fix(sandbox,host-service,cli): what a morning in a cloud workspace turned up

Merged
SA
2mo ago
+1410-214

An agent spent a morning getting Superset running in the cloud workspace "Hi" and wrote down 18 things that got in its way. I drove the same box with the CLI, checked each claim against the code, sent the agent my verdicts and let it push back, then had the plans reviewed adversarially. This is the result, worst first.

Report, with a plan and cleanup per item: https://app.superset.sh/page/hi-sandbox-field-report-yjbyeu

Security

The display was reachable without a ticket. websockify listened on a published port with no auth, behind Xvnc -SecurityTypes None. The sandbox's own *.vercel.run address served noVNC and accepted the VNC socket with no credential; that address appears in every desktop ticket's claims and does not change across resumes. It now listens on loopback, the port is unpublished, and host-service proxies /desktop/websockify behind the check every other route passes. The --web root goes too — the renderer bundles its own client.

Not fixed here, needs your call: claim.ts injects the creator's personal GitHub token when they have connected GitHub, and firewall rules apply to every process in the box. Anything running there can act as them on every repository they can reach.

Broken in production

Node cannot reach GitHub from any cloud workspace. The firewall terminates TLS for the five hosts it injects credentials into; its CA is in the system bundle, which curl, git, gh, python and bun read and Node does not. Nothing set NODE_EXTRA_CA_CERTS, so host-service's Octokit pull-request lookups fail. superset-boot now defaults it, and the terminal passthrough carries it on.

db:seed-dev fails on every fresh install since #7092, on my Mac too: organizationRoleName put @lingui/core/macro in the auth server's import graph and the seed runs uncompiled. The function moves to the renderer, which compiles macros.

Cloud workspaces

  • Agents survive a stop. host-service resumes sessions whose terminals died with the box, from startup, sandbox-only and capped at 8. Previously only a desktop pane opening resumed one.
  • A start hook that cannot run says so. The runner reported started: true for any spawn; it now watches the first seconds and reports a non-zero exit as a failure, with the log tail in sandbox.status.
  • Cloud workspaces get their own setup. setup.cloud.sh is to the cloud what setup.local.sh is to Docker. internal-setup.sh drops its three inline copies (180 → 100 lines); a shim keeps older branches working.
  • A wake no longer re-runs boot on a box that already answers (~2s saved per call, and boot.log stops filling with skipped boots).
  • Muse and zsh setup skip agents that are not installed; git identity is written to ~/.gitconfig.

Elsewhere

  • setup.local.sh gave ports +14 and +15 to two services each; both writers now go through a duplicate check.
  • "Not a member of organization" says the id came from the header.
  • Publishing says whether the entry path is held by your other page, a colleague's, or another organization's (3 strings, 16 locales).
  • CLI: environments list, pages delete, and agents read, which reads an agent's own transcript — a terminal snapshot is only the visible screen.

Checks

Typecheck, lint and i18n pass; host-service, CLI, trpc, shared and i18n tests pass. Pre-existing on main and untouched: 5 agent-setup identity tests, @superset/web's upstash imports.

Not verified end to end: the display proxy needs a real box — noVNC negotiates a binary subprotocol, and I could not exercise that path locally. Worth a canary before release.

https://claude.ai/code/session_01FK6rLzBEUiHHXZWNmpQ2BP

Summary by cubic

Hardens cloud workspace startup and desktop access after a field test. The desktop's unauthenticated published VNC port is gone; the display now stays private behind host-service auth.

Workspace and desktop

  • Websockify listens on loopback with no published port or noVNC web root; the desktop pane reaches /desktop/websockify through host-service auth, and stalled clients are disconnected instead of buffered.
  • Adds .superset/setup.cloud.sh and .superset/dev-stack.cloud.sh, with a compatibility shim for older checkouts; release probes skip cloud setup so no Neon branches are left behind.
  • Sets NODE_EXTRA_CA_CERTS for Node-based GitHub access and moves the localized role helper into the renderer so db:seed-dev can run uncompiled.
  • Resumes up to eight recently crashed agent sessions at sandbox startup and exposes start-hook state and log tails through sandbox.status; failed hooks can be retried.
  • sandbox.status also reports process start time so a client can tell a restart from a reconnect.
  • Avoids redundant boot on serving workspaces, persists Git identity globally, skips absent Muse setup, validates duplicate ports, and corrects local database port allocation.
  • Removes the shared "Default" environment from choices while preserving id-based resolution for existing workspaces.

CLI and API

  • Ships the superset binary as its own image asset on PATH so an agent in a box can act without a person pasting a key.
  • The firewall adds a derived workspace API credential only when a valid API URL is configured; it grants the creator's identity, the allowlist in api-credential.ts is the boundary, and the secret never reaches the box.
  • The CLI resolves API addresses at runtime, with desktop dev shims supplying local stack URLs instead of baking them into the binary.
  • Adds environments list, pages delete, and agents read; transcript reads validate the workspace and agent account.
  • Clarifies publication conflicts and organization membership errors with localized messages.
  • The display proxy still needs a real-workspace canary because the binary WebSocket path was not verified end to end.

Summary by CodeRabbit

  • New Features
    • Added CLI commands for listing environments, deleting pages, and reading agent transcripts.
    • Added automatic recovery for eligible crashed agent sessions.
    • Added sandbox authentication and support for workspace-scoped CLI/API access.
    • Added localized messages for page publication conflicts and cloud workspace restrictions.
  • Bug Fixes
    • Improved desktop display connectivity and sandbox startup handling.
    • Prevented conflicting service ports during workspace setup.
    • Environment listings and access now respect organization membership.
  • Documentation
    • Updated cloud sandbox guidance for certificates, credentials, and Docker startup.