Skip to content

Ai/workspace layout - #1527

Open
charmi-reddy wants to merge 49 commits into
TransformerOptimus:mainfrom
charmi-reddy:ai/workspace-layout
Open

Ai/workspace layout#1527
charmi-reddy wants to merge 49 commits into
TransformerOptimus:mainfrom
charmi-reddy:ai/workspace-layout

Conversation

@charmi-reddy

Copy link
Copy Markdown

This PR improves the Agent Workspace Action Console by making denial/feedback state resilient to live list updates. Previously, local UI state was tied to array index, which could become misaligned when pending actions refreshed or changed order. The update keys state by action ID, ensuring deny toggles and feedback always stay attached to the correct permission request. It also improves UX clarity by renaming the deny submission CTA to “Submit Denial.”

Key improvements:

  1. Switch deny/reason local state from index-based arrays to action ID keyed objects.
  2. Preserve correct input/toggle mapping when actions are added, removed, or reordered.
  3. Keep existing approval/denial submission flow unchanged while improving reliability.
  4. Update denial action label for clearer intent.

User impact:

  1. Prevents feedback from appearing under the wrong permission card.
  2. Reduces moderation mistakes during rapid permission updates.
  3. Makes the denial action clearer for operators.

Mitigates CWE-22 Zip Slip by validating ZIP member paths before extraction in marketplace and tool download flows, preventing arbitrary file write outside extraction directories. Adds regression tests for traversal payloads like ../../evil.py.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant