Uh oh!
There was an error while loading. Please reload this page.
fix(cli): delete only removes tb when it is tracebloc's own alias - #171
Merged
Conversation
`removeSelf` deleted any sibling file named `tb` (guard was only `tb !=
exe`), with no check that it was tracebloc's own symlink. If a user had an
unrelated `tb` on the same PATH dir tracebloc installed into (another
tool's binary, or a symlink elsewhere), `tracebloc delete` removed it —
wrong-target deletion of a file tracebloc never created.
Make delete symmetric with install. The installer refuses to clobber a
pre-existing `tb` (install.sh: creates it only when absent or when
`readlink tb == PREFIX/tracebloc`). Delete now mirrors that: new
aliasStatus() removes `tb` only when it is a symlink resolving to this
binary; a regular file or a symlink pointing elsewhere is left in place
with a note ("isn't tracebloc's `tb` alias"). Relative targets resolve
against the link dir, and an EvalSymlinks fallback covers the case where
the binary itself is a symlink (Intel Homebrew).
Found in the FR review of the offboarding surface; not a Bugbot finding.
Tests: TestDelete_OwnTBAlias_Removed (real tb->binary symlink is removed),
TestDelete_ForeignTBAlias_Left (a foreign regular-file `tb` is NOT removed
and is reported), and the full-sequence test now lays down a real symlink.
The foreign-tb test is verified to fail without the guard. Suite + vet green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>aptracebloc
approved these changes
Jul 7, 2026
Uh oh!
There was an error while loading. Please reload this page.
saadqbal added a commit
that referenced
this pull request
Jul 8, 2026
…atch phase) Four low/medium follow-ups from the Bugbot review of PR #164; the other five Bugbot items were already fixed by #165/#168/#171. - delete: fail fast on a 401/403 from the pre-offboard online check (revoked/expired credential) with a `tracebloc login` hint, instead of warning and marching the user through the confirm only to fail at revoke. - delete: clear + persist the active-client pointer IMMEDIATELY after the revoke succeeds (before the best-effort teardown), so a failed or interrupted teardown can't leave the host looking enrolled under a dead credential. - delete: mark the offboard degraded when removeSelf can't remove the CLI binary / own `tb` alias, so the closing line stops claiming a clean offboard while the CLI is still on disk. - data ingest: a pod already in Succeeded prints "Ingestion complete — showing its logs:" (replayed) instead of the "live progress:" line. Tests added for each; full internal/... suite + go vet + gofmt green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
aptracebloc pushed a commit
that referenced
this pull request
Jul 13, 2026
Adds real e2e coverage of the top-level `tracebloc delete` offboard (RFC-0001 §7.10), which CI's e2e.yml previously left untested (it only exercised `data ingest`). New test/integration/delete_e2e_test.go: - TestE2E_RevokeUsesPostNotDelete: a real HTTP round-trip against a recording stub asserts acceptance (a) — the credential is REVOKED via POST /edge-device/<id>/revoke/, never a hard DELETE of the row. - TestE2E_DeleteTeardown: builds the real binary and runs `tracebloc delete --yes --force` black-box against a throwaway k3d cluster with a real Helm release, asserting (b) the release is uninstalled, (c) the k3d cluster is deleted, (d) ~/.tracebloc is wiped, and (e) the foreign-`tb` guard (#171) leaves a `tb` it didn't create in place. Opt-in via TB_E2E_K3D=1 and refuses a pre-existing `tracebloc` cluster, so it never clobbers a dev machine. The black-box run is kept fully offline (egress through a dead proxy) so the revoke takes its documented best-effort transport-failure path while the local teardown runs for real; the POST-not-DELETE contract a live backend enforces is covered by the stub test. Revoke against a live backend is left to the pre-prod FR (CI can't provide one — no base-URL override on the CLI). Wires a new `delete-teardown` job (k3d + helm) into e2e.yml, mirroring the ingest e2e job's nightly/dispatch/`e2e`-label gating. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
tracebloc delete(offboarding) removed any sibling file namedtb, guarded only bytb != exe— with no check that it was tracebloc's own alias. If a user had an unrelatedtbon the same PATH dir tracebloc installed into (another tool's binary, or a symlink pointing elsewhere), offboarding deleted it — wrong-target deletion of a file tracebloc never created.This came out of the FR review of the offboarding surface (§7.10). It's not a Bugbot finding — Bugbot's five findings on #164 are all resolved (by #165, #168, #169); this is the one the review caught that they didn't.
Fix — make delete symmetric with install
The installer already refuses to clobber a pre-existing
tb(scripts/install.sh: creates it only when absent, or whenreadlink tb == PREFIX/tracebloc). Delete now mirrors that ownership test:aliasStatus(tb, exe) (exists, ours bool)—tbis ours only when it's a symlink resolving to this binary.tbalias." (mirrors the installer's "already exists and isn't ours" message).EvalSymlinksfallback covers the binary itself being a symlink (Intel Homebrew).Tests
TestDelete_OwnTBAlias_Removed— a realtb → traceblocsymlink is removed.TestDelete_ForeignTBAlias_Left— a foreign regular-filetbis not removed, is reported, and is untouched on disk. Verified to fail without the guard (unfixedremoveSelfdeletes it).internal/...suite +go vetgreen.Targets
developper convention.🤖 Generated with Claude Code