Fix review findings: secrets in snapshots, URL spoofing, migration data loss
Adversarial review of the branch produced findings across four areas. This addresses them, plus the Windows CI environment. Secrets. commit_container_snapshot baked the container's full env into the per-project snapshot image, so the shared OAuth token — and the AWS keys, git token and gateway master key — outlived revocation and were readable via docker inspect. Verified against Engine 29.6 that a commit body's config merges over the container's: keys cannot be dropped but can be overwritten, so all of them now commit as KEY=. clear_claude_token additionally rewrites images from earlier builds and reports honestly when a tag could not be rewritten. The recommendation to move the token out of env entirely was not taken, with reasoning: apiKeyHelper is a different auth method that outranks CLAUDE_CODE_OAUTH_TOKEN rather than a transport for it, and no file-based delivery exists. The durable exposure — the image — is what is closed here. Separately noted, not fixed: entrypoint.sh captures the token into the scheduler's .env inside the persisted volume. URL spoofing. Three call sites reached openUrl with container-controlled strings, one of which the review missed (the WebLinksAddon handler). The sign-in URL was scraped from container output with a longest-match tie-break and no userinfo check, so claude.ai@evil.tld rendered as "claude.ai…" in a truncating element. There is now one sanitizer in front of every sink — scheme allowlist, no userinfo, C0/C1 and quote rejection, host allowlist for the sign-in case, first-match — and the origin renders un-truncated. The toast is keyed so a changed URL remounts, closing a bait-and-switch where the user read one URL and clicked another. Migration. The rollback pin was best-effort: a tag failure was logged and the migration continued past remove_container, after which the final commit overwrote the only copy of the old system layer. It now aborts before anything destructive and reads the tag back. /var was destroyed while the ordinary recreate path preserves it — making the "safe" alternative to Reset more destructive than Reset's alternative; data-bearing subtrees are now detected and disclosed in the pre-flight rather than copied, since tarring a live database onto a different base's packages is a corruption risk. resume_migration now verifies the migration-state label instead of reporting success for a container that never swapped. dismiss actually resolves the record rather than leaving the feature permanently refusing to migrate. Start and Reset are guarded while a migration is live. Lifecycle. The gateway no longer publishes on 0.0.0.0 — bind address and advertised URL are derived together so they cannot drift. Disabling it now stops it. App exit runs teardown concurrently under a budget with a visible shutting-down state instead of blocking for minutes. Auto-starts retry when Docker is not up yet, and the polling-recovery path now reconciles, so interrupted migrations are still recovered. Auth-bridge forwards are capped, closing a container-driven fd exhaustion. Windows CI. build-windows failed on this branch with "linker link.exe not found". The runner had no MSVC build tools and the workflow assumed a hand-provisioned machine, so a bare runner registers, accepts jobs and fails at link time after downloading the whole crate graph. The job now installs the VC++ workload when vswhere cannot find it, matching how it already conditionally installs Rust and Node. 192 Rust tests, 274 frontend tests, both builds clean, zero warnings. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5
@@ -5,8 +5,10 @@ import Button from "../ui/Button";
|
||||
import Toggle from "../ui/Toggle";
|
||||
import { SwitchRow } from "../ui/Field";
|
||||
import MigrationReportCard from "./MigrationReportCard";
|
||||
import MigrationInterruptedCard from "./MigrationInterruptedCard";
|
||||
import type { ContainerMigration } from "../../hooks/useContainerMigration";
|
||||
import {
|
||||
DATA_NOT_CARRIED,
|
||||
KEPT_AUTOMATICALLY,
|
||||
KEPT_WHY,
|
||||
LOST_WITHOUT_REPLAY,
|
||||
@@ -14,6 +16,7 @@ import {
|
||||
REPLAY_COST,
|
||||
ROLLBACK_DISK_COST,
|
||||
ROLLBACK_SCOPE,
|
||||
formatDataSize,
|
||||
formatSnapshotDate,
|
||||
} from "./migrationCopy";
|
||||
|
||||
@@ -85,10 +88,12 @@ export default function MigrateContainerModal({
|
||||
const [keepRollback, setKeepRollback] = useState(true);
|
||||
const logRef = useRef<HTMLDivElement>(null);
|
||||
|
||||
const { running, report, log, phaseMessage, busy } = migration;
|
||||
const { running, report, interrupted, log, phaseMessage, busy, probeSettled } =
|
||||
migration;
|
||||
const aptDelta = staleness?.apt_delta ?? [];
|
||||
const npmDelta = staleness?.npm_global_delta ?? [];
|
||||
const verbatim = staleness?.verbatim_paths ?? [];
|
||||
const atRisk = staleness?.unpreserved_data ?? [];
|
||||
const gains = staleness?.missing_features ?? [];
|
||||
const snapshot = formatSnapshotDate(staleness?.snapshot_created_at ?? null);
|
||||
|
||||
@@ -100,13 +105,44 @@ export default function MigrateContainerModal({
|
||||
|
||||
const start = () => {
|
||||
const options: MigrationOptions = {
|
||||
// Deliberately *not* `&& verbatim.length > 0`. That looked like a
|
||||
// harmless optimisation but read the toggle's meaning off a probe that
|
||||
// may not have landed, so a null `staleness` sent `copy_paths: false`
|
||||
// and the backend — which recomputes the real set but honours the flag —
|
||||
// skipped files that did exist. The backend already skips the step when
|
||||
// its own set comes out empty; that is the only place that knows.
