Skip to content

fix(gemini): derive project_path from caller/on-disk identity, not the log's directories#126

Open
akesling wants to merge 1 commit into
mainfrom
fix/gemini-project-path-trust
Open

fix(gemini): derive project_path from caller/on-disk identity, not the log's directories#126
akesling wants to merge 1 commit into
mainfrom
fix/gemini-project-path-trust

Conversation

@akesling

@akesling akesling commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

Root cause

Same latent bug class that #103 fixed for toolpath-claude: read_session_metadata reported ConversationMetadata.project_path from the chat file's internal directories()[0] — a file-internal claim. A session projected in from another machine (or any log whose recorded directory disagrees with where it actually lives) reports a foreign project path.

Fix

Both read_session_metadata sites (main-file Case A and orphan-UUID Case B) now resolve the display path through one helper with the trust order:

  1. caller-supplied project path, when absolute (Path::is_absolute(), so Windows drive paths count too) — the caller/OS identity wins;
  2. the file-internal directories()[0] as fallback;
  3. the passed string as last resort.

A reverse slot→path lookup (friendly name / SHA-256 hash) was originally drafted for step 2 but review + a reachability trace proved it dead code: PathResolver::project_dir never resolves tmp/<arg> verbatim, so a bare-slot caller fails file resolution with ConversationNotFound before this helper can run. It was removed — paths.rs is byte-identical to main, no public API change (the analysis is preserved in the helper's doc comment and CHANGELOG).

Tests

TDD: new test mirrors the #103 precedent — a chat file whose directories claims /somewhere/else, caller passes /real/project (hash-slot on-disk layout), metadata must report /real/project. toolpath-gemini 162 unit + 29 integration + 5 doc green; full workspace suite + clippy green. toolpath-gemini bumped 0.6.0 → 0.6.1.

Notes

  • Part of a six-PR consistency series from a cross-harness audit; CHANGELOG/version lines may conflict with sibling fix PRs — resolve by keeping both entries.
  • No path-cli/toolpath-cli bump here; one release bump lands after the series merges.

View with Codesmith Autofix with Codesmith
Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.

…e log's directories

read_session_metadata preferred the chat file's internal directories()[0]
over the caller-passed project path, so a session projected onto this
machine from elsewhere (e.g. path resume of a Pathbase upload) reported
the original author's foreign path instead of where it actually lives
here. Same class of bug as toolpath-claude #103.

New trust order: caller-supplied absolute path wins verbatim (checked
via Path::is_absolute so Windows drive paths count too); else fall back
to directories()[0], then the caller string, preserving prior behavior.
A non-absolute caller string can't actually reach metadata assembly —
PathResolver::project_dir never resolves a bare slot name to its own
slot directory, so file resolution fails first — hence no slot
reverse-lookup is needed and the public API is unchanged.
@github-actions

github-actions Bot commented Jul 8, 2026

Copy link
Copy Markdown

🔍 Preview deployed: https://f8a3115e.toolpath.pages.dev

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant