Conversation
…#117) Addresses gitar findings on the prebuilt-bundle code plus the install-dir wrinkle: - Re-installs now update the EXISTING install in place: INSTALL_DIR defaults to the running service's WorkingDirectory (then /opt) before $HOME, so a root 'curl | sudo bash' no longer forks a second copy in /root and repoints the service away from the real install. (#117) - install-server.sh stages the bundle inside the install tree via mktemp instead of fixed world-writable /tmp paths (no symlink attack as root; atomic rename), and chown uses the owner's primary group ('user:' not 'user:user'). - desktop_rebuild.py: stage inside static/ so the swap is an atomic rename (no half-done cross-device move leaving static/desktop missing); stamp index.html fresh after extract so _is_bundle_stale does not treat the bundle as perpetually stale; and on Pythons without the path-safe tar filter, fall back to a local build rather than an unsafe extract. - README: installs/upgrades download a prebuilt bundle, they do not build the UI locally; corrected the stale 'rebuild on restart' note. Deferred follow-up: publish + verify a bundle SHA256 (gitar edge-case) -- needs a CI hash artifact. 21 desktop_rebuild tests pass.
…fc/taOS - CI publishes desktop-bundle.sha256 alongside the bundle (rolling + per release). - install-server.sh and desktop_rebuild.py verify the downloaded tarball against that digest before extracting; a corrupted or tampered bundle is rejected and the install falls back to a local build. Closes gitar's 'bundle never verified' edge case. Cross-platform (sha256sum / shasum -a 256; hashlib in Python). - README: jaylfc/tinyagentos -> jaylfc/taOS throughout (13 URLs). 22 desktop_rebuild tests pass (added a checksum-mismatch case).
Marks the install-path hardening (prebuilt SHA256 verify, update-in-place, symlink-safe staging, stale-mtime fix) so the in-app update checker flags it.
fix(install): harden prebuilt path + update-in-place (#117)
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
|
Warning Review limit reached
More reviews will be available in 11 minutes and 39 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
👋 Thanks for the PR! This one targets See CONTRIBUTING.md for the branch model. |
1 participant
Promotes the install-path hardening to master and cuts beta.4.1.
All gitar must-fixes folded in. CI green on #1207.