Triple-C

Two separate faults, both reachable from one screenshot of the Global
Environment Variables editor.

The value input was collapsed to a sliver, so a variable looked like it
had lost its value. `inputClass` carries `w-full`, and the `w-2/5` on the
key input did not beat it — class-attribute order is not what resolves
that conflict, stylesheet order is. The key therefore asked for the whole
row, and the value input, whose `flex-1` gives it a basis of 0 and only
the leftover space, got almost nothing. Widths now live on wrapper divs,
where nothing competes with them.

The fingerprint that detects custom-env changes was a plaintext
`KEY=VALUE` join, and it is written as the `triple-c.custom-env-fingerprint`
label. Labels are readable by anything on the host via `docker inspect`,
`docker commit` copies them onto the project's snapshot image, and the
recreation check logs both sides on a mismatch — so an API token set as a
custom variable was published to all three. It is hashed now, exactly as
`triple-c.git-token-hash` already was. Empty stays empty, so "nothing
configured" still reads as an empty label.

Changing the fingerprint format means every project's label mismatches
once: expect a single container recreation per project on next start.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-11 15:27:19 -07:00

auth_bridge

Fix review findings: secrets in snapshots, URL spoofing, migration data loss

2026-08-09 19:35:39 -07:00

browser_view

Say what "open in container" is doing, and land on the pane doing it

2026-08-11 11:13:21 -07:00

commands

Merge remote-tracking branch 'origin/main' into feature/corporate-ca

2026-08-10 11:20:23 -07:00

docker

Give the env var its value box back, and stop labelling the secret