Hand the agent a file for anything that is not a picture - #200
Conversation
A video, a note or a drawing the person placed was drawn and sent as a picture, as a board was. Now only pictures go as pictures; the rest keep their drawing for the tile and point the agent at the file behind them, `files/…` or `canvas.json#<id>`, in the project they were attached from. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| data: "CCC", | ||
| path: "/tmp/sp-chat-r/2.png", | ||
| page: "/proj/canvases/shop/01-home.html", | ||
| reference: "/proj/canvases/shop/01-home.html", |
There was a problem hiding this comment.
🔍 Video and shape references lack tests
The existing test only renames a board reference. Neither new video paths nor shape-record references are exercised, despite the viewer-test requirement in CONTRIBUTING.md.
Was this helpful? React with 👍 or 👎 to provide feedback.
| // Anything but a picture — a board, a video, a note — keeps its picture for the | ||
| // panel, and the agent is pointed at its file, `<slug>/<path>` in the canvases of |
There was a problem hiding this comment.
🔍 New comments contain em dashes
The changed comments here and in canvasAttach.tsx and agents.ts use em dashes, contrary to REVIEW.md.
Was this helpful? React with 👍 or 👎 to provide feedback.
| rest.every( | ||
| (s) => s && !s.startsWith(".") && !s.includes("\\"), | ||
| ); |
There was a problem hiding this comment.
🟥 Attached references escape canvas folders
A reference containing x/.. passes the component check, then path.join normalizes it outside the canvas folder. The agent receives an attacker-chosen local path instead of a canvas file.
Was this helpful? React with 👍 or 👎 to provide feedback.
There was a problem hiding this comment.
A .. part starts with a dot, so the check rejects it before path.join runs; x/.. never resolves. 2efcbee moves this into canvasFile (sp.ts) with a test covering shop/../../etc, shop/files/.. and backslash paths.
Deploying super-prototyping with
|
| Latest commit: |
f78f602
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://65ea039a.super-prototyping.pages.dev |
| Branch Preview URL: | https://fix-attach-non-images-by-ref.super-prototyping.pages.dev |
The resolution moves to sp.ts as canvasFile, with a test for a board, a video, a shape record, an app canvas, and names that try to leave the folder. Drop the em dashes REVIEW.md rules out. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2efcbee970
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| kind: "board", | ||
| name: personsShapeName(editor, target, slug), | ||
| src: URL.createObjectURL(blob), | ||
| reference: target.type === "image" ? undefined : true, |
There was a problem hiding this comment.
When a user creates or edits a note/drawing and immediately attaches and sends it, this switches the agent from the freshly rendered snapshot to canvas.json without flushing or awaiting the canvas-content save. installCanvasContent waits 500 ms before starting that write, so the agent can read an older record—or no record at all—while the chat thumbnail shows the current shape. Await saveNow(slug) before dispatching a reference to canvas.json.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in f78f602: the + awaits saveNow(slug) before handing over a reference to one of the person's shapes.
A note drawn a moment ago is still waiting out the half second before canvas.json is written, so the agent could read the record from before it. The + now awaits saveNow first, as an agent write already does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 participant
Follow-up to #199, which did this for boards.
Problem
A video, a note or a drawing the person placed on a canvas was drawn with
toImageand sent to the agent as a picture. The agent can't watch a video, and a note or a drawing is a record it can read directly.Fix
canvasAttach.tsx: an item the person placed (anything but animageshape) is attached withreference: true, as a board already is. Pictures, from the library or dropped in by the person, still go to the agent as images.referenceinstead ofpage, since it no longer means only a board.server/agent.tsresolves any<slug>/<path>, not only<slug>/<file>.html. That coversfiles/clip.mp4andcanvas.json#shape:…, looked up in the canvases of the project the item was attached from. Each part of the path is checked: none may start with a dot or contain a backslash.Test
tsc -bandvitest runpass. The release note under Unreleased is broadened to match.🤖 Generated with Claude Code