From e38fae9f68e22f10359b430a602250d02bbca9ab Mon Sep 17 00:00:00 2001
From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Date: Wed, 22 Jul 2026 14:34:29 -0700
Subject: [PATCH] fix(daemon): replace hosts with stale login preflight cache

Protocol 26 shipped the process-lifetime PAM rejection cache. Preserve its live sessions as a legacy generation, but route fresh terminals through protocol 27 so updating actually loads the expiring-cache fix.

Refs #9756
---
 .../daemon/daemon-foreground-confirmation-protocol.test.ts   | 3 ++-
 src/main/daemon/daemon-protocol-version.test.ts              | 4 ++--
 src/main/daemon/daemon-protocol-version.ts                   | 5 +++--
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/src/main/daemon/daemon-foreground-confirmation-protocol.test.ts b/src/main/daemon/daemon-foreground-confirmation-protocol.test.ts
index 5e5e63e1104..f50a2d4e0ac 100644
--- a/src/main/daemon/daemon-foreground-confirmation-protocol.test.ts
+++ b/src/main/daemon/daemon-foreground-confirmation-protocol.test.ts
@@ -3,11 +3,12 @@ import { PREVIOUS_DAEMON_PROTOCOL_VERSIONS, PROTOCOL_VERSION } from './types'
 
 describe('foreground-confirmation daemon protocol', () => {
   it('rejects daemons from before the fresh-confirmation RPC', () => {
-    expect(PROTOCOL_VERSION).toBe(26)
+    expect(PROTOCOL_VERSION).toBe(27)
     expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toContain(19)
     expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toContain(22)
     expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toContain(23)
     expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toContain(24)
     expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toContain(25)
+    expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toContain(26)
   })
 })
diff --git a/src/main/daemon/daemon-protocol-version.test.ts b/src/main/daemon/daemon-protocol-version.test.ts
index 9fb4784b687..d261caf934a 100644
--- a/src/main/daemon/daemon-protocol-version.test.ts
+++ b/src/main/daemon/daemon-protocol-version.test.ts
@@ -8,11 +8,11 @@ import {
 
 describe('daemon protocol version', () => {
   it('ships claim and incarnation authority after startup-ingress generations', () => {
-    expect(PROTOCOL_VERSION).toBe(26)
+    expect(PROTOCOL_VERSION).toBe(27)
     expect(AGENT_SESSION_CLAIM_DAEMON_PROTOCOL_VERSION).toBe(26)
     expect(AGENT_SESSION_CREATE_OPERATION_DAEMON_PROTOCOL_VERSION).toBe(26)
     expect(PREVIOUS_DAEMON_PROTOCOL_VERSIONS).toEqual(
-      Array.from({ length: 25 }, (_, index) => index + 1)
+      Array.from({ length: 26 }, (_, index) => index + 1)
     )
   })
 })
diff --git a/src/main/daemon/daemon-protocol-version.ts b/src/main/daemon/daemon-protocol-version.ts
index e8c88774f53..52369313478 100644
--- a/src/main/daemon/daemon-protocol-version.ts
+++ b/src/main/daemon/daemon-protocol-version.ts
@@ -1,12 +1,13 @@
 // Why: daemons survive app updates, so wire behavior must be version-gated.
-export const PROTOCOL_VERSION = 26
+// v27 replaces v26 daemons that can retain permanent macOS preflight rejections (#9756).
+export const PROTOCOL_VERSION = 27
 export const PTY_STARTUP_INGRESS_PROTOCOL_VERSION = 25
 export const AGENT_SESSION_CLAIM_DAEMON_PROTOCOL_VERSION = 26
 export const AGENT_SESSION_CREATE_OPERATION_DAEMON_PROTOCOL_VERSION = 26
 export const GIT_CREDENTIAL_GUARD_HOST_PROTOCOL_VERSION = 22
 export const CLEAN_DISCONNECT_PROTOCOL_VERSION = 24
 export const PREVIOUS_DAEMON_PROTOCOL_VERSIONS = [
-  1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25
+  1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26
 ] as const
 
 export function supportsPtyStartupIngress(protocolVersion: number): boolean {