From 4095834e4231a9ba5e516b1ff5c5e729c064aee0 Mon Sep 17 00:00:00 2001 From: qiuYliangM <185303122+qiuYliangM@users.noreply.github.com> Date: Wed, 30 Sep 2026 10:49:33 +0800 Subject: [PATCH 01/10] feat(workspace): squash the workspace_roots topic onto the r3 closure History compression (2026-09-30): the 56 reviewed topic commits (the round-8 through round-23 closes) are squashed into this single commit. The tree is byte-identical to the reviewed head 5063be0e8; the pre-squash line stays publicly reachable on the fork backup branch backup/pre-squash-54-20260930 and in this PR's timeline. The topic: threads carry cwd (primary root) + workspace_roots (the full accessible root set) across protocol, SQLite v5, TUI JSON persistence, per-turn sandbox materialization, cross-root carve-out/resolve_path/execpolicy judging, primary-root-only instructions, and the Accessible folders turn_meta disclosure. Signed-off-by: qiuYliangM <185303122+qiuYliangM@users.noreply.github.com> --- CHANGELOG.md | 106 + crates/app-server/src/lib.rs | 517 ++++- crates/cli/src/lib.rs | 1 + crates/command-contract/src/facets.rs | 5 + crates/command-contract/src/tests.rs | 4 + crates/config/src/tests.rs | 3 + crates/core/src/lib.rs | 1789 ++++++++++++++++- crates/core/tests/tool_success.rs | 1 + crates/execpolicy/src/lib.rs | 394 +++- .../execpolicy/tests/authorization_order.rs | 1 + crates/protocol/src/lib.rs | 26 + crates/protocol/src/op.rs | 51 + crates/protocol/tests/parity_protocol.rs | 172 +- crates/state/src/lib.rs | 486 ++++- crates/state/tests/parity_state.rs | 10 +- crates/tui/locales/ca.json | 9 + crates/tui/locales/de.json | 9 + crates/tui/locales/en.json | 9 + crates/tui/locales/es-419.json | 9 + crates/tui/locales/fr.json | 9 + crates/tui/locales/hi.json | 9 + crates/tui/locales/id.json | 9 + crates/tui/locales/ja.json | 9 + crates/tui/locales/ko.json | 9 + crates/tui/locales/pt-BR.json | 9 + crates/tui/locales/ru.json | 9 + crates/tui/locales/uk.json | 9 + crates/tui/locales/vi.json | 9 + crates/tui/locales/zh-Hans.json | 9 + crates/tui/locales/zh-Hant.json | 9 + crates/tui/src/acp_server.rs | 289 ++- crates/tui/src/commands/contract.rs | 5 + .../tui/src/commands/groups/config/status.rs | 132 ++ crates/tui/src/commands/groups/core/core.rs | 1 + crates/tui/src/commands/groups/debug/tests.rs | 104 + crates/tui/src/commands/groups/debug/undo.rs | 32 +- .../tui/src/commands/groups/session/rename.rs | 99 +- .../tui/src/commands/groups/session/resume.rs | 8 + .../src/commands/groups/session/session.rs | 163 ++ .../tui/src/commands/groups/session/title.rs | 48 + .../tui/src/commands/groups/skills/restore.rs | 52 +- .../tui/src/commands/groups/skills/review.rs | 3 + .../tui/src/commands/groups/skills/skills.rs | 3 + crates/tui/src/config/tests.rs | 4 + crates/tui/src/core/authority.rs | 345 +++- crates/tui/src/core/engine.rs | 124 +- crates/tui/src/core/engine/tests.rs | 649 +++++- crates/tui/src/core/engine/turn_loop.rs | 17 +- crates/tui/src/core/ops.rs | 4 + crates/tui/src/core/protocol_parity.rs | 32 + crates/tui/src/core/session.rs | 7 + crates/tui/src/exec_agent.rs | 24 +- crates/tui/src/lib.rs | 154 +- crates/tui/src/localization.rs | 112 +- crates/tui/src/mcp.rs | 2 +- crates/tui/src/mcp_server.rs | 6 + crates/tui/src/project_context.rs | 53 +- crates/tui/src/repo_law.rs | 683 ++++++- crates/tui/src/runtime_api.rs | 114 +- crates/tui/src/runtime_api/sessions.rs | 57 +- crates/tui/src/runtime_api/tests.rs | 591 +++++- crates/tui/src/runtime_chat_relay.rs | 2 + crates/tui/src/runtime_threads.rs | 102 +- crates/tui/src/runtime_threads/tests.rs | 481 +++++ crates/tui/src/sandbox/policy.rs | 9 +- crates/tui/src/session_control_acceptance.rs | 49 +- crates/tui/src/session_manager.rs | 329 ++- crates/tui/src/session_projection.rs | 1 + crates/tui/src/shell_dispatcher.rs | 6 +- crates/tui/src/snapshot/mod.rs | 85 + crates/tui/src/tools/approval_cache.rs | 79 +- crates/tui/src/tools/file.rs | 31 +- crates/tui/src/tools/revert_turn.rs | 77 +- crates/tui/src/tools/shell.rs | 86 +- crates/tui/src/tools/shell/tests.rs | 128 +- crates/tui/src/tools/spec.rs | 170 +- crates/tui/src/tools/spec/tests.rs | 138 ++ crates/tui/src/tools/subagent/mod.rs | 96 +- crates/tui/src/tools/subagent/tests.rs | 254 +++ crates/tui/src/tools/web_search.rs | 2 +- crates/tui/src/tui/app.rs | 5 + crates/tui/src/tui/app/init.rs | 1 + crates/tui/src/tui/app/types.rs | 1 + crates/tui/src/tui/approval/elevation.rs | 19 +- crates/tui/src/tui/approval/tests.rs | 44 +- crates/tui/src/tui/auto_review.rs | 101 +- crates/tui/src/tui/session_picker.rs | 1 + crates/tui/src/tui/ui/apply.rs | 39 + crates/tui/src/tui/ui/event_loop.rs | 24 + crates/tui/src/tui/ui/frame.rs | 42 +- crates/tui/src/tui/ui/handlers.rs | 32 +- crates/tui/src/tui/ui/provider_routes.rs | 1 + crates/tui/src/tui/ui/session_state.rs | 549 ++++- crates/tui/src/tui/ui/tests.rs | 23 + crates/tui/src/tui/underwater.rs | 1 + docs/AUTHORIZATION_ORDER.md | 9 +- docs/RUNTIME_API.md | 57 +- docs/SANDBOX.md | 6 +- 98 files changed, 9996 insertions(+), 702 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9a7e60c6e3..dffbb9cbfa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,112 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Changed + +- Resuming or forking a thread that does not exist now fails loudly: + `POST /v1/threads/{id}/resume` and `POST /v1/threads/{id}/fork` answer + HTTP 404, and the stdio `thread/resume` / `thread/fork` methods answer the + typed `thread_not_found` error (`-32004`), where both lanes previously + answered success with a `status: "missing"` body that every caller had to + know to check. +- Declared workspace root sets are validated at intake instead of silently + reshaped. `POST /v1/threads`, `PATCH /v1/threads/{id}`, and the stdio + `thread/start` / `thread/resume` / `thread/fork` equivalents now reject, + with HTTP 400 or a JSON-RPC error: a root that is not an absolute path + (`~/shared` is refused rather than silently dropped from the set), a root + that normalizes to the filesystem root (`/`, `/..`), and a root that is an + ancestor of the primary workspace (its parent directory). Each of those + widened the per-turn sandbox's writable roots past what the caller + declared; a root that merely sits under the primary is still accepted. + The checks are lexical: enforcement canonicalizes per root, so symlink + spellings can carry a sibling past the ancestor rejection (canonicalize- + at-intake is scheduled). Declared sets are additionally capped at 64 + entries at the validating intakes; the headless `POST /tool` lane + normalizes without the validator and caps at its invoke entry (round-23 + SF23-2). + The resume lane that moves the primary (`cwd` without `workspace_roots`) + validates the re-based persisted set with the same rules instead of + re-anchoring it tolerantly, so a persisted entry that becomes an ancestor + of the new primary errors rather than silently widening the row. +- Approval grants for shell commands are keyed to the command family AND + the `cwd`/`working_dir` operand (length-prefixed in the key), and a + `cwd: null` spelling no longer falls back to the no-operand family — + previously a session-approved plain command could be replayed redirected + into another root. Stored grants re-key; re-approval is required. +- The exec approval context judges the `cwd`/`working_dir` operand through + the same canonical resolution execution uses: a symlinked operand + (`link/..`) no longer normalizes back into the primary and fires a + primary-scoped allow while executing in an attached root. +- Known limitation of that canonical judging (and of the file gates that + share its judgment), disclosed rather than silently shipped: persisted + rule scopes hold their *declared* spelling while the judgment now reads + the operand's *canonical* spelling, so on any system where the two differ + (macOS `/tmp` ↔ `/private/tmp`, `/var` ↔ `/private/var`, a symlinked + spelling) a scoped rule spelled the other way stops firing for + operand-carrying calls — in BOTH spelling directions, and including a + scoped **deny**, which is fail-open (the denied command runs). Windows is + harder hit and fails closed: `std::fs::canonicalize` returns + `\\?\`-prefixed verbatim paths that scope matching cannot spell, so at + this head every existing cwd-carrying operand degrades every exact scoped + allow to the ordinary approval modal on Windows. Capturing canonical + scope spellings (and trimming Windows verbatim prefixes) is scheduled + post-merge. +- The headless `/tool` and stdio tool-call lane judges exec policy on the + same resolved operand cwd execution uses and routes its declared root set + through the shared shape normalizer, closing two silent mismatches: a + symlink-spelled operand no longer evades a deny scoped to the canonical + target, and a relative or `..` operand no longer leaves every scoped rule + inert for the call. A declared root set is also capped at 64 entries at + every validating intake, so one hostile or buggy declaration cannot turn + per-turn boundary work into a permanent stall. +- `PUT /v1/sessions` stamps the saved session's `workspace` AND + `workspace_roots` as one re-normalized pair from the engine snapshot + (matching `/rename` and `/fork`): a thread moved by PATCH since the last + save no longer leaves the session anchored at an abandoned workspace next + to a set led by the new directory — a later resume-thread would have + re-admitted the abandoned directory as a writable primary root. +- A cached resume that carries a `cwd` or `workspace_roots` override now + bumps the persisted row's `updated_at`, so recency listings reflect the + override; a parameterless cached resume stays write-free exactly like + base. +- Session ids are trimmed once at the intake boundary: + `PATCH /v1/sessions/{id}` and `PUT /v1/sessions` judge the trimmed value + (a padded id is one session, not two rows distinguished by whitespace), + and an explicit-but-empty id answers 400 instead of being silently turned + into "create new". +- `PATCH /v1/threads/{id}` with a `workspace`-only change now validates the + re-based root set with the same intake rules as a replacement, instead of + re-anchoring it tolerantly (a persisted entry that becomes an ancestor of + the new primary errors rather than widening the row). +- The `/cd` receipt for a moved-away directory changed severity from a + passive notice to a typed warning, and its guard widened to every + workspace swap lane. +- The cached-resume path no longer bumps `archived_at` (the preserve arm + existed to protect it and is unreachable); `isolated_worktree` defaults + flipped from false to true for resume-lane worktree children; and + `string_field` deny rules now match raw (untrimmed) collected values, + narrowing what they deny. +- Relative `--workspace` values are resolved against the process working + directory at startup instead of reaching the boundary checks as a root + whose normalized form contains every path — **on lanes that route through + `resolve_workspace`**; the headless `codewhale exec` / `codewhale serve` + lanes currently pass the value through unabsolutized (recorded as the + round-22 SF22-5 deferral). +- A worktree child session's exec lane no longer inherits the parent + session's writable roots: the lane is re-derived at spawn and at resume + from the child's own workspace. +- Session failure diagnostics collect candidate string fields verbatim: the + classifier no longer trims surrounding whitespace before matching (this + PR's change; base v0.9.12 carries the trim). + +### Removed + +- The never-fires `PUT`/`PATCH /v1/sessions` live-session conflict (409) + was removed: the process-local registry cannot coexist with the runtime + HTTP server in any shipped topology. Same-process writers converge by + last-write-wins at the store layer; the registry itself remains for + retention pruning. + ### Fixed - API-backed `[search]` providers now visibly degrade directly to the diff --git a/crates/app-server/src/lib.rs b/crates/app-server/src/lib.rs index fed49258e3..1d378f2ed9 100644 --- a/crates/app-server/src/lib.rs +++ b/crates/app-server/src/lib.rs @@ -142,6 +142,11 @@ struct ToolCallRequest { call: ToolCall, #[serde(default)] cwd: Option, + /// Session root set for the exec-policy context: attached-root ask and + /// deny rules only fire when the caller declares the set it recorded at + /// thread/start (review round-9, must-fix 1). Empty = single-root. + #[serde(default)] + workspace_roots: Vec, } #[derive(Debug, Deserialize)] @@ -198,6 +203,13 @@ struct RuntimeBridge { auth_token: Option, child: Option, thread_map: HashMap, + /// The workspace root set each mapped runtime thread was created with, + /// keyed by the stdio thread id. A roots-bearing resume updates the + /// record and the hint without touching the mapped thread, so the bridge + /// must notice the disagreement and re-map — otherwise every later + /// bridged turn keeps running the set the old thread was built with + /// while `thread/read` reports the new one. + thread_roots: HashMap>, last_seq_by_thread: HashMap, } @@ -205,6 +217,10 @@ struct RuntimeBridge { struct RuntimeThreadHint { model: Option, workspace: Option, + /// Accessible roots declared on the stdio thread record. The hint is the + /// only carrier between that record and the runtime thread every bridged + /// turn actually executes on. + workspace_roots: Vec, } #[derive(Debug, Clone, Copy, PartialEq, Eq)] @@ -654,27 +670,68 @@ async fn thread_handler(State(state): State, Json(req): Json http_error_from_jsonrpc(err).into_response(), }; } + // The HTTP face feeds the same hint map the stdio dispatch feeds: a + // start/resume/fork that declares `workspace_roots` must land in the + // hint cache, or the turn-executing runtime thread is created + // single-root and the attached-root ask/deny rules never fire + // (review round-9, must-fix 1). The `missing` guard mirrors the stdio + // named arms: a not-found resume/fork answers 404 and never touches + // the cache, or its null fields would clobber the cached hint. + let should_record_hint = matches!( + &req, + ThreadRequest::Create { .. } + | ThreadRequest::Start(_) + | ThreadRequest::Resume(_) + | ThreadRequest::Fork(_) + ); let mut runtime = state.runtime.write().await; match runtime.handle_thread(req).await { - Ok(res) => (StatusCode::OK, Json(res)).into_response(), - Err(err) => ( - StatusCode::INTERNAL_SERVER_ERROR, - Json(ThreadResponse { - thread_id: "error".to_string(), - status: format!("error:{err}"), - thread: None, - threads: Vec::new(), - goal: None, - model: None, - model_provider: None, - cwd: None, - approval_policy: None, - sandbox: None, - events: Vec::new(), - data: json!({}), - }), - ) - .into_response(), + Ok(res) => { + if should_record_hint { + if let Err(err) = ensure_thread_found(&res) { + return http_error_from_jsonrpc(err).into_response(); + } + record_stdio_thread_hint(&state, &res).await; + } + (StatusCode::OK, Json(res)).into_response() + } + Err(err) => { + // Intake-validation rejections are the caller's mistake, not a + // server fault: a declared root set that fails + // `validate_workspace_roots` (or an empty explicit cwd) answers + // 400 with the reason, where the unconditional 500 misclassified + // a client error and leaked absolute paths through a `status` + // field (review #484/CodeWhale round-22 SF22-4). The stdio + // lane's -32603 mapping is disclosed and stays. + if err + .downcast_ref::() + .is_some() + { + return ( + StatusCode::BAD_REQUEST, + Json(json!({ "error": err.to_string() })), + ) + .into_response(); + } + ( + StatusCode::INTERNAL_SERVER_ERROR, + Json(ThreadResponse { + thread_id: "error".to_string(), + status: format!("error:{err}"), + thread: None, + threads: Vec::new(), + goal: None, + model: None, + model_provider: None, + cwd: None, + approval_policy: None, + sandbox: None, + events: Vec::new(), + data: json!({}), + }), + ) + .into_response() + } } } @@ -714,7 +771,10 @@ async fn tool_handler( // read guard: they run concurrently with each other and with status // reads instead of serializing every request behind one Mutex. let runtime = state.runtime.read().await; - match runtime.invoke_tool(req.call, approval_mode, &cwd).await { + match runtime + .invoke_tool(req.call, approval_mode, &cwd, &req.workspace_roots) + .await + { Ok(value) => (StatusCode::OK, Json(value)), Err(err) => ( StatusCode::INTERNAL_SERVER_ERROR, @@ -1333,6 +1393,15 @@ async fn record_stdio_thread_hint(state: &AppState, response: &ThreadResponse) { RuntimeThreadHint { model: response.model.clone(), workspace: response.cwd.clone(), + // A `thread/start` declaring `workspace_roots` stores the full set + // on the parent record; the turn-executing runtime thread is + // created from this hint, so dropping the set here would deny or + // prompt writes under attached roots while `thread/read` still + // reports them. + workspace_roots: response + .thread + .as_ref() + .map_or_else(Vec::new, |thread| thread.workspace_roots.clone()), }, ); } @@ -1440,6 +1509,7 @@ impl RuntimeBridge { auth_token: Some(auth_token), child: Some(child), thread_map: HashMap::new(), + thread_roots: HashMap::new(), last_seq_by_thread: HashMap::new(), }; bridge.wait_until_ready().await?; @@ -1534,14 +1604,50 @@ impl RuntimeBridge { hint: Option, ) -> Result { if let Some(runtime_thread_id) = self.thread_map.get(stdio_thread_id) { + let roots_changed = hint.as_ref().is_some_and(|hint| { + self.thread_roots + .get(stdio_thread_id) + .is_some_and(|mapped| *mapped != hint.workspace_roots) + }); + if !roots_changed { + return Ok(runtime_thread_id.clone()); + } + // The hint now declares a different root set than the mapped + // runtime thread was created with (a roots-bearing resume after + // the first bridged turn). Re-shape the SAME runtime thread via + // the PATCH primitive instead of creating a fresh one: PATCH + // preserves session_id and the accumulated turns (the model's + // context), evicts the cached engine, and re-normalizes the set + // with the thread's workspace as the primary root. Re-creating + // the thread would run the next turn with correct roots but a + // blank memory, and strand the old thread unarchived in the + // store (review round-9, must-fix 2). + let hint = hint.expect("a root-set change implies a hint"); + let body = json!({ + "workspace": hint.workspace, + "workspace_roots": hint.workspace_roots, + }); + let _record = self + .request_json( + self.authed( + self.client + .patch(format!("{}/v1/threads/{runtime_thread_id}", self.base_url)), + ) + .json(&body), + ) + .await?; + self.thread_roots + .insert(stdio_thread_id.to_string(), hint.workspace_roots.clone()); return Ok(runtime_thread_id.clone()); } let hint = hint.unwrap_or_default(); + let roots = hint.workspace_roots.clone(); let runtime_thread_id = self - .create_runtime_thread(hint.model, hint.workspace) + .create_runtime_thread(hint.model, hint.workspace, hint.workspace_roots) .await?; self.thread_map .insert(stdio_thread_id.to_string(), runtime_thread_id.clone()); + self.thread_roots.insert(stdio_thread_id.to_string(), roots); Ok(runtime_thread_id) } @@ -1551,22 +1657,32 @@ impl RuntimeBridge { if let Some(runtime_thread_id) = self.thread_map.remove(stdio_thread_id) { self.last_seq_by_thread.remove(&runtime_thread_id); } + self.thread_roots.remove(stdio_thread_id); } async fn create_runtime_thread( &mut self, model: Option, workspace: Option, + workspace_roots: Vec, ) -> Result { + let mut body = json!({ + "model": model, + "workspace": workspace, + "mode": "agent", + "archived": false, + }); + if !workspace_roots.is_empty() { + // Every bridged turn runs on this runtime thread, not on the + // stdio record that declared the roots, so the set has to travel + // with the create request. An empty set stays off the wire: it + // degenerates to the workspace root on the runtime side. + body["workspace_roots"] = json!(workspace_roots); + } let record = self .request_json( self.authed(self.client.post(format!("{}/v1/threads", self.base_url))) - .json(&json!({ - "model": model, - "workspace": workspace, - "mode": "agent", - "archived": false, - })), + .json(&body), ) .await?; let thread_id = extract_runtime_thread_id(&record)?.to_string(); @@ -1819,6 +1935,7 @@ impl RuntimeBridge { auth_token: None, child: None, thread_map: HashMap::new(), + thread_roots: HashMap::new(), last_seq_by_thread: HashMap::new(), } } @@ -2039,7 +2156,12 @@ async fn dispatch_stdio_request_with_writer( | ThreadRequest::Fork(_) ); let response = handle_thread_request(state, request).await?; + // The envelope arm shares the named arms' guard: a `missing` + // resume/fork must fail and must not record — recording its null + // model/workspace would clobber the cached hint, and the next + // bridged turn would PATCH the live thread down to single-root. if should_record_hint { + ensure_thread_found(&response)?; record_stdio_thread_hint(state, &response).await; } StdioDispatchResult { @@ -2528,6 +2650,7 @@ mod tests { use axum::body::{Body, to_bytes}; use axum::extract::{Path as AxumPath, Query}; use axum::http::header; + use axum::routing::patch; use codewhale_protocol::AppRequest; use std::collections::HashMap; use std::fs; @@ -2694,6 +2817,7 @@ mod tests { path: None, ask_for_approval: codewhale_execpolicy::AskForApproval::UnlessTrusted, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .expect("policy check"); @@ -2730,6 +2854,7 @@ mod tests { path: None, ask_for_approval: codewhale_execpolicy::AskForApproval::UnlessTrusted, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .expect("policy check"); assert!(decision.matched_rule.is_none()); @@ -2776,6 +2901,7 @@ mod tests { path: None, ask_for_approval: codewhale_execpolicy::AskForApproval::UnlessTrusted, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .expect("policy check"); assert!(decision.allow); @@ -2825,6 +2951,7 @@ mod tests { path: None, ask_for_approval: codewhale_execpolicy::AskForApproval::UnlessTrusted, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .expect("policy check"); assert!(decision.matched_rule.is_none()); @@ -2843,6 +2970,7 @@ mod tests { auth_token: None, child: None, thread_map: HashMap::from([("stdio-1".to_string(), "runtime-1".to_string())]), + thread_roots: HashMap::new(), last_seq_by_thread: HashMap::new(), })) } @@ -3208,6 +3336,44 @@ mod tests { assert_eq!(cleared.result["data"]["cleared"], true); } + #[tokio::test] + async fn stdio_thread_start_records_the_declared_roots_in_the_hint() { + let tmp = tempfile::tempdir().expect("tempdir"); + let config_path = tmp.path().join("config.toml"); + fs::write(&config_path, "").expect("write config"); + let state = build_state(Some(config_path), None).expect("state"); + + let started = dispatch_stdio_request( + &state, + "thread/start", + json!({ + "cwd": "/tmp/codewhale-primary", + "workspace_roots": ["/tmp/codewhale-shared"] + }), + ) + .await + .expect("start thread"); + let thread_id = started.result["thread_id"] + .as_str() + .expect("thread id") + .to_string(); + + let hints = state.stdio_thread_hints.lock().await; + let hint = hints.get(&thread_id).expect("hint recorded"); + assert_eq!( + hint.workspace_roots, + vec![ + PathBuf::from("/tmp/codewhale-primary"), + PathBuf::from("/tmp/codewhale-shared") + ], + "the hint is the only way the declared set reaches the runtime thread" + ); + assert_eq!( + hint.workspace.as_deref(), + Some(Path::new("/tmp/codewhale-primary")) + ); + } + #[tokio::test] async fn stdio_resume_of_missing_thread_fails_without_clobbering_the_hint() { let tmp = tempfile::tempdir().expect("tempdir"); @@ -3225,6 +3391,7 @@ mod tests { RuntimeThreadHint { model: Some("deepseek-v4-pro".to_string()), workspace: Some(workspace.clone()), + ..RuntimeThreadHint::default() }, ); } @@ -3254,6 +3421,114 @@ mod tests { assert_eq!(hint.workspace.as_deref(), Some(workspace.as_path())); } + /// The generic `thread/request` envelope and the HTTP `/thread` face share + /// the named arms' guard: a `missing` resume/fork must fail with the named + /// not-found error on every surface, and none of them may record the + /// response's null fields over the cached hint (same clobber chain as + /// #5171 — the next bridged turn would PATCH the live thread down to + /// single-root). + #[tokio::test] + async fn missing_resume_never_clobbers_the_hint_on_any_face() { + let tmp = tempfile::tempdir().expect("tempdir"); + let config_path = tmp.path().join("config.toml"); + fs::write(&config_path, "").expect("write config"); + let state = build_state(Some(config_path), None).expect("state"); + + let workspace = tmp.path().join("ws"); + { + let mut hints = state.stdio_thread_hints.lock().await; + hints.insert( + "ghost-thread".to_string(), + RuntimeThreadHint { + model: Some("deepseek-v4-pro".to_string()), + workspace: Some(workspace.clone()), + workspace_roots: vec![workspace.clone(), tmp.path().join("attached")], + }, + ); + } + + // Generic stdio envelope arm. + let err = dispatch_stdio_request( + &state, + "thread/request", + json!({ "kind": "resume", "thread_id": "ghost-thread" }), + ) + .await + .expect_err("an envelope resume of a missing thread must fail like the named arm"); + assert_eq!(err.code, -32004); + + // HTTP face: 404 with the named error, hint untouched. + let app = app_router(state.clone(), &[]); + let response = app + .oneshot( + Request::builder() + .method(Method::POST) + .uri("/thread") + .header(header::CONTENT_TYPE, "application/json") + .body(Body::from( + serde_json::to_vec( + &json!({ "kind": "resume", "thread_id": "ghost-thread" }), + ) + .expect("request json"), + )) + .expect("request"), + ) + .await + .expect("response"); + assert_eq!(response.status(), StatusCode::NOT_FOUND); + let body = response_body_json(response).await; + assert!( + format!("{body}").contains("thread_not_found"), + "the HTTP error names the not-found cause: {body}" + ); + + let hints = state.stdio_thread_hints.lock().await; + let hint = hints + .get("ghost-thread") + .expect("cached hint survives both faces"); + assert_eq!(hint.model.as_deref(), Some("deepseek-v4-pro")); + assert_eq!(hint.workspace.as_deref(), Some(workspace.as_path())); + assert_eq!( + hint.workspace_roots, + vec![workspace.clone(), tmp.path().join("attached")], + "the attached root set survives — a wipe here is what collapses the next turn to single-root" + ); + } + + #[tokio::test] + async fn http_thread_face_answers_400_on_intake_validation_errors() { + // Round-22 SF22-4: a caller-side intake rejection (here, an explicit + // empty cwd; the same class as a declared root set failing + // `validate_workspace_roots`) is the client's mistake and answers + // 400 with the reason — the unconditional 500 misclassified it as a + // server fault and carried the paths in a `status` field. The stdio + // lane keeps its disclosed -32603 mapping. + let (app, _tmp) = app_with_config(None); + let response = app + .oneshot( + Request::builder() + .method(Method::POST) + .uri("/thread") + .header(header::CONTENT_TYPE, "application/json") + .body(Body::from( + serde_json::to_vec(&json!({ "kind": "start", "cwd": "" })) + .expect("request json"), + )) + .expect("request"), + ) + .await + .expect("response"); + + assert_eq!(response.status(), StatusCode::BAD_REQUEST); + let body = response_body_json(response).await; + assert!( + body["error"] + .as_str() + .is_some_and(|message| message.contains("cwd must not be empty")), + "the rejection reason must be in the body: {body}" + ); + } + fn sse_frame(event: &str, payload: Value) -> String { format!("event: {event}\ndata: {payload}\n\n") } @@ -3557,6 +3832,13 @@ mod tests { async fn create_thread(Json(body): Json) -> Json { assert_eq!(body["model"], "deepseek-v4"); assert_eq!(body["workspace"], "/tmp/codewhale-stdio"); + // A multi-root stdio thread must create a multi-root runtime + // thread: this is the only place the declared set can reach the + // thread every bridged turn executes on. + assert_eq!( + body["workspace_roots"], + json!(["/tmp/codewhale-stdio", "/tmp/codewhale-shared"]) + ); Json(json!({ "id": "thr_runtime", "model": body["model"].clone(), @@ -3583,6 +3865,10 @@ mod tests { Some(RuntimeThreadHint { model: Some("deepseek-v4".to_string()), workspace: Some(PathBuf::from("/tmp/codewhale-stdio")), + workspace_roots: vec![ + PathBuf::from("/tmp/codewhale-stdio"), + PathBuf::from("/tmp/codewhale-shared"), + ], }), ) .await @@ -3597,6 +3883,183 @@ mod tests { ); } + #[tokio::test] + async fn stdio_runtime_bridge_omits_an_empty_root_set() { + async fn create_thread(Json(body): Json) -> Json { + assert!( + body.get("workspace_roots").is_none(), + "a single-root hint must keep the historical frame: {body}" + ); + Json(json!({ "id": "thr_single" })) + } + + let listener = tokio::net::TcpListener::bind("127.0.0.1:0") + .await + .expect("bind test listener"); + let addr = listener.local_addr().expect("listener addr"); + let app = Router::new().route("/v1/threads", post(create_thread)); + + let server = tokio::spawn(async move { + axum::serve(listener, app) + .await + .expect("serve test runtime"); + }); + + let mut bridge = RuntimeBridge::from_base_url_for_test(format!("http://{addr}")); + let runtime_id = bridge + .ensure_runtime_thread( + "single_root_thread", + Some(RuntimeThreadHint { + model: Some("deepseek-v4".to_string()), + workspace: Some(PathBuf::from("/tmp/codewhale-single")), + workspace_roots: Vec::new(), + }), + ) + .await + .expect("runtime thread"); + server.abort(); + let _ = server.await; + + assert_eq!(runtime_id, "thr_single"); + } + + /// Round-9 M-B: a roots-bearing `thread/resume` after the first bridged + /// turn updates the stdio record and the hint, but the already-mapped + /// runtime thread was created with the old set. The bridge must reshape + /// the SAME runtime thread in place via PATCH (session id and turns + /// survive) so later turns execute the declared set; an unchanged hint + /// must keep the existing mapping. + #[tokio::test] + async fn stdio_runtime_bridge_remaps_when_the_hint_root_set_changes() { + let bodies = Arc::new(Mutex::new(Vec::::new())); + let captured = Arc::clone(&bodies); + async fn create_thread( + axum::extract::State(captured): axum::extract::State>>>, + Json(body): Json, + ) -> Json { + let ordinal = { + let mut bodies = captured.lock().await; + bodies.push(body.clone()); + bodies.len() + }; + Json(json!({ "id": format!("thr_runtime_{ordinal}") })) + } + // Patches land in the same capture, tagged: the roots-changed resume + // must re-shape the SAME runtime thread instead of creating a fresh + // one. + async fn patch_thread( + axum::extract::State(captured): axum::extract::State>>>, + axum::extract::Path(id): axum::extract::Path, + Json(body): Json, + ) -> Json { + let mut bodies = captured.lock().await; + let mut record = json!({ "patch": true }); + record["id"] = json!(id); + // A live PATCH preserves the thread's accumulated turns — that is + // the context-continuity guarantee under test. + record["turns"] = json!([{ "input": "earlier", "output": "earlier" }]); + record["workspace_roots"] = body["workspace_roots"].clone(); + bodies.push(record.clone()); + Json(record) + } + + let listener = tokio::net::TcpListener::bind("127.0.0.1:0") + .await + .expect("bind test listener"); + let addr = listener.local_addr().expect("listener addr"); + let app = Router::new() + .route("/v1/threads", post(create_thread)) + .route("/v1/threads/{id}", patch(patch_thread)) + .with_state(captured); + let server = tokio::spawn(async move { + axum::serve(listener, app) + .await + .expect("serve test runtime"); + }); + + let hint = |roots: &[&str]| RuntimeThreadHint { + model: None, + workspace: Some(PathBuf::from("/tmp/codewhale-primary")), + workspace_roots: roots.iter().map(PathBuf::from).collect(), + }; + let mut bridge = RuntimeBridge::from_base_url_for_test(format!("http://{addr}")); + let first = bridge + .ensure_runtime_thread( + "thr_stdio", + Some(hint(&["/tmp/codewhale-primary", "/tmp/codewhale-r1"])), + ) + .await + .expect("initial runtime thread"); + assert_eq!(first, "thr_runtime_1"); + + // An unchanged hint keeps the mapped thread: no second create. + let same = bridge + .ensure_runtime_thread( + "thr_stdio", + Some(hint(&["/tmp/codewhale-primary", "/tmp/codewhale-r1"])), + ) + .await + .expect("unchanged hint keeps the mapping"); + assert_eq!(same, "thr_runtime_1"); + assert_eq!( + bridge.thread_map.get("thr_stdio").map(String::as_str), + Some("thr_runtime_1") + ); + + // A roots-bearing resume changed the declared set: the bridge must + // re-shape the SAME runtime thread via PATCH (context continuity) + // instead of creating a fresh one. + let remapped = bridge + .ensure_runtime_thread( + "thr_stdio", + Some(hint(&["/tmp/codewhale-primary", "/tmp/codewhale-r2"])), + ) + .await + .expect("changed roots re-shape the runtime thread"); + assert_eq!(remapped, "thr_runtime_1", "the runtime thread is kept"); + assert_eq!( + bridge.thread_map.get("thr_stdio").map(String::as_str), + Some("thr_runtime_1") + ); + assert_eq!( + bridge.thread_roots.get("thr_stdio"), + Some(&vec![ + PathBuf::from("/tmp/codewhale-primary"), + PathBuf::from("/tmp/codewhale-r2") + ]), + "the mapped root set carries the resumed roots" + ); + server.abort(); + let _ = server.await; + + let bodies = bodies.lock().await; + assert_eq!(bodies.len(), 2, "one create plus one PATCH"); + assert_eq!( + bodies[0]["workspace_roots"], + json!(["/tmp/codewhale-primary", "/tmp/codewhale-r1"]) + ); + assert_eq!( + bodies[1]["patch"], + json!(true), + "the roots change re-shapes via PATCH" + ); + assert_eq!( + bodies[1]["id"], + json!("thr_runtime_1"), + "the PATCH lands on the same runtime thread" + ); + assert_eq!( + bodies[1]["workspace_roots"], + json!(["/tmp/codewhale-primary", "/tmp/codewhale-r2"]), + "the PATCH carries the resumed root set" + ); + assert_eq!( + bodies[1]["turns"].as_array().map(Vec::len), + Some(1), + "context continuity: the patched thread keeps its turns" + ); + } + // ── prompt routing runs a real turn ──────────────────────────────── // // `/prompt`, `prompt/request` and `prompt/run` used to return HTTP 200 diff --git a/crates/cli/src/lib.rs b/crates/cli/src/lib.rs index 6ace21dd07..f00ab3c188 100644 --- a/crates/cli/src/lib.rs +++ b/crates/cli/src/lib.rs @@ -4991,6 +4991,7 @@ fn run_sandbox_command(command: SandboxCommand) -> Result<()> { path: None, ask_for_approval: ask.into(), sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), })?; println!("{}", serde_json::to_string_pretty(&decision)?); Ok(()) diff --git a/crates/command-contract/src/facets.rs b/crates/command-contract/src/facets.rs index 137ad27b28..325528342a 100644 --- a/crates/command-contract/src/facets.rs +++ b/crates/command-contract/src/facets.rs @@ -937,6 +937,11 @@ pub trait CommandSkillGroupContext { /// `/restore `: host restores by snapshot id; handler composes the /// exact success message from its list entry. fn restore_snapshot(&mut self, id: &str) -> Result<(), String>; + /// `/restore` rollback scope: true when the session root set has entries + /// beyond the primary workspace. Snapshots are primary-bound, so the + /// handler must name the boundary instead of implying every accessible + /// root was reverted. + fn restore_covers_primary_only(&self) -> bool; /// `/restore` trust gate posture (yolo / trust_mode). fn approval_state(&self) -> CommandApprovalState; } diff --git a/crates/command-contract/src/tests.rs b/crates/command-contract/src/tests.rs index 76a7142338..bbf95c57d4 100644 --- a/crates/command-contract/src/tests.rs +++ b/crates/command-contract/src/tests.rs @@ -1492,6 +1492,10 @@ impl CommandSkillGroupContext for FakeSkillGroup { } } + fn restore_covers_primary_only(&self) -> bool { + false + } + fn approval_state(&self) -> CommandApprovalState { self.approval } diff --git a/crates/config/src/tests.rs b/crates/config/src/tests.rs index 63466aea5d..9dc49b1e0f 100644 --- a/crates/config/src/tests.rs +++ b/crates/config/src/tests.rs @@ -722,6 +722,7 @@ fn config_store_exec_policy_engine_uses_sibling_permissions() { path: None, ask_for_approval: codewhale_execpolicy::AskForApproval::UnlessTrusted, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .expect("policy check"); @@ -854,6 +855,7 @@ fn config_store_appends_exact_workspace_allow_rules() { path: None, ask_for_approval: codewhale_execpolicy::AskForApproval::OnRequest, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .expect("check exact grant"); assert_eq!( @@ -871,6 +873,7 @@ fn config_store_appends_exact_workspace_allow_rules() { path: None, ask_for_approval: codewhale_execpolicy::AskForApproval::OnRequest, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .expect("check extra args"); assert!(extra_args.requires_approval); diff --git a/crates/core/src/lib.rs b/crates/core/src/lib.rs index c1b9ce71cb..f459a91c1c 100644 --- a/crates/core/src/lib.rs +++ b/crates/core/src/lib.rs @@ -67,6 +67,348 @@ pub enum InitialHistory { }, } +/// Normalizes a workspace root set: `cwd` is the primary root at position 0, +/// followed by `roots` in their original order with duplicates removed. An +/// empty `roots` degenerates to `[cwd]`. +/// +/// Entries that are empty or relative are dropped, not normalized: every +/// containment check downstream is `Path::starts_with`-shaped, where an empty +/// root contains *every* path and a relative root is meaningless against the +/// absolute candidates the boundary checks resolve. The `cwd` argument is +/// filtered by the same rule, and there the filter fails closed: an empty or +/// relative cwd cannot head a root set (its normalized form is the vacuous +/// root), so the whole set collapses to empty and the thread has no writable +/// roots at all. Intake surfaces reject an empty cwd/workspace outright; this +/// filter is the last line for values that bypass a surface (legacy or +/// hand-edited records). This is the single chokepoint every consumer routes +/// through, so intake validation lives here rather than at each protocol +/// surface. +/// +/// Deduplication is lexical, not filesystem-aware: two spellings of the same +/// directory (a symlinked `/var/x` beside its `/private/var/x` target) both +/// survive here. Callers that enumerate writable roots canonicalize per root +/// for exactly that reason; a future canonicalizing intake would remove the +/// residue, at the cost of filesystem access on every normalization. +/// +/// This function stays a *shape* normalizer, not a validator, because it also +/// runs on sets that never passed an intake surface (restored sessions, legacy +/// or hand-edited records): those degrade by dropping the meaningless entries +/// rather than failing the whole load. Intake surfaces that receive a +/// caller-declared set route through [`validate_workspace_roots`] instead, +/// which rejects rather than drops. +pub fn normalize_workspace_roots(cwd: &Path, roots: &[PathBuf]) -> Vec { + if cwd.as_os_str().is_empty() || !cwd.is_absolute() { + return Vec::new(); + } + let mut normalized = vec![cwd.to_path_buf()]; + for root in roots { + if root.as_os_str().is_empty() || !root.is_absolute() { + continue; + } + if !normalized.contains(root) { + normalized.push(root.clone()); + } + } + normalized +} + +/// Lexically collapse CurDir and ParentDir components of `path` into the +/// landing path the tool boundary resolves: a `..` at the filesystem root +/// (or a Windows drive root) CLAMPS, it does not fail, and a `..` a relative +/// spelling cannot pop is KEPT. This is the single implementation behind the +/// tools layer's landing normalizer (`tools::spec::normalize_path`), shared +/// so the judgment lanes can never drift from the gate +/// (review #484/CodeWhale round-22 B22-5). +pub fn normalize_path_lexically(path: &Path) -> PathBuf { + let mut prefix: Option = None; + let mut is_root = false; + let mut stack: Vec = Vec::new(); + + for component in path.components() { + match component { + std::path::Component::Prefix(prefix_component) => { + prefix = Some(prefix_component.as_os_str().to_owned()); + } + std::path::Component::RootDir => { + is_root = true; + } + std::path::Component::CurDir => {} + std::path::Component::ParentDir => { + let parent = std::path::Component::ParentDir.as_os_str(); + if let Some(last) = stack.pop() { + if last == parent { + stack.push(last); + stack.push(parent.to_owned()); + } + } else if !is_root { + stack.push(parent.to_owned()); + } + } + std::path::Component::Normal(part) => { + stack.push(part.to_owned()); + } + } + } + + let mut normalized = PathBuf::new(); + if let Some(prefix) = prefix { + normalized.push(prefix); + } + if is_root { + normalized.push(Path::new(std::path::MAIN_SEPARATOR_STR)); + } + for part in stack { + normalized.push(part); + } + normalized +} + +/// Resolve a `cwd:`/`working_dir:`-style operand the way the exec lane does, +/// so a policy judgment sees the directory execution actually runs in +/// (review #484/CodeWhale round-22 B22-5): a relative spelling joins onto +/// `workspace`; an existing result canonicalizes through any symlink; a +/// nonexistent operand walks lexically to the deepest existing ancestor, +/// canonicalizes it through any symlink, re-appends the popped tail, and +/// normalizes — the same walk the engine's judged-cwd applies (round-20 +/// B20-1, round-21 B21-3). Both the headless `Runtime::invoke_tool` lane and +/// the TUI engine lane call this one implementation. +pub fn resolve_operand_cwd(workspace: &Path, raw: &str) -> PathBuf { + let raw_path = Path::new(raw); + let joined = if raw_path.is_absolute() { + raw_path.to_path_buf() + } else { + workspace.join(raw_path) + }; + match joined.canonicalize() { + Ok(canonical) => canonical, + Err(_) => { + let mut ancestor = joined.clone(); + let mut suffix: Vec = Vec::new(); + loop { + if ancestor.exists() { + break; + } + if let Some(name) = ancestor.file_name() { + suffix.push(name.to_owned()); + } + match ancestor.parent() { + Some(parent) if !parent.as_os_str().is_empty() => { + ancestor = parent.to_path_buf(); + } + _ => break, + } + } + let mut resolved = ancestor.canonicalize().unwrap_or_else(|_| ancestor.clone()); + for part in suffix.iter().rev() { + resolved.push(part); + } + normalize_path_lexically(&resolved) + } + } +} + +/// A caller-supplied value failed an intake validation rule: a declared +/// workspace root set (or a workspace/cwd that cannot head one) was refused. +/// +/// The distinct type (not just an `anyhow!` string) lets HTTP lanes classify +/// the rejection as the caller's mistake — HTTP 400 — instead of a server +/// fault (review #484/CodeWhale round-22 SF22-4). The `Display` text is the +/// rejection reason, unchanged from the plain `anyhow!` strings these sites +/// used before, so message-based classifiers keep working. +#[derive(Debug)] +pub struct IntakeValidationError { + message: String, +} + +impl std::fmt::Display for IntakeValidationError { + fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { + f.write_str(&self.message) + } +} + +impl std::error::Error for IntakeValidationError {} + +impl IntakeValidationError { + /// Build the rejection as an `anyhow::Error` so existing `anyhow::Result` + /// signatures carry it transparently. + fn err(message: impl Into) -> anyhow::Error { + anyhow::Error::new(Self { + message: message.into(), + }) + } +} + +/// Ceiling on one declared root set (review #484/CodeWhale round-22 SF22-8). +/// Every boundary consumer scales with the set length — the intake dedup, +/// per-turn sandbox materialization, per-operand `boundary_roots` +/// canonicalization, and repo law's per-root constitution loads — so an +/// unbounded declaration from a hostile or buggy client converts per-turn +/// work into a permanent stall. 64 is far above any legitimate multi-repo +/// session and bounds that work to a constant. +pub const MAX_WORKSPACE_ROOTS: usize = 64; + +/// Intake validation for a caller-declared root set: admit it whole or reject +/// it with an error, never silently reshape it. +/// +/// LEXICAL ONLY (review #484/CodeWhale round-20 B20-4): the checks run on +/// `normalize_lexical_components` output, while enforcement canonicalizes +/// per root — a symlink can make a lexically-sibling root the primary's +/// canonical ancestor (macOS `/tmp` ↔ `/private/tmp`), and a symlink to `/` +/// inside the workspace passes as a lexical child. Canonicalize-at-intake +/// (or re-checking at `get_writable_roots` materialization) is the +/// scheduled promotion; until then the rejection is advisory for any root +/// whose spelling differs from its canonical form. +/// +/// The per-turn sandbox copies this set verbatim into +/// `WorkspaceWrite.writable_roots`, so three classes of declared entry widen +/// the boundary past anything the caller saw, and each is rejected here: +/// +/// - a non-absolute root (`~/shared`, `relative/dir`) is meaningless against +/// the absolute candidates every containment check resolves — +/// [`normalize_workspace_roots`] would silently drop it, shrinking the +/// declared set without telling the caller, so intake refuses it instead; +/// - a root that normalizes to the filesystem root (`/`, `/..`) makes the +/// sandboxed exec lane filesystem-writable in one attachment; +/// - a root that is a proper ancestor of the primary root (the primary's +/// parent) grants the same reach one spelling at a time. +/// +/// `..` spellings are caught by the same lexical normalization the landing +/// checks apply, so `/shared/..` rejects exactly where `/` does. A root that +/// merely lives *under* the primary is fine — it is already writable through +/// the primary — and a root equal to the primary dedups in +/// [`normalize_workspace_roots`]. +/// +/// The degenerate primary keeps the normalizer's fail-closed collapse rather +/// than an error: an empty or relative primary cannot head a root set (its +/// normalized form is the vacuous root), which is the round-17 decision the +/// intake surfaces already pin — an empty workspace is rejected outright +/// there, and this collapse is the last line for values that bypass a +/// surface. +pub fn validate_workspace_roots(cwd: &Path, roots: &[PathBuf]) -> Result> { + if cwd.as_os_str().is_empty() || !cwd.is_absolute() { + return Ok(Vec::new()); + } + if roots.len() > MAX_WORKSPACE_ROOTS { + return Err(IntakeValidationError::err(format!( + "workspace root set declares {} roots; the intake cap is {MAX_WORKSPACE_ROOTS}, \ + and an oversized declaration stalls every per-turn boundary computation", + roots.len() + ))); + } + let primary = normalize_lexical_components(cwd); + for root in roots { + if root.as_os_str().is_empty() || !root.is_absolute() { + return Err(IntakeValidationError::err(format!( + "workspace root must be an absolute path; got {root:?}" + ))); + } + let normalized = normalize_lexical_components(root); + if is_filesystem_root(&normalized) { + return Err(IntakeValidationError::err(format!( + "workspace root {root:?} normalizes to the filesystem root; \ + attaching it would make the whole filesystem writable" + ))); + } + if primary != normalized && primary.starts_with(&normalized) { + return Err(IntakeValidationError::err(format!( + "workspace root {root:?} contains the primary root {cwd:?}; \ + attaching an ancestor of the primary would widen the sandbox \ + past the primary" + ))); + } + } + Ok(normalize_workspace_roots(cwd, roots)) +} + +/// Lexically collapse CurDir and ParentDir components of `path`, clamping a +/// `..` at the filesystem root rather than failing: `/a/..` judges as `/`, +/// the path the filesystem would actually resolve. Comparison-local, so a +/// self-consistent collapse of the two sides is exactly what the root-vs-root +/// checks need; the landing-path normalizer execution uses lives behind the +/// tool boundary and stays there. +fn normalize_lexical_components(path: &Path) -> PathBuf { + use std::path::Component; + let mut normalized = PathBuf::new(); + for component in path.components() { + match component { + Component::Prefix(_) | Component::RootDir => normalized.push(component.as_os_str()), + Component::CurDir => {} + Component::ParentDir => { + normalized.pop(); + } + Component::Normal(part) => normalized.push(part), + } + } + normalized +} + +/// True when `path` is a filesystem root — no named component left after +/// normalization (`/`, a Windows drive root, or a `..`-clamped spelling of +/// either). +fn is_filesystem_root(path: &Path) -> bool { + !path + .components() + .any(|component| matches!(component, std::path::Component::Normal(_))) +} + +/// Resolves the cwd and workspace roots for a resume request, aligned with +/// codex semantics: an explicit root set replaces the whole set (`Some([])` +/// clears back to the bare cwd); an explicit cwd alone takes over the +/// primary slot while additional roots are preserved; neither falls back to +/// the persisted values. An explicit empty cwd is rejected, not defaulted: +/// persisting it would null containment on every later resume, the same +/// poison the intake filter drops from the roots list. +/// +/// A caller-declared replacement set goes through +/// [`validate_workspace_roots`], so a super-root or an ancestor of the +/// primary is rejected here rather than admitted into the persisted row. +/// The same holds for the cwd-only move: moving the primary is a caller +/// decision, and re-basing the persisted additional roots onto it must not +/// durably mint a set whose entries are ancestors of (or super-roots for) +/// the new primary — the semantically identical PATCH workspace-only move +/// rejects, and a widened row would also strand a later bare fork, which +/// validates the inherited set. Only the pure-load branch (no overrides) +/// keeps the tolerant normalizer: a legacy or hand-edited row must stay +/// loadable, not strand its owner at resume time. +fn resolve_resume_roots( + persisted_cwd: &Path, + persisted_roots: &[PathBuf], + params_cwd: Option<&PathBuf>, + params_roots: Option<&[PathBuf]>, +) -> Result<(PathBuf, Vec)> { + if let Some(cwd) = params_cwd + && cwd.as_os_str().is_empty() + { + return Err(IntakeValidationError::err("cwd must not be empty")); + } + if let Some(roots) = params_roots { + let cwd = params_cwd + .cloned() + .unwrap_or_else(|| persisted_cwd.to_path_buf()); + // An explicit set replaces the persisted one wholesale — including + // the explicit empty set, which clears back to the bare cwd. The + // replacement is a caller decision, so it validates instead of + // degrading: a super-root must not slip in through the resume lane. + let roots = validate_workspace_roots(&cwd, roots)?; + return Ok((cwd, roots)); + } + if let Some(new_cwd) = params_cwd { + let additional: Vec = persisted_roots + .iter() + .filter(|root| root.as_path() != persisted_cwd) + .cloned() + .collect(); + // The persisted entries were admitted under the OLD primary; after + // the caller moves it they must satisfy the same intake rules the + // replacement set does, or the persisted row would grow a widening + // entry this topic's intake exists to refuse. + let roots = validate_workspace_roots(new_cwd, &additional)?; + return Ok((new_cwd.clone(), roots)); + } + let roots = normalize_workspace_roots(persisted_cwd, persisted_roots); + Ok((persisted_cwd.to_path_buf(), roots)) +} + /// Result of spawning or resuming a thread. #[derive(Debug, Clone)] pub struct NewThread { @@ -546,12 +888,17 @@ impl ThreadManager { &mut self, model_provider: String, cwd: PathBuf, + workspace_roots: &[PathBuf], initial_history: InitialHistory, persist_extended_history: bool, ) -> Result { let id = format!("thread-{}", Uuid::new_v4()); let now = chrono::Utc::now().timestamp(); let preview = preview_from_initial_history(&initial_history); + // Caller-declared set: validate, don't degrade. A super-root, an + // ancestor of the primary, or a non-absolute entry is an error, not + // a silent reshape of what the caller asked for. + let workspace_roots = validate_workspace_roots(&cwd, workspace_roots)?; let source = match initial_history { InitialHistory::New => SessionSource::Interactive, InitialHistory::Forked(_) => SessionSource::Fork, @@ -567,6 +914,7 @@ impl ThreadManager { status: ThreadStatus::Running, path: None, cwd: cwd.clone(), + workspace_roots, cli_version: self.cli_version.clone(), source: match source { SessionSource::Interactive => codewhale_protocol::SessionSource::Interactive, @@ -617,16 +965,50 @@ impl ThreadManager { pub fn resume_thread_with_history( &mut self, params: &ThreadResumeParams, - fallback_cwd: &Path, model_provider: String, ) -> Result> { if params.history.is_none() - && let Some(thread) = self.running_threads.get(¶ms.thread_id).cloned() + && let Some(mut thread) = self.running_threads.get(¶ms.thread_id).cloned() { + let (cwd, workspace_roots) = resolve_resume_roots( + &thread.cwd, + &thread.workspace_roots, + params.cwd.as_ref(), + params.workspace_roots.as_deref(), + )?; + thread.cwd = cwd; + thread.workspace_roots = workspace_roots; + // Write the override back to both the cache and the persisted row. + // The cache alone is not enough in-process: a later resume that + // carries history bypasses this branch entirely, re-reads the + // stored row, and would silently reinstate the pre-override set. + // Only an override pays that write: base neither persisted nor + // bumped `updated_at` on a parameterless cached resume, and doing + // it unconditionally reordered recency listings, refreshed + // archived threads to active timestamps, and taxed every resume + // with a read+write for no state change. + if params.cwd.is_some() || params.workspace_roots.is_some() { + thread.updated_at = chrono::Utc::now().timestamp(); + // Targeted write, not persist_thread: the cache snapshot is + // stale in every column another process may have written, and + // the upsert's preserving arms cover only policy and the + // archive stamp — a full upsert would let the stale snapshot + // revert concurrent updates to the passthrough columns (even + // resurrecting a concurrently archived thread). The override + // owns exactly cwd, the root set, and the recency stamp. + self.store.update_thread_root_set( + &thread.id, + &thread.cwd, + &thread.workspace_roots, + thread.updated_at, + )?; + } + self.running_threads + .insert(params.thread_id.clone(), thread.clone()); return Ok(Some(NewThread { model: params.model.clone().unwrap_or_else(|| "auto".to_string()), model_provider: params.model_provider.clone().unwrap_or(model_provider), - cwd: params.cwd.clone().unwrap_or_else(|| thread.cwd.clone()), + cwd: thread.cwd.clone(), approval_policy: params.approval_policy.clone(), sandbox: params.sandbox.clone(), thread, @@ -640,10 +1022,14 @@ impl ThreadManager { let mut thread = to_protocol_thread(metadata); thread.status = ThreadStatus::Running; thread.updated_at = chrono::Utc::now().timestamp(); - thread.cwd = params - .cwd - .clone() - .unwrap_or_else(|| fallback_cwd.to_path_buf()); + let (cwd, workspace_roots) = resolve_resume_roots( + &thread.cwd, + &thread.workspace_roots, + params.cwd.as_ref(), + params.workspace_roots.as_deref(), + )?; + thread.cwd = cwd; + thread.workspace_roots = workspace_roots; self.persist_thread(&thread, None)?; self.running_threads .insert(thread.id.clone(), thread.clone()); @@ -689,26 +1075,52 @@ impl ThreadManager { })) } - /// Forks an existing thread into a new one, inheriting the parent's provider. - pub fn fork_thread( - &mut self, - params: &ThreadForkParams, - fallback_cwd: &Path, - ) -> Result> { + /// Forks an existing thread into a new one, inheriting the parent's + /// provider and — when the request does not carry a root set — its + /// accessible roots. A fork without a `cwd` stays anchored at the + /// parent's cwd. + pub fn fork_thread(&mut self, params: &ThreadForkParams) -> Result> { + // An explicit empty cwd would persist a vacuous primary root + // (`starts_with("")` is true for every path); reject it like the + // resume lane does instead of poisoning the fork durably. + if let Some(cwd) = params.cwd.as_ref() + && cwd.as_os_str().is_empty() + { + return Err(IntakeValidationError::err("cwd must not be empty")); + } let parent = self.store.get_thread(¶ms.thread_id)?; let Some(parent) = parent else { return Ok(None); }; let parent_thread = to_protocol_thread(parent); + // `None` inherits the parent's set: the fork's cwd takes the primary + // slot and the parent's additional roots survive, the same + // primary-swap rule a cwd-only resume applies. A bare `thread/fork` + // is the historical shape, so reading an absent field as "no roots" + // would silently degrade a multi-root parent to `[cwd]`. `Some([])` + // stays an explicit clear. + let workspace_roots = match params.workspace_roots.as_deref() { + Some(roots) => roots.to_vec(), + None => parent_thread + .workspace_roots + .iter() + .filter(|root| root.as_path() != parent_thread.cwd) + .cloned() + .collect(), + }; let new = self.spawn_thread_with_history( params .model_provider .clone() .unwrap_or_else(|| parent_thread.model_provider.clone()), + // A bare `thread/fork` carries no cwd: anchor the fork at the + // parent's cwd, not the process cwd, so the parent's main + // directory stays the primary root of the set it inherits. params .cwd .clone() - .unwrap_or_else(|| fallback_cwd.to_path_buf()), + .unwrap_or_else(|| parent_thread.cwd.clone()), + &workspace_roots, InitialHistory::Forked(vec![json!({ "type": "fork", "from_thread_id": parent_thread.id @@ -865,38 +1277,40 @@ impl ThreadManager { } fn persist_thread(&self, thread: &Thread, rollout_path: Option) -> Result<()> { - // This update payload carries no per-thread policy, so preserve any - // policy already stored for the thread rather than erasing it with - // NULLs on every persist/resume. - let existing = self.store.get_thread(&thread.id)?; - self.store.upsert_thread(&ThreadMetadata { - id: thread.id.clone(), - rollout_path, - preview: thread.preview.clone(), - ephemeral: thread.ephemeral, - model_provider: thread.model_provider.clone(), - created_at: thread.created_at, - updated_at: thread.updated_at, - status: to_persisted_status(&thread.status), - path: thread.path.clone(), - cwd: thread.cwd.clone(), - cli_version: thread.cli_version.clone(), - source: to_persisted_source(&thread.source), - name: thread.name.clone(), - sandbox_policy: existing - .as_ref() - .and_then(|metadata| metadata.sandbox_policy.clone()), - approval_mode: existing - .as_ref() - .and_then(|metadata| metadata.approval_mode.clone()), - archived: matches!(thread.status, ThreadStatus::Archived), - archived_at: None, - git_sha: None, - git_branch: None, - git_origin_url: None, - memory_mode: None, - current_leaf_id: None, - }) + // This update payload carries no per-thread policy or archive + // timestamp, and the preserved values must survive concurrently + // applied clears: the state layer keeps them inside the upsert + // statement itself (policy fields while the payload carries none, + // the stamp only while the thread stays archived). A get-then-upsert + // here would resurrect a concurrently unarchived or detached record + // from a stale snapshot, and forced-Running resumes would ghost + // `archived=0` rows with a stamp set. + self.store + .upsert_thread_preserving_policy_and_archive(&ThreadMetadata { + id: thread.id.clone(), + rollout_path, + preview: thread.preview.clone(), + ephemeral: thread.ephemeral, + model_provider: thread.model_provider.clone(), + created_at: thread.created_at, + updated_at: thread.updated_at, + status: to_persisted_status(&thread.status), + path: thread.path.clone(), + cwd: thread.cwd.clone(), + workspace_roots: thread.workspace_roots.clone(), + cli_version: thread.cli_version.clone(), + source: to_persisted_source(&thread.source), + name: thread.name.clone(), + sandbox_policy: None, + approval_mode: None, + archived: matches!(thread.status, ThreadStatus::Archived), + archived_at: None, + git_sha: None, + git_branch: None, + git_origin_url: None, + memory_mode: None, + current_leaf_id: None, + }) } } @@ -1037,6 +1451,7 @@ impl Runtime { let new = self.thread_manager.spawn_thread_with_history( "deepseek".to_string(), cwd, + &[], InitialHistory::New, false, )?; @@ -1045,6 +1460,13 @@ impl Runtime { Ok(response) } ThreadRequest::Start(params) => { + // Same empty-cwd rejection as resume/fork: an explicit `""` + // would otherwise persist a vacuous primary root. + if let Some(cwd) = params.cwd.as_ref() + && cwd.as_os_str().is_empty() + { + return Err(IntakeValidationError::err("cwd must not be empty")); + } let cwd = params.cwd.clone().unwrap_or_else(|| { std::env::current_dir().unwrap_or_else(|_| PathBuf::from(".")) }); @@ -1054,6 +1476,7 @@ impl Runtime { .clone() .unwrap_or_else(|| "deepseek".to_string()), cwd, + ¶ms.workspace_roots, InitialHistory::New, params.persist_extended_history, )?; @@ -1062,12 +1485,10 @@ impl Runtime { Ok(response) } ThreadRequest::Resume(params) => { - let fallback_cwd = std::env::current_dir().unwrap_or_else(|_| PathBuf::from(".")); - if let Some(new) = self.thread_manager.resume_thread_with_history( - ¶ms, - &fallback_cwd, - "deepseek".to_string(), - )? { + if let Some(new) = self + .thread_manager + .resume_thread_with_history(¶ms, "deepseek".to_string())? + { let mut response = thread_response_from_new("resumed", new); response.data = self.persisted_thread_data(&response.thread_id)?; Ok(response) @@ -1089,8 +1510,7 @@ impl Runtime { } } ThreadRequest::Fork(params) => { - let cwd = std::env::current_dir().unwrap_or_else(|_| PathBuf::from(".")); - if let Some(new) = self.thread_manager.fork_thread(¶ms, &cwd)? { + if let Some(new) = self.thread_manager.fork_thread(¶ms)? { let mut response = thread_response_from_new("forked", new); response.data = self.persisted_thread_data(&response.thread_id)?; Ok(response) @@ -1321,9 +1741,20 @@ impl Runtime { call: ToolCall, approval_mode: AskForApproval, cwd: &Path, + workspace_roots: &[PathBuf], ) -> Result { let fallback_cwd = cwd.display().to_string(); - let (command, policy_cwd, execution_kind) = call.execution_subject(&fallback_cwd); + let (command, raw_policy_cwd, execution_kind) = call.execution_subject(&fallback_cwd); + // Judge the same effective cwd execution resolves (review + // #484/CodeWhale round-22 B22-5): this lane used to hand the RAW + // `params.cwd` operand to the policy check while execution resolved + // the same operand roots-aware and canonically — a symlink-spelled + // operand evaded a deny scoped to the canonical target, and any + // relative/`..` operand made `normalize_workspace_scope` reject the + // judgment side, silently disarming every scoped rule for the call. + let policy_cwd = resolve_operand_cwd(cwd, &raw_policy_cwd) + .to_string_lossy() + .into_owned(); let policy_tool = match &call.payload { ToolPayload::LocalShell { .. } => "exec_shell", _ => call.name.as_str(), @@ -1336,6 +1767,25 @@ impl Runtime { path: policy_path.as_deref(), ask_for_approval: approval_mode, sandbox_mode: None, + // The caller supplies the session's root set (hint map on the + // app-server bridge); an empty slice keeps the byte-identical + // single-root posture for callers that have none. The declared + // set is the only roots intake with no validator in front of it, + // so it at least goes through the shape normalizer the engine + // lane applies — empty/relative entries dropped, primary + // prepended, deduped — instead of reaching the policy raw, and + // is capped like a validating intake: an unbounded declaration + // here is an O(n²) dedup per tool call, client-repeatable + // (round-23 SF23-2). + workspace_roots: normalize_workspace_roots( + cwd, + workspace_roots + .iter() + .take(MAX_WORKSPACE_ROOTS) + .cloned() + .collect::>() + .as_slice(), + ), })?; let precheck = policy_precheck_payload(&decision, &command, &policy_cwd, execution_kind); let response_id = format!("tool-{}", Uuid::new_v4()); @@ -1826,19 +2276,26 @@ fn preview_from_initial_history(initial_history: &InitialHistory) -> String { } fn permission_path_for_call(call: &ToolCall) -> Option { + // Round-23 SF23-5: the alias set mirrors the tools layer's + // `PATH_ALIASES` (file_path / filePath fold onto `path`) so a + // camelCase-spelled file call cannot enter exec policy with `path: + // None` — path-scoped deny/ask would be silently blind on this lane. + // DEPENDENCY: if the tools layer grows another alias, this set must + // move with it (the lane currently dispatches against an empty + // registry, which is the only mitigation keeping this latent). + fn path_from(value: &Value) -> Option { + ["path", "file_path", "filePath"] + .iter() + .find_map(|name| value.get(name).and_then(Value::as_str)) + .map(str::to_string) + } match &call.payload { ToolPayload::Function { arguments } => serde_json::from_str::(arguments) .ok() - .and_then(|value| { - value - .get("path") - .and_then(Value::as_str) - .map(str::to_string) - }), - ToolPayload::Mcp { raw_arguments, .. } => raw_arguments - .get("path") - .and_then(Value::as_str) - .map(str::to_string), + .and_then(|value| path_from(&value)), + ToolPayload::Mcp { raw_arguments, .. } => { + path_from(raw_arguments).as_deref().map(str::to_string) + } ToolPayload::Custom { .. } | ToolPayload::LocalShell { .. } => None, } } @@ -1865,6 +2322,7 @@ fn to_protocol_thread(thread: ThreadMetadata) -> Thread { }, path: thread.path, cwd: thread.cwd, + workspace_roots: thread.workspace_roots, cli_version: thread.cli_version, source: match thread.source { SessionSource::Interactive => codewhale_protocol::SessionSource::Interactive, @@ -2234,6 +2692,7 @@ mod tests { status: PersistedThreadStatus::Running, path: None, cwd: PathBuf::from("/tmp/codewhale"), + workspace_roots: Vec::new(), cli_version: "0.0.0-test".to_string(), source: SessionSource::Interactive, name: None, @@ -2987,6 +3446,7 @@ mod tests { .spawn_thread_with_history( "deepseek".to_string(), PathBuf::from("/tmp/codewhale"), + &[], InitialHistory::New, true, ) @@ -3005,16 +3465,13 @@ mod tests { base_instructions: None, developer_instructions: None, personality: None, + workspace_roots: None, persist_extended_history: false, }; manager.archive_thread(&thread_id).expect("archive thread"); let archived = manager - .resume_thread_with_history( - &resume_params, - Path::new("/tmp/codewhale"), - "deepseek".to_string(), - ) + .resume_thread_with_history(&resume_params, "deepseek".to_string()) .expect("resume archived thread") .expect("thread in cache"); assert_eq!(archived.thread.status, ThreadStatus::Archived); @@ -3023,14 +3480,200 @@ mod tests { .unarchive_thread(&thread_id) .expect("unarchive thread"); let restored = manager + .resume_thread_with_history(&resume_params, "deepseek".to_string()) + .expect("resume unarchived thread") + .expect("thread in cache"); + assert_eq!(restored.thread.status, ThreadStatus::Idle); + } + + /// The cached-resume persist must not null the archive timestamp the + /// store recorded, the same way it already preserves the per-thread + /// policy fields. + #[test] + fn cached_resume_preserves_the_persisted_archive_timestamp() { + let store = temp_core_state("cached-resume-archived-at"); + let mut manager = ThreadManager::new(store); + let spawned = manager + .spawn_thread_with_history( + "deepseek".to_string(), + PathBuf::from("/tmp/codewhale"), + &[], + InitialHistory::New, + true, + ) + .expect("spawn thread"); + let thread_id = spawned.thread.id.clone(); + manager.archive_thread(&thread_id).expect("archive thread"); + let archived_at = manager + .state_store() + .get_thread(&thread_id) + .expect("read thread") + .expect("thread persisted") + .archived_at; + assert!(archived_at.is_some(), "archiving stamps archived_at"); + + let resumed = manager .resume_thread_with_history( - &resume_params, - Path::new("/tmp/codewhale"), + &ThreadResumeParams { + thread_id: thread_id.clone(), + history: None, + path: None, + model: None, + model_provider: None, + cwd: None, + approval_policy: None, + sandbox: None, + config: None, + base_instructions: None, + developer_instructions: None, + personality: None, + workspace_roots: None, + persist_extended_history: false, + }, "deepseek".to_string(), ) - .expect("resume unarchived thread") + .expect("resume archived thread") .expect("thread in cache"); - assert_eq!(restored.thread.status, ThreadStatus::Idle); + assert_eq!(resumed.thread.status, ThreadStatus::Archived); + let persisted = manager + .state_store() + .get_thread(&thread_id) + .expect("read thread") + .expect("thread persisted"); + assert_eq!( + persisted.archived_at, archived_at, + "a parameterless cached resume must not null the archive timestamp" + ); + } + + #[test] + fn parameterless_cached_resume_does_not_rewrite_the_row() { + // Base neither persisted nor bumped `updated_at` on a parameterless + // cached resume; the override writeback is gated the same way. Without + // the gate every parameterless resume reordered recency listings, + // refreshed archived rows to active timestamps, and paid a read+write + // for no state change. + let store = temp_core_state("cached-resume-no-writeback"); + let mut manager = ThreadManager::new(store); + let spawned = manager + .spawn_thread_with_history( + "deepseek".to_string(), + PathBuf::from("/tmp/codewhale"), + &[], + InitialHistory::New, + true, + ) + .expect("spawn thread"); + let thread_id = spawned.thread.id.clone(); + let mut aged = manager + .state_store() + .get_thread(&thread_id) + .expect("read thread") + .expect("thread persisted"); + aged.updated_at = 1_000; + manager + .state_store() + .upsert_thread(&aged) + .expect("age the stored row"); + + manager + .resume_thread_with_history( + &ThreadResumeParams { + thread_id: thread_id.clone(), + history: None, + path: None, + model: None, + model_provider: None, + cwd: None, + approval_policy: None, + sandbox: None, + config: None, + base_instructions: None, + developer_instructions: None, + personality: None, + workspace_roots: None, + persist_extended_history: false, + }, + "deepseek".to_string(), + ) + .expect("resume thread") + .expect("thread in cache"); + + let row = manager + .state_store() + .get_thread(&thread_id) + .expect("read thread") + .expect("thread persisted"); + assert_eq!( + row.updated_at, 1_000, + "a parameterless cached resume must not rewrite the stored row" + ); + } + + #[test] + fn resumed_archived_thread_does_not_ghost_an_archive_stamp() { + // Resuming a persisted archived thread forces it back to Running. + // Persisting that reactivation must produce `archived=0` with no + // stamp — base never produced the `archived=0` + stamp-set pair, and + // unconditionally preserving the stored stamp recreated exactly that + // ghost. + let store = temp_core_state("resume-archived-no-ghost"); + let mut manager = ThreadManager::new(store); + let spawned = manager + .spawn_thread_with_history( + "deepseek".to_string(), + PathBuf::from("/tmp/codewhale"), + &[], + InitialHistory::New, + true, + ) + .expect("spawn thread"); + let thread_id = spawned.thread.id.clone(); + manager.archive_thread(&thread_id).expect("archive thread"); + assert!( + manager + .state_store() + .get_thread(&thread_id) + .expect("read thread") + .expect("thread persisted") + .archived_at + .is_some(), + "archiving stamps archived_at" + ); + + manager + .resume_thread_with_history( + &ThreadResumeParams { + thread_id: thread_id.clone(), + history: Some(Vec::new()), + path: None, + model: None, + model_provider: None, + cwd: None, + approval_policy: None, + sandbox: None, + config: None, + base_instructions: None, + developer_instructions: None, + personality: None, + workspace_roots: None, + persist_extended_history: false, + }, + "deepseek".to_string(), + ) + .expect("resume thread") + .expect("thread resumed"); + + let row = manager + .state_store() + .get_thread(&thread_id) + .expect("read thread") + .expect("thread persisted"); + assert!(!row.archived, "the resume reactivates the thread"); + assert_eq!( + row.archived_at, None, + "reactivation must not ghost an archive stamp" + ); } #[test] @@ -3048,6 +3691,7 @@ mod tests { .spawn_thread_with_history( "deepseek".to_string(), PathBuf::from("/tmp/codewhale"), + &[], InitialHistory::Forked(history.clone()), true, ) @@ -3075,17 +3719,14 @@ mod tests { base_instructions: None, developer_instructions: None, personality: None, + workspace_roots: None, persist_extended_history: false, }; // Resuming twice with the same history must be idempotent. for _ in 0..2 { manager - .resume_thread_with_history( - &resume_params, - Path::new("/tmp/codewhale"), - "deepseek".to_string(), - ) + .resume_thread_with_history(&resume_params, "deepseek".to_string()) .expect("resume thread") .expect("thread found"); } @@ -3103,11 +3744,7 @@ mod tests { ..resume_params }; manager - .resume_thread_with_history( - &resume_params, - Path::new("/tmp/codewhale"), - "deepseek".to_string(), - ) + .resume_thread_with_history(&resume_params, "deepseek".to_string()) .expect("resume thread") .expect("thread found"); assert_eq!(message_count(&manager), 3); @@ -3140,14 +3777,11 @@ mod tests { base_instructions: None, developer_instructions: None, personality: None, + workspace_roots: None, persist_extended_history: false, }; manager - .resume_thread_with_history( - &resume_params, - Path::new("/tmp/codewhale"), - "deepseek".to_string(), - ) + .resume_thread_with_history(&resume_params, "deepseek".to_string()) .expect("resume thread") .expect("thread found"); @@ -3160,26 +3794,744 @@ mod tests { assert_eq!(persisted.approval_mode.as_deref(), Some("on-request")); } - #[tokio::test] - async fn invoke_tool_returns_timeout_status_for_slow_tools() { - use async_trait::async_trait; - use codewhale_agent::ModelRegistry; - use codewhale_config::ConfigToml; - use codewhale_execpolicy::{AskForApproval, ExecPolicyEngine}; - use codewhale_hooks::HookDispatcher; - use codewhale_mcp::McpManager; - use codewhale_protocol::{ToolKind, ToolOutput, ToolPayload}; - use codewhale_tools::{FunctionCallError, ToolDescriptor, ToolHandler, ToolInvocation}; + // ── workspace roots ──────────────────────────────────────────────── - struct SlowTool; - #[async_trait] - impl ToolHandler for SlowTool { - fn kind(&self) -> ToolKind { - ToolKind::Function - } + fn resume_params(thread_id: &str) -> ThreadResumeParams { + ThreadResumeParams { + thread_id: thread_id.to_string(), + history: None, + path: None, + model: None, + model_provider: None, + cwd: None, + approval_policy: None, + sandbox: None, + config: None, + base_instructions: None, + developer_instructions: None, + personality: None, + workspace_roots: None, + persist_extended_history: false, + } + } - async fn handle( - &self, + #[test] + fn normalize_workspace_roots_puts_cwd_first_and_dedups() { + let cwd = Path::new("/repo/main"); + assert_eq!(normalize_workspace_roots(cwd, &[]), vec![cwd.to_path_buf()]); + assert_eq!( + normalize_workspace_roots( + cwd, + &[ + PathBuf::from("/repo/lib"), + PathBuf::from("/repo/main"), + PathBuf::from("/repo/lib"), + PathBuf::from("/repo/docs"), + ], + ), + vec![ + PathBuf::from("/repo/main"), + PathBuf::from("/repo/lib"), + PathBuf::from("/repo/docs"), + ], + "cwd moves to the front and later roots dedup in original order" + ); + } + + #[test] + fn normalize_workspace_roots_drops_empty_and_relative_entries() { + let cwd = Path::new("/repo/main"); + assert_eq!( + normalize_workspace_roots( + cwd, + &[ + PathBuf::from(""), + PathBuf::from("relative/dir"), + PathBuf::from("~/home-dir"), + PathBuf::from("/repo/lib"), + ], + ), + vec![PathBuf::from("/repo/main"), PathBuf::from("/repo/lib")], + "an empty entry would contain every path under starts_with, and a \ + relative entry is meaningless against absolute candidates" + ); + // The cwd argument is filtered by the same rule, and there the + // filter fails closed: an empty or relative cwd cannot head a root + // set (its normalized form is the vacuous root `starts_with("")` + // accepts every path under), so the whole set collapses to empty + // rather than passing the poison through to boundary_roots(). + assert!(normalize_workspace_roots(Path::new(""), &[]).is_empty()); + assert!(normalize_workspace_roots(Path::new(""), &[PathBuf::from("/repo/lib")]).is_empty()); + assert!(normalize_workspace_roots(Path::new("relative/dir"), &[]).is_empty()); + } + + #[test] + fn spawn_thread_rejects_a_non_absolute_root_instead_of_dropping_it() { + // Regression pin, round-17: an empty-string root accepted at intake + // used to reach the persisted set and then boundary_roots(), where + // Path::starts_with("") is true for every path — read_file's + // containment check passed for arbitrary filesystem reads. Round-19 + // tightened the decision from "silently drop the entry" to "reject + // the declared set": a silent drop shrinks the set the caller asked + // for without telling it, and `~/shared` dies by the same rule. + let store = temp_core_state("spawn-empty-root"); + let mut manager = ThreadManager::new(store); + for root in ["", "~/shared", "relative/dir"] { + let err = manager + .spawn_thread_with_history( + "deepseek".to_string(), + PathBuf::from("/repo/main"), + &[PathBuf::from(root)], + InitialHistory::New, + true, + ) + .expect_err("a non-absolute root must be rejected at intake"); + assert!( + err.to_string().contains("absolute path"), + "unexpected error for {root:?}: {err}" + ); + } + } + + #[test] + fn spawn_thread_rejects_a_super_root_and_the_primarys_ancestor() { + // Round-19: the per-turn sandbox copies the set verbatim into + // WorkspaceWrite.writable_roots, so attaching `/` (or `/..`, which + // normalizes to it) made the sandboxed exec lane filesystem-writable, + // and the primary's parent granted the same reach one spelling at a + // time. Both are rejected at intake now; a sibling still attaches. + let store = temp_core_state("spawn-super-root"); + let mut manager = ThreadManager::new(store); + for root in ["/", "/..", "/shared/..", "/repo"] { + let err = manager + .spawn_thread_with_history( + "deepseek".to_string(), + PathBuf::from("/repo/main"), + &[PathBuf::from(root)], + InitialHistory::New, + true, + ) + .expect_err("a super-root or ancestor must be rejected at intake"); + assert!( + err.to_string().contains("filesystem root") + || err.to_string().contains("ancestor of the primary"), + "unexpected error for {root:?}: {err}" + ); + } + let spawned = manager + .spawn_thread_with_history( + "deepseek".to_string(), + PathBuf::from("/repo/main"), + &[ + PathBuf::from("/repo/lib"), + PathBuf::from("/repo/main/crates"), + ], + InitialHistory::New, + true, + ) + .expect("a sibling and a subdirectory of the primary are fine"); + assert_eq!( + spawned.thread.workspace_roots, + vec![ + PathBuf::from("/repo/main"), + PathBuf::from("/repo/lib"), + PathBuf::from("/repo/main/crates"), + ] + ); + } + + #[test] + fn validate_workspace_roots_keeps_the_degenerate_primary_collapse() { + // Round-17 decision, unchanged: an empty or relative primary cannot + // head a root set, so the set collapses to empty — the intake + // surfaces reject an empty workspace outright; this is the last line + // for values that bypass a surface. + assert!( + validate_workspace_roots(Path::new(""), &[PathBuf::from("/")]) + .unwrap() + .is_empty() + ); + assert!( + validate_workspace_roots(Path::new("relative/dir"), &[]) + .unwrap() + .is_empty() + ); + } + + #[test] + fn resume_with_a_super_root_set_is_rejected_at_intake() { + let store = temp_core_state("resume-super-root"); + let mut metadata = test_thread_metadata("thread-super-root"); + metadata.cwd = PathBuf::from("/old"); + metadata.workspace_roots = vec![PathBuf::from("/old")]; + store.upsert_thread(&metadata).expect("seed thread"); + let mut manager = ThreadManager::new(store); + + let mut params = resume_params("thread-super-root"); + params.workspace_roots = Some(vec![PathBuf::from("/..")]); + let err = manager + .resume_thread_with_history(¶ms, "deepseek".to_string()) + .expect_err("an explicit super-root replacement must be rejected"); + assert!( + err.to_string().contains("filesystem root"), + "unexpected error: {err}" + ); + + // The persisted row is untouched: the caller can retry with a real + // set, and a parameterless resume still loads the stored one. + let mut params = resume_params("thread-super-root"); + params.workspace_roots = Some(vec![PathBuf::from("/new-a")]); + let resumed = manager + .resume_thread_with_history(¶ms, "deepseek".to_string()) + .expect("resume thread") + .expect("thread found"); + assert_eq!( + resumed.thread.workspace_roots, + vec![PathBuf::from("/old"), PathBuf::from("/new-a")] + ); + } + + #[test] + fn spawn_thread_with_workspace_roots_persists_normalized_set() { + let store = temp_core_state("spawn-roots"); + let mut manager = ThreadManager::new(store); + let spawned = manager + .spawn_thread_with_history( + "deepseek".to_string(), + PathBuf::from("/repo/main"), + &[PathBuf::from("/repo/lib"), PathBuf::from("/repo/main")], + InitialHistory::New, + true, + ) + .expect("spawn thread"); + let expected = vec![PathBuf::from("/repo/main"), PathBuf::from("/repo/lib")]; + assert_eq!(spawned.thread.workspace_roots, expected); + assert_eq!(spawned.thread.cwd, spawned.thread.workspace_roots[0]); + + let persisted = manager + .state_store() + .get_thread(&spawned.thread.id) + .expect("read thread") + .expect("thread persisted"); + assert_eq!(persisted.workspace_roots, expected); + } + + #[test] + fn resume_with_workspace_roots_replaces_root_set() { + let store = temp_core_state("resume-roots-replace"); + let mut metadata = test_thread_metadata("thread-roots"); + metadata.cwd = PathBuf::from("/old"); + metadata.workspace_roots = vec![PathBuf::from("/old"), PathBuf::from("/keep")]; + store.upsert_thread(&metadata).expect("seed thread"); + + // A fresh manager forces the persisted path. + let mut manager = ThreadManager::new(store); + let mut params = resume_params("thread-roots"); + params.workspace_roots = Some(vec![PathBuf::from("/new-a"), PathBuf::from("/new-b")]); + let resumed = manager + .resume_thread_with_history(¶ms, "deepseek".to_string()) + .expect("resume thread") + .expect("thread found"); + + // Explicit roots replace the whole set; the persisted cwd stays primary. + assert_eq!(resumed.thread.cwd, PathBuf::from("/old")); + assert_eq!( + resumed.thread.workspace_roots, + vec![ + PathBuf::from("/old"), + PathBuf::from("/new-a"), + PathBuf::from("/new-b"), + ] + ); + let persisted = manager + .state_store() + .get_thread("thread-roots") + .expect("read thread") + .expect("thread persisted"); + assert_eq!(persisted.workspace_roots, resumed.thread.workspace_roots); + } + + #[test] + fn resume_roots_override_writes_back_to_running_cache() { + let store = temp_core_state("resume-roots-writeback"); + let mut manager = ThreadManager::new(store); + let spawned = manager + .spawn_thread_with_history( + "deepseek".to_string(), + PathBuf::from("/repo/main"), + &[], + InitialHistory::New, + true, + ) + .expect("spawn thread"); + let thread_id = spawned.thread.id.clone(); + + // Resume with an explicit set: the override lands on the returned + // thread and must be written back to the running-thread cache. + let mut params = resume_params(&thread_id); + params.workspace_roots = Some(vec![PathBuf::from("/repo/shared")]); + let first = manager + .resume_thread_with_history(¶ms, "deepseek".to_string()) + .expect("resume thread") + .expect("thread found"); + assert_eq!( + first.thread.workspace_roots, + vec![PathBuf::from("/repo/main"), PathBuf::from("/repo/shared")] + ); + + // A later parameterless resume reads the same cache entry: without + // the writeback it would resurrect the stale pre-override set. + let second = manager + .resume_thread_with_history(&resume_params(&thread_id), "deepseek".to_string()) + .expect("resume thread") + .expect("thread found"); + assert_eq!( + second.thread.workspace_roots, + vec![PathBuf::from("/repo/main"), PathBuf::from("/repo/shared")], + "the roots override must stick in the running-thread cache" + ); + } + + #[test] + fn resume_override_survives_a_later_history_carrying_resume() { + let store = temp_core_state("resume-roots-history-bypass"); + let mut manager = ThreadManager::new(store); + let spawned = manager + .spawn_thread_with_history( + "deepseek".to_string(), + PathBuf::from("/repo/main"), + &[], + InitialHistory::New, + true, + ) + .expect("spawn thread"); + let thread_id = spawned.thread.id.clone(); + + // Prime the running cache, then take the cached history-free branch + // with an explicit roots override: that branch used to update the + // cache only. + let primed = manager + .resume_thread_with_history(&resume_params(&thread_id), "deepseek".to_string()) + .expect("resume thread") + .expect("thread found"); + assert_eq!( + primed.thread.workspace_roots, + vec![PathBuf::from("/repo/main")] + ); + let mut params = resume_params(&thread_id); + params.workspace_roots = Some(vec![PathBuf::from("/repo/shared")]); + let overridden = manager + .resume_thread_with_history(¶ms, "deepseek".to_string()) + .expect("resume thread") + .expect("thread found"); + assert_eq!( + overridden.thread.workspace_roots, + vec![PathBuf::from("/repo/main"), PathBuf::from("/repo/shared")] + ); + + // A history-carrying resume bypasses the running cache and reads the + // stored row, so a cache-only override is silently undone here. + let mut params = resume_params(&thread_id); + params.history = Some(vec![json!({"type": "message", "role": "user"})]); + let second = manager + .resume_thread_with_history(¶ms, "deepseek".to_string()) + .expect("resume thread") + .expect("thread found"); + assert_eq!( + second.thread.workspace_roots, + vec![PathBuf::from("/repo/main"), PathBuf::from("/repo/shared")], + "a history-carrying resume must not reinstate the pre-override set" + ); + } + + #[test] + fn cached_resume_override_writeback_cannot_clobber_concurrent_row_updates() { + // Cross-process race pin: the cached-resume override writeback used + // to route through the full upsert, whose preserving arms cover only + // policy and the archive stamp — the stale cache snapshot reverted + // every other passthrough column, even resurrecting a concurrently + // archived thread. + let store = temp_core_state("resume-roots-writeback-stale"); + let mut manager = ThreadManager::new(store); + let spawned = manager + .spawn_thread_with_history( + "deepseek".to_string(), + PathBuf::from("/repo/main"), + &[], + InitialHistory::New, + true, + ) + .expect("spawn thread"); + let thread_id = spawned.thread.id.clone(); + + // A concurrent process attaches a policy and archives the thread; + // the in-process cache still carries the pre-archive snapshot. + manager + .state_store() + .upsert_thread(&ThreadMetadata { + sandbox_policy: Some("workspace-write".to_string()), + approval_mode: Some("on-request".to_string()), + ..manager + .state_store() + .get_thread(&thread_id) + .expect("read thread") + .expect("thread persisted") + }) + .expect("attach policy"); + manager + .state_store() + .mark_archived(&thread_id) + .expect("archive thread"); + + // The override writeback must land the roots without touching the + // concurrently written columns. + let mut params = resume_params(&thread_id); + params.workspace_roots = Some(vec![PathBuf::from("/repo/shared")]); + let resumed = manager + .resume_thread_with_history(¶ms, "deepseek".to_string()) + .expect("resume thread") + .expect("thread found"); + assert_eq!( + resumed.thread.workspace_roots, + vec![PathBuf::from("/repo/main"), PathBuf::from("/repo/shared")] + ); + + let persisted = manager + .state_store() + .get_thread(&thread_id) + .expect("read thread") + .expect("thread persisted"); + assert_eq!( + persisted.workspace_roots, + vec![PathBuf::from("/repo/main"), PathBuf::from("/repo/shared")], + "the override still owns the root set" + ); + assert!( + persisted.archived, + "a concurrently archived thread must not be resurrected" + ); + assert!(persisted.archived_at.is_some()); + assert_eq!(persisted.sandbox_policy.as_deref(), Some("workspace-write")); + assert_eq!(persisted.approval_mode.as_deref(), Some("on-request")); + } + + #[test] + fn resume_with_empty_roots_clears_back_to_bare_cwd() { + let store = temp_core_state("resume-roots-clear"); + let mut metadata = test_thread_metadata("thread-roots"); + metadata.cwd = PathBuf::from("/old"); + metadata.workspace_roots = vec![PathBuf::from("/old"), PathBuf::from("/keep")]; + store.upsert_thread(&metadata).expect("seed thread"); + + let mut manager = ThreadManager::new(store); + let mut params = resume_params("thread-roots"); + params.workspace_roots = Some(Vec::new()); + let resumed = manager + .resume_thread_with_history(¶ms, "deepseek".to_string()) + .expect("resume thread") + .expect("thread found"); + assert_eq!(resumed.thread.cwd, PathBuf::from("/old")); + assert_eq!( + resumed.thread.workspace_roots, + vec![PathBuf::from("/old")], + "Some([]) is an explicit clear, distinct from None (inherit)" + ); + } + + #[test] + fn resume_with_cwd_only_keeps_additional_roots() { + let store = temp_core_state("resume-roots-cwd-slot"); + let mut metadata = test_thread_metadata("thread-roots"); + metadata.cwd = PathBuf::from("/old"); + metadata.workspace_roots = vec![ + PathBuf::from("/old"), + PathBuf::from("/keep"), + PathBuf::from("/also"), + ]; + store.upsert_thread(&metadata).expect("seed thread"); + + let mut manager = ThreadManager::new(store); + let mut params = resume_params("thread-roots"); + params.cwd = Some(PathBuf::from("/new")); + let resumed = manager + .resume_thread_with_history(¶ms, "deepseek".to_string()) + .expect("resume thread") + .expect("thread found"); + + // The new cwd takes over the primary slot; the old cwd leaves the set + // while additional roots survive in order. + assert_eq!(resumed.thread.cwd, PathBuf::from("/new")); + assert_eq!( + resumed.thread.workspace_roots, + vec![ + PathBuf::from("/new"), + PathBuf::from("/keep"), + PathBuf::from("/also") + ] + ); + } + + #[test] + fn resume_cwd_only_rejects_a_rebased_ancestor_root() { + // Moving the primary is a caller decision, so the re-based set meets + // the same intake rules as a replacement set: a persisted additional + // root that becomes an ancestor of (or a super-root for) the new + // primary must error, not durably widen the persisted row — a + // widened row would also strand a later bare fork, which validates + // the inherited set. + let store = temp_core_state("resume-roots-cwd-ancestor"); + let mut metadata = test_thread_metadata("thread-roots"); + metadata.cwd = PathBuf::from("/p/x"); + metadata.workspace_roots = vec![PathBuf::from("/p/x"), PathBuf::from("/p")]; + store.upsert_thread(&metadata).expect("seed thread"); + + let mut manager = ThreadManager::new(store); + let mut params = resume_params("thread-roots"); + params.cwd = Some(PathBuf::from("/p/x/deep")); + let err = manager + .resume_thread_with_history(¶ms, "deepseek".to_string()) + .expect_err("an additional root that turns ancestor must be rejected"); + assert!( + err.to_string().contains("ancestor of the primary"), + "unexpected error: {err}" + ); + + // The persisted row is untouched by the failed attempt. + let persisted = manager + .state_store() + .get_thread("thread-roots") + .expect("read thread") + .expect("thread persisted"); + assert_eq!(persisted.cwd, PathBuf::from("/p/x")); + assert_eq!( + persisted.workspace_roots, + vec![PathBuf::from("/p/x"), PathBuf::from("/p")] + ); + } + + #[test] + fn resume_without_overrides_restores_persisted_cwd_and_roots() { + let store = temp_core_state("resume-roots-restore"); + let mut metadata = test_thread_metadata("thread-roots"); + metadata.cwd = PathBuf::from("/persisted"); + metadata.workspace_roots = vec![PathBuf::from("/persisted"), PathBuf::from("/keep")]; + store.upsert_thread(&metadata).expect("seed thread"); + + let mut manager = ThreadManager::new(store); + let resumed = manager + .resume_thread_with_history(&resume_params("thread-roots"), "deepseek".to_string()) + .expect("resume thread") + .expect("thread found"); + + // Regression: the persisted-path resume used to overwrite the cwd read + // back from the database with a current_dir fallback. + assert_eq!(resumed.thread.cwd, PathBuf::from("/persisted")); + assert_eq!( + resumed.thread.workspace_roots, + vec![PathBuf::from("/persisted"), PathBuf::from("/keep")] + ); + + // Legacy rows with no stored roots degenerate to [cwd]. + let store = temp_core_state("resume-roots-legacy"); + let mut metadata = test_thread_metadata("thread-legacy"); + metadata.cwd = PathBuf::from("/persisted"); + metadata.workspace_roots = Vec::new(); + store.upsert_thread(&metadata).expect("seed legacy thread"); + let mut manager = ThreadManager::new(store); + let resumed = manager + .resume_thread_with_history(&resume_params("thread-legacy"), "deepseek".to_string()) + .expect("resume thread") + .expect("thread found"); + assert_eq!(resumed.thread.cwd, PathBuf::from("/persisted")); + assert_eq!( + resumed.thread.workspace_roots, + vec![PathBuf::from("/persisted")] + ); + } + + fn fork_params(thread_id: &str) -> ThreadForkParams { + ThreadForkParams { + thread_id: thread_id.to_string(), + path: None, + model: None, + model_provider: None, + cwd: None, + approval_policy: None, + sandbox: None, + config: None, + base_instructions: None, + developer_instructions: None, + workspace_roots: None, + persist_extended_history: false, + } + } + + fn seed_multi_root_parent(name: &str) -> ThreadManager { + let store = temp_core_state(name); + let mut metadata = test_thread_metadata("thread-parent"); + metadata.cwd = PathBuf::from("/repo/main"); + metadata.workspace_roots = vec![PathBuf::from("/repo/main"), PathBuf::from("/repo/lib")]; + store.upsert_thread(&metadata).expect("seed thread"); + ThreadManager::new(store) + } + + #[test] + fn fork_without_roots_inherits_the_parent_set() { + let mut manager = seed_multi_root_parent("fork-roots-inherit"); + let forked = manager + .fork_thread(&fork_params("thread-parent")) + .expect("fork thread") + .expect("parent found"); + + // The historical bare `thread/fork` shape: the parent record is the + // only source of the set, so an absent field must inherit it — and an + // absent cwd keeps the parent's cwd as primary rather than + // re-anchoring the set under the process cwd. + assert_eq!(forked.thread.cwd, PathBuf::from("/repo/main")); + assert_eq!( + forked.thread.workspace_roots, + vec![PathBuf::from("/repo/main"), PathBuf::from("/repo/lib")], + ); + let persisted = manager + .state_store() + .get_thread(&forked.thread.id) + .expect("read fork") + .expect("fork persisted"); + assert_eq!(persisted.workspace_roots, forked.thread.workspace_roots); + } + + #[test] + fn fork_with_cwd_only_swaps_primary_and_keeps_additional_roots() { + let mut manager = seed_multi_root_parent("fork-roots-cwd"); + let mut params = fork_params("thread-parent"); + params.cwd = Some(PathBuf::from("/repo/topic")); + + let forked = manager + .fork_thread(¶ms) + .expect("fork thread") + .expect("parent found"); + + // Primary-swap semantics, matching a cwd-only resume: the parent's + // cwd leaves the set and its additional roots survive. + assert_eq!(forked.thread.cwd, PathBuf::from("/repo/topic")); + assert_eq!( + forked.thread.workspace_roots, + vec![PathBuf::from("/repo/topic"), PathBuf::from("/repo/lib")], + ); + } + + #[test] + fn fork_with_explicit_empty_roots_clears_to_the_bare_cwd() { + let mut manager = seed_multi_root_parent("fork-roots-clear"); + let mut params = fork_params("thread-parent"); + params.workspace_roots = Some(Vec::new()); + + let forked = manager + .fork_thread(¶ms) + .expect("fork thread") + .expect("parent found"); + + assert_eq!( + forked.thread.workspace_roots, + vec![PathBuf::from("/repo/main")], + "Some([]) is an explicit clear, distinct from None (inherit)" + ); + } + + #[test] + fn resume_with_empty_cwd_is_rejected() { + // Regression pin: a stdio resume carrying `cwd: ""` used to persist + // the empty string into the primary slot, where boundary_roots() + // turns it into the vacuous containment root on every later resume. + let store = temp_core_state("resume-empty-cwd"); + let mut metadata = test_thread_metadata("thread-empty-cwd"); + metadata.cwd = PathBuf::from("/persisted"); + metadata.workspace_roots = vec![PathBuf::from("/persisted")]; + store.upsert_thread(&metadata).expect("seed thread"); + let mut manager = ThreadManager::new(store); + let mut params = resume_params("thread-empty-cwd"); + params.cwd = Some(PathBuf::from("")); + + let err = manager + .resume_thread_with_history(¶ms, "deepseek".to_string()) + .expect_err("empty cwd must be rejected"); + assert!( + format!("{err:#}").contains("cwd must not be empty"), + "unexpected error: {err:#}" + ); + let persisted = manager + .state_store() + .get_thread("thread-empty-cwd") + .expect("read thread") + .expect("thread persisted"); + assert_eq!( + persisted.cwd, + PathBuf::from("/persisted"), + "a rejected resume must not touch the persisted root set" + ); + } + + #[test] + fn fork_with_empty_cwd_is_rejected() { + let mut manager = seed_multi_root_parent("fork-empty-cwd"); + let mut params = fork_params("thread-parent"); + params.cwd = Some(PathBuf::from("")); + + let err = manager + .fork_thread(¶ms) + .expect_err("empty cwd must be rejected"); + assert!( + format!("{err:#}").contains("cwd must not be empty"), + "unexpected error: {err:#}" + ); + } + + #[test] + fn spawn_thread_with_empty_cwd_persists_no_roots() { + // Fail closed at the chokepoint: a thread whose cwd slot is empty + // gets an empty root set, so boundary_roots() holds nothing and + // every containment check denies — never the vacuous `[""]`. + let store = temp_core_state("spawn-empty-cwd"); + let mut manager = ThreadManager::new(store); + let spawned = manager + .spawn_thread_with_history( + "deepseek".to_string(), + PathBuf::from(""), + &[], + InitialHistory::New, + true, + ) + .expect("spawn thread"); + assert!(spawned.thread.workspace_roots.is_empty()); + + let persisted = manager + .state_store() + .get_thread(&spawned.thread.id) + .expect("read thread") + .expect("thread persisted"); + assert!(persisted.workspace_roots.is_empty()); + } + + #[tokio::test] + async fn invoke_tool_returns_timeout_status_for_slow_tools() { + use async_trait::async_trait; + use codewhale_agent::ModelRegistry; + use codewhale_config::ConfigToml; + use codewhale_execpolicy::{AskForApproval, ExecPolicyEngine}; + use codewhale_hooks::HookDispatcher; + use codewhale_mcp::McpManager; + use codewhale_protocol::{ToolKind, ToolOutput, ToolPayload}; + use codewhale_tools::{FunctionCallError, ToolDescriptor, ToolHandler, ToolInvocation}; + + struct SlowTool; + #[async_trait] + impl ToolHandler for SlowTool { + fn kind(&self) -> ToolKind { + ToolKind::Function + } + + async fn handle( + &self, _invocation: ToolInvocation, ) -> std::result::Result { time::sleep(Duration::from_millis(200)).await; @@ -3226,6 +4578,7 @@ mod tests { }, AskForApproval::Never, Path::new("/tmp/codewhale"), + &[], ) .await .expect("invoke tool"); @@ -3255,6 +4608,7 @@ mod tests { .spawn_thread_with_history( "deepseek".to_string(), PathBuf::from("/tmp/codewhale"), + &[], InitialHistory::New, true, ) @@ -3284,4 +4638,225 @@ mod tests { "a refused message must leave no history rows: {history:?}" ); } + + /// Round-22 B22-5: the headless `/tool` + stdio tool-call lane must judge + /// exec policy on the same resolved effective cwd execution uses. + fn local_shell_call(command: &str, cwd: Option<&str>) -> ToolCall { + ToolCall { + name: "shell".to_string(), + payload: ToolPayload::LocalShell { + params: codewhale_protocol::LocalShellParams { + command: command.to_string(), + cwd: cwd.map(str::to_string), + timeout_ms: None, + }, + }, + source: ToolCallSource::Direct, + raw_tool_call_id: None, + } + } + + fn runtime_with_exec_rules(rules: Vec) -> Runtime { + Runtime::new( + ConfigToml::default(), + ModelRegistry::default(), + temp_core_state("invoke-tool-judged-cwd"), + Arc::new(ToolRegistry::default()), + Arc::new(McpManager::default()), + ExecPolicyEngine::with_rulesets(vec![ + codewhale_execpolicy::Ruleset::user(vec![], vec![]).with_ask_rules(rules), + ]), + HookDispatcher::default(), + ) + } + + fn exec_deny_scoped_to(workspace: &Path) -> codewhale_execpolicy::ToolAskRule { + codewhale_execpolicy::ToolAskRule { + tool: "exec_shell".into(), + command: Some("git push".into()), + command_exact: false, + path: None, + workspace: Some(workspace.to_string_lossy().into_owned()), + action: codewhale_execpolicy::PermissionAction::Deny, + } + } + + #[tokio::test] + async fn invoke_tool_judges_a_relative_operand_cwd_like_execution() { + // The raw relative operand made `normalize_workspace_scope` reject + // the judgment side, so every scope matched against the judged cwd + // was silently inert for the call — including a deny scoped to the + // very directory execution lands in. The deny here is scoped to the + // subdirectory the operands resolve to (it is deliberately NOT in + // the declared root set, so the root-set spanning cannot mask the + // judged-cwd leg). + let temp = tempfile::tempdir().expect("tempdir"); + let workspace = temp.path().join("ws"); + std::fs::create_dir_all(workspace.join("sub/x")).expect("fixture dirs"); + let workspace_canonical = workspace.canonicalize().expect("canonical workspace"); + let sub_canonical = workspace.join("sub").canonicalize().expect("canonical sub"); + + let runtime = runtime_with_exec_rules(vec![exec_deny_scoped_to(&sub_canonical)]); + + for operand in ["sub/.", "./sub", "sub/x/.."] { + let result = runtime + .invoke_tool( + local_shell_call("git push origin main", Some(operand)), + AskForApproval::OnRequest, + &workspace_canonical, + // Single-root posture: an empty declared set. + &[], + ) + .await + .expect("invoke tool"); + assert_eq!( + result["status"], "denied", + "operand {operand:?} resolves into the denied subdirectory, so the deny \ + must fire instead of every scoped rule being inert: {result}" + ); + } + + // Control: an operand resolving outside the denied scope keeps the + // ordinary approval gate — the deny is exact, not blanket. + let result = runtime + .invoke_tool( + local_shell_call( + "git push origin main", + Some(workspace_canonical.to_string_lossy().as_ref()), + ), + AskForApproval::OnRequest, + &workspace_canonical, + &[], + ) + .await + .expect("invoke tool"); + assert_eq!(result["status"], "approval_required", "{result}"); + } + + #[cfg(unix)] + #[tokio::test] + async fn invoke_tool_judges_a_symlink_spelled_operand_like_execution() { + // A deny scoped to the canonical spelling of the directory execution + // lands in was evaded by a symlink-spelled operand: judgment compared + // the raw lexical spelling while execution canonicalized through the + // link. The denied scope is deliberately absent from the declared + // root set so the root-set spanning cannot mask the judged-cwd leg. + let temp = tempfile::tempdir().expect("tempdir"); + let workspace = temp.path().join("ws"); + let real = temp.path().join("real"); + std::fs::create_dir_all(&workspace).expect("workspace dir"); + std::fs::create_dir_all(&real).expect("real dir"); + let real_canonical = real.canonicalize().expect("canonical real"); + std::os::unix::fs::symlink(&real_canonical, workspace.join("link")).expect("symlink"); + + let runtime = runtime_with_exec_rules(vec![exec_deny_scoped_to(&real_canonical)]); + let link = workspace.join("link"); + let result = runtime + .invoke_tool( + local_shell_call( + "git push origin main", + Some(link.to_string_lossy().as_ref()), + ), + AskForApproval::OnRequest, + &workspace.canonicalize().expect("canonical workspace"), + &[], + ) + .await + .expect("invoke tool"); + assert_eq!( + result["status"], "denied", + "the symlink resolves into the denied root, so the deny must fire: {result}" + ); + } + + #[test] + fn normalize_path_lexically_clamps_and_keeps_like_the_tool_boundary() { + // The shared normalizer behind the tools boundary's landing + // normalize: an overshoot `..` clamps at the filesystem root; a `..` + // a relative spelling cannot pop is kept. + assert_eq!( + normalize_path_lexically(Path::new("/w/x/../../../att/vendor/lib.rs")), + PathBuf::from("/att/vendor/lib.rs") + ); + assert_eq!( + normalize_path_lexically(Path::new("/a/..")), + PathBuf::from("/") + ); + assert_eq!( + normalize_path_lexically(Path::new("a/../../b")), + PathBuf::from("../b") + ); + } + + #[cfg(unix)] + #[test] + fn resolve_operand_cwd_walks_symlinks_like_execution() { + // Existing operands canonicalize through the link; a nonexistent + // operand resolves through the deepest existing ancestor and + // re-appends the popped tail — the walk the engine's judged-cwd + // applies (round-20 B20-1 / round-21 B21-3), now shared. + let temp = tempfile::tempdir().expect("tempdir"); + let ws = temp.path().join("ws"); + let attached = temp.path().join("att/repo"); + std::fs::create_dir_all(&ws).expect("ws"); + std::fs::create_dir_all(&attached).expect("attached"); + std::os::unix::fs::symlink(&attached, ws.join("link")).expect("symlink"); + let ws_canonical = ws.canonicalize().expect("canonical ws"); + let attached_canonical = attached.canonicalize().expect("canonical attached"); + + assert_eq!( + resolve_operand_cwd(&ws_canonical, "link"), + attached_canonical, + "an existing operand canonicalizes through the symlink" + ); + assert_eq!( + resolve_operand_cwd(&ws_canonical, "link/absent"), + attached_canonical.join("absent"), + "a nonexistent tail resolves through the deepest existing ancestor" + ); + assert_eq!( + resolve_operand_cwd(&ws_canonical, "link/absent/../.."), + attached_canonical.join("absent"), + "`..` is not a Normal component, so `file_name` skips it and the walk \ + keeps the last named segment — the engine lane's exact behavior, \ + moved verbatim" + ); + } + + #[test] + fn validate_workspace_roots_caps_the_declared_set_size() { + // Round-22 SF22-8: every boundary consumer scales with the set + // length, so an oversized declaration must be refused at intake + // rather than stalling every turn. + let cwd = PathBuf::from("/repo"); + let root = |i: usize| PathBuf::from(format!("/att{i}")); + let at_cap: Vec = (0..MAX_WORKSPACE_ROOTS).map(root).collect(); + assert!(validate_workspace_roots(&cwd, &at_cap).is_ok()); + let over_cap: Vec = (0..=MAX_WORKSPACE_ROOTS).map(root).collect(); + let err = validate_workspace_roots(&cwd, &over_cap).expect_err("over-cap must reject"); + assert!( + err.downcast_ref::().is_some(), + "the cap is an intake rejection: {err}" + ); + } + + #[test] + fn intake_rejections_carry_the_typed_validation_error() { + // The distinct type is what lets HTTP lanes answer 400 instead of a + // server-fault 500 (SF22-4); the Display text is unchanged. + let cwd = PathBuf::from("/repo"); + for roots in [ + vec![PathBuf::from("relative/dir")], + vec![PathBuf::from("/..")], + vec![cwd.parent().expect("repo parent").to_path_buf()], + ] { + let err = + validate_workspace_roots(&cwd, &roots).expect_err("intake rejection expected"); + assert!( + err.downcast_ref::().is_some(), + "rejection for {roots:?} must be typed: {err}" + ); + } + assert!(validate_workspace_roots(&cwd, &[PathBuf::from("/shared")]).is_ok()); + } } diff --git a/crates/core/tests/tool_success.rs b/crates/core/tests/tool_success.rs index 11f0c90fe6..ca220cf54c 100644 --- a/crates/core/tests/tool_success.rs +++ b/crates/core/tests/tool_success.rs @@ -95,6 +95,7 @@ async fn invoke_fixture( }, AskForApproval::Never, Path::new("/tmp/codewhale"), + &[], ) .await .expect("application failure remains a transport-successful tool result"); diff --git a/crates/execpolicy/src/lib.rs b/crates/execpolicy/src/lib.rs index 40a6c35dc2..534cad654a 100644 --- a/crates/execpolicy/src/lib.rs +++ b/crates/execpolicy/src/lib.rs @@ -313,6 +313,11 @@ pub struct ExecPolicyContext<'a> { pub ask_for_approval: AskForApproval, /// The sandbox mode in effect, if any (e.g. `"workspace-write"`). pub sandbox_mode: Option<&'a str>, + /// Additional workspace roots for ask/deny path and scope matching; + /// `cwd` remains the primary root. Allow rules keep matching the primary + /// root only, so an attached root never widens auto-approval. Empty + /// preserves the historical single-root matching. + pub workspace_roots: Vec, } #[derive(Debug, Clone, Default)] @@ -428,9 +433,24 @@ impl ExecPolicyEngine { fn matching_ask_rule(&self, ctx: &ExecPolicyContext<'_>) -> Option { let tool = ctx.tool.unwrap_or("exec_shell"); - let normalized_path = ctx - .path - .and_then(|path| normalize_workspace_relative_path(path, ctx.cwd)); + // Boundary roots for path/scope matching: the primary cwd plus any + // additional roots. An ask/deny rule path or scope that resolves + // against any single root matches — that only adds prompts or blocks; + // an empty root set keeps single-root behavior. + let mut roots: Vec = vec![ctx.cwd.to_string()]; + for root in &ctx.workspace_roots { + let root = root.to_string_lossy().into_owned(); + if !roots.contains(&root) { + roots.push(root); + } + } + let normalized_paths: Vec> = roots + .iter() + .map(|root| { + ctx.path + .and_then(|path| normalize_workspace_relative_path(path, root)) + }) + .collect(); let rulesets = self.read_rulesets(); let matched = rulesets @@ -443,36 +463,79 @@ impl ExecPolicyEngine { }) .filter(|(_, rule)| rule.tool == tool) .filter(|(_, rule)| { - rule.workspace - .as_deref() - .is_none_or(|workspace| workspace_scope_matches(workspace, ctx.cwd)) - }) - .filter(|(_, rule)| match rule.command.as_deref() { - Some(command) if rule.command_exact => command.trim() == ctx.command.trim(), - Some(command) => self.arity_dict.allow_rule_matches(command, ctx.command), - None => true, - }) - .filter(|(_, rule)| match (rule.path.as_deref(), ctx.path) { - (Some(pattern), Some(call_path)) => { - let ws_rule = normalize_workspace_relative_path(pattern, ctx.cwd); - match (ws_rule, normalized_path.as_deref()) { - // Workspace-relative normalization fails for a call - // outside the workspace or a rule that names one, and - // on a POSIX host a Windows-spelled rule/call pair - // parses as unrelated relative forms. A rule spelling - // an ABSOLUTE path must still be able to match such a - // call exactly, or pinned locations (a real home, - // `/root`, a Windows profile) are unmatchable. The - // helper only fires for rooted rules, so relative - // semantics are unchanged. - (Some(ws_rule), Some(ws_call)) => { - ws_rule == ws_call || absolute_path_rule_matches(pattern, call_path) - } - _ => absolute_path_rule_matches(pattern, call_path), + // Which roots is this rule eligible against? A workspace- + // scoped rule is evaluated only against roots inside its + // scope; an Allow rule additionally keeps the primary-only + // narrowing on every filter (it widens auto-approval, so it + // may never reach into an attached root - exec is judged + // where it runs: the session cwd, or the resolved + // cwd:/working_dir: operand when the call redirects). + let candidate_idx: Vec = if rule.action == PermissionAction::Allow { + // An Allow rule keeps the primary-only narrowing on + // every filter regardless of whether it carries a + // workspace: its rooted path and scope may never reach + // into an attached root. + if rule + .workspace + .as_deref() + .is_none_or(|workspace| workspace_scope_matches(workspace, ctx.cwd)) + { + vec![0] + } else { + Vec::new() + } + } else { + match rule.workspace.as_deref() { + None => (0..roots.len()).collect(), + Some(workspace) => roots + .iter() + .enumerate() + .filter(|(_, root)| workspace_scope_matches(workspace, root)) + .map(|(idx, _)| idx) + .collect(), + } + }; + if candidate_idx.is_empty() { + return false; + } + + let command_ok = match rule.command.as_deref() { + Some(command) if rule.command_exact => command.trim() == ctx.command.trim(), + Some(command) => self.arity_dict.allow_rule_matches(command, ctx.command), + None => true, + }; + if !command_ok { + return false; + } + // The path filter runs against the SAME scoped candidate + // roots, not independently over every root: a rule scoped to + // repo R with a relative path fires only on a call that + // normalizes under R, never on the same relative path + // materialized under an unrelated root. Workspace-relative + // normalization fails for a call outside every candidate + // root, for a rule that names none, and on a POSIX host for + // a Windows-spelled rule/call pair. A rule spelling an + // ABSOLUTE path must still be able to match such a call + // exactly, or pinned locations (a real home, `/root`, a + // Windows profile) are unmatchable - the fallback runs on + // the original call path regardless of the per-root outcome, + // so relative semantics and single-root behavior are + // unchanged. + match (rule.path.as_deref(), ctx.path) { + (Some(pattern), Some(call_path)) => { + candidate_idx.iter().any(|&idx| { + match ( + normalize_workspace_relative_path(pattern, &roots[idx]), + normalized_paths[idx].as_deref(), + ) { + (Some(ws_rule), Some(ws_call)) => ws_rule == ws_call, + _ => false, + } + }) || absolute_path_rule_matches(pattern, call_path) } + (Some(_), None) => false, + (None, _) => true, } - (Some(_), None) => false, - (None, _) => true, }) .max_by_key(|(layer, rule)| (*layer, rule.action, ask_rule_specificity(rule))) .map(|(_, rule)| (*rule).clone()); @@ -1196,6 +1259,7 @@ mod tests { path: None, ask_for_approval, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), } } @@ -2158,6 +2222,7 @@ mod tests { path: Some("tmp/project"), ask_for_approval: AskForApproval::Never, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .unwrap(); @@ -2182,6 +2247,7 @@ mod tests { path: Some("/workspace/src/a.rs"), ask_for_approval: AskForApproval::OnFailure, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .unwrap(); assert!(absolute_path.requires_approval); @@ -2198,6 +2264,7 @@ mod tests { path: Some("src/a.rs"), ask_for_approval: AskForApproval::OnFailure, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .unwrap(); assert!(relative_path.requires_approval); @@ -2224,6 +2291,7 @@ mod tests { path: Some(path), ask_for_approval: AskForApproval::OnFailure, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .unwrap(); assert_eq!( @@ -2248,6 +2316,7 @@ mod tests { path: Some(r"C:\workspace\src\a.rs"), ask_for_approval: AskForApproval::OnFailure, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .unwrap(); @@ -2278,6 +2347,7 @@ mod tests { path: Some("/root/.ssh/config"), ask_for_approval: AskForApproval::OnFailure, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .unwrap(); assert_eq!(decision.matched_action, Some(PermissionAction::Deny)); @@ -2291,6 +2361,7 @@ mod tests { path: Some("/root/.ssh/known_hosts"), ask_for_approval: AskForApproval::OnFailure, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .unwrap(); assert_eq!(decision.matched_rule, None); @@ -2307,6 +2378,7 @@ mod tests { path: Some("/root/../root/.ssh/config"), ask_for_approval: AskForApproval::OnFailure, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .unwrap(); assert_eq!(decision.matched_rule, None); @@ -2334,6 +2406,7 @@ mod tests { path: Some("~/.ssh/config"), ask_for_approval: AskForApproval::OnFailure, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .unwrap(); assert_eq!(decision.matched_action, Some(PermissionAction::Deny)); @@ -2348,6 +2421,7 @@ mod tests { path: Some("~/.ssh/../ssh/config"), ask_for_approval: AskForApproval::OnFailure, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .unwrap(); assert_eq!(decision.matched_rule, None); @@ -2371,6 +2445,7 @@ mod tests { path: Some("/src/a.rs"), ask_for_approval: AskForApproval::OnFailure, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .unwrap(); assert_eq!(decision.matched_rule, None); @@ -2398,6 +2473,7 @@ mod tests { path: Some(r"C:\Users\U\.AWS\credentials"), ask_for_approval: AskForApproval::OnFailure, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .unwrap(); // The rule folds `C:/Users/u/...` and the call folds `C:\Users\U\...` @@ -2410,6 +2486,253 @@ mod tests { } } + #[test] + fn typed_ask_path_matching_spans_additional_workspace_roots() { + // A relative rule path matches an invocation path under any root. + let engine = ExecPolicyEngine::with_rulesets(vec![ + Ruleset::user(vec![], vec![]) + .with_ask_rules(vec![ToolAskRule::file_path("edit_file", "src/a.rs")]), + ]); + let decision = engine + .check(ExecPolicyContext { + command: "", + cwd: "/workspace", + tool: Some("edit_file"), + path: Some("/shared/src/a.rs"), + ask_for_approval: AskForApproval::OnFailure, + sandbox_mode: Some("workspace-write"), + workspace_roots: vec![std::path::PathBuf::from("/shared")], + }) + .unwrap(); + assert!( + decision.requires_approval, + "relative rule path must match under the additional root: {decision:?}" + ); + + // The same path with no additional root configured must not match. + let decision = engine + .check(ExecPolicyContext { + command: "", + cwd: "/workspace", + tool: Some("edit_file"), + path: Some("/shared/src/a.rs"), + ask_for_approval: AskForApproval::OnFailure, + sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), + }) + .unwrap(); + assert_eq!(decision.matched_rule, None); + + // An absolute rule anchored at the additional root matches there but + // does not leak onto the same relative path under the primary root. + let anchored = + ExecPolicyEngine::with_rulesets(vec![Ruleset::user(vec![], vec![]).with_ask_rules( + vec![ToolAskRule::file_path("edit_file", "/shared/src/a.rs")], + )]); + let under_shared = anchored + .check(ExecPolicyContext { + command: "", + cwd: "/workspace", + tool: Some("edit_file"), + path: Some("/shared/src/a.rs"), + ask_for_approval: AskForApproval::OnFailure, + sandbox_mode: Some("workspace-write"), + workspace_roots: vec![std::path::PathBuf::from("/shared")], + }) + .unwrap(); + assert!(under_shared.requires_approval); + let under_primary = anchored + .check(ExecPolicyContext { + command: "", + cwd: "/workspace", + tool: Some("edit_file"), + path: Some("/workspace/src/a.rs"), + ask_for_approval: AskForApproval::OnFailure, + sandbox_mode: Some("workspace-write"), + workspace_roots: vec![std::path::PathBuf::from("/shared")], + }) + .unwrap(); + assert_eq!(under_primary.matched_rule, None); + } + + #[test] + fn workspace_scoped_allow_rule_stays_primary_root_scoped() { + let rule = ToolAskRule::exec_shell("git push").into_exact_workspace_allow("/shared"); + let engine = ExecPolicyEngine::with_rulesets(vec![ + Ruleset::user(vec![], vec![]).with_ask_rules(vec![rule]), + ]); + + // Inside the scope the rule auto-approves as before. + let scoped = engine + .check(ExecPolicyContext { + command: "git push", + cwd: "/shared", + tool: Some("exec_shell"), + path: None, + ask_for_approval: AskForApproval::UnlessTrusted, + sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), + }) + .unwrap(); + assert!( + scoped.allow && !scoped.requires_approval, + "rule scoped to the primary root must apply: {scoped:?}" + ); + + // An attached root must not widen the auto-approval to a session + // running against a different root: exec always runs in the session + // cwd, so the same command there may target a different repository. + let unscoped = engine + .check(ExecPolicyContext { + command: "git push", + cwd: "/workspace", + tool: Some("exec_shell"), + path: None, + ask_for_approval: AskForApproval::UnlessTrusted, + sandbox_mode: Some("workspace-write"), + workspace_roots: vec![std::path::PathBuf::from("/shared")], + }) + .unwrap(); + assert_eq!(unscoped.matched_rule, None); + } + + #[test] + fn scoped_relative_path_rule_does_not_fire_under_unrelated_root() { + // Scope and path must pair per root: a rule scoped to /shared with + // a relative path fires only on a call under /shared, never on the + // same relative path materialized under an unrelated root. With two + // independent filters this matched via scope=/shared + path=/shared + // under the primary - over-blocking outside the rule's repo. + let rule = ToolAskRule { + tool: "edit_file".into(), + command: None, + command_exact: false, + path: Some("deploy/config.yaml".into()), + workspace: Some("/shared".into()), + action: PermissionAction::Deny, + }; + let engine = ExecPolicyEngine::with_rulesets(vec![ + Ruleset::user(vec![], vec![]).with_ask_rules(vec![rule]), + ]); + + // Negative: the same relative path under the unrelated primary root + // must not fire the /shared-scoped rule. + let decision = engine + .check(ExecPolicyContext { + command: "", + cwd: "/workspace", + tool: Some("edit_file"), + path: Some("/workspace/deploy/config.yaml"), + ask_for_approval: AskForApproval::OnFailure, + sandbox_mode: Some("workspace-write"), + workspace_roots: vec![std::path::PathBuf::from("/shared")], + }) + .unwrap(); + assert_eq!( + decision.matched_rule, None, + "scope + relative path must pair per root, not match independently: {decision:?}" + ); + + // Control: the same call under the scoped root fires the rule. + let decision = engine + .check(ExecPolicyContext { + command: "", + cwd: "/workspace", + tool: Some("edit_file"), + path: Some("/shared/deploy/config.yaml"), + ask_for_approval: AskForApproval::OnFailure, + sandbox_mode: Some("workspace-write"), + workspace_roots: vec![std::path::PathBuf::from("/shared")], + }) + .unwrap(); + assert_eq!(decision.matched_action, Some(PermissionAction::Deny)); + } + + #[test] + fn allow_relative_path_rule_does_not_auto_approve_under_attached_root() { + // The Allow narrowing covers rooted path matching, not just the + // workspace scope: an allow rule whose relative path resolves only + // under an attached root must not auto-approve a call landing + // there. Without this, a refactor could silently regress the path + // direction while the scope direction stays pinned. + let engine = + ExecPolicyEngine::with_rulesets(vec![Ruleset::user(vec![], vec![]).with_ask_rules( + vec![ToolAskRule { + tool: "edit_file".into(), + command: None, + command_exact: false, + path: Some("src/a.rs".into()), + workspace: None, + action: PermissionAction::Allow, + }], + )]); + + // Control: the same relative rule auto-approves under the primary. + let under_primary = engine + .check(ExecPolicyContext { + command: "", + cwd: "/workspace", + tool: Some("edit_file"), + path: Some("/workspace/src/a.rs"), + ask_for_approval: AskForApproval::UnlessTrusted, + sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), + }) + .unwrap(); + assert!(under_primary.allow && !under_primary.requires_approval); + + // Negative: attached root must not widen the auto-approval. + let under_attached = engine + .check(ExecPolicyContext { + command: "", + cwd: "/workspace", + tool: Some("edit_file"), + path: Some("/shared/src/a.rs"), + ask_for_approval: AskForApproval::UnlessTrusted, + sandbox_mode: Some("workspace-write"), + workspace_roots: vec![std::path::PathBuf::from("/shared")], + }) + .unwrap(); + assert_eq!( + under_attached.matched_rule, None, + "the Allow rule must not match via the attached root" + ); + } + + #[test] + fn workspace_scoped_ask_rule_matches_any_workspace_root() { + // Unlike Allow, a prompting rule scoped to an attached root still + // fires there: multi-root matching for ask/deny only ever adds a + // prompt or a block, never an auto-approval. + let rule = ToolAskRule { + tool: "exec_shell".into(), + command: Some("git push".into()), + command_exact: true, + path: None, + workspace: Some("/shared".into()), + action: PermissionAction::Ask, + }; + let engine = ExecPolicyEngine::with_rulesets(vec![ + Ruleset::user(vec![], vec![]).with_ask_rules(vec![rule]), + ]); + let decision = engine + .check(ExecPolicyContext { + command: "git push", + cwd: "/workspace", + tool: Some("exec_shell"), + path: None, + ask_for_approval: AskForApproval::UnlessTrusted, + sandbox_mode: Some("workspace-write"), + workspace_roots: vec![std::path::PathBuf::from("/shared")], + }) + .unwrap(); + assert_eq!(decision.matched_action, Some(PermissionAction::Ask)); + assert!( + decision.requires_approval, + "ask rule scoped to an attached root must prompt: {decision:?}" + ); + } + // ── deny / allow action tests ────────────────────────────────────────── #[test] @@ -2434,6 +2757,7 @@ mod tests { path: None, ask_for_approval: AskForApproval::UnlessTrusted, sandbox_mode: None, + workspace_roots: Vec::new(), }) .unwrap(); @@ -2470,6 +2794,7 @@ mod tests { path: None, ask_for_approval: AskForApproval::OnRequest, sandbox_mode: None, + workspace_roots: Vec::new(), }) .unwrap(); @@ -2495,6 +2820,7 @@ mod tests { path: None, ask_for_approval: AskForApproval::UnlessTrusted, sandbox_mode: None, + workspace_roots: Vec::new(), }) .unwrap(); @@ -2529,6 +2855,7 @@ mod tests { path: None, ask_for_approval: AskForApproval::OnRequest, sandbox_mode: None, + workspace_roots: Vec::new(), }) .unwrap(); @@ -2797,6 +3124,7 @@ mod tests { path: Some("/workspace/src/secrets.rs"), ask_for_approval: UnlessTrusted, sandbox_mode: None, + workspace_roots: Vec::new(), }) .unwrap(); @@ -3137,6 +3465,7 @@ mod tests { path: Some("/workspace/src/main.rs"), ask_for_approval: UnlessTrusted, sandbox_mode: None, + workspace_roots: Vec::new(), }) .unwrap(); // write_file should not be affected by exec_shell deny @@ -3199,6 +3528,7 @@ mod tests { path: None, ask_for_approval: OnRequest, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .unwrap(); assert!( @@ -3272,6 +3602,7 @@ mod tests { path: None, ask_for_approval: OnRequest, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .unwrap(); @@ -3340,6 +3671,7 @@ mod tests { path: Some(path), ask_for_approval, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), } } } diff --git a/crates/execpolicy/tests/authorization_order.rs b/crates/execpolicy/tests/authorization_order.rs index 8f35b83a06..5bc6fbc91c 100644 --- a/crates/execpolicy/tests/authorization_order.rs +++ b/crates/execpolicy/tests/authorization_order.rs @@ -149,6 +149,7 @@ fn authorization_order_contract_matches_documented_precedence() { path: None, ask_for_approval: case.approval, sandbox_mode: Some("workspace-write"), + workspace_roots: Vec::new(), }) .unwrap_or_else(|error| panic!("{}: policy check failed: {error}", case.name)); diff --git a/crates/protocol/src/lib.rs b/crates/protocol/src/lib.rs index 3bf853d3c2..a4f19bfb06 100644 --- a/crates/protocol/src/lib.rs +++ b/crates/protocol/src/lib.rs @@ -91,6 +91,13 @@ pub struct Thread { #[serde(skip_serializing_if = "Option::is_none")] pub path: Option, pub cwd: PathBuf, + // Omitted only when the set is genuinely empty: legacy rows and the + // protocol-parity fixture hit this, but both spawn paths persist at + // least the cwd, so a thread created by this build always carries the + // key (an additive field legacy decoders tolerate). Decode still + // defaults via `default`. + #[serde(default, skip_serializing_if = "Vec::is_empty")] + pub workspace_roots: Vec, pub cli_version: String, pub source: SessionSource, #[serde(skip_serializing_if = "Option::is_none")] @@ -143,6 +150,13 @@ pub struct ThreadStartParams { pub model_provider: Option, #[serde(skip_serializing_if = "Option::is_none")] pub cwd: Option, + /// The full accessible root set with the cwd as the primary; a start has + /// no parent to inherit from, so this is a plain `Vec` (empty ≡ the bare + /// cwd), omitted from the wire when empty. Senders carry the full set + /// (cwd first) even where the field name reads "additional" — both + /// spellings are accepted and normalized to cwd-first on intake. + #[serde(default, skip_serializing_if = "Vec::is_empty")] + pub workspace_roots: Vec, #[serde(default)] pub persist_extended_history: bool, } @@ -172,6 +186,11 @@ pub struct ThreadResumeParams { pub developer_instructions: Option, #[serde(skip_serializing_if = "Option::is_none")] pub personality: Option, + /// `None` (or absent) inherits the persisted set; `Some(roots)` replaces + /// it wholesale — `Some([])` is an explicit clear back to the bare cwd, + /// matching upstream codex's `Option` semantics. + #[serde(default, skip_serializing_if = "Option::is_none")] + pub workspace_roots: Option>, #[serde(default)] pub persist_extended_history: bool, } @@ -197,6 +216,13 @@ pub struct ThreadForkParams { pub base_instructions: Option, #[serde(skip_serializing_if = "Option::is_none")] pub developer_instructions: Option, + /// `None` (or absent) inherits the parent thread's set, with the fork's + /// cwd taking the primary slot; `Some(roots)` replaces it wholesale — + /// `Some([])` is an explicit clear back to the bare cwd. The field is + /// new, so a bare `thread/fork` (the historical shape) must inherit + /// rather than silently degrade a multi-root parent to the fallback cwd. + #[serde(default, skip_serializing_if = "Option::is_none")] + pub workspace_roots: Option>, #[serde(default)] pub persist_extended_history: bool, } diff --git a/crates/protocol/src/op.rs b/crates/protocol/src/op.rs index ec323c82b7..5250b57d15 100644 --- a/crates/protocol/src/op.rs +++ b/crates/protocol/src/op.rs @@ -358,6 +358,10 @@ pub enum Op { system_prompt_override: bool, model: String, workspace: PathBuf, + /// Additional workspace roots synced with the session; `workspace` + /// stays the primary root. Absent on legacy payloads (single root). + #[serde(default, skip_serializing_if = "Vec::is_empty")] + workspace_roots: Vec, #[serde(default = "default_mode")] mode: String, }, @@ -654,6 +658,7 @@ mod tests { system_prompt_override: false, model: "m".into(), workspace: PathBuf::from("/ws"), + workspace_roots: Vec::new(), mode: "agent".into(), }, Op::CompactContext { @@ -707,6 +712,52 @@ mod tests { } } + #[test] + fn sync_session_workspace_roots_ride_the_wire_only_when_present() { + let op = |roots: Vec| Op::SyncSession { + engine_session_id: Some("s".into()), + messages: vec![], + system_prompt: None, + system_prompt_override: false, + model: "m".into(), + workspace: PathBuf::from("/ws"), + workspace_roots: roots, + mode: "agent".into(), + }; + + // An empty set stays off the wire: a single-root host's frame is the + // legacy shape, and a `skip_serializing_if` regression would leak the + // key into every sync. + let empty = serde_json::to_value(op(Vec::new())).unwrap(); + assert!( + empty.get("workspace_roots").is_none(), + "empty roots must stay off the wire: {empty}" + ); + + // A non-empty set is carried and round-trips. + let multi_roots = vec![PathBuf::from("/ws"), PathBuf::from("/shared")]; + let multi = serde_json::to_value(op(multi_roots.clone())).unwrap(); + assert_eq!(multi["workspace_roots"], json!(["/ws", "/shared"])); + let back: Op = serde_json::from_value(multi).unwrap(); + assert_eq!(back, op(multi_roots)); + + // A legacy payload without the key decodes to an empty set. + let legacy: Op = serde_json::from_value(json!({ + "kind": "sync_session", + "messages": [], + "model": "m", + "workspace": "/ws", + "mode": "agent" + })) + .unwrap(); + match legacy { + Op::SyncSession { + workspace_roots, .. + } => assert!(workspace_roots.is_empty()), + other => panic!("expected SyncSession, got {other:?}"), + } + } + #[test] fn every_variant_round_trips_and_tags_by_kind() { for op in every_variant() { diff --git a/crates/protocol/tests/parity_protocol.rs b/crates/protocol/tests/parity_protocol.rs index e637453391..c3ab73310c 100644 --- a/crates/protocol/tests/parity_protocol.rs +++ b/crates/protocol/tests/parity_protocol.rs @@ -1,10 +1,12 @@ use codewhale_protocol::{ - AppRequest, EventFrame, ThreadGoal, ThreadGoalProgressParams, ThreadGoalSetParams, - ThreadGoalStatus, ThreadListParams, ThreadRequest, ThreadResumeParams, ToolOutput, - UserInputAnswerEvent, UserInputOptionEvent, UserInputQuestionEvent, UserInputRequestEvent, + AppRequest, EventFrame, Thread, ThreadGoal, ThreadGoalProgressParams, ThreadGoalSetParams, + ThreadGoalStatus, ThreadListParams, ThreadRequest, ThreadResumeParams, ThreadStartParams, + ThreadStatus, ToolOutput, UserInputAnswerEvent, UserInputOptionEvent, UserInputQuestionEvent, + UserInputRequestEvent, runtime::{RUNTIME_EVENT_ENVELOPE_SCHEMA_VERSION, RuntimeEventEnvelope}, }; use serde_json::{Value, json}; +use std::path::PathBuf; #[test] fn mcp_tool_output_public_shape_remains_source_compatible() { @@ -109,6 +111,10 @@ fn thread_resume_params_round_trip() { base_instructions: Some("base".to_string()), developer_instructions: Some("dev".to_string()), personality: Some("default".to_string()), + workspace_roots: Some(vec![ + PathBuf::from("/repo/main"), + PathBuf::from("/repo/shared"), + ]), persist_extended_history: true, }); @@ -118,12 +124,172 @@ fn thread_resume_params_round_trip() { ThreadRequest::Resume(params) => { assert_eq!(params.thread_id, "thread-123"); assert_eq!(params.model.as_deref(), Some("deepseek-v4-pro")); + assert_eq!( + params.workspace_roots, + Some(vec![ + PathBuf::from("/repo/main"), + PathBuf::from("/repo/shared"), + ]), + "an explicit root set round-trips" + ); + assert!( + encoded.contains(r#""workspace_roots":["/repo/main","/repo/shared"]"#), + "the encoded frame must actually carry the set: {encoded}" + ); assert!(params.persist_extended_history); } other => panic!("unexpected request: {other:?}"), } } +#[test] +fn thread_start_params_workspace_roots_round_trip() { + let request = ThreadRequest::Start(ThreadStartParams { + model: None, + model_provider: None, + cwd: Some(PathBuf::from("/repo/main")), + workspace_roots: vec![PathBuf::from("/repo/lib"), PathBuf::from("/repo/docs")], + persist_extended_history: false, + }); + + let encoded = serde_json::to_string(&request).expect("serialize request"); + assert!(encoded.contains(r#""workspace_roots":["/repo/lib","/repo/docs"]"#)); + let decoded: ThreadRequest = serde_json::from_str(&encoded).expect("deserialize request"); + match decoded { + ThreadRequest::Start(params) => { + assert_eq!( + params.workspace_roots, + vec![PathBuf::from("/repo/lib"), PathBuf::from("/repo/docs")] + ); + } + other => panic!("unexpected request: {other:?}"), + } +} + +#[test] +fn thread_resume_params_explicit_empty_set_survives_the_wire() { + // The three-state resume contract rides on the wire distinguishing + // three shapes: absent key = None = inherit the persisted set; + // `[]` = Some(vec![]) = an explicit clear back to the bare cwd; + // non-empty = replace. A skip-attr or deserialize-adapter refactor + // that folds `[]` into `None` would silently degrade explicit-clear + // back to inherit - this pins the distinction on the wire itself. + let payload = r#"{"kind":"resume","thread_id":"t","workspace_roots":[]}"#; + let decoded: ThreadRequest = serde_json::from_str(payload).expect("deserialize explicit clear"); + match &decoded { + ThreadRequest::Resume(params) => { + assert_eq!(params.workspace_roots, Some(Vec::new())); + let encoded = serde_json::to_string(&decoded).expect("re-encode"); + assert!( + encoded.contains(r#""workspace_roots":[]"#), + "an explicit clear must re-encode with the key present: {encoded}" + ); + } + other => panic!("unexpected request: {other:?}"), + } +} + +#[test] +fn thread_params_without_workspace_roots_deserialize_to_empty() { + // Payloads written before the field existed carry no workspace_roots key; + // they must still decode, yielding an empty root set. + let legacy_start = r#"{"kind":"start","cwd":"/repo"}"#; + let decoded: ThreadRequest = + serde_json::from_str(legacy_start).expect("deserialize legacy start request"); + match decoded { + ThreadRequest::Start(params) => { + assert!(params.workspace_roots.is_empty()); + assert!( + !serde_json::to_string(¶ms) + .expect("serialize start params") + .contains("workspace_roots"), + "empty root set must stay off the wire" + ); + } + other => panic!("unexpected request: {other:?}"), + } + + let legacy_resume = r#"{"kind":"resume","thread_id":"thread-1"}"#; + let decoded: ThreadRequest = + serde_json::from_str(legacy_resume).expect("deserialize legacy resume request"); + match decoded { + ThreadRequest::Resume(params) => assert!(params.workspace_roots.is_none()), + other => panic!("unexpected request: {other:?}"), + } + + let legacy_fork = r#"{"kind":"fork","thread_id":"thread-1"}"#; + let decoded: ThreadRequest = + serde_json::from_str(legacy_fork).expect("deserialize legacy fork request"); + match decoded { + // Absent must mean "inherit the parent's set": an empty `Some` would + // be read as an explicit clear and degrade a multi-root parent to + // the fork cwd. + ThreadRequest::Fork(params) => assert!(params.workspace_roots.is_none()), + other => panic!("unexpected request: {other:?}"), + } +} + +#[test] +fn thread_fork_params_explicit_empty_set_survives_the_wire() { + // Same three-state contract as resume: absent key = None = inherit, + // `[]` = Some(vec![]) = explicit clear, non-empty = replace. + let payload = r#"{"kind":"fork","thread_id":"t","workspace_roots":[]}"#; + let decoded: ThreadRequest = serde_json::from_str(payload).expect("deserialize explicit clear"); + match &decoded { + ThreadRequest::Fork(params) => { + assert_eq!(params.workspace_roots, Some(Vec::new())); + let encoded = serde_json::to_string(&decoded).expect("re-encode"); + assert!( + encoded.contains(r#""workspace_roots":[]"#), + "an explicit clear must re-encode with the key present: {encoded}" + ); + } + other => panic!("unexpected request: {other:?}"), + } +} + +#[test] +fn thread_dto_workspace_roots_default_for_legacy_payloads() { + let legacy = r#"{ + "id": "thread-1", + "preview": "", + "ephemeral": false, + "model_provider": "deepseek", + "created_at": 1, + "updated_at": 2, + "status": "idle", + "cwd": "/repo", + "cli_version": "0.0.0", + "source": "interactive" + }"#; + let decoded: Thread = serde_json::from_str(legacy).expect("deserialize legacy thread"); + assert!(decoded.workspace_roots.is_empty()); + assert!(matches!(decoded.status, ThreadStatus::Idle)); + + // An empty root set is omitted from the wire frame, matching the params' + // skip-if-empty convention: a thread decoded from a legacy payload keeps + // the historical frame byte-identical. (A thread CREATED by this build + // always carries at least [cwd] — intake normalization never yields an + // empty set — so omission happens only for pre-field rows.) + let encoded_single_root = + serde_json::to_string(&decoded).expect("serialize single-root thread"); + let frame: serde_json::Value = + serde_json::from_str(&encoded_single_root).expect("single-root frame parses"); + assert!( + frame.get("workspace_roots").is_none(), + "an empty root set must stay off the wire frame: {frame}" + ); + + let mut current = decoded; + current.workspace_roots = vec![PathBuf::from("/repo"), PathBuf::from("/repo/lib")]; + let encoded = serde_json::to_string(¤t).expect("serialize thread"); + let round_tripped: Thread = serde_json::from_str(&encoded).expect("round-trip thread"); + assert_eq!( + round_tripped.workspace_roots, + vec![PathBuf::from("/repo"), PathBuf::from("/repo/lib")] + ); +} + #[test] fn thread_list_params_defaults_are_serializable() { let request = ThreadRequest::List(ThreadListParams { diff --git a/crates/state/src/lib.rs b/crates/state/src/lib.rs index 24bcbee55d..ad07f24ba2 100644 --- a/crates/state/src/lib.rs +++ b/crates/state/src/lib.rs @@ -75,6 +75,9 @@ pub struct ThreadMetadata { pub path: Option, /// Working directory that was active when the thread was created. pub cwd: PathBuf, + /// Workspace roots attached to the thread; `cwd` is always the primary root. + #[serde(default)] + pub workspace_roots: Vec, /// Version of the CLI that created this thread. pub cli_version: String, /// How this session was initiated. @@ -636,6 +639,54 @@ impl StateStore { )) .context("failed to initialize thread goal continuation schema")?; } + if user_version < 5 { + // Two processes first-opening the same store race here: deciding + // the column's presence outside the transaction (the v0/v4 shape) + // lets both see it missing and makes the loser's ALTER fail with + // a duplicate-column error. `BEGIN IMMEDIATE` alone is not + // enough — the decision would still precede the lock — so the + // presence check runs inside the write transaction, where the + // loser observes the winner's committed column and becomes a + // no-op version bump. + conn.execute_batch("BEGIN IMMEDIATE;") + .context("failed to begin the workspace roots migration")?; + // Any failure after the BEGIN must leave no open transaction + // behind; the connection would roll back on drop, but the + // explicit ROLLBACK keeps the same connection usable for the + // error report. + let migration = match column_exists(conn, "threads", "workspace_roots") { + Ok(exists) => { + if exists { + String::new() + } else { + "ALTER TABLE threads\n ADD COLUMN workspace_roots TEXT NOT NULL DEFAULT '[]';\n" + .to_string() + } + } + Err(error) => { + let _ = conn.execute_batch("ROLLBACK;"); + return Err(error).context("failed to inspect the threads table"); + } + }; + let committed = conn.execute_batch(&format!( + r#"{migration} + PRAGMA user_version = 5; + COMMIT; + "# + )); + if committed.is_err() { + // Leave no open transaction behind on a failed migration; + // the open error propagates below. + let _ = conn.execute_batch("ROLLBACK;"); + committed.context("failed to initialize thread workspace roots schema")?; + } + // Deliberately no local `user_version` mirror here: this is the + // terminal migration step, so the stale pre-migration value is + // never read again (an unused assignment fails -D warnings). + // A future v6 step re-reads PRAGMA user_version first, and the + // in-transaction column_exists guard keeps re-entry into this + // block harmless. + } Ok(()) } @@ -645,16 +696,75 @@ impl StateStore { /// or [`set_current_leaf_id`](Self::set_current_leaf_id) for that. pub fn upsert_thread(&self, thread: &ThreadMetadata) -> Result<()> { let conn = self.conn()?; + Self::upsert_thread_row(&conn, thread, false)?; + self.append_thread_name( + &thread.id, + thread.name.clone(), + thread.updated_at, + thread.rollout_path.clone(), + ) + } + + /// Insert or update thread metadata while keeping, atomically inside the + /// upsert statement, the columns whose authority the caller's snapshot + /// does not carry: the per-thread policy fields (kept when the payload + /// carries `None`) and the archive timestamp (kept only while the payload + /// still says archived, so a resume that reactivates the thread clears + /// the stamp instead of ghosting `archived=0` + stamp set). + /// + /// A get-then-upsert pair cannot express this: a row cleared concurrently + /// (unarchive, policy detach) between the read and the write would be + /// resurrected from the stale snapshot. The conditions here run on the + /// in-transaction row, so the read-modify-write collapses into one + /// statement. + pub fn upsert_thread_preserving_policy_and_archive( + &self, + thread: &ThreadMetadata, + ) -> Result<()> { + let conn = self.conn()?; + Self::upsert_thread_row(&conn, thread, true)?; + self.append_thread_name( + &thread.id, + thread.name.clone(), + thread.updated_at, + thread.rollout_path.clone(), + ) + } + + fn upsert_thread_row( + conn: &rusqlite::Connection, + thread: &ThreadMetadata, + preserve_policy_and_archive: bool, + ) -> Result<()> { + let (sandbox_policy_arm, approval_mode_arm, archived_at_arm) = + if preserve_policy_and_archive { + ( + "COALESCE(excluded.sandbox_policy, threads.sandbox_policy)", + "COALESCE(excluded.approval_mode, threads.approval_mode)", + // Payload-blind while archived: the row's stamp is the + // authority, so a stale payload carrying its own old + // stamp cannot resurrect a concurrently cleared one. + "CASE WHEN excluded.archived = 0 THEN NULL \ + ELSE threads.archived_at END", + ) + } else { + ( + "excluded.sandbox_policy", + "excluded.approval_mode", + "excluded.archived_at", + ) + }; conn.execute( - r#" + &format!( + r#" INSERT INTO threads ( id, rollout_path, preview, ephemeral, model_provider, created_at, updated_at, status, path, cwd, cli_version, source, title, sandbox_policy, approval_mode, archived, archived_at, - git_sha, git_branch, git_origin_url, memory_mode + git_sha, git_branch, git_origin_url, memory_mode, workspace_roots ) VALUES ( ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, ?16, ?17, - ?18, ?19, ?20, ?21 + ?18, ?19, ?20, ?21, ?22 ) ON CONFLICT(id) DO UPDATE SET rollout_path=excluded.rollout_path, @@ -669,15 +779,16 @@ impl StateStore { cli_version=excluded.cli_version, source=excluded.source, title=excluded.title, - sandbox_policy=excluded.sandbox_policy, - approval_mode=excluded.approval_mode, + sandbox_policy={sandbox_policy_arm}, + approval_mode={approval_mode_arm}, archived=excluded.archived, - archived_at=excluded.archived_at, + archived_at={archived_at_arm}, git_sha=excluded.git_sha, git_branch=excluded.git_branch, git_origin_url=excluded.git_origin_url, - memory_mode=excluded.memory_mode - "#, + memory_mode=excluded.memory_mode, + workspace_roots=excluded.workspace_roots + "#), params![ thread.id, path_to_opt_string(thread.rollout_path.as_deref()), @@ -700,16 +811,44 @@ impl StateStore { thread.git_branch, thread.git_origin_url, thread.memory_mode, + workspace_roots_to_json(&thread.workspace_roots), ], ) .context("failed to upsert thread metadata")?; + Ok(()) + } - self.append_thread_name( - &thread.id, - thread.name.clone(), - thread.updated_at, - thread.rollout_path.clone(), - )?; + /// Update only the location columns of a thread row: `cwd`, + /// `workspace_roots`, and the `updated_at` recency stamp. + /// + /// This is the cached-resume override writeback's write path. That + /// caller's payload comes from the in-process running-thread cache, which + /// is stale in every column another process may have written since the + /// cache entry was stamped. Routing the override through the full upsert + /// let that snapshot revert concurrent updates far beyond the override's + /// ownership — the upsert's preserving arms cover only the policy fields + /// and the archive stamp, while `archived`, `status`, `preview`, `title`, + /// and `rollout_path` are plain `excluded.*` passthrough (a stale cache + /// could even resurrect a concurrently archived thread). A narrow UPDATE + /// writes exactly the columns the override owns and nothing else. + pub fn update_thread_root_set( + &self, + id: &str, + cwd: &Path, + workspace_roots: &[PathBuf], + updated_at: i64, + ) -> Result<()> { + let conn = self.conn()?; + conn.execute( + "UPDATE threads SET cwd = ?2, workspace_roots = ?3, updated_at = ?4 WHERE id = ?1", + params![ + id, + cwd.display().to_string(), + workspace_roots_to_json(workspace_roots), + updated_at, + ], + ) + .context("failed to update thread root set")?; Ok(()) } @@ -722,7 +861,7 @@ impl StateStore { r#" SELECT id, rollout_path, preview, ephemeral, model_provider, created_at, updated_at, status, path, cwd, cli_version, source, title, sandbox_policy, approval_mode, archived, archived_at, - git_sha, git_branch, git_origin_url, memory_mode, current_leaf_id + git_sha, git_branch, git_origin_url, memory_mode, current_leaf_id, workspace_roots FROM threads WHERE id = ?1 "#, @@ -740,9 +879,9 @@ impl StateStore { pub fn list_threads(&self, filters: ThreadListFilters) -> Result> { let conn = self.conn()?; let sql = if filters.include_archived { - "SELECT id, rollout_path, preview, ephemeral, model_provider, created_at, updated_at, status, path, cwd, cli_version, source, title, sandbox_policy, approval_mode, archived, archived_at, git_sha, git_branch, git_origin_url, memory_mode, current_leaf_id FROM threads ORDER BY updated_at DESC LIMIT ?1" + "SELECT id, rollout_path, preview, ephemeral, model_provider, created_at, updated_at, status, path, cwd, cli_version, source, title, sandbox_policy, approval_mode, archived, archived_at, git_sha, git_branch, git_origin_url, memory_mode, current_leaf_id, workspace_roots FROM threads ORDER BY updated_at DESC LIMIT ?1" } else { - "SELECT id, rollout_path, preview, ephemeral, model_provider, created_at, updated_at, status, path, cwd, cli_version, source, title, sandbox_policy, approval_mode, archived, archived_at, git_sha, git_branch, git_origin_url, memory_mode, current_leaf_id FROM threads WHERE archived = 0 ORDER BY updated_at DESC LIMIT ?1" + "SELECT id, rollout_path, preview, ephemeral, model_provider, created_at, updated_at, status, path, cwd, cli_version, source, title, sandbox_policy, approval_mode, archived, archived_at, git_sha, git_branch, git_origin_url, memory_mode, current_leaf_id, workspace_roots FROM threads WHERE archived = 0 ORDER BY updated_at DESC LIMIT ?1" }; let mut stmt = conn.prepare(sql).context("failed to prepare list query")?; @@ -2019,9 +2158,73 @@ fn row_to_thread(row: &rusqlite::Row<'_>) -> rusqlite::Result { git_origin_url: row.get(19)?, memory_mode: row.get(20)?, current_leaf_id: row.get(21)?, + workspace_roots: workspace_roots_from_json(row.get::<_, Option>(22)?), }) } +fn workspace_roots_from_json(raw: Option) -> Vec { + let Some(value) = raw else { + return Vec::new(); + }; + // The fallback direction is safe (empty = single-root legacy), but a + // writer-side serialization bug must not present as silent degradation; + // tolerance with visibility, as for the other legacy-shaped columns. The + // warning surfaces only on hosts that installed a `tracing` subscriber + // (the TUI does); headless hosts without one still get the safe fallback + // but no log line. + match serde_json::from_str::>(&value) { + Ok(roots) => { + // The reader stays tolerant (normalization at intake and at seed + // drops these), but a poisoned row — written by an older build or + // hand-edited — must not be invisible: an empty entry contains + // every path under starts_with, a relative one is dead weight. + if roots + .iter() + .any(|root| root.as_os_str().is_empty() || !root.is_absolute()) + { + tracing::warn!( + target: "codewhale_state", + "workspace_roots on threads row holds an empty or relative entry; normalization drops it" + ); + } + roots + } + Err(error) => { + tracing::warn!( + target: "codewhale_state", + %error, + "invalid workspace_roots JSON on threads row; treating as empty" + ); + Vec::new() + } + } +} + +/// Serialize the root set for the `threads` column. +/// +/// A path that cannot be represented in the JSON column (non-UTF-8 on Unix) +/// is the one direction that can lose the set. Degrading to an empty list +/// keeps the thread writable — an upsert failure would cost the whole record +/// — but it must not be silent: the reader only warns on malformed JSON, so +/// without this the loss is invisible. Visibility note: the warning surfaces +/// only on hosts that installed a `tracing` subscriber before this call (the +/// TUI does; a headless host with no subscriber sees nothing on stderr), so +/// the tolerant empty-set fallback remains the load-bearing guarantee, not +/// the log line. +fn workspace_roots_to_json(roots: &[PathBuf]) -> String { + match serde_json::to_string(roots) { + Ok(json) => json, + Err(error) => { + tracing::warn!( + target: "codewhale_state", + %error, + "workspace_roots could not be serialized; persisting an empty set" + ); + "[]".to_string() + } + } +} + fn row_to_thread_goal(row: &rusqlite::Row<'_>) -> rusqlite::Result { let status_raw: String = row.get(3)?; Ok(ThreadGoalRecord { @@ -2076,6 +2279,7 @@ mod tests { status: ThreadStatus::Running, path: None, cwd: PathBuf::from("/tmp/codewhale"), + workspace_roots: Vec::new(), cli_version: "0.0.0-test".to_string(), source: SessionSource::Interactive, name: None, @@ -2207,6 +2411,152 @@ mod tests { } } + #[test] + fn preserving_upsert_keeps_policy_and_archive_stamp_the_payload_does_not_carry() { + let store = temp_state_store("preserving-upsert-keeps"); + let mut seeded = test_thread("thread-1"); + seeded.sandbox_policy = Some("workspace-write".to_string()); + seeded.approval_mode = Some("suggest".to_string()); + seeded.archived = true; + seeded.archived_at = Some(1_234); + store.upsert_thread(&seeded).expect("seed thread"); + + // The resume/persist payload carries no policy or stamp but still + // says archived (a cached resume keeps the cached status): the row's + // own values rule, inside the one statement. + let mut payload = test_thread("thread-1"); + payload.archived = true; + store + .upsert_thread_preserving_policy_and_archive(&payload) + .expect("preserving upsert"); + let row = store + .get_thread("thread-1") + .expect("read thread") + .expect("thread exists"); + assert_eq!(row.sandbox_policy, seeded.sandbox_policy); + assert_eq!(row.approval_mode, seeded.approval_mode); + assert!(row.archived, "payload still says archived"); + assert_eq!( + row.archived_at, + Some(1_234), + "stamp survives while archived" + ); + + // The plain upsert keeps its passthrough semantics: a None payload + // value really does clear the column. + let mut plain = test_thread("thread-1"); + plain.archived = true; + store.upsert_thread(&plain).expect("plain upsert"); + let row = store + .get_thread("thread-1") + .expect("read thread") + .expect("thread exists"); + assert_eq!(row.sandbox_policy, None); + assert_eq!(row.archived_at, None); + } + + #[test] + fn preserving_upsert_clears_the_stamp_when_the_payload_reactivates_the_thread() { + let store = temp_state_store("preserving-upsert-reactivates"); + let mut seeded = test_thread("thread-1"); + seeded.archived = true; + seeded.archived_at = Some(1_234); + store.upsert_thread(&seeded).expect("seed thread"); + + // A resume forces the thread back to Running: persisting it must not + // ghost `archived=0` with a stamp set — base never produced that pair. + let payload = test_thread("thread-1"); + store + .upsert_thread_preserving_policy_and_archive(&payload) + .expect("preserving upsert"); + let row = store + .get_thread("thread-1") + .expect("read thread") + .expect("thread exists"); + assert!(!row.archived); + assert_eq!(row.archived_at, None, "reactivation clears the stamp"); + } + + #[test] + fn preserving_upsert_does_not_resurrect_a_concurrently_cleared_stamp() { + let store = temp_state_store("preserving-upsert-no-resurrection"); + let mut seeded = test_thread("thread-1"); + seeded.archived = true; + seeded.archived_at = Some(1_234); + store.upsert_thread(&seeded).expect("seed thread"); + // Another process unarchives between the stale snapshot and this + // write: mark_unarchived clears flag and stamp on the row. + store.mark_unarchived("thread-1").expect("unarchive"); + + // A stale payload whose in-memory snapshot still says archived and + // still carries the pre-clear stamp must not resurrect it: while the + // payload says archived, the row's stamp is the only authority, and + // the row no longer carries one. (With a payload stamp of None this + // pin would be vacuous — the passthrough arm writes NULL too — so the + // payload deliberately carries the stale value.) + let mut stale = test_thread("thread-1"); + stale.archived = true; + stale.archived_at = Some(1_234); + store + .upsert_thread_preserving_policy_and_archive(&stale) + .expect("preserving upsert"); + let row = store + .get_thread("thread-1") + .expect("read thread") + .expect("thread exists"); + assert_eq!( + row.archived_at, None, + "a concurrently cleared stamp stays cleared" + ); + } + + #[test] + fn update_thread_root_set_touches_only_cwd_roots_and_updated_at() { + // The cached-resume override writeback's write path: its payload is a + // stale in-process snapshot, so the targeted UPDATE must move exactly + // the columns the override owns and leave every other column — a + // newer policy, the archive flag and stamp, preview, status — to the + // row's own authority. + let store = temp_state_store("root-set-targeted-update"); + let mut seeded = test_thread("thread-1"); + seeded.sandbox_policy = Some("workspace-write".to_string()); + seeded.approval_mode = Some("on-request".to_string()); + seeded.archived = true; + seeded.archived_at = Some(1_234); + seeded.preview = "concurrent preview".to_string(); + store.upsert_thread(&seeded).expect("seed thread"); + + store + .update_thread_root_set( + "thread-1", + Path::new("/repo/main"), + &[PathBuf::from("/repo/main"), PathBuf::from("/repo/shared")], + 9_999, + ) + .expect("targeted update"); + + let row = store + .get_thread("thread-1") + .expect("read thread") + .expect("thread exists"); + assert_eq!(row.cwd, PathBuf::from("/repo/main")); + assert_eq!( + row.workspace_roots, + vec![PathBuf::from("/repo/main"), PathBuf::from("/repo/shared")] + ); + assert_eq!(row.updated_at, 9_999); + assert_eq!(row.sandbox_policy, seeded.sandbox_policy); + assert_eq!(row.approval_mode, seeded.approval_mode); + assert!( + row.archived, + "the archive flag is not the override's column" + ); + assert_eq!(row.archived_at, Some(1_234)); + assert_eq!(row.preview, "concurrent preview"); + assert_eq!(row.status, seeded.status); + assert_eq!(row.created_at, seeded.created_at); + } + #[test] fn state_store_reuses_one_connection_across_operations_and_clones() { let store = temp_state_store("conn-reuse"); @@ -2388,6 +2738,108 @@ mod tests { let _ = fs::remove_dir_all(dir); } + #[test] + fn migration_to_workspace_roots_is_idempotent() { + // A v4 database must gain the workspace_roots column exactly once; + // reopening with a stale header re-runs the guarded ALTER without + // aborting on "duplicate column name". + let dir = temp_state_dir("migration-v5-idempotent"); + let db_path = dir.join("state.db"); + drop(StateStore::open(Some(db_path.clone())).expect("initial open")); + { + let conn = Connection::open(&db_path).expect("raw connection"); + conn.pragma_update(None, "user_version", 4) + .expect("reset user_version to v4"); + } + + let store = StateStore::open(Some(db_path.clone())).expect("reopen with v4 header"); + let mut thread = test_thread("thread-v5"); + thread.workspace_roots = vec![PathBuf::from("/tmp/codewhale")]; + store + .upsert_thread(&thread) + .expect("write after guarded v5 migration"); + + drop(store); + let store = StateStore::open(Some(db_path)).expect("third open"); + let persisted = store + .get_thread("thread-v5") + .expect("read after reopen") + .expect("thread persisted"); + assert_eq!( + persisted.workspace_roots, + vec![PathBuf::from("/tmp/codewhale")] + ); + + let _ = fs::remove_dir_all(dir); + } + + #[test] + fn workspace_roots_round_trip_and_listing() { + let store = temp_state_store("workspace-roots-round-trip"); + let mut thread = test_thread("thread-roots"); + thread.workspace_roots = vec![ + PathBuf::from("/tmp/codewhale"), + PathBuf::from("/tmp/shared-lib"), + ]; + store.upsert_thread(&thread).expect("upsert thread"); + + let loaded = store + .get_thread("thread-roots") + .expect("read thread") + .expect("thread must exist"); + assert_eq!(loaded.workspace_roots, thread.workspace_roots); + + let listed = store + .list_threads(ThreadListFilters { + include_archived: false, + limit: Some(10), + }) + .expect("list threads"); + assert_eq!(listed.len(), 1); + assert_eq!(listed[0].workspace_roots, thread.workspace_roots); + + // Replacing the root set persists through upsert conflict update. + let mut updated = loaded; + updated.workspace_roots = vec![PathBuf::from("/tmp/codewhale")]; + store.upsert_thread(&updated).expect("re-upsert thread"); + let reloaded = store + .get_thread("thread-roots") + .expect("read thread") + .expect("thread must exist"); + assert_eq!( + reloaded.workspace_roots, + vec![PathBuf::from("/tmp/codewhale")] + ); + } + + #[test] + fn workspace_roots_default_for_rows_predating_the_column() { + // A row inserted without the new column (or holding a value written + // by an older writer) must decode to an empty root set, not error. + let store = temp_state_store("workspace-roots-default"); + store + .upsert_thread(&test_thread("thread-legacy")) + .expect("upsert thread"); + let loaded = store + .get_thread("thread-legacy") + .expect("read thread") + .expect("thread must exist"); + assert!(loaded.workspace_roots.is_empty()); + } + + #[test] + fn workspace_roots_from_json_tolerates_missing_and_malformed_values() { + assert!(workspace_roots_from_json(None).is_empty()); + assert!(workspace_roots_from_json(Some(String::new())).is_empty()); + assert!(workspace_roots_from_json(Some("not-json".to_string())).is_empty()); + assert!(workspace_roots_from_json(Some("{}".to_string())).is_empty()); + assert!(workspace_roots_from_json(Some("null".to_string())).is_empty()); + assert_eq!( + workspace_roots_from_json(Some(r#"["/a","/b"]"#.to_string())), + vec![PathBuf::from("/a"), PathBuf::from("/b")] + ); + } + #[test] fn record_thread_goal_usage_accumulates_tokens_and_time() { let store = temp_state_store("thread-goal-usage"); diff --git a/crates/state/tests/parity_state.rs b/crates/state/tests/parity_state.rs index 5be1d89cf7..a24bbb167b 100644 --- a/crates/state/tests/parity_state.rs +++ b/crates/state/tests/parity_state.rs @@ -16,10 +16,10 @@ fn assert_workflow_trace_schema(conn: &Connection) { let user_version: u32 = conn .query_row("PRAGMA user_version;", [], |row| row.get(0)) .expect("read user_version"); - // v4 (goal-progress migration) adds `thread_goals.continuation_count` on top - // of the v3 workflow-trace + thread_goals tables. The table set asserted - // below is unchanged; only the schema version advanced. - assert_eq!(user_version, 4); + // v5 (workspace roots migration) adds `threads.workspace_roots` on top of + // the v4 goal-progress schema. The table set asserted below is unchanged; + // only the schema version advanced. + assert_eq!(user_version, 5); for table in [ "workflow_runs", @@ -56,6 +56,7 @@ fn upsert_and_resume_thread_metadata() { status: ThreadStatus::Running, path: Some(PathBuf::from("/tmp/project")), cwd: PathBuf::from("/tmp/project"), + workspace_roots: Vec::new(), cli_version: "0.0.0-test".to_string(), source: SessionSource::Interactive, name: Some("Test Thread".to_string()), @@ -370,6 +371,7 @@ fn test_fork() { status: ThreadStatus::Running, path: Some(PathBuf::from("/tmp/project")), cwd: PathBuf::from("/tmp/project"), + workspace_roots: Vec::new(), cli_version: "0.0.0-test".to_string(), source: SessionSource::Interactive, name: Some("Test Thread".to_string()), diff --git a/crates/tui/locales/ca.json b/crates/tui/locales/ca.json index e671748701..54d15cc6e6 100644 --- a/crates/tui/locales/ca.json +++ b/crates/tui/locales/ca.json @@ -1751,6 +1751,15 @@ "SessionMetricsStatusLine": "Mètriques de la sessió: {metrics}", "StatusLabelRoute": "Ruta", "StatusLabelDirectory": "Directori", + "StatusLabelWorkspaceRoots": "Carpetes accessibles", + "WorkspaceSwitchBusy": "L'workspace no ha canviat (l'estat de treball o el runtime està ocupat; espera i torna a provar /cd)", + "WorkspaceSwitchPersistFailed": "Ha fallat la persistència del canvi d'workspace: {error}; l'actor de persistència tampoc no està disponible", + "WorkspaceSwitchSaveFailedActorQueued": "El desat directe del canvi d'workspace ha fallat ({error}); l'actor de persistència conserva la instantània posterior al canvi", + "WorkspaceSwitchPersistedActorUnavailable": "El canvi d'workspace s'ha desat, però l'actor de persistència no està disponible; el proper desat automàtic el torna a escriure", + "WorkspaceSwitchSnapshotFailed": "Ha fallat la instantània del canvi d'workspace: {error}", + "WorkspaceSwitchSessionsDirFailed": "No s'ha pogut obrir el directori de sessions: {error}", + "WorkspaceRootsRemainder": "… (+{count} més)", + "WorkspaceRootsNotice": "Carpetes accessibles a més de {workspace}: {roots}", "StatusLabelProjectDocs": "Docs del projecte", "StatusLabelMode": "Mode", "StatusLabelSafety": "Seguretat", diff --git a/crates/tui/locales/de.json b/crates/tui/locales/de.json index ea65b6b349..cbd0e01ece 100644 --- a/crates/tui/locales/de.json +++ b/crates/tui/locales/de.json @@ -1751,6 +1751,15 @@ "SessionMetricsStatusLine": "Sitzungsmetriken: {metrics}", "StatusLabelRoute": "Route", "StatusLabelDirectory": "Verzeichnis", + "StatusLabelWorkspaceRoots": "Zugängliche Ordner", + "WorkspaceSwitchBusy": "Arbeitsbereich unverändert (Work-State oder Laufzeitarbeit beschäftigt; warten, dann /cd erneut versuchen)", + "WorkspaceSwitchPersistFailed": "Das Persistieren des Arbeitsbereichswechsels ist fehlgeschlagen: {error}; der Persistenz-Aktor ist ebenfalls nicht verfügbar", + "WorkspaceSwitchSaveFailedActorQueued": "Das direkte Speichern des Arbeitsbereichswechsels schlug fehl ({error}); der Persistenz-Aktor hält den Snapshot nach dem Wechsel", + "WorkspaceSwitchPersistedActorUnavailable": "Der Arbeitsbereichswechsel wurde gespeichert, aber der Persistenz-Aktor ist nicht verfügbar; das nächste Autosave schreibt ihn erneut", + "WorkspaceSwitchSnapshotFailed": "Die Momentaufnahme des Arbeitsbereichswechsels ist fehlgeschlagen: {error}", + "WorkspaceSwitchSessionsDirFailed": "Das Sitzungsverzeichnis konnte nicht geöffnet werden: {error}", + "WorkspaceRootsRemainder": "… (+{count} weitere)", + "WorkspaceRootsNotice": "Zugängliche Ordner neben {workspace}: {roots}", "StatusLabelProjectDocs": "Projektdokumente", "StatusLabelMode": "Modus", "StatusLabelSafety": "Sicherheit", diff --git a/crates/tui/locales/en.json b/crates/tui/locales/en.json index 68736df4a5..454dcb4a35 100644 --- a/crates/tui/locales/en.json +++ b/crates/tui/locales/en.json @@ -1751,6 +1751,15 @@ "SessionMetricsStatusLine": "Session metrics: {metrics}", "StatusLabelRoute": "Route", "StatusLabelDirectory": "Directory", + "StatusLabelWorkspaceRoots": "Accessible folders", + "WorkspaceSwitchBusy": "Workspace unchanged (Work state or runtime work busy; wait, then try /cd again)", + "WorkspaceSwitchPersistFailed": "Failed to persist workspace switch: {error}; the persistence actor is also unavailable", + "WorkspaceSwitchSaveFailedActorQueued": "Direct workspace-switch save failed ({error}); the persistence actor holds the post-switch snapshot", + "WorkspaceSwitchPersistedActorUnavailable": "Workspace switch persisted, but the persistence actor is unavailable; the next autosave re-persists it", + "WorkspaceSwitchSnapshotFailed": "Failed to snapshot the workspace switch: {error}", + "WorkspaceSwitchSessionsDirFailed": "Failed to open the sessions directory: {error}", + "WorkspaceRootsRemainder": "… (+{count} more)", + "WorkspaceRootsNotice": "Accessible folders beside {workspace}: {roots}", "StatusLabelProjectDocs": "Project docs", "StatusLabelMode": "Mode", "StatusLabelSafety": "Safety", diff --git a/crates/tui/locales/es-419.json b/crates/tui/locales/es-419.json index 42c58299d6..649e9b3e02 100644 --- a/crates/tui/locales/es-419.json +++ b/crates/tui/locales/es-419.json @@ -1751,6 +1751,15 @@ "SessionMetricsStatusLine": "Métricas de la sesión: {metrics}", "StatusLabelRoute": "Ruta", "StatusLabelDirectory": "Directorio", + "StatusLabelWorkspaceRoots": "Carpetas accesibles", + "WorkspaceSwitchBusy": "El workspace no cambió (el estado de Trabajo o la ejecución está ocupada; espera y vuelve a intentar /cd)", + "WorkspaceSwitchPersistFailed": "Error al persistir el cambio de workspace: {error}; el actor de persistencia tampoco está disponible", + "WorkspaceSwitchSaveFailedActorQueued": "El guardado directo del cambio de workspace falló ({error}); el actor de persistencia conserva el snapshot posterior al cambio", + "WorkspaceSwitchPersistedActorUnavailable": "El cambio de workspace se guardó, pero el actor de persistencia no está disponible; el siguiente autoguardado lo vuelve a escribir", + "WorkspaceSwitchSnapshotFailed": "Error al crear la instantánea del cambio de workspace: {error}", + "WorkspaceSwitchSessionsDirFailed": "No se pudo abrir el directorio de sesiones: {error}", + "WorkspaceRootsRemainder": "… (+{count} más)", + "WorkspaceRootsNotice": "Carpetas accesibles además de {workspace}: {roots}", "StatusLabelProjectDocs": "Docs del proyecto", "StatusLabelMode": "Modo", "StatusLabelSafety": "Seguridad", diff --git a/crates/tui/locales/fr.json b/crates/tui/locales/fr.json index 362667e2c4..6ad8d51799 100644 --- a/crates/tui/locales/fr.json +++ b/crates/tui/locales/fr.json @@ -1751,6 +1751,15 @@ "SessionMetricsStatusLine": "Métriques de session : {metrics}", "StatusLabelRoute": "Itinéraire", "StatusLabelDirectory": "Répertoire", + "StatusLabelWorkspaceRoots": "Dossiers accessibles", + "WorkspaceSwitchBusy": "L'espace de travail est inchangé (état Work ou exécution occupée ; patientez, puis réessayez /cd)", + "WorkspaceSwitchPersistFailed": "Échec de la persistance du changement d'espace de travail : {error} ; l'acteur de persistance est également indisponible", + "WorkspaceSwitchSaveFailedActorQueued": "L'enregistrement direct du changement d'espace de travail a échoué ({error}) ; l'acteur de persistance conserve l'instantané après le changement", + "WorkspaceSwitchPersistedActorUnavailable": "Le changement d'espace de travail est enregistré, mais l'acteur de persistance est indisponible ; la prochaine sauvegarde automatique le réécrira", + "WorkspaceSwitchSnapshotFailed": "Échec de l'instantané du changement d'espace de travail : {error}", + "WorkspaceSwitchSessionsDirFailed": "Impossible d'ouvrir le répertoire des sessions : {error}", + "WorkspaceRootsRemainder": "… (+{count} autres)", + "WorkspaceRootsNotice": "Dossiers accessibles en plus de {workspace} : {roots}", "StatusLabelProjectDocs": "Docs du projet", "StatusLabelMode": "Mode", "StatusLabelSafety": "Sécurité", diff --git a/crates/tui/locales/hi.json b/crates/tui/locales/hi.json index f8580f6c24..4e869df4cd 100644 --- a/crates/tui/locales/hi.json +++ b/crates/tui/locales/hi.json @@ -1751,6 +1751,15 @@ "SessionMetricsStatusLine": "सत्र मेट्रिक्स: {metrics}", "StatusLabelRoute": "रूट", "StatusLabelDirectory": "डायरेक्टरी", + "StatusLabelWorkspaceRoots": "सुलभ फ़ोल्डर", + "WorkspaceSwitchBusy": "वर्कस्पेस अपरिवर्तित (कार्य स्थिति या रनटाइम कार्य व्यस्त है; प्रतीक्षा करें, फिर /cd दोबारा आज़माएँ)", + "WorkspaceSwitchPersistFailed": "वर्कस्पेस बदलना परसिस्ट करने में विफल: {error}; परसिस्टेंस एक्टर भी अनुपलब्ध है", + "WorkspaceSwitchSaveFailedActorQueued": "वर्कस्पेस बदलने की सीधी सहेजगी विफल हुई ({error}); परसिस्टेंस एक्टर बदलाव के बाद का स्नैपशॉट रखता है", + "WorkspaceSwitchPersistedActorUnavailable": "वर्कस्पेस बदलना सहेजा गया, परंतु परसिस्टेंस एक्टर अनुपलब्ध है; अगला ऑटोसेव इसे फिर से लिखेगा", + "WorkspaceSwitchSnapshotFailed": "वर्कस्पेस बदलने का स्नैपशॉट विफल: {error}", + "WorkspaceSwitchSessionsDirFailed": "सत्र निर्देशिका नहीं खोली जा सकी: {error}", + "WorkspaceRootsRemainder": "… (+{count} और)", + "WorkspaceRootsNotice": "{workspace} के अतिरिक्त सुलभ फ़ोल्डर: {roots}", "StatusLabelProjectDocs": "प्रोजेक्ट दस्तावेज़", "StatusLabelMode": "मोड", "StatusLabelSafety": "सुरक्षा", diff --git a/crates/tui/locales/id.json b/crates/tui/locales/id.json index 2a42a0389f..e6f9bdb30c 100644 --- a/crates/tui/locales/id.json +++ b/crates/tui/locales/id.json @@ -1751,6 +1751,15 @@ "SessionMetricsStatusLine": "Metrik sesi: {metrics}", "StatusLabelRoute": "Rute", "StatusLabelDirectory": "Direktori", + "StatusLabelWorkspaceRoots": "Folder yang dapat diakses", + "WorkspaceSwitchBusy": "Workspace tidak berubah (status Work atau pekerjaan runtime sibuk; tunggu, lalu coba /cd lagi)", + "WorkspaceSwitchPersistFailed": "Gagal mempersistenkan perubahan workspace: {error}; actor persistensi juga tidak tersedia", + "WorkspaceSwitchSaveFailedActorQueued": "Penyimpanan langsung perubahan workspace gagal ({error}); actor persistensi menyimpan snapshot setelah perubahan", + "WorkspaceSwitchPersistedActorUnavailable": "Perubahan workspace disimpan, tetapi actor persistensi tidak tersedia; penyimpanan otomatis berikutnya akan menulisnya ulang", + "WorkspaceSwitchSnapshotFailed": "Gagal membuat snapshot perubahan workspace: {error}", + "WorkspaceSwitchSessionsDirFailed": "Gagal membuka direktori sesi: {error}", + "WorkspaceRootsRemainder": "… (+{count} lainnya)", + "WorkspaceRootsNotice": "Folder yang dapat diakses selain {workspace}: {roots}", "StatusLabelProjectDocs": "Dokumen proyek", "StatusLabelMode": "Mode", "StatusLabelSafety": "Keamanan", diff --git a/crates/tui/locales/ja.json b/crates/tui/locales/ja.json index 2a1aba5296..e791b601fa 100644 --- a/crates/tui/locales/ja.json +++ b/crates/tui/locales/ja.json @@ -1751,6 +1751,15 @@ "SessionMetricsStatusLine": "セッション指標: {metrics}", "StatusLabelRoute": "経路", "StatusLabelDirectory": "ディレクトリ", + "StatusLabelWorkspaceRoots": "アクセス可能なフォルダ", + "WorkspaceSwitchBusy": "ワークスペースは変更されていません（Work 状態またはランタイム処理が実行中です。待ってから /cd を再実行してください）", + "WorkspaceSwitchPersistFailed": "ワークスペース切り替えの永続化に失敗しました: {error}。永続化アクターも利用できません", + "WorkspaceSwitchSaveFailedActorQueued": "ワークスペース切り替えの直接保存に失敗しました（{error}）。永続化アクターが切り替え後のスナップショットを保持しています", + "WorkspaceSwitchPersistedActorUnavailable": "ワークスペース切り替えは保存されましたが、永続化アクターが利用できません。次の自動保存で再保存されます", + "WorkspaceSwitchSnapshotFailed": "ワークスペース切り替えのスナップショットに失敗しました: {error}", + "WorkspaceSwitchSessionsDirFailed": "セッションディレクトリを開けませんでした: {error}", + "WorkspaceRootsRemainder": "…（ほか {count} 件）", + "WorkspaceRootsNotice": "{workspace} のほかにアクセス可能なフォルダ: {roots}", "StatusLabelProjectDocs": "プロジェクト文書", "StatusLabelMode": "モード", "StatusLabelSafety": "安全性", diff --git a/crates/tui/locales/ko.json b/crates/tui/locales/ko.json index 7582372b55..aeacb3a839 100644 --- a/crates/tui/locales/ko.json +++ b/crates/tui/locales/ko.json @@ -1751,6 +1751,15 @@ "SessionMetricsStatusLine": "세션 지표: {metrics}", "StatusLabelRoute": "경로", "StatusLabelDirectory": "디렉터리", + "StatusLabelWorkspaceRoots": "접근 가능한 폴더", + "WorkspaceSwitchBusy": "워크스페이스가 변경되지 않았습니다 (작업 상태 또는 런타임 작업이 진행 중입니다. 잠시 후 /cd를 다시 시도하세요)", + "WorkspaceSwitchPersistFailed": "워크스페이스 전환 저장 실패: {error}; 퍼시스턴스 액터도 사용할 수 없습니다", + "WorkspaceSwitchSaveFailedActorQueued": "워크스페이스 전환 직접 저장 실패({error}); 퍼시스턴스 액터가 전환 후 스냅샷을 보관합니다", + "WorkspaceSwitchPersistedActorUnavailable": "워크스페이스 전환이 저장되었지만 퍼시스턴스 액터를 사용할 수 없습니다. 다음 자동 저장이 다시 기록합니다", + "WorkspaceSwitchSnapshotFailed": "워크스페이스 전환 스냅샷 실패: {error}", + "WorkspaceSwitchSessionsDirFailed": "세션 디렉터리를 열 수 없습니다: {error}", + "WorkspaceRootsRemainder": "… (+{count}개 더)", + "WorkspaceRootsNotice": "{workspace} 옆의 접근 가능한 폴더: {roots}", "StatusLabelProjectDocs": "프로젝트 문서", "StatusLabelMode": "모드", "StatusLabelSafety": "안전", diff --git a/crates/tui/locales/pt-BR.json b/crates/tui/locales/pt-BR.json index 8e2ff30d0b..e66d65e716 100644 --- a/crates/tui/locales/pt-BR.json +++ b/crates/tui/locales/pt-BR.json @@ -1751,6 +1751,15 @@ "SessionMetricsStatusLine": "Métricas da sessão: {metrics}", "StatusLabelRoute": "Rota", "StatusLabelDirectory": "Diretório", + "StatusLabelWorkspaceRoots": "Pastas acessíveis", + "WorkspaceSwitchBusy": "Workspace inalterado (estado de Trabalho ou execução ativa ocupada; aguarde e tente /cd novamente)", + "WorkspaceSwitchPersistFailed": "Falha ao persistir a mudança de workspace: {error}; o ator de persistência também está indisponível", + "WorkspaceSwitchSaveFailedActorQueued": "O salvamento direto da mudança de workspace falhou ({error}); o ator de persistência mantém o snapshot pós-mudança", + "WorkspaceSwitchPersistedActorUnavailable": "A mudança de workspace foi salva, mas o ator de persistência está indisponível; o próximo salvamento automático a regrava", + "WorkspaceSwitchSnapshotFailed": "Falha no instantâneo da mudança de workspace: {error}", + "WorkspaceSwitchSessionsDirFailed": "Falha ao abrir o diretório de sessões: {error}", + "WorkspaceRootsRemainder": "… (+{count} mais)", + "WorkspaceRootsNotice": "Pastas acessíveis além de {workspace}: {roots}", "StatusLabelProjectDocs": "Docs do projeto", "StatusLabelMode": "Modo", "StatusLabelSafety": "Segurança", diff --git a/crates/tui/locales/ru.json b/crates/tui/locales/ru.json index 5ba1336e74..a9e2df786c 100644 --- a/crates/tui/locales/ru.json +++ b/crates/tui/locales/ru.json @@ -1751,6 +1751,15 @@ "SessionMetricsStatusLine": "Метрики сессии: {metrics}", "StatusLabelRoute": "Маршрут", "StatusLabelDirectory": "Каталог", + "StatusLabelWorkspaceRoots": "Доступные папки", + "WorkspaceSwitchBusy": "Рабочее пространство не изменено (состояние Work или фоновая работа заняты; подождите и повторите /cd)", + "WorkspaceSwitchPersistFailed": "Не удалось сохранить смену рабочего пространства: {error}; субъект персистентности также недоступен", + "WorkspaceSwitchSaveFailedActorQueued": "Прямое сохранение смены рабочего пространства не удалось ({error}); субъект персистентности хранит снимок после смены", + "WorkspaceSwitchPersistedActorUnavailable": "Смена рабочего пространства сохранена, но субъект персистентности недоступен; следующее автосохранение запишет её заново", + "WorkspaceSwitchSnapshotFailed": "Не удалось создать снимок смены рабочего пространства: {error}", + "WorkspaceSwitchSessionsDirFailed": "Не удалось открыть каталог сеансов: {error}", + "WorkspaceRootsRemainder": "… (ещё {count})", + "WorkspaceRootsNotice": "Доступные папки кроме {workspace}: {roots}", "StatusLabelProjectDocs": "Документы проекта", "StatusLabelMode": "Режим", "StatusLabelSafety": "Безопасность", diff --git a/crates/tui/locales/uk.json b/crates/tui/locales/uk.json index 6624dac829..83ce1cd206 100644 --- a/crates/tui/locales/uk.json +++ b/crates/tui/locales/uk.json @@ -1751,6 +1751,15 @@ "SessionMetricsStatusLine": "Метрики сесії: {metrics}", "StatusLabelRoute": "Маршрут", "StatusLabelDirectory": "Каталог", + "StatusLabelWorkspaceRoots": "Доступні папки", + "WorkspaceSwitchBusy": "Робочий простір не змінено (стан роботи або виконання зайняті; зачекайте й повторіть /cd)", + "WorkspaceSwitchPersistFailed": "Не вдалося зберегти зміну робочого простору: {error}; суб'єкт персистентності також недоступний", + "WorkspaceSwitchSaveFailedActorQueued": "Пряме збереження зміни робочого простору не вдалося ({error}); суб'єкт персистентності зберігає знімок після зміни", + "WorkspaceSwitchPersistedActorUnavailable": "Зміну робочого простору збережено, але суб'єкт персистентності недоступний; наступне автозбереження запише її знову", + "WorkspaceSwitchSnapshotFailed": "Не вдалося створити знімок зміни робочого простору: {error}", + "WorkspaceSwitchSessionsDirFailed": "Не вдалося відкрити каталог сеансів: {error}", + "WorkspaceRootsRemainder": "… (ще {count})", + "WorkspaceRootsNotice": "Доступні папки окрім {workspace}: {roots}", "StatusLabelProjectDocs": "Документи проєкту", "StatusLabelMode": "Режим", "StatusLabelSafety": "Безпека", diff --git a/crates/tui/locales/vi.json b/crates/tui/locales/vi.json index fa618e5465..6f4f583da2 100644 --- a/crates/tui/locales/vi.json +++ b/crates/tui/locales/vi.json @@ -1751,6 +1751,15 @@ "SessionMetricsStatusLine": "Số liệu phiên: {metrics}", "StatusLabelRoute": "Tuyến", "StatusLabelDirectory": "Thư mục", + "StatusLabelWorkspaceRoots": "Thư mục có thể truy cập", + "WorkspaceSwitchBusy": "Workspace không đổi (trạng thái Công việc hoặc tác vụ thời gian chạy đang bận; hãy chờ rồi thử lại /cd)", + "WorkspaceSwitchPersistFailed": "Không thể lưu việc chuyển workspace: {error}; actor lưu trữ cũng không khả dụng", + "WorkspaceSwitchSaveFailedActorQueued": "Lưu trực tiếp việc chuyển workspace thất bại ({error}); actor lưu trữ đang giữ snapshot sau chuyển", + "WorkspaceSwitchPersistedActorUnavailable": "Đã lưu việc chuyển workspace, nhưng actor lưu trữ không khả dụng; lần tự lưu kế tiếp sẽ ghi lại", + "WorkspaceSwitchSnapshotFailed": "Không tạo được snapshot khi chuyển workspace: {error}", + "WorkspaceSwitchSessionsDirFailed": "Không mở được thư mục phiên: {error}", + "WorkspaceRootsRemainder": "… (+{count} nữa)", + "WorkspaceRootsNotice": "Thư mục có thể truy cập bên cạnh {workspace}: {roots}", "StatusLabelProjectDocs": "Tài liệu dự án", "StatusLabelMode": "Chế độ", "StatusLabelSafety": "An toàn", diff --git a/crates/tui/locales/zh-Hans.json b/crates/tui/locales/zh-Hans.json index 79e942ba85..02b7af7111 100644 --- a/crates/tui/locales/zh-Hans.json +++ b/crates/tui/locales/zh-Hans.json @@ -1751,6 +1751,15 @@ "SessionMetricsStatusLine": "会话指标：{metrics}", "StatusLabelRoute": "路由", "StatusLabelDirectory": "目录", + "StatusLabelWorkspaceRoots": "可访问的文件夹", + "WorkspaceSwitchBusy": "工作区未更改（工作状态或运行时任务正忙；请等待后重试 /cd）", + "WorkspaceSwitchPersistFailed": "工作区切换持久化失败：{error}；持久化执行器也不可用", + "WorkspaceSwitchSaveFailedActorQueued": "工作区切换的直接保存失败（{error}）；持久化执行器持有切换后的快照", + "WorkspaceSwitchPersistedActorUnavailable": "工作区切换已保存，但持久化执行器不可用；下次自动保存会重新写入", + "WorkspaceSwitchSnapshotFailed": "工作区切换快照失败：{error}", + "WorkspaceSwitchSessionsDirFailed": "无法打开会话目录：{error}", + "WorkspaceRootsRemainder": "…（另有 {count} 个）", + "WorkspaceRootsNotice": "{workspace} 之外可访问的文件夹：{roots}", "StatusLabelProjectDocs": "项目文档", "StatusLabelMode": "模式", "StatusLabelSafety": "安全", diff --git a/crates/tui/locales/zh-Hant.json b/crates/tui/locales/zh-Hant.json index 67e2921f83..1a2baa138e 100644 --- a/crates/tui/locales/zh-Hant.json +++ b/crates/tui/locales/zh-Hant.json @@ -1751,6 +1751,15 @@ "SessionMetricsStatusLine": "工作階段指標：{metrics}", "StatusLabelRoute": "路由", "StatusLabelDirectory": "目錄", + "StatusLabelWorkspaceRoots": "可存取的資料夾", + "WorkspaceSwitchBusy": "工作區未更改（工作狀態或執行時任務正忙；請等待後重試 /cd）", + "WorkspaceSwitchPersistFailed": "工作區切換持久化失敗：{error}；持久化執行器也不可用", + "WorkspaceSwitchSaveFailedActorQueued": "工作區切換的直接保存失敗（{error}）；持久化執行器持有切換後的快照", + "WorkspaceSwitchPersistedActorUnavailable": "工作區切換已保存，但持久化執行器不可用；下次自動保存會重新寫入", + "WorkspaceSwitchSnapshotFailed": "工作區切換快照失敗：{error}", + "WorkspaceSwitchSessionsDirFailed": "無法開啟工作階段目錄：{error}", + "WorkspaceRootsRemainder": "…（另有 {count} 個）", + "WorkspaceRootsNotice": "{workspace} 之外可存取的資料夾：{roots}", "StatusLabelProjectDocs": "專案文件", "StatusLabelMode": "模式", "StatusLabelSafety": "安全性", diff --git a/crates/tui/src/acp_server.rs b/crates/tui/src/acp_server.rs index 008d9d9b48..2ad3c1a64c 100644 --- a/crates/tui/src/acp_server.rs +++ b/crates/tui/src/acp_server.rs @@ -700,6 +700,7 @@ fn prepare_acp_tool_admission( &call.name, &prepared.input, workspace, + ®istry.context().workspace_roots, approval_mode, ) .or_else(|| { @@ -708,6 +709,7 @@ fn prepare_acp_tool_admission( &call.name, &prepared.input, workspace, + ®istry.context().workspace_roots, approval_mode, ) }); @@ -732,6 +734,7 @@ fn prepare_acp_tool_admission( approval_mode, crate::config::is_workspace_trusted(workspace), Some(workspace), + ®istry.context().workspace_roots, ); let (auto_review, _audit) = auto_review_plan_decision_for_context(&config.auto_review_policy(), &review_context); @@ -746,9 +749,12 @@ fn prepare_acp_tool_admission( } } - if let Some(repo_law) = - crate::repo_law::repo_law_plan_decision(workspace, &call.name, &prepared.input) - { + if let Some(repo_law) = crate::repo_law::repo_law_plan_decision( + workspace, + ®istry.context().workspace_roots, + &call.name, + &prepared.input, + ) { match repo_law { crate::repo_law::RepoLawPlanDecision::ForcePrompt(reason) => { permission_reason = Some(reason); @@ -1395,6 +1401,11 @@ struct AcpServer { struct AcpSession { cwd: PathBuf, + /// Accessible roots carried beside the session's primary `cwd`. ACP shares + /// the durable session store, so a session created by the TUI or the + /// Runtime API can arrive multi-root; the registry built over it must see + /// the same set or writes the session legitimately held fail here. + workspace_roots: Vec, messages: Vec, config: Config, model: String, @@ -1491,15 +1502,24 @@ impl AcpServer { } fn new_session(&mut self, params: Value) -> std::result::Result { - let cwd = params - .get("cwd") - .and_then(Value::as_str) - .map(PathBuf::from) - .unwrap_or_else(|| self.default_cwd.clone()); + // An explicit empty cwd would build the tool registry over the + // vacuous containment root (`starts_with("")` accepts every path); + // reject it rather than falling back to the default, so a client + // typo cannot silently re-anchor the session. + let cwd = match params.get("cwd").and_then(Value::as_str) { + Some("") => { + return Err(AcpError::invalid_params( + "session/new cwd must not be empty", + )); + } + Some(raw) => PathBuf::from(raw), + None => self.default_cwd.clone(), + }; let session_id = format!("codewhale-{}", uuid::Uuid::new_v4()); let tool_registry = Arc::new(build_acp_tool_registry( &self.config, &cwd, + &[], self.client_supports_terminal, )); @@ -1518,6 +1538,8 @@ impl AcpServer { session_id.clone(), AcpSession { cwd, + // A fresh ACP session has no durable record to inherit from. + workspace_roots: Vec::new(), messages: Vec::new(), config: self.config.clone(), model: self.model.clone(), @@ -1574,9 +1596,19 @@ impl AcpServer { })?; let cwd = saved.metadata.workspace.clone(); + if cwd.as_os_str().is_empty() { + // A legacy or hand-edited record with an empty workspace would + // arm the vacuous containment root for every tool call in the + // rehydrated session; refuse to load it. + return Err(AcpError::invalid_params(format!( + "session {session_id} has an empty workspace" + ))); + } + let workspace_roots = saved.metadata.workspace_roots.clone(); let tool_registry = Arc::new(build_acp_tool_registry( &self.config, &cwd, + &workspace_roots, self.client_supports_terminal, )); let resolved_id = saved.metadata.id.clone(); @@ -1590,6 +1622,7 @@ impl AcpServer { resolved_id.clone(), AcpSession { cwd, + workspace_roots, messages: saved.messages, config: self.config.clone(), model: self.model.clone(), @@ -1691,6 +1724,7 @@ impl AcpServer { session.tool_registry = Arc::new(build_acp_tool_registry( &session.config, &session.cwd, + &session.workspace_roots, self.client_supports_terminal, )); } @@ -2069,6 +2103,7 @@ fn acp_mode(config: &Config) -> crate::tui::app::AppMode { fn build_acp_tool_registry( config: &Config, workspace: &std::path::Path, + workspace_roots: &[std::path::PathBuf], client_supports_terminal: bool, ) -> ToolRegistry { let features = config.features(); @@ -2097,14 +2132,19 @@ fn build_acp_tool_registry( } else { ShellPolicy::None }; + // The turn environment is materialized over the session's whole root set, + // mirroring the engine lane: a resumed multi-root session keeps its + // attached roots instead of silently running single-root here. let sandbox_policy = crate::core::authority::sandbox_policy_for_turn( acp_mode(config), crate::tui::approval::ApprovalMode::Suggest, config.sandbox_mode.as_deref(), workspace, + workspace_roots, crate::core::authority::SandboxNetworkAccess::from_config(config.sandbox_network_access), ); let mut context = ToolContext::new(workspace) + .with_workspace_roots(workspace_roots.to_vec()) .with_shell_policy(shell_policy) .with_elevated_sandbox_policy(sandbox_policy); if acp_mode(config) == crate::tui::app::AppMode::Plan { @@ -2594,8 +2634,22 @@ mod tests { /// nothing else, so ACP clients that offer session history could not /// enumerate or resume anything. ACP sessions are in-memory and capped; /// the durable Codewhale sessions are what "resume" means. - #[tokio::test] - async fn session_list_and_load_reach_the_durable_codewhale_sessions() { + // session/load's first tr() initializes the i18n backend; that serde + // load is deeper than the default 2 MiB libtest thread stack. The + // product path runs on the 8 MiB main thread, so run the body on an + // equivalently sized stack (same pattern as + // setup_confirm_toast_names_secret_store_and_global_scope). + #[test] + fn session_list_and_load_reach_the_durable_codewhale_sessions() { + std::thread::Builder::new() + .stack_size(16 * 1024 * 1024) + .spawn(session_list_and_load_reach_the_durable_codewhale_sessions_body) + .expect("spawn test thread") + .join() + .expect("test thread"); + } + + fn session_list_and_load_reach_the_durable_codewhale_sessions_body() { let _guard = crate::test_support::lock_test_env(); let home = tempfile::TempDir::new().expect("isolated codewhale home"); let _home_guard = @@ -2668,6 +2722,166 @@ mod tests { assert_eq!