Repository navigation
Web terminal only in developer mode, off by default and in public mode #169
Description
Part of #173 (isolation plan).
POST /api/apps/home-cli/terminal/sessions starts a host process (elastos home) in a PTY for any holder of a home-cli launch token (elastos-server/src/api/gateway_home_terminal.rs:347-365, 648-692). Home can mint that token for any signed-in session, including guests on the public seed. A passkey step-up does not protect it, because Home chooses what the step-up shows.
Done means
- The web terminal is available only when developer mode is on. Developer mode is a setting stored by the Runtime in its data folder (not an environment variable), changeable only from the host command line. It is off by default. Home and apps cannot change it.
- While guest registration is enabled (as on the public seed), the terminal is always refused, even with developer mode on.
- When the terminal is refused, its routes answer 403 and no process starts. Regression test covers a guest, a signed-in owner, developer mode off and on, and guest registration enabled.
Activity
andersalm commentedon Oct 1, 2026
Runtime owns the web terminal developer-mode setting; host CLI changes it, and the default is off.
This session started #169 in its own worktree from fetched
origin/developatc9205a742(treeb219a667c).The terminal will answer 403 while guest registration is enabled, including when developer mode is on.
Regression checks will cover owner and guest sessions, both mode settings, every terminal route and the refused process start.
PR target is
develop; Irzhy review follows green checks, with merge waiting for his approval.andersalm commentedon Oct 1, 2026
Runtime now keeps web terminal access behind the host-owned developer_mode setting and closed guest registration.
The patch passed three terminal policy/process tests, four CLI configuration tests, both Home CLI smokes and the basic gates.
Independent review found a delayed-body race: a request admitted before a policy change could still reach process creation.
The correction adds a final policy check at process creation and delayed-body refused-case regressions for both policy changes.
#169 stays In progress until that correction passes its second review; PR target remains develop with Irzhy approval required.
andersalm commentedon Oct 1, 2026
Candidate
d92453b4is published in draft PR #195, targeting develop.Runtime keeps Terminal access behind host developer_mode and closed guest registration; delayed bodies receive a final policy check before effects.
Five Terminal regressions, four CLI configuration tests, both Home CLI smokes and the basic gates pass; blocked PTY revocation retires its child.
Independent review approved this exact source after two rounds; local and origin task branch divergence is 0/0.
#169 stays in QA while CI and installed human UX proof are pending; irzhywau review follows green checks and gates merge.
andersalm commentedon Oct 1, 2026
PR #195 remains draft at d92453b; run 36935447248 stopped at the 45-minute test-elastos limit.
The job log identifies the new raw PTY policy-revocation regression as still active after the other test work completes.
The test passed on this Mac; Linux fixture ownership and cleanup are now under investigation, with the refused-case proof retained.
Source, lint, capsule, custody and both Linux source-home checks pass; macOS source-home and a corrected test run remain open.
#169 stays in QA / Review; Irzhy review follows green checks, and merge also waits for his approval and complete journey proof.
andersalm commentedon Oct 1, 2026
Runtime now marks its original PTY descriptors close-on-exec, so unrelated children release them during exec.
The canceled run stalled in the new blocked-write test; a Mac reproduction confirms inherited slave retention can cause that hang, while the exact Linux trigger remains an inference.
Candidate 3cabc24 adds a finite write flood, bounded waits and panic cleanup; all seven terminal tests and the basic gates pass locally.
The correction is pushed to origin/fix/169-web-terminal-mode with divergence 0/0; draft PR #195 still targets develop.
The new CI run will prove Linux cleanup; #169 stays in QA / Review, and Irzhy review follows green checks before merge.
andersalm commentedon Oct 1, 2026
Runtime candidate 3cabc24 keeps PTY descriptors private and bounds blocked-write fixture cleanup.
Corrected CI run 36941238237 has a green source gate; the remaining jobs await runners or are active.
All seven terminal regressions and the basic gates pass on Mac, including descriptor flags, policy revocation and panic cleanup.
Draft PR #195 targets develop; its branch matches origin with divergence 0/0.
#169 stays in QA / Review; Linux proof, installed human UX and Irzhy's approval remain open, and reviewer request follows green checks.
andersalm commentedon Oct 2, 2026
Runtime must release terminal input when host policy revokes a session, including a full PTY.
Candidate 3cabc24 in draft PR #195 has seven green checks; its workspace test step remains active in run 36941238237.
Source inspection found that the fixture can retain a saturated Linux master write after the slave exits, while aborting the async task leaves its blocking write running.
A bounded isolated Linux reproduction will test that mechanism before another correction; the current active test remains unconfirmed until its log is available.
