Fix review findings: secrets in snapshots, URL spoofing, migration data loss

Adversarial review of the branch produced findings across four areas.
This addresses them, plus the Windows CI environment.

Secrets. commit_container_snapshot baked the container's full env into
the per-project snapshot image, so the shared OAuth token — and the AWS
keys, git token and gateway master key — outlived revocation and were
readable via docker inspect. Verified against Engine 29.6 that a commit
body's config merges over the container's: keys cannot be dropped but
can be overwritten, so all of them now commit as KEY=. clear_claude_token
additionally rewrites images from earlier builds and reports honestly
when a tag could not be rewritten.

The recommendation to move the token out of env entirely was not taken,
with reasoning: apiKeyHelper is a different auth method that outranks
CLAUDE_CODE_OAUTH_TOKEN rather than a transport for it, and no
file-based delivery exists. The durable exposure — the image — is what
is closed here. Separately noted, not fixed: entrypoint.sh captures the
token into the scheduler's .env inside the persisted volume.

URL spoofing. Three call sites reached openUrl with container-controlled
strings, one of which the review missed (the WebLinksAddon handler).
The sign-in URL was scraped from container output with a longest-match
tie-break and no userinfo check, so claude.ai@evil.tld rendered as
"claude.ai…" in a truncating element. There is now one sanitizer in
front of every sink — scheme allowlist, no userinfo, C0/C1 and quote
rejection, host allowlist for the sign-in case, first-match — and the
origin renders un-truncated. The toast is keyed so a changed URL
remounts, closing a bait-and-switch where the user read one URL and
clicked another.

Migration. The rollback pin was best-effort: a tag failure was logged
and the migration continued past remove_container, after which the
final commit overwrote the only copy of the old system layer. It now
aborts before anything destructive and reads the tag back. /var was
destroyed while the ordinary recreate path preserves it — making the
"safe" alternative to Reset more destructive than Reset's alternative;
data-bearing subtrees are now detected and disclosed in the pre-flight
rather than copied, since tarring a live database onto a different
base's packages is a corruption risk. resume_migration now verifies the
migration-state label instead of reporting success for a container that
never swapped. dismiss actually resolves the record rather than leaving
the feature permanently refusing to migrate. Start and Reset are guarded
while a migration is live.

Lifecycle. The gateway no longer publishes on 0.0.0.0 — bind address and
advertised URL are derived together so they cannot drift. Disabling it
now stops it. App exit runs teardown concurrently under a budget with a
visible shutting-down state instead of blocking for minutes. Auto-starts
retry when Docker is not up yet, and the polling-recovery path now
reconciles, so interrupted migrations are still recovered. Auth-bridge
forwards are capped, closing a container-driven fd exhaustion.

Windows CI. build-windows failed on this branch with "linker link.exe
not found". The runner had no MSVC build tools and the workflow assumed
a hand-provisioned machine, so a bare runner registers, accepts jobs and
fails at link time after downloading the whole crate graph. The job now
installs the VC++ workload when vswhere cannot find it, matching how it
already conditionally installs Rust and Node.

192 Rust tests, 274 frontend tests, both builds clean, zero warnings.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/src/hooks/useClaudeAuth.test.ts

@@ -35,6 +35,50 @@ describe("extractSignInUrl", () => {
     const text = `https://claude.ai/oauth/authorize?code=tr\n${full}\n`;
     expect(extractSignInUrl(text)).toBe(full);
   });
+
+  // ── The spoof this function exists to refuse ──────────────────────────────
+  // The transcript is container output. Everything below is a URL a misbehaving
+  // sandboxed agent can print at will, and the modal renders whatever comes
+  // back under a heading that says "Sign in with Anthropic".
+
+  it("rejects userinfo that makes an attacker's host read as Anthropic's", () => {
+    // Displays as `https://claude.ai...` in anything that truncates; navigates
+    // to evil.tld and harvests the real credential.
+    const spoof =
+      "https://claude.ai@evil.tld/oauth/authorize?" + "padding=".repeat(40);
+    expect(extractSignInUrl(`Use this url to sign in:\n${spoof}\n`)).toBeNull();
+  });
+
+  it("does not let a longer hostile URL displace the real one", () => {
+    const real = "https://claude.ai/oauth/authorize?code=true&client_id=abc";
+    const longer =
+      "https://evil.tld/oauth/authorize?" + "x".repeat(real.length * 2);
+    expect(extractSignInUrl(`${real}\n${longer}\n`)).toBe(real);
+    // ...and the same when the hostile one is printed first.
+    expect(extractSignInUrl(`${longer}\n${real}\n`)).toBe(real);
+  });
+
+  it("rejects a host that merely contains an Anthropic domain", () => {
+    expect(
+      extractSignInUrl("Sign in: https://claude.ai.evil.tld/oauth/authorize\n"),
+    ).toBeNull();
+    expect(
+      extractSignInUrl("Sign in: https://evil.tld/claude.ai/oauth/authorize\n"),
+    ).toBeNull();
+  });
+
+  it("rejects non-http schemes and control characters smuggled into the link", () => {
+    expect(extractSignInUrl("Open javascript:alert(1) to continue\n")).toBeNull();
+    expect(
+      extractSignInUrl("https://claude.ai/oauth\u0000/authorize\n"),
+    ).toBe("https://claude.ai/oauth");
+  });
+
+  it("takes the first legitimate link, not the longest", () => {
+    const first = "https://claude.ai/oauth/authorize?code=true";
+    const second = "https://platform.claude.com/oauth/authorize?code=true&more=1";
+    expect(extractSignInUrl(`${first}\n${second}\n`)).toBe(first);
+  });
 });
 
 describe("authErrorMessage", () => {

app/src/hooks/useClaudeAuth.ts

@@ -1,6 +1,7 @@
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { listen, type UnlistenFn } from "@tauri-apps/api/event";
 import * as commands from "../lib/tauri-commands";
+import { ANTHROPIC_SIGN_IN_HOSTS, sanitizeRelayUrl } from "../lib/urlRelay";
 import type {
   ClaudeTokenOutputEvent,
   ClaudeTokenProgressEvent,
@@ -39,25 +40,43 @@ export function authErrorMessage(e: unknown, fallback: string): string {
 /**
  * Pick the sign-in URL out of `claude setup-token`'s transcript.
  *
- * Prefers an OAuth-looking URL, and among candidates prefers the longest: a
- * TUI repaints, and a repaint can land a truncated copy of the same URL in the
- * transcript. Longest-wins means a partial frame never replaces the full link.
+ * **The transcript is container output, so every candidate here is
+ * attacker-controlled if the sandboxed agent misbehaves.** It is then rendered
+ * under a heading that says "Sign in with Anthropic" and handed to the host
+ * browser, which makes this the highest-value URL in the app to spoof: a user
+ * who follows it types their real Anthropic credentials into whatever it
+ * resolves to. Three rules follow, and none of them are optional:
+ *
+ *  - Every candidate goes through the shared {@link sanitizeRelayUrl}, with a
+ *    host allowlist. Only Anthropic's own domains can be a sign-in link;
+ *    userinfo (`https://claude.ai@evil.tld/...`) and control characters are
+ *    rejected there.
+ *  - The **first** surviving candidate wins. The previous rule was
+ *    longest-wins, which handed the choice to the attacker: pad a hostile URL
+ *    and it displaces the real one that came before it.
+ *  - The one exception is a candidate that *extends* the current pick, i.e.
+ *    starts with it. That is the case longest-wins existed for — a repainting
+ *    TUI can land a truncated copy of the same link in the transcript before
+ *    the complete one — and it cannot swap the origin, because a longer string
+ *    with the same prefix has the same host.
  */
 export function extractSignInUrl(text: string): string | null {
-  const matches = text.match(/https?:\/\/[^\s"'<>`]+/g);
+  // eslint-disable-next-line no-control-regex
+  const matches = text.match(/https?:\/\/[^\s"'`<>\x00-\x20\x7f]+/g);
   if (!matches) return null;
 
   const cleaned = matches
     // Trailing punctuation belongs to the prose, not the URL.
     .map((url) => url.replace(/[.,;:!?)\]}>'"]+$/, ""))
-    .filter((url) => url.length > "https://".length);
+    .map((url) => sanitizeRelayUrl(url, { allowHosts: ANTHROPIC_SIGN_IN_HOSTS }))
+    .filter((url): url is string => url !== null);
 
   const oauth = cleaned.filter((url) => /oauth|authorize|login/i.test(url));
   const pool = oauth.length > 0 ? oauth : cleaned;
 
   let best: string | null = null;
   for (const url of pool) {
-    if (best === null || url.length >= best.length) best = url;
+    if (best === null || url.startsWith(best)) best = url;
   }
   return best;
 }

app/src/hooks/useContainerMigration.test.tsx

@@ -45,6 +45,7 @@ const STALE: ContainerStaleness = {
   apt_delta: ["socat"],
   npm_global_delta: [],
   verbatim_paths: [],
+  unpreserved_data: [],
   outdated_package_count: 61,
   probe_error: null,
 };
@@ -199,6 +200,61 @@ describe("useContainerMigration", () => {
     );
   });
 
