Repository navigation
FLAB: streamline test permissions and PPE write defaults - #109
Merged
Merged
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 46e778f9-d964-46b0-bebe-3b6f9f71eb74
There was a problem hiding this comment.
🟡 Changes recommended
Edited or stale prepared authorizations can be sent without review IDs, bypassing server binding checks and allowing jobs to resume with changed or stale authorization.
1 open issue
What changed in this PR
This PR reduces repetitive approval prompts in FixLab’s dashboard and connected MCP workflows, and adds guided recovery for oversized source edits.
Changes:
- Default routine job access and configured PPE writes, with explicit opt-outs.
- Allow bounded reads of active-session checkpoints and add separately authorized fresh-edit recovery.
- Add regression coverage and document permission defaults and recovery boundaries.
| File | Description |
|---|---|
| test/dashboard-server.test.js | Tests connected defaults and bound edit recovery. |
| test/dashboard-runtime-requests.test.js | Tests recovery metadata and denial preservation. |
| test/dashboard-runtime-policy.test.js | Tests oversized-edit eligibility and checkpoint restrictions. |
| mcp/dashboard-client.js | Applies routine-access and configured PPE defaults. |
| e2e/dashboard-readiness.spec.js | Covers PPE opt-outs and guided recovery interactions. |
| docs/security.md | Documents PPE defaults and consent boundaries. |
| docs/commands.md | Explains permission defaults and recovery flows. |
| docs/architecture.md | Describes the updated permission and recovery model. |
| dashboard/server.js | Exposes readiness and manages bound recovery state. |
| dashboard/runtime-requests.js | Validates recovery metadata and generates authorization text. |
| dashboard/runtime-permission-policy.js | Adds checkpoint reads and oversized-edit eligibility checks. |
| dashboard/public/index.html | Adds recovery controls and updates write guidance. |
| dashboard/public/app.js | Implements PPE defaults and guided edit-recovery interactions. |
| dashboard/dev-post.js | Adds PPE configuration inspection. |
| dashboard/copilot-session.js | Passes session identity and eligible recovery metadata. |
Review effort: Balanced
Comment on lines
+2971
to
+2974
| ...(sourceEditAuthorizationSelection && sourceEditAuthorizationSelection.instanceId === dashboardInstanceId && | ||
| sourceEditAuthorizationSelection.jobId === activeJob?.id && | ||
| details === sourceEditAuthorizationSelection.authorization | ||
| ? { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Routine tests, PPE writes and oversized source edits can stall on repetitive or unavailable approvals.
Change
Default dashboard/MCP routine access and configured PPE writes, with opt-outs. Add active-session checkpoint reads and guided, explicitly authorized fresh-edit recovery without replaying denials.
Validation
npm pack --dry-runcontains the required filesWindows: 497 unit tests passed. Full browser run: 49/51; fixed the missing-identity resume regression. Both failed cases and both new flows passed serial reruns (4/4). Final lint, types and formatting passed. The original full run remains failed.
Risk
PPE defaults authorize configured origins only; grants expire. Authentication and managed policy remain enforced. No npm release.