Repository navigation
Enable routine backend source editing by default - #108
Merged
Merged
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 46e778f9-d964-46b0-bebe-3b6f9f71eb74
There was a problem hiding this comment.
🔵 Needs a closer look
The default permission change has unresolved linked-application unit failures, while full validation and the package-content check remain pending.
No open issues 🎉
What changed in this PR
This PR enables the dashboard’s existing routine source-access option by default, allowing new fix-and-validate jobs to edit non-sensitive source/tests and run dashboard-owned validation gates. Users can opt out; read-only modes and explicit API consent requirements remain unchanged.
Changes:
- Preselect routine source access for new dashboard submissions.
- Extend integration and browser coverage for default consent, opt-out, read-only access, and job-bound permissions.
- Document the default and its permission boundaries.
| File | Description |
|---|---|
test/dashboard-server.test.js |
Tests the intake default and read-only access while retaining job-binding checks. |
e2e/dashboard-readiness.spec.js |
Adds default-access browser coverage and explicitly opts out in the manual-trust test. |
docs/commands.md |
Documents default access, opt-out, and unchanged API consent requirements. |
dashboard/public/index.html |
Checks the routine source-access option by default. |
Review effort: Balanced
MonaDevAI
marked this pull request as ready for review
November 6, 2026 11:33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Dashboard intake leaves routine source access unchecked, so fix-and-validate jobs can repeatedly request permission to create backend regression tests and run configured checks.
Change
Enable the existing routine-source-access choice by default. Fix-and-validate jobs receive non-sensitive source/test edit trust and dashboard-owned validation gates; read-only modes still receive reads only. Users can opt out. API callers still require explicit consent, and existing jobs, earlier denials, unrestricted commands, protected configuration, credentials, business writes, and publication permissions are unchanged.
Validation
npm run validatedid not pass: 48/49 browser tests passed, with the previously observed linked-application case timing out at 30 seconds. This failed attempt is not reported as a pass.npm pack --dry-runcontains the required files.test,windows-containment, CodeQLanalyze, and CodeQL checks passed.Validation dependencies were restored using the configured internal feed. The existing lockfile was preserved. Earlier local attempts were affected by an overfull shared TEMP session catalog, fixtures inheriting packages when TEMP was inside the checkout, and a multi-hour timer interruption. The final Windows run used an outside-checkout isolated TEMP directory and the repository's temporary idle-sleep prevention. Logs are retained locally.
Risk
New dashboard fix-and-validate submissions grant routine source/test editing unless the user opts out. Consent remains bound to one job and canonical checkout; sensitive operations and arbitrary commands retain separate review.