Breadway/bos-settings
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Settings redesign: hub navigation (reconciled with the operand hardening) #2

Merged
Breadway merged 3 commits from feature/settings-redesign into main 2026-08-31 18:14:21 +08:00
Conversation 0 Commits 3 Files changed 97 +2664 -1142
Breadway commented 2026-08-31 18:02:57 +08:00
Owner
Copy link

Rebased onto origin/main. Two commits: the redesign squash (dce2031, unchanged content) and a reconciliation commit (3dfc9d5).

The redesign (dce2031)

Hub-based navigation — home / network / displays / input / apps / privacy / system hub pages, redesigned sidebar, shared nav state, new hub view components. Alongside: input validation into root commands, set_charge_threshold tee-stdin fix, streaming-install stdin fix, frontend type fixes, version → 0.8.2, clippy/svelte-check cleanup. 102 files — unreviewable commit-by-commit; this is the enumerated version.

Reconciliation with f7b114f "Harden privileged command operands" (3dfc9d5)

The branch was cut before that hardening landed. Rebase conflicts in users.rs / power.rs / firewall.rs / capabilities/default.json were resolved to keep the stricter side of each, then fold the redesign's additions on top:

file kept from f7b114f folded in from redesign
users.rs chpasswd_input (validates the password for : / newline — the redesign only checked the username), may_delete_user (refuses root / current user) -- argv separators, GECOS control-char stripping
power.rs charge_threshold_write (validates which, clamps) + util::run_with_stdin + its test brightness .clamp(0,100)
firewall.rs port-only valid_firewall_rule / valid_rule_number allowlist —
capabilities/default.json opener:default stays removed (nothing uses the opener plugin) 4 × core:window:* (the redesign's custom Titlebar.svelte needs them)

Dropped util::valid_username / util::valid_cli_value (redesign added them; every call site now uses the stricter f7b114f local validator) + an unused import.

⚠️ One unresolved product call

firewall.rs keeps f7b114f's port-only validator, which rejects service names like OpenSSH. The redesign's Firewall UI hint advertises exactly that (e.g. "8080/tcp" ... or a service name like "OpenSSH"). Either loosen the backend to util::valid_cli_value (still blocks flag/;/control injection, argv-safe) or drop the service-name hint. Left strict pending your decision — flagged in the commit message.

tauri.conf.json (+10)

version 0.8.0 → 0.8.2 (drift fix; Cargo.toml was already 0.8.2), window 960×640 → 1280×840 + minWidth/minHeight, cosmetic backgroundColor. identifier, CSP, and assetProtocol scope unchanged — no allowlist/security loosening.

Checks

Backend cargo build / cargo test (64 pass) / cargo clippy --all-targets -- -D warnings — clean. npm run build (frontend) — clean. screenshot.rs KNOWN_VIEWS updated with the new hub routes.

Manual smoke (needs doing on hermes)

