From cad521a7623855f7e89c0265166023abfd2bc02a Mon Sep 17 00:00:00 2001 From: Codev contributors Date: Fri, 9 Oct 2026 14:13:35 -0400 Subject: [PATCH] Record cross-group sidebar drop coverage --- DESIGN.md | 1 + 1 file changed, 1 insertion(+) diff --git a/DESIGN.md b/DESIGN.md index 4ac29a46..e4241de5 100644 --- a/DESIGN.md +++ b/DESIGN.md @@ -660,6 +660,7 @@ Run after phases 1 to 5 and again before every release, as its own change set. - **Release 2 Auto fallback and sidebar-order checks (2026-10-09, merged head `be87c8c`).** PR #38 now explains when a damaged or unwritable saved permission store makes Auto fail closed to Ask; its cross-platform CI [#37889002924](https://github.com/jay23606/codev/actions/runs/37889002924) and four-RID package preview [#37889002909](https://github.com/jay23606/codev/actions/runs/37889002909) passed. PR #39 adds drag-reordering within Pinned and Recents and verifies order restoration after a view-model reload; its portable/Avalonia tests passed on Windows, Linux, and macOS [#37943255278](https://github.com/jay23606/codev/actions/runs/37943255278), and all four package targets passed [#37943255316](https://github.com/jay23606/codev/actions/runs/37943255316). The follow-up docs update brings `docs/release-notes.md` into sync with these merged changes. Post-merge Windows/Linux/macOS CI [#37944018045](https://github.com/jay23606/codev/actions/runs/37944018045) passed. Local .NET 10 validation is unavailable on this checkout. - **Child-session drag-and-drop validation (2026-10-09, merged main `4b72cf6`).** PR #41 extended persisted ordering to child sessions; PR #42 added a headless interaction test that moves the pointer beyond the drag threshold, delivers DragEnter/DragOver/Drop, and confirms the child rows reorder. Cross-platform CI [#37951607464](https://github.com/jay23606/codev/actions/runs/37951607464), four-target preview [#37951607216](https://github.com/jay23606/codev/actions/runs/37951607216), and post-merge CI [#37952287393](https://github.com/jay23606/codev/actions/runs/37952287393) passed. The manual platform drag card is in `docs/avalonia-smoke-checklist.md`; native desktop drag remains unchecked. - **Top-level sidebar drag-and-drop interaction regression (2026-10-09).** The Avalonia headless test drives left-button press, movement past the drag threshold, and DragEnter/DragOver/Drop for two recent conversations, then asserts the sidebar collection order changed. The focused .NET 10 Release test passed locally; native manual pointer interaction remains unchecked. +- **Cross-group sidebar drop rejection (2026-10-09, PR #53, merged `cda255d`).** The headless interaction regression delivers Drop events from Pinned to Recents and between child sessions with different parents, then verifies each group's membership and order stay unchanged. The full headless suite passed on Windows, Linux, and macOS in CI [#37970798636](https://github.com/jay23606/codev/actions/runs/37970798636); all four packaged targets and their interaction checks passed in preview [#37970798808](https://github.com/jay23606/codev/actions/runs/37970798808). Native manual drag interaction remains unchecked. - **Local packaged Windows UI rerun (2026-10-08, artifact from feature head `b63afc9`).** Ran the exact preview ZIP with an isolated temporary data root and loopback Ollama/MCP fixtures. Auto file change, screenshot-matched command plus exact Deny, MCP Ask denial, stdio and Streamable HTTP calls, display/font persistence, search, and profile editing passed before the sidebar pin check. In two uninstrumented runs `IsPinned` remained false. A probe showed the screen point resolves to the `☆ Pin` UIA menu item, and `WindowFromPoint` plus the foreground check both resolve to windows owned by the Codev process; one instrumented copy passed once, while added settle/activation delays did not produce a reliable pass. Hosted Windows pin persistence passed in the same preview, and a new headless regression confirms the pin command persists across reload. The ordinary repository smoke script was left unchanged. Keep the local UIA click discrepancy open until a manual interaction or a reliable test explains it; this is not yet evidence of a confirmed product defect. - **Targeted MCP transport/configuration review (2026-10-07; initial source head `2fbb8e5`, current-source rerun on this checkout).** Reviewed the current configuration and execution boundaries for HTTP and stdio MCP servers: secret values are environment-backed rather than stored in settings; remote HTTP requires TLS and redirects are disabled to prevent forwarding configured headers; HTTP/SSE bodies and stdio frames have byte limits; stdio child processes use an explicit environment and are terminated as a process tree; MCP outputs enter the model through untrusted-result envelopes. The OAuth callback binds loopback and checks the redirect URI; protocol state validation remains delegated to the MCP SDK. No concrete defect was found in this focused pass. On this checkout, `dotnet test Codev.Tests/Codev.Tests.csproj -c Release --no-restore --filter 'FullyQualifiedName~Mcp'` passed 90 tests with one opt-in live-model test skipped, and `dotnet test Codev.Avalonia.Tests/Codev.Avalonia.Tests.csproj -c Release --no-restore --filter 'FullyQualifiedName~Mcp_'` passed 5 UI approval tests. Core integration coverage exercises legacy SSE fallback/tool invocation, HTTP OAuth success and issuer/state rejection, token refresh, and secret-header redirect handling. The in-memory MCP executor regression also confirms exact saved Deny blocks prompt retrieval as well as tool and resource calls in Auto, before the server prompt handler runs. This is scoped source review plus regression evidence, not the independent full security review; packaged HTTP/SSE UI scenarios, Ask-mode prompt/resource UI denial, hostile external server behavior, and broader external-side-effect review remain open. - **Targeted trusted-path and file-change review (2026-10-07, PR source head `c871125`).** Traced the trust registry, bounded project file reads, file proposal apply/restore, and race-resistant filesystem operations. Reads use no-follow handles and reject multi-link files; writes and deletes are relative to verified directory handles; review-time hashes refuse stale replacements. The focused `WorkspaceFileServiceTests` and `ProjectFolderTrustRegistryTests` passed 58/58, and `CodeTaskToolExecutorTests` plus `ConversationFileChangeHistoryServiceTests` passed 50/50 on Windows with .NET 10. These tests include link-swap/race and stale-change cases. No concrete gap was found in this scoped pass. It does not constrain arbitrary shell commands, which retain the user's account permissions, or complete the broader independent security review.