Codewhale/extensions/vscode/src/test · de/Codewhale

CCodeWhale Botfix(vscode): open a file only when its real path is inside the workspace

文件	最后提交记录	最后更新时间
api.test.ts	fix(vscode): make the extension's send path work, and close the security holes The extension had never successfully started a turn. `startTurn` accepted only HTTP 200/202 while the runtime's `start_thread_turn` (crates/tui/src/runtime_api.rs:4613-4632) returns `StatusCode::CREATED` as its ONLY success path, so every send failed. `git log -- src/api.ts` is a single commit: this was never a regression, it shipped that way and was never run end to end. api.ts (send path): - Status handling now tests a RANGE (`isOk`: >= 200 && < 300) through one `ensureOk` helper routed through every call site, rather than enumerating codes at eleven of them. 201 is accepted because it is 2xx, not because it is special-cased — the same shape the embedded web client already used at crates/tui/src/runtime_web/app.mjs:873, which is why that client worked against the same runtime this one choked on. - The runtime's JSON `error.message` is surfaced on every route; previously only startTurn passed it through. - 409 is typed: a second send while a turn is live is "already running", and interrupting when nothing streams is "nothing to stop", not an error. Security (extension.ts, runtime.ts, secrets.ts): - SecretStorage now wins over the settings token, matching what secrets.ts, the manifest and the README all already promised. Previously a repo-local .vscode/settings.json could supply a bearer AND retarget `runtimeHost`, and the token rode every request — opening a repo was enough. - The runtime token is passed to the terminal via environment instead of `--auth-token` in argv, which was visible in shell history and `ps`. - status.ts nonce uses a CSPRNG, matching chat.ts. Chat correctness and accessibility (chat.ts, transcript.ts): - Transcript prefers `detail` over the 280-char `summary`, so reload shows the reply instead of a stub. - `operation_key` is reused on retry, so a timeout and resend no longer creates two turns; the dead SSE stream is cleared so reconnect can fire. - The composer keeps its text until the turn is accepted. - Tool paths are parsed out of `metadata.tool_input` and treated as untrusted. The durable fix is runtime-side and is NOT taken here. - Focus styling and roles/labels added; there were none. Chrome (package.json, extension.ts): - Chat is contributed to the secondary sidebar with an activity-bar fallback, gated on `codewhale.noSecondarySidebar`, which is set at activation from `vscode.version` (>= 1.106). One ChatView instance serves both view ids and `reveal()` focuses whichever resolved. - `engines.vscode` stays `^1.96.2` and the threshold is enforced at runtime, matching the shipping Codex extension; raising the floor would have cut off 1.90-1.105 users and made the fallback unreachable for nothing. CI and dev loop (ci.yml, .gitignore, .vscode/): - CI runs the extension tests. Nothing ran them before, which is how a send path that could not work stayed green. - launch.json/tasks.json give a working F5 host. The root `.gitignore`'s bare `.vscode/` silently swallowed them, so a negation was added — without it these files exist locally and vanish on commit. Gates: cd extensions/vscode && npx tsc --noEmit -> clean cd extensions/vscode && npm test -> tests 42, pass 42, fail 0 (baseline before this was 25) manifest/provider coherence: every declared view id has a provider; no provider lacks a manifest entry; context key set at activation. Not done, deliberately: the Runtime view still exists, so this is not yet a single-view Agents panel. Removing it spans extension.ts, status.ts and two commands; a half-removal is worse than either state. Gate item 5 — a human driving one real turn in an Extension Development Host — remains unproven. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D4rk4NXwyy6wmvii9Lp84P Signed-off-by: CodeWhale Bot <bot@codewhale.net>	1 个月前
markdown.test.ts	feat(vscode): interactive chat sidebar over the Engine Runtime API Replace the attach-only scaffold with a working agent chat extension: - Chat sidebar (codewhale.chat): create/switch/resume threads, live streaming over the replayable SSE contract, inline tool approvals, clarification questions, steer, and interrupt - Editor context chips (selection / active file / diagnostics) assembled into the prompt; CodeWhale: Ask Codewhale command, ctrl+alt+c keybinding, and editor context menu entry - Safe Markdown rendering (escaped subset) with per-block Copy and Insert-at-cursor actions - Runtime bearer tokens move to VS Code SecretStorage (CodeWhale: Set Runtime Token) with settings migration - Pure /v1 client (api.ts), SSE parser (sse.ts), and renderer (markdown.ts) split out of VS Code for direct testing The runtime remains the single turn/event owner; the extension only renders and routes. Full-feature flows (diff review, model switching, account sign-in) stay with the runtime's embedded browser client until their contracts land. Proof: extensions/vscode npm test -> 25 passed, 0 failed; packaged codewhale-vscode-0.10.0.vsix (95 KB, tests excluded); compiled client smoke-tested against the release runtime binary (health, auth-required detection, thread summaries, create, detail hydration, snapshots) with no model turns executed.	1 个月前
sse.test.ts	feat(vscode): interactive chat sidebar over the Engine Runtime API Replace the attach-only scaffold with a working agent chat extension: - Chat sidebar (codewhale.chat): create/switch/resume threads, live streaming over the replayable SSE contract, inline tool approvals, clarification questions, steer, and interrupt - Editor context chips (selection / active file / diagnostics) assembled into the prompt; CodeWhale: Ask Codewhale command, ctrl+alt+c keybinding, and editor context menu entry - Safe Markdown rendering (escaped subset) with per-block Copy and Insert-at-cursor actions - Runtime bearer tokens move to VS Code SecretStorage (CodeWhale: Set Runtime Token) with settings migration - Pure /v1 client (api.ts), SSE parser (sse.ts), and renderer (markdown.ts) split out of VS Code for direct testing The runtime remains the single turn/event owner; the extension only renders and routes. Full-feature flows (diff review, model switching, account sign-in) stay with the runtime's embedded browser client until their contracts land. Proof: extensions/vscode npm test -> 25 passed, 0 failed; packaged codewhale-vscode-0.10.0.vsix (95 KB, tests excluded); compiled client smoke-tested against the release runtime binary (health, auth-required detection, thread summaries, create, detail hydration, snapshots) with no model turns executed.	1 个月前
transcript.test.ts	fix(vscode): open a file only when its real path is inside the workspace The extension's path check was lexical. It now resolves links on both the workspace folder and the requested path before comparing, refuses a dangling link, and keeps the lexical check for virtual workspaces. A file whose name merely begins with two dots is no longer refused. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Signed-off-by: CodeWhale Bot <bot@codewhale.net>	30 天前