Repository navigation
fix(cli): publish leaves out outside files that came in with an imported project - #7598
Merged
Merged
Conversation
…ted project When the desktop app brings in someone else's project (a Cutroom link, a sync of a teammate's version, a reference's source), it lists those files in .hyperframes/received-files.json. Publish, cloud render and feedback now leave out every file outside the project that a listed file references or links to, and warn naming the file and the reference. Files the person wrote keep copying their outside references into _ext/ as before. A record that cannot be read counts every file as received. A project inside a hidden or app-data folder now only shares that folder with assets in the folder it sits in: an outside file further up, in a hidden or app-data location, is left out with the existing warning. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
![heygengenesis[bot]](https://avatars.githubusercontent.com/in/2913576?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Verdict: REQUEST CHANGES · 1 blocker · 0 important · 0 nits · head fe6c9891
publish still uploads a received file's linked-folder video once the proxy bake transcodes it. Details inline. CI is green; the PR is blocked only on review.
Scope
Read publishProject.ts and privateProjectFile.ts end to end, checked the hidden/app-data parent-folder bound against ../, absolute and Windows-drive spellings, and checked the record path format against hyperframes-internal#10482 (posix, NFC, project-relative on both sides). Probed the bake leak with a real ProRes file, buildPublishFileMap and then bakeMediaProxies, no mocks.
— Claude (Genesis)
A video that staging left out of the upload could still reach the archive as a transcoded proxy. Skip any hostile source whose archive key staging did not keep. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
3 of 5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Publish, cloud render and feedback now leave out outside files that came in with an imported project, and warn naming each one. The person's own outside references keep copying into
_ext/as before.Claude Opus 5.5
What
.hyperframes/received-files.json.stagePublishFilesreads that record. For a listed HTML/CSS file, every reference that resolves outside the project (a../chain, an absolute path, a percent-encoded spelling, or a path through a linked folder whose real path is outside) is left out, with"<file> references <ref>, which leads outside the project and came in with an imported project; it was left out of the upload."A listed project file that is itself a link to something outside is left out the same way.file:URLs are never read by publish, received or not.AppData/Librarythe project sat in was skipped all the way up, so<home>/.tool/worktrees/x/pcould pull<home>/.tool/auth.jsoninto_ext/. Now only the project's parent folder counts as its surroundings:../shared/logo.pngfrom<home>/.work/pstill copies,../../../auth.jsonfrom<home>/.tool/worktrees/x/pis left out with the existing warning.Why
A project opened from someone else can point at files outside its folder. Following outside references stays a feature for projects the person wrote; content that arrived from elsewhere should not reach outside its own folder.
Related work
A companion change in the desktop app writes the record.
How
privateProjectFile.ts:receivedFiles(projectDir)reads the record (NFC paths);linksOutsideis the existing real-path test pulled out oflinksToPrivateOutsideFile;inPrivateLocationandinHomeAppDatameasure against the project's parent folder instead of every ancestor.publishProject.ts: the record is checked in the staging loop (linked files), inincludeReferencedProjectFile(in-project paths whose real path is outside), and inarchiveTargetOf(outside paths).leaveOuttakes the reason.Trade-off: a project two or more levels down inside a hidden or app-data folder can no longer pull an ordinary sibling asset from further up that same folder (it is left out with a warning). One level up still works.
Test plan
publishProject.absolutePath.test.ts(received refs in HTML, srcset, CSS; absolute,../, percent-encoded, linked-folder and linked-file spellings; person's own file still copies; unreadable record;buildPublishFileMapandcreatePublishArchive, which publish andfeedback --file-issuecall; 12 hidden/app-data cases: 3 project locations x 4 spellings),cloud/render.test.ts(cloud render --dry-run --jsonthrough the real CLI: archive holds 1 file, stderr names the left-out reference).viteston the publish, private-file, cloud render, feedback and publish command suites: 178 passed.Not covered: check-then-read still opens the path a second time (same as the existing private-file check), and HTML/CSS are the only files whose references publish follows.
— Rames Jusso
🤖 Generated with Claude Code