From 2cd57a32b2f091559377ca1ae4ef6067db98ee68 Mon Sep 17 00:00:00 2001 From: Hare Date: Sun, 6 Sep 2026 05:17:27 +0900 Subject: [PATCH] fix: align runtime trust schema and built-in controls --- crates/workspace-server/src/latest_schema.sql | 2 +- crates/workspace-server/src/store.rs | 11 +++++++++++ .../settings/runtimes/[runtimeId]/+page.svelte | 2 +- web/workspace/tests/runtime-management-source.test.ts | 4 ++++ 4 files changed, 17 insertions(+), 2 deletions(-) diff --git a/crates/workspace-server/src/latest_schema.sql b/crates/workspace-server/src/latest_schema.sql index e9f86a18..720ff8ea 100644 --- a/crates/workspace-server/src/latest_schema.sql +++ b/crates/workspace-server/src/latest_schema.sql @@ -440,7 +440,7 @@ CREATE TABLE workspace_runtime_bindings ( base_url TEXT NOT NULL, public_key TEXT NOT NULL, public_key_fingerprint TEXT NOT NULL, - binding_revision INTEGER NOT NULL CHECK (binding_revision > 0), + binding_revision INTEGER NOT NULL DEFAULT 1 CHECK (binding_revision > 0), created_at TEXT NOT NULL, updated_at TEXT NOT NULL, revoked_at TEXT, diff --git a/crates/workspace-server/src/store.rs b/crates/workspace-server/src/store.rs index 44de5aa5..0c7039b4 100644 --- a/crates/workspace-server/src/store.rs +++ b/crates/workspace-server/src/store.rs @@ -6470,6 +6470,17 @@ fn verify_workspace_runtime_binding_schema(conn: &Connection) -> Result<()> { "workspace_runtime_bindings schema does not match schema-52".to_string(), )); } + let revision_default = conn.query_row( + "SELECT dflt_value FROM pragma_table_info('workspace_runtime_bindings') WHERE name = 'binding_revision'", + [], + |row| row.get::<_, Option>(0), + )?; + if revision_default.as_deref() != Some("1") { + return Err(Error::Store( + "workspace_runtime_bindings binding_revision default does not match schema-52" + .to_string(), + )); + } let sql = conn.query_row( "SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'workspace_runtime_bindings'", [], diff --git a/web/workspace/src/routes/w/[workspaceId]/settings/runtimes/[runtimeId]/+page.svelte b/web/workspace/src/routes/w/[workspaceId]/settings/runtimes/[runtimeId]/+page.svelte index c7ad9c21..e05b9663 100644 --- a/web/workspace/src/routes/w/[workspaceId]/settings/runtimes/[runtimeId]/+page.svelte +++ b/web/workspace/src/routes/w/[workspaceId]/settings/runtimes/[runtimeId]/+page.svelte @@ -219,7 +219,7 @@ {/if} - {#if data.workspace.permissions.manage_runtimes} + {#if data.workspace.permissions.manage_runtimes && !runtime.management.built_in}

Workspace trust

diff --git a/web/workspace/tests/runtime-management-source.test.ts b/web/workspace/tests/runtime-management-source.test.ts index f455191e..034b4626 100644 --- a/web/workspace/tests/runtime-management-source.test.ts +++ b/web/workspace/tests/runtime-management-source.test.ts @@ -84,6 +84,10 @@ Deno.test("Runtime detail keeps trust controls owner-only and conflict-safe", as const reveal = page.indexOf("Reveal public key"); const mutation = page.indexOf('id="runtime-public-key-input"'); assert(ownerGate >= 0, "Runtime trust controls should use manage_runtimes"); + assert( + page.includes("!runtime.management.built_in"), + "Runtime trust controls should be hidden for the built-in Runtime", + ); assert( ownerGate < reveal && ownerGate < mutation, "owner gate should wrap key controls",