fix: correct runId JSON key mismatch in build polling

[ptone]

Summary

• Fixes the blocker bug from PR Scion/harness local build p2 GoogleCloudPlatform/scion#406 where the harness-config build UI hangs indefinitely with no log output
• Backend sends runId (camelCase) but frontend was reading run_id (snake_case), so the build run ID was always empty and polling never started
• Adds a guard in pollBuildStatus() to reset UI state if the run ID is missing, preventing a permanent spinner

Test plan

• Navigate to a harness-config detail page with a Dockerfile
• Click "Build Image" → fill in tag → click "Build"
• Verify build log output appears and build completes (no more infinite spinner)
• Verify build status badge updates correctly on completion

[gemini-code-assist]

Code Review

This pull request introduces several features and refactorings, including a new build command to compile container images from harness configurations, support for running agents with no credentials (--no-auth), and the integration of OpenTelemetry metrics for the Hub and telemetry pipeline. Additionally, the Discord plugin's standalone mode and database-backed account linking have been replaced with an in-memory implementation. Feedback on these changes highlights several improvement opportunities: resolving a potential memory leak in the frontend build polling loop, validating config.yaml structure and image tag formats, checking if secret file paths are directories, de-duplicating required files in the capture-auth configuration, warning on unrecognized auth fields, and restoring test coverage for the refactored Discord link service.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

If a build status fetch request is in-flight when the component is disconnected, this.buildRunning remains true. When the fetch promise resolves, it will schedule a new setTimeout and continue polling indefinitely in the background, causing a memory and resource leak. Setting this.buildRunning = false inside stopBuildPolling ensures that any pending polling loop is terminated immediately upon disconnect.

Suggested change

	private stopBuildPolling(): void {
	if (this.buildPollTimer) {
	clearTimeout(this.buildPollTimer);
	this.buildPollTimer = null;
	}
	}
	private stopBuildPolling(): void {
	this.buildRunning = false;
	if (this.buildPollTimer) {
	clearTimeout(this.buildPollTimer);
	this.buildPollTimer = null;
	}
	}

[gemini-code-assist]

If config.yaml is empty or its root is not a mapping node, the image field update is silently skipped, but the command still prints a misleading success message. It is safer to validate that the root is a mapping node and return an error if it is not.

Suggested change

	if len(doc.Content) > 0 && doc.Content[0].Kind == yaml.MappingNode {
	mapping := doc.Content[0]
	found := false
	for i := 0; i < len(mapping.Content)-1; i += 2 {
	if mapping.Content[i].Value == "image" {
	mapping.Content[i+1].Value = outputImage
	found = true
	break
	}
	}
	if !found {
	mapping.Content = append(mapping.Content,
	&yaml.Node{Kind: yaml.ScalarNode, Value: "image"},
	&yaml.Node{Kind: yaml.ScalarNode, Value: outputImage},
	)
	}
	}
	if len(doc.Content) == 0 || doc.Content[0].Kind != yaml.MappingNode {
	return fmt.Errorf("invalid config.yaml: root must be a mapping")
	}
	mapping := doc.Content[0]
	found := false
	for i := 0; i < len(mapping.Content)-1; i += 2 {
	if mapping.Content[i].Value == "image" {
	mapping.Content[i+1].Value = outputImage
	found = true
	break
	}
	}
	if !found {
	mapping.Content = append(mapping.Content,
	&yaml.Node{Kind: yaml.ScalarNode, Value: "image"},
	&yaml.Node{Kind: yaml.ScalarNode, Value: outputImage},
	)
	}

[gemini-code-assist]

If the resolved filePath is a directory, os.Stat will succeed but the subsequent os.ReadFile will fail. Adding an explicit check for info.IsDir() provides a clearer error message and prevents trying to read a directory as a secret file.

			info, err := os.Stat(filePath)
			if err != nil {
				log.Error("Failed to stat file %s: %v", filePath, err)
				os.Exit(1)
			}
			if info.IsDir() {
				log.Error("File %s is a directory", filePath)
				os.Exit(1)
			}
			if info.Size() > 64*1024 {
				log.Error("File exceeds 64KB limit (%d bytes)", info.Size())
				os.Exit(1)
			}

[gemini-code-assist]

If a harness configuration contains a typo in the field mapping (e.g., field: ClaudeAuthFil), it will silently fail to set the field on AuthConfig. Adding a default case to print a warning to stderr using the built-in println function makes debugging configuration typos much easier.

