Repository navigation
fix: check tls, api, certs - #1501
Merged
Merged
Conversation
🧙 Wizard CIRun the Wizard CI and test your changes against wizard-workbench example apps by replying with a GitHub comment using one of the following commands: Test all apps:
Test all apps in a directory:
Test an individual app:
Show more apps
Test against a Context Mill branch:
Add Results will be posted here when complete. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
sarahxsanders
left a comment
sarahxsanders
left a comment
Collaborator
There was a problem hiding this comment.
bot review — from sarah's agent review
- src/shared/tls-probe.ts:67: can we probe through the same proxy axios used? otherwise this can report a trusted public chain while the actual request failed on the proxy's certificate.
- src/shared/api.ts:521: can we pass the hostname and port separately? with
--base-url https://example.com:8443, this tries to resolveexample.com:8443and connects on 443, so the probe never checks the failing endpoint.
sarahxsanders
approved these changes
Oct 29, 2026
sarahxsanders
left a comment
sarahxsanders
left a comment
Collaborator
There was a problem hiding this comment.
my agent had thoughts as well
gewenyu99
approved these changes
Oct 29, 2026
![veria-ai[bot]](https://avatars.githubusercontent.com/in/1723776?s=60&v=4){kind=small}
PR overviewAll previously flagged issues have been addressed. No open security concerns remain on this pull request. Security reviewNo open security issues remain on this pull request. Fixed/addressed: 1 · PR risk: 0/10 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When the wizard can't load the project or user after login, it now says why and who can fix it. Before, every such failure showed
Failed to fetch project data.What it checks
API calls. The project and user fetches retry twice (after 500 ms, then 1.5 s) on a network error, a 5xx, a 408 or a 429. A 401, 403 or 404 fails at once. The final error names the host and the cause: Node's error code (such as
ECONNRESET) or the HTTP status.Certificate. When Node rejects the server's certificate (
SELF_SIGNED_CERT_IN_CHAIN,UNABLE_TO_GET_ISSUER_CERT_LOCALLYand similar), a VPN, proxy or security tool is likely intercepting HTTPS. These errors aren't retried. The message tells the user to ask IT to allow*.posthog.comwithout HTTPS inspection.TLS connection. On a certificate error only,
src/shared/tls-check.tsopens one connection to the same host. It does a verified TLS handshake against Node's defaults plus the OS store, sends nothing and closes. Certificate validation stays on. It records:system_store_trusts, true or false), in the log and on the captured exception. True means a root installed on the machine, typically by IT, signed the chain;Nothing changes what the wizard or the machine trusts, and the wizard suggests no workaround.
Local dev. For
localhost,127.0.0.1and[::1], a server that doesn't answer fails at once with "Check that your local server is running". There's no retry, no TLS check and no network advice.Log line on a certificate error:
What users see
These are frames from
OutroScreen, rendered with each message. A login failure has no credentials yet, so it shows this screen rather than the handoff.Untrusted certificate (TLS inspection)
No response (blocked or dropped connection)
Unexpected status after retries
Local PostHog not running
Before this change, for every case above
Testing
src/shared/__tests__/api-errors.test.ts(retry policy, messages, TLS check gating, local hosts) andsrc/shared/__tests__/tls-check.test.ts(validation on, issuer walk, verified and failed chains, other handshake failures).us.posthog.comandeu.posthog.comreport a public CA issuer withsystemStoreTrusts: true.self-signed.badssl.comanduntrusted-root.badssl.comreportfalse.🤖 Generated with Claude Code