Skip to content
This repository was archived by the owner on Jun 8, 2026. It is now read-only.

HOTFIX: Serve design dashboard assets - #273

Merged
mikeangstadt merged 1 commit into
mainfrom
hotfix-design-renderer-assets
Jun 6, 2026
Merged

mikeangstadt merged 1 commit into
mainfrom
hotfix-design-renderer-assets

Conversation

@mikeangstadt

Copy link
Copy Markdown
Contributor

Summary

  • Allow the app://renderer protocol to serve Vite build chunks from dist/renderer/assets.
  • Preserve fail-closed protocol checks for host, path traversal, file extension, realpath, and file type.
  • Bump desktop version to 0.15.114.

Testing

  • just desktop-typecheck
  • ./apps/desktop/node_modules/.bin/tsx --test apps/desktop/test/agent-dashboard-boundary.test.ts
  • pnpm -C apps/desktop exec eslint src/main/window.ts test/agent-dashboard-boundary.test.ts
  • pnpm -C apps/desktop build

Risks

  • Low; protocol exposure is limited to the renderer build assets directory and existing allowed file extensions.

- Allow the app protocol to serve Vite renderer chunks from the built assets directory.

- Keep protocol path, extension, and realpath checks fail-closed.

Testing: Focused desktop typecheck, protocol boundary test, changed-file lint, and desktop build passed.

Risks: Low; expands the custom renderer protocol only to the build output assets directory.
@mikeangstadt
mikeangstadt requested a review from a team June 6, 2026 04:30
@mikeangstadt
mikeangstadt merged commit fbccdfc into main Jun 6, 2026
5 checks passed
@mikeangstadt
mikeangstadt deleted the hotfix-design-renderer-assets branch June 6, 2026 04:48
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant