mirror of
https://github.com/NanmiCoder/cc-haha
synced 2026-07-30 16:23:35 +08:00
9b88c5a527
The Windows x64 build job went red on `Verify compiled Windows sidecar startup`, asserting that a loopback request without `CC_HAHA_LOCAL_ACCESS_TOKEN` returns 403 while it returned 200. Nothing about x64 is involved — that step carries `if: matrix.smoke_platform == 'windows' && matrix.arch == 'x64'`, so it is the only job in the whole matrix that runs the smoke at all. Any regression in this area can surface nowhere else. The 200 is correct. `7d2a8a3cd keep loopback trusted without the desktop process token` deliberately made the token additive again: gating every local request behind it turned the Grok OAuth success page, `/preview-fs` links and plain `curl` into 401s, because none of that traffic can ever carry the token. Loopback is trusted on its own; the token is demanded only on the `/api/h5-access` control plane, where another program on the same box must not be able to publish the user's sessions to the network. The assertion, written before that change, was still guarding the path that had been intentionally opened. So the probe moves to the boundary that is actually enforced, and gains a positive assertion — loopback without a token must be 200 — so the additive model is pinned down rather than merely no longer contradicted. Reverting to the pre-`7d2a8a3cd` behaviour now fails the smoke instead of passing it. Three copies of the stale assertion existed; all three are updated. Only the compiled-sidecar smoke runs in CI, but `local-index-benchmark.ts` and its corpus test were already failing the same way for anyone running them locally. The benchmark also cancels the probe response bodies now: an unread body holds its connection open, and that would land in the event-loop delay and RSS samples taken immediately after. Verified with the CI parameters — `bun run build:sidecars` then `CC_HAHA_COMPILED_SIDECAR_SMOKE_STARTS=20 bun run test:compiled-sidecar-smoke`, 8/8 — and by running the benchmark directly, which now reports `loopbackAuth` as 200/403/403/200 with validation intact.