[Epic] 1953-epic-desktop-transport-api - #1976
Draft
propr-dev[bot] wants to merge 319 commits into
Draft
Conversation
added 30 commits
August 29, 2026 21:28
![propr-dev[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
…ing: Implemented all four blockers on `ba9795f7` without committing: - Unified ProfileStore mutations under one serialized queue, eliminating lock inversion. - Enforced immediate pairing deadline/cancellation rejection with post-await lifetime checks. - Scoped authorization events and socket reconnects to the captured profile generation, with cleanup listener detachment. - Applied atomic exact-current credential deletion across stale pairing, invalidation, revoke, origin-change, and probe cleanup paths. Validation passed: - Final full suite: 321 non-live files plus native UI suite; 506 UI tests. - Client, desktop, UI focused tests and typechecks. - Production UI build. - Linux desktop package. - `git diff --check`. Packaged smoke was attempted but blocked by the unprivileged environment: Electron requires a root-owned mode-4755 `chrome-sandbox`. The smoke correctly refused to disable sandboxing. PR: #1977 Comment by: @integry (ID: 5464765371) Model: gpt-5.6-sol
Fixed PR #1988’s build blockers: - Restored correct URL warning classification in [runtimeConfig.ts](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-08-29T21-22-36/propr-ui/src/config/runtimeConfig.ts:100). - Compacted the Connect verification markup in [DesktopExperience.tsx](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-08-29T21-22-36/propr-ui/src/desktop/DesktopExperience.tsx:96) to satisfy the 400-line lint limit. Verified: - Failing CI regression: 66/66 passed - Focused UI/desktop tests: 88/88 passed - Client tests: 17/17 passed - UI typecheck, lint, and production build passed - Notification regression stage passed - Browser smoke tests: 4/4 passed - CLI package verification passed - `git diff --check` passed No commit was created. PR: #1988 Comment by: @github-actions[bot] (ID: 5464959244) Model: gpt-5.6-sol
…covery contr Implemented by ProPR AI using gpt-5.6-sol model. Implementation completed successfully.
…p/git-processor/worktrees/integry/propr/pr-1989-followup-2026-08-29T21-41-13/propr-ui/src/config/runtimeConfig.ts:121). Fixed PR #1989’s build regression in [runtimeConfig.ts](/tmp/git-processor/worktrees/integry/propr/pr-1989-followup-2026-08-29T21-41-13/propr-ui/src/config/runtimeConfig.ts:121). The UI now trims redundant trailing slashes before strict proxy URL validation, while continuing to reject paths, queries, fragments, ports, and userinfo. Validation passed: - Exact hosted-tunnel regression suite: 317/317 - UI tests: 66/66 - UI typecheck - UI lint - `git diff --check` Only the requested file was modified; no commit was created. PR: #1989 Comment by: @github-actions[bot] (ID: 5465042091) Model: gpt-5.6-sol
…release-security files. Implemented all four follow-ups without modifying F5–F8 or release-security files. - Enforced explicit, format-aware DEB/RPM payload and launcher layouts in [release-architecture.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T21-27-10/apps/desktop/scripts/release-architecture.mjs). - Added focused layout rejection tests in [release-architecture.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T21-27-10/apps/desktop/scripts/release-architecture.test.mjs). - Normalized workflow text and added CRLF matrix coverage. - Extracted the connected-experience render helper; UI lint now passes with zero warnings. - Updated tag-triggered preflight/environment documentation. Validation passed: - `git diff --check` - actionlint 1.7.12 - UI lint with `--max-warnings 0` - Desktop/UI typechecks - Desktop tests: 84 passed - UI tests: 501 passed - Real Linux x64 DEB/RPM/ZIP make - Real archive inspection and architecture-verified staging - Executable/fuse smoke inspection Full GUI smoke was attempted but this unprivileged container cannot configure `chrome-sandbox` as root-owned mode `4755` and disallows user namespaces; Electron correctly failed closed. The native Linux jobs perform that setup. The full six-target native matrix remains for CI on the new head. PR: #1972 Comment by: @integry (ID: 5464979817) Model: gpt-5.6-sol
…acee1a376ee827`. Implemented F4–F7 on exact head `b21fdf134a0b56166fa2f520f9acee1a376ee827`. Key changes: - Main-only monotonic probe tickets and fresh 128-bit opaque transport scopes per activation. - Scope-bound REST and Socket.IO authentication with stale/malformed cancellation, header stripping, force-new Managers, and preflight handling. - Authenticated attachment blob URLs with abort and guaranteed revocation. - Exact transient credential cleanup after cancellation/failure. - Atomic local profile/credential detachment before best-effort revocation, protecting later replacements. - Added race, rotation, header, socket, CORS, attachment, F6, and F7 regressions. Validation passed: - Desktop: 41 tests and typecheck. - UI: 509 tests, typecheck, lint, and production build. - Client: 24 tests and typecheck. - Remote-auth/CORS/socket/status: 59 tests. - Linux production desktop package. - Root typecheck. - `git diff --check`. Environmental limitations: - Full serial suite reached 172/322 with no failures, then blocked because `redis-server` is not installed. - Packaged smoke could not run securely because the host lacks root-owned mode-4755 `chrome-sandbox` setup and `xvfb-run`. Sandboxing was not bypassed. No commit was created. PR: #1977 Comment by: @integry (ID: 5465095640) Model: gpt-5.6-sol
Implemented F1 only. - Noncanonical reserved Connect URLs—including explicit `:443` and percent-encoded hosts—now fail before pairing creation. - Returns bounded `PAIRING_CONFIGURATION_INVALID` / HTTP 503 without reflecting configured input. - Valid Connect, arbitrary HTTPS remotes, lookalikes, and loopback behavior remain unchanged. - Added regressions confirming no pairing row is persisted. Changed [desktopAuthService.ts](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-08-29T22-14-16/packages/api/desktopAuthService.ts:152) and [desktopAuth.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-08-29T22-14-16/packages/api/test/desktopAuth.test.ts:101). Verification passed: - 67 Connect/client/API tests - 24 desktop tests - 96 runtime-config/desktop UX tests - 10 launcher drift tests - Affected typechecks and API lint - CLI release-package guard - `git diff --check` The full 321-file suite reached 176 files before hanging because Redis is unavailable at `127.0.0.1:6379`; it was stopped after repeated connection failures. No merge, base sync, commit, or PR creation was performed. PR: #1988 Comment by: @integry (ID: 5465187212) Model: gpt-5.6-sol
…Image.test.tsx](/tmp/git-processor/worktrees/integry/propr/pr-1977-followup-2026-08-29T22-27-43/propr-ui/src/components/TaskPlanner/AuthenticatedAttachmentImage.test.tsx:39). Fixed the TypeScript regression in [AuthenticatedAttachmentImage.test.tsx](/tmp/git-processor/worktrees/integry/propr/pr-1977-followup-2026-08-29T22-27-43/propr-ui/src/components/TaskPlanner/AuthenticatedAttachmentImage.test.tsx:39). The test now captures the signal in a typed collection, explicitly fails if absent, and verifies it is aborted after scope rotation—without a signal cast or assertion. Passed: - `npm run desktop:prepare` - `npm run typecheck -w propr-ui` - Focused authenticated attachment test: 2/2 passed - `git diff --check` Only the requested test file changed. HEAD remains `66cd848f7e91fd09b3376aed7a371fb2a948d90b`; no merge or base sync performed. PR: #1977 Comment by: @integry (ID: 5465242965) Model: gpt-5.6-sol
…itting. Implemented F9–F11 on the exact requested head without committing. - F9: Added a protected `desktop-release-preflight` environment, SHA-pinned GitHub App token action, explicit Administration/Contents read-only permissions, isolated preflight credentials, fail-closed bypass inspection, API-shaped tests, workflow assertions, and operator documentation. - F10: ZIP/NUPKG validation now checks every entry, local/central consistency, CRC, paths, collisions, overlaps, encryption, metadata limits, and canonical executable locations. DMGs require the exact application bundle layout. Windows Authenticode inspection now uses the canonical NUPKG executable. - F11: RELEASES parsing now requires the complete exact full-NUPKG set and verifies SHA-1 plus decimal size during staging, finalization, and signing. Validation passed: - actionlint - 93 desktop tests - 501 UI tests - Desktop and UI typechecks - Runtime and packaging audits: zero vulnerabilities - Linux production package and fuse inspection - Strict validation of a ZIP built from the real packaged Linux application - `git diff --check` Environment limitations: - Forge DEB/RPM/ZIP make is blocked by missing system tools: `dpkg`, `fakeroot`, `rpm/rpmbuild`, `cpio`, and `zip`. - The full suite reached 191/328 files without assertion failures, then blocked because Redis is not installed. - The six native CI jobs remain intact for rerun. - Windows thumbprint-policy changes were not included because the scope gate selected F9–F11 only. PR: #1972 Comment by: @integry (ID: 5465175214) Model: gpt-5.6-sol
