fix: allow preview chat with agents

[Dakuan]

Summary by cubic

Allow preview chat with agents in the builder. Adds a guarded preview mode for transient chats so builders can test agents without persisting conversations or enabling them.

• Bug Fixes
  • Chatbox supports a preview flag; builder AgentChatPanel passes it for transient chats.
  • Server permits preview chats for builders in the workspace (non-client) even if the agent is disabled.
  • Updated chat request type to include a preview field.

^{Written for commit f3cebca. Summary will update on new commits.}

[Dakuan]

@cubic-dev-ai

[cubic-dev-ai]

@cubic-dev-ai

@Dakuan I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

1 issue found across 4 files

Confidence score: 3/5

• Preview bypass in packages/server/src/api/controllers/ai/chatConversations.ts skips chatApp agent membership checks, allowing builders to preview any agentId and potentially leak access beyond intended “disabled” scope.
• Severity is medium (6/10) with plausible user-impacting access control risk, so there’s some merge risk despite otherwise limited scope.
• Pay close attention to packages/server/src/api/controllers/ai/chatConversations.ts - ensure preview path enforces chatApp membership before allowing access.

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/server/src/api/controllers/ai/chatConversations.ts">

<violation number="1" location="packages/server/src/api/controllers/ai/chatConversations.ts:217">
P2: The preview bypass skips the chatApp agent membership check. Builders can preview any agentId even if it isn’t configured for the chat app, which is broader than “disabled” and can leak access. Keep the membership check and only bypass the enabled flag.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}