This commit introduces several improvements to the security and file handling mechanisms across the application. Key changes include:
- Updated the Dockerfile to pin the GitHub CLI version for reproducible builds.
- Refactored the secure file system operations to ensure consistent path validation and type handling.
- Removed legacy path management functions and streamlined the allowed paths logic in the security module.
- Enhanced route handlers to validate path parameters against the ALLOWED_ROOT_DIRECTORY, improving security against unauthorized access.
- Updated the settings service to focus solely on the Anthropic API key, removing references to Google and OpenAI keys.
These changes aim to enhance security, maintainability, and clarity in the codebase.
Tests: All unit tests passing.
- Add comprehensive unit tests for SettingsService, covering global and project settings management, including creation, updates, and merging with defaults.
- Implement tests for handling credentials, ensuring proper masking and merging of API keys.
- Introduce tests for migration from localStorage, validating successful data transfer and error handling.
- Enhance error handling in subprocess management tests, ensuring robust timeout and output reading scenarios.
- Updated Playwright configuration to always reuse existing servers, improving test efficiency.
- Enhanced CreatePRDialog to handle null browser URLs gracefully, ensuring better user experience during PR creation failures.
- Added new unit tests for app specification format and automaker paths, improving test coverage and reliability.
- Introduced tests for file system utilities and logger functionality, ensuring robust error handling and logging behavior.
- Implemented comprehensive tests for SDK options and dev server service, enhancing overall test stability and maintainability.
The test "should reuse existing session if already started" expected fs.readFile to be called 1 time, but startConversation calls it 2 times on first call (loadSession + loadMetadata). The second call correctly reuses the in-memory session.
Co-authored-by: GTheMachine <156854865+GTheMachine@users.noreply.github.com>
