fix(tui): separate configuration summaries from full diagnostics

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

Author: johntmyers

.agents/skills/tui-development/SKILL.md

@@ -170,7 +170,7 @@ Phase 1: GetSandboxLogs  →  500 initial lines  →  send via Event::LogLines
 Phase 2: WatchSandbox(follow_logs: true)  →  live tail  →  send via Event::LogLines
 ```
 
-**Sandboxes**: Fetched via `ListSandboxes` in a background collection-refresh task scheduled from the 2-second tick, scoped to the current workspace (or all workspaces). Follow `next_page_token` until empty so the dashboard reflects the complete collection. The NOTES column puts active `ConfigurationInvalid` readiness diagnostics before port forwards and clears them on refresh after repair. Timed-out provisioning attempts show `Provisioning timed out` with cleanup pending or compute reclaimed, preserving port forwards. The sandbox detail pane uses the same Notes field.
+**Sandboxes**: Fetched via `ListSandboxes` in a background collection-refresh task scheduled from the 2-second tick, scoped to the current workspace (or all workspaces). Follow `next_page_token` until empty so the dashboard reflects the complete collection. The NOTES column summarizes active `ConfigurationInvalid` readiness conditions as `inspect for config` before port forwards and clears the note on refresh after repair. Full diagnostics remain available through `openshell sandbox get <name> -o json`. Timed-out provisioning attempts show `Provisioning timed out` with cleanup pending or compute reclaimed, preserving port forwards. The sandbox detail pane wraps the full configuration error in its Notes field.
 
 **Providers**: Fetched via `ListProviders` in the background collection-refresh task. Provider profiles are fetched per-workspace via `ListProviderProfiles` and cached in a `ProviderProfileCache` keyed by `(workspace, profile_id)`. Follow each list RPC's `next_page_token` until empty.
 

architecture/sandbox.md

@@ -630,8 +630,10 @@ default.
 The gateway tracks configuration admission independently of compute health.
 A blocked startup remains `Provisioning` with a `ConfigurationInvalid` readiness
 condition, even when the container backend reports readiness. Gateway management
-operations remain available. The TUI exposes configuration rejection conditions
-in sandbox NOTES alongside active port forwards. Replacing the policy or repairing providers allows
+operations remain available. The TUI summarizes configuration rejection in sandbox
+NOTES alongside active port forwards; the detail view wraps the full diagnostic,
+which is also available through sandbox inspection.
+Replacing the policy or repairing providers allows
 the same supervisor to reconcile and launch; it does not recreate the sandbox.
 Startup retries continue reporting readiness, but unchanged configuration rejections
 produce only one log event. A changed configuration or diagnostic emits a new

crates/openshell-tui/src/app.rs

@@ -657,6 +657,7 @@ pub struct App {
     pub sandbox_created: Vec<String>,
     pub sandbox_images: Vec<String>,
     pub sandbox_notes: Vec<String>,
+    pub sandbox_detail_notes: Vec<String>,
     /// Formatted labels for each sandbox (e.g., "env=prod,team=platform" or empty string).
     pub sandbox_labels: Vec<String>,
     /// Formatted annotations for each sandbox (e.g., "policy-signature=abc" or empty string).
@@ -1019,6 +1020,7 @@ impl App {
             sandbox_created: Vec::new(),
             sandbox_images: Vec::new(),
             sandbox_notes: Vec::new(),
+            sandbox_detail_notes: Vec::new(),
             sandbox_labels: Vec::new(),
             sandbox_annotations: Vec::new(),
             sandbox_workspaces: Vec::new(),
@@ -3528,6 +3530,7 @@ impl App {
         self.sandbox_created.clear();
         self.sandbox_images.clear();
         self.sandbox_notes.clear();
+        self.sandbox_detail_notes.clear();
         self.sandbox_labels.clear();
         self.sandbox_annotations.clear();
         self.sandbox_policy_versions.clear();

crates/openshell-tui/src/lib.rs

@@ -2732,6 +2732,14 @@ async fn fetch_sandboxes(
 }
 
 fn sandbox_notes(sandbox: &openshell_core::proto::Sandbox, forwards: String) -> String {
+    sandbox_notes_for_view(sandbox, forwards, false)
+}
+
+fn sandbox_notes_for_view(
+    sandbox: &openshell_core::proto::Sandbox,
+    forwards: String,
+    detail: bool,
+) -> String {
     if let Some(record) = sandbox
         .status
         .as_ref()
@@ -2760,17 +2768,18 @@ fn sandbox_notes(sandbox: &openshell_core::proto::Sandbox, forwards: String) ->
     let Some(rejection) = rejection else {
         return forwards;
     };
-    // Keep the table row on one line even when a diagnostic contains newlines.
