Problem
Now that the assistant can emit CreateDataSource / SetDataSourceConfig into a draft (see PR #192), a human asked to publish a draft can approve data-source config changes — endpoint, connector settings, credential presence — without seeing what changed. The preview-diff renders only a static one-line intent summary for these commands:
apps/server/src/functions/preview-diff.ts — setDataSourceConfig descriptor is summary: () => "Update data source config" (no field detail); createDataSource shows only the name.PreviewDiffRenderer.tsx renders intent.summary only — no field-level config delta.
So an agent-authored config change is approved effectively blind.
Why not fixed in #192
#192 is the credential allow-list + ref-adoption hardening (backend/tool-only, "No UI change"). Surfacing the config delta is a publish-approval rendering change (UI-touching, needs visual evidence) and belongs with the publish-approval surface — out of scope for #192. Flagged by review (Codex P1) on #192 and deferred here with the team's agreement.
Acceptance criteria
- The publish preview for
CreateDataSource / SetDataSourceConfig shows the config delta a human needs to approve safely: which connector fields changed (e.g. endpoint, method), and credential presence (e.g. "API key set / changed / cleared").
- The credential VALUE is NEVER rendered — only presence (refs are already stripped to
hasApiKey/hasConnectionString booleans on read; preserve that).
- Light + dark, with before/after where applicable; screenshots from the running app.
Pointers
apps/server/src/functions/preview-diff.ts (COMMAND_DESCRIPTORS)PreviewDiffRenderer.tsx- Related: the publish-approval surface work.
Problem
Now that the assistant can emit
CreateDataSource/SetDataSourceConfiginto a draft (see PR #192), a human asked to publish a draft can approve data-source config changes — endpoint, connector settings, credential presence — without seeing what changed. The preview-diff renders only a static one-line intent summary for these commands:apps/server/src/functions/preview-diff.ts—setDataSourceConfigdescriptor issummary: () => "Update data source config"(no field detail);createDataSourceshows only the name.PreviewDiffRenderer.tsxrendersintent.summaryonly — no field-level config delta.So an agent-authored config change is approved effectively blind.
Why not fixed in #192
#192 is the credential allow-list + ref-adoption hardening (backend/tool-only, "No UI change"). Surfacing the config delta is a publish-approval rendering change (UI-touching, needs visual evidence) and belongs with the publish-approval surface — out of scope for #192. Flagged by review (Codex P1) on #192 and deferred here with the team's agreement.
Acceptance criteria
CreateDataSource/SetDataSourceConfigshows the config delta a human needs to approve safely: which connector fields changed (e.g.endpoint,method), and credential presence (e.g. "API key set / changed / cleared").hasApiKey/hasConnectionStringbooleans on read; preserve that).Pointers
apps/server/src/functions/preview-diff.ts(COMMAND_DESCRIPTORS)PreviewDiffRenderer.tsx