You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Multiple catch blocks assume Error shape (e.message). In browsers, thrown values can be non-Error; accessing e.message may be undefined. Normalize error handling or cast types to avoid undefined notifications.
color: "success",message: "Succesfully copied to clipboard",});}catch(e){notification.add({color: "error",message: e.message,});}};/** * Copy the text * @param text - text to copy */constrecordFeedback=async(rating: boolean)=>{try{awaitroom.recordFeedback(message,rating);notification.add({color: "success",message: "Succesfully saved feedback",});}catch(e){notification.add({color: "error",message: e.message,});}};/** * Copy the text * @param text - text to copy */constrewriteMessage=async()=>{try{awaitroom.rewriteMessage(message);notification.add({color: "success",message: "Succesfully rewrote message",});}catch(e){notification.add({color: "error",message: e.message,});}
In auto-execute flow, you check instance of ResponseMessageStore before iterating tools, but earlier createMessage may return InputMessageStore or ResponseMessageStore. Ensure createMessage always returns a defined instance for the given pixelMessage types and handle unexpected/unknown types to avoid runtime undefined access.
// auto execute if enabledif(this._store.options.autoExecute){if(!(responseMessageinstanceofResponseMessageStore)){return;}// loop through the response and execute the tool// save the responsefor(consttoolofresponseMessage.tools){awaitthis.runTool(responseMessage,tool.id,tool.name,tool.parameters,);}}
The code now expects pixel messages to use 'tool_responses' instead of 'toolResponse'. Verify backend responses match this schema across INPUT_TOOL_EXEC and RESPONSE_TOOL; otherwise tools mapping will fail silently.
rewriteMessage references prompt which is undefined, causing runtime errors and malformed pixel calls. Pass the rewritten prompt as a parameter and interpolate that value. Also guard against missing parentMessage before accessing its properties.
-rewriteMessage = async (message: ResponseMessageStore): Promise<void> => {+rewriteMessage = async (message: ResponseMessageStore, prompt: string): Promise<void> => {
try {
- // turn on the loading screen
this.setIsLoading(true);
- // get the parent message
const parentMessage = message.parent;
- // build the context if it is there
let context = "";
if (this._store.options?.instructions) {
context = this._store.options?.instructions;
}
- // get a list of tool ids- const tools: string[] = this._store.options.tools.map(- (t) => t.id,- [],- );+ const tools: string[] = this._store.options.tools.map((t) => t.id);- // wait for the pixel to run+ const parentMsgId =+ parentMessage && parentMessage.id ? `parentMessageId=["${parentMessage.id}"],` : "";+
const response = await this.runPixel<
[
{
inputMessage: PixelMessage;
responseMessage: PixelMessage;
},
]
- >(- `AskPlayground(+ >(`AskPlayground(
engine=["${this._store.modelId}"],
roomId=["${this._store.roomId}"],
command=["<encode>${prompt}</encode>"],
${context ? `context=["<encode>${context}</encode>"],` : `context=[],`}
+${tools.length ? `mcpToolID=${JSON.stringify(tools)},` : "mcpToolID=[],"}+${parentMsgId}+paramValues=[${JSON.stringify({+ max_new_tokens: this._store.options.tokenLength,+ temperature: this._store.options.temperature,+ })}]+);`);-${tools.length ? `mcpToolID=${JSON.stringify(tools)},` : "mcpToolID=[],"}-${parentMessage.id ? `parentMessageId=["${parentMessage.id}"],` : ""}-paramValues=[${JSON.stringify({- max_new_tokens: this._store.options.tokenLength,- temperature: this._store.options.temperature,- })}]-);`,- );+ if (response.errors.length > 0) {+ throw new Error(JSON.stringify(response.errors));+ }+ const { output } = response.pixelReturn[0];+ const responseMessage = this.createMessage(output.responseMessage);+ parentMessage?.addChild(responseMessage);++ if (this._store.options.autoExecute) {+ if (!(responseMessage instanceof ResponseMessageStore)) {+ return;+ }+ for (const tool of responseMessage.tools) {+ await this.runTool(responseMessage, tool.id, tool.name, tool.parameters);+ }+ }+ } finally {+ this.setIsLoading(false);+ }+};+
Suggestion importance[1-10]: 9
__
Why: The snippet uses an undefined prompt in the pixel command, which is a clear runtime bug; passing it as a parameter and guarding parentMessage materially improves correctness and robustness.
High
Security
Encode tool execution response
executionResponse is interpolated without encoding, risking malformed pixel or injection if it contains quotes/newlines. Safely encode or stringify the response before embedding in the pixel string.
saveTool = async (
message: ResponseMessageStore,
toolId: string,
toolName: string,
executionResponse: string,
): Promise<void> => {
try {
- // turn on the loading screen
this.setIsLoading(true);
- // wait for the pixel to run+ const safeResponse = JSON.stringify(executionResponse);+
const response = await this.runPixel<
[
{
responseMessage: PixelMessage | string;
},
]
>(
- `AddPlaygroundToolExecution(roomId = [ "${this._store.roomId}" ], toolId = [ "${toolId}" ], toolName=[ "${toolName}" ], response=[ ${executionResponse} ]);`,+ `AddPlaygroundToolExecution(roomId = [ "${this._store.roomId}" ], toolId = [ "${toolId}" ], toolName=[ "${toolName}" ], response=[ ${safeResponse} ]);`,
);
- // throw errors
if (response.errors.length > 0) {
throw new Error(JSON.stringify(response.errors));
}
const { output } = response.pixelReturn[0];
-- // don't create a new message if it is a string. More tools need to be executed
if (typeof output.responseMessage === "string") {
return;
}
- // create the response and link to the input
const responseMessage = this.createMessage(output.responseMessage);
-
message.addChild(responseMessage);
} finally {
- // turn off the loading screen
this.setIsLoading(false);
}
};
Suggestion importance[1-10]: 8
__
Why: Interpolating executionResponse unescaped into the pixel string risks malformed queries; JSON-stringifying it is a solid security and correctness fix aligned with the PR’s pattern of stricter error handling.
Medium
General
Stabilize message listener effect
The effect depends on notification.add, a function that can change identity, causing unnecessary re-subscriptions and potential leaks. Wrap handleMessage with useCallback and limit dependencies to stable references, or remove notification.add from deps by using a ref.
Why: Using a stable useCallback for the message handler reduces unnecessary add/remove cycles; it's a reasonable maintainability improvement though not critical to functionality.
Support for MCP tool execution in the playground with tool response handling and artifact UI.
Shared FlexLayout integration across client and playground.
Changed
Refactored playground messaging and room stores to new message model and sidebar behavior.
Fixed
Tool calling flows in the playground and related renderer state handling.
to commit the new content to the CHANGELOG.md file, please type:
'/update_changelog --pr_update_changelog.push_changelog_changes=true'
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Changes Made
How to Test
Notes