fix(workspace): harden Vela billing proxy boundaries - #6348
Conversation
lefarcen
added
size/L
mrcfps
left a comment
mrcfps
left a comment
There was a problem hiding this comment.
@lefarcen Thanks for the focused hardening work here—the invalid-balance cache fallback, normalized-path validation, response/request header filtering, and disconnect cleanup are all covered at the right daemon boundary. I found one merge-safe scope-preservation edge in the new dynamic hop-by-hop filtering; details are inline.
🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.
mrcfps
left a comment
mrcfps
left a comment
There was a problem hiding this comment.
@lefarcen I reviewed all changed ranges on the current head and verified the wallet cache now rejects invalid decimal balances without replacing the last valid snapshot, the proxy validates normalized paths and Workspace scope before forwarding, hop-by-hop headers are removed in both directions, and aborted clients tear down upstream work. The follow-up commit also closes the earlier Connection-nominated Workspace header gap. The focused daemon suite passes 87/87 locally, with daemon typecheck, guard, and diff checks also clean. Thanks for the careful hardening and especially the deterministic regression coverage—this is a strong, focused fix. 🙌
🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.
2 participants
Why
Workspace delivery uncovered real hardening gaps in the daemon boundary that proxies Vela billing traffic. A malformed upstream wallet response could replace a valid cached balance, while normalized paths, malformed Workspace scopes, hop-by-hop headers, and disconnected clients were not rejected or cleaned up consistently.
This is a focused replacement for #6304. It keeps the production fixes and deterministic red specs, while deliberately excluding that draft's unrelated timeout increases and broad real-time test coverage.
What users will see
/api/v1/fail closed instead of being proxied or falling back to Personal scope.Surface area
apps/weborapps/desktop(including Electron menu bar)odsubcommand or flag, newtools-dev/tools-packflag, or newOD_*env var/api/*endpoint, new SSE event, or changed shape inpackages/contractsskills/,design-systems/,design-templates/, orcraft/, or change to the skills protocolTRANSLATIONS.mdfor the locale workflow)package.json(dependenciesordevDependencies); workspace-packagepackage.jsonfiles are out of scope. Include a paragraph on what we get vs. what bytes we ship (seeCONTRIBUTING.md→ Code style)Screenshots
N/A — this is daemon-only billing and proxy hardening with no UI change.
Bug fix verification
apps/daemon/tests/integrations/vela-wallet.test.tsand the Vela API proxy cases inapps/daemon/tests/integrations/vela.routes.test.ts.origin/feat/workspace-team@4a4dfadd(10 failures) and pass on this branch (12/12).Validation
pnpm exec vitest run -c vitest.config.ts tests/integrations/vela-wallet.test.ts tests/integrations/vela.routes.test.ts(87 passed)pnpm --filter @open-design/daemon typecheckpnpm --filter @open-design/daemon buildpnpm guardpnpm typecheckgit diff --check origin/feat/workspace-team...HEAD