morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #5346] [MERGED] fix(hopper): verify publisher before probing private display #6884

New issue

Closed

opened 2026-11-01 21:43:48 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:43:48 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/5346
Author: @gensokyo-dev
Created: 10/20/2026
Status: ✅ Merged
Merged: 10/20/2026
Merged by: @gensokyo-dev

Base: main ← Head: audit/ci-tests-20261020

📝 Commits (1)

887d641 fix(hopper): verify publisher before probing private display

📊 Changes

3 files changed (+17 additions, -7 deletions)

View changed files

📝 src/hopper/BridgeLauncher.ts (+2 -2)
📝 tests/acceptance/applications/hopperPublisherRejectionCli.test.ts (+9 -3)
📝 tests/boundary/providers/hopper/bridgeLauncher.test.ts (+6 -2)

📄 Description

Summary

An unauthenticated Linux Hopper launcher can report a display-probe failure instead of its publisher rejection. Verify the publisher before probing the private display, retaining display validation for admitted launchers.

Latest main 5fa4defcb failed the public CLI rejection test: the error omitted launch_rejection. Its ordinary local run passes. An unusable display-probe Python reproduces the same missing-field signature; the hosted report does not retain the exact underlying probe fault, so that specific cause remains unknown. No separate issue was opened because this CI run supplies the report.

Change and boundary impact

HopperApplicationLauncher owns the ordering and error priority. Publisher refusal now returns before any display probe; an admitted launcher still probes display before launch.
CLI/MCP schemas, Evidence, native launcher hash checks, expected-digest revalidation, target selection, execution authority and cleanup remain unchanged. No package, installation or generated-metadata changes.
Ordinary correction within the existing provider boundary; a new maintainer capability-scope decision is not applicable.

Validation performed

Unfixed source with the new controls: two failed, 11 passed. An unusable PYTHONHOME masks publisher rejection, and the boundary spy proves display selection runs before refusal. The ordinary control remains present; launcher execution marker stays absent and target bytes remain unchanged.
Corrected source: 177 passed / 12 files, covering the public CLI, publisher/cache verification, private display, Python isolation, startup/cancellation, cleanup and doctor discovery.
Both changed test files: 13 passed, repeated three additional consecutive times. The accepted-launcher runtime control still calls display selection once; the rejected-launcher control calls it zero times.
npm run check: all static, module-boundary and architecture gates passed. The hosted CI checks record the deterministic matrix results for this exact SHA. Greptile reviewed this SHA at 5/5 with no blocking findings. Codex review was unavailable because the repository quota is exhausted; its failure is not a code finding.

Local work is serialized on two CPUs with bounded runtime heaps. Warm prepared 177-case task: 14.0 s elapsed / 21.6 s CPU / 1,040 MiB peak sampled family RSS; static gate: 167.4 s / 283.1 s / 4,781 MiB. RSS sampled every 100 ms can double-count shared pages and miss brief/reparented children; host/cache state is uncontrolled and agent-token cost is unmeasured. No suite speedup is claimed.

Local installed Hopper 6.4.2 requires glibc 2.38 and unavailable Qt libraries on this Debian host. The hosted PR real-Hopper job and the separate unchanged-main job both reach the final owner-exit check and fail identically at real-hopper-owner-exit.mjs:130: process identity could not be revalidated. This exists on the baseline independently of this three-file correction; it is left outside this PR per the requested scope. Complete real-provider qualification is therefore not passing. The independent self-hosted jobs never received a runner; their runs were canceled after retaining both hosted failures. No local macOS qualification is claimed.

Author readiness

Human owner: @gensokyo-dev

The owner explicitly delegated these declarations and authorized opening ready, following CI/review and merging in this session. Codex reviewed the final diff and evidence; independent human review was not observed.

