mirror of
https://github.com/stablyai/orca.git
synced 2026-10-22 16:03:47 +00:00
84 lines
4.5 KiB
Markdown
84 lines
4.5 KiB
Markdown
# Restored-shell Codex hook-trust validation
|
|
|
|
## Root cause
|
|
|
|
Restored daemon shells became interactive after the daemon and hook server started, while managed Codex hook reconciliation remained an unawaited background task. A retained shell could therefore launch manually typed `codex` against its launch-time managed home before Orca refreshed that home's hook definitions and trusted hashes. The background repair then made persisted state and later `hooks/list` checks look healthy.
|
|
|
|
The retained shell's launch-time home is independent of the currently selected Codex routing lane. Startup now inventories authoritative live daemon PTYs on every retained-shell startup, resolves only registered Orca-managed host homes, and reconciles those homes before the startup gate completes.
|
|
|
|
## Security boundary
|
|
|
|
- Shared and legacy managed homes resolve only to Orca's private runtime home.
|
|
- Per-account homes pass existing Orca ownership validation.
|
|
- Real-home, WSL, SSH/non-host, unknown, missing-account, and unowned paths are skipped.
|
|
- Enabled settings reinstall/repair only Orca-managed hooks.
|
|
- Disabled settings remove only Orca-managed entries while preserving user hooks.
|
|
|
|
## Electron/CDP reproduction
|
|
|
|
Build:
|
|
|
|
```bash
|
|
pnpm run build:electron-vite
|
|
```
|
|
|
|
Isolated launch (the shortened profile path avoids the Unix-socket path limit):
|
|
|
|
```bash
|
|
/usr/bin/env -u ELECTRON_RUN_AS_NODE -u CODEX_HOME -u ORCA_CODEX_HOME \
|
|
PATH='/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin' \
|
|
HOME='/tmp/orca-rce-060679/home' \
|
|
USERPROFILE='/tmp/orca-rce-060679/home' \
|
|
ORCA_E2E_USER_DATA_DIR='/tmp/orca-rce-060679' \
|
|
ORCA_E2E_HOME_DIR='/tmp/orca-rce-060679/home' \
|
|
ORCA_E2E_HEADFUL=1 NODE_ENV=development \
|
|
'<worktree>/node_modules/.pnpm/electron@43.1.0/node_modules/electron/dist/Electron.app/Contents/MacOS/Electron' \
|
|
out/main/index.js --remote-debugging-port=9460
|
|
```
|
|
|
|
Validation used `agent-browser --cdp 9460` only. A real floating-shell PTY was created, the Electron main process was terminated without stopping the daemon, its pane registry retained the managed shared-home route, and an Orca lifecycle-hook `trusted_hash` was made stale. A deterministic Codex fixture was added only after startup so it reported the same review/ready state from the managed config without allowing generic startup CLI detection to hide the race.
|
|
|
|
Local capture filenames (uploaded to the PR as GitHub attachments; intentionally not committed):
|
|
|
|
- Before: `restored-codex-hook-review-before.png`
|
|
- After: `restored-codex-hook-trusted-after.png`
|
|
- Fresh pane: `fresh-codex-hook-trusted.png`
|
|
- Disabled hooks after retained restart: `restored-codex-hooks-disabled.png`
|
|
|
|
The pre-fix restart retained the stale hash and showed `Hooks need review`. The fixed restart repaired it before `awaitFirstWindowStartupServices()` resolved and the same retained PTY showed trusted/ready. A fresh pane reached normal Codex onboarding without a hook-review prompt. With `agentStatusHooksEnabled: false`, a retained restart left `hooks.json` as `{ "hooks": {} }` and `config.toml` with an empty `[hooks.state]`.
|
|
|
|
## Automated validation
|
|
|
|
```bash
|
|
pnpm exec vitest run \
|
|
src/main/codex/retained-codex-hook-state.test.ts \
|
|
src/main/startup/desktop-startup-ordering.test.ts \
|
|
src/main/codex-accounts/runtime-home-service.test.ts
|
|
|
|
pnpm run typecheck:node
|
|
|
|
pnpm exec oxfmt --check \
|
|
src/main/index.ts \
|
|
src/main/codex-accounts/runtime-home-service.ts \
|
|
src/main/codex-accounts/runtime-home-service.test.ts \
|
|
src/main/codex/retained-codex-hook-state.ts \
|
|
src/main/codex/retained-codex-hook-state.test.ts \
|
|
src/main/startup/desktop-startup-ordering.test.ts
|
|
|
|
pnpm exec oxlint \
|
|
src/main/index.ts \
|
|
src/main/codex-accounts/runtime-home-service.ts \
|
|
src/main/codex-accounts/runtime-home-service.test.ts \
|
|
src/main/codex/retained-codex-hook-state.ts \
|
|
src/main/codex/retained-codex-hook-state.test.ts \
|
|
src/main/startup/desktop-startup-ordering.test.ts
|
|
|
|
git diff --check
|
|
```
|
|
|
|
Results: 113 focused tests passed; node typecheck, formatting, direct oxlint, diff check, and Electron build passed. The aggregate changed-code script was not used because Node 26's unsupported-engine warning breaks its JSON parser; direct oxlint covered all changed source files.
|
|
|
|
## Remaining risk
|
|
|
|
The repair deliberately covers only host-side Orca-managed runtime homes recorded for live PTYs. Folder workspaces use the same verified host-home path; real-home, WSL, SSH, and arbitrary user or repository hook paths are not auto-trusted, and their existing launch-specific flows remain unchanged.
|