CodeInstances Adds a Self-Hosted Store, Push and Pull by ID, and Bug Reports

CodeInstances 0.5 moves a run from where it failed to where it gets fixed. codeinstances serve runs a small store of your own that keeps instances under their SHA-256 ids, push and pull move them by id or a 12-character prefix, and report writes a Markdown bug report that ends with the two commands that bring the exact run back. A GitHub Actions example pushes failing test runs and puts the report in the job summary. The release post has the details, and binaries are out for Linux, macOS and Windows.

The store only takes files whose id checks out and checks each download against it again. It always uses a token, making one when none is given, takes uploads only as JSON so a web page can’t plant files in it, and on a loopback address answers only to loopback names, which shuts out DNS rebinding. The client follows no redirects, so the token stays where it was sent.

Two independent reviews before release went at the store as attackers would. They found a tokenless store open to any web page, shell quoting in the report that would have run a crafted file name, memory use many times an upload’s size, and terminal control codes that a crafted file could slip into output. All of it is fixed and tested. 93 Go tests pass with a clean race detector run, and in the recorded demo pushing three runs took 18 ms and pulling one back 5 ms. Forking a run at a step is next on the plan.