59 lines
2.5 KiB
Markdown
59 lines
2.5 KiB
Markdown
---
|
|
phase: 04-auth-passthrough
|
|
fixed_at: 2026-04-10T00:00:00Z
|
|
review_path: .planning/phases/04-auth-passthrough/04-REVIEW.md
|
|
iteration: 1
|
|
findings_in_scope: 4
|
|
fixed: 4
|
|
skipped: 0
|
|
status: all_fixed
|
|
---
|
|
|
|
# Phase 04: Code Review Fix Report
|
|
|
|
**Fixed at:** 2026-04-10
|
|
**Source review:** .planning/phases/04-auth-passthrough/04-REVIEW.md
|
|
**Iteration:** 1
|
|
|
|
**Summary:**
|
|
- Findings in scope: 4 (2 Critical, 2 Warning; Info excluded by fix_scope)
|
|
- Fixed: 4
|
|
- Skipped: 0
|
|
|
|
## Fixed Issues
|
|
|
|
### CR-01: CREDS_FILE path resolves against the wrong directory on the host
|
|
|
|
**Files modified:** `claudebox.sh`
|
|
**Commit:** adb9dd1
|
|
**Applied fix:** Changed `CREDS_FILE` from `$HOME/.claude/.credentials.json` to `$HOME/.claudebox/.credentials.json`. Added comments explaining that the `~/.claude -> ~/.claudebox` symlink only exists inside the sandbox at runtime, so host-side credential detection must use the real claudebox config directory path.
|
|
|
|
---
|
|
|
|
### CR-02: Credentials bind target uses a symlink path — may silently fail
|
|
|
|
**Files modified:** `claudebox.sh`
|
|
**Commit:** adb9dd1
|
|
**Applied fix:** Changed the `BWRAP_ARGS` credential bind destination from `$HOME/.claude/.credentials.json` (symlink path, unresolvable by bwrap at bind time) to `$HOME/.claudebox/.credentials.json` (canonical real directory). Also updated the `--dry-run` output block to print the corrected destination path.
|
|
|
|
---
|
|
|
|
### WR-01: Credentials file mounted read-write instead of read-only
|
|
|
|
**Files modified:** `claudebox.sh`
|
|
**Commit:** adb9dd1
|
|
**Applied fix:** Changed `--bind` to `--ro-bind` for the credentials bind in both the `BWRAP_ARGS` array (line ~366) and the `--dry-run` output block (line ~333). Also updated the `print_audit` mounts display to show `(read-only)` and display `$CREDS_FILE` (the actual host source path) instead of the hardcoded symlink path inside the sandbox.
|
|
|
|
---
|
|
|
|
### WR-02: dry-run ENV_ARGS loop hard-codes stride of 3 — breaks if any non-setenv arg is added
|
|
|
|
**Files modified:** `claudebox.sh`
|
|
**Commit:** 0922b75
|
|
**Applied fix:** Added a guard assertion before the stride-3 loop that checks `${#ENV_ARGS[@]} % 3 != 0` and exits with a `BUG:` message if the invariant is violated. This catches any future breakage immediately rather than producing silently mangled output. Also changed `(( dry_run_i += 3 ))` to `dry_run_i=$(( dry_run_i + 3 ))` to use safe arithmetic assignment compatible with `set -euo pipefail` (which `writeShellApplication` enables).
|
|
|
|
---
|
|
|
|
_Fixed: 2026-04-10_
|
|
_Fixer: Claude (gsd-code-fixer)_
|
|
_Iteration: 1_
|