feat(enclave): support relative mount paths, skip missing directories

Author: mgabor3141

.changeset/enclave-relative-mounts.md

@@ -0,0 +1,7 @@
+---
+"pi-enclave": minor
+---
+
+Support relative mount paths and skip missing directories.
+
+Mount paths in config are now resolved against the workspace directory, so project configs can use short relative paths like `mounts = [".jj", ".git"]` instead of hardcoded absolute paths. Missing mount paths are silently skipped at VM start, making optional mounts safe to declare unconditionally.

packages/enclave/README.md

@@ -130,20 +130,24 @@ GraphQL policy parses the request body and checks actual field names (not the sp
 
 ### Mounts
 
-Additional directories to mount in the VM (e.g. for jj workspaces):
+The workspace directory is mounted automatically. Use `mounts` for directories outside it, like a jj/git repo root that is a parent of the workspace. Relative paths are resolved against the workspace directory. Missing paths are silently skipped, so optional mounts are safe to declare unconditionally:
 
 ```toml
-mounts = [
-  "~/dev/myproject/.jj",
-  "~/dev/myproject/.git",
-]
+# In .pi/enclave.toml (project config)
+mounts = ["../.jj", "../.git"]
+```
+
+Absolute and `~`-prefixed paths also work (useful in global config):
+
+```toml
+mounts = ["~/shared/data"]
 ```
 
 For read-only mounts, use the object form:
 
 ```toml
 mounts = [
-  "~/dev/myproject/.jj",
+  "../.jj",
   { path = "~/shared/configs", readonly = true },
 ]
 ```

packages/enclave/src/config.ts

@@ -353,13 +353,17 @@ export function loadConfig(cwd: string): {
 	const dropInPrefix = globalDropInDir();
 	const dropIns = layers.filter((l) => l.path.startsWith(dropInPrefix)).map((l) => basename(l.path, ".toml"));
 
-	// Expand ~ in mount paths
+	// Resolve mount paths: expand ~, resolve relative paths against cwd
 	if (merged.mounts) {
 		const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-		merged.mounts = merged.mounts.map((m) => ({
-			...m,
-			path: m.path.startsWith("~/") ? join(home, m.path.slice(2)) : m.path === "~" ? home : m.path,
-		}));
+		const resolvedCwd = resolve(cwd);
+		merged.mounts = merged.mounts.map((m) => {
+			let p = m.path;
+			if (p === "~") p = home;
+			else if (p.startsWith("~/")) p = join(home, p.slice(2));
+			else if (!p.startsWith("/")) p = join(resolvedCwd, p);
+			return { ...m, path: p };
+		});
 	}
 
 	return { merged, policies, hasGlobalConfig, hasProjectConfig, dropIns };

packages/enclave/src/vm.ts

@@ -8,6 +8,7 @@
  */
 
 import { execSync } from "node:child_process";
+import { existsSync } from "node:fs";
 import {
 	type CreateHttpHooksOptions,
 	type ExecResult,
@@ -213,9 +214,11 @@ export class EnclaveVM {
 			[workspaceDir]: shadowedFs,
 		};
 
-		// Extra mounts (e.g. jj repo root, shared directories)
+		// Extra mounts (e.g. jj repo root, shared directories).
+		// Skip paths that don't exist on the host (common with optional mounts like .jj/.git).
 		for (const extra of this.options.extraMounts) {
 			if (mounts[extra.path]) continue; // workspace already mounted
+			if (!existsSync(extra.path)) continue;
 			const provider = new RealFSProvider(extra.path);
 			if (extra.readonly) {
 				mounts[extra.path] = new ShadowProvider(provider, {

packages/enclave/templates/pi-enclave.d/jj.toml

@@ -1,8 +1,7 @@
 # Jujutsu (jj) support for pi-enclave
-# For jj workspaces, add a mount for the parent .jj directory in your
-# project config:
+# If the jj repo root is above your workspace, mount it in your project config:
 #
-# mounts = ["~/dev/myproject/.jj"]
+# mounts = ["../.jj"]
 packages = ["jujutsu"]
 setup = """
 jj config set --user user.name "$USER_NAME"

packages/enclave/templates/project.toml

@@ -2,5 +2,6 @@
 # Protects API keys and isolates file access.
 enabled = true
 
-# Mount additional directories in the VM (supports ~):
-# mounts = ["~/dev/myproject/.jj"]
+# Mount directories outside the workspace (relative paths ok, supports ~).
+# Missing paths are silently skipped.
+# mounts = ["../.jj", "../.git"]

packages/enclave/test/integration.test.ts

@@ -153,7 +153,7 @@ describe("addPackageToConfig", () => {
 	});
 });
 
-describe("mount path ~ expansion", () => {
+describe("mount path resolution", () => {
 	it("expands ~ to HOME in mount paths", () => {
 		ensureGlobalConfig();
 		const projectDir = join(tmpDir, "project");
@@ -173,4 +173,42 @@ describe("mount path ~ expansion", () => {
 		expect(merged.mounts?.[0]?.path).toBe(join(tmpDir, "dev/.jj"));
 		expect(merged.mounts?.[1]?.path).toBe(join(tmpDir, "dev/.git"));
 	});
+
+	it("resolves relative paths against cwd", () => {
+		const projectDir = join(tmpDir, "project", "sub");
+		mkdirSync(join(projectDir, ".pi"), { recursive: true });
+		writeFileSync(join(projectDir, ".pi", "enclave.toml"), 'enabled = true\nmounts = ["../.jj", "../.git"]\n');
+		const { merged } = loadConfig(projectDir);
+		expect(merged.mounts).toHaveLength(2);
+		expect(merged.mounts?.[0]?.path).toBe(join(tmpDir, "project", ".jj"));
+		expect(merged.mounts?.[1]?.path).toBe(join(tmpDir, "project", ".git"));
+	});
+
+	it("resolves nested relative paths against cwd", () => {
+		const projectDir = join(tmpDir, "project");
+		mkdirSync(join(projectDir, ".pi"), { recursive: true });
+		writeFileSync(join(projectDir, ".pi", "enclave.toml"), 'enabled = true\nmounts = ["../shared/data"]\n');
+		const { merged } = loadConfig(projectDir);
+		expect(merged.mounts?.[0]?.path).toBe(join(tmpDir, "shared/data"));
+	});
+
+	it("leaves absolute paths unchanged", () => {
+		const projectDir = join(tmpDir, "project");
+		mkdirSync(join(projectDir, ".pi"), { recursive: true });
+		writeFileSync(join(projectDir, ".pi", "enclave.toml"), 'enabled = true\nmounts = ["/tmp/shared"]\n');
+		const { merged } = loadConfig(projectDir);
+		expect(merged.mounts?.[0]?.path).toBe("/tmp/shared");
+	});
+
+	it("resolves relative paths in object mount syntax", () => {
+		const projectDir = join(tmpDir, "project", "sub");
+		mkdirSync(join(projectDir, ".pi"), { recursive: true });
+		writeFileSync(
+			join(projectDir, ".pi", "enclave.toml"),
+			'enabled = true\n\n[[mounts]]\npath = "../.jj"\nreadonly = true\n',
+		);
+		const { merged } = loadConfig(projectDir);
+		expect(merged.mounts?.[0]?.path).toBe(join(tmpDir, "project", ".jj"));
+		expect(merged.mounts?.[0]?.readonly).toBe(true);
+	});
 });