From aba2dac3c551335282e2e5ed81211b538d070436 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=9B=B7=E7=94=B5=E8=8A=BD=E8=A1=A3?=
 <zhangyanghaha0407@outlook.com>
Date: Tue, 21 Apr 2026 14:58:39 -0400
Subject: [PATCH] fix(docs): stop leaking backend reason codes to the open-file
 toast
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous toast pasted result.error.message straight into the UI,
so a failed open rendered
  "Couldn't open CEO-WEEK2-DAY1-SUMMARY.md: workspace_id=null
  task_id=null run_id=61669170-180b-4cb3-99d2-eb925ca9717c — none led
  to a workspace with a local_path"
to the operator. That text is a developer log line, not user feedback.

Drop the passthrough — the toast now simply reads
  "Couldn't open <filename>"
and the diagnostic details live only in the IPC return payload (which
a devtools or automated caller can still read). The resolver's five
reason codes and their detail strings remain intact in the main
process; they just no longer surface to the UI.
---
 .../components/company-operations/DocumentCenter.tsx      | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/renderer/components/company-operations/DocumentCenter.tsx b/src/renderer/components/company-operations/DocumentCenter.tsx
index e5750f9f..62bb8326 100644
--- a/src/renderer/components/company-operations/DocumentCenter.tsx
+++ b/src/renderer/components/company-operations/DocumentCenter.tsx
@@ -78,14 +78,14 @@ function WorkProductRow({ product, companyId }: { product: WorkProductRecord; co
   // the main process can join it against the work product's workspace
   // root before handing off to the OS shell. Direct `openPath(externalId)`
   // used to flash a failure when the renderer tried to treat the relative
-  // path as absolute. Surface shell failures (no associated app, path
-  // outside managed root, workspace moved) as a toast so the click
-  // doesn't look like a dead button when the OS can't complete the open.
+  // path as absolute. On failure show a single user-facing line — never
+  // leak the backend reason code or the resolver's null-chain detail to
+  // the operator, those belong in a main-process log, not the UI.
   const primaryAction = product.url || (product.provider === "filesystem" && product.externalId)
     ? async () => {
         const result = await window.agentCompany.openWorkProduct({ companyId, id: product.id });
         if (!result.ok) {
-          addToast(`Couldn't open ${product.title}: ${result.error.message}`, "danger");
+          addToast(`Couldn't open ${product.title}`, "danger");
         }
       }
     : undefined;