fix(api): address skiller review follow-ups

Author: skulidropek

packages/api/Dockerfile

@@ -122,7 +122,10 @@ RUN if [ "$DOCKER_GIT_CONTROLLER_BUILD_SKILLER" = "1" ]; then \
           sleep $((attempt * 2)); \
         done \
       && electron_zip="$(find "${electron_config_cache:-/root/.cache/electron}" -name 'electron-v*-linux-*.zip' -print -quit)" \
-      && test -n "$electron_zip" \
+      && if [ -z "$electron_zip" ]; then echo "Electron zip not found in cache: ${electron_config_cache:-/root/.cache/electron}" >&2; exit 1; fi \
+      && unzip -Z1 "$electron_zip" > /tmp/electron-zip-entries \
+      && if grep -Eq '(^/|(^|/)\.\.($|/))' /tmp/electron-zip-entries; then echo "Unsafe paths in Electron zip: $electron_zip" >&2; exit 1; fi \
+      && rm -f /tmp/electron-zip-entries \
       && rm -rf node_modules/electron/dist node_modules/electron/path.txt \
       && mkdir -p node_modules/electron/dist \
       && unzip -q "$electron_zip" -d node_modules/electron/dist \

packages/api/tests/skiller-routes.test.ts

@@ -32,12 +32,13 @@ const scope = (projectKey: string): SkillerContainerScope => ({
 })
 
 describe("skiller routes", () => {
-  it("launches Electron as the controller process user", () => {
+  it("launches Electron through the Skiller launch script", () => {
     const [command, args] = skillerLaunchCommand()
+    const launchCommand = args.join("\n")
 
     expect(command).toBe("bash")
-    expect(args.join(" ")).not.toContain("setpriv")
-    expect(args).toContainEqual(expect.stringContaining("node_modules/electron/dist/electron"))
+    expect(launchCommand).toContain("xvfb-run -a ./node_modules/electron/dist/electron")
+    expect(launchCommand).toContain("exec ./node_modules/electron/dist/electron")
   })
 
   it("keeps the terminal session id on session-scoped app routes", () => {

packages/app/tests/docker-git/controller-resource-limits.test.ts

@@ -95,15 +95,16 @@ describe("controller compose resource limits", () => {
   }
 })
 
-describe("controller Skiller Dockerfile", () => {
+describe("API Dockerfile Electron materialization", () => {
   it.effect("materializes Electron binary before bundling Skiller", () =>
     Effect.gen(function*(_) {
       const contents = yield* _(readComposeFile("packages/api/Dockerfile"))
-      expect(contents).toContain(
-        `electron_zip="$(find "\${electron_config_cache:-/root/.cache/electron}" -name 'electron-v*-linux-*.zip' -print -quit)"`
-      )
-      expect(contents).toContain("unzip -q \"$electron_zip\" -d node_modules/electron/dist")
-      expect(contents).toContain("test -x node_modules/electron/dist/electron")
+      expect(contents).toMatch(/electron_zip="\$\(find "\$\{electron_config_cache:-\/root\/\.cache\/electron\}"/u)
+      expect(contents).toMatch(/Electron zip not found in cache/u)
+      expect(contents).toMatch(/unzip -Z1 "\$electron_zip"/u)
+      expect(contents).toMatch(/Unsafe paths in Electron zip/u)
+      expect(contents).toMatch(/unzip -q "\$electron_zip" -d node_modules\/electron\/dist/u)
+      expect(contents).toMatch(/test -x node_modules\/electron\/dist\/electron/u)
     }))
 })