Repository navigation
feat: export git workspace diff and patch - #146
Merged
Merged
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughAdds git-based workspace diff/patch: domain types and wrappers, Docker provider git implementations, HTTP endpoint wiring, and corresponding tests. ChangesWorkspace Diff and Patch Export via Git
Sequence DiagramsequenceDiagram
participant Client
participant HTTPEndpoint
participant ConfigWrapper
participant DockerProvider
participant GitCmd
Client->>HTTPEndpoint: GET /sessions/{session_id}/workspace/diff
HTTPEndpoint->>ConfigWrapper: workspace_diff_from_config(config, workspace_id)
ConfigWrapper->>DockerProvider: workspace_diff(config, workspace_id)
DockerProvider->>GitCmd: git diff --name-status -z
GitCmd-->>DockerProvider: name-status output
DockerProvider->>GitCmd: git diff --numstat
GitCmd-->>DockerProvider: numstat output
DockerProvider-->>ConfigWrapper: WorkspaceDiff
ConfigWrapper-->>HTTPEndpoint: WorkspaceDiff
HTTPEndpoint-->>Client: WorkspaceDiffResponse (files, totals)
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
coding-agent/src/coding_agent/ui/http_server.py (1)
1739-1744:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winEnforce session visibility checks before exporting diff/patch
Line 1742 and Line 1791 inject
auth_context, but these handlers never validate caller visibility (unlike endpoints using_get_visible_session). This can expose another user’s workspace metadata/content.Suggested fix
async def get_session_workspace_diff( request: Request, session_id: str, auth_context: AuthContext | None = Depends(auth_context_from_headers), ) -> WorkspaceDiffResponse: del request + _ = await _get_visible_session(session_id, auth_context) try: diff = await session_manager.export_workspace_archive( session_id, lambda binding: workspace_diff_from_config( _load_cloud_workspace_config(), binding.workspace_id, ), )async def get_session_workspace_patch( request: Request, session_id: str, auth_context: AuthContext | None = Depends(auth_context_from_headers), ) -> WorkspacePatchResponse: del request + _ = await _get_visible_session(session_id, auth_context) try: patch = await session_manager.export_workspace_archive( session_id, lambda binding: workspace_patch_from_config( _load_cloud_workspace_config(), binding.workspace_id, ), )Also applies to: 1788-1793
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@coding-agent/src/coding_agent/ui/http_server.py` around lines 1739 - 1744, The handler get_session_workspace_diff (and the similar endpoint around lines 1788-1793) currently accept auth_context but skip visibility checks; update both to call the existing _get_visible_session(session_id, auth_context) (or equivalent visibility helper) at the start, use the returned session for any workspace access, and return the appropriate error (403/404) if the session is not visible to the caller; remove the placeholder "del request" and ensure all exported diff/patch logic uses the verified session object so no other user's workspace metadata/content can be leaked.
🧹 Nitpick comments (1)
coding-agent/tests/ui/test_http_server.py (1)
3472-3579: ⚡ Quick winAdd owner-isolation tests for
/workspace/diffand/workspace/patchThese new tests cover happy paths well, but they don’t assert cross-user access is hidden (404) like existing session/result tests do. Adding one non-owner case per endpoint would guard the auth boundary.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@coding-agent/tests/ui/test_http_server.py` around lines 3472 - 3579, Add owner-isolation assertions to the two tests (test_workspace_diff_returns_provider_result and test_workspace_patch_returns_provider_result) by creating a second client or simulating a different user and calling the same endpoints (/sessions/{session_id}/workspace/diff and /sessions/{session_id}/workspace/patch) as a non-owner, then assert the response status_code is 404; keep the existing monkeypatch setup for workspace_diff_from_config/workspace_patch_from_config and _load_cloud_workspace_config and reuse the created session_id but perform the GET as the non-owner to ensure cross-user access is hidden.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@coding-agent/src/coding_agent/ui/http_server.py`:
- Around line 1739-1744: The handler get_session_workspace_diff (and the similar
endpoint around lines 1788-1793) currently accept auth_context but skip
visibility checks; update both to call the existing
_get_visible_session(session_id, auth_context) (or equivalent visibility helper)
at the start, use the returned session for any workspace access, and return the
appropriate error (403/404) if the session is not visible to the caller; remove
the placeholder "del request" and ensure all exported diff/patch logic uses the
verified session object so no other user's workspace metadata/content can be
leaked.
---
Nitpick comments:
In `@coding-agent/tests/ui/test_http_server.py`:
- Around line 3472-3579: Add owner-isolation assertions to the two tests
(test_workspace_diff_returns_provider_result and
test_workspace_patch_returns_provider_result) by creating a second client or
simulating a different user and calling the same endpoints
(/sessions/{session_id}/workspace/diff and
/sessions/{session_id}/workspace/patch) as a non-owner, then assert the response
status_code is 404; keep the existing monkeypatch setup for
workspace_diff_from_config/workspace_patch_from_config and
_load_cloud_workspace_config and reuse the created session_id but perform the
GET as the non-owner to ensure cross-user access is hidden.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 62a06a92-48a7-46a4-b659-25526a2c3fb3
📒 Files selected for processing (6)
coding-agent/src/coding_agent/environment/__init__.pycoding-agent/src/coding_agent/environment/docker_workspace_provider.pycoding-agent/src/coding_agent/environment/workspace_provider.pycoding-agent/src/coding_agent/ui/http_server.pycoding-agent/tests/coding_agent/environment/test_docker_workspace_provider.pycoding-agent/tests/ui/test_http_server.py
This was referenced May 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
Summary by CodeRabbit
New Features
Behavior Changes
Errors
Tests