clawwork-ai/ClawWork

[Bug] migrateWorkspace path check uses hardcoded '/' separator, bypassed on Windows

Open

#382 opened on Apr 15, 2026

View on GitHub
 (2 comments) (0 reactions) (0 assignees)TypeScript (63 forks)github user discovery
area/artifactgood first issuekind/bug

Repository metrics

Stars
 (519 stars)
PR merge metrics
 (PR metrics pending)

Description

Problem

migrateWorkspace validates that the new workspace path is not inside the old one, to prevent a recursive copy loop. The check uses a hardcoded / separator, which is always wrong on Windows — path.resolve() returns C:\foo\bar style paths there, so startsWith(oldPath + '/') is always false and the guard is silently bypassed.

Location

File: packages/desktop/src/main/workspace/init.ts:11-17

export async function migrateWorkspace(oldPath: string, newPath: string): Promise<void> {
  if (!existsSync(oldPath)) throw new Error(`Source workspace does not exist: ${oldPath}`);
  const resolvedOld = resolve(oldPath);
  const resolvedNew = resolve(newPath);
  if (resolvedNew.startsWith(resolvedOld + '/') || resolvedNew === resolvedOld) {
    throw new Error('New workspace path must not be inside or equal to the current workspace');
  }

On Windows, a user could pick C:\workspace\sub as the new workspace while the old one is C:\workspace, and the recursive copy would create C:\workspace\sub\sub\sub\... until disk fills up.

Fix Approach

  1. Import sep from path.
  2. Replace resolvedOld + '/' with resolvedOld + sep.

Verification

  1. Run pnpm check — must pass.
  2. Add a unit test for migrateWorkspace that exercises the nested-path rejection with platform-appropriate separators.

Context

  • WG: Artifact & File System
  • Priority: Low (good first issue)
  • Estimated effort: 10-15 minutes

Contributor guide