aaron/graphs #2702

aaronvg · 2025-11-06T23:35:48Z

design-docs v1
plans 1-3
move baml-graphs files over
add tests
test runner changes
wip migrating old code to sdk

Note

Refactors playground to use a new SDK-based runtime/selection model, adds ReactFlow workflow graph with auto‑layout and detail panel, centralizes navigation/test execution, and replaces direct WASM/mermaid paths.

SDK Core:
- Introduces BamlRuntime (WASM) and MockBamlRuntime, unified interface/types, and JotaiStorage for state.
- Consolidates atoms (diagnostics, selection, tests, files, feature flags) and adds unified unifiedSelectionAtom with SelectionBridge.
- Adds navigation heuristic (navigationHeuristic) and cursor/test selection syncing.
Graph & Detail Panel:
- Replaces Mermaid view with ReactFlow graph (GraphView) + ELK auto‑layout, custom nodes/edges, and camera pan utilities.
- Adds DetailPanel (I/O, logs, history) and workflow UI components (toolbar/indicator).
Test Execution:
- Routes test runs through SDK (tests.run/runAll/cancel), adds watch notifications, flashing regions, and history atoms.
Prompt Preview:
- Renders prompts/cURL via SDK runtime (renderPromptForTest/renderCurlForTest), updates media rendering and token stats.
Playground Integration:
- Unifies Preview/Graph in UnifiedPromptPreview, introduces bottom panel switching, updates sidebar and function/test items.
Build/Config:
- Vite/Tailwind tweaks, new vitest config, dependency bumps.
Docs/Tests:
- Adds design/implementation docs and vitest suites for navigation and runtime integration.

^{Written by Cursor Bugbot for commit ec4b57c. This will update automatically on new commits. Configure here.}

vercel · 2025-11-06T23:35:53Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
promptfiddle	Error			Nov 10, 2025 2:06am

github-actions · 2025-11-06T23:37:45Z

🌿 Preview your docs: https://boundary-preview-f307442b-c983-49b5-9b4c-7b96b6904019.docs.buildwithfern.com

typescript/packages/playground-common/src/baml_wasm_web/EventListener.tsx

+  // Main message handler - routes IDE/LSP messages to SDK methods
  useEffect(() => {
-    const fn = (event: MessageEvent<VscodeToWebviewCommand>) => {
+    const handler = async (event: MessageEvent<VscodeToWebviewCommand>) => {


To address this issue, we need to verify the event.origin property in the main 'message' event handler before any processing occurs. This means modifying the handler function (defined at line 95) so that it only routes messages if they originate from a trusted source.

General steps:

Define an allow-list of trusted origins (for example: only window.origin, or a set of specific URLs, whatever fits the application's security model).

In the handler, early return if event.origin does not match a trusted origin.

Optionally, add logging for denied origins.

Best way in this code:

Since the handler runs in the webview/SPA, and likely only communicates with itself (e.g., the origin of the webapp), use window.location.origin as the only trusted origin.

Add a check: if (event.origin !== window.location.origin) { return; } at the beginning of the handler.

Optionally, log or warn if a message is ignored for documentation/debugging.

These changes are all done inside the existing handler definition, and no additional dependencies are needed.

Files/lines to change:
Edit typescript/packages/playground-common/src/baml_wasm_web/EventListener.tsx, inside the handler defined at line 95.

No external imports or new methods are needed.

github-actions · 2025-11-06T23:52:11Z

https://sage-backend-ovirkdwqn-baml.vercel.app

github-actions · 2025-11-08T02:56:08Z

🌿 Preview your docs: https://boundary-preview-acdb8e1a-2938-4741-b7db-86e8cc7bfb43.docs.buildwithfern.com

github-actions · 2025-11-08T02:56:34Z

https://sage-backend-1p2572ucw-baml.vercel.app

github-actions · 2025-11-09T21:39:01Z

https://sage-backend-o759ni95n-baml.vercel.app

github-actions · 2025-11-09T21:39:14Z

🌿 Preview your docs: https://boundary-preview-1927b766-0156-4b4d-846f-93bc8d508147.docs.buildwithfern.com

github-actions · 2025-11-10T01:10:31Z

🌿 Preview your docs: https://boundary-preview-5a1a9683-eb9e-443c-b7b7-a1c34305471c.docs.buildwithfern.com

github-actions · 2025-11-10T01:10:39Z

https://sage-backend-b2u4gsx71-baml.vercel.app

cursor · 2025-11-10T01:11:26Z

typescript/packages/playground-common/src/features/graph/layout/node/algorithms/elk-geometry.ts

+        ? outsidePoint.y - h - y
+        : y - h - outsidePoint.y;
+    r = (R * q) / Q;
+    const res = {


Bug: Division by Zero: Order of Operations Flaw

Division by zero vulnerability when Q equals zero. At line 73, r = (R * q) / Q performs division without checking if Q is zero. While there's a check if (Q === 0) at line 87 that sets res.y, the division at line 73 executes first and will produce Infinity or NaN when Q is zero, corrupting the calculation before the check can fix it. The check should occur before the division.

cursor · 2025-11-10T01:11:26Z

typescript/packages/playground-common/src/features/graph/layout/node/algorithms/elk-geometry.ts

+      r = x - w - outsidePoint.x;
+    }
+    const q = (Q * r) / R;
+    let _x =


Bug: Division by Zero: Check Order Matters

Division by zero vulnerability when R equals zero. At line 100, const q = (Q * r) / R performs division without checking if R is zero. While there's a check if (R === 0) at line 108 that sets _x, the division at line 100 executes first and will produce Infinity or NaN when R is zero, corrupting the calculation before the check can fix it. The check should occur before the division.

