mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-09-20 00:11:34 +00:00
3421c4f06f
Two root-cause fixes for the sandbox failure where an inline Dockerfile came back from the store as `ARG REDACTED` and the Daytona snapshot build died on the unset variable. Entropy redaction measures values, not assignment pairs. The detector matched `NAME=value` as one token, so an uppercase name merged its charset into a pure-hex value (which alone can never exceed 4.0 bits) and pushed the pair over the 4.5-bit threshold — then replaced the whole pair, destroying the name. `find_entropy_regions` now strips an identifier-shaped `NAME=` prefix before measuring and redacts only the value, matching the gitleaks layer's `key=REDACTED` shape. Execution no longer reads redacted content. Every stored event passes through the redaction sink, and `load_from_store` rehydrated the worker's RunSpec from the projection folded from those events — so a redactor false positive silently rewrote the spec the sandbox builds from (and changed its snapshot identity). The creation path now writes the exact spec bytes to the content-addressed blob store and records `spec_blob` on run.created; `load_from_store` loads the spec from the blob, keeping the event stream authoritative for run identity, provenance, and event-recorded blob ids. Retry and fork carry the source run's `spec_blob` forward, so derived runs stop inheriting the redacted copy. Runs created before the blob existed fall back to the folded spec. The projection and every API surface keep serving the redacted fold; blobs were already stored unredacted (the workflow bundle carries the same bytes), so this adds no new exposure at rest. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| agent_session_activated_props_round_trip.rs | ||
| automation_round_trip.rs | ||
| billed_token_counts_round_trip.rs | ||
| command_termination_round_trip.rs | ||
| completion_message_round_trip.rs | ||
| completion_usage_round_trip.rs | ||
| cost_source_round_trip.rs | ||
| create_completion_request_round_trip.rs | ||
| diff_stats_round_trip.rs | ||
| diff_summary_round_trip.rs | ||
| environment_round_trip.rs | ||
| event_envelope_round_trip.rs | ||
| git_context_round_trip.rs | ||
| interview_option_round_trip.rs | ||
| interview_question_record_round_trip.rs | ||
| manifest_args_round_trip.rs | ||
| mcp_server_round_trip.rs | ||
| mcp_transport_round_trip.rs | ||
| model_costs_round_trip.rs | ||
| model_features_round_trip.rs | ||
| model_limits_round_trip.rs | ||
| model_round_trip.rs | ||
| model_test_mode_round_trip.rs | ||
| pair_round_trip.rs | ||
| parallel_branch_id_round_trip.rs | ||
| pending_interview_record_round_trip.rs | ||
| principal_round_trip.rs | ||
| provider_id_round_trip.rs | ||
| provider_round_trip.rs | ||
| pull_request_round_trip.rs | ||
| question_type_round_trip.rs | ||
| reasoning_output_round_trip.rs | ||
| run_billing_stage_round_trip.rs | ||
| run_event_round_trip.rs | ||
| run_failure_round_trip.rs | ||
| run_integrations_round_trip.rs | ||
| run_model_settings_round_trip.rs | ||
| run_projection_round_trip.rs | ||
| run_sandbox_round_trip.rs | ||
| run_summary_round_trip.rs | ||
| sandbox_details_round_trip.rs | ||
| sandbox_inventory_round_trip.rs | ||
| sandbox_services_round_trip.rs | ||
| secret_metadata_round_trip.rs | ||
| secret_type_round_trip.rs | ||
| server_settings_round_trip.rs | ||
| session_contract_round_trip.rs | ||
| stage_completion_round_trip.rs | ||
| stage_handler_round_trip.rs | ||
| stage_id_round_trip.rs | ||
| stage_model_usage_round_trip.rs | ||
| stage_outcome_round_trip.rs | ||
| stage_projection_round_trip.rs | ||
| stage_state_round_trip.rs | ||
| status_round_trip.rs | ||
| submit_answer_request_round_trip.rs | ||
| system_integrations_round_trip.rs | ||
| variable_round_trip.rs | ||
| workflow_settings_round_trip.rs | ||