fix(cli): harden artifact sharing env scrubbing and Netlify setup (#1…

…0024)
qqqys · Aug 19, 2026 · Aug 19, 2026 · Aug 25, 2026 · Aug 25, 2026 · Aug 25, 2026
commit f4eab1b2de8c34c3b65691078ae3d1e8ceaf3c24
diff --git a/packages/cli/src/serve/process-env-guard.test.ts b/packages/cli/src/serve/process-env-guard.test.ts
@@ -154,8 +154,8 @@ const allowedProcessEnvAccesses = normalizeAllowances([
     'packages/cli/src/serve/routes/workspace-artifact-publish.ts',
     {
       reason:
-        'Artifact provider CLIs are process-scoped: they install under the daemon-wide Qwen directory rather than any workspace, and provider child processes inherit the daemon environment with PATH pinned to the daemon PATH.',
-      accesses: { 'key:PATH': 1, whole: 3 },
+        'Artifact provider CLIs are process-scoped: they install under the daemon-wide Qwen directory rather than any workspace, and provider child processes inherit the daemon environment with PATH pinned to the daemon PATH. The credential-store location variables (XDG_* / APPDATA / LOCALAPPDATA) are read back from the daemon environment in a loop so a workspace overlay cannot redirect where the daemon-managed provider logins live.',
+      accesses: { 'computed:key': 1, 'key:PATH': 1, whole: 3 },
     },
   ],
   [

diff --git a/packages/cli/src/serve/routes/workspace-artifact-publish.test.ts b/packages/cli/src/serve/routes/workspace-artifact-publish.test.ts
@@ -6,6 +6,7 @@
 
 import * as path from 'node:path';
 import * as http from 'node:http';
+import * as fsp from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import express from 'express';
@@ -508,6 +509,14 @@ describe('GET /workspace/artifact/publish-config', () => {
       env: {
         PATH: '/workspace/bin',
         NODE_OPTIONS: '--import /workspace/evil.js',
+        NETLIFY_AUTH_TOKEN: 'attacker-token',
+        NETLIFY_API_URL: 'https://attacker.example',
+        NETLIFY_SITE_ID: 'attacker-site',
+        CLOUDFLARE_API_TOKEN: 'attacker-token',
+        CLOUDFLARE_API_BASE_URL: 'https://attacker.example',
+        CF_API_BASE_URL: 'https://attacker.example',
+        VERCEL_TOKEN: 'attacker-token',
+        XDG_DATA_HOME: '/workspace/.xdg',
       },
     });
     mockSettings({
@@ -520,11 +529,9 @@ describe('GET /workspace/artifact/publish-config', () => {
       },
     });
     const runCommand: ArtifactRouteCommandRunner = vi.fn(
-      async (command, args, options) => {
+      async (command, args) => {
         expect(command).toBe(process.execPath);
         expect(args[0]).toBe(TEST_NETLIFY_ENTRY);
-        expect(options.env['PATH']).toBe(process.env['PATH']);
-        expect(options.env['NODE_OPTIONS']).toBeUndefined();
         if (args[1] === '--version') return '27.1.2';
         if (args[1] === 'api') throw new Error('not authenticated');
         throw new Error(`Unexpected command: ${args.join(' ')}`);
@@ -548,6 +555,22 @@ describe('GET /workspace/artifact/publish-config', () => {
         .mocked(runCommand)
         .mock.calls.every(([command]) => command === process.execPath),
     ).toBe(true);
+    const netlifyCalls = vi
+      .mocked(runCommand)
+      .mock.calls.filter(([, args]) => args[0] === TEST_NETLIFY_ENTRY);
+    expect(netlifyCalls.length).toBeGreaterThan(0);
+    for (const [, , options] of netlifyCalls) {
+      expect(options.env['PATH']).toBe(process.env['PATH']);
+      expect(options.env['NODE_OPTIONS']).toBeUndefined();
+      expect(options.env['NETLIFY_AUTH_TOKEN']).toBeUndefined();
+      expect(options.env['NETLIFY_API_URL']).toBeUndefined();
+      expect(options.env['NETLIFY_SITE_ID']).toBeUndefined();
+      expect(options.env['CLOUDFLARE_API_TOKEN']).toBeUndefined();
+      expect(options.env['CLOUDFLARE_API_BASE_URL']).toBeUndefined();
+      expect(options.env['CF_API_BASE_URL']).toBeUndefined();
+      expect(options.env['VERCEL_TOKEN']).toBeUndefined();
+      expect(options.env['XDG_DATA_HOME']).toBe(process.env['XDG_DATA_HOME']);
+    }
   });
 
   it('runs the JavaScript CLI entrypoint on Windows instead of .cmd shims', async () => {
@@ -815,7 +838,10 @@ describe('POST /workspace/artifact/netlify/setup', () => {
       .post('/workspace/artifact/netlify/setup')
       .send({ action: 'poll' });
 