-    let message = rejection
-        .message
-        .split_whitespace()
-        .collect::<Vec<_>>()
-        .join(" ");
-    let mut notes = "Config invalid".to_string();
-    if !message.is_empty() {
-        notes.push_str(": ");
-        notes.push_str(&message);
-    }
+    let mut notes = if detail {
+        format!(
+            "Invalid config: {}",
+            rejection
+                .message
+                .split_whitespace()
+                .collect::<Vec<_>>()
+                .join(" ")
+        )
+    } else {
+        "inspect for config".to_string()
+    };
     if !forwards.is_empty() {
         notes.push_str("; ");
         notes.push_str(&forwards);
@@ -2838,6 +2847,14 @@ fn apply_sandbox_refresh(app: &mut App, sandboxes: Vec<openshell_core::proto::Sa
         })
         .collect();
 
+    app.sandbox_detail_notes = sandboxes
+        .iter()
+        .map(|s| {
+            let forwards = openshell_core::forward::build_sandbox_notes(s.object_name(), &forwards);
+            sandbox_notes_for_view(s, forwards, true)
+        })
+        .collect();
+
     // Build LABELS column from metadata.
     app.sandbox_labels = sandboxes
         .iter()
@@ -3330,18 +3347,19 @@ mod sandbox_notes_tests {
         };
         assert_eq!(
             sandbox_notes(&sandbox, "fwd:8080".into()),
-            "Config invalid: credentialed endpoint requires L7 inspection; fwd:8080"
+            "inspect for config; fwd:8080"
         );
-        // Older gateways can expose only Ready; retain the diagnostic there too.
-        sandbox.status.as_mut().unwrap().conditions.remove(0);
         assert_eq!(
-            sandbox_notes(&sandbox, String::new()),
-            "Config invalid: credentialed endpoint requires L7 inspection"
+            super::sandbox_notes_for_view(&sandbox, "fwd:8080".into(), true),
+            "Invalid config: credentialed endpoint requires L7 inspection; fwd:8080"
         );
+        // Older gateways can expose only Ready; retain the note there too.
+        sandbox.status.as_mut().unwrap().conditions.remove(0);
+        assert_eq!(sandbox_notes(&sandbox, String::new()), "inspect for config");
         sandbox.status.as_mut().unwrap().conditions[0]
             .message
             .clear();
-        assert_eq!(sandbox_notes(&sandbox, String::new()), "Config invalid");
+        assert_eq!(sandbox_notes(&sandbox, String::new()), "inspect for config");
         sandbox.status.as_mut().unwrap().conditions[0].status = "True".into();
         assert_eq!(sandbox_notes(&sandbox, "fwd:8080".into()), "fwd:8080");
         sandbox.status = None;

crates/openshell-tui/src/ui/mod.rs

@@ -74,8 +74,8 @@ fn draw_sandbox_screen(frame: &mut Frame<'_>, app: &mut App, area: Rect) {
     let chunks = Layout::default()
         .direction(Direction::Vertical)
         .constraints([
-            Constraint::Length(sandbox_detail::required_height(app)), // metadata
-            Constraint::Min(0),                                       // policy or logs
+            Constraint::Length(sandbox_detail::required_height(app, area.width)), // metadata
+            Constraint::Min(0),                                                   // policy or logs
         ])
         .split(area);
 
@@ -738,6 +738,55 @@ mod tests {
         assert!(!rendered.contains("ALPHA"));
     }
 
+    #[tokio::test]
+    async fn configuration_notes_fit_dashboard_and_wrap_in_detail() {
+        let mut app = test_app();
+        app.sandbox_names = vec!["quarantined".into()];
+        app.sandbox_count = 1;
+        app.sandbox_notes = vec!["inspect for config".into()];
+        let diagnostic = "Invalid config: credentialed endpoint api.example.com:443 requires L7 inspection before the sandbox workload can start safely";
+        app.sandbox_detail_notes = vec![diagnostic.into()];
+        for width in [80, 100, 120] {
+            for all_workspaces in [false, true] {
+                app.all_workspaces = all_workspaces;
+                let mut terminal = Terminal::new(TestBackend::new(width, 24)).unwrap();
+                terminal
+                    .draw(|frame| {
+                        sandboxes::draw(frame, &app, frame.size(), true);
+                    })
+                    .unwrap();
+                let text: String = terminal
+                    .backend()
+                    .buffer()
+                    .content()
+                    .iter()
+                    .map(ratatui::buffer::Cell::symbol)
+                    .collect();
+                assert!(
+                    text.contains("inspect for config"),
+                    "dashboard at {width}: {text}"
+                );
+                assert!(!text.contains("credentialed endpoint"));
+            }
+            app.screen = Screen::Sandbox;
+            let mut terminal = Terminal::new(TestBackend::new(width, 24)).unwrap();
+            terminal.draw(|frame| draw(frame, &mut app)).unwrap();
+            let text: String = terminal
+                .backend()
+                .buffer()
+                .content()
+                .iter()
+                .map(ratatui::buffer::Cell::symbol)
+                .collect();
+            let words = text
+                .replace('│', " ")
+                .split_whitespace()
+                .collect::<Vec<_>>()
+                .join(" ");
+            assert!(words.contains(diagnostic), "detail at {width}: {words}");
+        }
+    }
+
     #[tokio::test]
     async fn sandbox_delete_confirmation_is_visible_in_standard_terminal() {
         let mut app = test_app();

crates/openshell-tui/src/ui/sandbox_detail.rs

@@ -27,16 +27,32 @@ fn pending_draft_count(app: &App) -> usize {
     }
 }
 
+fn note_lines(app: &App, width: u16) -> Vec<String> {
+    let notes = app
+        .sandbox_detail_notes
+        .get(app.sandbox_selected)
+        .filter(|s| !s.is_empty())
+        .map_or("none", String::as_str);
+    super::sandbox_draft::wrap_value(
+        &format!("  Notes: {notes}"),
+        usize::from(width.saturating_sub(4).max(1)),
+    )
+}
+
 /// Return the rows needed to render every metadata line without clipping.
