-
Notifications
You must be signed in to change notification settings - Fork 0
feat(workbench-shell): ✨ Add dynamic chart artifact rendering to thread messages #169
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
74e9e7e
861724b
41b0f09
a8077b2
c2a2355
88774aa
dcd787d
a7186d7
dbc284d
5a9f8c6
3e9ab8b
74bd469
e631cd4
2567766
bbcbe18
e44fb7f
db8828a
b3339cc
f65e44f
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Large diffs are not rendered by default.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -30,6 +30,7 @@ | |
| "class-variance-authority": "^0.7.1", | ||
| "clsx": "^2.1.1", | ||
| "cmdk": "^1.1.1", | ||
| "dompurify": "^3.4.2", | ||
| "lucide-react": "^0.542.0", | ||
| "motion": "^12.36.0", | ||
| "nanoid": "^5.1.6", | ||
|
|
@@ -42,11 +43,15 @@ | |
| "tailwind-merge": "^3.3.1", | ||
| "tw-animate-css": "^1.3.7", | ||
| "use-stick-to-bottom": "^1.1.3", | ||
| "vega": "^6.2.0", | ||
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
Sorry, something went wrong. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [MEDIUM] Large dependency tree addition (vega, vega-lite, vega-embed) unguarded Adding vega, vega-lite, and vega-embed brings in a large dependency tree. Confirm that tree-shaking, bundle size impact, and license compatibility (BSD-3-Clause, ISC, MIT) are reviewed. No usage of these libraries appears in the provided source diffs, so this is a placeholder dependency add. Suggestion: Run a bundle analyzer ( Risk: Increased bundle size and potential noise in supply-chain audits; no functional risk yet. Confidence: 0.95 [From SubAgent: general]
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [MEDIUM] Heavy vega visualization dependency bundle impact Adding vega, vega-lite, and vega-embed as direct runtime dependencies significantly increases JavaScript bundle size and memory footprint, potentially slowing initial load and parse times. Suggestion: Consider dynamic/lazy loading (React.lazy + import() or code splitting) for the visualization feature so vega libraries are only fetched when a visualization message is actually rendered. Risk: Larger bundle slows cold load and parse, and canvas rendering can block the UI thread for complex or many charts per message. Confidence: 0.85 [From SubAgent: performance]
|
||
| "vega-embed": "^7.1.0", | ||
| "vega-lite": "^6.4.3", | ||
| "xterm": "^5.3.0" | ||
| }, | ||
| "devDependencies": { | ||
| "@tailwindcss/vite": "^4.1.12", | ||
| "@tauri-apps/cli": "^2", | ||
| "@types/dompurify": "^3.0.5", | ||
| "@types/react": "^19.1.8", | ||
| "@types/react-dom": "^19.1.6", | ||
| "@vitejs/plugin-react": "^4.6.0", | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| ALTER TABLE messages ADD COLUMN parts_json TEXT; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[MEDIUM] No tests for new frontend dependencies (vega, dompurify)
New frontend dependencies (vega visualization libraries and dompurify for HTML sanitization) have been added without any unit tests to verify their integration, correct rendering behavior, or sanitization efficacy.
Suggestion: Add Vitest unit tests for: 1) dompurify sanitization of potentially dangerous HTML/script inputs, 2) vega-embed rendering edge cases (invalid specs, malformed data, empty datasets), 3) correct graceful degradation when vega rendering fails. Mock the DOM environment as needed.
Risk: Unsanitized HTML could lead to XSS vulnerabilities if dompurify is misconfigured or not applied consistently, and broken vega rendering could produce silent UI errors.
Confidence: 0.85