Warning
Review limit reached
Only developers with an assigned seat can use this organization's usage-based review budget, and seats here are assigned manually. Ask an admin to assign a seat, or change the review continuation mode in Billing.
Next included review available in 23 minutes.
View limit details
Limit details: You’ve used all 10 included reviews currently available.
Review configuration:
⚙️ Run configuration
- Configuration used: Path: .coderabbit.config.ts
- Review profile: CHILL
- Plan: Advanced
- Run ID:
a09cbff6-364a-40c3-bd70-37a851797006
📥 Commits
Reviewing files that changed from the base of the PR and between 68c1401c7658857110ef8660cc904778c37d2895 and 5a16f179fb4f56aa8827763ea9c49698f6112bb6.
📒 Files selected for processing: 5
apps/web/src/browser/ElectronBrowserHost.tsxapps/web/src/components/preview/previewSessionSync.browser.test.tsapps/web/src/components/preview/usePreviewSession.tspackages/client-runtime/src/state/preview.tspackages/client-runtime/src/state/runtime.test.ts
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
- Configuration used: Path: .coderabbit.config.ts
- Review profile: CHILL
- Plan: Advanced
- Run ID:
d693419d-3897-46ab-91ac-a54011a65fc0
📥 Commits
Reviewing files that changed from the base of the PR and between a357bf832b381aad01b245ab3b9ade0444cdda45 and 68c1401c7658857110ef8660cc904778c37d2895.
📒 Files selected for processing: 5
apps/web/src/browser/ElectronBrowserHost.tsxapps/web/src/components/preview/previewSessionSync.browser.test.tsapps/web/src/components/preview/usePreviewSession.tspackages/client-runtime/src/state/preview.tspackages/client-runtime/src/state/runtime.test.ts
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.
📝 Walkthrough
The runtime publishes preview events individually. In Electron, the host starts environment-scoped synchronization for threads discovered in preview events.
Changes: Desktop preview sessions
Layer / File(s) Summary Publish preview events individually
packages/client-runtime/src/state/preview.ts,packages/client-runtime/src/state/runtime.test.tsThe preview subscription rechunks its stream so each event is published separately. Runtime tests check that batched opened and closed events arrive in order. Synchronize desktop preview sessions
apps/web/src/components/preview/usePreviewSession.ts,apps/web/src/browser/ElectronBrowserHost.tsx,apps/web/src/components/preview/previewSessionSync.browser.test.tsThe desktop hook mounts scoped preview synchronization for new eligible thread IDs in Electron. ElectronBrowserHostcalls the hook with the primary environment ID. Browser tests cover opened, list, and closed events.Priority: ⬇️ Low
Estimated code review effort: 3 (Moderate) | ~20 minutes
Change: Bug fix
Sequence Diagram(s)
mermaid1 sequenceDiagram 2 participant ElectronBrowserHost 3 participant useDesktopHostedPreviewSessions 4 participant PreviewEventsSubscription 5 participant PerThreadPreviewSync 6 ElectronBrowserHost->>useDesktopHostedPreviewSessions: Passes primaryEnvironmentId 7 useDesktopHostedPreviewSessions->>PreviewEventsSubscription: Subscribes to environment events 8 PreviewEventsSubscription->>useDesktopHostedPreviewSessions: Publishes individual preview events 9 useDesktopHostedPreviewSessions->>PerThreadPreviewSync: Mounts sync for a new eligible thread ID Suggested reviewers:
juliusmarminge
Merge Risk: ⚪ Minimal · up to 68c14
Background desktop preview attachment has no identified merge-blocking issue; normal checks remain appropriate.
Security architecture risk: 🔵 Low · up to 68c14
Background previews can now start without opening their chats. Existing environment scoping and preview permissions remain in place, and no permission bypass was established. Cleanup across environment changes and packaged desktop behavior remain partly unverified.
Retained concerns No architecture-level concerns identified.
Security review details
Security Blast Radius
- inferred — The effective expansion is desktop hosting for event-discovered background threads in the primary environment, using existing browser profiles and desktop-tab mechanisms. It is not merely a rendering change, but the inspected path does not establish new authority over another environment or service.
Trust Boundaries and Controls
- observed — Server WebSocket setup authenticates the session and installs RPC scope authorization. Preview list and event subscription require orchestration-read scope; preview mutation methods require preview-operation scope. Independently, desktop rendering requires preview-operation permission for the session's environment. These inspected controls are unchanged from the comparison base.
Resilience and Maintainability Implications
- inferred — Retained state across discovery disposal is a lifecycle uncertainty, not an established authorization bypass. The store's retention predates this PR, and the existing host filter excludes server-runtime sessions outside the current primary environment. Permission checks also remain tied to the original environment. These controls limit the security interpretation of stale-state scenarios.
Hardening Proposals
- proposed — Define and verify the intended retained-session policy across primary-environment replacement, clearing the primary environment, and reconnecting after missed close events. Validate subscription disposal and externally visible webview removal together, without assuming retained snapshots must always be deleted.
Pre-merge checks: Passed 4
Check name Status Explanation Title check Passed The title clearly and concisely describes the main fix: opening agent tabs from background threads in the desktop browser. Description check Passed The description explains the problem, implementation, verification, limitations, and affected platforms. It is mostly complete, although it does not explicitly document maintainer approval or explain … Linked Issues check Passed Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request. Full details: Description check
Explanation
The description explains the problem, implementation, verification, limitations, and affected platforms. It is mostly complete, although it does not explicitly document maintainer approval or explain why the fix qualifies without prior approval.
✨ Finishing Touches
🧪 Generate unit tests (beta)
- Create a new PR
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
