Skip to content

fix(remote): guard the remaining path-taking local commands - #693

Merged
Ziinc merged 1 commit into
claude/prd-gaps-remote-path-guards-5from
claude/prd-gaps-remote-path-guards-13
Oct 1, 2026
Merged

Ziinc merged 1 commit into
claude/prd-gaps-remote-path-guards-5from
claude/prd-gaps-remote-path-guards-13

Conversation

@Ziinc

@Ziinc Ziinc commented Sep 30, 2026 •

Copy link
Copy Markdown
Collaborator

Stacked on #691. Removes the last 21 entries from KNOWN_UNGUARDED. The enumeration test in #684 now requires that no path-first api wrapper hands a remote path to a local command.

Wrapper Treatment for a remote repository
listWorkflows, runWorkflow, runWorkflowJob, listWorkflowRuns, isRepoTrusted, trustRepo, getWorkspaceSetupStatus, rerunWorkspaceSetupScript, getRepoLogs, getLogTimeseries, runLogsSql assertLocalOperation ("Checks and logs … not available for remote repositories yet")
initRepo, setGitSubmoduleSynced, writeSendReviewImage, githubOpenOrCreateWorkspaceFromIssue assertLocalOperation
loadRepoYamlConfig all-null config, since the remote .treq/config.yaml is not read
listGitignoredPathSuggestions, listSendArtifacts []
setWindowRepoPath no-op
listSkillCatalog, listInstalledSkills application scope (repoPath: null)

Still open (not first-parameter paths, so the enumeration test does not reach them)

  • installSkill, uninstallSkill, setSkillInstallScope with a remote repoPath
  • startFileWatcher / stopFileWatcher(workspaceId, workspacePath)
  • ptyCreateSession(…, workingDir, …, repoPath) for local terminals
  • api-linear / api-tracker kickoff wrappers (Dashboard already disables auto-kickoff for remote)

Checks

Checks and logs (workflows, setup script, trust, repo logs, SQL), repo init,
submodule sync, send-review images and the GitHub issue opener are asserted
local. Read-only lookups whose empty result the UI already handles
(`.treq/config.yaml`, gitignored path suggestions, send artifacts, the
window's repo path) return that empty result for a remote repository. Skill
listing falls back to application scope. This empties
KNOWN_UNGUARDED in remote-path-guards.test.ts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MbYSPHBRmDYwPJpHG33Y4t
@Ziinc
Ziinc force-pushed the claude/prd-gaps-remote-path-guards-12 branch from a736f7e to da79c6a Compare September 30, 2026 09:28
@Ziinc
Ziinc force-pushed the claude/prd-gaps-remote-path-guards-13 branch from 8ea23ec to 98d3b56 Compare September 30, 2026 09:32
Base automatically changed from claude/prd-gaps-remote-path-guards-12 to claude/prd-gaps-remote-path-guards-5 October 1, 2026 07:44
@Ziinc
Ziinc merged commit 17f63de into claude/prd-gaps-remote-path-guards-5 Oct 1, 2026
15 checks passed
@Ziinc
Ziinc deleted the claude/prd-gaps-remote-path-guards-13 branch October 1, 2026 07:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants