fix(daemon): let an installed version stand as its whole code identity - #2569
Open
thymikee wants to merge 1 commit into
Open
fix(daemon): let an installed version stand as its whole code identity#2569thymikee wants to merge 1 commit into
thymikee wants to merge 1 commit into
Conversation
Two installs of one published version signed their identical bytes differently, because the fingerprint is size:mtime and an installer stamps a fresh mtime on every file. The second client therefore read "code-signature mismatch" and replaced a daemon that already ran exactly its code, dropping the live session on it (#2458). An installed tree's version already fixes its bytes, so it now answers with no fingerprint and the version alone decides reuse. A source checkout, where code does move under an unchanged version, keeps the check. The predicate that tells the two trees apart moves beside the project-root walk it shares, and the takeover ladder moves beside the answer it consumes so the order lives in one place. The packaging gate proves the premise against a clean install: the published tree ships no src/daemon.ts. Closes #2458
|
Size Report
Startup median (7 runs, lower is better):
|
Member
Author
|
The signature bypass at daemon-launch-spec.ts:113 only checks the client. With an explicit shared --state-dir, a modified source checkout can start a daemon under the published version, and an installed client now reuses that modified code. #2458 scopes the bypass to both sides being installed. Record the daemon’s code origin or equivalent package identity and bypass fingerprints only for two matching installed versions; add the source-daemon → installed-client case. Checks are green, but this remains a code blocker at 5fef822. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two installs of one published version signed their identical bytes differently: the fingerprint is
size:mtime, and an installer stamps a fresh mtime on every file. The second client readcode-signature mismatch, replaced a daemon already running exactly its code, and dropped the live session on it.An installed tree's version already fixes its bytes, so it now answers with no fingerprint and the version alone decides reuse. A source checkout — where code does move under an unchanged version — keeps the check, and keeps its worktree-scoped state directory. The installed/source predicate moves next to the project-root walk it shares (
@agent-device/host-kit/version), and the takeover ladder moves beside the answer it consumes.Behavior seen by users:
$B devicesno longer printsReplacing daemon ... code-signature mismatchwhen a same-version install started the daemon.website/docs/docs/security-trust.mdstates the residual limit (hand-patchednode_modules, a registry serving one version twice).Touched files: 9 (+288/-53), one command family.
Validation
Commit
5fef822379.pnpm check:quick,check:layering,check:production-exports,check:packagepass; the new packaging assertion ran against a clean install: "Confirmed the installed tree carries no daemon source".pnpm gate vitest-related <changed files>: 539 files / 4224 tests pass.distmtimes shifted: the second client reused pid and reported nothing on stderr. A source-checkout client against the same--state-dirstill printscode-signature mismatchand takes over.info.codeSignature !== await ...compare fails the Same published version installed twice replaces the daemon and drops the live session #2458 reuse test.Unresolved:
mutation-modelfails locally at merge-baseab3d11e069too (gestures.test.tsno longer reachesscroll-edge-state) — advisory-only per #1457, workflow path-filtered away from this diff.