Fix review findings: secrets in snapshots, URL spoofing, migration data loss
Adversarial review of the branch produced findings across four areas. This addresses them, plus the Windows CI environment. Secrets. commit_container_snapshot baked the container's full env into the per-project snapshot image, so the shared OAuth token — and the AWS keys, git token and gateway master key — outlived revocation and were readable via docker inspect. Verified against Engine 29.6 that a commit body's config merges over the container's: keys cannot be dropped but can be overwritten, so all of them now commit as KEY=. clear_claude_token additionally rewrites images from earlier builds and reports honestly when a tag could not be rewritten. The recommendation to move the token out of env entirely was not taken, with reasoning: apiKeyHelper is a different auth method that outranks CLAUDE_CODE_OAUTH_TOKEN rather than a transport for it, and no file-based delivery exists. The durable exposure — the image — is what is closed here. Separately noted, not fixed: entrypoint.sh captures the token into the scheduler's .env inside the persisted volume. URL spoofing. Three call sites reached openUrl with container-controlled strings, one of which the review missed (the WebLinksAddon handler). The sign-in URL was scraped from container output with a longest-match tie-break and no userinfo check, so claude.ai@evil.tld rendered as "claude.ai…" in a truncating element. There is now one sanitizer in front of every sink — scheme allowlist, no userinfo, C0/C1 and quote rejection, host allowlist for the sign-in case, first-match — and the origin renders un-truncated. The toast is keyed so a changed URL remounts, closing a bait-and-switch where the user read one URL and clicked another. Migration. The rollback pin was best-effort: a tag failure was logged and the migration continued past remove_container, after which the final commit overwrote the only copy of the old system layer. It now aborts before anything destructive and reads the tag back. /var was destroyed while the ordinary recreate path preserves it — making the "safe" alternative to Reset more destructive than Reset's alternative; data-bearing subtrees are now detected and disclosed in the pre-flight rather than copied, since tarring a live database onto a different base's packages is a corruption risk. resume_migration now verifies the migration-state label instead of reporting success for a container that never swapped. dismiss actually resolves the record rather than leaving the feature permanently refusing to migrate. Start and Reset are guarded while a migration is live. Lifecycle. The gateway no longer publishes on 0.0.0.0 — bind address and advertised URL are derived together so they cannot drift. Disabling it now stops it. App exit runs teardown concurrently under a budget with a visible shutting-down state instead of blocking for minutes. Auto-starts retry when Docker is not up yet, and the polling-recovery path now reconciles, so interrupted migrations are still recovered. Auth-bridge forwards are capped, closing a container-driven fd exhaustion. Windows CI. build-windows failed on this branch with "linker link.exe not found". The runner had no MSVC build tools and the workflow assumed a hand-provisioned machine, so a bare runner registers, accepts jobs and fails at link time after downloading the whole crate graph. The job now installs the VC++ workload when vswhere cannot find it, matching how it already conditionally installs Rust and Node. 192 Rust tests, 274 frontend tests, both builds clean, zero warnings. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5
@@ -45,6 +45,7 @@ const STALE: ContainerStaleness = {
|
||||
apt_delta: ["socat"],
|
||||
npm_global_delta: [],
|
||||
verbatim_paths: [],
|
||||
unpreserved_data: [],
|
||||
outdated_package_count: 61,
|
||||
probe_error: null,
|
||||
};
|
||||
@@ -199,6 +200,61 @@ describe("useContainerMigration", () => {
|
||||
);
|
||||
});
|
||||
|
||||
it("resolves the record when a report is dismissed, not just the local state", async () => {
|
||||
// Dismiss is the *only* action offered when `rollback_available` is false.
|
||||
// As local state it left an `awaiting-confirmation` record on disk that
|
||||
// came back on the next mount and made every future migration refuse with
|
||||
// "already has a finished migration waiting for a decision" — unrecoverable
|
||||
// without deleting JSON by hand.
