shadow-testandClaude Opus 5
2de00b3c55
Adversarial review of the branch produced findings across four areas. This addresses them, plus the Windows CI environment. Secrets. commit_container_snapshot baked the container's full env into the per-project snapshot image, so the shared OAuth token — and the AWS keys, git token and gateway master key — outlived revocation and were readable via docker inspect. Verified against Engine 29.6 that a commit body's config merges over the container's: keys cannot be dropped but can be overwritten, so all of them now commit as KEY=. clear_claude_token additionally rewrites images from earlier builds and reports honestly when a tag could not be rewritten. The recommendation to move the token out of env entirely was not taken, with reasoning: apiKeyHelper is a different auth method that outranks CLAUDE_CODE_OAUTH_TOKEN rather than a transport for it, and no file-based delivery exists. The durable exposure — the image — is what is closed here. Separately noted, not fixed: entrypoint.sh captures the token into the scheduler's .env inside the persisted volume. URL spoofing. Three call sites reached openUrl with container-controlled strings, one of which the review missed (the WebLinksAddon handler). The sign-in URL was scraped from container output with a longest-match tie-break and no userinfo check, so claude.ai@evil.tld rendered as "claude.ai…" in a truncating element. There is now one sanitizer in front of every sink — scheme allowlist, no userinfo, C0/C1 and quote rejection, host allowlist for the sign-in case, first-match — and the origin renders un-truncated. The toast is keyed so a changed URL remounts, closing a bait-and-switch where the user read one URL and clicked another. Migration. The rollback pin was best-effort: a tag failure was logged and the migration continued past remove_container, after which the final commit overwrote the only copy of the old system layer. It now aborts before anything destructive and reads the tag back. /var was destroyed while the ordinary recreate path preserves it — making the "safe" alternative to Reset more destructive than Reset's alternative; data-bearing subtrees are now detected and disclosed in the pre-flight rather than copied, since tarring a live database onto a different base's packages is a corruption risk. resume_migration now verifies the migration-state label instead of reporting success for a container that never swapped. dismiss actually resolves the record rather than leaving the feature permanently refusing to migrate. Start and Reset are guarded while a migration is live. Lifecycle. The gateway no longer publishes on 0.0.0.0 — bind address and advertised URL are derived together so they cannot drift. Disabling it now stops it. App exit runs teardown concurrently under a budget with a visible shutting-down state instead of blocking for minutes. Auto-starts retry when Docker is not up yet, and the polling-recovery path now reconciles, so interrupted migrations are still recovered. Auth-bridge forwards are capped, closing a container-driven fd exhaustion. Windows CI. build-windows failed on this branch with "linker link.exe not found". The runner had no MSVC build tools and the workflow assumed a hand-provisioned machine, so a bare runner registers, accepts jobs and fails at link time after downloading the whole crate graph. The job now installs the VC++ workload when vswhere cannot find it, matching how it already conditionally installs Rust and Node. 192 Rust tests, 274 frontend tests, both builds clean, zero warnings. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
52 lines
1.4 KiB
TOML
52 lines
1.4 KiB
TOML
[package]
|
|
name = "triple-c"
|
|
version = "0.3.0"
|
|
edition = "2021"
|
|
|
|
[lib]
|
|
name = "triple_c_lib"
|
|
crate-type = ["lib", "cdylib", "staticlib"]
|
|
|
|
[[bin]]
|
|
name = "triple-c"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
tauri = { version = "2", features = ["image-png", "image-ico"] }
|
|
tauri-plugin-store = "2"
|
|
tauri-plugin-dialog = "2"
|
|
tauri-plugin-opener = "2"
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
bollard = "0.18"
|
|
keyring = { version = "3", features = ["apple-native", "windows-native", "linux-native"] }
|
|
tokio = { version = "1", features = ["full"] }
|
|
futures-util = "0.3"
|
|
uuid = { version = "1", features = ["v4"] }
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
dirs = "6"
|
|
log = "0.4"
|
|
fern = { version = "0.7", features = ["date-based"] }
|
|
tar = "0.4"
|
|
include_dir = "0.7"
|
|
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "multipart"] }
|
|
iana-time-zone = "0.1"
|
|
sha2 = "0.10"
|
|
axum = { version = "0.8", features = ["ws"] }
|
|
tower-http = { version = "0.6", features = ["cors"] }
|
|
base64 = "0.22"
|
|
rand = "0.9"
|
|
local-ip-address = "0.6"
|
|
|
|
[dev-dependencies]
|
|
# `test-util` (not part of tokio's `full`) lets the auto-start retry tests run
|
|
# their backoff schedule under a paused clock instead of in real seconds.
|
|
tokio = { version = "1", features = ["full", "test-util"] }
|
|
|
|
[build-dependencies]
|
|
tauri-build = { version = "2", features = [] }
|
|
|
|
[features]
|
|
default = ["custom-protocol"]
|
|
custom-protocol = ["tauri/custom-protocol"]
|