burin/helix-loader/ at 3286d03bc0e1979835e111abedb5e1a030a210ad · isaaccorbrey.com/burin · Tangled

isaaccorbrey.com / burin

0

A post-modern development environment.

0

burin / helix-loader

1 folder 2 files

at 3286d03bc0e1979835e111abedb5e1a030a210ad

Blaž Hrastnik workspace trust: v2 (#15857) 5w ago

workspace trust: v2 (#15857) * workspace trust: v2 Simplifies the previous implementation: user is prompted to either trust or deny, esc skips the prompt for now. Less choice fatigue and matches other implementations. Unlike other editors, we follow direnv implementation: .helix/ contents are hashed and a change to the config requires the user to re-approve. This avoids attack vectors where the user trusts the workspace but pulls in an untrusted PR branch. To make the hashing safe I had to pull in sha2, we could in practice use sha1 that's already in the dependency tree via gix, but that seems like a bad cryptographic choice in 2026. The on-disk file layout changed to use a directory with a file per filepath, this avoids concurrent conflicts if you have multiple different editor instances writing to the trust config. If the workspace is running in untrusted mode and trusting would make a meaningful change (local config exists, or in level=none a language server would start), then we show an indicator on the bottom corner of the editor. There's still a problem with git config: smudge filters still get executed and disabling that in untrusted mode would break autocrlf diffs. Since we only leverage gix for diffing, I'm hoping upstream could consider a patch for this. * Address lints * Address clippy lint * Break doc links to private items Should get the lints CI green * fix: gix regression * Rename all to insecure, reintroduce globs * fix lint * Remove unused function --------- Co-authored-by: Michael Davis <mcarsondavis@gmail.com>

1 month ago

workspace trust: v2 (#15857) * workspace trust: v2 Simplifies the previous implementation: user is prompted to either trust or deny, esc skips the prompt for now. Less choice fatigue and matches other implementations. Unlike other editors, we follow direnv implementation: .helix/ contents are hashed and a change to the config requires the user to re-approve. This avoids attack vectors where the user trusts the workspace but pulls in an untrusted PR branch. To make the hashing safe I had to pull in sha2, we could in practice use sha1 that's already in the dependency tree via gix, but that seems like a bad cryptographic choice in 2026. The on-disk file layout changed to use a directory with a file per filepath, this avoids concurrent conflicts if you have multiple different editor instances writing to the trust config. If the workspace is running in untrusted mode and trusting would make a meaningful change (local config exists, or in level=none a language server would start), then we show an indicator on the bottom corner of the editor. There's still a problem with git config: smudge filters still get executed and disabling that in untrusted mode would break autocrlf diffs. Since we only leverage gix for diffing, I'm hoping upstream could consider a patch for this. * Address lints * Address clippy lint * Break doc links to private items Should get the lints CI green * fix: gix regression * Rename all to insecure, reintroduce globs * fix lint * Remove unused function --------- Co-authored-by: Michael Davis <mcarsondavis@gmail.com>

1 month ago

docs(loader): fix "enouch" typo (#15414)

4 months ago