improvement(ui): remove React anti-patterns, fix CSP violations

[waleedlatif1]

Summary

• Remove useCallback/useEffect anti-patterns in mothership-view, message-actions, and resource-tabs; use render-time state reset pattern and plain functions where no observer tracks the reference
• Extract ResourceTabItem as memoized component in resource-tabs; wrap MessageActions in memo
• Add active state styling to ResourceHeader action buttons; switch logs view toggle from disabled to active semantics
• Fix CSP violations: add worker-src blob:, ws://localhost:4722 (dev), react-grab (dev), and analytics.ahrefs.com (hosted) to correct directives

Type of Change

• Bug fix

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Apr 16, 2026 8:58pm

[cursor]

PR Summary

Medium Risk
Mostly UI refactors, but changes render-time state updates and CSP directives, which could introduce subtle React re-render issues or unintentionally broaden allowed network/worker sources if misconfigured.

Overview
Removes unnecessary useCallback/useEffect usage across several workspace UI components, including memoizing MessageActions, extracting a memoized ResourceTabItem, and switching MothershipView/ResourceTabs resets to render-time state reset patterns.

Updates header action semantics and styling by adding an active state to ResourceHeader actions (used for the Logs/Dashboard toggle) and tweaks the Logs refresh action (new RefreshCw icon + label).

Fixes CSP issues by adding worker-src (including blob:) and expanding allowed connect-src/analytics domains for dev/hosted environments; also updates the Bell SVG and adds the new RefreshCw icon export.

^{Reviewed by Cursor Bugbot for commit dcfc5f6. Configure here.}

[greptile-apps]

Greptile Summary

Cleans up React anti-patterns across four components (MothershipView, MessageActions, ResourceTabs, drop-overlay) — replacing useEffect-based state sync with render-time resets, dropping unobserved useCallback wrappers, and extracting ResourceTabItem as a memo-ized component. Also adds worker-src blob: to the CSP, adds analytics.ahrefs.com and react-grab entries to the correct directives, and introduces a RefreshCw icon alongside active-state semantics for the logs view toggle.

Confidence Score: 5/5

Safe to merge — all findings are P2 or lower and no correctness or data-integrity issues were found.

React pattern changes are each correct (render-time reset, plain functions on non-memoized consumers, memo on the right boundary). CSP additions are properly scoped to dev/hosted environments. The only finding is a minor CSP inconsistency where ws://localhost:4722 is gated on isDev instead of isReactGrabEnabled, which has no production impact.

apps/sim/lib/core/security/csp.ts — minor guard inconsistency for ws://localhost:4722

Important Files Changed

Filename	Overview
apps/sim/lib/core/security/csp.ts	Adds worker-src directive ('self' blob:), analytics.ahrefs.com to hosted connect-src, and react-grab / ws://localhost:4722 to dev connect-src. Minor inconsistency: ws://localhost:4722 is gated on isDev rather than isReactGrabEnabled like the other react-grab entries.
apps/sim/app/workspace/[workspaceId]/components/message-actions/message-actions.tsx	Wraps component in memo to prevent parent re-renders; removes useCallback from all handlers since they are only used with native elements or non-memoized children.
apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/mothership-view.tsx	Replaces useEffect+prevActiveId state sync with the React-documented render-time state reset pattern; removes unnecessary useCallback from handleCyclePreview which is only passed to a non-memoized child.
apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-tabs/resource-tabs.tsx	Extracts ResourceTabItem as a memoized component; setHoveredTabId (React-stable dispatch) is passed directly as a prop which is safe.
apps/sim/app/workspace/[workspaceId]/logs/logs.tsx	Switches Logs/Dashboard toggle from disabled semantics to active semantics; replaces Loader with RefreshCw icon; adds a label to the refresh button.
apps/sim/app/workspace/[workspaceId]/components/resource/components/resource-header/resource-header.tsx	Adds optional active prop to HeaderAction; applies surface-active background for active=true and hover-only bg for active=false, scoped with rounded-lg when the prop is present.
apps/sim/components/emcn/icons/refresh-cw.tsx	New RefreshCw icon reusing loader.module.css spin animation; standard Lucide paths, consistent with existing icon conventions.
apps/sim/components/emcn/icons/bell.tsx	Updates Bell to standard Lucide paths, corrects viewBox from -1 -2 24 24 to 0 0 24 24, bumps strokeWidth from 1.75 to 2.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[MothershipView memo] -->|plain fn| B[handleCyclePreview]
    A -->|render-time reset| C["prevActiveId check → setPreviewMode('preview')"]
    A --> D[ResourceTabs]
    D -->|memoized| E[ResourceTabItem ×N]
    E -->|stable dispatch| F[setHoveredTabId]
    E -->|useCallback| G[handleDragStart/Over/End\nhandleTabClick / handleRemove]
    H[MessageActions memo] -->|plain fns| I[copyToClipboard\ncopyRequestId\nhandleFeedback*]
    I -->|native elements only| J["button onClick"]
    K[ResourceHeader] -->|active prop| L{active?}
    L -->|true| M[surface-active bg]
    L -->|false| N[hover-only bg]
    L -->|undefined| O[original subtle style]

Loading

_{Reviews (2): Last reviewed commit: "improvement(ui): add RefreshCw icon, upd..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit dcfc5f6. Configure here.}