  • launch the app, walk every hub → panel, custom titlebar buttons (close/min/max) + drag region
  • Users: add / remove / change-password (try a : or newline in the password → rejected; try removing root / yourself → rejected)
  • Power: charge threshold set (try which other than start/end → rejected), brightness
  • Firewall: add 8080/tcp (works), add OpenSSH (currently rejected — see the flag above)
  • bos-settings --screenshot <view> --output x.png for a few of the new hub views
  • OS-level panels (from the deferred-extras landing) still function
Rebased onto `origin/main`. Two commits: the redesign squash (`dce2031`, unchanged content) and a reconciliation commit (`3dfc9d5`). ## The redesign (`dce2031`) Hub-based navigation — home / network / displays / input / apps / privacy / system hub pages, redesigned sidebar, shared nav state, new hub view components. Alongside: input validation into root commands, `set_charge_threshold` tee-stdin fix, streaming-install stdin fix, frontend type fixes, version → 0.8.2, clippy/svelte-check cleanup. **102 files** — unreviewable commit-by-commit; this is the enumerated version. ## Reconciliation with `f7b114f` "Harden privileged command operands" (`3dfc9d5`) The branch was cut **before** that hardening landed. Rebase conflicts in `users.rs` / `power.rs` / `firewall.rs` / `capabilities/default.json` were resolved to keep the **stricter** side of each, then fold the redesign's additions on top: | file | kept from f7b114f | folded in from redesign | |---|---|---| | `users.rs` | `chpasswd_input` (validates the **password** for `:` / newline — the redesign only checked the username), `may_delete_user` (refuses root / current user) | `--` argv separators, GECOS control-char stripping | | `power.rs` | `charge_threshold_write` (validates `which`, clamps) + `util::run_with_stdin` + its test | brightness `.clamp(0,100)` | | `firewall.rs` | port-only `valid_firewall_rule` / `valid_rule_number` allowlist | — | | `capabilities/default.json` | `opener:default` stays **removed** (nothing uses the opener plugin) | 4 × `core:window:*` (the redesign's custom `Titlebar.svelte` needs them) | Dropped `util::valid_username` / `util::valid_cli_value` (redesign added them; every call site now uses the stricter f7b114f local validator) + an unused import. ## ⚠️ One unresolved product call `firewall.rs` keeps f7b114f's **port-only** validator, which rejects service names like `OpenSSH`. The redesign's Firewall UI hint advertises exactly that (`e.g. "8080/tcp" ... or a service name like "OpenSSH"`). **Either** loosen the backend to `util::valid_cli_value` (still blocks flag/`;`/control injection, argv-safe) **or** drop the service-name hint. Left strict pending your decision — flagged in the commit message. ## tauri.conf.json (`+10`) `version` 0.8.0 → 0.8.2 (drift fix; Cargo.toml was already 0.8.2), window 960×640 → 1280×840 + `minWidth`/`minHeight`, cosmetic `backgroundColor`. **`identifier`, CSP, and `assetProtocol` scope unchanged** — no allowlist/security loosening. ## Checks Backend `cargo build` / `cargo test` (64 pass) / `cargo clippy --all-targets -- -D warnings` — clean. `npm run build` (frontend) — clean. `screenshot.rs` `KNOWN_VIEWS` updated with the new hub routes. ## Manual smoke (needs doing on hermes) - launch the app, walk every hub → panel, custom titlebar buttons (close/min/max) + drag region - Users: add / remove / change-password (try a `:` or newline in the password → rejected; try removing root / yourself → rejected) - Power: charge threshold set (try `which` other than start/end → rejected), brightness - Firewall: add `8080/tcp` (works), add `OpenSSH` (**currently rejected** — see the flag above) - `bos-settings --screenshot <view> --output x.png` for a few of the new hub views - OS-level panels (from the deferred-extras landing) still function
Breadway added 3 commits 2026-08-31 18:02:57 +08:00 
Rework the settings app around hub pages (home, network, displays, input,
apps, privacy, system) with a redesigned sidebar, shared nav state, and new
hub view components. Alongside the redesign: validate webview inputs into
root commands (users, firewall, snapshots, wifi), fix set_charge_threshold
writing the percentage via tee stdin, prevent streaming installs from
hanging on inherited stdin, add frontend type fixes, sync versions to
0.8.2, and clean up clippy/svelte-check warnings.
Generated with Codebuff 🤖
Co-Authored-By: Codebuff <noreply@codebuff.com>
The redesign branch was cut before "Harden privileged command operands
against injection" landed on main; the rebase conflicts in users.rs,
power.rs, firewall.rs and capabilities/default.json were resolved to
keep the stricter side of each:

- users.rs: keep `chpasswd_input` / `valid_chpasswd_password` (validates
  the *password* for `:` / newline, which the redesign's inline checks
  missed) and `may_delete_user` (refuses root / the current user);
  fold in the redesign's `--` argv separators and GECOS control-char
  stripping on top.
- power.rs: keep `charge_threshold_write` (validates `which` ∈
  {start,end} and clamps) + `util::run_with_stdin` for the tee pipe,
  plus its test; take the redesign's brightness clamp.
- firewall.rs: keep the port-only `valid_firewall_rule` /
  `valid_rule_number` allowlist from f7b114f. NOTE: the redesign's
  Firewall UI hint advertises service names ("OpenSSH") which this
  validator rejects — either loosen it to `util::valid_cli_value` or
  drop the service-name hint. Left strict pending that call.
- capabilities/default.json: keep `opener:default` removed (nothing in
  the frontend or backend uses the opener plugin); add the four
  `core🪟*` perms the redesign's custom Titlebar needs.

Drops `util::valid_username` / `util::valid_cli_value` (added by the
redesign, now unused — every call site uses the stricter f7b114f local
validator) and the unused `use super::util` in firewall.rs.
Breadway merged commit b34fd6c807 into main 2026-08-31 18:14:21 +08:00
Breadway deleted branch feature/settings-redesign 2026-08-31 18:14:21 +08:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Breadway/bos-settings#2
No description provided.
Delete branch "feature/settings-redesign"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?