🤖 fix: archiving a Daytona workspace keeps SSH access to a sandbox that lost Xum's label
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 82/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- node.js, typescript
Research direction
Start with src/node/services/daytona/daytonaLifecycleHooks.ts:31 and compare the archive hook with DaytonaSSHRuntime.removalOfUnownedSandbox(), which already releases access for an unowned sandbox. Add a hook test for an unlabeled sandbox that checks token revocation, alias removal, and pooled connection retirement. The issue is done when the archive hook releases SSH access on "notOwned" and that test passes.
Written by the indexing model from the issue text.
Description
Follow-up from the Codex review of #7100 (thread: https://github.com/coder/xum/pull/7100#discussion_r4354065074, src/node/services/daytona/daytonaLifecycleHooks.ts:31).
Problem
Archiving the workspace that created a Daytona sandbox deletes the sandbox. DaytonaSandboxes.deleteSandbox() first checks that the sandbox carries this install's label. When it does not (for example, a create of unknown outcome left the workspace naming someone else's sandbox), it returns "notOwned" before it revokes the SSH token, removes the include-file alias, or retires pooled connections. The archive hook (createDaytonaArchiveHook) only shows a warning and lets the archive finish. So Xum's alias, token, pooled SSH sessions and the bash AI proxy reverse forward can stay usable against a sandbox that Xum now treats as foreign.
The removal path already handles this case: DaytonaSSHRuntime.removalOfUnownedSandbox() calls releaseAccess(sandboxId) before it returns.
Proposed fix
In the archive hook, when deleteSandbox() returns "notOwned", release Xum's SSH access to the sandbox (the same releaseSshAccess call the removal path makes) before the archive succeeds. Add a hook test with an unlabeled sandbox that expects the token revoke, the alias removal and the pooled-connection retirement.
Why it is deferred
#7100 runs its review loop under a P0/P1-only rule; P2 findings get a tracked follow-up.
- Dominant language
- TypeScript
- Stars
- 2.1k
- Forks
- 140
- Avg merge
- 4h 55m
- Merged PRs (30d)
- 897
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from coder/xum
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
🤖 fix: a Daytona connection test started before a settings save can show the old key as connectedOpen
Difficulty 2/5 1-3 hours Newbie friendliness 79/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
🤖 fix: stream-error card header actions reach 2.6px into the card padding in a 170px VS Code sidebarOpen
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
Maintainers usually reply within 1 day
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Automattic/data-liberation-agent#953 ·
Maintainers usually reply within 1 day
-
documentation
Difficulty 1/5 Under an hour Newbie friendliness 90/100
funmary-app/funmary#399 ·
Maintainers usually reply within 1 day
-
area:curator enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
CassioDalla/Scrinalia#150 ·
Maintainers usually reply within 1 day
-
status: needs-triage v1-bug-bash
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
a2ui-project/a2ui#3533 ·
Maintainers usually reply within 1 day
-
backend enhancement priority:P3
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
geolens-io/geolens#3310 ·
Maintainers usually reply within 1 day