Repository navigation
session:spawn relays the raw provider exception over IPC (q22 at the source) #1267
Description
Found by #1264 review B (R2-2).
src/main/ipc/session.ts (session:spawn handler) rethrows the raw provider exception, so its text crosses IPC. recover() already launders it into SESSION_START_FAILED_MESSAGE (sessionManager.ts recoverSession); session:spawn does not.
Why it matters (steering q22): provider launch exceptions can carry environment values, proxy URLs or scoped MCP tokens. The incident journals already hold one such text verbatim as a renderer.unhandledrejection from a spawn nobody caught. Each renderer surface currently has to remember not to show it (#1262, #1264 did so by hand).
Fix: flatten in main's session:spawn handler, as recover does: journal the raw error, throw SESSION_START_FAILED_MESSAGE, and pass MissingWorkspaceDirectoryError through (its message is curated; MISSING_WORKSPACE_FOLDER_PREFIX after #1264). Fail-first test: a spawn that throws a message containing a token-shaped string must reach the renderer without it.
Severity: P2 (class C3/security), not user-triggered today.
🤖 Generated with Claude Code
Activity
Juliusolsson05 commentedon Sep 25, 2026
Status after #1286 (merged via batch #1318, 2026-09-25).
Renderer side, done:
sessionSpawnErrorMessagenow flattens every spawn rejection to the safe sentence, once, for every caller (newTab, reload, provider switch, rewind, creates, and the orchestration tool error). Only three curated messages pass: the proxy startup failure, the missing folder (rebuilt from the renderer's own cwd), and a missing provider CLI (known provider ids only).Still open (this issue):
session:spawnin main still relays the raw provider exception over IPC. The fix belongs at the source, likerecoverSession.Merge pull request #1324 from Juliusolsson05/fix/spawn-ipc-launder