feat(launching): record and revalidate launch receipts - #341
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| foreach (var (variableName, value) in context.EnvironmentVariables) | ||
| { | ||
| receipt.EnvironmentVariables[variableName] = value; | ||
| } |
There was a problem hiding this comment.
When a profile defines a secret-bearing child-process environment variable, RecordLaunchAsync persists its value in plaintext, and later drift comparisons include the old or new value in logs and UI notifications. This exposes credentials to anyone who can read the workspace, logs, or notification. How this was verified: The unrestricted profile environment dictionary was traced unchanged through the launch context into JSON serialization and value-interpolating drift messages.
Knowledge Base Used: Game Profiles and Launching
Prompt To Fix With AI
This is a comment left during a code review.
Path: GenHub/GenHub/Features/Launching/LaunchReceiptService.cs
Line: 65-68
Comment:
**Environment secrets leak into receipts**
When a profile defines a secret-bearing child-process environment variable, `RecordLaunchAsync` persists its value in plaintext, and later drift comparisons include the old or new value in logs and UI notifications. This exposes credentials to anyone who can read the workspace, logs, or notification. **How this was verified:** The unrestricted profile environment dictionary was traced unchanged through the launch context into JSON serialization and value-interpolating drift messages.
**Knowledge Base Used:** [Game Profiles and Launching](https://app.greptile.com/genhub/-/custom-context/knowledge-base/community-outpost/genhub/-/docs/game-profiles-launching.md)
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.| private static bool PathsEqual(string left, string right) => | ||
| string.Equals( | ||
| Path.TrimEndingDirectorySeparator(left), | ||
| Path.TrimEndingDirectorySeparator(right), | ||
| StringComparison.Ordinal); |
There was a problem hiding this comment.
PathsEqual uses ordinal comparison and only trims trailing separators, so equivalent Windows paths with different casing or slash representation are reported as executable or archive-root drift. Using platform-aware, canonical path comparison avoids misleading notifications for unchanged launches.
Knowledge Base Used: Game Profiles and Launching
Prompt To Fix With AI
This is a comment left during a code review.
Path: GenHub/GenHub/Features/Launching/LaunchReceiptService.cs
Line: 186-190
Comment:
**Path comparison ignores Windows semantics**
`PathsEqual` uses ordinal comparison and only trims trailing separators, so equivalent Windows paths with different casing or slash representation are reported as executable or archive-root drift. Using platform-aware, canonical path comparison avoids misleading notifications for unchanged launches.
**Knowledge Base Used:** [Game Profiles and Launching](https://app.greptile.com/genhub/-/custom-context/knowledge-base/community-outpost/genhub/-/docs/game-profiles-launching.md)
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
Code Review SummaryStatus: 1 Issue Found (Already Reported) | Recommendation: Address before merge Overview
Issue Details (click to expand)CRITICAL
Files Reviewed (15 files)
Notes
|
Code Review SummaryStatus: 3 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)CRITICAL
WARNING
Files Reviewed (17 files)
Fix these issues in Kilo Cloud Previous Review Summary (commit 070d578)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit 070d578)Status: 1 Issue Found (Already Reported) | Recommendation: Address before merge Overview
Issue Details (click to expand)CRITICAL
Files Reviewed (16 files)
Notes
Reviewed by glm-5.2 · Input: 74.4K · Output: 21.9K · Cached: 817.3K |
…, environment and result-surfaced drift
070d578 to
970d237
Compare
|
Rebased onto
Instead the four commits unique to this branch were replayed onto The rebase applied cleanly but the test suite has not been run against the rebased branch, so CI here is the first verification. #340 received the equivalent rebase and passed 1,553 tests. No approvals existed, so nothing was dismissed by the force-push. |
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| } | ||
|
|
||
| report.Receipt = receipt; | ||
| CompareExecutable(receipt.Executable, report); |
There was a problem hiding this comment.
WARNING: Unguarded receipt-field access can abort a launch that the documented invariant says must never block on receipts.
The JSON parse immediately above is wrapped defensively, but CompareExecutable(receipt.Executable, report) and the foreach (... in receipt.ArchiveRoots) below it are not. A corrupt or tampered receipt that still parses successfully — e.g. "Executable": null, "ArchiveRoots": null, or a null archive-root entry — produces an unhandled NullReferenceException here; an uncaught SecurityException or transient IO error from FileInfo inside CompareExecutable has the same effect. RevalidateAsync is awaited on the launch path (RevalidateLaunchReceiptAsync -> LaunchProfileAsync), so the exception propagates and fails the launch, contradicting the stated guarantee that receipt and drift issues never block a launch. Wrap this block in the same try/catch used for the parse, or null-guard the receipt fields before use.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
1 participant
Summary
Record what each successful launch consisted of and cheaply compare subsequent launches against that receipt so configuration and filesystem drift is visible.
Changes
Testing
dotnet test GenHub/GenHub.sln -c Release— 1,476 tests passed.Risks and rollback
Routine revalidation deliberately avoids content hashing, so a same-size replacement with a deliberately preserved timestamp is not detected. Receipt persistence is best-effort and does not fail an otherwise successful launch. Reverting this PR removes receipt recording and drift notifications.
Related issues
Fixes #323
Greptile Summary
The PR adds persistent, versioned launch receipts and reports configuration or filesystem drift on subsequent launches.
Confidence Score: 4/5
The PR is not yet safe to merge because launch receipts still expose profile-defined environment secrets through persisted JSON, logs, and UI notifications.
The entire child-process environment is copied into the receipt without filtering, and drift messages interpolate old and new values verbatim, leaving the previously reported credential-disclosure path reachable.
Files Needing Attention: GenHub/GenHub/Features/Launching/LaunchReceiptService.cs; GenHub/GenHub/Features/Launching/GameLauncher.cs
Important Files Changed
Sequence Diagram
sequenceDiagram participant UI as Launcher ViewModel participant Launcher as GameLauncher participant Receipt as LaunchReceiptService participant Workspace as WorkspaceManager participant Process as Game Process Manager UI->>Launcher: Launch profile Launcher->>Receipt: Revalidate previous receipt Receipt-->>Launcher: Filesystem drift and previous receipt Launcher->>Workspace: Prepare workspace Workspace-->>Launcher: Workspace and executable Launcher->>Receipt: Compare upcoming configuration Receipt-->>Launcher: Configuration drift Launcher->>Process: Start process Process-->>Launcher: Process information Launcher->>Receipt: Record latest receipt Launcher-->>UI: Success with drift warningsReviews (3): Last reviewed commit: "feat(launching): surface receipt drift a..." | Re-trigger Greptile
Context used: