Files
Triple-C/app/src/components/projects/home/config/WorkspaceSection.tsx
T
shadow-testandClaude Opus 5 9472cb3c4c Resolve host paths before mounting them, and stop reading stored data as choice
Four fixes that share a shape: a value already on disk, or one spelled
around a check, being taken at face value.

`/..` bind-mounted the entire host filesystem read-write. `is_filesystem_root`
was purely lexical — trim trailing separators, refuse what was left only if it
was empty or a bare `C:` — and nothing in the file ever called `canonicalize`,
so `/..`, `/./`, `/home/..`, `/etc/../` and `C:\..` all passed. The daemon
resolves them: `docker run -v /..:/mnt/probe` mounts the host root, and the app
mounts read-*write* into a container whose agent has passwordless sudo. It is
the escalation `check_mount_name_stays_under_workspace` exists to close,
reached through the host-path half of the mount instead of the mount-name half.

`classify_mount_source` replaces it and asks the OS: `canonicalize` applies
`..`, follows symlinks, and resolves 8.3 aliases and UNC spellings on Windows.
A path that cannot be resolved — `projects.json` synced from another machine,
a folder not created yet — falls back to a lexical collapse rather than being
refused, because refusing would make such a project unsavable; the gap is
bounded, since what resolution adds is a property of paths that exist. A path
that names no location at all (`C:x`, a relative path) is refused rather than
guessed at. Same check now guards `ssh_key_path` and `ca_cert_path`, whose
read-only mounts were whole-host disclosure at /tmp/.host-ssh.

Custom env var names had no charset check anywhere, so `BASH_FUNC_stat%%` —
bash's wire format for an exported shell function, body in the value — reached
the container environment verbatim. Latent today because the image's /bin/sh is
dash, but the pre-commit scrub runs `/bin/sh -c` as root and nothing pins that.
Keys are now shell identifiers, on the project and the global list both, with
the same grandfathering the folder rows get: a stored key is admitted, a new or
edited one is not.

The blank workspace row was persisted. The comment said it was dropped on save;
the code computed the filtered list and then saved the unfiltered one, so
"+ Add folder" plus a blur stored `{"Target": "/workspace/", "Source": ""}` and
the project could never be started or recreated again. Every save in the
section now goes through one filter, and a blur that changed nothing saves
nothing.

Widening the five `ClaudeCodeSettings` booleans to `Option<bool>` reinterpreted
every stored record. They were plain `bool`s that always serialised, so every
project ever saved carries an explicit `"env_scrub": false` that nobody chose —
and under the new merge that `Some(false)` beats a global `Some(true)`, where
the old rule let the global win. Upgrading silently turned five settings off,
"strip credentials from subprocess environments" among them. Deserialisation
now goes through a shim that dates the record by the presence of the
pre-widening `enable_session_recap` key and reads its `false`s as unset. The
fields skip serialising when unset, so an older binary can still parse
`projects.json` after a downgrade — a `null` would fail to parse and take the
whole list down, since `ProjectsStore` parses all-or-nothing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc
2026-08-23 17:02:03 -07:00

