CyberCoveLLC/Triple-C
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 35 Wiki Activity

Stop the snapshot retry being an unconfirmed revoke, and unbrick legacy configs

Browse Source 
Three things, all reachable from a single credential-handling round.

**The "Retry snapshot cleanup" button deleted the token.** `clear_claude_token`
called `secure::delete_claude_oauth_token()` unconditionally; the `mode`
argument only changed the toast wording, so there was no sweep-only path on the
wire. The leftover panel rendered on `leftover !== null` alone and
`onAuthenticated` never cleared it, so the sequence revoke -> snapshot skipped
-> re-authenticate from the button directly above -> press the retry the panel
is still offering threw away the token acquired seconds earlier, announced by a
message about images. The deliberate Revoke needs a confirmation modal; this
needed nothing.

`sweep_claude_token_snapshots` is the honest primitive: it rewrites the images
and never touches the keychain. The images are the durable record, so the retry
re-derives its work from Docker and needs no stored token. Re-authenticating
now clears the panel, and the Authenticate button is disabled while a cleanup
runs — a sweep is a per-image inspect/create/commit/rmi over the Docker socket
and takes minutes.

**Sweep-first left the token live for that whole window.** The keychain delete
sat behind `list_images` plus the per-image loop, at bollard's 120s-per-request
default, while the UI said "Revoking...". A quit or crash in there and nothing
was revoked at all; worse, `has_claude_token` stayed true and
`shared_claude_auth` reads the keychain at container-*create* time, so a
project whose `SecretScrub` guard had already released could be started later
in the same sweep and be handed a fresh copy of the credential in its env.
Keychain-first now, and the comment that claimed "no window in which a scrubbed
image is re-poisoned" — true of images, silent about containers — is corrected.
The reorder's original justification (crash-mid-sweep recoverability) is what
the sweep-only command covers.

A keychain refusal no longer discards a scrub report, because nothing has been
swept yet, and both remedies stay on screen: Revoke, and the image sweep, which
is now offered in every state rather than only when nothing is stored.

**`update_project` validating every folder list bricked existing projects.** It
validated nothing until recently while `WorkspaceSection` saved `{paths}` on
every blur, so `projects.json` can hold a half-filled row, a mount name with a
space, a duplicate, or `/` as a host path. Any such project became entirely
unsavable — every Config toggle, every permission-mode change and
`useTerminal.ts`'s tab rename came back with a message about folders — and
refusing the save did not unmount anything. `validate_project_paths_update`
admits a row carried over verbatim from what is stored and holds a new or
edited row to every rule, which keeps the escalation closed: introducing a bad
value through this command is exactly what a non-carried-over row is. The
`/workspace/../tmp/claude-x` chain is the one exception and runs on every row
regardless, because a stored one is live data loss rather than untidy data.

`ssh_key_path` and `ca_cert_path` had no check at all; a filesystem root there
read-only bind-mounts the whole host at /tmp/.host-ssh. Refused on change, with
the same grandfathering.

