chore(release): v0.11.1 - #26
Merged
Merged
Conversation
Since 0.11.0 documents are read through `read_document`, which only allowed paths under the home dir or the bundled resource dir. Opening a folder anywhere else — /tmp, /Volumes, a repo cloned outside home — listed its files in the sidebar but refused to open any of them: the listing goes through the fs plugin (scoped to `/**`), the read did not. The failure was invisible. `loadFile` only logged to the console, so selecting a file just did nothing, which reads as an unresponsive click rather than a refusal. Confining to the home dir also had the threat model backwards: it allowed ~/.ssh and ~/.aws while blocking /tmp. Confine to the folder the user opened instead — the access they actually granted — so a crafted relative link still cannot escape it, and every folder they can browse, they can read. The resource dir stays allowed for the bundled examples. Surface load failures in the content area (FR + EN) so a file that cannot be opened says so instead of silently doing nothing. Claude-Session: https://claude.ai/code/session_01NcJuB2iR4WEfuQVLpYqWi4
Opening a file from Finder handed it to the frontmost window, which replaced whatever that window was showing. That was the only possible behaviour before 0.11.0, when the app had a single window; now that several windows exist, it silently discards the document you were reading. Add a General preference with the two reasonable answers, defaulting to a new window — what macOS document viewers do, and what loses nothing. A window still on the welcome screen is reused instead of spawning a second one, so choosing "new window" never leaves an empty window behind, and a failed spawn falls back to reusing rather than dropping the open. The backend already accepts a file path for a spawned window (PendingOpen::File), so this only wires the choice through. Claude-Session: https://claude.ai/code/session_01NcJuB2iR4WEfuQVLpYqWi4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Patch release. Fixes a regression shipped in 0.11.0 that made documents outside the home directory impossible to open, and adds the Finder-opening preference that the new multi-window support calls for.
Fixed — documents outside the home directory could not be opened
Since 0.11.0 documents are read through the
read_documentcommand, which only allowed paths under the home dir or the bundled resource dir. Opening a folder anywhere else —/tmp,/Volumes, a repo cloned outside home — listed its files in the sidebar but refused to open any of them: the listing goes through the fs plugin (scoped to/**), the read did not.The failure was invisible.
loadFileonly logged to the console, so selecting a file just did nothing, which reads as an unresponsive click rather than a refusal.Confining to the home dir also had the threat model backwards: it allowed
~/.sshand~/.awswhile blocking/tmp. Reads are now confined to the folder the user opened — the access they actually granted — so every folder they can browse they can read, and a crafted relative link still cannot escape it. The resource dir stays allowed for the bundled examples.Load failures are now surfaced in the content area (FR + EN).
Added — Finder opening behaviour
Opening a file from Finder handed it to the frontmost window, replacing whatever it was showing. That was the only possible behaviour before 0.11.0, when the app had a single window; with several windows it silently discards the document you were reading.
New General preference with the two reasonable answers, defaulting to new window — what macOS document viewers do, and what loses nothing. A window still on the welcome screen is reused either way, so choosing "new window" never leaves an empty window behind, and a failed spawn falls back to reusing rather than dropping the open.
The backend already accepted a file path for a spawned window (
PendingOpen::File), so this only wires the choice through.Verification
npx tsc --noEmit, 317 tests (3 new on the preference resolver and its validator),cargo build --releaseclean/private/tmp, the error message on a deleted file, both Finder behaviours, and the welcome-screen reuse caseType of Change
Checklist
https://claude.ai/code/session_01NcJuB2iR4WEfuQVLpYqWi4