feat(frontend): add AutoGPT logo to share page and zip download for outputs - #11741
Conversation
…utputs - Add AutoGPT logo header to the share page layout with dark/light mode support - Modify download functionality to bundle all outputs into a single zip file - Add jszip dependency for zip file generation - Handle both text outputs and file attachments in the zip
github-project-automation
Bot
moved this to 🆕 Needs initial review
in AutoGPT development kanban
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds Changes
Sequence Diagram(s)sequenceDiagram
participant User as "User"
participant UI as "UI"
participant DownloadUtil as "DownloadUtil"
participant RemoteHost as "RemoteHost"
participant ZipCreator as "ZIP Creator"
participant Browser as "Browser"
User->>UI: Click "Download"
UI->>DownloadUtil: provide DownloadItems
DownloadUtil->>DownloadUtil: separate texts, blobs, URLs
DownloadUtil->>RemoteHost: fetch remote URLs (fetchFileAsBlob)
RemoteHost-->>DownloadUtil: blob or fetch error
DownloadUtil->>ZipCreator: add blobs and combined text files
DownloadUtil->>ZipCreator: add unfetchable URLs -> unfetched_files.txt
ZipCreator-->>DownloadUtil: outputs.zip
DownloadUtil->>Browser: trigger save of outputs.zip
Browser-->>User: download complete
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
ntindle
changed the title
|
Thank you for submitting this PR to add the AutoGPT logo to the share page and implement zip downloading for outputs. The implementation looks good, but there are a few items that need to be addressed before this can be merged:
The code changes themselves look appropriate - adding the jszip dependency, implementing the logo in the share page layout with dark/light mode support, and enhancing the download functionality to bundle all outputs into a single zip file. Once you've updated the PR description and completed the checklist, we can proceed with the review process. |
|
Thank you for your contribution! The changes to add the AutoGPT logo to the share page and implement zip download functionality for outputs look good technically, but there are a few things that need to be addressed before this PR can be merged:
Your code changes look good - I particularly like the thoughtful implementation of the zip functionality with unique filename handling. Once you complete the description and checklist, this PR should be ready for another review. |
- Move AutoGPT logo from top left to top right in the header - Change logo link to /login page (redirects to library if signed in, signup if new user)
|
Thanks for your contribution! The code changes look good, but there are a couple of issues that need to be addressed before this can be merged:
The code implementation itself looks solid:
Please update the PR description with the required information, and this should be good to go! |
|
@claude update the pr description please to follow the template |
|
@claude re-lock the frontend pnpm for the added dependency |
|
Claude finished @ntindle's task in 54s —— View job Updating PR Description
Done! I've updated the PR description to follow the template:
|
|
Claude finished @ntindle's task in 1m 1s —— View job Re-locking Frontend pnpm Dependencies
Regenerated |
Co-authored-by: Nicholas Tindle <ntindle@users.noreply.github.com>
|
As tested by agent |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.
🔍 PR Overlap DetectionThis check compares your PR against all other open PRs targeting the same branch to detect potential merge conflicts early. 🔴 Merge Conflicts DetectedThe following PRs have been tested and will have merge conflicts if merged after this PR. Consider coordinating with the authors.
🟢 Low Risk — File Overlap OnlyThese PRs touch the same files but different sections (click to expand)
Summary: 3 conflict(s), 0 medium risk, 11 low risk (out of 14 PRs with file overlap) Auto-generated on push. Ignores: |
…p ordering - file_id parameter now enforces UUID regex pattern matching share_token - Moved delete_shared_execution_files before update_share_status to eliminate the window where old allowlist records + new token coexist Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Prevents cross-workspace file exposure via crafted agent outputs. create_shared_execution_files now validates that file IDs belong to the execution owner's workspace before adding them to the allowlist. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
… messages - Text content (combined_output.txt, unfetched_files.txt) now counted toward MAX_TOTAL_SIZE_BYTES aggregate zip limit - Split ForeignKeyViolationError and UniqueViolationError into separate except blocks with accurate log messages Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Boy Scout Rule cleanup of unused assignments from merged copilot code. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
github-actions
Bot
added
the
conflicts
|
This pull request has conflicts with the base branch, please resolve those so we can evaluate the pull request. |
github-actions
Bot
removed
the
conflicts
|
Conflicts have been resolved! 🎉 A maintainer will review the pull request shortly. |
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 14fb67d. Configure here.
Prevents stale workspace file URLs when shareToken changes while outputs remain the same. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
github-project-automation
Bot
moved this from 🚧 Needs work
to 👍🏼 Mergeable
in AutoGPT development kanban
github-project-automation
Bot
moved this from 👍🏼 Mergeable
to ✅ Done
in AutoGPT development kanban
7 participants
Why / What / How
Why: The share page was unbranded (no logo/navigation) and images from workspace files couldn't render because the proxy didn't handle public share URLs. Zip downloads also had several gaps — no size limits, no workspace file support, silent failures on data URLs, and single files got wrapped in unnecessary zips.
What: Adds AutoGPT branding to the share page, secure public access to workspace files via a SharedExecutionFile allowlist, and a hardened zip download module.
How: Backend scans execution outputs for
workspace://URIs on share-enable and persists an allowlist in a newSharedExecutionFiletable. A new unauthenticated endpoint serves files validated against this allowlist. Frontend proxy routing is extended (with UUID validation) to handle the 7-segment public share download path as a binary response. Download logic is consolidated into a shared module with size limits, parallel fetches, filename sanitization, and single-file direct download.Changes 🏗️
Share page branding:
/priorityon visible variant onlySecure public workspace file access (backend):
SharedExecutionFilePrisma model with@@unique([shareToken, fileId])constraint_extract_workspace_file_ids()scans outputs forworkspace://URIs (handles nested dicts/lists)create_shared_execution_files()/delete_shared_execution_files()manage allowlist lifecycleGET /public/shared/{token}/files/{id}/download— validates against allowlist, uniform 404 for all failuresContent-Disposition: inlinefor share page rendering20260417000000_add_shared_execution_file)Frontend proxy fix:
isWorkspaceDownloadRequestextended to match public share path (7-segment)Download module (
download-outputs.ts):fetchFileAsBlobwith content-length pre-check before bufferingsanitizeFilenamestrips path traversal, leading dots, falls back to "file"getUniqueFilenamededuplicates with counter suffixfetchInParallelwith configurable concurrency (5)/api/proxy/...)Share page file rendering:
WorkspaceFileRendererbuilds public share URLs whenshareTokenis in metadataRunOutputspropagatesshareTokento renderer metadataChecklist 📋
For code changes:
/and shows correct dark/light variantFor configuration changes:
.env.defaultis updated or already compatible with my changesdocker-compose.ymlis updated or already compatible with my changesNote
Medium Risk
Adds a new unauthenticated file download path gated by a database allowlist plus a new Prisma model/migration; mistakes here could expose workspace files or break sharing. Frontend download behavior also changes significantly (zipping/fetching), which could impact large-output performance and edge cases.
Overview
Enables public rendering and downloading of workspace files on shared execution pages by introducing a
SharedExecutionFileallowlist tied to the share token and populating it when sharing is enabled (and clearing it on disable/re-share).Adds
GET /public/shared/{share_token}/files/{file_id}/download(no auth) that validates the requested file against the allowlist and returns a uniform 404 on failure; workspace download responses now supportinlineContent-Dispositionvia the exportedcreate_file_download_responsehelper.Frontend updates the share page to pass
shareTokeninto output renderers soWorkspaceFileRenderercan build public-share download URLs; the proxy matcher is extended/strictly UUID-validated for both workspace and public-share download paths with extensive adversarial tests. Output downloading is consolidated intodownload-outputs.tsusing dynamicjszipimport, filename sanitization/deduping, concurrency + size limits, and a single-file non-zip fast path.Reviewed by Cursor Bugbot for commit e2f5bd9. Bugbot is set up for automated code reviews on this repo. Configure here.