3 Commits

Include renames

Author	SHA1	Message	Date
Neil	26721bd632	fix(codex): stop blocking the main thread on trust grants (#16441) (#16594) ... * fix(codex): stop blocking the main thread on trust grants (#16441) Codex hook trust was granted by blocking the Electron main thread on `spawnSync` of a bundled ELECTRON_RUN_AS_NODE entry for the whole app-server deadline: 15s native, 35s WSL, ~45s on the real-home path (rebase inspect + repair + grant). Cold start and every Codex pane launch showed "Not Responding"; the reported event-loop gap was 15,049 ms. The subprocess only ever existed to donate an event loop to a deliberately blocked parent — `runCodexHookTrustGrantSession` was already the real async implementation. Make the callers async and the fork is unnecessary, so the bridge, the forked entry and its envelope are deleted along with their build/knip/tsconfig registrations. The CLI `agent hooks prepare-codex` handler is already async, so it awaits the in-process session and saves a process spawn per managed-home shell. `resolveCodexTrustGrantHost` is async too; the WSL identity probe moves from `execFileSync` to `runProcess`, dropping that file from the child-process import allowlist. Status reads keep a synchronous native-only stamp path. Two invariants that held only because the lane blocked: - Overlapping capability probes were impossible by construction. `GitCapabilityCache`'s dedupe engine is extracted to a shared `CapabilityProbeCache` and `CodexAppServerCapabilityCache` now inherits it, so concurrent launches against a cold host share one app-server session instead of one each. - Two grants on one `config.toml` could not interleave capture and restore. A reentrant per-file lane now serializes the whole install sequence (managed, WSL runtime, real-home ensure, legacy sweep) and the grant and rebase inside it. Cold-start work moves off the critical path: retained-home reconciliation (N sequential sessions) is fire-and-forget behind the daemon provider, and the startup real-home ensure chains into managed hook reconciliation instead of blocking app init. Every preserved semantic is unchanged: never throws, the ORCA_DISABLE_CODEX_TRUST_RPC kill switch, ledger hits, backfill-pending and cooldown fallbacks, config rollback on every failure path, pre-grant self-computed trust removal, the verify-failure taxonomy, diagnostics and telemetry. * fix(codex): widen the trust-config lane to every config.toml writer Review follow-ups on #16441's async trust grant: - `markCodexProjectTrusted` now runs inside the runtime+system config.toml lanes, so a project-trust write can no longer land inside a hook grant's capture->restore window and be silently reverted. Its callers await it. - `install`/`refreshRuntimeUserHooks`/`remove` hold the system config.toml lane as well as the runtime one — they promote approvals into ~/.codex/config.toml and mirror it back. Lock order is runtime-before-system everywhere. - The real-home ensure chain resumes after a rejection instead of returning the same rejected promise to every later pane launch, and resolving the real home is now inside the module's never-throws boundary. - `buildSpawnEnv` awaits inside a cancelable pending-spawn registration, so shutdown during the (now long) env build stops the PTY from launching. `prepareLocalPtySpawn` generalizes into `awaitCancelableLocalPtySpawn`. - CapabilityProbeCache drops the test-only `nowMs` passthrough; its probe backstop comment now describes what it actually guards. - Preflight is a plain async function; the trust dispatch in orca-runtime collapses into one `markWorkspaceTrustedForAgent`. * test(codex): exercise the trust-config lane under real concurrency The async grant makes two pane launches overlap for the first time. These drive the real modules end to end on real files: a rollback swallowing a sibling's grant, a markCodexProjectTrusted write landing inside a capture -> restore window, shared capability-probe dedupe on a cold host, the host-scoped transient cooldown, and reentrancy from inside an installer. Each was verified to fail against a deliberately broken implementation (lane removed, dedupe disabled, cooldown made global, reentrancy pass- through disabled). * test(codex): stop hook-service suites spawning the developer's real codex The forked grant bundle never existed under vitest, so the RPC lane was unreachable in tests on main. Running it in-process makes these suites spawn a real `codex app-server` when one is installed: 38 spawns and two failures in hook-service-runtime-trust-repair on a machine with codex, green in CI where there is none. Stand in for the missing binary so both environments exercise the same fallback lane. * docs(codex): scope the trust-RPC kill switch comment to what it actually gates The comment read as though the flag forces the fallback lane everywhere. It gates the managed grant only: the real-home rebase still runs its own inspect/repair app-server sessions when Orca's insertion shifts a user's hook positions, and never reads the flag. Verified by exercise, not by reading — with the flag set, both inspect-user-hook-trust and repair-user-hook-trust still ran. Pre-existing: main has no check there either, it just blocked the main thread while doing it. Widening the flag to cover the rebase is a follow-up; this only stops the comment promising something the constant does not do.	2026-08-26 16:44:55 -07:00
Jinjing	7e76bb3aec	Fix rebase race by fetching to private ref before rebasing (#15990) ... * Fix rebase race by fetching to private ref before rebasing `git pull --rebase` is vulnerable to concurrent fetches modifying remote-tracking refs during execution. Fetch to a temporary private ref (refs/orca/rebase/*) first, then rebase from that stable ref to avoid the race condition. * Fix rebase race by fetching to private ref with timeout Concurrent fetches can interfere with remote-tracking refs between fetch and rebase. Use a unique private ref and 60-second timeout to isolate each rebase operation and prevent hangs on stalled remotes. Extract gitPullRebaseFromBase to a dedicated module. * fix rebase race by fetching to private ref with timeouts Concurrent fetches can replace FETCH_HEAD and remote-tracking refs between fetch and rebase, causing the rebase to fail. Fetch to a temporary private ref instead, use --no-write-fetch-head when available (Git 2.29+), and serialize FETCH_HEAD access for older versions. Add process termination barriers to ensure proper cleanup and extend timeouts for SSH operations. * Fix rebase race by fetching to both private and tracking refs Concurrent fetches between source and rebase can replace remote-tracking refs, causing rebases to use stale bases. Now fetch to both a private ref and the remote-tracking ref simultaneously, ensuring the tracking ref stays current. Also improves process termination for WSL guests with process-group tracking, fixes process-tree termination timeouts on POSIX, and serializes FETCH_HEAD operations for linked worktrees through their shared Git directory. * Add WSL setsid --wait probe and barrier termination timeout Probe for `setsid --wait` support and fall back to unwrapped execution for BusyBox compatibility. Add a deadline for process termination barriers to prevent hanging when tree termination cannot be verified. Update tests for cross-platform compatibility. * Add wsl-process-group-termination to WSL invocation allowlist * Serialize per-worktree git mutations to fix rebase race Introduce operation locking for each worktree to prevent concurrent mutations (like rebase) from interfering with each other. Ensures rebasing a linked worktree doesn't affect the source worktree state. Add SIGKILL fallback if process termination barriers cannot verify tree termination. * Serialize pull and fastForward operations per-worktree - Extract generic git operation lock to reuse locking pattern - Refactor existing locks to use the generic implementation - Apply per-worktree serialization to pull and fastForward to prevent races * Route WSL group termination through runWslProcess ce743a4fd0 silenced the wsl-invocation boundary guard by appending wsl-process-group-termination.ts to the allowlist. That fixture only grows when the scanner learns to see a spawn it was blind to, and only shrinks for a migration -- this was new code on this branch, so the entry was the boundary regressing rather than the guard getting honest. Migrate the kill instead. terminate() now calls runWslProcess with the script form (`<shell> -c <script> -- <args>`), which keeps the group id in $1, so the payload is unchanged. The script is plain POSIX, so it must not pin shell: 'bash'; it calls only builtins and coreutils on the default PATH and reads no login environment, so loginPath is 'none'. wrapGuestArgs() is untouched: its argv is spliced into git/runner.ts's own wsl.exe invocation, which is a long-standing allowlist entry. The unit test now mocks runWslProcess and asserts the spec shape -- distro, loginPath, the group id in args -- so a regression back to a raw spawn fails here as well as at the boundary guard. * Assert cleanup is defined before accessing properties	2026-08-24 12:11:55 -07:00
Neil	533992bdda	fix(git): cache unsupported capabilities per host (#8109) ... * fix(git): cache unsupported capabilities per host Old Git worktree, ref-search, and merge-tree fallbacks retried unsupported flags on recurring operations, flooding subprocess traces. Centralize capability probing per native, WSL, and SSH execution host, coalesce concurrent probes, and retry periodically for in-place Git upgrades. * fix(git): recognize real old-Git merge-tree rejection * test(git): enforce real binary compatibility matrix * fix(ci): preserve Git compatibility test ownership * fix(git): retain supported capability state	2026-07-10 18:19:36 -07:00