fix(cli): use correct pubkey source for CVM replicate env encryption#227
Open
fix(cli): use correct pubkey source for CVM replicate env encryption#227
Conversation
The replicate command was using getCvmComposeConfig which calls
/cvms/{id}/compose_file — an endpoint that does not return env_pubkey.
This caused "undefined is not an object" when encrypting env vars.
Switch to safeGetCvmInfo + getEncryptPubkey, matching the approach
used by `phala env encrypt`. Remove the unused getCvmComposeConfig
helper and CvmComposeConfigResponse type.
Leechael
force-pushed
the
fix/replicate-env-encrypt-pubkey
branch
from
f514e3a to
2b3b98b
Compare
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| ? `${CLOUD_URL}/${workspace.slug}/apps/${replica.app_id}/instances/${vmUuid}` | ||
| : replica.app_url || "-"; | ||
| const lines = [ | ||
| `Source CVM ID: ${context.cvmId.id}`, |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
- Add --compose-hash, --prepare-only, --commit, --token, --transaction-hash options
- Rename --teepod-id to --node-id with name resolution support
- Handle 465 responses for on-chain KMS prepare flow
- Add commit command hints to prepare-only output
- Use instance-level /cvms/{vm_uuid}/replicas endpoint
- Show Team (from source CVM workspace) and App URL in replica output - Keep CVM UUID dashes intact (don't strip hyphens) - Show KMS type in output - Add 0x prefix to compose hash, app id, device id in prepare output - Preserve ResourceError from safeGetCvmInfo so error codes (e.g. ERR-03-003, ERR-03-009) and suggestions are displayed
| "Private key is required for on-chain replica approval. Pass --private-key or set PRIVATE_KEY.", | ||
| ); | ||
| } | ||
| return privateKey as `0x${string}`; |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
When compose hash or device is not registered on-chain, display what needs registration before demanding --private-key. If no private key is provided, show prepare output and actionable error message instead of a generic "private key required" error.
When app_id matches multiple CVMs (ERR-03-010) and --compose-hash is provided, fallback to listing CVMs and filtering by compose_hash to find the specific source instance.
Replace full CVM list with GET /apps/{appId}/cvms to resolve app_id
ambiguity. Show available compose hashes (deduplicated) when no match.
Comment on lines
+337
to
+347
| ...new Set( | ||
| appCvmsResult.data.map((c) => c.compose_hash).filter(Boolean), | ||
| ), | ||
| ]; | ||
| throw new Error( | ||
| `No CVM instance with compose_hash ${input.composeHash} found for app ${rawId}. ` + | ||
| `Available compose hashes: ${available.length > 0 ? available.join(", ") : "none"}`, | ||
| ); | ||
| } else { | ||
| throw cvmResult.error; | ||
| } |
There was a problem hiding this comment.
Bug: When identifying a CVM by --compose-hash, if the single matched CVM lacks a vm_uuid, a misleading 'multiple CVMs found' error is thrown.
Severity: MEDIUM
Suggested Fix
Add a specific check for the case where matched.length === 1 but matched[0].vm_uuid is falsy. In this new branch, throw a clear error message indicating that the CVM matched by the compose hash is missing its vm_uuid and cannot be used as a source for replication.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: cli/src/commands/cvms/replicate/index.ts#L327-L347
Potential issue: When disambiguating a CVM using `--compose-hash`, the logic checks if
`matched.length === 1 && matched[0].vm_uuid`. If exactly one CVM matches the hash but
its `vm_uuid` is null or undefined (a valid state according to the API schema), this
condition fails. The code then incorrectly falls through to a final `else` block, which
re-throws an `ERR-03-010` error, originally intended for when multiple CVMs match an
identifier. This results in a misleading error message telling the user about an
ambiguous identifier, when the actual issue is that the uniquely matched CVM is
incomplete.
JS SDK: - CvmKmsInfoV20260121Schema: add chain_id → chain transform (parity with KmsInfoSchema used by 2025-10-28 API) - addDevice/addComposeHash: pre-check contract owner before submitting tx, give clear error if sender is not owner - dstackAppAbi: add OwnableUnauthorizedAccount and OwnableInvalidOwner error definitions for proper error decoding CLI: - Use sourceCvm.kms_info.chain (from SDK transform) instead of manual chain_id mapping - Use safeGetAppCvms for app_id disambiguation instead of full CVM list - Remove debug logging
Contributor
📋 Check Results✨ JS SDK - Code FormattingShow format check results🔍 JS SDK - TypeScript Type CheckShow type check output🧪 JS SDK - Test ResultsShow test output📝 JS SDK - Lint CheckShow lint results🌐 JS SDK - Browser CompatibilityShow browser test results🌐 Browser Compatibility ReportBrowser compatibility tests completed across:
The SDK has been verified to work in modern browser environments. Check run: https://github.com/Phala-Network/phala-cloud/actions/runs/23957011962 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
phala cvms replicate -ecommand usedgetCvmComposeConfigwhich calls/cvms/{id}/compose_file— an endpoint that does not returnenv_pubkey, causingundefined is not an object (evaluating 'hex.startsWith').safeGetCvmInfo+getEncryptPubkey, matching the approach used byphala env encrypt.getCvmComposeConfigandCvmComposeConfigResponse.Test plan
phala cvms replicate -e /tmp/env.test <app_id>with a centralized KMS CVMphala cvms replicate -e /tmp/env.test <app_id>with a decentralized (on-chain) KMS CVMphala env encryptstill works as before