fix(dashboard): close 2 strong slop-scan findings + adversarial-review hardening#38
Merged
Merged
Conversation
Slop-scan rerun on apps/dashboard after the 3-PR zod trust-boundary refactor flagged two strong findings that survived. Both are 1-line classes that the manual subagent audit also caught: 1. defensive.error-swallowing at WorkflowsDashboard.tsx:346 handleLoadTemplate caught and only console.error'd. User-clicked template loads now surface the failure via setApiError, mirroring executeWorkflow's pattern at the same file. 2. structure.pass-through-wrappers at AgentsPanel.tsx:57 parseMetadata was a literal forward to parseAgentMetadata introduced in PR #37 (T05) for testability. Drop the wrapper and call parseAgentMetadata at the 3 sites directly. Required a type guard at line 498 because parseAgentMetadata returns the typed schema output (where passthrough fields are 'unknown') instead of Record<string, any>. Verification: - pnpm --filter @consensus-tools/dashboard test 79/79 pass - pnpm --filter @consensus-tools/dashboard typecheck clean - pnpm --filter @consensus-tools/dashboard build passes - npx slop-scan@latest scan apps/dashboard --lint 3 findings (was 5) Both 'strong' findings closed; remaining 3 are 'medium' directory fan-out hotspots that are React app shape, not slop. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Slop-scan rerun on
apps/dashboard(post the 3-PR zod trust-boundary refactor) flagged 2 strong findings. This PR closes both, plus a third issue Codex adversarial caught at the handler we were touching.Changes
apps/dashboard/src/components/agents/AgentsPanel.tsxCloses
structure.pass-through-wrappersat line 57.parseMetadatawas a literal forward toparseAgentMetadataintroduced in PR #37 (T05) for testability. Drop the wrapper, inlineparseAgentMetadataat the 3 call sites. Required atypeof === 'string'type guard at line 498 becauseparseAgentMetadatareturns the typed schema output (passthrough fields areunknown) where the old wrapper returnedRecord<string, any>.apps/dashboard/src/pages/WorkflowsDashboard.tsxCloses
defensive.error-swallowingat line 346 (handleLoadTemplate). The handler caught and onlyconsole.error'd. Now mirrors the siblingexecuteWorkflowpattern (setApiError(null)at start,setApiError(...)in the catch).Plus: empty-payload 200 case (Codex adversarial finding). The original try/catch only handled non-OK HTTP. A
200 OKwith{}or{template: null}would silently clear errors and do nothing. Added anelsebranch that surfaces "server returned no template payload" so backend regressions / proxy mangling don't get swallowed.Adversarial review (max)
User invoked
/review max adversarial. Three passes ran:ParticipantCardconfirmed safe for prop removal.handleLoadTemplate— no abort/versioning, overlapping clicks can clobber error state; (2) silent failure on empty 200.Codex finding #2 (silent empty 200): FIXED in this PR with the
elsebranch.Codex finding #1 (race condition): DEFERRED to P2 follow-up. It's a pre-existing structural issue across multiple handlers in this file (the explicit comment at
refreshList:108calls out the same class). Fix needsAbortController+ request versioning across the file — too broad for a 6-line slop-cleanup PR.Verification
pnpm --filter @consensus-tools/dashboard test— 79/79 passpnpm --filter @consensus-tools/dashboard typecheck— cleanpnpm --filter @consensus-tools/dashboard build— passesnpx slop-scan@latest scan apps/dashboard --lint— 5 → 3 findings (bothstrongitems closed; 3 remaining aremedium structure.directory-fanout-hotspotwhich are React app shape, not slop)Test plan
WorkflowsDashboardhandlers (Codex finding init #1)🤖 Generated with Claude Code