clawwork-ai/ClawWork

[Bug] migrateWorkspace path check uses hardcoded '/' separator, bypassed on Windows

Open

#382 opened on Apr 15, 2026

 (2 comments) (0 reactions) (0 assignees)TypeScript (76 forks)github user discovery
area/artifactgood first issuekind/bug

Repository metrics

Stars
 (529 stars)
PR merge metrics
 (Avg merge 22d) (2 merged PRs in 30d)

Description

Problem

migrateWorkspace validates that the new workspace path is not inside the old one, to prevent a recursive copy loop. The check uses a hardcoded / separator, which is always wrong on Windows — path.resolve() returns C:\foo\bar style paths there, so startsWith(oldPath + '/') is always false and the guard is silently bypassed.

Location

File: packages/desktop/src/main/workspace/init.ts:11-17

export async function migrateWorkspace(oldPath: string, newPath: string): Promise<void> {
  if (!existsSync(oldPath)) throw new Error(`Source workspace does not exist: ${oldPath}`);
  const resolvedOld = resolve(oldPath);
  const resolvedNew = resolve(newPath);
  if (resolvedNew.startsWith(resolvedOld + '/') || resolvedNew === resolvedOld) {
    throw new Error('New workspace path must not be inside or equal to the current workspace');
  }

On Windows, a user could pick C:\workspace\sub as the new workspace while the old one is C:\workspace, and the recursive copy would create C:\workspace\sub\sub\sub\... until disk fills up.

Fix Approach

  1. Import sep from path.
  2. Replace resolvedOld + '/' with resolvedOld + sep.

Verification

  1. Run pnpm check — must pass.
  2. Add a unit test for migrateWorkspace that exercises the nested-path rejection with platform-appropriate separators.

Context

  • WG: Artifact & File System
  • Priority: Low (good first issue)
  • Estimated effort: 10-15 minutes

Contributor guide