Repository navigation
Conversation
Remote project identities are not local paths. Route plugin directory and classified preview reads through a separate owner-only Host service that preserves scope, canonical containment and credential protections. Capture workspace admission before awaiting and reject stale bindings or unloaded plugins, including legacy SDK calls. Keep older Hosts compatible with existing remote operations and report missing preview support clearly. Refs vastsa#1711
Include the upstream tool-identity and Gemini Live fixes that landed after the remote file candidate was published. Preserve the shared branch history and validate the combined tree before updating the pull request. Refs vastsa#1711
Include the maintainer's newly merged notification changes without altering them. Validate the remote file candidate against this updated upstream tree before publishing the branch update. Refs vastsa#1711
Keep the remote Host file service within the same per-directory result limit as local plugin reads. Share the limit through the SDK so the two implementations cannot drift, and cover the boundary with a large-directory regression.
…dex/review-pr1824
vastsa
left a comment
vastsa
left a comment
There was a problem hiding this comment.
Thanks for the careful scope, Host-side checks, and cross-repository validation. I confirmed #1711 is a real defect: the remote project identity is opaque, while the current bundled File Manager still uses local filesystem reads.
I can't merge this as the fix yet because this PR leaves apps/desktop/resources/plugins/pi.file-manager and its pinned bundle unchanged. The new workspacePluginFiles route has no consumer in the shipped app, so the reported File Manager path still fails. The companion plugin PR #5 is still open; please coordinate the pair and include the normal pinned-plugin provenance update before asking to land this as the #1711 fix. Then validate the resulting bundled user path on the updated integration candidate.
I added a small follow-up commit on this branch to make Host listings share the SDK's 1,000-entry limit, with a regression test. The current candidate passes the scoped Host/RACP/SDK and Desktop broker suites, typecheck, lint and docs checks.
Default remote-file acceptance to the shipped plugin and record the loaded directory, so a passing development-plugin run cannot stand in for a completed bundled update. Keep the paired release gate explicit in both delivery specifications. Repair the two CI test assumptions exposed by the updated integration candidate: permit attributes on the main pane and supply the WebSocket close reason at the transport fixture boundary.
Preserve the upstream window stacking correction while preparing the remote File Manager delivery. Validate the resulting integration state without rewriting the shared contributor or maintainer commits.
Refresh the paired File Manager delivery against the current target branch, keeping the original contributors' file-reference and activity disclosure repairs intact. Revalidate the affected boundaries and plugin journey on the combined candidate without rewriting history.
|
I've retained your listing-limit follow-up and updated the validation records. The bundled-delivery gap is still open. The companion plugin PR #5 prepares version 0.9.1, and I've requested its review and release. Once the accepted version is published, I'll update the bundled runtime and provenance pins, then validate the actual bundled path on the refreshed integration candidate. The passing candidate tests do not establish shipped acceptance; issue #1711 remains unresolved until that delivery is complete. |
Preserve both ADR entries when integrating current main so the scoped remote-file repair remains reviewable alongside the AskTool draft fix. Initialize the newly required draft map in the existing restoration test fixture; production state already supplies it. Keep the original restoration assertions and timeouts intact.
Keep the remote-file candidate current with the newly merged empty-reply persistence repair without changing its production implementation. Supply the new completion-notice dependency in two existing persistence test fixtures so terminal and shutdown regression checks continue to exercise the original assertions.
Main now filters every empty assistant row unless it carries a tool, a structured error, accepted steering or a trusted completion reply. The older source assertion still required the removed failed-status clause. Keep the complete new exclusion guard in the regression assertion and retain the executable structured-error persistence checks. Integrate the latest marketplace repair without altering its production behavior.
…date Keep the remote-file candidate current with the accepted tab-close repair and its geometry regression. Preserve the upstream implementation and both branches of the documented acceptance scenarios.
Two Linux certificate preflights stopped after the expected baseline with no indication of which later operation hung. Log each probe and cleanup phase so another failure identifies the pending operation directly. Keep every TLS, proxy, redirect and cancellation assertion and the existing deadlines intact. Integrate the current upstream tool-abort repair while retaining shared history and its production implementation.
Assertions in HTTPS and proxy event callbacks escape the scenario catch. Electron then opens its default error dialog, hiding the assertion and blocking the probe until the outer process deadline kills it. Report uncaught fixture errors and exit with failure so Linux CI exposes the actual assertion. A real Electron fault-injection comparison reproduces the blocked dialog before this change and visible exit code 1 afterward.
The tool-abort repair moved detached Bash exclusion into the process cancellation branch. The older source assertion still expected the previous outer conditional and failed despite preserving that exclusion. Assert the current local-background None branch and registration path. Include exact viewport measurements when the unchanged long-history reader-position assertion fails, so Linux failures are diagnosable.
Preserve the upstream test corrections and browser lifecycle changes while retaining the scoped remote workspace read implementation and its ADR entry. Drop a duplicate AskTool fixture field from the merge. The refreshed candidate passes targeted Desktop regressions, scoped protocol and plugin checks, workspace builds, and Desktop typecheck. Local Electron acceptance is not run because its runtime is missing; the paired plugin release and shipped bundle update remain pending.
The newly merged visualization feature appended its acceptance scenario at the same location as remote File Manager coverage. Keep both sections intact while incorporating the current main without rewriting history. Preserve all upstream runtime changes and the paired-release blocker. The refreshed candidate passes targeted Desktop and runtime regressions, shared contracts, builds, typecheck, and static documentation checks.
|
Re-reviewed the current delivery state. As your latest update notes, the bundled File Manager and its provenance pin still do not consume |
The Host route alone leaves the shipped panel on local filesystem reads. Bundle the pinned companion consumer as an explicitly identified Desktop hotfix, retaining the accepted search-theme repair and source provenance. Its version supersedes stale installed copies without claiming publication. Exercise the actual bundled process and view, including real remote bytes, stale-workspace rejection, read-only controls and restored local saving. Integrate current main and retain the pending official-release requirement. Refs vastsa#1711
Seraph-x
changed the title
|
The earlier branch was incomplete: it supplied the Host/SDK route but left the actual bundled consumer unchanged. Commit I followed the Desktop hotfix pattern already used by #1861 and marked this version Please review whether this explicitly pinned Desktop hotfix is an acceptable delivery path, or whether the official companion release remains a prerequisite. I have not treated #1711 as resolved. The rewritten PR description records the two local packaging timeouts, unrun native/platform checks and the successful scoped validations; the new GitHub checks are still running. |
Problem
Part of #1711. The earlier candidate added scoped Host/SDK reads but left the bundled File Manager on local Node fs. The opaque remote project identity therefore still failed in the panel users actually receive.
Changes
workspacePluginFilesroute, canonical containment, plugin read scopes, credential protection and stale-workspace checks.0.9.1-pi.1, pinned to companion plugin PR #5 commitf47ce21fab3c59f3f4b94d30f3e3a0c8124447e1. Include the remote SDK consumer, built view and PDF license notices.This is an explicitly identified Desktop hotfix, not an upstream or marketplace release. It follows the local hotfix approach already used by #1861. Companion PR #5 remains unmerged and unpublished. Maintainer acceptance of this delivery approach, or completion of the requested official paired release, is still required. Issue #1711 must remain open. Remote editing/search/Git/watch remain outside this repair.
Validation
Head
5d25468ed2a5235b5576ef31f552b144f7d1fc1eincorporates main541471d55648df021b232b5d01f0e1dd14cbb033.Before updating the bundle, the actual bundled regression returned
NOT_FOUND; the default Electron journey remained on Loading and failed after its original 15-second wait. After updating it, the same default directory, without a development-plugin argument, passed four complete Electron journeys: six scenario groups and eleven remote requests per run.The production process/view traverses Desktop's broker, loopback RACP and real Host filesystem. Coverage includes nested text/image bytes, credential hiding, read-only controls, disconnect/recovery, stale preview/ancestor races, restored local Browser/editor discovery, and actual local saving. The project-record lookup/authentication bootstrap are fixture boundaries; this does not test an external SSH tunnel.
Additional local results (macOS arm64, Node 24.13.0, Electron 43.6.0):
e8b6041cb5d3d4eab2b68a1e7fa61a8c7089235d9918f4a418541bd60cd109b3.Failures and limits
The first native-watch check could not receive filesystem events inside the sandbox; the unchanged checks passed with native events allowed. The first runtime full run had a process-readiness timing failure; its isolated tests and the complete repeat with two file workers passed with repository-default timeouts.
The pi-host full suite is not locally green: its initial packaging assertion encountered macOS
/varversus/private/varspelling. With a canonical temporary root and one file worker, 65 tests passed, one skipped, and two unchanged packaging cases still exceeded their default five-second deadlines. Neither assertions/timeouts nor packaging implementation were modified.No local Rust toolchain is available, so the added native version-ordering assertions have not run locally. Full Desktop, external SSH and native Windows/Linux acceptance were not rerun locally for this update. All six GitHub checks for this head passed: JS build/typecheck/lint/architecture/tests, Rust format/lint/tests, Windows transcript-cache/native checks, Trusted extensions/GenUI Electron E2E, docs, latest-base gate. Full Desktop CI: 4,400 passed, 20 skipped, 0 failed (4,420 total). pi-host CI: 64 passed, 4 skipped, 0 failed. The native assertions ran in CI; local limitations and earlier failures above remain recorded. GitHub merge candidate
ae2022434f26b1fb640c1353ec2d38ed3a4cd893has exactly the same tracked tree as this tested head. Successful checks do not imply official companion publication or maintainer delivery acceptance.