Repository navigation
Integrate approved file cards, handoff, usage history, mascots and macOS fixes - #141
Merged
Merged
Conversation
Adds the Files canvas card: a read-only browser and reader rooted either at a live terminal session working directory or at a folder picked in a native dialog. Main owns access through a new FileAccessService that canonicalizes root and target with realpath, rejects absolute paths, `..`, escaping symlinks and non-regular files, and enforces byte, entry, depth and result caps; the renderer only receives an opaque root id plus relative paths over the allow-listed `files:*` channels. Cards persist and restore their root, bounds, open file and expanded folders, and show an unavailable state when a root is gone. Text and code are rendered richly: Markdown files render as GitHub-Flavored Markdown (headings, lists, task lists, tables, blockquotes, rules, inline and fenced code) and recognized code files are syntax-highlighted by extension. Rendering is sanitized (no raw HTML, event handlers or dangerous schemes; no innerHTML), http(s) links open in the built-in browser, only embedded `data:` images render, and files above the ~250 KB threshold fall back to plain text with a notice. The heavy Markdown/highlight renderers and the card are lazy-loaded to keep them out of the startup bundle. Excluded: the unrelated custom-agents WIP is intentionally not part of this branch. Also raises the renderer static-graph budget in tests/renderer-bundle-splitting.test.mjs (still well under the old ~1.6 MB single chunk) to account for the new card's startup orchestration.
`FileAccessService` registered roots with `realpathSync` but canonicalized targets with the async `realpath`, which on Windows can return a differently cased or 8.3-shortened path. The prefix containment check then treated the root itself (and every child) as outside the root, so listing/reading failed. Resolve targets with the same `realpathSync` used at registration and compare normalized (case-insensitive, `\\?\`-stripped) paths on Windows. Windows CI: tests/file-access-service.test.mjs and files-ipc-security.test.mjs were the 13 failing tests; they now pass on Linux and should on Windows.
# Conflicts: # src/main/index.ts # src/preload/index.ts # src/renderer/src/features/workspace/WorkspaceCanvas.tsx
# Conflicts: # src/main/ipc/registerIpc.ts # src/renderer/src/App.tsx # tests/app-shortcuts.test.mjs
# Conflicts: # package-lock.json
howdeploy
added a commit
that referenced
this pull request
Oct 12, 2026
The approved DEV lockfile carried into #141 was generated with npm 12. GitHub CI uses Node 22/npm 10, whose `npm ci` rejected the incomplete transitive dependency graph before any application tests ran. Regenerate the lockfile using the already installed Node 22.22.0/npm 10.9.4. This adds the missing dependency entries required by app-builder-lib's @electron/get 3.x tree. No package.json changes or changes to existing package versions, artifact URLs, or integrity hashes are included. Validation: `npm ci --dry-run --ignore-scripts --no-audit --no-fund` passed with npm 10.9.4; `git diff --check` passed. No dependencies were installed and no lifecycle scripts were executed for this repair. The DEV application build passed before this lockfile-only change. Application tests and platform UI checks were not run locally. This is a maintainer integration fix; the original contributor commits and acknowledgments in #141 remain unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This integrates the six contributions accepted during the maintainer's DEV review, together with the maintainer's local UI and minimap fixes. Rejected orchestration features, including #133, are excluded entirely.
Included contributions and credit
Thank you to all six contributors. Each original PR head and its author commits are retained in Git history through separate merge commits. This integration must use a merge commit rather than squash or rebase.
Maintainer patches
Scope
#132, #133, #134, #135, and #137 are not included. #136 is also excluded pending the previously requested UI/UX redesign. No commits from that cumulative orchestration series are ancestors of this branch.
Material handoff in #130 does not automatically apply a saved JSON agent report to the material state; this remains the reviewed behavior.
Validation
VITE_BUILD_CHANNEL=DEV npm run buildpassed, including the script's TypeScript checks and native-helper build.git diff --checkpassed.