197 lines
7.2 KiB
TypeScript

import { useEffect, useState } from "react";
import { open } from "@tauri-apps/plugin-dialog";
import type { Project, ProjectPath } from "../../../../lib/types";
import Button from "../../../ui/Button";
import Field, { ConfigGroup, inputClass, monoInputClass } from "../../../ui/Field";
interface Props {
project: Project;
save: (patch: Partial<Project>) => Promise<boolean>;
disabled: boolean;
}
/** Whether two folder lists are the same rows in the same order. */
function sameRows(a: ProjectPath[], b: ProjectPath[]): boolean {
return (
a.length === b.length &&
a.every((row, i) => row.host_path === b[i].host_path && row.mount_name === b[i].mount_name)
);
}
export default function WorkspaceSection({ project, save, disabled }: Props) {
const [name, setName] = useState(project.name);
const [paths, setPaths] = useState<ProjectPath[]>(project.paths ?? []);
useEffect(() => {
setName(project.name);
setPaths(project.paths ?? []);
}, [project]);
/**
* Persist a folder list, minus the rows that are only in it because the UI
* put them there.
*
* **The blank row must never reach the store.** "+ Add folder" inserts
* `{host_path: "", mount_name: ""}` deliberately, and `create_container`
* mounts every stored row unfiltered — a stored blank one becomes
* `{"Target": "/workspace/", "Source": ""}`, which the daemon rejects with
* `field Source must not be empty`. The project then cannot be started or
* recreated at all, from a click and a blur. `AddProjectDialog` has always
* filtered this; this section computed the filtered list and then saved the
* unfiltered one.
*
* Every save goes through here for that reason — Browse and Remove write the
* list too, and either can be holding a blank row from an earlier click.
*/
const persist = (rows: ProjectPath[]) => {
const filled = rows.filter((p) => p.host_path.trim() || p.mount_name.trim());
return save({ paths: filled });
};
/**
* Save only when every row is fully filled in.
*
* Both inputs save on blur, so tabbing from the host path to the mount name
* fires a save with the name still empty. `update_project` now validates —
* a half-filled row is refused — so the unconditional save turned an ordinary
* keystroke into an error toast. A blank row is *not* incomplete: the
* "+ Add folder" button adds one deliberately, and it is dropped on save.
*
* A blur that changed nothing saves nothing, which is what keeps the blank
* row on screen while it is being filled in: persisting the filtered list
* would round-trip through `project` and take the empty row away under the
* cursor.
*/
const saveIfComplete = () => {
const filled = paths.filter((p) => p.host_path.trim() || p.mount_name.trim());
const halfFilled = filled.some((p) => !p.host_path.trim() || !p.mount_name.trim());
if (halfFilled) return;
if (sameRows(filled, project.paths ?? [])) return;
return persist(paths);
};
return (
<ConfigGroup
title="Workspace"
description="What this sandbox is called and which host folders it can see."
>
<Field
label="Project name"
hint="Shown in the sidebar and on terminal tabs."
>
{(id) => (
<input
id={id}
value={name}
onChange={(e) => setName(e.target.value)}
onBlur={() => {
const trimmed = name.trim();
if (!trimmed) {
setName(project.name);
return;
}
if (trimmed !== project.name) save({ name: trimmed });
}}
onKeyDown={(e) => {
if (e.key === "Enter") (e.target as HTMLInputElement).blur();
if (e.key === "Escape") setName(project.name);
}}
className={inputClass}
/>
)}
</Field>
<div>
<span className="block text-[13px] font-medium text-[var(--text-primary)]">
Folders
</span>
<p className="mt-0.5 mb-2 text-xs text-[var(--text-secondary)] leading-snug">
Each host folder is mounted at <span className="font-mono">/workspace/&lt;name&gt;</span>{" "}
inside the container.
</p>
<div className="space-y-3">
{paths.map((pp, i) => (
<div key={i} className="flex flex-col gap-1.5 sm:flex-row sm:items-center">
<input
value={pp.host_path}
aria-label={`Folder ${i + 1} host path`}
onChange={(e) => {
const updated = [...paths];
updated[i] = { ...updated[i], host_path: e.target.value };
setPaths(updated);
}}
onBlur={() => saveIfComplete()}
placeholder="/path/to/folder"
disabled={disabled}
className={`flex-1 min-w-0 ${inputClass}`}
/>
<div className="flex items-center gap-1.5">
<Button
size="md"
disabled={disabled}
onClick={async () => {
const selected = await open({ directory: true, multiple: false });
if (typeof selected === "string") {
const updated = [...paths];
const basename =
selected.replace(/[/\\]$/, "").split(/[/\\]/).pop() || "";
updated[i] = {
host_path: selected,
mount_name: updated[i].mount_name || basename,
};
setPaths(updated);
persist(updated);
}
}}
>
Browse
</Button>
<span className="text-xs text-[var(--text-secondary)] font-mono flex-shrink-0">
/workspace/
</span>
<input
value={pp.mount_name}
aria-label={`Folder ${i + 1} mount name`}
onChange={(e) => {
const updated = [...paths];
updated[i] = { ...updated[i], mount_name: e.target.value };
setPaths(updated);
}}
onBlur={() => saveIfComplete()}
placeholder="name"
disabled={disabled}
className={`w-40 ${monoInputClass}`}
/>
{paths.length > 1 && (
<Button
size="md"
variant="danger"
disabled={disabled}
aria-label={`Remove folder ${i + 1}`}
onClick={() => {
const updated = paths.filter((_, j) => j !== i);
setPaths(updated);
persist(updated);
}}
>
Remove
</Button>
)}
</div>
</div>
))}
</div>
<Button
className="mt-2"
disabled={disabled}
onClick={() => setPaths([...paths, { host_path: "", mount_name: "" }])}
>
+ Add folder
</Button>
</div>
</ConfigGroup>
);
}