|
||||
replay_packages: replayPackages,
|
||||
copy_paths: copyPaths && verbatim.length > 0,
|
||||
copy_paths: copyPaths,
|
||||
keep_rollback: keepRollback,
|
||||
};
|
||||
void migration.start(options);
|
||||
};
|
||||
|
||||
// ---- Unfinished ---------------------------------------------------------
|
||||
// Ahead of the report, for the reason spelled out in MigrationInterruptedCard:
|
||||
// Keep is not a legitimate action on a container that is mid-swap.
|
||||
if (interrupted) {
|
||||
return (
|
||||
<Modal
|
||||
title={`Update container base — ${projectName}`}
|
||||
onClose={onClose}
|
||||
widthClassName="w-[34rem]"
|
||||
footer={
|
||||
<Button size="md" variant="ghost" onClick={onClose}>
|
||||
Close
|
||||
</Button>
|
||||
}
|
||||
>
|
||||
<MigrationInterruptedCard
|
||||
record={interrupted}
|
||||
busy={busy || running}
|
||||
onResume={() => void migration.resume()}
|
||||
onRollback={() => void migration.rollback().then(onClose)}
|
||||
/>
|
||||
</Modal>
|
||||
);
|
||||
}
|
||||
|
||||
// ---- Outcome ------------------------------------------------------------
|
||||
if (report) {
|
||||
return (
|
||||
@@ -125,10 +161,7 @@ export default function MigrateContainerModal({
|
||||
busy={busy}
|
||||
onKeep={() => void migration.keep().then(onClose)}
|
||||
onRollback={() => void migration.rollback().then(onClose)}
|
||||
onDismiss={() => {
|
||||
migration.dismiss();
|
||||
onClose();
|
||||
}}
|
||||
onDismiss={() => void migration.dismiss().then(onClose)}
|
||||
/>
|
||||
</Modal>
|
||||
);
|
||||
@@ -187,13 +220,35 @@ export default function MigrateContainerModal({
|
||||
<Button size="md" variant="ghost" onClick={onClose}>
|
||||
Cancel
|
||||
</Button>
|
||||
<Button size="md" variant="primary" onClick={start}>
|
||||
<Button
|
||||
size="md"
|
||||
variant="primary"
|
||||
disabled={!probeSettled}
|
||||
onClick={start}
|
||||
>
|
||||
Update container base
|
||||
</Button>
|
||||
</>
|
||||
}
|
||||
>
|
||||
<div className="space-y-3">
|
||||
{/* 0. Until the probe lands, every list below is "not known" wearing
|
||||
"empty"'s clothes. Say which one it is, and do not let the run
|
||||
start on an unread delta. */}
|
||||
{!probeSettled && (
|
||||
<section
|
||||
className="border border-[var(--warning)]/40 bg-[var(--warning-muted)] rounded-[var(--radius-panel)] px-3.5 py-3"
|
||||
role="status"
|
||||
aria-live="polite"
|
||||
>
|
||||
<p className="text-xs text-[var(--text-primary)] leading-snug">
|
||||
Still working out what this container has that the current base
|
||||
does not. The lists below are not complete until it finishes, so
|
||||
the update cannot start yet.
