precogly / precogly/precogly

[Bug]: Opening a context-less Solo file leaks and re-saves the previous model context

Open
#531 0 comments 0 reactions 0 assignees View on GitHub
needs-triage
Dominant language
TypeScript
Stars
155
Forks
37
Avg merge
1d 17h
Merged PRs (30d)
82

Description

## Summary

Opening a context-less model in Precogly Solo retains the System Context from the previously opened model. Saving the new model then writes that previous model's context into the new file.

## Steps to reproduce

1. Open File A in Solo. File A contains a distinctive system description, for example `File A confidential payment context`.
2. Open File B. File B is a valid CycloneDX model whose Precogly visualization has no `systemContext`.
3. Open **Add / Edit Context → System**.
4. Save File B and inspect its downloaded CycloneDX JSON.

## Actual behavior

- File B's System panel displays `File A confidential payment context`.
- Saving File B writes that value to:

```text
blueprints[0].visualizations[0].data.systemContext.systemInfo.description
```

No warning indicates that state from another document was retained or added.

## Expected behavior

Opening File B should fully replace document-scoped state. If File B has no System Context, the context form and exported `systemContext` should use a clean default rather than retain File A's values.

## Browser reproduction against current `main`

Reproduced in headless Chrome against commit [`4f429a8`](https://github.com/precogly/precogly/commit/4f429a8d4e7c9b0192cf5b6cd0826db702bbebf4) with two in-memory CycloneDX files.

The focused Playwright journey verifies File A's description, opens context-less File B, saves B, reads the downloaded JSON, and fails with:

```text
Expected: ""
Received: "File A confidential payment context"
```

## Cause indicated by the current implementation

The layout loads context only when the newly opened file supplies a truthy `systemContext`; there is no reset branch:

https://github.com/precogly/precogly/blob/4f429a8d4e7c9b0192cf5b6cd0826db702bbebf4/frontend/src/features/guest-editor/GuestLayout.tsx#L194-L203

The header repeats the same conditional behavior when replacing threat-editor state:

https://github.com/precogly/precogly/blob/4f429a8d4e7c9b0192cf5b6cd0826db702bbebf4/frontend/src/features/guest-editor/components/GuestEditorHeader.tsx#L265-L278

Save always retrieves and serializes the currently held context, including the retained File A values:

https://github.com/precogly/precogly/blob/4f429a8d4e7c9b0192cf5b6cd0826db702bbebf4/frontend/src/features/guest-editor/components/GuestEditorHeader.tsx#L161-L175

## Impact

This silently contaminates one threat model with another model's assumptions and system description. Besides producing incorrect analysis evidence, it can disclose sensitive architecture context if File B is later shared with a different audience.

## Relationship to existing issues

- #477 covers warning about unsaved edits before opening another file, not clearing document-scoped state after the open.
- Closed #186 introduced System Context in Solo.
- Closed #508 concerns fields from the current imported file being dropped, not values leaking in from a previous file.

No existing issue found covers this cross-file context retention and re-export path.

Contributor guide

Open the contributing guide

Research direction

Start in frontend/src/features/guest-editor/GuestLayout.tsx and GuestEditorHeader.tsx at the linked context-loading and save paths. Run the focused Playwright journey described in the issue, then inspect the state transition when opening a model without systemContext. Done means File B shows a clean context and its downloaded CycloneDX JSON does not contain File A's description.

Written by the indexing model from the issue text.

Assessment

Tech stack
playwright, typescript
Domain
frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.