feat(mcp-guardrails): ui changes

[Madhuvod]

Summary

Adds a "Show original values" toggle to the MCP log detail sheet, allowing users with the Logs:Reveal permission to view redacted placeholders replaced with their original values. Redaction utility functions are extracted into a shared module and extended to support recursive reveal over structured JSON-like values.

Changes

• Extracted hasRedactionMappingEntries and applyRedactionMapping from logDetailView.tsx into a new shared ui/lib/utils/redaction.ts module, removing the inline definitions.
• Added applyRedactionMappingToValue for recursive reveal over nested objects and arrays without mutating the fetched log data.
• Added mergeRedactionMappings to combine input and output phase maps for fields like error details that may contain content from both phases.
• Introduced a RedactionMapping interface in logs.ts and applied it to both LogEntry and MCPToolLogEntry (the latter now includes redaction_mapping on detail responses).
• Added a canReveal prop to MCPLogDetailSheet, gated by the Logs:Reveal RBAC permission checked in MCPLogsPage.
• Rendered a Switch toggle labeled "Show original values" in the sheet header when reveal data is available; toggling it applies the redaction mapping to arguments, result, and error details before display.
• Reset the toggle state whenever the displayed log ID changes or reveal availability changes.
• Added unit tests covering hasRedactionMappingEntries, applyRedactionMappingToValue (including immutability), and mergeRedactionMappings conflict resolution.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

1. Open the MCP Logs page as a user with the Logs:Reveal permission.
2. Click a log entry that has redacted fields (placeholders like [EMAIL-1]).
3. Verify the "Show original values" toggle appears in the sheet header.
4. Toggle it on and confirm placeholders in Arguments, Result, and Error Details are replaced with original values.
5. Toggle it off and confirm placeholders are restored.
6. Navigate to a different log and confirm the toggle resets to off.
7. As a user without Logs:Reveal, confirm the toggle does not appear.

cd ui
pnpm i || npm i
pnpm test || npm test
pnpm build || npm run build

Screenshots/Recordings

Add before/after screenshots showing the toggle and revealed values in the MCP log detail sheet.

Breaking changes

• Yes
• No

Related issues

Link related issues here.

Security considerations

The reveal toggle is gated behind the Logs:Reveal RBAC permission. Original values are only substituted client-side when the backend includes redaction_mapping in the response, which itself is only returned to callers with the appropriate permission. No original values are persisted or logged by the UI.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • Added permission-controlled “Show original values” functionality for MCP log details.
  • Redacted arguments, results, and error details can now be revealed when authorized.
  • Added previous/next navigation support in log detail views.

• Bug Fixes

  • Improved redaction handling for nested and structured log data while preserving original values.

• Tests

  • Added coverage for redaction detection, mapping, merging, and non-mutating transformations.

Walkthrough

Adds shared redaction mapping utilities and types, gates MCP log value reveal through RBAC, and updates log detail views to display original values when permitted.

Changes

Log redaction reveal

Layer / File(s)	Summary
Redaction contracts and utilities ui/lib/types/logs.ts, ui/lib/utils/redaction.ts, ui/lib/utils/redaction.test.ts	Defines shared redaction mappings, recursive reveal helpers, merge behavior, and tests for precedence and immutability.
MCP log reveal flow ui/app/workspace/mcp-logs/page.tsx, ui/app/workspace/mcp-logs/views/mcpLogDetailsSheet.tsx	Passes reveal permission to the detail sheet, adds the “Show original values” toggle, and renders mapped arguments, results, and error details.
Shared utility adoption ui/app/workspace/logs/sheets/logDetailView.tsx	Replaces local redaction helpers with imports from the shared utility module.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant MCPLogsPage
  participant MCPLogDetailSheet
  participant RedactionUtilities
  participant CodeEditors
  MCPLogsPage->>MCPLogDetailSheet: pass reveal permission
  MCPLogDetailSheet->>RedactionUtilities: apply enabled mappings
  RedactionUtilities-->>MCPLogDetailSheet: return displayed values
  MCPLogDetailSheet->>CodeEditors: render arguments, result, and error details

Loading

Suggested reviewers: akshaydeo, impoiler, pratham-mishra04

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title identifies MCP guardrails UI work but does not state the main change: the redaction reveal toggle.
Description check	✅ Passed	The description covers the feature, implementation, testing steps, security considerations, and affected areas; screenshots and related issues remain unspecified.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 07-20-feat_mcp-guardrails_ui_changes

---

_{Comment @coderabbitai help to get the list of available commands.}

[Madhuvod]

• added plugin logs in mcp logs #5489
• feat(mcp-guardrails): ui changes #5366 👈 (View in Graphite)
• feat(mcp-guardrails): add MCP log redaction changes #5359
• v2.0.0

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Confidence Score: 4/5

The redaction reconstruction path can display the wrong sensitive value and needs a fix before merging.