(no_id.expect_err("missing sessionId").code, -32602); } + // Same big-stack wrapper as + // session_list_and_load_reach_the_durable_codewhale_sessions: this load + // also reaches session_configuration's first tr(). + #[test] + fn session_load_carries_the_persisted_workspace_roots() { + std::thread::Builder::new() + .stack_size(16 * 1024 * 1024) + .spawn(session_load_carries_the_persisted_workspace_roots_body) + .expect("spawn test thread") + .join() + .expect("test thread"); + } + + fn session_load_carries_the_persisted_workspace_roots_body() { + let _guard = crate::test_support::lock_test_env(); + let home = tempfile::TempDir::new().expect("isolated codewhale home"); + let _home_guard = + crate::test_support::EnvVarGuard::set("CODEWHALE_HOME", home.path().as_os_str()); + + let workspace = home.path().join("workspace"); + let attached = home.path().join("shared"); + std::fs::create_dir_all(&workspace).expect("workspace"); + std::fs::create_dir_all(&attached).expect("attached root"); + let mut saved = crate::session_manager::create_saved_session( + &[Message { + role: Role::User, + content: vec![ContentBlock::Text { + text: "multi-root session".to_string(), + cache_control: None, + }], + }], + "deepseek-v4-flash", + &workspace, + 0, + None, + ); + saved.metadata.workspace_roots = vec![workspace.clone(), attached.clone()]; + let saved_id = saved.metadata.id.clone(); + let manager = crate::session_manager::SessionManager::new( + crate::session_manager::default_sessions_dir().expect("sessions dir"), + ) + .expect("session manager"); + manager.save_session(&saved).expect("save fixture session"); + + let mut server = AcpServer::new( + Config::default(), + "deepseek-v4-flash".to_string(), + workspace.clone(), + ); + server + .load_session(json!({ "sessionId": saved_id })) + .expect("session/load"); + + let session = server.sessions.get(&saved_id).expect("loaded session"); + assert_eq!( + session.workspace_roots, + vec![workspace.clone(), attached.clone()], + "session/load must keep the persisted set on the ACP session" + ); + // The registry the ask/deny checks, repo law, and the auto-review gate + // all read is built over that same set; an empty context here is the + // silent single-root degradation this lane must not have. + assert_eq!( + session.tool_registry.context().workspace_roots, + vec![workspace.clone(), attached.clone()], + "the ACP tool registry must be built over the session's roots" + ); + // The materialized turn environment spans the attached root. + let policy = session + .tool_registry + .context() + .elevated_sandbox_policy + .as_ref() + .expect("sandbox policy materialized at registry build"); + let writable: Vec = policy + .get_writable_roots(&workspace) + .into_iter() + .map(|root| root.root) + .collect(); + let attached_canonical = attached.canonicalize().expect("canonical attached"); + assert!( + writable.contains(&attached_canonical), + "the attached root must be writable in the ACP turn environment: {writable:?}" + ); + } + + #[test] + fn session_new_rejects_empty_cwd() { + // Regression pin: `session/new` with `cwd: ""` used to build the + // tool registry over the vacuous containment root + // (`starts_with("")` accepts every path). + let workspace = tempfile::tempdir().unwrap(); + let mut server = AcpServer::new( + Config::default(), + "deepseek-v4-flash".into(), + workspace.path().into(), + ); + let err = server + .new_session(json!({"cwd": ""})) + .expect_err("empty cwd must be rejected"); + assert_eq!(err.code, -32602); + } + + // Same big-stack wrapper as + // session_list_and_load_reach_the_durable_codewhale_sessions. + #[test] + fn session_load_rejects_empty_workspace() { + std::thread::Builder::new() + .stack_size(16 * 1024 * 1024) + .spawn(session_load_rejects_empty_workspace_body) + .expect("spawn test thread") + .join() + .expect("test thread"); + } + + fn session_load_rejects_empty_workspace_body() { + let _guard = crate::test_support::lock_test_env(); + let home = tempfile::TempDir::new().expect("isolated codewhale home"); + let _home_guard = + crate::test_support::EnvVarGuard::set("CODEWHALE_HOME", home.path().as_os_str()); + + // A legacy or hand-edited record with an empty workspace must not be + // rehydrated: its tool registry would arm the vacuous containment + // root for every tool call. + let saved = crate::session_manager::create_saved_session( + &[Message { + role: Role::User, + content: vec![ContentBlock::Text { + text: "corrupt record".to_string(), + cache_control: None, + }], + }], + "deepseek-v4-flash", + &PathBuf::new(), + 0, + None, + ); + let saved_id = saved.metadata.id.clone(); + let manager = crate::session_manager::SessionManager::new( + crate::session_manager::default_sessions_dir().expect("sessions dir"), + ) + .expect("session manager"); + manager.save_session(&saved).expect("save fixture session"); + + let workspace = home.path().join("workspace"); + let mut server = AcpServer::new( + Config::default(), + "deepseek-v4-flash".to_string(), + workspace.clone(), + ); + let err = server + .load_session(json!({ "sessionId": saved_id })) + .expect_err("empty saved workspace must be rejected"); + assert_eq!(err.code, -32602); + assert!( + !server.sessions.contains_key(&saved_id), + "a rejected load must not register the session" + ); + } + #[tokio::test] async fn standard_session_configuration_is_offered_and_scoped_to_one_session() { let workspace = tempfile::tempdir().unwrap(); @@ -3647,7 +3861,7 @@ mod tests { allow_shell: Some(true), ..Config::default() }; - let registry = build_acp_tool_registry(&config, &workspace, false); + let registry = build_acp_tool_registry(&config, &workspace, &[], false); assert!(!registry.contains("Bash")); assert!(registry.contains("File")); } @@ -3655,7 +3869,7 @@ mod tests { #[test] fn shell_tool_omitted_without_headless_config_opt_in() { let workspace = std::env::temp_dir(); - let registry = build_acp_tool_registry(&Config::default(), &workspace, true); + let registry = build_acp_tool_registry(&Config::default(), &workspace, &[], true); assert!(!registry.contains("Bash")); assert_eq!(registry.context().shell_policy, ShellPolicy::None); assert!(!registry.context().auto_approve); @@ -3670,7 +3884,7 @@ mod tests { sandbox_url: Some("http://127.0.0.1:8080".to_string()), ..Config::default() }; - let registry = build_acp_tool_registry(&configured, &workspace, true); + let registry = build_acp_tool_registry(&configured, &workspace, &[], true); assert!(registry.contains("bash")); assert!(registry.context().sandbox_backend.is_some()); @@ -3679,7 +3893,7 @@ mod tests { sandbox_backend: Some("unsupported-backend".to_string()), ..Config::default() }; - let registry = build_acp_tool_registry(&unsupported, &workspace, true); + let registry = build_acp_tool_registry(&unsupported, &workspace, &[], true); assert!(!registry.contains("bash")); assert!(!registry.contains("Bash")); assert!(registry.context().sandbox_backend.is_none()); @@ -3697,7 +3911,7 @@ mod tests { }), ..Config::default() }; - let registry = build_acp_tool_registry(&config, &std::env::temp_dir(), true); + let registry = build_acp_tool_registry(&config, &std::env::temp_dir(), &[], true); assert!(!registry.contains("bash")); assert!(!registry.contains("Bash")); assert!( @@ -3796,7 +4010,7 @@ mod tests { allow_shell: Some(true), ..Config::default() }; - let registry = build_acp_tool_registry(&config, dir.path(), true); + let registry = build_acp_tool_registry(&config, dir.path(), &[], true); (dir, registry) } @@ -3849,7 +4063,7 @@ mod tests { json!({"decision": "deny", "reason": "release gate"}), true, ); - let registry = build_acp_tool_registry(&config, dir.path(), false); + let registry = build_acp_tool_registry(&config, dir.path(), &[], false); let error = prepare_acp_tool_with_hooks( &config, "test-model", @@ -3880,7 +4094,7 @@ mod tests { }), true, ); - let registry = build_acp_tool_registry(&config, dir.path(), false); + let registry = build_acp_tool_registry(&config, dir.path(), &[], false); let raw = pending_call("File", json!({"action": "read", "path": "safe.txt"})); let (_, raw_admission) = prepare_acp_tool_admission(&config, ®istry, &raw).unwrap(); assert_eq!(raw_admission, AcpToolAdmission::Auto); @@ -4053,6 +4267,45 @@ mod tests { } } + #[test] + fn acp_admission_repo_law_judges_attached_roots() { + // Round-15 pin at the ACP admission layer: + // `prepare_acp_tool_admission` must forward the registry's root set + // to `repo_law_plan_decision`. A `&[]` mutation at that call site + // unloads the attached root's constitution, so the hold below + // vanishes with every repo-law unit test (one layer down) still + // green. + let dir = tempfile::tempdir().expect("tempdir"); + let attached = tempfile::tempdir().expect("attached root"); + let law_dir = attached.path().join(".codewhale"); + std::fs::create_dir_all(&law_dir).unwrap(); + std::fs::write( + law_dir.join("constitution.json"), + r#"{ + "protected_invariants": [ + { "text": "Never rewrite the shared wire", "paths": ["wire.rs"], "action": "block" } + ] + }"#, + ) + .unwrap(); + let config = Config { + allow_shell: Some(true), + ..Config::default() + }; + let registry = + build_acp_tool_registry(&config, dir.path(), &[attached.path().to_path_buf()], true); + let target = attached.path().join("wire.rs"); + let call = pending_call( + "File", + json!({"action": "write", "path": target.to_string_lossy(), "content": "new"}), + ); + let (_, admission) = prepare_acp_tool_admission(&config, ®istry, &call).unwrap(); + assert!(matches!( + admission, + AcpToolAdmission::Block(reason) if reason.contains("Never rewrite the shared wire") + )); + } + #[tokio::test] async fn acp_read_runs_without_permission_but_reports_pending_before_in_progress() { let (dir, registry) = workspace_registry(); diff --git a/crates/tui/src/commands/contract.rs b/crates/tui/src/commands/contract.rs index eca6f693f8..0fca20f9c9 100644 --- a/crates/tui/src/commands/contract.rs +++ b/crates/tui/src/commands/contract.rs @@ -1608,6 +1608,11 @@ impl CommandSkillGroupContext for SkillGroupAdapter<'_> { .map_err(|err| format!("Restore failed: {err}")) } + fn restore_covers_primary_only(&self) -> bool { + let app = self.host.app.borrow(); + crate::snapshot::restore_covers_primary_only(&app.workspace, &app.workspace_roots) + } + fn approval_state(&self) -> CommandApprovalState { let app = self.host.app.borrow(); CommandApprovalState { diff --git a/crates/tui/src/commands/groups/config/status.rs b/crates/tui/src/commands/groups/config/status.rs index 7f1fa0e48a..2759a75bac 100644 --- a/crates/tui/src/commands/groups/config/status.rs +++ b/crates/tui/src/commands/groups/config/status.rs @@ -45,6 +45,20 @@ fn format_status(app: &App) -> String { MessageId::StatusLabelDirectory, &display_path(&app.workspace), ); + // Human-facing disclosure of the session's accessible root set: the + // `Accessible folders:` turn-meta line is model-facing only, and a + // session whose roots were attached once (or inherited through resume or + // a bare fork) re-entered the TUI with zero indication that writes under + // any attached root are governed by this session's policy. Absent for a + // single-root session, matching the model-facing line's convention. + if let Some(roots) = workspace_roots_summary(app) { + push_row( + &mut out, + locale, + MessageId::StatusLabelWorkspaceRoots, + &roots, + ); + } push_row( &mut out, locale, @@ -273,12 +287,43 @@ fn push_row(out: &mut String, locale: Locale, label: MessageId, value: &str) { let _ = writeln!(out, " {label: Option { + const MAX_LISTED_ROOTS: usize = 5; + let additional: Vec = app + .workspace_roots + .iter() + .filter(|root| root.as_path() != app.workspace.as_path()) + .map(|root| display_path(root)) + .collect(); + if additional.is_empty() { + return None; + } + let remainder = additional.len().saturating_sub(MAX_LISTED_ROOTS); + let mut listed = additional + .into_iter() + .take(MAX_LISTED_ROOTS) + .collect::>() + .join(", "); + if remainder > 0 { + listed.push_str( + &tr(app.ui_locale, MessageId::WorkspaceRootsRemainder) + .replace("{count}", &remainder.to_string()), + ); + } + Some(listed) +} + fn safety_summary(app: &App) -> Cow<'static, str> { let policy = crate::core::authority::sandbox_policy_for_turn( app.mode, app.approval_mode, app.configured_sandbox_mode.as_deref(), &app.workspace, + &app.workspace_roots, crate::core::authority::SandboxNetworkAccess::from_config(app.configured_sandbox_network), ); // The policy is the intent; `sandbox_backend` is what this platform can @@ -920,4 +965,91 @@ mod tests { let tmpdir = TempDir::new().expect("temp dir"); assert_eq!(project_docs(tmpdir.path(), Locale::En), "no project docs"); } + + #[test] + fn status_report_names_the_accessible_root_set() { + let tmpdir = TempDir::new().expect("temp dir"); + let mut app = create_test_app(tmpdir.path().to_path_buf()); + + // A single-root session keeps the report unchanged: the Directory row + // already names the only accessible root. + let single = format_status(&app); + assert!(!single.contains("Accessible folders:")); + + let attached = TempDir::new().expect("attached dir"); + app.workspace_roots = vec![ + app.workspace.clone(), + attached.path().to_path_buf(), + PathBuf::from("/shared/telemetry"), + ]; + let multi = format_status(&app); + assert!( + multi.contains("Accessible folders:"), + "the live root set must be visible to the human: {multi}" + ); + assert!( + multi.contains(&display_path(attached.path())), + "attached roots are enumerated: {multi}" + ); + assert!(multi.contains("/shared/telemetry"), "{multi}"); + let roots_line = multi + .lines() + .find(|line| line.contains("Accessible folders:")) + .expect("roots row"); + assert!( + !roots_line.contains(&display_path(&app.workspace)), + "the primary is the Directory row's fact, not the enumeration's: {roots_line}" + ); + } + + #[test] + fn status_report_caps_the_root_enumeration() { + let tmpdir = TempDir::new().expect("temp dir"); + let mut app = create_test_app(tmpdir.path().to_path_buf()); + app.workspace_roots = (0..7) + .map(|index| PathBuf::from(format!("/shared/root-{index}"))) + .collect(); + let multi = format_status(&app); + assert!(multi.contains("/shared/root-4"), "{multi}"); + assert!(!multi.contains("/shared/root-5"), "{multi}"); + assert!(multi.contains("(+2 more)"), "{multi}"); + } + + #[test] + fn workspace_roots_notice_only_fires_beside_the_primary() { + use crate::tui::ui::workspace_roots_notice; + + assert_eq!( + workspace_roots_notice(Locale::En, Path::new("/w"), &[]), + None + ); + assert_eq!( + workspace_roots_notice(Locale::En, Path::new("/w"), &[PathBuf::from("/w")]), + None, + "the primary alone is not a disclosure" + ); + let notice = workspace_roots_notice( + Locale::En, + Path::new("/w"), + &[PathBuf::from("/w"), PathBuf::from("/r2")], + ) + .expect("notice"); + assert!(notice.contains("Accessible folders beside /w"), "{notice}"); + assert!(notice.contains("/r2"), "{notice}"); + + // The disclosure is user-visible prose: a non-English locale must + // render its own pack, not the English template. + let japanese = workspace_roots_notice( + Locale::Ja, + Path::new("/w"), + &[PathBuf::from("/w"), PathBuf::from("/r2")], + ) + .expect("notice"); + assert!(japanese.contains("アクセス可能なフォルダ"), "{japanese}"); + assert!( + !japanese.contains("Accessible folders beside"), + "{japanese}" + ); + assert!(japanese.contains("/r2"), "{japanese}"); + } } diff --git a/crates/tui/src/commands/groups/core/core.rs b/crates/tui/src/commands/groups/core/core.rs index caf371354f..397cc247a7 100644 --- a/crates/tui/src/commands/groups/core/core.rs +++ b/crates/tui/src/commands/groups/core/core.rs @@ -180,6 +180,7 @@ pub fn clear(app: &mut App) -> CommandResult { system_prompt: None, model: app.model.clone(), workspace: app.workspace.clone(), + workspace_roots: Vec::new(), mode: app.mode, }, ) diff --git a/crates/tui/src/commands/groups/debug/tests.rs b/crates/tui/src/commands/groups/debug/tests.rs index 0023ea9fdb..5e8a871dca 100644 --- a/crates/tui/src/commands/groups/debug/tests.rs +++ b/crates/tui/src/commands/groups/debug/tests.rs @@ -1307,6 +1307,110 @@ fn test_patch_undo_requests_session_resync_after_restore() { )); } +#[test] +fn test_patch_undo_with_attached_roots_names_rollback_boundary() { + // Snapshots are primary-bound (M15-3): with attached roots the /undo + // report and transcript cell must name the boundary instead of implying + // every accessible root was reverted. Single-root wording is untouched. + use crate::snapshot::SnapshotRepo; + use crate::test_support::lock_test_env; + use tempfile::tempdir; + + struct HomeGuard { + prev: Option, + _lock: crate::test_support::TestEnvLock, + } + + impl Drop for HomeGuard { + fn drop(&mut self) { + // SAFETY: process-wide lock still held. + unsafe { + match self.prev.take() { + Some(v) => std::env::set_var("HOME", v), + None => std::env::remove_var("HOME"), + } + } + } + } + + fn scoped_home(home: &std::path::Path) -> HomeGuard { + let lock = lock_test_env(); + let prev = std::env::var_os("HOME"); + // SAFETY: serialized by the global env lock. + unsafe { + std::env::set_var("HOME", home); + } + HomeGuard { prev, _lock: lock } + } + + let tmp = tempdir().unwrap(); + let workspace = tmp.path().join("ws"); + let attached = tmp.path().join("attached"); + std::fs::create_dir_all(&workspace).unwrap(); + std::fs::create_dir_all(&attached).unwrap(); + let _guard = scoped_home(tmp.path()); + + let repo = SnapshotRepo::open_or_init(&workspace).unwrap(); + std::fs::write(workspace.join("a.txt"), b"original").unwrap(); + repo.snapshot_with_session("pre-turn:1", Some("test-session")) + .unwrap(); + std::fs::write(workspace.join("a.txt"), b"modified").unwrap(); + + let mut app = create_test_app(); + app.workspace = workspace.clone(); + app.workspace_roots = vec![attached]; + app.yolo = true; + app.current_session_id = Some("test-session".to_string()); + + let result = patch_undo(&mut app); + + assert!(!result.is_error); + let message = result.message.expect("undo summary"); + assert!( + message.contains(crate::snapshot::ATTACHED_ROOTS_NOT_REVERTED_NOTE), + "{message}" + ); + let cell = app + .history + .iter() + .find_map(|cell| match cell { + HistoryCell::System { content } => Some(content.as_str()), + _ => None, + }) + .expect("transcript cell"); + assert!( + cell.contains(crate::snapshot::ATTACHED_ROOTS_NOT_REVERTED_NOTE), + "{cell}" + ); + assert!(!cell.contains("/undo reverted workspace to"), "{cell}"); + + // Single-root report stays byte-identical: no boundary clause. + std::fs::write(workspace.join("a.txt"), b"again").unwrap(); + let mut single = create_test_app(); + single.workspace = workspace.clone(); + single.yolo = true; + single.current_session_id = Some("test-session".to_string()); + let single_result = patch_undo(&mut single); + assert!(!single_result.is_error); + let single_message = single_result.message.expect("undo summary"); + assert!( + !single_message.contains(crate::snapshot::ATTACHED_ROOTS_NOT_REVERTED_NOTE), + "{single_message}" + ); + let single_cell = single + .history + .iter() + .find_map(|cell| match cell { + HistoryCell::System { content } => Some(content.as_str()), + _ => None, + }) + .expect("transcript cell"); + assert!( + single_cell.contains("/undo reverted workspace to snapshot"), + "{single_cell}" + ); +} + #[test] fn test_undo_legacy_chain_falls_back_to_conversation_only() { use crate::snapshot::SnapshotRepo; diff --git a/crates/tui/src/commands/groups/debug/undo.rs b/crates/tui/src/commands/groups/debug/undo.rs index d77c957654..01a853b0da 100644 --- a/crates/tui/src/commands/groups/debug/undo.rs +++ b/crates/tui/src/commands/groups/debug/undo.rs @@ -234,16 +234,26 @@ pub fn patch_undo(app: &mut App) -> CommandResult { .unwrap_or(None); let short = &target.id.as_str()[..target.id.as_str().len().min(8)]; + // The snapshot side-repo is rooted at the primary workspace: with + // attached roots in the session set, name the rollback boundary instead + // of implying every accessible root was reverted. + let primary_only = + crate::snapshot::restore_covers_primary_only(&app.workspace, &app.workspace_roots); + let boundary_note = if primary_only { + format!("\n{}", crate::snapshot::ATTACHED_ROOTS_NOT_REVERTED_NOTE) + } else { + String::new() + }; let summary = match diff_stat { Some(ref stat) => { format!( - "Restored snapshot '{}' ({}). Files affected:\n{stat}", + "Restored snapshot '{}' ({}). Files affected:\n{stat}{boundary_note}", target.label, short ) } None => { format!( - "Restored snapshot '{}' ({}). No diff changes detected.", + "Restored snapshot '{}' ({}). No diff changes detected.{boundary_note}", target.label, short ) } @@ -251,10 +261,19 @@ pub fn patch_undo(app: &mut App) -> CommandResult { // Post a system cell so the reverted state is visible in the transcript. app.push_history_cell(HistoryCell::System { - content: format!( - "/undo reverted workspace to snapshot '{}' ({})", - target.label, short - ), + content: if primary_only { + format!( + "/undo reverted the primary workspace to snapshot '{}' ({}). {}", + target.label, + short, + crate::snapshot::ATTACHED_ROOTS_NOT_REVERTED_NOTE + ) + } else { + format!( + "/undo reverted workspace to snapshot '{}' ({})", + target.label, short + ) + }, }); CommandResult::with_message_and_action( @@ -265,6 +284,7 @@ pub fn patch_undo(app: &mut App) -> CommandResult { system_prompt: app.system_prompt.clone(), model: app.model.clone(), workspace: app.workspace.clone(), + workspace_roots: app.workspace_roots.clone(), mode: app.mode, }, ) diff --git a/crates/tui/src/commands/groups/session/rename.rs b/crates/tui/src/commands/groups/session/rename.rs index c013110c58..18446960a4 100644 --- a/crates/tui/src/commands/groups/session/rename.rs +++ b/crates/tui/src/commands/groups/session/rename.rs @@ -115,6 +115,14 @@ pub(crate) fn rename_with_manager( .metadata .set_model_provider_route(app.api_provider.as_str(), app.provider_id_for_persistence()); session.metadata.workspace.clone_from(&app.workspace); + // The paired set travels with the workspace it belongs to. Syncing only + // the primary would let a `/rename` after a `/cd` whose direct save + // failed rewrite `workspace: new` next to the stale pre-switch set — + // resurrecting the abandoned directory on the next resume. + session + .metadata + .workspace_roots + .clone_from(&app.workspace_roots); session.metadata.mode = Some(app.mode.as_setting().to_string()); app.sync_cost_to_metadata(&mut session.metadata); session.metadata.title = new_title.to_string(); @@ -154,17 +162,23 @@ pub(crate) fn live_session_before_first_snapshot( if let Ok(Some(checkpoint)) = manager.load_session_checkpoint(session_id) { return Some(checkpoint); } - Some( - crate::session_manager::create_saved_session_with_id_and_mode( - session_id.to_string(), - &app.api_messages, - &app.model_selection_for_persistence(), - &app.workspace, - u64::from(app.session.total_tokens), - app.system_prompt.as_ref(), - Some(app.mode.as_setting()), - ), - ) + let mut rebuilt = crate::session_manager::create_saved_session_with_id_and_mode( + session_id.to_string(), + &app.api_messages, + &app.model_selection_for_persistence(), + &app.workspace, + u64::from(app.session.total_tokens), + app.system_prompt.as_ref(), + Some(app.mode.as_setting()), + ); + // The rebuilt document pairs `workspace` with the live root set, exactly + // like `build_session_snapshot`; a roots-blind rebuild would persist a + // workspace whose primary root is still the previous directory. + rebuilt + .metadata + .workspace_roots + .clone_from(&app.workspace_roots); + Some(rebuilt) } #[cfg(test)] @@ -382,6 +396,69 @@ mod tests { assert_eq!(persisted.messages.len(), 1); } + #[test] + fn rename_stamps_the_live_workspace_roots() { + let tmp = TempDir::new().unwrap(); + let manager = make_session_manager(&tmp); + let mut app = make_app(&tmp); + let new_workspace = tmp.path().join("after-cd"); + let shared = tmp.path().join("shared"); + let mut session = create_saved_session_with_mode( + &[], + "deepseek-v4-pro", + &tmp.path().join("before-cd"), + 0, + None, + None, + ); + session.metadata.id = "rename-roots".to_string(); + // The disk record still carries the pre-`/cd` pair, the shape a + // failed direct save leaves behind. + session.metadata.workspace_roots = vec![tmp.path().join("before-cd"), shared.clone()]; + manager.save_session(&session).unwrap(); + + app.current_session_id = Some("rename-roots".to_string()); + app.workspace = new_workspace.clone(); + app.workspace_roots = vec![new_workspace.clone(), shared.clone()]; + + let result = rename_with_manager("Rooted Rename", "rename-roots", &manager, &mut app); + assert!(!result.is_error, "{result:?}"); + + let reloaded = manager.load_session("rename-roots").unwrap(); + assert_eq!(reloaded.metadata.workspace, new_workspace); + assert_eq!( + reloaded.metadata.workspace_roots, + vec![new_workspace, shared], + "a /rename save must pair the new workspace with the live root set, \ + or the abandoned directory re-enters on the next resume" + ); + } + + // Same stamp on the rebuild path: nothing persisted yet, so the document + // is constructed from in-memory App state and must carry the live set. + #[test] + fn rename_mid_first_turn_rebuild_stamps_the_live_workspace_roots() { + let tmp = TempDir::new().unwrap(); + let manager = make_session_manager(&tmp); + let mut app = make_app(&tmp); + + let session_id = "live-rebuild-roots"; + let shared = tmp.path().join("shared"); + app.current_session_id = Some(session_id.to_string()); + app.api_messages = vec![user_message("turn one, nothing persisted yet")]; + app.workspace_roots = vec![app.workspace.clone(), shared.clone()]; + + let result = rename_with_manager("Rebuilt Roots", session_id, &manager, &mut app); + assert!(!result.is_error, "{result:?}"); + + let persisted = manager.load_session(session_id).unwrap(); + assert_eq!( + persisted.metadata.workspace_roots, + vec![app.workspace.clone(), shared], + "the rebuilt document must pair the workspace with the live root set" + ); + } + fn user_message(text: &str) -> crate::models::Message { crate::models::Message { role: Role::User, diff --git a/crates/tui/src/commands/groups/session/resume.rs b/crates/tui/src/commands/groups/session/resume.rs index cb0846b3c7..72457d661b 100644 --- a/crates/tui/src/commands/groups/session/resume.rs +++ b/crates/tui/src/commands/groups/session/resume.rs @@ -113,6 +113,14 @@ fn import_container( app.current_session_id = Some(new_id.clone()); app.current_session_metadata = Some(imported.metadata.clone()); app.api_messages = imported.messages.clone(); + // The import is a fresh session in the current workspace, so the live + // root set is re-pointed with it. Leaving the previous session's set in + // place would let the next autosave stamp it onto the imported record — + // durable roots bleed across sessions that never shared a directory. + app.workspace_roots = codewhale_core::normalize_workspace_roots( + &imported.metadata.workspace, + &imported.metadata.workspace_roots, + ); app.view_stack.push(SessionPickerView::new_selecting( &app.workspace, app.ui_locale, diff --git a/crates/tui/src/commands/groups/session/session.rs b/crates/tui/src/commands/groups/session/session.rs index e7350af888..12b8c4ee34 100644 --- a/crates/tui/src/commands/groups/session/session.rs +++ b/crates/tui/src/commands/groups/session/session.rs @@ -40,6 +40,14 @@ pub fn save(app: &mut App, path: Option<&str>) -> CommandResult { Err(err) => return CommandResult::error(format!("Failed to snapshot Work state: {err}")), }; session.last_auto_route = app.auto_route_for_persistence(); + // Stamp the live root set before the write, exactly like the fork paths + // and `build_session_snapshot`: the freshly built metadata carries an + // empty set, and an explicit-path `/save` has no later autosave to heal + // it — `/save` followed by quit durably degrades a multi-root session. + session + .metadata + .workspace_roots + .clone_from(&app.workspace_roots); let save_path = explicit_save_path.unwrap_or_else(|| { let dir = crate::session_manager::default_sessions_dir() .unwrap_or_else(|_| app.workspace.clone()); @@ -147,6 +155,35 @@ pub fn fork_from_session(app: &mut App, session_id_or_prefix: &str) -> CommandRe forked.artifacts = source_session.artifacts.clone(); forked.work_state = source_session.work_state.clone(); forked.last_auto_route = source_session.last_auto_route.clone(); + // The fork is anchored to the current workspace, so it takes the same + // primary-swap semantics `/cd` and the runtime PATCH workspace-only + // branch apply: the source's primary directory leaves the set — it is + // not this fork's directory — and the source's additional roots survive, + // re-normalized against the fork's own workspace. Stamping the source + // set verbatim would persist `workspace: ` next to a set led by + // the abandoned directory, which engine-side normalization then re-admits + // as a writable root on the next resume. + let additional_roots: Vec = source_session + .metadata + .workspace_roots + .iter() + .filter(|root| **root != source_session.metadata.workspace) + .cloned() + .collect(); + // Round-20 should-fix 1: same intake rule as /cd and the runtime lanes — + // a re-based set that widens past the fork's primary must not persist. + forked.metadata.workspace_roots = match codewhale_core::validate_workspace_roots( + &app.workspace, + &additional_roots, + ) { + Ok(roots) => roots, + Err(err) => { + return CommandResult::error(format!( + "Cannot fork: the source root set re-based onto {} would widen past it ({err:#}). Re-declare the roots on the fork.", + app.workspace.display() + )); + } + }; if let Err(err) = manager.save_session(&forked) { return CommandResult::error(format!("Failed to save forked session: {err}")); } @@ -171,6 +208,7 @@ pub fn fork_from_session(app: &mut App, session_id_or_prefix: &str) -> CommandRe .map(|s| crate::models::SystemPrompt::Text(s.clone())), model: forked.metadata.model.clone(), workspace: app.workspace.clone(), + workspace_roots: forked.metadata.workspace_roots.clone(), mode: app.mode, }, ) @@ -223,6 +261,11 @@ pub fn fork(app: &mut App) -> CommandResult { .clone_from(&cached.parent_session_id); parent.metadata.forked_from_message_count = cached.forked_from_message_count; } + // The freshly constructed metadata has empty roots; the live App state + // is the current set for this session (it supersedes the cached copy, + // which the App itself wrote at the last snapshot). Stamp it before the + // save for the same durable-erasure reason as above. + parent.metadata.workspace_roots = app.workspace_roots.clone(); app.sync_cost_to_metadata(&mut parent.metadata); parent.context_references = app.session_context_references.clone(); parent.artifacts = app.session_artifacts.clone(); @@ -258,6 +301,7 @@ pub fn fork(app: &mut App) -> CommandResult { j.spawn_depth = parent.metadata.spawn_depth; } forked.metadata.mark_forked_from(&parent.metadata); + forked.metadata.workspace_roots = parent.metadata.workspace_roots.clone(); forked.context_references = app.session_context_references.clone(); forked.artifacts = app.session_artifacts.clone(); forked.work_state = work_state; @@ -289,6 +333,7 @@ pub fn fork(app: &mut App) -> CommandResult { system_prompt: app.system_prompt.clone(), model: app.model.clone(), workspace: app.workspace.clone(), + workspace_roots: parent.metadata.workspace_roots.clone(), mode: app.mode, }, ) @@ -351,6 +396,7 @@ pub fn new_session(app: &mut App, arg: Option<&str>) -> CommandResult { system_prompt: None, model: app.model.clone(), workspace: app.workspace.clone(), + workspace_roots: Vec::new(), mode: app.mode, }, ) @@ -664,6 +710,73 @@ mod tests { ); } + #[test] + fn save_stamps_the_live_workspace_roots() { + let tmpdir = TempDir::new().unwrap(); + let mut app = create_test_app_with_tmpdir(&tmpdir); + let save_path = tmpdir.path().join("roots_session.json"); + app.workspace_roots = vec![app.workspace.clone(), tmpdir.path().join("shared")]; + + let result = save(&mut app, Some(save_path.to_str().unwrap())); + + assert!(!result.is_error, "{:?}", result.message); + let saved: crate::session_manager::SavedSession = + serde_json::from_str(&std::fs::read_to_string(&save_path).unwrap()).unwrap(); + assert_eq!( + saved.metadata.workspace_roots, + vec![app.workspace.clone(), tmpdir.path().join("shared")], + "an explicit-path /save must persist the live set, or /save-then-quit degrades it" + ); + assert_eq!(saved.metadata.workspace, app.workspace); + } + + #[test] + fn fork_from_session_swaps_the_primary_and_keeps_additional_roots() { + let tmpdir = TempDir::new().unwrap(); + let _lock = crate::test_support::lock_test_env(); + let home = tmpdir.path().join("home"); + std::fs::create_dir_all(&home).unwrap(); + let home_guard = EnvVarGuard::set("HOME", &home); + let mut app = create_test_app_with_tmpdir(&tmpdir); + app.workspace = tmpdir.path().join("current"); + app.workspace_roots = vec![app.workspace.clone()]; + + let manager = crate::session_manager::SessionManager::default_location().unwrap(); + let abandoned = tmpdir.path().join("abandoned"); + let shared = tmpdir.path().join("shared"); + let mut source = create_saved_session_with_id_and_mode( + "source-session".to_string(), + &[crate::models::Message { + role: Role::User, + content: vec![crate::models::ContentBlock::Text { + text: "fork me elsewhere".to_string(), + cache_control: None, + }], + }], + &app.model, + &abandoned, + 0, + None, + Some(app.mode.label()), + ); + source.metadata.workspace_roots = vec![abandoned.clone(), shared.clone()]; + manager.save_session(&source).unwrap(); + + let result = fork_from_session(&mut app, "source-session"); + + assert!(!result.is_error, "{:?}", result.message); + let fork = manager + .load_session(app.current_session_id.as_deref().expect("fork id")) + .expect("fork persisted"); + assert_eq!(fork.metadata.workspace, app.workspace); + assert_eq!( + fork.metadata.workspace_roots, + vec![app.workspace.clone(), shared], + "the fork's primary is its own workspace; the abandoned primary must not re-enter" + ); + drop(home_guard); + } + #[test] fn fork_saves_parent_and_switches_to_child_session() { let tmpdir = TempDir::new().unwrap(); @@ -774,6 +887,56 @@ mod tests { assert_eq!(std::env::var_os("HOME"), previous_home); } + #[test] + fn fork_stamps_the_live_workspace_roots() { + let tmpdir = TempDir::new().unwrap(); + let _lock = crate::test_support::lock_test_env(); + let home = tmpdir.path().join("home"); + std::fs::create_dir_all(&home).unwrap(); + let home_guard = EnvVarGuard::set("HOME", &home); + let mut app = create_test_app_with_tmpdir(&tmpdir); + app.current_session_id = Some("parent-roots".to_string()); + let shared = tmpdir.path().join("shared"); + app.workspace_roots = vec![app.workspace.clone(), shared.clone()]; + app.api_messages.push(crate::models::Message { + role: Role::User, + content: vec![crate::models::ContentBlock::Text { + text: "fork with roots".to_string(), + cache_control: None, + }], + }); + + let result = fork(&mut app); + + assert!(!result.is_error, "{:?}", result.message); + let manager = crate::session_manager::SessionManager::default_location().unwrap(); + let expected = vec![app.workspace.clone(), shared]; + let parent = manager.load_session("parent-roots").expect("parent saved"); + assert_eq!( + parent.metadata.workspace_roots, expected, + "the /fork parent save must persist the live set, or the fork's own \ + save degrades it on the next snapshot" + ); + let fork_id = app.current_session_id.clone().expect("fork session id"); + let child = manager.load_session(&fork_id).expect("child saved"); + assert_eq!( + child.metadata.workspace_roots, expected, + "the forked session inherits the parent's live set" + ); + match result.action { + Some(AppAction::SyncSession { + workspace_roots, .. + }) => { + assert_eq!( + workspace_roots, expected, + "the SyncSession handoff carries the same set the fork persisted" + ); + } + other => panic!("fork must hand off a SyncSession, got {other:?}"), + } + drop(home_guard); + } + #[test] fn fork_rejects_active_runtime_without_switching_sessions() { let tmpdir = TempDir::new().unwrap(); diff --git a/crates/tui/src/commands/groups/session/title.rs b/crates/tui/src/commands/groups/session/title.rs index fffa928214..7dfb02f88d 100644 --- a/crates/tui/src/commands/groups/session/title.rs +++ b/crates/tui/src/commands/groups/session/title.rs @@ -160,6 +160,15 @@ pub(crate) fn set_window_title_with_manager( .metadata .set_model_provider_route(app.api_provider.as_str(), app.provider_id_for_persistence()); session.metadata.workspace.clone_from(&app.workspace); + // The paired set travels with the workspace it belongs to, exactly as in + // `/rename`: syncing only the primary would let a `/title` after a `/cd` + // whose direct save failed rewrite `workspace: new` next to the stale + // pre-switch set — and `/title` then quit is durable, since no turn + // checkpoint follows to heal it. + session + .metadata + .workspace_roots + .clone_from(&app.workspace_roots); session.metadata.mode = Some(app.mode.as_setting().to_string()); app.sync_cost_to_metadata(&mut session.metadata); session.window_title = title.clone(); @@ -248,6 +257,45 @@ mod tests { assert_eq!(reloaded.metadata.title, "Original Name"); } + #[test] + fn set_title_stamps_the_live_workspace_roots() { + let tmp = TempDir::new().unwrap(); + let manager = make_session_manager(&tmp); + let mut app = make_app(&tmp); + let new_workspace = tmp.path().join("after-cd"); + let shared = tmp.path().join("shared"); + let mut session = create_saved_session_with_mode( + &[], + "deepseek-v4-pro", + &tmp.path().join("before-cd"), + 0, + None, + None, + ); + session.metadata.id = "title-roots".to_string(); + // The disk record still carries the pre-`/cd` pair, the shape a + // failed direct save leaves behind. + session.metadata.workspace_roots = vec![tmp.path().join("before-cd"), shared.clone()]; + manager.save_session(&session).unwrap(); + + app.current_session_id = Some("title-roots".to_string()); + app.workspace = new_workspace.clone(); + app.workspace_roots = vec![new_workspace.clone(), shared.clone()]; + + let result = + set_window_title_with_manager(&mut app, Some("after-cd-task".to_string()), &manager); + assert!(!result.is_error, "unexpected error: {:?}", result.message); + + let reloaded = manager.load_session("title-roots").unwrap(); + assert_eq!(reloaded.metadata.workspace, new_workspace); + assert_eq!( + reloaded.metadata.workspace_roots, + vec![new_workspace, shared], + "a /title save must pair the new workspace with the live root set, \ + or the abandoned directory re-enters on the next resume" + ); + } + #[test] fn clear_title_removes_the_session_level_title() { let tmp = TempDir::new().unwrap(); diff --git a/crates/tui/src/commands/groups/skills/restore.rs b/crates/tui/src/commands/groups/skills/restore.rs index e77223987d..639c39b069 100644 --- a/crates/tui/src/commands/groups/skills/restore.rs +++ b/crates/tui/src/commands/groups/skills/restore.rs @@ -132,11 +132,20 @@ fn restore(group: &mut dyn CommandSkillGroupContext, arg: Option<&str>) -> Comma return CommandResult::error(err); } - CommandResult::message(format!( - "Restored snapshot #{n} ('{}', {}). Workspace files have been reverted; conversation history is unchanged.", - target.label, - short_sha(target.id.as_str()), - )) + CommandResult::message(if group.restore_covers_primary_only() { + format!( + "Restored snapshot #{n} ('{}', {}). {} Conversation history is unchanged.", + target.label, + short_sha(target.id.as_str()), + crate::snapshot::ATTACHED_ROOTS_NOT_REVERTED_NOTE, + ) + } else { + format!( + "Restored snapshot #{n} ('{}', {}). Workspace files have been reverted; conversation history is unchanged.", + target.label, + short_sha(target.id.as_str()), + ) + }) } fn parse_list_arg(arg: &str) -> Result, String> { @@ -212,6 +221,7 @@ mod tests { snapshots: Result, String>, restore: Result<(), String>, approval: CommandApprovalState, + primary_only: bool, } impl FakeSkillGroup { fn new(snapshots: Vec) -> Self { @@ -222,6 +232,7 @@ mod tests { yolo: true, trust_mode: false, }, + primary_only: false, } } } @@ -287,6 +298,9 @@ mod tests { fn restore_snapshot(&mut self, _id: &str) -> Result<(), String> { self.restore.clone() } + fn restore_covers_primary_only(&self) -> bool { + self.primary_only + } fn approval_state(&self) -> CommandApprovalState { self.approval } @@ -381,6 +395,34 @@ mod tests { assert!(result.message.unwrap().contains("Restored snapshot #2")); } + #[test] + fn restore_with_attached_roots_names_rollback_boundary() { + // Snapshots are primary-bound: with attached roots the report must + // say only the primary workspace was reverted instead of claiming a + // full rollback (M15-3). Single-root wording stays byte-identical. + let mut group = FakeSkillGroup::new(vec![snap("pre-turn:1", "11111111", 1_700_000_000)]); + group.primary_only = true; + let result = restore(&mut group, Some("1")); + assert!(!result.is_error); + let msg = result.message.unwrap(); + assert!( + msg.contains(crate::snapshot::ATTACHED_ROOTS_NOT_REVERTED_NOTE), + "{msg}" + ); + assert!(!msg.contains("Workspace files have been reverted"), "{msg}"); + + let mut single = FakeSkillGroup::new(vec![snap("pre-turn:1", "11111111", 1_700_000_000)]); + let single_msg = restore(&mut single, Some("1")).message.unwrap(); + assert!( + single_msg.contains("Workspace files have been reverted"), + "{single_msg}" + ); + assert!( + !single_msg.contains(crate::snapshot::ATTACHED_ROOTS_NOT_REVERTED_NOTE), + "{single_msg}" + ); + } + #[test] fn restore_outside_trust_mode_refuses() { let mut group = FakeSkillGroup::new(vec![snap("pre-turn:1", "11111111", 1_700_000_000)]); diff --git a/crates/tui/src/commands/groups/skills/review.rs b/crates/tui/src/commands/groups/skills/review.rs index 62543d3f74..f8eee92ab3 100644 --- a/crates/tui/src/commands/groups/skills/review.rs +++ b/crates/tui/src/commands/groups/skills/review.rs @@ -166,6 +166,9 @@ mod tests { fn restore_snapshot(&mut self, _id: &str) -> Result<(), String> { unimplemented!("not used by review tests") } + fn restore_covers_primary_only(&self) -> bool { + unimplemented!("not used by review tests") + } fn approval_state(&self) -> CommandApprovalState { self.approval } diff --git a/crates/tui/src/commands/groups/skills/skills.rs b/crates/tui/src/commands/groups/skills/skills.rs index 533c060d3a..6820a814a4 100644 --- a/crates/tui/src/commands/groups/skills/skills.rs +++ b/crates/tui/src/commands/groups/skills/skills.rs @@ -1039,6 +1039,9 @@ mod tests { fn restore_snapshot(&mut self, _id: &str) -> Result<(), String> { self.restore.clone() } + fn restore_covers_primary_only(&self) -> bool { + unimplemented!("not used by skills tests") + } fn approval_state(&self) -> CommandApprovalState { self.approval } diff --git a/crates/tui/src/config/tests.rs b/crates/tui/src/config/tests.rs index 86733f1886..c497345ff8 100644 --- a/crates/tui/src/config/tests.rs +++ b/crates/tui/src/config/tests.rs @@ -615,6 +615,7 @@ reason = "read_file is allowed" crate::tui::approval::ApprovalMode::Auto, true, None, + &[], ); let shell_decision = policy.evaluate(&shell_context); assert_eq!( @@ -630,6 +631,7 @@ reason = "read_file is allowed" crate::tui::approval::ApprovalMode::Auto, true, None, + &[], ); let read_decision = policy.evaluate(&read_context); assert_eq!( @@ -751,6 +753,7 @@ command = "cargo test" path: None, ask_for_approval: codewhale_execpolicy::AskForApproval::OnFailure, sandbox_mode: None, + workspace_roots: Vec::new(), }) .expect("check permission"); @@ -786,6 +789,7 @@ command = "npm test" path: None, ask_for_approval: codewhale_execpolicy::AskForApproval::OnFailure, sandbox_mode: None, + workspace_roots: Vec::new(), }) .expect("check permission"); diff --git a/crates/tui/src/core/authority.rs b/crates/tui/src/core/authority.rs index e03f055f7f..9e022126a9 100644 --- a/crates/tui/src/core/authority.rs +++ b/crates/tui/src/core/authority.rs @@ -210,6 +210,7 @@ impl TurnAuthority { pub(crate) fn sandbox_policy( &self, workspace: &Path, + workspace_roots: &[PathBuf], configured_mode: Option<&str>, network_access: SandboxNetworkAccess, ) -> SandboxPolicy { @@ -218,6 +219,7 @@ impl TurnAuthority { self.approval_mode_for_session(), configured_mode, workspace, + workspace_roots, network_access, ) } @@ -327,6 +329,7 @@ pub(crate) fn sandbox_policy_for_turn( approval_mode: ApprovalMode, configured_mode: Option<&str>, workspace: &Path, + workspace_roots: &[PathBuf], network_access: SandboxNetworkAccess, ) -> SandboxPolicy { let default = if mode == AppMode::Plan { @@ -334,7 +337,7 @@ pub(crate) fn sandbox_policy_for_turn( } else if approval_mode == ApprovalMode::Bypass { SandboxPolicy::DangerFullAccess } else { - workspace_write_policy(workspace, network_access) + workspace_write_policy(workspace, workspace_roots, network_access) }; // The effective Config has already applied managed/project precedence. @@ -343,7 +346,7 @@ pub(crate) fn sandbox_policy_for_turn( match (default, configured_mode) { (SandboxPolicy::ReadOnly, _) | (_, Some("read-only")) => SandboxPolicy::ReadOnly, (SandboxPolicy::DangerFullAccess, Some("workspace-write")) => { - workspace_write_policy(workspace, network_access) + workspace_write_policy(workspace, workspace_roots, network_access) } (SandboxPolicy::DangerFullAccess, Some("external-sandbox")) => { SandboxPolicy::ExternalSandbox { @@ -387,9 +390,21 @@ impl SandboxNetworkAccess { } } -fn workspace_write_policy(workspace: &Path, network_access: SandboxNetworkAccess) -> SandboxPolicy { +/// The per-turn materialization of the session's full workspace root set: +/// `workspace` stays the primary writable root and the normalized additional +/// roots follow it. An empty `workspace_roots` degenerates to `[workspace]`, +/// exactly the historical single-root policy. Every materialization point +/// (turn sandbox policy, tool context, exec-policy checks) normalizes +/// through `normalize_workspace_roots`, so a root-set change made while a +/// session is running takes effect on the next turn without rewriting +/// persisted rules or configuration. +fn workspace_write_policy( + workspace: &Path, + workspace_roots: &[PathBuf], + network_access: SandboxNetworkAccess, +) -> SandboxPolicy { SandboxPolicy::WorkspaceWrite { - writable_roots: vec![workspace.to_path_buf()], + writable_roots: codewhale_core::normalize_workspace_roots(workspace, workspace_roots), network_access: network_access.is_allowed(), exclude_tmpdir: false, exclude_slash_tmp: false, @@ -490,35 +505,68 @@ pub(crate) fn write_carve_out_posture( } /// Whether every target path of a file-write call qualifies for the -/// in-workspace write carve-out (#5185): the workspace is a git work tree, -/// each path resolves inside it, and none touches `.git` internals, runtime -/// state, or a sensitive file. +/// in-workspace write carve-out (#5185): an absolute path resolves inside at +/// least one workspace root (primary or additional); a relative path is +/// judged against the primary root alone, because execution resolves it +/// there (ToolContext::resolve_path). The qualifying root must be a git work +/// tree, and the path must touch no `.git` internals, runtime state, or +/// sensitive file. Every root is judged independently. +/// +/// The absolute/relative branch runs on the *untrimmed* spelling, exactly as +/// execution does (`ToolContext::resolve_path`): a leading-whitespace +/// absolute-looking target is joined onto the primary by the write tools, so +/// judging it as an absolute attached-root path would auto-approve a write +/// that lands somewhere else. /// /// The git work-tree marker is deliberate (the same shape as kimi-code's /// `git-cwd-write-approve` policy): the carve-out exists because /// version-controlled edits stay reviewable and recoverable, so a workspace /// without git keeps the modal. #[must_use] -pub(crate) fn paths_within_workspace_write_carve_out(workspace: &Path, paths: &[String]) -> bool { +pub(crate) fn paths_within_workspace_write_carve_out( + workspace: &Path, + workspace_roots: &[PathBuf], + paths: &[String], +) -> bool { if paths.is_empty() { return false; } + let roots = codewhale_core::normalize_workspace_roots(workspace, workspace_roots); + paths.iter().all(|raw| { + if Path::new(raw).is_absolute() { + roots + .iter() + .any(|root| carve_out_target_within_root(root, raw)) + } else { + // A relative target is joined onto the primary workspace at + // execution time, so approval must judge it there: qualifying it + // through an attached git root would let the write land in the + // non-git primary tree modal-free and defeat the carve-out's own + // reviewability rationale. + carve_out_target_within_root(workspace, raw) + } + }) +} + +fn carve_out_target_within_root(root: &Path, raw: &str) -> bool { // `.git` may be a directory (normal checkout) or a file (worktree or // submodule); either marks a git work tree. - if workspace.join(".git").symlink_metadata().is_err() { + if root.join(".git").symlink_metadata().is_err() { return false; } - let Ok(workspace_canonical) = workspace.canonicalize() else { + let Ok(root_canonical) = root.canonicalize() else { return false; }; - paths - .iter() - .all(|raw| carve_out_target_allowed(workspace, &workspace_canonical, raw)) + carve_out_target_allowed(root, &root_canonical, raw) } fn carve_out_target_allowed(workspace: &Path, workspace_canonical: &Path, raw: &str) -> bool { - let raw = raw.trim(); - if raw.is_empty() { + // The branch runs on the untrimmed spelling, matching both the caller's + // branch and execution's (`ToolContext::resolve_path`): trimming here + // would judge ` /abs/path` as an absolute out-of-tree path while the + // write lands at `/ /abs/path`, or the reverse. Trim decides only + // whether the target is empty. + if raw.trim().is_empty() { return false; } let raw_path = Path::new(raw); @@ -556,7 +604,7 @@ fn carve_out_target_allowed(workspace: &Path, workspace_canonical: &Path, raw: & /// Canonicalize the deepest existing ancestor of `candidate` and re-append /// the not-yet-existing tail, so write targets that do not exist yet still /// get a real-path check. -fn resolve_deepest_existing(candidate: &Path) -> Option { +pub(crate) fn resolve_deepest_existing(candidate: &Path) -> Option { let mut ancestor = candidate; let mut suffix: Vec<&OsStr> = Vec::new(); loop { @@ -749,7 +797,7 @@ mod tests { vec!["src/main.rs".to_string(), "src/other.rs".to_string()], ] { assert!( - paths_within_workspace_write_carve_out(workspace, &paths), + paths_within_workspace_write_carve_out(workspace, &[], &paths), "{paths:?} should qualify" ); } @@ -776,7 +824,7 @@ mod tests { vec!["src/main.rs".to_string(), ".env".to_string()], ] { assert!( - !paths_within_workspace_write_carve_out(workspace, &paths), + !paths_within_workspace_write_carve_out(workspace, &[], &paths), "{paths:?} must keep the modal" ); } @@ -787,6 +835,7 @@ mod tests { let tmp = tempfile::tempdir().expect("tempdir"); assert!(!paths_within_workspace_write_carve_out( tmp.path(), + &[], &["src/main.rs".to_string()] )); } @@ -794,7 +843,227 @@ mod tests { #[test] fn carve_out_rejects_empty_target_list() { let tmp = carve_out_workspace(); - assert!(!paths_within_workspace_write_carve_out(tmp.path(), &[])); + assert!(!paths_within_workspace_write_carve_out( + tmp.path(), + &[], + &[] + )); + } + + #[test] + fn workspace_write_policy_materializes_additional_roots() { + let workspace = Path::new("/work"); + let agent = authority(AppMode::Agent, false, ApprovalMode::Suggest); + let roots = vec![PathBuf::from("/shared"), PathBuf::from("/work")]; + + let policy = + agent.sandbox_policy(workspace, &roots, None, SandboxNetworkAccess::Restricted); + let SandboxPolicy::WorkspaceWrite { writable_roots, .. } = policy else { + panic!("agent posture must stay workspace-write"); + }; + assert_eq!( + writable_roots, + vec![PathBuf::from("/work"), PathBuf::from("/shared")], + "the primary root stays first and duplicates are removed" + ); + + // An empty root set is byte-identical to the historical single-root + // policy. + let single = agent.sandbox_policy(workspace, &[], None, SandboxNetworkAccess::Restricted); + let SandboxPolicy::WorkspaceWrite { + writable_roots: single_roots, + .. + } = single + else { + panic!("agent posture must stay workspace-write"); + }; + assert_eq!(single_roots, vec![workspace.to_path_buf()]); + } + + #[test] + fn carve_out_spans_additional_roots_independently() { + let primary = carve_out_workspace(); + let shared = carve_out_workspace(); + let no_git = tempfile::tempdir().expect("no-git tempdir"); + let roots = vec![shared.path().to_path_buf(), no_git.path().to_path_buf()]; + let workspace = primary.path(); + + // A target inside an additional git work tree qualifies, named + // relative to that root. + assert!(paths_within_workspace_write_carve_out( + workspace, + &roots, + &[shared + .path() + .join("src/main.rs") + .to_string_lossy() + .into_owned()], + )); + + // A root without a git work tree never qualifies, even for paths + // inside it. + assert!(!paths_within_workspace_write_carve_out( + workspace, + &roots, + &[no_git + .path() + .join("src/main.rs") + .to_string_lossy() + .into_owned()], + )); + + // Excluded names stay excluded under every root. + assert!(!paths_within_workspace_write_carve_out( + workspace, + &roots, + &[shared.path().join(".env").to_string_lossy().into_owned()], + )); + assert!(!paths_within_workspace_write_carve_out( + workspace, + &roots, + &[shared + .path() + .join(".git/config") + .to_string_lossy() + .into_owned()], + )); + } + + #[test] + fn carve_out_relative_target_keeps_modal_when_only_attached_root_has_git() { + // Execution joins a relative target onto the primary workspace, so a + // git work tree among the additional roots must not qualify a + // relative write into the non-git primary tree: approval judges the + // relative target against the primary root alone and keeps the + // modal. + let primary = tempfile::tempdir().expect("tempdir"); + std::fs::create_dir_all(primary.path().join("src")).expect("primary src dir"); + let attached = carve_out_workspace(); + + assert!(!paths_within_workspace_write_carve_out( + primary.path(), + &[attached.path().to_path_buf()], + &["src/main.rs".to_string()], + )); + + // The same target spelled absolutely inside the attached git root + // still qualifies: absolute targets are judged against every root. + assert!(paths_within_workspace_write_carve_out( + primary.path(), + &[attached.path().to_path_buf()], + &[attached + .path() + .join("src/main.rs") + .to_string_lossy() + .into_owned()], + )); + } + + #[test] + fn forkguard_workspace_roots_carve_out_spans_attached_roots() { + let primary = carve_out_workspace(); + let attached = carve_out_workspace(); + let roots = vec![attached.path().to_path_buf()]; + + // A write target inside the attached git work tree takes the + // carve-out exactly as a primary-root target would. + assert!(paths_within_workspace_write_carve_out( + primary.path(), + &roots, + &[attached + .path() + .join("src/main.rs") + .to_string_lossy() + .into_owned()], + )); + + // The excluded names keep the modal inside attached roots too. + for target in [".env", ".git/config", ".codewhale/mcp.json"] { + assert!( + !paths_within_workspace_write_carve_out( + primary.path(), + &roots, + &[attached.path().join(target).to_string_lossy().into_owned()], + ), + "{target} must stay excluded under an attached root" + ); + } + } + + #[test] + fn forkguard_workspace_roots_carve_out_branches_on_the_untrimmed_spelling() { + // Judgment branches exactly as execution does (`resolve_path`): a + // leading-whitespace absolute-looking target is a *relative* path to + // the write tools, joined onto the primary. Judging it on its trimmed + // spelling would let it qualify through an attached git root + // modal-free while the write lands under the primary — the exact + // reviewability gap the carve-out's primary-only relative rule + // exists to prevent. + let primary = tempfile::tempdir().expect("non-git primary"); + std::fs::create_dir_all(primary.path().join("src")).expect("primary src dir"); + let attached = carve_out_workspace(); + let roots = vec![attached.path().to_path_buf()]; + + let whitespace_prefixed = format!(" {}", attached.path().join("src/main.rs").display()); + assert!( + !paths_within_workspace_write_carve_out(primary.path(), &roots, &[whitespace_prefixed],), + "a whitespace-prefixed absolute-looking target must keep the modal" + ); + + // The trimmed spelling stays qualified: trimming decides nothing but + // emptiness at the inner guard. + assert!(paths_within_workspace_write_carve_out( + primary.path(), + &roots, + &[attached + .path() + .join("src/main.rs") + .to_string_lossy() + .into_owned()], + )); + } + + #[test] + fn forkguard_workspace_roots_sandbox_materializes_every_root() { + let primary = tempfile::tempdir().expect("primary"); + let attached = tempfile::tempdir().expect("attached"); + let roots = vec![attached.path().to_path_buf()]; + let policy = authority(AppMode::Agent, false, ApprovalMode::Suggest).sandbox_policy( + primary.path(), + &roots, + None, + SandboxNetworkAccess::Restricted, + ); + + let writable: Vec = policy + .get_writable_roots(primary.path()) + .into_iter() + .map(|root| root.root) + .collect(); + let primary_canonical = primary.path().canonicalize().expect("canonical primary"); + let attached_canonical = attached.path().canonicalize().expect("canonical attached"); + // `get_writable_roots` canonicalizes every root it enumerates (on + // macOS the raw tempdir spelling and its `/private/var` reality + // differ), so the canonical form is the guarantee under test. + for expected in [primary_canonical, attached_canonical] { + assert!( + writable.contains(&expected), + "writable roots {writable:?} must contain {expected:?}" + ); + } + + // Empty root set materializes exactly the historical single-root + // policy value. + let single = authority(AppMode::Agent, false, ApprovalMode::Suggest).sandbox_policy( + Path::new("/work"), + &[], + None, + SandboxNetworkAccess::Restricted, + ); + let SandboxPolicy::WorkspaceWrite { writable_roots, .. } = single else { + panic!("agent posture must stay workspace-write"); + }; + assert_eq!(writable_roots, vec![PathBuf::from("/work")]); } #[cfg(unix)] @@ -805,6 +1074,7 @@ mod tests { std::os::unix::fs::symlink(outside.path(), tmp.path().join("link")).expect("symlink"); assert!(!paths_within_workspace_write_carve_out( tmp.path(), + &[], &["link/evil.rs".to_string()] )); // A symlink that stays inside the workspace is fine. @@ -812,6 +1082,7 @@ mod tests { .expect("inner symlink"); assert!(paths_within_workspace_write_carve_out( tmp.path(), + &[], &["src-link/main.rs".to_string()] )); } @@ -822,23 +1093,25 @@ mod tests { let full_access = authority(AppMode::Agent, true, ApprovalMode::Bypass); assert_eq!( - full_access.sandbox_policy(workspace, None, SandboxNetworkAccess::Restricted), + full_access.sandbox_policy(workspace, &[], None, SandboxNetworkAccess::Restricted), SandboxPolicy::DangerFullAccess ); // Clamping full-access down to workspace-write must land on the same // restricted posture an ordinary Agent turn gets, not on a wider one. assert!(matches!( - full_access.sandbox_policy( - workspace, - Some("workspace-write"), - SandboxNetworkAccess::Restricted - ), - SandboxPolicy::WorkspaceWrite { writable_roots, network_access, .. } - if writable_roots == vec![workspace.to_path_buf()] && !network_access - )); + full_access.sandbox_policy( + workspace, + &[], + Some("workspace-write"), + SandboxNetworkAccess::Restricted + ), + SandboxPolicy::WorkspaceWrite { writable_roots, network_access, .. } + if writable_roots == vec![workspace.to_path_buf()] && !network_access + )); assert_eq!( full_access.sandbox_policy( workspace, + &[], Some("read-only"), SandboxNetworkAccess::Restricted ), @@ -849,6 +1122,7 @@ mod tests { assert!(matches!( full_access.sandbox_policy( workspace, + &[], Some("external-sandbox"), SandboxNetworkAccess::Restricted ), @@ -859,6 +1133,7 @@ mod tests { assert!(matches!( full_access.sandbox_policy( workspace, + &[], Some("external-sandbox"), SandboxNetworkAccess::Allowed ), @@ -879,8 +1154,12 @@ mod tests { ] { for configured in [None, Some("workspace-write"), Some("danger-full-access")] { let auth = authority(AppMode::Agent, false, approval_mode); - let policy = - auth.sandbox_policy(workspace, configured, SandboxNetworkAccess::Restricted); + let policy = auth.sandbox_policy( + workspace, + &[], + configured, + SandboxNetworkAccess::Restricted, + ); assert!( !policy.has_network_access(), "{approval_mode:?}/{configured:?} leaked network: {policy:?}" @@ -892,7 +1171,7 @@ mod tests { // semantics: DangerFullAccess reports network regardless of this key, // because it applies no sandbox at all. let bypass = authority(AppMode::Agent, true, ApprovalMode::Bypass); - let policy = bypass.sandbox_policy(workspace, None, SandboxNetworkAccess::Restricted); + let policy = bypass.sandbox_policy(workspace, &[], None, SandboxNetworkAccess::Restricted); assert_eq!(policy, SandboxPolicy::DangerFullAccess); assert!(policy.has_network_access()); @@ -904,7 +1183,7 @@ mod tests { ] { assert!( !plan - .sandbox_policy(workspace, None, access) + .sandbox_policy(workspace, &[], None, access) .has_network_access() ); } @@ -938,6 +1217,7 @@ mod tests { assert!(matches!( authority.sandbox_policy( workspace, + &[], Some("danger-full-access"), SandboxNetworkAccess::Restricted ), @@ -949,6 +1229,7 @@ mod tests { assert_eq!( plan.sandbox_policy( workspace, + &[], Some("danger-full-access"), SandboxNetworkAccess::Restricted ), diff --git a/crates/tui/src/core/engine.rs b/crates/tui/src/core/engine.rs index 1b20f1c586..a05c7be804 100644 --- a/crates/tui/src/core/engine.rs +++ b/crates/tui/src/core/engine.rs @@ -294,6 +294,12 @@ pub struct EngineConfig { pub active_route_limits: Option, /// Workspace root for tool execution and file operations. pub workspace: PathBuf, + /// Additional workspace roots for this engine session; `workspace` stays + /// the primary root. Materialized into the per-turn sandbox policy, tool + /// context boundary, and exec-policy checks on every turn, so a root-set + /// change takes effect on the next turn. Empty preserves single-root + /// behavior exactly. + pub workspace_roots: Vec, /// Host-owned conversation id the engine adopts at construction. /// /// Interactive hosts claim a session id before the engine exists: the @@ -562,6 +568,7 @@ impl Default for EngineConfig { model: DEFAULT_TEXT_MODEL.to_string(), active_route_limits: None, workspace: PathBuf::from("."), + workspace_roots: Vec::new(), session_id: None, subagent_state_root: None, allow_shell: true, @@ -1837,6 +1844,9 @@ impl Engine { { session.id = session_id.to_string(); } + config.workspace_roots = + codewhale_core::normalize_workspace_roots(&config.workspace, &config.workspace_roots); + session.workspace_roots = config.workspace_roots.clone(); // Set up stable system prompt with project context (default to agent mode). // Per-turn working-set metadata is injected into the latest user // message at request time so file churn does not rewrite this prefix. @@ -2202,6 +2212,7 @@ impl Engine { &tool_name, &tool_input, &self.session.workspace, + &self.session.workspace_roots, self.session.approval_mode, ); if let Some(ToolAskRuleDecision::Block(reason)) = ask_rule_decision { @@ -3397,6 +3408,7 @@ impl Engine { system_prompt_override, model, workspace, + workspace_roots, mode, } => { self.drop_all_steers().await; @@ -3488,9 +3500,12 @@ impl Engine { self.session.auto_model = model.trim().eq_ignore_ascii_case("auto"); self.session.model = model; self.session.workspace = workspace.clone(); + self.session.workspace_roots = + codewhale_core::normalize_workspace_roots(&workspace, &workspace_roots); self.current_mode = mode; self.config.model.clone_from(&self.session.model); self.config.workspace = workspace.clone(); + self.config.workspace_roots = self.session.workspace_roots.clone(); if plugin_workspace_changed { self.plugin_registry = self.plugin_registry.rediscover_for_workspace(&workspace); @@ -3507,6 +3522,10 @@ impl Engine { // conversation (see the method). self.invalidate_mcp_boot_for_workspace_change(); } + // Base reloads the project context on every session + // sync; keep that unconditional so mid-session + // instruction edits are picked up on same-workspace + // re-syncs. The loader reads the primary root only. let ctx = crate::project_context::load_project_context_with_parents(&workspace); self.session.project_context = if ctx.has_instructions() { @@ -3551,6 +3570,7 @@ impl Engine { model_provider: self.api_provider.as_str().to_string(), model_provider_id: self.api_provider_id.clone(), workspace: self.session.workspace.clone(), + workspace_roots: self.session.workspace_roots.clone(), system_prompt: self.session.system_prompt.clone(), mode: self.current_mode.as_setting().to_string(), }; @@ -4136,6 +4156,7 @@ impl Engine { approval_mode, self.api_config.sandbox_mode.as_deref(), &self.config.workspace, + &self.session.workspace_roots, crate::core::authority::SandboxNetworkAccess::from_config( self.api_config.sandbox_network_access, ), @@ -4146,6 +4167,37 @@ impl Engine { // the static system prefix stays byte-stable across sessions (see // `render_environment_block` for the prefix-cache rationale). format!("Current workspace: {}", self.config.workspace.display()), + ]; + // The channel by which a multi-root session's model learns it may touch + // the attached roots: restricted postures need it for the permission + // boundary, full-access postures for plain visibility. The primary root + // is already named by the workspace line above. Order is the normalized + // storage order, never re-sorted per turn, so a stable root set keeps + // the line byte-identical; long sets are truncated to a bound. + let attached_roots: Vec<&Path> = self + .session + .workspace_roots + .iter() + .skip(1) + .map(PathBuf::as_path) + .collect(); + if !attached_roots.is_empty() { + const MAX_LISTED_ROOTS: usize = 5; + let listed = attached_roots + .iter() + .take(MAX_LISTED_ROOTS) + .map(|root| root.display().to_string()) + .collect::>() + .join(", "); + let remainder = attached_roots.len().saturating_sub(MAX_LISTED_ROOTS); + let suffix = if remainder > 0 { + format!(" … (+{remainder} more)") + } else { + String::new() + }; + lines.push(format!("Accessible folders: {listed}{suffix}")); + } + lines.extend([ format!( "Current permission posture: {}", approval_mode.permission_chip_label() @@ -4159,7 +4211,7 @@ impl Engine { crate::sandbox::process_hardening::no_new_privs_active(), ) ), - ]; + ]); if approval_mode == crate::tui::approval::ApprovalMode::Never { lines.push( "Approval prompts are disabled; do not request escalation for this turn." @@ -6632,11 +6684,13 @@ impl Engine { self.session.auto_approve, self.session.approval_mode, ); + context.workspace_roots = self.session.workspace_roots.clone(); context.trust_mode = authority.trust_mode; context.auto_approve = authority.auto_approve; context.set_shell_policy(self.effective_turn_shell_policy(authority.shell_policy())); context.elevated_sandbox_policy = Some(authority.sandbox_policy( &self.session.workspace, + &self.session.workspace_roots, self.api_config.sandbox_mode.as_deref(), crate::core::authority::SandboxNetworkAccess::from_config( self.api_config.sandbox_network_access, @@ -6684,6 +6738,7 @@ impl Engine { self.session.mcp_config_path.clone(), authority.auto_approve, ) + .with_workspace_roots(self.session.workspace_roots.clone()) .with_state_namespace(self.session.id.clone()) .with_route_context_window(crate::route_budget::route_context_window_tokens( route.provider, @@ -6755,6 +6810,7 @@ impl Engine { let policy = authority.sandbox_policy( &self.session.workspace, + &self.session.workspace_roots, self.api_config.sandbox_mode.as_deref(), crate::core::authority::SandboxNetworkAccess::from_config( self.api_config.sandbox_network_access, @@ -8058,6 +8114,7 @@ pub(super) fn exec_shell_ask_rule_decision( tool_name: &str, tool_input: &Value, workspace: &Path, + workspace_roots: &[PathBuf], approval_mode: crate::tui::approval::ApprovalMode, ) -> Option { exec_shell_ask_rule_decision_for_policy( @@ -8065,6 +8122,7 @@ pub(super) fn exec_shell_ask_rule_decision( tool_name, tool_input, workspace, + workspace_roots, approval_mode, ) } @@ -8077,6 +8135,7 @@ pub(crate) fn exec_shell_ask_rule_decision_for_policy( tool_name: &str, tool_input: &Value, workspace: &Path, + workspace_roots: &[PathBuf], approval_mode: crate::tui::approval::ApprovalMode, ) -> Option { let policy_tool_name = @@ -8085,12 +8144,33 @@ pub(crate) fn exec_shell_ask_rule_decision_for_policy( return None; } let command = tool_input.get("command").and_then(Value::as_str)?; + // The exec lane resolves a `cwd:`/`working_dir:` operand through the + // roots-aware `ToolContext::resolve_path` and executes there, so the + // approval context must judge the same effective cwd: an allow rule + // scoped to the primary repo must not auto-approve the same command + // redirected into an attached root. Execution canonicalizes existing + // components (symlinks included) before its boundary check, so the + // judgment canonicalizes the same way: the lexical join alone let + // `link/..` normalize back into the primary while execution landed in + // the symlink target, firing a primary-scoped allow across the boundary + // (review #484/CodeWhale round-20 B20-1). A nonexistent operand + // resolves through the deepest existing ancestor (symlinks included), + // matching resolve_nonexistent_path's behavior (round-21 B21-3). The + // walk lives in core (`resolve_operand_cwd`) so the headless + // `Runtime::invoke_tool` lane judges the identical effective cwd with + // one shared implementation (round-22 B22-5). + let effective_cwd = ["cwd", "working_dir"] + .iter() + .find_map(|name| tool_input.get(name).and_then(Value::as_str)) + .map(|dir| codewhale_core::resolve_operand_cwd(workspace, dir)); tool_ask_rule_decision_for_context( exec_policy_engine, policy_tool_name, command, None, + effective_cwd.as_deref().unwrap_or(workspace), workspace, + workspace_roots, approval_mode, ) } @@ -8100,6 +8180,7 @@ pub(super) fn file_tool_ask_rule_decision( tool_name: &str, tool_input: &Value, workspace: &Path, + workspace_roots: &[PathBuf], approval_mode: crate::tui::approval::ApprovalMode, ) -> Option { file_tool_ask_rule_decision_for_policy( @@ -8107,6 +8188,7 @@ pub(super) fn file_tool_ask_rule_decision( tool_name, tool_input, workspace, + workspace_roots, approval_mode, ) } @@ -8119,6 +8201,7 @@ pub(crate) fn file_tool_ask_rule_decision_for_policy( tool_name: &str, tool_input: &Value, workspace: &Path, + workspace_roots: &[PathBuf], approval_mode: crate::tui::approval::ApprovalMode, ) -> Option { let policy_tool_name = @@ -8131,6 +8214,8 @@ pub(crate) fn file_tool_ask_rule_decision_for_policy( "", None, workspace, + workspace, + workspace_roots, approval_mode, ); } @@ -8144,6 +8229,8 @@ pub(crate) fn file_tool_ask_rule_decision_for_policy( "", Some(&path), workspace, + workspace, + workspace_roots, approval_mode, ) { Some(ToolAskRuleDecision::Block(reason)) => { @@ -8171,10 +8258,12 @@ fn tool_ask_rule_decision_for_context( tool_name: &str, command: &str, path: Option<&str>, + cwd: &Path, workspace: &Path, + workspace_roots: &[PathBuf], approval_mode: crate::tui::approval::ApprovalMode, ) -> Option { - let cwd = workspace.to_string_lossy(); + let judged_cwd = cwd.to_string_lossy(); let ask_for_approval = match approval_mode { crate::tui::approval::ApprovalMode::Never => AskForApproval::Never, crate::tui::approval::ApprovalMode::Auto @@ -8184,11 +8273,17 @@ fn tool_ask_rule_decision_for_context( let decision = exec_policy_engine .check(ExecPolicyContext { command, - cwd: cwd.as_ref(), + cwd: judged_cwd.as_ref(), tool: Some(tool_name), path, ask_for_approval, sandbox_mode: None, + // `check` prepends the judged cwd itself and dedupes, so pass the + // full normalized session set (primary included): ask/deny scope + // matching keeps spanning every declared root even when the + // judged cwd differs from the session primary (an exec `cwd:` + // operand), while allow rules stay narrowed to the judged cwd. + workspace_roots: codewhale_core::normalize_workspace_roots(workspace, workspace_roots), }) .ok()?; if !decision.allow { @@ -8208,12 +8303,18 @@ fn tool_ask_rule_decision_for_context( } fn file_tool_permission_paths(tool_name: &str, input: &Value) -> Option> { + // Alias-aware (`file_path`/`filePath`): the ask-rule and carve-out + // judgments run before execution folds `PATH_ALIASES` onto `path`, so + // an alias-spelled call was invisible to every persisted rule and to + // the write carve-out (round-22 B22-2). match tool_name { - "read_file" | "write_file" | "edit_file" | "file_search" | "grep_files" => { - Some(string_field(input, "path").into_iter().collect()) - } + "read_file" | "write_file" | "edit_file" | "file_search" | "grep_files" => Some( + crate::tools::file::path_param_value(input) + .into_iter() + .collect(), + ), "list_dir" => Some(vec![ - string_field(input, "path").unwrap_or_else(|| ".".to_string()), + crate::tools::file::path_param_value(input).unwrap_or_else(|| ".".to_string()), ]), "apply_patch" => Some(apply_patch_permission_paths(input)), _ => None, @@ -8231,15 +8332,6 @@ fn file_write_tool_target_paths(tool_name: &str, input: &Value) -> Option Option { - input - .get(key) - .and_then(Value::as_str) - .map(str::trim) - .filter(|value| !value.is_empty()) - .map(str::to_string) -} - fn apply_patch_permission_paths(input: &Value) -> Vec { crate::tools::apply_patch::preflight_apply_patch(input) .map(|preflight| preflight.touched_files) diff --git a/crates/tui/src/core/engine/tests.rs b/crates/tui/src/core/engine/tests.rs index cd888138dc..f22abb5724 100644 --- a/crates/tui/src/core/engine/tests.rs +++ b/crates/tui/src/core/engine/tests.rs @@ -8666,6 +8666,7 @@ fn auto_review_plan_decision( approval_mode, workspace_trusted, workspace, + &[], ); auto_review_plan_decision_for_context(policy, &context) } @@ -9013,6 +9014,7 @@ fn workspace_write_carve_out_covers_the_default_ask_posture_only() { ask.1, ask.2, workspace, + &[], tool, input, ApprovalRequirement::Suggest, @@ -9073,6 +9075,7 @@ fn workspace_write_carve_out_covers_the_default_ask_posture_only() { approval_mode, auto_approve, workspace, + &[], "write_file", &json!({"path": "src/main.rs"}), ApprovalRequirement::Suggest, @@ -9087,12 +9090,57 @@ fn workspace_write_carve_out_covers_the_default_ask_posture_only() { ask.1, ask.2, workspace, + &[], "write_file", &json!({"path": "src/main.rs"}), ApprovalRequirement::Required, )); } +#[test] +fn workspace_write_carve_out_judges_the_raw_spelling_on_the_real_pipeline() { + // The gate must judge exactly what execution resolves: the engine's path + // collector passes the tool input through untrimmed, and + // `ToolContext::resolve_path` branches on the raw spelling. A + // leading-whitespace absolute-looking target is a *relative* path to the + // write tools (joined onto the primary), so a trimmed judgment would let + // it qualify through an attached git root modal-free while the write + // lands inside the non-git primary tree — fail-open where base was + // fail-closed. + let primary = tempdir().expect("non-git primary"); + let attached = tempdir().expect("attached dir"); + std::fs::create_dir(attached.path().join(".git")).expect("git marker"); + let ask = ( + crate::tui::app::AppMode::Agent, + crate::tui::approval::ApprovalMode::Suggest, + false, + ); + let carve_out = |input: &serde_json::Value| { + workspace_write_carve_out_applies( + ask.0, + ask.1, + ask.2, + primary.path(), + &[attached.path().to_path_buf()], + "write_file", + input, + ApprovalRequirement::Suggest, + ) + }; + + let whitespace_prefixed = format!(" {}", attached.path().join("src/main.rs").display()); + assert!( + !carve_out(&json!({"path": whitespace_prefixed})), + "the raw pipeline must keep the modal for a whitespace-prefixed target" + ); + + // The trimmed spelling stays qualified on the same pipeline: trimming + // decides nothing but emptiness anywhere on this path. + assert!(carve_out( + &json!({"path": attached.path().join("src/main.rs")}) + )); +} + #[test] fn sandbox_escalation_requires_a_pair_and_a_strictly_wider_mode() { use crate::sandbox::SandboxPolicy; @@ -9417,6 +9465,7 @@ fn exec_shell_scenario() { "exec_shell", &json!({"command": "cargo test --workspace"}), Path::new("/repo"), + &[], crate::tui::approval::ApprovalMode::Auto, ); @@ -9440,6 +9489,7 @@ fn exec_shell_scenario() { "exec_shell", &json!({"command": "cargo test --workspace"}), Path::new("/repo"), + &[], crate::tui::approval::ApprovalMode::Never, ); @@ -9462,6 +9512,7 @@ fn exec_shell_scenario() { "exec_shell", &json!({"command": "git status"}), Path::new("/repo"), + &[], crate::tui::approval::ApprovalMode::Auto, ); @@ -9481,6 +9532,7 @@ fn canonical_bash_run_honors_legacy_typed_ask_rules() { "Bash", &json!({"action": "run", "command": "cargo test --workspace"}), Path::new("/repo"), + &[], crate::tui::approval::ApprovalMode::Auto, ); @@ -9509,6 +9561,7 @@ fn exec_shell_allow_rule_decision_allows_only_exact_command_in_scoped_repo() { "exec_shell", &json!({"command": "cargo test"}), Path::new("/repo"), + &[], crate::tui::approval::ApprovalMode::Suggest, ), Some(ToolAskRuleDecision::Allow) @@ -9519,6 +9572,7 @@ fn exec_shell_allow_rule_decision_allows_only_exact_command_in_scoped_repo() { "exec_shell", &json!({"command": "cargo test --workspace"}), Path::new("/repo"), + &[], crate::tui::approval::ApprovalMode::Suggest, ), None @@ -9529,12 +9583,152 @@ fn exec_shell_allow_rule_decision_allows_only_exact_command_in_scoped_repo() { "exec_shell", &json!({"command": "cargo test"}), Path::new("/other"), + &[], + crate::tui::approval::ApprovalMode::Suggest, + ), + None + ); +} + +#[test] +fn exec_shell_scoped_allow_rule_does_not_follow_cwd_into_attached_root() { + // B15-3 regression pin: the normal exec lane resolves a `cwd:` operand + // into any declared root and executes there, so the approval context + // must judge the resolved effective cwd. A grant scoped to the primary + // repo must not auto-approve the same command redirected into an + // attached root — a different repository the grant never named. + let rule = codewhale_execpolicy::ToolAskRule::exec_shell("git push") + .into_exact_workspace_allow("/repo"); + let config = EngineConfig { + exec_policy_engine: codewhale_execpolicy::ExecPolicyEngine::with_rulesets(vec![ + codewhale_execpolicy::Ruleset::user(vec![], vec![]).with_ask_rules(vec![rule]), + ]), + ..EngineConfig::default() + }; + let roots = [PathBuf::from("/shared")]; + + // Control: inside the scoped repo the grant still auto-approves, with + // the attached root declared. + assert_eq!( + exec_shell_ask_rule_decision( + &config, + "exec_shell", + &json!({"command": "git push"}), + Path::new("/repo"), + &roots, + crate::tui::approval::ApprovalMode::Suggest, + ), + Some(ToolAskRuleDecision::Allow) + ); + // A relative `cwd:` resolves against the primary root (execution + // semantics), so it keeps the grant. + assert_eq!( + exec_shell_ask_rule_decision( + &config, + "exec_shell", + &json!({"command": "git push", "cwd": "."}), + Path::new("/repo"), + &roots, + crate::tui::approval::ApprovalMode::Suggest, + ), + Some(ToolAskRuleDecision::Allow) + ); + // Redirected into the attached root, the /repo-scoped grant must not + // auto-approve. + assert_eq!( + exec_shell_ask_rule_decision( + &config, + "exec_shell", + &json!({"command": "git push", "cwd": "/shared"}), + Path::new("/repo"), + &roots, + crate::tui::approval::ApprovalMode::Suggest, + ), + None, + "a /repo-scoped allow must not auto-approve execution under an attached root" + ); + + // The scope match is honest in both directions: a grant scoped to the + // attached root fires exactly when execution lands there. + let attached_rule = codewhale_execpolicy::ToolAskRule::exec_shell("git push") + .into_exact_workspace_allow("/shared"); + let attached_config = EngineConfig { + exec_policy_engine: codewhale_execpolicy::ExecPolicyEngine::with_rulesets(vec![ + codewhale_execpolicy::Ruleset::user(vec![], vec![]).with_ask_rules(vec![attached_rule]), + ]), + ..EngineConfig::default() + }; + assert_eq!( + exec_shell_ask_rule_decision( + &attached_config, + "exec_shell", + &json!({"command": "git push", "cwd": "/shared"}), + Path::new("/repo"), + &roots, + crate::tui::approval::ApprovalMode::Suggest, + ), + Some(ToolAskRuleDecision::Allow) + ); + assert_eq!( + exec_shell_ask_rule_decision( + &attached_config, + "exec_shell", + &json!({"command": "git push"}), + Path::new("/repo"), + &roots, crate::tui::approval::ApprovalMode::Suggest, ), None ); } +#[test] +fn exec_shell_attached_root_scoped_deny_reaches_rule_decision() { + // Pin for the engine-level exec-policy glue: the declared root set must + // reach the typed-rule decision. Every other engine-level caller passes + // `&[]`, so a glue mutation dropping the set only shows up as an + // attached-root-dependent outcome flipping. + let rule = codewhale_execpolicy::ToolAskRule { + tool: "exec_shell".into(), + command: Some("git push".into()), + command_exact: false, + path: None, + workspace: Some("/shared".into()), + action: codewhale_execpolicy::PermissionAction::Deny, + }; + let config = EngineConfig { + exec_policy_engine: codewhale_execpolicy::ExecPolicyEngine::with_rulesets(vec![ + codewhale_execpolicy::Ruleset::user(vec![], vec![]).with_ask_rules(vec![rule]), + ]), + ..EngineConfig::default() + }; + + let decision = exec_shell_ask_rule_decision( + &config, + "exec_shell", + &json!({"command": "git push origin main"}), + Path::new("/repo"), + &[PathBuf::from("/shared")], + crate::tui::approval::ApprovalMode::Suggest, + ); + assert!( + matches!(decision, Some(ToolAskRuleDecision::Block(_))), + "a deny rule scoped to an attached root must reach the decision: {decision:?}" + ); + + // Control: with the historical empty root set the /shared-scoped deny + // does not reach the call. + let decision = exec_shell_ask_rule_decision( + &config, + "exec_shell", + &json!({"command": "git push origin main"}), + Path::new("/repo"), + &[], + crate::tui::approval::ApprovalMode::Suggest, + ); + assert_eq!(decision, None); +} + #[test] fn file_ask_scenario() { // Scenario consolidation of: file_ask_rule_decision_prompts_for_matching_read_path, file_ask_rule_decision_prompts_for_absolute_workspace_path, file_ask_rule_decision_blocks_matching_read_path_when_approval_is_never, file_ask_rule_decision_ignores_unmatched_path @@ -9550,6 +9744,7 @@ fn file_ask_scenario() { "read_file", &json!({"path": "secrets/api_key.txt"}), Path::new("/repo"), + &[], crate::tui::approval::ApprovalMode::Auto, ); @@ -9573,6 +9768,7 @@ fn file_ask_scenario() { "read_file", &json!({"path": "/repo/secrets/api_key.txt"}), Path::new("/repo"), + &[], crate::tui::approval::ApprovalMode::Auto, ); @@ -9596,6 +9792,7 @@ fn file_ask_scenario() { "read_file", &json!({"path": "secrets/api_key.txt"}), Path::new("/repo"), + &[], crate::tui::approval::ApprovalMode::Never, ); @@ -9618,6 +9815,7 @@ fn file_ask_scenario() { "read_file", &json!({"path": "docs/readme.md"}), Path::new("/repo"), + &[], crate::tui::approval::ApprovalMode::Auto, ); @@ -9637,6 +9835,7 @@ fn canonical_file_action_honors_legacy_path_ask_rules() { "File", &json!({"action": "write", "path": "src/lib.rs", "content": "new\n"}), Path::new("/repo"), + &[], crate::tui::approval::ApprovalMode::Auto, ); @@ -9648,6 +9847,62 @@ fn canonical_file_action_honors_legacy_path_ask_rules() { ); } +#[test] +#[allow(non_snake_case)] +fn camelCase_file_path_alias_reaches_the_ask_rule_and_carve_out_judgments() { + // Round-22 B22-2: execution folds `filePath` (and `file_path`) onto + // `path` via `PATH_ALIASES` only at execute time, and the default + // `ToolSpec::prepare` passes input through unchanged — so an + // alias-spelled write was invisible to the persisted ask-rule judgment + // and to the in-workspace write carve-out at once. + let config = EngineConfig { + exec_policy_engine: file_ask_rule_engine("write_file", "src/lib.rs"), + ..EngineConfig::default() + }; + + let camel = file_tool_ask_rule_decision( + &config, + "File", + &json!({"action": "write", "filePath": "src/lib.rs", "content": "new\n"}), + Path::new("/repo"), + &[], + crate::tui::approval::ApprovalMode::Auto, + ); + assert_eq!( + camel, + Some(ToolAskRuleDecision::Prompt( + "Typed ask rule 'tool=write_file path=src/lib.rs' requires approval.".to_string() + )), + "a filePath-spelled write must reach the ask-rule judgment" + ); + + let snake = file_tool_ask_rule_decision( + &config, + "File", + &json!({"action": "write", "file_path": "src/lib.rs", "content": "new\n"}), + Path::new("/repo"), + &[], + crate::tui::approval::ApprovalMode::Auto, + ); + assert_eq!( + snake, camel, + "the file_path alias must behave identically to filePath" + ); + + // The canonical key still wins when present, matching the execute-time + // fold (both present and disagreeing fails the call at execution, so the + // judgment is free to prefer the canonical spelling). + let canonical_wins = file_tool_ask_rule_decision( + &config, + "File", + &json!({"action": "write", "path": "src/other.rs", "filePath": "src/lib.rs"}), + Path::new("/repo"), + &[], + crate::tui::approval::ApprovalMode::Auto, + ); + assert_eq!(canonical_wins, None, "path wins; other.rs is not ruled"); +} + #[test] fn apply_patch_allow_requires_every_touched_path_to_match() { let rules = ["src/a.rs", "src/b.rs"] @@ -9674,6 +9929,7 @@ fn apply_patch_allow_requires_every_touched_path_to_match() { ] }), Path::new("/repo"), + &[], crate::tui::approval::ApprovalMode::Suggest, ); assert_eq!(fully_allowed, Some(ToolAskRuleDecision::Allow)); @@ -9688,6 +9944,7 @@ fn apply_patch_allow_requires_every_touched_path_to_match() { ] }), Path::new("/repo"), + &[], crate::tui::approval::ApprovalMode::Suggest, ); assert_eq!(partially_allowed, None); @@ -13249,6 +13506,7 @@ async fn full_access_permission_allow_cannot_bypass_repo_law() { "write_file", &tool_input, workspace.path(), + &[], crate::tui::approval::ApprovalMode::Bypass, ), Some(ToolAskRuleDecision::Allow), @@ -13269,6 +13527,62 @@ async fn full_access_permission_allow_cannot_bypass_repo_law() { assert!(!target.exists(), "repo-law block must prevent the write"); } +#[tokio::test] +#[allow(clippy::await_holding_lock)] +async fn full_access_repo_law_holds_writes_under_attached_roots() { + // Round-15 pin at the turn-loop layer: `run_turn` must forward the + // session root set to `repo_law_plan_decision`. A `&[]` mutation at the + // turn-loop call site leaves the attached root's constitution unloaded, + // so the write below would execute with every repo-law unit test (one + // layer down) still green. + let _lock = lock_test_env(); + let workspace = tempdir().expect("tempdir"); + let attached = tempdir().expect("attached root"); + let law_dir = attached.path().join(".codewhale"); + fs::create_dir_all(&law_dir).expect("create law directory"); + fs::write( + law_dir.join("constitution.json"), + r#"{ + "protected_invariants": [{ + "text": "Shared root notes need human review", + "paths": ["SHARED.md"] + }] + }"#, + ) + .expect("write repo law fixture"); + let target = attached.path().join("SHARED.md"); + let engine_config = EngineConfig { + model: crate::config::DEFAULT_TEXT_MODEL.to_string(), + workspace: workspace.path().to_path_buf(), + workspace_roots: vec![attached.path().to_path_buf()], + mcp_config_path: workspace.path().join("mcp.json"), + snapshots_enabled: false, + subagents_enabled: false, + ..EngineConfig::default() + }; + let tool_input = json!({ + "action": "write", + "path": target.to_string_lossy(), + "content": "must not be written\n" + }); + + assert_full_access_model_tool_batch_is_blocked( + engine_config, + vec![("File", tool_input)], + &[( + "File", + "Repository law blocked tool 'File' in Full Access: Repo law holds this write: \"Shared root notes need human review\"", + )], + "Repository law blocked tool 'File' in Full Access: Repo law holds this write:", + ) + .await; + + assert!( + !target.exists(), + "repo-law block must prevent the write under the attached root" + ); +} + #[tokio::test] #[allow(clippy::await_holding_lock)] async fn auto_review_auto_resolves_hallucinated_question_without_prompting() { @@ -13542,6 +13856,7 @@ async fn full_access_permission_allow_cannot_bypass_background_catastrophic_floo "exec_shell", &tool_input, workspace.path(), + &[], crate::tui::approval::ApprovalMode::Bypass, ), Some(ToolAskRuleDecision::Allow), @@ -14914,6 +15229,7 @@ fn sandbox_policy_for_turn_returns_correct_default_policy_per_mode() { ApprovalMode::Suggest, None, &workspace, + &[], SandboxNetworkAccess::Restricted, ), SandboxPolicy::ReadOnly @@ -14925,6 +15241,7 @@ fn sandbox_policy_for_turn_returns_correct_default_policy_per_mode() { ApprovalMode::Suggest, None, &workspace, + &[], SandboxNetworkAccess::Restricted, ) { SandboxPolicy::WorkspaceWrite { @@ -14947,6 +15264,7 @@ fn sandbox_policy_for_turn_returns_correct_default_policy_per_mode() { ApprovalMode::Suggest, None, &workspace, + &[], SandboxNetworkAccess::Allowed, ) { SandboxPolicy::WorkspaceWrite { network_access, .. } => { @@ -14965,6 +15283,7 @@ fn sandbox_policy_for_turn_returns_correct_default_policy_per_mode() { ApprovalMode::Bypass, None, &workspace, + &[], SandboxNetworkAccess::Restricted, ), SandboxPolicy::DangerFullAccess @@ -15832,6 +16151,7 @@ async fn sync_session_restores_current_mode() { system_prompt_override: false, model: "deepseek-v4-pro".to_string(), workspace: tmp.path().to_path_buf(), + workspace_roots: Vec::new(), mode: AppMode::Plan, }) .await @@ -15910,6 +16230,7 @@ async fn sync_session_without_prompt_repins_full_system_prompt_on_next_turn() { system_prompt_override: false, model: crate::config::DEFAULT_TEXT_MODEL.to_string(), workspace: workspace.path().to_path_buf(), + workspace_roots: Vec::new(), mode: AppMode::Agent, }) .await @@ -15991,6 +16312,7 @@ async fn sync_session_same_id_does_not_finalize_live_worker() { system_prompt_override: false, model: "deepseek-v4-pro".to_string(), workspace: workspace.clone(), + workspace_roots: Vec::new(), mode: AppMode::Agent, }) .await @@ -16011,6 +16333,7 @@ async fn sync_session_same_id_does_not_finalize_live_worker() { system_prompt_override: false, model: "deepseek-v4-pro".to_string(), workspace: workspace.clone(), + workspace_roots: Vec::new(), mode: AppMode::Agent, }) .await @@ -16052,6 +16375,7 @@ async fn sync_session_different_id_finalizes_live_worker() { system_prompt_override: false, model: "deepseek-v4-pro".to_string(), workspace: workspace.clone(), + workspace_roots: Vec::new(), mode: AppMode::Agent, }) .await @@ -16075,6 +16399,7 @@ async fn sync_session_different_id_finalizes_live_worker() { system_prompt_override: false, model: "deepseek-v4-pro".to_string(), workspace: workspace.clone(), + workspace_roots: Vec::new(), mode: AppMode::Agent, }) .await @@ -16141,6 +16466,7 @@ async fn sync_session_migrates_one_checkpoint_and_strips_its_system_carrier() { system_prompt_override: true, model: "deepseek-v4-pro".to_string(), workspace: tmp.path().to_path_buf(), + workspace_roots: Vec::new(), mode: AppMode::Agent, }) .await @@ -16224,6 +16550,7 @@ async fn sync_session_projects_persisted_subagent_handoff_for_headless_restore() system_prompt_override: false, model: "deepseek-v4-pro".to_string(), workspace: tmp.path().to_path_buf(), + workspace_roots: Vec::new(), mode: AppMode::Agent, }) .await @@ -16290,6 +16617,107 @@ async fn session_snapshot_omits_id_for_legacy_root_custom_route() { run.abort(); } +#[test] +fn tool_context_for_turn_materializes_session_workspace_roots() { + let tmp = tempdir().expect("tempdir"); + let shared = tempdir().expect("shared root"); + let expected = vec![tmp.path().to_path_buf(), shared.path().to_path_buf()]; + + let mut config = deterministic_engine_config(tmp.path()); + config.workspace_roots = vec![shared.path().to_path_buf()]; + let (engine, _handle) = Engine::new(config, &Config::default()); + let ctx = engine.build_tool_context(AppMode::Agent, false); + assert_eq!(ctx.workspace_roots, expected); + match &ctx.elevated_sandbox_policy { + Some(crate::sandbox::SandboxPolicy::WorkspaceWrite { writable_roots, .. }) => { + assert_eq!(writable_roots, &expected); + } + other => panic!("agent turn must carry a workspace-write policy: {other:?}"), + } + + // No configured roots: the session degenerates to the primary root and + // the materialized policy is byte-identical to the historical shape. + let (engine, _handle) = + Engine::new(deterministic_engine_config(tmp.path()), &Config::default()); + let ctx = engine.build_tool_context(AppMode::Agent, false); + assert_eq!(ctx.workspace_roots, vec![tmp.path().to_path_buf()]); + match &ctx.elevated_sandbox_policy { + Some(crate::sandbox::SandboxPolicy::WorkspaceWrite { writable_roots, .. }) => { + assert_eq!(writable_roots, &vec![tmp.path().to_path_buf()]); + } + other => panic!("agent turn must carry a workspace-write policy: {other:?}"), + } +} + +#[tokio::test] +async fn sync_session_replaces_workspace_roots_for_the_next_turn() { + let tmp = tempdir().expect("tempdir"); + let shared = tempdir().expect("shared root"); + let (engine, handle) = Engine::new(deterministic_engine_config(tmp.path()), &Config::default()); + let run = tokio::spawn(engine.run()); + + // A roots-only sync (same primary workspace) swaps the materialized set. + handle + .send(Op::SyncSession { + session_id: Some("roots-session".to_string()), + messages: Vec::new(), + system_prompt: None, + system_prompt_override: false, + model: "deepseek-v4-pro".to_string(), + workspace: tmp.path().to_path_buf(), + workspace_roots: vec![shared.path().to_path_buf()], + mode: AppMode::Agent, + }) + .await + .expect("sync session"); + + let (tx, rx) = tokio::sync::oneshot::channel(); + handle + .send(Op::GetSessionSnapshot { + tx: std::sync::Arc::new(std::sync::Mutex::new(Some(tx))), + }) + .await + .expect("request snapshot"); + let snapshot = tokio::time::timeout(Duration::from_secs(2), rx) + .await + .expect("snapshot response") + .expect("snapshot"); + assert_eq!( + snapshot.workspace_roots, + vec![tmp.path().to_path_buf(), shared.path().to_path_buf()], + "next turn must materialize the replaced root set" + ); + + // A later sync with no roots configured falls back to the primary root. + handle + .send(Op::SyncSession { + session_id: Some("roots-session".to_string()), + messages: Vec::new(), + system_prompt: None, + system_prompt_override: false, + model: "deepseek-v4-pro".to_string(), + workspace: tmp.path().to_path_buf(), + workspace_roots: Vec::new(), + mode: AppMode::Agent, + }) + .await + .expect("sync session without roots"); + let (tx, rx) = tokio::sync::oneshot::channel(); + handle + .send(Op::GetSessionSnapshot { + tx: std::sync::Arc::new(std::sync::Mutex::new(Some(tx))), + }) + .await + .expect("request snapshot"); + let snapshot = tokio::time::timeout(Duration::from_secs(2), rx) + .await + .expect("snapshot response") + .expect("snapshot"); + assert_eq!(snapshot.workspace_roots, vec![tmp.path().to_path_buf()]); + + run.abort(); +} + #[tokio::test] #[allow(clippy::await_holding_lock)] async fn edit_last_turn_preserves_current_mode() { @@ -16359,6 +16787,7 @@ async fn edit_last_turn_preserves_current_mode() { system_prompt_override: false, model: "deepseek-v4-pro".to_string(), workspace: tmp.path().to_path_buf(), + workspace_roots: Vec::new(), mode: AppMode::Agent, }) .await @@ -16516,6 +16945,7 @@ async fn edit_last_turn_cuts_at_user_prompt_before_tool_results() { system_prompt_override: false, model: "deepseek-v4-pro".to_string(), workspace: tmp.path().to_path_buf(), + workspace_roots: Vec::new(), mode: AppMode::Agent, }) .await @@ -16629,6 +17059,7 @@ async fn edit_last_turn_without_user_prompt_errors_and_sends_nothing() { system_prompt_override: false, model: "deepseek-v4-pro".to_string(), workspace: tmp.path().to_path_buf(), + workspace_roots: Vec::new(), mode: AppMode::Agent, }) .await @@ -16732,6 +17163,7 @@ async fn edit_last_turn_without_user_prompt_errors_and_sends_nothing() { system_prompt_override: false, model: "deepseek-v4-pro".to_string(), workspace: tmp.path().to_path_buf(), + workspace_roots: Vec::new(), mode: AppMode::Agent, }) .await @@ -18289,6 +18721,100 @@ fn working_set_reaches_model_as_turn_metadata() { assert!(text.contains("src/lib.rs")); } +fn turn_meta_text(engine: &mut Engine, input: &str) -> String { + let user_msg = engine.user_text_message_with_turn_metadata(input.to_string()); + user_msg + .content + .iter() + .find_map(|block| match block { + ContentBlock::Text { text, .. } if text.starts_with("") => { + Some(text.clone()) + } + _ => None, + }) + .expect("turn metadata block") +} + +#[test] +fn forkguard_workspace_roots_turn_meta_lists_attached_roots() { + let tmp = tempdir().expect("tempdir"); + let shared_a = tempdir().expect("shared a"); + let shared_b = tempdir().expect("shared b"); + let config = EngineConfig { + workspace: tmp.path().to_path_buf(), + workspace_roots: vec![shared_a.path().to_path_buf(), shared_b.path().to_path_buf()], + ..Default::default() + }; + let (mut engine, _handle) = Engine::new(config, &Config::default()); + + let first = turn_meta_text(&mut engine, "one"); + let expected_line = format!( + "Accessible folders: {}, {}", + shared_a.path().display(), + shared_b.path().display() + ); + assert!(first.contains(&expected_line), "{first}"); + // The line sits immediately after the workspace line (the model reads the + // primary root there and the attached roots here). + let workspace_pos = first.find("Current workspace:").expect("workspace line"); + let folders_pos = first.find("Accessible folders:").expect("folders line"); + assert!(folders_pos > workspace_pos); + assert!( + !first[workspace_pos..folders_pos].contains("Current permission posture:"), + "the folders line must precede the posture lines: {first}" + ); + // A stable root set renders the line byte-identically every turn. + let second = turn_meta_text(&mut engine, "two"); + assert_eq!( + first + .lines() + .find(|line| line.starts_with("Accessible folders:")), + second + .lines() + .find(|line| line.starts_with("Accessible folders:")), + ); +} + +#[test] +fn turn_meta_omits_accessible_folders_for_single_root() { + let tmp = tempdir().expect("tempdir"); + let config = EngineConfig { + workspace: tmp.path().to_path_buf(), + ..Default::default() + }; + let (mut engine, _handle) = Engine::new(config, &Config::default()); + + let text = turn_meta_text(&mut engine, "hello"); + assert!( + !text.contains("Accessible folders:"), + "single-root sessions keep the historical block byte shape: {text}" + ); +} + +#[test] +fn turn_meta_accessible_folders_truncates_long_root_sets() { + let tmp = tempdir().expect("tempdir"); + let roots: Vec = (0..7) + .map(|index| tmp.path().join(format!("root-{index}"))) + .collect(); + let config = EngineConfig { + workspace: tmp.path().to_path_buf(), + workspace_roots: roots.clone(), + ..Default::default() + }; + let (mut engine, _handle) = Engine::new(config, &Config::default()); + + let text = turn_meta_text(&mut engine, "hello"); + let line = text + .lines() + .find(|line| line.starts_with("Accessible folders:")) + .expect("folders line"); + // At most five attached roots listed, the rest folded into a count. + assert!(line.contains("root-0") && line.contains("root-4"), "{line}"); + assert!(!line.contains("root-5"), "{line}"); + assert!(line.ends_with("… (+2 more)"), "{line}"); +} + #[test] fn turn_metadata_includes_git_workspace_snapshot_in_repo() { use crate::dependencies::ExternalTool; @@ -24856,6 +25382,7 @@ async fn forkguard_workspace_sync_invalidates_in_flight_boot() { system_prompt_override: false, model: crate::config::DEFAULT_TEXT_MODEL.to_string(), workspace: workspace_b.path().to_path_buf(), + workspace_roots: Vec::new(), mode: AppMode::Agent, }) .await @@ -25053,7 +25580,7 @@ async fn forkguard_reload_injects_recovery_notice_exactly_once() { let briefed = snapshot .messages .iter() - .any(|message| crate::runtime_handoff::is_mcp_boot_failure_briefing_message(message)); + .any(crate::runtime_handoff::is_mcp_boot_failure_briefing_message); if briefed { break; } @@ -26345,3 +26872,123 @@ async fn a_booting_turn_keeps_an_already_declared_surface_reason() { last ); } + +// Round-20 B20-1: the judged cwd must resolve symlinks the way execution +// does. `link/..` normalizes lexically back into the primary but lands +// in the attached repo on disk; a primary-scoped allow must not fire for +// it, and neither for the link itself. Unix-gated: symlink creation is +// the fixture (architecture-guard allow-target-cfg). +#[test] +#[cfg(unix)] +fn exec_judged_cwd_resolves_symlinks_like_execution() { + use std::path::Path; + + let temp = tempfile::tempdir().expect("tempdir"); + let primary_raw = temp.path().join("ws"); + let attached_raw = temp.path().join("attached").join("repo"); + std::fs::create_dir_all(&primary_raw).unwrap(); + std::fs::create_dir_all(&attached_raw).unwrap(); + // Judge and scope against canonical spellings so the control legs are + // platform-stable (macOS /var → /private/var would otherwise flip the + // control leg to a modal). + let primary = std::fs::canonicalize(&primary_raw).unwrap(); + let attached = std::fs::canonicalize(&attached_raw).unwrap(); + std::os::unix::fs::symlink(&attached, primary_raw.join("link")).unwrap(); + + let rule = codewhale_execpolicy::ToolAskRule::exec_shell("git push") + .into_exact_workspace_allow(primary.to_string_lossy().as_ref()); + let config = EngineConfig { + exec_policy_engine: codewhale_execpolicy::ExecPolicyEngine::with_rulesets(vec![ + codewhale_execpolicy::Ruleset::user(vec![], vec![]).with_ask_rules(vec![rule]), + ]), + ..EngineConfig::default() + }; + let roots = [attached.clone()]; + + // Control: in the primary itself the grant fires. + assert_eq!( + exec_shell_ask_rule_decision( + &config, + "exec_shell", + &json!({"command": "git push", "cwd": "."}), + Path::new(&primary), + &roots, + crate::tui::approval::ApprovalMode::Suggest, + ), + Some(ToolAskRuleDecision::Allow) + ); + + // symlink+`..`: lexically back in the primary, canonically the + // attached repo — the /primary-scoped grant must not fire. + assert_ne!( + exec_shell_ask_rule_decision( + &config, + "exec_shell", + &json!({"command": "git push", "cwd": "link/.."}), + Path::new(&primary), + &roots, + crate::tui::approval::ApprovalMode::Suggest, + ), + Some(ToolAskRuleDecision::Allow) + ); + + // symlink-interior: the link itself resolves into the attached repo. + let through_link = primary.join("link"); + assert_ne!( + exec_shell_ask_rule_decision( + &config, + "exec_shell", + &json!({"command": "git push", "cwd": through_link}), + Path::new(&primary), + &roots, + crate::tui::approval::ApprovalMode::Suggest, + ), + Some(ToolAskRuleDecision::Allow) + ); +} + +// Round-21 B21-3 absent-interior leg: a nonexistent component behind the +// link used to keep the lexical join (normalize pops `absent/..` and +// `link/..` back onto the primary) while execution's +// resolve_nonexistent_path canonicalizes the deepest existing ancestor — +// the link — landing in the attached repo. +#[test] +#[cfg(unix)] +fn exec_judged_cwd_resolves_absent_interior_behind_symlink() { + use std::path::Path; + + let temp = tempfile::tempdir().expect("tempdir"); + let primary_raw = temp.path().join("ws"); + let attached_raw = temp.path().join("attached").join("repo"); + std::fs::create_dir_all(&primary_raw).unwrap(); + std::fs::create_dir_all(&attached_raw).unwrap(); + let primary = std::fs::canonicalize(&primary_raw).unwrap(); + let attached = std::fs::canonicalize(&attached_raw).unwrap(); + std::os::unix::fs::symlink(&attached, primary_raw.join("link")).unwrap(); + + let rule = codewhale_execpolicy::ToolAskRule::exec_shell("git push") + .into_exact_workspace_allow(primary.to_string_lossy().as_ref()); + let config = EngineConfig { + exec_policy_engine: codewhale_execpolicy::ExecPolicyEngine::with_rulesets(vec![ + codewhale_execpolicy::Ruleset::user(vec![], vec![]).with_ask_rules(vec![rule]), + ]), + ..EngineConfig::default() + }; + let roots = [attached]; + + // The `link//../..` spelling: the lexical join pops back onto + // the primary; the deepest-existing resolution (what execution's + // resolve_nonexistent_path does) lands in the attached repo through + // the link. The primary-scoped allow must not fire. + assert_ne!( + exec_shell_ask_rule_decision( + &config, + "exec_shell", + &json!({"command": "git push", "cwd": "link/absent/../.."}), + Path::new(&primary), + &roots, + crate::tui::approval::ApprovalMode::Suggest, + ), + Some(ToolAskRuleDecision::Allow) + ); +} diff --git a/crates/tui/src/core/engine/turn_loop.rs b/crates/tui/src/core/engine/turn_loop.rs index 33434375b5..7eac44f3e2 100644 --- a/crates/tui/src/core/engine/turn_loop.rs +++ b/crates/tui/src/core/engine/turn_loop.rs @@ -781,6 +781,7 @@ pub(super) fn workspace_write_carve_out_applies( approval_mode: crate::tui::approval::ApprovalMode, auto_approve: bool, workspace: &std::path::Path, + workspace_roots: &[std::path::PathBuf], tool_name: &str, input: &serde_json::Value, approval: ApprovalRequirement, @@ -793,7 +794,11 @@ pub(super) fn workspace_write_carve_out_applies( let Some(paths) = file_write_tool_target_paths(tool_name, input) else { return false; }; - crate::core::authority::paths_within_workspace_write_carve_out(workspace, &paths) + crate::core::authority::paths_within_workspace_write_carve_out( + workspace, + workspace_roots, + &paths, + ) } pub(super) fn registered_tool_forces_prompt( @@ -3426,6 +3431,7 @@ impl Engine { batch_approval_mode, self.api_config.sandbox_mode.as_deref(), &self.session.workspace, + &self.session.workspace_roots, crate::core::authority::SandboxNetworkAccess::from_config( self.api_config.sandbox_network_access, ), @@ -3675,6 +3681,7 @@ impl Engine { self.session.approval_mode, self.session.auto_approve, &self.session.workspace, + &self.session.workspace_roots, &tool_name, &tool_input, prepared.call.approval, @@ -3734,6 +3741,7 @@ impl Engine { &tool_name, &tool_input, &self.session.workspace, + &self.session.workspace_roots, self.session.approval_mode, ) .or_else(|| { @@ -3742,6 +3750,7 @@ impl Engine { &tool_name, &tool_input, &self.session.workspace, + &self.session.workspace_roots, self.session.approval_mode, ) }); @@ -3785,6 +3794,7 @@ impl Engine { self.session.approval_mode, crate::config::is_workspace_trusted(&self.session.workspace), Some(&self.session.workspace), + &self.session.workspace_roots, ); let (decision, audit_event) = auto_review_plan_decision_for_context( &self.config.auto_review_policy, @@ -3855,10 +3865,13 @@ impl Engine { // Repo law: protected invariants with path globs compile into // mechanical write holds. Like the safety floor, law is not // bypassable by mode — it can only add holds, never remove - // one, so this cannot weaken any gate above. + // one, so this cannot weaken any gate above. Each accessible root + // carries its own constitution: a write under an attached root is + // judged against that root's law, not only the primary's. if blocked_error.is_none() && let Some(decision) = crate::repo_law::repo_law_plan_decision( &self.session.workspace, + &self.session.workspace_roots, &tool_name, &tool_input, ) diff --git a/crates/tui/src/core/ops.rs b/crates/tui/src/core/ops.rs index 3fbd102d0b..4c9795c36c 100644 --- a/crates/tui/src/core/ops.rs +++ b/crates/tui/src/core/ops.rs @@ -181,6 +181,9 @@ pub struct SessionSnapshot { /// Exact non-secret configured provider key. pub model_provider_id: Option, pub workspace: PathBuf, + /// Workspace roots currently materialized for the session; `workspace` + /// is the primary root at position 0. + pub workspace_roots: Vec, pub system_prompt: Option, pub mode: String, } @@ -471,6 +474,7 @@ pub enum Op { system_prompt_override: bool, model: String, workspace: PathBuf, + workspace_roots: Vec, mode: AppMode, }, diff --git a/crates/tui/src/core/protocol_parity.rs b/crates/tui/src/core/protocol_parity.rs index 13bd7d099e..9797f0c814 100644 --- a/crates/tui/src/core/protocol_parity.rs +++ b/crates/tui/src/core/protocol_parity.rs @@ -1100,6 +1100,7 @@ pub fn op_to_protocol(op: &Op) -> wire_op::Op { system_prompt_override, model, workspace, + workspace_roots, mode, } => wire_op::Op::SyncSession { engine_session_id: session_id.clone(), @@ -1108,6 +1109,7 @@ pub fn op_to_protocol(op: &Op) -> wire_op::Op { system_prompt_override: *system_prompt_override, model: model.clone(), workspace: workspace.clone(), + workspace_roots: workspace_roots.clone(), mode: app_mode_str(*mode).to_string(), }, Op::CompactContext { @@ -1422,6 +1424,36 @@ mod tests { ); } + /// The tui→wire SyncSession projection must carry the root set: the + /// engine's whole multi-root posture rides on this one mapping, and a + /// regression to an empty set compiles and stays green without this + /// round-trip (round-13 note). + #[test] + fn sync_session_projection_round_trips_a_non_empty_root_set() { + let op = Op::SyncSession { + session_id: Some("sess-1".to_string()), + messages: Vec::new(), + system_prompt: None, + system_prompt_override: false, + model: "m".to_string(), + workspace: std::path::PathBuf::from("/work"), + workspace_roots: vec![ + std::path::PathBuf::from("/work"), + std::path::PathBuf::from("/shared"), + ], + mode: AppMode::Agent, + }; + let msg = op_to_protocol(&op); + let value = serde_json::to_value(&msg).unwrap(); + let back: wire_op::Op = serde_json::from_value(value.clone()).unwrap(); + assert_eq!(back, msg); + assert_eq!( + value["workspace_roots"], + json!(["/work", "/shared"]), + "the projection must ship the live set, not an empty one" + ); + } + #[test] fn mode_labels_round_trip_through_app_mode_parse() { for mode in [AppMode::Agent, AppMode::Plan, AppMode::Operate] { diff --git a/crates/tui/src/core/session.rs b/crates/tui/src/core/session.rs index e654eb8b3d..9071eccc6d 100644 --- a/crates/tui/src/core/session.rs +++ b/crates/tui/src/core/session.rs @@ -168,6 +168,12 @@ pub struct Session { /// Workspace directory pub workspace: PathBuf, + /// Additional workspace roots for this session; `workspace` is always the + /// primary root. Read on every turn when the sandbox policy, tool + /// boundary, and exec-policy context are materialized, so a root-set + /// change takes effect on the next turn. Empty means single-root. + pub workspace_roots: Vec, + /// System prompt (optional) pub system_prompt: Option, /// True when `system_prompt` is a persisted/runtime-supplied prefix that @@ -310,6 +316,7 @@ impl Session { reasoning_effort_auto: false, auto_model: false, workspace, + workspace_roots: Vec::new(), system_prompt: None, system_prompt_override: false, compaction_summary_prompt: None, diff --git a/crates/tui/src/exec_agent.rs b/crates/tui/src/exec_agent.rs index 297cc82368..63d5f3196c 100644 --- a/crates/tui/src/exec_agent.rs +++ b/crates/tui/src/exec_agent.rs @@ -202,10 +202,19 @@ pub(crate) async fn run_exec_agent( ..crate::tools::spec::RuntimeToolServices::default() }; + // Roots enter exec only through the persisted session metadata (Runtime + // API / headless), so capture them once at resume: the engine starts with + // this set and the save path must write the same set back, or a follow-up + // `exec --resume` silently degrades the thread to single-root. + let resume_workspace_roots: Vec = resume_session + .as_ref() + .map_or_else(Vec::new, |saved| saved.metadata.workspace_roots.clone()); + let engine_config = EngineConfig { model: effective_model.clone(), active_route_limits, workspace: workspace.clone(), + workspace_roots: resume_workspace_roots.clone(), session_id: None, subagent_state_root: None, plugin_registry: Some(std::sync::Arc::clone(&engine_plugin_registry)), @@ -356,12 +365,23 @@ pub(crate) async fn run_exec_agent( let mode = AppMode::Agent; let resuming_session = resume_session.is_some(); + let latest_workspace_roots = resume_workspace_roots; let mut loaded_session_id = None; if let Some(saved) = resume_session { let saved_id = saved.metadata.id.clone(); if saved.metadata.workspace != workspace && output_format == ExecOutputFormat::Text { + // The engine runs the SAVED workspace/root pair (the + // `Op::SyncSession` below re-normalizes it against itself), so + // the CLI `--workspace` does not re-anchor a resumed session and + // there is nothing to validate here — the lane never mints a + // moved row. The warning only tells the user which directory the + // session actually runs in (round-22 SF22-3 retires the round-21 + // hard block, which refused legitimate resumes against a + // workspace the lane never adopts and named a + // `--workspace-roots` flag that does not exist). eprintln!( - "Warning: session {} was created in a different workspace ({}). Resuming anyway.", + "Warning: session {} was created in a different workspace ({}). \ + Resuming in the session's own workspace.", truncate_id(&saved_id), saved.metadata.workspace.display(), ); @@ -375,6 +395,7 @@ pub(crate) async fn run_exec_agent( system_prompt_override: false, model: saved.metadata.model, workspace: saved.metadata.workspace, + workspace_roots: saved.metadata.workspace_roots.clone(), mode, }) .await?; @@ -914,6 +935,7 @@ pub(crate) async fn run_exec_agent( id: effective_provider_id.as_deref(), }, &latest_workspace, + &latest_workspace_roots, &latest_system_prompt, latest_session_id.as_deref(), u64::from(usage.input_tokens) + u64::from(usage.output_tokens), diff --git a/crates/tui/src/lib.rs b/crates/tui/src/lib.rs index 7ac675f7cc..afdbcdb1f9 100644 --- a/crates/tui/src/lib.rs +++ b/crates/tui/src/lib.rs @@ -1830,7 +1830,7 @@ fn run_with_args(args: Vec) -> Result<()> { // project-level config — `--no-project-config` opts the layer out for // every roster read in this process. crate::fleet::roster::set_project_agent_profiles_enabled(!cli.no_project_config); - let workspace = resolve_workspace(&cli); + let workspace = resolve_workspace(&cli)?; let mut plugin_discovery = None; let mut plugin_registry = None; let (cli, command) = prepare_cli_startup( @@ -2224,7 +2224,7 @@ async fn run_async_main_dispatch( ) } }; - let workspace = resolve_workspace(&cli); + let workspace = resolve_workspace(&cli)?; if args.context_json { run_doctor_context_json(&config, &workspace) } else if args.json { @@ -2268,7 +2268,7 @@ async fn run_async_main_dispatch( Commands::SessionDiagnostics(args) => run_session_diagnostics(args), Commands::Setup(args) => { let config = load_config_from_cli(&cli)?; - let workspace = resolve_workspace(&cli); + let workspace = resolve_workspace(&cli)?; run_setup(&config, &workspace, args, plugin_registry.as_ref()) } Commands::RemoteSetup(args) => remote_setup::run_remote_setup(args), @@ -2482,7 +2482,7 @@ async fn run_async_main_dispatch( } Commands::Fleet(args) => { let config = load_config_from_cli(&cli)?; - let workspace = resolve_workspace(&cli); + let workspace = resolve_workspace(&cli)?; run_fleet_command(&workspace, &config, args).await } Commands::WorkflowTool(args) => { @@ -2514,7 +2514,7 @@ async fn run_async_main_dispatch( Commands::Scorecard(args) => run_scorecard(args), Commands::Mcp { command } => { let config = load_config_from_cli(&cli)?; - let workspace = resolve_workspace(&cli); + let workspace = resolve_workspace(&cli)?; run_mcp_command(&config, &workspace, command, plugin_registry.as_ref()).await } Commands::Features(command) => { @@ -2525,7 +2525,7 @@ async fn run_async_main_dispatch( // Identity derivation is structural: credential-bearing // environment values never enter this path. let config = load_structural_config_from_cli(&cli)?; - let workspace = resolve_workspace(&cli); + let workspace = resolve_workspace(&cli)?; integrations::cli::run(&config, &workspace, command) } Commands::Sandbox(args) => run_sandbox_command(args), @@ -2588,7 +2588,7 @@ async fn run_async_main_dispatch( } Commands::Resume { session_id, last } => { let config = load_config_from_cli(&cli)?; - let workspace = resolve_workspace(&cli); + let workspace = resolve_workspace(&cli)?; let resume_id = resolve_session_id(session_id, last, &workspace)?; run_interactive( &cli, @@ -2602,7 +2602,7 @@ async fn run_async_main_dispatch( } Commands::Fork { session_id, last } => { let config = load_config_from_cli(&cli)?; - let workspace = resolve_workspace(&cli); + let workspace = resolve_workspace(&cli)?; let new_session_id = fork_session(&config, session_id, last, &workspace)?; run_interactive( &cli, @@ -2637,7 +2637,7 @@ async fn run_async_main_dispatch( // snapshots are preserved for explicit resume, but never auto-attached. let mut startup_notice = None; let resume_session_id = if cli.continue_session { - let workspace = resolve_workspace(&cli); + let workspace = resolve_workspace(&cli)?; resolve_continue_session_id( &workspace, io::stdin().is_terminal() && io::stdout().is_terminal(), @@ -2645,7 +2645,7 @@ async fn run_async_main_dispatch( } else if let Some(id) = cli.resume.clone() { Some(id) } else if !cli.fresh { - let workspace = resolve_workspace(&cli); + let workspace = resolve_workspace(&cli)?; preserve_interrupted_checkpoint_for_explicit_resume(&workspace); // Opt-in auto-resume (#2934). Off by default, so the historical // "plain `codewhale` starts fresh" behaviour is unchanged unless the @@ -8093,10 +8093,29 @@ fn init_project() -> Result<()> { Ok(()) } -fn resolve_workspace(cli: &Cli) -> PathBuf { - cli.workspace +fn resolve_workspace(cli: &Cli) -> Result { + let workspace = cli + .workspace .clone() - .unwrap_or_else(|| std::env::current_dir().unwrap_or_else(|_| PathBuf::from("."))) + .unwrap_or_else(|| std::env::current_dir().unwrap_or_else(|_| PathBuf::from("."))); + // An empty `--workspace ""` would persist a vacuous primary root + // (`starts_with("")` contains every path); reject it like the runtime + // thread guard does. + if workspace.as_os_str().is_empty() { + bail!("workspace must not be empty"); + } + if workspace.is_absolute() { + return Ok(workspace); + } + // A relative workspace reaches boundary_roots() as a root whose + // normalized form is empty ("." carries no components), which contains + // every path; resolve it against the process cwd at intake, the same + // rule checked_workspace_path applies to MCP config paths. + Ok(crate::mcp::normalize_path_components( + &std::env::current_dir() + .context("failed to resolve current directory for workspace")? + .join(workspace), + )) } fn load_config_from_cli(cli: &Cli) -> Result { @@ -8401,6 +8420,12 @@ fn fork_session( ); forked.metadata.copy_cost_from(&saved.metadata); forked.metadata.mark_forked_from(&saved.metadata); + // The fork continues the same conversation over the same accessible + // set: stamp the source's roots before the save. Without it the freshly + // constructed (empty) metadata persists, and the disk-authority + // lifecycle merge keeps re-erasing any later correction - the same + // sticky erasure the in-app `/fork` stamp prevents. + forked.metadata.workspace_roots = saved.metadata.workspace_roots.clone(); manager.save_session(&forked)?; let source_title = saved.metadata.title.trim(); @@ -8779,7 +8804,7 @@ async fn run_pr( let prompt = format_pr_prompt(number, &view, &diff); let resume_session_id = if cli.continue_session { - let workspace = resolve_workspace(cli); + let workspace = resolve_workspace(cli)?; latest_session_id_for_workspace(&workspace).ok().flatten() } else { cli.resume.clone() @@ -11815,7 +11840,7 @@ async fn run_workflow_tool_command_inner( bail!("workflow-tool accepts only action=run"); } - let workspace = resolve_workspace(cli); + let workspace = resolve_workspace(cli)?; let mut config = load_config_from_cli(cli)?; merge_user_workspace_config(&mut config, cli.config.clone(), &workspace); if let Ok(env_url) = @@ -12062,6 +12087,12 @@ async fn build_direct_workflow_tool( let allow_shell = yolo || config.allow_shell(); let shell_policy = shell_policy_for_mode(mode, allow_shell); let trusted = crate::workspace_trust::WorkspaceTrust::load_for(workspace); + // Headless workflow contexts are single-root: the caller reaches this + // builder with a workspace path and no root set, so an attached-root write + // of a multi-root session is denied here rather than held. Enforcement + // only (no display surface), byte-identical to base, and the same + // disclosed gap `Runtime::invoke_tool` carries; wiring a session's roots + // through is a scheduled follow-up. let mut context = crate::tools::ToolContext::with_auto_approve( workspace.to_path_buf(), yolo, @@ -12086,6 +12117,7 @@ async fn build_direct_workflow_tool( }, config.sandbox_mode.as_deref(), workspace, + &[], crate::core::authority::SandboxNetworkAccess::from_config(config.sandbox_network_access), )); let network_policy = config.network.clone().map(|network| { @@ -12385,6 +12417,7 @@ fn persist_exec_session( model: &str, provider_route: PersistedProviderRoute<'_>, workspace: &Path, + workspace_roots: &[PathBuf], system_prompt: &Option, session_id: Option<&str>, total_tokens: u64, @@ -12428,6 +12461,7 @@ fn persist_exec_session( provider_route.kind, provider_route.id, workspace, + workspace_roots, ); let id = saved.metadata.id.clone(); manager @@ -12442,12 +12476,14 @@ fn stamp_exec_session_metadata( model_provider_kind: &str, model_provider_id: Option<&str>, workspace: &Path, + workspace_roots: &[PathBuf], ) { saved.metadata.model = model.to_string(); saved .metadata .set_model_provider_route(model_provider_kind, model_provider_id); saved.metadata.workspace = workspace.to_path_buf(); + saved.metadata.workspace_roots = workspace_roots.to_vec(); saved.metadata.mode = Some("exec".to_string()); } @@ -16274,6 +16310,7 @@ api_key = "test-only-key" crate::config::ApiProvider::Custom.as_str(), Some("custom-b"), Path::new("/tmp/exec-resume"), + &[PathBuf::from("/tmp/exec-resume-shared")], ); let mut next_config = custom_exec_config("custom-a"); @@ -16286,6 +16323,18 @@ api_key = "test-only-key" Some("custom-b") ); assert_eq!(persisted.metadata.model, "model-b"); + // The stamp must carry the root set, not only the primary: a resumed + // multi-root exec that dropped it would persist single-root and the + // next `exec --resume` would run degraded. + assert_eq!( + persisted.metadata.workspace_roots, + vec![PathBuf::from("/tmp/exec-resume-shared")], + "the exec stamp must write the root set it was given" + ); + assert_eq!( + persisted.metadata.workspace, + PathBuf::from("/tmp/exec-resume") + ); assert_eq!(next_config.provider.as_deref(), Some("custom-b")); assert_eq!(resumed_model, "model-b"); } @@ -16306,6 +16355,7 @@ api_key = "test-only-key" crate::config::ApiProvider::Custom.as_str(), None, Path::new("/tmp/exec-root"), + &[], ); assert_eq!(saved.metadata.model_provider, "custom"); @@ -16728,6 +16778,30 @@ api_key = "test-only-key" assert!(args.continue_session); } + #[test] + fn workspace_flag_rejects_empty_path() { + // clap's PathBuf parser rejects an empty `--workspace ""` before it + // reaches resolve_workspace; pin that contract so a parser change + // cannot re-open the vacuous-containment lane (`starts_with("")` is + // true for every path). resolve_workspace additionally hard-rejects + // an empty value itself, so the slot stays fail-closed however the + // Cli is built. + let err = Cli::try_parse_from(["codewhale", "--workspace", "", "exec", "probe"]) + .expect_err("empty workspace must be rejected"); + assert_eq!(err.kind(), clap::error::ErrorKind::InvalidValue); + } + + #[test] + fn workspace_flag_resolves_relative_against_process_cwd() { + // A relative spelling resolves to absolute at intake: its normalized + // form would otherwise be the vacuous containment root ("." carries + // no components), so the CLI must not hand it downstream as-is. + let cli = parse_cli(&["codewhale", "--workspace", ".", "exec", "probe"]); + let resolved = resolve_workspace(&cli).expect("relative workspace resolves"); + assert!(resolved.is_absolute()); + assert_eq!(resolved, std::env::current_dir().expect("process cwd")); + } + #[test] fn sessions_footer_points_to_resume_subcommand() { let cli = parse_cli(&["codewhale", "resume", "abc123"]); @@ -19676,3 +19750,53 @@ mod telemetry_surface_tests; #[cfg(test)] #[path = "tests/telemetry_counters.rs"] mod telemetry_counter_tests; + +#[cfg(test)] +mod fork_session_tests { + use super::*; + use crate::session_manager::SessionManager; + use crate::test_support::{EnvVarGuard, lock_test_env}; + + /// The CLI fork continues the same conversation over the same accessible + /// set: the source's roots must reach the persisted fork, or the + /// disk-authority lifecycle merge keeps re-erasing any later correction. + #[test] + fn fork_session_stamps_the_source_workspace_roots() { + let _lock = lock_test_env(); + let tmp = tempfile::tempdir().expect("tempdir"); + let home = tmp.path().join("home"); + std::fs::create_dir_all(&home).expect("home"); + let _home = EnvVarGuard::set("HOME", &home); + + let workspace = tmp.path().join("workspace"); + let shared = tmp.path().join("shared"); + let manager = SessionManager::default_location().expect("default manager"); + let mut source = create_saved_session( + &[crate::models::Message { + role: crate::models::Role::User, + content: vec![crate::models::ContentBlock::Text { + text: "fork me with my roots".to_string(), + cache_control: None, + }], + }], + "deepseek-chat", + &workspace, + 0, + None, + ); + source.metadata.workspace_roots = vec![workspace.clone(), shared.clone()]; + manager.save_session(&source).expect("save source"); + + let config = Config::default(); + let forked_id = fork_session(&config, Some(source.metadata.id.clone()), false, &workspace) + .expect("fork session"); + + let forked = manager.load_session(&forked_id).expect("fork persisted"); + assert_eq!(forked.metadata.workspace, workspace); + assert_eq!( + forked.metadata.workspace_roots, + vec![workspace, shared], + "the fork must persist the source's root set, not the freshly constructed empty one" + ); + } +} diff --git a/crates/tui/src/localization.rs b/crates/tui/src/localization.rs index 1212303fe0..69a7da51c5 100644 --- a/crates/tui/src/localization.rs +++ b/crates/tui/src/localization.rs @@ -1524,6 +1524,7 @@ pub enum MessageId { // `/status` report labels and runtime summaries. StatusLabelRoute, StatusLabelDirectory, + StatusLabelWorkspaceRoots, StatusLabelProjectDocs, StatusLabelMode, StatusLabelSafety, @@ -1576,6 +1577,15 @@ pub enum MessageId { StatusSafetyDisabledSetuidAllowed, StatusSafetyExternal, StatusPointers, + // Multi-root workspace disclosure and /cd persistence receipts. + WorkspaceRootsNotice, + WorkspaceRootsRemainder, + WorkspaceSwitchBusy, + WorkspaceSwitchPersistedActorUnavailable, + WorkspaceSwitchSaveFailedActorQueued, + WorkspaceSwitchPersistFailed, + WorkspaceSwitchSnapshotFailed, + WorkspaceSwitchSessionsDirFailed, // Underwater post-launch empty state. EmptyStateNoGit, EmptyStateMcpLabel, @@ -3646,6 +3656,7 @@ pub const ALL_MESSAGE_IDS: &[MessageId] = &[ MessageId::SessionMetricsStatusLine, MessageId::StatusLabelRoute, MessageId::StatusLabelDirectory, + MessageId::StatusLabelWorkspaceRoots, MessageId::StatusLabelProjectDocs, MessageId::StatusLabelMode, MessageId::StatusLabelSafety, @@ -3698,6 +3709,14 @@ pub const ALL_MESSAGE_IDS: &[MessageId] = &[ MessageId::StatusSafetyDisabledSetuidAllowed, MessageId::StatusSafetyExternal, MessageId::StatusPointers, + MessageId::WorkspaceRootsNotice, + MessageId::WorkspaceRootsRemainder, + MessageId::WorkspaceSwitchBusy, + MessageId::WorkspaceSwitchPersistedActorUnavailable, + MessageId::WorkspaceSwitchSaveFailedActorQueued, + MessageId::WorkspaceSwitchPersistFailed, + MessageId::WorkspaceSwitchSnapshotFailed, + MessageId::WorkspaceSwitchSessionsDirFailed, MessageId::EmptyStateNoGit, MessageId::EmptyStateMcpLabel, MessageId::EmptyStatePrompt, @@ -5197,35 +5216,92 @@ mod tests { ); } + /// `Some` when `pack` spells a different placeholder set for `key` than + /// the English pack — the signal every placeholder-parity gate fails on. + /// Missing keys are gate-precondition violations and panic, matching the + /// gates' previous inline behavior. + fn placeholder_parity_mismatch( + english: &serde_json::Map, + pack: &serde_json::Map, + key: &str, + tag: &str, + ) -> Option { + let english_value = english + .get(key) + .and_then(serde_json::Value::as_str) + .unwrap_or_else(|| panic!("English {key} must be a string")); + let translated = pack + .get(key) + .and_then(serde_json::Value::as_str) + .unwrap_or_else(|| panic!("{tag} is missing raw key {key}")); + let expected = message_placeholders(english_value); + let actual = message_placeholders(translated); + (actual != expected) + .then(|| format!("{key}: {tag} placeholders {actual:?} != English {expected:?}")) + } + #[test] - fn status_report_copy_has_placeholder_parity_across_complete_packs() { + fn status_and_workspace_copy_has_placeholder_parity_across_complete_packs() { let english = raw_locale_messages(Locale::En); - let status_ids = ALL_MESSAGE_IDS + let gated_ids = ALL_MESSAGE_IDS .iter() - .filter(|id| format!("{id:?}").starts_with("Status")); + .filter(|id| { + let key = format!("{id:?}"); + key.starts_with("Status") || key.starts_with("Workspace") + }) + .collect::>(); + assert!( + gated_ids + .iter() + .any(|id| format!("{id:?}").starts_with("Workspace")), + "the gate must cover the Workspace* MessageIds" + ); - for id in status_ids { + for id in gated_ids { let key = format!("{id:?}"); - let english_value = english - .get(&key) - .and_then(serde_json::Value::as_str) - .unwrap_or_else(|| panic!("English {key} must be a string")); for locale in Locale::shipped_complete() { let pack = raw_locale_messages(*locale); - let translated = pack - .get(&key) - .and_then(serde_json::Value::as_str) - .unwrap_or_else(|| panic!("{} is missing raw key {key}", locale.tag())); - assert_eq!( - message_placeholders(translated), - message_placeholders(english_value), - "{} changed placeholders for {key}", - locale.tag() - ); + if let Some(mismatch) = + placeholder_parity_mismatch(&english, &pack, &key, locale.tag()) + { + panic!("{} changed placeholders: {mismatch}", locale.tag()); + } } } } + /// A pack that drops a `{error}` placeholder from a `Workspace*` key must + /// fail the gate — the exact slip that used to ship silently while only + /// `Status*` keys were gated (round-15). + #[test] + fn workspace_placeholder_parity_gate_detects_a_dropped_placeholder() { + let key = "WorkspaceSwitchSnapshotFailed"; + let english = serde_json::json!({ + key: "Failed to snapshot the session for the workspace switch: {error}", + }) + .as_object() + .expect("object") + .clone(); + let mut pack = english.clone(); + pack.insert( + key.to_string(), + serde_json::Value::String("snapshot failed".to_string()), + ); + assert!( + placeholder_parity_mismatch(&english, &pack, key, "test").is_some(), + "a dropped {{error}} placeholder must fail the gate" + ); + + pack.insert( + key.to_string(), + serde_json::Value::String("échec de l'instantané : {error}".to_string()), + ); + assert!( + placeholder_parity_mismatch(&english, &pack, key, "test").is_none(), + "a translated string keeping the placeholder set passes" + ); + } + #[test] fn status_report_copy_preserves_technical_identities_across_complete_packs() { let required: &[(MessageId, &[&str])] = &[ diff --git a/crates/tui/src/mcp.rs b/crates/tui/src/mcp.rs index 3833a4e07c..b658f968b5 100644 --- a/crates/tui/src/mcp.rs +++ b/crates/tui/src/mcp.rs @@ -5030,7 +5030,7 @@ fn resolve_project_mcp_cwd(workspace: &Path, cwd: Option<&Path>) -> Result PathBuf { +pub(crate) fn normalize_path_components(path: &Path) -> PathBuf { let mut normalized = PathBuf::new(); for component in path.components() { match component { diff --git a/crates/tui/src/mcp_server.rs b/crates/tui/src/mcp_server.rs index e49781c9df..960eab20f6 100644 --- a/crates/tui/src/mcp_server.rs +++ b/crates/tui/src/mcp_server.rs @@ -82,6 +82,12 @@ fn mcp_request_model(arguments: &Value, default_model: &str) -> String { } pub fn run_mcp_server(workspace: PathBuf) -> Result<()> { + // The tool registry treats an empty workspace as the vacuous containment + // root (`starts_with("")` accepts every path); fail fast instead of + // serving an uncontained session. + if workspace.as_os_str().is_empty() { + anyhow::bail!("workspace must not be empty"); + } let settings = McpServerSettings::load()?; let mut server = McpServer::new(workspace, settings)?; server.run() diff --git a/crates/tui/src/project_context.rs b/crates/tui/src/project_context.rs index 1040fc004c..51a625d872 100644 --- a/crates/tui/src/project_context.rs +++ b/crates/tui/src/project_context.rs @@ -22,7 +22,7 @@ use std::fs; use std::io::Read; use std::path::{Path, PathBuf}; -pub(crate) use self::constitution::{RepoLawAction, RepoLawRule, load_repo_law_rules}; +pub(crate) use self::constitution::{RepoLawAction, load_repo_law_rules}; use self::constitution::{load_repo_constitution_block, repo_constitution_candidate_paths}; use self::pack::generate_bounded_project_overview; pub use self::pack::generate_project_context_pack; @@ -481,6 +481,12 @@ pub(crate) fn enforce_project_instruction_budget(ctx: &mut ProjectContext) { /// Production goes through [`load_project_context_with_imports`] so the import /// set is explicit at the call site; this exists for tests that only care about /// default behaviour. +/// +/// Multi-root sessions (`workspace_roots`) deliberately discover instructions +/// from the primary root only: additional roots grant filesystem access, not +/// prompt authority. Widening this scan would inflate the prompt and shift the +/// KV prefix-cache stable region with the root set, so any change must weigh +/// that first (see `forkguard_workspace_roots_instruction_discovery_takes_only_the_primary_root`). #[cfg(test)] pub fn load_project_context(workspace: &Path) -> ProjectContext { load_project_context_with_imports(workspace, &foreign_instruction_imports()) @@ -596,6 +602,10 @@ fn load_dir_instructions( /// or paths mentioned in conversation — and the chain never crosses the /// repository boundary. Outside any repository only the workspace itself is /// searched. +/// +/// The walk starts at the primary root only — the same multi-root policy as +/// [`load_project_context`]: additional workspace roots are never scanned for +/// instructions. pub fn load_project_context_with_parents(workspace: &Path) -> ProjectContext { load_project_context_for_host( workspace, @@ -1330,6 +1340,47 @@ mod tests { assert_eq!(load_repo_law_rules(tmp.path()).len(), 1); } + #[test] + fn forkguard_workspace_roots_instruction_discovery_takes_only_the_primary_root() { + // The multi-root discipline for instructions is structural: the + // discovery loader's signature admits exactly one root (`&Path`), so + // an attached root has no input channel into the injected block — the + // lock is the signature, not a runtime branch this test could flip. + // What this test does exercise is the consequence: the block comes + // from the primary root and stays byte-stable whatever else exists. + let primary = tempdir().expect("primary root"); + let attached = tempdir().expect("attached root"); + fs::write( + primary.path().join("AGENTS.md"), + "primary-root instructions", + ) + .expect("write primary AGENTS.md"); + fs::write( + attached.path().join("AGENTS.md"), + "attached-root instructions that must never load", + ) + .expect("write attached AGENTS.md"); + + let with_attached = load_project_context_with_parents_cached_and_home(primary.path(), None); + // Byte-for-byte the same context as loading the primary root alone. + fs::remove_file(attached.path().join("AGENTS.md")).expect("remove attached AGENTS.md"); + let without_attached = + load_project_context_with_parents_cached_and_home(primary.path(), None); + + assert_eq!( + with_attached.instructions, without_attached.instructions, + "the injected instructions are a function of the primary root alone" + ); + let instructions = with_attached + .instructions + .expect("primary instructions load"); + assert!(instructions.contains("primary-root instructions")); + assert!( + !instructions.contains("attached-root"), + "attached root instructions must never be injected: {instructions}" + ); + } + #[test] fn test_load_project_context_empty() { let tmp = tempdir().expect("tempdir"); diff --git a/crates/tui/src/repo_law.rs b/crates/tui/src/repo_law.rs index c0cf6f647f..e95c7f3721 100644 --- a/crates/tui/src/repo_law.rs +++ b/crates/tui/src/repo_law.rs @@ -18,11 +18,11 @@ //! - Only the repo-local constitution participates. The user-global //! constitution stays advisory prose and never reaches this module. -use std::path::Path; +use std::path::{Path, PathBuf}; use serde_json::Value; -use crate::project_context::{RepoLawAction, RepoLawRule, load_repo_law_rules}; +use crate::project_context::{RepoLawAction, load_repo_law_rules}; use crate::tools::apply_patch::{NormalizedApplyPatchInput, normalize_apply_patch_input}; /// Semantic write actions whose inputs name filesystem targets we can hold. @@ -39,11 +39,25 @@ pub(crate) enum RepoLawPlanDecision { Block(String), } -/// Evaluate the workspace's repo law against a proposed tool call. Returns -/// `None` for tools without write targets, workspaces without enforceable -/// law, and writes outside every protected glob. +/// Evaluate the accessible roots' repo law against a proposed tool call. +/// +/// `workspace_roots` carries the roots attached beside the primary; an empty +/// set (a host that never materialized one) keeps exactly the single-root +/// behavior. Each root is judged in its own namespace because the globs are +/// workspace-relative and two roots can carry different laws, so a root's +/// constitution holds the writes that land under it. +/// +/// A *relative* target is judged against every root, not only the one +/// execution will resolve it under: `push_normalized` keeps the relative tail +/// per root, so an attached root's law can hold a write that execution would +/// place under the primary. That direction is deliberate and fail-closed — +/// the worst case is an extra prompt or block, never a missed hold — and +/// `strongest_hold_wins_across_roots` pins it. Returns `None` for tools +/// without write targets, roots without enforceable law, and writes outside +/// every protected glob. pub(crate) fn repo_law_plan_decision( workspace: &Path, + workspace_roots: &[PathBuf], tool_name: &str, tool_input: &Value, ) -> Option { @@ -57,62 +71,96 @@ pub(crate) fn repo_law_plan_decision( if !WRITE_POLICY_ACTIONS.contains(&policy_action) { return None; } - let targets = write_target_paths(workspace, tool_input); - if targets.is_empty() { - return None; - } - let rules = load_repo_law_rules(workspace); - if rules.is_empty() { - return None; - } - // Strongest action wins across all (rule, target) matches. - let mut hold: Option<(&RepoLawRule, &str)> = None; - for rule in &rules { - for target in &targets { - if rule.globs.is_match(target) { - let stronger = matches!(rule.action, RepoLawAction::Block) || hold.is_none(); - let already_blocking = hold - .as_ref() - .is_some_and(|(held, _)| matches!(held.action, RepoLawAction::Block)); - if stronger && !already_blocking { - hold = Some((rule, target.as_str())); + // Strongest action wins across all (root, rule, target) matches. The + // reason is built where the match is found so the borrow does not have to + // outlive the per-root rule set. + let mut hold: Option<(bool, String)> = None; + for root in codewhale_core::normalize_workspace_roots(workspace, workspace_roots) { + // Canonicalize once per root with a raw fallback (the + // `ToolContext::boundary_roots` idiom): a root that does not resolve + // still judges raw spellings, so its constitution is never silently + // dropped. + let root_canonical = root.canonicalize().unwrap_or_else(|_| root.clone()); + let targets = write_target_paths(workspace, &root, &root_canonical, tool_input); + if targets.is_empty() { + continue; + } + let rules = load_repo_law_rules(&root); + for rule in &rules { + for target in &targets { + if !rule.globs.is_match(target) { + continue; + } + let blocking = matches!(rule.action, RepoLawAction::Block); + let already_blocking = hold.as_ref().is_some_and(|(blocking, _)| *blocking); + if (blocking || hold.is_none()) && !already_blocking { + hold = Some(( + blocking, + format!( + "Repo law holds this write: \"{}\" protects {} (matched {target}, .codewhale/constitution.json)", + rule.text, + rule.patterns.join(", ") + ), + )); } } } } - let (rule, target) = hold?; - let protects = rule.patterns.join(", "); - let reason = format!( - "Repo law holds this write: \"{}\" protects {protects} (matched {target}, .codewhale/constitution.json)", - rule.text - ); - Some(match rule.action { - RepoLawAction::Ask => RepoLawPlanDecision::ForcePrompt(reason), - RepoLawAction::Block => RepoLawPlanDecision::Block(reason), + let (blocking, reason) = hold?; + Some(if blocking { + RepoLawPlanDecision::Block(reason) + } else { + RepoLawPlanDecision::ForcePrompt(reason) }) } /// Extract workspace-relative write targets from a tool input. Covers the -/// `path`/`target`/`destination`/`file_path` params, canonical +/// `path`/`filePath`/`target`/`destination`/`file_path` params, canonical /// `replace[].path`, legacy `changes[].path`, and /// every unified-diff / codex-envelope header shape the patch tools accept — /// old (`--- `) and new (`+++ `) paths, with or without an `a/`/`b/` prefix, /// tab-timestamp suffixes stripped, and `/dev/null` (deletion) falling back /// to the counterpart path. Missing any shape the tool honors is a hold /// bypass, so this deliberately over-collects candidate paths. -fn write_target_paths(workspace: &Path, input: &Value) -> Vec { +/// +/// `workspace` is the primary root (what execution resolves relative targets +/// against); `root` is the root whose law is being judged, with +/// `root_canonical` its resolved spelling. +fn write_target_paths( + workspace: &Path, + root: &Path, + root_canonical: &Path, + input: &Value, +) -> Vec { let mut targets = Vec::new(); - for key in ["path", "target", "destination", "file_path"] { + // `filePath`/`file_path` are the spellings `PATH_ALIASES` folds onto + // `path` at execute time (`tools/file.rs`); the default `ToolSpec:: + // prepare` passes input through unchanged, so plan-time judgment must + // scan them too — a `filePath`-spelled write otherwise gets zero + // repo-law targets and no constitution ever fires (round-22 B22-2). + // Round-23 nit: the alias spellings derive from the shared + // `PATH_ALIASES` constant (no second source of truth). + let alias_keys: Vec = crate::tools::file::PATH_ALIASES + .iter() + .map(|alias| alias.alias.to_string()) + .collect(); + let mut keys: Vec = vec![ + "path".to_string(), + "target".to_string(), + "destination".to_string(), + ]; + keys.extend(alias_keys); + for key in &keys { if let Some(path) = input.get(key).and_then(Value::as_str) { - push_normalized(&mut targets, workspace, path); + push_normalized(&mut targets, workspace, root, root_canonical, path); } } match normalize_apply_patch_input(input) { Ok(NormalizedApplyPatchInput::Replacement { entries, .. }) => { for change in entries { if let Some(path) = change.get("path").and_then(Value::as_str) { - push_normalized(&mut targets, workspace, path); + push_normalized(&mut targets, workspace, root, root_canonical, path); } } } @@ -120,25 +168,37 @@ fn write_target_paths(workspace: &Path, input: &Value) -> Vec { let mut pending_old: Option = None; for line in patch.lines() { if let Some(rest) = line.strip_prefix("*** Update File: ") { - push_normalized(&mut targets, workspace, rest.trim()); + push_normalized(&mut targets, workspace, root, root_canonical, rest.trim()); } else if let Some(rest) = line.strip_prefix("*** Add File: ") { - push_normalized(&mut targets, workspace, rest.trim()); + push_normalized(&mut targets, workspace, root, root_canonical, rest.trim()); } else if let Some(rest) = line.strip_prefix("*** Delete File: ") { - push_normalized(&mut targets, workspace, rest.trim()); + push_normalized(&mut targets, workspace, root, root_canonical, rest.trim()); } else if let Some(rest) = line.strip_prefix("--- ") { // Old path: remember it so a `+++ /dev/null` deletion still // holds the file being removed. pending_old = diff_header_path(rest); if let Some(ref p) = pending_old { - push_normalized(&mut targets, workspace, p); + push_normalized(&mut targets, workspace, root, root_canonical, p); } } else if let Some(rest) = line.strip_prefix("+++ ") { match diff_header_path(rest) { - Some(new_path) => push_normalized(&mut targets, workspace, &new_path), + Some(new_path) => push_normalized( + &mut targets, + workspace, + root, + root_canonical, + &new_path, + ), // `+++ /dev/null` → deletion; the target is the old path. None => { if let Some(old) = pending_old.take() { - push_normalized(&mut targets, workspace, &old); + push_normalized( + &mut targets, + workspace, + root, + root_canonical, + &old, + ); } } } @@ -167,20 +227,49 @@ fn diff_header_path(rest: &str) -> Option { Some(stripped.to_string()) } -/// Normalize to a forward-slash, workspace-relative string so globs written +/// Normalize to a forward-slash, root-relative string so globs written /// as `crates/x/**` match regardless of how the tool spelled the path. Crucially /// this collapses `.`/`..` path components the same way the write tools' /// `resolve_path` does, so an interior `crates/./protocol/x` or /// `x/../crates/protocol/x` cannot spell its way past a glob (a confirmed /// bypass before this). -fn push_normalized(targets: &mut Vec, workspace: &Path, raw: &str) { +/// +/// `workspace` (primary) and `root` (the law being judged) differ for +/// multi-root sessions. A relative spelling is judged against every root — +/// keep the raw collapsed tail per root, so an attached root's law can hold +/// a write that execution would place under the primary (fail-closed: an +/// extra prompt or block at worst). +/// +/// Spelling alone is not enough, because execution resolves writes +/// canonically: `ToolContext::resolve_path` joins a relative spelling onto +/// the primary (an absolute one stands), normalizes lexically, and then +/// admits a candidate that canonicalizes into any boundary root with no +/// containment re-check. So each root also judges where the write actually +/// lands — the execution candidate collapsed lexically, then resolved through +/// symlinks — stripped against both the raw and the canonical root spelling, +/// the same dual check `carve_out_target_allowed` performs. Without that, a +/// canonical spelling of a symlinked root, an interior symlink, or an +/// absolute `..` collapse carries the write into a root whose anchored globs +/// never fired — a block-class law bypass. +fn push_normalized( + targets: &mut Vec, + workspace: &Path, + root: &Path, + root_canonical: &Path, + raw: &str, +) { let trimmed = raw.trim().replace('\\', "/"); if trimmed.is_empty() { return; } - // Make workspace-relative when the tool gave an absolute path inside it. + // Make root-relative when the tool gave an absolute path inside the root, + // under either its raw or its canonical spelling (a root reached through + // a symlink still carries its law). let path = Path::new(&trimmed); - let relative = path.strip_prefix(workspace).unwrap_or(path); + let relative = path + .strip_prefix(root) + .or_else(|_| path.strip_prefix(root_canonical)) + .unwrap_or(path); // Lexically collapse CurDir (`.`) and ParentDir (`..`) components, and // drop any leading root/empty component. An absolute path outside the @@ -192,8 +281,9 @@ fn push_normalized(targets: &mut Vec, workspace: &Path, raw: &str) { "" | "." => {} ".." => { // A `..` that pops above the root escapes the workspace; keep - // an explicit marker so it can never match a workspace-relative - // glob, and the ordinary approval/sandbox gates still govern it. + // an explicit marker so this spelling tail can never match a + // workspace-relative glob. Where the write actually lands is + // judged separately below from the clamped execution candidate. if parts.pop().is_none() { parts.push("..".to_string()); } @@ -201,12 +291,78 @@ fn push_normalized(targets: &mut Vec, workspace: &Path, raw: &str) { other => parts.push(other.to_string()), } } + // Judge the execution-landing path against this root, under both its raw + // and its canonical spelling. Execution joins the *raw* spelling onto the + // primary (`ToolContext::resolve_path`), so derive the candidate from the + // raw string with component operations — splitting display strings is not + // a path operation and silently misparses Windows separators. + let raw_path = Path::new(raw); + let raw_joined = if raw_path.is_absolute() { + raw_path.to_path_buf() + } else { + workspace.join(raw_path) + }; + // The normalizer clamps a `..` at the filesystem root exactly like + // execution, so an overshoot spelling still yields the landing path the + // write tools would admit — judging it is what closes the overshoot + // bypass into an attached root. + let candidate = normalize_lexical_components(&raw_joined); + if let Ok(tail) = candidate + .strip_prefix(root) + .or_else(|_| candidate.strip_prefix(root_canonical)) + { + let tail = tail.to_string_lossy().replace('\\', "/"); + if !tail.is_empty() { + targets.push(tail); + } + } + // Then symlink reality: resolve the deepest existing ancestor and + // judge the resolved path against the canonical root, so an interior + // symlink hop into this root (or a root reached through one) cannot + // spell its way past the law. + if let Some(resolved) = crate::core::authority::resolve_deepest_existing(&candidate) + && let Ok(tail) = resolved.strip_prefix(root_canonical) + { + let tail = tail.to_string_lossy().replace('\\', "/"); + if !tail.is_empty() { + targets.push(tail); + } + } + // Then symlink reality on the PRE-normalization candidate: the lexical + // normalize above collapses `l/..` BEFORE the resolved leg runs, so a + // symlink+`..` hop (`/p/l/../secret` with `/p/l → /shared/x`) judged the + // collapsed `/p/secret` while execution's canonicalize expands the link + // FIRST and only then applies `..` — landing in `/shared/secret`. The + // attached root's constitution never saw the target (round-22 B22-1). + // Resolving the raw joined candidate walks the same symlink-expanded + // reality execution walks; the already-normalized leg above stays so + // the overshoot-clamp behavior is judged both ways. + if let Some(resolved) = crate::core::authority::resolve_deepest_existing(&raw_joined) + && let Ok(tail) = resolved.strip_prefix(root_canonical) + { + let tail = tail.to_string_lossy().replace('\\', "/"); + if !tail.is_empty() { + targets.push(tail); + } + } let normalized = parts.join("/"); if !normalized.is_empty() { targets.push(normalized); } } +/// Lexically collapse CurDir and ParentDir components of `path` into the +/// candidate the write actually lands on. This IS the normalizer execution +/// applies to a joined candidate (`tools::spec::normalize_path`, called by +/// `ToolContext::resolve_path`), reused so the law can never drift from the +/// gate: a `..` at the filesystem root (or a Windows drive root) CLAMPS, it +/// does not fail, so `/w/x/../../../att/vendor/lib.rs` judges as +/// `/att/vendor/lib.rs` — the landing path execution admits. A `..` a +/// relative spelling cannot pop is kept, again matching execution. +fn normalize_lexical_components(path: &Path) -> PathBuf { + crate::tools::spec::normalize_path(path) +} + #[cfg(test)] mod tests { use super::*; @@ -219,6 +375,16 @@ mod tests { std::fs::write(dir.join("constitution.json"), body).unwrap(); } + /// Single-root call, the shape every host without a materialized root set + /// uses. + fn decide( + workspace: &Path, + tool_name: &str, + tool_input: &Value, + ) -> Option { + repo_law_plan_decision(workspace, &[], tool_name, tool_input) + } + const LAW: &str = r#"{ "authority": ["AGENTS.md"], "protected_invariants": [ @@ -236,7 +402,7 @@ mod tests { r#"{"protected_invariants": ["Prose only, no paths."]}"#, ); assert_eq!( - repo_law_plan_decision( + decide( tmp.path(), "write_file", &json!({"path": "src/main.rs", "content": "x"}), @@ -249,7 +415,7 @@ mod tests { fn block_action_denies_protected_write() { let tmp = TempDir::new().unwrap(); write_law(tmp.path(), LAW); - let decision = repo_law_plan_decision( + let decision = decide( tmp.path(), "write_file", &json!({"path": "crates/protocol/wire.rs", "content": "x"}), @@ -266,7 +432,7 @@ mod tests { fn ask_action_force_prompts_and_names_the_law() { let tmp = TempDir::new().unwrap(); write_law(tmp.path(), LAW); - let decision = repo_law_plan_decision( + let decision = decide( tmp.path(), "edit_file", &json!({"path": "CHANGELOG.md", "old": "a", "new": "b"}), @@ -285,7 +451,7 @@ mod tests { let tmp = TempDir::new().unwrap(); write_law(tmp.path(), LAW); - let blocked = repo_law_plan_decision( + let blocked = decide( tmp.path(), "File", &json!({ @@ -296,7 +462,7 @@ mod tests { ); assert!(matches!(blocked, Some(RepoLawPlanDecision::Block(_)))); - let held = repo_law_plan_decision( + let held = decide( tmp.path(), "File", &json!({ @@ -314,7 +480,7 @@ mod tests { let tmp = TempDir::new().unwrap(); write_law(tmp.path(), LAW); assert_eq!( - repo_law_plan_decision( + decide( tmp.path(), "write_file", &json!({"path": "src/main.rs", "content": "x"}), @@ -322,7 +488,7 @@ mod tests { None ); assert_eq!( - repo_law_plan_decision( + decide( tmp.path(), "read_file", &json!({"path": "crates/protocol/wire.rs"}), @@ -336,28 +502,28 @@ mod tests { let tmp = TempDir::new().unwrap(); write_law(tmp.path(), LAW); // Canonical replace[].path shape. - let decision = repo_law_plan_decision( + let decision = decide( tmp.path(), "apply_patch", &json!({"replace": [{"path": "crates/protocol/msg.rs"}]}), ); assert!(matches!(decision, Some(RepoLawPlanDecision::Block(_)))); // Legacy changes[].path shape must receive the same hold. - let decision = repo_law_plan_decision( + let decision = decide( tmp.path(), "apply_patch", &json!({"changes": [{"path": "crates/protocol/msg.rs"}]}), ); assert!(matches!(decision, Some(RepoLawPlanDecision::Block(_)))); // unified diff shape - let decision = repo_law_plan_decision( + let decision = decide( tmp.path(), "apply_patch", &json!({"patch": "--- a/crates/protocol/msg.rs\n+++ b/crates/protocol/msg.rs\n@@\n"}), ); assert!(matches!(decision, Some(RepoLawPlanDecision::Block(_)))); // codex envelope shape - let decision = repo_law_plan_decision( + let decision = decide( tmp.path(), "apply_patch", &json!({"patch": "*** Begin Patch\n*** Update File: crates/protocol/msg.rs\n*** End Patch\n"}), @@ -375,7 +541,7 @@ mod tests { { "text": "never", "paths": ["docs/frozen/**"], "action": "block" } ]}"#, ); - let decision = repo_law_plan_decision( + let decision = decide( tmp.path(), "write_file", &json!({"path": "docs/frozen/spec.md", "content": "x"}), @@ -388,13 +554,13 @@ mod tests { let tmp = TempDir::new().unwrap(); write_law(tmp.path(), LAW); let absolute = tmp.path().join("crates/protocol/wire.rs"); - let decision = repo_law_plan_decision( + let decision = decide( tmp.path(), "write_file", &json!({"path": absolute.to_string_lossy(), "content": "x"}), ); assert!(matches!(decision, Some(RepoLawPlanDecision::Block(_)))); - let decision = repo_law_plan_decision( + let decision = decide( tmp.path(), "write_file", &json!({"path": "./CHANGELOG.md", "content": "x"}), @@ -410,7 +576,7 @@ mod tests { let tmp = TempDir::new().unwrap(); write_law(tmp.path(), "{ not json"); assert_eq!( - repo_law_plan_decision( + decide( tmp.path(), "write_file", &json!({"path": "crates/protocol/wire.rs", "content": "x"}), @@ -424,7 +590,7 @@ mod tests { ]}"#, ); assert_eq!( - repo_law_plan_decision( + decide( tmp.path(), "write_file", &json!({"path": "crates/protocol/wire.rs", "content": "x"}), @@ -443,7 +609,7 @@ mod tests { "x/../crates/protocol/wire.rs", "./crates/protocol/wire.rs", ] { - let decision = repo_law_plan_decision( + let decision = decide( tmp.path(), "write_file", &json!({ "path": path, "content": "x" }), @@ -459,7 +625,7 @@ mod tests { fn fim_edit_is_gated_like_other_write_tools() { let tmp = TempDir::new().unwrap(); write_law(tmp.path(), LAW); - let decision = repo_law_plan_decision( + let decision = decide( tmp.path(), "fim_edit", &json!({ "path": "crates/protocol/wire.rs", "prefix": "a", "suffix": "b" }), @@ -475,7 +641,7 @@ mod tests { let tmp = TempDir::new().unwrap(); write_law(tmp.path(), LAW); // no a/ or b/ prefix - let d = repo_law_plan_decision( + let d = decide( tmp.path(), "apply_patch", &json!({ "patch": "--- crates/protocol/wire.rs\n+++ crates/protocol/wire.rs\n@@\n" }), @@ -485,7 +651,7 @@ mod tests { "no-prefix: {d:?}" ); // deletion: +++ /dev/null, target is the old path - let d = repo_law_plan_decision( + let d = decide( tmp.path(), "apply_patch", &json!({ "patch": "--- a/crates/protocol/wire.rs\n+++ /dev/null\n@@ -1 +0,0 @@\n-x\n" }), @@ -495,7 +661,7 @@ mod tests { "deletion: {d:?}" ); // tab-timestamp suffix on the header - let d = repo_law_plan_decision( + let d = decide( tmp.path(), "apply_patch", &json!({ "patch": "--- a/x\t2026-01-01\n+++ b/crates/protocol/wire.rs\t2026-01-01 10:00:00\n@@\n" }), @@ -510,7 +676,7 @@ mod tests { fn no_law_file_means_no_holds() { let tmp = TempDir::new().unwrap(); assert_eq!( - repo_law_plan_decision( + decide( tmp.path(), "write_file", &json!({"path": "anything.rs", "content": "x"}), @@ -518,4 +684,377 @@ mod tests { None ); } + + #[test] + fn attached_root_law_holds_writes_under_that_root() { + let primary = TempDir::new().unwrap(); + let attached = TempDir::new().unwrap(); + write_law(primary.path(), LAW); + write_law( + attached.path(), + r#"{"protected_invariants": [ + { "text": "Vendored tree is read-only", "paths": ["vendor/**"], "action": "block" } + ]}"#, + ); + let roots = vec![attached.path().to_path_buf()]; + + // Root-relative globs stay root-relative: the primary's + // `crates/protocol/**` must not fire on a same-shaped path under an + // attached root just because the tail happens to look alike. + assert_eq!( + repo_law_plan_decision( + primary.path(), + &roots, + "write_file", + &json!({ + "path": attached.path().join("crates/protocol/wire.rs"), + "content": "x" + }), + ), + None + ); + + let decision = repo_law_plan_decision( + primary.path(), + &roots, + "write_file", + &json!({"path": attached.path().join("vendor/lib.rs"), "content": "x"}), + ); + let Some(RepoLawPlanDecision::Block(reason)) = decision else { + panic!("expected the attached root's law to block, got {decision:?}"); + }; + assert!(reason.contains("Vendored tree is read-only"), "{reason}"); + } + + #[test] + fn strongest_hold_wins_across_roots() { + let primary = TempDir::new().unwrap(); + let attached = TempDir::new().unwrap(); + write_law( + primary.path(), + r#"{"protected_invariants": [ + { "text": "ask in primary", "paths": ["shared/**"] } + ]}"#, + ); + write_law( + attached.path(), + r#"{"protected_invariants": [ + { "text": "block in attached", "paths": ["shared/**"], "action": "block" } + ]}"#, + ); + + // The same relative target matches an Ask in the primary and a Block + // in the attached root; law can only add holds, so the Block wins. + let decision = repo_law_plan_decision( + primary.path(), + &[attached.path().to_path_buf()], + "write_file", + &json!({"path": "shared/lib.rs", "content": "x"}), + ); + assert!( + matches!(decision, Some(RepoLawPlanDecision::Block(_))), + "{decision:?}" + ); + } + + #[test] + fn dotdot_spelled_relative_target_still_holds_in_the_attached_root() { + // A `..`-spelled relative target execution resolves into an attached + // root must not escape that root's anchored globs by spelling: the + // judged tail is the execution-resolved path under the containing + // root, not the raw `..` spelling (which never matched anything). + let primary = TempDir::new().unwrap(); + let attached = TempDir::new().unwrap(); + write_law( + attached.path(), + r#"{"protected_invariants": [ + { "text": "Vendored tree is read-only", "paths": ["vendor/**"], "action": "block" } + ]}"#, + ); + let spelling = format!( + "../{}/vendor/lib.rs", + attached.path().file_name().unwrap().to_string_lossy() + ); + + let decision = repo_law_plan_decision( + primary.path(), + &[attached.path().to_path_buf()], + "write_file", + &json!({"path": spelling, "content": "x"}), + ); + let Some(RepoLawPlanDecision::Block(reason)) = decision else { + panic!( + "expected the attached root's law to hold a ..-spelled target, got {decision:?}" + ); + }; + assert!(reason.contains("Vendored tree is read-only"), "{reason}"); + + // A `..`-spelled target that resolves outside every root stays + // unheld by anchored globs (the ordinary gates govern it). + let decision = repo_law_plan_decision( + primary.path(), + &[attached.path().to_path_buf()], + "write_file", + &json!({"path": "../../elsewhere/lib.rs", "content": "x"}), + ); + assert_eq!(decision, None, "an out-of-tree escape has no anchored hold"); + } + + #[cfg(unix)] + #[test] + fn symlinked_attached_root_law_holds_a_canonical_spelled_target() { + // The attached root is a symlink to the real repo. A target spelled + // with the real (canonical) path never strip-prefixes the raw root + // spelling, yet execution canonicalizes the write straight into the + // repo — the root's law must still hold it. + let primary = TempDir::new().unwrap(); + let real = TempDir::new().unwrap(); + write_law( + real.path(), + r#"{"protected_invariants": [ + { "text": "Vendored tree is read-only", "paths": ["vendor/**"], "action": "block" } + ]}"#, + ); + std::fs::create_dir(real.path().join("vendor")).unwrap(); + let link_parent = TempDir::new().unwrap(); + let linked = link_parent.path().join("linked"); + std::os::unix::fs::symlink(real.path(), &linked).expect("symlink"); + + let decision = repo_law_plan_decision( + primary.path(), + &[linked], + "write_file", + &json!({"path": real.path().join("vendor/lib.rs"), "content": "x"}), + ); + let Some(RepoLawPlanDecision::Block(reason)) = decision else { + panic!( + "expected the symlinked root's law to hold a canonical-spelled target, got {decision:?}" + ); + }; + assert!(reason.contains("Vendored tree is read-only"), "{reason}"); + } + + #[cfg(unix)] + #[test] + fn interior_symlink_target_lands_under_the_attached_roots_law() { + // A relative spelling through an interior symlink of the primary + // canonicalizes into the attached repo at execution; the judged tail + // must be the resolved path under that root, not the raw spelling + // (which matches none of its anchored globs). + let primary = TempDir::new().unwrap(); + let attached = TempDir::new().unwrap(); + write_law( + attached.path(), + r#"{"protected_invariants": [ + { "text": "Vendored tree is read-only", "paths": ["vendor/**"], "action": "block" } + ]}"#, + ); + std::fs::create_dir(attached.path().join("vendor")).unwrap(); + std::os::unix::fs::symlink(attached.path(), primary.path().join("linked2")) + .expect("symlink"); + + let decision = repo_law_plan_decision( + primary.path(), + &[attached.path().to_path_buf()], + "write_file", + &json!({"path": "linked2/vendor/lib.rs", "content": "x"}), + ); + let Some(RepoLawPlanDecision::Block(reason)) = decision else { + panic!( + "expected the attached root's law to hold an interior-symlink target, got {decision:?}" + ); + }; + assert!(reason.contains("Vendored tree is read-only"), "{reason}"); + } + + #[test] + fn absolute_dotdot_spelling_into_an_attached_root_is_held() { + // An absolute spelling whose `..` collapse lands inside an attached + // root: execution's lexical normalize pops the `..` and admits the + // write, so the attached root's anchored globs must judge the + // collapsed landing path, not the raw spelling. + let primary = TempDir::new().unwrap(); + let attached = TempDir::new().unwrap(); + write_law( + attached.path(), + r#"{"protected_invariants": [ + { "text": "Vendored tree is read-only", "paths": ["vendor/**"], "action": "block" } + ]}"#, + ); + let spelling = format!( + "{}/x/../../{}/vendor/lib.rs", + primary.path().display(), + attached.path().file_name().unwrap().to_string_lossy() + ); + + let decision = repo_law_plan_decision( + primary.path(), + &[attached.path().to_path_buf()], + "write_file", + &json!({"path": spelling, "content": "x"}), + ); + let Some(RepoLawPlanDecision::Block(reason)) = decision else { + panic!( + "expected the attached root's law to hold an absolute `..`-spelled target, got {decision:?}" + ); + }; + assert!(reason.contains("Vendored tree is read-only"), "{reason}"); + } + + #[test] + fn absolute_dotdot_overshoot_into_an_attached_root_is_held() { + // Sibling of the two-`..` pin above, with one `..` MORE than the + // spelling is deep: the collapse overshoots the filesystem root. + // Execution's `normalize_path` CLAMPS the extra `..` at the root, so + // `/w/x/../../../att/vendor/lib.rs` lands on `/att/vendor/lib.rs` and + // the attached repo's law must hold it; a strict collapse that bails + // on the overshoot judges no landing path and silently admits the + // write in every posture (a confirmed block-class bypass). + let primary = TempDir::new().unwrap(); + let attached = TempDir::new().unwrap(); + write_law( + attached.path(), + r#"{"protected_invariants": [ + { "text": "Vendored tree is read-only", "paths": ["vendor/**"], "action": "block" } + ]}"#, + ); + // Pop `x` plus every primary component, then overshoot once more + // (RootDir/Prefix components are not popped, so the count is exact on + // Unix and one over on Windows — extra `..`s clamp harmlessly). Then + // re-descend the attached root's own components from the root. + let dots = vec![".."; primary.path().components().count() + 1].join("/"); + let attached_tail = attached + .path() + .components() + .filter_map(|c| match c { + std::path::Component::Normal(part) => Some(part.to_string_lossy().into_owned()), + _ => None, + }) + .collect::>() + .join("/"); + let spelling = format!( + "{}/x/{dots}/{attached_tail}/vendor/lib.rs", + primary.path().display() + ); + + let decision = repo_law_plan_decision( + primary.path(), + &[attached.path().to_path_buf()], + "write_file", + &json!({"path": spelling, "content": "x"}), + ); + let Some(RepoLawPlanDecision::Block(reason)) = decision else { + panic!( + "expected the attached root's law to hold a `..`-overshoot target (clamps to {attached_tail}/vendor/lib.rs), got {decision:?}" + ); + }; + assert!(reason.contains("Vendored tree is read-only"), "{reason}"); + } + + #[test] + fn lexical_normalize_clamps_parent_dir_at_the_filesystem_root() { + // The landing normalizer is execution's own `normalize_path`: a `..` + // at the filesystem root clamps instead of failing, so the overshoot + // spelling judges as the path execution would admit. + assert_eq!( + normalize_lexical_components(Path::new("/w/x/../../../att/vendor/lib.rs")), + PathBuf::from("/att/vendor/lib.rs") + ); + assert_eq!( + normalize_lexical_components(Path::new("/a/..")), + PathBuf::from("/") + ); + // A `..` a relative spelling cannot pop is kept, matching execution. + assert_eq!( + normalize_lexical_components(Path::new("a/../../b")), + PathBuf::from("../b") + ); + } + + #[test] + fn relative_target_landing_under_an_ancestor_root_is_held() { + // The session cwd is a subdirectory of an attached root: execution + // joins a relative target onto the primary, landing INSIDE the + // attached root, whose anchored globs must judge the landing path — + // the raw tail alone (`x/y` against `sub/**`) never matches. + let attached = TempDir::new().unwrap(); + let primary = attached.path().join("sub"); + std::fs::create_dir_all(&primary).unwrap(); + write_law( + attached.path(), + r#"{"protected_invariants": [ + { "text": "Sub tree is read-only", "paths": ["sub/**"], "action": "block" } + ]}"#, + ); + + let decision = repo_law_plan_decision( + &primary, + &[attached.path().to_path_buf()], + "write_file", + &json!({"path": "x/y", "content": "x"}), + ); + let Some(RepoLawPlanDecision::Block(reason)) = decision else { + panic!( + "expected the ancestor root's law to hold a relative target landing inside it, got {decision:?}" + ); + }; + assert!(reason.contains("Sub tree is read-only"), "{reason}"); + } + + #[cfg(unix)] + #[test] + fn symlink_dotdot_hop_into_an_attached_root_is_held() { + // Round-22 B22-1: the kernel applies `..` AFTER symlink expansion, so + // `/p/l/../secret` with `/p/l → /shared/x` executes in + // `/shared/secret` — but the lexical normalize collapsed `l/..` FIRST + // and the resolved leg ran on that collapsed spelling, so the + // attached root's constitution judged `/p/secret` and never fired. + // Under Full Access the write landed in a constitution-protected path + // with no hold at all (at base it was PathEscape-blocked). + let primary = TempDir::new().unwrap(); + let attached = TempDir::new().unwrap(); + write_law( + attached.path(), + r#"{"protected_invariants": [ + { "text": "secret is read-only", "paths": ["secret"], "action": "block" } + ]}"#, + ); + std::fs::create_dir(attached.path().join("x")).unwrap(); + std::fs::create_dir(attached.path().join("secret")).unwrap(); + std::os::unix::fs::symlink(attached.path().join("x"), primary.path().join("l")) + .expect("symlink"); + + let spelling = format!("{}/l/../secret", primary.path().display()); + let decision = repo_law_plan_decision( + primary.path(), + &[attached.path().to_path_buf()], + "write_file", + &json!({"path": spelling, "content": "x"}), + ); + let Some(RepoLawPlanDecision::Block(reason)) = decision else { + panic!("expected the attached root's law to hold a symlink+`..` hop, got {decision:?}"); + }; + assert!(reason.contains("secret is read-only"), "{reason}"); + } + + #[test] + #[allow(non_snake_case)] + fn filePath_spelled_write_receives_the_same_hold() { + // Round-22 B22-2: execution folds the camelCase `filePath` alias onto + // `path` (`PATH_ALIASES`) only at execute time, and the default + // `ToolSpec::prepare` passes input through unchanged — so a + // `filePath`-spelled write produced zero repo-law targets and no + // constitution ever fired. + let tmp = TempDir::new().unwrap(); + write_law(tmp.path(), LAW); + let decision = decide( + tmp.path(), + "write_file", + &json!({"filePath": "crates/protocol/wire.rs", "content": "x"}), + ); + let Some(RepoLawPlanDecision::Block(reason)) = decision else { + panic!("expected the filePath-spelled write to be held, got {decision:?}"); + }; + assert!(reason.contains("The wire format is frozen"), "{reason}"); + } } diff --git a/crates/tui/src/runtime_api.rs b/crates/tui/src/runtime_api.rs index bc4576930b..0eeb4beee0 100644 --- a/crates/tui/src/runtime_api.rs +++ b/crates/tui/src/runtime_api.rs @@ -4431,7 +4431,11 @@ async fn patch_undo_thread_turn( .get_thread(&id) .await .map_err(map_thread_err)?; - let patch_result = patch_undo_workspace_files(&thread.workspace, thread.session_id.as_deref()); + let patch_result = patch_undo_workspace_files( + &thread.workspace, + &thread.workspace_roots, + thread.session_id.as_deref(), + ); // Step 2: Remove the last conversation turn (undo_conversation). let (forked_thread, original_user_text) = state @@ -4454,6 +4458,7 @@ async fn patch_undo_thread_turn( /// current workspace — same target selection as the TUI's `patch_undo`. fn patch_undo_workspace_files( workspace: &FsPath, + workspace_roots: &[std::path::PathBuf], current_session_id: Option<&str>, ) -> PatchUndoResult { let repo = match crate::snapshot::SnapshotRepo::open_or_init(workspace) { @@ -4523,13 +4528,21 @@ fn patch_undo_workspace_files( }); let short = &target.id.as_str()[..target.id.as_str().len().min(8)]; + // Snapshots are primary-bound: with attached roots in the thread set, + // name the rollback boundary instead of implying a full revert. + let boundary_note = if crate::snapshot::restore_covers_primary_only(workspace, workspace_roots) + { + format!("\n{}", crate::snapshot::ATTACHED_ROOTS_NOT_REVERTED_NOTE) + } else { + String::new() + }; let summary = match diff_stat { Some(ref stat) => format!( - "Restored snapshot '{}' ({}). Files affected:\n{stat}", + "Restored snapshot '{}' ({}). Files affected:\n{stat}{boundary_note}", target.label, short ), None => format!( - "Restored snapshot '{}' ({}). No diff changes detected.", + "Restored snapshot '{}' ({}). No diff changes detected.{boundary_note}", target.label, short ), }; @@ -5858,13 +5871,88 @@ async fn restore_snapshot( State(state): State, Path(id): Path, ) -> Result, ApiError> { + // Round-23 SF23-1 + B23-2: every read happens BEFORE the mutating + // restore (a thread-store failure must not turn a completed rollback + // into a 500), and the boundary decision no longer depends on the + // snapshot's `[sid=...]` tag matching a live thread record — `PUT + // /v1/sessions` re-keys the thread to a new session handle, so the + // exact join silently dropped the clause through an ordinary, + // disclosed-API sequence. + let snapshot = snapshot_for_workspace(&state.workspace, &id)?; + let mut payload = json!({ "restored": id }); + let mut boundary = false; + // Snapshots are primary-bound: with attached roots in the owning + // thread's set, name the rollback boundary instead of implying a full + // revert (review #484/CodeWhale round-22 B22-4). An untagged (legacy) + // snapshot has no owner to consult and stays unchanged; a TAGGED + // snapshot always names the boundary — fail-safe by construction: + // a matching multi-root thread proves it, and a tagged snapshot whose + // owner no longer matches (the PUT re-key sequence) proves an + // interactive owner existed while proving nothing about the roots + // (round-23 B23-2). + if snapshot.session_id.is_some() { + match state + .runtime_threads + .list_threads(ThreadListFilter::IncludeArchived, None) + .await + { + Ok(threads) => { + let matched = threads + .iter() + .find(|thread| thread.session_id.as_deref() == snapshot.session_id.as_deref()); + boundary = match matched { + Some(thread) => crate::snapshot::restore_covers_primary_only( + &thread.workspace, + &thread.workspace_roots, + ), + None => true, + }; + } + // A thread-store read failure degrades to the conservative + // clause (naming the boundary) rather than a 500 after the + // rollback, and without leaking the store error text. + Err(err) => { + eprintln!( + "[runtime_api] restore boundary lookup failed; naming the boundary conservatively: {err}" + ); + boundary = true; + } + } + } + if boundary { + payload["boundary"] = json!({ + "attached_roots_not_reverted": true, + "note": crate::snapshot::ATTACHED_ROOTS_NOT_REVERTED_NOTE, + }); + } restore_snapshot_for_workspace(&state.workspace, &id)?; - Ok(Json(json!({ - "restored": id, - }))) + Ok(Json(payload)) } -fn restore_snapshot_for_workspace(workspace: &FsPath, id: &str) -> Result<(), ApiError> { +/// Round-23 B23-2/SF23-1: the read half of the restore — find and return +/// the snapshot WITHOUT mutating, so callers can compute the response +/// before the rollback runs. +fn snapshot_for_workspace( + workspace: &FsPath, + id: &str, +) -> Result { + let repo = crate::snapshot::SnapshotRepo::open_or_init(workspace) + .map_err(|e| ApiError::internal(format!("Snapshot repo init failed: {e}")))?; + let known = repo + .list(usize::MAX) + .map_err(|e| ApiError::internal(format!("Failed to list snapshots: {e}")))?; + known + .iter() + .find(|snapshot| snapshot.id.as_str() == id) + .cloned() + .ok_or_else(|| ApiError::not_found(format!("no such snapshot: {id}"))) +} + +fn restore_snapshot_for_workspace( + workspace: &FsPath, + id: &str, +) -> Result { + let snapshot = snapshot_for_workspace(workspace, id)?; let repo = crate::snapshot::SnapshotRepo::open_or_init(workspace) .map_err(|e| ApiError::internal(format!("Snapshot repo init failed: {e}")))?; // The id arrives from the request path and is handed to git as a @@ -5874,18 +5962,10 @@ fn restore_snapshot_for_workspace(workspace: &FsPath, id: &str) -> Result<(), Ap // for command-line-injection scanners (an allowlist `contains` is // their modeled trust boundary), so the pre-existing, accepted flow // stops re-flagging when call sites are refactored. - let known_ids: Vec = repo - .list(usize::MAX) - .map_err(|e| ApiError::internal(format!("Failed to list snapshots: {e}")))? - .into_iter() - .map(|snapshot| snapshot.id.as_str().to_string()) - .collect(); - if !known_ids.contains(&id.to_string()) { - return Err(ApiError::not_found(format!("no such snapshot: {id}"))); - } let snapshot_id = crate::snapshot::SnapshotId(id.to_string()); repo.restore(&snapshot_id) - .map_err(|e| ApiError::internal(format!("Snapshot restore failed: {e}"))) + .map_err(|e| ApiError::internal(format!("Snapshot restore failed: {e}")))?; + Ok(snapshot) } fn snapshot_entries_for_workspace( diff --git a/crates/tui/src/runtime_api/sessions.rs b/crates/tui/src/runtime_api/sessions.rs index 81d8ed0ab5..80b3e71114 100644 --- a/crates/tui/src/runtime_api/sessions.rs +++ b/crates/tui/src/runtime_api/sessions.rs @@ -198,6 +198,16 @@ pub(super) async fn patch_session( Path(id): Path, Json(req): Json, ) -> Result, ApiError> { + // Normalize the id once at the boundary: the store judges the trimmed + // value, so a padded id (`"%20sess…"` in the path) is one session to the + // store, not two rows distinguished by whitespace. An empty id has no + // target. + let id = id.trim().to_string(); + if id.is_empty() { + return Err(ApiError::bad_request( + "PATCH /v1/sessions/{id} requires a non-empty session id", + )); + } if req.title.is_none() && req.archived.is_none() { return Err(ApiError::bad_request( "PATCH /v1/sessions/{id} requires at least one of `title` or `archived`", @@ -312,6 +322,7 @@ pub(super) async fn resume_session_thread( model_provider: Some(session.metadata.model_provider.clone()), model_provider_id: session.metadata.model_provider_id.clone(), workspace: Some(session.metadata.workspace.clone()), + workspace_roots: session.metadata.workspace_roots.clone(), mode: Some(mode), allow_shell: None, trust_mode: None, @@ -418,6 +429,7 @@ pub(super) async fn create_session_from_thread( )?; } session.system_prompt = detail.thread.system_prompt.clone(); + session.metadata.workspace_roots = detail.thread.workspace_roots.clone(); if let Some(title) = session_title_override(req.title.as_deref(), detail.thread.title.as_deref()) @@ -717,8 +729,22 @@ async fn persist_thread_cost( /// token counts and message ordering are authoritative. pub(super) async fn save_current_session( State(state): State, - Json(req): Json, + Json(mut req): Json, ) -> Result, ApiError> { + // Normalize the id once at the boundary: the store judges the trimmed + // value, so a padded id (`" sess… "`) is one session to the store, not + // two rows distinguished by whitespace. An explicit-but-empty id has no + // target at all and is rejected, not silently turned into "create new". + if let Some(raw) = req.session_id.as_deref() { + let trimmed = raw.trim(); + if trimmed.is_empty() { + return Err(ApiError::bad_request( + "`session_id` must not be empty when provided", + )); + } + req.session_id = Some(trimmed.to_string()); + } + // Find the thread to save. let thread_id = match req.thread_id { Some(id) => id, @@ -737,6 +763,14 @@ pub(super) async fn save_current_session( } }; + // Round-20 B20-3: the live-session guard was removed. The static + // registry is process-local and the runtime HTTP server never coexists + // with an interactive TUI surface in any shipped topology, so the guard + // could never engage — it headlined a breaking change that is + // unobservable (the registry itself stays: same-process retention + // pruning consults it). A concurrent writer in the same process is + // still arbitrated by last-write-wins at the store layer. + // Get the engine handle (loads the thread into an engine if needed), // then request a session snapshot. This reuses the same code path as // TUI's `build_session_snapshot`: the engine holds the authoritative @@ -774,6 +808,19 @@ pub(super) async fn save_current_session( snapshot.model_provider_id.as_deref(), ); updated.metadata.mode = Some(snapshot.mode.clone()); + // The paired set travels with the workspace it belongs to, + // exactly as in `/rename` and `/fork`: a PATCH may have moved + // the thread since this session was last saved, and stamping + // only the roots would persist `workspace: ` next + // to a set led by the new directory — a later resume-thread + // then re-admits the abandoned directory as a writable + // primary root. Both fields come from the same snapshot, + // re-normalized so the pair is consistent by construction. + updated.metadata.workspace = snapshot.workspace.clone(); + updated.metadata.workspace_roots = codewhale_core::normalize_workspace_roots( + &snapshot.workspace, + &snapshot.workspace_roots, + ); updated } Err(e) => { @@ -791,6 +838,7 @@ pub(super) async fn save_current_session( &snapshot.model_provider, snapshot.model_provider_id.as_deref(), ); + session.metadata.workspace_roots = snapshot.workspace_roots.clone(); session } else { return Err(ApiError::internal(format!( @@ -812,6 +860,7 @@ pub(super) async fn save_current_session( &snapshot.model_provider, snapshot.model_provider_id.as_deref(), ); + session.metadata.workspace_roots = snapshot.workspace_roots.clone(); session }; @@ -970,9 +1019,9 @@ fn map_session_err(id: &str, err: std::io::Error, action: &str) -> ApiError { std::io::ErrorKind::InvalidInput => { ApiError::bad_request(format!("Invalid session id '{id}'")) } - // The session is open in an interactive Codewhale session, which holds - // the authoritative copy in memory. Fail closed with a typed conflict - // rather than write something its next autosave would revert. + // Round-20 B20-3 retired the producing live-session guard, so this + // kind has no producer left on Unix; the mapping is retained + // defensively (a future io producer must not surface as a 500). std::io::ErrorKind::ResourceBusy => ApiError { status: StatusCode::CONFLICT, message: err.to_string(), diff --git a/crates/tui/src/runtime_api/tests.rs b/crates/tui/src/runtime_api/tests.rs index ef97857500..5d34284372 100644 --- a/crates/tui/src/runtime_api/tests.rs +++ b/crates/tui/src/runtime_api/tests.rs @@ -283,6 +283,7 @@ fn saved_session_with_blocks(blocks: Vec) -> SavedS model_provider: "deepseek".to_string(), model_provider_id: None, workspace: PathBuf::from("."), + workspace_roots: Vec::new(), mode: None, cost: Default::default(), parent_session_id: None, @@ -420,6 +421,7 @@ fn messages_from_thread_detail_batches_tool_results() { reasoning_effort: None, allowed_tools: None, workspace: PathBuf::from("."), + workspace_roots: Vec::new(), mode: "agent".to_string(), permission_posture: Some("ask".to_string()), allow_shell: false, @@ -610,6 +612,7 @@ fn legacy_exact_thread_export_normalizes_provider_kind_and_id() { reasoning_effort: None, allowed_tools: None, workspace: PathBuf::from("."), + workspace_roots: Vec::new(), mode: "agent".to_string(), permission_posture: None, allow_shell: false, @@ -4333,6 +4336,396 @@ async fn session_resume_thread_creates_thread_from_saved_session() -> Result<()> Ok(()) } +#[tokio::test] +async fn session_resume_thread_carries_persisted_workspace_roots() -> Result<()> { + let root = + std::env::temp_dir().join(format!("deepseek-session-resume-roots-{}", Uuid::new_v4())); + let sessions_dir = root.join("sessions"); + fs::create_dir_all(&sessions_dir)?; + let session = json!({ + "schema_version": 1, + "metadata": { + "id": "sess_roots_resume", + "title": "Roots resume session", + "created_at": "2025-01-01T00:00:00Z", + "updated_at": "2025-01-01T00:10:00Z", + "message_count": 1, + "total_tokens": 10, + "model": "deepseek-v4-pro", + "workspace": "/tmp/test", + "workspace_roots": ["/tmp/shared"], + "mode": "agent" + }, + "messages": [ + { + "role": "user", + "content": [{ "type": "text", "text": "Hello, roots!" }] + } + ], + "system_prompt": null + }); + fs::write( + sessions_dir.join("sess_roots_resume.json"), + serde_json::to_string_pretty(&session)?, + )?; + + let Some((addr, _runtime_threads, handle)) = + spawn_test_server_with_root(root.clone(), sessions_dir.clone()).await? + else { + return Ok(()); + }; + let client = crate::tls::reqwest_client(); + + let resp = client + .post(format!( + "http://{addr}/v1/sessions/sess_roots_resume/resume-thread" + )) + .json(&json!({ "model": "deepseek-v4-pro" })) + .send() + .await?; + assert_eq!(resp.status(), StatusCode::CREATED); + let resumed: serde_json::Value = resp.json().await?; + let thread_id = resumed["thread_id"] + .as_str() + .context("missing resumed thread id")?; + + // The HTTP resume must carry the session's persisted roots into the + // created thread: resuming a multi-root session and saving once must + // not launder it back to single-root. + let detail: serde_json::Value = client + .get(format!("http://{addr}/v1/threads/{thread_id}")) + .send() + .await? + .error_for_status()? + .json() + .await?; + assert_eq!(detail["thread"]["workspace"], "/tmp/test"); + assert_eq!( + detail["thread"]["workspace_roots"], + json!(["/tmp/test", "/tmp/shared"]), + "resume must normalize the persisted set with the workspace leading" + ); + + handle.abort(); + Ok(()) +} + +#[tokio::test] +async fn saved_sessions_carry_thread_workspace_roots_through_save_and_resave() -> Result<()> { + let root = std::env::temp_dir().join(format!("deepseek-session-roots-{}", Uuid::new_v4())); + let sessions_dir = root.join("sessions"); + let Some((addr, runtime_threads, handle)) = + spawn_test_server_with_root(root.clone(), sessions_dir.clone()).await? + else { + return Ok(()); + }; + let client = crate::tls::reqwest_client(); + + let created: serde_json::Value = client + .post(format!("http://{addr}/v1/threads")) + .json(&json!