the current head. The captured dependency guard still reports blocked at that same head. CODEOWNERS assigns pnpm-lock.yaml to openclaw/openclaw-secops; root policy accepts organization-owner direction only with verified active organization-admin membership. Live membership and permission reads failed to connect, so the approval's qualifying authority could not be established here. (.github/CODEOWNERS:27, 06159ccf6c9d)

Likely related people:

  • obviyus: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
  • steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
  • openclaw/openclaw-secops: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (4 earlier review cycles)
  • reviewed 2026-09-06T17:05:06.456Z sha 6db8f65 :: blocked before merge. :: none
  • reviewed 2026-09-06T17:28:41.339Z sha 6db8f65 :: blocked before merge. :: none
  • reviewed 2026-09-06T17:39:43.261Z sha 6db8f65 :: blocked before merge. :: none
  • reviewed 2026-09-06T18:02:30.591Z sha 6db8f65 :: blocked before merge. :: none

@obviyus

obviyus commented Sep 6, 2026

Copy link
Copy Markdown
Collaborator Author

Recording Ayaan's explicit approval to land this PR's intentional dependency change at head 6db8f651cef34329de3762ae08419a733c7166f6.

The change adds the UI importer for the already-pinned diff 9.0.0 package; it introduces no new resolved version. Ayaan explicitly approved the security merge after the lockfile-owner hold was reported.

This approval does not waive required CI, the local review gate, or the remaining packaged-Gateway browser proof. It is not a claim of secops membership or a /allow-dependencies-change command.

@clawsweeper clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Sep 6, 2026
@obviyus

obviyus commented Sep 7, 2026

Copy link
Copy Markdown
Collaborator Author

landpr-approve-admin-merge
pr: 140300
head: 06159cc
scope: owner-review

@obviyus
obviyus merged commit 52dd662 into main Sep 7, 2026
163 of 164 checks passed
@obviyus
obviyus deleted the codex/workshop-full-document branch September 7, 2026 02:09
@obviyus

obviyus commented Sep 7, 2026

Copy link
Copy Markdown
Collaborator Author

Landed as 52dd6629 with green required CI and a clean exact-head ClawSweeper review.

Proof: The packaged Workshop reader shows complete skill instructions with inline changes, including blank lines and late edits. The fresh independent review found no code or security issues and accepted the retained packaged proof for the type-only refresh.

Before After
The reader omitted unchanged instructions and late changes. The reader preserves all instructions in one scrollable comparison.
A large comparison blocked reading until it finished. Current instructions remain readable while the browser worker compares versions.
  • Reviewed source: 06159cc.
  • Required CI: https://github.com/openclaw/openclaw/actions/runs/34074522408.
  • Admin merge uses Ayaan's exact-head approval for the procedural security-owner review hold on the existing diff importer. This is not a claim of security-team membership and does not waive code findings, security concerns, product proof or CI.
  • The earlier hosted review could not retrieve the images. The fresh local review inspected the retained packaged before/after screenshots and complete 41/700-line observations; no further rank-up moves remain.
  • All 78 focused UI tests passed after the type-only conflict resolution. Existing packaged proof keeps its original build identity; no production deployment was performed.

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Sep 7, 2026
…aw#140300)

Show complete skill instructions with inline changes in one scrollable Workshop reader. Reuse the pinned diff library and shared escaped renderer, with off-thread comparisons and readable current content while saved versions load.

Remove clipped-preview state and the duplicate-document fallback. Preserve blank lines, saved-version ownership checks, and stale-read fencing.

Verified baseline/candidate browser behavior, large rewrites, worker failure recovery, independent acceptance, focused tests, and exact-head review.

Co-authored-by: Ayaan Zaidi <hi@obviy.us>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

app: web-ui App: web-ui dependencies-changed PR changes dependency-related files docs Improvements or additions to documentation maintainer Maintainer-authored PR P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: L status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant