Skip to content

Revert "feat(copilot): add persistent workspace panel and secure context hydration" - #192

Merged
BruzWJ merged 1 commit into
stagingfrom
revert-191-refactor/persisted-copilot
Aug 16, 2026
Merged

Revert "feat(copilot): add persistent workspace panel and secure context hydration"#192
BruzWJ merged 1 commit into
stagingfrom
revert-191-refactor/persisted-copilot

Conversation

@BruzWJ

@BruzWJ BruzWJ commented Aug 16, 2026

Copy link
Copy Markdown
Contributor

Reverts #191

Summary by CodeRabbit

  • New Features

    • Added Copilot as a workspace widget with context-aware assistance, persistent chat history, independent panel conversations, model selection, access controls, file attachments, knowledge-base mentions, and workflow todos.
    • Copilot now automatically uses the active paired panel’s context and supports synchronized panel colors.
    • Added structured workflow execution details, including optional block-level information.
    • Added safer API-key redaction for displayed and stored data.
  • Documentation

    • Added comprehensive Copilot widget documentation and updated setup, workflow, and navigation guidance.
  • Bug Fixes

    • Improved streaming cleanup, message context persistence, attachment previews, markdown rendering, and mention handling.

@coderabbitai

coderabbitai Bot commented Aug 16, 2026

Copy link
Copy Markdown

Review Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e257e4c5-178c-45dc-97ff-013361bf3f04

📥 Commits

Reviewing files that changed from the base of the PR and between 81c8f1e and 020b798.

📒 Files selected for processing (151)
  • apps/docs/content/docs/en/copilot/index.mdx
  • apps/docs/content/docs/en/widgets/copilot.mdx
  • apps/docs/content/docs/en/widgets/editor-workflow.mdx
  • apps/docs/content/docs/en/widgets/index.mdx
  • apps/docs/content/docs/en/widgets/meta.json
  • apps/docs/doc-templates/widget.mdx
  • apps/tradinggoose/app/[locale]/workspace/[workspaceId]/knowledge/[id]/[documentId]/page.tsx
  • apps/tradinggoose/app/[locale]/workspace/[workspaceId]/knowledge/[id]/page.tsx
  • apps/tradinggoose/app/api/copilot/chat/review-session-post.test.ts
  • apps/tradinggoose/app/api/copilot/chat/review-session.test.ts
  • apps/tradinggoose/app/api/copilot/chat/route.ts
  • apps/tradinggoose/app/api/orders/[orderId]/provider-detail/route.test.ts
  • apps/tradinggoose/app/workspace/[workspaceId]/dashboard/dashboard-client.test.tsx
  • apps/tradinggoose/app/workspace/[workspaceId]/dashboard/dashboard-client.tsx
  • apps/tradinggoose/app/workspace/[workspaceId]/knowledge/knowledge.tsx
  • apps/tradinggoose/app/workspace/[workspaceId]/monitor/components/board/board-state.test.ts
  • apps/tradinggoose/app/workspace/[workspaceId]/monitor/components/board/monitor-board.interaction.test.tsx
  • apps/tradinggoose/app/workspace/[workspaceId]/monitor/components/board/monitor-board.test.tsx
  • apps/tradinggoose/app/workspace/[workspaceId]/monitor/components/data/execution-ordering.ts
  • apps/tradinggoose/app/workspace/[workspaceId]/monitor/components/data/use-monitor-workspace-logs.ts
  • apps/tradinggoose/app/workspace/[workspaceId]/monitor/components/timeline/monitor-timeline.test.tsx
  • apps/tradinggoose/app/workspace/[workspaceId]/monitor/components/timeline/timeline-state.test.ts
  • apps/tradinggoose/app/workspace/[workspaceId]/monitor/components/workspace/monitor-config-workspace.test.tsx
  • apps/tradinggoose/app/workspace/[workspaceId]/monitor/components/workspace/monitor-config-workspace.tsx
  • apps/tradinggoose/app/workspace/[workspaceId]/monitor/components/workspace/monitor-execution-workspace.test.tsx
  • apps/tradinggoose/app/workspace/[workspaceId]/monitor/components/workspace/monitor-execution-workspace.tsx
  • apps/tradinggoose/app/workspace/[workspaceId]/monitor/monitor.test.tsx
  • apps/tradinggoose/app/workspace/[workspaceId]/monitor/monitor.tsx
  • apps/tradinggoose/app/workspace/[workspaceId]/records/components/log-details/components/execution-snapshot/frozen-canvas.tsx
  • apps/tradinggoose/app/workspace/[workspaceId]/records/records.test.tsx
  • apps/tradinggoose/app/workspace/[workspaceId]/records/records.tsx
  • apps/tradinggoose/components/json-display/json-display.tsx
  • apps/tradinggoose/components/ui/sheet.test.tsx
  • apps/tradinggoose/components/ui/sheet.tsx
  • apps/tradinggoose/global-navbar/components/copilot-sidebar-toggle.test.tsx
  • apps/tradinggoose/global-navbar/components/copilot-sidebar-toggle.tsx
  • apps/tradinggoose/global-navbar/copilot-context.test.tsx
  • apps/tradinggoose/global-navbar/copilot-context.tsx
  • apps/tradinggoose/global-navbar/global-copilot-layout.test.tsx
  • apps/tradinggoose/global-navbar/global-copilot-layout.tsx
  • apps/tradinggoose/global-navbar/global-copilot-panel.test.tsx
  • apps/tradinggoose/global-navbar/global-copilot-panel.tsx
  • apps/tradinggoose/global-navbar/global-navbar.tsx
  • apps/tradinggoose/hooks/use-mobile.tsx
  • apps/tradinggoose/hooks/use-stream-cleanup.ts
  • apps/tradinggoose/i18n/messages/en.json
  • apps/tradinggoose/i18n/messages/es.json
  • apps/tradinggoose/i18n/messages/zh.json
  • apps/tradinggoose/lib/copilot/api.ts
  • apps/tradinggoose/lib/copilot/chat-contexts.test.ts
  • apps/tradinggoose/lib/copilot/chat-contexts.ts
  • apps/tradinggoose/lib/copilot/components/copilot-app.tsx
  • apps/tradinggoose/lib/copilot/components/copilot-message/components/assistant-message-segments.test.ts
  • apps/tradinggoose/lib/copilot/components/copilot-message/components/options-selector.test.ts
  • apps/tradinggoose/lib/copilot/components/copilot-message/copilot-message.test.tsx
  • apps/tradinggoose/lib/copilot/components/copilot-message/message-visibility.test.ts
  • apps/tradinggoose/lib/copilot/components/copilot/copilot.tsx
  • apps/tradinggoose/lib/copilot/components/user-input/components/model-selector.tsx
  • apps/tradinggoose/lib/copilot/components/user-input/hooks/use-user-input-mention-sources.test.tsx
  • apps/tradinggoose/lib/copilot/components/user-input/hooks/use-user-input-mention-sources.ts
  • apps/tradinggoose/lib/copilot/context-limits.ts
  • apps/tradinggoose/lib/copilot/execution-log-context.ts
  • apps/tradinggoose/lib/copilot/process-contents.test.ts
  • apps/tradinggoose/lib/copilot/process-contents.ts
  • apps/tradinggoose/lib/copilot/registry.ts
  • apps/tradinggoose/lib/copilot/review-sessions/thread-history.test.ts
  • apps/tradinggoose/lib/copilot/review-sessions/thread-history.ts
  • apps/tradinggoose/lib/copilot/tool-prompt-metadata.ts
  • apps/tradinggoose/lib/copilot/tools/client/base-tool.ts
  • apps/tradinggoose/lib/copilot/tools/client/manager.test.ts
  • apps/tradinggoose/lib/copilot/tools/client/manager.ts
  • apps/tradinggoose/lib/copilot/tools/server/router.test.ts
  • apps/tradinggoose/lib/copilot/tools/server/workflow/read-workflow-logs.test.ts
  • apps/tradinggoose/lib/copilot/tools/server/workflow/read-workflow-logs.ts
  • apps/tradinggoose/lib/security/redaction.test.ts
  • apps/tradinggoose/lib/security/redaction.ts
  • apps/tradinggoose/lib/trading/order-detail.ts
  • apps/tradinggoose/lib/trading/order-records.ts
  • apps/tradinggoose/lib/utils.test.ts
  • apps/tradinggoose/lib/utils.ts
  • apps/tradinggoose/lib/yjs/use-dashboard-color-pair.ts
  • apps/tradinggoose/lib/yjs/workflow-session-host.test.tsx
  • apps/tradinggoose/lib/yjs/workflow-session-host.tsx
  • apps/tradinggoose/scripts/i18n-catalog/inventory.test.ts
  • apps/tradinggoose/stores/console/store.test.ts
  • apps/tradinggoose/stores/console/store.ts
  • apps/tradinggoose/stores/copilot/channel-id.test.ts
  • apps/tradinggoose/stores/copilot/channel-id.ts
  • apps/tradinggoose/stores/copilot/index.ts
  • apps/tradinggoose/stores/copilot/store-lifecycle.test.tsx
  • apps/tradinggoose/stores/copilot/store-messages.test.ts
  • apps/tradinggoose/stores/copilot/store-messages.ts
  • apps/tradinggoose/stores/copilot/store-provenance.test.ts
  • apps/tradinggoose/stores/copilot/store-provenance.ts
  • apps/tradinggoose/stores/copilot/store.test.ts
  • apps/tradinggoose/stores/copilot/store.ts
  • apps/tradinggoose/stores/copilot/types.ts
  • apps/tradinggoose/stores/index.ts
  • apps/tradinggoose/widgets/registry.test.ts
  • apps/tradinggoose/widgets/registry.tsx
  • apps/tradinggoose/widgets/widget-config-runtime.tsx
  • apps/tradinggoose/widgets/widget-contract-types.ts
  • apps/tradinggoose/widgets/widget-contracts.ts
  • apps/tradinggoose/widgets/widgets/copilot/components/context-usage-pill/context-usage-pill.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/copilot-app.test.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/copilot-app.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/copilot-message/components/assistant-message-segments.test.ts
  • apps/tradinggoose/widgets/widgets/copilot/components/copilot-message/components/assistant-message-segments.ts
  • apps/tradinggoose/widgets/widgets/copilot/components/copilot-message/components/file-display.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/copilot-message/components/index.ts
  • apps/tradinggoose/widgets/widgets/copilot/components/copilot-message/components/markdown-renderer.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/copilot-message/components/options-selector.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/copilot-message/components/smooth-streaming.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/copilot-message/components/thinking-group.test.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/copilot-message/components/thinking-group.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/copilot-message/copilot-message.test.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/copilot-message/copilot-message.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/copilot-message/message-visibility.test.ts
  • apps/tradinggoose/widgets/widgets/copilot/components/copilot-message/message-visibility.ts
  • apps/tradinggoose/widgets/widgets/copilot/components/copilot/copilot-header.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/copilot/copilot.test.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/copilot/copilot.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/index.ts
  • apps/tradinggoose/widgets/widgets/copilot/components/todo-list/todo-list.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/user-input/components/access-level-selector.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/user-input/components/attached-files-grid.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/user-input/components/mention-menu.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/user-input/components/model-selector.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/user-input/constants.ts
  • apps/tradinggoose/widgets/widgets/copilot/components/user-input/hooks/use-user-input-attachments.ts
  • apps/tradinggoose/widgets/widgets/copilot/components/user-input/hooks/use-user-input-mention-sources.test.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/user-input/hooks/use-user-input-mention-sources.ts
  • apps/tradinggoose/widgets/widgets/copilot/components/user-input/hooks/use-user-input-mentions.ts
  • apps/tradinggoose/widgets/widgets/copilot/components/user-input/mention-copy.ts
  • apps/tradinggoose/widgets/widgets/copilot/components/user-input/mention-editor-dom.test.ts
  • apps/tradinggoose/widgets/widgets/copilot/components/user-input/mention-editor-dom.ts
  • apps/tradinggoose/widgets/widgets/copilot/components/user-input/mention-utils.test.ts
  • apps/tradinggoose/widgets/widgets/copilot/components/user-input/mention-utils.ts
  • apps/tradinggoose/widgets/widgets/copilot/components/user-input/types.ts
  • apps/tradinggoose/widgets/widgets/copilot/components/user-input/user-input.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/user-input/workspace-entity-mentions.ts
  • apps/tradinggoose/widgets/widgets/copilot/components/welcome/welcome.test.tsx
  • apps/tradinggoose/widgets/widgets/copilot/components/welcome/welcome.tsx
  • apps/tradinggoose/widgets/widgets/copilot/contract.ts
  • apps/tradinggoose/widgets/widgets/copilot/index.test.tsx
  • apps/tradinggoose/widgets/widgets/copilot/index.tsx
  • apps/tradinggoose/widgets/widgets/copilot/live-contexts.test.ts
  • apps/tradinggoose/widgets/widgets/copilot/live-contexts.ts
  • apps/tradinggoose/widgets/widgets/copilot/workspace-entities.test.ts
  • apps/tradinggoose/widgets/widgets/copilot/workspace-entities.ts
  • apps/tradinggoose/widgets/widgets/editor_workflow/components/workflow-editor/workflow-canvas.tsx

📝 Walkthrough

Walkthrough

The PR replaces the global Copilot panel with a workspace widget. It adds panel-scoped shared chat state, new context and execution-log processing, knowledge-base mentions, Copilot UI components, lifecycle cleanup, and updated documentation and tests.

Changes

Copilot widget migration

Layer / File(s) Summary
Widget registration and global integration removal
apps/tradinggoose/global-navbar/*, apps/tradinggoose/widgets/*, apps/tradinggoose/app/...
Copilot moves from global navigation and context publishers into the widget registry. Workspace pages no longer publish global Copilot context.
Chat contracts and server processing
apps/tradinggoose/app/api/copilot/*, apps/tradinggoose/lib/copilot/*
Context schemas, hydration, review-session persistence, and workflow-log responses now use the revised Copilot contracts.
Shared store and Copilot UI
apps/tradinggoose/stores/copilot/*, apps/tradinggoose/widgets/widgets/copilot/*
Copilot stores synchronize shared review-session state across widget channels. The new UI includes chat, messages, mentions, models, access levels, todos, and welcome content.
Supporting cleanup and documentation
apps/docs/*, apps/tradinggoose/hooks/*, apps/tradinggoose/lib/utils.ts, apps/tradinggoose/lib/trading/*
Documentation describes widget usage. Stream cleanup and API-key redaction utilities are added or relocated. Supporting fixtures and translations are updated.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant CopilotWidget
  participant CopilotStore
  participant ChatRoute
  participant ContextProcessor
  User->>CopilotWidget: Enter message and contexts
  CopilotWidget->>CopilotStore: Update channel-scoped chat state
  CopilotStore->>ChatRoute: Send message with live context
  ChatRoute->>ContextProcessor: Hydrate workspace contexts
  ContextProcessor-->>ChatRoute: Return processed contexts
  ChatRoute-->>CopilotStore: Stream assistant response
  CopilotStore-->>CopilotWidget: Update messages and tool state
Loading

Possibly related PRs

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch revert-191-refactor/persisted-copilot

Comment @coderabbitai help to get the list of available commands.

@BruzWJ
BruzWJ merged commit 6ae06f9 into staging Aug 16, 2026
0 of 2 checks passed
@BruzWJ
BruzWJ deleted the revert-191-refactor/persisted-copilot branch August 16, 2026 01:45
@greptile-apps

greptile-apps Bot commented Aug 16, 2026

Copy link
Copy Markdown
Contributor

Greptile Summary

Reverts the persistent global Copilot panel and restores Copilot as a dashboard widget with panel/pair-color channels. Major changes include:

  • Moves Copilot UI and context behavior back into the widget registry and dashboard pairing model
  • Reworks Copilot chat context hydration, message state, and session synchronization
  • Removes global navbar Copilot components and page-level context publishers
  • Alters workflow-session hosting and monitor/record context integration

Confidence Score: 0/5

The PR is not safe to merge until unbounded context hydration, cross-account Copilot store retention, and stale Yjs document scoping are corrected.

The reverted safeguards permit resource amplification through arbitrary context arrays, retain user conversation state in non-default widget stores across account resets, and temporarily associate a prior workflow's writable Yjs document with a newly selected workflow.

Files Needing Attention: apps/tradinggoose/app/api/copilot/chat/route.ts, apps/tradinggoose/lib/copilot/process-contents.ts, apps/tradinggoose/lib/yjs/workflow-session-host.tsx, apps/tradinggoose/stores/copilot/store.ts, apps/tradinggoose/stores/index.ts

Security Review

Two security-relevant regressions were identified:

  • Authenticated callers can submit unbounded Copilot context arrays, causing arbitrary concurrent hydration work and oversized upstream payloads.
  • Non-default Copilot widget stores survive logout/account transitions and can expose the previous user's conversation when a channel identifier is reused.

Important Files Changed

Filename Overview
apps/tradinggoose/app/api/copilot/chat/route.ts Removes context-count enforcement and moves request-controlled context hydration ahead of review-session loading.
apps/tradinggoose/lib/copilot/process-contents.ts Removes context deduplication, cancellation, redaction, and byte limits while concurrently hydrating every supplied context.
apps/tradinggoose/lib/yjs/workflow-session-host.tsx Removes workflowId-scoped Yjs write state, exposing the previous workflow document during identity transitions.
apps/tradinggoose/stores/copilot/store.ts Restores indefinitely cached panel/pair stores without authenticated-user or workspace scoping.
apps/tradinggoose/stores/index.ts Logout reset now clears only two fields in the default Copilot store, leaving widget-channel state retained.
apps/tradinggoose/widgets/widgets/copilot/index.tsx Restores the Copilot dashboard widget and binds it directly to dashboard-derived channel identifiers.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Request[Copilot chat request] --> Contexts[Unbounded contexts array]
  Contexts --> Hydration[Concurrent server hydration]
  Hydration --> Upstream[External Copilot request]
  Widget[Copilot dashboard widget] --> Channel[Pair or panel channel ID]
  Channel --> Registry[Persistent Copilot store registry]
  Logout[Logout reset] --> Default[Default store only]
  Registry -. retained non-default stores .-> NextUser[Later workspace or user]
  Editor[Workflow editor changes workflowId] --> Provider[Mounted WorkflowSessionProvider]
  Provider --> OldDoc[Previous Yjs document until effect]
  OldDoc --> WrongWorkflow[Wrong workflow read or mutation]
Loading

Fix all with Greploop

Fix All in Codex Fix All in Claude Code Fix All in Cursor

Prompt To Fix All With AI
### Issue 1
apps/tradinggoose/app/api/copilot/chat/route.ts:709
**Unbounded context hydration**

When an authenticated caller submits a large `contexts` array, the route accepts every entry and hydrates them concurrently without cardinality or aggregate-size limits, causing excessive server work and oversized upstream Copilot requests.

**How this was verified:** The request schema no longer applies the 16-context limit, and the complete array is mapped to concurrent hydration tasks without aggregate output-size enforcement.

### Issue 2
apps/tradinggoose/lib/yjs/workflow-session-host.tsx:81-83
**Stale workflow document scope**

When a mounted `WorkflowSessionProvider` changes from workflow A to workflow B, `writeState` still contains workflow A's document until the effect runs, so the transition render exposes the old document and writable ref under workflow B's identity and can read or mutate the wrong workflow.

### Issue 3
apps/tradinggoose/stores/index.ts:71
**Widget stores survive logout**

When a user signs out after using a non-default Copilot widget channel, `resetAllStores` clears only the default store while panel and pair-color stores remain cached, causing a reused channel to retain the previous user's conversation, tool state, and pending stream state.

**How this was verified:** Non-default stores remain in the module-level channel registry, while the logout reset updates only `getCopilotStore()` and no widget lifecycle clears those retained stores.

### Issue 4
apps/docs/content/docs/en/widgets/copilot.mdx:1-4
**Missing staging changelog entry**

This staging-targeted revert adds no dated markdown file under `changelog/`, leaving the change out of the repository's required branch history and changelog-aware downstream workflows.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Reviews (1): Last reviewed commit: "Revert "feat(copilot): add persistent wo..." | Re-trigger Greptile

contexts: z.array(ChatContextSchema).optional(),
})

/** POST /api/copilot/chat */

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 security Unbounded context hydration

When an authenticated caller submits a large contexts array, the route accepts every entry and hydrates them concurrently without cardinality or aggregate-size limits, causing excessive server work and oversized upstream Copilot requests.

How this was verified: The request schema no longer applies the 16-context limit, and the complete array is mapped to concurrent hydration tasks without aggregate output-size enforcement.

Knowledge Base Used: API Routes (apps/tradinggoose/app/api)

Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/tradinggoose/app/api/copilot/chat/route.ts
Line: 709

Comment:
**Unbounded context hydration**

When an authenticated caller submits a large `contexts` array, the route accepts every entry and hydrates them concurrently without cardinality or aggregate-size limits, causing excessive server work and oversized upstream Copilot requests.

**How this was verified:** The request schema no longer applies the 16-context limit, and the complete array is mapped to concurrent hydration tasks without aggregate output-size enforcement.

**Knowledge Base Used:** [API Routes (`apps/tradinggoose/app/api`)](https://app.greptile.com/tradinggoose/-/custom-context/knowledge-base/tradinggoose/tradinggoose-studio/-/docs/api-routes.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Fix in Codex Fix in Claude Code Fix in Cursor

Comment on lines +81 to +83
const [writeState, setWriteState] = useState<SharedWorkflowSessionState>(() =>
getSharedWorkflowSessionState(workflowId)
)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Stale workflow document scope

When a mounted WorkflowSessionProvider changes from workflow A to workflow B, writeState still contains workflow A's document until the effect runs, so the transition render exposes the old document and writable ref under workflow B's identity and can read or mutate the wrong workflow.

Rule Used: This repo is Yjs-first for collaborative workflow ... (source)

Knowledge Base Used: Frontend Stores

Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/tradinggoose/lib/yjs/workflow-session-host.tsx
Line: 81-83

Comment:
**Stale workflow document scope**

When a mounted `WorkflowSessionProvider` changes from workflow A to workflow B, `writeState` still contains workflow A's document until the effect runs, so the transition render exposes the old document and writable ref under workflow B's identity and can read or mutate the wrong workflow.

**Rule Used:** This repo is Yjs-first for collaborative workflow ... ([source](greptile.json))

**Knowledge Base Used:** [Frontend Stores](https://app.greptile.com/tradinggoose/-/custom-context/knowledge-base/tradinggoose/tradinggoose-studio/-/docs/frontend-stores.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Fix in Codex Fix in Claude Code Fix in Cursor

useExecutionStore.getState().reset()
useConsoleStore.setState({ entries: [] })
resetCopilotStoreRegistry()
getCopilotStore().setState({ messages: [], isSendingMessage: false })

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 security Widget stores survive logout

When a user signs out after using a non-default Copilot widget channel, resetAllStores clears only the default store while panel and pair-color stores remain cached, causing a reused channel to retain the previous user's conversation, tool state, and pending stream state.

How this was verified: Non-default stores remain in the module-level channel registry, while the logout reset updates only getCopilotStore() and no widget lifecycle clears those retained stores.

Knowledge Base Used:

Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/tradinggoose/stores/index.ts
Line: 71

Comment:
**Widget stores survive logout**

When a user signs out after using a non-default Copilot widget channel, `resetAllStores` clears only the default store while panel and pair-color stores remain cached, causing a reused channel to retain the previous user's conversation, tool state, and pending stream state.

**How this was verified:** Non-default stores remain in the module-level channel registry, while the logout reset updates only `getCopilotStore()` and no widget lifecycle clears those retained stores.

**Knowledge Base Used:**
- [Frontend Stores](https://app.greptile.com/tradinggoose/-/custom-context/knowledge-base/tradinggoose/tradinggoose-studio/-/docs/frontend-stores.md)
- [Dashboard Widgets](https://app.greptile.com/tradinggoose/-/custom-context/knowledge-base/tradinggoose/tradinggoose-studio/-/docs/widgets.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Fix in Codex Fix in Claude Code Fix in Cursor

BruzWJ added a commit that referenced this pull request Aug 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant