8 Commits

Include renames

Author	SHA1	Message	Date
shadow-testandClaude Opus 5	dcd2dfe5a3	Stop a project id from steering a Docker API DELETE, and stop trusting a store that lost its list ... C-2 (critical). `destroy_ownerless_rollback_pin` validated its tag and not its project id, then interpolated both into `triple-c-snapshot-{id}:{tag}` and handed the result to bollard. bollard does not percent-encode: `Uri::parse` joins an absolute path onto the base URL, which replaces the path outright and applies RFC 3986 dot-segment removal. An id of `a/../../v1.47/volumes/<name>?` turns a "remove image tag" into `DELETE /v1.47/volumes/<name>`. That arm is reached *because* `find_project` failed, so the id is unconstrained IPC input, and the typed confirmation is no barrier — it compares the caller's own two strings. Reproduced against the live daemon, and now a test: with the check removed the volume is gone and the test fails; with it, the volume survives and a legitimate ownerless pin still deletes. The reference that reaches `remove_image` is now the daemon's own repo_tag, matched on the parsed pair, so nothing built from IPC input addresses the API at all. The same id check now guards the owned arms of `destroy` and `compact_snapshot`, which build volume names and image references from a `projects.json` field. H-1. The ownerless arm decided ownership from the in-memory list alone and then called `sweep_orphaned_snapshots()`, which deletes the freshly dangling image on the same pass — so a corrupt `projects.json` could reap a pin whose migration is still awaiting confirmation, the one thing `pin_is_reapable` orders its conditions to prevent. It now re-reads the store from disk, runs `project_store_trust`, refuses an id the store knows, takes the project lock before reading anything a decision rests on, and checks `has_record`. H-3. The corrupt-store guard keyed on "empty list + file exists", and `ProjectsStore::new()` swallows a corrupt file without rewriting it — so the first `save()`, as little as starting a project, wrote `[{new}]` over it and the guard passed with every other project's volumes unclaimed. A corrupt load is now recorded in a sticky `projects.json.corrupt` marker beside the file, and the existing `.bak` is no longer clobbered by a second corruption. A missing `projects.json` is refused too: it cannot be told from a moved or partially restored data directory, and the genuinely fresh case has nothing to find. Also: the three migration commands surface the lock's real refusal instead of substituting "a migration is already running"; `note_ownerless_since` re-checks `has_record` after writing a tombstone, closing the window that could plant one behind a valid record and reap the pin with zero grace; corrupt migration-record copies are capped at four; `reconcile_migration` yields to any lock holder, not only a migration; and a 22-space run in a refusal string is gone. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc	2026-08-23 13:11:42 -07:00
shadow-testandClaude Opus 5	6abc7f27a4	Fix disk/migration defects and add a real per-project lock ... The compaction panel's headline action had never worked, three reclaim paths could delete data with no confirmation and no grace period, and the app's only mutual-exclusion primitive was one-way. **A per-project lock (`project_lock.rs`).** `ACTIVE_MIGRATIONS` was the app's only exclusion and everything but migration merely *polled* it once at entry. Compaction, start/stop/recreate, Reset and destroy now **acquire** a `ProjectGuard` and hold it for the whole operation; `is_migrating` is a view onto the same registry. Closes the three verified interleavings where a compaction commits `flat(A)` over a `:latest` that a migration, a recreate or a Reset had already moved. In-process only — the two-instance case is documented in the module, not solved, and the daemon-wide reapers gained age gates to bound it. **H1: compaction never ran.** `fold_shell_script` joined the scrub script's lines with a space, so every build died on `syntax error: unexpected "do"`. Replaced with the JSON exec form, which carries any script verbatim; `sh -n` and a real end-to-end build now cover it (159.5 MB / 9 layers -> 33.7 MB / 1 layer, setuid and multi-line env preserved). **H2/H4:** `reclaim_migration_pins` and `survey_rollback_pins` apply `parse_rollback_tag` and `pin_is_reapable` like every other path, and stop double-counting an image with two pin tags. The 14-day grace period is re-anchored from the tag's timestamp (when the migration *started*) to a tombstone recording when the record went missing, with clock skew handled in both directions. **H3:** `migration_store::load` no longer renames a corrupt record aside — that destroyed the `has_record` signal