feat: harden community production foundation through story 1.5

apps/ui/js/api.js

@@ -8,6 +8,18 @@
     }, extra || {});
   }
 
+  function attachCorrelation(error, response) {
+    var requestId = response.headers.get('x-request-id');
+    var traceId = response.headers.get('x-trace-id');
+    if (requestId && requestId.length <= 128 && /^[!-~]+$/.test(requestId) && requestId.indexOf(',') === -1 && requestId.indexOf(';') === -1) {
+      error.requestId = requestId;
+    }
+    if (traceId && /^[0-9a-f]{32}$/.test(traceId) && traceId !== '00000000000000000000000000000000') {
+      error.traceId = traceId;
+    }
+    return error;
+  }
+
   async function request(path, options) {
     var response = await fetch(path, Object.assign({
       credentials: 'same-origin',
@@ -42,11 +54,11 @@
       var error = new Error(message);
       error.status = response.status;
       error.payload = payload;
-      throw error;
+      throw attachCorrelation(error, response);
     }
 
     if (text && payload === null) {
-      throw new Error('Backend returned a non-JSON response');
+      throw attachCorrelation(new Error('Backend returned a non-JSON response'), response);
     }
 
     return payload;
@@ -81,7 +93,7 @@
       var error = new Error(message);
       error.status = response.status;
       error.payload = payload;
-      throw error;
+      throw attachCorrelation(error, response);
     }
 
     return text;

apps/ui/playwright.config.js

@@ -26,10 +26,14 @@ module.exports = defineConfig({
     : {
         command: 'bash scripts/playwright-stack.sh',
         cwd: __dirname,
-        url: `${baseURL}/login`,
-        timeout: 600_000,
-        reuseExistingServer: false,
+      url: `${baseURL}/login`,
+      timeout: 600_000,
+      reuseExistingServer: false,
+      gracefulShutdown: {
+        signal: 'SIGTERM',
+        timeout: 10_000,
       },
+    },
   projects: [
     {
       name: 'chromium',

apps/ui/scripts/playwright-stack.sh

@@ -67,7 +67,8 @@ cleanup() {
   kill_port_processes "$MCP_PORT"
 }
 
-trap cleanup EXIT INT TERM
+trap cleanup EXIT
+trap 'exit 130' INT TERM
 
 cleanup
 
@@ -131,7 +132,13 @@ mkdir -p "$CRANK_STORAGE_ROOT"
 
 (
   cd "$ROOT_DIR"
-  cargo run -p admin-api >"$LOG_DIR/admin-api.log" 2>&1
+  cargo run -p admin-api --bin crank-migrate -- apply >"$LOG_DIR/migrate.log" 2>&1
+)
+
+(
+  cd "$ROOT_DIR"
+  exec env -u CRANK_MCP_BIND -u CRANK_MCP_REFRESH_MS \
+    cargo run -p admin-api --bin admin-api >"$LOG_DIR/admin-api.log" 2>&1
 ) &
 echo $! > "$TMP_DIR/admin-api.pid"
 
@@ -141,7 +148,11 @@ done
 
 (
   cd "$ROOT_DIR"
-  cargo run -p mcp-server >"$LOG_DIR/mcp-server.log" 2>&1
+  exec env -u CRANK_ADMIN_BIND -u CRANK_STORAGE_ROOT -u CRANK_SESSION_SECRET \
+    -u CRANK_PASSWORD_PEPPER -u CRANK_SESSION_TTL_HOURS \
+    -u CRANK_BOOTSTRAP_ADMIN_EMAIL -u CRANK_BOOTSTRAP_ADMIN_PASSWORD \
+    -u CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME -u CRANK_DEMO_SEED \
+    cargo run -p mcp-server >"$LOG_DIR/mcp-server.log" 2>&1
 ) &
 echo $! > "$TMP_DIR/mcp-server.pid"
 
@@ -151,7 +162,7 @@ done
 
 (
   cd "$ROOT_DIR/apps/ui"
-  node scripts/playwright-ui-server.js >"$LOG_DIR/ui-server.log" 2>&1
+  exec node scripts/playwright-ui-server.js >"$LOG_DIR/ui-server.log" 2>&1
 ) &
 echo $! > "$TMP_DIR/ui-server.pid"
 

apps/ui/tests/e2e/observability.spec.js

@@ -28,3 +28,47 @@ test('secrets page exposes stable secret management hooks', async ({ page }) =>
   await expect(page.locator('[data-testid="secret-submit-button"]')).toBeVisible();
   await expect(page.locator('html')).toHaveAttribute('data-crank-bootstrap-state', 'ready');
 });
+
+test('API errors retain only bounded canonical support identities', async ({ page }) => {
+  await login(page);
+  await page.route('**/api/admin/workspaces/correlation-*/operations', async (route) => {
+    var hostile = route.request().url().includes('correlation-hostile');
+    await route.fulfill({
+      status: 503,
+      contentType: 'application/json',
+      headers: hostile
+        ? { 'x-request-id': 'reflected;attacker', 'x-trace-id': 'NOT-A-TRACE' }
+        : {
+            'x-request-id': '01J5SAFELOCALREQUEST',
+            'x-trace-id': '0123456789abcdef0123456789abcdef',
+          },
+      body: JSON.stringify({ error: { message: 'safe failure' } }),
+    });
+  });
+
+  var safe = await page.evaluate(async () => {
+    try {
+      await window.CrankApi.listOperations('correlation-safe');
+      return null;
+    } catch (error) {
+      return { requestId: error.requestId, traceId: error.traceId };
+    }
+  });
+  expect(safe).toEqual({
+    requestId: '01J5SAFELOCALREQUEST',
+    traceId: '0123456789abcdef0123456789abcdef',
+  });
+
+  var hostile = await page.evaluate(async () => {
+    try {
+      await window.CrankApi.listOperations('correlation-hostile');
+      return null;
+    } catch (error) {
+      return {
+        hasRequestId: Object.prototype.hasOwnProperty.call(error, 'requestId'),
+        hasTraceId: Object.prototype.hasOwnProperty.call(error, 'traceId'),
+      };
+    }
+  });
+  expect(hostile).toEqual({ hasRequestId: false, hasTraceId: false });
+});