Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions agentex-ui/components/primary-content/prompt-input.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,9 @@ export function PromptInput({ prompt, setPrompt }: PromptInputProps) {
const { taskID, agentName, updateParams } = useSafeSearchParams();
const [isClient, setIsClient] = useState(false);
const [isSendingJSON, setIsSendingJSON] = useState(false);
const [isTaskParamsOpen, setIsTaskParamsOpen] = useState(false);
const [taskParams, setTaskParams] = useState('');
const taskParamsViewRef = useRef<EditorView | null>(null);

const { agentexClient } = useAgentexClient();

Expand Down Expand Up @@ -119,9 +122,20 @@ export function PromptInput({ prompt, setPrompt }: PromptInputProps) {
setPrompt('');

if (!currentTaskId) {
let extraTaskParams: Record<string, unknown> = {};
if (taskParams.trim()) {
try {
extraTaskParams = JSON.parse(taskParams);
} catch {
toast.error('Invalid Task Parameters JSON');
return;
}
}
Comment on lines +126 to +133
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Stale task params silently injected when accordion is closed

extraTaskParams is applied whenever taskParams.trim() is non-empty, regardless of whether isTaskParamsOpen is true. If a user opens the accordion, enters params, then closes it (collapsing the UI), the next handleSendPrompt call will still inject those params without any visible indicator — directly contradicting the visual affordance of the toggle. Gate the parse behind isTaskParamsOpen so that closing the accordion genuinely disables the params.

Suggested change
if (taskParams.trim()) {
try {
extraTaskParams = JSON.parse(taskParams);
} catch {
toast.error('Invalid Task Parameters JSON');
return;
}
}
if (isTaskParamsOpen && taskParams.trim()) {
try {
extraTaskParams = JSON.parse(taskParams);
Prompt To Fix With AI
This is a comment left during a code review.
Path: agentex-ui/components/primary-content/prompt-input.tsx
Line: 126-133

Comment:
**Stale task params silently injected when accordion is closed**

`extraTaskParams` is applied whenever `taskParams.trim()` is non-empty, regardless of whether `isTaskParamsOpen` is `true`. If a user opens the accordion, enters params, then closes it (collapsing the UI), the next `handleSendPrompt` call will still inject those params without any visible indicator — directly contradicting the visual affordance of the toggle. Gate the parse behind `isTaskParamsOpen` so that closing the accordion genuinely disables the params.

```suggestion
      if (isTaskParamsOpen && taskParams.trim()) {
        try {
          extraTaskParams = JSON.parse(taskParams);
```

How can I resolve this? If you propose a fix, please make it concise.

Fix in Cursor Fix in Claude Code Fix in Codex


const task = await createTaskMutation.mutateAsync({
agentName: agentName,
params: {
...extraTaskParams,
description: prompt,
content: currentPrompt,
},
Expand Down Expand Up @@ -159,10 +173,32 @@ export function PromptInput({ prompt, setPrompt }: PromptInputProps) {
sendMessageMutation,
setPrompt,
isSendingJSON,
taskParams,
]);

return (
<div className="flex w-full max-w-3xl flex-col gap-2">
{!taskID && !isDisabled && (
<div className="flex flex-col gap-1">
<button
type="button"
className="text-muted-foreground hover:text-foreground ml-4 flex items-center gap-1 text-sm transition-colors"
onClick={() => setIsTaskParamsOpen(v => !v)}
>
<span>{isTaskParamsOpen ? '▾' : '▸'}</span>
Task Parameters
</button>
{isTaskParamsOpen && (
<DataInput
prompt={taskParams}
setPrompt={setTaskParams}
isDisabled={isDisabled}
handleSendPrompt={handleSendPrompt}
codeMirrorViewRef={taskParamsViewRef}
/>
)}
</div>
Comment on lines +181 to +200
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Missing dev-only guard on Task Parameters UI

The PR description says "Also only available in dev environment," but neither the UI panel (line 181) nor the extraTaskParams parse logic (line 126) has a process.env.NODE_ENV === 'development' check. As-is, the Task Parameters accordion and its ability to inject arbitrary JSON into createTask are fully live in production, directly contradicting the stated design constraint.

Prompt To Fix With AI
This is a comment left during a code review.
Path: agentex-ui/components/primary-content/prompt-input.tsx
Line: 181-200

Comment:
**Missing dev-only guard on Task Parameters UI**

The PR description says "Also only available in dev environment," but neither the UI panel (line 181) nor the `extraTaskParams` parse logic (line 126) has a `process.env.NODE_ENV === 'development'` check. As-is, the Task Parameters accordion and its ability to inject arbitrary JSON into `createTask` are fully live in production, directly contradicting the stated design constraint.

How can I resolve this? If you propose a fix, please make it concise.

Fix in Cursor Fix in Claude Code Fix in Codex

)}
<div
className={`border-input dark:bg-input ${isDisabled ? 'bg-muted scale-90 cursor-not-allowed' : 'scale-100'} flex w-full items-center justify-between rounded-4xl border py-2 pr-2 pl-6 shadow-sm transition-transform duration-300 disabled:cursor-not-allowed`}
>
Expand Down
Loading