both pin reapers depend on. `save` fsyncs the file and the directory, and corruption backups are timestamped. **H2b/M2:** a crashed compaction's `:compacting` tag and `triple-c-compact-*` container are reaped at startup; the stale-container sweep moved from the end of a compaction to the start, where its doc always claimed it was. **M5/M6:** orphan-volume deletion moved from a `Safety::Safe` tick to the destructive path with a typed volume name; `project_store_trust` reads the real `projects.json` so a second instance's project is not offered as an orphan. Numbers: `images_total_bytes` uses `df()`'s deduplicated `layers_size`; the Total column is derived from the same figure the Snapshot column shows; partial container/staging reclaims report their failure count; `human()` no longer prints "1000.0 KB"; `docker_cli` has a timeout; blocking `fs` calls moved to `spawn_blocking`. Also fixes `ProbeContainerGuard::remove_now`, which disarmed before the await and so did nothing on the cancellation path it exists for. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc	2026-08-23 11:45:28 -07:00
shadow-testandClaude Opus 5	2ca86bb5d8	Scrub the writable layer on the migration path too, and de-duplicate CLAUDE_JSON ... Two integration fixes after merging the three feature branches. `scrub_writable_layer` is a `docker exec`, so it only works while the container runs. `migrate_project_to_base` stops its container one line before the pre-swap commit, which meant the single largest snapshot Triple-C ever takes was the one path that committed unscrubbed. Call the scrub explicitly before the stop instead of relying on the call inside `commit_container_snapshot`. Also drop a duplicate `CLAUDE_JSON=` assignment in entrypoint.sh. The Shift+Enter block re-declared it defensively to avoid a merge conflict with the awsAuthRefresh block; the conflict did not materialise. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc	2026-08-23 08:38:01 -07:00
shadow-testandClaude Opus 5	dd2894cc60	Stop Docker disk growth, and fix the Claude Code settings that never worked ... Two independent sets of fixes. ## Disk: stop the growth, no UI this round The dangling-snapshot sweep was already correct and was never the leak. The leak is that every `docker commit` **stacks** a layer and nothing compacts one: a file deleted after it has been committed becomes a whiteout, not free bytes. 24 conditions trigger recreation+commit, so changing one settings field costs a multi-gigabyte layer for the life of the project. One project was measured with 14 stacked commit layers, ~5.1 GB above its base. * **Scrub the writable layer before every commit** (`docker/container.rs`, `SNAPSHOT_SCRUB_PATHS` / `scrub_writable_layer`). The one moment those bytes are still free to drop is before the commit that captures them. Measured on one container's 4.48 GB pending layer: 3.0 GB of agent scratchpad under `/tmp/claude-*`, the terminal drag-drop staging area (256 MiB per file, with no `rm` for it anywhere in the repo), a PNG per pasted image, and the apt lists/cache/logs that `browser_view/install.rs` and `triple-c-playwright-heal` leave behind with no `apt-get clean`. A hardcoded list, never a heuristic: `/workspace/{mount_name}` is a host bind mount and nothing here may reach one, and the three `/tmp` globs cannot select the read-only `.host-ca`/`.host-aws` mounts. Failure is a log line — a scrub must never block a snapshot. * **Cap container logs** (`capped_log_config`). There was no `LogConfig` anywhere, so containers ran on the daemon's unbounded `json-file` default. Deliberately *not* wired into `container_needs_recreation`: participating would recreate every project once, and a recreation costs a commit, which is the thing being fixed. Picked up on the next natural recreation. * **Make superseded base images sweepable** (`container/Dockerfile`). It carried no `LABEL` at all, so `orphan_sweep_filters`' `dangling` + `triple-c.managed` pair provably could not match one — ~11.9 GB observed stranded. Stamping `triple-c.managed=true` is the whole fix; the sweep needed no change. `create_container` writes the new `triple-c.base` key explicitly empty, or Docker's label inheritance plus `docker commit` would make every snapshot claim to be a base image. `force: false` stays, and now says why. * **Sweep at startup** (`lib.rs`), not only after recreation: probes first (a probe pins an image the unforced sweep then refuses), pins second, sweep last. `sweep_orphaned_snapshots_logged` exists because all three callers threw the report away — `reclaimed_bytes`, `failed` and `unavailable` included. * **Reap migration leftovers.** `rollback_migration` retagged and orphaned the migrated snapshot with no sweep. Stale `pre-migration-*` pins are now age-reaped by scanning the tag pattern rather than trusting the state file — `migration_store::load` reports an unparseable record as absent, which stranded a 4-12 GB pin nothing could name again; `load` now moves a corrupt record aside so `has_record` is trustworthy. A pin whose migration is still awaiting confirmation is never reaped at any age. The probe container's removal was a plain statement after an await, so a dropped future (an app quit mid-migration) leaked a container pinning a multi-gigabyte image; it is a `Drop` guard now, with `reap_probe_containers` for the case where the process itself dies. * **Prune scheduler logs.** `remove` deleted a task's JSON but never its log directory, and the task runner appended uncapped `claude -p` output. * **Fix the delete copy.** It said "the container, config volume, and stored credentials"; it removes *both* volumes and the snapshot image. No prune UI, and no unfiltered `prune_images`/`prune_volumes` anywhere — the daemon is shared with the user's unrelated work. ## Claude Code settings: two invented keys, one inverted default, one sticky bug Verified against code.claude.com/docs/en/settings-reference.md and env-vars.md. * `effort` -> **`effortLevel`**, the key Claude Code actually reads; the old one was written and silently ignored. `xhigh` added to the dropdown. * `focusMode` -> **`viewMode: "focus"`**. `focusMode` was invented. The real key does exactly what the existing UI hint already described. * **Session recap was inverted.** Claude Code's recap is on by default, so `CLAUDE_CODE_ENABLE_AWAY_SUMMARY=1`-when-enabled was a no-op and the control could never turn the recap *off*. The field is renamed to `session_recap_disabled` rather than reused: reusing the name with the opposite meaning would have read every stored `enable_session_recap: false` — which is every project that never touched the control — as "the user turned this off". * **The stickiness, which is the important one.** Keys were emitted only when non-default, and the entrypoint *merges* into a settings.json on a persisted volume, so switching a setting off omitted its key, the merge preserved the stale on-value, and the setting stayed on until a destructive Reset. The fix already existed in the same file — the sandbox block is emitted unconditionally for exactly this reason — and is now applied to all five keys. A key whose neutral state is *unset* (`tui`, `effortLevel`, `viewMode`, `awaySummaryEnabled`) is emitted as JSON `null` and the entrypoint deletes it, because a stand-in value is not neutral: `tui: "default"` pins the classic renderer where unset lets Claude Code choose, and `viewMode: "default"` overrides the user's own sticky `/focus` choice. * The same stickiness existed, unnoticed, in the **env vars**: `docker commit` bakes container env into the snapshot image, so a `=1` written once rode it forever. All four are now emitted on every create, extracted into `claude_code_env_vars` and unit tested. Two use an empty value for "off" rather than `0`, because they outrank a setting the user can change from inside their own container and Triple-C's default must not overrule a `/config` choice it never asked about. * TUI mode is now a genuine three-way choice (automatic / classic / fullscreen), which the always-emitted key makes both necessary and possible. `merge_claude_code_settings` is untouched by choice: a project-level OFF still cannot override a globally-ON setting. Tests: 364 frontend (+5), 308 Rust (+23), covering the scrub path list and script, log rotation, pin reaping, and that toggling a setting off actually clears a previously-set ON value. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc	2026-08-23 08:35:10 -07:00
shadow-testandClaude Opus 5	84a67fcd0d	Stop an empty base-image label from silencing the migration notice ... A project can be out of date and say nothing about it, in two ways that compound: the lineage lookup treats "unknown" as an answer, and the fallback that exists for unknown lineage disappears when its probe fails. `create_container` always writes triple-c.base-image-id, even when the value is unknown — deliberately, so an inherited image label cannot ride a snapshot forever. That makes Some("") the ordinary reading from a container whose lineage was never established. The lookup filtered for emptiness only on the final result, so that empty string satisfied the container branch and skipped the snapshot entirely: a snapshot that had recorded a real lineage was never consulted, and the project reported "unknown" with the answer one lookup away. Each source is now filtered before it can answer, in pick_recorded_lineage, which is a plain function so the case has a test that fails against the old logic. A genuinely pre-label project stays unknown, and should: its ancestor is not knowable, and inventing one would make it look permanently current. The probe is the intended signal for those — but if the probe failed, get_container_staleness returned early with nothing populated, the banner found no gaps and rendered null, and the probe_error it already knew how to display sat behind a gate that returned before reaching it. Silence there is indistinguishable from "up to date", and it is likeliest for the oldest and largest projects, whose manifests are the ones apt to exceed the inspection limit — one real project measured 6.93 MB against an 8 MB cap. An unknown-lineage container whose probe failed now says the check could not be completed, with the reason, under the tone that means unresolved rather than the one that means something is wrong. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-13 21:24:51 -07:00
shadow-testandClaude Opus 5	5f990dd28b	Sweep the snapshot commits recreation leaves behind ... Every recreation commits the container to triple-c-snapshot-{id}:latest and moves that tag; the image it pointed at keeps its layers and loses its name. Nothing deleted those, so they accumulate — measured on one real host, 7 orphans holding 7.4 GB, three of them from a single day's work. `sweep_orphaned_snapshots` removes them, under two conditions that are the whole safety argument. Untagged: every image the app depends on carries a tag, so a project's live `:latest` and a migration's `pre-migration-*` rollback pin cannot match the filter at all. And labelled `triple-c.managed=true`, which `docker commit` copies from the container onto the image — the user's own dangling images are not ours to delete. Removal is unforced on top of that, so Docker refuses while any container is still built from the image, including the stopped containers of projects that are not running; those are counted and left for the next sweep. It runs after a recreation, which is when the orphan it just made becomes removable, and after a migration is accepted, which is the moment dropping the pin turns the pre-migration snapshot into an orphan. Both detached: this is housekeeping, and a full disk beats a project that will not start. Each sweep clears every orphan it finds, so recreations that predate it are cleaned up too. The label string is now a constant rather than four literals, and a test pins both filter conditions in place. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-11 19:01:20 -07:00
shadow-testandClaude Opus 5	2de00b3c55	Fix review findings: secrets in snapshots, URL spoofing, migration data loss ... Adversarial review of the branch produced findings across four areas. This addresses them, plus the Windows CI environment. Secrets. commit_container_snapshot baked the container's full env into the per-project snapshot image, so the shared OAuth token — and the AWS keys, git token and gateway master key — outlived revocation and were readable via docker inspect. Verified against Engine 29.6 that a commit body's config merges over the container's: keys cannot be dropped but can be overwritten, so all of them now commit as KEY=. clear_claude_token additionally rewrites images from earlier builds and reports honestly when a tag could not be rewritten. The recommendation to move the token out of env entirely was not taken, with reasoning: apiKeyHelper is a different auth method that outranks CLAUDE_CODE_OAUTH_TOKEN rather than a transport for it, and no file-based delivery exists. The durable exposure — the image — is what is closed here. Separately noted, not fixed: entrypoint.sh captures the token into the scheduler's .env inside the persisted volume. URL spoofing. Three call sites reached openUrl with container-controlled strings, one of which the review missed (the WebLinksAddon handler). The sign-in URL was scraped from container output with a longest-match tie-break and no userinfo check, so claude.ai@evil.tld rendered as "claude.ai…" in a truncating element. There is now one sanitizer in front of every sink — scheme allowlist, no userinfo, C0/C1 and quote rejection, host allowlist for the sign-in case, first-match — and the origin renders un-truncated. The toast is keyed so a changed URL remounts, closing a bait-and-switch where the user read one URL and clicked another. Migration. The rollback pin was best-effort: a tag failure was logged and the migration continued past remove_container, after which the final commit overwrote the only copy of the old system layer. It now aborts before anything destructive and reads the tag back. /var was destroyed while the ordinary recreate path preserves it — making the "safe" alternative to Reset more destructive than Reset's alternative; data-bearing subtrees are now detected and disclosed in the pre-flight rather than copied, since tarring a live database onto a different base's packages is a corruption risk. resume_migration now verifies the migration-state label instead of reporting success for a container that never swapped. dismiss actually resolves the record rather than leaving the feature permanently refusing to migrate. Start and Reset are guarded while a migration is live. Lifecycle. The gateway no longer publishes on 0.0.0.0 — bind address and advertised URL are derived together so they cannot drift. Disabling it now stops it. App exit runs teardown concurrently under a budget with a visible shutting-down state instead of blocking for minutes. Auto-starts retry when Docker is not up yet, and the polling-recovery path now reconciles, so interrupted migrations are still recovered. Auth-bridge forwards are capped, closing a container-driven fd exhaustion. Windows CI. build-windows failed on this branch with "linker link.exe not found". The runner had no MSVC build tools and the workflow assumed a hand-provisioned machine, so a bare runner registers, accepts jobs and fails at link time after downloading the whole crate graph. The job now installs the VC++ workload when vswhere cannot find it, matching how it already conditionally installs Rust and Node. 192 Rust tests, 274 frontend tests, both builds clean, zero warnings. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-09 19:35:39 -07:00
shadow-testandClaude Opus 5	d42b741337	Migrate a project onto a new base image without losing its volumes ... Projects were pinned to the image they were first created from. Both create paths preferred triple-c-snapshot-<id>:latest whenever it existed, and container_needs_recreation compared the container's live image against the triple-c.image label — which create_container wrote from the same image it created from. A tautology that could never fire. The only escape was Reset, which calls remove_project_volumes and destroys the login, skills and transcripts. Measured consequences on this host: real projects are missing socat (so the auth bridge cannot tunnel) and bubblewrap (so sandbox mode does not work), plus Mission Control and triple-c-sso-refresh, and sit 61 packages behind the base including ca-certificates, openssl and curl. Detection. create_container now writes triple-c.base-image-id (the image ID, not RepoDigests, which local-built and custom images do not have) and triple-c.create-image. container_needs_recreation takes the expected create-image and compares against the latter, so the check means something. base-image-id is deliberately NOT compared: a base bump would otherwise silently recreate from the snapshot, consuming the "you should migrate" signal without migrating. Staleness is surfaced, never acted on automatically. Migration keeps the volumes. /home/claude and ~/.claude are volumes and the image's copy is seed-only — permanently masked after first mount — so the login, ~/.claude.json, skills, transcripts, scheduler tasks, SSH keys, cargo, uv, ruff and Claude Code itself re-attach untouched. Only root-level state is rebuilt: apt packages are replayed against the new base rather than copied, so no stale libc is dragged forward, and /usr/local, /opt and the non-bind-mounted parts of /workspace are copied verbatim with tar --skip-old-files so they can never clobber a newer base binary. docker diff is not used: on a snapshot-derived container it reports only changes since the last commit. Raw image-vs-image diffing is filtered through dpkg ownership because it otherwise lies — 8,677 raw path differences on a real project reduced to 2 genuinely user-authored files, both loose /workspace-root files. Crash safety. snapshot:latest keeps pointing at the old image until the final commit, so any crash before it self-heals on next start. Later crashes are caught by reconcile_project_statuses. The rollback pin is a docker tag: 0.057s and 0 bytes. Rollback restores the system layer only — volumes are never touched — and the UI says so rather than implying a time machine. Fixes an infinite recreation loop shipped with the MCP removal. docker commit propagates labels to the image, so a container created from a snapshot inherited its non-empty triple-c.mcp-fingerprint and the one-shot shim recreated it again on every start, forever. Lineage labels are now always written explicitly. Documents the second, separate bug this uncovered: Dockerfile changes under /home/claude never reach an existing project, migration or not, because the volume masks them. Anything that must stay upgradable belongs in /usr/local/bin or /opt, or must be seeded by entrypoint.sh. 145 Rust tests, 227 frontend tests, both builds clean. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-09 18:19:12 -07:00