Conversation
…board Root cause: every dashboard /api/link route required a paired session, but a standalone loopback dashboard (browser or desktop webview) only holds a loopback-issued session, so candidates, probe, confirm-host and apply all answered 403 and SSH hosts never loaded. Fix: the Home-side routes (status, candidates, probe, confirm-host, apply, DELETE) also admit the current loopback session on trusted loopback ingress of a standalone runtime. POST /api/link/join stays paired-only; pairing sessions exist only on hub runtimes and join requires standalone, so no dashboard can join as a Child in this release. Status reports joinAvailable to GUI sessions (admin-token keeps the exact K16 DTO), and the dashboard disables the Child role with a notice in all 10 locales that points to Home-initiated linking. Docs, structure notes and the route registry say the same. ssh runs with Homebrew and ~/.bun/bin appended to PATH, and every remote ocx call runs through a sh prelude that appends the fallback dirs after the remote PATH (exit 127 -> remote_ocx_missing). confirm-host requires ocx >= 2.66.0, parsed to a bounded semver shape. Link errors carry a bounded, redacted hint from ssh stderr, the ssh runner's own failure, or the parsed remote version; server and dashboard cap it at 160 code points without splitting a surrogate pair. Specific error guidance is translated in every locale. Security: the loopback session is minted without a credential, so this is casual-path protection like POST /api/github/star, not a secret-backed boundary; hubs and join keep the paired-only rule, Tailscale identity sessions are still refused, and hints are never logged or read from stdin. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
|
✅ Deterministic PR hygiene checks passed. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: lidge-jun/opencodex/.coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (34)
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review. 📝 WalkthroughWalkthroughRemote linking now uses Home-initiated setup, with Child joining gated by session availability. Remote SSH commands use an expanded PATH and return bounded error hints. The dashboard displays specific link errors, and the guides describe the updated requirements and troubleshooting steps. ChangesRemote Link flow
Priority: ➖ Normal Estimated code review effort: 4 (Complex) | ~45 minutes Change: Bug fix Sequence Diagram(s)sequenceDiagram
participant Dashboard as Home dashboard
participant Routes as link-routes.ts
participant SSH as SSH runner
participant Host as Remote host
Dashboard->>Routes: Request status and Home-side link operations
Routes-->>Dashboard: Return join availability or link result
Routes->>SSH: Run remote ocx command
SSH->>Host: Execute command over SSH
Host-->>SSH: Return output and exit status
SSH-->>Routes: Return command result
Routes-->>Dashboard: Return result and optional error hint
Merge Risk: ⚪ Minimal · up to The Remote Link changes are mergeable after normal checks; no actionable issue remains from this review. Security Architecture ReviewSecurity architecture risk: 🟡 Moderate · up to A standalone dashboard can now manage remote links without pairing. The change keeps important session and loopback restrictions, but it gives that session access to operations that modify trusted SSH hosts, issue link keys, and connect or remove links. Concurrent or interrupted operations warrant design review. Retained concerns
Security review detailsSecurity Blast Radius
Security Findings and Attack Paths
Trust Boundaries and Controls
Resilience and Maintainability Implications
Hardening Proposals
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 32.14% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 56 functions across 23 files. (11 skipped: 11 unsupported.)