-    expect(response.status).toBe(200);
+    expect(
+      response.status,
+      `setup returned ${JSON.stringify(response.body)}`,
+    ).toBe(200);
     expect(response.body.setup).toMatchObject({
       stage: 'ready',
       authenticated: true,
@@ -888,7 +914,10 @@ describe('POST /workspace/artifact/netlify/setup', () => {
       .post('/workspace/artifact/netlify/setup')
       .send({ action: 'prepare' });
 
-    expect(response.status).toBe(200);
+    expect(
+      response.status,
+      `setup returned ${JSON.stringify(response.body)}`,
+    ).toBe(200);
     expect(response.body.setup).toMatchObject({
       stage: 'ready',
       authenticated: true,
@@ -974,7 +1003,10 @@ describe('POST /workspace/artifact/netlify/setup', () => {
       .post('/workspace/artifact/netlify/setup')
       .send({ action: 'connect' });
 
-    expect(response.status).toBe(200);
+    expect(
+      response.status,
+      `setup returned ${JSON.stringify(response.body)}`,
+    ).toBe(200);
     expect(response.body.setup).toMatchObject({
       stage: 'ready',
       linked: true,
@@ -1174,7 +1206,10 @@ describe('POST /workspace/artifact/netlify/setup', () => {
       .post('/workspace/artifact/netlify/setup')
       .send({ action: 'connect' });
 
-    expect(response.status).toBe(200);
+    expect(
+      response.status,
+      `setup returned ${JSON.stringify(response.body)}`,
+    ).toBe(200);
     expect(response.body.setup).toMatchObject({
       stage: 'ready',
       configured: true,
@@ -1227,6 +1262,85 @@ describe('POST /workspace/artifact/netlify/setup', () => {
         .mock.calls.some(([, args]) => args[0] === 'sites:create'),
     ).toBe(false);
   });
+
+  // Self-referential symlink creation is not reliably permitted on Windows.
+  it.skipIf(process.platform === 'win32')(
+    'creates a dedicated project when the boundary probe cannot read .git',
+    async () => {
+      const workspaceCwd = await fsp.mkdtemp(
+        path.join(tmpdir(), 'qwen-art-boundary-'),
+      );
+      const settingsByWorkspace: Record<string, Record<string, unknown>> = {
+        [workspaceCwd]: {},
+      };
+      mockSettings(settingsByWorkspace);
+      await fsp.symlink(
+        path.join(workspaceCwd, '.git'),
+        path.join(workspaceCwd, '.git'),
+      );
+      try {
+        const primary = runtime('primary', workspaceCwd, { primary: true });
+        const runCommand: ArtifactRouteCommandRunner = vi.fn(
+          async (_command, args) => {
+            if (args[0] === '--version') return '27.1.2';
+            if (args[0] === 'api' && args[1] === 'getCurrentUser') {
+              return JSON.stringify({ id: 'user-id' });
+            }
+            if (args[0] === 'api' && args[1] === 'getSite') {
+              return JSON.stringify({
+                id: 'created-site',
+                name: 'Created site',
+              });
+            }
+            if (args[0] === 'status') throw new Error('not linked');
+            if (args[0] === 'sites:create') {
+              return JSON.stringify({
+                id: 'created-site',
+                name: 'Created site',
+              });
+            }
+            throw new Error(`Unexpected command: ${args.join(' ')}`);
+          },
+        );
+        const persistSettings = vi.fn(async (_workspace, writes) => {
+          const host: Record<string, unknown> = {};
+          for (const write of writes) {
+            if (write.key === 'artifact.host.uploadCommand') {
+              host['uploadCommand'] = write.value;
+            }
+            if (write.key === 'artifact.host.urlFromCommandOutput') {
+              host['urlFromCommandOutput'] = write.value;
+            }
+          }
+          settingsByWorkspace[workspaceCwd] = { host };
+        });
+        const app = express();
+        app.use(express.json());
+        registerWorkspaceArtifactPublishRoutes(app, {
+          getPrimaryRuntime: () => primary,
+          sendBridgeError,
+          mutate: allowMutations,
+          runCommand: adaptTestRunner(runCommand),
+          persistSettings,
+        });
+
+        const response = await request(app)
+          .post('/workspace/artifact/netlify/setup')
+          .send({ action: 'prepare' });
+
+        expect(
+          response.status,
+          `setup returned ${JSON.stringify(response.body)}`,
+        ).toBe(200);
+        expect(response.body.setup).toMatchObject({
+          stage: 'ready',
+          linkedSite: { id: 'created-site' },
+        });
+      } finally {
+        await fsp.rm(workspaceCwd, { recursive: true, force: true });
+      }
+    },
+  );
 });
 
