Hare/yoi
1
1
Fork 0
Code Actions Packages Releases Activity

ticket: approve profile source tree work

Browse Source
This commit is contained in:
Keisuke Hirata 2026-07-09 18:16:38 +09:00
parent ae227c7e4d
commit dccfe539ef
No known key found for this signature in database
2 changed files with 37 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.yoi/tickets/00001KX1JNJ2Y/item.md
View File

@ -2,7 +2,7 @@
title: 'Add ProfileSourceTree virtual filesystem and Decodal profile editor'
state: 'inprogress'
created_at: '2026-07-08T19:18:25Z'
updated_at: '2026-07-09T09:10:00Z'
updated_at: '2026-07-09T09:16:20Z'
assignee: null
queued_by: 'workspace-panel'
queued_at: '2026-07-09T07:56:07Z'

36
.yoi/tickets/00001KX1JNJ2Y/thread.md
View File

@ -310,3 +310,39 @@ Second review-fix implementation report:
- Requesting second follow-up external review against `941b9126..13c6548b` and full combined implementation。
---
<!-- event: review author: reviewer at: 2026-07-09T09:16:20Z status: approve -->
## Review: approve
External second follow-up review result: approve
Blockers verified:
- Source-root symlink rejection is now in the shared source-root path validation:
- `existing_profile_source_root` rejects `.yoi/profiles` when the final component is a symlink。
- `prepare_profile_source_root_for_write` rejects both `.yoi` symlink parents and `.yoi/profiles` symlink roots before create/write operations。
- `checked_source_path`, tree listing, file read/write/delete, and archive construction all flow through these guards before touching tree contents。
- Regression coverage for `.yoi/profiles -> outside_dir` exists:
- `source_root_symlink_is_rejected_before_tree_side_effects` covers write rejection before outside side effects, `read_profile_source_tree` fail-closed behavior, and `build_workspace_profile_archive` fail-closed behavior。
- Existing symlink-parent / entry symlink tests remain in place for nested escape cases。
Still-good items checked and intact:
- Decodal editor wiring remains present via the Svelte editor component using `decodal()` / CodeMirror integration。
- Profile tree API routes remain wired for tree read and file create/save/delete:
- `/settings/profiles/trees/{source_tree_id}`
- `/settings/profiles/trees/{source_tree_id}/file`
- Virtual source tree summaries still expose virtual metadata/provenance/digest-type fields without host path disclosure。
- Selected-root archive construction still uses the selected profile entrypoint plus import closure rather than blindly archiving every source。
- `Runtime ArchiveSourceLoader` behavior remains bounded to archive manifest/import-map package files plus archive-backed imports; no host filesystem fallback was introduced。
Validation performed:
- Read Ticket records in `.yoi/tickets/00001KX1JNJ2Y/`, including latest implementation/review context。
- Inspected latest fix `13c6548b`, diff from `941b9126..13c6548b`, and relevant source files in the implementation worktree only。
- Reviewed the orchestrator-provided successful validation list; Reviewer did not rerun tests or modify files。
Non-blocking follow-up:
- A direct assertion for `read_profile_tree_file` against a root-symlinked `.yoi/profiles` would make the regression matrix even more explicit, but the implementation path already uses the same guarded `checked_source_path`, so this is not a merge blocker。
No merge-blocking issues found.
---