jpmschweitzer/clide
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
548 Commits 1 Branch 17 Tags
2e323990df1769fb3cdfbefa92351663ec026e24
Commit Graph
6 Commits
Author SHA1 Message Date
jpmschweitzerandClaude Opus 4.8 0bb89a2e58 read user-scope Claude config files via a read allow-list (D-80) 
The reader opened repo-local .claude markdown but rejected user-scope
files under ~/.claude with "path outside workspace" — that dir is
global, outside the repo, and files.read was repo-confined (T-102).

Per D-76 the Claude config surface is clide-managed, so files.read now
resolves a path under an allow-list: the workspace root plus trusted
extra read roots (FilesService.extraReadRoots), wired in main.dart to
~/.claude when present. Reads widen; writes stay repo-confined, and the
symlink re-check still refuses a config-root symlink that escapes. Off-
root paths and `..` traversal are rejected as before.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-01 09:08:32 +02:00
jpmschweitzerandClaude Opus 4.8 ade8a88b75 fix markdown reader 404 on absolute paths 
resolveUnderRoot joined an absolute input onto the workspace root
(/repo + /repo/x → /repo/repo/x), so files.read 404'd on a file that
exists. The Claude Config tab hands the reader a skill's absolute
SKILL.md path, which hit this. Normalize an absolute input as-is; the
existing containment check still rejects absolute paths outside the
root, so the T-102 boundary is preserved.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-01 08:50:00 +02:00
jpmschweitzerandClaude Opus 4.7 06b08b7388 reject symlinks pointing outside the workspace (T-102) 
resolveUnderRoot already blocked path-layer traversal but explicitly
did NOT follow symlinks — a repo symlink config -> /etc/shadow
passed the containment check because the link path was under root.
clide would then read the target.

Add resolveUnderRootFollowingSymlinks: resolves any symlinks at the
target and re-verifies containment against the resolved real root.
The split keeps pure path math testable without filesystem access.
files.read and files.ls now route through it.

Tests cover: plain non-symlink passthrough, non-existent target
(returns path-layer result so caller surfaces not-found cleanly),
single-hop and chained symlinks whose targets escape the workspace,
and tolerance of symlinks in the root path itself (macOS /tmp).

Also adds the T-101 CHANGELOG entry that the docs commit missed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-17 21:01:56 +02:00
jpmschweitzerandClaude Opus 4.7 72a3dce4a3 test sweep: foundational systems — files / ipc errno / panes (T-91)
test / unit + widget + golden + a11y (push) Failing after 32s
test / integration_test (xvfb) (push) Has been skipped
test / bundle smoke (xvfb 5s) (push) Has been skipped
test / daemon subprocess + web WASM smoke (push) Has been skipped
test / dart doc (lib API) (push) Failing after 1m2s 
Three small foundational test additions:

- test/files/watcher_test.dart (new, 8 tests): FileChangeKind
  fromEvent across every FileSystemEvent.type + wire getter,
  FileChange.toJson, FileWatcher end-to-end (created event,
  ignored-path filtering, idempotent start, stop teardown).
- ignore_test: trailing /**, bare **, ? glob-pattern branches in
  the regex compiler.
- path_safety_test: PathOutsideRoot.toString embeds the three
  fields.
- ipc/errno_mapping_test: ENOTDIR / ENOMEM / EAGAIN branches in
  errnoToIpcError that weren't previously hit.
- panes/registry_test: RecordingEventSink.ofSubsystem filter.

Coverage: src/files/watcher.dart 10/36 -> ~ all; ignore.dart +
path_safety.dart residuals closed; ipc/errno_mapping.dart 3 added
branches; panes/event_sink.dart 100%.

Total coverage 90.53% -> 90.99%.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 10:19:07 +02:00
jpmschweitzerandClaude f0bb2ffcce format the tree to current dart format spec 
Mechanical `dart format` sweep across files that drifted from the
formatter's output (mostly trailing-comma and line-wrap differences
from a Dart SDK / formatter version bump). No semantic changes.

Caught because the pre-push gate now actually fires.

Co-Authored-By: Claude <noreply@anthropic.com>
 2026-05-06 22:28:51 +02:00
jpmschweitzerandClaude 816e60d028 reject path traversal in files.read and files.ls (T-78) 
Both handlers concatenated the request path onto the workspace root
without validating containment, letting `path: "../../../etc/passwd"`
escape the workspace. resolveUnderRoot normalizes the path and
checks containment under root.absolute.path before any filesystem
access.

Co-Authored-By: Claude <noreply@anthropic.com>
 2026-05-05 15:02:30 +02:00