({ + "model": "deepseek-v4-pro", + "workspace": root.join("workspace"), + "workspace_roots": ["/shared"] + })) + .send() + .await? + .error_for_status()? + .json() + .await?; + let thread_id = created["id"] + .as_str() + .context("missing thread id")? + .to_string(); + + runtime_threads + .seed_thread_from_messages( + &thread_id, + &[ + Message { + role: Role::User, + content: vec![ContentBlock::Text { + text: "Persist these roots".to_string(), + cache_control: None, + }], + }, + Message { + role: Role::Assistant, + content: vec![ContentBlock::Text { + text: "Roots should survive the save.".to_string(), + cache_control: None, + }], + }, + ], + ) + .await?; + + // Save the thread as a session: the session metadata must carry the + // thread's root set, or a later `exec --resume` silently degrades the + // thread to single-root. + let resp = client + .post(format!("http://{addr}/v1/sessions")) + .json(&json!({ "thread_id": thread_id })) + .send() + .await?; + assert_eq!(resp.status(), StatusCode::CREATED); + let saved: serde_json::Value = resp.json().await?; + let session_handle = saved["session_id"] + .as_str() + .context("missing session id")? + .to_string(); + + let session_manager = crate::session_manager::SessionManager::new(sessions_dir.clone())?; + let stored = session_manager.load_session_by_prefix(&session_handle)?; + let expected_roots = json!([root.join("workspace"), "/shared"]); + assert_eq!( + serde_json::to_value(&stored.metadata.workspace_roots)?, + expected_roots, + "save-thread-as-session must stamp the thread's workspace_roots" + ); + + // Change the thread's set before the re-save. The POST above already + // wrote `expected_roots` to the file, so asserting the same value after + // the PUT would pass with the PUT stamp deleted; the newer set is what + // makes the snapshot save path load-bearing. + let patched: serde_json::Value = client + .patch(format!("http://{addr}/v1/threads/{thread_id}")) + .json(&json!({ "workspace_roots": ["/later"] })) + .send() + .await? + .error_for_status()? + .json() + .await?; + assert_eq!( + patched["workspace_roots"], + json!([root.join("workspace"), "/later"]) + ); + + // Re-saving through the snapshot path must write the thread's *current* + // roots: the engine builds from the thread and the save copies the + // snapshot roots over the metadata. + client + .put(format!("http://{addr}/v1/sessions")) + .json(&json!({ + "thread_id": thread_id, + "session_id": session_handle + })) + .send() + .await? + .error_for_status()?; + let resaved = session_manager.load_session_by_prefix(&session_handle)?; + assert_eq!( + serde_json::to_value(&resaved.metadata.workspace_roots)?, + json!([root.join("workspace"), "/later"]), + "the snapshot save path must write the thread's current roots" + ); + + handle.abort(); + Ok(()) +} + +#[tokio::test] +async fn session_resave_after_workspace_move_keeps_workspace_and_roots_paired() -> Result<()> { + let root = std::env::temp_dir().join(format!("deepseek-session-move-{}", Uuid::new_v4())); + let sessions_dir = root.join("sessions"); + let Some((addr, runtime_threads, handle)) = + spawn_test_server_with_root(root.clone(), sessions_dir.clone()).await? + else { + return Ok(()); + }; + let client = crate::tls::reqwest_client(); + + let w1 = root.join("w1"); + let w2 = root.join("w2"); + let created: serde_json::Value = client + .post(format!("http://{addr}/v1/threads")) + .json(&json!({ + "model": "deepseek-v4-pro", + "workspace": w1, + "workspace_roots": ["/shared"] + })) + .send() + .await? + .error_for_status()? + .json() + .await?; + let thread_id = created["id"] + .as_str() + .context("missing thread id")? + .to_string(); + + runtime_threads + .seed_thread_from_messages( + &thread_id, + &[Message { + role: Role::User, + content: vec![ContentBlock::Text { + text: "Save me at w1, then move me.".to_string(), + cache_control: None, + }], + }], + ) + .await?; + + // Save at w1, then move the thread to w2. The PATCH evicts the engine, + // so the re-save snapshots a fresh engine built from the moved thread. + let resp = client + .post(format!("http://{addr}/v1/sessions")) + .json(&json!({ "thread_id": thread_id })) + .send() + .await?; + assert_eq!(resp.status(), StatusCode::CREATED); + let saved: serde_json::Value = resp.json().await?; + let session_handle = saved["session_id"] + .as_str() + .context("missing session id")? + .to_string(); + + let patched: serde_json::Value = client + .patch(format!("http://{addr}/v1/threads/{thread_id}")) + .json(&json!({ "workspace": w2 })) + .send() + .await? + .error_for_status()? + .json() + .await?; + assert_eq!(patched["workspace"], json!(w2)); + assert_eq!(patched["workspace_roots"], json!([w2, "/shared"])); + + client + .put(format!("http://{addr}/v1/sessions")) + .json(&json!({ + "thread_id": thread_id, + "session_id": session_handle + })) + .send() + .await? + .error_for_status()?; + + // The persisted pair must be internally consistent: `workspace` is w2 + // and the abandoned w1 is nowhere in the root set, or a later + // resume-thread would re-admit w1 as a writable primary root. + let session_manager = crate::session_manager::SessionManager::new(sessions_dir.clone())?; + let resaved = session_manager.load_session_by_prefix(&session_handle)?; + assert_eq!( + resaved.metadata.workspace, w2, + "re-save must stamp the moved workspace beside the roots" + ); + assert_eq!( + serde_json::to_value(&resaved.metadata.workspace_roots)?, + json!([w2, "/shared"]), + "re-save must not leave the abandoned w1 in the persisted root set" + ); + + handle.abort(); + Ok(()) +} + +/// Declared root sets are validated at intake, not silently reshaped. The +/// per-turn sandbox copies the set into `WorkspaceWrite.writable_roots` +/// verbatim, so attaching `/` (or `/..`, or the workspace's parent — the +/// same reach one spelling at a time) would make the sandboxed exec lane +/// filesystem-writable, and a non-absolute entry like `~/shared` used to be +/// silently dropped, shrinking the declared set without a word. All four are +/// rejected now; a normal sibling root still attaches. +#[tokio::test] +async fn thread_create_rejects_super_root_ancestor_and_non_absolute_roots() -> Result<()> { + let root = std::env::temp_dir().join(format!("deepseek-thread-root-intake-{}", Uuid::new_v4())); + let sessions_dir = root.join("sessions"); + let workspace = root.join("workspace"); + let Some((addr, _runtime_threads, handle)) = + spawn_test_server_with_root_token_mobile_workspace( + root.clone(), + sessions_dir, + None, + false, + workspace.clone(), + ) + .await? + else { + return Ok(()); + }; + let client = crate::tls::reqwest_client(); + + // The filesystem root, in the spelling a client would type and in the + // `..` spelling that normalizes to it. + for declared in ["/", "/.."] { + let rejected = client + .post(format!("http://{addr}/v1/threads")) + .json(&json!({ "workspace_roots": [declared] })) + .send() + .await?; + assert_eq!( + rejected.status(), + StatusCode::BAD_REQUEST, + "attaching {declared:?} must be rejected at intake" + ); + } + + // The workspace's parent contains the primary: the same widening, one + // spelling at a time. + let parent = workspace + .parent() + .and_then(|dir| dir.to_str()) + .context("test workspace must have a parent")? + .to_string(); + let rejected = client + .post(format!("http://{addr}/v1/threads")) + .json(&json!({ "workspace_roots": [parent] })) + .send() + .await?; + assert_eq!( + rejected.status(), + StatusCode::BAD_REQUEST, + "attaching the primary's parent must be rejected at intake" + ); + + // A `~` spelling is non-absolute: rejected instead of silently dropped + // from the declared set. + let rejected = client + .post(format!("http://{addr}/v1/threads")) + .json(&json!({ "workspace_roots": ["~/shared"] })) + .send() + .await?; + assert_eq!( + rejected.status(), + StatusCode::BAD_REQUEST, + "a non-absolute root must be rejected, not silently dropped" + ); + + // A normal sibling root still attaches, and the PATCH lane reuses the + // same validation for an explicit replacement set. + let sibling = root.join("sibling-lib"); + let created: serde_json::Value = client + .post(format!("http://{addr}/v1/threads")) + .json(&json!({ "workspace_roots": [sibling.to_string_lossy()] })) + .send() + .await? + .error_for_status()? + .json() + .await?; + let thread_id = created["id"].as_str().context("missing thread id")?; + assert_eq!( + created["workspace_roots"], + json!([workspace.to_string_lossy(), sibling.to_string_lossy()]), + "a sibling root attaches beside the absolute primary" + ); + + let rejected = client + .patch(format!("http://{addr}/v1/threads/{thread_id}")) + .json(&json!({ "workspace_roots": ["/deep/../../.."] })) + .send() + .await?; + assert_eq!( + rejected.status(), + StatusCode::BAD_REQUEST, + "PATCH re-declares the set and must reject a super-root spelling too" + ); + + handle.abort(); + Ok(()) +} + #[tokio::test] async fn session_create_from_completed_thread_saves_messages() -> Result<()> { let root = std::env::temp_dir().join(format!("deepseek-thread-session-{}", Uuid::new_v4())); @@ -4643,12 +5036,12 @@ fn patch_undo_helper_restores_only_the_bound_session() -> Result<()> { repo.snapshot_with_session("pre-turn:foreign", Some("session-foreign"))?; fs::write(&file, "current-after")?; - let restored = patch_undo_workspace_files(&workspace, Some("session-current")); + let restored = patch_undo_workspace_files(&workspace, &[], Some("session-current")); assert!(restored.files_restored, "{:?}", restored.summary); assert_eq!(fs::read_to_string(&file)?, "current-before"); fs::write(&file, "must-stay")?; - let unbound = patch_undo_workspace_files(&workspace, None); + let unbound = patch_undo_workspace_files(&workspace, &[], None); assert!(!unbound.files_restored); assert_eq!(fs::read_to_string(&file)?, "must-stay"); Ok(()) @@ -4734,6 +5127,165 @@ fn restore_snapshot_endpoint_helper_rejects_unknown_snapshot_id() -> Result<()> Ok(()) } +#[tokio::test] +async fn restore_route_names_the_attached_roots_boundary_for_multi_root_threads() -> Result<()> { + // Round-22 B22-4: the restore face reported a bare `{"restored": id}` + // while every sibling rollback face carried the attached-roots clause. + // The snapshot's `[sid=...]` tag joins it to the owning thread record, + // whose declared root set decides whether the clause is added. + let _lock = lock_test_env(); + let root = tempfile::tempdir()?; + let home = root.path().join("home"); + fs::create_dir_all(&home)?; + let _home = EnvVarGuard::set("HOME", &home); + + let sessions_dir = root.path().join("sessions"); + let workspace = root.path().join("workspace"); + let Some((addr, runtime_threads, handle)) = spawn_test_server_with_root_token_mobile_workspace( + root.path().to_path_buf(), + sessions_dir, + None, + false, + workspace.clone(), + ) + .await? + else { + return Ok(()); + }; + let client = crate::tls::reqwest_client(); + + let multi = runtime_threads + .create_thread(CreateThreadRequest { + workspace: Some(workspace.clone()), + workspace_roots: vec![root.path().join("attached")], + ..CreateThreadRequest::default() + }) + .await?; + runtime_threads + .set_thread_session_id(&multi.id, "sess-multi") + .await?; + let single = runtime_threads + .create_thread(CreateThreadRequest { + workspace: Some(workspace.clone()), + ..CreateThreadRequest::default() + }) + .await?; + runtime_threads + .set_thread_session_id(&single.id, "sess-single") + .await?; + + let repo = crate::snapshot::SnapshotRepo::open_or_init(&workspace)?; + fs::write(workspace.join("a.txt"), "v1")?; + let multi_snap = repo.snapshot_with_session("pre-turn:1", Some("sess-multi"))?; + fs::write(workspace.join("a.txt"), "v2")?; + let single_snap = repo.snapshot_with_session("pre-turn:2", Some("sess-single"))?; + fs::write(workspace.join("a.txt"), "v3")?; + + // Multi-root: the clause names what the restore does NOT revert. + let response = client + .post(format!( + "http://{addr}/v1/snapshots/{}/restore", + multi_snap.0 + )) + .send() + .await?; + assert_eq!(response.status(), StatusCode::OK); + let body: serde_json::Value = response.json().await?; + assert_eq!(body["restored"], multi_snap.0.as_str()); + assert_eq!( + body["boundary"]["attached_roots_not_reverted"], + json!(true), + "a disjoint attached root persists past the restore: {body}" + ); + assert!( + body["boundary"]["note"] + .as_str() + .is_some_and(|note| note.contains("attached workspace roots")), + "{body}" + ); + + // Single-root: the legacy response shape stays byte-identical. + let response = client + .post(format!( + "http://{addr}/v1/snapshots/{}/restore", + single_snap.0 + )) + .send() + .await?; + assert_eq!(response.status(), StatusCode::OK); + let body: serde_json::Value = response.json().await?; + assert!( + body.get("boundary").is_none(), + "a single-root restore must not grow the clause: {body}" + ); + + // Round-23 B23-2: the ordinary save/re-key sequence — a `PUT /v1/sessions` + // moves the multi-root thread to a NEW session handle after the snapshot + // was tagged with the old one. The clause must survive the re-key: the + // tagged snapshot proves an interactive owner existed and proves nothing + // about the roots, so the boundary is named even though no live thread + // matches the old sid any more. + let rekey: serde_json::Value = client + .put(format!("http://{addr}/v1/sessions")) + .json(&json!({ + "thread_id": multi.id, + "session_id": "sess-multi-rekeyed", + })) + .send() + .await? + .error_for_status()? + .json() + .await?; + assert_eq!(rekey["session_id"], "sess-multi-rekeyed", "{rekey}"); + let response = client + .post(format!( + "http://{addr}/v1/snapshots/{}/restore", + multi_snap.0 + )) + .send() + .await?; + assert_eq!(response.status(), StatusCode::OK); + let body: serde_json::Value = response.json().await?; + assert_eq!( + body["boundary"]["attached_roots_not_reverted"], + json!(true), + "the re-keyed owner must not drop the boundary clause: {body}" + ); + + // Round-23 B23-1 legs: a `..`-spelled root and an inward-symlink root + // component-wise "nest" under the primary over raw spellings while + // consumers canonicalize them outside — the clause must fire for both + // (the old predicate withheld it, fail-unsafe). + let dotdot_thread = runtime_threads + .create_thread(CreateThreadRequest { + workspace: Some(workspace.join("ws")), + workspace_roots: vec![workspace.join("ws").join("..").join("shared2")], + ..CreateThreadRequest::default() + }) + .await?; + runtime_threads + .set_thread_session_id(&dotdot_thread.id, "sess-dotdot") + .await?; + let dotdot_snap = repo.snapshot_with_session("pre-turn:3", Some("sess-dotdot"))?; + let response = client + .post(format!( + "http://{addr}/v1/snapshots/{}/restore", + dotdot_snap.0 + )) + .send() + .await?; + assert_eq!(response.status(), StatusCode::OK); + let body: serde_json::Value = response.json().await?; + assert_eq!( + body["boundary"]["attached_roots_not_reverted"], + json!(true), + "a ..-spelled attached root must still fire the boundary: {body}" + ); + + handle.abort(); + Ok(()) +} + #[tokio::test] async fn session_create_from_thread_rejects_active_turn() -> Result<()> { let Some((addr, runtime_threads, handle)) = spawn_test_server().await? else { @@ -5054,41 +5606,6 @@ async fn session_patch_route_renames_archives_and_reports_real_changes() -> Resu Ok(()) } -/// A session the TUI holds open is refused with a typed 409 rather than -/// written behind its back. -#[tokio::test] -async fn session_patch_route_refuses_a_live_session_with_a_conflict() -> Result<()> { - // The live-session claim is process-global by construction (the embedded - // API runs inside the TUI process), so this test must not run alongside - // anything else that claims or clears it. - let _lock = lock_test_env(); - let Some((addr, _dir, handle)) = - spawn_server_with_saved_sessions(&[("sess-live", "Held open", false)]).await? - else { - return Ok(()); - }; - let client = crate::tls::reqwest_client(); - - crate::session_manager::set_live_session(Some("sess-live")); - let conflict = client - .patch(format!("http://{addr}/v1/sessions/sess-live")) - .json(&json!({ "title": "Renamed from the dashboard" })) - .send() - .await?; - assert_eq!(conflict.status(), StatusCode::CONFLICT); - - crate::session_manager::set_live_session(None); - let allowed = client - .patch(format!("http://{addr}/v1/sessions/sess-live")) - .json(&json!({ "title": "Renamed from the dashboard" })) - .send() - .await?; - assert_eq!(allowed.status(), StatusCode::OK); - - handle.abort(); - Ok(()) -} - /// `?peek=true` returns the bounded redacted projection, and the plain route /// still returns the full detail shape. #[tokio::test] diff --git a/crates/tui/src/runtime_chat_relay.rs b/crates/tui/src/runtime_chat_relay.rs index 1d30c1f1fd..2d159d43c8 100644 --- a/crates/tui/src/runtime_chat_relay.rs +++ b/crates/tui/src/runtime_chat_relay.rs @@ -543,6 +543,7 @@ impl RuntimeChatRelayHost { task_id: None, dynamic_tools: Vec::new(), environments: Vec::new(), + workspace_roots: Vec::new(), }) .await .map_err(|_| "Runtime Chat could not create its replay fixture.".to_string())? @@ -669,6 +670,7 @@ impl RuntimeChatRelayHost { task_id: None, dynamic_tools: Vec::new(), environments: Vec::new(), + workspace_roots: Vec::new(), }) .await .map_err(|_| { diff --git a/crates/tui/src/runtime_threads.rs b/crates/tui/src/runtime_threads.rs index 8d41377095..f035fe406d 100644 --- a/crates/tui/src/runtime_threads.rs +++ b/crates/tui/src/runtime_threads.rs @@ -637,6 +637,12 @@ pub struct ThreadRecord { #[serde(default, skip_serializing_if = "Option::is_none")] pub allowed_tools: Option>, pub workspace: PathBuf, + /// Additional workspace roots attached to this thread; `workspace` is + /// always the primary root. Additive like `title`: records written + /// before multi-root support have no key and behave as a single-root + /// workspace, so the schema version is not bumped. + #[serde(default, skip_serializing_if = "Vec::is_empty")] + pub workspace_roots: Vec, pub mode: String, /// Named default permission posture for new turns. Absent on legacy /// records, whose effective posture is derived from the old fields. @@ -678,6 +684,7 @@ fn thread_execution_state_matches(left: &ThreadRecord, right: &ThreadRecord) -> && left.reasoning_effort == right.reasoning_effort && left.allowed_tools == right.allowed_tools && left.workspace == right.workspace + && left.workspace_roots == right.workspace_roots && left.mode == right.mode && left.permission_posture == right.permission_posture && left.allow_shell == right.allow_shell @@ -1408,6 +1415,25 @@ impl RuntimeThreadStore { } pub fn save_thread(&self, thread: &ThreadRecord) -> Result<()> { + // Workspace/roots pairing guard (review #54 round-9 should-fix): the + // storage convention makes `workspace` a member of the declared set. + // A writer that moves the workspace without the set — or the set + // without the workspace — used to persist silently; this is the one + // choke point all persistence callers share, so a warn here turns + // that failure mode into a searchable signal. + if !thread.workspace_roots.is_empty() + && !thread + .workspace_roots + .iter() + .any(|root| root == &thread.workspace) + { + tracing::warn!( + "thread {} persists workspace {} outside its declared root set {:?}", + thread.id, + thread.workspace.display(), + thread.workspace_roots + ); + } write_json_atomic(&self.thread_path(&thread.id)?, thread) } @@ -2126,6 +2152,11 @@ pub struct CreateThreadRequest { #[serde(default)] pub allowed_tools: Option>, pub workspace: Option, + /// Additional accessible roots for the thread; `workspace` stays the + /// primary root and the set is normalized on create (workspace first, + /// deduped). Empty or omitted preserves the single-root default. + #[serde(default, skip_serializing_if = "Vec::is_empty")] + pub workspace_roots: Vec, pub mode: Option, #[serde(default)] pub permission_posture: Option, @@ -2161,6 +2192,7 @@ pub struct UpdateThreadRequest { pub title: Option, pub system_prompt: Option, pub workspace: Option, + pub workspace_roots: Option>, } #[derive(Debug, Clone, Serialize, Deserialize, Default)] @@ -5399,6 +5431,12 @@ impl RuntimeThreadManager { .filter(|m| !m.trim().is_empty()) .unwrap_or(default_model); let workspace = req.workspace.unwrap_or_else(|| self.workspace.clone()); + // Same guard as update_thread: an empty workspace persists a vacuous + // primary root (`starts_with("")` contains every path), so reject it + // at intake instead of defaulting it silently. + if workspace.as_os_str().is_empty() { + bail!("workspace must not be empty"); + } let requested_mode = req .mode .filter(|m| !m.trim().is_empty()) @@ -5416,6 +5454,14 @@ impl RuntimeThreadManager { let trust_mode = req.trust_mode.unwrap_or(false); let auto_approve = policy.auto_approve(); + // The declared set is validated at intake, not silently reshaped: a + // super-root (`/`, `/..`), an ancestor of the primary, or a + // non-absolute entry (`~/shared`) each widens — or silently shrinks — + // the sandbox the caller thinks it declared. The primary slot was + // already guarded non-empty above; validation also requires it to be + // absolute, since every containment check resolves absolute paths. + let workspace_roots = + codewhale_core::validate_workspace_roots(&workspace, &req.workspace_roots)?; let thread = ThreadRecord { schema_version: CURRENT_RUNTIME_SCHEMA_VERSION, id: format!("thr_{}", &Uuid::new_v4().to_string()[..8]), @@ -5439,6 +5485,7 @@ impl RuntimeThreadManager { task_id: req.task_id, title: None, session_id: None, + workspace_roots, }; self.store.save_thread(&thread)?; if let Err(error) = self @@ -5697,6 +5744,7 @@ impl RuntimeThreadManager { && req.title.is_none() && req.system_prompt.is_none() && req.workspace.is_none() + && req.workspace_roots.is_none() { bail!("At least one thread field is required"); } @@ -5812,22 +5860,66 @@ impl RuntimeThreadManager { changes.insert("system_prompt".to_string(), json!(new_sys)); } } + if let Some(roots) = req.workspace_roots { + // Explicit roots replace the whole set, normalized with the + // (possibly also-updated) workspace as the primary root. + // Caller-declared: validate instead of silently reshaping — + // the same super-root/ancestor/non-absolute rejections the + // create lane applies. + let primary = req + .workspace + .clone() + .unwrap_or_else(|| thread.workspace.clone()); + let normalized = codewhale_core::validate_workspace_roots(&primary, &roots)?; + if thread.workspace_roots != normalized { + changes.insert("workspace_roots".to_string(), json!(normalized)); + thread.workspace_roots = normalized; + } + } if let Some(workspace) = req.workspace && thread.workspace != workspace { changes.insert("workspace".to_string(), json!(workspace)); + if !changes.contains_key("workspace_roots") { + // A workspace-only change keeps the additional roots and + // hands the primary slot to the new workspace. The moved + // primary re-declares the set: an additional root that + // would end up an ancestor of the new primary (or a + // super-root inherited from a legacy row) is a widening + // decision and is rejected, not admitted silently. + let additional: Vec = thread + .workspace_roots + .iter() + .filter(|root| **root != thread.workspace) + .cloned() + .collect(); + let normalized = + codewhale_core::validate_workspace_roots(&workspace, &additional)?; + if thread.workspace_roots != normalized { + changes.insert("workspace_roots".to_string(), json!(normalized)); + thread.workspace_roots = normalized; + } + } thread.workspace = workspace; } let workspace_changed = changes.contains_key("workspace"); - if workspace_changed + let roots_changed = changes.contains_key("workspace_roots"); + if (workspace_changed || roots_changed) && active .engines .get(id) .and_then(|state| state.active_turn.as_ref()) .is_some() { - bail!("workspace cannot be changed while the thread has an active turn"); + // Name the leg that actually moved: a roots-only PATCH must + // not report a workspace change that was never requested. + let what = match (workspace_changed, roots_changed) { + (true, true) | (false, false) => "workspace/roots", + (true, false) => "workspace", + (false, true) => "workspace_roots", + }; + bail!("{what} cannot be changed while the thread has an active turn"); } // A posture/mode edit must reach the live engine even while a @@ -5845,14 +5937,14 @@ impl RuntimeThreadManager { } else { thread.updated_at = Utc::now(); self.store.save_thread(&thread)?; - if workspace_changed { + if workspace_changed || roots_changed { active.lru.retain(|thread_id| thread_id != id); active.engines.remove(id).map(|state| state.engine) } else { None } }; - let posture_engine = if posture_changed && !workspace_changed { + let posture_engine = if posture_changed && !workspace_changed && !roots_changed { active.engines.get(id).map(|state| state.engine.clone()) } else { None @@ -8013,6 +8105,7 @@ impl RuntimeThreadManager { model: route_model.clone(), active_route_limits: route_limits, workspace: thread.workspace.clone(), + workspace_roots: thread.workspace_roots.clone(), session_id: None, subagent_state_root: None, plugin_registry: thread_plugin_registry.clone(), @@ -8215,6 +8308,7 @@ impl RuntimeThreadManager { system_prompt_override: thread.system_prompt.is_some(), model: route_model.clone(), workspace: thread.workspace.clone(), + workspace_roots: thread.workspace_roots.clone(), mode: RuntimePolicyProjection::from_persisted( &thread.mode, thread.permission_posture.as_deref(), diff --git a/crates/tui/src/runtime_threads/tests.rs b/crates/tui/src/runtime_threads/tests.rs index 2d77df2200..f89988b963 100644 --- a/crates/tui/src/runtime_threads/tests.rs +++ b/crates/tui/src/runtime_threads/tests.rs @@ -382,6 +382,7 @@ fn sample_thread(thread_id: &str) -> ThreadRecord { reasoning_effort: None, allowed_tools: None, workspace: PathBuf::from("."), + workspace_roots: Vec::new(), mode: AppMode::Agent.as_setting().to_string(), permission_posture: Some("ask".to_string()), allow_shell: false, @@ -5791,6 +5792,210 @@ async fn update_thread_workspace_persists_event_and_evicts_idle_engine() -> Resu Ok(()) } +#[tokio::test] +async fn update_thread_roots_evicts_idle_engine() -> Result<()> { + // Eviction fires under `workspace_changed || roots_changed`; the workspace + // leg is pinned above, this pins the roots leg — regressing the + // disjunction would leave the stale single-root engine cached with every + // other test green. + let manager = test_manager(test_runtime_dir())?; + let workspace = std::env::temp_dir().join("codewhale-runtime-roots-evict"); + let thread = manager + .create_thread(CreateThreadRequest { + model: None, + workspace: Some(workspace.clone()), + mode: None, + allow_shell: None, + trust_mode: None, + auto_approve: None, + archived: false, + system_prompt: None, + task_id: None, + ..Default::default() + }) + .await?; + + let harness = install_mock_engine(&manager, &thread.id).await; + let mut rx_op = harness.rx_op; + + manager + .update_thread( + &thread.id, + UpdateThreadRequest { + workspace_roots: Some(vec![std::path::PathBuf::from("/shared")]), + ..UpdateThreadRequest::default() + }, + ) + .await?; + + { + let active = manager.active.lock().await; + assert!( + !active.engines.contains_key(&thread.id), + "a roots change must evict the stale cached engine just like a workspace change" + ); + assert!(!active.lru.iter().any(|id| id == &thread.id)); + } + + match tokio::time::timeout(Duration::from_secs(1), rx_op.recv()).await { + Ok(Some(Op::Shutdown)) => {} + other => panic!("expected cached engine shutdown, got {other:?}"), + } + Ok(()) +} + +#[tokio::test] +async fn update_thread_explicit_empty_roots_clears_to_primary_and_evicts_engine() -> Result<()> { + // Round-15 pin for the explicit-clear leg: PATCH `workspace_roots: []` + // is not "no change" — it clears the set back to the bare primary root, + // evicts the cached engine, and a later parameterless resume must not + // resurrect the cleared roots. + let manager = test_manager(test_runtime_dir())?; + let workspace = std::env::temp_dir().join("codewhale-runtime-roots-clear"); + let shared = std::env::temp_dir().join("codewhale-runtime-roots-clear-shared"); + let thread = manager + .create_thread(CreateThreadRequest { + model: None, + workspace: Some(workspace.clone()), + workspace_roots: vec![shared.clone()], + mode: None, + allow_shell: None, + trust_mode: None, + auto_approve: None, + archived: false, + system_prompt: None, + task_id: None, + ..Default::default() + }) + .await?; + assert_eq!(thread.workspace_roots, vec![workspace.clone(), shared]); + + let harness = install_mock_engine(&manager, &thread.id).await; + let mut rx_op = harness.rx_op; + + let updated = manager + .update_thread( + &thread.id, + UpdateThreadRequest { + workspace_roots: Some(Vec::new()), + ..UpdateThreadRequest::default() + }, + ) + .await?; + + // The explicit empty set clears back to the bare primary root and the + // cleared set is the persisted set. + assert_eq!(updated.workspace_roots, vec![workspace.clone()]); + assert_eq!( + manager.store.load_thread(&thread.id)?.workspace_roots, + vec![workspace.clone()], + ); + + // Clearing roots is a roots change: the stale multi-root engine is + // evicted from the cache and the LRU, and told to shut down. + { + let active = manager.active.lock().await; + assert!( + !active.engines.contains_key(&thread.id), + "an explicit-empty roots clear must evict the stale cached engine" + ); + assert!(!active.lru.iter().any(|id| id == &thread.id)); + } + match tokio::time::timeout(Duration::from_secs(1), rx_op.recv()).await { + Ok(Some(Op::Shutdown)) => {} + other => panic!("expected cached engine shutdown, got {other:?}"), + } + + // A parameterless resume reloads the persisted (cleared) set — the old + // multi-root set must not resurrect. + let resumed = manager.resume_thread(&thread.id).await?; + assert_eq!(resumed.workspace_roots, vec![workspace.clone()]); + Ok(()) +} + +#[tokio::test] +async fn update_thread_roots_preserves_session_and_turn_context() -> Result<()> { + // Review #484 round-9 must-fix 2: a roots-bearing resume must re-shape + // the SAME runtime thread (PATCH primitive), preserving session_id and + // the accumulated turns — re-creating the thread would run the next + // turn with correct roots but a blank memory. + let manager = test_manager(test_runtime_dir())?; + let primary = std::env::temp_dir().join("codewhale-ctx-primary"); + let thread = manager + .create_thread(CreateThreadRequest { + workspace: Some(primary.clone()), + ..Default::default() + }) + .await?; + + // Simulate a session that already ran: a session binding and a + // recorded turn. + { + let mut record = manager.store.load_thread(&thread.id)?; + record.session_id = Some("ses_context".to_string()); + record.latest_turn_id = Some("turn_context".to_string()); + manager.store.save_thread(&record)?; + } + + let updated = manager + .update_thread( + &thread.id, + UpdateThreadRequest { + workspace_roots: Some(vec![primary.clone(), primary.join("extra")]), + ..UpdateThreadRequest::default() + }, + ) + .await?; + + assert_eq!( + updated.workspace_roots, + vec![primary.clone(), primary.join("extra")], + "the PATCH carries the new root set" + ); + assert_eq!( + updated.session_id.as_deref(), + Some("ses_context"), + "context continuity: session binding survives the roots change" + ); + assert_eq!( + updated.latest_turn_id.as_deref(), + Some("turn_context"), + "context continuity: the recorded turn survives the roots change" + ); + assert_eq!( + manager.store.load_thread(&thread.id)?.workspace_roots.len(), + 2, + "the persisted record carries the new set" + ); + Ok(()) +} + +#[tokio::test] +async fn create_thread_workspace_rejects_empty_path() -> Result<()> { + // Regression pin: POST /v1/threads with `"workspace": ""` used to persist + // the empty string as the primary root, where boundary_roots() turns it + // into the vacuous containment root (`starts_with("")` is true for every + // path) — the same poison update_thread already rejects. + let manager = test_manager(test_runtime_dir())?; + let err = manager + .create_thread(CreateThreadRequest { + model: None, + workspace: Some(PathBuf::new()), + mode: None, + allow_shell: None, + trust_mode: None, + auto_approve: None, + archived: false, + system_prompt: None, + task_id: None, + ..Default::default() + }) + .await + .expect_err("empty workspace must be rejected"); + assert!(format!("{err:#}").contains("workspace must not be empty")); + Ok(()) +} + #[tokio::test] async fn update_thread_workspace_rejects_empty_path() -> Result<()> { let manager = test_manager(test_runtime_dir())?; @@ -5823,6 +6028,74 @@ async fn update_thread_workspace_rejects_empty_path() -> Result<()> { Ok(()) } +#[tokio::test] +async fn update_thread_roots_rejects_active_turn() -> Result<()> { + // The fence covers `workspace_changed || roots_changed`; this pins the + // roots leg on its own: a mid-turn root-set replacement is deferred + // exactly like a mid-turn workspace swap. + let manager = test_manager(test_runtime_dir())?; + let workspace = std::env::temp_dir().join("codewhale-runtime-roots-active"); + let thread = manager + .create_thread(CreateThreadRequest { + model: None, + workspace: Some(workspace.clone()), + mode: None, + allow_shell: None, + trust_mode: None, + auto_approve: None, + archived: false, + system_prompt: None, + task_id: None, + ..Default::default() + }) + .await?; + + let harness = install_mock_engine(&manager, &thread.id).await; + let mut rx_op = harness.rx_op; + { + let mut active = manager.active.lock().await; + let state = active.engines.get_mut(&thread.id).expect("mock engine"); + state.active_turn = Some(ActiveTurnState { + turn_id: "turn_live_roots".to_string(), + interrupt_requested: false, + compaction_id: None, + }); + } + + let roots_before = thread.workspace_roots.clone(); + let err = manager + .update_thread( + &thread.id, + UpdateThreadRequest { + workspace_roots: Some(vec![std::path::PathBuf::from("/shared")]), + ..UpdateThreadRequest::default() + }, + ) + .await + .expect_err("roots update during active turn must fail"); + + assert!(format!("{err:#}").contains("active turn")); + let persisted = manager.store.load_thread(&thread.id)?; + assert_eq!( + persisted.workspace_roots, roots_before, + "rejected update must not touch the persisted root set" + ); + { + let active = manager.active.lock().await; + assert!( + active.engines.contains_key(&thread.id), + "active engine should stay cached after rejected update" + ); + } + assert!( + tokio::time::timeout(Duration::from_millis(100), rx_op.recv()) + .await + .is_err(), + "a rejected roots update must not reach the engine" + ); + Ok(()) +} + #[tokio::test] async fn update_thread_workspace_rejects_active_turn() -> Result<()> { let manager = test_manager(test_runtime_dir())?; @@ -5887,6 +6160,213 @@ async fn update_thread_workspace_rejects_active_turn() -> Result<()> { Ok(()) } +#[test] +fn thread_record_workspace_roots_default_for_legacy_json() { + let thread = sample_thread("thr_roots"); + let mut value = serde_json::to_value(&thread).expect("serialize thread"); + assert!( + value.get("workspace_roots").is_none(), + "an empty root set must stay off the wire" + ); + let decoded: ThreadRecord = + serde_json::from_value(value.clone()).expect("legacy thread decodes"); + assert!(decoded.workspace_roots.is_empty()); + + value["workspace_roots"] = serde_json::json!(["/repo", "/repo/lib"]); + let decoded: ThreadRecord = serde_json::from_value(value).expect("thread with roots decodes"); + assert_eq!( + decoded.workspace_roots, + vec![PathBuf::from("/repo"), PathBuf::from("/repo/lib")] + ); +} + +#[tokio::test] +async fn create_thread_normalizes_workspace_roots() -> Result<()> { + let manager = test_manager(test_runtime_dir())?; + let workspace = std::env::temp_dir().join("codewhale-create-roots-ws"); + let thread = manager + .create_thread(CreateThreadRequest { + workspace: Some(workspace.clone()), + workspace_roots: vec![ + PathBuf::from("/shared"), + workspace.clone(), + PathBuf::from("/dup"), + PathBuf::from("/dup"), + ], + ..Default::default() + }) + .await?; + + // The workspace is the primary root and leads; additional roots dedupe + // in request order. + assert_eq!( + thread.workspace_roots, + vec![ + workspace.clone(), + PathBuf::from("/shared"), + PathBuf::from("/dup") + ] + ); + assert_eq!( + manager.store.load_thread(&thread.id)?.workspace_roots, + thread.workspace_roots, + "the normalized set must be the persisted set" + ); + Ok(()) +} + +#[test] +fn forkguard_workspace_roots_thread_record_persists_and_legacy_defaults_empty() -> Result<()> { + let manager = test_manager(test_runtime_dir())?; + let mut thread = sample_thread("thr_roots_forkguard"); + let roots = vec![PathBuf::from("/repo"), PathBuf::from("/shared")]; + thread.workspace_roots = roots.clone(); + manager.store.save_thread(&thread)?; + + // The root set survives a durable save→load round trip unchanged. + assert_eq!( + manager.store.load_thread(&thread.id)?.workspace_roots, + roots + ); + + // A record serialized without the key (pre-multi-root shape) loads as an + // empty, single-root set. + let mut legacy = serde_json::to_value(&thread)?; + legacy + .as_object_mut() + .expect("thread serializes as object") + .remove("workspace_roots"); + let legacy: ThreadRecord = serde_json::from_value(legacy)?; + assert!(legacy.workspace_roots.is_empty()); + Ok(()) +} + +#[tokio::test] +async fn update_thread_workspace_roots_replace_set_and_are_idempotent() -> Result<()> { + let manager = test_manager(test_runtime_dir())?; + let workspace = std::env::temp_dir().join("codewhale-runtime-roots-primary"); + let thread = manager + .create_thread(CreateThreadRequest { + model: None, + workspace: Some(workspace.clone()), + mode: None, + allow_shell: None, + trust_mode: None, + auto_approve: None, + archived: false, + system_prompt: None, + task_id: None, + ..Default::default() + }) + .await?; + + let roots = vec![ + std::env::temp_dir().join("codewhale-runtime-roots-shared-a"), + std::env::temp_dir().join("codewhale-runtime-roots-shared-b"), + ]; + let updated = manager + .update_thread( + &thread.id, + UpdateThreadRequest { + workspace_roots: Some(roots.clone()), + ..UpdateThreadRequest::default() + }, + ) + .await?; + + // Explicit roots replace the whole set; the workspace stays primary. + let mut expected = vec![workspace.clone()]; + expected.extend(roots.iter().cloned()); + assert_eq!(updated.workspace_roots, expected); + assert_eq!( + manager.store.load_thread(&thread.id)?.workspace_roots, + expected + ); + + let events = manager.events_since(&thread.id, None)?; + let event = events + .iter() + .rev() + .find(|event| event.event == "thread.updated") + .expect("thread.updated event"); + assert_eq!( + event + .payload + .get("changes") + .and_then(|changes| changes.get("workspace_roots")), + Some(&serde_json::to_value(&expected)?) + ); + + // Re-applying the same roots is a no-op: no change receipt, no timestamp + // bump. + let reapplied = manager + .update_thread( + &thread.id, + UpdateThreadRequest { + workspace_roots: Some(roots), + ..UpdateThreadRequest::default() + }, + ) + .await?; + assert_eq!(reapplied.workspace_roots, expected); + assert_eq!(reapplied.updated_at, updated.updated_at); + Ok(()) +} + +#[tokio::test] +async fn update_thread_workspace_only_keeps_additional_roots() -> Result<()> { + let manager = test_manager(test_runtime_dir())?; + let old_workspace = std::env::temp_dir().join("codewhale-runtime-roots-old"); + let new_workspace = std::env::temp_dir().join("codewhale-runtime-roots-new"); + let shared = std::env::temp_dir().join("codewhale-runtime-roots-shared"); + let thread = manager + .create_thread(CreateThreadRequest { + model: None, + workspace: Some(old_workspace.clone()), + mode: None, + allow_shell: None, + trust_mode: None, + auto_approve: None, + archived: false, + system_prompt: None, + task_id: None, + ..Default::default() + }) + .await?; + manager + .update_thread( + &thread.id, + UpdateThreadRequest { + workspace_roots: Some(vec![shared.clone()]), + ..UpdateThreadRequest::default() + }, + ) + .await?; + + let updated = manager + .update_thread( + &thread.id, + UpdateThreadRequest { + workspace: Some(new_workspace.clone()), + ..UpdateThreadRequest::default() + }, + ) + .await?; + + // The new workspace takes over the primary slot; the old workspace leaves + // the set while additional roots survive. + assert_eq!(updated.workspace, new_workspace); + assert_eq!( + updated.workspace_roots, + vec![new_workspace.clone(), shared.clone()] + ); + assert_eq!( + manager.store.load_thread(&thread.id)?.workspace_roots, + vec![new_workspace, shared] + ); + Ok(()) +} + #[tokio::test] async fn start_turn_passes_effective_auto_approve_to_engine() -> Result<()> { let manager = test_manager(test_runtime_dir())?; @@ -11160,6 +11640,7 @@ fn opening_manager_recovers_stale_queued_and_in_progress_work() -> Result<()> { reasoning_effort: None, allowed_tools: None, workspace: PathBuf::from("."), + workspace_roots: Vec::new(), mode: "agent".to_string(), permission_posture: None, allow_shell: false, diff --git a/crates/tui/src/sandbox/policy.rs b/crates/tui/src/sandbox/policy.rs index a40bf15b0b..987164ca17 100644 --- a/crates/tui/src/sandbox/policy.rs +++ b/crates/tui/src/sandbox/policy.rs @@ -313,7 +313,14 @@ impl SandboxPolicy { exclude_slash_tmp, .. } => { - let mut roots: Vec = writable_roots.clone(); + // Canonicalize the configured roots the same way as the cwd, + // /tmp, and TMPDIR entries below: on macOS a `/var` spelling + // and its `/private/var` reality are the same directory, and + // the sandbox consumers compare canonical forms. + let mut roots: Vec = writable_roots + .iter() + .map(|root| root.canonicalize().unwrap_or_else(|_| root.clone())) + .collect(); // Add the current working directory if let Ok(canonical_cwd) = cwd.canonicalize() { diff --git a/crates/tui/src/session_control_acceptance.rs b/crates/tui/src/session_control_acceptance.rs index ef25589e2d..31a836cdc1 100644 --- a/crates/tui/src/session_control_acceptance.rs +++ b/crates/tui/src/session_control_acceptance.rs @@ -121,8 +121,8 @@ pub const ACCEPTANCE_MATRIX: &[AcceptanceCase] = &[ }, AcceptanceCase { contract: Contract::ControlPlane, - behavior: "An external writer is refused with a typed conflict while a session is live", - test: "an_external_writer_is_refused_while_a_session_is_live", + behavior: "External writers converge by last-write-wins (the live-session refusal is retired; the registry serves retention pruning)", + test: "external_writers_converge_by_last_write_wins_guard_retired", }, AcceptanceCase { contract: Contract::PersistentSessions, @@ -722,48 +722,37 @@ mod tests { } #[test] - fn an_external_writer_is_refused_while_a_session_is_live() { - // The archive-race gate. The TUI owns the in-memory copy, so an - // out-of-band write must fail closed rather than be reverted later. + fn external_writers_converge_by_last_write_wins_guard_retired() { + // Round-20 B20-3: the External live-session refusal is retired. The + // process-local registry cannot coexist with the runtime HTTP lane in + // any shipped topology, so the refusal could never engage; an + // external writer now converges by last-write-wins at the store + // layer. The registry itself remains — same-process retention pruning + // consults it — which is why set_live_session stays. let _lock = crate::test_support::lock_test_env(); let fx = Fixture::new(); fx.save("owned", "Open in the TUI", &fx.workspace); crate::session_manager::set_live_session(Some("owned")); - let refused = fx - .manager + fx.manager .set_session_archived("owned", true, SessionMutator::External) - .expect_err("external write must be refused while the session is live"); - assert_eq!(refused.kind(), std::io::ErrorKind::ResourceBusy); + .expect("the retired guard no longer refuses external writes"); assert!( - !fx.manager + fx.manager .load_session("owned") .expect("reload") .metadata .archived, - "a refused write must not have partially applied" - ); - - let refused_rename = fx - .manager - .rename_session("owned", "Nope", SessionMutator::External) - .expect_err("external rename must be refused too"); - assert_eq!(refused_rename.kind(), std::io::ErrorKind::ResourceBusy); - - // The owner is still allowed. - assert!( - fx.manager - .set_session_archived("owned", true, SessionMutator::Owner) - .is_ok() + "the external write landed" ); + fx.manager + .rename_session("owned", "Renamed out-of-band", SessionMutator::External) + .expect("external rename converges too"); - // Releasing the claim re-opens external writes. + // The registry still tracks the interactive claim for retention. + assert!(crate::session_manager::is_live_session("owned")); crate::session_manager::set_live_session(None); - assert!( - fx.manager - .rename_session("owned", "Now allowed", SessionMutator::External) - .is_ok() - ); + assert!(!crate::session_manager::is_live_session("owned")); } #[test] diff --git a/crates/tui/src/session_manager.rs b/crates/tui/src/session_manager.rs index d22ebb4c70..543b0b56d1 100644 --- a/crates/tui/src/session_manager.rs +++ b/crates/tui/src/session_manager.rs @@ -159,6 +159,11 @@ pub struct SessionMetadata { pub model_provider_id: Option, /// Workspace directory pub workspace: PathBuf, + /// Additional workspace roots attached to this session; `workspace` is + /// always the primary root. Sessions written before multi-root support + /// have no key and load as an empty set (single-root behavior). + #[serde(default, skip_serializing_if = "Vec::is_empty")] + pub workspace_roots: Vec, /// Optional mode label (agent/plan/etc.) #[serde(default)] pub mode: Option, @@ -199,16 +204,19 @@ fn is_not_archived(archived: &bool) -> bool { /// Sessions currently owned by an in-process interactive surface (the TUI). /// -/// A saved session is a file, and a running TUI holds the authoritative copy -/// in memory: it autosaves the whole document from `App` state. That makes an -/// out-of-band write to the *same* session unsafe — the next autosave would -/// silently revert it. Rather than let that happen quietly, the owner claims -/// the id here and any external writer is refused. +/// The registry's remaining consumer is the orphan-reclamation keep-chain: +/// a running TUI holds the authoritative session copy in memory and re-saves +/// the whole document, so the directory `reclaim_orphaned_session_dirs` +/// sweeps must never treat a live owner's session as an orphan. (The +/// write-conflict guard this registry used to feed was retired — round-20 +/// B20-3: the process-local External lane never coexists with the +/// interactive surface in a shipped topology, so external writes converge +/// by last-write-wins at the store layer.) /// /// A static registry rather than a field on `RuntimeApiState` because the /// embedded Runtime API runs inside the TUI process; a standalone -/// `codewhale web` has an empty registry and is therefore never blocked, which -/// is exactly right — there is no TUI holding anything. +/// `codewhale web` has an empty registry, and the reclaim sweep needs no +/// entries there — a headless process holds no interactive autosave. static LIVE_SESSIONS: std::sync::OnceLock>> = std::sync::OnceLock::new(); @@ -287,9 +295,11 @@ pub fn is_claimed_session_dir(session_id: &str) -> bool { /// Who is asking to mutate a saved session. /// -/// This is an authority distinction, not a convenience one: the owner may -/// write because it will update its in-memory copy in the same step; anyone -/// else may not, because it cannot. +/// This was an authority distinction when a live owner's out-of-band write +/// could revert the next autosave; since the live guard's retirement +/// (round-20 B20-3) both spellings write, so the parameter is retained only +/// in the API shape. The owner distinction still documents intent: the owner +/// updates its cached copy atomically with the write, anyone else cannot. #[derive(Debug, Clone, Copy, PartialEq, Eq)] pub enum SessionMutator { /// The in-process surface that currently owns the session (the TUI). It @@ -297,7 +307,7 @@ pub enum SessionMutator { /// write — see `App::apply_session_mutation`. Owner, /// Any other writer: the Runtime API, the web dashboard, a second - /// process. Refused while the session is claimed. + /// process. Writes converge by last-write-wins at the store layer. External, } @@ -305,13 +315,19 @@ pub enum SessionMutator { /// /// The TUI owns at most one session at a time, so switching sessions must /// release the previous claim in the same step — otherwise a `/new` would -/// leave the old id permanently locked against the dashboard. +/// leave the old id in the registry and the orphan-reclamation sweep would +/// keep a directory no interactive surface is using. pub fn set_live_session(session_id: Option<&str>) { - if let Ok(mut live) = live_sessions().write() { - live.clear(); - if let Some(id) = session_id.map(str::trim).filter(|id| !id.is_empty()) { - live.insert(id.to_string()); - } + // Recover a poisoned write lock rather than dropping the claim: a lost + // claim unblocks external writers against a session that may still + // autosave, and the wholesale clear below makes any stale content moot. + let mut live = match live_sessions().write() { + Ok(live) => live, + Err(poisoned) => poisoned.into_inner(), + }; + live.clear(); + if let Some(id) = session_id.map(str::trim).filter(|id| !id.is_empty()) { + live.insert(id.to_string()); } } @@ -335,27 +351,21 @@ fn is_session_uuid(name: &str) -> bool { /// /// The registry is process-local. Reclamation must not treat a missing entry /// here as proof that no other Codewhale process still owns the directory. +/// +/// The query is judged against the trimmed id, the same normalized value +/// `set_live_session` stores: every store path trims (`validated_session_id`), +/// so the keep-chain compares one canonical value. A poisoned lock means +/// ownership cannot be determined, so the answer fails closed: treat the +/// session as live and keep its directory out of the orphan sweep, rather +/// than reclaim a directory an autosave nobody can see is still writing. #[must_use] pub fn is_live_session(session_id: &str) -> bool { + let trimmed = session_id.trim(); live_sessions() .read() - .is_ok_and(|live| live.contains(session_id)) -} - -/// The error an external writer gets when the session is live. -/// -/// `ResourceBusy` so callers can map it to a typed conflict rather than -/// pattern-matching on a message. -fn live_session_conflict(session_id: &str) -> std::io::Error { - std::io::Error::new( - std::io::ErrorKind::ResourceBusy, - format!( - "session '{session_id}' is open in an interactive Codewhale session; \ - change it there instead — an external write would be reverted by its next autosave" - ), - ) + .map(|live| live.contains(trimmed)) + .unwrap_or(true) } - /// File-name stem of the sidecar mapping session ids to the session /// instance (process boot) that created their persisted record. Lives in /// the sessions directory next to the `.json` records it describes. @@ -894,6 +904,7 @@ impl SavedSession { model_provider: default_model_provider(), model_provider_id: None, workspace, + workspace_roots: Vec::new(), mode: None, cost: SessionCostSnapshot::default(), parent_session_id: None, @@ -1624,9 +1635,11 @@ impl SessionManager { archived: bool, mutator: SessionMutator, ) -> std::io::Result { - if mutator == SessionMutator::External && is_live_session(id) { - return Err(live_session_conflict(id)); - } + let _ = mutator; // retained in the API shape; the live guard is retired (round-20 B20-3) + // Round-20 B20-3: no live-session guard here — the registry is + // process-local and the External mutator's only lane (the runtime + // HTTP server) never coexists with an interactive surface in a + // shipped topology, so the check could never engage. let mut session = self.load_session(id)?; if session.metadata.archived == archived { return Ok(session.metadata); @@ -1666,6 +1679,16 @@ impl SessionManager { metadata.created_at = persisted.created_at; metadata.parent_session_id = persisted.parent_session_id; metadata.forked_from_message_count = persisted.forked_from_message_count; + // The persisted set is the authority only against roots-blind + // writers: an empty incoming set may mean "rebuilt without knowing + // about multi-root", so the persisted set wins there. A non-empty + // incoming set is a deliberate live-owner mutation (a `/cd` primary + // swap, or a snapshot stamped from the loaded session) and must + // survive the merge - overwriting it would durably revert the swap + // and resurrect abandoned directories on the next resume. + if metadata.workspace_roots.is_empty() { + metadata.workspace_roots = persisted.workspace_roots; + } true } @@ -1681,9 +1704,10 @@ impl SessionManager { mutator: SessionMutator, ) -> std::io::Result { let title = normalize_session_title(title)?; - if mutator == SessionMutator::External && is_live_session(id) { - return Err(live_session_conflict(id)); - } + let _ = mutator; // retained in the API shape; the live guard is retired (round-20 B20-3) + // Round-20 B20-3: no live-session guard (see set_session_archived) — + // the External lane cannot coexist with the interactive surface that + // populates the registry. let mut session = self.load_session(id)?; if session.metadata.title == title { return Ok(session.metadata); @@ -2219,6 +2243,7 @@ pub fn create_saved_session_with_id_and_mode( model_provider: default_model_provider(), model_provider_id: None, workspace: workspace.to_path_buf(), + workspace_roots: Vec::new(), mode: mode.map(str::to_string), cost: SessionCostSnapshot::default(), parent_session_id: None, @@ -2638,6 +2663,134 @@ mod tests { ); } + #[test] + fn workspace_roots_default_for_legacy_sessions_and_round_trip() { + let tmp = tempdir().expect("tempdir"); + let manager = SessionManager::new(tmp.path().to_path_buf()).expect("manager"); + let workspace = tmp.path().join("ws"); + let messages = vec![make_test_message("user", "hi")]; + let session = create_saved_session_with_id_and_mode( + "roots-session".to_string(), + &messages, + "deepseek-v4-flash", + &workspace, + 0, + None, + None, + ); + + // A session written before multi-root support has no workspace_roots + // key; it must load as an empty (single-root) set, and a roots-less + // session must keep that key off the wire. + let mut value = serde_json::to_value(&session).expect("serialize session"); + let metadata = value.get_mut("metadata").expect("metadata object"); + assert!(metadata.get("workspace_roots").is_none()); + let metadata = metadata.take(); + let mut metadata: SessionMetadata = + serde_json::from_value(metadata).expect("legacy metadata decodes"); + assert!(metadata.workspace_roots.is_empty()); + + // Roots survive a save/load round-trip byte-faithfully. + metadata.workspace_roots = vec![workspace.clone(), tmp.path().join("shared")]; + let mut session = session; + session.metadata = metadata; + manager.save_session(&session).expect("save session"); + let loaded = manager.load_session("roots-session").expect("load session"); + assert_eq!( + loaded.metadata.workspace_roots, + vec![workspace, tmp.path().join("shared")] + ); + } + + #[test] + fn workspace_switch_survives_autosave_merge_and_restart() { + // /cd round trip: disk holds the pre-switch state; the live owner + // swaps the primary (/A -> /C, roots [/A,/B] -> [/C,/B]); the + // autosave stamps the live set and merges against disk; the + // restart+resume re-normalizes. The abandoned directory must not + // resurrect as a writable root. + let tmp = tempdir().expect("tempdir"); + let manager = SessionManager::new(tmp.path().to_path_buf()).expect("manager"); + let workspace = tmp.path().join("a"); + let messages = vec![make_test_message("user", "hi")]; + let mut session = create_saved_session_with_id_and_mode( + "switch-session".to_string(), + &messages, + "deepseek-v4-flash", + &workspace, + 0, + None, + Some("agent"), + ); + session.metadata.workspace_roots = vec![workspace.clone(), tmp.path().join("b")]; + manager + .save_session(&session) + .expect("save pre-switch session"); + + // The /cd swap in memory: new primary, old primary leaves the set. + let mut live = manager + .load_session("switch-session") + .expect("load for switch"); + let new_workspace = tmp.path().join("c"); + live.metadata.workspace = new_workspace.clone(); + live.metadata.workspace_roots = vec![new_workspace.clone(), tmp.path().join("b")]; + + // Autosave: stamp the live set, then merge against disk exactly as + // build_session_snapshot does. + live.metadata.total_tokens = 5; + assert!(manager.merge_persisted_lifecycle(&mut live.metadata)); + manager.save_session(&live).expect("autosave"); + + // Restart + resume: reload, then re-normalize the way the engine + // resolves roots on resume. + let resumed = manager.load_session("switch-session").expect("reload"); + assert_eq!(resumed.metadata.workspace, new_workspace); + assert_eq!( + resumed.metadata.workspace_roots, + vec![new_workspace, tmp.path().join("b")], + "the abandoned directory must not resurrect as a writable root" + ); + } + + #[test] + fn merge_persisted_lifecycle_restores_persisted_workspace_roots() { + let tmp = tempdir().expect("tempdir"); + let manager = SessionManager::new(tmp.path().to_path_buf()).expect("manager"); + let workspace = tmp.path().join("ws"); + let messages = vec![make_test_message("user", "hi")]; + let mut session = create_saved_session_with_id_and_mode( + "merge-roots-session".to_string(), + &messages, + "deepseek-v4-flash", + &workspace, + 0, + None, + Some("agent"), + ); + session.metadata.workspace_roots = vec![workspace.clone(), tmp.path().join("shared")]; + manager.save_session(&session).expect("save session"); + + // A host without multi-root awareness rebuilds the metadata through + // the historical constructor and would rewrite the file with an + // empty root set; the lifecycle merge must restore the persisted + // set instead of letting that rewrite erase it. + let mut rewritten = create_saved_session_with_id_and_mode( + session.metadata.id.clone(), + &messages, + "deepseek-v4-flash", + &workspace, + 0, + None, + Some("agent"), + ); + assert!(rewritten.metadata.workspace_roots.is_empty()); + assert!(manager.merge_persisted_lifecycle(&mut rewritten.metadata)); + assert_eq!( + rewritten.metadata.workspace_roots, + vec![workspace, tmp.path().join("shared")] + ); + } + /// Coverage state round-trips with the money it qualifies, and a session /// written before coverage existed is detected as *unknown* rather than being /// read as a complete total covering zero turns (#4318). @@ -2864,6 +3017,7 @@ mod tests { model_provider: "deepseek".to_string(), model_provider_id: None, workspace: workspace.to_path_buf(), + workspace_roots: Vec::new(), mode: None, cost: SessionCostSnapshot::default(), parent_session_id: None, @@ -2905,6 +3059,7 @@ mod tests { model_provider: "deepseek".to_string(), model_provider_id: None, workspace: workspace.to_path_buf(), + workspace_roots: Vec::new(), mode: Some("yolo".to_string()), cost: SessionCostSnapshot::default(), parent_session_id: None, @@ -4857,4 +5012,100 @@ mod tests { "unexpected error: {err}" ); } + + /// The live-session claim is judged on the trimmed id — the same + /// normalized value `set_live_session` stores — so a padded id cannot + /// read as a stranger to the guard while every store path + /// (`validated_session_id`) reads it as the owner. + #[test] + fn live_session_claim_matches_the_trimmed_query() { + let _lock = crate::shell_dispatcher::test_env_lock::lock_test_env(); + set_live_session(Some(" sess-pad ")); + assert!(is_live_session("sess-pad")); + assert!( + is_live_session(" sess-pad "), + "a padded id must hit the claim the trimmed id would hit" + ); + assert!(!is_live_session("sess-other")); + set_live_session(None); + assert!(!is_live_session(" sess-pad ")); + } + + /// A poisoned claim lock means ownership cannot be determined, so the + /// answer fails closed: the session counts as live and external writers + /// take the conflict instead of racing an autosave nobody can see. + #[test] + fn live_session_claim_fails_closed_on_a_poisoned_lock() { + let _lock = crate::shell_dispatcher::test_env_lock::lock_test_env(); + set_live_session(Some("sess-poison")); + // Poison the lock by panicking while holding its write guard, then + // clear the poison in the same test — the process-global lock is + // shared with every other test in this binary, and only the env lock + // above keeps the poisoned window single-threaded. + let _ = std::panic::catch_unwind(|| { + let _guard = live_sessions().write(); + panic!("poison the live-session claim lock"); + }); + assert!( + live_sessions().read().is_err(), + "the lock must actually be poisoned for this pin to mean anything" + ); + assert!( + is_live_session("sess-poison"), + "poisoned: the known claim must still read as live" + ); + assert!( + is_live_session("sess-unknown"), + "poisoned: an unknown id must also read as live (fail closed)" + ); + live_sessions().clear_poison(); + set_live_session(None); + assert!(!is_live_session("sess-unknown")); + } +} + +#[test] +fn reclaim_keeps_a_live_claimed_session_dir() { + // Round-21 should-fix 5 (the keystone for B20-3's registry-retention + // decision): the retired HTTP guard left the registry one real + // consumer — the orphan-dir reclaim must keep a directory whose id + // is claimed live by the interactive surface, or that keep would be + // dead code. Hermetic under ENV_LOCK + PINVOU3_HOME. + let _lock = crate::shell_dispatcher::test_env_lock::lock_test_env(); + let prev_home = std::env::var("PINVOU3_HOME").ok(); + let home = + std::env::temp_dir().join(format!("pinvou3-reclaim-live-home-{}", std::process::id())); + let _ = std::fs::remove_dir_all(&home); + // SAFETY: platform::paths::tests::ENV_LOCK held; env writes are serialized. + unsafe { std::env::set_var("PINVOU3_HOME", &home) }; + let manager = SessionManager::new(home.join("sessions")).expect("session manager"); + + // An orphan session directory in the exact shape the runtime mints. + let id = "3f2504e0-4f89-41d3-9a0c-0305e82c3301"; + let dir = home.join("sessions").join(id); + std::fs::create_dir_all(&dir).unwrap(); + + // Unclaimed: the orphan is reclaimed. + manager.reclaim_orphaned_session_dirs(); + assert!(!dir.exists(), "an unclaimed orphan is reclaimed"); + + // Re-create it and claim it live: the reclaim must keep it. + std::fs::create_dir_all(&dir).unwrap(); + set_live_session(Some(id)); + manager.reclaim_orphaned_session_dirs(); + assert!(dir.exists(), "a live-claimed orphan survives the reclaim"); + + set_live_session(None); + manager.reclaim_orphaned_session_dirs(); + assert!(!dir.exists(), "releasing the claim re-opens the reclaim"); + + // SAFETY: ENV_LOCK held for the whole test; restoring the caller's + // environment. + unsafe { + match prev_home { + Some(home) => std::env::set_var("PINVOU3_HOME", home), + None => std::env::remove_var("PINVOU3_HOME"), + } + } + let _ = std::fs::remove_dir_all(&home); } diff --git a/crates/tui/src/session_projection.rs b/crates/tui/src/session_projection.rs index 46bf85a89b..72c0ee9a94 100644 --- a/crates/tui/src/session_projection.rs +++ b/crates/tui/src/session_projection.rs @@ -339,6 +339,7 @@ mod tests { model_provider: "deepseek".to_string(), model_provider_id: None, workspace: PathBuf::from(workspace), + workspace_roots: Vec::new(), mode: Some("agent".to_string()), cost: Default::default(), parent_session_id: None, diff --git a/crates/tui/src/shell_dispatcher.rs b/crates/tui/src/shell_dispatcher.rs index 2a896240e2..42c5655ac5 100644 --- a/crates/tui/src/shell_dispatcher.rs +++ b/crates/tui/src/shell_dispatcher.rs @@ -759,8 +759,10 @@ mod tests { .decode(payload) .expect("payload is base64"); let units: Vec = decoded - .chunks_exact(2) - .map(|pair| u16::from_le_bytes([pair[0], pair[1]])) + .as_chunks::<2>() + .0 + .iter() + .map(|pair| u16::from_le_bytes(*pair)) .collect(); let text = String::from_utf16(&units).expect("payload is UTF-16LE"); assert!(text.contains("Write-Output '中文-ok'"), "{text}"); diff --git a/crates/tui/src/snapshot/mod.rs b/crates/tui/src/snapshot/mod.rs index 81344c37d3..19b9878e13 100644 --- a/crates/tui/src/snapshot/mod.rs +++ b/crates/tui/src/snapshot/mod.rs @@ -51,8 +51,93 @@ pub use prune::{DEFAULT_MAX_AGE, prune_older_than}; /// Maximum snapshots kept per workspace side-repo. Oldest are pruned /// after each new snapshot to cap disk usage (#1112). pub const DEFAULT_MAX_SNAPSHOTS: usize = 50; + +/// Honesty clause for revert/undo reports when the session root set extends +/// beyond the primary workspace: the snapshot side-repo is rooted at the +/// primary, so a restore rolls back only the primary while attached-root +/// writes persist. Appended verbatim so single-root reports stay +/// byte-identical (the clause is simply never added there). +pub const ATTACHED_ROOTS_NOT_REVERTED_NOTE: &str = + "Only the primary workspace was reverted; attached workspace roots were not rolled back."; + +/// Whether a restore from the workspace snapshot repo covers only the +/// primary root — true exactly when the normalized root set has an entry +/// OUTSIDE the primary tree. Revert/undo reports must carry +/// [`ATTACHED_ROOTS_NOT_REVERTED_NOTE`] in that case instead of implying a +/// full rollback. +/// +/// A root nested under the primary does NOT count +/// (review #484/CodeWhale round-22 N22-3): `validate_workspace_roots` +/// explicitly allows attached roots under the primary, and the side repo's +/// work-tree IS the primary tree, so `repo.restore` reverts those writes +/// with the primary — claiming they "were not rolled back" would tell the +/// user the opposite of what happened. +/// +/// Round-23 B23-1: BOTH sides are lexically normalized before the +/// containment comparison. Over the raw persisted spellings a `..`-spelled +/// root (`/ws/../shared`) or an inward-symlink root (`/ws/link → +/// /elsewhere`) component-wise "nests" under the primary while every +/// consumer canonicalizes it outside — writes there persist through the +/// primary-rooted restore, so withholding the note for those spellings was +/// fail-unsafe (and the previous doc asserted the opposite of the code). +/// Normalizing first fires the note for exactly the roots whose consumers +/// see them outside the primary; over-disclosing the boundary is the safe +/// side. +pub fn restore_covers_primary_only( + workspace: &std::path::Path, + workspace_roots: &[std::path::PathBuf], +) -> bool { + let workspace_lexical = codewhale_core::normalize_path_lexically(workspace); + codewhale_core::normalize_workspace_roots(workspace, workspace_roots) + .iter() + .skip(1) + .any(|root| { + let root_lexical = codewhale_core::normalize_path_lexically(root); + !root_lexical.starts_with(&workspace_lexical) + }) +} #[allow(unused_imports)] pub use repo::{ DEFAULT_MAX_WORKSPACE_BYTES_FOR_SNAPSHOT, Snapshot, SnapshotId, SnapshotRepo, estimate_workspace_size_bounded, }; + +#[cfg(test)] +mod tests { + use super::*; + use std::path::PathBuf; + + #[test] + fn nested_under_primary_attached_roots_are_reverted_with_the_primary() { + // Round-22 N22-3: the side repo's work-tree IS the primary tree, so a + // root nested under it (validate_workspace_roots explicitly allows + // those) is rolled back by the restore — the boundary note must not + // claim otherwise. + let workspace = PathBuf::from("/ws"); + assert!(restore_covers_primary_only( + &workspace, + &[PathBuf::from("/elsewhere")], + )); + assert!(!restore_covers_primary_only( + &workspace, + &[PathBuf::from("/ws/nested")], + )); + assert!(!restore_covers_primary_only( + &workspace, + &[PathBuf::from("/ws/nested/deeper")], + )); + // A root that contains the primary (`/`, a legacy-row ancestor) is + // outside the reverted tree's spelling — its writes outside the + // primary persist. A root equal to the primary dedups away in the + // normalizer, like the empty set. + assert!(restore_covers_primary_only( + &workspace, + &[PathBuf::from("/")], + )); + assert!(!restore_covers_primary_only( + &workspace, + &[PathBuf::from("/ws")], + )); + assert!(!restore_covers_primary_only(&workspace, &[])); + } +} diff --git a/crates/tui/src/tools/approval_cache.rs b/crates/tui/src/tools/approval_cache.rs index 69c411ccea..4cdcec7f00 100644 --- a/crates/tui/src/tools/approval_cache.rs +++ b/crates/tui/src/tools/approval_cache.rs @@ -27,7 +27,7 @@ //! | Tool | Grouping key | //! |---------------|------------------------------------------| //! | `apply_patch` | `patch:` | -//! | shell tools | `shell:` | +//! | shell tools | `shell:` (+ `@cwd:` when the call carries one) | //! | `fetch_url` | `net:` | //! | everything else| `tool::` | //! @@ -94,7 +94,18 @@ pub fn build_approval_grouping_key(tool_name: &str, input: &serde_json::Value) - | "exec_wait" | "exec_interact" => { let prefix = command_prefix(input); - format!("shell:{prefix}") + // The approval side judges the resolved effective cwd (the same + // value exec rule matching sees), so the grant is keyed to the + // command family AND the cwd operand: a grant approved at the + // session workspace must not silently cover the same command + // redirected into another root. + match shell_cwd_operand(input) { + // Length-prefix the operand (round-20 B20-2): the raw + // `prefix@cwd:` concatenation is non-injective — model-craftable + // spellings of prefix/cwd collide across the boundary. + Some(cwd) => format!("shell:{prefix}@cwd:{}:{cwd}", cwd.len()), + None => format!("shell:{prefix}"), + } } "fetch_url" | "web.fetch" | "web_fetch" => { let host = parse_host(input); @@ -128,6 +139,20 @@ fn command_prefix(input: &serde_json::Value) -> String { classify_command(&tokens) } +/// Return the exec `cwd`/`working_dir` operand when the call carries one — +/// the value the approval side resolves and judges as the effective cwd. +fn shell_cwd_operand(input: &serde_json::Value) -> Option<&str> { + // Round-20 B20-2: mirror the check-side and execution field semantics — + // `get("cwd")` returning `Some(Value::Null)` used to block the + // `working_dir` fallback, keying the grant to the no-operand family + // while the check/exec treated the same call as redirected to + // `working_dir`. Skip Null (and non-string) values like they do. + ["cwd", "working_dir"] + .iter() + .find_map(|name| input.get(name).and_then(Value::as_str)) + .filter(|cwd| !cwd.is_empty()) +} + /// Hash the sorted set of file paths referenced by a patch input. fn hash_patch_paths(input: &serde_json::Value) -> String { use std::collections::hash_map::DefaultHasher; @@ -380,6 +405,56 @@ mod tests { assert_eq!(group_a, group_b, "approvals must group by command family"); } + #[test] + fn shell_grouping_key_rekeys_on_the_cwd_operand() { + let at_workspace = + build_approval_grouping_key("exec_shell", &json!({"command": "git status"})); + let redirected = build_approval_grouping_key( + "exec_shell", + &json!({"command": "git status", "cwd": "/attached/repo"}), + ); + assert_ne!( + at_workspace, redirected, + "a grant approved at the session workspace must not cover the same command redirected into another root" + ); + + let same_redirect = build_approval_grouping_key( + "exec_shell", + &json!({"command": "git status -s", "cwd": "/attached/repo"}), + ); + assert_eq!( + redirected, same_redirect, + "the same command family in the same cwd stays one grant" + ); + + let via_working_dir = build_approval_grouping_key( + "exec_shell", + &json!({"command": "git status", "working_dir": "/attached/repo"}), + ); + assert_eq!( + redirected, via_working_dir, + "cwd and working_dir are the same operand for the grant key" + ); + + // Round-20 B20-2: `cwd: null` must not block the `working_dir` + // fallback — the null spelling used to key the NO-OPERAND family + // while the check and execution treated the same call as redirected, + // letting a session-approved plain command run in the attached root + // unprompted. + let null_cwd_with_working_dir = build_approval_grouping_key( + "exec_shell", + &json!({"command": "git status", "cwd": null, "working_dir": "/attached/repo"}), + ); + assert_eq!( + redirected, null_cwd_with_working_dir, + "a null cwd plus working_dir keys as the redirected operand" + ); + assert_ne!( + at_workspace, null_cwd_with_working_dir, + "the redirected spelling must not collide with the no-operand family" + ); + } + #[test] fn patch_keys_differ_by_path() { let key_a = build_approval_key( diff --git a/crates/tui/src/tools/file.rs b/crates/tui/src/tools/file.rs index 182714aeed..02f4d02c84 100644 --- a/crates/tui/src/tools/file.rs +++ b/crates/tui/src/tools/file.rs @@ -145,11 +145,11 @@ pub(super) const EXPECTED_HASH_DESCRIPTION: &str = "The `content_hash` from a pr /// value is an error rather than a coin flip, and any parameter that is not a /// known synonym still fails validation. The #5209 guarantee — no fabricated /// "Replaced 1 occurrence" for an edit that never landed — is unchanged. -pub(super) struct ParamAlias { +pub(crate) struct ParamAlias { /// Spelling a model might emit. - alias: &'static str, + pub(crate) alias: &'static str, /// Parameter this tool implements. - canonical: &'static str, + pub(crate) canonical: &'static str, } const fn alias(alias: &'static str, canonical: &'static str) -> ParamAlias { @@ -159,7 +159,7 @@ const fn alias(alias: &'static str, canonical: &'static str) -> ParamAlias { /// Path spellings shared by every file action. `path` is CodeWhale's /// canonical name and the most common one in the field, but `file_path` is /// widespread enough in training data to be worth accepting everywhere. -pub(super) const PATH_ALIASES: &[ParamAlias] = +pub(crate) const PATH_ALIASES: &[ParamAlias] = &[alias("file_path", "path"), alias("filePath", "path")]; /// Edit-specific spellings. Ordered most- to least-common. @@ -238,6 +238,29 @@ pub(super) fn apply_param_aliases( Ok(()) } +/// Read the canonical `path` parameter with every accepted alias spelling, +/// in `apply_param_aliases` fold order: the canonical key wins, then the +/// aliases in declaration order, empty strings skipped. +/// +/// Plan-time gates — repo law, persisted ask/allow/deny rules, the +/// in-workspace write carve-out, Auto-Review — run before execution folds +/// `PATH_ALIASES` onto `path` (the default `ToolSpec::prepare` passes input +/// through unchanged), so each must consult this helper instead of reading +/// `path` alone: a `file_path`- or `filePath`-spelled write was otherwise +/// invisible to every one of them at once (review #484/CodeWhale round-22 +/// B22-2). +pub(crate) fn path_param_value(input: &Value) -> Option { + std::iter::once("path") + .chain(PATH_ALIASES.iter().map(|alias| alias.alias)) + .find_map(|key| { + input + .get(key) + .and_then(Value::as_str) + .filter(|value| !value.is_empty()) + .map(str::to_string) + }) +} + // === Per-action parameter contracts === /// The parameter contract for one `File` action. diff --git a/crates/tui/src/tools/revert_turn.rs b/crates/tui/src/tools/revert_turn.rs index f981d9043b..dffb99406a 100644 --- a/crates/tui/src/tools/revert_turn.rs +++ b/crates/tui/src/tools/revert_turn.rs @@ -35,7 +35,8 @@ impl ToolSpec for RevertTurnTool { Use when the user explicitly asks to undo, revert, or roll back the most recent edits. \ `turn_offset` is 1-based: 1 reverts the most recent turn, 2 reverts the previous one, \ and so on (max 50). Conversation history is NOT modified — only working-tree files are \ - restored from the side-git snapshot repo." + restored from the side-git snapshot repo. Snapshots cover the primary workspace root \ + only; writes under attached workspace roots are not rolled back." } fn input_schema(&self) -> Value { @@ -73,6 +74,8 @@ impl ToolSpec for RevertTurnTool { } let workspace = context.workspace.clone(); + let primary_only = + crate::snapshot::restore_covers_primary_only(&workspace, &context.workspace_roots); let label = format!("revert_turn(offset={offset})"); let session = context.state_namespace.clone(); let result = tokio::task::spawn_blocking(move || -> Result { @@ -115,11 +118,20 @@ impl ToolSpec for RevertTurnTool { } repo.restore(&target.id) .map_err(|e| format!("Restore failed: {e}"))?; - Ok(format!( - "{label}: restored '{}' ({}). Workspace files reverted; conversation unchanged.", - target.label, - short_sha(target.id.as_str()), - )) + Ok(if primary_only { + format!( + "{label}: restored '{}' ({}). {} Conversation unchanged.", + target.label, + short_sha(target.id.as_str()), + crate::snapshot::ATTACHED_ROOTS_NOT_REVERTED_NOTE, + ) + } else { + format!( + "{label}: restored '{}' ({}). Workspace files reverted; conversation unchanged.", + target.label, + short_sha(target.id.as_str()), + ) + }) }) .await .map_err(|e| ToolError::execution_failed(format!("revert_turn join failed: {e}")))?; @@ -191,6 +203,59 @@ mod tests { let content = std::fs::read_to_string(workspace.join("a.txt")).unwrap(); assert_eq!(content, "original"); + + // Single-root report stays byte-identical: no boundary clause. + assert!( + r.content + .contains("Workspace files reverted; conversation unchanged."), + "{}", + r.content + ); + assert!( + !r.content + .contains(crate::snapshot::ATTACHED_ROOTS_NOT_REVERTED_NOTE), + "{}", + r.content + ); + } + + #[tokio::test] + async fn revert_turn_with_attached_roots_names_rollback_boundary() { + // Snapshots are primary-bound (M15-3): with attached roots in the + // session set the report must not claim a full rollback — attached + // root writes persist after the revert. + let tmp = tempdir().unwrap(); + let workspace = tmp.path().join("ws"); + let attached = tmp.path().join("attached"); + std::fs::create_dir_all(&workspace).unwrap(); + std::fs::create_dir_all(&attached).unwrap(); + let _guard = scoped_home(tmp.path()); + + let repo = SnapshotRepo::open_or_init(&workspace).unwrap(); + std::fs::write(workspace.join("a.txt"), b"original").unwrap(); + repo.snapshot_with_session("pre-turn:1", Some("workspace")) + .unwrap(); + std::fs::write(workspace.join("a.txt"), b"modified").unwrap(); + + let tool = RevertTurnTool; + let ctx = ToolContext::new(workspace.clone()).with_workspace_roots(vec![attached.clone()]); + let r = tool.execute(json!({}), &ctx).await.expect("execute"); + assert!(r.success, "expected success: {r:?}"); + assert_eq!( + std::fs::read_to_string(workspace.join("a.txt")).unwrap(), + "original" + ); + assert!( + r.content + .contains(crate::snapshot::ATTACHED_ROOTS_NOT_REVERTED_NOTE), + "{}", + r.content + ); + assert!( + !r.content.contains("Workspace files reverted"), + "{}", + r.content + ); } #[tokio::test] diff --git a/crates/tui/src/tools/shell.rs b/crates/tui/src/tools/shell.rs index ddb24510d4..8db9a37d72 100644 --- a/crates/tui/src/tools/shell.rs +++ b/crates/tui/src/tools/shell.rs @@ -2141,7 +2141,7 @@ impl ShellManager { origin_tool_call_id: Option, origin_turn_id: Option, work_lifecycle: Option, - readonly_workspace: Option<&std::path::Path>, + readonly_roots: Option<&[PathBuf]>, persist_pending: bool, timeout_bounds_ms: (u64, u64), ) -> Result { @@ -2157,7 +2157,7 @@ impl ShellManager { let policy = policy_override.unwrap_or_else(|| self.sandbox_policy.clone()); // Create command spec and prepare sandboxed environment - let spec = if let Some(workspace) = readonly_workspace { + let spec = if let Some(roots) = readonly_roots { if command.contains('|') { // An agent read-only pipeline: every segment was admitted by // `is_agent_readonly_shell_command` (no separators, redirects, @@ -2168,7 +2168,7 @@ impl ShellManager { CommandSpec::shell(&piped, work_dir.clone(), Duration::from_millis(timeout_ms)) } else { let (program, args) = hardened_readonly_argv(command)?; - let program = resolve_readonly_program(&program, workspace)?; + let program = resolve_readonly_program(&program, roots)?; CommandSpec::program( program .to_str() @@ -4020,9 +4020,35 @@ fn hardened_readonly_argv(command: &str) -> Result<(String, Vec)> { Ok((program, argv)) } +/// Canonical boundary set for the read-only Scout shell: every declared +/// workspace root (primary first), canonicalized. Attached roots carry the +/// same trust weight as the primary — they are agent-writable, so a program +/// or PATH entry under any of them is untrusted, while operands under them +/// were already admitted by the roots-aware `resolve_path`. Roots that do not +/// resolve on disk cannot contain anything and drop out: fail-closed for +/// operand admission, and a non-existent root can shadow neither a PATH entry +/// nor an executable. +fn canonical_readonly_roots(roots: &[PathBuf]) -> std::io::Result> { + let Some((primary, extra)) = roots.split_first() else { + return Err(std::io::Error::new( + std::io::ErrorKind::NotFound, + "read-only boundary requires at least the primary root", + )); + }; + let mut canonical = vec![primary.canonicalize()?]; + for root in extra { + if let Ok(resolved) = root.canonicalize() + && !canonical.contains(&resolved) + { + canonical.push(resolved); + } + } + Ok(canonical) +} + fn enforce_readonly_workspace_operands( command: &str, - workspace: &std::path::Path, + roots: &[PathBuf], effective_cwd: &std::path::Path, ) -> Result<(), ToolError> { let argv = shell_words::split(&normalize_windows_command_paths(command)).map_err(|error| { @@ -4035,7 +4061,7 @@ fn enforce_readonly_workspace_operands( // is pinned and evaluated separately by the network-policy guard. return Ok(()); } - let workspace = workspace.canonicalize().map_err(|error| { + let roots = canonical_readonly_roots(roots).map_err(|error| { ToolError::execution_failed(format!( "Could not resolve the Scout workspace before shell dispatch: {error}" )) @@ -4045,7 +4071,7 @@ fn enforce_readonly_workspace_operands( "Could not prove the read-only shell working directory stays in the workspace: {error}" )) })?; - if !effective_cwd.starts_with(&workspace) { + if !roots.iter().any(|root| effective_cwd.starts_with(root)) { return Err(ToolError::permission_denied( "[shell.readonly.cwd.outside_workspace] Read-only Scout shell working directory resolves outside the workspace.", )); @@ -4093,7 +4119,7 @@ fn enforce_readonly_workspace_operands( "[shell.readonly.operand.unresolved] Could not prove absolute read-only operand {value:?} stays inside the workspace because it could not be resolved: {error}" )) })?; - if !resolved.starts_with(&workspace) { + if !roots.iter().any(|root| resolved.starts_with(root)) { return Err(ToolError::permission_denied(format!( "[shell.readonly.operand.outside_workspace] Read-only Scout shell operand {value:?} resolves outside the workspace. Use the bounded File read/search actions for project evidence." ))); @@ -4121,7 +4147,7 @@ fn enforce_readonly_workspace_operands( "[shell.readonly.operand.unresolved] Could not prove read-only operand {value:?} stays in the workspace: {error}" )) })?; - if !resolved.starts_with(&workspace) { + if !roots.iter().any(|root| resolved.starts_with(root)) { return Err(ToolError::permission_denied(format!( "[shell.readonly.operand.outside_workspace] Read-only Scout shell operand {value:?} resolves outside the workspace. Use the bounded File read/search actions for project evidence." ))); @@ -4132,43 +4158,43 @@ fn enforce_readonly_workspace_operands( } fn readonly_sanitized_path_from( - workspace: &std::path::Path, + roots: &[PathBuf], path: &std::ffi::OsStr, ) -> Option { - let workspace = workspace.canonicalize().ok()?; + let roots = canonical_readonly_roots(roots).ok()?; let safe = std::env::split_paths(path).filter_map(|entry| { if !entry.is_absolute() { return None; } let resolved = entry.canonicalize().ok()?; - (!resolved.starts_with(&workspace)).then_some(resolved) + (!roots.iter().any(|root| resolved.starts_with(root))).then_some(resolved) }); std::env::join_paths(safe).ok() } -fn readonly_sanitized_path(workspace: &std::path::Path) -> Option { +fn readonly_sanitized_path(roots: &[PathBuf]) -> Option { let path = std::env::var_os("PATH")?; - readonly_sanitized_path_from(workspace, &path).map(|value| value.to_string_lossy().into_owned()) + readonly_sanitized_path_from(roots, &path).map(|value| value.to_string_lossy().into_owned()) } -fn resolve_readonly_program(program: &str, workspace: &std::path::Path) -> Result { +fn resolve_readonly_program(program: &str, roots: &[PathBuf]) -> Result { let path = std::env::var_os("PATH") .ok_or_else(|| anyhow!("no executable search path is configured"))?; - resolve_readonly_program_from_path(program, workspace, &path) + resolve_readonly_program_from_path(program, roots, &path) } fn resolve_readonly_program_from_path( program: &str, - workspace: &std::path::Path, + roots: &[PathBuf], path: &std::ffi::OsStr, ) -> Result { - let workspace = workspace.canonicalize()?; + let roots = canonical_readonly_roots(roots)?; if std::path::Path::new(program).components().count() != 1 { return Err(anyhow!( "read-only command must name a bare allowlisted executable" )); } - let safe_path = readonly_sanitized_path_from(&workspace, path).ok_or_else(|| { + let safe_path = readonly_sanitized_path_from(&roots, path).ok_or_else(|| { anyhow!("no trusted executable search path remains outside the workspace") })?; let names = if cfg!(windows) { @@ -4190,7 +4216,7 @@ fn resolve_readonly_program_from_path( } } let resolved = candidate.canonicalize()?; - if resolved.is_absolute() && !resolved.starts_with(&workspace) { + if resolved.is_absolute() && !roots.iter().any(|root| resolved.starts_with(root)) { return Ok(resolved); } } @@ -4288,6 +4314,12 @@ async fn execute_foreground_via_background( let timeout_ms = timeout_ms.map(|timeout| timeout.clamp(timeout_bounds_ms.0, timeout_bounds_ms.1)); let spawn_timeout_ms = timeout_ms.unwrap_or(timeout_bounds_ms.1); + // The read-only launch boundary is the full declared root set (primary + // first), so program resolution and PATH sanitization distrust every + // agent-writable root, not just the primary. + let readonly_roots = direct_argv.then(|| { + codewhale_core::normalize_workspace_roots(&context.workspace, &context.workspace_roots) + }); let spawned = { let mut manager = context .shell_manager @@ -4310,7 +4342,7 @@ async fn execute_foreground_via_background( context.origin_tool_call_id.clone(), context.origin_turn_id.clone(), lifecycle, - direct_argv.then_some(context.workspace.as_path()), + readonly_roots.as_deref(), false, timeout_bounds_ms, )? @@ -5057,19 +5089,25 @@ impl ToolSpec for BashTool { // shared ShellManager's parent-workspace default_workspace. None => Some(context.workspace.display().to_string()), }; - if matches!(context.shell_policy, ShellPolicy::ReadOnly) { + let read_only_shell = matches!(context.shell_policy, ShellPolicy::ReadOnly); + // The read-only boundary is the full declared root set, not just the + // primary: attached roots are agent-writable (untrusted for programs + // and PATH) yet legitimate operand/cwd targets. + let readonly_roots = read_only_shell.then(|| { + codewhale_core::normalize_workspace_roots(&context.workspace, &context.workspace_roots) + }); + if let Some(roots) = readonly_roots.as_deref() { let effective_cwd = working_dir .as_deref() .map(std::path::Path::new) .unwrap_or(&context.workspace); - enforce_readonly_workspace_operands(command, &context.workspace, effective_cwd)?; + enforce_readonly_workspace_operands(command, roots, effective_cwd)?; } // #456 — collect env from any configured `shell_env` hooks. Runs // synchronously, captures stdout, parses `KEY=VAL` lines, audit-logs // the keys (never the values). Empty / no-op when no hook is // configured. - let read_only_shell = matches!(context.shell_policy, ShellPolicy::ReadOnly); let mut extra_env = if read_only_shell { // shell_env hooks are arbitrary operator-configured processes. // They cannot run inside the evidence-only execution boundary. @@ -5124,7 +5162,7 @@ impl ToolSpec for BashTool { inert_git_helper.to_string(), ); extra_env.insert("GIT_ATTR_NOSYSTEM".to_string(), "1".to_string()); - if let Some(path) = readonly_sanitized_path(&context.workspace) { + if let Some(path) = readonly_sanitized_path(readonly_roots.as_deref().unwrap_or(&[])) { extra_env.insert("PATH".to_string(), path); } extra_env.insert("GIT_CONFIG_COUNT".to_string(), "3".to_string()); diff --git a/crates/tui/src/tools/shell/tests.rs b/crates/tui/src/tools/shell/tests.rs index 816c26a31c..0a2543aeac 100644 --- a/crates/tui/src/tools/shell/tests.rs +++ b/crates/tui/src/tools/shell/tests.rs @@ -937,6 +937,7 @@ fn readonly_program_resolution_ignores_workspace_shadow_executables() { let workspace = tempdir().expect("workspace"); let trusted = tempdir().expect("trusted bin"); let path = std::env::join_paths([workspace.path(), trusted.path()]).expect("test PATH"); + let roots = [workspace.path().to_path_buf()]; for program in ["git", "gh", "rg"] { let file = if cfg!(windows) { @@ -956,12 +957,55 @@ fn readonly_program_resolution_ignores_workspace_shadow_executables() { } } let resolved = - resolve_readonly_program_from_path(program, workspace.path(), &path).expect("resolved"); + resolve_readonly_program_from_path(program, &roots, &path).expect("resolved"); assert_eq!(resolved, trusted.path().join(file).canonicalize().unwrap()); assert!(resolved.is_absolute() && !resolved.starts_with(workspace.path())); } } +/// B14-1: an attached root is agent-writable, so an executable planted inside +/// it must shadow nothing and its PATH entries must be stripped — exactly +/// like the primary root. Judging only the primary here fails open. +#[cfg(any(unix, windows))] +#[test] +fn forkguard_workspace_roots_readonly_shell_distrusts_attached_root_programs() { + let workspace = tempdir().expect("workspace"); + let attached = tempdir().expect("attached root"); + let trusted = tempdir().expect("trusted bin"); + let path = std::env::join_paths([workspace.path(), attached.path(), trusted.path()]) + .expect("test PATH"); + let roots = [ + workspace.path().to_path_buf(), + attached.path().to_path_buf(), + ]; + + let file = if cfg!(windows) { "git.exe" } else { "git" }; + for directory in [workspace.path(), attached.path(), trusted.path()] { + let executable = directory.join(file); + std::fs::write(&executable, b"fixture").expect("fixture executable"); + #[cfg(unix)] + { + use std::os::unix::fs::PermissionsExt as _; + let mut permissions = executable.metadata().unwrap().permissions(); + permissions.set_mode(0o755); + std::fs::set_permissions(&executable, permissions).unwrap(); + } + } + + let resolved = resolve_readonly_program_from_path("git", &roots, &path).expect("resolved"); + assert_eq!(resolved, trusted.path().join(file).canonicalize().unwrap()); + + // A program that exists only inside an attached root fails closed. + let attached_only = std::env::join_paths([attached.path()]).expect("attached-only PATH"); + resolve_readonly_program_from_path("git", &roots, &attached_only) + .expect_err("a program inside an attached root must not be trusted"); + + // PATH entries under attached roots are stripped from the sanitized set. + let sanitized = readonly_sanitized_path_from(&roots, &path).expect("sanitized PATH"); + let kept: Vec<_> = std::env::split_paths(&sanitized).collect(); + assert_eq!(kept, vec![trusted.path().canonicalize().unwrap()]); +} + #[test] fn readonly_child_env_removes_git_and_github_redirects() { let mut command = std::process::Command::new("unused"); @@ -1001,8 +1045,9 @@ fn readonly_operands_are_workspace_bounded_and_symlink_aware() { let outside = tempdir().expect("outside"); std::fs::write(workspace.path().join("inside.txt"), "inside").expect("inside file"); std::fs::write(outside.path().join("secret.txt"), "secret").expect("outside file"); + let roots = [workspace.path().to_path_buf()]; - enforce_readonly_workspace_operands("cat inside.txt", workspace.path(), workspace.path()) + enforce_readonly_workspace_operands("cat inside.txt", &roots, workspace.path()) .expect("in-workspace operand"); let inside_absolute = workspace .path() @@ -1011,7 +1056,7 @@ fn readonly_operands_are_workspace_bounded_and_symlink_aware() { .expect("canonical inside file"); enforce_readonly_workspace_operands( &format!("cat {}", inside_absolute.display()), - workspace.path(), + &roots, workspace.path(), ) .expect("absolute in-workspace operand"); @@ -1023,7 +1068,7 @@ fn readonly_operands_are_workspace_bounded_and_symlink_aware() { .expect("canonical outside file"); let error = enforce_readonly_workspace_operands( &format!("cat {}", outside_absolute.display()), - workspace.path(), + &roots, workspace.path(), ) .expect_err("absolute outside operand must fail") @@ -1038,10 +1083,9 @@ fn readonly_operands_are_workspace_bounded_and_symlink_aware() { r"cat C:\secret", r"cat \\server\share\secret", ] { - let error = - enforce_readonly_workspace_operands(command, workspace.path(), workspace.path()) - .expect_err("out-of-workspace operand must fail") - .to_string(); + let error = enforce_readonly_workspace_operands(command, &roots, workspace.path()) + .expect_err("out-of-workspace operand must fail") + .to_string(); assert!(error.contains("inside the workspace"), "{command}: {error}"); } @@ -1052,13 +1096,10 @@ fn readonly_operands_are_workspace_bounded_and_symlink_aware() { workspace.path().join("secret-link"), ) .expect("outside symlink"); - let error = enforce_readonly_workspace_operands( - "cat secret-link", - workspace.path(), - workspace.path(), - ) - .expect_err("symlink escape must fail") - .to_string(); + let error = + enforce_readonly_workspace_operands("cat secret-link", &roots, workspace.path()) + .expect_err("symlink escape must fail") + .to_string(); assert!(error.contains("resolves outside"), "{error}"); let subdir = workspace.path().join("subdir"); @@ -1068,11 +1109,66 @@ fn readonly_operands_are_workspace_bounded_and_symlink_aware() { subdir.join("secret-link"), ) .expect("cwd-relative outside symlink"); - enforce_readonly_workspace_operands("cat secret-link", workspace.path(), &subdir) + enforce_readonly_workspace_operands("cat secret-link", &roots, &subdir) .expect_err("operands must resolve relative to the effective cwd"); } } +/// B14-1: the operand/cwd gate judges against the full declared root set. +/// Operands and working directories under an attached root were already +/// admitted by the roots-aware `resolve_path`; refusing them here would +/// contradict the session's own declaration, while anything outside every +/// root stays refused. +#[test] +fn forkguard_workspace_roots_readonly_shell_operands_span_attached_roots() { + let workspace = tempdir().expect("workspace"); + let attached = tempdir().expect("attached root"); + let outside = tempdir().expect("outside"); + std::fs::write(attached.path().join("shared.txt"), "shared").expect("attached file"); + std::fs::write(outside.path().join("secret.txt"), "secret").expect("outside file"); + let roots = [ + workspace.path().to_path_buf(), + attached.path().to_path_buf(), + ]; + + // The working directory may sit under an attached root, and relative + // operands resolve there. + enforce_readonly_workspace_operands("cat shared.txt", &roots, attached.path()) + .expect("operand under an attached root"); + + let attached_absolute = attached + .path() + .join("shared.txt") + .canonicalize() + .expect("canonical attached file"); + enforce_readonly_workspace_operands( + &format!("cat {}", attached_absolute.display()), + &roots, + workspace.path(), + ) + .expect("absolute operand under an attached root"); + + // A directory outside every declared root stays refused. + let outside_absolute = outside + .path() + .join("secret.txt") + .canonicalize() + .expect("canonical outside file"); + let error = enforce_readonly_workspace_operands( + &format!("cat {}", outside_absolute.display()), + &roots, + workspace.path(), + ) + .expect_err("operand outside every root must fail") + .to_string(); + assert!(error.contains("operand.outside_workspace"), "{error}"); + + // A working directory outside every root stays refused even when the + // operand itself sits under one. + enforce_readonly_workspace_operands("cat shared.txt", &roots, outside.path()) + .expect_err("cwd outside every root must fail"); +} + #[test] fn windows_verbatim_and_drive_operands_survive_posix_split() { // `shell_words` splits with POSIX backslash-escaping, which silently eats diff --git a/crates/tui/src/tools/spec.rs b/crates/tui/src/tools/spec.rs index 179f5833b9..e20d9d88c4 100644 --- a/crates/tui/src/tools/spec.rs +++ b/crates/tui/src/tools/spec.rs @@ -8,7 +8,7 @@ use std::collections::HashMap; use std::fs; -use std::path::{Component, Path, PathBuf}; +use std::path::{Path, PathBuf}; use std::sync::{Arc, Mutex, OnceLock}; use std::time::SystemTime; @@ -603,6 +603,9 @@ pub struct ToolExecutionState { pub(crate) tool_authority: Option>, /// Whether to allow paths outside workspace pub trust_mode: bool, + /// Additional workspace roots tools may touch; `workspace` is always the + /// primary root. Empty means the historical single-root boundary. + pub workspace_roots: Vec, /// Current sandbox policy #[allow(dead_code)] pub sandbox_policy: SandboxPolicy, @@ -779,6 +782,7 @@ impl ToolContext { origin_turn_id: None, tool_authority, trust_mode, + workspace_roots: Vec::new(), sandbox_policy: SandboxPolicy::None, notes_path: notes_path.into(), mcp_config_path: mcp_config_path.into(), @@ -834,6 +838,15 @@ impl ToolContext { self } + /// Attach the session's additional workspace roots. The primary root + /// stays `workspace`; boundary checks accept a path contained in any + /// root. An empty set keeps the historical single-root boundary. + #[must_use] + pub fn with_workspace_roots(mut self, workspace_roots: Vec) -> Self { + self.workspace_roots = workspace_roots; + self + } + /// Attach durable runtime services to tools. #[must_use] pub fn with_runtime_services(mut self, runtime: RuntimeToolServices) -> Self { @@ -1058,6 +1071,20 @@ impl ToolContext { /// let path = ctx.resolve_path("README.md")?; /// # Ok::<(), crate::tools::spec::ToolError>(()) /// ``` + /// Boundary roots for escape checks: the primary workspace followed by + /// any additional roots, each paired with its canonical (or raw fallback) + /// form. With no additional roots configured this is exactly the primary + /// root, so single-root sessions take the historical code path. + fn boundary_roots(&self) -> Vec<(PathBuf, PathBuf)> { + codewhale_core::normalize_workspace_roots(&self.workspace, &self.workspace_roots) + .into_iter() + .map(|root| { + let canonical = root.canonicalize().unwrap_or_else(|_| root.clone()); + (root, canonical) + }) + .collect() + } + pub fn resolve_path(&self, raw: &str) -> Result { let candidate = if std::path::Path::new(raw).is_absolute() { PathBuf::from(raw) @@ -1071,33 +1098,30 @@ impl ToolContext { return Ok(candidate.canonicalize().unwrap_or(candidate)); } - // Try to canonicalize the workspace - let workspace_canonical = self - .workspace - .canonicalize() - .unwrap_or_else(|_| self.workspace.clone()); + let boundary_roots = self.boundary_roots(); + let candidate_normalized = normalize_path(&candidate); // When follow_symlinks is enabled, check the non-canonical (symlink) - // path against the workspace first. A symlink inside the workspace - // that resolves outside is allowed — the symlink itself is the gate. + // path against each root first. A symlink inside a root that resolves + // outside is allowed — the symlink itself is the gate. if self.follow_symlinks { - let candidate_normalized = normalize_path(&candidate); - let workspace_normalized = normalize_path(&self.workspace); - let workspace_canonical_normalized = normalize_path(&workspace_canonical); - - if candidate_normalized.starts_with(&workspace_normalized) - || candidate_normalized.starts_with(&workspace_canonical_normalized) - { - // The symlink (or plain path) is inside the workspace. - // Return the canonicalized target so file I/O works correctly. - if candidate.exists() { - return Ok(candidate.canonicalize().unwrap_or(candidate)); + for (root, root_canonical) in &boundary_roots { + let root_normalized = normalize_path(root); + let root_canonical_normalized = normalize_path(root_canonical); + if candidate_normalized.starts_with(&root_normalized) + || candidate_normalized.starts_with(&root_canonical_normalized) + { + // The symlink (or plain path) is inside this root. + // Return the canonicalized target so file I/O works correctly. + if candidate.exists() { + return Ok(candidate.canonicalize().unwrap_or(candidate)); + } + // Non-existent path: canonicalize the deepest existing ancestor + return self.resolve_nonexistent_path(candidate, root_canonical); } - // Non-existent path: canonicalize the deepest existing ancestor - return self.resolve_nonexistent_path(candidate, &workspace_canonical); } - // Path is outside workspace even before resolving symlinks. + // Path is outside every root even before resolving symlinks. // Fall through to the standard escape check. } @@ -1105,23 +1129,21 @@ impl ToolContext { // This handles symlinks like /var -> /private/var on macOS let candidate_canonical = candidate .canonicalize() - .unwrap_or_else(|_| normalize_path(&candidate)); - let workspace_normalized = normalize_path(&workspace_canonical); - - // Check if the candidate is under the workspace (comparing canonical paths) - if !candidate_canonical.starts_with(&workspace_normalized) { - // Also try with non-canonical workspace for cases where workspace itself - // hasn't been canonicalized yet - let workspace_plain = normalize_path(&self.workspace); - let candidate_normalized = normalize_path(&candidate); - if !candidate_normalized.starts_with(&workspace_plain) - && !self.is_trusted_external_path(&candidate_canonical) - && !self.is_trusted_external_path(&candidate_normalized) - { - return Err(ToolError::PathEscape { - path: candidate_canonical, - }); - } + .unwrap_or_else(|_| candidate_normalized.clone()); + + // The candidate must sit under at least one root (comparing canonical + // paths, then plain paths for roots that do not canonicalize yet). + let contained = boundary_roots.iter().any(|(root, root_canonical)| { + candidate_canonical.starts_with(normalize_path(root_canonical)) + || candidate_normalized.starts_with(normalize_path(root)) + }); + if !contained + && !self.is_trusted_external_path(&candidate_canonical) + && !self.is_trusted_external_path(&candidate_normalized) + { + return Err(ToolError::PathEscape { + path: candidate_canonical, + }); } // For existing paths, use canonicalize directly @@ -1134,16 +1156,31 @@ impl ToolContext { )) })?; - if !canonical.starts_with(&workspace_canonical) - && !self.is_trusted_external_path(&canonical) - { + let under_root = boundary_roots + .iter() + .any(|(_, root_canonical)| canonical.starts_with(root_canonical)); + if !under_root && !self.is_trusted_external_path(&canonical) { return Err(ToolError::PathEscape { path: canonical }); } return Ok(canonical); } - self.resolve_nonexistent_path(candidate, &workspace_canonical) + // Non-existent path: resolve against the containing root's boundary; + // `resolve_nonexistent_path` re-checks trusted external paths itself. + let boundary = boundary_roots + .iter() + .find(|(root, root_canonical)| { + candidate_canonical.starts_with(normalize_path(root_canonical)) + || candidate_normalized.starts_with(normalize_path(root)) + }) + .map(|(_, root_canonical)| root_canonical.clone()) + .unwrap_or_else(|| { + self.workspace + .canonicalize() + .unwrap_or_else(|_| self.workspace.clone()) + }); + self.resolve_nonexistent_path(candidate, &boundary) } /// Resolve a non-existent path by canonicalizing its deepest existing @@ -1319,48 +1356,13 @@ pub async fn lsp_diagnostics_for_paths(context: &ToolContext, paths: &[PathBuf]) render_blocks(&blocks) } +/// The tools boundary's landing normalizer: clamps a `..` at the filesystem +/// root, keeps a `..` a relative spelling cannot pop. Delegates to the shared +/// core implementation so the judgment lanes (repo law, the judged exec cwd) +/// normalize identically by construction instead of by copy +/// (review #484/CodeWhale round-22 B22-5). pub(crate) fn normalize_path(path: &Path) -> PathBuf { - let mut prefix: Option = None; - let mut is_root = false; - let mut stack: Vec = Vec::new(); - - for component in path.components() { - match component { - Component::Prefix(prefix_component) => { - prefix = Some(prefix_component.as_os_str().to_owned()); - } - Component::RootDir => { - is_root = true; - } - Component::CurDir => {} - Component::ParentDir => { - let parent = Component::ParentDir.as_os_str(); - if let Some(last) = stack.pop() { - if last == parent { - stack.push(last); - stack.push(parent.to_owned()); - } - } else if !is_root { - stack.push(parent.to_owned()); - } - } - Component::Normal(part) => { - stack.push(part.to_owned()); - } - } - } - - let mut normalized = PathBuf::new(); - if let Some(prefix) = prefix { - normalized.push(prefix); - } - if is_root { - normalized.push(Path::new(std::path::MAIN_SEPARATOR_STR)); - } - for part in stack { - normalized.push(part); - } - normalized + codewhale_core::normalize_path_lexically(path) } /// The core trait that all tools must implement. diff --git a/crates/tui/src/tools/spec/tests.rs b/crates/tui/src/tools/spec/tests.rs index 120e86a91f..a69953591b 100644 --- a/crates/tui/src/tools/spec/tests.rs +++ b/crates/tui/src/tools/spec/tests.rs @@ -74,6 +74,144 @@ fn test_tool_context_resolve_path_normalizes_parent() { assert!(result.is_ok()); } +#[test] +fn test_tool_context_resolve_path_allows_additional_workspace_roots() { + let workspace = tempdir().expect("workspace tempdir"); + let shared = tempdir().expect("shared root tempdir"); + std::fs::write(shared.path().join("lib.rs"), "// shared\n").expect("write"); + let ctx = ToolContext::new(workspace.path().to_path_buf()) + .with_workspace_roots(vec![shared.path().to_path_buf()]); + + // Existing and not-yet-existing files under an additional root resolve. + let existing = ctx + .resolve_path(shared.path().join("lib.rs").to_string_lossy().as_ref()) + .expect("existing file under additional root"); + assert!(existing.ends_with("lib.rs")); + let created = ctx + .resolve_path( + shared + .path() + .join("new/dir/file.rs") + .to_string_lossy() + .as_ref(), + ) + .expect("new file under additional root"); + assert!(created.ends_with("file.rs")); + + // A genuine escape is still denied, and the same path is denied when the + // root set is empty (the historical single-root boundary). + let escape = ctx.resolve_path("/etc/passwd"); + assert!(matches!(escape, Err(ToolError::PathEscape { .. }))); + let single_root = ToolContext::new(workspace.path().to_path_buf()); + let denied = single_root.resolve_path(shared.path().join("lib.rs").to_string_lossy().as_ref()); + assert!(matches!(denied, Err(ToolError::PathEscape { .. }))); +} + +#[test] +fn test_tool_context_resolve_path_empty_string_root_stays_fail_closed() { + // Regression pin: an empty-string root accepted at intake used to reach + // boundary_roots() as ("", "") — Path::starts_with("") is true for every + // path, so both containment checks passed and read_file (approval Auto, + // no prompt in any posture) could read arbitrary filesystem paths. + let workspace = tempdir().expect("workspace tempdir"); + let ctx = ToolContext::new(workspace.path().to_path_buf()) + .with_workspace_roots(vec![PathBuf::from("")]); + + let escape = ctx.resolve_path("/etc/passwd"); + assert!( + matches!(escape, Err(ToolError::PathEscape { .. })), + "an empty-string declared root must not null containment" + ); + // The primary root still works: the filter drops the poison entry, not + // the set. + let inside = workspace.path().join("ok.txt"); + std::fs::write(&inside, "ok").expect("write"); + assert!(ctx.resolve_path(inside.to_string_lossy().as_ref()).is_ok()); +} + +#[test] +fn forkguard_workspace_roots_resolve_path_spans_attached_roots() { + let workspace = tempdir().expect("workspace tempdir"); + let attached = tempdir().expect("attached root tempdir"); + std::fs::write(attached.path().join("lib.rs"), "// attached\n").expect("write"); + let ctx = ToolContext::new(workspace.path().to_path_buf()) + .with_workspace_roots(vec![attached.path().to_path_buf()]); + + // Attached root: existing and not-yet-existing targets resolve. + assert!( + ctx.resolve_path(attached.path().join("lib.rs").to_string_lossy().as_ref()) + .is_ok() + ); + assert!( + ctx.resolve_path( + attached + .path() + .join("new/file.rs") + .to_string_lossy() + .as_ref() + ) + .is_ok() + ); + + // A path outside every root still fails closed. + assert!(matches!( + ctx.resolve_path("/etc/passwd"), + Err(ToolError::PathEscape { .. }) + )); + + // Empty root set = the exact historical single-root boundary: the same + // attached-root path is rejected. + let single_root = ToolContext::new(workspace.path().to_path_buf()); + assert!(matches!( + single_root.resolve_path(attached.path().join("lib.rs").to_string_lossy().as_ref()), + Err(ToolError::PathEscape { .. }) + )); +} + +#[test] +fn forkguard_workspace_roots_relative_target_resolves_against_primary_root() { + // Execution-layer pin: a relative target joins onto the PRIMARY root + // even when attached roots exist (ToolContext::resolve_path), never + // onto an attached root that happens to carry the same name. The + // approval layers rely on exactly this join. + let workspace = tempdir().expect("workspace tempdir"); + let attached = tempdir().expect("attached root tempdir"); + std::fs::write(workspace.path().join("note.txt"), "primary").expect("write"); + std::fs::write(attached.path().join("note.txt"), "attached").expect("write"); + let ctx = ToolContext::new(workspace.path().to_path_buf()) + .with_workspace_roots(vec![attached.path().to_path_buf()]); + + let resolved = ctx.resolve_path("note.txt").expect("resolve"); + assert_eq!( + resolved, + workspace + .path() + .join("note.txt") + .canonicalize() + .expect("canonical"), + "a relative target must resolve against the primary root" + ); +} + +#[cfg(unix)] +#[test] +fn test_tool_context_resolve_path_follow_symlinks_spans_additional_roots() { + let workspace = tempdir().expect("workspace tempdir"); + let shared = tempdir().expect("shared root tempdir"); + let outside = tempdir().expect("outside tempdir"); + symlink(outside.path(), shared.path().join("link-out")).expect("symlink"); + let ctx = ToolContext::new(workspace.path().to_path_buf()) + .with_workspace_roots(vec![shared.path().to_path_buf()]) + .with_follow_symlinks(true); + + // In follow-symlinks mode the symlink's location is the gate; a link + // inside an additional root is accepted just like one in the primary. + let resolved = ctx + .resolve_path(shared.path().join("link-out").to_string_lossy().as_ref()) + .expect("symlink inside additional root"); + assert!(resolved.ends_with("link-out") || resolved == outside.path().canonicalize().unwrap()); +} + #[test] fn test_tool_context_trust_mode() { let tmp = tempdir().expect("tempdir"); diff --git a/crates/tui/src/tools/subagent/mod.rs b/crates/tui/src/tools/subagent/mod.rs index a536dcbb35..7e74c4cab5 100644 --- a/crates/tui/src/tools/subagent/mod.rs +++ b/crates/tui/src/tools/subagent/mod.rs @@ -3348,6 +3348,17 @@ pub struct SubAgentManager { pending_follow_ups: HashMap>, /// Test/observability: agent ids that received a live wake via followup. woken_agents: HashMap, + /// Test/observability: the workspace root set each spawned child was + /// launched with, keyed by child agent id. `ToolContext::boundary_roots` + /// and the gate's sandbox policy both materialize from this set. + #[cfg(test)] + spawned_workspace_roots: HashMap>, + /// Test/observability: the exec-lane sandbox policy each spawned child + /// was launched with, keyed by child agent id. The policy is cloned from + /// the parent, so a worktree child must re-derive it from its cleared + /// root set or the parent's attached roots stay writable. + #[cfg(test)] + spawned_sandbox_policies: HashMap>, /// Agent ids whose handle-store entries should be evicted on the next async /// drain. Populated by `cleanup()` when an agent record is retired; drained /// by async callers that hold the `HandleStore` lock (#3885). @@ -3470,6 +3481,10 @@ impl SubAgentManager { queued_mail: HashMap::new(), pending_follow_ups: HashMap::new(), woken_agents: HashMap::new(), + #[cfg(test)] + spawned_workspace_roots: HashMap::new(), + #[cfg(test)] + spawned_sandbox_policies: HashMap::new(), pending_handle_evictions: Vec::new(), resume_targets: HashMap::new(), child_approvals: HashMap::new(), @@ -5820,6 +5835,7 @@ impl SubAgentManager { fork_context, workspace, claim, + recorded_worktree_isolation, preserved_profile, child_route, ) = { @@ -5862,13 +5878,26 @@ impl SubAgentManager { // stays inside the coordination ledger with the original bounded // scope instead of inheriting the caller's unchecked write surface. // The ledger claim is already namespaced and carries the isolation - // flag; both are passed through to the spawn seam. + // flag; both are passed through to the spawn seam. The claim is + // not the isolation authority, though — it can be released or + // never have existed for a worktree child — so the worker + // record's launch manifest is read below as the durable fallback. let claim = self .coordination .write_claims .iter() .find(|record| record.claim.owner == agent_id) .map(|record| (record.claim.clone(), record.isolated_worktree)); + // The spec's launch manifest durably pins that this child was + // spawned into an isolated worktree, independent of the claim + // lifecycle. Keying isolation on the claim alone resumed a + // released or claim-less worktree child in the caller's full + // root set — wider than the spawn it continues. + let recorded_worktree_isolation = self + .worker_records + .get(&agent_id) + .and_then(|record| record.spec.launch_manifest.as_ref()) + .map(|manifest| manifest.worktree); // Preserve the interrupted child's runtime posture (read_only / // denied tools / shell) instead of rebuilding from the caller's // role, which could widen the resumed child's authority. @@ -5889,6 +5918,7 @@ impl SubAgentManager { agent.fork_context, agent.workspace.clone(), claim, + recorded_worktree_isolation, preserved_profile, child_route, ) @@ -5905,10 +5935,27 @@ impl SubAgentManager { )); } let runtime = runtime.background_runtime(); + // The live claim's flag wins (it is the freshest isolation truth); + // the launch manifest covers the released/never-claimed legs. + let isolated_worktree = claim + .as_ref() + .map(|(_, isolated)| *isolated) + .or(recorded_worktree_isolation) + .unwrap_or(false); // Resume in the interrupted child's workspace, not the caller's // (worktree/cwd children must not resume in the parent directory). let mut runtime = runtime; runtime.context.workspace = workspace; + if isolated_worktree { + // Same isolation rule as a fresh worktree spawn: a worktree + // child's boundary is the worktree alone, so the parent's + // attached roots do not carry over into the resumed child + // (neither `boundary_roots` nor the gate's sandbox policy may + // resolve or write outside the worktree). Re-derive the cloned + // sandbox policy as well — the exec lane consumes it verbatim. + runtime.context.workspace_roots = Vec::new(); + rederive_sandbox_policy_roots(&mut runtime.context); + } let options = SubAgentSpawnOptions { name: None, // the old session name stays owned by the terminal record model: Some(model), @@ -5917,10 +5964,7 @@ impl SubAgentManager { nickname: None, fork_context, write_claim: claim.as_ref().map(|(claim, _)| claim.clone()), - isolated_worktree: claim - .as_ref() - .map(|(_, isolated)| *isolated) - .unwrap_or(false), + isolated_worktree, claim_pre_namespaced: claim.is_some(), preserve_runtime_profile: preserved_profile, ..Default::default() @@ -6725,6 +6769,14 @@ impl SubAgentManager { } let launch_gate = (runtime.spawn_depth == 1).then(|| self.launch_gate.clone()); + #[cfg(test)] + self.spawned_workspace_roots + .insert(agent_id.clone(), runtime.context.workspace_roots.clone()); + #[cfg(test)] + self.spawned_sandbox_policies.insert( + agent_id.clone(), + runtime.context.elevated_sandbox_policy.clone(), + ); let task = SubAgentTask { manager_handle, runtime, @@ -9296,6 +9348,24 @@ async fn wait_result_payload( Ok(tool_result) } +/// Re-derive the exec lane's writable roots after a worktree clear site +/// resets `context.workspace_roots`. A child runtime clones the parent's +/// context wholesale — including `elevated_sandbox_policy`, which the engine +/// built over the parent's full root set — so without this rebuild the exec +/// lane (`shell.rs` policy override → `WorkspaceWrite::get_writable_roots`) +/// would still treat the parent's attached roots as writable while the file +/// lane's `boundary_roots` no longer resolves there. Only the WorkspaceWrite +/// face carries a root set to re-derive; the other postures hold none. +fn rederive_sandbox_policy_roots(context: &mut ToolContext) { + let cleared = + codewhale_core::normalize_workspace_roots(&context.workspace, &context.workspace_roots); + if let Some(crate::sandbox::SandboxPolicy::WorkspaceWrite { writable_roots, .. }) = + context.elevated_sandbox_policy.as_mut() + { + *writable_roots = cleared; + } +} + async fn spawn_subagent_from_input( input: Value, manager: SharedSubAgentManager, @@ -9405,6 +9475,18 @@ async fn spawn_subagent_from_input( ); if let Some(workspace) = child_workspace { child_runtime.context.workspace = workspace.clone(); + if spawn_request.worktree.is_some() { + // A worktree child is an isolation boundary, not a wider + // session: its boundary is the worktree alone, so the parent's + // attached roots do not carry over (at base a worktree child + // could only resolve inside its worktree). The cloned sandbox + // policy must be re-derived too — it was built over the parent's + // full root set, and the exec lane consumes it verbatim. + child_runtime.context.workspace_roots = Vec::new(); + rederive_sandbox_policy_roots(&mut child_runtime.context); + } + // An explicit `cwd:` swap without a worktree is non-isolating and + // keeps the parent's root set (disclosed in the PR description). // A worktree child gets a distinct workspace-scoped plugin catalog. // Reusing the parent's registry here would leak workspace plugins (and // their authority receipts) across the exact isolation boundary the @@ -14495,6 +14577,7 @@ impl SubAgentToolRegistry { approval_mode, workspace_trusted, Some(&workspace), + &self.gate_runtime.context.workspace_roots, ); let (decision, _audit) = auto_review_plan_decision_for_context( &self.gate_runtime.auto_review_policy, @@ -14875,6 +14958,7 @@ impl SubAgentToolRegistry { } crate::core::authority::paths_within_workspace_write_carve_out( &self.registry.context().workspace, + &self.registry.context().workspace_roots, &raw_mutation_target_paths(name, input), ) } @@ -15453,6 +15537,7 @@ impl SubAgentToolRegistry { name, &input, &self.registry.context().workspace, + &self.registry.context().workspace_roots, crate::tui::approval::ApprovalMode::Auto, ) .or_else(|| { @@ -15461,6 +15546,7 @@ impl SubAgentToolRegistry { name, &input, &self.registry.context().workspace, + &self.registry.context().workspace_roots, crate::tui::approval::ApprovalMode::Auto, ) }); diff --git a/crates/tui/src/tools/subagent/tests.rs b/crates/tui/src/tools/subagent/tests.rs index 7ce40f9112..86c2a94661 100644 --- a/crates/tui/src/tools/subagent/tests.rs +++ b/crates/tui/src/tools/subagent/tests.rs @@ -20766,6 +20766,260 @@ async fn resume_from_checkpoint_rejects_missing_continuable_checkpoint() { ); } +/// The resume lane must honor the same isolation rule as a fresh worktree +/// spawn: a worktree child's boundary is the worktree alone, so a multi-root +/// parent's attached roots must not re-widen the resumed child. Both +/// enforcement surfaces (`ToolContext::boundary_roots` and the gate's +/// per-turn sandbox policy) materialize from the child's +/// `(workspace, workspace_roots)` pair — and the exec lane's cloned +/// `elevated_sandbox_policy` must be re-derived from that pair too, or the +/// parent's attached roots would stay writable through the policy override. +#[tokio::test] +async fn resume_of_isolated_worktree_child_keeps_the_worktree_as_its_only_root() { + let tmp = tempdir().unwrap(); + let parent_workspace = tmp.path().join("parent"); + let attached_root = tmp.path().join("attached"); + let worktree = tmp.path().join("worktree"); + for dir in [&parent_workspace, &attached_root, &worktree] { + std::fs::create_dir_all(dir).unwrap(); + } + let manager = new_shared_subagent_manager(tmp.path().to_path_buf(), 4); + let (agent_id, _handle) = { + let mut guard = manager.write().await; + let (agent_id, handle) = guard.insert_test_interrupted_continuable_agent( + "paused_worktree_child", + &worktree, + vec![Message { + role: Role::User, + content: vec![ContentBlock::Text { + text: "prior work".to_string(), + cache_control: None, + }], + }], + ); + // The interrupted child held an isolated-worktree write claim. + guard + .coordination + .register_claim( + WriteScopeClaim { + owner: agent_id.clone(), + roots: vec![".".to_string()], + exact_files: Vec::new(), + contracts: Vec::new(), + }, + true, + |_| false, + ) + .expect("isolated worktree claim"); + (agent_id, handle) + }; + let mut runtime = stub_runtime(); + runtime.manager = Arc::clone(&manager); + // Multi-root parent: its primary workspace plus an attached root, with + // the exec-lane policy built over that full set (as the engine builds it + // for the parent's turn). + runtime.context.workspace = parent_workspace.clone(); + runtime.context.workspace_roots = vec![parent_workspace.clone(), attached_root.clone()]; + runtime.context.elevated_sandbox_policy = Some(crate::sandbox::SandboxPolicy::WorkspaceWrite { + writable_roots: codewhale_core::normalize_workspace_roots( + &parent_workspace, + &runtime.context.workspace_roots, + ), + network_access: false, + exclude_tmpdir: false, + exclude_slash_tmp: false, + }); + + let resumed = { + let mut guard = manager.write().await; + guard + .resume_from_checkpoint(Arc::clone(&manager), runtime, &agent_id, "continue") + .expect("resume ok") + }; + + let guard = manager.read().await; + let child_roots = guard + .spawned_workspace_roots + .get(&resumed.agent_id) + .expect("the spawn seam captured the resumed child's root set"); + assert!( + child_roots.is_empty(), + "an isolated worktree child must not carry the parent's attached roots: {child_roots:?}" + ); + let boundary = codewhale_core::normalize_workspace_roots(&worktree, child_roots); + assert_eq!( + boundary, + vec![worktree.clone()], + "the resumed child's boundary materializes as the worktree alone" + ); + let child_policy = guard + .spawned_sandbox_policies + .get(&resumed.agent_id) + .expect("the spawn seam captured the resumed child's sandbox policy") + .as_ref() + .expect("the resumed child inherited the parent's exec-lane policy"); + assert_eq!( + child_policy, + &crate::sandbox::SandboxPolicy::WorkspaceWrite { + writable_roots: vec![worktree], + network_access: false, + exclude_tmpdir: false, + exclude_slash_tmp: false, + }, + "the exec lane's writable set must be re-derived from the cleared \ + root set — the parent's attached root must not stay writable" + ); +} + +/// Isolation must not key on the write claim's existence: a claim can be +/// released or never created for a worktree child. The worker record's +/// launch manifest durably pins the worktree spawn, so the claim-less resume +/// still comes back with the worktree as its only root instead of the +/// caller's full set. +#[tokio::test] +async fn claim_less_resume_of_a_recorded_worktree_child_stays_isolated() { + let tmp = tempdir().unwrap(); + let parent_workspace = tmp.path().join("parent"); + let attached_root = tmp.path().join("attached"); + let worktree = tmp.path().join("worktree"); + for dir in [&parent_workspace, &attached_root, &worktree] { + std::fs::create_dir_all(dir).unwrap(); + } + let manager = new_shared_subagent_manager(tmp.path().to_path_buf(), 4); + let agent_id = { + let mut guard = manager.write().await; + let (agent_id, _handle) = guard.insert_test_interrupted_continuable_agent( + "released_worktree_child", + &worktree, + vec![Message { + role: Role::User, + content: vec![ContentBlock::Text { + text: "prior work".to_string(), + cache_control: None, + }], + }], + ); + // The claim has been released (or never existed) — no ledger record + // remains. The worker record still carries the worktree spawn. + let mut spec = make_worker_spec(&agent_id, worktree.clone()); + spec.agent_type = FleetRole::Builder; + spec.runtime_profile = WorkerRuntimeProfile::for_role(FleetRole::Builder); + spec.launch_manifest = Some(ChildLaunchManifest { + owner_session: "root".to_string(), + child_id: agent_id.clone(), + profile: spec.runtime_profile.clone(), + prompt: spec.objective.clone(), + cwd: Some(worktree.display().to_string()), + worktree: true, + writable_roots: Vec::new(), + writable_files: Vec::new(), + coordination_contracts: Vec::new(), + expected_artifact: None, + token_budget: None, + resume_identity: Some(agent_id.clone()), + generation: 1, + resume_from_agent_id: None, + }); + guard.register_worker(spec); + agent_id + }; + let mut runtime = stub_runtime(); + runtime.manager = Arc::clone(&manager); + runtime.context.workspace = parent_workspace.clone(); + runtime.context.workspace_roots = vec![parent_workspace.clone(), attached_root.clone()]; + runtime.context.elevated_sandbox_policy = Some(crate::sandbox::SandboxPolicy::WorkspaceWrite { + writable_roots: codewhale_core::normalize_workspace_roots( + &parent_workspace, + &runtime.context.workspace_roots, + ), + network_access: false, + exclude_tmpdir: false, + exclude_slash_tmp: false, + }); + + let resumed = { + let mut guard = manager.write().await; + guard + .resume_from_checkpoint(Arc::clone(&manager), runtime, &agent_id, "continue") + .expect("resume ok") + }; + + let guard = manager.read().await; + let child_roots = guard + .spawned_workspace_roots + .get(&resumed.agent_id) + .expect("the spawn seam captured the resumed child's root set"); + assert!( + child_roots.is_empty(), + "a claim-less worktree child must not inherit the caller's root set: {child_roots:?}" + ); + let child_policy = guard + .spawned_sandbox_policies + .get(&resumed.agent_id) + .expect("the spawn seam captured the resumed child's sandbox policy") + .as_ref() + .expect("the resumed child inherited the parent's exec-lane policy"); + assert_eq!( + child_policy, + &crate::sandbox::SandboxPolicy::WorkspaceWrite { + writable_roots: vec![worktree], + network_access: false, + exclude_tmpdir: false, + exclude_slash_tmp: false, + }, + "a claim-less worktree child must not inherit the caller's writable roots" + ); +} + +/// The rebuild idiom shared by both worktree clear sites: after the roots set +/// is cleared, the WorkspaceWrite face of the cloned policy re-derives from +/// the child's `(workspace, workspace_roots)` pair — the worktree alone — and +/// postures that carry no root set pass through untouched. +#[test] +fn rederive_sandbox_policy_roots_confines_the_exec_lane_to_the_cleared_set() { + let tmp = tempdir().unwrap(); + let parent_workspace = tmp.path().join("parent"); + let attached_root = tmp.path().join("attached"); + let worktree = tmp.path().join("worktree"); + for dir in [&parent_workspace, &attached_root, &worktree] { + std::fs::create_dir_all(dir).unwrap(); + } + + // The shape a worktree clear site leaves behind: the child's workspace is + // the worktree, the roots set is cleared, and the policy is still the one + // cloned from the parent over the parent's full root set. + let mut context = ToolContext::new(worktree.clone()); + context.workspace_roots = Vec::new(); + context.elevated_sandbox_policy = Some(crate::sandbox::SandboxPolicy::WorkspaceWrite { + writable_roots: vec![parent_workspace, attached_root], + network_access: true, + exclude_tmpdir: false, + exclude_slash_tmp: false, + }); + rederive_sandbox_policy_roots(&mut context); + assert_eq!( + context.elevated_sandbox_policy, + Some(crate::sandbox::SandboxPolicy::WorkspaceWrite { + writable_roots: vec![worktree], + network_access: true, + exclude_tmpdir: false, + exclude_slash_tmp: false, + }), + "the parent's attached roots must not survive the re-derivation" + ); + + // Root-less postures have no writable set to re-derive and pass through. + for policy in [ + crate::sandbox::SandboxPolicy::ReadOnly, + crate::sandbox::SandboxPolicy::DangerFullAccess, + ] { + let mut context = ToolContext::new(tmp.path().join("child")); + context.elevated_sandbox_policy = Some(policy.clone()); + rederive_sandbox_policy_roots(&mut context); + assert_eq!(context.elevated_sandbox_policy, Some(policy)); + } +} + #[test] fn user_follow_up_to_running_child_counts_queued_until_the_loop_takes_it() { let tmp = tempdir().expect("tempdir"); diff --git a/crates/tui/src/tools/web_search.rs b/crates/tui/src/tools/web_search.rs index 9696866e4e..286677a020 100644 --- a/crates/tui/src/tools/web_search.rs +++ b/crates/tui/src/tools/web_search.rs @@ -4649,7 +4649,7 @@ mod tests { locale: crate::tools::web::contract::CapabilityState::Supported, published_date: crate::tools::web::contract::CapabilityState::Unknown, }; - let response = finalize_search_response(query, capabilities.clone(), raw, Instant::now()); + let response = finalize_search_response(query, capabilities, raw, Instant::now()); assert!( !response.receipt.honored.locale, "an ignored locale must not be reported as honored" diff --git a/crates/tui/src/tui/app.rs b/crates/tui/src/tui/app.rs index 9a091acfe2..08eccdcc02 100644 --- a/crates/tui/src/tui/app.rs +++ b/crates/tui/src/tui/app.rs @@ -1591,6 +1591,11 @@ pub struct App { /// Last effective thinking receipt for the most recently accepted route. pub(crate) last_effective_reasoning_effort: Option, pub workspace: PathBuf, + /// Additional accessible roots carried by the current session. The TUI + /// has no multi-root UI; this only preserves roots another host (Runtime + /// API, exec) persisted on the session, so a resume or re-sync neither + /// drops nor invents them. + pub workspace_roots: Vec, /// Effective `[workflow]` table for this session (`/workflow settings`). pub workflow_config: codewhale_config::WorkflowConfigToml, /// Effective `[goal] max_continuations` backstop; `0` means unlimited. diff --git a/crates/tui/src/tui/app/init.rs b/crates/tui/src/tui/app/init.rs index 41699f5ede..72451d0478 100644 --- a/crates/tui/src/tui/app/init.rs +++ b/crates/tui/src/tui/app/init.rs @@ -819,6 +819,7 @@ impl App { reasoning_effort_preference, last_effective_reasoning_effort: None, workspace, + workspace_roots: Vec::new(), workflow_config: config.workflow_config(), goal_max_continuations: config.goal_max_continuations(), goal_continuation_waiting: false, diff --git a/crates/tui/src/tui/app/types.rs b/crates/tui/src/tui/app/types.rs index e270cff28e..94d721c9fc 100644 --- a/crates/tui/src/tui/app/types.rs +++ b/crates/tui/src/tui/app/types.rs @@ -966,6 +966,7 @@ pub enum AppAction { system_prompt: Option, model: String, workspace: PathBuf, + workspace_roots: Vec, mode: AppMode, }, OpenConfigView, diff --git a/crates/tui/src/tui/approval/elevation.rs b/crates/tui/src/tui/approval/elevation.rs index f090909575..6097b05999 100644 --- a/crates/tui/src/tui/approval/elevation.rs +++ b/crates/tui/src/tui/approval/elevation.rs @@ -57,13 +57,24 @@ impl ElevationOption { } } - /// Convert to a sandbox policy. - pub fn to_policy(&self, base_cwd: &Path) -> SandboxPolicy { + /// Convert to a sandbox policy. `workspace_roots` is the session's live + /// root set, materialized with the per-turn policy's + /// `normalize_workspace_roots` idiom: the retry must keep every attached + /// root writable, or a denied call that legitimately writes one would be + /// denied again and nudge the user toward Full Access. + pub fn to_policy(&self, base_cwd: &Path, workspace_roots: &[PathBuf]) -> SandboxPolicy { match self { - ElevationOption::WithNetwork => SandboxPolicy::workspace_with_network(), + ElevationOption::WithNetwork => SandboxPolicy::workspace_with_roots( + codewhale_core::normalize_workspace_roots(base_cwd, workspace_roots), + true, + ), ElevationOption::WithWriteAccess(paths) => { let mut roots = paths.clone(); - roots.push(base_cwd.to_path_buf()); + for root in codewhale_core::normalize_workspace_roots(base_cwd, workspace_roots) { + if !roots.contains(&root) { + roots.push(root); + } + } SandboxPolicy::workspace_with_roots(roots, false) } ElevationOption::FullAccess => SandboxPolicy::DangerFullAccess, diff --git a/crates/tui/src/tui/approval/tests.rs b/crates/tui/src/tui/approval/tests.rs index 52d63e1d56..bb04123959 100644 --- a/crates/tui/src/tui/approval/tests.rs +++ b/crates/tui/src/tui/approval/tests.rs @@ -2276,7 +2276,7 @@ fn test_elevation_option_descriptions() { fn test_elevation_option_to_policy() { let cwd = PathBuf::from("/tmp/test"); - let policy = ElevationOption::WithNetwork.to_policy(&cwd); + let policy = ElevationOption::WithNetwork.to_policy(&cwd, &[]); assert!(matches!( policy, SandboxPolicy::WorkspaceWrite { @@ -2285,14 +2285,52 @@ fn test_elevation_option_to_policy() { } )); - let policy = ElevationOption::FullAccess.to_policy(&cwd); + let policy = ElevationOption::FullAccess.to_policy(&cwd, &[]); assert!(matches!(policy, SandboxPolicy::DangerFullAccess)); let paths = vec![PathBuf::from("/tmp/test/src")]; - let policy = ElevationOption::WithWriteAccess(paths).to_policy(&cwd); + let policy = ElevationOption::WithWriteAccess(paths).to_policy(&cwd, &[]); assert!(matches!(policy, SandboxPolicy::WorkspaceWrite { .. })); } +/// The retry policy must materialize the session's live root set (round-15): +/// a denied call retried WithNetwork keeps every attached root writable, +/// matching the per-turn policy instead of shrinking to the bare cwd. +#[test] +fn elevation_retry_policy_keeps_the_sessions_attached_roots() { + let cwd = PathBuf::from("/work/primary"); + let attached = PathBuf::from("/work/attached"); + let session_roots = vec![cwd.clone(), attached.clone()]; + + let SandboxPolicy::WorkspaceWrite { + writable_roots, + network_access, + .. + } = ElevationOption::WithNetwork.to_policy(&cwd, &session_roots) + else { + panic!("WithNetwork stays workspace-write"); + }; + assert!(network_access); + assert_eq!(writable_roots, session_roots); + + let extra = PathBuf::from("/work/extra"); + let SandboxPolicy::WorkspaceWrite { + writable_roots, + network_access, + .. + } = ElevationOption::WithWriteAccess(vec![extra.clone()]).to_policy(&cwd, &session_roots) + else { + panic!("WithWriteAccess stays workspace-write"); + }; + assert!(!network_access); + for root in [&extra, &cwd, &attached] { + assert!( + writable_roots.contains(root), + "retry must keep {root:?} writable: {writable_roots:?}" + ); + } +} + // ======================================================================== // ElevationRequest Tests // ======================================================================== diff --git a/crates/tui/src/tui/auto_review.rs b/crates/tui/src/tui/auto_review.rs index 3af136db78..f80afcc3c0 100644 --- a/crates/tui/src/tui/auto_review.rs +++ b/crates/tui/src/tui/auto_review.rs @@ -194,6 +194,7 @@ impl<'a> AutoReviewContext<'a> { approval_mode: ApprovalMode, workspace_trusted: bool, workspace: Option<&std::path::Path>, + workspace_roots: &[std::path::PathBuf], ) -> Self { let category = get_tool_category_for_call(tool_name, params); let risk = classify_risk(tool_name, category, params); @@ -212,7 +213,9 @@ impl<'a> AutoReviewContext<'a> { .zip(file_write_target_paths(tool_name, params)) .is_some_and(|(workspace, paths)| { crate::core::authority::paths_within_workspace_write_carve_out( - workspace, &paths, + workspace, + workspace_roots, + &paths, ) }), } @@ -386,12 +389,13 @@ fn file_write_target_paths(tool_name: &str, input: &Value) -> Option let canonical = crate::tools::canonical_action::canonical_action_alias(tool_name, input); Some(match canonical { "write_file" | "edit_file" => vec![ - input - .get("path") - .and_then(Value::as_str) - .map(str::trim) - .filter(|path| !path.is_empty()) - .map(str::to_string)?, + // Raw spelling, untrimmed: the carve-out must judge exactly the + // path execution resolves (`ToolContext::resolve_path` joins the + // raw string onto the workspace). Alias spellings + // (`file_path`/`filePath`) included: execution folds them onto + // `path` only at execute time, so reading `path` alone judged + // nothing for an alias-spelled write (round-22 B22-2). + crate::tools::file::path_param_value(input)?, ], "apply_patch" => { crate::tools::apply_patch::preflight_apply_patch(input) @@ -1024,7 +1028,15 @@ mod tests { run_origin: RunOrigin, approval_mode: ApprovalMode, ) -> AutoReviewContext<'_> { - AutoReviewContext::from_tool_call(tool_name, ¶ms, run_origin, approval_mode, true, None) + AutoReviewContext::from_tool_call( + tool_name, + ¶ms, + run_origin, + approval_mode, + true, + None, + &[], + ) } fn assert_safety_gate(decision: &AutoReviewDecision) { @@ -1081,6 +1093,7 @@ mod tests { ApprovalMode::Auto, true, None, + &[], ); let decision = policy.evaluate(&ctx); @@ -1089,6 +1102,75 @@ mod tests { assert_eq!(decision.rule_id.as_deref(), Some("no-rm")); } + #[test] + fn write_targets_bounded_spans_attached_workspace_roots() { + // Pin for the bounded-write plumbing: the declared root set must + // reach the carve-out check. Every other caller here passes + // `None, &[]`, so a mutation dropping the set inside the context + // builder only shows up as an attached-root-dependent outcome. + let workspace = tempfile::tempdir().expect("workspace tempdir"); + let attached = tempfile::tempdir().expect("attached root tempdir"); + std::fs::create_dir(workspace.path().join(".git")).expect("git marker"); + std::fs::create_dir(attached.path().join(".git")).expect("git marker"); + let target = attached.path().join("src/a.rs"); + + let ctx = AutoReviewContext::from_tool_call( + "write_file", + &json!({ "path": target.to_string_lossy() }), + RunOrigin::Interactive, + ApprovalMode::Auto, + true, + Some(workspace.path()), + &[attached.path().to_path_buf()], + ); + assert!( + ctx.write_targets_bounded, + "a write target under an attached git root is bounded only while the root set reaches the carve-out" + ); + + // Control: the same call with the historical empty root set is not + // bounded. + let ctx = AutoReviewContext::from_tool_call( + "write_file", + &json!({ "path": target.to_string_lossy() }), + RunOrigin::Interactive, + ApprovalMode::Auto, + true, + Some(workspace.path()), + &[], + ); + assert!(!ctx.write_targets_bounded); + } + + #[test] + #[allow(non_snake_case)] + fn filePath_spelled_write_reaches_the_auto_review_carve_out() { + // Round-22 B22-2: execution folds the camelCase `filePath` alias onto + // `path` only at execute time, so Auto-Review's target collector read + // `path` alone and an alias-spelled write had no bounded targets — + // an unbounded write reached review. The alias must extract the same + // target. + let workspace = tempfile::tempdir().expect("workspace tempdir"); + let attached = tempfile::tempdir().expect("attached root tempdir"); + std::fs::create_dir(workspace.path().join(".git")).expect("git marker"); + std::fs::create_dir(attached.path().join(".git")).expect("git marker"); + let target = attached.path().join("src/a.rs"); + + let ctx = AutoReviewContext::from_tool_call( + "write_file", + &json!({ "filePath": target.to_string_lossy() }), + RunOrigin::Interactive, + ApprovalMode::Auto, + true, + Some(workspace.path()), + &[attached.path().to_path_buf()], + ); + assert!( + ctx.write_targets_bounded, + "a filePath-spelled write under an attached git root must be judged" + ); + } + #[test] fn safety_floor_holds_publish_before_allow_rules() { let policy = AutoReviewPolicy { @@ -1508,6 +1590,7 @@ mod tests { ApprovalMode::Suggest, true, None, + &[], ); let decision = policy.evaluate(&ctx); @@ -1563,6 +1646,7 @@ mod tests { ApprovalMode::Auto, true, None, + &[], ); assert_eq!(context.tool_name, tool_name); assert_eq!(context.category, category, "{tool_name}"); @@ -1630,6 +1714,7 @@ mod tests { ApprovalMode::Auto, true, None, + &[], ); let text = build_reviewer_context( &ctx, diff --git a/crates/tui/src/tui/session_picker.rs b/crates/tui/src/tui/session_picker.rs index 60a32549eb..3acc767635 100644 --- a/crates/tui/src/tui/session_picker.rs +++ b/crates/tui/src/tui/session_picker.rs @@ -1263,6 +1263,7 @@ mod tests { model_provider: "deepseek".to_string(), model_provider_id: None, workspace: std::path::PathBuf::from("/tmp"), + workspace_roots: Vec::new(), mode: Some("agent".to_string()), cost: crate::session_manager::SessionCostSnapshot::default(), parent_session_id: None, diff --git a/crates/tui/src/tui/ui/apply.rs b/crates/tui/src/tui/ui/apply.rs index 4f5b8fb87e..dfe6931016 100644 --- a/crates/tui/src/tui/ui/apply.rs +++ b/crates/tui/src/tui/ui/apply.rs @@ -1096,6 +1096,7 @@ pub(crate) async fn apply_provider_fallback_switch( system_prompt_override: false, model: app.model.clone(), workspace: app.workspace.clone(), + workspace_roots: app.workspace_roots.clone(), mode: app.mode, }) .await; @@ -1210,6 +1211,18 @@ pub(crate) async fn apply_command_result( return Ok(false); } }; + // The persisted metadata is the only roots source in the TUI + // (no multi-root UI): seed the app state only after every + // fallible restore step has succeeded, so a failed load + // cannot leave the *current* session's engine inheriting a + // foreign root set through the next routine re-sync. The seed + // routes through the same normalize the writers use, so a + // legacy or hand-edited record cannot seed an entry the + // intake filter would have dropped. + app.workspace_roots = codewhale_core::normalize_workspace_roots( + &app.workspace, + &session.metadata.workspace_roots, + ); sync_runtime_workspace_state(task_manager, app.workspace.clone()).await; if respawn { let _ = engine_handle.send(Op::Shutdown).await; @@ -1231,6 +1244,7 @@ pub(crate) async fn apply_command_result( system_prompt_override: false, model: app.model.clone(), workspace: app.workspace.clone(), + workspace_roots: app.workspace_roots.clone(), mode: app.mode, }) .await; @@ -1249,6 +1263,13 @@ pub(crate) async fn apply_command_result( content: success_message.clone(), }); app.status_message = Some(success_message); + // The imported record's root set arrived from another host; + // name it in the transcript beside the load receipt. + if let Some(notice) = + workspace_roots_notice(app.ui_locale, &app.workspace, &app.workspace_roots) + { + app.add_message(HistoryCell::System { content: notice }); + } // A loaded session is the working screen. The launch card's // recent rows reach here through `/resume`-shaped dispatch; // leaving the launch stage visible over the restored @@ -1262,6 +1283,7 @@ pub(crate) async fn apply_command_result( system_prompt, model, workspace, + workspace_roots, mode, } => { let mut session_id = session_id; @@ -1276,6 +1298,14 @@ pub(crate) async fn apply_command_result( apply_workspace_runtime_state(app, config, workspace.clone()); sync_runtime_workspace_state(task_manager, workspace.clone()).await; } + // The action is the roots authority for this transition (a + // fork carries the parent's set, a new session carries an + // empty one). Record it in the same step as the workspace + // above: the provider restore below can fail and return + // early, and leaving the previous session's set paired with + // the new workspace would make every later re-sync send a + // workspace whose primary root is the old directory. + app.workspace_roots = workspace_roots.clone(); let provider_changed = config.api_provider() != app.api_provider || config.provider_identity_for(config.api_provider()) != app.provider_identity_for_persistence(); @@ -1322,6 +1352,7 @@ pub(crate) async fn apply_command_result( system_prompt_override: false, model, workspace, + workspace_roots, mode, }) .await; @@ -1399,6 +1430,7 @@ pub(crate) async fn apply_command_result( system_prompt_override: false, model: app.model.clone(), workspace: app.workspace.clone(), + workspace_roots: app.workspace_roots.clone(), mode: app.mode, }) .await; @@ -2286,6 +2318,7 @@ pub(crate) async fn apply_command_result( system_prompt_override: false, model: app.model.clone(), workspace: app.workspace.clone(), + workspace_roots: app.workspace_roots.clone(), mode: app.mode, }) .await; @@ -3296,6 +3329,12 @@ pub(crate) fn apply_loaded_session_with_goal( "runtime work is active; wait for the current turn, maintenance, and background tasks to finish, or cancel that specific work before switching sessions".to_string(), ); } + if session.metadata.workspace.as_os_str().is_empty() { + // A legacy or hand-edited record with an empty workspace would seed + // the vacuous containment root (`starts_with("")` accepts every + // path); refuse the restore like any other invalid saved state. + return Err("saved session workspace must not be empty".to_string()); + } if let Some(goal) = goal { goal.validate() .map_err(|error| format!("saved session goal is invalid: {error}"))?; diff --git a/crates/tui/src/tui/ui/event_loop.rs b/crates/tui/src/tui/ui/event_loop.rs index 8d05f57c7b..063b84f9e7 100644 --- a/crates/tui/src/tui/ui/event_loop.rs +++ b/crates/tui/src/tui/ui/event_loop.rs @@ -586,6 +586,27 @@ pub async fn run_tui( Ok(goal) => { match apply_loaded_session_with_goal(&mut app, config, &saved, goal.as_ref()) { Ok(()) => { + // The engine below is built and synced from App + // state: without this seed, a multi-root session + // resumed from the CLI runs single-root for the + // whole process lifetime. The seed routes through + // the same normalize the writers use, so a legacy + // or hand-edited record cannot seed an entry the + // intake filter would have dropped. + app.workspace_roots = codewhale_core::normalize_workspace_roots( + &app.workspace, + &saved.metadata.workspace_roots, + ); + // Name the inherited set in the transcript: the + // roots arrived from another host and no header + // chrome reports them. + if let Some(notice) = workspace_roots_notice( + app.ui_locale, + &app.workspace, + &app.workspace_roots, + ) { + app.add_message(HistoryCell::System { content: notice }); + } app.status_message = Some(format!( "Resumed session: {}", crate::session_manager::truncate_id(&saved.metadata.id) @@ -730,6 +751,7 @@ pub async fn run_tui( system_prompt_override: false, model: app.model.clone(), workspace: app.workspace.clone(), + workspace_roots: app.workspace_roots.clone(), mode: app.mode, }) .await; @@ -1145,6 +1167,7 @@ async fn submit_decided_composer_input( system_prompt_override: false, model: app.model.clone(), workspace: app.workspace.clone(), + workspace_roots: app.workspace_roots.clone(), mode: app.mode, }) .await; @@ -3694,6 +3717,7 @@ pub(crate) async fn run_event_loop( system_prompt_override: false, model: app.model.clone(), workspace: app.workspace.clone(), + workspace_roots: app.workspace_roots.clone(), mode: app.mode, }) .await; diff --git a/crates/tui/src/tui/ui/frame.rs b/crates/tui/src/tui/ui/frame.rs index f80e8fa1fd..c112a75f4e 100644 --- a/crates/tui/src/tui/ui/frame.rs +++ b/crates/tui/src/tui/ui/frame.rs @@ -713,6 +713,7 @@ pub(crate) fn build_engine_config(app: &App, config: &Config) -> EngineConfig { model: app.model.clone(), active_route_limits: app.active_route_limits, workspace: app.workspace.clone(), + workspace_roots: app.workspace_roots.clone(), // The App owns the session id (claimed before the Runtime store lock // and used for every checkpoint/autosave); the engine adopts it so the // engine conversation and the persisted session are the same record. @@ -908,6 +909,10 @@ pub(crate) fn build_session_snapshot( Some(app.mode.as_setting()), ) }; + // Autosave must rewrite the roots the session runs with, not an empty + // set: an erased `workspace_roots` here durably degrades a multi-root + // session on disk. + session.metadata.workspace_roots = app.workspace_roots.clone(); let computed_title = session.metadata.title.clone(); if let Some(cached) = app .current_session_metadata @@ -971,15 +976,16 @@ pub(crate) fn build_session_snapshot( session.last_auto_route = app.auto_route_for_persistence(); session.window_title.clone_from(&app.window_title); app.current_session_metadata = Some(session.metadata.clone()); - // Claim ownership of this session for the process. From here on the - // Runtime API refuses external renames/archives of it with a typed 409 - // rather than writing something the next snapshot would revert. + // Claim ownership of this session for the process. The registry's + // remaining consumer is the orphan-reclamation keep-chain: a live + // owner's session directory is never swept while the TUI holds it. // // Claiming here rather than at each of the ten `current_session_id` // assignment sites is deliberate: this is the function that establishes // "the TUI holds the authoritative copy", which is exactly the condition - // the conflict protects. A session that has never been snapshotted has no - // in-memory state to lose, so leaving it unclaimed is correct, not a gap. + // the keep-chain protects. A session that has never been snapshotted has + // no in-memory state to lose, so leaving it unclaimed is correct, not a + // gap. crate::session_manager::set_live_session(Some(&session.metadata.id)); Ok(session) } @@ -2037,6 +2043,32 @@ mod tests { use super::{register_info_interaction_targets, render_info_row, short_title_truncate}; use ratatui::{Terminal, backend::TestBackend}; + /// The autosave chokepoint is a roots writer like any other: an erased + /// `workspace_roots` here durably degrades a multi-root session on disk, + /// so the stamp needs a behavior test of its own. + #[test] + fn autosave_snapshot_stamps_the_live_root_set() { + let tmp = tempfile::tempdir().expect("tempdir"); + let workspace = tmp.path().join("work"); + let attached = tmp.path().join("attached"); + std::fs::create_dir_all(&workspace).expect("workspace dir"); + std::fs::create_dir_all(&attached).expect("attached dir"); + let mut app = crate::test_support::test_app_with_options( + crate::test_support::test_tui_options(&workspace), + ); + app.workspace_roots = vec![workspace.clone(), attached.clone()]; + + let manager = crate::session_manager::SessionManager::new(tmp.path().join("sessions")) + .expect("manager"); + let session = super::build_session_snapshot(&mut app, &manager).expect("snapshot"); + + assert_eq!( + session.metadata.workspace_roots, + vec![workspace, attached], + "the autosave chokepoint must persist the live set, not an empty one" + ); + } + /// Chrome that answers a click must also answer the pointer, or the app /// teaches people that pointing at things does not work here. #[test] diff --git a/crates/tui/src/tui/ui/handlers.rs b/crates/tui/src/tui/ui/handlers.rs index f4fcea405d..ac6ea92e1c 100644 --- a/crates/tui/src/tui/ui/handlers.rs +++ b/crates/tui/src/tui/ui/handlers.rs @@ -1088,21 +1088,21 @@ pub(crate) async fn handle_view_events( app.add_message(HistoryCell::System { content: format!("Retrying {tool_name} with network access enabled"), }); - let policy = option.to_policy(&app.workspace); + let policy = option.to_policy(&app.workspace, &app.workspace_roots); let _ = engine_handle.retry_tool_with_policy(tool_id, policy).await; } ElevationOption::WithWriteAccess(_) => { app.add_message(HistoryCell::System { content: format!("Retrying {tool_name} with write access enabled"), }); - let policy = option.to_policy(&app.workspace); + let policy = option.to_policy(&app.workspace, &app.workspace_roots); let _ = engine_handle.retry_tool_with_policy(tool_id, policy).await; } ElevationOption::FullAccess => { app.add_message(HistoryCell::System { content: format!("Retrying {tool_name} with full access (no sandbox)"), }); - let policy = option.to_policy(&app.workspace); + let policy = option.to_policy(&app.workspace, &app.workspace_roots); let _ = engine_handle.retry_tool_with_policy(tool_id, policy).await; } } @@ -1163,6 +1163,19 @@ pub(crate) async fn handle_view_events( continue; } }; + // Seed only after the fallible restore succeeded: the + // persisted metadata is the target session's roots, + // and the respawned engine plus every re-sync read + // this field. Without it, switching sessions either + // leaks the previous session's set into this one or + // silently strips this session's persisted set. The + // seed routes through the same normalize the writers + // use, so a legacy or hand-edited record cannot seed + // an entry the intake filter would have dropped. + app.workspace_roots = codewhale_core::normalize_workspace_roots( + &app.workspace, + &session.metadata.workspace_roots, + ); sync_runtime_workspace_state(task_manager, app.workspace.clone()).await; if respawn { let _ = engine_handle.send(Op::Shutdown).await; @@ -1185,6 +1198,7 @@ pub(crate) async fn handle_view_events( system_prompt_override: false, model: app.model.clone(), workspace: app.workspace.clone(), + workspace_roots: app.workspace_roots.clone(), mode: app.mode, }) .await; @@ -1205,6 +1219,17 @@ pub(crate) async fn handle_view_events( content: loaded_message.clone(), }); app.status_message = Some(loaded_message); + // The picker can cross workspaces and the loaded + // session may carry roots the header never showed; + // name them in the transcript (durable, like the + // receipt above) rather than a transient toast. + if let Some(notice) = workspace_roots_notice( + app.ui_locale, + &app.workspace, + &app.workspace_roots, + ) { + app.add_message(HistoryCell::System { content: notice }); + } app.launch.visible = false; app.launch.status = None; } @@ -2216,6 +2241,7 @@ pub(crate) async fn handle_view_events( system_prompt_override: false, model: app.model.clone(), workspace: app.workspace.clone(), + workspace_roots: app.workspace_roots.clone(), mode: app.mode, }) .await; diff --git a/crates/tui/src/tui/ui/provider_routes.rs b/crates/tui/src/tui/ui/provider_routes.rs index 4a67c9f15f..a653e33774 100644 --- a/crates/tui/src/tui/ui/provider_routes.rs +++ b/crates/tui/src/tui/ui/provider_routes.rs @@ -741,6 +741,7 @@ pub(crate) async fn switch_provider( system_prompt_override: false, model: app.model.clone(), workspace: app.workspace.clone(), + workspace_roots: app.workspace_roots.clone(), mode: app.mode, }) .await; diff --git a/crates/tui/src/tui/ui/session_state.rs b/crates/tui/src/tui/ui/session_state.rs index 68cab94ab0..83d4407725 100644 --- a/crates/tui/src/tui/ui/session_state.rs +++ b/crates/tui/src/tui/ui/session_state.rs @@ -588,6 +588,9 @@ pub(crate) fn begin_launch_session( let session_id = uuid::Uuid::new_v4().to_string(); app.current_session_id = Some(session_id.clone()); app.current_session_metadata = None; + // A new session starts single-root: never inherit the previous + // session's additional roots. + app.workspace_roots = Vec::new(); app.session_title = Some(app.tr(MessageId::SessionsNewSessionTitle).into_owned()); app.launch.visible = false; app.launch.status = None; @@ -598,6 +601,7 @@ pub(crate) fn begin_launch_session( system_prompt: None, model: app.model.clone(), workspace: app.workspace.clone(), + workspace_roots: app.workspace_roots.clone(), mode: app.mode, }) } @@ -609,6 +613,127 @@ pub(crate) async fn sync_runtime_workspace_state( task_manager.set_default_workspace(workspace).await; } +/// One-line human disclosure for a session that carries accessible roots +/// beside its primary workspace, capped like the model-facing +/// `Accessible folders:` line. The turn-meta envelope is model-facing only +/// and the TUI has no multi-root UI, so without this a session whose roots +/// were attached once (or inherited through resume or a bare fork) re-enters +/// with zero indication that writes under an attached root are governed by +/// this session's policy — and under the default Ask posture an attached git +/// root's writes are carve-out modal-free. +pub(crate) fn workspace_roots_notice( + locale: crate::localization::Locale, + workspace: &Path, + roots: &[PathBuf], +) -> Option { + const MAX_LISTED_ROOTS: usize = 5; + let additional: Vec<&PathBuf> = roots + .iter() + .filter(|root| root.as_path() != workspace) + .take(MAX_LISTED_ROOTS) + .collect(); + if additional.is_empty() { + return None; + } + let remainder = roots + .len() + .saturating_sub(1) + .saturating_sub(additional.len()); + let listed = additional + .into_iter() + .map(|root| root.display().to_string()) + .collect::>() + .join(", "); + let mut roots_value = listed; + if remainder > 0 { + roots_value.push_str( + &tr(locale, MessageId::WorkspaceRootsRemainder) + .replace("{count}", &remainder.to_string()), + ); + } + Some( + tr(locale, MessageId::WorkspaceRootsNotice) + .replace("{workspace}", &workspace.display().to_string()) + .replace("{roots}", &roots_value), + ) +} + +/// The `/cd` persistence receipt, typed so the closing-status classifier can +/// tell a degraded success from a real failure instead of treating any +/// receipt as an error (round-17: the actor-unavailable arm used to promote +/// to a sticky Error toast even though the direct save had landed). +#[derive(Debug)] +enum WorkspaceSwitchReceipt { + /// The direct save landed; only the actor enqueue failed and the next + /// autosave re-persists the snapshot. A warning note, not an error. + Degraded(String), + /// The swap is not durably recorded (save failed, or the snapshot itself + /// could not be built). The user must see this as a failure. + Failure(String), +} + +impl WorkspaceSwitchReceipt { + fn text(&self) -> &str { + match self { + Self::Degraded(text) | Self::Failure(text) => text, + } + } +} + +/// Persist the post-switch snapshot through both durability paths and +/// return exactly what happened. The direct save is the immediate disk +/// authority; the actor enqueue heals the reorder window (a queued +/// pre-switch snapshot is coalesced away by this fresher one). The status +/// must never claim a persistence that did not happen: when both paths fail +/// the next restart would resurrect the pre-switch workspace/root set, and +/// that has to be the visible failure. The caller assigns the receipt LAST — +/// the closing "Workspace: X" line must not clobber it (round-14 M-1). +fn persist_workspace_switch_snapshot( + locale: crate::localization::Locale, + manager: &SessionManager, + snapshot: crate::session_manager::SavedSession, +) -> Option { + let save_error = manager.save_session(&snapshot).err(); + // The direct save bypasses the persistence actor, so a pre-`/cd` + // snapshot already queued there (an autosave that fired moments ago) + // could still land after it and revert the root swap on disk. Enqueue + // the post-switch snapshot: the actor's latest-wins coalescing drops + // the queued stale one, and even a stale write already in flight is + // followed by this fresher record of the swapped set. + let queued = persistence_actor::try_persist(PersistRequest::SessionSnapshot(snapshot)); + workspace_switch_persistence_message( + locale, + save_error.as_ref().map(|err| err.to_string()), + queued, + ) +} + +/// The status receipt for the two `/cd` persistence paths, from the actual +/// outcomes: a save error plus an unavailable actor means NEITHER path +/// persisted the swap, and the message must say so — a "persisted" claim +/// there would hide a restart resurrecting the pre-switch workspace/root +/// set. A landed save with a dead actor is a degraded success (`Degraded`), +/// not a failure. +fn workspace_switch_persistence_message( + locale: crate::localization::Locale, + save_error: Option, + queued: bool, +) -> Option { + let message: Option = match (&save_error, queued) { + (None, true) => None, + (None, false) => Some(WorkspaceSwitchReceipt::Degraded( + tr(locale, MessageId::WorkspaceSwitchPersistedActorUnavailable).into_owned(), + )), + (Some(error), true) => Some(WorkspaceSwitchReceipt::Failure( + tr(locale, MessageId::WorkspaceSwitchSaveFailedActorQueued).replace("{error}", error), + )), + (Some(error), false) => Some(WorkspaceSwitchReceipt::Failure( + tr(locale, MessageId::WorkspaceSwitchPersistFailed).replace("{error}", error), + )), + }; + message +} + pub(crate) async fn switch_workspace( app: &mut App, engine_handle: &mut EngineHandle, @@ -616,12 +741,9 @@ pub(crate) async fn switch_workspace( config: &Config, workspace: PathBuf, ) { - if app.is_loading { - app.status_message = - Some("Cannot switch workspace while a request is running.".to_string()); - app.add_message(HistoryCell::System { - content: "Cannot switch workspace while a request is running.".to_string(), - }); + if let Some(message) = workspace_switch_blocked_message(app) { + app.status_message = Some(message.clone()); + app.add_message(HistoryCell::System { content: message }); return; } @@ -630,9 +752,47 @@ pub(crate) async fn switch_workspace( return; } + // Primary-swap semantics, matching the runtime PATCH workspace-only + // branch and `resolve_resume_roots`: the previous directory leaves the + // root set (it stopped being the session's directory), the new + // workspace takes the primary slot, and additional roots survive + // re-normalized against the new primary. + // Round-20 should-fix 1: the runtime PATCH workspace-only branch and + // `resolve_resume_roots` reject a re-based set whose entries become an + // ancestor of (or a super-root for) the new primary — persisting one + // here would strand a later bare fork/resume-move with a hard error. + // Validate BEFORE the swap and refuse the move with the same rule. + let carried: Vec = app + .workspace_roots + .iter() + .filter(|root| **root != app.workspace) + .cloned() + .collect(); + let re_based = match codewhale_core::validate_workspace_roots(&workspace, &carried) { + Ok(roots) => roots, + Err(err) => { + let message = format!( + "Cannot switch workspace to {}: the carried root set would widen past the new directory ({err:#}). Re-declare the roots after switching.", + workspace.display() + ); + app.status_message = Some(message.clone()); + app.add_message(HistoryCell::System { content: message }); + return; + } + }; + app.workspace = workspace.clone(); + app.workspace_roots = re_based; + apply_workspace_runtime_state(app, config, workspace.clone()); sync_runtime_workspace_state(task_manager, workspace.clone()).await; + // Persist the primary swap immediately (the same pattern as the fork + // paths): the autosave merge treats disk as the authority against an + // empty incoming set, so without a direct save the stale pre-`/cd` + // set would be rewritten on disk and resurrect the old directory as a + // writable root on the next resume. + let persist_receipt = persist_workspace_switch_receipt(app); + let _ = engine_handle.send(Op::Shutdown).await; let engine_config = build_engine_config(app, config); *engine_handle = spawn_tui_engine(engine_config, config); @@ -645,6 +805,7 @@ pub(crate) async fn switch_workspace( system_prompt_override: false, model: app.model.clone(), workspace: workspace.clone(), + workspace_roots: app.workspace_roots.clone(), mode: app.mode, }) .await; @@ -653,7 +814,86 @@ pub(crate) async fn switch_workspace( app.add_message(HistoryCell::System { content: format!("Switched workspace to {}", workspace.display()), }); - app.status_message = Some(format!("Workspace: {}", workspace.display())); + // The receipt rides the closing line instead of being assigned earlier: + // an unconditional "Workspace: X" assignment after the persist block used + // to clobber every failure receipt it exists to disclose (round-14 M-1). + apply_workspace_switch_closing_status(app, &workspace, persist_receipt); +} + +/// The `/cd` transition guard, aligned with `/clear`: an idle compaction or +/// a queued task blocks the switch just like a running request, because the +/// switch persists the new root set and shuts the engine down — mid-compaction +/// that loses the compaction result. Like `/clear`'s busy message, the wording +/// is generic ("runtime work busy") and localized: naming "a request" would +/// misdescribe the compaction/purge/queued-task legs (round-17). +fn workspace_switch_blocked_message(app: &App) -> Option { + app.session_transition_blocked() + .then(|| tr(app.ui_locale, MessageId::WorkspaceSwitchBusy).into_owned()) +} + +/// The closing `/cd` status line: the persistence receipt (when any) is +/// composed into the success line, so the success text can never silently +/// replace a failure disclosure. +fn workspace_switch_closing_status(workspace: &Path, receipt: Option) -> String { + match receipt { + Some(receipt) => format!("Workspace: {} — {receipt}", workspace.display()), + None => format!("Workspace: {}", workspace.display()), + } +} + +/// Set the closing `/cd` status line and surface the persistence receipt at +/// the severity it actually is: a real failure promotes to a sticky error +/// with a typed level, while a degraded success (save landed, actor down) is +/// a typed warning toast. The `status_message` -> toast sync classifies by +/// sniffing English keywords, so a localized receipt would otherwise degrade +/// to an ephemeral Info toast. Marking the line as seen keeps that sync from +/// re-adding the same text as a second, misclassified toast. +fn apply_workspace_switch_closing_status( + app: &mut App, + workspace: &Path, + receipt: Option, +) { + let closing = workspace_switch_closing_status( + workspace, + receipt.as_ref().map(|receipt| receipt.text().to_string()), + ); + app.status_message = Some(closing.clone()); + match receipt { + Some(WorkspaceSwitchReceipt::Failure(_)) => { + app.set_sticky_status(closing.clone(), StatusToastLevel::Error, None); + app.last_status_message_seen = Some(closing); + } + Some(WorkspaceSwitchReceipt::Degraded(_)) => { + app.push_status_toast(closing.clone(), StatusToastLevel::Warning, Some(8_000)); + app.last_status_message_seen = Some(closing); + } + None => {} + } +} + +/// The `/cd` persist step, returning the user-visible receipt (if any). Only +/// an existing session has a record to swap: with no current session, +/// `build_session_snapshot` would mint AND durably save an empty +/// "New Session" orphan on every bare-prompt `/cd` (round-14 M-3), so the +/// step is skipped entirely there. +fn persist_workspace_switch_receipt(app: &mut App) -> Option { + // Only an existing session has a record to swap: with no current + // session, `build_session_snapshot` would mint AND durably save an empty + // "New Session" orphan on every bare-prompt `/cd` (round-14 M-3). + app.current_session_id.as_ref()?; + match SessionManager::default_location() { + Ok(manager) => match crate::tui::ui::frame::build_session_snapshot(app, &manager) { + Ok(snapshot) => persist_workspace_switch_snapshot(app.ui_locale, &manager, snapshot), + Err(err) => Some(WorkspaceSwitchReceipt::Failure( + tr(app.ui_locale, MessageId::WorkspaceSwitchSnapshotFailed) + .replace("{error}", &err.to_string()), + )), + }, + Err(err) => Some(WorkspaceSwitchReceipt::Failure( + tr(app.ui_locale, MessageId::WorkspaceSwitchSessionsDirFailed) + .replace("{error}", &err.to_string()), + )), + } } pub(crate) fn restore_failed_immediate_submit( @@ -1194,3 +1434,298 @@ mod launch_resume_tests { ); } } + +#[cfg(test)] +mod workspace_switch_persistence_tests { + use super::*; + + fn message_for(save_error: Option, queued: bool) -> Option { + workspace_switch_persistence_message(crate::localization::Locale::En, save_error, queued) + .map(|receipt| receipt.text().to_string()) + } + + /// The round-13 blocker: when the direct save AND the actor enqueue both + /// fail, neither path persisted the swap — the receipt must say so + /// instead of claiming persistence while a restart would resurrect the + /// pre-switch workspace/root set. + #[test] + fn double_failure_reports_failure_never_persistence() { + let message = message_for(Some("disk full".to_string()), false) + .expect("both paths failed; a receipt is required"); + assert!( + message.contains("Failed to persist workspace switch"), + "{message}" + ); + assert!(message.contains("disk full"), "{message}"); + assert!( + !message.to_ascii_lowercase().contains("persisted, but"), + "the double-failure receipt must not claim persistence: {message}" + ); + + // The actor-unavailable leg (save succeeded) is the only one allowed + // to say "persisted". + let saved_but_unqueued = + message_for(None, false).expect("save ok, actor down; a receipt is required"); + assert!( + saved_but_unqueued.contains("persisted"), + "{saved_but_unqueued}" + ); + + // Save failed but the actor holds the snapshot: no "persisted" claim + // about the direct save, and the actor leg is named. + let queued_anyway = message_for(Some("read-only fs".to_string()), true) + .expect("save failed; a receipt is required"); + assert!( + queued_anyway.contains("Direct workspace-switch save failed"), + "{queued_anyway}" + ); + assert!( + !queued_anyway + .to_ascii_lowercase() + .contains("persisted, but"), + "{queued_anyway}" + ); + + // Both paths succeeded: no receipt (the switch message follows). + assert_eq!(message_for(None, true), None); + } + + /// Round-17: the receipt is typed by outcome — the actor-unavailable leg + /// is a degraded success (the direct save landed), only save/snapshot + /// failures are `Failure`. The classifier keys off this type, not off + /// "is there a receipt". + #[test] + fn receipt_type_distinguishes_degraded_success_from_failure() { + assert!(matches!( + workspace_switch_persistence_message(crate::localization::Locale::En, None, false), + Some(WorkspaceSwitchReceipt::Degraded(_)) + )); + assert!(matches!( + workspace_switch_persistence_message( + crate::localization::Locale::En, + Some("disk full".to_string()), + true, + ), + Some(WorkspaceSwitchReceipt::Failure(_)) + )); + assert!(matches!( + workspace_switch_persistence_message( + crate::localization::Locale::En, + Some("disk full".to_string()), + false, + ), + Some(WorkspaceSwitchReceipt::Failure(_)) + )); + assert!( + workspace_switch_persistence_message(crate::localization::Locale::En, None, true) + .is_none() + ); + } + + /// The receipt is user-visible prose: a non-English locale renders its + /// own pack, never the English template. + #[test] + fn double_failure_receipt_is_localized() { + let message = workspace_switch_persistence_message( + crate::localization::Locale::Ja, + Some("disk full".to_string()), + false, + ) + .expect("receipt"); + let message = message.text(); + assert!(message.contains("永続化"), "{message}"); + assert!( + !message.contains("Failed to persist workspace switch"), + "{message}" + ); + } + + /// M-1 wiring: the closing status line composes the receipt into the + /// success text instead of overwriting it, so a double persistence + /// failure can never surface as a bare "Workspace: X". + #[test] + fn closing_status_carries_the_receipt() { + let workspace = Path::new("/tmp/ws"); + let bare = workspace_switch_closing_status(workspace, None); + assert_eq!(bare, "Workspace: /tmp/ws"); + + let with_receipt = workspace_switch_closing_status( + workspace, + Some("Failed to persist workspace switch: disk full".to_string()), + ); + assert!( + with_receipt.contains("Workspace: /tmp/ws"), + "{with_receipt}" + ); + assert!( + with_receipt.contains("Failed to persist workspace switch"), + "the receipt must survive the closing line: {with_receipt}" + ); + } + + /// Round-15: the failure receipt must surface as a sticky Error toast via + /// its typed level, in every locale — the keyword classifier only sniffs + /// English, so a localized receipt would otherwise degrade to an + /// ephemeral Info toast. Round-17: the classification is by receipt TYPE, + /// so the degraded-success arm (save landed, actor down) must NOT promote + /// as a sticky Error — it is a warning toast. + #[test] + fn failure_receipt_promotes_as_typed_sticky_error_in_any_locale() { + let dir = tempfile::tempdir().expect("tempdir"); + let mut app = App::new( + crate::test_support::test_tui_options(dir.path()), + &Config::default(), + ); + let receipt = tr( + crate::localization::Locale::Ja, + MessageId::WorkspaceSwitchPersistFailed, + ) + .replace("{error}", "disk full"); + apply_workspace_switch_closing_status( + &mut app, + Path::new("/tmp/ws"), + Some(WorkspaceSwitchReceipt::Failure(receipt)), + ); + let sticky = app.sticky_status.as_ref().expect("sticky error toast"); + assert_eq!(sticky.level, StatusToastLevel::Error); + assert!( + sticky.ttl_ms.is_some(), + "sticky errors stay TTL-capped, not permanent chrome" + ); + assert_eq!( + app.last_status_message_seen, app.status_message, + "the typed promotion replaces the keyword-classified re-toast" + ); + + // The degraded-success arm: the direct save landed and only the + // actor enqueue failed, so a sticky Error would cry failure over a + // persisted switch. It surfaces as a typed Warning toast instead. + let mut app = App::new( + crate::test_support::test_tui_options(dir.path()), + &Config::default(), + ); + let note = tr( + crate::localization::Locale::Ja, + MessageId::WorkspaceSwitchPersistedActorUnavailable, + ) + .into_owned(); + apply_workspace_switch_closing_status( + &mut app, + Path::new("/tmp/ws"), + Some(WorkspaceSwitchReceipt::Degraded(note)), + ); + assert!( + app.sticky_status.is_none(), + "a degraded success must not promote as a sticky error: {:?}", + app.sticky_status + ); + let toast = app + .status_toasts + .back() + .expect("a degraded success still raises a toast"); + assert_eq!(toast.level, StatusToastLevel::Warning); + assert_eq!( + app.last_status_message_seen, app.status_message, + "the typed toast replaces the keyword-classified re-toast" + ); + + let mut app = App::new( + crate::test_support::test_tui_options(dir.path()), + &Config::default(), + ); + apply_workspace_switch_closing_status(&mut app, Path::new("/tmp/ws"), None); + assert!( + app.sticky_status.is_none(), + "a plain success stays an untyped status line" + ); + } + + /// Round-15: `/cd` shares the `/clear` transition guard — an idle + /// compaction (no request running) must block the switch, because the + /// switch persists the new root set and shuts the engine down + /// mid-compaction, losing the result. + #[test] + fn cd_guard_blocks_idle_compaction_like_clear() { + let dir = tempfile::tempdir().expect("tempdir"); + let mut app = App::new( + crate::test_support::test_tui_options(dir.path()), + &Config::default(), + ); + app.is_compacting = true; + assert!(!app.is_loading, "idle compaction: no request running"); + assert!(workspace_switch_blocked_message(&app).is_some()); + + app.is_compacting = false; + assert!(workspace_switch_blocked_message(&app).is_none()); + } + + /// Round-17: the blocked message is localized prose that names the real + /// blocker class. The old hardcoded literal blamed "a request running" + /// on every leg — including idle compaction, where no request is running. + #[test] + fn cd_blocked_message_is_localized_and_names_no_running_request() { + let dir = tempfile::tempdir().expect("tempdir"); + let mut app = App::new( + crate::test_support::test_tui_options(dir.path()), + &Config::default(), + ); + app.is_compacting = true; + + let message = workspace_switch_blocked_message(&app).expect("blocked"); + assert_eq!( + message, + tr( + crate::localization::Locale::En, + MessageId::WorkspaceSwitchBusy, + ), + "the message comes from the locale pack, not a literal" + ); + assert!( + !message.to_ascii_lowercase().contains("request"), + "an idle compaction must not be told a request is running: {message}" + ); + + app.ui_locale = crate::localization::Locale::Ja; + let message = workspace_switch_blocked_message(&app).expect("blocked"); + assert!(message.contains("ワークスペース"), "{message}"); + assert!(!message.contains("Workspace unchanged"), "{message}"); + } + + /// M-3: a bare-prompt `/cd` has no session record to swap; the persist + /// step must not mint (and durably save) an empty "New Session" orphan. + #[test] + fn bare_cd_persists_nothing_and_mints_no_orphan() { + let dir = tempfile::tempdir().expect("tempdir"); + let options = crate::test_support::test_tui_options(dir.path()); + let mut app = App::new(options, &Config::default()); + assert!(app.current_session_id.is_none(), "fresh TUI has no session"); + + let receipt = persist_workspace_switch_receipt(&mut app); + assert!(receipt.is_none(), "no session, no receipt, no disk write"); + assert!( + app.current_session_id.is_none() && app.current_session_metadata.is_none(), + "the persist step must not mint a session on a bare /cd" + ); + } + + /// M-2: the two `/cd` failure strings are typed MessageIds rendered from + /// every pack, never hardcoded English. + #[test] + fn cd_failure_strings_are_localized() { + for locale in [ + crate::localization::Locale::En, + crate::localization::Locale::Ja, + crate::localization::Locale::ZhHans, + ] { + let snapshot = tr(locale, MessageId::WorkspaceSwitchSnapshotFailed); + let sessions_dir = tr(locale, MessageId::WorkspaceSwitchSessionsDirFailed); + assert!(snapshot.contains("{error}"), "{snapshot}"); + assert!(sessions_dir.contains("{error}"), "{sessions_dir}"); + } + let ja = tr( + crate::localization::Locale::Ja, + MessageId::WorkspaceSwitchSnapshotFailed, + ); + assert!(!ja.contains("Failed to snapshot"), "{ja}"); + } +} diff --git a/crates/tui/src/tui/ui/tests.rs b/crates/tui/src/tui/ui/tests.rs index 669ea8dffc..178012f591 100644 --- a/crates/tui/src/tui/ui/tests.rs +++ b/crates/tui/src/tui/ui/tests.rs @@ -6596,6 +6596,7 @@ fn saved_session_with_messages(messages: Vec) -> SavedSession { model_provider: "deepseek".to_string(), model_provider_id: None, workspace: PathBuf::from("/tmp/resume-recovery"), + workspace_roots: Vec::new(), mode: Some("yolo".to_string()), cost: crate::session_manager::SessionCostSnapshot::default(), parent_session_id: None, @@ -17757,6 +17758,25 @@ fn legacy_session_without_work_state_clears_previous_todo_on_load() { assert_eq!(app.work_state_snapshot().expect("snapshot"), None); } +#[test] +fn empty_workspace_session_restore_is_rejected_and_leaves_current_session_intact() { + // Regression pin: a legacy or hand-edited record with `workspace: ""` + // used to resume unchallenged, seeding the vacuous containment root + // (`starts_with("")` accepts every path) into the restored session. + let mut app = create_test_app(); + app.api_messages + .push(text_message("user", "current conversation")); + app.current_session_id = Some("current-session".to_string()); + let mut session = saved_session_with_messages(vec![text_message("user", "legacy")]); + session.metadata.workspace = PathBuf::new(); + + let err = apply_loaded_session(&mut app, &mut Config::default(), &session).unwrap_err(); + + assert!(err.contains("workspace must not be empty"), "{err}"); + assert_eq!(app.api_messages.len(), 1); + assert_eq!(app.current_session_id.as_deref(), Some("current-session")); +} + #[test] fn contended_work_restore_leaves_current_session_wholly_unchanged() { let mut app = create_test_app(); @@ -20794,6 +20814,7 @@ async fn approval_decision_persists_ask_rules_to_permissions_file() { path: None, ask_for_approval: codewhale_execpolicy::AskForApproval::OnFailure, sandbox_mode: None, + workspace_roots: Vec::new(), }) .expect("check persisted runtime policy"); assert!(decision.requires_approval); @@ -20850,6 +20871,7 @@ async fn approval_decision_persists_exact_workspace_allow_rule() { path: None, ask_for_approval: codewhale_execpolicy::AskForApproval::OnRequest, sandbox_mode: None, + workspace_roots: Vec::new(), }) .expect("check persisted allow"); assert_eq!( @@ -20867,6 +20889,7 @@ async fn approval_decision_persists_exact_workspace_allow_rule() { path: None, ask_for_approval: codewhale_execpolicy::AskForApproval::OnRequest, sandbox_mode: None, + workspace_roots: Vec::new(), }) .expect("check expanded command"); assert!(expanded.requires_approval); diff --git a/crates/tui/src/tui/underwater.rs b/crates/tui/src/tui/underwater.rs index 37ed294cc0..32eaaea74a 100644 --- a/crates/tui/src/tui/underwater.rs +++ b/crates/tui/src/tui/underwater.rs @@ -879,6 +879,7 @@ fn filesystem_scope_notice(app: &App) -> Option> { app.approval_mode, app.configured_sandbox_mode.as_deref(), &app.workspace, + &app.workspace_roots, crate::core::authority::SandboxNetworkAccess::from_config(app.configured_sandbox_network), ); // A policy is an intent; enforcement needs a backend. On default Linux diff --git a/docs/AUTHORIZATION_ORDER.md b/docs/AUTHORIZATION_ORDER.md index 5322de1f89..b8acc06eed 100644 --- a/docs/AUTHORIZATION_ORDER.md +++ b/docs/AUTHORIZATION_ORDER.md @@ -39,7 +39,14 @@ a hold that the layer actually produced. There is no project-local permission-rule source today. An optional `workspace` field scopes one user rule to a repository; it does not create a project overlay. `/permissions` reports that source, matcher, scope, and whether the -scope applies to the current workspace. +scope covers the current session. In a multi-root session the scope matches +the session's accessible root set by name; the action carried by that rule +stays primary-root-scoped, so a scoped `allow` never auto-approves a write +under an attached root — one exception, inherited from the single-root base: +a rule spelling an ABSOLUTE path falls back to matching the call's original +spelling exactly, root-independently, so such a rule can approve a write +under an attached root — while scoped `ask`/`deny` reach every attached root +(the same narrowing the execution-policy engine applies). The execution-policy engine evaluates matching rules as follows: diff --git a/docs/RUNTIME_API.md b/docs/RUNTIME_API.md index 8cd938e7e2..acc319b48b 100644 --- a/docs/RUNTIME_API.md +++ b/docs/RUNTIME_API.md @@ -521,6 +521,11 @@ a TLS or verified transport boundary. - `GET /v1/sessions/summary?…` (same query params; projected row shape) - `GET /v1/sessions/{id}` (add `?peek=true&entries=12` for a bounded, redacted read-only peek instead of the full transcript) +- `POST /v1/sessions` (`{ "thread_id": string, "title"?: string }` — save a + thread's stored turns as a new session) +- `PUT /v1/sessions` (`{ "thread_id"?: string, "session_id"?: string }` — + snapshot a thread's live engine state; a `session_id` overwrites that + session in place) - `PATCH /v1/sessions/{id}` (`{ "title"?: string, "archived"?: bool }`) - `DELETE /v1/sessions/{id}` - `POST /v1/sessions/{id}/resume-thread` @@ -560,9 +565,12 @@ archive notion. While a session is open in an interactive Codewhale process, that process holds the authoritative copy in memory and rewrites the whole document on its next -autosave. `PATCH` therefore fails closed on it with `409 Conflict` rather than -writing something that would be silently reverted. Change it in the terminal -instead. A standalone `codewhale web` holds nothing open and is never blocked. +autosave. **Retracted (round-20 B20-3):** the `409 Conflict` guard on +`PATCH` and `PUT /v1/sessions` was removed — the process-local live-session +registry cannot coexist with the runtime HTTP server in any shipped +topology, so the conflict was unobservable and the guard is gone. Same- +process writers converge by last-write-wins at the store layer; change a +session open in the terminal from the terminal. `GET /v1/sessions/{id}?peek=true` returns a bounded, redacted, read-only view instead of the transcript: at most 12 entries of at most 400 characters each @@ -590,10 +598,44 @@ provider, model, workspace, and permission fields: "model_provider": "openai-codex", "model": "gpt-5.6", "reasoning_effort": "high", - "allowed_tools": ["read_file", "search"] + "allowed_tools": ["read_file", "search"], + "workspace_roots": ["/Users/you/projects/codewhale", "/Users/you/projects/shared"] } ``` +`workspace_roots` (added by the multi-root workspace theme) declares the +thread's full accessible root set: the first entry is the primary root (the +thread's `workspace`) and the rest are attached roots whose writes the +thread's sandbox policy, write carve-out, and repo law also govern. One +server-side substitution qualifies "first entry": when the request omits +`workspace`, the server fills in its own workspace, which takes the primary +slot and demotes the client-sent first entry to an attached root. Omitting +the field yields the historical single-root thread: the stored set is +`[workspace]`, serialized as a one-element array (see the ThreadRecord note +under "Runtime data model"). `PATCH +/v1/threads/{id}` accepts the same field to reshape a live thread (empty +array clears back to the bare workspace); a change while a turn is active is +rejected. `POST /v1/threads/{id}/fork` and `POST /v1/threads/{id}/resume` +take no request body: both always inherit the thread's stored set, and a +client posting `workspace_roots` to either gets plain inheritance — reshape +through `PATCH` instead. + +Resuming or forking a thread id that does not exist answers `404 Not Found` +(the stdio `thread/resume` / `thread/fork` methods answer the typed +`thread_not_found` error, `-32004`) instead of a success envelope carrying +`status: "missing"`, so a stale id no longer hides behind a 200. Declared +`workspace_roots` are validated at intake rather than silently reshaped: a +root that is not an absolute path (a `~/shared` spelling is refused, not +dropped), a root that normalizes to the filesystem root (`/`, `/..