Implemented all selected blockers F1–F7. Key results: - Root access now uses one synchronous, descriptor-anchored, identity-checked snapshot; replacements and unsafe ancestry fail with `INVALID_ROOT`. Windows semantics fail closed when authority cannot be proven. - CLI/API identity creation is centralized, permission-checked, atomic, durable, concurrency-safe, and interruption-recoverable. - Discovery v1 parsing is strict and shared between producer and consumer. - Every rejected/timeout response body is cancelled; invalid, unreachable, and timeout exit classes are separated correctly. - Tunnel setup again normalizes redundant trailing slashes before strict validation. - Added packaged CLI, replacement, concurrency, interruption, body-stream, schema, and Unix/Windows-semantics regressions. - Updated desktop-pairing documentation. - No commit or PR operations performed. Verification: - Focused CLI/API/shared/tunnel/launcher/hosted-UI tests: passed. - Packaged CLI integration tests: passed. - Typechecks and lint: passed. - CLI package guard (`npm run cli:pack`): passed. - `git diff --check`: passed. - Full suite: 322/323 runners passed; all 69 UI files and 496 UI tests passed. The sole exception was the pre-existing Redis-backed `llmMetrics.test.ts`, which timed out because Redis and a Docker daemon are unavailable in the agent image. PR: #1989 Comment by: @integry (ID: 5465164512) Model: gpt-5.6-sol
…c0e83b082c4c75d8ac8894cd947aeb1`. Implemented the remaining blockers on exact head `0b7c2961ac0e83b082c4c75d8ac8894cd947aeb1`. Key changes: - Strict raw Connect shorthand validation; credentials, ports, encoding, Unicode, paths, whitespace, alternate casing, trailing dots, and lookalikes are rejected before flow persistence. - Reserved `t-*.propr.dev` attempts can no longer downgrade to generic HTTPS pairing/client behavior. - Malformed runtime configuration is bounded and redacted. The API client is constructed only after successful validation, otherwise a safe configuration screen renders. - Desktop logs, IPC errors, DOM messages, and profile presentation avoid raw endpoints and failure details. - Added managed-tunnel stale/restart recovery with Retry, Re-enter, Rediscover, and explicit confirmation before replacing a profile. - Added a secret-free optional rediscovery adapter seam. - Formal F1 API files were not modified. Validation passed: - Client/shared pairing: 20 tests - API desktop-auth/status: 39 tests - Desktop/Electron: 24 tests - Full UI: 507 tests across 70 files - Root, client, UI, and desktop typechecks - Root and UI lint - CLI package guard - `git diff --check` The repository-wide runner reached 175/321 files, then hung on Redis-dependent tests because neither Redis nor Docker is available. A resumed run encountered the same environment blocker at `llmMetrics.test.ts`. All affected and independently runnable suites pass. No commit, merge, sync, or PR operation was performed. PR: #1988 Comment by: @integry (ID: 5465256401) Model: gpt-5.6-sol
…ithout syncing, merging, or committing. Implemented the requested exact-head fixes on `1c42418a…` without syncing, merging, or committing. Key changes: - Status-only probes with bounded, one-use activation tickets and atomic main-process activation. - Profile origin updates and credential detachment serialized before best-effort revoke. - Failure-safe profile removal for corrupt/decrypt/unlink/state-write scenarios. - SocketProvider now reacts to scope and API-origin changes, with proper desktop null-scope behavior and full Manager teardown. - Realistic packaged-origin CORS preflight coverage while retaining malformed OPTIONS tests. Verification passed: - Desktop, UI, client, and API typechecks - Desktop suite: 51 tests - Client suite: 24 tests - API auth/socket/CORS/attachment suite: 38 tests - Full configured UI suite: 513 tests - UI lint: no errors - Runtime and packaging audits: zero vulnerabilities - Clean-dependency desktop package guard and production Linux package - API production build - `git diff --check` Unavailable locally: - Secure packaged smoke: `xvfb-run` is absent. - Root full suite: 173/322 tests passed before Redis-dependent execution; neither Redis nor Docker is installed in the container. PR: #1977 Comment by: @integry (ID: 5465267002) Model: gpt-5.6-sol
…c1e0` follow-up without merging, syncing, or committing. Implemented the exact `ef737aacf73c77e4fa6c8a6d59dc3e5a16bbc1e0` follow-up without merging, syncing, or committing. Key changes: - Hardened DMG layout validation and added realistic Electron helper/install-link fixtures. - Added canonical Windows certificate/SPKI SHA-256 allowlists, signer equality checks, timestamp/chain validation, evidence propagation, and runtime enforcement. - Added missing, malformed, same-subject/different-key, mixed-signer, and tamper tests. - Preserved macOS Team ID/designated-requirement behavior and F9–F11. Passing locally: - Desktop typecheck - 97 desktop tests - 51 focused release/security tests - Runtime and packaging audits: 0 vulnerabilities - Linux package build and executable/fuse inspection - MJS syntax checks - `git diff --check` Host-limited gates: - Linux makers lack `fakeroot`, RPM, and ZIP tools. - Full suite reached 191/328 without failures, then stalled because Redis is unavailable. - Actionlint and six native matrix/aggregate finalization require CI; Docker and native runners are unavailable locally. No unrelated files changed. PR: #1972 Comment by: @integry (ID: 5465401089) Model: gpt-5.6-sol
…g head without merging, syncing, or committing. Implemented the remaining A–D blockers on the exact existing head without merging, syncing, or committing. Key fixes: - Hermetic explicit-root discovery with robust `--root` parsing and a minimal non-ProPR environment allowlist. - Docker execution failures now produce `internalFailure`/exit 1; exit 2 is reserved for proven not-ready states. - No-store headers apply at the earliest `/api` boundary, including limiter and error responses. - Strict raw Connect selector validation and consistent case normalization across shared, API, UI, CLI, and launcher paths. - Added packaged hostile-CWD/env CLI tests, Docker failure regressions, real global limiter saturation, and selector parity tests. Validation passed: - CLI/API/shared/UI typechecks - CLI/API/UI lint - Focused CLI, API, pairing, tunnel, rate-limit, and UI tests - CLI packaging - `git diff --check` The configured full suite passed 322/323 runs. The sole failure was the unrelated Redis-dependent `test/llmMetrics.test.ts`, which timed out while Redis at `127.0.0.1:6379` was unavailable. PR: #1989 Comment by: @integry (ID: 5465371272) Model: gpt-5.6-sol
…re.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T23-31-51/apps/desktop/scripts/release-architecture.test.mjs:203). Implemented the narrow test-only fix in [release-architecture.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T23-31-51/apps/desktop/scripts/release-architecture.test.mjs:203). - Split hostile DMG scenarios into independent tests and cleanup hooks. - Skip case-collision validation only when the filesystem returns `EEXIST`; unexpected errors still fail. - Production DMG validation, Windows signer-pin logic, workflows, and base remain untouched. Validation passed: - Focused architecture tests: 12/12 - Linux desktop suite: 101/101 - Desktop typecheck - Validate Changes’ Redis-free stages: release verification, 278 unit tests, 316 tunnel tests, 66 UI tests, CLI packaging - [actionlint v1.7.12](https://github.com/rhysd/actionlint/releases/tag/v1.7.12) - `git diff --check` The full suite reached 187/328 before Redis-dependent tests retried against unavailable Redis; this host has neither Redis nor Docker. The six native packaging jobs and native macOS x64/arm64 runs require CI runners and remain pending after the system commits the change. PR: #1972 Comment by: @integry (ID: 5465506808) Model: gpt-5.6-sol
…a03e6ce26429f7d6846286` without merging, syncing, or committing. Implemented the exact-head follow-up on `38cdf456a090b8e252a03e6ce26429f7d6846286` without merging, syncing, or committing. Key changes: - Enforced atomic profile/requested/credential origin equality in [credential-service.ts](/home/node/workspace/apps/desktop/src/credential-service.ts) and [profile-store.ts](/home/node/workspace/apps/desktop/src/profile-store.ts), including stale detachment and delayed activation-race coverage. - Bound renderer activation to the main-returned `profileId`; mismatches become authentication-required and never publish a scope. - Restored authorization reconnect and stale deferred SocketProvider regressions. - Split [DesktopExperience.tsx](/home/node/workspace/propr-ui/src/desktop/DesktopExperience.tsx) to 289 lines and [DesktopExperience.test.tsx](/home/node/workspace/propr-ui/src/desktop/DesktopExperience.test.tsx) to 390 lines, without weakening lint. Validation passed: - Focused desktop: 55 tests - Focused adapter/apiClient/SocketProvider/UI: 58 tests - Full UI: 517 tests - UI lint, typecheck, and production build - Desktop typecheck and Linux production package - `git diff --check` The configured full suite completed 167/322 serial files without failures, then blocked indefinitely on file 168 because Redis was unavailable at `127.0.0.1:6379`; neither `redis-server` nor Docker is installed in this environment. PR: #1977 Comment by: @integry (ID: 5465456632) Model: gpt-5.6-sol
…g or syncing the transport base. Implemented the exact-head Connect follow-up without merging or syncing the transport base. - Enforced byte-for-byte canonical Connect origins across shared, client, API, Electron, hosted UI, CLI, and launcher paths. Reserved nested/lookalike hosts cannot fall through as generic remotes. - Removed renderer discovery fallback from managed recovery. Trusted rediscovery now requires current-attempt fencing, matching opaque profile ID, strict endpoint validation, and explicit confirmation. - Added bounded/redacted confirmation copy and deterministic recovery regressions. - Split the affected UI modules to eliminate all six lint warnings without changing lint configuration. Verification: - Connect suites: passed - UI lint, typecheck, build: passed - Desktop typecheck and Electron package: passed - `git diff --check`: passed - Full suite: 320/321 runs passed; only `test/llmMetrics.test.ts` timed out waiting for Redis at `127.0.0.1:6379`, which is unavailable in this environment. No commit was created. PR: #1988 Comment by: @integry (ID: 5465471435) Model: gpt-5.6-sol
…c5d0745785c4a43808d944764c6f0b00`; no base sync or merge. Implemented the two requested fixes on exact head `fb14a297c5d0745785c4a43808d944764c6f0b00`; no base sync or merge. - [release-architecture.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T23-49-00/apps/desktop/scripts/release-architecture.mjs:332) now permits only bounded, strict-UTF-8 symlinks inside canonical macOS `.framework` internals. Resolution rejects traversal, cycles, missing/case-mismatched targets, alternate apps, helpers, canonical executables, duplicates, and all other special files—after ZIP metadata, size, CRC, overlap, and decompression validation. - [release-artifacts.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T23-49-00/apps/desktop/scripts/release-artifacts.test.mjs:505) covers the real Electron framework link topology and all requested hostile cases. - [release-architecture.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T23-49-00/apps/desktop/scripts/release-architecture.test.mjs:135) skips only the filesystem-backed DMG suite on Windows. Production `/Applications` validation is unchanged. - [release-workflow.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T23-49-00/apps/desktop/src/release-workflow.test.ts:149) proves both macOS architectures run the complete suite unconditionally. Passed locally: - Desktop typecheck and all 104 desktop tests - Focused archive/workflow tests - Windows-platform simulation confirms only the DMG suite skips - Desktop audits: zero vulnerabilities - Validate Changes host-runnable stages: release verification, 278 unit tests, 316 tunnel regressions, 66 UI tests, CLI package - Actionlint 1.7.12 from the [official releases](https://github.com/rhysd/actionlint/releases) - `git diff --check` Native six-target packaging/staging and real Forge DMG confirmation remain CI-only. This host lacks macOS/Windows runners, Docker/Redis, and Linux maker utilities without sudo. The full suite reached 190/328 files green before Redis-dependent tests blocked on `ECONNREFUSED`. The cached real Electron 44 Darwin ZIP confirms the accepted framework link payloads exactly. PR: #1972 Comment by: @integry (ID: 5465582041) Model: gpt-5.6-sol
Implemented only F8 and F9. - F8: successful A→B activation now clears renderer local/session storage before publishing the new scope, including same-origin switches. - F9: pairing uses proposed profile data without modifying the stored profile. Profile and credential commit transactionally after successful pairing; failures preserve the prior active profile, credential, and connection. Old tokens are revoked only after replacement commit. - Added regressions for browser-launch failure, cancellation, expiry, polling failure, secure-storage failure, commit/revoke ordering, and same-origin renderer isolation. Verification passed: - Desktop full test suite: 61 tests - Desktop typecheck - UI Electron adapter tests - UI typecheck and lint - `git diff --check` No commit was created. PR: #1977 Comment by: @integry (ID: 5465624544) Model: gpt-5.6-sol
Implemented only F2 and F3. - Hosted API client creation is now blocked for missing or non-Connect configurations, while OAuth completion remains exempt: [runtimeConfig.ts](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-08-30T00-13-37/propr-ui/src/config/runtimeConfig.ts:350). - Approval URLs now require canonical raw query names and values, rejecting encoded names/hosts: [desktopPairing.ts](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-08-30T00-13-37/packages/shared/src/desktopPairing.ts:57). - Added API-client gating and cross-contract encoding regressions. Verification passed: - Shared build - Client tests: 21 passed - UI tests: 66 passed - UI typecheck and targeted lint - `git diff --check` PR: #1988 Comment by: @integry (ID: 5465683890) Model: gpt-5.6-sol
…dc54004bb279e1` without merging, syncing, or committing. Implemented F8/F9 on exact head `f491eb7137cd9ff0b36b1e2c90dc54004bb279e1` without merging, syncing, or committing. Key changes: - [profile-store.ts](/tmp/git-processor/worktrees/integry/propr/pr-1977-followup-2026-08-30T00-17-19/apps/desktop/src/profile-store.ts) now uses immutable encrypted credential slots and one atomic versioned state pointer, with fsync ordering, legacy migration, startup recovery, orphan cleanup, and fail-closed validation. - Added injected durability failures, concurrent replacement, legacy migration, and real SIGKILL child-process recovery tests proving complete A or complete B. - [electronAdapters.ts](/tmp/git-processor/worktrees/integry/propr/pr-1977-followup-2026-08-30T00-17-19/propr-ui/src/desktop/electronAdapters.ts) now clears renderer storage only after exact-profile, current-attempt activation validation. - Mismatch, throw, stale activation, failed edits/pairing, and probing clear nothing. Clear failures restore sentinels, discard the main activation, publish no B scope, and return a fixed safe error. - Added a scoped activation-discard IPC path without removing the credential. Passed: - Desktop suite: 64 tests - UI isolation suites: 62 tests - UI and desktop typechecks - UI lint and production build - Linux desktop package - `git diff --check` - Exact-head verification The configured full suite was attempted and passed all tests reached, but the Redis-dependent portion blocked on `ECONNREFUSED 127.0.0.1:6379`; this environment has neither Redis nor Docker available. PR: #1977 Comment by: @integry (ID: 5465699420) Model: gpt-5.6-sol
Implemented only F4, F5, and F6: - Added the 2048-character guard before parsing `API_PUBLIC_URL` in [desktopAuthService.ts](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-08-30T00-37-29/packages/api/desktopAuthService.ts:156). - Detects decoded `tunnel` parameter names such as `%74unnel`, blocking stored/configured fallback in [hostedTunnelConfig.ts](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-08-30T00-37-29/propr-ui/src/config/hostedTunnelConfig.ts:42). - Connect pairing errors now apply only to authentication; help-launch failures retain the bounded help-specific message in [DesktopExperience.tsx](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-08-30T00-37-29/propr-ui/src/desktop/DesktopExperience.tsx:221). - Added focused regressions for all three findings. Verification passed: - API pairing suite: 8 tests - Focused UI suites: 82 tests - Desktop experience suite: 22 tests - API and UI typechecks - API and UI lint - `git diff --check` No commit was created. PR: #1988 Comment by: @integry (ID: 5465785343) Model: gpt-5.6-sol
…t `f088817cd9fc95581ffe665fcdceaf2064779c41`; no merge, sync, or commit performed. Implemented only the aggregate DMG finalization fix on exact `f088817cd9fc95581ffe665fcdceaf2064779c41`; no merge, sync, or commit performed. - Native macOS staging now mounts and validates final DMG bytes before emitting strict versioned evidence. - Linux aggregation verifies hashes, sizes, bindings, and Mach-O bytes while relying exclusively on native evidence for DMG filesystem semantics. - Added all requested tampering, cross-target, schema, duplicate, marker, sanitized-7z, and workflow regressions. - Existing signer pins, ZIP/NUPKG validation, publication permissions, and runtime verification remain unchanged. Key files: [release-artifacts.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T00-21-53/apps/desktop/scripts/release-artifacts.mjs), [release-architecture.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T00-21-53/apps/desktop/scripts/release-architecture.mjs), [desktop-release-guard.yml](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T00-21-53/.github/workflows/desktop-release-guard.yml). Validation passed: - Desktop tests: 110/110 - Desktop typecheck - Validate Changes command set, including 278 fast tests and hosted-tunnel regressions - Full Suite: all 328 suites/files - Exact SHA-pinned actionlint - Sixteen-artifact `SHA256SUMS` verification - `git diff --check` The six real native package jobs require the post-commit CI matrix; this Linux runner cannot execute macOS and Windows native packaging. PR: #1972 Comment by: @integry (ID: 5465718687) Model: gpt-5.6-sol
…1b65ba6bc09e7e8edbc4c9ef418b12d436980` without merging, syncing, or committing. Implemented all seven follow-up blockers on exact HEAD `c551b65ba6bc09e7e8edbc4c9ef418b12d436980` without merging, syncing, or committing. Key outcomes: - Real fail-closed Windows DACL/reparse-point and macOS ACL authority checks with deterministic fixtures. - Crash-remnant identity recovery and strictly bounded, revalidated reads. - Abort-before-listener race closed with exact cleanup. - Root-specific persisted tunnel overrides restored through read-only config access. - Noncanonical managed URL spellings rejected across launcher, shared, API, CLI, and hosted UI boundaries. - Validated Docker transport environment forwarding with redacted failures. - Clean-checkout unit preparation now builds required workspaces first. Validation passed: - Clean `npm ci` and 281 fast unit tests. - Exact full suite: all 322 non-live files plus UI workspace; 497 UI tests. - 321 hosted-tunnel tests and focused identity/discovery regressions. - Node 22 and 24 CLI matrices. - Desktop audits, clean package build, typecheck, and 24 runtime tests. - CLI package dry run, API/CLI/UI builds, typechecks, and zero-warning lint. - Actionlint, release shellcheck, release metadata, and `git diff --check`. The packaged GUI launch smoke was unavailable because this host lacks Xvfb/root sandbox-helper setup; desktop packaging and runtime coverage passed. PR: #1989 Comment by: @integry (ID: 5465520611) Model: gpt-5.6-sol
…0fcc8cc9e2070921e0ffbc79a3e2b004c89da89`. Implemented the two requested DMG blockers on exact head `20fcc8cc9e2070921e0ffbc79a3e2b004c89da89`. - Added strict pre/post DMG identity, metadata, size, and SHA-256 verification around native inspection in [release-artifacts.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T00-53-41/apps/desktop/scripts/release-artifacts.mjs:160). - Hardened mounted layouts to allow only bounded framework-internal symlinks and require real canonical bundle/executable ancestors in [release-architecture.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T00-53-41/apps/desktop/scripts/release-architecture.mjs:803). - Added mutation/replacement, helper symlink, ancestor symlink, non-framework, escape/cycle/missing/case, real Electron framework, and complete SHA256SUMS regressions. Passed locally: - Focused staging/layout: 39/39 - Desktop suite: 115/115 - Desktop typecheck - Fast validation unit set: 278/278 - Release metadata verification - ESLint on all touched files - `git diff --check` Native macOS mounts, six native packaging jobs, full Redis-backed suite, and pinned-container actionlint require CI runners unavailable in this Linux environment. No commit was created; signer pins, evidence schema, six-target matrix, and Linux finalization remain unchanged. PR: #1972 Comment by: @integry (ID: 5465850564) Model: gpt-5.6-sol
…yncing, or committing. Implemented the exact-head DMG follow-up without merging, syncing, or committing. Key changes: - DMG validation now uses a private `O_RDONLY | O_NOFOLLOW` held capability; inspectors receive no mutable pathname. - `hdiutil` and Linux aggregate 7-Zip inspection read inherited `/dev/fd/3`. - Pre/post checks retain device, inode, mode, link count, size, and SHA-256 while excluding ctime/mtime. - Validated bytes are copied through private `O_EXCL` publication temps, atomically published, and revalidated. - Added swap/restore, permanent replacement, in-place mutation, and native xattr/ctime regressions. - Added fail-closed descriptor-backed `hdiutil` probes to both macOS matrices while preserving all six targets and evidence schema. Changed files include [release-artifacts.mjs](/home/node/workspace/apps/desktop/scripts/release-artifacts.mjs), [release-architecture.mjs](/home/node/workspace/apps/desktop/scripts/release-architecture.mjs), and [desktop-release-guard.yml](/home/node/workspace/.github/workflows/desktop-release-guard.yml). Passed locally: - Focused artifact/layout tests: 40 passed, native xattr fixture skipped on Linux - Desktop suite: 116 passed, 1 native-only skip - Desktop typecheck - Aggregate finalization/SHA256SUMS tests - Validate Changes components, fast unit tests, hosted-tunnel regressions, and CLI package verification - actionlint - `git diff --check` Full Suite reached 191/328 with changes green, then blocked because this host lacks the CI Redis/Docker service. Native macOS x64/arm64 mount probes and the six native packaging jobs require their CI runners. PR: #1972 Comment by: @integry (ID: 5465939422) Model: gpt-5.6-sol
…out merging, syncing, or committing. Implemented the remaining discovery authority blockers without merging, syncing, or committing. Key changes: - Docker discovery now filters by exact `propr.stack`, rejects duplicate/unknown labeled containers, and retains the 64 KiB cap. - Docker receives only strictly validated bootstrap, home/context, SSH, and documented Docker variables. - Windows ACL inspection now reads owner/DACL/reparse metadata from the same native handle; macOS ACL inspection uses the pinned descriptor. - Identity and `READY` entries receive consistent native authority validation, including recovery and publication paths. - Persisted tunnel state now uses a bounded, handle-pinned OS-home read with platform-canonical root keys and fixed fail-closed errors. - Added real Windows/macOS authority CI coverage in [pr-build-check.yml](/tmp/git-processor/worktrees/integry/propr/pr-1989-followup-2026-08-30T00-57-36/.github/workflows/pr-build-check.yml). - Exit semantics now match the request: ready/not-ready `0`, internal/config failure `1`, unsupported/incompatible `2`. Validation completed successfully: - Clean `npm ci`, release verification, fast-unit and hosted-tunnel validation - Focused root, identity, discovery, CLI, API, and orchestrator suites - CLI package, typecheck, and lint - Desktop audits, package, typecheck, and 24 runtime tests - UI full suite: 497 tests passed - `git diff --check` The aggregate full suite passed 322/324 file runs. One Redis-dependent test timed out because Redis is unavailable locally; the other transient repository-manager failure passed its isolated rerun (9/9). Native Windows/macOS jobs, actionlint, and packaged GUI smoke remain CI-only because this Linux runner lacks those OSes, Docker/actionlint, and `xvfb-run`. PR: #1989 Comment by: @integry (ID: 5465866322) Model: gpt-5.6-sol
