hermes/atheos-blog-lxc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: rDelete fataled on musl (GLOB_BRACE) - broke ALL deletion and plugin removal

Browse Source 
Reported as "deleting terminal just cycles in the ui". Root cause is much larger than the
plugin: it was a platform bug that broke deletion everywhere.

CAUSE
  traits/helpers.php::rDelete() did:
      glob($target . "{*,.[!.]*,..?*}", GLOB_BRACE|GLOB_MARK);
  GLOB_BRACE is a GLIBC extension. Alpine is musl, where the constant is undefined,
  and referencing an undefined constant is a FATAL in PHP 8:
      PHP Fatal error: Uncaught Error: Undefined constant "GLOB_BRACE"
      in traits/helpers.php:138
      #0 components/market/class.market.php(178): Common::rDelete()
      #1 components/market/controller.php(46): Market->remove()
  The fatal kills the request before Common::send(200), so the front end never gets a
  settle response and the UI spins forever. A hang, not an error - which is why it
  presented as "cycles in the ui".

BLAST RADIUS (measured, two call sites)
  components/market/class.market.php:178   removing a plugin from the market
  components/filetree/class.filetree.php:59  DELETING ANY FILE OR FOLDER IN THE EDITOR
  The second is core functionality, so this was never a plugin bug - installing the
  Terminal plugin is just what made it visible.

FIX
  patches/helpers-rDelete-GLOB_BRACE.diff - expand the brace pattern by hand when
  GLOB_BRACE is undefined, keeping upstream behaviour where it is defined. Verified:
  nested dirs + dotfiles + single files all delete correctly now.
  Upstream has NOT fixed this (checked main) so it cannot be resolved by updating.

PLUGIN REMOVED
  Once deletion worked, removal via the market succeeded and the plugin is now gone:
    {"text":"Plugin successfully removed.","status":200}
  That is the right end state - a browser shell was the largest attack surface, and
  macros already provide command execution. Removed through the market's own code path
  so the plugin list, addons cache and bundle stayed consistent.

TESTS (now 42 passed, 1 failed - the failure is branch protection, a genuine open item)
  + a GLOB_BRACE regression guard that fails loudly if the patch is lost to an update
  + the identity guard is INVERTED: FR-11 required an EMPTY identity so the agent could
    not impersonate the operator, but the operator has since asked for it to be set, so
    the test asserting emptiness was asserting the opposite of the current design. It
    now requires the identity to be present and to NOT look agent-generated.

docs/known-issues.md: new section 1 documents the GLOB_BRACE fault in full, including the
honest note that this is the real cost of choosing Alpine over a glibc base image.
This commit is contained in:
hermes
2026-09-29 16:28:44 +10:00
parent 0bdd15b31b
commit c4a4de1da7
4 changed files with 161 additions and 180 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/build-and-test.sh
+38 -4
View File
@@ -108,7 +108,29 @@ done
echo
echo "=============================================================="
echo "GUARD: is master PROTECTED on the blog repo? (the writer-branch model depends on it)"
echo "REGRESSION: rDelete works (GLOB_BRACE is glibc-only; musl lacks it)"
echo "=============================================================="
# traits/helpers.php::rDelete() used GLOB_BRACE, which is undefined under musl -> PHP 8 fatal.
# That broke deleting ANY file/folder in the editor AND removing a market plugin (the UI
# would spin forever because the fatal killed the response before Common::send()).
# docs/known-issues.md §1. This test fails loudly if the patch is lost (e.g. by an update).
rm -rf /tmp/rdel_guard 2>/dev/null
if mkdir -p /tmp/rdel_guard/a/b/c /tmp/rdel_guard/.hd 2>/dev/null \
&& touch /tmp/rdel_guard/f.txt /tmp/rdel_guard/.dot /tmp/rdel_guard/a/b/c/deep.txt; then
ROUT=$(php83 -r 'require_once("/var/www/atheos/common.php"); echo Common::rDelete("/tmp/rdel_guard/") ? "ok" : "fail";' 2>&1 | grep -viE 'deprecat|warning|notice' | tail -1)
if [ "$ROUT" = "ok" ] && [ ! -e /tmp/rdel_guard ]; then
ok "rDelete removed a nested tree incl. dotfiles (delete works)"
else
if echo "$ROUT" | grep -q 'GLOB_BRACE'; then
bad "rDelete FATALS on GLOB_BRACE - re-apply patches/helpers-rDelete-GLOB_BRACE.diff"
else
bad "rDelete failed (got: $ROUT)"
fi
fi
else
bad "could not build the rDelete test tree"
fi
rm -rf /tmp/rdel_guard 2>/dev/null
echo "=============================================================="
# The whole branch-based workflow assumes the deploy key CANNOT push master. That is a
# repo-side setting we cannot verify from here by inspection - so test it the way an
@@ -128,10 +150,22 @@ fi
echo
echo "=============================================================="
echo "FR-11 GUARD: agent created NO identity or armistace credential"
echo "IDENTITY: git identity is SET by the operator (FR-11 superseded by explicit request)"
echo "=============================================================="
chk "git user.name empty" "$(asuser 'git config --get user.name' 2>/dev/null)" ""
chk "git user.email empty" "$(asuser 'git config --get user.email' 2>/dev/null)" ""
# FR-11 originally required the agent to leave the identity EMPTY so it could not impersonate
# the operator. The operator has since explicitly asked for it to be set, so the requirement is
# superseded - and the guard is inverted: the identity must now be present and must be the
# OPERATOR's, not an agent-invented one. Guarding the old expectation would assert the opposite
# of the current design and fail forever (which is what it did).
NAME=$(asuser 'git config --get user.name' 2>/dev/null)
MAIL=$(asuser 'git config --get user.email' 2>/dev/null)
if [ -n "$NAME" ]; then ok "git user.name set ($NAME)"; else bad "git user.name is empty - macro 2 will refuse to commit"; fi
if [ -n "$MAIL" ]; then ok "git user.email set ($MAIL)"; else bad "git user.email is empty"; fi
case "$MAIL" in
*hermes*|*bot*|*noreply@anthropic*|*agent*) bad "identity looks agent-generated: $MAIL" ;;
"") ;;
*) ok "identity is an operator address, not an agent-invented one" ;;
esac
if [ -f /home/atheos/.ssh/id_ed25519_blog ]; then ok "deploy key present"; else bad "deploy key missing"; fi
chk "deploy key mode" "$(stat -c '%a' /home/atheos/.ssh/id_ed25519_blog 2>/dev/null)" "600"
chk "deploy key owner" "$(stat -c '%U' /home/atheos/.ssh/id_ed25519_blog 2>/dev/null)" "atheos"