`), and a +root that is an ancestor of the primary workspace (its parent directory) +all answer `400 Bad Request` with the reason — each of those would widen +the per-turn sandbox past what the request declared. A root that sits under +the primary is accepted, and an explicit empty array still clears back to +the bare workspace. These rejection checks are **lexical** (round-20 +B20-4): enforcement canonicalizes per root, so a symlink spelling can carry +a lexically-sibling root past the ancestor rejection; canonicalize-at- +intake is the scheduled promotion. + `reasoning_effort` uses the canonical Runtime vocabulary (`auto`, `off`, `low`, `medium`, `high`, `xhigh`, `ultra`, or `max`; documented compatibility aliases are accepted and persisted canonically). `allowed_tools` is a @@ -1015,7 +1057,12 @@ The runtime uses a durable Thread/Turn/Item lifecycle. - **ThreadRecord** — `id`, `created_at`, `updated_at`, `model`, `model_provider` (generic kind), `model_provider_id` (optional exact configured - route), `workspace`, `mode`, `task_id`, `system_prompt`, `latest_turn_id`, + route), `workspace`, `workspace_roots` (the full accessible root set, + primary first; normalization always prepends the workspace, so a thread + created through `POST /v1/threads` serializes at least one element — a + single-root thread reads `"workspace_roots": [""]` — and only + rows persisted before the field existed omit the key entirely), `mode`, + `task_id`, `system_prompt`, `latest_turn_id`, `latest_response_bookmark`, `archived` - **TurnRecord** — `id`, `thread_id`, `status` (`queued|in_progress|completed| failed|interrupted|canceled`), `effective_provider`, `effective_model`, diff --git a/docs/SANDBOX.md b/docs/SANDBOX.md index 2aa216bd2b..f995ade7d6 100644 --- a/docs/SANDBOX.md +++ b/docs/SANDBOX.md @@ -77,8 +77,10 @@ read-only, applied last so they can narrow a policy-writable path) and directories are never honored). Missing paths are skipped silently. That gives the child a read-only root view. For `workspace-write`, every safe, -existing policy root is mounted read-write: the working directory, configured -additional roots, `/tmp` and `TMPDIR` unless excluded, and verified Git +existing policy root is mounted read-write: the working directory, the +session's configured additional roots (for a multi-root thread this is the +attached `workspace_roots` beside the primary workspace; for a single-root +thread none), `/tmp` and `TMPDIR` unless excluded, and verified Git worktree metadata roots. Existing `.codewhale` and `.deepseek` descendants are remounted read-only after their writable parent. Missing paths, non-directory paths, and `/` are not promoted to writable mounts. From 0d5602aa5a9e49db504bd7882485da92630c1a66 Mon Sep 17 00:00:00 2001 From: qiuYliangM <185303122+qiuYliangM@users.noreply.github.com> Date: Wed, 30 Sep 2026 12:03:15 +0800 Subject: [PATCH 02/10] fix(tui): resolve the restore boundary predicate through symlinks Round-24 B24-1: restore_covers_primary_only judged only the lexically normalized spellings, so an inward-symlink root (/ws/link -> /elsewhere) nested lexically while every consumer canonicalized it outside - its writes persisted past the primary-rooted restore with the boundary note withheld. The predicate now fires when either the lexical or the canonical-or-raw form of a root lands outside the primary (the ToolContext::boundary_roots idiom), and the round-23 doc comment no longer asserts symlink handling the code did not do. Pins: a real-symlink unit test (silent for a nested plain root and an inward-pointing link), and the HTTP restore-route leg the round-23 commit message claimed but never built. The response boundary object is now documented in docs/RUNTIME_API.md (companion commit). Signed-off-by: qiuYliangM <185303122+qiuYliangM@users.noreply.github.com> --- crates/tui/src/runtime_api/tests.rs | 38 +++++++++++++++++ crates/tui/src/snapshot/mod.rs | 65 ++++++++++++++++++++++++----- 2 files changed, 93 insertions(+), 10 deletions(-) diff --git a/crates/tui/src/runtime_api/tests.rs b/crates/tui/src/runtime_api/tests.rs index 5d34284372..1cde80e129 100644 --- a/crates/tui/src/runtime_api/tests.rs +++ b/crates/tui/src/runtime_api/tests.rs @@ -5282,6 +5282,44 @@ async fn restore_route_names_the_attached_roots_boundary_for_multi_root_threads( "a ..-spelled attached root must still fire the boundary: {body}" ); + // Round-24 B24-1: the symlink leg the round-23 commit message claimed + // but never built — an inward-symlink root (`ws3/link → elsewhere3`) + // lexically nests under `ws3` while the predicate's consumers resolve + // it outside, so the clause must fire through the canonical spelling. + #[cfg(unix)] + { + let symlink_workspace = workspace.join("ws3"); + fs::create_dir_all(&symlink_workspace)?; + let outside = workspace.join("elsewhere3"); + fs::create_dir_all(&outside)?; + std::os::unix::fs::symlink(&outside, symlink_workspace.join("link"))?; + let symlink_thread = runtime_threads + .create_thread(CreateThreadRequest { + workspace: Some(symlink_workspace.clone()), + workspace_roots: vec![symlink_workspace.join("link")], + ..CreateThreadRequest::default() + }) + .await?; + runtime_threads + .set_thread_session_id(&symlink_thread.id, "sess-symlink") + .await?; + let symlink_snap = repo.snapshot_with_session("pre-turn:4", Some("sess-symlink"))?; + let response = client + .post(format!( + "http://{addr}/v1/snapshots/{}/restore", + symlink_snap.0 + )) + .send() + .await?; + assert_eq!(response.status(), StatusCode::OK); + let body: serde_json::Value = response.json().await?; + assert_eq!( + body["boundary"]["attached_roots_not_reverted"], + json!(true), + "an inward-symlink attached root must fire the boundary: {body}" + ); + } + handle.abort(); Ok(()) } diff --git a/crates/tui/src/snapshot/mod.rs b/crates/tui/src/snapshot/mod.rs index 19b9878e13..0b12c887c9 100644 --- a/crates/tui/src/snapshot/mod.rs +++ b/crates/tui/src/snapshot/mod.rs @@ -73,27 +73,36 @@ pub const ATTACHED_ROOTS_NOT_REVERTED_NOTE: &str = /// with the primary — claiming they "were not rolled back" would tell the /// user the opposite of what happened. /// -/// Round-23 B23-1: BOTH sides are lexically normalized before the -/// containment comparison. Over the raw persisted spellings a `..`-spelled -/// root (`/ws/../shared`) or an inward-symlink root (`/ws/link → -/// /elsewhere`) component-wise "nests" under the primary while every -/// consumer canonicalizes it outside — writes there persist through the -/// primary-rooted restore, so withholding the note for those spellings was -/// fail-unsafe (and the previous doc asserted the opposite of the code). -/// Normalizing first fires the note for exactly the roots whose consumers -/// see them outside the primary; over-disclosing the boundary is the safe -/// side. +/// Round-23 B23-1 + round-24 B24-1: BOTH spellings of every side are judged. +/// The lexically normalized forms catch `..`-spelled roots (`/ws/../shared` +/// collapses outside the primary); the canonical-or-raw forms (the +/// `ToolContext::boundary_roots` idiom) catch inward-symlink roots +/// (`/ws/link → /elsewhere`) that lexically nest under the primary while +/// every consumer canonicalizes them outside — writes through such a root +/// persist past the primary-rooted restore, so withholding the note for +/// either class was fail-unsafe (and an earlier doc asserted the opposite +/// of the code). The clause fires when EITHER form lands outside the +/// primary; over-disclosing the boundary is the safe side. pub fn restore_covers_primary_only( workspace: &std::path::Path, workspace_roots: &[std::path::PathBuf], ) -> bool { let workspace_lexical = codewhale_core::normalize_path_lexically(workspace); + let workspace_canonical = codewhale_core::normalize_path_lexically( + &workspace + .canonicalize() + .unwrap_or_else(|_| workspace.to_path_buf()), + ); codewhale_core::normalize_workspace_roots(workspace, workspace_roots) .iter() .skip(1) .any(|root| { let root_lexical = codewhale_core::normalize_path_lexically(root); + let root_canonical = codewhale_core::normalize_path_lexically( + &root.canonicalize().unwrap_or_else(|_| root.clone()), + ); !root_lexical.starts_with(&workspace_lexical) + || !root_canonical.starts_with(&workspace_canonical) }) } #[allow(unused_imports)] @@ -140,4 +149,40 @@ mod tests { )); assert!(!restore_covers_primary_only(&workspace, &[])); } + + #[cfg(unix)] + #[test] + fn inward_symlink_root_fires_the_boundary_note() { + // Round-24 B24-1: lexical normalization cannot see through an inward + // symlink — `/ws/link → /elsewhere` lexically nests under `/ws` + // while every consumer canonicalizes it outside, so the + // lexical-only predicate withheld the boundary note while writes + // through the root persisted past the primary-rooted restore. The + // canonical leg (raw fallback for roots that do not resolve) must + // fire it; a genuinely nested plain root must stay silent. + let base = tempfile::tempdir().expect("tempdir"); + let workspace = base.path().join("ws"); + std::fs::create_dir_all(&workspace).expect("mkdir ws"); + let elsewhere = base.path().join("elsewhere"); + std::fs::create_dir_all(&elsewhere).expect("mkdir elsewhere"); + let link = workspace.join("link"); + std::os::unix::fs::symlink(&elsewhere, &link).expect("symlink"); + assert!( + restore_covers_primary_only(&workspace, &[link.clone()]), + "an inward-symlink root must fire the boundary note" + ); + // A plain root nested under the primary keeps the old behavior even + // though the primary itself now also canonicalizes. + assert!(!restore_covers_primary_only( + &workspace, + &[workspace.join("nested")] + )); + // A symlink INSIDE the primary pointing at a nested directory stays + // inside on both spellings — no note. + let nested = workspace.join("nested-real"); + std::fs::create_dir_all(&nested).expect("mkdir nested"); + let inner_link = workspace.join("inner-link"); + std::os::unix::fs::symlink(&nested, &inner_link).expect("symlink"); + assert!(!restore_covers_primary_only(&workspace, &[inner_link])); + } } From 3634b659071c2e283e34039afd8028fc59a53619 Mon Sep 17 00:00:00 2001 From: qiuYliangM <185303122+qiuYliangM@users.noreply.github.com> Date: Wed, 30 Sep 2026 12:03:15 +0800 Subject: [PATCH 03/10] fix(tui): fold apply_patch path aliases in the preflight summary Round-24 B24-2: execute folds PATH_ALIASES before reading the top-level path override, but every plan-time consumer of preflight_apply_patch (ask rules, the in-workspace write carve-out, auto-review, resource claims, the work-surface activity line) judged the raw input - a filePath/file_path-spelled override was invisible to all of them while execution honored it, so a patch with innocuous headers landed its write on the override target (e.g. .git/hooks/pre-commit, the carve-out's own named exclusion) past every plan-time gate. The preflight folds the same aliases with the same conflict semantics; folding is a no-op for the execute lane, which calls the plan fn directly. Pin: alias-spelled overrides surface as touched_files/path_override with a decoy header present, and alias/canonical disagreement fails exactly like execute time. Signed-off-by: qiuYliangM <185303122+qiuYliangM@users.noreply.github.com> --- crates/tui/src/tools/apply_patch.rs | 59 ++++++++++++++++++++++++++++- 1 file changed, 57 insertions(+), 2 deletions(-) diff --git a/crates/tui/src/tools/apply_patch.rs b/crates/tui/src/tools/apply_patch.rs index ecfb7c5397..0528a7c590 100644 --- a/crates/tui/src/tools/apply_patch.rs +++ b/crates/tui/src/tools/apply_patch.rs @@ -555,9 +555,23 @@ fn verify_patch_expected_hash( /// This deliberately stops before workspace resolution or file reads. It is /// suitable for policy checks, audit logs, diagnostics hooks, and future undo /// planning that must know the target files before mutation. +/// +/// The `path` alias spellings (`file_path`/`filePath`) are folded exactly +/// like `execute` folds them before reading the top-level override (review +/// #484/CodeWhale round-24 B24-2): every plan-time consumer of this summary +/// (ask rules, the in-workspace write carve-out, auto-review, resource +/// claims, the work-surface activity line) judges the RAW input, so an +/// alias-spelled override used to be invisible here while execution folded +/// it — the judged files and the written file could differ, and a patch +/// with innocuous headers plus a `filePath` override landed its write on +/// the override target past every plan-time gate. `execute` folds before +/// calling the plan fn directly, so folding again here is a no-op for that +/// lane; alias-conflict errors surface identically to execute time. pub fn preflight_apply_patch(input: &Value) -> Result { - let normalized = normalize_apply_patch_input(input)?; - Ok(preflight_apply_patch_plan(input, normalized)?.summary) + let mut folded = input.clone(); + apply_param_aliases(&mut folded, PATH_ALIASES, "apply_patch")?; + let normalized = normalize_apply_patch_input(&folded)?; + Ok(preflight_apply_patch_plan(&folded, normalized)?.summary) } fn preflight_apply_patch_plan( @@ -1679,6 +1693,47 @@ mod tests { assert_eq!(preflight.path_override.as_deref(), Some("src/lib.rs")); } + #[test] + fn test_preflight_apply_patch_folds_alias_path_override() { + // Round-24 B24-2: the alias-spelled top-level override is folded + // exactly like execute folds it, so the plan-time gates that judge + // raw input see the file the write will actually land on — with an + // innocuous patch header, the override (not the header) must be the + // preflight's touched file. + let patch = r"@@ -1,2 +1,2 @@ + old +-value ++new-value +"; + + for alias in ["file_path", "filePath"] { + let preflight = preflight_apply_patch(&json!({ + alias: ".git/hooks/pre-commit", + "patch": patch, + // A decoy header must not become the judged target. + })) + .expect("preflight"); + assert_eq!( + preflight.touched_files, + vec![".git/hooks/pre-commit"], + "alias `{alias}` override must be visible to preflight" + ); + assert_eq!( + preflight.path_override.as_deref(), + Some(".git/hooks/pre-commit") + ); + } + + // Conflicting alias + canonical spellings fail exactly like + // execute time, instead of silently judging one of them. + let conflict = preflight_apply_patch(&json!({ + "path": "a.rs", + "filePath": "b.rs", + "patch": patch, + })); + assert!(conflict.is_err(), "alias/canonical disagreement must fail"); + } + #[test] fn test_preflight_apply_patch_multi_file_create_and_delete() { let patch = r"diff --git a/new.rs b/new.rs From c4fec8fd0d9f5f63e77d993ba060fca0abb5af41 Mon Sep 17 00:00:00 2001 From: qiuYliangM <185303122+qiuYliangM@users.noreply.github.com> Date: Wed, 30 Sep 2026 12:03:37 +0800 Subject: [PATCH 04/10] fix(core): validate the /tool roots intake and cap the normalizer Round-24 B24-3/B24-4: Runtime::invoke_tool was the one declared-roots intake with no validator in front of it - take(64) silently truncated an over-cap declaration, and / (or a primary-ancestor root) reached the policy context; the cwd slot accepted the null -> current_dir() -> "." fallback spelling. The lane now rejects a non-absolute or empty cwd outright and routes the declared set through validate_workspace_roots (admit it whole or reject it with an error); the app-server handler answers 400 with the reason for intake-validation failures instead of a server-fault 500. B24-4: the 64-entry cap moves into normalize_workspace_roots itself, so the load faces that consume sets which never passed an intake (resume resolution, engine init, Op::SyncSession, exec --resume, ACP session/load) can no longer turn a hand-edited unbounded row into a per-call O(n^2) stall. Earliest declared wins; a declaration that passed intake is never truncated (the intake cap and this cap count the same entries). Pins: cap truncation + intake/normalizer agreement at the cap, and the three rejection classes plus a full validated declaration at Runtime::invoke_tool. Signed-off-by: qiuYliangM <185303122+qiuYliangM@users.noreply.github.com> --- crates/app-server/src/lib.rs | 23 ++++- crates/core/src/lib.rs | 175 +++++++++++++++++++++++++++++++---- 2 files changed, 175 insertions(+), 23 deletions(-) diff --git a/crates/app-server/src/lib.rs b/crates/app-server/src/lib.rs index 1d378f2ed9..f73289fb93 100644 --- a/crates/app-server/src/lib.rs +++ b/crates/app-server/src/lib.rs @@ -776,10 +776,25 @@ async fn tool_handler( .await { Ok(value) => (StatusCode::OK, Json(value)), - Err(err) => ( - StatusCode::INTERNAL_SERVER_ERROR, - Json(json!({ "ok": false, "error": err.to_string() })), - ), + Err(err) => { + // The /tool face is a roots intake since round-24 B24-3, so an + // over-cap, filesystem-root, primary-ancestor, non-absolute, or + // empty/relative-cwd declaration is the caller's mistake: answer + // 400 with the reason, matching the sibling lane above, instead + // of misclassifying it as a server fault. + let status = if err + .downcast_ref::() + .is_some() + { + StatusCode::BAD_REQUEST + } else { + StatusCode::INTERNAL_SERVER_ERROR + }; + ( + status, + Json(json!({ "ok": false, "error": err.to_string() })), + ) + } } } diff --git a/crates/core/src/lib.rs b/crates/core/src/lib.rs index f459a91c1c..807713c648 100644 --- a/crates/core/src/lib.rs +++ b/crates/core/src/lib.rs @@ -96,12 +96,26 @@ pub enum InitialHistory { /// rather than failing the whole load. Intake surfaces that receive a /// caller-declared set route through [`validate_workspace_roots`] instead, /// which rejects rather than drops. +/// +/// The additional entries are capped at [`MAX_WORKSPACE_ROOTS`], earliest +/// declared wins (review #484/CodeWhale round-24 B24-4). Validating intakes +/// reject an over-cap declaration with an error, but the load faces (the +/// state reader's resume resolution, engine init, `Op::SyncSession`, +/// `exec --resume`, ACP `session/load`) consume sets that never passed one — +/// an unbounded hand-edited row turned every write-tool call into O(n²) dedup +/// plus per-root canonicalization, a permanent stall the cap exists to bound. +/// A declaration that passed intake can never be truncated here: the intake +/// cap counts declared roots and this cap counts the same entries, so a +/// full 64-root declaration survives whole behind the primary. pub fn normalize_workspace_roots(cwd: &Path, roots: &[PathBuf]) -> Vec { if cwd.as_os_str().is_empty() || !cwd.is_absolute() { return Vec::new(); } let mut normalized = vec![cwd.to_path_buf()]; for root in roots { + if normalized.len() > MAX_WORKSPACE_ROOTS { + break; + } if root.as_os_str().is_empty() || !root.is_absolute() { continue; } @@ -1736,6 +1750,15 @@ impl Runtime { } /// Evaluates execution policy and dispatches a tool call. + /// + /// This lane is a roots intake like any other (review #484/CodeWhale + /// round-24 B24-3): a caller-declared set is admitted whole or rejected + /// with an error, never silently reshaped — the old `take(64)` + /// truncated the tail, and `/` or a primary-ancestor root reached the + /// policy context unvalidated. The cwd slot gets the same doctrine: the + /// `null → current_dir() → "."` fallback chain upstream can hand a + /// relative or empty spelling here, and a relative workspace cannot + /// head a root set. pub async fn invoke_tool( &self, call: ToolCall, @@ -1743,6 +1766,13 @@ impl Runtime { cwd: &Path, workspace_roots: &[PathBuf], ) -> Result { + if cwd.as_os_str().is_empty() || !cwd.is_absolute() { + return Err(anyhow::anyhow!( + "invoke_tool workspace slot must be an absolute directory; \ + got an empty or relative cwd" + )); + } + let workspace_roots = validate_workspace_roots(cwd, workspace_roots)?; let fallback_cwd = cwd.display().to_string(); let (command, raw_policy_cwd, execution_kind) = call.execution_subject(&fallback_cwd); // Judge the same effective cwd execution resolves (review @@ -1767,25 +1797,13 @@ impl Runtime { path: policy_path.as_deref(), ask_for_approval: approval_mode, sandbox_mode: None, - // The caller supplies the session's root set (hint map on the - // app-server bridge); an empty slice keeps the byte-identical - // single-root posture for callers that have none. The declared - // set is the only roots intake with no validator in front of it, - // so it at least goes through the shape normalizer the engine - // lane applies — empty/relative entries dropped, primary - // prepended, deduped — instead of reaching the policy raw, and - // is capped like a validating intake: an unbounded declaration - // here is an O(n²) dedup per tool call, client-repeatable - // (round-23 SF23-2). - workspace_roots: normalize_workspace_roots( - cwd, - workspace_roots - .iter() - .take(MAX_WORKSPACE_ROOTS) - .cloned() - .collect::>() - .as_slice(), - ), + // Validated intake (round-24 B24-3): over-cap, filesystem-root, + // primary-ancestor, and non-absolute declarations are rejected + // with an error before any policy work; the surviving set comes + // back normalized — primary prepended, deduped, capped exactly + // like every other consumer. An empty slice still keeps the + // byte-identical single-root posture for callers that have none. + workspace_roots, })?; let precheck = policy_precheck_payload(&decision, &command, &policy_cwd, execution_kind); let response_id = format!("tool-{}", Uuid::new_v4()); @@ -3865,6 +3883,50 @@ mod tests { assert!(normalize_workspace_roots(Path::new("relative/dir"), &[]).is_empty()); } + #[test] + fn normalize_workspace_roots_caps_additional_entries_earliest_declared_wins() { + // Round-24 B24-4: the load faces consume sets that never passed an + // intake, so the shape normalizer itself must bound them — an + // unbounded hand-edited row made every write-tool call an O(n²) + // dedup plus per-root canonicalization. + let cwd = Path::new("/repo/main"); + let roots: Vec = (0..MAX_WORKSPACE_ROOTS + 10) + .map(|index| PathBuf::from(format!("/repo/r{index}"))) + .collect(); + let normalized = normalize_workspace_roots(cwd, &roots); + assert_eq!( + normalized.len(), + MAX_WORKSPACE_ROOTS + 1, + "the primary plus at most MAX_WORKSPACE_ROOTS additional entries survive" + ); + assert_eq!(normalized[0], cwd.to_path_buf()); + assert_eq!(normalized[1], PathBuf::from("/repo/r0")); + assert_eq!( + normalized[MAX_WORKSPACE_ROOTS], + PathBuf::from(format!("/repo/r{}", MAX_WORKSPACE_ROOTS - 1)), + "earliest declared wins; the tail past the cap is dropped" + ); + } + + #[test] + fn a_full_validated_declaration_is_never_truncated_by_the_normalizer() { + // Round-24 B24-4: the intake cap counts declared roots, the + // normalizer cap counts the same entries — a declaration that + // passed intake must survive the shape normalizer byte-identical. + let cwd = Path::new("/repo/main"); + let roots: Vec = (0..MAX_WORKSPACE_ROOTS) + .map(|index| PathBuf::from(format!("/repo/r{index}"))) + .collect(); + let validated = validate_workspace_roots(cwd, &roots) + .expect("a full MAX_WORKSPACE_ROOTS declaration is admitted whole"); + assert_eq!(validated.len(), MAX_WORKSPACE_ROOTS + 1); + assert_eq!( + normalize_workspace_roots(cwd, &roots), + validated, + "the intake's returned set and the raw normalizer must agree at the cap" + ); + } + #[test] fn spawn_thread_rejects_a_non_absolute_root_instead_of_dropping_it() { // Regression pin, round-17: an empty-string root accepted at intake @@ -4733,6 +4795,81 @@ mod tests { assert_eq!(result["status"], "approval_required", "{result}"); } + #[tokio::test] + async fn invoke_tool_rejects_degenerate_root_intake_declarations() { + // Round-24 B24-3: this face was the one roots intake with no + // validator in front of it — an over-cap declaration was silently + // truncated and `/` (or a primary ancestor) reached the policy + // context; a relative cwd slot fell back to the process directory + // spelling. All three classes now fail loud before any policy work. + let runtime = runtime_with_exec_rules(vec![]); + let workspace = tempfile::tempdir().expect("tempdir"); + let cwd = workspace.path().join("ws"); + std::fs::create_dir_all(&cwd).expect("workspace dir"); + let cwd = cwd.canonicalize().expect("canonical cwd"); + + let err = runtime + .invoke_tool( + local_shell_call("echo hi", None), + AskForApproval::Never, + Path::new("."), + &[], + ) + .await + .expect_err("a relative cwd slot must be rejected"); + assert!( + err.to_string().contains("absolute"), + "the rejection names the absolute-cwd requirement: {err}" + ); + + let err = runtime + .invoke_tool( + local_shell_call("echo hi", None), + AskForApproval::Never, + &cwd, + &[PathBuf::from("/")], + ) + .await + .expect_err("a filesystem-root declaration must be rejected"); + assert!( + err.to_string().contains("filesystem"), + "the rejection names the filesystem-root hazard: {err}" + ); + + let over_cap: Vec = (0..MAX_WORKSPACE_ROOTS + 1) + .map(|index| cwd.join(format!("r{index}"))) + .collect(); + let err = runtime + .invoke_tool( + local_shell_call("echo hi", None), + AskForApproval::Never, + &cwd, + &over_cap, + ) + .await + .expect_err("an over-cap declaration must be rejected"); + assert!( + err.to_string().contains("cap"), + "the rejection names the intake cap: {err}" + ); + + // A full validated declaration survives: the same set at exactly + // the cap goes through and reaches the ordinary approval gate. + let at_cap: Vec = (0..MAX_WORKSPACE_ROOTS) + .map(|index| cwd.join(format!("r{index}"))) + .collect(); + let result = runtime + .invoke_tool( + local_shell_call("echo hi", None), + AskForApproval::OnRequest, + &cwd, + &at_cap, + ) + .await + .expect("a full validated declaration is admitted whole"); + assert_eq!(result["status"], "approval_required", "{result}"); + } + #[cfg(unix)] #[tokio::test] async fn invoke_tool_judges_a_symlink_spelled_operand_like_execution() { From 69e3a41614eb2221e36bfe679aac85b6b5fff0c0 Mon Sep 17 00:00:00 2001 From: qiuYliangM <185303122+qiuYliangM@users.noreply.github.com> Date: Wed, 30 Sep 2026 12:03:37 +0800 Subject: [PATCH 05/10] perf(tui): hoist repo-law per-root input work and cache constitutions Round-24 B24-5: the repo-law gate re-derived root-independent work inside the per-root loop on every write-tool call - the landing candidate, both deepest-existing resolutions, and the patch parse are byte-identical across roots, and load_repo_law_rules re-read, re-parsed, and re-compiled the constitution globset once per root per call (a 64-root session paid ~190+ realpath syscalls and 64 constitution compiles for one write judgment; base loads once with zero fs calls). The input-derived resolution now happens once per call, and the compile is cached per constitution file revalidated by (mtime, size); the upward discovery walk stays uncached so a constitution created at a nearer directory is still found. Target sets are unchanged (sorted and deduped as before). Pins: the existing repo-law suite (bypass vectors included) passes unchanged against the restructured judgment. Signed-off-by: qiuYliangM <185303122+qiuYliangM@users.noreply.github.com> --- .../tui/src/project_context/constitution.rs | 80 +++++++-- crates/tui/src/repo_law.rs | 166 +++++++++++------- 2 files changed, 173 insertions(+), 73 deletions(-) diff --git a/crates/tui/src/project_context/constitution.rs b/crates/tui/src/project_context/constitution.rs index 3649ad786d..fad2972c28 100644 --- a/crates/tui/src/project_context/constitution.rs +++ b/crates/tui/src/project_context/constitution.rs @@ -97,10 +97,65 @@ pub(crate) struct RepoLawRule { /// degrades to fewer (or zero) rules: enforcement can silently do less, /// never more, and never poisons the tool gate. Parse warnings still reach /// the user through the prompt-side load path, which reads the same file. -pub(crate) fn load_repo_law_rules(workspace: &Path) -> Vec { - let Some((_, constitution)) = discover_repo_constitution(workspace) else { - return Vec::new(); +/// +/// The read+parse+globset compile is cached per constitution file and +/// revalidated by (mtime, size) on every call (review #484/CodeWhale +/// round-24 B24-5): the repo-law gate runs on every write-tool call, and a +/// 64-root session re-walking git roots and recompiling the same +/// constitution once per root per call converted the gate into a hot loop. +/// The upward discovery walk itself stays uncached so a constitution +/// created at a nearer directory is found on the next call; only the +/// compile of an already-resolved file is memoized. +pub(crate) fn load_repo_law_rules(workspace: &Path) -> std::sync::Arc> { + static CACHE: std::sync::OnceLock< + std::sync::Mutex>, + > = std::sync::OnceLock::new(); + let Some(path) = discover_repo_constitution_path(workspace) else { + return std::sync::Arc::new(Vec::new()); }; + let Ok(metadata) = std::fs::metadata(&path) else { + return std::sync::Arc::new(Vec::new()); + }; + let modified = metadata + .modified() + .unwrap_or(std::time::SystemTime::UNIX_EPOCH); + let len = metadata.len(); + let cache = CACHE.get_or_init(|| std::sync::Mutex::new(std::collections::HashMap::new())); + let mut guard = cache + .lock() + .unwrap_or_else(std::sync::PoisonError::into_inner); + if let Some(hit) = guard.get(&path) + && hit.modified == modified + && hit.len == len + { + return std::sync::Arc::clone(&hit.rules); + } + let rules = std::sync::Arc::new( + read_repo_constitution(&path) + .map(compile_repo_law_rules) + .unwrap_or_default(), + ); + guard.insert( + path, + CachedRepoLawRules { + modified, + len, + rules: std::sync::Arc::clone(&rules), + }, + ); + rules +} + +struct CachedRepoLawRules { + modified: std::time::SystemTime, + len: u64, + rules: std::sync::Arc>, +} + +/// Compile the enforceable rules from an already-parsed constitution: text +/// and path globs are trimmed, empty or uncompilable entries degrade to +/// fewer rules, and only entries carrying usable globs become holds. +fn compile_repo_law_rules(constitution: RepoConstitution) -> Vec { let mut rules = Vec::new(); for invariant in constitution.protected_invariants.into_iter().flatten() { let ProtectedInvariant::Enforced(enforced) = invariant else { @@ -138,9 +193,9 @@ pub(crate) fn load_repo_law_rules(workspace: &Path) -> Vec { } /// Walk from `workspace` toward the git root looking for the repo -/// constitution; parse best-effort. Shared by the enforcement loader; the -/// prompt-side loader keeps its richer warning handling. -fn discover_repo_constitution(workspace: &Path) -> Option<(PathBuf, RepoConstitution)> { +/// constitution; existence-only, no read. The enforcement loader caches the +/// compile behind the returned path. +fn discover_repo_constitution_path(workspace: &Path) -> Option { let git_root = find_git_root(workspace); let mut current = workspace.to_path_buf(); loop { @@ -149,10 +204,7 @@ fn discover_repo_constitution(workspace: &Path) -> Option<(PathBuf, RepoConstitu path.push(component); } if context_candidate_exists(&path) { - let constitution = load_context_file(&path) - .ok() - .and_then(|raw| serde_json::from_str::(&raw).ok())?; - return Some((path, constitution)); + return Some(path); } if let Some(ref root) = git_root && current == *root @@ -167,6 +219,14 @@ fn discover_repo_constitution(workspace: &Path) -> Option<(PathBuf, RepoConstitu None } +/// Read and parse the repo constitution at `path`, best-effort: any read or +/// parse failure degrades to None, exactly like the old inline walk. +fn read_repo_constitution(path: &Path) -> Option { + load_context_file(path) + .ok() + .and_then(|raw| serde_json::from_str::(&raw).ok()) +} + impl RepoConstitution { /// True when the file carried no usable policy (so we can skip emitting an /// empty block). diff --git a/crates/tui/src/repo_law.rs b/crates/tui/src/repo_law.rs index e95c7f3721..dee4ed84f2 100644 --- a/crates/tui/src/repo_law.rs +++ b/crates/tui/src/repo_law.rs @@ -75,6 +75,16 @@ pub(crate) fn repo_law_plan_decision( // Strongest action wins across all (root, rule, target) matches. The // reason is built where the match is found so the borrow does not have to // outlive the per-root rule set. + // Root-independent input work happens ONCE (review #484/CodeWhale + // round-24 B24-5): the landing candidates and their deepest-existing + // resolutions are byte-identical for every root, and the patch parse + // does not depend on the root set at all — re-deriving them inside the + // loop made a 64-root session re-walk symlink chains and re-resolve + // constitutions on every write-tool call. + let candidates = collect_write_candidates(workspace, tool_input); + if candidates.is_empty() { + return None; + } let mut hold: Option<(bool, String)> = None; for root in codewhale_core::normalize_workspace_roots(workspace, workspace_roots) { // Canonicalize once per root with a raw fallback (the @@ -82,12 +92,12 @@ pub(crate) fn repo_law_plan_decision( // still judges raw spellings, so its constitution is never silently // dropped. let root_canonical = root.canonicalize().unwrap_or_else(|_| root.clone()); - let targets = write_target_paths(workspace, &root, &root_canonical, tool_input); + let targets = write_target_paths(&candidates, &root, &root_canonical); if targets.is_empty() { continue; } let rules = load_repo_law_rules(&root); - for rule in &rules { + for rule in rules.iter() { for target in &targets { if !rule.globs.is_match(target) { continue; @@ -115,7 +125,28 @@ pub(crate) fn repo_law_plan_decision( }) } -/// Extract workspace-relative write targets from a tool input. Covers the +/// One collected write target from the tool input, prepared once per call. +/// Every field is root-independent, so the per-root loop only does +/// containment strips (review #484/CodeWhale round-24 B24-5 — the old shape +/// re-derived the landing candidate and re-resolved it through +/// `resolve_deepest_existing` once per root, over byte-identical inputs). +struct WriteCandidate { + /// The trimmed, backslash-normalized spelling the tool supplied. + trimmed: String, + /// `raw_joined` lexically collapsed exactly like the landing normalizer: + /// the raw spelling joined onto the primary (relative targets) or + /// as-given (absolute), before any collapse. + candidate: PathBuf, + /// `candidate` resolved through its deepest existing ancestor, once. + candidate_resolved: Option, + /// The PRE-normalization raw candidate resolved through its deepest + /// existing ancestor, once — the symlink-expanded reality execution + /// walks (round-22 B22-1 leg). + raw_resolved: Option, +} + +/// Collect every write spelling a tool input carries, with the +/// root-independent resolution work done once. Covers the /// `path`/`filePath`/`target`/`destination`/`file_path` params, canonical /// `replace[].path`, legacy `changes[].path`, and /// every unified-diff / codex-envelope header shape the patch tools accept — @@ -123,17 +154,8 @@ pub(crate) fn repo_law_plan_decision( /// tab-timestamp suffixes stripped, and `/dev/null` (deletion) falling back /// to the counterpart path. Missing any shape the tool honors is a hold /// bypass, so this deliberately over-collects candidate paths. -/// -/// `workspace` is the primary root (what execution resolves relative targets -/// against); `root` is the root whose law is being judged, with -/// `root_canonical` its resolved spelling. -fn write_target_paths( - workspace: &Path, - root: &Path, - root_canonical: &Path, - input: &Value, -) -> Vec { - let mut targets = Vec::new(); +fn collect_write_candidates(workspace: &Path, input: &Value) -> Vec { + let mut spellings: Vec = Vec::new(); // `filePath`/`file_path` are the spellings `PATH_ALIASES` folds onto // `path` at execute time (`tools/file.rs`); the default `ToolSpec:: // prepare` passes input through unchanged, so plan-time judgment must @@ -153,14 +175,14 @@ fn write_target_paths( keys.extend(alias_keys); for key in &keys { if let Some(path) = input.get(key).and_then(Value::as_str) { - push_normalized(&mut targets, workspace, root, root_canonical, path); + spellings.push(path.to_string()); } } match normalize_apply_patch_input(input) { Ok(NormalizedApplyPatchInput::Replacement { entries, .. }) => { for change in entries { if let Some(path) = change.get("path").and_then(Value::as_str) { - push_normalized(&mut targets, workspace, root, root_canonical, path); + spellings.push(path.to_string()); } } } @@ -168,37 +190,25 @@ fn write_target_paths( let mut pending_old: Option = None; for line in patch.lines() { if let Some(rest) = line.strip_prefix("*** Update File: ") { - push_normalized(&mut targets, workspace, root, root_canonical, rest.trim()); + spellings.push(rest.trim().to_string()); } else if let Some(rest) = line.strip_prefix("*** Add File: ") { - push_normalized(&mut targets, workspace, root, root_canonical, rest.trim()); + spellings.push(rest.trim().to_string()); } else if let Some(rest) = line.strip_prefix("*** Delete File: ") { - push_normalized(&mut targets, workspace, root, root_canonical, rest.trim()); + spellings.push(rest.trim().to_string()); } else if let Some(rest) = line.strip_prefix("--- ") { // Old path: remember it so a `+++ /dev/null` deletion still // holds the file being removed. pending_old = diff_header_path(rest); if let Some(ref p) = pending_old { - push_normalized(&mut targets, workspace, root, root_canonical, p); + spellings.push(p.clone()); } } else if let Some(rest) = line.strip_prefix("+++ ") { match diff_header_path(rest) { - Some(new_path) => push_normalized( - &mut targets, - workspace, - root, - root_canonical, - &new_path, - ), + Some(new_path) => spellings.push(new_path), // `+++ /dev/null` → deletion; the target is the old path. None => { if let Some(old) = pending_old.take() { - push_normalized( - &mut targets, - workspace, - root, - root_canonical, - &old, - ); + spellings.push(old); } } } @@ -207,6 +217,46 @@ fn write_target_paths( } Err(_) => {} } + spellings.sort(); + spellings.dedup(); + spellings + .into_iter() + .filter_map(|raw| { + let trimmed = raw.trim().replace('\\', "/"); + if trimmed.is_empty() { + return None; + } + let raw_path = Path::new(&raw); + let raw_joined = if raw_path.is_absolute() { + raw_path.to_path_buf() + } else { + workspace.join(raw_path) + }; + let candidate = normalize_lexical_components(&raw_joined); + let candidate_resolved = crate::core::authority::resolve_deepest_existing(&candidate); + let raw_resolved = crate::core::authority::resolve_deepest_existing(&raw_joined); + Some(WriteCandidate { + trimmed, + candidate, + candidate_resolved, + raw_resolved, + }) + }) + .collect() +} + +/// Root-relative glob targets for one root, from the pre-resolved +/// candidates. Sorted and deduped: the rule loop below matches a set, and +/// the hold reason cites a match, not an order. +fn write_target_paths( + candidates: &[WriteCandidate], + root: &Path, + root_canonical: &Path, +) -> Vec { + let mut targets = Vec::new(); + for candidate in candidates { + push_normalized(&mut targets, candidate, root, root_canonical); + } targets.sort(); targets.dedup(); targets @@ -234,11 +284,15 @@ fn diff_header_path(rest: &str) -> Option { /// `x/../crates/protocol/x` cannot spell its way past a glob (a confirmed /// bypass before this). /// -/// `workspace` (primary) and `root` (the law being judged) differ for -/// multi-root sessions. A relative spelling is judged against every root — -/// keep the raw collapsed tail per root, so an attached root's law can hold -/// a write that execution would place under the primary (fail-closed: an -/// extra prompt or block at worst). +/// `root` is the root whose law is being judged, with `root_canonical` its +/// resolved spelling; the candidate's root-independent resolution work was +/// already done once in [`collect_write_candidates`] +/// (review #484/CodeWhale round-24 B24-5). +/// +/// A relative spelling is judged against every root — keep the raw collapsed +/// tail per root, so an attached root's law can hold a write that execution +/// would place under the primary (fail-closed: an extra prompt or block at +/// worst). /// /// Spelling alone is not enough, because execution resolves writes /// canonically: `ToolContext::resolve_path` joins a relative spelling onto @@ -253,19 +307,14 @@ fn diff_header_path(rest: &str) -> Option { /// never fired — a block-class law bypass. fn push_normalized( targets: &mut Vec, - workspace: &Path, + candidate: &WriteCandidate, root: &Path, root_canonical: &Path, - raw: &str, ) { - let trimmed = raw.trim().replace('\\', "/"); - if trimmed.is_empty() { - return; - } // Make root-relative when the tool gave an absolute path inside the root, // under either its raw or its canonical spelling (a root reached through // a symlink still carries its law). - let path = Path::new(&trimmed); + let path = Path::new(&candidate.trimmed); let relative = path .strip_prefix(root) .or_else(|_| path.strip_prefix(root_canonical)) @@ -293,23 +342,14 @@ fn push_normalized( } // Judge the execution-landing path against this root, under both its raw // and its canonical spelling. Execution joins the *raw* spelling onto the - // primary (`ToolContext::resolve_path`), so derive the candidate from the - // raw string with component operations — splitting display strings is not - // a path operation and silently misparses Windows separators. - let raw_path = Path::new(raw); - let raw_joined = if raw_path.is_absolute() { - raw_path.to_path_buf() - } else { - workspace.join(raw_path) - }; - // The normalizer clamps a `..` at the filesystem root exactly like - // execution, so an overshoot spelling still yields the landing path the - // write tools would admit — judging it is what closes the overshoot - // bypass into an attached root. - let candidate = normalize_lexical_components(&raw_joined); + // primary (`ToolContext::resolve_path`), so the candidate was derived + // from the raw string with component operations — splitting display + // strings is not a path operation and silently misparses Windows + // separators. if let Ok(tail) = candidate + .candidate .strip_prefix(root) - .or_else(|_| candidate.strip_prefix(root_canonical)) + .or_else(|_| candidate.candidate.strip_prefix(root_canonical)) { let tail = tail.to_string_lossy().replace('\\', "/"); if !tail.is_empty() { @@ -320,7 +360,7 @@ fn push_normalized( // judge the resolved path against the canonical root, so an interior // symlink hop into this root (or a root reached through one) cannot // spell its way past the law. - if let Some(resolved) = crate::core::authority::resolve_deepest_existing(&candidate) + if let Some(resolved) = &candidate.candidate_resolved && let Ok(tail) = resolved.strip_prefix(root_canonical) { let tail = tail.to_string_lossy().replace('\\', "/"); @@ -337,7 +377,7 @@ fn push_normalized( // Resolving the raw joined candidate walks the same symlink-expanded // reality execution walks; the already-normalized leg above stays so // the overshoot-clamp behavior is judged both ways. - if let Some(resolved) = crate::core::authority::resolve_deepest_existing(&raw_joined) + if let Some(resolved) = &candidate.raw_resolved && let Ok(tail) = resolved.strip_prefix(root_canonical) { let tail = tail.to_string_lossy().replace('\\', "/"); From dee19f9a1da8ec67e3fb320241e7f97c24a7d826 Mon Sep 17 00:00:00 2001 From: qiuYliangM <185303122+qiuYliangM@users.noreply.github.com> Date: Wed, 30 Sep 2026 12:03:37 +0800 Subject: [PATCH 06/10] fix(tui): rename the /cd guidance and correct the change records Round-24 B24-6/B24-7/B24-8: the localized busy receipt in all 15 language packs told users to retry /cd, a command that does not exist (the TUI command is /workspace, alias /cwd); CHANGELOG attributed the deny-rule trim removal to session_diagnostics, a module this branch never touches, instead of the plan-time operand collector (path_param_value) its consumers actually read; and RUNTIME_API.md overstated the ThreadRecord key-omission condition (serde skips the key for every empty normalized set, not only pre-field rows) and documented the snapshot restore response as bare {"restored": id} without the conditional boundary object. The stale /cd line in the CHANGELOG behavior list is corrected by the same commit. Rust doc comments keep the /cd shorthand this branch's review history uses for the workspace-switch lane. Signed-off-by: qiuYliangM <185303122+qiuYliangM@users.noreply.github.com> --- CHANGELOG.md | 12 ++++++++---- crates/tui/locales/ca.json | 2 +- crates/tui/locales/de.json | 2 +- crates/tui/locales/en.json | 2 +- crates/tui/locales/es-419.json | 2 +- crates/tui/locales/fr.json | 2 +- crates/tui/locales/hi.json | 2 +- crates/tui/locales/id.json | 2 +- crates/tui/locales/ja.json | 2 +- crates/tui/locales/ko.json | 2 +- crates/tui/locales/pt-BR.json | 2 +- crates/tui/locales/ru.json | 2 +- crates/tui/locales/uk.json | 2 +- crates/tui/locales/vi.json | 2 +- crates/tui/locales/zh-Hans.json | 2 +- crates/tui/locales/zh-Hant.json | 2 +- docs/RUNTIME_API.md | 21 +++++++++++++++++++-- 17 files changed, 42 insertions(+), 21 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index dffbb9cbfa..22dec70331 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -84,7 +84,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 re-based root set with the same intake rules as a replacement, instead of re-anchoring it tolerantly (a persisted entry that becomes an ancestor of the new primary errors rather than widening the row). -- The `/cd` receipt for a moved-away directory changed severity from a +- The `/workspace` receipt for a moved-away directory changed severity from a passive notice to a typed warning, and its guard widened to every workspace swap lane. - The cached-resume path no longer bumps `archived_at` (the preserve arm @@ -101,9 +101,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - A worktree child session's exec lane no longer inherits the parent session's writable roots: the lane is re-derived at spawn and at resume from the child's own workspace. -- Session failure diagnostics collect candidate string fields verbatim: the - classifier no longer trims surrounding whitespace before matching (this - PR's change; base v0.9.12 carries the trim). +- Deny rules now match raw (untrimmed) collected values, narrowing what + they deny: the plan-time file-tool operand collector is + `path_param_value` (`tools/file.rs`; the round-22 replacement for + `engine.rs::string_field`), which returns the `path` parameter verbatim — + alias spellings included, surrounding whitespace never trimmed — and both + the ask/deny-rule matcher (`file_tool_permission_paths`) and Auto-Review + (`file_write_target_paths`) feed that operand to the policy checks. ### Removed diff --git a/crates/tui/locales/ca.json b/crates/tui/locales/ca.json index 54d15cc6e6..4ea1ed815e 100644 --- a/crates/tui/locales/ca.json +++ b/crates/tui/locales/ca.json @@ -1752,7 +1752,7 @@ "StatusLabelRoute": "Ruta", "StatusLabelDirectory": "Directori", "StatusLabelWorkspaceRoots": "Carpetes accessibles", - "WorkspaceSwitchBusy": "L'workspace no ha canviat (l'estat de treball o el runtime està ocupat; espera i torna a provar /cd)", + "WorkspaceSwitchBusy": "L'workspace no ha canviat (l'estat de treball o el runtime està ocupat; espera i torna a provar /workspace)", "WorkspaceSwitchPersistFailed": "Ha fallat la persistència del canvi d'workspace: {error}; l'actor de persistència tampoc no està disponible", "WorkspaceSwitchSaveFailedActorQueued": "El desat directe del canvi d'workspace ha fallat ({error}); l'actor de persistència conserva la instantània posterior al canvi", "WorkspaceSwitchPersistedActorUnavailable": "El canvi d'workspace s'ha desat, però l'actor de persistència no està disponible; el proper desat automàtic el torna a escriure", diff --git a/crates/tui/locales/de.json b/crates/tui/locales/de.json index cbd0e01ece..cab7ab3b81 100644 --- a/crates/tui/locales/de.json +++ b/crates/tui/locales/de.json @@ -1752,7 +1752,7 @@ "StatusLabelRoute": "Route", "StatusLabelDirectory": "Verzeichnis", "StatusLabelWorkspaceRoots": "Zugängliche Ordner", - "WorkspaceSwitchBusy": "Arbeitsbereich unverändert (Work-State oder Laufzeitarbeit beschäftigt; warten, dann /cd erneut versuchen)", + "WorkspaceSwitchBusy": "Arbeitsbereich unverändert (Work-State oder Laufzeitarbeit beschäftigt; warten, dann /workspace erneut versuchen)", "WorkspaceSwitchPersistFailed": "Das Persistieren des Arbeitsbereichswechsels ist fehlgeschlagen: {error}; der Persistenz-Aktor ist ebenfalls nicht verfügbar", "WorkspaceSwitchSaveFailedActorQueued": "Das direkte Speichern des Arbeitsbereichswechsels schlug fehl ({error}); der Persistenz-Aktor hält den Snapshot nach dem Wechsel", "WorkspaceSwitchPersistedActorUnavailable": "Der Arbeitsbereichswechsel wurde gespeichert, aber der Persistenz-Aktor ist nicht verfügbar; das nächste Autosave schreibt ihn erneut", diff --git a/crates/tui/locales/en.json b/crates/tui/locales/en.json index 454dcb4a35..7de3971a92 100644 --- a/crates/tui/locales/en.json +++ b/crates/tui/locales/en.json @@ -1752,7 +1752,7 @@ "StatusLabelRoute": "Route", "StatusLabelDirectory": "Directory", "StatusLabelWorkspaceRoots": "Accessible folders", - "WorkspaceSwitchBusy": "Workspace unchanged (Work state or runtime work busy; wait, then try /cd again)", + "WorkspaceSwitchBusy": "Workspace unchanged (Work state or runtime work busy; wait, then try /workspace again)", "WorkspaceSwitchPersistFailed": "Failed to persist workspace switch: {error}; the persistence actor is also unavailable", "WorkspaceSwitchSaveFailedActorQueued": "Direct workspace-switch save failed ({error}); the persistence actor holds the post-switch snapshot", "WorkspaceSwitchPersistedActorUnavailable": "Workspace switch persisted, but the persistence actor is unavailable; the next autosave re-persists it", diff --git a/crates/tui/locales/es-419.json b/crates/tui/locales/es-419.json index 649e9b3e02..9fc7739012 100644 --- a/crates/tui/locales/es-419.json +++ b/crates/tui/locales/es-419.json @@ -1752,7 +1752,7 @@ "StatusLabelRoute": "Ruta", "StatusLabelDirectory": "Directorio", "StatusLabelWorkspaceRoots": "Carpetas accesibles", - "WorkspaceSwitchBusy": "El workspace no cambió (el estado de Trabajo o la ejecución está ocupada; espera y vuelve a intentar /cd)", + "WorkspaceSwitchBusy": "El workspace no cambió (el estado de Trabajo o la ejecución está ocupada; espera y vuelve a intentar /workspace)", "WorkspaceSwitchPersistFailed": "Error al persistir el cambio de workspace: {error}; el actor de persistencia tampoco está disponible", "WorkspaceSwitchSaveFailedActorQueued": "El guardado directo del cambio de workspace falló ({error}); el actor de persistencia conserva el snapshot posterior al cambio", "WorkspaceSwitchPersistedActorUnavailable": "El cambio de workspace se guardó, pero el actor de persistencia no está disponible; el siguiente autoguardado lo vuelve a escribir", diff --git a/crates/tui/locales/fr.json b/crates/tui/locales/fr.json index 6ad8d51799..c922ee8c1c 100644 --- a/crates/tui/locales/fr.json +++ b/crates/tui/locales/fr.json @@ -1752,7 +1752,7 @@ "StatusLabelRoute": "Itinéraire", "StatusLabelDirectory": "Répertoire", "StatusLabelWorkspaceRoots": "Dossiers accessibles", - "WorkspaceSwitchBusy": "L'espace de travail est inchangé (état Work ou exécution occupée ; patientez, puis réessayez /cd)", + "WorkspaceSwitchBusy": "L'espace de travail est inchangé (état Work ou exécution occupée ; patientez, puis réessayez /workspace)", "WorkspaceSwitchPersistFailed": "Échec de la persistance du changement d'espace de travail : {error} ; l'acteur de persistance est également indisponible", "WorkspaceSwitchSaveFailedActorQueued": "L'enregistrement direct du changement d'espace de travail a échoué ({error}) ; l'acteur de persistance conserve l'instantané après le changement", "WorkspaceSwitchPersistedActorUnavailable": "Le changement d'espace de travail est enregistré, mais l'acteur de persistance est indisponible ; la prochaine sauvegarde automatique le réécrira", diff --git a/crates/tui/locales/hi.json b/crates/tui/locales/hi.json index 4e869df4cd..aefa18c037 100644 --- a/crates/tui/locales/hi.json +++ b/crates/tui/locales/hi.json @@ -1752,7 +1752,7 @@ "StatusLabelRoute": "रूट", "StatusLabelDirectory": "डायरेक्टरी", "StatusLabelWorkspaceRoots": "सुलभ फ़ोल्डर", - "WorkspaceSwitchBusy": "वर्कस्पेस अपरिवर्तित (कार्य स्थिति या रनटाइम कार्य व्यस्त है; प्रतीक्षा करें, फिर /cd दोबारा आज़माएँ)", + "WorkspaceSwitchBusy": "वर्कस्पेस अपरिवर्तित (कार्य स्थिति या रनटाइम कार्य व्यस्त है; प्रतीक्षा करें, फिर /workspace दोबारा आज़माएँ)", "WorkspaceSwitchPersistFailed": "वर्कस्पेस बदलना परसिस्ट करने में विफल: {error}; परसिस्टेंस एक्टर भी अनुपलब्ध है", "WorkspaceSwitchSaveFailedActorQueued": "वर्कस्पेस बदलने की सीधी सहेजगी विफल हुई ({error}); परसिस्टेंस एक्टर बदलाव के बाद का स्नैपशॉट रखता है", "WorkspaceSwitchPersistedActorUnavailable": "वर्कस्पेस बदलना सहेजा गया, परंतु परसिस्टेंस एक्टर अनुपलब्ध है; अगला ऑटोसेव इसे फिर से लिखेगा", diff --git a/crates/tui/locales/id.json b/crates/tui/locales/id.json index e6f9bdb30c..e6ec66f0fe 100644 --- a/crates/tui/locales/id.json +++ b/crates/tui/locales/id.json @@ -1752,7 +1752,7 @@ "StatusLabelRoute": "Rute", "StatusLabelDirectory": "Direktori", "StatusLabelWorkspaceRoots": "Folder yang dapat diakses", - "WorkspaceSwitchBusy": "Workspace tidak berubah (status Work atau pekerjaan runtime sibuk; tunggu, lalu coba /cd lagi)", + "WorkspaceSwitchBusy": "Workspace tidak berubah (status Work atau pekerjaan runtime sibuk; tunggu, lalu coba /workspace lagi)", "WorkspaceSwitchPersistFailed": "Gagal mempersistenkan perubahan workspace: {error}; actor persistensi juga tidak tersedia", "WorkspaceSwitchSaveFailedActorQueued": "Penyimpanan langsung perubahan workspace gagal ({error}); actor persistensi menyimpan snapshot setelah perubahan", "WorkspaceSwitchPersistedActorUnavailable": "Perubahan workspace disimpan, tetapi actor persistensi tidak tersedia; penyimpanan otomatis berikutnya akan menulisnya ulang", diff --git a/crates/tui/locales/ja.json b/crates/tui/locales/ja.json index e791b601fa..cf95cdafe7 100644 --- a/crates/tui/locales/ja.json +++ b/crates/tui/locales/ja.json @@ -1752,7 +1752,7 @@ "StatusLabelRoute": "経路", "StatusLabelDirectory": "ディレクトリ", "StatusLabelWorkspaceRoots": "アクセス可能なフォルダ", - "WorkspaceSwitchBusy": "ワークスペースは変更されていません（Work 状態またはランタイム処理が実行中です。待ってから /cd を再実行してください）", + "WorkspaceSwitchBusy": "ワークスペースは変更されていません（Work 状態またはランタイム処理が実行中です。待ってから /workspace を再実行してください）", "WorkspaceSwitchPersistFailed": "ワークスペース切り替えの永続化に失敗しました: {error}。永続化アクターも利用できません", "WorkspaceSwitchSaveFailedActorQueued": "ワークスペース切り替えの直接保存に失敗しました（{error}）。永続化アクターが切り替え後のスナップショットを保持しています", "WorkspaceSwitchPersistedActorUnavailable": "ワークスペース切り替えは保存されましたが、永続化アクターが利用できません。次の自動保存で再保存されます", diff --git a/crates/tui/locales/ko.json b/crates/tui/locales/ko.json index aeacb3a839..a9416690a4 100644 --- a/crates/tui/locales/ko.json +++ b/crates/tui/locales/ko.json @@ -1752,7 +1752,7 @@ "StatusLabelRoute": "경로", "StatusLabelDirectory": "디렉터리", "StatusLabelWorkspaceRoots": "접근 가능한 폴더", - "WorkspaceSwitchBusy": "워크스페이스가 변경되지 않았습니다 (작업 상태 또는 런타임 작업이 진행 중입니다. 잠시 후 /cd를 다시 시도하세요)", + "WorkspaceSwitchBusy": "워크스페이스가 변경되지 않았습니다 (작업 상태 또는 런타임 작업이 진행 중입니다. 잠시 후 /workspace를 다시 시도하세요)", "WorkspaceSwitchPersistFailed": "워크스페이스 전환 저장 실패: {error}; 퍼시스턴스 액터도 사용할 수 없습니다", "WorkspaceSwitchSaveFailedActorQueued": "워크스페이스 전환 직접 저장 실패({error}); 퍼시스턴스 액터가 전환 후 스냅샷을 보관합니다", "WorkspaceSwitchPersistedActorUnavailable": "워크스페이스 전환이 저장되었지만 퍼시스턴스 액터를 사용할 수 없습니다. 다음 자동 저장이 다시 기록합니다", diff --git a/crates/tui/locales/pt-BR.json b/crates/tui/locales/pt-BR.json index e66d65e716..12ae8c2318 100644 --- a/crates/tui/locales/pt-BR.json +++ b/crates/tui/locales/pt-BR.json @@ -1752,7 +1752,7 @@ "StatusLabelRoute": "Rota", "StatusLabelDirectory": "Diretório", "StatusLabelWorkspaceRoots": "Pastas acessíveis", - "WorkspaceSwitchBusy": "Workspace inalterado (estado de Trabalho ou execução ativa ocupada; aguarde e tente /cd novamente)", + "WorkspaceSwitchBusy": "Workspace inalterado (estado de Trabalho ou execução ativa ocupada; aguarde e tente /workspace novamente)", "WorkspaceSwitchPersistFailed": "Falha ao persistir a mudança de workspace: {error}; o ator de persistência também está indisponível", "WorkspaceSwitchSaveFailedActorQueued": "O salvamento direto da mudança de workspace falhou ({error}); o ator de persistência mantém o snapshot pós-mudança", "WorkspaceSwitchPersistedActorUnavailable": "A mudança de workspace foi salva, mas o ator de persistência está indisponível; o próximo salvamento automático a regrava", diff --git a/crates/tui/locales/ru.json b/crates/tui/locales/ru.json index a9e2df786c..996c8cfc57 100644 --- a/crates/tui/locales/ru.json +++ b/crates/tui/locales/ru.json @@ -1752,7 +1752,7 @@ "StatusLabelRoute": "Маршрут", "StatusLabelDirectory": "Каталог", "StatusLabelWorkspaceRoots": "Доступные папки", - "WorkspaceSwitchBusy": "Рабочее пространство не изменено (состояние Work или фоновая работа заняты; подождите и повторите /cd)", + "WorkspaceSwitchBusy": "Рабочее пространство не изменено (состояние Work или фоновая работа заняты; подождите и повторите /workspace)", "WorkspaceSwitchPersistFailed": "Не удалось сохранить смену рабочего пространства: {error}; субъект персистентности также недоступен", "WorkspaceSwitchSaveFailedActorQueued": "Прямое сохранение смены рабочего пространства не удалось ({error}); субъект персистентности хранит снимок после смены", "WorkspaceSwitchPersistedActorUnavailable": "Смена рабочего пространства сохранена, но субъект персистентности недоступен; следующее автосохранение запишет её заново", diff --git a/crates/tui/locales/uk.json b/crates/tui/locales/uk.json index 83ce1cd206..5c24cd0762 100644 --- a/crates/tui/locales/uk.json +++ b/crates/tui/locales/uk.json @@ -1752,7 +1752,7 @@ "StatusLabelRoute": "Маршрут", "StatusLabelDirectory": "Каталог", "StatusLabelWorkspaceRoots": "Доступні папки", - "WorkspaceSwitchBusy": "Робочий простір не змінено (стан роботи або виконання зайняті; зачекайте й повторіть /cd)", + "WorkspaceSwitchBusy": "Робочий простір не змінено (стан роботи або виконання зайняті; зачекайте й повторіть /workspace)", "WorkspaceSwitchPersistFailed": "Не вдалося зберегти зміну робочого простору: {error}; суб'єкт персистентності також недоступний", "WorkspaceSwitchSaveFailedActorQueued": "Пряме збереження зміни робочого простору не вдалося ({error}); суб'єкт персистентності зберігає знімок після зміни", "WorkspaceSwitchPersistedActorUnavailable": "Зміну робочого простору збережено, але суб'єкт персистентності недоступний; наступне автозбереження запише її знову", diff --git a/crates/tui/locales/vi.json b/crates/tui/locales/vi.json index 6f4f583da2..0094fbd2f3 100644 --- a/crates/tui/locales/vi.json +++ b/crates/tui/locales/vi.json @@ -1752,7 +1752,7 @@ "StatusLabelRoute": "Tuyến", "StatusLabelDirectory": "Thư mục", "StatusLabelWorkspaceRoots": "Thư mục có thể truy cập", - "WorkspaceSwitchBusy": "Workspace không đổi (trạng thái Công việc hoặc tác vụ thời gian chạy đang bận; hãy chờ rồi thử lại /cd)", + "WorkspaceSwitchBusy": "Workspace không đổi (trạng thái Công việc hoặc tác vụ thời gian chạy đang bận; hãy chờ rồi thử lại /workspace)", "WorkspaceSwitchPersistFailed": "Không thể lưu việc chuyển workspace: {error}; actor lưu trữ cũng không khả dụng", "WorkspaceSwitchSaveFailedActorQueued": "Lưu trực tiếp việc chuyển workspace thất bại ({error}); actor lưu trữ đang giữ snapshot sau chuyển", "WorkspaceSwitchPersistedActorUnavailable": "Đã lưu việc chuyển workspace, nhưng actor lưu trữ không khả dụng; lần tự lưu kế tiếp sẽ ghi lại", diff --git a/crates/tui/locales/zh-Hans.json b/crates/tui/locales/zh-Hans.json index 02b7af7111..59480f35a4 100644 --- a/crates/tui/locales/zh-Hans.json +++ b/crates/tui/locales/zh-Hans.json @@ -1752,7 +1752,7 @@ "StatusLabelRoute": "路由", "StatusLabelDirectory": "目录", "StatusLabelWorkspaceRoots": "可访问的文件夹", - "WorkspaceSwitchBusy": "工作区未更改（工作状态或运行时任务正忙；请等待后重试 /cd）", + "WorkspaceSwitchBusy": "工作区未更改（工作状态或运行时任务正忙；请等待后重试 /workspace）", "WorkspaceSwitchPersistFailed": "工作区切换持久化失败：{error}；持久化执行器也不可用", "WorkspaceSwitchSaveFailedActorQueued": "工作区切换的直接保存失败（{error}）；持久化执行器持有切换后的快照", "WorkspaceSwitchPersistedActorUnavailable": "工作区切换已保存，但持久化执行器不可用；下次自动保存会重新写入", diff --git a/crates/tui/locales/zh-Hant.json b/crates/tui/locales/zh-Hant.json index 1a2baa138e..04dfd39d8a 100644 --- a/crates/tui/locales/zh-Hant.json +++ b/crates/tui/locales/zh-Hant.json @@ -1752,7 +1752,7 @@ "StatusLabelRoute": "路由", "StatusLabelDirectory": "目錄", "StatusLabelWorkspaceRoots": "可存取的資料夾", - "WorkspaceSwitchBusy": "工作區未更改（工作狀態或執行時任務正忙；請等待後重試 /cd）", + "WorkspaceSwitchBusy": "工作區未更改（工作狀態或執行時任務正忙；請等待後重試 /workspace）", "WorkspaceSwitchPersistFailed": "工作區切換持久化失敗：{error}；持久化執行器也不可用", "WorkspaceSwitchSaveFailedActorQueued": "工作區切換的直接保存失敗（{error}）；持久化執行器持有切換後的快照", "WorkspaceSwitchPersistedActorUnavailable": "工作區切換已保存，但持久化執行器不可用；下次自動保存會重新寫入", diff --git a/docs/RUNTIME_API.md b/docs/RUNTIME_API.md index acc319b48b..3366bb4bed 100644 --- a/docs/RUNTIME_API.md +++ b/docs/RUNTIME_API.md @@ -820,6 +820,22 @@ returns `{"restored": ""}`. The `id` must match a listed snapshot exactly (full id, case-sensitive); an unknown or malformed id returns `404` before any git command runs. +When the snapshot's owning thread declares a root outside the primary +workspace, the restore response grows a `boundary` object naming what the +rollback does not cover: `attached_roots_not_reverted` (always `true`) and +`note` (human-readable text). Single-root restores keep the legacy bare +shape above — no `boundary` key. + +```json +{ + "restored": "", + "boundary": { + "attached_roots_not_reverted": true, + "note": "Only the primary workspace was reverted; attached workspace roots were not rolled back." + } +} +``` + ```json [ { @@ -1060,8 +1076,9 @@ The runtime uses a durable Thread/Turn/Item lifecycle. route), `workspace`, `workspace_roots` (the full accessible root set, primary first; normalization always prepends the workspace, so a thread created through `POST /v1/threads` serializes at least one element — a - single-root thread reads `"workspace_roots": [""]` — and only - rows persisted before the field existed omit the key entirely), `mode`, + single-root thread reads `"workspace_roots": [""]` — and any + row whose normalized set is empty — including every row persisted before + the field existed — omits the key entirely), `mode`, `task_id`, `system_prompt`, `latest_turn_id`, `latest_response_bookmark`, `archived` - **TurnRecord** — `id`, `thread_id`, `status` (`queued|in_progress|completed| From b227aa043703260f586b04ae6886b02a31a3305a Mon Sep 17 00:00:00 2001 From: qiuYliangM <185303122+qiuYliangM@users.noreply.github.com> Date: Wed, 30 Sep 2026 15:24:49 +0800 Subject: [PATCH 07/10] fix(tui): close the round-24 P3 residue wave MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Accuracy group: the execpolicy workspace_roots field doc now states the judged-cwd redirect caveat instead of the false primary-only claim; the headless lane canonicalizes ONLY operand-carrying calls (a no-operand call judges the declared spelling, matching the engine lane — pin: a declared-spelling scoped deny fires for a no-operand symlinked session); the resume-thread lane answers 400 for IntakeValidationError like the /thread and /tool lanes (pin); the create/PATCH primary-absoluteness comments and the PATCH keeps-roots comment tell the collapse truth; the repo_law .. marker says anchored glob; update_thread_root_set's doc drops the column-ownership overclaim and its vanished-row writeback now fails loud (pin). Behavior residuals: the runtime fork validates the cloned set at intake (a poisoned source row is rejected, not duplicated); ACP session/new rejects a relative cwd like the empty string; the exec persist absolutizes a legacy relative workspace row instead of re-stamping it; the /cd refusal copy names actionable exits (no TUI root producer exists); a re-based /cd emits the WorkspaceRootsNotice like /resume; the exec-resume mismatch warning is no longer Text-gated (stderr never touches the JSON stream); /branch documents its deliberate non-stamp; the guard-era registry docstrings stop describing the retired conflict guard. Pins: manager-level combined PATCH (workspace + roots validate against the NEW primary, rejection moves nothing), the PUT empty-session_id and session-PATCH invalid-id 400 arms, and the absolute-path fallback outside every root. Signed-off-by: qiuYliangM <185303122+qiuYliangM@users.noreply.github.com> --- crates/core/src/lib.rs | 93 ++++++++++++++++++- crates/execpolicy/src/lib.rs | 71 ++++++++++++-- crates/state/src/lib.rs | 56 +++++++++-- crates/tui/src/acp_server.rs | 15 ++- .../tui/src/commands/groups/session/branch.rs | 5 + crates/tui/src/core/engine.rs | 10 ++ crates/tui/src/exec_agent.rs | 6 +- crates/tui/src/lib.rs | 17 ++++ crates/tui/src/repo_law.rs | 8 +- crates/tui/src/runtime_api/sessions.rs | 33 +++++++ crates/tui/src/runtime_api/tests.rs | 57 ++++++++++-- crates/tui/src/runtime_threads.rs | 37 +++++++- crates/tui/src/runtime_threads/tests.rs | 69 ++++++++++++++ crates/tui/src/session_manager.rs | 14 ++- crates/tui/src/tui/ui/session_state.rs | 30 +++++- 15 files changed, 474 insertions(+), 47 deletions(-) diff --git a/crates/core/src/lib.rs b/crates/core/src/lib.rs index 807713c648..79f2e58540 100644 --- a/crates/core/src/lib.rs +++ b/crates/core/src/lib.rs @@ -1774,7 +1774,9 @@ impl Runtime { } let workspace_roots = validate_workspace_roots(cwd, workspace_roots)?; let fallback_cwd = cwd.display().to_string(); - let (command, raw_policy_cwd, execution_kind) = call.execution_subject(&fallback_cwd); + // `raw_policy_cwd` is superseded by the operand-aware resolution + // below; `command` and the kind label still come from the subject. + let (command, _raw_policy_cwd, execution_kind) = call.execution_subject(&fallback_cwd); // Judge the same effective cwd execution resolves (review // #484/CodeWhale round-22 B22-5): this lane used to hand the RAW // `params.cwd` operand to the policy check while execution resolved @@ -1782,9 +1784,23 @@ impl Runtime { // operand evaded a deny scoped to the canonical target, and any // relative/`..` operand made `normalize_workspace_scope` reject the // judgment side, silently disarming every scoped rule for the call. - let policy_cwd = resolve_operand_cwd(cwd, &raw_policy_cwd) - .to_string_lossy() - .into_owned(); + // Round-24 P3 accuracy fix: canonical resolution applies ONLY to + // operand-carrying calls, matching the engine lane — a no-operand + // call executes at the declared workspace spelling, so judging its + // canonical form (the old unconditional resolve) made every + // declared-spelling scoped rule inert lane-wide on symlinked + // systems (macOS `/tmp` sessions), the opposite divergence from the + // one B22-5 fixed. + let operand_cwd = match &call.payload { + ToolPayload::LocalShell { params } => params.cwd.clone(), + _ => None, + }; + let policy_cwd = match operand_cwd { + Some(dir) => resolve_operand_cwd(cwd, &dir) + .to_string_lossy() + .into_owned(), + None => fallback_cwd.clone(), + }; let policy_tool = match &call.payload { ToolPayload::LocalShell { .. } => "exec_shell", _ => call.name.as_str(), @@ -4795,6 +4811,75 @@ mod tests { assert_eq!(result["status"], "approval_required", "{result}"); } + #[cfg(unix)] + #[tokio::test] + async fn invoke_tool_judges_a_no_operand_call_at_the_declared_spelling() { + // Round-24 P3 accuracy fix: canonical resolution used to apply to + // EVERY call on this lane, so a symlink-spelled session workspace + // (macOS `/tmp`) judged its canonical form and a deny scoped to the + // DECLARED spelling went inert lane-wide — the opposite divergence + // from the operand one B22-5 fixed, and wider (every call, not just + // redirected ones). A no-operand call executes at the declared + // spelling, so it must judge there; an operand-carrying call keeps + // the canonical resolution (the B22-5 pin above covers that leg). + let temp = tempfile::tempdir().expect("tempdir"); + let real = temp.path().join("real"); + std::fs::create_dir_all(&real).expect("real dir"); + let link = temp.path().join("link"); + std::os::unix::fs::symlink(&real, &link).expect("symlink"); + let declared = link.to_string_lossy().into_owned(); + let canonical = real.canonicalize().expect("canonical real"); + + // Deny scoped to the DECLARED spelling fires for a no-operand call. + let runtime = runtime_with_exec_rules(vec![exec_deny_scoped_to(Path::new(&declared))]); + let result = runtime + .invoke_tool( + local_shell_call("git push origin main", None), + AskForApproval::OnRequest, + &link, + &[], + ) + .await + .expect("invoke tool"); + assert_eq!( + result["status"], "denied", + "a no-operand call judges at the declared spelling, so the declared-scoped \ + deny must fire: {result}" + ); + + // The canonical-spelling scope no longer matches a no-operand call + // (judgment sits at the declared spelling); it keeps firing for an + // operand-carrying call that resolves there. + let runtime = runtime_with_exec_rules(vec![exec_deny_scoped_to(&canonical)]); + let result = runtime + .invoke_tool( + local_shell_call("git push origin main", None), + AskForApproval::OnRequest, + &link, + &[], + ) + .await + .expect("invoke tool"); + assert_eq!( + result["status"], "approval_required", + "the canonical-spelling scope stays inert for a no-operand call judged at \ + the declared spelling: {result}" + ); + let result = runtime + .invoke_tool( + local_shell_call("git push origin main", Some(&declared)), + AskForApproval::OnRequest, + &link, + &[], + ) + .await + .expect("invoke tool"); + assert_eq!( + result["status"], "denied", + "an operand-carrying call still judges canonically (B22-5): {result}" + ); + } + #[tokio::test] async fn invoke_tool_rejects_degenerate_root_intake_declarations() { // Round-24 B24-3: this face was the one roots intake with no diff --git a/crates/execpolicy/src/lib.rs b/crates/execpolicy/src/lib.rs index 534cad654a..719f1eb7e5 100644 --- a/crates/execpolicy/src/lib.rs +++ b/crates/execpolicy/src/lib.rs @@ -314,9 +314,16 @@ pub struct ExecPolicyContext<'a> { /// The sandbox mode in effect, if any (e.g. `"workspace-write"`). pub sandbox_mode: Option<&'a str>, /// Additional workspace roots for ask/deny path and scope matching; - /// `cwd` remains the primary root. Allow rules keep matching the primary - /// root only, so an attached root never widens auto-approval. Empty - /// preserves the historical single-root matching. + /// `cwd` remains the primary root. Ask/deny rules may span every root + /// (they only add prompts or blocks), while Allow rules narrow to the + /// judged-cwd slot only, so an attached root never widens + /// auto-approval. Caveat recorded for accuracy (round-24 P3): the + /// judged-cwd slot is `cwd` — where the call RUNS — so a `cwd:`/ + /// working-dir redirect that lands the call inside an attached root + /// judges an unscoped Allow there ("judged where it runs", the opposite + /// policy of the session-grant re-key, which keeps grants pinned to the + /// spelling the user approved). Empty preserves the historical + /// single-root matching. pub workspace_roots: Vec, } @@ -470,7 +477,13 @@ impl ExecPolicyEngine { // may never reach into an attached root - exec is judged // where it runs: the session cwd, or the resolved // cwd:/working_dir: operand when the call redirects). - let candidate_idx: Vec = if rule.action == PermissionAction::Allow { + // Round-24 P3 perf: the dominant shapes (every Allow rule, + // and unscoped ask/deny on the single-root sessions that + // are the norm) borrow a static candidate slice instead of + // allocating a Vec per rule per call; only scoped + // ask/deny over a multi-root set allocates. + let scoped_candidates: Vec; + let candidate_idx: &[usize] = if rule.action == PermissionAction::Allow { // An Allow rule keeps the primary-only narrowing on // every filter regardless of whether it carries a // workspace: its rooted path and scope may never reach @@ -480,12 +493,14 @@ impl ExecPolicyEngine { .as_deref() .is_none_or(|workspace| workspace_scope_matches(workspace, ctx.cwd)) { - vec![0] + &[0] } else { - Vec::new() + &[] } + } else if rule.workspace.is_none() && roots.len() == 1 { + &[0] } else { - match rule.workspace.as_deref() { + scoped_candidates = match rule.workspace.as_deref() { None => (0..roots.len()).collect(), Some(workspace) => roots .iter() @@ -493,7 +508,8 @@ impl ExecPolicyEngine { .filter(|(_, root)| workspace_scope_matches(workspace, root)) .map(|(idx, _)| idx) .collect(), - } + }; + &scoped_candidates }; if candidate_idx.is_empty() { return false; @@ -2451,6 +2467,45 @@ mod tests { assert_eq!(decision.matched_rule, None); } + #[test] + fn typed_ask_absolute_path_rule_matches_a_call_outside_every_root() { + // Round-24 P3 pin bounding the absolute-path fallback: a rule + // spelling an ABSOLUTE location no root can normalize (`/root`, + // a real home) stays matchable for a call whose path sits outside + // every candidate root — the fallback compares the original call + // spelling regardless of the per-root outcome. The sibling test + // above pins the other side (a RELATIVE rule never reaches an + // absolute call through the same fallback). + let engine = + ExecPolicyEngine::with_rulesets(vec![Ruleset::user(vec![], vec![]).with_ask_rules( + vec![ToolAskRule { + tool: "edit_file".into(), + command: None, + command_exact: false, + path: Some("/root/.ssh/authorized_keys".into()), + workspace: None, + action: PermissionAction::Deny, + }], + )]); + + let decision = engine + .check(ExecPolicyContext { + command: "", + cwd: "/workspace", + tool: Some("edit_file"), + path: Some("/root/.ssh/authorized_keys"), + ask_for_approval: AskForApproval::OnFailure, + sandbox_mode: Some("workspace-write"), + workspace_roots: vec![std::path::PathBuf::from("/other/root")], + }) + .unwrap(); + assert!( + decision.matched_rule.is_some(), + "the deny on the pinned absolute location must fire even though the \ + call path normalizes under no candidate root" + ); + } + #[test] fn typed_ask_absolute_path_rule_folds_separators_and_case_on_windows() { let engine = diff --git a/crates/state/src/lib.rs b/crates/state/src/lib.rs index ad07f24ba2..1554e99fc6 100644 --- a/crates/state/src/lib.rs +++ b/crates/state/src/lib.rs @@ -831,6 +831,15 @@ impl StateStore { /// and `rollout_path` are plain `excluded.*` passthrough (a stale cache /// could even resurrect a concurrently archived thread). A narrow UPDATE /// writes exactly the columns the override owns and nothing else. + /// + /// Scope caveat (recorded for accuracy, round-24 P3): "the columns the + /// override owns" is over-broad for the roots-only leg in one direction + /// — `cwd` is written UNCONDITIONALLY, including when the caller only + /// meant to refresh the root set, so a concurrently moved cwd the cache + /// never saw is still reverted by that spelling. The typed caller API + /// always passes the pair. A row deleted concurrently with this UPDATE + /// fails loud instead of a silent no-op success (round-24 P3): the + /// writeback's ownership claim only holds while the row exists. pub fn update_thread_root_set( &self, id: &str, @@ -839,16 +848,22 @@ impl StateStore { updated_at: i64, ) -> Result<()> { let conn = self.conn()?; - conn.execute( - "UPDATE threads SET cwd = ?2, workspace_roots = ?3, updated_at = ?4 WHERE id = ?1", - params![ - id, - cwd.display().to_string(), - workspace_roots_to_json(workspace_roots), - updated_at, - ], - ) - .context("failed to update thread root set")?; + let rows = conn + .execute( + "UPDATE threads SET cwd = ?2, workspace_roots = ?3, updated_at = ?4 WHERE id = ?1", + params![ + id, + cwd.display().to_string(), + workspace_roots_to_json(workspace_roots), + updated_at, + ], + ) + .context("failed to update thread root set")?; + if rows == 0 { + return Err(anyhow::anyhow!( + "thread '{id}' vanished before the root-set writeback landed" + )); + } Ok(()) } @@ -2557,6 +2572,27 @@ mod tests { assert_eq!(row.created_at, seeded.created_at); } + #[test] + fn update_thread_root_set_fails_loud_when_the_row_vanished() { + // Round-24 P3 (behavior residual closed): a concurrently deleted row + // used to turn the cached-resume writeback into a silent no-op + // success — the caller claimed ownership of columns it never wrote. + // Zero rows affected must surface as an error instead. + let store = temp_state_store("root-set-vanished"); + let err = store + .update_thread_root_set( + "ghost-thread", + Path::new("/repo/main"), + &[PathBuf::from("/repo/main")], + 9_999, + ) + .expect_err("an absent row must not report success"); + assert!( + err.to_string().contains("vanished"), + "unexpected error: {err:#}" + ); + } + #[test] fn state_store_reuses_one_connection_across_operations_and_clones() { let store = temp_state_store("conn-reuse"); diff --git a/crates/tui/src/acp_server.rs b/crates/tui/src/acp_server.rs index 2ad3c1a64c..6684f8085f 100644 --- a/crates/tui/src/acp_server.rs +++ b/crates/tui/src/acp_server.rs @@ -1502,16 +1502,23 @@ impl AcpServer { } fn new_session(&mut self, params: Value) -> std::result::Result { - // An explicit empty cwd would build the tool registry over the - // vacuous containment root (`starts_with("")` accepts every path); - // reject it rather than falling back to the default, so a client - // typo cannot silently re-anchor the session. + // An explicit empty or RELATIVE cwd would build the tool registry + // over the vacuous containment root (`starts_with("")` accepts + // every path) or over a root no boundary consumer can resolve (a + // relative workspace cannot head a root set — the same intake rule + // as every other lane); reject both rather than falling back to the + // default, so a client typo cannot silently re-anchor or cripple + // the session (round-24 P3: the empty-string guard's own rationale + // always covered the relative spelling). let cwd = match params.get("cwd").and_then(Value::as_str) { Some("") => { return Err(AcpError::invalid_params( "session/new cwd must not be empty", )); } + Some(raw) if !std::path::Path::new(raw).is_absolute() => { + return Err(AcpError::invalid_params("session/new cwd must be absolute")); + } Some(raw) => PathBuf::from(raw), None => self.default_cwd.clone(), }; diff --git a/crates/tui/src/commands/groups/session/branch.rs b/crates/tui/src/commands/groups/session/branch.rs index d791b87f0b..be20819dd5 100644 --- a/crates/tui/src/commands/groups/session/branch.rs +++ b/crates/tui/src/commands/groups/session/branch.rs @@ -65,6 +65,11 @@ fn branch(app: &mut App, arg: Option<&str>) -> CommandResult { .unwrap_or(0); match session.journal_branch_to(entry_id) { Ok(()) => { + // Deliberately NOT stamping the live workspace/root set here + // (round-24 P3, enumerated against the "interactive lanes stamp" + // claim): this is a pure disk round-trip — load, move the + // journal leaf, save — and the leaf move cannot change the + // sandbox. The next autosave stamps the live set if it diverged. if let Err(e) = manager.save_session(&session) { return CommandResult::error(format!("branch saved but persist failed: {e}")); } diff --git a/crates/tui/src/core/engine.rs b/crates/tui/src/core/engine.rs index a05c7be804..9ac5ef9be0 100644 --- a/crates/tui/src/core/engine.rs +++ b/crates/tui/src/core/engine.rs @@ -8196,6 +8196,16 @@ pub(super) fn file_tool_ask_rule_decision( /// Evaluate the persisted file ask/allow/deny rules without requiring a full /// [`EngineConfig`]. This keeps protocol adapters on the canonical path and /// preserves the all-targets-must-match rule for multi-file patches. +/// +/// Disclosed residual (pre-existing at base, round-24 P3): the file lane +/// judges the operand's RAW spelling against the declared workspace — it +/// canonicalizes nothing — while execution canonicalizes. A `..`-spelled +/// operand that execution lands outside the declared roots therefore keeps +/// an ABSOLUTE-path deny rule inert here (the per-root relative +/// normalization cannot spell it, and the absolute fallback compares the +/// raw spelling). Fail-closed in practice through the other gate layers +/// (sandbox boundary + repo law judge the landing path); pinned as known +/// behavior, not silently shipped. pub(crate) fn file_tool_ask_rule_decision_for_policy( exec_policy_engine: &codewhale_execpolicy::ExecPolicyEngine, tool_name: &str, diff --git a/crates/tui/src/exec_agent.rs b/crates/tui/src/exec_agent.rs index 63d5f3196c..672a92f100 100644 --- a/crates/tui/src/exec_agent.rs +++ b/crates/tui/src/exec_agent.rs @@ -369,7 +369,7 @@ pub(crate) async fn run_exec_agent( let mut loaded_session_id = None; if let Some(saved) = resume_session { let saved_id = saved.metadata.id.clone(); - if saved.metadata.workspace != workspace && output_format == ExecOutputFormat::Text { + if saved.metadata.workspace != workspace { // The engine runs the SAVED workspace/root pair (the // `Op::SyncSession` below re-normalizes it against itself), so // the CLI `--workspace` does not re-anchor a resumed session and @@ -379,6 +379,10 @@ pub(crate) async fn run_exec_agent( // hard block, which refused legitimate resumes against a // workspace the lane never adopts and named a // `--workspace-roots` flag that does not exist). + // Round-24 P3: the old Text-format gate dropped this warning + // for JSON consumers entirely — it goes to stderr and never + // touches the stdout JSON stream, so the gate suppressed + // safety-relevant information for no compatibility gain. eprintln!( "Warning: session {} was created in a different workspace ({}). \ Resuming in the session's own workspace.", diff --git a/crates/tui/src/lib.rs b/crates/tui/src/lib.rs index afdbcdb1f9..ba9dc54723 100644 --- a/crates/tui/src/lib.rs +++ b/crates/tui/src/lib.rs @@ -12422,6 +12422,23 @@ fn persist_exec_session( session_id: Option<&str>, total_tokens: u64, ) -> Result { + // Round-24 P3 (behavior residual closed): a legacy relative-workspace + // row resumed through this lane used to be re-stamped verbatim, so the + // exec persist durably MINTED relative spellings a fresh `--workspace` + // could never declare (intake absolutizes). Absolutize against the + // process cwd here — the row converts to an absolute spelling on its + // next persist instead of propagating. + let workspace_abs; + let workspace: &Path = if workspace.is_absolute() { + workspace + } else { + workspace_abs = crate::mcp::normalize_path_components( + &std::env::current_dir() + .context("failed to resolve current directory for exec persist")? + .join(workspace), + ); + workspace_abs.as_path() + }; let manager = SessionManager::default_location().context("could not open session manager for save")?; let mut saved = if let Some(id) = session_id.filter(|id| !id.trim().is_empty()) { diff --git a/crates/tui/src/repo_law.rs b/crates/tui/src/repo_law.rs index dee4ed84f2..9769d09206 100644 --- a/crates/tui/src/repo_law.rs +++ b/crates/tui/src/repo_law.rs @@ -331,8 +331,12 @@ fn push_normalized( ".." => { // A `..` that pops above the root escapes the workspace; keep // an explicit marker so this spelling tail can never match a - // workspace-relative glob. Where the write actually lands is - // judged separately below from the clamped execution candidate. + // workspace-ANCHORED glob (one whose first segment is + // literal). A `**`-leading glob can still match the marker + // tail — recorded for accuracy (round-24 P3); those globs + // stay fail-closed through the landing-path leg below. + // Where the write actually lands is judged separately below + // from the clamped execution candidate. if parts.pop().is_none() { parts.push("..".to_string()); } diff --git a/crates/tui/src/runtime_api/sessions.rs b/crates/tui/src/runtime_api/sessions.rs index 80b3e71114..0c09690418 100644 --- a/crates/tui/src/runtime_api/sessions.rs +++ b/crates/tui/src/runtime_api/sessions.rs @@ -1031,6 +1031,18 @@ fn map_session_err(id: &str, err: std::io::Error, action: &str) -> ApiError { } fn map_resume_thread_create_err(err: anyhow::Error) -> ApiError { + // Intake validation failures are client errors (round-24 P3): the + // resume lane forwards the SAVED session's workspace/roots into + // `create_thread`, whose validating intake can reject them — a + // hand-edited or migrated session row with a `/`-rooted or over-cap + // root set must answer 400 with the reason, exactly like the `/thread` + // and `/tool` lanes, not a server-fault 500. + if err + .downcast_ref::() + .is_some() + { + return ApiError::bad_request(format!("Failed to create thread: {err}")); + } let reason = err.to_string(); let message = format!("Failed to create thread: {reason}"); if reason.starts_with("saved session has an empty provider identity") @@ -1147,4 +1159,25 @@ mod resume_thread_error_tests { )); assert_eq!(storage.status, StatusCode::INTERNAL_SERVER_ERROR); } + + #[test] + fn intake_validation_errors_answer_400_like_the_thread_lane() { + // Round-24 P3: the resume lane forwards the saved session's root + // set into create_thread's validating intake; a rejected row (here + // a `/`-rooted set read back from a hand-edited session file) is a + // client-fixable record, not a server fault — the mapping must + // match the /thread and /tool lanes instead of the old 500. + let err = codewhale_core::validate_workspace_roots( + std::path::Path::new("/ws"), + &[std::path::PathBuf::from("/")], + ) + .expect_err("a filesystem-root declaration is rejected at intake"); + let mapped = map_resume_thread_create_err(err); + assert_eq!(mapped.status, StatusCode::BAD_REQUEST); + assert!( + mapped.message.contains("filesystem root"), + "the 400 body carries the intake reason: {}", + mapped.message + ); + } } diff --git a/crates/tui/src/runtime_api/tests.rs b/crates/tui/src/runtime_api/tests.rs index 1cde80e129..64ee95efdb 100644 --- a/crates/tui/src/runtime_api/tests.rs +++ b/crates/tui/src/runtime_api/tests.rs @@ -4524,6 +4524,49 @@ async fn saved_sessions_carry_thread_workspace_roots_through_save_and_resave() - Ok(()) } +#[tokio::test] +async fn put_empty_session_id_and_patch_invalid_path_id_answer_400() -> Result<()> { + // Round-24 P3 pin: the two boundary-validation 400 arms whose pins were + // lost with the 409-guard removal — an explicit-but-empty `session_id` + // on PUT /v1/sessions is a client error (not "create new"), and a + // session PATCH addressed at an invalid id shape answers 400, not 500. + let root = std::env::temp_dir().join(format!("deepseek-put-400-{}", Uuid::new_v4())); + let sessions_dir = root.join("sessions"); + let Some((addr, _runtime_threads, handle)) = + spawn_test_server_with_root(root.clone(), sessions_dir.clone()).await? + else { + return Ok(()); + }; + let client = crate::tls::reqwest_client(); + + // PUT with an explicit empty session_id: rejected at the boundary. + let rejected = client + .put(format!("http://{addr}/v1/sessions")) + .json(&json!({ "session_id": "" })) + .send() + .await?; + assert_eq!( + rejected.status(), + StatusCode::BAD_REQUEST, + "an explicit empty session_id must be a 400, not a silent create" + ); + + // Session PATCH addressed at an invalid id shape: 400 with the reason. + let invalid = client + .patch(format!("http://{addr}/v1/sessions/not a valid id!")) + .json(&json!({ "title": "x" })) + .send() + .await?; + assert_eq!( + invalid.status(), + StatusCode::BAD_REQUEST, + "an invalid session id in the path must answer 400, not 500" + ); + + handle.abort(); + Ok(()) +} + #[tokio::test] async fn session_resave_after_workspace_move_keeps_workspace_and_roots_paired() -> Result<()> { let root = std::env::temp_dir().join(format!("deepseek-session-move-{}", Uuid::new_v4())); @@ -5092,8 +5135,9 @@ fn restore_snapshot_endpoint_helper_restores_workspace_files() -> Result<()> { let snapshot_id = repo.snapshot("pre-turn:1")?; fs::write(workspace.join("a.txt"), "v2")?; - restore_snapshot_for_workspace(&workspace, snapshot_id.as_str()) - .expect("snapshot restore should succeed"); + let snapshot = + snapshot_for_workspace(&workspace, snapshot_id.as_str()).expect("membership lookup"); + restore_snapshot_for_workspace(&workspace, &snapshot).expect("snapshot restore should succeed"); assert_eq!(fs::read_to_string(workspace.join("a.txt"))?, "v1"); Ok(()) } @@ -5113,10 +5157,11 @@ fn restore_snapshot_endpoint_helper_rejects_unknown_snapshot_id() -> Result<()> repo.snapshot("pre-turn:1")?; // An id the side repo does not know must 404 without reaching git, - // instead of being handed over as an arbitrary treeish. - let err = - restore_snapshot_for_workspace(&workspace, "0123456789abcdef0123456789abcdef01234567") - .expect_err("an unknown snapshot id must be rejected"); + // instead of being handed over as an arbitrary treeish. (Round-24 P3: + // the membership gate lives in the read half — the restore half now + // takes the fetched snapshot — so this pins the read half's 404.) + let err = snapshot_for_workspace(&workspace, "0123456789abcdef0123456789abcdef01234567") + .expect_err("an unknown snapshot id must be rejected"); assert_eq!(err.status, StatusCode::NOT_FOUND); assert!( err.message.contains("no such snapshot"), diff --git a/crates/tui/src/runtime_threads.rs b/crates/tui/src/runtime_threads.rs index f035fe406d..0dcf45c616 100644 --- a/crates/tui/src/runtime_threads.rs +++ b/crates/tui/src/runtime_threads.rs @@ -5458,8 +5458,12 @@ impl RuntimeThreadManager { // super-root (`/`, `/..`), an ancestor of the primary, or a // non-absolute entry (`~/shared`) each widens — or silently shrinks — // the sandbox the caller thinks it declared. The primary slot was - // already guarded non-empty above; validation also requires it to be - // absolute, since every containment check resolves absolute paths. + // already guarded non-empty above; a RELATIVE primary is not errored + // here — the validator fail-closed collapses its set to empty (the + // round-17 decision: every boundary consumer then treats the row as + // single-root on the degenerate primary and admits no writes through + // it), recorded for accuracy because "requires it to be absolute" + // overclaimed (round-24 P3). let workspace_roots = codewhale_core::validate_workspace_roots(&workspace, &req.workspace_roots)?; let thread = ThreadRecord { @@ -5882,9 +5886,13 @@ impl RuntimeThreadManager { changes.insert("workspace".to_string(), json!(workspace)); if !changes.contains_key("workspace_roots") { // A workspace-only change keeps the additional roots and - // hands the primary slot to the new workspace. The moved - // primary re-declares the set: an additional root that - // would end up an ancestor of the new primary (or a + // hands the primary slot to the new workspace — except a + // degenerate relative OLD primary, whose stored set the + // intake collapsed to empty: there are no additional + // roots to keep, and the row stays single-root on the new + // primary (recorded for accuracy, round-24 P3). The + // moved primary re-declares the set: an additional root + // that would end up an ancestor of the new primary (or a // super-root inherited from a legacy row) is a widening // decision and is rejected, not admitted silently. let additional: Vec = thread @@ -6098,6 +6106,25 @@ impl RuntimeThreadManager { forked.updated_at = now; forked.latest_turn_id = None; forked.archived = false; + // A fork MINTS a new row, so the cloned set passes the same + // validating intake the create lane applies (round-24 P3, closing + // the "a bare fork fails loud" over-generalization): a poisoned + // source row (a super-root, a primary-ancestor, or an over-cap set + // hand-edited into the store) is rejected instead of duplicated + // into a fresh id. A degenerate relative primary collapses to the + // empty set fail-closed, exactly like create. + let carried: Vec = source + .workspace_roots + .iter() + .filter(|root| **root != source.workspace) + .cloned() + .collect(); + forked.workspace_roots = + codewhale_core::validate_workspace_roots(&source.workspace, &carried).map_err( + |reason| { + anyhow::anyhow!("source thread root set no longer passes intake: {reason}") + }, + )?; let source_turns = self.store.list_turns_for_thread(&source.id)?; let mut cloned_records = Vec::with_capacity(source_turns.len()); diff --git a/crates/tui/src/runtime_threads/tests.rs b/crates/tui/src/runtime_threads/tests.rs index f89988b963..82602a4dad 100644 --- a/crates/tui/src/runtime_threads/tests.rs +++ b/crates/tui/src/runtime_threads/tests.rs @@ -5792,6 +5792,75 @@ async fn update_thread_workspace_persists_event_and_evicts_idle_engine() -> Resu Ok(()) } +#[tokio::test] +async fn update_thread_combined_patch_validates_roots_against_the_new_primary() -> Result<()> { + // Round-24 P3 pin (manager-level combined PATCH): when workspace and + // roots arrive in ONE PATCH, the declared set is validated against the + // NEW primary — an ancestor of the incoming workspace is rejected and + // the whole PATCH fails without moving the thread; a valid combined + // PATCH persists the re-normalized set under the new primary. + let manager = test_manager(test_runtime_dir())?; + let workspace = std::env::temp_dir().join("codewhale-runtime-combined-patch"); + let thread = manager + .create_thread(CreateThreadRequest { + workspace: Some(workspace.clone()), + ..Default::default() + }) + .await?; + + let new_workspace = std::env::temp_dir().join("codewhale-runtime-combined-patch-next"); + let err = manager + .update_thread( + &thread.id, + UpdateThreadRequest { + workspace: Some(new_workspace.clone()), + workspace_roots: Some(vec![std::env::temp_dir()]), + ..UpdateThreadRequest::default() + }, + ) + .await + .expect_err("an ancestor of the new primary must be rejected in the combined PATCH"); + assert!( + err.to_string().contains("ancestor of the primary"), + "unexpected error: {err:#}" + ); + let unchanged = manager.get_thread(&thread.id).await?; + assert!( + unchanged.workspace == workspace, + "a rejected combined PATCH must not move the workspace either" + ); + assert_ne!( + unchanged.workspace_roots, + vec![workspace.clone(), std::env::temp_dir()], + "a rejected combined PATCH must not persist the wide set" + ); + assert_eq!( + unchanged.workspace_roots, + vec![workspace], + "the set stays the create-time single-root form" + ); + + let shared = std::env::temp_dir().join("codewhale-runtime-combined-patch-shared"); + manager + .update_thread( + &thread.id, + UpdateThreadRequest { + workspace: Some(new_workspace.clone()), + workspace_roots: Some(vec![shared.clone()]), + ..UpdateThreadRequest::default() + }, + ) + .await?; + let updated = manager.get_thread(&thread.id).await?; + assert_eq!(updated.workspace, new_workspace); + assert_eq!( + updated.workspace_roots, + vec![new_workspace.clone(), shared], + "the valid combined PATCH persists the set normalized under the new primary" + ); + Ok(()) +} + #[tokio::test] async fn update_thread_roots_evicts_idle_engine() -> Result<()> { // Eviction fires under `workspace_changed || roots_changed`; the workspace diff --git a/crates/tui/src/session_manager.rs b/crates/tui/src/session_manager.rs index 543b0b56d1..545f004958 100644 --- a/crates/tui/src/session_manager.rs +++ b/crates/tui/src/session_manager.rs @@ -209,9 +209,10 @@ fn is_not_archived(archived: &bool) -> bool { /// the whole document, so the directory `reclaim_orphaned_session_dirs` /// sweeps must never treat a live owner's session as an orphan. (The /// write-conflict guard this registry used to feed was retired — round-20 -/// B20-3: the process-local External lane never coexists with the -/// interactive surface in a shipped topology, so external writes converge -/// by last-write-wins at the store layer.) +/// B20-3: the registry and the runtime HTTP server never share a process +/// in a shipped topology, so the conflict path could never engage; +/// same-process writers converge by last-write-wins at the store layer. +/// Stale coexistence wording corrected round-24 P3.) /// /// A static registry rather than a field on `RuntimeApiState` because the /// embedded Runtime API runs inside the TUI process; a standalone @@ -5032,8 +5033,11 @@ mod tests { } /// A poisoned claim lock means ownership cannot be determined, so the - /// answer fails closed: the session counts as live and external writers - /// take the conflict instead of racing an autosave nobody can see. + /// answer fails closed: the session counts as live, so the orphan + /// reclamation keep-chain skips it rather than deleting a directory a + /// maybe-running surface still owns. (The write-conflict guard that + /// used to be the other fail-closed consumer was retired in round-20 + /// B20-3; stale wording corrected round-24 P3.) #[test] fn live_session_claim_fails_closed_on_a_poisoned_lock() { let _lock = crate::shell_dispatcher::test_env_lock::lock_test_env(); diff --git a/crates/tui/src/tui/ui/session_state.rs b/crates/tui/src/tui/ui/session_state.rs index 83d4407725..de6c83356b 100644 --- a/crates/tui/src/tui/ui/session_state.rs +++ b/crates/tui/src/tui/ui/session_state.rs @@ -669,6 +669,12 @@ enum WorkspaceSwitchReceipt { Degraded(String), /// The swap is not durably recorded (save failed, or the snapshot itself /// could not be built). The user must see this as a failure. + /// Accuracy caveat (round-24 P3): the save-failed/actor-QUEUED arm also + /// lands here, and that arm DOES durably converge — the actor holds the + /// post-switch snapshot and its latest-wins coalescing drops any stale + /// pre-switch write; it is classified as Failure (not Degraded) because + /// the direct disk authority missed, so the restart-order guarantee + /// depends on the actor alone until the next persist. Failure(String), } @@ -771,15 +777,23 @@ pub(crate) async fn switch_workspace( let re_based = match codewhale_core::validate_workspace_roots(&workspace, &carried) { Ok(roots) => roots, Err(err) => { + // Round-24 P3 copy fix: the old guidance ("re-declare the roots + // after switching") named a producer the TUI does not have — + // no command attaches or detaches roots — and the switch was + // refused, so there is nothing to re-declare "after". The + // actionable exits are a new session in that directory or + // editing the session's root set outside the TUI. let message = format!( - "Cannot switch workspace to {}: the carried root set would widen past the new directory ({err:#}). Re-declare the roots after switching.", - workspace.display() + "Cannot switch workspace to {}: the carried root set would widen past the new directory ({}). The switch is refused; start a new session in that directory, or remove the widening roots from this session's saved root set outside the TUI.", + workspace.display(), + err ); app.status_message = Some(message.clone()); app.add_message(HistoryCell::System { content: message }); return; } }; + let carried_additional = re_based.len() > 1; app.workspace = workspace.clone(); app.workspace_roots = re_based; @@ -814,6 +828,18 @@ pub(crate) async fn switch_workspace( app.add_message(HistoryCell::System { content: format!("Switched workspace to {}", workspace.display()), }); + // Round-24 P3 display fix: a switch that RE-BASED surviving roots + // changes what the sandbox governs, exactly like the /resume and /load + // entries that already disclose the set — without this notice the + // carried roots silently changed their anchor (or were dropped by the + // re-normalization) with no in-band disclosure. + if carried_additional { + if let Some(notice) = + workspace_roots_notice(app.ui_locale, &workspace, &app.workspace_roots) + { + app.add_message(HistoryCell::System { content: notice }); + } + } // The receipt rides the closing line instead of being assigned earlier: // an unconditional "Workspace: X" assignment after the persist block used // to clobber every failure receipt it exists to disclose (round-14 M-1). From 8419d0132484e869473452c7cd82f2985a69155c Mon Sep 17 00:00:00 2001 From: qiuYliangM <185303122+qiuYliangM@users.noreply.github.com> Date: Wed, 30 Sep 2026 15:24:57 +0800 Subject: [PATCH 08/10] perf(tui): hoist per-call root work and memoize boundaries Round-24 P3 performance group: ToolContext::boundary_roots memoizes the normalized set plus canonical spellings per context lifetime (roots are lifetime-immutable; the builder installs a fresh cache) instead of canonicalizing every root on every resolve_path; the carve-out stats .git and canonicalizes each root once per judgment instead of once per absolute target; canonical_readonly_roots dedups through a set (was O(N^2) Vec contains); get_writable_roots drops the full root-vec clone on the git-pointer walk; the restore face threads the fetched snapshot through instead of listing the store twice per request; and matching_ask_rule borrows a static candidate slice for the dominant shapes (every Allow rule; unscoped rules on single-root sessions) instead of allocating a Vec per rule. No judgment semantics change; the existing suites pass unchanged. Signed-off-by: qiuYliangM <185303122+qiuYliangM@users.noreply.github.com> --- crates/tui/src/core/authority.rs | 43 +++++++++++++++++++++----------- crates/tui/src/runtime_api.rs | 31 ++++++++++++----------- crates/tui/src/sandbox/policy.rs | 11 +++++--- crates/tui/src/tools/shell.rs | 6 ++++- crates/tui/src/tools/spec.rs | 39 ++++++++++++++++++++++------- 5 files changed, 88 insertions(+), 42 deletions(-) diff --git a/crates/tui/src/core/authority.rs b/crates/tui/src/core/authority.rs index 9e022126a9..334f6114ff 100644 --- a/crates/tui/src/core/authority.rs +++ b/crates/tui/src/core/authority.rs @@ -532,34 +532,47 @@ pub(crate) fn paths_within_workspace_write_carve_out( return false; } let roots = codewhale_core::normalize_workspace_roots(workspace, workspace_roots); + // Round-24 P3 perf: the per-root `.git` stat and canonicalize are + // hoisted out of the per-target loop — the old shape re-canonicalized + // every root for every absolute target (roots × targets realpath + // chains on one judgment). Eligibility (a git work tree that + // canonicalizes) is per call, not per target; the allowed-check per + // target is untouched. + let eligible_git_roots: Vec<(&Path, PathBuf)> = roots + .iter() + // `.git` may be a directory (normal checkout) or a file (worktree + // or submodule); either marks a git work tree. + .filter(|root| root.join(".git").symlink_metadata().is_ok()) + .filter_map(|root| { + root.canonicalize() + .ok() + .map(|canonical| (root.as_path(), canonical)) + }) + .collect(); + let primary_git_canonical = if workspace.join(".git").symlink_metadata().is_ok() { + workspace.canonicalize().ok() + } else { + None + }; paths.iter().all(|raw| { if Path::new(raw).is_absolute() { - roots + eligible_git_roots .iter() - .any(|root| carve_out_target_within_root(root, raw)) + .any(|(root, canonical)| carve_out_target_allowed(root, canonical, raw)) } else { // A relative target is joined onto the primary workspace at // execution time, so approval must judge it there: qualifying it // through an attached git root would let the write land in the // non-git primary tree modal-free and defeat the carve-out's own // reviewability rationale. - carve_out_target_within_root(workspace, raw) + match &primary_git_canonical { + Some(canonical) => carve_out_target_allowed(workspace, canonical, raw), + None => false, + } } }) } -fn carve_out_target_within_root(root: &Path, raw: &str) -> bool { - // `.git` may be a directory (normal checkout) or a file (worktree or - // submodule); either marks a git work tree. - if root.join(".git").symlink_metadata().is_err() { - return false; - } - let Ok(root_canonical) = root.canonicalize() else { - return false; - }; - carve_out_target_allowed(root, &root_canonical, raw) -} - fn carve_out_target_allowed(workspace: &Path, workspace_canonical: &Path, raw: &str) -> bool { // The branch runs on the untrimmed spelling, matching both the caller's // branch and execution's (`ToolContext::resolve_path`): trimming here diff --git a/crates/tui/src/runtime_api.rs b/crates/tui/src/runtime_api.rs index 0eeb4beee0..2495788225 100644 --- a/crates/tui/src/runtime_api.rs +++ b/crates/tui/src/runtime_api.rs @@ -5925,7 +5925,7 @@ async fn restore_snapshot( "note": crate::snapshot::ATTACHED_ROOTS_NOT_REVERTED_NOTE, }); } - restore_snapshot_for_workspace(&state.workspace, &id)?; + restore_snapshot_for_workspace(&state.workspace, &snapshot)?; Ok(Json(payload)) } @@ -5950,22 +5950,25 @@ fn snapshot_for_workspace( fn restore_snapshot_for_workspace( workspace: &FsPath, - id: &str, -) -> Result { - let snapshot = snapshot_for_workspace(workspace, id)?; + snapshot: &crate::snapshot::Snapshot, +) -> Result<(), ApiError> { + // Round-24 P3 perf: the already-fetched membership-checked snapshot is + // threaded through instead of re-listing the store a second time per + // restore request (the read half above already proved the id belongs to + // this repo). let repo = crate::snapshot::SnapshotRepo::open_or_init(workspace) .map_err(|e| ApiError::internal(format!("Snapshot repo init failed: {e}")))?; - // The id arrives from the request path and is handed to git as a - // treeish, so it is accepted only if the side repo actually knows it — - // anything else is a 404 rather than an arbitrary string on a git - // command line. The membership check also marks the id as validated - // for command-line-injection scanners (an allowlist `contains` is - // their modeled trust boundary), so the pre-existing, accepted flow - // stops re-flagging when call sites are refactored. - let snapshot_id = crate::snapshot::SnapshotId(id.to_string()); - repo.restore(&snapshot_id) + // The id arrived from the request path and is handed to git as a + // treeish; it reached this fn only through the side repo's own + // membership list, so anything else was already answered 404 rather + // than an arbitrary string on a git command line. The membership check + // also marks the id as validated for command-line-injection scanners + // (an allowlist `contains` is their modeled trust boundary), so the + // pre-existing, accepted flow stops re-flagging when call sites are + // refactored. + repo.restore(&snapshot.id) .map_err(|e| ApiError::internal(format!("Snapshot restore failed: {e}")))?; - Ok(snapshot) + Ok(()) } fn snapshot_entries_for_workspace( diff --git a/crates/tui/src/sandbox/policy.rs b/crates/tui/src/sandbox/policy.rs index 987164ca17..49060123e0 100644 --- a/crates/tui/src/sandbox/policy.rs +++ b/crates/tui/src/sandbox/policy.rs @@ -332,10 +332,15 @@ impl SandboxPolicy { // Git worktrees keep mutable metadata outside the worktree // directory. Allow only the gitdir and commondir derived from // a workspace `.git` pointer, preserving the workspace boundary - // for all other external paths. - for root in roots.clone() { - roots.extend(resolve_git_worktree_writable_roots(&root)); + // for all other external paths. (Round-24 P3 perf: the walk + // results buffer into a side vec — the old `roots.clone()` + // copied the whole root vec per exec command only to iterate + // it while extending.) + let mut git_pointer_roots = Vec::new(); + for root in &roots { + git_pointer_roots.extend(resolve_git_worktree_writable_roots(root)); } + roots.extend(git_pointer_roots); // Add /tmp unless excluded if !exclude_slash_tmp && let Ok(tmp) = Path::new("/tmp").canonicalize() { diff --git a/crates/tui/src/tools/shell.rs b/crates/tui/src/tools/shell.rs index 8db9a37d72..234d527eb7 100644 --- a/crates/tui/src/tools/shell.rs +++ b/crates/tui/src/tools/shell.rs @@ -4036,9 +4036,13 @@ fn canonical_readonly_roots(roots: &[PathBuf]) -> std::io::Result> )); }; let mut canonical = vec![primary.canonicalize()?]; + // Round-24 P3 perf: the Vec `contains` made the dedup O(N²) in the + // root-set size — a set keeps the order-preserving first-wins dedup + // linear. Behavior identical (first canonical spelling wins). + let mut seen: std::collections::HashSet = canonical.iter().cloned().collect(); for root in extra { if let Ok(resolved) = root.canonicalize() - && !canonical.contains(&resolved) + && seen.insert(resolved.clone()) { canonical.push(resolved); } diff --git a/crates/tui/src/tools/spec.rs b/crates/tui/src/tools/spec.rs index e20d9d88c4..daba599891 100644 --- a/crates/tui/src/tools/spec.rs +++ b/crates/tui/src/tools/spec.rs @@ -606,6 +606,16 @@ pub struct ToolExecutionState { /// Additional workspace roots tools may touch; `workspace` is always the /// primary root. Empty means the historical single-root boundary. pub workspace_roots: Vec, + /// Round-24 P3 perf memo for `boundary_roots()`: the normalized set plus + /// each root's canonical spelling, canonicalizing once per context + /// lifetime instead of once per `resolve_path` call (several judgments + /// ride every tool call). Invariant: `workspace` and `workspace_roots` + /// are immutable for the context's lifetime — the constructors install a + /// fresh cache and `with_workspace_roots` replaces it; clones share it, + /// which is sound because clones carry identical roots. No code path + /// mutates the roots in place (surveyed; if one ever must, it must swap + /// this Arc first or the boundary would judge stale spellings). + pub(crate) boundary_roots_cache: std::sync::Arc>>, /// Current sandbox policy #[allow(dead_code)] pub sandbox_policy: SandboxPolicy, @@ -783,6 +793,7 @@ impl ToolContext { tool_authority, trust_mode, workspace_roots: Vec::new(), + boundary_roots_cache: std::sync::Arc::new(std::sync::OnceLock::new()), sandbox_policy: SandboxPolicy::None, notes_path: notes_path.into(), mcp_config_path: mcp_config_path.into(), @@ -844,6 +855,9 @@ impl ToolContext { #[must_use] pub fn with_workspace_roots(mut self, workspace_roots: Vec) -> Self { self.workspace_roots = workspace_roots; + // Fresh memo: the boundary must never judge the previous set's + // canonical spellings (see the field's invariant note). + self.boundary_roots_cache = std::sync::Arc::new(std::sync::OnceLock::new()); self } @@ -1075,14 +1089,21 @@ impl ToolContext { /// any additional roots, each paired with its canonical (or raw fallback) /// form. With no additional roots configured this is exactly the primary /// root, so single-root sessions take the historical code path. - fn boundary_roots(&self) -> Vec<(PathBuf, PathBuf)> { - codewhale_core::normalize_workspace_roots(&self.workspace, &self.workspace_roots) - .into_iter() - .map(|root| { - let canonical = root.canonicalize().unwrap_or_else(|_| root.clone()); - (root, canonical) - }) - .collect() + fn boundary_roots(&self) -> &[(PathBuf, PathBuf)] { + // Round-24 P3 perf: memoized per context (roots are lifetime- + // immutable, see the cache field's invariant note). The canonicalize + // chain per root used to run on every resolve_path call — several + // per tool turn — which on a 64-root session was hundreds of + // realpath syscalls per turn for an unchanged set. + self.boundary_roots_cache.get_or_init(|| { + codewhale_core::normalize_workspace_roots(&self.workspace, &self.workspace_roots) + .into_iter() + .map(|root| { + let canonical = root.canonicalize().unwrap_or_else(|_| root.clone()); + (root, canonical) + }) + .collect() + }) } pub fn resolve_path(&self, raw: &str) -> Result { @@ -1105,7 +1126,7 @@ impl ToolContext { // path against each root first. A symlink inside a root that resolves // outside is allowed — the symlink itself is the gate. if self.follow_symlinks { - for (root, root_canonical) in &boundary_roots { + for (root, root_canonical) in boundary_roots { let root_normalized = normalize_path(root); let root_canonical_normalized = normalize_path(root_canonical); if candidate_normalized.starts_with(&root_normalized) From eec20a2d8b358f025e98c7edc01392dae8698239 Mon Sep 17 00:00:00 2001 From: qiuYliangM <185303122+qiuYliangM@users.noreply.github.com> Date: Wed, 30 Sep 2026 19:06:23 +0800 Subject: [PATCH 09/10] fix(tui): close the round-26 isolation and intake gaps MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit B26-1 (isolation regression, introduced by the round-25 memo): the boundary memo's no-in-place-mutation invariant was false at three production sites. ToolContext::rebase_roots now owns the (workspace, roots) pair swap AND the memo Arc swap together; the worktree spawn and resume sites and the per-turn live context go through it, and the field invariant names the setter as the only mutation path. Pin: rebased_roots_drop_the_parent_filled_boundary_memo fills the PARENT memo first (the falsely-covered shape) and proves the rebased child denies the parent workspace and its attached root while resolving inside the worktree. M26-1: fork_at_user_message (the live /undo, /patch-undo, /retry routes) runs the same validating intake fork_thread got in round-25 — a poisoned source row is rejected, not duplicated. Pin covers BOTH fork faces with a hand-poisoned store row; the round-25 ACP relative-cwd rejection gets its missing pin too (m26-6). M26-2: the four TUI load/resume faces move onto a new primary yet seeded the tolerant normalizer, durably re-minting a widening carried entry every intake refuses. seed_loaded_workspace_roots applies the core resume lane's rule — pure load tolerates (legacy rows stay loadable), a move validates and refuses before any app mutation. Pin: validates_moves_and_tolerates_pure_loads. M26-3: the apply_patch session-grant grouping key hashed only the payload headers, so the same body under two different top-level overrides shared one grant family — a session-approved patch auto-approved a redirect to an arbitrary target (the B20-2 class, patch arm). hash_patch_paths folds the aliases and keys an override exactly as execution's PathOverride-wins semantics do. Pin: grouping_key_rekeys_on_the_top_level_path_override. M26-4d/f: the revert_turn tool description's boundary clause is an unconditional literal, so single-root schemas changed — the description is now qualified, recorded, and pinned; the /fork refusal copy no longer names the producerless re-declare step. Verification: the fork-ci clippy gate command clean; full codewhale-tui --lib 12,029 passed with 5 remote_control/model_inventory parallel flakes that pass single-threaded (unchanged class); the targeted suites for every touched area green. Signed-off-by: qiuYliangM <185303122+qiuYliangM@users.noreply.github.com> --- crates/tui/src/acp_server.rs | 23 +++++ .../tui/src/commands/groups/session/resume.rs | 10 +- .../src/commands/groups/session/session.rs | 2 +- crates/tui/src/core/engine.rs | 9 +- crates/tui/src/runtime_threads.rs | 17 ++++ crates/tui/src/runtime_threads/tests.rs | 43 +++++++++ crates/tui/src/tools/approval_cache.rs | 60 +++++++++++- crates/tui/src/tools/revert_turn.rs | 17 +++- crates/tui/src/tools/spec.rs | 32 ++++++- crates/tui/src/tools/spec/tests.rs | 71 ++++++++++++++ crates/tui/src/tools/subagent/mod.rs | 30 ++++-- crates/tui/src/tui/ui/apply.rs | 30 ++++-- crates/tui/src/tui/ui/event_loop.rs | 90 +++++++++++------- crates/tui/src/tui/ui/handlers.rs | 29 ++++-- crates/tui/src/tui/ui/session_state.rs | 94 ++++++++++++++++++- 15 files changed, 488 insertions(+), 69 deletions(-) diff --git a/crates/tui/src/acp_server.rs b/crates/tui/src/acp_server.rs index 6684f8085f..4ea47d8012 100644 --- a/crates/tui/src/acp_server.rs +++ b/crates/tui/src/acp_server.rs @@ -2832,6 +2832,29 @@ mod tests { assert_eq!(err.code, -32602); } + #[test] + fn session_new_rejects_relative_cwd() { + // Round-26 m26-6 pin for the round-25 guard: a relative cwd cannot + // head a root set (the empty-string guard's own rationale always + // covered this spelling — it built a registry no boundary consumer + // could resolve, failing per-call instead of at intake). + let workspace = tempfile::tempdir().unwrap(); + let mut server = AcpServer::new( + Config::default(), + "deepseek-v4-flash".into(), + workspace.path().into(), + ); + let err = server + .new_session(json!({"cwd": "some/relative/dir"})) + .expect_err("a relative cwd must be rejected"); + assert_eq!(err.code, -32602); + assert!( + err.message.contains("absolute"), + "the rejection must say why: {}", + err.message + ); + } + // Same big-stack wrapper as // session_list_and_load_reach_the_durable_codewhale_sessions. #[test] diff --git a/crates/tui/src/commands/groups/session/resume.rs b/crates/tui/src/commands/groups/session/resume.rs index 72457d661b..8b14d8acad 100644 --- a/crates/tui/src/commands/groups/session/resume.rs +++ b/crates/tui/src/commands/groups/session/resume.rs @@ -117,10 +117,16 @@ fn import_container( // root set is re-pointed with it. Leaving the previous session's set in // place would let the next autosave stamp it onto the imported record — // durable roots bleed across sessions that never shared a directory. - app.workspace_roots = codewhale_core::normalize_workspace_roots( + // Round-26 M26-2 comment fix: `import_foreign` mints the record under + // the CURRENT workspace with an EMPTY root set, so this seed is the + // single-root shape by construction — the validating helper is used for + // uniformity with the other load faces (an empty set always passes). + app.workspace_roots = crate::tui::ui::seed_loaded_workspace_roots( &imported.metadata.workspace, &imported.metadata.workspace_roots, - ); + &imported.metadata.workspace, + ) + .unwrap_or_default(); app.view_stack.push(SessionPickerView::new_selecting( &app.workspace, app.ui_locale, diff --git a/crates/tui/src/commands/groups/session/session.rs b/crates/tui/src/commands/groups/session/session.rs index 12b8c4ee34..bfd4b2d1d6 100644 --- a/crates/tui/src/commands/groups/session/session.rs +++ b/crates/tui/src/commands/groups/session/session.rs @@ -179,7 +179,7 @@ pub fn fork_from_session(app: &mut App, session_id_or_prefix: &str) -> CommandRe Ok(roots) => roots, Err(err) => { return CommandResult::error(format!( - "Cannot fork: the source root set re-based onto {} would widen past it ({err:#}). Re-declare the roots on the fork.", + "Cannot fork: the source root set re-based onto {} would widen past it ({err:#}). The fork is refused; start it from a directory the set does not widen past, or clear the widening roots from the saved record outside the TUI.", app.workspace.display() )); } diff --git a/crates/tui/src/core/engine.rs b/crates/tui/src/core/engine.rs index 9ac5ef9be0..36e04c818b 100644 --- a/crates/tui/src/core/engine.rs +++ b/crates/tui/src/core/engine.rs @@ -6684,7 +6684,14 @@ impl Engine { self.session.auto_approve, self.session.approval_mode, ); - context.workspace_roots = self.session.workspace_roots.clone(); + // Round-26 B26-1 (latent site made safe): the per-turn live context + // re-assigns the pair on a clone that may share a memo Arc with an + // earlier turn's context — even a same-set assignment goes through + // `rebase_roots` so the memo can never outlive its pair. + context.rebase_roots( + self.session.workspace.clone(), + self.session.workspace_roots.clone(), + ); context.trust_mode = authority.trust_mode; context.auto_approve = authority.auto_approve; context.set_shell_policy(self.effective_turn_shell_policy(authority.shell_policy())); diff --git a/crates/tui/src/runtime_threads.rs b/crates/tui/src/runtime_threads.rs index 0dcf45c616..e5983118e1 100644 --- a/crates/tui/src/runtime_threads.rs +++ b/crates/tui/src/runtime_threads.rs @@ -6243,6 +6243,23 @@ impl RuntimeThreadManager { forked.updated_at = now; forked.latest_turn_id = None; forked.archived = false; + // Round-26 M26-1: this fork face (the live /undo, /patch-undo, and + // /retry routes) MINTS a new row exactly like `fork_thread` and now + // runs the same validating intake on the cloned set — a poisoned + // source row (super-root, primary-ancestor, over-cap) is rejected + // instead of duplicated into a fresh id. + let carried: Vec = source + .workspace_roots + .iter() + .filter(|root| **root != source.workspace) + .cloned() + .collect(); + forked.workspace_roots = + codewhale_core::validate_workspace_roots(&source.workspace, &carried).map_err( + |reason| { + anyhow::anyhow!("source thread root set no longer passes intake: {reason}") + }, + )?; let mut cloned_records = Vec::with_capacity(target_turn_idx); for source_turn in source_turns.iter().take(target_turn_idx) { diff --git a/crates/tui/src/runtime_threads/tests.rs b/crates/tui/src/runtime_threads/tests.rs index 82602a4dad..254164028d 100644 --- a/crates/tui/src/runtime_threads/tests.rs +++ b/crates/tui/src/runtime_threads/tests.rs @@ -12102,6 +12102,49 @@ fn seed_turns_with_user_messages( Ok(turn_ids) } +#[tokio::test] +async fn both_fork_faces_reject_a_poisoned_source_root_set() -> Result<()> { + // Round-26 M26-1 + m26-6: every fork face MINTS a new row, so every one + // validates the cloned set — `fork_thread` (the round-25 fix, unpinned + // until now) and `fork_at_user_message` (the live /undo, /patch-undo, + // /retry routes, added this round). A hand-edited row carrying the + // filesystem root is rejected with the intake reason instead of being + // duplicated into a fresh id. + let manager = test_manager(test_runtime_dir())?; + let workspace = std::env::temp_dir().join("codewhale-runtime-fork-poison"); + let thread = manager + .create_thread(CreateThreadRequest { + workspace: Some(workspace.clone()), + ..Default::default() + }) + .await?; + seed_turns_with_user_messages(&manager, &thread.id, &["first", "second"])?; + + // Poison the stored row directly (the load faces stay tolerant by + // design — this is exactly the input they exist to survive). + let mut poisoned = manager.get_thread(&thread.id).await?; + poisoned.workspace_roots = vec![workspace.clone(), std::path::PathBuf::from("/")]; + manager.store.save_thread(&poisoned)?; + + let bare = manager + .fork_thread(&thread.id) + .await + .expect_err("fork_thread must reject the poisoned source row"); + assert!( + bare.to_string().contains("no longer passes intake"), + "fork_thread: {bare:#}" + ); + let backtracked = manager + .fork_at_user_message(&thread.id, 0) + .await + .expect_err("fork_at_user_message must reject the poisoned source row too"); + assert!( + backtracked.to_string().contains("no longer passes intake"), + "fork_at_user_message: {backtracked:#}" + ); + Ok(()) +} + #[tokio::test] async fn fork_at_user_message_drops_tail_and_returns_user_text() -> Result<()> { // Seed three completed user/assistant turns. Backtracking with diff --git a/crates/tui/src/tools/approval_cache.rs b/crates/tui/src/tools/approval_cache.rs index 4cdcec7f00..008d19295e 100644 --- a/crates/tui/src/tools/approval_cache.rs +++ b/crates/tui/src/tools/approval_cache.rs @@ -158,9 +158,30 @@ fn hash_patch_paths(input: &serde_json::Value) -> String { use std::collections::hash_map::DefaultHasher; use std::hash::{Hash, Hasher}; + // Round-26 M26-3: fold the alias spellings and honor the top-level + // `path` override EXACTLY like execution does (a PathOverride wins and + // the payload headers become decoys) — the grouping key must cover the + // file the write actually lands on. The key used to hash only the + // headers, so the same patch body under two different `filePath` + // overrides shared one grant key and a session-approved family + // auto-approved a redirect to an arbitrary target (the B20-2 shell + // class, on the patch arm). + let mut folded = input.clone(); + if super::file::apply_param_aliases(&mut folded, super::file::PATH_ALIASES, "apply_patch") + .is_err() + { + // Alias conflict: execution fails the call too; fall through and + // key on the raw header set rather than under-keying. + } + if let Some(override_path) = folded.get("path").and_then(Value::as_str) { + let mut hasher = DefaultHasher::new(); + override_path.hash(&mut hasher); + return format!("override:{:x}", hasher.finish()); + } + let mut paths: Vec<&str> = Vec::new(); - match normalize_apply_patch_input(input) { + match normalize_apply_patch_input(&folded) { Ok(NormalizedApplyPatchInput::Replacement { entries, .. }) => { for change in entries { if let Some(path) = change.get("path").and_then(|v| v.as_str()) { @@ -378,6 +399,43 @@ mod tests { ); } + #[test] + fn grouping_key_rekeys_on_the_top_level_path_override() { + // Round-26 M26-3: execution's PathOverride wins over the payload + // headers (they become decoys), so the grouping key must cover the + // override — the same patch body under two different targets used + // to share one grant key, letting a session-approved family + // auto-approve a redirect to an arbitrary file (the B20-2 shell + // class, on the patch arm). Alias spellings fold first, exactly + // like preflight/execute. + let patch = "@@ -1,2 +1,2 @@\n old\n-value\n+new-value\n"; + let decoy = build_approval_grouping_key("apply_patch", &json!({"patch": patch})); + for alias in ["path", "file_path", "filePath"] { + let redirected = build_approval_grouping_key( + "apply_patch", + &json!({alias: ".git/hooks/pre-commit", "patch": patch}), + ); + assert_ne!( + redirected, decoy, + "an {alias} override must re-key the grant family away from the header set" + ); + } + // The same override target under different alias spellings is ONE + // family (the fold runs before hashing). + let canonical = build_approval_grouping_key( + "apply_patch", + &json!({"path": ".git/hooks/pre-commit", "patch": patch}), + ); + let alias_spellings = build_approval_grouping_key( + "apply_patch", + &json!({"filePath": ".git/hooks/pre-commit", "patch": patch}), + ); + assert_eq!( + canonical, alias_spellings, + "alias spellings of the same override collapse to one family" + ); + } + #[test] fn grouping_key_treats_replace_and_legacy_changes_as_the_same_path_set() { let canonical = build_approval_grouping_key( diff --git a/crates/tui/src/tools/revert_turn.rs b/crates/tui/src/tools/revert_turn.rs index dffb99406a..07d6490fd6 100644 --- a/crates/tui/src/tools/revert_turn.rs +++ b/crates/tui/src/tools/revert_turn.rs @@ -36,7 +36,9 @@ impl ToolSpec for RevertTurnTool { `turn_offset` is 1-based: 1 reverts the most recent turn, 2 reverts the previous one, \ and so on (max 50). Conversation history is NOT modified — only working-tree files are \ restored from the side-git snapshot repo. Snapshots cover the primary workspace root \ - only; writes under attached workspace roots are not rolled back." + only; writes under attached workspace roots are not rolled back — this sentence \ + ships for every session, including single-root ones whose tool schema therefore \ + differs from the base (recorded, round-26 M26-4d)." } fn input_schema(&self) -> Value { @@ -333,4 +335,17 @@ mod tests { "current" ); } + + #[test] + fn description_names_the_rollback_boundary_unconditionally() { + // Round-26 M26-4d: the boundary clause in the tool DESCRIPTION is an + // unconditional literal — every session's schema (single-root ones + // included) differs from base, so the description face needs its own + // pin, matching the response-face pins. + let description = RevertTurnTool::description(&RevertTurnTool); + assert!( + description.contains("attached workspace roots are not rolled back"), + "the description must keep naming the rollback boundary: {description}" + ); + } } diff --git a/crates/tui/src/tools/spec.rs b/crates/tui/src/tools/spec.rs index daba599891..3e83231b17 100644 --- a/crates/tui/src/tools/spec.rs +++ b/crates/tui/src/tools/spec.rs @@ -610,11 +610,14 @@ pub struct ToolExecutionState { /// each root's canonical spelling, canonicalizing once per context /// lifetime instead of once per `resolve_path` call (several judgments /// ride every tool call). Invariant: `workspace` and `workspace_roots` - /// are immutable for the context's lifetime — the constructors install a - /// fresh cache and `with_workspace_roots` replaces it; clones share it, - /// which is sound because clones carry identical roots. No code path - /// mutates the roots in place (surveyed; if one ever must, it must swap - /// this Arc first or the boundary would judge stale spellings). + /// change ONLY through [`ToolContext::rebase_roots`] (which swaps this + /// Arc for a fresh one) or at construction — clones share the Arc, which + /// is sound only while the pair stays identical. Round-26 B26-1 closed + /// the regression this comment's earlier "no in-place mutation" survey + /// missed: the worktree spawn/resume sites and the per-turn live context + /// used to assign the fields in place on a clone, so a parent-filled + /// memo kept judging the CHILD's file-tool containment against the + /// PARENT boundary (fail-open for worktree isolation). pub(crate) boundary_roots_cache: std::sync::Arc>>, /// Current sandbox policy #[allow(dead_code)] @@ -861,6 +864,25 @@ impl ToolContext { self } + /// Replace the (primary workspace, attached roots) pair on a LIVE + /// context and refresh the boundary memo atomically (round-26 B26-1). + /// + /// Cloned contexts share the parent's memo `Arc`; assigning the two + /// fields in place used to leave that shared memo filled with the + /// PARENT's boundary, so the child's file-tool containment judged + /// against the parent workspace plus its attached roots — for a + /// worktree child (whose boundary is the worktree alone) that passed + /// containment for the entire parent checkout: fail-open for exactly + /// the isolation the worktree contract names. Every site that moves a + /// context onto a different primary or root set MUST go through here; + /// the memo swap is not optional. Callers that change the roots derive + /// them into the sandbox policy separately (`rederive_sandbox_policy_roots`). + pub(crate) fn rebase_roots(&mut self, workspace: PathBuf, workspace_roots: Vec) { + self.workspace = workspace; + self.workspace_roots = workspace_roots; + self.boundary_roots_cache = std::sync::Arc::new(std::sync::OnceLock::new()); + } + /// Attach durable runtime services to tools. #[must_use] pub fn with_runtime_services(mut self, runtime: RuntimeToolServices) -> Self { diff --git a/crates/tui/src/tools/spec/tests.rs b/crates/tui/src/tools/spec/tests.rs index a69953591b..95fd8722c7 100644 --- a/crates/tui/src/tools/spec/tests.rs +++ b/crates/tui/src/tools/spec/tests.rs @@ -664,3 +664,74 @@ fn test_approval_requirement_default() { let level = ApprovalRequirement::default(); assert_eq!(level, ApprovalRequirement::Auto); } + +#[test] +fn rebased_roots_drop_the_parent_filled_boundary_memo() { + // Round-26 B26-1: a cloned context shares the parent's boundary memo + // Arc. The worktree spawn/resume sites used to clear/replace the root + // pair IN PLACE, so a parent that had already called resolve_path + // (filling the memo with the PARENT's boundary) left the child judging + // file-tool containment against the parent workspace plus its attached + // roots — the child could read the whole parent checkout through the + // exact isolation the worktree contract promises. `rebase_roots` swaps + // the pair AND the memo; this pin fills the parent memo first, exactly + // the shape the production probes showed was falsely covered before. + let base = tempfile::tempdir().expect("base tempdir"); + let parent_ws = base.path().join("parent-ws"); + std::fs::create_dir_all(&parent_ws).expect("parent dir"); + let attached = base.path().join("attached"); + std::fs::create_dir_all(&attached).expect("attached dir"); + let secret = attached.join("secret.txt"); + std::fs::write(&secret, "x").expect("secret"); + + // Parent: primary + attached root; one resolve_path FILLS the memo. + let parent = ToolContext::new(parent_ws.clone()).with_workspace_roots(vec![attached.clone()]); + let ok = parent + .resolve_path(secret.to_string_lossy().as_ref()) + .expect("the attached root admits the path for the parent"); + assert!(ok.starts_with(&attached)); + + // Child: a clone of the parent runtime's context, rebased onto a fresh + // worktree (the production spawn/resume shape). + let worktree = base.path().join("wt"); + std::fs::create_dir_all(&worktree).expect("worktree dir"); + let mut child = parent.clone(); + child.rebase_roots(worktree.clone(), Vec::new()); + + let inside = worktree.join("file.txt"); + std::fs::write(&inside, "x").expect("inside file"); + assert!( + child + .resolve_path(inside.to_string_lossy().as_ref()) + .is_ok(), + "the rebased child still resolves inside its own worktree" + ); + assert!( + matches!( + child.resolve_path(secret.to_string_lossy().as_ref()), + Err(ToolError::PathEscape { .. }) + ), + "the parent-filled memo must NOT survive the rebase: the parent's attached root is outside the child boundary" + ); + assert!( + matches!( + child.resolve_path( + parent_ws + .join("src") + .join("lib.rs") + .to_string_lossy() + .as_ref() + ), + Err(ToolError::PathEscape { .. }) + ), + "the parent's own workspace is outside the worktree child's boundary" + ); + + // Control: the untouched parent still admits the attached root (the + // rebase did not mutate the shared-clone parent's judgment). + assert!( + parent + .resolve_path(secret.to_string_lossy().as_ref()) + .is_ok() + ); +} diff --git a/crates/tui/src/tools/subagent/mod.rs b/crates/tui/src/tools/subagent/mod.rs index 7e74c4cab5..b632cade9c 100644 --- a/crates/tui/src/tools/subagent/mod.rs +++ b/crates/tui/src/tools/subagent/mod.rs @@ -5945,7 +5945,6 @@ impl SubAgentManager { // Resume in the interrupted child's workspace, not the caller's // (worktree/cwd children must not resume in the parent directory). let mut runtime = runtime; - runtime.context.workspace = workspace; if isolated_worktree { // Same isolation rule as a fresh worktree spawn: a worktree // child's boundary is the worktree alone, so the parent's @@ -5953,8 +5952,16 @@ impl SubAgentManager { // (neither `boundary_roots` nor the gate's sandbox policy may // resolve or write outside the worktree). Re-derive the cloned // sandbox policy as well — the exec lane consumes it verbatim. - runtime.context.workspace_roots = Vec::new(); + // `rebase_roots` (round-26 B26-1) also drops the parent-shared + // boundary memo with the pair swap. + runtime.context.rebase_roots(workspace, Vec::new()); rederive_sandbox_policy_roots(&mut runtime.context); + } else { + // A cwd-resumed child keeps the carried root set; the memo still + // refreshes because the primary moved (the boundary normalizes + // the set against the new primary). + let carried = runtime.context.workspace_roots.clone(); + runtime.context.rebase_roots(workspace, carried); } let options = SubAgentSpawnOptions { name: None, // the old session name stays owned by the terminal record @@ -9474,7 +9481,6 @@ async fn spawn_subagent_from_input( spawn_request.max_depth, ); if let Some(workspace) = child_workspace { - child_runtime.context.workspace = workspace.clone(); if spawn_request.worktree.is_some() { // A worktree child is an isolation boundary, not a wider // session: its boundary is the worktree alone, so the parent's @@ -9482,11 +9488,23 @@ async fn spawn_subagent_from_input( // could only resolve inside its worktree). The cloned sandbox // policy must be re-derived too — it was built over the parent's // full root set, and the exec lane consumes it verbatim. - child_runtime.context.workspace_roots = Vec::new(); + // `rebase_roots` (round-26 B26-1): the pair swap MUST also drop + // the parent-shared boundary memo, or the child's file-tool + // containment keeps judging against the parent's boundary. + child_runtime + .context + .rebase_roots(workspace.clone(), Vec::new()); rederive_sandbox_policy_roots(&mut child_runtime.context); + } else { + // An explicit `cwd:` swap without a worktree is non-isolating and + // keeps the parent's root set (disclosed in the PR description) — + // but the memo still refreshes: the boundary normalizes the + // carried set against the NEW primary. + let carried = child_runtime.context.workspace_roots.clone(); + child_runtime + .context + .rebase_roots(workspace.clone(), carried); } - // An explicit `cwd:` swap without a worktree is non-isolating and - // keeps the parent's root set (disclosed in the PR description). // A worktree child gets a distinct workspace-scoped plugin catalog. // Reusing the parent's registry here would leak workspace plugins (and // their authority receipts) across the exact isolation boundary the diff --git a/crates/tui/src/tui/ui/apply.rs b/crates/tui/src/tui/ui/apply.rs index dfe6931016..e8ca3f6124 100644 --- a/crates/tui/src/tui/ui/apply.rs +++ b/crates/tui/src/tui/ui/apply.rs @@ -1188,6 +1188,23 @@ pub(crate) async fn apply_command_result( return Ok(false); } }; + // Round-26 M26-2: a moved primary validates the carried set + // BEFORE any app mutation — the load refuses honestly instead + // of materializing a widening entry the intakes refuse. + let roots_seed = match crate::tui::ui::session_state::seed_loaded_workspace_roots( + &session.metadata.workspace, + &session.metadata.workspace_roots, + &app.workspace, + ) { + Ok(roots) => roots, + Err(reason) => { + app.status_message = Some(format!( + "Failed to load session {}: {reason}", + path.display() + )); + return Ok(false); + } + }; let fresh_config = match Config::load(app.config_path.clone(), app.config_profile.as_deref()) { Ok(config) => config, @@ -1215,14 +1232,11 @@ pub(crate) async fn apply_command_result( // (no multi-root UI): seed the app state only after every // fallible restore step has succeeded, so a failed load // cannot leave the *current* session's engine inheriting a - // foreign root set through the next routine re-sync. The seed - // routes through the same normalize the writers use, so a - // legacy or hand-edited record cannot seed an entry the - // intake filter would have dropped. - app.workspace_roots = codewhale_core::normalize_workspace_roots( - &app.workspace, - &session.metadata.workspace_roots, - ); + // foreign root set through the next routine re-sync. The + // seed was validated against the load primary above (M26-2): + // a pure load normalizes tolerantly, a moved primary refused + // before any mutation. + app.workspace_roots = roots_seed; sync_runtime_workspace_state(task_manager, app.workspace.clone()).await; if respawn { let _ = engine_handle.send(Op::Shutdown).await; diff --git a/crates/tui/src/tui/ui/event_loop.rs b/crates/tui/src/tui/ui/event_loop.rs index 063b84f9e7..c2c3541fee 100644 --- a/crates/tui/src/tui/ui/event_loop.rs +++ b/crates/tui/src/tui/ui/event_loop.rs @@ -582,45 +582,71 @@ pub async fn run_tui( }; match load_result { - Ok(Some(saved)) => match manager.load_session_goal(&saved.metadata.id) { - Ok(goal) => { - match apply_loaded_session_with_goal(&mut app, config, &saved, goal.as_ref()) { - Ok(()) => { - // The engine below is built and synced from App - // state: without this seed, a multi-root session - // resumed from the CLI runs single-root for the - // whole process lifetime. The seed routes through - // the same normalize the writers use, so a legacy - // or hand-edited record cannot seed an entry the - // intake filter would have dropped. - app.workspace_roots = codewhale_core::normalize_workspace_roots( - &app.workspace, - &saved.metadata.workspace_roots, - ); - // Name the inherited set in the transcript: the - // roots arrived from another host and no header - // chrome reports them. - if let Some(notice) = workspace_roots_notice( - app.ui_locale, - &app.workspace, - &app.workspace_roots, + Ok(Some(saved)) => { + // Round-26 M26-2: the CLI resume MOVES the session onto the + // process workspace when they differ — validate the carried + // set before applying anything (a widening entry is refused + // honestly; a pure load in the session's own directory keeps + // the tolerant normalizer). + let roots_seed = match crate::tui::ui::session_state::seed_loaded_workspace_roots( + &saved.metadata.workspace, + &saved.metadata.workspace_roots, + &app.workspace, + ) { + Ok(roots) => Some(roots), + Err(reason) => { + app.status_message = Some(format!( + "Failed to resume session {}: {reason}", + crate::session_manager::truncate_id(&saved.metadata.id), + )); + None + } + }; + if let Some(roots_seed) = roots_seed { + match manager.load_session_goal(&saved.metadata.id) { + Ok(goal) => { + match apply_loaded_session_with_goal( + &mut app, + config, + &saved, + goal.as_ref(), ) { - app.add_message(HistoryCell::System { content: notice }); + Ok(()) => { + // The engine below is built and synced from App + // state: without this seed, a multi-root session + // resumed from the CLI runs single-root for the + // whole process lifetime. The seed was validated + // above (M26-2): pure load → tolerant normalize, + // moved primary → validated before any mutation. + app.workspace_roots = roots_seed; + // Name the inherited set in the transcript: the + // roots arrived from another host and no header + // chrome reports them. + if let Some(notice) = workspace_roots_notice( + app.ui_locale, + &app.workspace, + &app.workspace_roots, + ) { + app.add_message(HistoryCell::System { content: notice }); + } + app.status_message = Some(format!( + "Resumed session: {}", + crate::session_manager::truncate_id(&saved.metadata.id) + )); + } + Err(err) => { + app.status_message = + Some(format!("Failed to restore session: {err}")); + } } - app.status_message = Some(format!( - "Resumed session: {}", - crate::session_manager::truncate_id(&saved.metadata.id) - )); } Err(err) => { - app.status_message = Some(format!("Failed to restore session: {err}")); + app.status_message = + Some(format!("Failed to restore session goal: {err}")); } } } - Err(err) => { - app.status_message = Some(format!("Failed to restore session goal: {err}")); - } - }, + } Ok(None) => { app.status_message = Some("No sessions found to resume".to_string()); } diff --git a/crates/tui/src/tui/ui/handlers.rs b/crates/tui/src/tui/ui/handlers.rs index ac6ea92e1c..efa43dc674 100644 --- a/crates/tui/src/tui/ui/handlers.rs +++ b/crates/tui/src/tui/ui/handlers.rs @@ -1148,6 +1148,24 @@ pub(crate) async fn handle_view_events( match manager.load_session(&session_id) { Ok(session) => { + // Round-26 M26-2: switching onto a session whose + // recorded primary differs from the current workspace + // validates the carried set BEFORE any mutation — a + // widening entry refuses the switch honestly. + let roots_seed = + match crate::tui::ui::session_state::seed_loaded_workspace_roots( + &session.metadata.workspace, + &session.metadata.workspace_roots, + &app.workspace, + ) { + Ok(roots) => roots, + Err(reason) => { + app.status_message = Some(format!( + "Failed to load session {session_id}: {reason}" + )); + continue; + } + }; let next_config = config.clone(); let respawn = match apply_loaded_session_config_snapshot( app, @@ -1169,13 +1187,10 @@ pub(crate) async fn handle_view_events( // this field. Without it, switching sessions either // leaks the previous session's set into this one or // silently strips this session's persisted set. The - // seed routes through the same normalize the writers - // use, so a legacy or hand-edited record cannot seed - // an entry the intake filter would have dropped. - app.workspace_roots = codewhale_core::normalize_workspace_roots( - &app.workspace, - &session.metadata.workspace_roots, - ); + // seed was validated against the load primary above + // (M26-2): a pure load normalizes tolerantly, a moved + // primary refused before any mutation. + app.workspace_roots = roots_seed; sync_runtime_workspace_state(task_manager, app.workspace.clone()).await; if respawn { let _ = engine_handle.send(Op::Shutdown).await; diff --git a/crates/tui/src/tui/ui/session_state.rs b/crates/tui/src/tui/ui/session_state.rs index de6c83356b..0e2c0a545a 100644 --- a/crates/tui/src/tui/ui/session_state.rs +++ b/crates/tui/src/tui/ui/session_state.rs @@ -613,6 +613,36 @@ pub(crate) async fn sync_runtime_workspace_state( task_manager.set_default_workspace(workspace).await; } +/// Round-26 M26-2: the load/resume faces' root-set seed. The core resume +/// lane's own rule, applied to the TUI faces that used to seed the +/// tolerant normalizer even when the session MOVED onto a different +/// primary — a carried entry that would widen past the new primary (an +/// ancestor, a super-root) was kept alive in the materialized sandbox for +/// the process lifetime and durably re-minted by the next autosave, the +/// exact shape `/cd`, `/fork`, runtime PATCH and every intake refuse. A +/// PURE load (primary unchanged) keeps the tolerant normalizer so legacy +/// and hand-edited rows stay loadable; a MOVE validates and refuses +/// honestly. +pub(crate) fn seed_loaded_workspace_roots( + record_primary: &std::path::Path, + persisted_roots: &[std::path::PathBuf], + target_primary: &std::path::Path, +) -> std::result::Result, String> { + if record_primary == target_primary { + return Ok(codewhale_core::normalize_workspace_roots( + target_primary, + persisted_roots, + )); + } + codewhale_core::validate_workspace_roots(target_primary, persisted_roots).map_err(|reason| { + format!( + "the session's recorded root set would widen past {} ({reason}); \ + load it in its own directory, or clear the widening roots from the saved record", + target_primary.display() + ) + }) +} + /// One-line human disclosure for a session that carries accessible roots /// beside its primary workspace, capped like the model-facing /// `Accessible folders:` line. The turn-meta envelope is model-facing only @@ -833,12 +863,11 @@ pub(crate) async fn switch_workspace( // entries that already disclose the set — without this notice the // carried roots silently changed their anchor (or were dropped by the // re-normalization) with no in-band disclosure. - if carried_additional { - if let Some(notice) = + if carried_additional + && let Some(notice) = workspace_roots_notice(app.ui_locale, &workspace, &app.workspace_roots) - { - app.add_message(HistoryCell::System { content: notice }); - } + { + app.add_message(HistoryCell::System { content: notice }); } // The receipt rides the closing line instead of being assigned earlier: // an unconditional "Workspace: X" assignment after the persist block used @@ -1755,3 +1784,58 @@ mod workspace_switch_persistence_tests { assert!(!ja.contains("Failed to snapshot"), "{ja}"); } } + +#[cfg(test)] +mod seed_loaded_workspace_roots_tests { + use super::seed_loaded_workspace_roots; + + #[test] + fn validates_moves_and_tolerates_pure_loads() { + // Round-26 M26-2: the four TUI load/resume faces used to seed the + // tolerant normalizer even when the session MOVED onto a different + // primary, keeping a carried ancestor/super-root alive in the live + // sandbox — the shape /cd, /fork, runtime PATCH and every intake + // refuse. A move now validates (the refusal names the widening + // entry); a pure load in the session's own directory keeps the + // tolerant normalizer so legacy rows stay loadable. + let record_primary = std::path::PathBuf::from("/work/project"); + let carried = vec![ + std::path::PathBuf::from("/work/project"), + std::path::PathBuf::from("/home/alice"), + ]; + + // Pure load: tolerated (the set normalizes under the record primary). + let seeded = seed_loaded_workspace_roots(&record_primary, &carried, &record_primary) + .expect("a pure load keeps the tolerant normalizer"); + assert_eq!(seeded, carried); + + // Move: the ancestor entry is refused with the intake reason. + let moved_primary = std::path::PathBuf::from("/home/alice/elsewhere"); + let err = seed_loaded_workspace_roots(&record_primary, &carried, &moved_primary) + .expect_err("a move must refuse a carried ancestor of the new primary"); + assert!( + err.contains("widen") && err.contains("ancestor"), + "the refusal names the widening entry: {err}" + ); + + // Move onto a primary the carried set does not widen past stays fine. + let ok = seed_loaded_workspace_roots( + &record_primary, + &[ + std::path::PathBuf::from("/work/project"), + std::path::PathBuf::from("/srv/data"), + ], + &moved_primary, + ) + .expect("a carried sibling root survives a move"); + assert_eq!( + ok, + vec![ + moved_primary.clone(), + std::path::PathBuf::from("/work/project"), + std::path::PathBuf::from("/srv/data"), + ], + "the move seeds the new primary plus the carried set unchanged" + ); + } +} From 9e8912329c63b60e699714ad0c458d80a0979d92 Mon Sep 17 00:00:00 2001 From: qiuYliangM <185303122+qiuYliangM@users.noreply.github.com> Date: Sat, 3 Oct 2026 00:17:39 +0800 Subject: [PATCH 10/10] fix(tui): close the round-27/28 blocking set MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit B27-1/B27-2 (both from the round-26 M26-2 shape): the TUI load faces re-home the app onto the RECORD primary during restore, so the seed is a pure load under that primary — the 'moved primary validates' arm seeded against the pre-restore app.workspace instead, materializing the launch directory as an undeclared writable root (persisted by the next autosave) and falsely rejecting primary-led rows from subdirectories (the record primary was never stripped). seed_loaded_workspace_roots now anchors at the record primary with the tolerant normalizer; the three faces seed at their original post-restore spots. Pin: seeds_under_the_record_primary_and_never_the_launch_directory. B27-3 + A28-3: the apply_patch grouping key is built from the REAL parser's plan (preflight_apply_patch) — the top-level override keys only in the patch form (replace-form top levels are decoys execution never reads), every accepted +++ spelling normalizes into the key, and deletions key under a separate delete marker. The old ad-hoc scan keyed an approved override grant onto arbitrary replace-writes and keyed all non-b/-spelled sections into one shared no_files family. Pins extended: replace-decoy equivalence, a/b-spelling collapse, delete-vs-write re-key. A28-1: resume/fork/start reject a RELATIVE cwd exactly like the empty spelling — the degenerate collapse used to destroy the declared root set and persist the broken primary, bricking later resumes. Pin: resume_with_a_relative_cwd_is_rejected_like_the_empty_spelling (row untouched). A28-2: ACP session/load validates the persisted root set before arming the registry — a poisoned row is refused with the intake reason instead of silently granting a fully-writable posture (REST resume 400s the same row). Pin: session_load_rejects_a_poisoned_persisted_root_set. A28-4/M27-1: the two macOS-deterministic fixture bugs fixed — the rebased-roots pin compares against the canonical attached spelling, and the snapshot nested-plain-root dir exists before the containment judgment (missing dirs canonicalize to the raw /var spelling). M27-2: both runtime fork faces clear the source session handle and task_id — ensure_engine_loaded prefers the handle and would replay the FULL source history, dropped tail included. Pin: both_fork_faces_clear_the_source_session_handle. M27-3: the CLI fork runs the validating intake on the source set before minting the copy. M27-4: the /tool empty-or-relative cwd rejection is typed as an IntakeValidationError so the app-server maps it to 400, per the lane's own comment. Verification: fork-ci clippy gate clean; core 117/0; full codewhale-tui --lib 12,032 passed with 4 parallel flakes (remote_control x3, clipboard wl_paste) that pass single-threaded. Signed-off-by: qiuYliangM <185303122+qiuYliangM@users.noreply.github.com> --- crates/core/src/lib.rs | 75 +++++++-- crates/tui/src/acp_server.rs | 72 +++++++++ .../tui/src/commands/groups/session/resume.rs | 11 +- crates/tui/src/lib.rs | 12 +- crates/tui/src/runtime_threads.rs | 12 ++ crates/tui/src/runtime_threads/tests.rs | 37 +++++ crates/tui/src/snapshot/mod.rs | 12 +- crates/tui/src/tools/approval_cache.rs | 144 ++++++++++++------ crates/tui/src/tools/spec/tests.rs | 7 +- crates/tui/src/tui/ui/apply.rs | 30 +--- crates/tui/src/tui/ui/event_loop.rs | 91 ++++------- crates/tui/src/tui/ui/handlers.rs | 33 ++-- crates/tui/src/tui/ui/session_state.rs | 89 +++++------ 13 files changed, 398 insertions(+), 227 deletions(-) diff --git a/crates/core/src/lib.rs b/crates/core/src/lib.rs index 79f2e58540..dfad5556e8 100644 --- a/crates/core/src/lib.rs +++ b/crates/core/src/lib.rs @@ -390,10 +390,17 @@ fn resolve_resume_roots( params_cwd: Option<&PathBuf>, params_roots: Option<&[PathBuf]>, ) -> Result<(PathBuf, Vec)> { + // A28-1: a RELATIVE cwd is rejected like the empty spelling — the + // validator's degenerate collapse would otherwise silently destroy the + // whole declared root set AND persist the relative primary, bricking + // every later resume of the row (the empty guard's own rationale, + // verbatim, covers this spelling). if let Some(cwd) = params_cwd - && cwd.as_os_str().is_empty() + && (cwd.as_os_str().is_empty() || !cwd.is_absolute()) { - return Err(IntakeValidationError::err("cwd must not be empty")); + return Err(IntakeValidationError::err( + "cwd must be a non-empty absolute path", + )); } if let Some(roots) = params_roots { let cwd = params_cwd @@ -1096,11 +1103,15 @@ impl ThreadManager { pub fn fork_thread(&mut self, params: &ThreadForkParams) -> Result> { // An explicit empty cwd would persist a vacuous primary root // (`starts_with("")` is true for every path); reject it like the - // resume lane does instead of poisoning the fork durably. + // resume lane does instead of poisoning the fork durably. A28-1: a + // relative cwd is rejected for the same reason — the collapse would + // destroy the carried root set and persist the broken primary. if let Some(cwd) = params.cwd.as_ref() - && cwd.as_os_str().is_empty() + && (cwd.as_os_str().is_empty() || !cwd.is_absolute()) { - return Err(IntakeValidationError::err("cwd must not be empty")); + return Err(IntakeValidationError::err( + "cwd must be a non-empty absolute path", + )); } let parent = self.store.get_thread(¶ms.thread_id)?; let Some(parent) = parent else { @@ -1475,11 +1486,15 @@ impl Runtime { } ThreadRequest::Start(params) => { // Same empty-cwd rejection as resume/fork: an explicit `""` - // would otherwise persist a vacuous primary root. + // would otherwise persist a vacuous primary root. A28-1: a + // relative cwd is the same destruction class (the collapse + // drops the declared roots and persists the broken primary). if let Some(cwd) = params.cwd.as_ref() - && cwd.as_os_str().is_empty() + && (cwd.as_os_str().is_empty() || !cwd.is_absolute()) { - return Err(IntakeValidationError::err("cwd must not be empty")); + return Err(IntakeValidationError::err( + "cwd must be a non-empty absolute path", + )); } let cwd = params.cwd.clone().unwrap_or_else(|| { std::env::current_dir().unwrap_or_else(|_| PathBuf::from(".")) @@ -1767,9 +1782,12 @@ impl Runtime { workspace_roots: &[PathBuf], ) -> Result { if cwd.as_os_str().is_empty() || !cwd.is_absolute() { - return Err(anyhow::anyhow!( + // M27-4: typed as an intake error so the app-server maps it to + // HTTP 400 like every other IntakeValidationError (the bare + // anyhow made it a 500, contradicting the lane's own comment). + return Err(IntakeValidationError::err( "invoke_tool workspace slot must be an absolute directory; \ - got an empty or relative cwd" + got an empty or relative cwd", )); } let workspace_roots = validate_workspace_roots(cwd, workspace_roots)?; @@ -4534,7 +4552,7 @@ mod tests { .resume_thread_with_history(¶ms, "deepseek".to_string()) .expect_err("empty cwd must be rejected"); assert!( - format!("{err:#}").contains("cwd must not be empty"), + format!("{err:#}").contains("non-empty absolute"), "unexpected error: {err:#}" ); let persisted = manager @@ -4559,9 +4577,42 @@ mod tests { .fork_thread(¶ms) .expect_err("empty cwd must be rejected"); assert!( - format!("{err:#}").contains("cwd must not be empty"), + format!("{err:#}").contains("non-empty absolute"), + "unexpected error: {err:#}" + ); + } + + #[test] + fn resume_with_a_relative_cwd_is_rejected_like_the_empty_spelling() { + // A28-1: a relative cwd used to pass the guard and hit the + // validator's degenerate collapse — the declared root set was + // silently destroyed, the relative primary persisted, and every + // later resume of the row failed (invoke_tool hard-rejects a + // relative workspace). The empty guard's own rationale applies + // verbatim; both spellings are now refused at the same gate. + let mut manager = seed_multi_root_parent("resume-relative-cwd"); + let mut params = resume_params("thread-parent"); + params.cwd = Some(PathBuf::from(".")); + params.workspace_roots = Some(vec![PathBuf::from("/a"), PathBuf::from("/b")]); + let err = manager + .resume_thread_with_history(¶ms, "deepseek".to_string()) + .expect_err("a relative cwd must be rejected"); + assert!( + format!("{err:#}").contains("non-empty absolute"), "unexpected error: {err:#}" ); + // The persisted row is untouched — no destroyed root set, no + // relative primary minted. + let persisted = manager + .state_store() + .get_thread("thread-parent") + .expect("read thread") + .expect("thread persisted"); + assert_eq!( + persisted.cwd, + PathBuf::from("/repo/main"), + "a rejected resume must not mint the relative primary" + ); } #[test] diff --git a/crates/tui/src/acp_server.rs b/crates/tui/src/acp_server.rs index 4ea47d8012..2d97cc1f30 100644 --- a/crates/tui/src/acp_server.rs +++ b/crates/tui/src/acp_server.rs @@ -1611,7 +1611,21 @@ impl AcpServer { "session {session_id} has an empty workspace" ))); } + // A28-2: the persisted set is armed VERBATIM into the tool registry + // and the per-turn sandbox — a hand-edited or poisoned record + // carrying `/` (or any primary ancestor) gave the rehydrated + // session a fully-writable posture silently, where the REST resume + // lane answers 400 for the same row and the TUI lane tolerates with + // a disclosure. Validate here: a poisoned row is refused with the + // intake reason (the IDE can repair the record); a clean row passes + // byte-identically (same primary, no re-anchor). let workspace_roots = saved.metadata.workspace_roots.clone(); + let workspace_roots = codewhale_core::validate_workspace_roots(&cwd, &workspace_roots) + .map_err(|reason| { + AcpError::invalid_params(format!( + "session {session_id} root set no longer passes intake: {reason}" + )) + })?; let tool_registry = Arc::new(build_acp_tool_registry( &self.config, &cwd, @@ -2832,6 +2846,64 @@ mod tests { assert_eq!(err.code, -32602); } + fn session_load_rejects_a_poisoned_persisted_root_set_body() { + // A28-2: session/load armed the persisted set verbatim — a record + // carrying `/` gave the rehydrated IDE session a fully-writable + // posture where REST resume answers 400 for the same row. The load + // now runs the validating intake and refuses with the reason. + let _guard = crate::test_support::lock_test_env(); + let home = tempfile::TempDir::new().expect("isolated codewhale home"); + let _home_guard = + crate::test_support::EnvVarGuard::set("CODEWHALE_HOME", home.path().as_os_str()); + let workspace = home.path().join("ws"); + std::fs::create_dir_all(&workspace).expect("workspace dir"); + let mut saved = crate::session_manager::create_saved_session( + &[Message { + role: Role::User, + content: vec![ContentBlock::Text { + text: "poisoned".to_string(), + cache_control: None, + }], + }], + "deepseek-v4-flash", + &workspace, + 0, + None, + ); + saved.metadata.workspace_roots = vec![workspace.clone(), std::path::PathBuf::from("/")]; + let session_id = saved.metadata.id.clone(); + let manager = crate::session_manager::SessionManager::new( + crate::session_manager::default_sessions_dir().expect("sessions dir"), + ) + .expect("session manager"); + manager.save_session(&saved).expect("seed poisoned record"); + + let mut server = AcpServer::new( + Config::default(), + "deepseek-v4-flash".to_string(), + workspace.clone(), + ); + let err = server + .load_session(json!({"sessionId": session_id})) + .expect_err("a poisoned root set must be refused at load"); + assert_eq!(err.code, -32602); + assert!( + err.message.contains("no longer passes intake"), + "the refusal carries the intake reason: {}", + err.message + ); + } + + #[test] + fn session_load_rejects_a_poisoned_persisted_root_set() { + std::thread::Builder::new() + .stack_size(16 * 1024 * 1024) + .spawn(session_load_rejects_a_poisoned_persisted_root_set_body) + .expect("spawn test thread") + .join() + .expect("test thread"); + } + #[test] fn session_new_rejects_relative_cwd() { // Round-26 m26-6 pin for the round-25 guard: a relative cwd cannot diff --git a/crates/tui/src/commands/groups/session/resume.rs b/crates/tui/src/commands/groups/session/resume.rs index 8b14d8acad..d17b971b2d 100644 --- a/crates/tui/src/commands/groups/session/resume.rs +++ b/crates/tui/src/commands/groups/session/resume.rs @@ -117,16 +117,13 @@ fn import_container( // root set is re-pointed with it. Leaving the previous session's set in // place would let the next autosave stamp it onto the imported record — // durable roots bleed across sessions that never shared a directory. - // Round-26 M26-2 comment fix: `import_foreign` mints the record under - // the CURRENT workspace with an EMPTY root set, so this seed is the - // single-root shape by construction — the validating helper is used for - // uniformity with the other load faces (an empty set always passes). + // B27-1/B27-2: seeded under the record's own primary — `import_foreign` + // mints the record under the CURRENT workspace with an EMPTY root set, + // so this is the single-root pure-load shape by construction. app.workspace_roots = crate::tui::ui::seed_loaded_workspace_roots( &imported.metadata.workspace, &imported.metadata.workspace_roots, - &imported.metadata.workspace, - ) - .unwrap_or_default(); + ); app.view_stack.push(SessionPickerView::new_selecting( &app.workspace, app.ui_locale, diff --git a/crates/tui/src/lib.rs b/crates/tui/src/lib.rs index ba9dc54723..8ccbdd0e6a 100644 --- a/crates/tui/src/lib.rs +++ b/crates/tui/src/lib.rs @@ -8425,7 +8425,17 @@ fn fork_session( // constructed (empty) metadata persists, and the disk-authority // lifecycle merge keeps re-erasing any later correction - the same // sticky erasure the in-app `/fork` stamp prevents. - forked.metadata.workspace_roots = saved.metadata.workspace_roots.clone(); + // M27-3: the CLI fork mints a session-row copy like every other fork + // face — the same validating intake applies, so an out-of-band poisoned + // source row cannot ride the fork to durable propagation past the + // source's own runtime resume rejection. + forked.metadata.workspace_roots = match codewhale_core::validate_workspace_roots( + &saved.metadata.workspace, + &saved.metadata.workspace_roots, + ) { + Ok(roots) => roots, + Err(reason) => bail!("source session root set no longer passes intake: {reason}"), + }; manager.save_session(&forked)?; let source_title = saved.metadata.title.trim(); diff --git a/crates/tui/src/runtime_threads.rs b/crates/tui/src/runtime_threads.rs index e5983118e1..5c1ae1f93e 100644 --- a/crates/tui/src/runtime_threads.rs +++ b/crates/tui/src/runtime_threads.rs @@ -6106,6 +6106,12 @@ impl RuntimeThreadManager { forked.updated_at = now; forked.latest_turn_id = None; forked.archived = false; + // M27-2: the fork must NOT inherit the source's session handle — + // ensure_engine_loaded prefers it and would replay the FULL source + // history into the model context (for fork_at_user_message that + // includes exactly the turns the backtrack dropped). + forked.session_id = None; + forked.task_id = None; // A fork MINTS a new row, so the cloned set passes the same // validating intake the create lane applies (round-24 P3, closing // the "a bare fork fails loud" over-generalization): a poisoned @@ -6243,6 +6249,12 @@ impl RuntimeThreadManager { forked.updated_at = now; forked.latest_turn_id = None; forked.archived = false; + // M27-2: same session-handle clearing as fork_thread — the undo + // contract must hold at the model-context layer too, or + // ensure_engine_loaded replays the full source history (dropped + // tail included) through the inherited handle. + forked.session_id = None; + forked.task_id = None; // Round-26 M26-1: this fork face (the live /undo, /patch-undo, and // /retry routes) MINTS a new row exactly like `fork_thread` and now // runs the same validating intake on the cloned set — a poisoned diff --git a/crates/tui/src/runtime_threads/tests.rs b/crates/tui/src/runtime_threads/tests.rs index 254164028d..841c2b41f5 100644 --- a/crates/tui/src/runtime_threads/tests.rs +++ b/crates/tui/src/runtime_threads/tests.rs @@ -12145,6 +12145,43 @@ async fn both_fork_faces_reject_a_poisoned_source_root_set() -> Result<()> { Ok(()) } +#[tokio::test] +async fn both_fork_faces_clear_the_source_session_handle() -> Result<()> { + // M27-2: ensure_engine_loaded prefers thread.session_id and would + // replay the FULL source session file into the fork's model context — + // for the backtrack faces that includes exactly the turns the fork + // dropped. Both runtime fork faces clear the handle (and task_id, the + // sibling owner identity). + let manager = test_manager(test_runtime_dir())?; + let workspace = std::env::temp_dir().join("codewhale-runtime-fork-handle"); + let thread = manager + .create_thread(CreateThreadRequest { + workspace: Some(workspace.clone()), + ..Default::default() + }) + .await?; + manager + .set_thread_session_id(&thread.id, "source-session-handle") + .await + .expect("seed source session handle"); + seed_turns_with_user_messages(&manager, &thread.id, &["first", "second"])?; + + let bare = manager.fork_thread(&thread.id).await?; + assert_eq!( + bare.session_id, None, + "fork_thread must not inherit the source session handle" + ); + assert_eq!(bare.task_id, None); + + let (backtracked, _) = manager.fork_at_user_message(&thread.id, 0).await?; + assert_eq!( + backtracked.session_id, None, + "the backtrack fork must not replay the dropped tail through the inherited handle" + ); + assert_eq!(backtracked.task_id, None); + Ok(()) +} + #[tokio::test] async fn fork_at_user_message_drops_tail_and_returns_user_text() -> Result<()> { // Seed three completed user/assistant turns. Backtracking with diff --git a/crates/tui/src/snapshot/mod.rs b/crates/tui/src/snapshot/mod.rs index 0b12c887c9..c5e7c03c5e 100644 --- a/crates/tui/src/snapshot/mod.rs +++ b/crates/tui/src/snapshot/mod.rs @@ -172,11 +172,13 @@ mod tests { "an inward-symlink root must fire the boundary note" ); // A plain root nested under the primary keeps the old behavior even - // though the primary itself now also canonicalizes. - assert!(!restore_covers_primary_only( - &workspace, - &[workspace.join("nested")] - )); + // though the primary itself now also canonicalizes. A28-4: the dir + // must EXIST first — a missing target canonicalizes to the raw + // /var spelling while the primary canonicalizes to /private/var, + // mixing spellings and spuriously firing the note on stock macOS. + let nested_plain = workspace.join("nested"); + std::fs::create_dir_all(&nested_plain).expect("mkdir nested"); + assert!(!restore_covers_primary_only(&workspace, &[nested_plain])); // A symlink INSIDE the primary pointing at a nested directory stays // inside on both spellings — no note. let nested = workspace.join("nested-real"); diff --git a/crates/tui/src/tools/approval_cache.rs b/crates/tui/src/tools/approval_cache.rs index 008d19295e..31cf9194a0 100644 --- a/crates/tui/src/tools/approval_cache.rs +++ b/crates/tui/src/tools/approval_cache.rs @@ -37,7 +37,6 @@ use serde_json::Value; use sha2::{Digest, Sha256}; use crate::command_safety::classify_command; -use crate::tools::apply_patch::{NormalizedApplyPatchInput, normalize_apply_patch_input}; /// The fingerprint of a tool call — stable enough to match repeated /// calls but specific enough to avoid privilege confusion. @@ -84,6 +83,15 @@ pub fn build_approval_grouping_key(tool_name: &str, input: &serde_json::Value) - let tool_name = crate::tools::canonical_action::canonical_action_alias(tool_name, input); let fingerprint = match tool_name { "apply_patch" => { + // B27-3 + A28-3: key on the REAL parser's plan — + // `preflight_apply_patch`, the same alias-folded judgment every + // plan-time gate uses. The round-26 ad-hoc scan (a) keyed the + // top-level override for replace-forms where execution never + // reads it (an approved patch grant then auto-approved an + // arbitrary replace-write under the same decoy override), and + // (b) collected only `+++ b/` headers, keying `+++ a/`-spelled, + // bare, timestamped, and /dev/null-delete sections into one + // shared `no_files` family that covers arbitrary targets. let paths_hash = hash_patch_paths(input); format!("patch:{paths_hash}") } @@ -153,64 +161,44 @@ fn shell_cwd_operand(input: &serde_json::Value) -> Option<&str> { .filter(|cwd| !cwd.is_empty()) } -/// Hash the sorted set of file paths referenced by a patch input. +/// Hash the write targets of a patch input, taken from the REAL parser's +/// plan (`preflight_apply_patch`): the top-level override keys ONLY in the +/// patch form (execution's PathOverride-wins semantics; replace-form top +/// levels are decoys), otherwise the touched file set keys as parsed — +/// every accepted `+++` spelling (`a/`/`b/` prefixes, bare, tab timestamps) +/// normalizes to the execution target, and deletions key under a separate +/// delete marker so a delete grant never covers writes (B27-3/A28-3). fn hash_patch_paths(input: &serde_json::Value) -> String { use std::collections::hash_map::DefaultHasher; use std::hash::{Hash, Hasher}; - // Round-26 M26-3: fold the alias spellings and honor the top-level - // `path` override EXACTLY like execution does (a PathOverride wins and - // the payload headers become decoys) — the grouping key must cover the - // file the write actually lands on. The key used to hash only the - // headers, so the same patch body under two different `filePath` - // overrides shared one grant key and a session-approved family - // auto-approved a redirect to an arbitrary target (the B20-2 shell - // class, on the patch arm). let mut folded = input.clone(); if super::file::apply_param_aliases(&mut folded, super::file::PATH_ALIASES, "apply_patch") .is_err() { - // Alias conflict: execution fails the call too; fall through and - // key on the raw header set rather than under-keying. + // Alias conflict: execution fails the call too; a distinct family + // keeps the key from silently matching a folded spelling. + return "alias_conflict".to_string(); } - if let Some(override_path) = folded.get("path").and_then(Value::as_str) { - let mut hasher = DefaultHasher::new(); - override_path.hash(&mut hasher); - return format!("override:{:x}", hasher.finish()); - } - - let mut paths: Vec<&str> = Vec::new(); - - match normalize_apply_patch_input(&folded) { - Ok(NormalizedApplyPatchInput::Replacement { entries, .. }) => { - for change in entries { - if let Some(path) = change.get("path").and_then(|v| v.as_str()) { - paths.push(path); + match super::apply_patch::preflight_apply_patch(&folded) { + Ok(plan) => { + let mut hasher = DefaultHasher::new(); + if let Some(override_path) = plan.path_override.as_deref() { + "override".hash(&mut hasher); + override_path.hash(&mut hasher); + } else { + for path in &plan.touched_files { + path.hash(&mut hasher); } - } - } - Ok(NormalizedApplyPatchInput::Patch(patch_text)) => { - for line in patch_text.lines() { - if let Some(rest) = line.strip_prefix("+++ b/") { - paths.push(rest.trim()); + for path in &plan.deletes { + "delete".hash(&mut hasher); + path.hash(&mut hasher); } } + format!("{:x}", hasher.finish()) } - Err(_) => {} + Err(_) => "unparseable".to_string(), } - - paths.sort(); - paths.dedup(); - - if paths.is_empty() { - return "no_files".to_string(); - } - - let mut hasher = DefaultHasher::new(); - for path in &paths { - path.hash(&mut hasher); - } - format!("{:x}", hasher.finish()) } /// Parse the host portion from a URL input. @@ -434,6 +422,72 @@ mod tests { canonical, alias_spellings, "alias spellings of the same override collapse to one family" ); + + // B27-3: in the REPLACE form the top-level path is a decoy execution + // never reads — the key must follow the entries, so an approved + // patch-form override grant cannot cover a replace-write hiding + // behind the same decoy. + let replace_decoy = build_approval_grouping_key( + "apply_patch", + &json!({"path": ".git/hooks/pre-commit", "replace": [{"path": "notes.txt", "content": "x"}]}), + ); + let replace_plain = build_approval_grouping_key( + "apply_patch", + &json!({"replace": [{"path": "notes.txt", "content": "x"}]}), + ); + assert_eq!( + replace_decoy, replace_plain, + "a replace-form top-level path is a decoy and must not key the family" + ); + assert_ne!( + replace_plain, + build_approval_grouping_key( + "apply_patch", + &json!({"replace": [{"path": "other.txt", "content": "x"}]}), + ), + "different replace targets are different families" + ); + + // A28-3: header spellings the old ad-hoc scan missed (`+++ a/`, bare + // `+++ x`) key to the REAL target, and a single-file grant must not + // cover a two-file patch whose second section rides such a spelling. + // `+++ a/x`-spelled and `+++ b/x`-spelled writes of the same target + // are ONE family (the parser normalizes both to x) — the old ad-hoc + // `+++ b/`-only scan keyed the a-spelling into the shared `no_files` + // family, whose grant then covered arbitrary targets (A28-3). + let b_spelled = build_approval_grouping_key( + "apply_patch", + &json!({"patch": "--- a/.env\n+++ b/.env\n@@ -1,1 +1,1 @@\n-old\n+new\n"}), + ); + let a_spelled = build_approval_grouping_key( + "apply_patch", + &json!({"patch": "--- b/.env\n+++ a/.env\n@@ -1,1 +1,1 @@\n-old\n+new\n"}), + ); + assert_eq!( + b_spelled, a_spelled, + "header-prefix spellings of the same target collapse to one family" + ); + assert_ne!( + b_spelled, + build_approval_grouping_key( + "apply_patch", + &json!({"patch": "--- a/other.txt\n+++ b/other.txt\n@@ -1,1 +1,1 @@\n-old\n+new\n"}), + ), + "different targets stay different families" + ); + // Deletions key under a delete marker: a delete grant covers no write. + let deletion = build_approval_grouping_key( + "apply_patch", + &json!({"patch": "--- a/old.txt\n+++ /dev/null\n@@ -1 +0,0 @@\n-gone\n"}), + ); + let write_same_path = build_approval_grouping_key( + "apply_patch", + &json!({"patch": "--- a/old.txt\n+++ b/old.txt\n@@ -1,1 +1,1 @@\n-old\n+new\n"}), + ); + assert_ne!( + deletion, write_same_path, + "a deletion keys apart from a write of the same path" + ); } #[test] diff --git a/crates/tui/src/tools/spec/tests.rs b/crates/tui/src/tools/spec/tests.rs index 95fd8722c7..73f5827a2a 100644 --- a/crates/tui/src/tools/spec/tests.rs +++ b/crates/tui/src/tools/spec/tests.rs @@ -689,7 +689,12 @@ fn rebased_roots_drop_the_parent_filled_boundary_memo() { let ok = parent .resolve_path(secret.to_string_lossy().as_ref()) .expect("the attached root admits the path for the parent"); - assert!(ok.starts_with(&attached)); + // M27-1: resolve_path canonicalizes its return — compare against the + // canonical spelling so the pin survives a symlinked temp root (macOS + // /var vs /private/var), instead of aborting before the isolation + // assertions on every stock macOS box. + let attached_canonical = attached.canonicalize().expect("canonical attached"); + assert!(ok.starts_with(&attached_canonical)); // Child: a clone of the parent runtime's context, rebased onto a fresh // worktree (the production spawn/resume shape). diff --git a/crates/tui/src/tui/ui/apply.rs b/crates/tui/src/tui/ui/apply.rs index e8ca3f6124..a462b284fc 100644 --- a/crates/tui/src/tui/ui/apply.rs +++ b/crates/tui/src/tui/ui/apply.rs @@ -1188,23 +1188,6 @@ pub(crate) async fn apply_command_result( return Ok(false); } }; - // Round-26 M26-2: a moved primary validates the carried set - // BEFORE any app mutation — the load refuses honestly instead - // of materializing a widening entry the intakes refuse. - let roots_seed = match crate::tui::ui::session_state::seed_loaded_workspace_roots( - &session.metadata.workspace, - &session.metadata.workspace_roots, - &app.workspace, - ) { - Ok(roots) => roots, - Err(reason) => { - app.status_message = Some(format!( - "Failed to load session {}: {reason}", - path.display() - )); - return Ok(false); - } - }; let fresh_config = match Config::load(app.config_path.clone(), app.config_profile.as_deref()) { Ok(config) => config, @@ -1232,11 +1215,14 @@ pub(crate) async fn apply_command_result( // (no multi-root UI): seed the app state only after every // fallible restore step has succeeded, so a failed load // cannot leave the *current* session's engine inheriting a - // foreign root set through the next routine re-sync. The - // seed was validated against the load primary above (M26-2): - // a pure load normalizes tolerantly, a moved primary refused - // before any mutation. - app.workspace_roots = roots_seed; + // foreign root set through the next routine re-sync. Seeded + // under the RECORD primary (B27-1/B27-2): the restore has + // already re-homed the app there, so this is a pure load and + // the launch directory never enters the set. + app.workspace_roots = crate::tui::ui::session_state::seed_loaded_workspace_roots( + &session.metadata.workspace, + &session.metadata.workspace_roots, + ); sync_runtime_workspace_state(task_manager, app.workspace.clone()).await; if respawn { let _ = engine_handle.send(Op::Shutdown).await; diff --git a/crates/tui/src/tui/ui/event_loop.rs b/crates/tui/src/tui/ui/event_loop.rs index c2c3541fee..3b16c8132f 100644 --- a/crates/tui/src/tui/ui/event_loop.rs +++ b/crates/tui/src/tui/ui/event_loop.rs @@ -582,71 +582,46 @@ pub async fn run_tui( }; match load_result { - Ok(Some(saved)) => { - // Round-26 M26-2: the CLI resume MOVES the session onto the - // process workspace when they differ — validate the carried - // set before applying anything (a widening entry is refused - // honestly; a pure load in the session's own directory keeps - // the tolerant normalizer). - let roots_seed = match crate::tui::ui::session_state::seed_loaded_workspace_roots( - &saved.metadata.workspace, - &saved.metadata.workspace_roots, - &app.workspace, - ) { - Ok(roots) => Some(roots), - Err(reason) => { - app.status_message = Some(format!( - "Failed to resume session {}: {reason}", - crate::session_manager::truncate_id(&saved.metadata.id), - )); - None - } - }; - if let Some(roots_seed) = roots_seed { - match manager.load_session_goal(&saved.metadata.id) { - Ok(goal) => { - match apply_loaded_session_with_goal( - &mut app, - config, - &saved, - goal.as_ref(), + Ok(Some(saved)) => match manager.load_session_goal(&saved.metadata.id) { + Ok(goal) => { + match apply_loaded_session_with_goal(&mut app, config, &saved, goal.as_ref()) { + Ok(()) => { + // The engine below is built and synced from App + // state: without this seed, a multi-root session + // resumed from the CLI runs single-root for the + // whole process lifetime. Seeded under the RECORD + // primary (B27-1/B27-2): the restore re-homes the + // app onto it, so this is a pure load and the + // launch directory never enters the set. + app.workspace_roots = + crate::tui::ui::session_state::seed_loaded_workspace_roots( + &saved.metadata.workspace, + &saved.metadata.workspace_roots, + ); + // Name the inherited set in the transcript: the + // roots arrived from another host and no header + // chrome reports them. + if let Some(notice) = workspace_roots_notice( + app.ui_locale, + &app.workspace, + &app.workspace_roots, ) { - Ok(()) => { - // The engine below is built and synced from App - // state: without this seed, a multi-root session - // resumed from the CLI runs single-root for the - // whole process lifetime. The seed was validated - // above (M26-2): pure load → tolerant normalize, - // moved primary → validated before any mutation. - app.workspace_roots = roots_seed; - // Name the inherited set in the transcript: the - // roots arrived from another host and no header - // chrome reports them. - if let Some(notice) = workspace_roots_notice( - app.ui_locale, - &app.workspace, - &app.workspace_roots, - ) { - app.add_message(HistoryCell::System { content: notice }); - } - app.status_message = Some(format!( - "Resumed session: {}", - crate::session_manager::truncate_id(&saved.metadata.id) - )); - } - Err(err) => { - app.status_message = - Some(format!("Failed to restore session: {err}")); - } + app.add_message(HistoryCell::System { content: notice }); } + app.status_message = Some(format!( + "Resumed session: {}", + crate::session_manager::truncate_id(&saved.metadata.id) + )); } Err(err) => { - app.status_message = - Some(format!("Failed to restore session goal: {err}")); + app.status_message = Some(format!("Failed to restore session: {err}")); } } } - } + Err(err) => { + app.status_message = Some(format!("Failed to restore session goal: {err}")); + } + }, Ok(None) => { app.status_message = Some("No sessions found to resume".to_string()); } diff --git a/crates/tui/src/tui/ui/handlers.rs b/crates/tui/src/tui/ui/handlers.rs index efa43dc674..2d6da878b2 100644 --- a/crates/tui/src/tui/ui/handlers.rs +++ b/crates/tui/src/tui/ui/handlers.rs @@ -1148,24 +1148,6 @@ pub(crate) async fn handle_view_events( match manager.load_session(&session_id) { Ok(session) => { - // Round-26 M26-2: switching onto a session whose - // recorded primary differs from the current workspace - // validates the carried set BEFORE any mutation — a - // widening entry refuses the switch honestly. - let roots_seed = - match crate::tui::ui::session_state::seed_loaded_workspace_roots( - &session.metadata.workspace, - &session.metadata.workspace_roots, - &app.workspace, - ) { - Ok(roots) => roots, - Err(reason) => { - app.status_message = Some(format!( - "Failed to load session {session_id}: {reason}" - )); - continue; - } - }; let next_config = config.clone(); let respawn = match apply_loaded_session_config_snapshot( app, @@ -1186,11 +1168,16 @@ pub(crate) async fn handle_view_events( // and the respawned engine plus every re-sync read // this field. Without it, switching sessions either // leaks the previous session's set into this one or - // silently strips this session's persisted set. The - // seed was validated against the load primary above - // (M26-2): a pure load normalizes tolerantly, a moved - // primary refused before any mutation. - app.workspace_roots = roots_seed; + // silently strips this session's persisted set. + // Seeded under the RECORD primary (B27-1/B27-2): the + // restore re-homes the app onto it, so this is a pure + // load and the previous session's directory never + // enters the set. + app.workspace_roots = + crate::tui::ui::session_state::seed_loaded_workspace_roots( + &session.metadata.workspace, + &session.metadata.workspace_roots, + ); sync_runtime_workspace_state(task_manager, app.workspace.clone()).await; if respawn { let _ = engine_handle.send(Op::Shutdown).await; diff --git a/crates/tui/src/tui/ui/session_state.rs b/crates/tui/src/tui/ui/session_state.rs index 0e2c0a545a..5a80db18c4 100644 --- a/crates/tui/src/tui/ui/session_state.rs +++ b/crates/tui/src/tui/ui/session_state.rs @@ -613,34 +613,27 @@ pub(crate) async fn sync_runtime_workspace_state( task_manager.set_default_workspace(workspace).await; } -/// Round-26 M26-2: the load/resume faces' root-set seed. The core resume -/// lane's own rule, applied to the TUI faces that used to seed the -/// tolerant normalizer even when the session MOVED onto a different -/// primary — a carried entry that would widen past the new primary (an -/// ancestor, a super-root) was kept alive in the materialized sandbox for -/// the process lifetime and durably re-minted by the next autosave, the -/// exact shape `/cd`, `/fork`, runtime PATCH and every intake refuse. A -/// PURE load (primary unchanged) keeps the tolerant normalizer so legacy -/// and hand-edited rows stay loadable; a MOVE validates and refuses -/// honestly. +/// The load/resume faces' root-set seed (round-26 M26-2, corrected by +/// round-27 B27-1/B27-2). The TUI restore path RE-HOMES the app onto the +/// record's own primary (`apply_workspace_runtime_state` runs inside +/// `apply_loaded_session_*`), so by the time the engine consumes the set +/// this is a PURE LOAD in the core lane's terms — the tolerant normalizer +/// under the RECORD primary is the correct semantics, legacy and +/// hand-edited rows stay loadable, and the LAUNCH directory never enters +/// the set. The round-26 "moved primary validates" shape seeded against +/// the pre-restore `app.workspace` instead: the launch directory became an +/// undeclared writable root (B27-1, persisted by the next autosave) and +/// primary-led rows loaded from a subdirectory were falsely rejected by +/// the ancestor rule because the record primary was not stripped first +/// (B27-2 — core's real move arm, `/cd` and `/fork` all strip it). A +/// genuine primary MOVE keeps using the core lane's own validating path +/// (`resolve_resume_roots`), which strips the old primary before +/// validating; no TUI face moves the primary. pub(crate) fn seed_loaded_workspace_roots( record_primary: &std::path::Path, persisted_roots: &[std::path::PathBuf], - target_primary: &std::path::Path, -) -> std::result::Result, String> { - if record_primary == target_primary { - return Ok(codewhale_core::normalize_workspace_roots( - target_primary, - persisted_roots, - )); - } - codewhale_core::validate_workspace_roots(target_primary, persisted_roots).map_err(|reason| { - format!( - "the session's recorded root set would widen past {} ({reason}); \ - load it in its own directory, or clear the widening roots from the saved record", - target_primary.display() - ) - }) +) -> Vec { + codewhale_core::normalize_workspace_roots(record_primary, persisted_roots) } /// One-line human disclosure for a session that carries accessible roots @@ -1790,52 +1783,42 @@ mod seed_loaded_workspace_roots_tests { use super::seed_loaded_workspace_roots; #[test] - fn validates_moves_and_tolerates_pure_loads() { - // Round-26 M26-2: the four TUI load/resume faces used to seed the - // tolerant normalizer even when the session MOVED onto a different - // primary, keeping a carried ancestor/super-root alive in the live - // sandbox — the shape /cd, /fork, runtime PATCH and every intake - // refuse. A move now validates (the refusal names the widening - // entry); a pure load in the session's own directory keeps the - // tolerant normalizer so legacy rows stay loadable. + fn seeds_under_the_record_primary_and_never_the_launch_directory() { + // Round-27 B27-1 regression pin: the round-26 shape seeded against + // the PRE-restore app.workspace, so a record loaded from a different + // directory ended up with the LAUNCH directory materialized as an + // undeclared writable root (persisted by the next autosave). The + // restore re-homes the app onto the record primary, so the seed + // anchors there — the launch directory can never enter the set. let record_primary = std::path::PathBuf::from("/work/project"); + let launch_dir = std::path::PathBuf::from("/home/alice/elsewhere"); let carried = vec![ std::path::PathBuf::from("/work/project"), std::path::PathBuf::from("/home/alice"), ]; - - // Pure load: tolerated (the set normalizes under the record primary). - let seeded = seed_loaded_workspace_roots(&record_primary, &carried, &record_primary) - .expect("a pure load keeps the tolerant normalizer"); + let seeded = seed_loaded_workspace_roots(&record_primary, &carried); assert_eq!(seeded, carried); - - // Move: the ancestor entry is refused with the intake reason. - let moved_primary = std::path::PathBuf::from("/home/alice/elsewhere"); - let err = seed_loaded_workspace_roots(&record_primary, &carried, &moved_primary) - .expect_err("a move must refuse a carried ancestor of the new primary"); assert!( - err.contains("widen") && err.contains("ancestor"), - "the refusal names the widening entry: {err}" + !seeded.contains(&launch_dir), + "the launch directory must never be seeded as a root: {seeded:?}" ); - - // Move onto a primary the carried set does not widen past stays fine. - let ok = seed_loaded_workspace_roots( + // The launch directory being an ANCESTOR of nothing relevant is not + // consulted at all — no move arm exists on the TUI faces (B27-2: + // primary-led rows load from any directory without false refusal). + let primary_led = seed_loaded_workspace_roots( &record_primary, &[ std::path::PathBuf::from("/work/project"), std::path::PathBuf::from("/srv/data"), ], - &moved_primary, - ) - .expect("a carried sibling root survives a move"); + ); assert_eq!( - ok, + primary_led, vec![ - moved_primary.clone(), std::path::PathBuf::from("/work/project"), std::path::PathBuf::from("/srv/data"), ], - "the move seeds the new primary plus the carried set unchanged" + "a primary-led row is a pure load from any directory (B27-2)" ); } }