Best possible solution:

Keep the ephemeral Activity tab design, but harden preview redaction and regression coverage for common secret formats before merging the user-visible feature.

Do we have a high-confidence way to reproduce the issue?

Yes, source inspection gives a high-confidence reproduction path: emit a session.tool result whose text contains OPENAI_API_KEY=... or GITHUB_TOKEN=... and the current redactor will not match that prefixed key name before storing the preview.

Is this the best way to solve the issue?

No, not yet; reusing session.tool for an ephemeral browser-local tab is a maintainable shape, but the output-preview redaction boundary needs broader coverage before this is the best mergeable solution.

Full review comments:

• [P1] Redact prefixed secret names before previewing output — ui/src/ui/activity-model.ts:45-46
  The redactor only matches bare names like token= or api_key= because the key pattern starts at a word boundary. Common tool output such as OPENAI_API_KEY=..., GITHUB_TOKEN=..., or AWS_SECRET_ACCESS_KEY=... will still be stored and rendered in outputPreview, so broaden this coverage and add regression tests before exposing previews.
  Confidence: 0.92

Overall correctness: patch is incorrect
Overall confidence: 0.9

Codex review notes: model gpt-5.5, reasoning high; reviewed against deb54b5dab08.

Label justifications:

• P2: This is a normal-priority Control UI feature with limited surface area, but the output-preview redaction gap needs fixing before merge.
• merge-risk: 🚨 security-boundary: The PR creates a new UI path that renders tool output previews, so incomplete redaction can expose credentials or sensitive paths.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🦞 diamond lobster and patch quality is 🧂 unranked krab.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (live_output): The PR body includes after-fix browser smoke proof against a local fake Gateway event shape plus focused tests and Testbox changed-check proof.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix browser smoke proof against a local fake Gateway event shape plus focused tests and Testbox changed-check proof.

PR surface:

Source +2273, Tests +274, Docs +9. Total +2556 across 76 files.

Security concerns:

• [high] Prefixed secret names are not redacted — ui/src/ui/activity-model.ts:45
  The current key regex misses common prefixed environment variable secret names while the feature renders redacted tool-result previews in the browser.
  Confidence: 0.92

Acceptance criteria:

• node scripts/run-vitest.mjs ui/src/ui/app-tool-stream.node.test.ts ui/src/ui/views/activity.test.ts
• git diff --check
• node scripts/crabbox-wrapper.mjs run --provider blacksmith-testbox --blacksmith-workflow .github/workflows/ci-check-testbox.yml --blacksmith-job check --shell -- "pnpm check:changed"

What I checked:

• Activity model stores sanitized output previews: The PR adds buildOutputPreview() and stores its redacted/truncated text as outputPreview on ActivityEntry, so redaction coverage is the security boundary for anything rendered in the new tab. (ui/src/ui/activity-model.ts:119, 0aa9aa421151)
• Secret redaction gap: The key-name regex is anchored to a word boundary before bare names like token or api_key, which does not cover common prefixed environment variable names such as OPENAI_API_KEY, GITHUB_TOKEN, or AWS_SECRET_ACCESS_KEY. (ui/src/ui/activity-model.ts:45, 0aa9aa421151)
• Activity hooks into existing tool delivery: The PR calls updateActivityFromToolEvent() from the existing handleAgentEvent() tool stream path after session filtering, avoiding a new Gateway event family. (ui/src/ui/app-tool-stream.ts:677, 0aa9aa421151)
• Existing session.tool contract: Current Gateway code already mirrors tool lifecycle events to session.tool subscribers, matching the PR's stated choice to reuse existing delivery. (src/gateway/server-chat.ts:988, 9db04a27eb20)
• Focused tests cover some redaction cases: The new tests cover bearer headers, bare token=..., and absolute path redaction, but they do not cover prefixed secret environment variable names. (ui/src/ui/app-tool-stream.node.test.ts:328, 0aa9aa421151)
• Real behavior proof in PR body: The PR body reports a local Vite Control UI browser smoke against a fake Gateway WebSocket emitting session.tool, plus focused Vitest runs, git diff --check, and Blacksmith Testbox changed-check run tbx_01ksen33c79b8rywayf6cxww4r. (0aa9aa421151)

Likely related people:

• vincentkoc: Blame on the current Control UI tool stream and Gateway event flow points to the recent runtime chunk split that owns much of the surrounding UI/gateway path. (role: recent area contributor; confidence: high; commits: 8bf4f7d4a88d; files: ui/src/ui/app-tool-stream.ts, ui/src/ui/app-gateway.ts, src/gateway/server-chat.ts)
• galiniliev: Recent session.tool history shows work on Gateway session-tool mirroring and backoff behavior, which is the event source this PR consumes. (role: adjacent gateway event contributor; confidence: high; commits: 42bdc949f297; files: src/gateway/server-chat.ts, src/gateway/server-chat.agent-events.test.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

• Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
• The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
• Hatchability usually comes from sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness. A merged PR is already final, so merge makes the egg hatchable independently.
• The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
• Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.