feat: lift network.ts fs/path behind window.main.timeline IPC bridge (PR B)#9945
Open
jackkav wants to merge 2 commits into
Open
feat: lift network.ts fs/path behind window.main.timeline IPC bridge (PR B)#9945jackkav wants to merge 2 commits into
jackkav wants to merge 2 commits into
Conversation
Removes `node:fs` and `node:path` from the renderer-reachable `src/network/network.ts`. Three timeline-path constructions and two `appendFile` calls are replaced with narrow `window.main.timeline.getPath` (sync IPC) and `window.main.timeline.appendToFile` (async IPC) helpers that live in main, where Node builtins belong. Path validation in `appendToTimeline` mirrors `writeResponseBodyToFile`: only paths inside the `responses/` directory ending in `.timeline` are accepted, preventing a compromised renderer from writing arbitrary files. Updates `config/renderer-node-import-baseline.json` to remove the two `src/network/network.ts` entries — the baseline shrinks as intended. Part of the nodeIntegration: false migration (PR B). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
✅ Circular References ReportGenerated at: 2026-05-21T15:03:07.459Z Summary
Click to view all circular references in PR (19)Click to view all circular references in base branch (19)Analysis✅ No Change: This PR does not introduce or remove any circular references. This report was generated automatically by comparing against the |
…etwork tests
- `getTimelinePath`: use `path.resolve` + `path.relative` check instead of
`path.join` to prevent path-traversal attacks (Aikido medium severity finding)
- `network.test.ts`: add `vi.stubGlobal('window', ...)` mock for
`window.main.timeline` so tests don't throw "window is not defined" now
that `defaultSendActionRuntime` calls `window.main.timeline.appendToFile`
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
node:fsandnode:pathfrom renderer-reachablesrc/network/network.ts— last Node builtin user in the network stacktimeline.getPathsync,timeline.appendToFileasync) that replace three path-construction blocks and twoappendFilecallsappendToTimelinevalidates the target path is insideresponses/and ends in.timeline, matching the same defence-in-depth pattern aswriteResponseBodyToFileconfig/renderer-node-import-baseline.jsonby 2 entries (src/network/network.tsfs+path)Context
Part of the
nodeIntegration: falserenderer migration. This is PR B fromNODE_INTEGRATION_MIGRATION_PR_PLAN.md(option 1 — narrow main-side helper; defers option 2 pipeline-to-main move to post-flip cleanup).Stacks on top of
chore/disable-node-integration.Test plan
npm run type-check— passes (0 errors)npm run check:renderer-node-imports— passes, baseline no longer containssrc/network/network.ts🤖 Generated with Claude Code