Suggested change

	func setAuthConfigField(auth *api.AuthConfig, field, value string) {
	switch field {
	case "GoogleAppCredentials":
	auth.GoogleAppCredentials = value
	case "OAuthCreds":
	auth.OAuthCreds = value
	case "CodexAuthFile":
	auth.CodexAuthFile = value
	case "OpenCodeAuthFile":
	auth.OpenCodeAuthFile = value
	case "ClaudeAuthFile":
	auth.ClaudeAuthFile = value
	}
	}
	func setAuthConfigField(auth *api.AuthConfig, field, value string) {
	switch field {
	case "GoogleAppCredentials":
	auth.GoogleAppCredentials = value
	case "OAuthCreds":
	auth.OAuthCreds = value
	case "CodexAuthFile":
	auth.CodexAuthFile = value
	case "OpenCodeAuthFile":
	auth.OpenCodeAuthFile = value
	case "ClaudeAuthFile":
	auth.ClaudeAuthFile = value
	default:
	println("Warning: unrecognized AuthConfig field:", field)
	}
	}

[gemini-code-assist]

If multiple auth types in authMeta.Types declare the same required file (e.g., CLAUDE_AUTH), the generated capture-auth-config.json will contain duplicate entries. This causes capture_auth.py to attempt capturing the same secret multiple times, which can lead to duplicate logs or failures if --force is not set. De-duplicating the entries by rf.Name prevents this.

	seen := make(map[string]bool)
	var creds []credEntry
	for _, authType := range authMeta.Types {
		for _, rf := range authType.RequiredFiles {
			// Entries with empty TargetSuffix (e.g. gcloud-adc) are intentionally
			// excluded — these credentials come from well-known system paths and don't
			// use the suffix-based source derivation.
			if rf.Name == "" || rf.TargetSuffix == "" {
				continue
			}
			if seen[rf.Name] {
				continue
			}
			seen[rf.Name] = true
			fileType := rf.Type
			if fileType == "" {
				fileType = "file"
			}
			suffix := rf.TargetSuffix
			if !strings.HasPrefix(suffix, "/") {
				suffix = "/" + suffix
			}
			source := "~" + suffix
			creds = append(creds, credEntry{
				Key:    rf.Name,
				Source: source,
				Type:   fileType,
				Target: source,
			})
		}
	}

[gemini-code-assist]

The tag parameter is received directly from the HTTP request body and passed to the container build command. If the tag contains invalid characters or starts with a dash, it can cause the build command to fail with confusing errors or cause argument confusion. It is highly recommended to validate that the tag conforms to standard container image tag format (e.g., matching ^[a-zA-Z0-9_][a-zA-Z0-9_.-]{0,127}$).

Suggested change

	tag := e.tag
	if tag == "" {
	tag = "latest"
	}
	if v := params["tag"]; v != "" {
	tag = v
	}
	tag := e.tag
	if tag == "" {
	tag = "latest"
	}
	if v := params["tag"]; v != "" {
	tag = v
	}
	if tag != "" {
	for _, r := range tag {
	if !((r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9') || r == '_' || r == '.' || r == '-') {
	return fmt.Errorf("invalid tag %q: must only contain alphanumeric characters, underscores, periods, and dashes", tag)
	}
	}
	}

[gemini-code-assist]

The database-backed DiscordPendingLinkStore has been replaced with an in-memory map, and the corresponding test file pkg/hub/discord_link_test.go was deleted. Deleting the test suite entirely reduces test coverage. It is highly recommended to add a new test file to verify the correctness and thread-safety of the new in-memory DiscordLinkService implementation.