Put the Scheduler dock on the same conversation store as everything else

2026-08-09 00:16:09 -04:00
parent f4fd17be4d
commit 073352b21e
4 changed files with 105 additions and 9 deletions
@@ -256,7 +256,13 @@ if ($action === 'chat_save') {
    $cap = vv_ai_profiles_max_turns() * 2;
    if (count($clean) > $cap) $clean = array_slice($clean, -$cap);

-    $r = vv_ai_chat_save(trim($_POST['id'] ?? ''), $profile, $clean);
+    // Whitelisted exactly as ask's is, and for the same reason: a scope is only ever a name from
+    // a page's own view state, it is stored and later replayed into a prompt, and anything
+    // richer than a file name is an instruction-injection surface for no benefit.
+    $scope = trim($_POST['scope'] ?? '');
+    if ($scope !== '' && !vv_ai_scope_ok($scope)) $scope = '';
+
+    $r = vv_ai_chat_save(trim($_POST['id'] ?? ''), $profile, $clean, $scope);
    vv_ai_log('chat_save ' . ($r['ok'] ? 'ok id=' . substr($r['id'], 0, 12)
                                       : 'FAILED: ' . $r['error']));
    echo json_encode($r);