Feat/core loop

[wangxingjun778]

No description provided.

[gemini-code-assist]

Code Review

This pull request introduces LeapBoard, a Server-Driven UI (SDUI) monitoring web dashboard for LeapFlow, adding a domain-neutral monitoring subsystem, a session-analysis producer, and TUI/CLI integrations. The code review identified several critical security and reliability issues: a CORS bypass vulnerability in the origin check, insecure masking of short secrets, a potential risk of terminating unrelated processes due to PID reuse, sequential blocking when stopping active watches on exit, a bug in CLI typo suggestions discarding global flags, and a regex limitation when parsing floats with trailing dots.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The _check_origin method uses simple substring matching ("127.0.0.1" in origin or "localhost" in origin) to validate the Origin header. This can be easily bypassed by an attacker registering a domain like attacker127.0.0.1.com or localhost.attacker.com. Use proper URL parsing to validate the hostname exactly.

Suggested change

	def _check_origin(request: Any) -> bool:
	origin = request.headers.get("Origin")
	if not origin:
	return True # non-browser or same-origin requests carry no Origin
	return "127.0.0.1" in origin or "localhost" in origin
	@staticmethod
	def _check_origin(request: Any) -> bool:
	from urllib.parse import urlparse
	origin = request.headers.get("Origin")
	if not origin:
	return True # non-browser or same-origin requests carry no Origin
	try:
	parsed = urlparse(origin)
	return parsed.hostname in ("127.0.0.1", "localhost")
	except Exception:
	return False

[gemini-code-assist]

The typo correction suggestion discards any global flags/options that appeared before first_pos (e.g., leap --profile dev deamon status becomes leap daemon status, losing --profile dev). Preserve the original arguments by replacing only the typo token.

                corrected_args = list(effective_argv)
                corrected_args[first_pos] = suggestion
                corrected = " ".join(["leap", *corrected_args])

[gemini-code-assist]

In _stop_board_watches_on_exit, active watches are stopped sequentially in a loop. If there are multiple active watches, this can block the TUI exit process sequentially for up to 1.0 second per watch if the daemon is slow or unresponsive. Running these concurrently using asyncio.gather prevents sequential blocking.

    tasks = []
    for watch in active:
        watch_id = str(watch.get("watch_id", ""))
        if watch_id:
            tasks.append(asyncio.wait_for(client.watch_stop(watch_id), timeout=1.0))
    if tasks:
        results = await asyncio.gather(*tasks, return_exceptions=True)
        stopped = sum(1 for r in results if not isinstance(r, Exception))

[gemini-code-assist]

In _mask_secret, revealing the last 3 characters of a secret when its length is >= 8 is a security risk. For short secrets (e.g., exactly 8 characters), revealing 3 characters exposes 37.5% of the secret, significantly reducing the search space for brute-forcing. The threshold should be increased to at least 16 characters to ensure sufficient entropy remains masked.

Suggested change

	# Reveal last 3 chars only when the secret is long enough to remain safe.
	suffix = text[-3:] if len(text) >= 8 else ""
	return f"***{suffix}" if suffix else "***"
	# Reveal last 3 chars only when the secret is long enough to remain safe.
	suffix = text[-3:] if len(text) >= 16 else ""
	return f"***{suffix}" if suffix else "***"

[gemini-code-assist]

In _retire_stale_server, the launcher attempts to terminate a stale process by calling os.kill(pid, signal.SIGTERM) based solely on the PID stored in the state file. If the original dashboard process has died and the OS has reused the PID for an unrelated process, this will terminate an innocent process. Consider verifying that the process is indeed the dashboard server (e.g., by checking its command line or process name) before sending the signal, or avoid terminating it if the token probe fails.

[gemini-code-assist]

The regex r"[-+]?\d*\.?\d+([eE][-+]?\d+)?" used in _num to validate float strings does not match valid float representations with a trailing dot but no decimal digits (e.g., 1.), which are common in some data outputs. Using a more robust regex pattern will improve parsing correctness.

Suggested change

	if re.fullmatch(r"[-+]?\d*\.?\d+([eE][-+]?\d+)?", cleaned or ""):
	try:
	return float(cleaned)
	except ValueError:
	return None
	if re.fullmatch(r"[-+]?(\d+(\.\d*)?|\.\d+)([eE][-+]?\d+)?", cleaned or ""):
	try:
	return float(cleaned)
	except ValueError:
	return None