Island rhythms/create execute code by IslandRhythms · Pull Request #205 · mongoosejs/studio

IslandRhythms · 2026-04-01T15:49:24Z

closes #177

vercel · 2026-04-01T15:49:43Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
studio	Ready	Preview, Comment	Apr 1, 2026 9:07pm

Copilot

Pull request overview

Expands the “Create Document” modal to support generating the draft via backend-assisted workflows (pulling values from related documents and executing a server-side script), with AI support for both document and script drafting.

Changes:

Adds a two-tab Create Document UI (“Manual” and “Server script”), including pull-from-related mapping UI and script execution output/logs.
Introduces backend actions for pulling values from related documents and executing a “create draft” script in a VM sandbox.
Extends AI chat context/prompts to support generating either document bodies or server-side scripts.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
frontend/src/models/models.js	Stores `modelSchemaPaths` from `listModels()` to power path suggestions in Create Document.
frontend/src/models/models.html	Passes `modelSchemaPaths` into the Create Document component; widens modal via `containerClass`.
frontend/src/modal/modal.css	Adds a create-document-specific modal sizing/padding variant.
frontend/src/create-document/create-document.js	Implements pull mappings, backend pull merge, and server-script execution for draft generation; AI targeting document vs script.
frontend/src/create-document/create-document.html	Reworks Create Document modal UI into tabs and adds pull mapping + server script editors.
frontend/src/api.js	Adds API helpers for `pullDocumentValues` and `executeCreateDocumentScript`.
backend/authorize.js	Wires role requirements for the two new Model actions.
backend/actions/Model/streamChatMessage.js	Adds `aiTarget` + `createDraftScript` context and separate system prompts for document vs script generation.
backend/actions/Model/pullDocumentValues.js	New action: fetches related docs and extracts values by path into a returned object.
backend/actions/Model/index.js	Exports the new Model actions.
backend/actions/Model/executeCreateDocumentScript.js	New action: executes user-provided script in VM against a mutable `draft` object and returns updated draft + logs.
backend/actions/Model/createChatMessage.js	Mirrors `streamChatMessage` changes for non-streamed LLM calls (document vs script targeting).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-01T15:56:13Z

+      <ace-editor
+        v-model="documentData"
+        mode="javascript"
+        :line-numbers="true"
+        class="h-[300px] w-full mt-2"
+      />


The document editor is rendered twice (one Ace editor in the Manual tab and another in the Server script tab) but both bind to the same documentData. This creates and maintains two Ace instances, which is unnecessarily heavy and can lead to subtle sync/selection issues. Consider rendering a single shared ace-editor for documentData outside the tab panels (or use v-if to mount only the active tab’s editor).

Suggested change

<ace-editor

v-model="documentData"

mode="javascript"

:line-numbers="true"

class="h-[300px] w-full mt-2"

/>

<pre

class="mt-2 h-[300px] w-full overflow-auto rounded-md border border-edge-muted bg-muted/20 p-2 font-mono text-xs text-content-secondary whitespace-pre-wrap"

>{{ documentData }}</pre>

Copilot · 2026-04-01T15:56:14Z

+      throw new Error(`Model ${sourceModel} not found`);
+    }
+    const doc = await Model.findById(sourceDocumentId).setOptions({ sanitizeFilter: true }).orFail();
+    const lean = doc.toObject({ virtuals: false, getters: true });


pullDocumentValues() uses doc.toObject({ virtuals: false, getters: true }), which differs from getDocuments/getDocument (they use getters: false, transform: false). Using getters and default transforms can return computed/transformed values instead of raw stored data, which is surprising for a “pull field values” API. Consider using the same serialization options as the other Model read endpoints (e.g., toJSON({ virtuals: false, getters: false, transform: false })).

Suggested change

const lean = doc.toObject({ virtuals: false, getters: true });

const lean = doc.toJSON({ virtuals: false, getters: false, transform: false });

Copilot · 2026-04-01T15:56:14Z

+  const values = {};
+  for (const pull of pulls) {
+    const lean = await getLean(pull.sourceModel.trim(), pull.sourceDocumentId.trim());
+    const v = mpath.get(pull.sourcePath, lean);
+    if (v !== undefined) {
+      mpath.set(pull.targetPath, v, values);
+    }


mpath.set(pull.targetPath, v, values) writes into a plain object using a user-supplied path. Without guarding against paths like __proto__, constructor, or prototype, this can enable prototype pollution on the server. Validate/sanitize targetPath (and potentially sourcePath) to reject dangerous segments, or build values with Object.create(null) and explicitly block these keys before calling mpath.set.

Copilot · 2026-04-01T15:56:15Z

+  const context = vm.createContext(sandbox);
+  const result = await vm.runInContext(wrappedScript(script), context);
+


User-provided scripts are executed via vm.runInContext() with no execution time limit. A script with an infinite loop (or heavy synchronous work) can block the Node event loop and take down the server process. Consider running these scripts in a worker thread/isolated process with an enforced timeout and resource limits (or otherwise hard-limiting execution) before exposing this endpoint broadly.

Copilot · 2026-04-01T15:56:15Z

+module.exports = ({ db }) => async function pullDocumentValues(params) {
+  const { pulls, roles } = new PullDocumentValuesParams(params);
+
+  await authorize('Model.pullDocumentValues', roles);
+
+  if (!Array.isArray(pulls) || pulls.length === 0) {
+    throw new Error('pulls must be a non-empty array');
+  }


New backend behavior (Model.pullDocumentValues) isn’t covered by tests. There are existing test/Model.*.test.js suites for Model actions; please add tests for at least: (1) pulling a simple field, (2) nested path pulls, (3) caching behavior for repeated pulls from the same source doc, and (4) rejecting invalid pull payloads.

Copilot · 2026-04-01T15:56:15Z

+module.exports = ({ db }) => async function executeCreateDocumentScript(params) {
+  const { model, data, script, roles } = new ExecuteCreateDocumentScriptParams(params);
+
+  await authorize('Model.executeCreateDocumentScript', roles);
+
+  const Model = db.models[model];
+  if (Model == null) {
+    throw new Error(`Model ${model} not found`);
+  }
+
+  const draft = EJSON.deserialize(data);


New backend behavior (Model.executeCreateDocumentScript) isn’t covered by tests. Please add a Model action test that verifies: (1) the script can mutate draft, (2) logs are captured, and (3) authorization/invalid model handling. This will help prevent regressions in the sandbox contract.

vkarpov15

Let's remove the Manual vs Server script distinction and the "Pull from another document" input, in favor of allowing Model/createChatMessage to execute some lightweight tools to pull data for the user using the tools in #201

The idea is that, as a user creating an AccessToken, I should be able to say "create token for user with email val@karpov.io" and the LLM can execute a query for User with email val@karpov.io via a tool, and generate the draft document with the correct id.

vkarpov15 · 2026-04-01T21:09:27Z

  documentData: {
    $type: 'string'
  },
+  createDraftScript: {


Model/streamChatMessage is explicitly for chat threads, we shouldn't use it for generating documents.

vkarpov15 · 2026-04-01T21:10:51Z

+    class="mb-4 rounded-md border border-emerald-200 bg-emerald-50/70 p-3 dark:border-emerald-900 dark:bg-emerald-950/40"
+  >
+    <p class="mb-2 text-xs text-content-secondary">
+      AI suggestion ready for the <strong class="text-content">{{ lastAiTarget === 'script' ? 'server script' : 'document' }}</strong>. Accept to keep it or reject to restore the previous version.


It is a little messy how the "AI suggestion" shows up at the bottom below everything, instead of right under AI mode

vkarpov15 · 2026-04-01T21:14:35Z

      />
+    </div>
+    <div class="rounded-md border border-edge-strong bg-page0 p-3">
+      <label class="block text-sm font-bold text-content">Pull from another document</label>


The "Pull from another document" is unfortunately quite clunky - the idea is that the AI should be able to fetch data on its own to give back to the user. Take a look at the agents mode PR for how you can use the AI SDK to expose tools for the AI to pull data: #201.

The use case I want to support is this: in the AccessToken model, I should be able to enter in "create token for user with email val@karpov.io" and the AI should pull the ObjectId for user with email val@karpov.io for me, and insert it into the Document to Create.

vkarpov15 · 2026-04-01T21:24:07Z

+    <button
+      type="button"
+      role="tab"
+      :aria-selected="createModalTab === 'manual'"


Manual vs Server script distinction is unclear here, I'd prefer to remove the two tabs entirely and just expand it so AI Mode can handle pulling data

vkarpov15 · 2026-04-18T21:20:40Z

Going to close this for now until we can get agent mode out for better guidance on how to implement this

IslandRhythms added 3 commits March 27, 2026 16:36

allow mappings

cd0a833

Involve AI

ee16e96

modify layout

da20359

IslandRhythms requested review from Copilot and vkarpov15 April 1, 2026 15:49

Copilot started reviewing on behalf of IslandRhythms April 1, 2026 15:50 View session

Copilot AI reviewed Apr 1, 2026

View reviewed changes

resolve conflicts

b34b8b8

vercel Bot deployed to Preview April 1, 2026 16:01 View deployment

Merge branch 'main' into IslandRhythms/create-execute-code

46a6c61

vercel Bot deployed to Preview April 1, 2026 21:07 View deployment

vkarpov15 requested changes Apr 1, 2026

View reviewed changes

vkarpov15 closed this Apr 18, 2026

	const lean = doc.toObject({ virtuals: false, getters: true });
	const lean = doc.toJSON({ virtuals: false, getters: false, transform: false });

		const context = vm.createContext(sandbox);
		const result = await vm.runInContext(wrappedScript(script), context);

Conversation

IslandRhythms commented Apr 1, 2026

Uh oh!

vercel Bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

vkarpov15 left a comment

Choose a reason for hiding this comment

Uh oh!

vkarpov15 Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

vkarpov15 Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

vkarpov15 Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

vkarpov15 Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

vkarpov15 commented Apr 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vercel Bot commented Apr 1, 2026 •

edited

Loading