From 1b01a0a018ab1ea2825c6fa6dadeaf72ec9f095b Mon Sep 17 00:00:00 2001 From: Rui He Date: Wed, 22 Jul 2026 09:07:39 -0400 Subject: [PATCH] fix(fleetdash): theme the tool-use reveal button + high-contrast value rows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The reveal button rendered as a raw browser default (off-theme) and the decrypted value cells used .t (var(--dim)), so the payload was low-contrast gray. Now: - .cwbtn: a themed action button (cyan --accent border/text, panel-tint bg, hover glow) matching the dashboard's cyberpunk theme. - .cwvals rows: keys in --ink, values in near-white #eaf2f9 semibold (right- aligned) — the payload reads clearly; step header in --accent, sha in --dim. Rendering stays textContent-only (no XSS sink); proxy/endpoint behavior unchanged. Co-Authored-By: Claude Fable 5 --- infra/tool/fleetdash.py | 34 +++++++++++++++++++++++++--------- 1 file changed, 25 insertions(+), 9 deletions(-) diff --git a/infra/tool/fleetdash.py b/infra/tool/fleetdash.py index d35cff2..2679e17 100644 --- a/infra/tool/fleetdash.py +++ b/infra/tool/fleetdash.py @@ -514,6 +514,18 @@ def render_text(results, feed, risk, limit=40): .asof{color:var(--dim);font-size:11px;white-space:nowrap} .asof .lag{color:var(--push)} .pausebtn{font:12px var(--mono);padding:2px 9px;background:var(--panel);border:1px solid var(--line); border-radius:6px;color:var(--dim);cursor:pointer} .pausebtn.on{color:var(--push);border-color:var(--push)} + /* tier-2 tool-use reveal: a themed action button + high-contrast decrypted-value rows */ + .cwbtn{font:12px var(--mono);padding:5px 13px;background:rgba(57,208,216,.07);border:1px solid var(--accent); + border-radius:6px;color:var(--accent);cursor:pointer;letter-spacing:.03em;transition:background .15s,box-shadow .15s} + .cwbtn:hover{background:rgba(57,208,216,.15);box-shadow:0 0 0 1px var(--accent),0 0 12px rgba(57,208,216,.22)} + .cwvals{margin-top:8px} + .cwvals .cwstep{margin:12px 0 3px;color:var(--accent);font-weight:600;letter-spacing:.03em} + .cwvals .cwsha{color:var(--dim);font-weight:400;margin-left:6px;font-size:11px} + .cwvals .cwerr{color:var(--reject);margin:2px 0} + .cwvals table{width:100%;border-collapse:collapse} + .cwvals td{padding:3px 8px;border-bottom:1px solid var(--line);vertical-align:top} + .cwvals .cwk{color:var(--ink);white-space:nowrap;padding-right:18px} + .cwvals .cwv{color:#eaf2f9;font-weight:600;text-align:right;word-break:break-all} .tzwrap{color:var(--dim);font-size:11px;display:flex;align-items:center;gap:5px} .tzwrap select{background:var(--panel);color:var(--ink);border:1px solid var(--line);border-radius:5px; font:11px var(--mono);padding:2px 4px} @@ -1142,15 +1154,19 @@ def _values_reveal_script(): 'out.textContent="";var steps=(d&&d.steps)||[];' 'if(!steps.length){out.textContent="no recorded values for this run";return}' 'steps.forEach(function(s){' - 'var h=document.createElement("div");h.style.marginTop="8px";' - 'var t=document.createElement("b");t.textContent="step "+s.step+" · "+(s.values_sha||"").slice(0,16);' - 'h.appendChild(t);' - 'var tbl=document.createElement("table");var body=document.createElement("tbody");' - 'var vv=s.values||{};if(s.error){var er=document.createElement("div");er.className="no";' + 'var h=document.createElement("div");' + 'var t=document.createElement("div");t.className="cwstep";' + 't.textContent="step "+s.step;' + 'var sh=document.createElement("span");sh.className="cwsha";' + 'sh.textContent=(s.values_sha||"").slice(0,16);t.appendChild(sh);h.appendChild(t);' + 'if(s.error){var er=document.createElement("div");er.className="cwerr";' 'er.textContent="decrypt error: "+s.error;h.appendChild(er)}' + 'var tbl=document.createElement("table");var body=document.createElement("tbody");' + 'var vv=s.values||{};' 'Object.keys(vv).sort().forEach(function(k){var tr=document.createElement("tr");' - 'var kd=document.createElement("td");kd.textContent=k;var vd=document.createElement("td");' - 'vd.className="t";vd.textContent=String(vv[k]);tr.appendChild(kd);tr.appendChild(vd);' + 'var kd=document.createElement("td");kd.className="cwk";kd.textContent=k;' + 'var vd=document.createElement("td");vd.className="cwv";vd.textContent=String(vv[k]);' + 'tr.appendChild(kd);tr.appendChild(vd);' 'body.appendChild(tr)});tbl.appendChild(body);h.appendChild(tbl);out.appendChild(h)})' '}).catch(function(e){out.textContent="fetch failed: "+e})});' '})();') @@ -1257,8 +1273,8 @@ def prob_line(p): 'exact declared, non-secret inputs into the value-free chain. The values themselves are ' 'encrypted at rest (tier-2 ledger); reveal decrypts them live on the node with its ' 'recipient key (secrets never recorded — they stay *_FILE pointers).

' - f'' - '
' + f'' + '
' + _values_reveal_script()) if any_values else "") + flow + _card("claim & approval",