Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -121,7 +121,7 @@ export function OpenInWorkspace({ task }: OpenInWorkspaceProps) {
const result = await createWorkspace.mutateAsyncWithPendingSetup(
{
projectId,
name: task.slug,
name: task.title,
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Possible workspace collision on same-title tasks

createWorkspace.mutateAsyncWithPendingSetup deduplicates by projectId + name (evidenced by the result.wasExisting check). When name was task.slug, collisions were impossible because slugs are unique per project. Now that name is task.title, two tasks in the same project that share a title (e.g., both called "Fix auth middleware") will match the same workspace: the second open-in-workspace call will return wasExisting: true and launch a new agent session inside the first task's workspace instead of creating a fresh one.

If workspace deduplication is also expected to key on branchName, this may be safe, but the code path for result.wasExisting only re-runs launchAgentSession — it does not verify that the found workspace's branch matches the current task's branch.

Consider appending the slug to keep uniqueness while still showing a human-friendly name, e.g.:

name: task.title ? `${task.title} (${task.slug})` : task.slug,

or guarantee uniqueness by checking whether the backend deduplication key includes branchName.

Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/desktop/src/renderer/routes/_authenticated/_dashboard/tasks/$taskId/components/PropertiesSidebar/components/OpenInWorkspace/OpenInWorkspace.tsx
Line: 124

Comment:
**Possible workspace collision on same-title tasks**

`createWorkspace.mutateAsyncWithPendingSetup` deduplicates by `projectId` + `name` (evidenced by the `result.wasExisting` check). When `name` was `task.slug`, collisions were impossible because slugs are unique per project. Now that `name` is `task.title`, two tasks in the same project that share a title (e.g., both called `"Fix auth middleware"`) will match the same workspace: the second open-in-workspace call will return `wasExisting: true` and launch a new agent session inside the first task's workspace instead of creating a fresh one.

If workspace deduplication is also expected to key on `branchName`, this may be safe, but the code path for `result.wasExisting` only re-runs `launchAgentSession` — it does not verify that the found workspace's branch matches the current task's branch.

Consider appending the slug to keep uniqueness while still showing a human-friendly name, e.g.:

```ts
name: task.title ? `${task.title} (${task.slug})` : task.slug,
```

or guarantee uniqueness by checking whether the backend deduplication key includes `branchName`.

How can I resolve this? If you propose a fix, please make it concise.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Missing guard for empty/undefined task.title

task.title is typed as part of TaskWithStatus but tasks can exist in a draft/untitled state (e.g., a task created without a title yet). Passing an empty string or undefined as name to createWorkspace may be rejected by the backend or silently create a workspace with a blank name. The previous task.slug was always a non-empty structured identifier.

Consider adding a fallback:

Suggested change
name: task.title,
name: task.title || task.slug,
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/desktop/src/renderer/routes/_authenticated/_dashboard/tasks/$taskId/components/PropertiesSidebar/components/OpenInWorkspace/OpenInWorkspace.tsx
Line: 124

Comment:
**Missing guard for empty/undefined `task.title`**

`task.title` is typed as part of `TaskWithStatus` but tasks can exist in a draft/untitled state (e.g., a task created without a title yet). Passing an empty string or `undefined` as `name` to `createWorkspace` may be rejected by the backend or silently create a workspace with a blank name. The previous `task.slug` was always a non-empty structured identifier.

Consider adding a fallback:

```suggestion
					name: task.title || task.slug,
```

How can I resolve this? If you propose a fix, please make it concise.

branchName,
},
{ agentLaunchRequest: launchRequestTemplate ?? undefined },
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -174,7 +174,7 @@ export function RunInWorkspacePopover({
const result = await createWorkspace.mutateAsyncWithPendingSetup(
{
projectId: effectiveProjectId,
name: task.slug,
name: task.title,
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Same workspace-collision risk as in OpenInWorkspace

The same deduplication concern applies here. In the bulk path this is especially impactful: if a user bulk-selects multiple tasks that happen to have the same title, only the first one creates a new workspace; all subsequent ones will hit wasExisting: true and inject their agent launch request into the same pre-existing workspace, rather than each getting their own isolated environment.

Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/desktop/src/renderer/routes/_authenticated/_dashboard/tasks/components/TasksView/components/TasksTopBar/components/RunInWorkspacePopover/RunInWorkspacePopover.tsx
Line: 177

Comment:
**Same workspace-collision risk as in `OpenInWorkspace`**

The same deduplication concern applies here. In the bulk path this is especially impactful: if a user bulk-selects multiple tasks that happen to have the same title, only the first one creates a new workspace; all subsequent ones will hit `wasExisting: true` and inject their agent launch request into the same pre-existing workspace, rather than each getting their own isolated environment.

How can I resolve this? If you propose a fix, please make it concise.

branchName,
},
{ agentLaunchRequest: launchRequestTemplate ?? undefined },
Expand Down
Loading