…30d30c7b9a2ab7024f8932fa2f` without merging, syncing, or committing. Implemented all four blockers on exact head `8897926a40fe7030d30c7b9a2ab7024f8932fa2f` without merging, syncing, or committing. - Added credential identity epochs through [profile-store.ts](/home/node/workspace/apps/desktop/src/profile-store.ts), activation IPC, and [electronAdapters.ts](/home/node/workspace/propr-ui/src/desktop/electronAdapters.ts). Real identity replacement clears local/session storage once; reconnecting the same credential retains it. - Added alternating write-through, self-contained encrypted journals with recovery for pointer rollback, reordered visibility, corrupt/missing slots, and every credential/state boundary. - Persisted bounded pending revocations atomically with B. Startup and pre-mutation retries retain network/5xx failures, terminally complete 2xx/401/404, and emit only redacted diagnostics. - Serialized cancellation/profile switching through the publish gate, with deterministic pre-publish race coverage. - Added native Windows child termination/restart tests plus real-process revocation crash fixtures. Validation passed: - Configured Full Suite: all 321 non-live files plus UI workspace passed in 501.7s. - Desktop tests/typecheck/package. - UI tests, focused renderer/isolation/SocketProvider tests, typecheck, lint, and build. - Client, IPC/preload, API client, hosted-tunnel, notification, CLI packaging, release verification, and fast unit suites. - `git diff --check`. Environment-only limitations: - Native Windows tests are included but skipped on this Linux host. - Playwright Chromium could not start because the container’s 512-PID cgroup was exhausted by 352 unreapable test-runner zombie processes; it failed before loading a page. - Docker-based actionlint/shellcheck could not run because Docker is unavailable. PR: #1977 Comment by: @integry (ID: 5465910433) Model: gpt-5.6-sol
…a67d2ff46758b6086faf40aac68619f9` without merging or committing. Implemented the two requested fixes on exact head `bcc73729a67d2ff46758b6086faf40aac68619f9` without merging or committing. - [release-artifacts.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T01-45-33/apps/desktop/scripts/release-artifacts.mjs) now creates held, randomized private snapshots outside public output with strict mode/link/identity checks and atomic held-byte publication. - [release-architecture.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T01-45-33/apps/desktop/scripts/release-architecture.mjs) mounts the internal private pathname with readonly hdiutil; `/dev/fd` hdiutil support and its probe were removed. - Both macOS workflow targets now run a real private-snapshot isolation probe that swaps original/public paths while mounted. - Added mutation/replacement and A/B evidence/publication regressions. - [release-workflow.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T01-45-33/apps/desktop/src/release-workflow.test.ts) normalizes all loaded fixtures to LF while retaining ordering and matrix assertions. Passed locally: - Desktop suite: 117 passed, 1 macOS-only skip - Fast unit suite: 278 passed - Desktop/UI typecheck - Focused artifact/layout/workflow tests - SHA256SUMS artifact verification regression - Changed-script ESLint and syntax checks - Workflow YAML parsing - `git diff --check` CI-only/infrastructure-blocked here: - Native macOS/Windows jobs and packaging - actionlint container: Docker/actionlint unavailable - Full Suite reached 167/328 with completed tests passing, then required unavailable Redis and was stopped. PR: #1972 Comment by: @integry (ID: 5466066908) Model: gpt-5.6-sol
…f…` without merging or syncing the transport base. Implemented the durability follow-up on exact head `0a2cbd3f…` without merging or syncing the transport base. Key changes: - Added prepared → flush → verify → `O_SYNC` commit-marker journal publication. Flush/verification failures now fail before durable callbacks or B publication. - Encrypted and authenticated self-contained journals with bounded size and lossless string/`BigInt` generations. - Recovery now authenticates journals before reading or repairing `profiles.json`. - Added mirror corruption, alternate-slot rollback, missing-slot, injected I/O failure, revocation, cancellation, and crash matrices. - Added required x64 `windows-latest` durability job in [desktop-release-guard.yml](/home/node/workspace/.github/workflows/desktop-release-guard.yml:26), with explicit scenario-count enforcement and zero permitted skips. Validation passed: - Clean `npm ci` - Desktop tests: 87/87 - Linux native durability command: 67/67, 0 skipped - Client tests: 24/24 - UI transport tests: 39/39 - Fast validation tests: 279/279 - Desktop/UI typechecks, UI lint/build, root lint/build - Linux desktop package - Release metadata and `git diff --check` Native Windows success is not claimed: the hosted job must execute after push. Local `actionlint` and the Redis-backed configured Full Suite could not run because this environment has no Docker or Redis; both remain covered by CI. PR: #1977 Comment by: @integry (ID: 5466169482) Model: gpt-5.6-sol
…ommitting or merging. Implemented the bounded correction on `a84653aaf` without committing or merging. - Linux ARM64: added `EINVAL`-only fallback with before/opened/after `dev+ino` equality, directory/non-link checks, held-FD pinning, and unchanged addon-relative `config.json` proof in [directoryDescriptor.ts](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T17-01-56/packages/cli/src/utils/directoryDescriptor.ts:193). - Added deterministic success, replacement, symlink, and non-`EINVAL` rejection tests in [agentSkill.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T17-01-56/packages/cli/src/agentSkill.test.ts:184). - Windows: removed redundant owner translation while retaining the existing ACL object and replacing only its protected DACL in [smoke-packaged-connect.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T17-01-56/apps/desktop/scripts/smoke-packaged-connect.mjs:195). Passed locally: - CLI typecheck, lint, build, focused tests, and CI-style Agent Skill lane. - Desktop typecheck and tests: 162/162. - Native durability: 115/115. - Platform-safe Connect: 85/85. - Validate fast tests: 283/283. - Hosted regression: 322/322; UI: 73/73. - Linux x64 desktop package and CLI package. - Runtime and desktop audits: zero vulnerabilities. - `git diff --check`. Target-native gates remain pending: all six Packaged Connect launches, Windows lanes, Darwin native verification, and glibc 2.31 require their CI runners. The Full Suite passed files 1–204, then was stopped at file 205 because this host has no Redis service. Linux packaged launch was also unavailable because Xvfb and root-owned setuid sandbox preparation are unavailable; `--no-sandbox` was not used. PR: #1988 Comment by: @integry (ID: 5497508759) Model: gpt-5.6-sol
…riptor.ts](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T17-26-08/packages/cli/src/utils/directoryDescriptor.ts:216): fallback now opens with `O_RDONLY | O_DIRECTORY`, dropping only `O_NOFOLLOW`. Implemented the exact one-line correction in [directoryDescriptor.ts](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T17-26-08/packages/cli/src/utils/directoryDescriptor.ts:216): fallback now opens with `O_RDONLY | O_DIRECTORY`, dropping only `O_NOFOLLOW`. Checks passed: - CLI typecheck, lint, and build - Focused CLI suite: 69 passed, 1 Darwin-only skip - All EINVAL/replacement/symlink/non-EINVAL and addon `openAt(O_NOFOLLOW)` proofs - Platform-safe Connect: 85/85 - `git diff --check` HEAD remains `5f8bdb7d6a988d7fb6f54d27682af9b912933195`. No commit or ancestry changes; only the requested file is modified. PR: #1988 Comment by: @integry (ID: 5497785299) Model: gpt-5.6-sol
…r changing ancestry. Implemented the exact-head corrections without committing or changing ancestry. - Linux authority walks now reuse the ARM64+EINVAL-only pinned directory fallback for root and child components, with bigint dev/inode equality and retained `O_DIRECTORY`. - Added real authority-path success, replacement, symlink, and non-EINVAL regressions. - Windows fixture now uses PS5.1-compatible rooted/canonical path validation and eight redacted ACL subphases. - Preserved production ownership verification, existing ACL object, DACL scope, and addon file `openAt(O_NOFOLLOW)`. Key files: [directoryDescriptor.ts](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T17-30-38/packages/cli/src/utils/directoryDescriptor.ts), [connectIdentity.ts](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T17-30-38/packages/cli/src/connectIdentity.ts), [smoke-packaged-connect.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T17-30-38/apps/desktop/scripts/smoke-packaged-connect.mjs). Validation passed: - Focused Linux tests: 64 passed, 1 Darwin-only skipped - Platform-safe Connect proof: 85/85 - CLI lint and typecheck - Desktop typecheck/build - Direct smoke-script ESLint and syntax checks - `git diff --check` Windows and ARM64 packaged gates require their target-native CI runners. Head remains `b9ca387e9450912c2d4e7b973aa241f6f3fdceaa`. PR: #1988 Comment by: @integry (ID: 5497836392) Model: gpt-5.6-sol
…dvisories Implemented by ProPR AI using gpt-5.6-sol model. Implementation completed successfully.
…11c312073ebcbed20accd5d7d6382b`. Implemented the scoped correction on exact head `615a10628911c312073ebcbed20accd5d7d6382b`. - Added Linux ARM64-only sequence: strict flags → `O_RDONLY | O_DIRECTORY` on `EINVAL` → `O_RDONLY` only on a second `EINVAL`. - Preserved BigInt before/opened/after dev+ino equality, directory/nonlink checks, and descriptor closure in [directoryDescriptor.ts](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T17-41-14/packages/cli/src/utils/directoryDescriptor.ts:203). - Added descriptor-operation and real authority-walk tests for consecutive `EINVAL`, non-`EINVAL` rejection, replacement, symlink, and non-directory descriptors in [agentSkill.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T17-41-14/packages/cli/src/agentSkill.test.ts:201) and [publicInstanceIdentity.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T17-41-14/test/publicInstanceIdentity.test.ts:383). - Root/component helper reuse and addon `openAt(O_NOFOLLOW)` remain intact. - Windows PS5.1 code, ancestry, and lockfiles were untouched. Validation passed: - Focused Linux tests: 67 passed, 1 Darwin-only skipped - Platform-safe Connect proof: 85/85 - CLI lint - CLI production/test typecheck - `git diff --check` No commit was created. Target-native Linux ARM64 and Windows execution remain CI-runner gates. PR: #1988 Comment by: @integry (ID: 5497959163) Model: gpt-5.6-sol
…89be1d750d61a45b23447c5c8f415304`. Implemented the Windows fixture fix on exact head `2a0c85b989be1d750d61a45b23447c5c8f415304`. - Suppressed the Boolean return from `RemoveAccessRuleSpecific` in [smoke-packaged-connect.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T17-48-36/apps/desktop/scripts/smoke-packaged-connect.mjs:224). - Audited the helper for other output leaks; existing fail-closed stdout/stderr handling and error propagation remain intact. - No lockfiles or ancestry changed. Validation passed: - Platform-safe Connect proof: 85/85 - JavaScript syntax check - `git diff --check` Windows x64 and ARM64 Packaged Connect still require CI reruns for final platform confirmation. PR: #1988 Comment by: @integry (ID: 5498044359) Model: gpt-5.6-sol
…packaging-b-20260901-1731-2qm [2046 by GPT-5.6 Sol] Patch desktop packaging browserslist advisories
…b5a5b6`. Implemented F7–F11 follow-up corrections on exact head `258b5a5b6`. - Routed all three authority child-directory opens through `openAuthorityDirectoryNoFollow` in [connectIdentity.ts](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T17-52-36/packages/cli/src/connectIdentity.ts:399). - Added per-callsite regressions for consecutive EINVAL, replacement, symlink, non-directory, non-EINVAL, and absent `.propr` semantics in [publicInstanceIdentity.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T17-52-36/test/publicInstanceIdentity.test.ts:498). - Updated the lifecycle fixture to use a policy-valid pairing URL in [pairing-response-lifecycle.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T17-52-36/apps/desktop/src/pairing-response-lifecycle.test.ts:231). - Confirmed existing head already contains F7/F8 production validation, F9 Windows working-directory correction, and F11 universal writable-mode rejection. - Preserved addon `openAt(O_NOFOLLOW)`, lockfile, workflow, and ancestry. Verification passed: - Public identity suite: 35/35 - Platform-safe Connect verifier: 85/85 - Desktop transport suite: 162/162 - Focused pairing, authority, discovery, and broker tests - CLI/shared/client/desktop typechecks - CLI lint and diff checks The target-native Linux ARM64 packaged job requires the ARM CI runner and was not executable in this x64 container. No commit was created. PR: #1988 Comment by: @integry (ID: 5498090414) Model: gpt-5.6-sol
…d2815cd` without changing ancestry or `package-lock.json`. Implemented the Windows fixture correction on exact head `5d2815cd` without changing ancestry or `package-lock.json`. - Suppressed `SetAccessRuleProtection`, `RemoveAccessRuleSpecific`, `AddAccessRule`, and `Set-Acl` results in [windows-fixture-acl.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T18-04-17/apps/desktop/scripts/windows-fixture-acl.mjs:31). - Preserved raw zero-byte enforcement and split failures into `powershell-stdout` and `powershell-stderr` in [smoke-packaged-connect.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T18-04-17/apps/desktop/scripts/smoke-packaged-connect.mjs:194). - Retained exits 40–47, `process-failed`, and `unexpected-exit`. - Added a Windows PowerShell 5.1 encoded-helper regression covering directory and file ACLs with exact zero-byte assertions on both streams in [windows-fixture-acl.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T18-04-17/apps/desktop/scripts/windows-fixture-acl.test.mjs:11). - Required that regression in both Windows Packaged Connect matrix jobs via [desktop-connect-discovery-guard.yml](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T18-04-17/.github/workflows/desktop-connect-discovery-guard.yml:78). Validation completed: - Desktop tests: 162/162 passed. - Packaged layout: 3/3 passed. - ESLint, syntax checks, workflow YAML parse, and `git diff --check`: passed. - Windows x64/ARM64 native execution remains for CI; both jobs now run the regression before packaging. PR: #1988 Comment by: @integry (ID: 5498225902) Model: gpt-5.6-sol
… into 1985/gpt-5.6-sol-support-propr-connect-tun-20260829-2108-al6
…5384a80f`. Implemented the PS5.1 regression correction on exact head `5384a80f`. - Root cause: PS5.1/.NET Framework `GetFullPath` expands 8.3 components from raw `tmpdir()`, causing the strict canonical-equality rejection. The test now constructs fixtures from the canonical temporary root, matching production behavior. [.NET reference source](https://github.com/microsoft/referencesource/blob/main/mscorlib/system/io/path.cs) - Added distinct redacted codes: ROOTED_PATH `40`, FULL_PATH `48`, CANONICAL_EQUALITY `49`, OUTER_INVOCATION `50` in [windows-fixture-acl.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T18-16-01/apps/desktop/scripts/windows-fixture-acl.mjs:9). - Added matching parent phases in [smoke-packaged-connect.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T18-16-01/apps/desktop/scripts/smoke-packaged-connect.mjs:210). - Expanded the retained PS5.1 regression to cover directory/file success, 8.3 aliases, traversal, relative/empty paths, invalid kinds, invalid full paths, type mismatches, and exact zero-byte streams in [windows-fixture-acl.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T18-16-01/apps/desktop/scripts/windows-fixture-acl.test.mjs:11). Validation passed: - Desktop: 162/162 - Platform-safe Connect: 85/85 - ESLint, syntax, encoded-source round-trip, and `git diff --check` No ancestry, workflow, Linux authority, or lockfile changes. Windows x64/ARM64 PS5.1 and packaged execution remain required target-native CI gates. PR: #1988 Comment by: @integry (ID: 5498363332) Model: gpt-5.6-sol
…ad `cc71e347`. Implemented the PS5.1 canonical-path correction on exact head `cc71e347`. - Added a shared bounded PS5.1 canonicalization bridge in [windows-fixture-acl.mjs](/home/node/workspace/apps/desktop/scripts/windows-fixture-acl.mjs:67). It uses fixed encoded commands and environment transport, requires status 0/zero stderr, validates UTF-8 framing/rootedness, and proves pre/post filesystem identity and type. - Updated packaged smoke to canonicalize every ACL entry before invoking the unchanged ACL helper: [smoke-packaged-connect.mjs](/home/node/workspace/apps/desktop/scripts/smoke-packaged-connect.mjs:189). - Updated the native regression to report only fixed normalization categories and preserve all negative phase codes: [windows-fixture-acl.test.mjs](/home/node/workspace/apps/desktop/scripts/windows-fixture-acl.test.mjs:34). - Identified the remaining category as post-creation 8.3 short-name component expansion retained by Node’s spelling but expanded by PS5.1 `GetFullPath`, consistent with [.NET Framework’s normalization implementation](https://github.com/microsoft/referencesource/blob/main/mscorlib/system/io/path.cs). - No lockfile, Linux authority, ancestry, or ACL-helper changes. Validation: - Desktop tests: 162/162 - Platform-safe Connect: 85/85 - Syntax, ESLint, and `git diff --check`: passed - Windows regression: locally skipped as expected; native x64/ARM64 regression and Packaged Connect gates remain required by the existing matrix. PR: #1988 Comment by: @integry (ID: 5498503275) Model: gpt-5.6-sol
…4abb0f07`. Implemented on exact head `23def149d6241fb663b3fa67782c87f34abb0f07`. - Added only `$ProgressPreference='SilentlyContinue'` to the encoded ACL helper while retaining `ErrorActionPreference='Stop'` and all fail-closed phases: [windows-fixture-acl.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T18-40-05/apps/desktop/scripts/windows-fixture-acl.mjs:8) - Kept exact zero-byte stdout/stderr assertions for every case, now reporting only fixed redacted stream categories without exposing content or byte counts: [windows-fixture-acl.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T18-40-05/apps/desktop/scripts/windows-fixture-acl.test.mjs:15) - Did not change caller stderr handling, canonicalization/identity proofs, ACL scope, platform authority code, lockfile, or ancestry. Local checks passed: - ESLint on both changed files - Node syntax checks - `git diff --check` - Focused regression loads successfully but is skipped on this Linux host The replacement head still requires the PS5.1 regression, win32 x64/ARM64 Packaged Connect, native durability, and full six-platform CI matrix. No commit was created. PR: #1988 Comment by: @integry (ID: 5498656279) Model: gpt-5.6-sol
…space/apps/desktop/scripts/windows-fixture-acl.test.mjs:67). Updated only [windows-fixture-acl.test.mjs](/home/node/workspace/apps/desktop/scripts/windows-fixture-acl.test.mjs:67). - Replaced the illegal-pipe vector with fixed server-only UNC `\\propr-invalid-unc\`. - It passes `IsPathRooted` but `GetFullPath` rejects the missing share, preserving phase 48 ([.NET Framework reference source](https://github.com/microsoft/referencesource/blob/main/mscorlib/system/io/path.cs#L876-L897)). - Production helper, phases, streams, security checks, lockfile, and ancestry remain unchanged. - `git diff --check`, syntax validation, and ESLint passed. - Focused test passes structurally but skips on this Linux host; Win32 x64 and ARM64 CI remain the required native proof. PR: #1988 Comment by: @integry (ID: 5498742896) Model: gpt-5.6-sol
… exact head `36b460da…`. Implemented the diagnostic-only `Get-Acl` classification on exact head `36b460da…`. - Added fixed exit codes 51–55 for command/module unavailable, item/provider missing, unauthorized/security, unsupported platform, and allowlisted “other” exceptions. Unclassified failures remain 44. - Classification is confined to the existing `Get-Acl` catch and emits no output or exception details. - Updated the native regression to report only constant categories while still requiring status 0, zero streams, owner proof, and exact protected three-rule DACLs for both directory and file cases. - No ACL semantics, phase mappings, smoke behavior, lockfile, or ancestry changed. Files: - [windows-fixture-acl.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T18-54-14/apps/desktop/scripts/windows-fixture-acl.mjs:37) - [windows-fixture-acl.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T18-54-14/apps/desktop/scripts/windows-fixture-acl.test.mjs:15) Validation passed: ESLint, Node syntax checks, `git diff --check`, and the focused test structurally. Native PS5.1 execution is skipped on this Linux host and requires the replacement x64/ARM64 jobs. PR: #1988 Comment by: @integry (ID: 5498831874) Model: gpt-5.6-sol
…c1257972` without committing. Implemented on exact head `03af55daf8eee80379b24a83005a8d3cc1257972` without committing. - Replaced `Get-Acl`/`Set-Acl` with type-specific `System.IO.File/Directory` ACL APIs in [windows-fixture-acl.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T19-03-54/apps/desktop/scripts/windows-fixture-acl.mjs:38). - Mutation requests only `Access`; owner is neither read nor changed. - Proof requests `Access|Owner`, verifies the pre-mutation owner baseline, then re-reads and requires unchanged owner plus exactly three canonical, explicit allow rules. - Preserved current SID, SYSTEM, Administrators, FullControl, inheritance flags, fixed exit phases, and zero-stream enforcement. - Updated the packaged-smoke phase label to `access-control-read`. Validation: - ESLint, syntax checks, and `git diff --check`: passed. - Native durability: 115/115 passed. - Windows-focused harness loaded successfully but was skipped on Linux. - No lockfile or ancestry changes. The existing CI matrix provides the required Windows x64/ARM64 focused and packaged-status gates plus Darwin/Linux lanes. PR: #1988 Comment by: @integry (ID: 5498958962) Model: gpt-5.6-sol
… [windows-fixture-acl.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T19-16-06/apps/desktop/scripts/windows-fixture-acl.test.mjs:16). Implemented the owner-preservation regression correction in [windows-fixture-acl.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1988-followup-2026-09-01T19-16-06/apps/desktop/scripts/windows-fixture-acl.test.mjs:16). - Baseline owner is classified via fixed byte-empty statuses as current user, Administrators, or SYSTEM. - Unknown owners and lookup failures fail closed. - Only the category is retained and passed to the post-mutation proof. - Post-proof requires the same category before validating the exact protected/canonical three-rule DACL. - Added unknown-owner and category-mismatch regressions. - Added a guard ensuring production still requests only `Access` and never sets owner. - No production, workflow, lockfile, or ancestry changes. Validation passed: syntax, ESLint, desktop typecheck, and diff checks. The PS5.1 test is correctly skipped on this Linux host; x64/ARM64 focused and packaged status-0 execution remains enforced by the existing Windows CI matrix. PR: #1988 Comment by: @integry (ID: 5499105483) Model: gpt-5.6-sol
Integrate the audited ProPR Connect endpoint, discovery, canonical-path, ACL, and owner-preservation work into the transport sub-epic. Windows packaged-smoke lifecycle and ARM64 ordinary-user staging remain explicit blocking correction tasks before transport propagation to the top desktop epic.
…epic-desktop-transport-api Automatically resolved merge conflicts after merging target branch into PR branch. Resolved conflicts in: - .github/workflows/desktop-release-guard.yml - apps/desktop/README.md - apps/desktop/forge.config.ts - apps/desktop/package.json - apps/desktop/scripts/smoke-packaged.mjs - apps/desktop/src/logger.ts - apps/desktop/src/main.ts PR: #2035 Model: gpt-5.6-sol
…fecycle boun Implemented by ProPR AI using gpt-5.6-sol model. Implementation completed successfully.
