bugfix-and-rewrite #59

pptx704 · 2026-07-13T07:59:32Z

pptx704 commented

2026-07-13 07:59:32 +00:00

No description provided.

pptx704 added 7 commits 2026-07-13 07:59:33 +00:00

Make file operations run as sandbox default user, not root e58a17bf03

File reads and writes forced username=root when talking to envd, while
process execution ran as the sandbox default user. Drop the hardcoded
user so file ops resolve the same default user as exec.

Fix capsule showing running instead of starting on launch 31e77f8f6a

The dashboard jumped a launching capsule straight to running, skipping
the starting state. The event stream was treating the request-accepted
event the same as the boot-complete event and forcing a running status.
Now only true completion events set the final status, so transient
states show correctly.

Switch API error responses to structured error codes 7d782daed3

Backend handlers now return errors through a shared apperr catalog
instead of ad-hoc strings, so every error has a stable code, a
human message, and a request ID. The frontend API client understands
this new error shape and surfaces the code/request ID to callers so
error messages (and support requests) are more useful.

Fix audit log misattributing failed capsule startups to system b255042496

Failed create/resume now logs as a separate "error" entry instead of
overwriting who actually created the capsule.

Drop legacy raw-JWT credentials file format bb7725c323

Host credentials file has been JSON for a while; old hosts on the
raw-JWT format will just re-register.

Harden user-facing inputs and channel webhooks against abuse 01fd1ddc81

- Validate emails and display names (users, API keys, OAuth signups) against a strict allowlist so stored values can't carry HTML/script payloads
- Block notification channel webhooks from targeting private/internal/metadata addresses (SSRF), with an opt-out env var for self-hosted setups that need it
- Bound concurrent channel delivery retries so a sustained outage can't spawn unbounded goroutines
- Fail closed when the admin check can't reach the database, instead of quietly denying a legitimate admin
- Remove envd's dead auth middleware (unused, envd relies on VM isolation not per-request auth) and drop unused username plumbing from the filesystem service

Finish sandbox-to-capsule ID rename and clean up leftover stub files 0fd561726e

Move client-IP parsing into a shared pkg/netutil helper used by both
auth handlers and session middleware, update remaining sb-/wrenn-sb-
references to the cl-/wrenn-cl- naming, and remove a few empty
placeholder files left over from earlier package splits. Also updates
docs and the default listen port.

pptx704 merged commit 46fba794f3 into dev

2026-07-13 08:00:01 +00:00

pptx704 referenced this issue from a commit

2026-07-13 08:00:01 +00:00

Merge pull request 'bugfix-and-rewrite' (#59) from bugfix-and-rewrite into dev

pptx704 deleted branch bugfix-and-rewrite

2026-07-13 08:00:01 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: wrenn/wrenn#59