+  it("resolves the record when a report is dismissed, not just the local state", async () => {
+    // Dismiss is the *only* action offered when `rollback_available` is false.
+    // As local state it left an `awaiting-confirmation` record on disk that
+    // came back on the next mount and made every future migration refuse with
+    // "already has a finished migration waiting for a decision" — unrecoverable
+    // without deleting JSON by hand.
+    confirmMigration.mockResolvedValue(undefined);
+    migrateProjectToBase.mockResolvedValue({ ...CLEAN, rollback_available: false });
+    const { result } = renderHook(() => useContainerMigration(project));
+    await act(async () => {
+      await result.current.start(OPTIONS);
+    });
+    expect(result.current.report).not.toBeNull();
+
+    await act(async () => {
+      await result.current.dismiss();
+    });
+    expect(confirmMigration).toHaveBeenCalledWith("p1");
+    expect(result.current.report).toBeNull();
+  });
+
+  it("keeps the report on screen when dismissing it could not be recorded", async () => {
+    confirmMigration.mockRejectedValue(new Error("disk is read-only"));
+    migrateProjectToBase.mockResolvedValue({ ...CLEAN, rollback_available: false });
+    const { result } = renderHook(() => useContainerMigration(project));
+    await act(async () => {
+      await result.current.start(OPTIONS);
+    });
+    await act(async () => {
+      await result.current.dismiss();
+    });
+    expect(result.current.report).not.toBeNull();
+    expect(pushToast).toHaveBeenCalledWith(
+      expect.objectContaining({ kind: "error" }),
+    );
+  });
+
+  it("reports the probe as settled only once it has actually landed", async () => {
+    // Everything downstream reads an unlanded probe's empty arrays as "nothing
+    // found", so "settled" has to be a distinct signal from "not probing".
+    getContainerStaleness.mockResolvedValue({
+      ...STALE,
+      probe_error: "could not exec in the container",
+    });
+    const { result } = renderHook(() => useContainerMigration(project));
+    await waitFor(() => expect(result.current.probing).toBe(false));
+    expect(result.current.probeSettled).toBe(false);
+
+    getContainerStaleness.mockResolvedValue(STALE);
+    await act(async () => {
+      await result.current.refresh();
+    });
+    expect(result.current.probeSettled).toBe(true);
+  });
+
   describe("crash recovery", () => {
     it("adopts a run that was still in progress, and polls it to a report", async () => {
       getMigrationState.mockResolvedValue(state());
@@ -240,6 +296,8 @@ describe("useContainerMigration", () => {
       const { result } = renderHook(() => useContainerMigration(project));
       await waitFor(() => expect(result.current.interrupted).not.toBeNull());
 
+      // The resume worked, so the backend cleared the record.
+      getMigrationState.mockResolvedValue(state({ phase: "awaiting-confirmation" }));
       await act(async () => {
         await result.current.resume();
       });
@@ -250,6 +308,42 @@ describe("useContainerMigration", () => {
       expect(result.current.report).toEqual(CLEAN);
     });
 
+    it("keeps a mid-swap container visible when the resume itself fails", async () => {
+      // The old behaviour nulled `interrupted` at the top of `start` and never
+      // looked again, so a failed resume hid a half-migrated container for the
+      // rest of the session — leaving Keep as the only offered action over it.
+      getMigrationState.mockResolvedValue(state({ phase: "interrupted" }));
+      migrateProjectToBase.mockRejectedValue(new Error("docker daemon went away"));
+      const { result } = renderHook(() => useContainerMigration(project));
+      await waitFor(() => expect(result.current.interrupted).not.toBeNull());
+
+      await act(async () => {
+        await result.current.resume();
+      });
+      expect(result.current.report?.phase).toBe("failed");
+      expect(result.current.interrupted?.phase).toBe("interrupted");
+    });
+
+    it("adopts the interrupted record a failed fresh run leaves behind", async () => {
+      // `commit_container_snapshot` failing after the swap returns a report and
+      // writes `interrupted`. Both have to reach the UI, or Keep is offered
+      // over a container the app can no longer reason about.
+      getMigrationState.mockResolvedValue(null);
+      const { result } = renderHook(() => useContainerMigration(project));
+      await waitFor(() => expect(result.current.staleness).toEqual(STALE));
+
+      migrateProjectToBase.mockResolvedValue({
+        ...CLEAN,
+        phase: "failed",
+        message: "saving it failed. Resume it, or roll back.",
+      });
+      getMigrationState.mockResolvedValue(state({ phase: "interrupted" }));
+      await act(async () => {
+        await result.current.start(OPTIONS);
+      });
+      expect(result.current.interrupted?.phase).toBe("interrupted");
+    });
+
     it("ignores an unrecognised phase from a future build rather than crashing", async () => {
       getMigrationState.mockResolvedValue(state({ phase: "quantum-tunnelling" }));
       const { result } = renderHook(() => useContainerMigration(project));

app/src/hooks/useContainerMigration.ts

@@ -29,6 +29,17 @@ export interface ContainerMigration {
   /** Null until the first probe returns, or when the container has never been created. */
   staleness: ContainerStaleness | null;
   probing: boolean;
+  /**
+   * The probe has landed with a complete answer.
+   *
+   * Until it does, `apt_delta`, `verbatim_paths` and `unpreserved_data` are all
+   * "not known", which is indistinguishable from "empty" at every call site
+   * that reads them. Starting a migration in that state means the modal telling
+   * the user there was nothing to copy while the backend quietly skips copying
+   * — so the action is gated on this, not on the probe merely having been
+   * kicked off.
+   */
+  probeSettled: boolean;
   /** True while a migration is running — whether we started it or found it. */
   running: boolean;
   /** True when the run in progress was recovered from disk, not started here. */
@@ -51,8 +62,15 @@ export interface ContainerMigration {
   start: (options: MigrationOptions) => Promise<void>;
   keep: () => Promise<void>;
   rollback: () => Promise<void>;
-  /** Clear a report we cannot act on (failed / rolled back). Local only. */
-  dismiss: () => void;
+  /**
+   * Acknowledge a report there is nothing to keep or roll back.
+   *
+   * It has to reach the backend, not just clear local state: an
+   * `awaiting-confirmation` record that is never resolved comes back on the
+   * next mount *and* makes every future migration refuse with "already has a
+   * finished migration waiting for a decision".
+   */
+  dismiss: () => Promise<void>;
   refresh: () => Promise<void>;
 }
 
@@ -186,6 +204,25 @@ export function useContainerMigration(project: Project): ContainerMigration {
     );
   }, [progress, running]);
 
+  /**
+   * Re-read the persisted record after a run settles.
+   *
+   * A migration that got past the container swap and then failed leaves the
+   * record at `interrupted` — the container is mid-swap and the only correct
+   * next actions are Resume and Roll back. Without this the hook would show the
+   * failure report's Keep button over a half-migrated container, and a *failed
+   * resume* would clear `interrupted` and never look again, hiding the mid-swap
+   * container for the rest of the session.
+   */
+  const adoptRecordAfterRun = useCallback(async () => {
+    try {
+      const state = await commands.getMigrationState(projectId);
+      setInterrupted(state?.phase === INTERRUPTED ? state : null);
+    } catch {
+      /* Leave whatever we had; a transient IPC failure is not an outcome. */
+    }
+  }, [projectId]);
+
   const start = useCallback(
     async (options: MigrationOptions) => {
       setLog([]);
@@ -213,10 +250,11 @@ export function useContainerMigration(project: Project): ContainerMigration {
       } finally {
         setRunning(false);
         useAppState.getState().setContainerProgress(projectId, null);
+        await adoptRecordAfterRun();
         void refresh();
       }
     },
-    [projectId, refresh],
+    [projectId, refresh, adoptRecordAfterRun],
   );
 
   /**
@@ -271,11 +309,35 @@ export function useContainerMigration(project: Project): ContainerMigration {
     }
   }, [projectId, project.name, refresh, pushToast]);
 
