Repository navigation
Conversation
…eardown Add --persist-profile / CLOAKSERVE_PERSIST_PROFILE. When set, the per-seed user-data-dir is kept on stop and after a failed launch instead of being deleted, so a profile on a --data-dir volume survives. Default is unchanged, and the _safe_rmtree containment guard (CVE-2026-45727) is not modified. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
|
Thanks for the PR, @anvilsong! The persist switch is a good addition, and routing both delete points through One thing before we merge: When a client connects without a Could you persist only seeded profiles and keep deleting the def _discard_profile(self, path: str) -> None:
if self._persist_profile and Path(path).name != "__default__":
logger.info("Keeping profile dir (persist mode): %s", path)
return
self._safe_rmtree(path)A README note that The branch also needs a rebase, since |
Defect
cloakserve owns each seed's Chrome user-data-dir and deletes it with
_safe_rmtreein two places: after a failed launch (_get_or_create,bin/cloakserve~L389) and on stop/teardown (_cleanup_process, ~L424). With--data-dirpointing at a persistent volume and a pinnedfingerprintseed, the volume survives the container but the profile comes back empty, so there is no way to persist a profile through cloakserve.Measured evidence
Observed downstream on 0.4.5 (same code paths still present in v0.5.11): 3.4 MB of profile written, cookie set, session deleted, volume intact, profile dir empty afterwards. Downstream currently carries a build-time patch making
_safe_rmtreea no-op behind an env flag.Fix
New opt-in
--persist-profileflag /CLOAKSERVE_PERSIST_PROFILE=1env var (flag accepts=true|false, overrides env). When on, a newChromePool._discard_profile()skips deletion on both the failed-launch and teardown paths. When off (default), it calls_safe_rmtreeexactly as before, so ephemeral behavior is unchanged. Also documented in README and CHANGELOG.Security note
_safe_rmtreeand its containment guard (refuse anything not strictly inside data_dir), the CVE-2026-45727 remediation, are untouched. Persist mode only skips the call; it never widens what can be deleted.Testing
pytest tests/test_cloakserve.py: 108 passed (existing tests, including the_safe_rmtreecontainment tests, plus new tests for flag/env parsing, persist keeping the dir, and ephemeral mode still deleting and still refusing outside paths).