add agent rule action

[iceljc]

PR Type

Enhancement

---

Description

• Add agent rule action support with dropdown selection

• Implement action configuration editor using JSON format

• Load action options from backend API endpoint

• Add CodeMirror JSON language support dependency

---

Diagram Walkthrough

flowchart LR
  A["Agent Rule Component"] -->|imports| B["getAgentRuleActions"]
  B -->|fetches from| C["agentRuleActionsUrl"]
  C -->|returns| D["Action Options"]
  D -->|populates| E["Action Dropdown"]
  E -->|selects| F["AgentAction"]
  F -->|configures via| G["CodeScript JSON Editor"]
  A -->|stores| H["AgentRule with Action"]

Loading

File Walkthrough

	Relevant files
Enhancement	agent-rule.svelte Add action selection and configuration UI                                src/routes/page/agent/[agentId]/agent-components/agent-rule.svelte Import getAgentRuleActions service and CodeScript component Add actionOptions state variable and loadAgentRuleActions() function Implement changeAction() and toggleAction() handlers for action management Add action selection dropdown and JSON config editor UI sections Update changeContent() to handle action config JSON parsing Refactor onMount() to use Promise.all for parallel loading +159/-22 _agent.scss Add styling for action config editor                                          src/lib/scss/custom/pages/_agent.scss Add .agent-action-config CSS class with height constraints Set min-height to 0px and max-height to 200px for action config display +5/-0      agentTypes.js Define AgentAction and AgentRule types                                      src/lib/helpers/types/agentTypes.js Add optional action property to AgentRule typedef Create new AgentAction typedef with name, disabled, and config properties +8/-0      agent-service.js Add getAgentRuleActions service function                                  src/lib/services/agent-service.js Add new getAgentRuleActions() async function Fetch action list from agentRuleActionsUrl endpoint Return Promise resolving to string array of available actions +10/-0
Configuration changes	api-endpoints.js Add rule actions API endpoint                                                        src/lib/services/api-endpoints.js Add agentRuleActionsUrl endpoint pointing to /rule/actions +1/-0
Dependencies	package.json Add CodeMirror JSON language support                                          package.json Add @codemirror/lang-json dependency version ^6.0.2 Enable JSON syntax highlighting for action config editor +1/-0

---

[qodo-code-review]

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
⚪	Prototype pollution Description: Untrusted JSON is parsed from editor input (JSON.parse(e.detail?.text || '{}')) into found.action.config, which can enable prototype-pollution style payloads (e.g., {"proto":{"polluted":true}}) if this object is later merged/used unsafely elsewhere (client-side or when submitted to the backend). agent-rule.svelte [189-203] Referred Code } else if (field === 'action-config') { if (found.action == null) { found.action = { name: '', disabled: false, config: {} }; } try { found.action.config = JSON.parse(e.detail?.text || '{}'); handleAgentChange(); } catch { // ignore invalid JSON while typing } }
Ticket Compliance
⚪	🎫 No ticket provided Create ticket/issue
Codebase Duplication Compliance
⚪	Codebase context is not defined Follow the guide to enable codebase context checks.
Custom Compliance
🟢	Generic: Comprehensive Audit Trails Objective: To create a detailed and reliable record of critical system actions for security analysis and compliance. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Meaningful Naming and Self-Documenting Code Objective: Ensure all identifiers clearly express their purpose and intent, making code self-documenting Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Error Handling Objective: To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Logging Practices Objective: To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
🔴	Generic: Robust Error Handling and Edge Case Management Objective: Ensure comprehensive error handling that provides meaningful context and graceful degradation Status: Unhandled fetch failures: The new action/trigger loading uses Promise.all without await and wraps API calls in new Promise without catch/reject, causing network/API failures to be silently ignored with no graceful UI fallback. Referred Code onMount(async () =>{ resizeWindow(); Promise.all([ loadAgentRuleOptions(), loadAgentRuleActions() ]); }); function loadAgentRuleOptions() { return new Promise((resolve, reject) => { getAgentRuleOptions().then(data => { const list = data?.map(x => { return { name: x.trigger_name, displayName: "", output_args: x.output_args, json_args: x.json_args, statement: x.statement }; }) || []; ruleOptions = [{ ... (clipped 30 lines) Learn more about managing compliance generic rules or creating your own custom rules
⚪	Generic: Security-First Input Validation and Data Handling Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities Status: Unvalidated JSON config: The PR accepts and persists arbitrary JSON from the UI (JSON.parse of editor text) as rule.action.config with no schema/allowlist validation, requiring verification that the backend safely validates/sanitizes this input before use. Referred Code } else if (field === 'action-config') { if (found.action == null) { found.action = { name: '', disabled: false, config: {} }; } try { found.action.config = JSON.parse(e.detail?.text || '{}'); handleAgentChange(); } catch { // ignore invalid JSON while typing } } Learn more about managing compliance generic rules or creating your own custom rules

Compliance status legend

🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

[qodo-code-review]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Handle potential promise rejections properly Add await and a try...catch block around the Promise.all call in onMount to handle potential errors during data fetching and prevent unhandled promise rejections. src/routes/page/agent/[agentId]/agent-components/agent-rule.svelte [77-83] onMount(async () =>{ resizeWindow(); - Promise.all([ - loadAgentRuleOptions(), - loadAgentRuleActions() - ]); + try { + await Promise.all([ + loadAgentRuleOptions(), + loadAgentRuleActions() + ]); + } catch (error) { + console.error('Failed to load agent rule data:', error); + // Optionally, show an error message to the user + } }); Apply / Chat Suggestion importance[1-10]: 7 __ Why: The suggestion correctly points out the lack of error handling for the Promise.all call, which could lead to unhandled promise rejections, and provides a robust solution using await and try...catch.	Medium
General	Avoid using the Promise constructor anti-pattern Refactor the loadAgentRuleOptions function to use async/await instead of the new Promise constructor, which is an unnecessary anti-pattern in this context. src/routes/page/agent/[agentId]/agent-components/agent-rule.svelte [85-105] -function loadAgentRuleOptions() { - return new Promise((resolve, reject) => { - getAgentRuleOptions().then(data => { - const list = data?.map(x => { - return { - name: x.trigger_name, - displayName: "", - output_args: x.output_args, - json_args: x.json_args, - statement: x.statement - }; - }) || []; - ruleOptions = [{ - name: "", - displayName: "" - }, ...list]; - init(); - resolve('done'); - }); - }); +async function loadAgentRuleOptions() { + const data = await getAgentRuleOptions(); + const list = data?.map(x => { + return { + name: x.trigger_name, + displayName: "", + output_args: x.output_args, + json_args: x.json_args, + statement: x.statement + }; + }) || []; + ruleOptions = [{ + name: "", + displayName: "" + }, ...list]; + init(); } Apply / Chat Suggestion importance[1-10]: 6 __ Why: The suggestion correctly identifies and fixes a Promise constructor anti-pattern, improving code quality and robustness by simplifying the asynchronous logic and ensuring proper error propagation.	Low
More