feat: agent models panel & session info sidebar improvements#65
feat: agent models panel & session info sidebar improvements#65
Conversation
- Add AgentModelsPanel component to configure per-agent model overrides - Add backend route for GET/POST agent model configuration - Use local.agent.list() as source of truth (same as prompt input) instead of hardcoded arrays - Sort agents alphabetically in both the panel and prompt input select - Reorder sidebar sections: Settings and Actions after Bridge, Agent Models before Subagent Models - Add memory.ttl setting support - Fix memory.ttl write to use setMemoryTtl() to avoid read-modify-write race - Fix POST response to update from server data instead of optimistic local state - Remove duplicate fetch on mount (createEffect already handles initial fetch) - Validate agent/model field formats via Zod schema; remove hardcoded VALID_AGENTS allowlist - Remove dead switch cases in getFeatureValue
Shows Ollama, Embeddings, and Vector store config in a collapsible section after the Subagent Models panel. Gracefully handles missing .vuhitra/ or env.json with a not-found message.
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| } | ||
| } | ||
|
|
||
| export const EnvInfoRoutes = () => |
There was a problem hiding this comment.
WARNING: The directory query parameter accepts any string without path traversal validation. An attacker with valid SDK credentials could potentially read files outside the intended project directory by providing paths like ../ or absolute paths. Consider validating that the resolved directory is within the expected project root.
| }, | ||
| }, | ||
| }), | ||
| validator("query", z.object({ directory: z.string().optional() })), |
There was a problem hiding this comment.
WARNING: The directory query parameter accepts any string without path traversal validation. This could allow reading profile data from unintended locations. Consider validating that the resolved path is within the expected project scope.
Code Review SummaryStatus: 2 Warnings Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Other Observations (not in diff)Issues found in unchanged code that cannot receive inline comments:
Files Reviewed (7 files)
Summary: The PR adds new functionality for managing agent models and environment info, plus a collapsible UI for subagent models. The main concerns are the |
1 participant
Summary
.vuhitra/already exists in the directory.vuhitra/env.json, showing Ollama, Embeddings, and Vector store config — gracefully handles missing file/agent-modeland/env-inforoutes;memory.ttlwrite now usessetMemoryTtl()to avoid read-modify-write raceTest plan
.vuhitra/, verify Initialize Vuhitracode button is disabled.vuhitra/, verify Initialize Vuhitracode button is enabled and works.vuhitra/env.json, verify Project Info panel shows correct values.vuhitra/env.json, verify Project Info panel shows "not found" message