#169 remains in QA / Review; exact Linux cleanup proof and Irzhy's approval are open, and reviewer request follows green checks.
andersalm commentedon Oct 2, 2026
An isolated unprivileged Linux 6.8 ARM64 probe confirms that a full PTY master write can stay stalled after its slave process exits.
The same probe confirms that nonblocking input with an independent cancellation signal stops under that backpressure; all probe children were reaped and the existing test VM returned to its stopped state.
The local #169 correction uses Tokio AsyncFd for input and output, and signals input closure before session cleanup waits for its lock.
Regressions retain the idle master reader, exercise panic cancellation and verify delayed output plus slave-close drain; compilation follows under the single Mac build lease.
Draft PR #195 remains at 3cabc24 until this correction passes; the old active CI test log and Irzhy's approval remain open.
andersalm commentedon Oct 2, 2026
PR #195 candidate
6d7b499f373f11ad49f75aa40282fc5b0f756edbintegrates develop356839f0with preserved history.Linux CI 36941238237 confirmed the PTY stall; an isolated Linux probe reproduced it after child exit.
Runtime now uses cancellable nonblocking PTY I/O; eight terminal tests, Clippy and the basic gates pass.
The candidate is pushed to
origin/fix/169-web-terminal-mode; fresh CI must pass before Irzhy review.Installed human UX remains open; #167 fixture and recovery verification continues before #170.
andersalm commentedon Oct 2, 2026
PR #195 candidate
6d7b499f373f11ad49f75aa40282fc5b0f756edbis clean and matches its remote.CI 36947103433 passes test-elastos on Linux, confirming the cancellable PTY correction completes the workspace suite.
Source gate, lint, capsule tests, custody smoke and ARM source-home also pass; two source-home jobs still run.
The local eight-case PTY suite and Linux kernel reproduction support the same cancellation mechanism.
Keep the PR in QA until every check is green, then request Irzhy; #167 is pushed and #170 scope is recorded.
andersalm commentedon Oct 2, 2026
PR #195 candidate
6d7b499f373f11ad49f75aa40282fc5b0f756edbis ready for review;irzhywauis requested.CI 36947103433 is green: all eight required jobs pass, including Linux workspace and three source-home platforms.
Cancellable PTY I/O fixes the reproduced blocked-write mechanism; eight local regressions and Clippy pass.
The task branch matches its remote and contains develop
356839f0; human approval still gates merge.#168 remains in review, #167 CI 36950212069 tests
678ae6b1, and #170 stays at its verified start gate.andersalm commentedon Oct 2, 2026
PR #195 retains its original green CI and Claude Opus PASS, but integration with #197 exposes four conflicts.
The conflicts are gateway admission, shared CLI configuration, Home-system fixtures and command documentation; #169 and #167 behavior both need to survive.
A normal merge is being resolved in #169's own worktree while #197 candidate
14dfba3ccompletes CI; PR #195 keeps develop as its target.The resolved candidate will need its one focused compatibility review, fresh CI and a current operator-posted adversarial verdict before merge.
#172 stays at its design start gate until #168 and #169 are integrated; #186 independent code is draft PR #201 and shared publishing awaits #170/#160.
andersalm commentedon Oct 2, 2026
PR #195 integration candidate
6e18a7622421bb66cdc7bcfff33a671989a38ab7now contains merged #197 and current develop.The normal merges preserve history; Terminal policy gates preflight before front-door early responses, and both CLI configuration checks and refused-case fixtures remain.
Resolved tree
de541cdcpasses 8 Terminal, 6 configuration, 5 front-door and 5 hint-reader cases plus recovery; basic gates pass after the accepted model-baseline merge.The candidate was fast-forward pushed to origin for fresh CI of full tree
c6804426439b87a90c8c1c5475bda9d795a9b4ef.#169 is back in QA and waits for green CI plus a new operator-posted adversarial PASS for this changed candidate; then #172 can receive its design note.
andersalm commentedon Oct 2, 2026
PR #195 merged into develop as
17132f05ba09eba37dff4506d56d0392a38fafabfrom candidate6e18a7622421bb66cdc7bcfff33a671989a38ab7.CI 36964108963 passes all eight required checks, including Linux PTY regressions and three source-home platforms.
Runtime persists host-only developer mode, defaults it off, and refuses every terminal route while guest registration is enabled; refused owner and guest cases start zero processes.
The focused local integration checks pass 24 cases plus Home CLI recovery; the operator's Claude review is PASS, and its remaining test note is recorded in #177.
All #169 Done means are proven for this merged source candidate; #172 can now receive its design note, while installed deployment remains under its own gate.