Skip to content

Grant non-interactive agents access to linked node_modules directories - #56

Merged
MonaDevAI merged 5 commits into
mainfrom
users/mobiswal/dashboard-linked-node-modules
Oct 12, 2026
Merged

MonaDevAI merged 5 commits into
mainfrom
users/mobiswal/dashboard-linked-node-modules

Conversation

@MonaDevAI

Copy link
Copy Markdown
Contributor

Dashboard and run executors now pass --add-dir for node_modules junctions that resolve outside the repository. Non-interactive agents were auto-denied on the path-permission prompt, which blocked jobs at intake. Adds a test; dashboard tests pass (55/55).

MonaDevAI and others added 2 commits October 5, 2026 22:51
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: b5a57f24-f683-48de-abce-24cc5bc03e96
Dashboard and run executors now pass --add-dir for node_modules junctions that
resolve outside the repository, so auto-denied path prompts no longer block jobs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d8b7888d-c8b2-4e87-95a4-623577cf1e57
Copilot AI balanced review requested due to automatic review settings October 12, 2026 00:30

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Repository-controlled symlinks can grant autonomous agents access to arbitrary host paths.

2 open findings
What changed in this PR

Adds external linked node_modules access for non-interactive CLI and dashboard agents.

Changes:

  • Detects external dependency links and adds --add-dir.
  • Adds dashboard-level coverage.
  • Downgrades development dependencies and rewrites lockfile sources.
File Description
dashboard/​server.js Detects and grants linked dependency paths.
bin/​fixlab.js Forwards detected paths to CLI runtimes.
test/​dashboard-server.test.js Tests junction detection and invocation arguments.
package.json Downgrades Node types and globals.
package-lock.json Updates dependency versions and registry URLs.

🧠 Review effort: Balanced


💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread dashboard/server.js Resolved
Comment thread dashboard/server.js Resolved
A blocked job previously held the queue until resumed; only failed jobs could be
dismissed. Blocked jobs stay blocked in history.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d8b7888d-c8b2-4e87-95a4-623577cf1e57
Copilot AI balanced review requested due to automatic review settings October 12, 2026 00:37

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Repository-controlled symlinks can silently grant agents access to arbitrary external directories.

2 open findings

🧠 Review effort: Balanced

Address review: a repository-controlled node_modules symlink no longer grants
--add-dir on its own. Targets must fall under trustedDependencyRoots declared in
the repository profile (filesystem roots ignored), and the profile's configured
working directories are searched instead of only one directory level.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d8b7888d-c8b2-4e87-95a4-623577cf1e57
Copilot AI balanced review requested due to automatic review settings October 12, 2026 00:49

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Repository-controlled configuration can grant agents access to unrelated host directories.

1 open finding
2 resolved since last review
Previously missed (2)

In code that hasn't changed since last review

Medium severity Missing dashboard coverage for blocked-job dismiss control

dashboard/​public/​app.js:449

The new server test verifies the dismiss endpoint, but none of the dashboard tests exercise this client-side branch, so a blocked job could still render a hidden or mislabeled dismiss control without detection. Add focused dashboard UI coverage for the blocked status, including the button visibility/label and confirmation path, as required for dashboard behavior changes.

Medium severity Regression test misses Agency and dashboard directory forwarding

test/​dashboard-server.test.js:90

This regression test exercises only the Copilot invocation builder. It does not cover the changed Agency builder or prove that either the CLI launch path or dashboard executor actually forwards the discovered directories, so removing those wiring changes would still leave the test green. Add focused spawned-argv coverage for both runtimes and both entry points.

🧠 Review effort: Balanced

Comment thread dashboard/server.js
Comment on lines +1360 to +1363
const trustedRoots = (
Array.isArray(profile?.trustedDependencyRoots)
? profile.trustedDependencyRoots
: []
Copilot AI balanced review requested due to automatic review settings October 12, 2026 00:53

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Repository-controlled access expansion and unsafe Windows shell argument handling introduce security risks.

3 open findings

🧠 Review effort: Balanced

Comment thread dashboard/public/app.js
Comment on lines +445 to +449
canResume && ["failed", "blocked"].includes(job?.status);
dismissFailedJobButton.textContent =
job?.status === "blocked"
? "Dismiss blocked job and continue queue"
: "Dismiss failed job and continue queue";
Comment thread dashboard/server.js
Comment on lines +2834 to +2836
if (!["failed", "blocked"].includes(currentJob.status)) {
sendJson(response, 409, {
error: "only a failed FixLab job can be dismissed"
error: "only a failed or blocked FixLab job can be dismissed"
@MonaDevAI
MonaDevAI merged commit cd30a71 into main Oct 12, 2026
4 checks passed
@MonaDevAI
MonaDevAI deleted the users/mobiswal/dashboard-linked-node-modules branch October 12, 2026 00:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants