Skip to content

fix: register pendingSave around workspace.save and save_as (Closes #982)#983

Merged
xiaolai merged 1 commit into
mainfrom
fix/audit-982
May 31, 2026
Merged

fix: register pendingSave around workspace.save and save_as (Closes #982)#983
xiaolai merged 1 commit into
mainfrom
fix/audit-982

Conversation

@xiaolai
Copy link
Copy Markdown
Owner

@xiaolai xiaolai commented May 31, 2026

Closes #982

Summary

  • handleWorkspaceSave and handleWorkspaceSaveAs in the MCP v2 bridge wrote directly via writeTextFile() with no registerPendingSave / clearPendingSave coordination, so the external file watcher would treat our own writes as external changes and prompt the user to reload.
  • Apply the same register → write → clear (try/finally) pattern that [audit] mcp-bridge: document.write bypasses pendingSaves, triggers spurious external-change dialog #975 added to document.write.
  • Extend workspace.test.ts to assert the coordination for both save and save_as, including the rejection path.

Test plan

  • pnpm test src/hooks/mcpBridge/v2/__tests__/workspace.test.ts — 18 tests pass
  • pnpm check:all — full gate passes (lint + test + build)
  • grep registerPendingSave src/hooks/mcpBridge/v2/workspace.ts → 3 matches (import + 2 calls)
  • grep clearPendingSave src/hooks/mcpBridge/v2/workspace.ts → 3 matches (import + 2 calls)

…loses #982)

handleWorkspaceSave and handleWorkspaceSaveAs in the MCP v2 bridge wrote
directly via writeTextFile() without registerPendingSave / clearPendingSave
coordination. The external file watcher couldn't tell these were our own
writes and would prompt the user to reload, potentially discarding the
AI's save or interleaved edits.

Apply the same register → write → clear (with try/finally) pattern that
issue #975 added to document.write, and extend the workspace tests to
assert both handlers register and clear the pending save, including when
writeTextFile rejects.
@xiaolai xiaolai added the audit Codebase audit finding label May 31, 2026
@xiaolai
Copy link
Copy Markdown
Owner Author

xiaolai commented May 31, 2026

VERIFIED — The audit finding is resolved. handleWorkspaceSave and handleWorkspaceSaveAs now wrap writeTextFile with registerPendingSave/clearPendingSave in try/finally blocks (matching the #975 reference pattern), and tests assert correct call ordering plus cleanup on write rejection; changes are scoped to workspace.ts and its test file with no touches to document.ts or other modules.

@xiaolai xiaolai enabled auto-merge (squash) May 31, 2026 10:44
@xiaolai xiaolai merged commit 6df93a6 into main May 31, 2026
8 checks passed
@xiaolai xiaolai deleted the fix/audit-982 branch May 31, 2026 10:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

audit Codebase audit finding

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[audit] mcp-bridge: workspace.save and workspace.save_as bypass pendingSaves, trigger spurious external-change dialog

1 participant