Repository navigation
🤖 fix: harden the dev-server browser-open recipe (warning first, named failures, per-sandbox session) - #7911
Conversation
…d failures, node check, per-sandbox session)
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Hooray! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
…M_ROOT lockfile; clarify token lifetime and the shared-host limit
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Summary
Four small fixes to the browser-open recipe in
.xum/skills/dev-server-sandbox/SKILL.mdthat the advisor raised on #7910. They change the skill text only.Background
#7910 made the recipe turn
agent-browser's credential-less stream off before the token goes in. The advisor's review of that PR found four gaps. This PR closes them.Implementation
The warning for hosts with other accounts now comes before the recipe, and it says more. Chrome's DevTools port is open from the moment Chrome launches, not only while the page is open. Another account can catch the token while the page navigates, or read it from the page's storage afterwards, and the token works until the sandbox restarts. The Windows daemon-port note moved up with it.
Each failure message names the step that failed:
'open about:blank' failed,'stream disable' failed and the stream is still on, or'stream status' does not show the stream off. All end with "so the token was not sent". Astream disablethat exits 1 because the stream was already off is not a failure when the status check shows it off.The status check is a node check of
data.enabled === falseon the JSON (off()), not agrepof the text. Unreadable JSON counts as "not off".The session name is
xum-sandbox-$VITE_PORT, so two sandboxes in one workspace do not share a session. The later commands in the text use the same name.The recipe refuses to start unless
VITE_PORTis digits and$XUM_ROOT/server.lockis readable. An unsetVITE_PORTwould otherwise buildhttp://localhost:/?token=..., which is port 80. Nothing is sent and noagent-browsercommand runs.The warning says the default token is new for every run and works until the sandbox restarts, and that a token set with
XUM_DEV_SERVER_AUTH_TOKENworks for as long as you reuse it.The three protections are described as extra protection on a host where you are the only account. On a shared host they are not enough, because of the DevTools port.
The recipe also gets two small shell helpers (
abrunsagent-browser --session "$S",failprints the message). The post-load re-check, the close on a re-enabled stream, and the token redaction are unchanged. Items 5 to 7 come from the root checker's review of the first version of this PR.Validation
I ran the recipe as written (extracted from the skill, session
xum-sandbox-<vite port>) againstmake dev-server-sandboxwith a token ofXq+9/aZ=_proof&k#z, and probed asnobody:nobodywith 101.stream disable(the page isabout:blank) answerednobodywith 101. After the recipe,nobodygotConnection refusedthere, andstream statussaidStreaming disabled. The session's daemon had no TCP listener left.[agent-browser] launched browser), with 0 hits for the raw and URL-encoded token. The page loaded authenticated (the first-run provider dialog) and its URL had no token.Operation timed out) and exited 1 with no token in the output. The rerun on the same sandbox passed. I did not find the cause: the sandbox was still warming up.VITE_PORTunset, empty or not digits,XUM_ROOTunset, and anXUM_ROOTwithoutserver.lockeach exit 1 withset VITE_PORT (digits) and XUM_ROOT (the sandbox root, with a server.lock), so the token was not sent. The stand-in saw 0 calls, and no output held the token. With the real tool andVITE_PORTunset: exit 1, nothing on stdout, and noxum-sandbox-session was created. The real-tool proof above was rerun on the final recipe with the same result.agent-browser(they log every call). Each row is exit code and what the recipe printed:open about:blankfails: exit 1,'open about:blank' failed, so the token was not sent, no batch call.stream disablefails and status says on: exit 1,'stream disable' failed and the stream is still on, ....stream disableworks but status says on: exit 1,'stream status' does not show the stream off, ....'stream status'message.stream disableexits 1 because the stream is already off: exit 0, token sent.?token=<redacted>and exits 1.session was closed, and with a failingcloseexit 1 withcould not be closed: close it yourself.--session xum-sandbox-<port>, and a second port gave a second name.Risks
Skill text only. The remaining exposure is the one the new warning describes: Chrome's DevTools port has no credential, so the recipe is for hosts where you are the only account.
Generated with
xum• Model:anthropic:claude-sonnet-5-5• Thinking:xhigh• Cost:$43.87