CyberCoveLLC/Triple-C
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 35 Wiki Activity

Close the cross-stream gaps the parallel fix round left open

Browse Source 
Three items each of which fell between two agents' file lists.

`scrub_secrets_from_snapshots` was the third unsynchronised writer of
`triple-c-snapshot-{id}:latest`, after a recreate's commit and a
compaction. It has the same read-modify-write shape — create a scratch
container from the snapshot, commit back over the same tag — and loses
the same race, which here means re-baking the very credential it exists
to remove. It now takes the project's claim, under a new
`ProjectOp::SecretScrub`, and reports a snapshot it had to skip rather
than rewriting it unsafely.

Its scratch container also now carries `triple-c.scrub=true`, so the
Disk panel's reclaim bucket discriminates by label and by the live claim
rather than by a clock. The 15-minute age gate stays as the backstop for
the cross-process case the claim cannot see.

The store plugin is unregistered and its dependency dropped. Its
capability grants were removed as a host-file-write primitive; the
registration without a grant was unreachable but dead.

Finally, container.rs's fold test was pinning a fold that no longer
exists — disk.rs now emits the JSON exec form. It asserts the stronger
property instead: the script a compaction runs is byte-for-byte the one
snapshot_scrub_script() produces, so the two files cannot drift silently.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc
This commit is contained in:
shadow-test
2026-08-23 11:53:25 -07:00
co-authored by Claude Opus 5
parent 17f031a5d7
commit a76f2c0a17
11 changed files with 169 additions and 417 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/src-tauri/gen/schemas/acl-manifests.json
+1 -1
View File
File diff suppressed because one or more lines are too long
app/src-tauri/gen/schemas/desktop-schema.json
-174
View File
@@ -2491,180 +2491,6 @@
"type": "string",
"const": "opener:deny-reveal-item-in-dir",
"markdownDescription": "Denies the reveal_item_in_dir command without any pre-configured scope."
},
{
"description": "This permission set configures what kind of\noperations are available from the store plugin.\n\n#### Granted Permissions\n\nAll operations are enabled by default.\n\n\n#### This default permission set includes:\n\n- `allow-load`\n- `allow-get-store`\n- `allow-set`\n- `allow-get`\n- `allow-has`\n- `allow-delete`\n- `allow-clear`\n- `allow-reset`\n- `allow-keys`\n- `allow-values`\n- `allow-entries`\n- `allow-length`\n- `allow-reload`\n- `allow-save`",
"type": "string",
"const": "store:default",
"markdownDescription": "This permission set configures what kind of\noperations are available from the store plugin.\n\n#### Granted Permissions\n\nAll operations are enabled by default.\n\n\n#### This default permission set includes:\n\n- `allow-load`\n- `allow-get-store`\n- `allow-set`\n- `allow-get`\n- `allow-has`\n- `allow-delete`\n- `allow-clear`\n- `allow-reset`\n- `allow-keys`\n- `allow-values`\n- `allow-entries`\n- `allow-length`\n- `allow-reload`\n- `allow-save`"
},
{
"description": "Enables the clear command without any pre-configured scope.",
"type": "string",
"const": "store:allow-clear",
"markdownDescription": "Enables the clear command without any pre-configured scope."
},
{
"description": "Enables the delete command without any pre-configured scope.",
"type": "string",
"const": "store:allow-delete",
"markdownDescription": "Enables the delete command without any pre-configured scope."
},
{
"description": "Enables the entries command without any pre-configured scope.",
"type": "string",
"const": "store:allow-entries",
"markdownDescription": "Enables the entries command without any pre-configured scope."
},
{
"description": "Enables the get command without any pre-configured scope.",
"type": "string",
"const": "store:allow-get",
"markdownDescription": "Enables the get command without any pre-configured scope."
},
{
"description": "Enables the get_store command without any pre-configured scope.",
"type": "string",
"const": "store:allow-get-store",
"markdownDescription": "Enables the get_store command without any pre-configured scope."
},
{
"description": "Enables the has command without any pre-configured scope.",
"type": "string",
"const": "store:allow-has",
"markdownDescription": "Enables the has command without any pre-configured scope."
},
{
"description": "Enables the keys command without any pre-configured scope.",
"type": "string",
"const": "store:allow-keys",
"markdownDescription": "Enables the keys command without any pre-configured scope."
},
{
"description": "Enables the length command without any pre-configured scope.",
"type": "string",
"const": "store:allow-length",
"markdownDescription": "Enables the length command without any pre-configured scope."
},
{
"description": "Enables the load command without any pre-configured scope.",
"type": "string",
"const": "store:allow-load",
"markdownDescription": "Enables the load command without any pre-configured scope."
},
{
"description": "Enables the reload command without any pre-configured scope.",
"type": "string",
"const": "store:allow-reload",
"markdownDescription": "Enables the reload command without any pre-configured scope."
},
{
"description": "Enables the reset command without any pre-configured scope.",
"type": "string",
"const": "store:allow-reset",
"markdownDescription": "Enables the reset command without any pre-configured scope."
