From d0e791a219f82794f2e02f3e14fba456cd9b7f21 Mon Sep 17 00:00:00 2001 From: Gabriel Fonseca Date: Tue, 10 Nov 2026 11:56:05 +0000 Subject: [PATCH 1/3] fix(tools): say which relative path to use when a path escapes the workspace A model that wrote to an absolute path such as /published.txt got a refusal that named the boundary but not what to do. The error now suggests a relative file name. The boundary check itself is unchanged, and the error keeps its existing wording. Co-Authored-By: Claude Haiku 5.5 --- crates/code-runtime/src/file_ops.rs | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/crates/code-runtime/src/file_ops.rs b/crates/code-runtime/src/file_ops.rs index 3408637..4b472b2 100644 --- a/crates/code-runtime/src/file_ops.rs +++ b/crates/code-runtime/src/file_ops.rs @@ -33,9 +33,12 @@ fn validate_workspace_boundary(resolved: &Path, workspace_root: &Path) -> io::Re return Err(io::Error::new( io::ErrorKind::PermissionDenied, format!( - "path {} escapes workspace boundary {}", + "path {} escapes workspace boundary {}; use a path relative to the workspace, such as {}", resolved.display(), - workspace_root.display() + workspace_root.display(), + resolved + .file_name() + .map_or_else(|| "a relative file name".to_string(), |name| name.to_string_lossy().into_owned()), ), )); } From 1a796949907bc68b7a0d616de8be120d731c85e3 Mon Sep 17 00:00:00 2001 From: Gabriel Fonseca Date: Tue, 10 Nov 2026 11:56:05 +0000 Subject: [PATCH 2/3] fix(cli): say when a repository task finished without changes A repository task that changed no files publishes no branch, and nothing in its result said so. The result now notes that no changes were made, so a finished task without a branch is not mistaken for a failed publication. Co-Authored-By: Claude Haiku 5.5 --- cli/src/main.rs | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/cli/src/main.rs b/cli/src/main.rs index f5d8838..5cf9b42 100644 --- a/cli/src/main.rs +++ b/cli/src/main.rs @@ -3773,7 +3773,17 @@ fn run_hosted_task_worker( Ok(Some(publication)) => { result = augment_hosted_result_with_publication(result, &publication); } - Ok(None) => {} + // A repository task that changed no files publishes nothing. Say so in the result, + // so a finished task without a branch is not mistaken for a publication failure. + Ok(None) => { + if payload.base_commit.is_some() { + let note = "No file changes were made, so no branch was published."; + result = Some(match result { + Some(value) if !value.trim().is_empty() => format!("{value}\n\n{note}"), + _ => note.to_string(), + }); + } + } // The run itself succeeded. The publication failure is recorded in the result. Err(error) => { let note = format!("Publication failed: {error}"); From 90573b3a597e3b4089b5422eb3bbaaf17b1d5c09 Mon Sep 17 00:00:00 2001 From: Gabriel Fonseca Date: Tue, 10 Nov 2026 11:56:05 +0000 Subject: [PATCH 3/3] test(e2e): ask for a relative path in the worker end-to-end prompt The default prompt let the model choose an absolute path, which the workspace boundary correctly refuses. The check is about publishing, so the prompt now asks for the relative path explicitly. The Linux script gets the same prompt. Co-Authored-By: Claude Haiku 5.5 --- scripts/linux-amd64-worker-e2e.sh | 2 +- scripts/worker-e2e.sh | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/scripts/linux-amd64-worker-e2e.sh b/scripts/linux-amd64-worker-e2e.sh index eac5fab..e777b0a 100755 --- a/scripts/linux-amd64-worker-e2e.sh +++ b/scripts/linux-amd64-worker-e2e.sh @@ -77,7 +77,7 @@ done curl -sf -H "authorization: Bearer $KEY" "http://127.0.0.1:$PORT/v1/version" >/dev/null \ || { echo "error: server did not start"; docker logs "$CONTAINER" 2>&1 | tail -30; exit 1; } -PROMPT="Create a file named published.txt in the current directory containing exactly: from the linux worker. Reply DONE." +PROMPT="Create a file named published.txt in the current directory (use the relative path published.txt, never an absolute path) containing exactly: from the linux worker. Reply DONE." IDS=() for n in 1 2; do BRANCH="frontal-code/linux-e2e-$n" diff --git a/scripts/worker-e2e.sh b/scripts/worker-e2e.sh index ef19bcb..136c2bb 100755 --- a/scripts/worker-e2e.sh +++ b/scripts/worker-e2e.sh @@ -32,7 +32,7 @@ WORK="$(mktemp -d "${TMPDIR:-/tmp}/frontal-worker-e2e.XXXXXX")" SERVER_LOG="$WORK/server.log" API_KEY="e2e-$(date +%s)-$RANDOM" STAMP="$(date +%s)" -PROMPT="${PROMPT:-Create a file named published.txt in the current directory containing exactly: from the worker. Then run: python3 -c 'print(1)'. Then run: curl -m 5 -sS https://example.com -o /dev/null; echo CURL_EXIT=\$?. Then run: rm -rf /tmp/anything; echo RM_EXIT=\$?. Reply with the exit code lines and the word DONE.}" +PROMPT="${PROMPT:-Create a file named published.txt in the current directory (use the relative path published.txt, never an absolute path) containing exactly: from the worker. Then run: python3 -c 'print(1)'. Then run: curl -m 5 -sS https://example.com -o /dev/null; echo CURL_EXIT=\$?. Then run: rm -rf /tmp/anything; echo RM_EXIT=\$?. Reply with the exit code lines and the word DONE.}" : "${FRONTAL_CODE_SERVER_DATABASE_URL:?set FRONTAL_CODE_SERVER_DATABASE_URL to a Postgres database}" @@ -55,7 +55,7 @@ git -C "$WORK/seed" -c user.name=seed -c user.email=seed@local commit -q -m init git -C "$WORK/seed" push -q "$WORK/remote.git" main cargo build -q -p code-server --manifest-path "$ROOT/Cargo.toml" -SERVER_BIN="$ROOT/target/debug/code-server" +SERVER_BIN="${CARGO_TARGET_DIR:-$ROOT/target}/debug/code-server" cleanup() { if [ -n "${SERVER_PID:-}" ]; then kill "$SERVER_PID" 2>/dev/null || true; fi