app/src-tauri/src/commands/terminal_commands.rs

@@ -196,6 +196,12 @@ pub async fn upload_host_file_to_terminal(
     host_path: String,
     state: State<'_, AppState>,
 ) -> Result<String, String> {
+    // The drop target is a host path chosen by the webview, not by the OS drag
+    // itself, so it gets the same host-read policy as the Files pane's upload:
+    // absolute, no traversal, and nothing out of a hidden directory
+    // (`~/.ssh`, `~/.aws`) or a system location.
+    let host_path = crate::commands::file_commands::validate_host_read_path(&host_path)?;
+
     let container_id = state.exec_manager.get_container_id(&session_id).await?;
 
     let meta = tokio::fs::metadata(&host_path)

app/src-tauri/src/docker/exec.rs

@@ -611,11 +611,29 @@ async fn exec_oneshot_inner(
 
     // The output stream draining doesn't strictly guarantee inspect_exec has the
     // final exit_code populated yet, so poll until the exec reports finished.
-    let exit_code = wait_for_exec_exit(&exec.id).await.unwrap_or(0);
+    let exit_code = require_exit_code(wait_for_exec_exit(&exec.id).await)?;
 
     Ok((combined, exit_code))
 }
 
+/// Turn "the exit code could not be determined" into an error rather than a 0.
+///
+/// `unwrap_or(0)` is how a rename that never happened reported success: callers
+/// branch on `code != 0`, so an unreadable status silently became "it worked",
+/// the UI closed its rename box and the file had not moved. An exec whose
+/// outcome cannot be established has not been established to have succeeded —
+/// fail closed and let the caller surface it.
+///
+/// The `test -e` probe in `rename_container_path` also fails closed under this:
+/// it propagates the error instead of reading an undeterminable status as
+/// "the destination does not exist".
+fn require_exit_code(code: Option<i64>) -> Result<i64, String> {
+    code.ok_or_else(|| {
+        "Could not determine whether the command finished (Docker did not report an exit status)"
+            .to_string()
+    })
+}
+
 /// Poll `inspect_exec` until the exec reports finished and return its exit code.
 /// Returns `None` if the code can't be determined (inspect error, or the exec
 /// doesn't report finished within ~1s — which shouldn't happen once its output
@@ -666,6 +684,16 @@ mod tests {
         assert!(buf.is_empty());
     }
 
+    #[test]
+    fn an_undeterminable_exit_status_is_an_error_not_a_zero() {
+        // The bug this guards: `unwrap_or(0)` made every caller that branches on
+        // `code != 0` — rename, mkdir — report success for an exec whose outcome
+        // nobody could read.
+        assert_eq!(require_exit_code(Some(0)).unwrap(), 0);
+        assert_eq!(require_exit_code(Some(1)).unwrap(), 1);
+        assert!(require_exit_code(None).is_err());
+    }
+
     #[test]
     fn the_bridge_budget_is_far_smaller_than_the_general_one() {
         // The auth bridge re-reads container-controlled procfs every 2s, so it