|
||||
confirmMigration.mockResolvedValue(undefined);
|
||||
migrateProjectToBase.mockResolvedValue({ ...CLEAN, rollback_available: false });
|
||||
const { result } = renderHook(() => useContainerMigration(project));
|
||||
await act(async () => {
|
||||
await result.current.start(OPTIONS);
|
||||
});
|
||||
expect(result.current.report).not.toBeNull();
|
||||
|
||||
await act(async () => {
|
||||
await result.current.dismiss();
|
||||
});
|
||||
expect(confirmMigration).toHaveBeenCalledWith("p1");
|
||||
expect(result.current.report).toBeNull();
|
||||
});
|
||||
|
||||
it("keeps the report on screen when dismissing it could not be recorded", async () => {
|
||||
confirmMigration.mockRejectedValue(new Error("disk is read-only"));
|
||||
migrateProjectToBase.mockResolvedValue({ ...CLEAN, rollback_available: false });
|
||||
const { result } = renderHook(() => useContainerMigration(project));
|
||||
await act(async () => {
|
||||
await result.current.start(OPTIONS);
|
||||
});
|
||||
await act(async () => {
|
||||
await result.current.dismiss();
|
||||
});
|
||||
expect(result.current.report).not.toBeNull();
|
||||
expect(pushToast).toHaveBeenCalledWith(
|
||||
expect.objectContaining({ kind: "error" }),
|
||||
);
|
||||
});
|
||||
|
||||
it("reports the probe as settled only once it has actually landed", async () => {
|
||||
// Everything downstream reads an unlanded probe's empty arrays as "nothing
|
||||
// found", so "settled" has to be a distinct signal from "not probing".
|
||||
getContainerStaleness.mockResolvedValue({
|
||||
...STALE,
|
||||
probe_error: "could not exec in the container",
|
||||
});
|
||||
const { result } = renderHook(() => useContainerMigration(project));
|
||||
await waitFor(() => expect(result.current.probing).toBe(false));
|
||||
expect(result.current.probeSettled).toBe(false);
|
||||
|
||||
getContainerStaleness.mockResolvedValue(STALE);
|
||||
await act(async () => {
|
||||
await result.current.refresh();
|
||||
});
|
||||
expect(result.current.probeSettled).toBe(true);
|
||||
});
|
||||
|
||||
describe("crash recovery", () => {
|
||||
it("adopts a run that was still in progress, and polls it to a report", async () => {
|
||||
getMigrationState.mockResolvedValue(state());
|
||||
@@ -240,6 +296,8 @@ describe("useContainerMigration", () => {
|
||||
const { result } = renderHook(() => useContainerMigration(project));
|
||||
await waitFor(() => expect(result.current.interrupted).not.toBeNull());
|
||||
|
||||
// The resume worked, so the backend cleared the record.
|
||||
getMigrationState.mockResolvedValue(state({ phase: "awaiting-confirmation" }));
|
||||
await act(async () => {
|
||||
await result.current.resume();
|
||||
});
|
||||
@@ -250,6 +308,42 @@ describe("useContainerMigration", () => {
|
||||
expect(result.current.report).toEqual(CLEAN);
|
||||
});
|
||||
|
||||
it("keeps a mid-swap container visible when the resume itself fails", async () => {
|
||||
// The old behaviour nulled `interrupted` at the top of `start` and never
|
||||
// looked again, so a failed resume hid a half-migrated container for the
|
||||
// rest of the session — leaving Keep as the only offered action over it.
|
||||
getMigrationState.mockResolvedValue(state({ phase: "interrupted" }));
|
||||
migrateProjectToBase.mockRejectedValue(new Error("docker daemon went away"));
|
||||
const { result } = renderHook(() => useContainerMigration(project));
|
||||
await waitFor(() => expect(result.current.interrupted).not.toBeNull());
|
||||
|
||||
await act(async () => {
|
||||
await result.current.resume();
|
||||
});
|
||||
expect(result.current.report?.phase).toBe("failed");
|
||||
expect(result.current.interrupted?.phase).toBe("interrupted");
|
||||
});
|
||||
|
||||
it("adopts the interrupted record a failed fresh run leaves behind", async () => {
|
||||
// `commit_container_snapshot` failing after the swap returns a report and
|
||||
// writes `interrupted`. Both have to reach the UI, or Keep is offered
|
||||
// over a container the app can no longer reason about.
|
||||
getMigrationState.mockResolvedValue(null);
|
||||
const { result } = renderHook(() => useContainerMigration(project));
|
||||
await waitFor(() => expect(result.current.staleness).toEqual(STALE));
|
||||
|
||||
migrateProjectToBase.mockResolvedValue({
|
||||
...CLEAN,
|
||||
phase: "failed",
|
||||
message: "saving it failed. Resume it, or roll back.",
|
||||
});
|
||||
getMigrationState.mockResolvedValue(state({ phase: "interrupted" }));
|
||||
await act(async () => {
|
||||
await result.current.start(OPTIONS);
|
||||
});
|
||||
expect(result.current.interrupted?.phase).toBe("interrupted");
|
||||
});
|
||||
|
||||
it("ignores an unrecognised phase from a future build rather than crashing", async () => {
|
||||
getMigrationState.mockResolvedValue(state({ phase: "quantum-tunnelling" }));
|
||||
const { result } = renderHook(() => useContainerMigration(project));
|
||||
|
||||
Reference in New Issue
Block a user