-pub(super) fn required_height(app: &App) -> u16 {
+pub(super) fn required_height(app: &App, width: u16) -> u16 {
     let policy_rows = u16::from(app.sandbox_policy_is_global);
     let action_rows = if app.confirm_delete {
         2 // spacer plus confirmation
     } else {
         u16::from(pending_draft_count(app) > 0)
     };
 
-    BASE_CONTENT_ROWS + policy_rows + action_rows + BORDER_ROWS
+    BASE_CONTENT_ROWS
+        + policy_rows
+        + action_rows
+        + BORDER_ROWS
+        + u16::try_from(note_lines(app, width).len().saturating_sub(1)).unwrap_or(u16::MAX - 16)
 }
 
 /// Draw a compact metadata pane for the currently selected sandbox.
@@ -130,18 +146,12 @@ pub fn draw(frame: &mut Frame<'_>, app: &App, area: Rect) {
         Span::styled(providers_str, t.text),
     ]);
 
-    // Row 6: Configuration diagnostics and forwarded ports
-    let notes_str = app
-        .sandbox_notes
-        .get(idx)
-        .filter(|s| !s.is_empty())
-        .map_or("none", String::as_str);
-    let row6 = Line::from(vec![
-        Span::styled("  Notes: ", t.muted),
-        Span::styled(notes_str, t.text),
-    ]);
-
-    let mut lines = vec![row1, row2, row3, row4, row5, row6];
+    let mut lines = vec![row1, row2, row3, row4, row5];
+    lines.extend(
+        note_lines(app, area.width)
+            .into_iter()
+            .map(|line| Line::from(Span::styled(line, t.text))),
+    );
 
     // Show global policy indicator when the sandbox's policy is managed at
     // gateway scope.

crates/openshell-tui/src/ui/sandbox_draft.rs

@@ -574,7 +574,7 @@ fn display_width(text: &str) -> usize {
 ///
 /// A word wider than `width` is hard-broken rather than allowed to overflow.
 /// Always returns at least one row so callers can index the first row safely.
-fn wrap_value(text: &str, width: usize) -> Vec<String> {
+pub(super) fn wrap_value(text: &str, width: usize) -> Vec<String> {
     if width == 0 {
         return vec![text.to_string()];
     }

crates/openshell-tui/src/ui/sandboxes.rs

@@ -94,7 +94,7 @@ pub fn draw(frame: &mut Frame<'_>, app: &App, area: Rect, focused: bool) {
             Constraint::Percentage(7),
             Constraint::Percentage(18),
             Constraint::Percentage(15),
-            Constraint::Percentage(12),
+            Constraint::Length(18),
         ]
     } else {
         vec![
@@ -104,7 +104,7 @@ pub fn draw(frame: &mut Frame<'_>, app: &App, area: Rect, focused: bool) {
             Constraint::Percentage(8),
             Constraint::Percentage(20),
             Constraint::Percentage(15),
-            Constraint::Percentage(12),
+            Constraint::Length(18),
         ]
     };
 

docs/sandboxes/manage-sandboxes.mdx

@@ -609,7 +609,7 @@ Use the terminal to spot blocked connections marked `action=deny` and provider-r
 
 The dashboard has three panels stacked vertically: Gateways, Providers (or Global Settings), and Sandboxes. Navigate within a panel with `Up`/`Down` or `j`/`k`. At a list boundary the cursor overflows into the adjacent panel, skipping empty panels. Use `Tab`/`Shift+Tab` to cycle panels directly. Press `h`/`l` or `Left`/`Right` in the middle panel to switch between the Providers and Global Settings tabs.
 
-The sandbox table’s NOTES column shows `Config invalid` and the rejection reason when policy or provider configuration blocks provisioning. Open the sandbox detail view to see the Notes field. The diagnostic clears after the configuration is repaired; active port forwards remain listed.
+The sandbox table’s NOTES column shows `inspect for config` when policy or provider configuration blocks provisioning. Open the sandbox detail view for the full rejection reason, or run `openshell sandbox get <name> -o json`. The note clears after the configuration is repaired; active port forwards remain listed.
 
 ## Port Forwarding