fix: CreateTap idempotent by existence check, not error-string parsing #21

New issue

Closed

opened 2026-07-03 14:14:23 +00:00 by a73x · 1 comment

a73x commented

2026-07-03 14:14:23 +00:00

(Migrated from git.a73x.sh)

[claude 2026-07-03] Fixes 94303e65 (found running eitri in the sandbox per session goal). Create-retry re-ran CreateTap on the previous attempt's live tap; 'ip tuntap add' failed with 'ioctl(TUNSETIFF): Device or resource busy' (not in tolerated()), so the VM terminal-failed with a tap artifact masking the real disk-guard error. Fix: existence-check the link and skip the add (EnsureBridge's documented approach); string tolerance retained as TOCTOU backstop. TDD: TestCreateTapIdempotentWhenTapExists watched fail with the exact real-world error; fresh-tap and propagation tests rescripted for the probe. VERIFIED END-TO-END in a rebuilt sandbox: disk_gb=1 VM now terminal-fails with 'disk_gb 1 ... smaller than base image'. make ci green (after clearing a stale golangci cache referencing a removed worktree).

Migrated from git-collab patche 64df1ea2638cca2b5135b5fbe72fdb310f2564f9.

Original author: a73x dev@a73x.sh.

Fixes git-collab issue 94303e65

Historical merged patch. The original head and merge commits were not recorded. Forgejo cannot display a pull request without a head commit, so this record is preserved as a closed issue. The original diff is unavailable; no commit was guessed.

Original branches: fix/createtap-idempotent → main.

[claude 2026-07-03] Fixes 94303e65 (found running eitri in the sandbox per session goal). Create-retry re-ran CreateTap on the previous attempt's live tap; 'ip tuntap add' failed with 'ioctl(TUNSETIFF): Device or resource busy' (not in tolerated()), so the VM terminal-failed with a tap artifact masking the real disk-guard error. Fix: existence-check the link and skip the add (EnsureBridge's documented approach); string tolerance retained as TOCTOU backstop. TDD: TestCreateTapIdempotentWhenTapExists watched fail with the exact real-world error; fresh-tap and propagation tests rescripted for the probe. VERIFIED END-TO-END in a rebuilt sandbox: disk_gb=1 VM now terminal-fails with 'disk_gb 1 ... smaller than base image'. make ci green (after clearing a stale golangci cache referencing a removed worktree). --- Migrated from git-collab patche `64df1ea2638cca2b5135b5fbe72fdb310f2564f9`. Original author: a73x <dev@a73x.sh>. Fixes git-collab issue `94303e65` **Historical merged patch.** The original head and merge commits were not recorded. Forgejo cannot display a pull request without a head commit, so this record is preserved as a closed issue. The original diff is unavailable; no commit was guessed. Original branches: `fix/createtap-idempotent` → `main`.

a73x commented

2026-07-03 14:17:16 +00:00

(Migrated from git.a73x.sh)

Original review: comment (revision not recorded)

[claude 2026-07-03] Fresh-context reviewer: approve, no blocking issues. Verified: race-clean; mutant walk (unconditional add, inverted probe, early-return, dropped tolerance — all killed by the tests); fail-open probe semantics correct (perm errors propagate via the untolerated add; the EnsureBridge precedent has the identical trade-off); lost-restart caller strictly improves (old path succeeded only by accident of an ignored EBUSY). Informational minors recorded on the patch: 8-hex tap-name prefix collision now degrades silently instead of loudly (negligible probability, pre-existing truncation; hardening option = /sys/class/net//tun_flags ownership check); one cosmetic assert. End-to-end verified in a rebuilt sandbox before merge. Merging per session goal.

**Original review: comment** (revision not recorded) [claude 2026-07-03] Fresh-context reviewer: approve, no blocking issues. Verified: race-clean; mutant walk (unconditional add, inverted probe, early-return, dropped tolerance — all killed by the tests); fail-open probe semantics correct (perm errors propagate via the untolerated add; the EnsureBridge precedent has the identical trade-off); lost-restart caller strictly improves (old path succeeded only by accident of an ignored EBUSY). Informational minors recorded on the patch: 8-hex tap-name prefix collision now degrades silently instead of loudly (negligible probability, pre-existing truncation; hardening option = /sys/class/net/<tap>/tun_flags ownership check); one cosmetic assert. End-to-end verified in a rebuilt sandbox before merge. Merging per session goal.