Adversarial review of the branch produced findings across four areas. This addresses them, plus the Windows CI environment. Secrets. commit_container_snapshot baked the container's full env into the per-project snapshot image, so the shared OAuth token — and the AWS keys, git token and gateway master key — outlived revocation and were readable via docker inspect. Verified against Engine 29.6 that a commit body's config merges over the container's: keys cannot be dropped but can be overwritten, so all of them now commit as KEY=. clear_claude_token additionally rewrites images from earlier builds and reports honestly when a tag could not be rewritten. The recommendation to move the token out of env entirely was not taken, with reasoning: apiKeyHelper is a different auth method that outranks CLAUDE_CODE_OAUTH_TOKEN rather than a transport for it, and no file-based delivery exists. The durable exposure — the image — is what is closed here. Separately noted, not fixed: entrypoint.sh captures the token into the scheduler's .env inside the persisted volume. URL spoofing. Three call sites reached openUrl with container-controlled strings, one of which the review missed (the WebLinksAddon handler). The sign-in URL was scraped from container output with a longest-match tie-break and no userinfo check, so claude.ai@evil.tld rendered as "claude.ai…" in a truncating element. There is now one sanitizer in front of every sink — scheme allowlist, no userinfo, C0/C1 and quote rejection, host allowlist for the sign-in case, first-match — and the origin renders un-truncated. The toast is keyed so a changed URL remounts, closing a bait-and-switch where the user read one URL and clicked another. Migration. The rollback pin was best-effort: a tag failure was logged and the migration continued past remove_container, after which the final commit overwrote the only copy of the old system layer. It now aborts before anything destructive and reads the tag back. /var was destroyed while the ordinary recreate path preserves it — making the "safe" alternative to Reset more destructive than Reset's alternative; data-bearing subtrees are now detected and disclosed in the pre-flight rather than copied, since tarring a live database onto a different base's packages is a corruption risk. resume_migration now verifies the migration-state label instead of reporting success for a container that never swapped. dismiss actually resolves the record rather than leaving the feature permanently refusing to migrate. Start and Reset are guarded while a migration is live. Lifecycle. The gateway no longer publishes on 0.0.0.0 — bind address and advertised URL are derived together so they cannot drift. Disabling it now stops it. App exit runs teardown concurrently under a budget with a visible shutting-down state instead of blocking for minutes. Auto-starts retry when Docker is not up yet, and the polling-recovery path now reconciles, so interrupted migrations are still recovered. Auth-bridge forwards are capped, closing a container-driven fd exhaustion. Windows CI. build-windows failed on this branch with "linker link.exe not found". The runner had no MSVC build tools and the workflow assumed a hand-provisioned machine, so a bare runner registers, accepts jobs and fails at link time after downloading the whole crate graph. The job now installs the VC++ workload when vswhere cannot find it, matching how it already conditionally installs Rust and Node. 192 Rust tests, 274 frontend tests, both builds clean, zero warnings. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
136 lines
3.6 KiB
TypeScript
136 lines
3.6 KiB
TypeScript
import { useCallback, useRef } from "react";
|
|
import { useShallow } from "zustand/react/shallow";
|
|
import { listen } from "@tauri-apps/api/event";
|
|
import { useAppState } from "../store/appState";
|
|
import * as commands from "../lib/tauri-commands";
|
|
|
|
export function useDocker() {
|
|
const {
|
|
dockerAvailable,
|
|
setDockerAvailable,
|
|
imageExists,
|
|
setImageExists,
|
|
} = useAppState(
|
|
useShallow(s => ({
|
|
dockerAvailable: s.dockerAvailable,
|
|
setDockerAvailable: s.setDockerAvailable,
|
|
imageExists: s.imageExists,
|
|
setImageExists: s.setImageExists,
|
|
}))
|
|
);
|
|
|
|
const checkDocker = useCallback(async () => {
|
|
try {
|
|
const available = await commands.checkDocker();
|
|
setDockerAvailable(available);
|
|
return available;
|
|
} catch {
|
|
setDockerAvailable(false);
|
|
return false;
|
|
}
|
|
}, [setDockerAvailable]);
|
|
|
|
const checkImage = useCallback(async () => {
|
|
try {
|
|
const exists = await commands.checkImageExists();
|
|
setImageExists(exists);
|
|
return exists;
|
|
} catch {
|
|
setImageExists(false);
|
|
return false;
|
|
}
|
|
}, [setImageExists]);
|
|
|
|
const buildImage = useCallback(
|
|
async (onProgress?: (msg: string) => void) => {
|
|
const unlisten = onProgress
|
|
? await listen<string>("image-build-progress", (event) => {
|
|
onProgress(event.payload);
|
|
})
|
|
: null;
|
|
|
|
try {
|
|
await commands.buildImage();
|
|
setImageExists(true);
|
|
} finally {
|
|
unlisten?.();
|
|
}
|
|
},
|
|
[setImageExists],
|
|
);
|
|
|
|
const pollingRef = useRef<ReturnType<typeof setInterval> | null>(null);
|
|
|
|
/**
|
|
* Poll until Docker appears, then stop.
|
|
*
|
|
* `onAvailable` runs exactly once, after `dockerAvailable` is set and the
|
|
* image has been re-checked. It exists because a session that started before
|
|
* the daemon was up otherwise never does the "Docker is up" work — status
|
|
* reconciliation, interrupted-migration recovery, loading the project list.
|
|
*/
|
|
const startDockerPolling = useCallback((onAvailable?: () => void | Promise<void>) => {
|
|
// Don't start if already polling
|
|
if (pollingRef.current) return () => {};
|
|
|
|
const interval = setInterval(async () => {
|
|
try {
|
|
const available = await commands.checkDocker();
|
|
if (available) {
|
|
clearInterval(interval);
|
|
pollingRef.current = null;
|
|
setDockerAvailable(true);
|
|
// Also check image once Docker is available
|
|
try {
|
|
const exists = await commands.checkImageExists();
|
|
setImageExists(exists);
|
|
} catch {
|
|
setImageExists(false);
|
|
}
|
|
try {
|
|
await onAvailable?.();
|
|
} catch (e) {
|
|
console.error("Docker-available callback failed:", e);
|
|
}
|
|
}
|
|
} catch {
|
|
// Still not available, keep polling
|
|
}
|
|
}, 5000);
|
|
|
|
pollingRef.current = interval;
|
|
return () => {
|
|
clearInterval(interval);
|
|
pollingRef.current = null;
|
|
};
|
|
}, [setDockerAvailable, setImageExists]);
|
|
|
|
const pullImage = useCallback(
|
|
async (imageName: string, onProgress?: (msg: string) => void) => {
|
|
const unlisten = onProgress
|
|
? await listen<string>("image-pull-progress", (event) => {
|
|
onProgress(event.payload);
|
|
})
|
|
: null;
|
|
|
|
try {
|
|
await commands.pullImage(imageName);
|
|
setImageExists(true);
|
|
} finally {
|
|
unlisten?.();
|
|
}
|
|
},
|
|
[setImageExists],
|
|
);
|
|
|
|
return {
|
|
dockerAvailable,
|
|
imageExists,
|
|
checkDocker,
|
|
checkImage,
|
|
buildImage,
|
|
pullImage,
|
|
startDockerPolling,
|
|
};
|
|
}
|