Quarantine unreadable settings instead of wiping them - #405
Merged
Conversation
|
Warning Review limit reachedNext included review available in 33 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
ceiling | b29d3ba | Commit Preview URL Branch Preview URL |
Sep 07 2026, 06:01 PM |
Settings::read_path treated DPAPI, unsupported ProtectedFile, and IO errors as defaults with no .bak, so try_update overwrote the live file. Match the SBS-954 parse quarantine and fail-closed ledger persist. Co-authored-by: Tyler <tyler@southboundsoftware.com>
cursor
Bot
force-pushed
the
cursor/sbs-1074-settings-read-fail-closed-22d3
branch
from
August 23, 2026 22:30
bd930fc to
c0daa54
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Settings::read_pathmappedsecure_file::read_stringerrors (DPAPI unprotect, unsupported ProtectedFile version, IO on an existing file) to defaults with no.bak. The nexttry_updatethen atomically replaced the live undecodablesettings.json.Parse failures already quarantine (SBS-954 / SBS-1029). This change treats those read failures the same way:
load()to retry under the state lock.try_updatemoves the original tosettings.json.bakbefore writing defaults onto the vacated path.The account ledger persist path had the same fail-open wipe:
record_and_persistusedload_default()(undecodable → empty) then saved. Persist now fails closed, matching API keys andwindow_geometry.json.Related issue
Closes SBS-1074.
Affected areas
Validation
The four new settings tests failed on
mainbefore the fix (unlocked read did not setpending_quarantine;try_updatewrote defaults over the live file with no.bak). They pass after the change.Commands run on this Linux cloud agent (Windows-native DPAPI/NTFS not available here):
cargo fmt --all --check --manifest-path rust/Cargo.toml— passcargo test --manifest-path rust/Cargo.toml— pass (1192 lib + 32 bin)cargo clippy --manifest-path rust/Cargo.toml --all-targets -- -D warnings— fails on pre-existing Linux-only dead code insecure_file.rs/updater.rs(Windows-gated). Not introduced by this PR. Hosted CI is Windows.cargo test --manifest-path apps/desktop-tauri/src-tauri/Cargo.toml— cannot build here (gdk-3.0missing). Hosted desktop CI is Windows.Hosted CI on
c0daa54d(rebased ontomain/ 1.5.36) is green: Frontend, Rust / shared, Rust / desktop, Rust aggregator, and CodeQL all passed. An earlier Rust / shared failure oncli::tty_runner::tests::test_run_sends_script_through_ptywas an unrelated PTY flake and did not reproduce.UI / tray proof
Notes for reviewers
secure_filestores:load_defaultremains fail-open for readers.usage-history.json,quota-run-history.json, capacity-event baselines) still fail-open then persist. They are rebuildable charts/events, not user-authored settings; left alone to keep this change scoped.Note
Quarantine unreadable settings and account-ledger files instead of overwriting them
ProtectedFileversion, and IO read failures throughSettings::handle_undecodable, which defers quarantine on unlocked reads and moves the file to backup on locked reads. Missing files still initialize defaults.AccountLedger::record_and_persistnow usesAccountLedger::persist_if_changed, which strictly loads the existing ledger before saving. Undecodable or unreadable ledgers are left byte-for-byte unchanged; missing ledgers can still be created and persisted.Settings::read_pathandAccountLedger::persist_if_changedno longer treat unreadable existing files as empty defaults that get overwritten — callers that relied on the old fail-open behavior will see the original corrupt file preserved in the backup path rather than replaced.Macroscope summarized c0daa54.