-  const dismiss = useCallback(() => setReport(null), []);
+  /**
+   * Dismiss resolves the record; it is not a local hide.
+   *
+   * `confirm_migration` is the backend's "this decision is made": it drops the
+   * rollback tag (there is none in this case), deletes the staged payload and
+   * removes the state file. Skipping it left an `awaiting-confirmation` record
+   * on disk that reappeared on every mount and made `migrate_project_to_base`
+   * refuse forever — recoverable only by deleting JSON by hand.
+   */
+  const dismiss = useCallback(async () => {
+    setBusy(true);
+    try {
+      await commands.confirmMigration(projectId);
+      setReport(null);
+    } catch (e) {
+      pushToast({
+        kind: "error",
+        message: `Could not clear the update record for “${project.name}”`,
+        detail: String(e),
+      });
+    } finally {
+      setBusy(false);
+    }
+  }, [projectId, project.name, pushToast]);
 
   return {
     staleness,
     probing,
+    probeSettled: !probing && staleness !== null && !staleness.probe_error,
     running,
     recovered,
     interrupted,

app/src/hooks/useDocker.test.tsx

@@ -0,0 +1,87 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { act, renderHook } from "@testing-library/react";
+import { useDocker } from "./useDocker";
+
+const checkDocker = vi.fn();
+const checkImageExists = vi.fn();
+
+vi.mock("../lib/tauri-commands", () => ({
+  checkDocker: () => checkDocker(),
+  checkImageExists: () => checkImageExists(),
+  buildImage: vi.fn(),
+  pullImage: vi.fn(),
+}));
+
+vi.mock("@tauri-apps/api/event", () => ({ listen: vi.fn(async () => vi.fn()) }));
+
+const setDockerAvailable = vi.fn();
+const setImageExists = vi.fn();
+
+vi.mock("../store/appState", () => ({
+  useAppState: (selector: (s: unknown) => unknown) =>
+    selector({
+      dockerAvailable: false,
+      setDockerAvailable,
+      imageExists: false,
+      setImageExists,
+    }),
+}));
+
+/** Let the interval fire and its awaited body settle. */
+const tick = async () => {
+  await act(async () => {
+    vi.advanceTimersByTime(5000);
+    await Promise.resolve();
+    await Promise.resolve();
+    await Promise.resolve();
+  });
+};
+
+describe("useDocker.startDockerPolling", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.useFakeTimers();
+    checkImageExists.mockResolvedValue(true);
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it("runs onAvailable once, after Docker is marked available and the image re-checked", async () => {
+    checkDocker.mockResolvedValueOnce(false).mockResolvedValue(true);
+    const onAvailable = vi.fn();
+
+    const { result } = renderHook(() => useDocker());
+    act(() => {
+      result.current.startDockerPolling(onAvailable);
+    });
+
+    await tick();
+    expect(onAvailable).not.toHaveBeenCalled();
+
+    await tick();
+    expect(setDockerAvailable).toHaveBeenCalledWith(true);
+    expect(setImageExists).toHaveBeenCalledWith(true);
+    expect(onAvailable).toHaveBeenCalledTimes(1);
+
+    // Polling stopped, so no second invocation.
+    await tick();
+    expect(onAvailable).toHaveBeenCalledTimes(1);
+  });
+
+  it("still works without a callback and can be cancelled by its cleanup", async () => {
+    checkDocker.mockResolvedValue(true);
+
+    const { result } = renderHook(() => useDocker());
+    let stop: () => void = () => {};
+    act(() => {
+      stop = result.current.startDockerPolling();
+    });
+    act(() => stop());
+
+    await tick();
+    expect(checkDocker).not.toHaveBeenCalled();
+    expect(setDockerAvailable).not.toHaveBeenCalled();
+  });
+});

app/src/hooks/useDocker.ts

@@ -61,7 +61,15 @@ export function useDocker() {
 
   const pollingRef = useRef<ReturnType<typeof setInterval> | null>(null);
 
-  const startDockerPolling = useCallback(() => {
+  /**
+   * Poll until Docker appears, then stop.
+   *
+   * `onAvailable` runs exactly once, after `dockerAvailable` is set and the
+   * image has been re-checked. It exists because a session that started before
+   * the daemon was up otherwise never does the "Docker is up" work — status
+   * reconciliation, interrupted-migration recovery, loading the project list.
+   */
+  const startDockerPolling = useCallback((onAvailable?: () => void | Promise<void>) => {
     // Don't start if already polling
     if (pollingRef.current) return () => {};
 
@@ -79,6 +87,11 @@ export function useDocker() {
           } catch {
             setImageExists(false);
           }
+          try {
+            await onAvailable?.();
+          } catch (e) {
+            console.error("Docker-available callback failed:", e);
+          }
         }
       } catch {
         // Still not available, keep polling