Repository navigation
Grant agents access to each job's screenshot directory - #57
Merged
Merged
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b5a57f24-f683-48de-abce-24cc5bc03e96
Dashboard and run executors now pass --add-dir for node_modules junctions that resolve outside the repository, so auto-denied path prompts no longer block jobs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d8b7888d-c8b2-4e87-95a4-623577cf1e57
A blocked job previously held the queue until resumed; only failed jobs could be dismissed. Blocked jobs stay blocked in history. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d8b7888d-c8b2-4e87-95a4-623577cf1e57
Address review: a repository-controlled node_modules symlink no longer grants --add-dir on its own. Targets must fall under trustedDependencyRoots declared in the repository profile (filesystem roots ignored), and the profile's configured working directories are searched instead of only one directory level. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d8b7888d-c8b2-4e87-95a4-623577cf1e57
Dashboard-launched agents could not read uploaded screenshots stored in the job artifact directory outside the repository, which blocked diagnosis. Pass only that job's artifact directory via --add-dir. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: aa2b2938-9ca6-4b67-a11a-f131b554d603
There was a problem hiding this comment.
🟡 Changes recommended
Repository-controlled path grants and Windows shell argument handling introduce security risks.
2 open findings
What changed in this PR
Grants agents access to job-scoped screenshot artifacts, alongside bundled dependency-access and blocked-job dismissal changes.
Changes:
- Adds scoped
--add-dirarguments for screenshots and linked dependencies. - Allows blocked jobs to be dismissed.
- Adjusts development dependency versions.
| File | Description |
|---|---|
dashboard/server.js |
Adds directory grants and blocked-job dismissal. |
dashboard/public/app.js |
Updates dismissal UI for blocked jobs. |
bin/fixlab.js |
Grants linked dependency directories to CLI agents. |
test/dashboard-server.test.js |
Tests directory grants and blocked dismissal. |
docs/repository-onboarding.md |
Documents trusted dependency roots. |
package.json |
Adjusts development dependencies. |
package-lock.json |
Updates locked dependency metadata. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+1360
to
+1365
| const trustedRoots = ( | ||
| Array.isArray(profile?.trustedDependencyRoots) | ||
| ? profile.trustedDependencyRoots | ||
| : [] | ||
| ) | ||
| .filter((value) => typeof value === "string" && isAbsolute(value)) |
Comment on lines
444
to
+449
| const canDismissFailedJob = | ||
| canResume && job?.status === "failed"; | ||
| canResume && ["failed", "blocked"].includes(job?.status); | ||
| dismissFailedJobButton.textContent = | ||
| job?.status === "blocked" | ||
| ? "Dismiss blocked job and continue queue" | ||
| : "Dismiss failed job and continue queue"; |
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: aa2b2938-9ca6-4b67-a11a-f131b554d603
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Dashboard-launched agents run non-interactively. Uploaded screenshots are stored in the job artifact directory outside the repository, so the agent was denied access and diagnosis blocked ("Permission denied because no interactive user response was available").
Change
Pass only the current job's artifact directory to the agent via
--add-dir, in addition to the existing linked dependency directories. Branch also carries earlier commits (linked node_modules access, dismissing blocked jobs, public dev dependencies).Validation
node --test: all pass; dashboard test asserts the executor receives the screenshot directory)npm pack --dry-runcontains the required files (not run; npm unavailable on this machine)lint, typecheck, docs, agent-rules, policy and self-healing gates pass.
format:checkreportsmcp/server.js, which this PR does not modify (pre-existing).test:e2eandpack:checkwere skipped because npm is unavailable.Risk
Grants file access to one job-scoped FixLab-owned directory only; no
--allow-all-paths. Requires a dashboard restart to take effect.