 describe('multi-provider artifact setup', () => {
@@ -1893,6 +2007,37 @@ describe('POST /workspace/artifact/publish', () => {
         .mocked(readyNetlify)
         .mock.calls.some(([, args]) => args[0] === 'status'),
     ).toBe(false);
+    expect(
+      vi
+        .mocked(readyNetlify)
+        .mock.calls.some(
+          ([, args]) => args[0] === 'api' && args[1] === 'updateSite',
+        ),
+    ).toBe(false);
+    expect(response.body).toMatchObject({
+      provider: 'netlify',
+      url: 'https://preview.example.com/report',
+    });
+  });
+
+  it('strips site protection only for the managed Netlify site', async () => {
+    const readBytesWindow = windowReader(HTML);
+    const primary = runtime('primary', '/workspace', {
+      primary: true,
+      readBytesWindow,
+    });
+    mockSettings({
+      '/workspace': {
+        host: NETLIFY_HOST,
+        share: { netlify: { siteId: 'site-id' } },
+      },
+    });
+
+    const response = await request(makePrimaryApp(primary))
+      .post('/workspace/artifact/publish')
+      .send({ path: 'out/report.html', provider: 'netlify' });
+
+    expect(response.status).toBe(200);
     const updateCall = vi
       .mocked(readyNetlify)
       .mock.calls.find(
@@ -1914,10 +2059,6 @@ describe('POST /workspace/artifact/publish', () => {
     expect(mocked.hostPublish.mock.invocationCallOrder[0]).toBeLessThan(
       vi.mocked(readyNetlify).mock.invocationCallOrder[updateCallIndex]!,
     );
-    expect(response.body).toMatchObject({
-      provider: 'netlify',
-      url: 'https://preview.example.com/report',
-    });
   });
 
   it('publishes through a pinned Cloudflare Pages project', async () => {
@@ -2514,6 +2655,7 @@ describe('POST /workspace/artifact/publish', () => {
     mockSettings({
       '/workspace': {
         host: NETLIFY_HOST,
+        share: { netlify: { siteId: 'site-id' } },
       },
     });
     const protectedNetlify: ArtifactRouteCommandRunner = vi.fn(

diff --git a/packages/cli/src/serve/routes/workspace-artifact-publish.ts b/packages/cli/src/serve/routes/workspace-artifact-publish.ts
@@ -446,6 +446,27 @@ function providerEnv(runtime: WorkspaceRuntime): NodeJS.ProcessEnv {
   delete env['CLOUDFLARE_ACCOUNT_ID'];
   delete env['VERCEL_ORG_ID'];
   delete env['VERCEL_PROJECT_ID'];
+  delete env['CLOUDFLARE_API_TOKEN'];
+  delete env['CLOUDFLARE_API_BASE_URL'];
+  delete env['CF_API_BASE_URL'];
+  delete env['VERCEL_TOKEN'];
+  delete env['NETLIFY_AUTH_TOKEN'];
+  delete env['NETLIFY_API_URL'];
+  delete env['NETLIFY_SITE_ID'];
+  // Restore the daemon's credential-store locations instead of deleting
+  // them: logins performed by this daemon live under those paths.
+  for (const key of [
+    'XDG_DATA_HOME',
+    'XDG_STATE_HOME',
+    'XDG_CACHE_HOME',
+    'XDG_CONFIG_HOME',
+    'APPDATA',
+    'LOCALAPPDATA',
+  ]) {
+    const daemonValue = process.env[key];
+    if (daemonValue === undefined) delete env[key];
+    else env[key] = daemonValue;
+  }
   return env;
 }
 
@@ -1579,8 +1600,9 @@ async function assertLinkBoundary(runtime: WorkspaceRuntime): Promise<void> {
       await fsp.stat(path.join(current, '.git'));
       repositoryRoot = current;
       break;
-    } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    } catch {
+      // Only a discovered .git proves nesting; an unreadable entry proves
+      // nothing, and rethrowing turns transient fs errors into setup 500s.
     }
     const parent = path.dirname(current);
     if (parent === current) break;
@@ -2948,7 +2970,9 @@ async function handlePublish(
             `Could not publish the artifact through ${selectedProvider}. Try again.`,
           );
         });
-      if (selectedProvider === 'netlify') {
+      if (selectedProvider === 'netlify' && settings.netlify.siteId) {
+        // Only the dedicated site this flow created may have protection
+        // stripped; a host-configured site keeps its password/SSO settings.
         await makeSitePublic(
           resolvedPublisher.command,
           resolvedPublisher.targetId,