[PR #2499] [MERGED] fix(hopper): stop Linux demo children when the REA owner exits #5276

New issue

Closed

opened 2026-10-31 01:05:23 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:05:23 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2499
Author: @N0zoM1z0
Created: 10/13/2026
Status: ✅ Merged
Merged: 10/13/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/hopper-orphan-lifecycle

📝 Commits (1)

6bf7990 fix(hopper): stop Linux demo children when the REA owner exits

📊 Changes

9 files changed (+412 additions, -9 deletions)

View changed files

📝 docs/installation.md (+13 -6)
📝 scripts/hopper-demo-x11.py (+53 -3)
➕ scripts/lib/real-hopper-owner-exit.mjs (+130 -0)
📝 scripts/verify-real-hopper.mjs (+9 -0)
📝 src/hopper/BridgeLauncher.ts (+3 -0)
📝 tests/boundary/providers/hopper/bridgeLauncher.test.ts (+58 -0)
📝 tests/boundary/providers/hopper/linuxPrivateDisplay.test.ts (+20 -0)
➕ tests/fixtures/hopperLifetimeLaunch.py (+16 -0)
➕ tests/fixtures/hopperOwnerLifetime.py (+110 -0)

📄 Description

After a Linux Hopper demo MCP owner is SIGKILLed, its detached helper continues waiting for Hopper. The vendor singleton forwards later launches into that orphan, so every subsequent native operation exits 75 with license-prompt guidance. This was reproduced with real Hopper 6.4.2 on Ubuntu 24.04, including a successful CLI baseline and a failing different-target analysis after killing only the MCP owner.

Bind the owned Linux helper to REA's private piped stdin. EOF during startup or after bridge readiness unwinds the existing cleanup of its direct Hopper and Xvfb children. The stream accepts both FIFO and libuv Unix socket transports. Add production-boundary tests and real graceful/SIGKILL CLI/MCP recovery checks, with an unrelated Hopper-name sentinel. Clarify the documented macOS document retention and owned Linux demo shutdown behavior.

Fixes #2459.

Validation:

npm run check and npm run docs:check passed.
79 focused Hopper launch, startup, cleanup, lease, restart, and verification tests passed; the final changed Python fixture was rerun through its 12-test boundary file. Both Python suites passed (20 tests).
Real Hopper 6.4.2 demo on Ubuntu 24.04 x64, Node 24.18.0: baseline SIGKILL reproduction fails with exit 75; the patched workflow cleans helper/Hopper/Xvfb after graceful exit and SIGKILL, recovers the stale lease, reopens the same and a different ELF through the CLI, and allows a subsequent MCP session. Token-based process cleanup verification and the unrelated sentinel passed. The new verifier is included in the existing real-Hopper lane.
Codex CLI 0.161.0 connected to the real MCP server, opened /usr/bin/true, listed 86 procedures and returned Evidence. It finished with the session open; afterward no helper/Hopper/Xvfb remained and a different-target CLI analysis succeeded. Temporary copied authentication was removed.
Full npm run verify:hopper:linux was attempted on both the patch and untouched main bb540826d: both fail at the same existing fixture omitted its real long literal assertion in verifySearchModes. The focused real owner-exit verifier passed independently; this PR does not claim a full real-Hopper lane pass. Licensed Hopper, macOS, WSL, and the user/mount namespace fallback were not exercised on a real provider.

Already orphaned applications from older REA versions still require closing manually. SIGKILL can retain private runtime files; subsequent sessions recover the lease after the helper finishes child cleanup. The change prevents the recurring singleton wedge without adopting or signaling unrelated applications.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2499 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/13/2026 **Status:** ✅ Merged **Merged:** 10/13/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/hopper-orphan-lifecycle` --- ### 📝 Commits (1) - [`6bf7990`](https://github.com/morluto/rea/commit/6bf79906a9e28f53424bf7df23325b43d348ddbe) fix(hopper): stop Linux demo children when the REA owner exits ### 📊 Changes **9 files changed** (+412 additions, -9 deletions) <details> <summary>View changed files</summary> 📝 `docs/installation.md` (+13 -6) 📝 `scripts/hopper-demo-x11.py` (+53 -3) ➕ `scripts/lib/real-hopper-owner-exit.mjs` (+130 -0) 📝 `scripts/verify-real-hopper.mjs` (+9 -0) 📝 `src/hopper/BridgeLauncher.ts` (+3 -0) 📝 `tests/boundary/providers/hopper/bridgeLauncher.test.ts` (+58 -0) 📝 `tests/boundary/providers/hopper/linuxPrivateDisplay.test.ts` (+20 -0) ➕ `tests/fixtures/hopperLifetimeLaunch.py` (+16 -0) ➕ `tests/fixtures/hopperOwnerLifetime.py` (+110 -0) </details> ### 📄 Description After a Linux Hopper demo MCP owner is SIGKILLed, its detached helper continues waiting for Hopper. The vendor singleton forwards later launches into that orphan, so every subsequent native operation exits 75 with license-prompt guidance. This was reproduced with real Hopper 6.4.2 on Ubuntu 24.04, including a successful CLI baseline and a failing different-target analysis after killing only the MCP owner. Bind the owned Linux helper to REA's private piped stdin. EOF during startup or after bridge readiness unwinds the existing cleanup of its direct Hopper and Xvfb children. The stream accepts both FIFO and libuv Unix socket transports. Add production-boundary tests and real graceful/SIGKILL CLI/MCP recovery checks, with an unrelated Hopper-name sentinel. Clarify the documented macOS document retention and owned Linux demo shutdown behavior. Fixes #2459. Validation: - `npm run check` and `npm run docs:check` passed. - 79 focused Hopper launch, startup, cleanup, lease, restart, and verification tests passed; the final changed Python fixture was rerun through its 12-test boundary file. Both Python suites passed (20 tests). - Real Hopper 6.4.2 demo on Ubuntu 24.04 x64, Node 24.18.0: baseline SIGKILL reproduction fails with exit 75; the patched workflow cleans helper/Hopper/Xvfb after graceful exit and SIGKILL, recovers the stale lease, reopens the same and a different ELF through the CLI, and allows a subsequent MCP session. Token-based process cleanup verification and the unrelated sentinel passed. The new verifier is included in the existing real-Hopper lane. - Codex CLI 0.161.0 connected to the real MCP server, opened `/usr/bin/true`, listed 86 procedures and returned Evidence. It finished with the session open; afterward no helper/Hopper/Xvfb remained and a different-target CLI analysis succeeded. Temporary copied authentication was removed. - Full `npm run verify:hopper:linux` was attempted on both the patch and untouched main `bb540826d`: both fail at the same existing `fixture omitted its real long literal` assertion in `verifySearchModes`. The focused real owner-exit verifier passed independently; this PR does not claim a full real-Hopper lane pass. Licensed Hopper, macOS, WSL, and the user/mount namespace fallback were not exercised on a real provider. Already orphaned applications from older REA versions still require closing manually. SIGKILL can retain private runtime files; subsequent sessions recover the lease after the helper finishes child cleanup. The change prevents the recurring singleton wedge without adopting or signaling unrelated applications. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:05:23 +00:00