Repository navigation
Add web UI with pair and serve, Docker image, CI fix, unsigned MSIX docs - #38
Merged
Merged
Conversation
- Fix the flaky plugin-copy test: bind the temp copy cleanup to the task atomically with TaskQueue.EnqueueWithFinalizer so an immediately-finishing task cannot outrun its registration. - Docs no longer ask users to self-sign MSIX; install the unsigned bundle with Add-AppxPackage -AllowUnsigned until an officially signed bundle ships. - Add vfox-plus pair (loopback, one-time links) and vfox-plus serve (persistent, expiring sessions, mintable links), plus a minimal published Docker image running serve. - Add the full web interface at /app: SDKs, registry, tasks with live logs over SSE, settings and vfox config.
linghengqian
marked this pull request as draft
October 25, 2026 15:35
linghengqian
added
bug
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
skywalking-eyes requires it for HTML sources.
Memory use at
|
| Implementation | Technology | Processes | Home PSS | Home RSS | Versions PSS | Versions RSS | The list adds (PSS) |
|---|---|---|---|---|---|---|---|
| mygo | mygo 0.6.3, Go 1.27.3, GTK 3 (purego), CPU renderer | 1 | 45 (+3) | 59 | 54 (+4) | 69 | +9 |
In MB, for the application and all of its child processes, sorted by the PSS of the Home page; "Versions" is the SDKs page with the available versions of Node.js listed. A number in parentheses is the difference from main, in bold when it is more than the noise of CI. "(main)" marks an implementation that this pull request did not rebuild: its numbers are those of main.
Details
- Measured by
vfxtool measurein the workflow of the implementation, on a GitHub-hosted runner with Xvfb and no GPU. These are not the numbers ofdocs/memory.md, which come from another machine: compare the rows of one comment. - The same code does not use the same memory in every CI run, so a difference counts as a change only when it is more than 5 MB and more than 5% of the number on main.
- Runs of this pull request: mygo.
- Latest runs on main: mygo (
a21080b).
CodeQL go/cookie-secure-not-set flags it, but Secure would stop browsers from sending the cookie back over plain HTTP outside localhost and break pairing. Loopback traffic never leaves the machine; beyond it, serve warns to prefer an encrypted tunnel.
errcheck: check Close errors. errorlint: errors.Is for flag.ErrHelp. gosec G114: ReadHeaderTimeout on the server. gosec G120/G124: bound the upload, document why Secure stays off. revive/unparam: comment and signature cleanups.
Non-loopback serve now always speaks HTTPS: it uses --tls-cert/--tls-key when given and generates a self-signed certificate next to the settings otherwise, printing the SHA-256 fingerprint for comparison in the browser. The session cookie sets Secure exactly when TLS is on; loopback pair stays plain HTTP. This answers go/cookie-secure-not-set: suppressing the alert was wrong, the transport is now really encrypted.
Loopback origins (localhost, 127.0.0.1) are trustworthy, so browsers send Secure cookies back over plain HTTP there; every non-loopback bind already serves HTTPS. This satisfies go/cookie-secure-not-set and gosec G124 with the literal instead of suppressions.
CodeQL go/path-injection flagged os.ReadFile receiving an HTTP-supplied path via AddPluginFromSource. Local filesystem paths are now rejected in the web API (the desktop keeps accepting them); uploads sanitize dot names.
CodeQL go/path-injection kept flagging PreparePluginSource even with a URL guard it cannot see through. The web API now builds vfox add directly for URLs and server-side uploads instead of going through AddPluginFromSource, so no request-controlled string reaches the filesystem reads. This also fixes early deletion of uploads: cleanup runs in the task finalizer, not on handler return.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix the flaky CI test
Sandboxes / mygofailed inTestModelHandsVfoxACopyOfALocalLuaPluginAndDeletesItAfterwardswith a 5 s timeout waiting for the plugin copy to be deleted.Root cause:
AddPluginFromSourceenqueued the task first and registered the temp.luacopy afterwards. A task that finishes immediately (the fake runner completes in microseconds) could finish before the registration, soonTaskFinishednever found the copy and the test timed out. More likely to hit under-racein a loaded sandbox container.Fix:
TaskQueue.EnqueueWithFinalizerbinds the cleanup to the task atomically at creation, runs it exactly once at announce time (normal finish, failure, queued cancel) and for queued tasks onDispose.AppModeldrops the racy map. Three deterministic regression tests cover finish, dedup and dispose.Unsigned MSIX docs
Docs no longer ask users to self-sign. Windows 11 installs the unsigned
.msixbundlewithAdd-AppxPackage -AllowUnsigned; the docs state the bundle is currently unsigned and an officially signed bundle will ship later.Sign-Msix.ps1stays as a maintainer helper.vfox-plus pair,vfox-plus serve, Docker imageNew
mygo/pairpackage (stdlib only):pair: loopback-only pairing server printing a one-time link in the style ofopencode pair(5 min TTL, session cookie, bilingual page).serve: persistent server for containers and remote instances, expiring sessions (default 24 h), mintable links viaGET /api/token(uses the request Host, so it works behind port mappings), non-loopback warning.mygo/Dockerfile: multi-stage build, minimal Ubuntu runtime (ca-certificates + vfox + vfox-plus, non-root user, data volumes), defaultserve --bind 0.0.0.0 --port 8080. Verified in a container: pair,/app, inventory, link reuse rejection, minted links.Full web interface
A paired browser gets
/app(single embedded page, zero external requests): installed SDKs with install/use/uninstall, plugin registry with add/update/remove (URL or file upload), tasks with live progress and logs over SSE, settings and vfox config keys. State-changing routes need a session plus same-origin;useoffers the global scope only. Verified against real vfox locally and in Docker;go test -race,vet,gofmtanddocs-checkpass.