fix: enforceable Agent writes plus non-blocking save bubbles - #75
Merged
Conversation
The Agent volunteered "save this as a shared DeepSQL brain note" after answering a metric, then 403'd for users without manage-content. Stamp callerCapabilities on get_brain_context / list_connections, fail-close save_brain_note before the POST, and stop SOUL.md from asking whether to persist a definition the current account cannot write. Co-authored-by: Venkat SF <venkatesh.sakamuri@stayflexi.com>
venkateshsakamuri-lab
marked this pull request as ready for review
August 22, 2026 07:48
venkateshsakamuri-lab
requested review from
a team and
geekypunk
as code owners
August 22, 2026 07:48
After an Agent turn, admins see a chip they can open for the excerpt of the shared note that would be created. Overlaps with existing notes or business rules merge into one intent; identical intent is not offered. Propose/accept never blocks the composer. Co-authored-by: Venkat SF <venkatesh.sakamuri@stayflexi.com>
cursor
Bot
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
CodeQL flagged QUALIFIED_TABLE as polynomial ReDoS on Agent Q&A (long runs of 'A'). Walk the string once instead. Co-authored-by: Venkat SF <venkatesh.sakamuri@stayflexi.com>
Clean first-turn answers stay quiet. A chip appears only when the user corrects or teaches after a prior Agent reply. One unsaved chip at a time; dismissed targets stay suppressed for the session. Co-authored-by: Venkat SF <venkatesh.sakamuri@stayflexi.com>
venkateshsakamuri-lab
added a commit
that referenced
this pull request
Aug 25, 2026
<!-- CURSOR_AGENT_PR_BODY_BEGIN --> ## Summary Weekly product cut **v1.3.0** — **DeepSQL Desktop (IDE) first ship** as the headline, plus Agent/Brain/Editor hardening landed on `main` since `v1.2.0`. ## Release contents - Bump `backend/pom.xml` → `1.3.0` - Bump `desktop/package.json` → `1.0.0` (installers via separate `desktop-v1.0.0` tag) - `CHANGELOG.md` + `docs/releases/RELEASE_NOTES-v1.3.0.md` - `docs/oss-ux/RELEASE.md` version table + Desktop tagging notes - Root `README.md` + `desktop/README.md` release pointers ## Included since v1.2.0 | PR | Topic | |----|--------| | #73 | **DeepSQL Desktop** — Electron thin client (TLS + SSH tunnel) | | #78 | Agent MCP cross-user credential leak closed | | #77 / #74 | Brain review approvals + schema-doc dedupe | | #75 | Enforceable Agent writes / non-blocking save bubbles | | #76 | Editor CSV export bound + concurrency/cancel audit | | #71 | View as Agent enforces target user policy | | #70 | Schema allowlist walks whole statement | | #72 | Brain endpoint connection authz | **Not included:** #80 (workspaces & custom roles) — still open; favorite-endpoint auth fix required first. ## After merge ```bash git checkout main && git pull git tag -a v1.3.0 -m "DeepSQL v1.3.0" git push origin v1.3.0 # optional Desktop installers: git tag -a desktop-v1.0.0 -m "DeepSQL Desktop v1.0.0" git push origin desktop-v1.0.0 ``` Tag push triggers `.github/workflows/release.yml` for product artifacts; `desktop-v*` triggers `.github/workflows/desktop-release.yml`. <!-- CURSOR_AGENT_PR_BODY_END --> <div><a href="https://cursor.com/agents/bc-8ce91e70-c67b-48c6-84b3-05bb9d06231a?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-8ce91e70-c67b-48c6-84b3-05bb9d06231a&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> Co-authored-by: Cursor Agent <cursoragent@cursor.com>
![https://cursor.com/assets/images/open-in-web-dark.png"><source](https://cursor.com/assets/images/open-in-web-dark.png"><source){kind=link}
![https://cursor.com/assets/images/open-in-web-light.png"><img](https://cursor.com/assets/images/open-in-web-light.png"><img){kind=link}
![https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a](https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a){kind=link}
![https://cursor.com/assets/images/open-in-cursor-dark.png"><source](https://cursor.com/assets/images/open-in-cursor-dark.png"><source){kind=link}
![https://cursor.com/assets/images/open-in-cursor-light.png"><img](https://cursor.com/assets/images/open-in-cursor-light.png"><img){kind=link}
![https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div](https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div){kind=link}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Agent chat answered a metric, then offered “Should I save this as a shared DeepSQL brain note?” A user without
canManageContentclicked Yes and got a 403. The offer itself is the bug.Admins still need a way to persist a useful definition — without the Agent asking, without blocking chat, and without creating a second note that overlaps an existing brain note or business rule. Chips must stay quiet when the Agent already got it right.
Fix
Capability gating
callerCapabilities(includingdoNotOfferandcanWriteSharedBrainNotes) onget_brain_context,list_connections,list_brain_recommendations, andget_current_user.save_brain_notefail-closes beforePOST /brain/noteswhencanManageContentis false.SOUL.md/bi-queryskill: never volunteer a write listed indoNotOffer.Suggestion bubbles — only after correction or teaching
that's wrong,always filter,remember this, …) after a prior Agent reply.schema.tableextraction is a linear scan (no ReDoS regex).Verify
cd backend && ./mvnw test -Dtest=BrainNoteIntentServiceTest,BrainControllerAuthorizationSafetyTestnode --test src/components/AgentChat/shouldOfferBrainSuggestion.test.js src/components/AgentChat/AgentRecommendationBubbles.test.jsPOST /brain/notes/propose: first-turn and thanks →204; correction withpriorAnswer→200NEW/MERGESuggestion chip opens an excerpt of the brain note
After save the chip is gone and the composer stays usable
brain_note_suggestion_bubble.mp4
To show artifacts inline, enable in settings.