fix: render web-UI slash commands compactly instead of leaking prompt - #1055
Open
snazzybean wants to merge 1 commit into
Open
fix: render web-UI slash commands compactly instead of leaking prompt#1055snazzybean wants to merge 1 commit into
snazzybean wants to merge 1 commit into
Conversation
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
🚧 Files skipped from review as they are similar to previous changes (5)
📝 WalkthroughWalkthroughLocal slash commands now separate compact chat display text from expanded provider prompts across Claude normalization, command submission, queued-draft persistence, and automatic sending. ChangesLocal command flow
Sequence Diagram(s)sequenceDiagram
participant Composer
participant QueueStorage
participant AutoSend
participant ClaudeSessionsProvider
Composer->>Composer: Build displayText and promptContent
Composer->>QueueStorage: Persist content and promptContent
QueueStorage->>AutoSend: Restore queued command
AutoSend->>ClaudeSessionsProvider: Send promptContent
ClaudeSessionsProvider-->>Composer: Normalize local-command message
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
snazzybean
force-pushed
the
fix/1009-command-prompt-leak
branch
3 times, most recently
from
July 22, 2026 21:09
bb23730 to
e438c50
Compare
snazzybean
marked this pull request as ready for review
July 22, 2026 21:14
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
server/modules/providers/list/claude/claude-sessions.provider.ts (1)
356-384: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winAttach images to the compact command bubble.
When this array entry includes images, the local-command branch emits a text message without
imageAttachmentsand leavesimagesAttachedfalse. Lines 412-424 then add a second image-only user bubble on replay. Mirror the normal text branch by attaching the images here and settingimagesAttached = true; add a command-plus-image regression case.Proposed fix
messages.push(createNormalizedMessage({ id: `${baseId}_cmd_${partIndex}`, sessionId, timestamp: ts, provider: PROVIDER, kind: 'text', role: 'user', content: displayText, + images: !imagesAttached && imageAttachments.length > 0 + ? imageAttachments + : undefined, commandName: localCommandPayload.commandName, commandMessage: localCommandPayload.commandMessage, commandArgs: localCommandPayload.commandArgs, isLocalCommand: true, })); + imagesAttached = true;🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/modules/providers/list/claude/claude-sessions.provider.ts` around lines 356 - 384, The local-command branch around buildLocalCommandDisplayText must attach pending imageAttachments to the emitted command message using the same imagesAttached guard as the normal text branch, then set imagesAttached = true after emission. Add a regression case covering a local command with images and verify replay produces one command-plus-image user message rather than a separate image-only bubble.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@server/modules/providers/list/claude/claude-sessions.provider.ts`:
- Around line 352-373: Update the local-command parsing in the array-content
handling around parseLocalCommandPayload so it only accepts a complete CLI
wrapper at the beginning of the text, rather than any embedded command tag.
Preserve surrounding or non-wrapper text as normal content, while continuing to
build the compact display message for valid submitter-emitted wrappers.
---
Outside diff comments:
In `@server/modules/providers/list/claude/claude-sessions.provider.ts`:
- Around line 356-384: The local-command branch around
buildLocalCommandDisplayText must attach pending imageAttachments to the emitted
command message using the same imagesAttached guard as the normal text branch,
then set imagesAttached = true after emission. Add a regression case covering a
local command with images and verify replay produces one command-plus-image user
message rather than a separate image-only bubble.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 5aae9bfe-f283-4eea-a722-18cc55383047
📒 Files selected for processing (5)
server/modules/providers/list/claude/claude-sessions.provider.tsserver/modules/providers/tests/claude-local-command-invocation.test.tssrc/components/chat/hooks/useChatComposerState.tssrc/components/chat/utils/chatStorage.tssrc/hooks/useQueuedMessageAutoSend.ts
snazzybean
force-pushed
the
fix/1009-command-prompt-leak
branch
from
July 23, 2026 17:27
2940f6c to
576746d
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/components/chat/utils/chatStorage.ts`:
- Around line 83-84: Update the parsed queued-message handling around
StoredQueuedMessage to validate promptContent at runtime before returning it:
preserve it only when it is a string, otherwise omit it or set it to the
existing absent-value representation. Keep the content.trim() check and return
behavior unchanged, ensuring malformed persisted promptContent cannot reach
useQueuedMessageAutoSend.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 5efb5bb9-e9c9-4cd7-b7e4-53aef65493ab
📒 Files selected for processing (5)
server/modules/providers/list/claude/claude-sessions.provider.tsserver/modules/providers/tests/claude-local-command-invocation.test.tssrc/components/chat/hooks/useChatComposerState.tssrc/components/chat/utils/chatStorage.tssrc/hooks/useQueuedMessageAutoSend.ts
🚧 Files skipped from review as they are similar to previous changes (2)
- src/hooks/useQueuedMessageAutoSend.ts
- src/components/chat/hooks/useChatComposerState.ts
snazzybean
force-pushed
the
fix/1009-command-prompt-leak
branch
from
July 23, 2026 17:32
576746d to
4d330c3
Compare
snazzybean
force-pushed
the
fix/1009-command-prompt-leak
branch
from
July 28, 2026 18:51
4d330c3 to
ca10db4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1009
Problem
Custom slash commands were expanded client-side and their full body was sent as the chat message, so the internal prompt showed up as a user bubble both live and after a reload.
Reproduction
/handoff just the essentials./handoff just the essentials, live and after reload.Change
Display text and the sent prompt are now separate. The bubble only shows
/name args, while Claude receives the expanded body wrapped in the CLI-native<command-name>tags. On reload the existing normalization folds that back into the compact form. The array-content branch parses the same wrapper, since aborted and streamed runs deliver the prompt as array text. Other providers keep receiving the plain body.Tests
5 new node:test cases: string and array form, empty args, native tag-only, and a negative case.
npm run typecheck,npm run lint, andnpm run buildare all green.Review focus
The delicate part is the fingerprint coupling: frontend and backend must format the command identically, otherwise a duplicate bubble appears after the run completes. Please also check the non-Claude path.
Summary by CodeRabbit
New Features
Bug Fixes
Tests