},
{
"description": "Enables the save command without any pre-configured scope.",
"type": "string",
"const": "store:allow-save",
"markdownDescription": "Enables the save command without any pre-configured scope."
},
{
"description": "Enables the set command without any pre-configured scope.",
"type": "string",
"const": "store:allow-set",
"markdownDescription": "Enables the set command without any pre-configured scope."
},
{
"description": "Enables the values command without any pre-configured scope.",
"type": "string",
"const": "store:allow-values",
"markdownDescription": "Enables the values command without any pre-configured scope."
},
{
"description": "Denies the clear command without any pre-configured scope.",
"type": "string",
"const": "store:deny-clear",
"markdownDescription": "Denies the clear command without any pre-configured scope."
},
{
"description": "Denies the delete command without any pre-configured scope.",
"type": "string",
"const": "store:deny-delete",
"markdownDescription": "Denies the delete command without any pre-configured scope."
},
{
"description": "Denies the entries command without any pre-configured scope.",
"type": "string",
"const": "store:deny-entries",
"markdownDescription": "Denies the entries command without any pre-configured scope."
},
{
"description": "Denies the get command without any pre-configured scope.",
"type": "string",
"const": "store:deny-get",
"markdownDescription": "Denies the get command without any pre-configured scope."
},
{
"description": "Denies the get_store command without any pre-configured scope.",
"type": "string",
"const": "store:deny-get-store",
"markdownDescription": "Denies the get_store command without any pre-configured scope."
},
{
"description": "Denies the has command without any pre-configured scope.",
"type": "string",
"const": "store:deny-has",
"markdownDescription": "Denies the has command without any pre-configured scope."
},
{
"description": "Denies the keys command without any pre-configured scope.",
"type": "string",
"const": "store:deny-keys",
"markdownDescription": "Denies the keys command without any pre-configured scope."
},
{
"description": "Denies the length command without any pre-configured scope.",
"type": "string",
"const": "store:deny-length",
"markdownDescription": "Denies the length command without any pre-configured scope."
},
{
"description": "Denies the load command without any pre-configured scope.",
"type": "string",
"const": "store:deny-load",
"markdownDescription": "Denies the load command without any pre-configured scope."
},
{
"description": "Denies the reload command without any pre-configured scope.",
"type": "string",
"const": "store:deny-reload",
"markdownDescription": "Denies the reload command without any pre-configured scope."
},
{
"description": "Denies the reset command without any pre-configured scope.",
"type": "string",
"const": "store:deny-reset",
"markdownDescription": "Denies the reset command without any pre-configured scope."
},
{
"description": "Denies the save command without any pre-configured scope.",
"type": "string",
"const": "store:deny-save",
"markdownDescription": "Denies the save command without any pre-configured scope."
},
{
"description": "Denies the set command without any pre-configured scope.",
"type": "string",
"const": "store:deny-set",
"markdownDescription": "Denies the set command without any pre-configured scope."
},
{
"description": "Denies the values command without any pre-configured scope.",
"type": "string",
"const": "store:deny-values",
"markdownDescription": "Denies the values command without any pre-configured scope."
}
]
},
app/src-tauri/gen/schemas/linux-schema.json
-174
View File
@@ -2491,180 +2491,6 @@
"type": "string",
"const": "opener:deny-reveal-item-in-dir",
"markdownDescription": "Denies the reveal_item_in_dir command without any pre-configured scope."
},
{
"description": "This permission set configures what kind of\noperations are available from the store plugin.\n\n#### Granted Permissions\n\nAll operations are enabled by default.\n\n\n#### This default permission set includes:\n\n- `allow-load`\n- `allow-get-store`\n- `allow-set`\n- `allow-get`\n- `allow-has`\n- `allow-delete`\n- `allow-clear`\n- `allow-reset`\n- `allow-keys`\n- `allow-values`\n- `allow-entries`\n- `allow-length`\n- `allow-reload`\n- `allow-save`",
"type": "string",
"const": "store:default",
"markdownDescription": "This permission set configures what kind of\noperations are available from the store plugin.\n\n#### Granted Permissions\n\nAll operations are enabled by default.\n\n\n#### This default permission set includes:\n\n- `allow-load`\n- `allow-get-store`\n- `allow-set`\n- `allow-get`\n- `allow-has`\n- `allow-delete`\n- `allow-clear`\n- `allow-reset`\n- `allow-keys`\n- `allow-values`\n- `allow-entries`\n- `allow-length`\n- `allow-reload`\n- `allow-save`"
},
{
"description": "Enables the clear command without any pre-configured scope.",
"type": "string",
"const": "store:allow-clear",
"markdownDescription": "Enables the clear command without any pre-configured scope."
},
{
"description": "Enables the delete command without any pre-configured scope.",
"type": "string",
"const": "store:allow-delete",
"markdownDescription": "Enables the delete command without any pre-configured scope."
},
{
"description": "Enables the entries command without any pre-configured scope.",
"type": "string",
"const": "store:allow-entries",
