Fix review findings: secrets in snapshots, URL spoofing, migration data loss
Adversarial review of the branch produced findings across four areas. This addresses them, plus the Windows CI environment. Secrets. commit_container_snapshot baked the container's full env into the per-project snapshot image, so the shared OAuth token — and the AWS keys, git token and gateway master key — outlived revocation and were readable via docker inspect. Verified against Engine 29.6 that a commit body's config merges over the container's: keys cannot be dropped but can be overwritten, so all of them now commit as KEY=. clear_claude_token additionally rewrites images from earlier builds and reports honestly when a tag could not be rewritten. The recommendation to move the token out of env entirely was not taken, with reasoning: apiKeyHelper is a different auth method that outranks CLAUDE_CODE_OAUTH_TOKEN rather than a transport for it, and no file-based delivery exists. The durable exposure — the image — is what is closed here. Separately noted, not fixed: entrypoint.sh captures the token into the scheduler's .env inside the persisted volume. URL spoofing. Three call sites reached openUrl with container-controlled strings, one of which the review missed (the WebLinksAddon handler). The sign-in URL was scraped from container output with a longest-match tie-break and no userinfo check, so claude.ai@evil.tld rendered as "claude.ai…" in a truncating element. There is now one sanitizer in front of every sink — scheme allowlist, no userinfo, C0/C1 and quote rejection, host allowlist for the sign-in case, first-match — and the origin renders un-truncated. The toast is keyed so a changed URL remounts, closing a bait-and-switch where the user read one URL and clicked another. Migration. The rollback pin was best-effort: a tag failure was logged and the migration continued past remove_container, after which the final commit overwrote the only copy of the old system layer. It now aborts before anything destructive and reads the tag back. /var was destroyed while the ordinary recreate path preserves it — making the "safe" alternative to Reset more destructive than Reset's alternative; data-bearing subtrees are now detected and disclosed in the pre-flight rather than copied, since tarring a live database onto a different base's packages is a corruption risk. resume_migration now verifies the migration-state label instead of reporting success for a container that never swapped. dismiss actually resolves the record rather than leaving the feature permanently refusing to migrate. Start and Reset are guarded while a migration is live. Lifecycle. The gateway no longer publishes on 0.0.0.0 — bind address and advertised URL are derived together so they cannot drift. Disabling it now stops it. App exit runs teardown concurrently under a budget with a visible shutting-down state instead of blocking for minutes. Auto-starts retry when Docker is not up yet, and the polling-recovery path now reconciles, so interrupted migrations are still recovered. Auth-bridge forwards are capped, closing a container-driven fd exhaustion. Windows CI. build-windows failed on this branch with "linker link.exe not found". The runner had no MSVC build tools and the workflow assumed a hand-provisioned machine, so a bare runner registers, accepts jobs and fails at link time after downloading the whole crate graph. The job now installs the VC++ workload when vswhere cannot find it, matching how it already conditionally installs Rust and Node. 192 Rust tests, 274 frontend tests, both builds clean, zero warnings. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5
@@ -79,9 +79,17 @@ export default function GatewaySettings() {
|
||||
refreshStatus();
|
||||
}, [refreshStatus]);
|
||||
|
||||
/**
|
||||
* Persist a gateway settings change, then re-read the container status.
|
||||
*
|
||||
* `update_settings` reconciles the container itself — it stops the gateway
|
||||
* when `enabled` goes false and recreates it on a port change — so the status
|
||||
* we are holding is stale the moment the save returns.
|
||||
*/
|
||||
const patch = async (changes: Partial<GatewaySettingsType>) => {
|
||||
if (!appSettings) return;
|
||||
await saveSettings({ ...appSettings, gateway: { ...gateway, ...changes } });
|
||||
await refreshStatus();
|
||||
};
|
||||
|
||||
const savePort = async () => {
|
||||
@@ -190,6 +198,13 @@ export default function GatewaySettings() {
|
||||
? "Stopped"
|
||||
: "Image ready";
|
||||
|
||||
// Rendered in whichever branch is live — only one of them ever mounts.
|
||||
const errorLine = error ? (
|
||||
<p className="text-xs text-[var(--error)]" role="alert">
|
||||
{error}
|
||||
</p>
|
||||
) : null;
|
||||
|
||||
return (
|
||||
<div>
|
||||
<label className="block text-sm font-medium mb-1">Model Gateway</label>
|
||||
@@ -213,6 +228,27 @@ export default function GatewaySettings() {
|
||||
}
|
||||
/>
|
||||
|
||||
{/*
|
||||
Turning the gateway off hides its configuration, but a container that
|
||||
already exists must stay reachable — otherwise a leftover container
|
||||
keeps its port bound with no UI left to stop it.
|
||||
*/}
|
||||
{!gateway.enabled && status?.container_exists && (
|
||||
<div className="space-y-2" data-testid="gateway-leftover-container">
|
||||
<div className="flex items-center gap-3 flex-wrap">
|
||||
<StatusIndicator tone={tone} label={statusLabel} className="text-xs" />
|
||||
<Button variant="danger" disabled={loading} onClick={() => run(stopGateway)}>
|
||||
{loading ? "Working…" : "Stop"}
|
||||
</Button>
|
||||
</div>
|
||||
<p className="text-xs text-[var(--text-secondary)] leading-snug">
|
||||
The gateway container is still present. Stop it here if it is still running; it
|
||||
will not be started again while the gateway is off.
|
||||
</p>
|
||||
{errorLine}
|
||||
</div>
|
||||
)}
|
||||
|
||||
{gateway.enabled && (
|
||||
<>
|
||||
{/* ── Container ─────────────────────────────────────────────── */}
|
||||
@@ -247,11 +283,7 @@ export default function GatewaySettings() {
|
||||
</pre>
|
||||
)}
|
||||
|
||||
{error && (
|
||||
<p className="text-xs text-[var(--error)]" role="alert">
|
||||
{error}
|
||||
</p>
|
||||
)}
|
||||
{errorLine}
|
||||
|
||||
{/* ── Provider ──────────────────────────────────────────────── */}
|
||||
<Field
|
||||
@@ -395,10 +427,10 @@ export default function GatewaySettings() {
|
||||
</div>
|
||||
<p className="mt-0.5 text-xs text-[var(--text-secondary)] leading-snug">
|
||||
Set a project's backend to <strong>OpenAI Compatible</strong> and use these
|
||||
values. On native Linux Docker, where{" "}
|
||||
<code className="font-mono">host.docker.internal</code> is not injected into
|
||||
containers, use <code className="font-mono">http://172.17.0.1:{gateway.port}</code>{" "}
|
||||
instead.
|
||||
values. The base URL below is the one your Docker engine actually needs —{" "}
|
||||
<code className="font-mono">host.docker.internal</code> on Docker Desktop, the
|
||||
bridge gateway address on native Linux, where that name is not injected into
|
||||
containers.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
|
||||
Reference in New Issue
Block a user