shadow-testandClaude Opus 5
2de00b3c55
Adversarial review of the branch produced findings across four areas. This addresses them, plus the Windows CI environment. Secrets. commit_container_snapshot baked the container's full env into the per-project snapshot image, so the shared OAuth token — and the AWS keys, git token and gateway master key — outlived revocation and were readable via docker inspect. Verified against Engine 29.6 that a commit body's config merges over the container's: keys cannot be dropped but can be overwritten, so all of them now commit as KEY=. clear_claude_token additionally rewrites images from earlier builds and reports honestly when a tag could not be rewritten. The recommendation to move the token out of env entirely was not taken, with reasoning: apiKeyHelper is a different auth method that outranks CLAUDE_CODE_OAUTH_TOKEN rather than a transport for it, and no file-based delivery exists. The durable exposure — the image — is what is closed here. Separately noted, not fixed: entrypoint.sh captures the token into the scheduler's .env inside the persisted volume. URL spoofing. Three call sites reached openUrl with container-controlled strings, one of which the review missed (the WebLinksAddon handler). The sign-in URL was scraped from container output with a longest-match tie-break and no userinfo check, so claude.ai@evil.tld rendered as "claude.ai…" in a truncating element. There is now one sanitizer in front of every sink — scheme allowlist, no userinfo, C0/C1 and quote rejection, host allowlist for the sign-in case, first-match — and the origin renders un-truncated. The toast is keyed so a changed URL remounts, closing a bait-and-switch where the user read one URL and clicked another. Migration. The rollback pin was best-effort: a tag failure was logged and the migration continued past remove_container, after which the final commit overwrote the only copy of the old system layer. It now aborts before anything destructive and reads the tag back. /var was destroyed while the ordinary recreate path preserves it — making the "safe" alternative to Reset more destructive than Reset's alternative; data-bearing subtrees are now detected and disclosed in the pre-flight rather than copied, since tarring a live database onto a different base's packages is a corruption risk. resume_migration now verifies the migration-state label instead of reporting success for a container that never swapped. dismiss actually resolves the record rather than leaving the feature permanently refusing to migrate. Start and Reset are guarded while a migration is live. Lifecycle. The gateway no longer publishes on 0.0.0.0 — bind address and advertised URL are derived together so they cannot drift. Disabling it now stops it. App exit runs teardown concurrently under a budget with a visible shutting-down state instead of blocking for minutes. Auto-starts retry when Docker is not up yet, and the polling-recovery path now reconciles, so interrupted migrations are still recovered. Auth-bridge forwards are capped, closing a container-driven fd exhaustion. Windows CI. build-windows failed on this branch with "linker link.exe not found". The runner had no MSVC build tools and the workflow assumed a hand-provisioned machine, so a bare runner registers, accepts jobs and fails at link time after downloading the whole crate graph. The job now installs the VC++ workload when vswhere cannot find it, matching how it already conditionally installs Rust and Node. 192 Rust tests, 274 frontend tests, both builds clean, zero warnings. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
75 lines
2.5 KiB
TypeScript
75 lines
2.5 KiB
TypeScript
import type { MigrationState } from "../../lib/types";
|
|
import Button from "../ui/Button";
|
|
import StatusIndicator from "../ui/StatusIndicator";
|
|
import { ROLLBACK_SCOPE, formatSnapshotDate } from "./migrationCopy";
|
|
|
|
interface Props {
|
|
record: MigrationState;
|
|
/** Disables the action row while resume/rollback is in flight. */
|
|
busy?: boolean;
|
|
onResume: () => void;
|
|
onRollback: () => void;
|
|
}
|
|
|
|
/**
|
|
* A migration that got past the container swap and stopped there.
|
|
*
|
|
* This is deliberately **not** [`MigrationReportCard`]. That card's primary
|
|
* action is Keep, which means "accept this and drop the rollback image" — and
|
|
* on an unfinished migration `triple-c-snapshot-<id>:latest` still points at
|
|
* the *old* lineage, so Keep would delete the only way back while leaving a
|
|
* container the app can no longer reason about. The backend's own message on
|
|
* this record says to resume; offering Keep beside it was the UI contradicting
|
|
* the backend and losing.
|
|
*
|
|
* So the two actions here are Resume and Roll back, and nothing else. It is
|
|
* shown ahead of any report, whether the record was found on mount or produced
|
|
* by a run that just failed — those are the same situation.
|
|
*/
|
|
export default function MigrationInterruptedCard({
|
|
record,
|
|
busy = false,
|
|
onResume,
|
|
onRollback,
|
|
}: Props) {
|
|
const started = formatSnapshotDate(record.started_at);
|
|
|
|
return (
|
|
<div className="space-y-2">
|
|
<StatusIndicator
|
|
tone="error"
|
|
label="The container base update did not finish"
|
|
className="text-[13px] font-semibold"
|
|
/>
|
|
|
|
<p className="text-xs text-[var(--text-secondary)] leading-snug">
|
|
This container is part-way onto the new base: it was replaced, but the
|
|
result was never saved
|
|
{started ? `. The update started ${started}` : ""}. Resuming replays the
|
|
same plan it was given — it is the only way to finish it.
|
|
</p>
|
|
|
|
{record.report?.message && (
|
|
<p className="text-xs text-[var(--text-secondary)] leading-snug select-text">
|
|
{record.report.message}
|
|
</p>
|
|
)}
|
|
|
|
<p className="text-xs text-[var(--text-secondary)] leading-snug">
|
|
{ROLLBACK_SCOPE}
|
|
</p>
|
|
|
|
<div className="flex flex-wrap gap-1.5 pt-0.5">
|
|
<Button size="md" variant="primary" disabled={busy} onClick={onResume}>
|
|
Resume update
|
|
</Button>
|
|
{record.rollback_image && (
|
|
<Button size="md" variant="danger" disabled={busy} onClick={onRollback}>
|
|
Roll back
|
|
</Button>
|
|
)}
|
|
</div>
|
|
</div>
|
|
);
|
|
}
|