• Input and output mappings can collide on the same placeholder.
• Sequential replacement can rewrite text introduced by an earlier replacement.
• The sheet prevents stale detail records from being revealed during navigation.

ui/lib/utils/redaction.ts and ui/lib/utils/redaction.test.ts

Security Review

The reveal control is permission-gated, but mapping collisions and chained replacement can display an unrelated sensitive value instead of the exact stored original.

Important Files Changed

Filename	Overview
ui/lib/utils/redaction.ts	Adds shared reveal helpers, but mixed-phase collisions and sequential substitution can produce incorrect values.
ui/lib/utils/redaction.test.ts	Adds basic helper coverage but codifies output-last collisions and omits chained replacement cases.
ui/app/workspace/mcp-logs/views/mcpLogDetailsSheet.tsx	Adds a reveal toggle, phase-specific mapping, and state reset when the selected log changes.
ui/app/workspace/mcp-logs/page.tsx	Passes the Logs reveal permission into the MCP details sheet.
ui/lib/types/logs.ts	Extracts the shared mapping type and adds it to MCP detail records.
ui/app/workspace/logs/sheets/logDetailView.tsx	Replaces local redaction helpers with the shared utility.

_{Reviews (1): Last reviewed commit: "feat(mcp-guardrails): ui changes" | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

ui/app/workspace/mcp-logs/views/mcpLogDetailsSheet.tsx (1)

333-358: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Use nullish checks for revealed text sections.

A valid redaction mapping can restore a string to "". The current truthiness guards then remove the Arguments or Result section after reveal. Check explicitly for undefined/null so empty content remains visible.

Proposed fix

-				{displayedArguments && (
+				{displayedArguments !== undefined && displayedArguments !== null && (
...
-				{displayedResult && displayLog.status !== "processing" && (
+				{displayedResult !== undefined && displayedResult !== null && displayLog.status !== "processing" && (

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ui/app/workspace/mcp-logs/views/mcpLogDetailsSheet.tsx` around lines 333 -
358, Update the displayedArguments and displayedResult rendering guards in the
MCP log details view to check only for nullish values, not truthiness. Preserve
the Arguments and Result sections when reveal resolves their content to an empty
string, while still hiding them when the corresponding value is null or
undefined.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ui/app/workspace/mcp-logs/views/mcpLogDetailsSheet.tsx`:
- Around line 155-162: Add an accessible name to the reveal Switch in the
revealAvailable block, using aria-label="Show original values" or associating
the visible text through aria-labelledby/Label and a matching control
identifier. Preserve the existing revealEnabled state and onCheckedChange
behavior.
- Line 86: Scope showRevealedValues to the current displayLog in the MCP log
details view so navigation cannot briefly reveal the new log’s original values.
Update the state handling around displayLog.id to reset immediately on log
changes, or key the relevant component by displayLog.id, while preserving the
existing reveal toggle behavior within one active log.

In `@ui/lib/utils/redaction.ts`:
- Around line 9-16: Update applyRedactionMapping to perform one replacement pass
over the original text using a token-matching regular expression and a callback
that looks up each token’s mapping value. Ensure replacement values are returned
literally, without interpreting $ sequences, and prevent mapped values from
being processed again.

---

Outside diff comments:
In `@ui/app/workspace/mcp-logs/views/mcpLogDetailsSheet.tsx`:
- Around line 333-358: Update the displayedArguments and displayedResult
rendering guards in the MCP log details view to check only for nullish values,
not truthiness. Preserve the Arguments and Result sections when reveal resolves
their content to an empty string, while still hiding them when the corresponding
value is null or undefined.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 78cfbebd-e605-48fe-81b2-cd73aa3bca64

📥 Commits

Reviewing files that changed from the base of the PR and between 69f47a6 and 794c468.

📒 Files selected for processing (6)

• ui/app/workspace/logs/sheets/logDetailView.tsx
• ui/app/workspace/mcp-logs/page.tsx
• ui/app/workspace/mcp-logs/views/mcpLogDetailsSheet.tsx
• ui/lib/types/logs.ts
• ui/lib/utils/redaction.test.ts
• ui/lib/utils/redaction.ts

[akshaydeo]

Merge activity

• Jul 31, 9:30 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jul 31, 9:32 AM UTC: @akshaydeo merged this pull request with Graphite.

The base branch was changed.