v2.2.1 hardening: packaging leak, quality gates, install automation - #43
Merged
Merged
Conversation
…tion Comprehensive correctness/security/automation pass across server, client, Electron, and packaging, verified by a 5-dimension adversarial review round. Security - Stop bundling the developer's live data/studio.db (with real tokens) into electron-builder artifacts; leaked GitHub releases were deleted. - upload_image reads through a single held fd (open→fstat→read), closing the realpath-check-then-read TOCTOU. Correctness - Publish quality gate enforced consistently across REST + MCP + scheduler; score-70 backfill made a true one-time migration. - Ambiguous publish outcomes recorded as "unknown" (not false "failed") on timeout/network drop after the publish POST, across all entry points. - agenticLevel persists; PUT /api/settings reports dropped values via skipped[] and accepts the numeric round-trip; internal migration_* flags no longer leak. - Chat reconnect merge normalizes SQLite naive-UTC timestamps to UTC (was duplicating/dropping messages by the local TZ offset). - Scheduler retry overlap-guard race, timezone validation, subprocess-session mid-turn wedge + duplicate result, idle-eviction of running sessions. - Client: WS errors surfaced, publish dialog no longer wiped mid-stream, confirmed/guarded deletes, indefinite reconnect backoff. Desktop - In-app updater wired (sandbox-safe preload), single-instance lock, navigation/openExternal allow-list, startup-error dialog, signal cleanup of the detached server so Ctrl+C can't orphan it. Install & first-run automation - Fresh-clone crash fixed (auto-create data dir); studio doctor preflight; working studio setup-mcp; ensure-native-abi auto-heals the better-sqlite3 ABI break after electron:build; npm package ships the UI + skills; engines/.nvmrc/ LICENSE added; .env.example trimmed; CI fresh-boot smoke step. Tests: 299 pass (added memory-service, agent-routes, strategy-agent, and publish-ambiguity coverage). typecheck/lint/build/format all green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… high) Semver-safe lockfile bumps only (no package.json range changes). Clears the CI Security audit gate (npm audit --audit-level=critical). Verified: typecheck, 299 tests, build, format green; API + WebSocket boot confirmed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A full correctness / security / automation pass over Claude World Studio, driven by a five-dimension audit (install, server, client, Electron, docs) and a five-dimension adversarial review round (with 3 skeptics per finding). Every confirmed finding was fixed and re-verified.
Baseline → now: typecheck ✅ · lint 0 errors ✅ · 299 tests pass (was 233) ✅ · build ✅ · format ✅ · fresh-clone boot + settings round-trip verified at runtime.
🔒 Security (action required)
data/studio.dbinto release artifacts. electron-builder shipped the dev DB — containing real Threads tokens and a Cloudflare key — inside every.dmg/.zipfrom v1.3.0–v2.0.0. Removeddata/**+extraResourcesfrom the build config; the leaking GitHub releases (v1.3.0, v1.4.0, v1.6.0, v1.6.1, v1.7.0, v2.0.0) were deleted.upload_imagenow reads through a single held fd, closing a symlink TOCTOU.Correctness
/api/publish+/batch, the MCP tool, and the scheduler (was hardcoded 70 in some paths, configurable in others); score-70 backfill is now a true one-time migration."unknown", never a false"failed"that would retry into a duplicate post.agenticLevelpersists;PUT /api/settingssurfaces dropped values (skipped[]), stops leakingmigration_*flags, and accepts the numeric round-trip.Desktop
electron:devcan't orphan the server.Install & first-run automation
data/auto-created);studio doctorpreflight; workingstudio setup-mcp;ensure-native-abiauto-heals the better-sqlite3 ABI break afterelectron:build; npm package ships the built UI + skills;engines/.nvmrc/LICENSE; trimmed.env.example; CI fresh-boot smoke step.Not in this PR (needs your environment)
🤖 Generated with Claude Code