Tests are mutation-checked: reverting to sweep-first fails all four new Rust
ordering tests, pointing the retry back at `clear_claude_token` fails five
frontend tests, and validating an update in isolation fails the legacy-data
tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc
This commit is contained in:
shadow-test
2026-08-23 15:42:20 -07:00
co-authored by Claude Opus 5
parent ed91423666
commit 39934299f9
6 changed files with 910 additions and 166 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/src/components/settings/SharedAuthSettings.test.tsx
+155 -16
View File
@@ -6,14 +6,38 @@ import type { ClearTokenOutcome, Project } from "../../lib/types";
const hasClaudeToken = vi.fn();
const clearClaudeToken = vi.fn();
const sweepClaudeTokenSnapshots = vi.fn();
vi.mock("../../lib/tauri-commands", () => ({
hasClaudeToken: () => hasClaudeToken(),
clearClaudeToken: () => clearClaudeToken(),
sweepClaudeTokenSnapshots: () => sweepClaudeTokenSnapshots(),
acquireClaudeToken: vi.fn(),
submitClaudeTokenCode: vi.fn(),
}));
// Stood in for so a sign-in can be *completed* in a test. The panel's reaction
// to `onAuthenticated` is the subject of the H1 sequence below, and driving the
// real acquisition dialog to get there would test the dialog instead.
vi.mock("./ClaudeAuthModal", () => ({
default: ({
onAuthenticated,
onClose,
}: {
onAuthenticated: () => void;
onClose: () => void;
}) => (
<button
onClick={() => {
onAuthenticated();
onClose();
}}
>
finish sign-in
</button>
),
}));
vi.mock("@tauri-apps/api/event", () => ({ listen: vi.fn(async () => vi.fn()) }));
vi.mock("@tauri-apps/plugin-opener", () => ({ openUrl: vi.fn() }));
@@ -59,11 +83,22 @@ const running = (over: Partial<Project> = {}): Project => ({
...over,
});
/** A `ClearTokenOutcome` with nothing left behind, plus any overrides. */
const outcome = (over: Partial<ClearTokenOutcome> = {}): ClearTokenOutcome => ({
snapshots_scrubbed: [],
snapshots_failed: [],
snapshots_skipped: [],
snapshots_superseded: [],
docker_unavailable: null,
...over,
});
describe("SharedAuthSettings", () => {
beforeEach(() => {
vi.clearAllMocks();
projects = [];
hasClaudeToken.mockResolvedValue(false);
sweepClaudeTokenSnapshots.mockResolvedValue(outcome());
useAppState.setState({ toasts: [] });
});
@@ -251,19 +286,17 @@ describe("SharedAuthSettings", () => {
fireEvent.click(await screen.findByRole("button", { name: "Revoke token" }));
const retry = await screen.findByTestId("shared-auth-retry");
clearClaudeToken.mockResolvedValueOnce({
snapshots_scrubbed: ["triple-c-snapshot-p1:latest"],
snapshots_failed: [],
snapshots_skipped: [],
snapshots_superseded: [],
docker_unavailable: null,
});
sweepClaudeTokenSnapshots.mockResolvedValueOnce(
outcome({ snapshots_scrubbed: ["triple-c-snapshot-p1:latest"] }),
);
fireEvent.click(retry);
await waitFor(() =>
expect(screen.queryByTestId("shared-auth-leftover")).not.toBeInTheDocument(),
);
expect(clearClaudeToken).toHaveBeenCalledTimes(2);
// One revoke, one sweep — the retry must not be a second revoke.
expect(clearClaudeToken).toHaveBeenCalledTimes(1);
expect(sweepClaudeTokenSnapshots).toHaveBeenCalledTimes(1);
const toast = useAppState.getState().toasts.at(-1)!;
expect(toast.kind).toBe("success");
expect(toast.message).toMatch(/cleared from 1 snapshot image/i);
@@ -274,20 +307,14 @@ describe("SharedAuthSettings", () => {
// anything is in the keychain today, so the sweep cannot be gated on it.
projects = [running()];
hasClaudeToken.mockResolvedValue(false);
clearClaudeToken.mockResolvedValue({
snapshots_scrubbed: [],
snapshots_failed: [],
snapshots_skipped: [],
snapshots_superseded: [],
docker_unavailable: null,
});
render(<SharedAuthSettings />);
const sweep = await screen.findByTestId("shared-auth-sweep");
expect(screen.queryByRole("button", { name: "Revoke" })).not.toBeInTheDocument();
fireEvent.click(sweep);
await waitFor(() => expect(clearClaudeToken).toHaveBeenCalled());
await waitFor(() => expect(sweepClaudeTokenSnapshots).toHaveBeenCalled());
expect(clearClaudeToken).not.toHaveBeenCalled();
const toast = useAppState.getState().toasts.at(-1)!;
expect(toast.kind).toBe("success");
expect(toast.message).toBe("No snapshot image is holding the token.");
@@ -300,4 +327,116 @@ describe("SharedAuthSettings", () => {
expect(toast.kind).toBe("success");
expect(screen.queryByTestId("shared-auth-leftover")).not.toBeInTheDocument();
});
// ── The retry must not be a revoke in disguise ───────────────────────────
// The sequence that shipped green: revoke, get a skipped image, re-authenticate
// from the button directly above the warning, then press the retry the warning
