fix: end-to-end bug audit — deploy/seed-phrase/lifecycle hardening - #30
Open
Sentinel-Bluebuilder wants to merge 4 commits into
Open
Conversation
End-to-end audit fixes across the main-process services: - deploy.ts: cancel/lifecycle races, mnemonic carry-through (H-3, H-4, M-12) - docker.ts: pipe/health detection + error surfacing (H-2, M-7, M-8) - node-manager.ts: live-status single-fire + status reconciliation (H-1, M-9, M-10, M-11, M-15) - cli-registry.ts / node-specs.ts / ssh.ts: input validation + correctness - shared/types.ts + ipc.ts: IPC enum + handler wiring (H-5, L-5, L-6) - validate.ts: shared validators extracted for reuse (M-13)
…10,L-12) - index.ts: single-instance lock + clean updater teardown on quit (L-7) - updater.ts: window-aware install dialog + cancellable startup check (L-12) - host-keys.ts: distinguish ENOENT from real read errors (L-3) - live-stats.ts: refcount subscribers by webContents, auto-release on destroy instead of leaking across renderer reloads (L-10) - system-report.ts: real fs.statfs disk probe replacing the hardcoded 50GB/diskOk stub, degrading to unknown rather than fabricating (L-12) - logger/settings/store/chain/geoip/wallet/sentinel-client: secret redaction, RPC-first fallbacks, and defensive guards
…6..H-8,M-16,L-12) - store/app.ts: per-node liveStatusAt freshness clock so a slow nodes.status RPC can't overwrite a fresher live-status push (M-16 TOCTOU); named window listeners with teardown (H-6); seed-backup redirect runs before the done-dedup guard so replayed done frames still drive the seed flow (H-7) - Progress.tsx: Cancel re-reads live progress and bails if an unacked recovery phrase is present, instead of clearing it (H-8) - Nodes.tsx: refresh status only for newly-seen node ids (M-16) - DeploySshBatch.tsx: track + clear deploy poll intervals on unmount and gate row writes behind an alive flag (M-16) - WalletSetup.tsx: render the recovery phrase only once revealed instead of leaving it in the DOM behind a CSS blur (L-12) - ProgressRing.tsx: move monotonic peak into state advanced from an effect instead of mutating a ref during render (L-12) - format.ts: guard NaN/Infinity in fmtAmount/fmtUSD and invalid ISO in relativeTime (L-12)
wallet-setup.test.tsx: the L-12 fix stops rendering mnemonic words into the DOM until the user explicitly reveals them (each tile shows "••••••" pre-reveal so the secret never sits in the a11y tree / DevTools). Update the test to assert the word is ABSENT first, click "Click to reveal phrase", then assert it renders — matching the corrected behavior. metrics.test.ts: better-sqlite3 is a native addon built for a single NODE_MODULE_VERSION. The app ships on Electron (ABI 140), so `npm run rebuild:electron` produces an Electron-ABI binary the vitest runner (Node, ABI 137) cannot dlopen — the metrics store then degrades to a no-op and the assertions can't run. Probe the binding once and describe.skip WITH A LOGGED REASON when it can't load under the runner, instead of silently passing against a disabled store. Full logic still runs whenever the runner ABI matches the built binary.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
End-to-end audit of the desktop node deployer surfaced and fixed a batch of
correctness, security, and lifecycle bugs spanning the main process and the
renderer. Fixes are grouped into three single-concern commits.
High severity
doneframes no longer skip the recovery-phrase backup flow.landed in the same tick.
Medium severity
src/main/validate.ts).nodes.statusRPC and the fast live-statuspush (per-node freshness clock);
Nodesrefreshes only newly-seen ids;DeploySshBatchclears its deploy poll intervals on unmount.Low severity
ENOENTfrom real read errors.webContentsand auto-releasedon destroy (no leak across renderer reloads).
fs.statfsdisk probe (was a hardcoded 50GB/diskOk:truestub);recovery phrase rendered only once revealed (was CSS-blurred but live in DOM);
ProgressRingpeak moved out of render into state;NaN/Infinity/invalid-ISOguards in formatters.
Testing
Built and exercised locally on Windows 11 (Electron). Full CLI + UI
end-to-end pass to follow.
Notes
only public addresses are ever surfaced.