"markdownDescription": "Enables the entries command without any pre-configured scope."
},
{
"description": "Enables the get command without any pre-configured scope.",
"type": "string",
"const": "store:allow-get",
"markdownDescription": "Enables the get command without any pre-configured scope."
},
{
"description": "Enables the get_store command without any pre-configured scope.",
"type": "string",
"const": "store:allow-get-store",
"markdownDescription": "Enables the get_store command without any pre-configured scope."
},
{
"description": "Enables the has command without any pre-configured scope.",
"type": "string",
"const": "store:allow-has",
"markdownDescription": "Enables the has command without any pre-configured scope."
},
{
"description": "Enables the keys command without any pre-configured scope.",
"type": "string",
"const": "store:allow-keys",
"markdownDescription": "Enables the keys command without any pre-configured scope."
},
{
"description": "Enables the length command without any pre-configured scope.",
"type": "string",
"const": "store:allow-length",
"markdownDescription": "Enables the length command without any pre-configured scope."
},
{
"description": "Enables the load command without any pre-configured scope.",
"type": "string",
"const": "store:allow-load",
"markdownDescription": "Enables the load command without any pre-configured scope."
},
{
"description": "Enables the reload command without any pre-configured scope.",
"type": "string",
"const": "store:allow-reload",
"markdownDescription": "Enables the reload command without any pre-configured scope."
},
{
"description": "Enables the reset command without any pre-configured scope.",
"type": "string",
"const": "store:allow-reset",
"markdownDescription": "Enables the reset command without any pre-configured scope."
},
{
"description": "Enables the save command without any pre-configured scope.",
"type": "string",
"const": "store:allow-save",
"markdownDescription": "Enables the save command without any pre-configured scope."
},
{
"description": "Enables the set command without any pre-configured scope.",
"type": "string",
"const": "store:allow-set",
"markdownDescription": "Enables the set command without any pre-configured scope."
},
{
"description": "Enables the values command without any pre-configured scope.",
"type": "string",
"const": "store:allow-values",
"markdownDescription": "Enables the values command without any pre-configured scope."
},
{
"description": "Denies the clear command without any pre-configured scope.",
"type": "string",
"const": "store:deny-clear",
"markdownDescription": "Denies the clear command without any pre-configured scope."
},
{
"description": "Denies the delete command without any pre-configured scope.",
"type": "string",
"const": "store:deny-delete",
"markdownDescription": "Denies the delete command without any pre-configured scope."
},
{
"description": "Denies the entries command without any pre-configured scope.",
"type": "string",
"const": "store:deny-entries",
"markdownDescription": "Denies the entries command without any pre-configured scope."
},
{
"description": "Denies the get command without any pre-configured scope.",
"type": "string",
"const": "store:deny-get",
"markdownDescription": "Denies the get command without any pre-configured scope."
},
{
"description": "Denies the get_store command without any pre-configured scope.",
"type": "string",
"const": "store:deny-get-store",
"markdownDescription": "Denies the get_store command without any pre-configured scope."
},
{
"description": "Denies the has command without any pre-configured scope.",
"type": "string",
"const": "store:deny-has",
"markdownDescription": "Denies the has command without any pre-configured scope."
},
{
"description": "Denies the keys command without any pre-configured scope.",
"type": "string",
"const": "store:deny-keys",
"markdownDescription": "Denies the keys command without any pre-configured scope."
},
{
"description": "Denies the length command without any pre-configured scope.",
"type": "string",
"const": "store:deny-length",
"markdownDescription": "Denies the length command without any pre-configured scope."
},
{
"description": "Denies the load command without any pre-configured scope.",
"type": "string",
"const": "store:deny-load",
"markdownDescription": "Denies the load command without any pre-configured scope."
},
{
"description": "Denies the reload command without any pre-configured scope.",
"type": "string",
"const": "store:deny-reload",
"markdownDescription": "Denies the reload command without any pre-configured scope."
},
{
"description": "Denies the reset command without any pre-configured scope.",
"type": "string",
"const": "store:deny-reset",
"markdownDescription": "Denies the reset command without any pre-configured scope."
},
{
"description": "Denies the save command without any pre-configured scope.",
"type": "string",
"const": "store:deny-save",
"markdownDescription": "Denies the save command without any pre-configured scope."
},
{
"description": "Denies the set command without any pre-configured scope.",
"type": "string",
"const": "store:deny-set",
"markdownDescription": "Denies the set command without any pre-configured scope."
},
{
"description": "Denies the values command without any pre-configured scope.",
"type": "string",
"const": "store:deny-values",
"markdownDescription": "Denies the values command without any pre-configured scope."
}
]
},