// is still offering. One command was behind both, so that press deleted the
// token acquired seconds earlier — no confirmation, and a toast that mentioned
// only images. The deliberate Revoke needs a modal; this needed nothing.
it("does not leave a stale cleanup panel over a freshly acquired token", async () => {
projects = [running()];
// Stored when the panel mounts, gone after the revoke, stored again once
// the sign-in finishes.
hasClaudeToken
.mockResolvedValueOnce(true)
.mockResolvedValueOnce(false)
.mockResolvedValue(true);
clearClaudeToken.mockResolvedValue(
outcome({ snapshots_skipped: ["triple-c-snapshot-p1:latest: busy"] }),
);
render(<SharedAuthSettings />);
fireEvent.click(await screen.findByRole("button", { name: "Revoke" }));
fireEvent.click(await screen.findByRole("button", { name: "Revoke token" }));
await screen.findByTestId("shared-auth-leftover");
// Re-authenticate from the button above the warning.
fireEvent.click(await screen.findByRole("button", { name: "Authenticate" }));
fireEvent.click(await screen.findByRole("button", { name: "finish sign-in" }));
await screen.findByRole("button", { name: "Revoke" });
expect(screen.queryByTestId("shared-auth-leftover")).not.toBeInTheDocument();
expect(screen.queryByTestId("shared-auth-retry")).not.toBeInTheDocument();
// The images can still be cleaned up — and doing so does not spend the new
// token.
fireEvent.click(screen.getByTestId("shared-auth-sweep"));
await waitFor(() => expect(sweepClaudeTokenSnapshots).toHaveBeenCalled());
expect(clearClaudeToken).toHaveBeenCalledTimes(1);
});
it("sends the retry to the sweep-only command, never to the revoke", async () => {
projects = [running()];
hasClaudeToken.mockResolvedValueOnce(true).mockResolvedValue(false);
clearClaudeToken.mockResolvedValue(
outcome({ snapshots_skipped: ["triple-c-snapshot-p1:latest: busy"] }),
);
sweepClaudeTokenSnapshots.mockResolvedValue(
outcome({ snapshots_skipped: ["triple-c-snapshot-p1:latest: busy"] }),
);
render(<SharedAuthSettings />);
fireEvent.click(await screen.findByRole("button", { name: "Revoke" }));
fireEvent.click(await screen.findByRole("button", { name: "Revoke token" }));
const retry = await screen.findByTestId("shared-auth-retry");
fireEvent.click(retry);
await waitFor(() => expect(sweepClaudeTokenSnapshots).toHaveBeenCalledTimes(1));
fireEvent.click(await screen.findByTestId("shared-auth-retry"));
await waitFor(() => expect(sweepClaudeTokenSnapshots).toHaveBeenCalledTimes(2));
// However many times it is pressed, the keychain is touched exactly once —
// by the revoke the user confirmed.
expect(clearClaudeToken).toHaveBeenCalledTimes(1);
// …and a retry that still finds a busy project says so without ever
// claiming a token was removed.
const toast = useAppState.getState().toasts.at(-1)!;
expect(toast.message).not.toMatch(/keychain/i);
});
it("will not start a sign-in while a cleanup is still running", async () => {
// A sweep is a per-image inspect/create/commit/rmi over the Docker socket
// and runs for minutes. Acquiring a token inside that window races the
// rewrite that is meant to be removing one.
projects = [running()];
hasClaudeToken.mockResolvedValue(false);
sweepClaudeTokenSnapshots.mockReturnValue(new Promise(() => {}));
render(<SharedAuthSettings />);
const authenticate = await screen.findByRole("button", { name: "Authenticate" });
expect(authenticate).toBeEnabled();
fireEvent.click(await screen.findByTestId("shared-auth-sweep"));
await waitFor(() =>
expect(screen.getByRole("button", { name: "Authenticate" })).toBeDisabled(),
);
});
// ── A keychain that refuses the delete has to leave something to press ───
it("keeps both remedies on screen when the keychain refuses the delete", async () => {
projects = [running()];
hasClaudeToken.mockResolvedValue(true);
clearClaudeToken.mockRejectedValue("the keychain is locked");
render(<SharedAuthSettings />);
fireEvent.click(await screen.findByRole("button", { name: "Revoke" }));
fireEvent.click(await screen.findByRole("button", { name: "Revoke token" }));
await waitFor(() =>
expect(useAppState.getState().toasts.length).toBeGreaterThan(0),
);
const toast = useAppState.getState().toasts[0];
expect(toast.kind).toBe("error");
expect(toast.detail).toMatch(/still stored/i);
// The token is still there, so Revoke is still the retry for it — and the
// images, which the failed delete says nothing about, have their own sweep.
await screen.findByRole("button", { name: "Revoke" });
const sweep = screen.getByTestId("shared-auth-sweep");
fireEvent.click(sweep);
await waitFor(() => expect(sweepClaudeTokenSnapshots).toHaveBeenCalled());
});
});