cursor · 2025-11-10T01:11:27Z

typescript/packages/playground-common/src/sdk/atoms/core.atoms.ts

+  return runtime?.getWorkflows() ?? [];
+}, (get, set, update: FunctionWithCallGraph[]) => {
+  set(workflowsAtom, update);
+});


Bug: Atom Write Recursion: Breaking the Jotai Model

Infinite recursion in workflowsAtom write function. The setter calls set(workflowsAtom, update) which recursively invokes itself, causing a stack overflow. The write function should update an internal state atom rather than calling itself. This pattern breaks Jotai's derived atom model where the read function should be the source of truth derived from runtimeInstanceAtom.

github-actions · 2025-11-10T01:46:31Z

🌿 Preview your docs: https://boundary-preview-c601fb96-5fac-4ac6-903e-dfcf6dd6cdd7.docs.buildwithfern.com

github-actions · 2025-11-10T01:46:43Z

https://sage-backend-9f5zvzn4c-baml.vercel.app

github-actions · 2025-11-10T01:52:29Z

🌿 Preview your docs: https://boundary-preview-935ee4be-e43e-46ec-80a5-8a6d4fb778ed.docs.buildwithfern.com

github-actions · 2025-11-10T01:52:49Z

https://sage-backend-2wh39jk7r-baml.vercel.app

aaronvg added 6 commits November 4, 2025 15:05

design-docs v1

d67a726

plans 1-3

2f95963

move baml-graphs files over

5ff06a6

add tests

e92a8d8

test runner changes

9dc2600

wip migrating old code to sdk

9cc852b

aaronvg temporarily deployed to boundary-tools-dev November 6, 2025 23:35 — with GitHub Actions Inactive

github-advanced-security bot found potential problems Nov 6, 2025

View reviewed changes

vercel bot had a problem deploying to Preview November 6, 2025 23:51 Failure

aaronvg added 4 commits November 6, 2025 16:21

test runner migrated

ae1bd70

things

8904e7c

checkpoint

35af3e4

function click fix

5a64cdd

aaronvg had a problem deploying to boundary-tools-dev November 8, 2025 02:53 — with GitHub Actions Error

remove logs

f760578

aaronvg temporarily deployed to boundary-tools-dev November 8, 2025 02:54 — with GitHub Actions Inactive

vercel bot had a problem deploying to Preview November 8, 2025 03:09 Failure

fix test panel atom states

9d0cb1a

aaronvg temporarily deployed to boundary-tools-dev November 8, 2025 03:10 — with GitHub Actions Inactive

vercel bot had a problem deploying to Preview November 9, 2025 21:12 Failure

checkpoint, working integration1

e572273

aaronvg temporarily deployed to boundary-tools-dev November 9, 2025 21:36 — with GitHub Actions Inactive

vercel bot had a problem deploying to Preview November 9, 2025 21:54 Failure

aaronvg added 2 commits November 9, 2025 14:07

fix selection bug

92192b5

new debug panel with ifs

a9f435e

aaronvg temporarily deployed to boundary-tools-dev November 10, 2025 01:08 — with GitHub Actions Inactive

cursor bot reviewed Nov 10, 2025

View reviewed changes

vercel bot had a problem deploying to Preview November 10, 2025 01:23 Failure

arrow pointer thing

03a279d

aaronvg temporarily deployed to boundary-tools-dev November 10, 2025 01:44 — with GitHub Actions Inactive

tweak

ec4b57c

aaronvg temporarily deployed to boundary-tools-dev November 10, 2025 01:50 — with GitHub Actions Inactive

vercel bot had a problem deploying to Preview November 10, 2025 02:06 Failure

@@ -93,6 +93,11 @@
               // Main message handler - routes IDE/LSP messages to SDK methods
               useEffect(() => {
                 const handler = async (event: MessageEvent<VscodeToWebviewCommand>) => {
+                  // Only accept messages from same origin
+                  if (event.origin !== window.location.origin) {
+                    console.warn('[EventListener] Ignoring message from untrusted origin:', event.origin);
+                    return;
+                  }
                   const { source, payload } = event.data;
                   console.debug('[EventListener] Handling command:', { source, payload });

aaron/graphs #2702

Are you sure you want to change the base?

aaron/graphs #2702

Uh oh!

Conversation

aaronvg commented Nov 6, 2025 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel bot commented Nov 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Nov 6, 2025

Uh oh!

Check warning

Copilot Autofix

github-actions bot commented Nov 6, 2025

Uh oh!

github-actions bot commented Nov 8, 2025

Uh oh!

github-actions bot commented Nov 8, 2025

Uh oh!

github-actions bot commented Nov 9, 2025

Uh oh!

github-actions bot commented Nov 9, 2025

Uh oh!

github-actions bot commented Nov 10, 2025

Uh oh!

github-actions bot commented Nov 10, 2025

Uh oh!

cursor bot Nov 10, 2025

Choose a reason for hiding this comment

Bug: Division by Zero: Order of Operations Flaw

Uh oh!

cursor bot Nov 10, 2025

Choose a reason for hiding this comment

Bug: Division by Zero: Check Order Matters

Uh oh!

cursor bot Nov 10, 2025

Choose a reason for hiding this comment

Bug: Atom Write Recursion: Breaking the Jotai Model

Uh oh!

github-actions bot commented Nov 10, 2025

Uh oh!

github-actions bot commented Nov 10, 2025

Uh oh!

github-actions bot commented Nov 10, 2025

Uh oh!

github-actions bot commented Nov 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

aaronvg commented Nov 6, 2025 •

edited by cursor bot

Loading

vercel bot commented Nov 6, 2025 •

edited

Loading