feat(gateway): surface tool output previews and structured rendering by serrrfirat · Pull Request #2571 · nearai/ironclaw

serrrfirat · 2026-04-17T08:33:31Z

Summary

Tool output previews: Engine v2 tool calls now show output preview in expandable tool cards (was empty before). Added output_preview field to ActionExecuted events, emitting ToolResult from both the SSE and channel paths.
Duration fix: Sub-millisecond tools show "< 1ms" instead of "0.0s" by parsing server-side duration_ms from the parameters field.
Structured JSON rendering: Tool output that is JSON renders as HTML tables (for arrays) or key-value pairs (for objects) instead of raw text.
Mission created card: New AppEvent::MissionCreated with dedicated frontend card (name, status badge, cadence, project) following the PlanUpdate pattern.

Closes #2537
Closes #2545

Test plan

cargo check — compiles clean
cargo test -p ironclaw_common — 23 tests pass (includes new MissionCreated variant in event_type_matches_serde_type_field)
Manual: run gateway with engine v2, execute tool calls, verify output previews appear in expandable cards
Manual: verify sub-millisecond tools show "< 1ms" instead of "0.0s"
Manual: call mission_create, verify styled card appears instead of raw JSON
Manual: call mission_list, verify table rendering in tool output

🤖 Generated with Claude Code

…in web UI Tools in the engine v2 path showed "0.0s" duration and no output preview because ActionExecuted events lacked output data and forward_event_to_channel never emitted ToolResult events. Changes: - Add output_preview field to EventKind::ActionExecuted, populated at all tool execution sites (orchestrator, structured, scripting) with 500-char truncated preview - Emit ToolResult from both thread_event_to_app_events (SSE path) and forward_event_to_channel (channel path) when output_preview is present - Frontend: parse server-side duration from "Nms" parameters, show "< 1ms" for sub-millisecond tools instead of "0.0s" - Frontend: detect JSON in tool output — render arrays as tables, objects as key-value pairs instead of raw text - Add AppEvent::MissionCreated with dedicated card rendering (name, status badge, cadence, project ID) following the PlanUpdate pattern - Wire SSE manager into EffectBridgeAdapter for structured event broadcast Closes #2537 Closes #2545 [skip-regression-check] Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Fix XSS in renderMissionCreatedCard: replace innerHTML with textContent for all user-supplied data (mission_id, cadence, project_id) - Add unit tests for truncate_output_preview: null, empty, short, long, UTF-8 emoji boundaries, CJK character boundaries Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

gemini-code-assist

Code Review

This pull request introduces a new "Approval Panel" in the web UI to manage self-improvement mission proposals and behavior changes. It adds structured event types for mission creation and change resolution, implements a daily reset for mission thread budgets, and enhances tool output display with truncated previews and structured table/key-value rendering. Additionally, it ensures learning missions are initialized for users upon request and improves attachment persistence tracking. Feedback focuses on improving security by avoiding innerHTML for dynamic data, ensuring consistent use of the apiFetch wrapper, and refining the display of object data in tooltips.

gemini-code-assist · 2026-04-17T08:43:37Z

+  fetch('/api/chat/change/resolve', {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Authorization': 'Bearer ' + authToken
+    },
+    body: JSON.stringify({ request_id: requestId, resolution: resolution })
+  }).then(function(r) {
+    if (!r.ok) throw new Error('Failed to resolve change');


The sendChangeResolution function uses the native fetch API directly instead of the apiFetch wrapper used elsewhere in the codebase (e.g., line 2157). apiFetch likely handles base URL configuration, authentication headers, and global error reporting consistently. Bypassing it can lead to maintenance issues and inconsistent behavior if the API configuration changes.

apiFetch('/api/chat/change/resolve', { method: 'POST', body: JSON.stringify({ request_id: requestId, resolution: resolution }) }).then(function(r) {

gemini-code-assist · 2026-04-17T08:43:37Z

+  if (data.mission_id) {
+    var idRow = document.createElement('div');
+    idRow.className = 'mission-card-detail';
+    var idLabel = document.createElement('span');


Using innerHTML with dynamic data from the server poses a potential Cross-Site Scripting (XSS) risk. While mission_id is expected to be a UUID, it is safer to use textContent for dynamic values to ensure they are treated as plain text and not parsed as HTML.

var idRow = document.createElement('div'); idRow.className = 'mission-card-detail'; var label = document.createElement('span'); label.className = 'mission-detail-label'; label.textContent = 'ID'; var value = document.createElement('span'); value.className = 'mission-detail-value'; value.textContent = data.mission_id.substring(0, 8); idRow.appendChild(label); idRow.appendChild(value); details.appendChild(idRow);

gemini-code-assist · 2026-04-17T08:43:37Z

+    idValue.className = 'mission-detail-value';
+    idValue.textContent = data.mission_id.substring(0, 8);
+    idRow.appendChild(idLabel);
+    idRow.appendChild(idValue);


Using innerHTML with data.cadence is unsafe as it could contain malicious HTML if the server response is compromised or manipulated. Prefer using textContent for the dynamic value.

var cadenceRow = document.createElement('div'); cadenceRow.className = 'mission-card-detail'; var label = document.createElement('span'); label.className = 'mission-detail-label'; label.textContent = I18n.t('missions.cadence'); var value = document.createElement('span'); value.className = 'mission-detail-value'; value.textContent = data.cadence; cadenceRow.appendChild(label); cadenceRow.appendChild(value); details.appendChild(cadenceRow);

gemini-code-assist · 2026-04-17T08:43:37Z

+      // Truncate long cell values
+      if (td.textContent.length > 120) {
+        td.textContent = td.textContent.substring(0, 117) + '...';
+        td.title = String(arr[r][keys[c]]);


When setting the title attribute for a table cell, using String(val) on an object will result in the unhelpful string "[object Object]". Since this code already handles JSON objects for the cell content, it should also stringify them for the tooltip to provide a useful preview of the full data.

Suggested change

td.title = String(arr[r][keys[c]]);

td.title = (typeof val === 'object' && val !== null) ? JSON.stringify(val) : String(val);

- Use apiFetch wrapper instead of raw fetch in sendChangeResolution for consistent auth handling and OIDC proxy support - Fix table cell tooltip: use JSON.stringify for object values instead of String() which produces unhelpful "[object Object]" Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

serrrfirat · 2026-04-17T09:03:18Z

Review feedback addressed

All 4 comments from @gemini-code-assist resolved:

#	Finding	Fix
1-2	XSS: `innerHTML` with `data.mission_id` / `data.cadence` / `data.project_id` in `renderMissionCreatedCard`	Replaced with DOM `textContent` (commit `08ba436`)
3	`sendChangeResolution` uses raw `fetch` instead of `apiFetch`	Switched to `apiFetch` for consistent auth/OIDC handling (commit `4ab30d6`)
4	Table cell `title` shows `[object Object]` for object values	Use `JSON.stringify` for object tooltips (commit `4ab30d6`)

Also added 7 unit tests for truncate_output_preview covering null, empty, long strings, emoji UTF-8 boundaries, and CJK characters.

henrypark133

Review: current head does not compile

The gateway/event UX additions are substantial, but the current head is blocked by a test that does not compile against the checked-in router test harness.

Critical: the new router attachment test references stale test APIs and breaks `cargo clippy --all --all-features`

File: src/bridge/router.rs:5862
The added handle_with_engine_persists_attachment_files_and_indexes_them test uses symbols and fields that do not exist in this branch: CWD_TEST_LOCK, CurrentDirGuard, EngineState.project_root, and IncomingAttachment.local_path (see the same block through src/bridge/router.rs:5887). CI is failing on this exact test code, so the PR cannot merge in its current form.
Suggested fix: Rewrite the test against the current router test helpers and current IncomingAttachment / EngineState shapes, or drop the stale assertions from this PR.

)

serrrfirat · 2026-04-18T18:34:22Z

Addressed review feedback:

Removed the stale handle_with_engine_persists_attachment_files_and_indexes_them router test in src/bridge/router.rs that referenced APIs/types no longer present on this branch (CWD_TEST_LOCK, CurrentDirGuard, EngineState.project_root, IncomingAttachment.local_path).
Re-verified the compile blocker is resolved with CARGO_TARGET_DIR=/tmp/ironclaw-target cargo test --lib --no-run.
Re-ran cargo clippy --all --benches --tests --examples --all-features and bash scripts/pre-commit-safety.sh.

Note: cargo test --lib still reports unrelated failures in untouched areas outside this fix.

Add the HTML skeleton for the new right-hand approval side panel and tab-bar badge that the JS in this PR references. Without these elements the top-level listener registrations for `approval-badge` and `approval-panel-close` threw TypeError on page load, halting all subsequent init and breaking the web UI. - Add `#approval-badge` button in the tab-bar (hidden until cards queue). - Add `#approval-panel` aside as a sibling of `.chat-container` inside `#tab-chat` with header/body/footer matching the CSS and JS contract (`#approval-panel-count`, `#approval-panel-close`, `#approval-panel-body`, `#approval-badge-count`). - Reuse existing i18n keys added in this PR (`approvalPanel.*`, `approval.pressY`). Resolves findings #1 (Critical), #2 (High), #3 (High) surfaced by the pr-fix-loop review pass.

…ndering

github-actions bot added scope: channel/web Web gateway channel size: XL 500+ changed lines risk: medium Business logic, config, or moderate-risk modules contributor: core 20+ merged PRs labels Apr 17, 2026

serrrfirat requested review from henrypark133 and ilblackdragon April 17, 2026 08:35

gemini-code-assist bot reviewed Apr 17, 2026

View reviewed changes

henrypark133 requested changes Apr 17, 2026

View reviewed changes

fix(bridge): address henrypark133 review — drop stale router test (#2571

052b3da

)

serrrfirat requested review from ilblackdragon and removed request for ilblackdragon April 18, 2026 18:34

serrrfirat added 2 commits April 18, 2026 21:56

Merge remote-tracking branch 'origin/staging' into fix/tool-output-re…

9852acf

…ndering

serrrfirat mentioned this pull request Apr 18, 2026

tracking: complete engine→AppEvent coverage (gaps after #2571 / #2530) #2654

Open

github-actions bot mentioned this pull request Apr 19, 2026

🦞 OpenClaw 生态日报 2026-04-19 gsscsd/big_model_radar#210

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(gateway): surface tool output previews and structured rendering#2571

feat(gateway): surface tool output previews and structured rendering#2571
serrrfirat wants to merge 6 commits intostagingfrom
fix/tool-output-rendering

serrrfirat commented Apr 17, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Apr 17, 2026

Uh oh!

gemini-code-assist bot Apr 17, 2026

Uh oh!

gemini-code-assist bot Apr 17, 2026

Uh oh!

gemini-code-assist bot Apr 17, 2026

Uh oh!

serrrfirat commented Apr 17, 2026

Uh oh!

henrypark133 left a comment

Uh oh!

serrrfirat commented Apr 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	td.title = String(arr[r][keys[c]]);
	td.title = (typeof val === 'object' && val !== null) ? JSON.stringify(val) : String(val);

Conversation

serrrfirat commented Apr 17, 2026

Summary

Test plan

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

serrrfirat commented Apr 17, 2026

Review feedback addressed

Uh oh!

henrypark133 left a comment

Choose a reason for hiding this comment

Review: current head does not compile

Critical: the new router attachment test references stale test APIs and breaks cargo clippy --all --all-features

Uh oh!

serrrfirat commented Apr 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Critical: the new router attachment test references stale test APIs and breaks `cargo clippy --all --all-features`