|
||||
</p>
|
||||
</section>
|
||||
)}
|
||||
|
||||
{/* 1. Reassurance first. Not a choice — a statement of fact. */}
|
||||
<Section title="Kept automatically">
|
||||
<BulletList items={KEPT_AUTOMATICALLY} />
|
||||
@@ -203,6 +258,51 @@ export default function MigrateContainerModal({
|
||||
</p>
|
||||
</Section>
|
||||
|
||||
{/* 1b. The one thing that is genuinely destroyed. Directly under the
|
||||
reassurance, because a user who reads only the top of this dialog
|
||||
must not come away thinking nothing is at stake. */}
|
||||
<section
|
||||
className="border border-[var(--error)]/40 bg-[var(--error-muted)] rounded-[var(--radius-panel)] px-3.5 py-3 space-y-2"
|
||||
data-testid="migration-unpreserved"
|
||||
>
|
||||
<h3 className="text-[13px] font-medium text-[var(--text-primary)]">
|
||||
{atRisk.length > 0
|
||||
? `Destroyed, and not restored by this update (${atRisk.length})`
|
||||
: "Not carried across"}
|
||||
</h3>
|
||||
<p className="text-xs text-[var(--text-secondary)] leading-snug">
|
||||
{DATA_NOT_CARRIED}
|
||||
</p>
|
||||
{probeSettled ? (
|
||||
atRisk.length > 0 ? (
|
||||
<ul className="space-y-1 pl-4 list-disc marker:text-[var(--text-disabled)]">
|
||||
{atRisk.map((d) => (
|
||||
<li
|
||||
key={d.path}
|
||||
className="text-xs leading-snug text-[var(--text-primary)]"
|
||||
>
|
||||
<span className="font-mono break-all">{d.path}</span>
|
||||
<span className="text-[var(--text-secondary)]">
|
||||
{" "}
|
||||
— {formatDataSize(d.bytes)} in {d.file_count} file
|
||||
{d.file_count === 1 ? "" : "s"}
|
||||
</span>
|
||||
</li>
|
||||
))}
|
||||
</ul>
|
||||
) : (
|
||||
<p className="text-xs text-[var(--text-secondary)]">
|
||||
Nothing was found under <code className="font-mono">/var</code>{" "}
|
||||
on this container, so there is nothing here to lose.
|
||||
</p>
|
||||
)
|
||||
) : (
|
||||
<p className="text-xs text-[var(--text-secondary)]">
|
||||
Not checked yet.
|
||||
</p>
|
||||
)}
|
||||
</section>
|
||||
|
||||
{/* 2. The apt replay. */}
|
||||
<Section
|
||||
title={`Reinstalled from the new base's repos (${aptDelta.length})`}
|
||||
@@ -216,7 +316,12 @@ export default function MigrateContainerModal({
|
||||
>
|
||||
{aptDelta.length === 0 ? (
|
||||
<p className="text-xs text-[var(--text-secondary)]">
|
||||
No extra apt packages were found on this container.
|
||||
{/* "None found" and "not looked yet" are different sentences.
|
||||
Printing the first while the probe is still running is how a
|
||||
user ends up believing a delta was empty when it was unread. */}
|
||||
{probeSettled
|
||||
? "No extra apt packages were found on this container."
|
||||
: "Still checking which apt packages this container added."}
|
||||
</p>
|
||||
) : (
|
||||
<BulletList items={aptDelta} mono />
|
||||
@@ -232,10 +337,16 @@ export default function MigrateContainerModal({
|
||||
<p className="text-xs text-[var(--text-secondary)]">{REPLAY_COST}</p>
|
||||
</Section>
|
||||
|
||||
{/* 3. Verbatim copies — usually nothing, so usually not shown at all. */}
|
||||
{verbatim.length > 0 && (
|
||||
{/* 3. Verbatim copies — usually nothing once the probe has settled, so
|
||||
usually not shown at all. Shown while it has not, because a hidden
|
||||
section reads as "there is nothing here". */}
|
||||
{(verbatim.length > 0 || !probeSettled) && (
|
||||
<Section
|
||||
title={`Copied across as-is (${verbatim.length})`}
|
||||
title={
|
||||
probeSettled
|
||||
? `Copied across as-is (${verbatim.length})`
|
||||
: "Copied across as-is"
|
||||
}
|
||||
control={
|
||||
<Toggle
|
||||
label="Copy user-authored files across as-is"
|
||||
@@ -251,7 +362,13 @@ export default function MigrateContainerModal({
|
||||
<code className="font-mono">/workspace</code> that belongs to no
|
||||
package, so it cannot be reinstalled from a repository.
|
||||
</p>
|
||||
<BulletList items={verbatim} mono />
|
||||
{probeSettled ? (
|
||||
<BulletList items={verbatim} mono />
|
||||
) : (
|
||||
<p className="text-xs text-[var(--text-secondary)]">
|
||||
Still checking what is there.
|
||||
</p>
|
||||
)}
|
||||
</Section>
|
||||
)}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user