Repository navigation
feat(web): 种子配置默认锁定 + 空 TZ 跟随 SOCKS5（#612 拆分） - #613
Conversation
Co-authored-by: ted <kuhlmangarry24@gmail.com>
Co-authored-by: ted <kuhlmangarry24@gmail.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 3 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 6e055dc. Configure here.
| } | ||
| const pinned = persistVmTimezone(cfg.paths.project, id, zone, { source: 'manual' }) | ||
| if (!pinned) return json(res, 404, { ok: false, error: { message: 'vm not found' } }) | ||
| Object.assign(vm, pinned) |
There was a problem hiding this comment.
Seed pin overwrites live VM record
High Severity
Pinning a timezone on seed PUT assigns persistVmTimezone's summarizeVm result onto the full slot record and writes that back. The summary redacts proxy.password to *** and injects panel-only fields, so a seed that pins TZ can wipe the SOCKS password and pollute vms/<id>.json.
Reviewed by Cursor Bugbot for commit 6e055dc. Configure here.
| locale: draft.locale, | ||
| } | ||
| if (draft.timezoneFollow) body.timezone_follow_proxy = true | ||
| else if (draft.timezoneFixed) body.timezone = draft.timezoneFixed |
There was a problem hiding this comment.
Seed save requires proxy timezone
High Severity
seedSaveBody always sends timezone_follow_proxy when timezone_source is not manual. Seed PUT then fails closed if SOCKS geo has no IANA zone, so editing theme, env, or claude.setting cannot save on unpinned slots without a detected exit timezone.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 6e055dc. Configure here.
| vm.timezone_source = 'proxy_geo' | ||
| } | ||
| } | ||
| if (nextLocale) vm.locale = nextLocale |
There was a problem hiding this comment.
Locale seed skips fingerprint locale
Medium Severity
Seed PUT writes vm.locale only. Timezone persist also copies the zone onto fingerprint.timezone, but locale does not update fingerprint.locale. Outbound identity still prefers the fingerprint, so LANG in seed files can disagree with workstation locale until a fingerprint reset.
Reviewed by Cursor Bugbot for commit 6e055dc. Configure here.
2 participants
意图（源自被拒 #612 /
fix/remote-slot-refresh拆分）在 tip
#611只读契约键（TZ/LANG 不经extra_env）之上，增量交付：extra_env。timezone_follow_proxy；可改固定 IANA 或改回跟随。实现要点
SeedPolicyCard锁定 UX +ZoneField/LocaleField；seedSaveBody附带timezone/timezone_follow_proxy/locale，extra_env仍剥离 TZ/LANG（feat(seed): 可编辑 env/theme + 调试上传 40 条脱敏（#610 拆分） #611 契约）。PUT /seed-settings在写文件前应用locale与timezone/timezone_follow_proxy（与 PATCH 时区规则一致）。CHANGELOG未发布、docs/PANEL_API.mdseed-settings 行。明确不含
fix/remote-slot-refresh测试
test/unit/panel-vm-seed-settings.test.mjs（PUT 跟随代理时区 + locale）web/src/features/vm/seed-settings.test.ts（save body 不含 extra_env TZ）Note
Medium Risk
改动 VM 播种 API 与槽位时区/语言持久化路径，有误配或代理地理缺失时 PUT 会 400；UI 锁定降低误操作但不改变契约 env 的写入规则。
Reviewed by Cursor Bugbot for commit 6e055dc. Configure here.