…erge head `cfadd43e` without committing. Implemented the semantic conflict-resolution fix on exact merge head `cfadd43e` without committing. Key changes: - Added an explicit four-launch plan: isolated release guard, success, retry, forced-timeout. - Restored the protocol-1 profile API fixture, exact renderer-origin checks, Connect deep-link argv, and detailed MVP proof. - Preserved protocol-2 transport fixtures, credentials, shutdown ordering, secret scans, sandboxing, and `shell:false`. - Added deterministic env/argv/marker regression coverage. - Removed only the extra EOF blank line. Files: [smoke-packaged.mjs](/tmp/git-processor/worktrees/integry/propr/pr-2035-followup-2026-09-01T22-10-56/apps/desktop/scripts/smoke-packaged.mjs:133), [packaged-smoke-plan.mjs](/tmp/git-processor/worktrees/integry/propr/pr-2035-followup-2026-09-01T22-10-56/apps/desktop/scripts/packaged-smoke-plan.mjs:1), [main.ts](/tmp/git-processor/worktrees/integry/propr/pr-2035-followup-2026-09-01T22-10-56/apps/desktop/src/main.ts:633). Validation passed: - Launch-plan/support tests: 12/12 - Transport UI tests: 10/10 - JavaScript syntax checks - `git diff --check` The full desktop suite remains non-green due to three pre-existing exact-head failures in unchanged deep-link/window tests and a stale shutdown static assertion: 310 passed, 3 failed, 7 skipped. Typecheck likewise hits the existing `window-options.test.ts` string-versus-`Rectangle` error. Packaged smoke could not run locally because no packaged artifacts exist; Linux/Windows x64/ARM64 release CI remains the required authority before propagation. PR: #2035 Comment by: @integry (ID: 5501114665) Model: gpt-5.6-sol
Implemented only the three requested corrections: - Removed duplicate activate-path deep-link registration in [main.ts](/tmp/git-processor/worktrees/integry/propr/pr-2035-followup-2026-09-01T22-26-23/apps/desktop/src/main.ts:867). - Updated coordinator wiring assertions in [smoke-test-authorization.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-2035-followup-2026-09-01T22-26-23/apps/desktop/src/smoke-test-authorization.test.ts:112). - Corrected the window-options arguments in [window-options.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-2035-followup-2026-09-01T22-26-23/apps/desktop/src/window-options.test.ts:15). Validation passed: - Focused tests: 21/21 - Desktop/UI typecheck: passed - Full desktop suite: 320 tests, 313 passed, 7 skipped, 0 failed - `git diff --check`: clean - Exactly one `deepLinkDelivery.setWindow` registration - Smoke scripts and release workflows unchanged - EOF newlines preserved Exact current HEAD: `da54bc2d9de8037a74db49d186e217ceceb97197` Per instruction, changes remain uncommitted; the system-generated commit will assign the new head. PR: #2035 Comment by: @integry (ID: 5501262020) Model: gpt-5.6-sol
Implemented the two requested follow-up fixes in: - [packaged-connect-lifecycle.mjs](/tmp/git-processor/worktrees/integry/propr/pr-2054-followup-2026-09-01T22-25-29/apps/desktop/scripts/packaged-connect-lifecycle.mjs:120) - [packaged-connect-lifecycle.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-2054-followup-2026-09-01T22-25-29/apps/desktop/scripts/packaged-connect-lifecycle.test.mjs:251) Changes include recursive decoded-JSON sensitive-string inspection, real cleanup phase deadlines, and isolated default Windows filesystem cleanup so stuck native requests cannot hold the harness open. Existing taskkill, readiness, sanitization, retry, and primary-result behavior remains intact. Validation: - Lifecycle/cleanup tests: 19/19 passed - Related smoke-support tests: 11/11 passed - ESLint: passed - `git diff --check`: passed - Desktop typecheck: blocked by the pre-existing untouched `src/window-options.test.ts:15` `string`/`Rectangle` error Per instruction, I did not commit. The exact checked-out head remains `678e573b005f9623cbb6380622ca4216e3b3a431`; the automation-generated post-commit head is therefore not yet available. PR: #2054 Comment by: @integry (ID: 5501251882) Model: gpt-5.6-sol
Implemented the fail-closed capture correction. - Any truncated capture now converts ready success to fixed sanitized category `output-rejected`: [packaged-connect-lifecycle.mjs](/tmp/git-processor/worktrees/integry/propr/pr-2054-followup-2026-09-01T22-37-25/apps/desktop/scripts/packaged-connect-lifecycle.mjs:457) - Added deterministic post-ready record-count and byte-budget bypass tests: [packaged-connect-lifecycle.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-2054-followup-2026-09-01T22-37-25/apps/desktop/scripts/packaged-connect-lifecycle.test.mjs:287) Validation: - Focused lifecycle/cleanup suite: 21/21 passed - ESLint: passed - `git diff --check`: passed - Desktop typecheck: blocked by the existing untouched `src/window-options.test.ts:15` `string`/`Rectangle` error Per instruction, changes are uncommitted. Exact checked-out head remains `0c4ffa6dd916b0947bb0e10e2be8bcf7d1301606`; the system-generated commit will establish the new head. PR: #2054 Comment by: @integry (ID: 5501363330) Model: gpt-5.6-sol
…oof boundaries: Implemented the Linux release-guard fix without altering proof boundaries: - Every Linux mode now receives exactly `--password-store=gnome-libsecret`. - Every Linux mode receives only the validated `DBUS_SESSION_BUS_ADDRESS`. - Release-guard remains non-transport and excludes all three transport-specific variables. - Updated exact four-mode env/argv assertions. Validation: - Focused tests: 12/12 passed - Desktop typecheck: passed - Full desktop suite: 313 passed, 7 platform skips, 0 failed - Linux x64 package and fuse inspection: passed - Native launch attempted but blocked by host dependencies (`libglib-2.0.so.0`, Xvfb, D-Bus/keyring helpers unavailable). ARM64 cannot run natively on this x64 host. - `git diff --check`: passed Exact checked-out head remains `1c020161f2d032e00aae1779d98b813ecec35c53`. Per instruction, I did not commit; the automated commit will create the new head. PR: #2035 Comment by: @integry (ID: 5501384456) Model: gpt-5.6-sol
… into 2051/gpt-5.6-sol-make-packaged-windows-con-20260901-2205-5rn
Implemented the Connect deep-link seam and security boundary. - Added strict Connect parsing/canonical revalidation in [security.ts](/tmp/git-processor/worktrees/integry/propr/pr-2035-followup-2026-09-01T22-55-16/apps/desktop/src/security.ts:103). - Added one-consumer buffered inbox, remount safety, and profile-bound Open navigation. - DesktopExperience now stages `https://connect.propr.dev` as an untrusted ProfileEditor candidate with zero pre-confirm save/pair/probe/activate/credential effects. - Preserved the native release guard, D-Bus/keyring changes, and all four launch modes unchanged. The exact input assertion remains at [main.ts](/tmp/git-processor/worktrees/integry/propr/pr-2035-followup-2026-09-01T22-55-16/apps/desktop/src/main.ts:646). Validation passed: - Security tests: 14/14 - Focused renderer tests: 30/30 - Desktop UI suite: 91/91 - Final Electron adapter tests: 15/15 - Full desktop suite: 315 passed, 7 platform skips, 0 failed - Desktop/UI typechecks - Linux x64 packaging and packaged executable/fuse inspection Both native launch commands were attempted but could not start because this container lacks `dbus-run-session`, `xvfb-run`, and `gnome-keyring-daemon` (exit 127). Per the no-commit instruction, exact checked-out HEAD remains: `c78392df090ccaa5b8c124ef02b5d0300452f97f` PR: #2035 Comment by: @integry (ID: 5501517875) Model: gpt-5.6-sol
…1e632c0e4f0e240acfbc64931da`. Implemented the requested correction on head `983ace5e4fb411e632c0e4f0e240acfbc64931da`. Changes: - Extracted deep-link subscription, Connect staging/pending state, startup Open queue, and active-profile navigation into [useDesktopDeepLinks.ts](/tmp/git-processor/worktrees/integry/propr/pr-2035-followup-2026-09-02T05-43-42/propr-ui/src/desktop/useDesktopDeepLinks.ts). - Reduced [DesktopExperience.tsx](/tmp/git-processor/worktrees/integry/propr/pr-2035-followup-2026-09-02T05-43-42/propr-ui/src/desktop/DesktopExperience.tsx) below the configured lint limit. - Replaced the unused listener fixture in [electronAdapters.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-2035-followup-2026-09-02T05-43-42/propr-ui/src/desktop/electronAdapters.test.ts). - Left native release proof and packaged Connect lanes untouched. Validation passed: - UI lint - UI typecheck - Desktop typecheck - Connect/remount tests: 22 passed - Strict desktop deep-link security tests: 14 passed - Complete desktop UI suite: 92 passed across 10 files - `git diff --check` No commit was created. PR: #2035 Comment by: @integry (ID: 5505027653) Model: gpt-5.6-sol
… into 2051/gpt-5.6-sol-make-packaged-windows-con-20260901-2205-5rn
…windows-con-20260901-2205-5rn [2051 by GPT-5.6 Sol] Make packaged Windows Connect smoke lifecycle bounded and path-redacted
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Epic PR
This PR aggregates all changes from child PRs merged to the
1953-epic-desktop-transport-apibranch.Created automatically by ProPR