✨ Finishing Touches 💡 2📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
🛠️ Fix failing CI checks 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
리뷰 · 우선순위 50 / 80이 글은 원격 연결 화면이 SSH 컴퓨터 목록을 하나도 못 불러오던 문제를 고칩니다. 바탕은 혼자 쓰는 설치의 대시보드는 이 컴퓨터 안에서만 통하는 세션을 갖고 있습니다. 원격 연결 API는 짝을 맺은 세션만 받아 줬습니다. 그래서 목록, 연결 시험, 호스트 확인, 연결하기가 전부 403이었습니다. 화면에는 후보가 없다고만 나왔습니다. 이제는 그 세션으로 홈 쪽 일을 할 수 있습니다. 상태, 후보, 연결 시험, 호스트 확인, 연결, 끊기가 여기 들어갑니다. 아이로 붙는 SSH를 켤 때 Homebrew와
라인 - 라인 - GitHub Actions 메인테이너의 판단이 필요한 지점
너의 추천 홈 쪽은 이 컴퓨터 세션을 허용하는 쪽으로 두세요. 아이로 붙는 길은 짝을 맺은 세션만 두는 지금 구분이 맞습니다. 머지 전에 윈도우 원격에서 이 댓글은 grok-bot이 작성했습니다 |
…ards (batch 9D) (#5986) A second `ocx` instance now leaves the live proxy's shared client routing alone across startup, management requests, restart, and stop. The batch also makes Home-side Remote Link usable from the local dashboard, keeps OAuth device guidance current, and offers one-time pairing on an authenticated remote hub that lacks a GUI session. | PR | Change | Author | |---|---|---| | #5926 | Isolate sibling startup, shared writes, restart and stop from the live owner. | JUN (lidge-jun) | | #5928 | Admit the local Home dashboard to SSH host discovery/probe/apply, improve SSH resolution and bounded errors, and keep Child join paired-only. | JUN (lidge-jun) | | #5911 | Show Meta Muse OAuth only to eligible GUI sessions and replace stale device hints through login. | Ingwannu, with shared device-hint work credited to codingbo | | #5978 | Show the one-time pairing form on Remote Link for a remote hub without a GUI session. | RHODIZSECURITY | The owner's three original commits retain JUN authorship. Each contributor PR remains one attributed squash commit. The older device-hint variant (#5915) is outside this branch because #5911 covers the same login behavior; its shared implementation is credited to codingbo. Follow-up commits after independent review: | Commit | Result | |---|---| | `66967095d0` | Restrict the new pairing display path to hub runtimes; a non-loopback standalone keeps its local-session guidance. | | `fa182b9d2d` | Keep sibling-home roster updates available while skipping the shared Claude Desktop profile auto-apply, including after asynchronous discovery. | | `32d7893113` | Require a fresh, home-bound listener proof before an orphan stop can signal a discovered proxy. | | `dda805fbad` | Require a short-lived, one-use sibling restart handoff record bound to the prior sibling runtime and home; a port env alone cannot claim sibling status. | | `37f368cf20` | Keep the connected-client sibling recycle path valid when its runtime record has no server attestation secret; the same-home PID, ports and process-local mark still gate issuance. | | `a42fcac751` | Capture the connected sibling's one-use handoff before link recycle stops the listener and removes its runtime record; spawn with that captured environment. | | `d3cc7b80bb` | Remove the Kiro cooldown test's timestamp-order race exposed by macOS CI. | `dev` advanced during review. Merge commit `a4d9aff73e` brought in `177c647d9c` and kept both the SSH PATH and listener-before-supervisor Remote Link contracts. Merge commit `43d314287c` brings in current `dev` `93e5d5bea5` without changing the owner's commits. Their combined dashboard structure document exceeded its line budget; `1e93a8401b` reflows the existing OAuth paragraph from 603 to 600 lines without raising the cap. The Kiro timing correction also landed independently on `dev`; the merge keeps that current test. Screenshots from the built GUI (demo session and responses only):    Security re-review should focus on sibling start/stop and handoff (`src/codex/sibling-start.ts`, `src/codex/sibling-handoff.ts`, `src/client/runtime.ts`, `src/cli/index.ts`, `src/server/proxy-liveness.ts`), Desktop auto-apply (`src/server/management/agent-settings-routes.ts`), Remote Link admission and SSH (`src/server/management/link-routes.ts`, `src/link/ssh-argv.ts`, `src/link/ssh-runner.ts`), OAuth state and principal discovery (`src/oauth/index.ts`, `src/oauth/login-flow-state.ts`, `src/server/management/oauth-account-routes.ts`), and the hub-only pairing gate (`gui/src/App.tsx`). Independent reviewer sign-off remains required before merge. Co-authored-by: Ingwannu <ingwannu@users.noreply.github.com> Co-authored-by: codingbo <cnsdbo@163.com> Co-authored-by: RHODIZSECURITY <180237049+RHODIZSECURITY@users.noreply.github.com>
1 participant
Summary
On a normal standalone install, the Remote Link page (sidebar Remote Link / 원격 연결) never loaded a single SSH host. Every dashboard
/api/link/*route required a GUI session issued by the pairing exchange (isPaired→issuance === "pairing"). A standalone loopback dashboard, in the browser or the desktop webview, only ever holds aloopbacksession, and pairing grants exist only on hub runtimes. So status, candidates, probe, confirm-host and apply all answered403 forbidden. The sheet said "No SSH host candidates were found" and gave the generic "Remote link request could not be completed." Against a running 2.66.0 sidecar, the dashboard's own session got 200 on/api/settingsand 403 on/api/link/statusand/api/link/candidates. The route tests stubbedisPairedtotrue, so they never caught it. The~/.ssh/configparser itself was fine.Clearing the 403 exposed more failures on real hosts:
sshwith launchd'sPATH=/usr/bin:/bin:/usr/sbin:/sbin, so aProxyCommand cloudflared …could not find its helper.ocxlives in~/.bun/bin, which a non-interactive ssh shell does not have.ocx --versionexited 127.remote_port_failed.Changes:
loopback-issued GUI session that reached the public listener bound to a loopback hostname, on a standalone runtime. Paired sessions still pass. Hubs stay paired-only, Tailscale identity sessions are still refused, and thehub-linkingress is not trusted loopback.POST /api/link/joinstays paired-only, unchanged fromdev. A join restarts this proxy (503 drain, closed listener) and moves Codex/Claude routing to the Home tunnel, and turning Remote Link on must never drop existing Codex connections.GET /api/link/statusreportsjoinAvailableto GUI sessions. The admin-token DTO keeps its exact keys forocx link status. When it is false, the dashboard disables the Child card, including keyboard selection. A notice in all 10 locales explains that joining as a Child from the dashboard is not available in this release, and points to Home-initiated linking.ssh/ssh-keygen(probe, exec and the supervisor's tunnels) run with/opt/homebrew/bin,/usr/local/bin,~/.bun/binand~/.local/binappended toPATHon POSIX.ocxcall goes throughremoteOcxArgv:sh -c 'PATH="$PATH:$HOME/.bun/bin:$HOME/.local/bin:/opt/homebrew/bin:/usr/local/bin"; exec ocx "$@"'. That covers confirm-host, apply port/connect, remove/disconnect, join issue/revoke and teardown revoke. The fallbacks are appended, so anocxthat already resolved still wins. Exit 127 maps toremote_ocx_missing.opencodex X.Y.Z[-pre][+build]into a bounded semver shape and requires ≥ 2.66.0, the first release withocx link. It returnsremote_ocx_outdatedorremote_ocx_unrecognizedand restores known_hosts.hint: the last ssh stderr line, the runner's own failure, or the parsed remote version. Controls, bidi and tokens are stripped, and it is capped at 160 code points without splitting a surrogate pair. The dashboard shows it under a specific message. New/rewritten error texts exist in all 10 locales.structure/remote-link.md(Dashboard admission section, citing both thegithub/starandmachine-listenerprecedents),structure/gui-and-management-api.md, the route registry, andguides/remote-link.mdin 8 locales.Security review requested. The loopback bootstrap mints this session with no credential. Any local process that sends a loopback
Hostcan drive probe, confirm-host and apply, including remoteocxcommands over the user's SSH keys. That is casual-path protection likePOST /api/github/star, not a secret-backed boundary like the admin token. It is the same trade-offsrc/client/machine-listener.tsdeclined for its machine routes, and this PR takes it only for the Home side, where nothing touches127.0.0.1:<port>.Screenshots come from this branch's built dashboard served by a proxy with a temporary HOME/OPENCODEX_HOME/CODEX_HOME. Its
~/.ssh/configholds demo aliases only.Verification
bun run typecheck,(cd gui && bunx tsc -b),bun run lint:gui,bun run structure:check,bun run privacy:scan,bun run build:gui: pass.bun test tests/server/link-management-routes.test.ts tests/server/link-join-route.test.ts tests/clients/link-ssh-argv.test.ts tests/clients/client-link-teardown.test.ts: 51 pass, 0 fail.(cd gui && bun test tests/remote-link.test.tsx tests/locale-parity.test.ts tests/i18n-locales.test.ts): 42 pass, 0 fail.bun test tests/ci-workflows/file-size-ratchet.test.ts: pass.isPairedstub. It expects:joinAvailablefalse for loopback, true for paired standalone.remoteOcxArgv-wrapped commands and return 127 for a bareocx, so reverting any call site fails.(\S*)version regex, the unbounded outdated hint, join on the widened check, the bare-ocxcall sites, and the GUI Child gate.probe_failedfor a bare-cloudflaredProxyCommand under the sidecar PATH,zsh: command not found: ocx(exit 127) on two macOS hosts, and a usage banner accepted as a version on a Windows host. No source file contains literal invisible or bidi characters (checked with perl).docs-sitebuild not run locally; left to CI.Checklist
🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Bug Fixes
Documentation