app/src/components/settings/SharedAuthSettings.tsx
+85 -36
View File
@@ -4,7 +4,10 @@ import Modal from "../ui/Modal";
import StatusIndicator, { type StatusTone } from "../ui/StatusIndicator";
import { selectClass } from "../ui/Field";
import ClaudeAuthModal from "./ClaudeAuthModal";
import { clearClaudeToken } from "../../lib/tauri-commands";
import {
clearClaudeToken,
sweepClaudeTokenSnapshots,
} from "../../lib/tauri-commands";
import type { ClearTokenOutcome } from "../../lib/types";
import { useProjects } from "../../hooks/useProjects";
import { useAppState } from "../../store/appState";
@@ -96,18 +99,30 @@ export default function SharedAuthSettings() {
const display = STATUS_DISPLAY[status];
/**
* Run `clear_claude_token`. It is deliberately the same command for both the
* first revoke and every retry: it sweeps the snapshot images first, deletes
* the keychain entry second, and treats a missing entry as success — so
* calling it again with nothing stored is a pure snapshot sweep, and the
* images themselves are the durable record of what is left to do.
* Run one of the two cleanups. **They are different commands**, and that is
* the point.
*
* `"revoke"` deletes the keychain entry and then rewrites the images. It is
* destructive, and it is only ever reached through the confirmation modal.
*
* `"sweep"` rewrites the images and never touches the keychain. Both the
* standalone check and the retry offered after an incomplete revocation use
* it, because neither is a request to delete a credential — the images are
* the durable record of what is left to do, so the work is re-derived from
* Docker rather than from any token that happens to be stored.
*
* While there was one command behind both, the retry button was an
* unconfirmed revoke: re-authenticate from the button above the panel, press
* "Retry snapshot cleanup", and the token acquired seconds earlier was gone,
* announced by a toast that mentioned only images.
*/
const runSweep = async (mode: "revoke" | "sweep") => {
const runCleanup = async (mode: "revoke" | "sweep") => {
setSweeping(true);
try {
const outcome = (await clearClaudeToken()) as RevokeOutcome;
const outcome = (await (mode === "revoke"
? clearClaudeToken()
: sweepClaudeTokenSnapshots())) as RevokeOutcome;
setConfirmRevoke(false);
await refresh();
const failed = list(outcome.snapshots_failed);
const skipped = list(outcome.snapshots_skipped);
@@ -116,12 +131,14 @@ export default function SharedAuthSettings() {
setLeftover(needsAnotherPass(outcome) ? outcome : null);
// The keychain entry is gone either way. What matters here is the copy of
// the token that `docker commit` baked into each project's snapshot
// image: that one outlives every container, and `docker image inspect`
// will keep printing it until the image is rewritten. If that could not
// be done, the revocation is incomplete and saying "removed" would be a
// lie.
// Whatever the mode, what is being reported here is the copy of the
// token that `docker commit` baked into each project's snapshot image:
// that one outlives every container, and `docker image inspect` will
// keep printing it until the image is rewritten. On a revoke the
// keychain entry is already gone by this point — the command deletes it
// before it touches an image — so if the rewrite could not be done the
// revocation is incomplete and saying "removed" would be a lie. On a
// sweep nothing was deleted at all, and the wording must not imply it.
if (outcome.docker_unavailable) {
pushToast({
kind: "error",
@@ -137,7 +154,10 @@ export default function SharedAuthSettings() {
} else if (failed.length > 0) {
pushToast({
kind: "error",
message: "Token removed from the keychain, but it is still in some images.",
message:
mode === "revoke"
? "Token removed from the keychain, but it is still in some images."
: "A token is still readable in some snapshot images.",
detail:
`${failed.length} snapshot image(s) could not be rewritten and ` +
"still contain the token, readable via `docker image inspect`. Reset those " +
@@ -187,12 +207,24 @@ export default function SharedAuthSettings() {
mode === "revoke"
? "Could not remove the shared Claude token."
: "Could not clear the token from snapshot images.",
detail: authErrorMessage(
e,
"The OS keychain rejected the delete. The token may still be stored.",
),
detail:
mode === "revoke"
? // The keychain delete runs first and nothing else runs until it
// succeeds, so the consequence is knowable and worth stating
// rather than leaving the user with a raw keyring error: the
// token is still stored, and no image was touched. Revoke stays