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/5346 **Author:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Created:** 10/20/2026 **Status:** ✅ Merged **Merged:** 10/20/2026 **Merged by:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Base:** `main` ← **Head:** `audit/ci-tests-20261020` --- ### 📝 Commits (1) - [`887d641`](https://github.com/morluto/rea/commit/887d641b8becba8dde6b1f6f046c80de92852332) fix(hopper): verify publisher before probing private display ### 📊 Changes **3 files changed** (+17 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `src/hopper/BridgeLauncher.ts` (+2 -2) 📝 `tests/acceptance/applications/hopperPublisherRejectionCli.test.ts` (+9 -3) 📝 `tests/boundary/providers/hopper/bridgeLauncher.test.ts` (+6 -2) </details> ### 📄 Description ## Summary An unauthenticated Linux Hopper launcher can report a display-probe failure instead of its publisher rejection. Verify the publisher before probing the private display, retaining display validation for admitted launchers. Latest main `5fa4defcb` [failed the public CLI rejection test](https://github.com/morluto/rea/actions/runs/39355960186/job/118411042904): the error omitted `launch_rejection`. Its ordinary local run passes. An unusable display-probe Python reproduces the same missing-field signature; the hosted report does not retain the exact underlying probe fault, so that specific cause remains unknown. No separate issue was opened because this CI run supplies the report. ## Change and boundary impact - `HopperApplicationLauncher` owns the ordering and error priority. Publisher refusal now returns before any display probe; an admitted launcher still probes display before launch. - CLI/MCP schemas, Evidence, native launcher hash checks, expected-digest revalidation, target selection, execution authority and cleanup remain unchanged. No package, installation or generated-metadata changes. - Ordinary correction within the existing provider boundary; a new maintainer capability-scope decision is not applicable. ## Validation performed - Unfixed source with the new controls: **two failed, 11 passed**. An unusable `PYTHONHOME` masks publisher rejection, and the boundary spy proves display selection runs before refusal. The ordinary control remains present; launcher execution marker stays absent and target bytes remain unchanged. - Corrected source: **177 passed / 12 files**, covering the public CLI, publisher/cache verification, private display, Python isolation, startup/cancellation, cleanup and doctor discovery. - Both changed test files: **13 passed**, repeated three additional consecutive times. The accepted-launcher runtime control still calls display selection once; the rejected-launcher control calls it zero times. - `npm run check`: all static, module-boundary and architecture gates passed. The hosted CI checks record the deterministic matrix results for this exact SHA. Greptile reviewed this SHA at **5/5 with no blocking findings**. Codex review was unavailable because the repository quota is exhausted; its failure is not a code finding. Local work is serialized on two CPUs with bounded runtime heaps. Warm prepared 177-case task: **14.0 s elapsed / 21.6 s CPU / 1,040 MiB peak sampled family RSS**; static gate: **167.4 s / 283.1 s / 4,781 MiB**. RSS sampled every 100 ms can double-count shared pages and miss brief/reparented children; host/cache state is uncontrolled and agent-token cost is unmeasured. No suite speedup is claimed. Local installed Hopper 6.4.2 requires glibc 2.38 and unavailable Qt libraries on this Debian host. The hosted [PR real-Hopper job](https://github.com/morluto/rea/actions/runs/39358826865/job/118419906382) and the separate [unchanged-main job](https://github.com/morluto/rea/actions/runs/39359253507/job/118421276676) both reach the final owner-exit check and fail identically at `real-hopper-owner-exit.mjs:130`: `process identity could not be revalidated`. This exists on the baseline independently of this three-file correction; it is left outside this PR per the requested scope. Complete real-provider qualification is therefore **not passing**. The independent self-hosted jobs never received a runner; their runs were canceled after retaining both hosted failures. No local macOS qualification is claimed. ## Author readiness Human owner: @gensokyo-dev The owner explicitly delegated these declarations and authorized opening ready, following CI/review and merging in this session. Codex reviewed the final diff and evidence; independent human review was not observed. - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:43:48 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6884

No description provided.

Rows
Columns