Feat/web saas single user by cllarisy · Pull Request #476 · NanmiCoder/cc-haha

cllarisy · 2026-05-16T13:32:34Z

非常抱歉！我是 GitHub 菜鸟，不小心将自己 fork 分支的 commits 推送到了大佬的主项目中，我想挖个坑跳进去！
I'm really sorry! I'm a GitHub newbie, and I accidentally pushed commits from my fork branch to your main project. I feel so embarrassed that I just want to dig a hole and hide in it!

Summary

Feature Quality Contract

Changed surface:
Tests added or updated:
Coverage evidence:
E2E / live-model evidence:
Known risk / rollback:

Verification

I ran the relevant local checks, or explained why they do not apply.
I added or updated same-area tests for every production behavior change.
I ran bun run verify for code changes, including the coverage gate.
New or changed executable production lines meet the changed-line coverage threshold, or the blocker/maintainer override is documented.
I attached or summarized the quality report path, JUnit/log artifact path, and pass/fail/skip counts.
I ran E2E/live smoke for cross-boundary, provider/runtime, desktop chat, agent-loop, native, or release changes, or documented the blocker.

Risk

This PR does not touch CLI core paths, or it has maintainer approval for allow-cli-core-change.
Production code changes include matching tests, or have maintainer approval for allow-missing-tests.
Coverage baseline/threshold changes have maintainer approval for allow-coverage-baseline-change.
Quarantined tests still have owners, exit criteria, and unexpired review windows.
Provider/runtime changes were covered by mock contract tests, and live smoke was run or explicitly deferred.

@dosubot review this PR for changed-area risk, missing tests, docs impact, desktop startup risk, and CLI core impact.

Also broadens the default agent prompt to cover general tasks (src/constants/prompts.ts), bundled in this commit per user request.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…ions - Change resolveSessionWorkDir default from os.homedir() to the workspace root so on-the-fly sessions create their workspace inside the sandbox - Update stale getPermissionArgs test assertion in conversations.test.ts Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…aS router Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Add ensureInsideWorkspaceRoot guard to all filesystem route handlers (browse, file, read). The guard validates paths against the configured workspace root before the per-session isAllowedFilesystemPath check. Also add a /api/filesystem/read endpoint for reading file contents. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

github-actions · 2026-05-16T13:32:53Z

PR quality triage

Changed areas: area:desktop, area:docs, area:server

CLI core policy: No CLI-core policy block detected.

Missing-test policy: Blocked by policy until a maintainer applies allow-missing-tests or matching tests are added.

Coverage baseline policy: No coverage-baseline policy block detected.

CLI core files:

none

Coverage policy files:

none

Expected checks:

change-policy
desktop-checks
server-checks
desktop-native-checks
docs-checks
coverage-checks

Test coverage signals:

BLOCKING unless allow-missing-tests is applied: Desktop product files changed without a desktop test file in the PR.
BLOCKING unless allow-missing-tests is applied: Agent/runtime product files changed without a tools/utils test file in the PR.
Agent/model runtime path changed: use mock/request-shape tests in PR and maintainer live-model smoke before release.

Risk notes:

Desktop state/API layer changed: verify store persistence, WebSocket behavior, and startup errors.
Session runtime changed: review reconnect, startup diagnostics, provider selection, and thinking settings.

Hard merge gates still come from GitHub Actions, not AI review.

Dosu handoff: Dosu can be used as the AI reviewer for risk explanation, missing-test prompts, and maintainer Q&A. If it does not comment automatically from the PR template, ask:

@dosubot review this PR for changed-area risk, missing tests, docs impact, desktop startup risk, and CLI core impact.

dosubot · 2026-05-16T13:38:47Z

Hi @cllarisy! I'm Dosu and I’m helping the cc-haha team.

Here's my review of PR #476 across the requested dimensions:

Changed-Area Risk

High Risk 🔴

Authentication fully disabled — requireAuth middleware now returns null for all requests. This is only safe for single-user deployments on isolated/trusted networks. Any internet-facing exposure without a reverse proxy or network isolation is a critical vulnerability.
Permissive CORS — All origins are now allowed. Same concern as above: only acceptable behind a trusted boundary.
--dangerously-skip-permissions always used — The workspace root becomes the sole security boundary. A bug in path validation = unrestricted filesystem access.

Medium Risk 🟡

Breaking API contract — Session creation changed from workDir → workspaceName. Existing clients calling this API will break with no documented migration path.
Removed endpoints — Computer Use, OAuth, Doctor, H5-access all return 404. No version negotiation or graceful degradation for existing integrations.
Workspace root path edge cases — Cross-platform path normalization (Windows vs Unix) is tested but real-world edge cases may surface.

Missing Tests

Test coverage is good overall — 5 new test files and 6 updated test files. Gaps I'd flag:

No tests for isWebRuntime() runtime detection logic in the desktop frontend.
No tests verifying that desktop components gracefully handle disabled APIs when running in web mode.
No integration tests for the Vite path-alias reuse (@desktop/*) to catch breakage from desktop component changes.
No negative tests for the workspace root singleton lifecycle (e.g., what happens if configureWorkspaceRoot() is never called before a request arrives).

Docs Impact

✅ New documentation added at docs/web-saas/01-quickstart.md covering:

Server startup with CC_HAHA_WORKSPACES_ROOT env var
Web frontend build/dev instructions
Intentionally disabled features
Workspace root security model

Gap: No documentation on the API contract change (workDir → workspaceName) or client migration steps.

Desktop Startup Risk

Moderate. Three files affect startup flow:

AppShell.tsx — Conditionally skips initializeDesktopServerUrl() when isWebRuntime() is true.
desktopRuntime.ts — New runWebRuntimeBootstrap() sets base URL to window.location.origin and auth token to null.
web/src/main.tsx — Calls bootstrap before render.

Risk: if isWebRuntime() detection fails or is misconfigured, the desktop app could skip server URL init (broken desktop) or the web app could attempt Tauri-specific calls (runtime errors). No automated tests cover this branch.

CLI Core Impact

✅ No CLI core paths appear to be touched. Changes are confined to:

Server API/routing
Desktop/web frontend
Service layer (workspace root, sessions, filesystem)

Summary Verdict

This is a major architectural change that introduces a single-user web deployment profile. The security trade-offs (disabled auth, permissive CORS, skipped permissions) are intentional but must be clearly communicated as deployment constraints. The test and docs coverage is reasonable but has the gaps noted above.

Recommendations before merge:

Document the workDir → workspaceName migration path for API consumers.
Add at least a smoke test for isWebRuntime() desktop startup branching.
Consider adding a startup warning log if the server binds to a public interface with auth disabled.
Verify workspace root singleton initialization has a fail-safe if called before configuration.

To reply, just mention @dosu.

Docs are dead. Just use Dosu.

Replace rollupOptions.external with resolve.alias — externals only cover production builds, but Vite's dev-server dependency scan also walks every import site eagerly. A dedicated stub module with every named export the desktop/src tree references lets both dev and production builds resolve cleanly without installing the native Tauri packages. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

The plan's original approach of importing desktop/src into the Vite build pulled 280+ CLI modules (bun:bundle, .js ext imports, native addons) that Vite cannot resolve. Replaced with a self-contained React chat app that talks directly to the Bun server via HTTP and WebSocket — no desktop/src or src/ imports, clean 30-module build. Removed all desktop-only dependencies (tailwind, lucide, mermaid, shiki, etc.) from web/package.json. Serves fonts and icons from desktop/public via Vite's publicDir config. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

… mode In the web SaaS profile, the server process holds API credentials in its environment and the child CLI inherits them directly. Desktop concepts like managed OAuth (CLAUDE_CODE_ENTRYPOINT=claude-desktop) and provider env stripping (which removes ANTHROPIC_API_KEY from child env) are now disabled — shouldMarkManagedOAuth always returns false, and shouldStripInheritedProviderEnv always returns false. This fixes "Not logged in · Please run /login" errors that occurred because the child CLI had no API key to authenticate with. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Hejinhe and others added 15 commits May 15, 2026 21:05

feat(server): add workspace root service with sandbox containment

7a48ae7

Also broadens the default agent prompt to cover general tasks (src/constants/prompts.ts), bundled in this commit per user request.

feat(server): configure workspace root on startup

e52cbee

feat(server): confine session creation to workspace root

fbdce44

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

feat(server): always bypass CLI permissions inside workspace root

bbf26ea

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

fix(server): use hardenedOptions in recursive startSession retry

2e506f4

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

feat(server): remove computer-use, OAuth, and doctor surfaces from Sa…

ebc9d8a

…aS router Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

feat(server): single-user SaaS auth and permissive CORS

9be56b2

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

feat(server): serve web/dist as the primary static frontend

b00be10

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

feat(web): scaffold web frontend that reuses desktop React tree

1fb60ed

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

feat(web): bootstrap the React shell for web runtime

ed14cd2

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

feat(web): hide Computer Use surfaces in browser runtime

4a0d6fd

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docs: add web SaaS quickstart

1b7a398

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

test(server): add SaaS startup smoke test

907bac2

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

dosubot Bot added size:XL This PR changes 500-999 lines, ignoring generated files. enhancement New feature or request labels May 16, 2026

github-actions Bot added area:desktop area:docs area:server needs-maintainer-approval labels May 16, 2026

Hejinhe and others added 4 commits May 16, 2026 21:44

chore: add web build artifacts to .gitignore

e6486b4

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

cllarisy closed this May 19, 2026

cllarisy deleted the feat/web-saas-single-user branch May 19, 2026 16:33

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feat/web saas single user#476

Feat/web saas single user#476
cllarisy wants to merge 19 commits into
NanmiCoder:mainfrom
cllarisy:feat/web-saas-single-user

cllarisy commented May 16, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 16, 2026

Uh oh!

dosubot Bot commented May 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

cllarisy commented May 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Feature Quality Contract

Verification

Risk

Uh oh!

github-actions Bot commented May 16, 2026

PR quality triage

Uh oh!

dosubot Bot commented May 16, 2026

Changed-Area Risk

Missing Tests

Docs Impact

Desktop Startup Risk

CLI Core Impact

Summary Verdict

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

cllarisy commented May 16, 2026 •

edited

Loading