// on screen because `status` is still "stored", and the snapshot
// sweep beside it does not need this delete to have worked.
`${authErrorMessage(e, "The OS keychain rejected the delete.")} ` +
"The token is still stored and no snapshot image was changed — try again, " +
"or use “Check snapshot images” to clean the images on their own."
: authErrorMessage(e, "The snapshot images could not be checked."),
});
} finally {
// In `finally` rather than in the success path: a failed revoke leaves
// the token stored, and the panel has to say so rather than keeping
// whatever it believed before the attempt.
await refresh();
setSweeping(false);
}
};
@@ -255,7 +287,11 @@ export default function SharedAuthSettings() {
<Button
size="md"
variant="primary"
disabled={!host}
// Also disabled while a cleanup is running. A sweep is a per-image
// inspect/create/commit/rmi over the Docker socket and takes minutes;
// acquiring a token in the middle of one races the rewrite, and a
// revoke started before it would delete the new token when it lands.
disabled={!host || sweeping}
onClick={() => setAuthOpen(true)}
>
{status === "stored" ? "Re-authenticate" : "Authenticate"}
@@ -270,19 +306,21 @@ export default function SharedAuthSettings() {
Revoke
</Button>
)}
{status === "absent" && (
// Not gated on a stored token, on purpose. A revoke that could not
// finish leaves the token in a snapshot image while the keychain
// entry — and therefore the Revoke button — is already gone, and a
// snapshot committed by an older build carries it whether or not
// anything is stored today. With nothing in the keychain the same
// command is a pure image sweep.
{status !== "checking" && (
// Offered in every state, not just "absent". Three reasons, and the
// command behind it deletes nothing, so none of them costs anything:
// a snapshot committed by an older build carries a token whether or
// not one is stored today; a revoke that could not finish leaves one
// in an image while the keychain entry — and the Revoke button — is
// already gone; and when the keychain refuses the delete, `status`
// stays "stored", which used to leave the images with no affordance
// at all.
<Button
size="md"
variant="ghost"
disabled={sweeping}
data-testid="shared-auth-sweep"
onClick={() => void runSweep("sweep")}
onClick={() => void runCleanup("sweep")}
>
{sweeping ? "Checking…" : "Check snapshot images"}
</Button>
@@ -327,7 +365,9 @@ export default function SharedAuthSettings() {
variant="secondary"
disabled={sweeping}
data-testid="shared-auth-retry"
onClick={() => void runSweep("sweep")}
// `runCleanup("sweep")` is `sweep_claude_token_snapshots`, which
// has no keychain delete on the wire at all — see `runCleanup`.
onClick={() => void runCleanup("sweep")}
>
{sweeping ? "Retrying…" : "Retry snapshot cleanup"}
</Button>
@@ -360,6 +400,13 @@ export default function SharedAuthSettings() {
projectName={host.name}
onClose={() => setAuthOpen(false)}
onAuthenticated={() => {
// The panel is about a *previous* credential and the button that
// finishes it is a sweep, so leaving it up after a fresh sign-in
// is at best confusing and was at worst fatal: while the retry ran
// `clear_claude_token`, the obvious next click deleted the token
// just acquired. "Check snapshot images" stays available above, so
// nothing is lost by clearing this.
setLeftover(null);
void refresh();
}}
/>
@@ -384,7 +431,7 @@ export default function SharedAuthSettings() {
size="md"
variant="danger"
disabled={sweeping}
onClick={() => void runSweep("revoke")}
onClick={() => void runCleanup("revoke")}
>
{sweeping ? "Revoking…" : "Revoke token"}
</Button>
@@ -399,11 +446,13 @@ export default function SharedAuthSettings() {
restarted.
</p>
<p className="mt-2 text-[13px] text-[var(--text-secondary)] leading-snug">
Each project&rsquo;s snapshot image is rewritten first, because{" "}
<code className="font-mono">docker commit</code> copies the token into it
and an image outlives every container built from it. A project that is
busy right now is skipped rather than rewritten unsafely &mdash; you will
be told which, and the cleanup can be run again from here afterwards.
The keychain entry goes first, then each project&rsquo;s snapshot image is
rewritten &mdash; <code className="font-mono">docker commit</code> copies
the token into it, and an image outlives every container built from it.
That second half takes a while, and a project that is busy right now is
skipped rather than rewritten unsafely: you will be told which, and
&ldquo;Check snapshot images&rdquo; runs the cleanup again afterwards
without touching the keychain.
</p>
</Modal>
)}