Fix capability/runtime gating and build config perms

Author: cursoragent

cmd/api/api/capabilities.go

@@ -55,12 +55,14 @@ func (s *ApiService) GetCapabilities(ctx context.Context, _ oapi.GetCapabilities
 	if s.InstanceManager != nil {
 		defaultRuntime = s.InstanceManager.DefaultHypervisor()
 	}
-	caps, capsKnown := hypervisor.CapabilitiesForType(defaultRuntime)
+	supported := supportedRuntimes(runtime.GOOS)
+	caps, capsKnown := capabilitiesForDefaultRuntime(defaultRuntime, supported)
 	if !capsKnown {
-		// The configured default runtime is not available on this platform;
+		// The configured default runtime is not usable on this host;
 		// report zeroed features rather than guessing.
-		log.WarnContext(ctx, "default runtime has no registered capabilities on this host",
-			"runtime", string(defaultRuntime))
+		log.WarnContext(ctx, "default runtime has no usable capabilities on this host",
+			"runtime", string(defaultRuntime),
+			"supported", supported)
 	}
 
 	emulation := emulationSupported(runtime.GOOS, runtime.GOARCH, defaultRuntime)
@@ -85,7 +87,7 @@ func (s *ApiService) GetCapabilities(ctx context.Context, _ oapi.GetCapabilities
 		},
 		Runtime: oapi.CapabilitiesRuntime{
 			Default:        string(defaultRuntime),
-			Supported:      supportedRuntimes(runtime.GOOS),
+			Supported:      supported,
 			Snapshot:       caps.SupportsSnapshot,
 			Standby:        standbySupported(caps),
 			Pause:          caps.SupportsPause,
@@ -157,6 +159,23 @@ func supportedRuntimes(goos string) []string {
 	}
 }
 
+func capabilitiesForDefaultRuntime(defaultRuntime hypervisor.Type, supported []string) (hypervisor.Capabilities, bool) {
+	if !runtimeSupported(defaultRuntime, supported) {
+		return hypervisor.Capabilities{}, false
+	}
+	return hypervisor.CapabilitiesForType(defaultRuntime)
+}
+
+func runtimeSupported(defaultRuntime hypervisor.Type, supported []string) bool {
+	defaultRuntimeName := string(defaultRuntime)
+	for _, runtimeName := range supported {
+		if runtimeName == defaultRuntimeName {
+			return true
+		}
+	}
+	return false
+}
+
 // emulationSupported reports whether the host can boot images built for the
 // other CPU architecture. This mirrors the create-path rule for attaching
 // the Rosetta share: vz on Apple Silicon macOS.

cmd/api/api/capabilities_test.go

@@ -111,6 +111,19 @@ func TestSupportedRuntimes(t *testing.T) {
 	require.Equal(t, []string{"vz"}, supportedRuntimes("darwin"))
 }
 
+func TestRuntimeSupported(t *testing.T) {
+	t.Parallel()
+	require.True(t, runtimeSupported(hypervisor.TypeVZ, supportedRuntimes("darwin")))
+	require.False(t, runtimeSupported(hypervisor.TypeCloudHypervisor, supportedRuntimes("darwin")))
+}
+
+func TestCapabilitiesForDefaultRuntime_IgnoresUnsupportedRuntime(t *testing.T) {
+	t.Parallel()
+	caps, ok := capabilitiesForDefaultRuntime(hypervisor.TypeCloudHypervisor, supportedRuntimes("darwin"))
+	require.False(t, ok)
+	require.Equal(t, hypervisor.Capabilities{}, caps)
+}
+
 func TestEmulationSupported(t *testing.T) {
 	t.Parallel()
 	require.True(t, emulationSupported("darwin", "arm64", hypervisor.TypeVZ))

lib/builds/storage.go

@@ -237,6 +237,9 @@ func writeBuildConfig(p *paths.Paths, id string, config *BuildConfig) error {
 	if err := os.WriteFile(configPath, data, 0600); err != nil {
 		return fmt.Errorf("write build config: %w", err)
 	}
+	if err := os.Chmod(configPath, 0600); err != nil {
+		return fmt.Errorf("chmod build config: %w", err)
+	}
 
 	return nil
 }

lib/builds/storage_test.go

@@ -36,3 +36,34 @@ func TestBuildMetadataReadWrite_MetadataRoundTrip(t *testing.T) {
 	loaded.Tags["team"] = "mutated"
 	require.Equal(t, "backend", build.Tags["team"])
 }
+
+func TestWriteBuildConfig_UsesOwnerOnlyPermissions(t *testing.T) {
+	tempDir := t.TempDir()
+	p := paths.New(tempDir)
+	id := "build-config-1"
+
+	cfg := &BuildConfig{RegistryToken: "secret-token"}
+	require.NoError(t, writeBuildConfig(p, id, cfg))
+
+	info, err := os.Stat(p.BuildConfig(id))
+	require.NoError(t, err)
+	require.Equal(t, os.FileMode(0600), info.Mode().Perm())
+}
+
+func TestWriteBuildConfig_TightensLegacyPermissions(t *testing.T) {
+	tempDir := t.TempDir()
+	p := paths.New(tempDir)
+	id := "build-config-legacy"
+
+	require.NoError(t, os.MkdirAll(p.BuildDir(id), 0755))
+	configPath := p.BuildConfig(id)
+	require.NoError(t, os.WriteFile(configPath, []byte(`{"registry_token":"old-token"}`), 0644))
+	require.NoError(t, os.Chmod(configPath, 0644))
+
+	cfg := &BuildConfig{RegistryToken: "new-token"}
+	require.NoError(t, writeBuildConfig(p, id, cfg))
+
+	info, err := os.Stat(configPath)
+	require.NoError(t, err)
+	require.Equal(t, os.FileMode(0600), info.Mode().Perm())
+}