Summary
Found during fine-grained code-quality review (second pass) at commit 14fbf3e (develop). Severity: medium — bug. Two state-correctness bugs:
playgroundStore.addToolCall mutates state in place — stores/playgroundStore.ts:104-120, line 109: lastMsg.toolCalls = [...] mutates the message object still referenced by the previous state array. Memoized components/selectors comparing message identity won't re-render, and devtools history is corrupted. Fix: rebuild immutably (msgs[i] = { ...lastMsg, toolCalls: [...] }).useSkillPackage serves the previous skill's files — hooks/useSkillPackage.ts:73-76: if (!presignedUrl) return; keeps the prior files/fileContents/rawZip state. Navigating from skill A (with package) to skill B whose presignedPackageUrl is absent (permission-gated payloads) renders A's file tree and contents under B's header — a cross-skill content leak in the UI. Fix: reset the state slots before the early return and on every URL change before fetch resolves.
Related to #1001 (the sibling cross-skill edit-leak on the same page).
Summary
Found during fine-grained code-quality review (second pass) at commit
14fbf3e(develop). Severity: medium — bug. Two state-correctness bugs:playgroundStore.addToolCallmutates state in place —stores/playgroundStore.ts:104-120, line 109:lastMsg.toolCalls = [...]mutates the message object still referenced by the previous state array. Memoized components/selectors comparing message identity won't re-render, and devtools history is corrupted. Fix: rebuild immutably (msgs[i] = { ...lastMsg, toolCalls: [...] }).useSkillPackageserves the previous skill's files —hooks/useSkillPackage.ts:73-76:if (!presignedUrl) return;keeps the priorfiles/fileContents/rawZipstate. Navigating from skill A (with package) to skill B whosepresignedPackageUrlis absent (permission-gated payloads) renders A's file tree and contents under B's header — a cross-skill content leak in the UI. Fix: reset the state slots before the early return and on every URL change before fetch resolves.Related to #1001 (the sibling cross-skill edit-leak on the same page).