Files
orca/config/scripts/verify-packaged-daemon-entry.test.mjs
T
Jinwoo HongandNeil 3f8d296b8d fix(macos): preserve terminal permissions across app updates with a small signed helper (#27021)
* fix(macos): preserve terminal privacy identity across app updates

* test(macos): make launchd fixtures portable across host platforms

* fix(macos): probe protected contents and close handles on denial

* fix(i18n): register terminal permission status labels

* fix(macos): fork the daemon when no stable-bundle job can claim the endpoint

A copy, signature, plist or deadline failure before bootstrap, a bootstrap
launchd refused with the job absent, a job whose daemon exited before
answering, and a foreign endpoint all threw out of the launcher. The app then
lost its persistent daemon and fell back to local PTYs, where main forks one.
These now fall through to the existing fork path, which also adopts a foreign
occupant normally instead of as a degraded endpoint. A timed-out bootstrap or
a job still running/unreadable stays fatal, so no second daemon races it.

* feat(telemetry): split daemon origin events by stable-copy launch method

daemon_adopted, daemon_pty_cwd_denied and daemon_pty_cwd_readable gain a
closed-enum launch_method (stable-copy / app-fork / unknown), read from the
spawner path the daemon recorded, so the update fix is measurable per daemon
even when an old forked daemon is adopted across updates. The reliability
gate is a test manifest with no runtime switch, so there is no gate state to
report; spawner_path_class reports the private copy as 'other' alongside
other non-/Applications installs.

* refactor(telemetry): report the stable copy as a spawner path class

The separate launch_method property duplicated what the recorded spawner
path already says. spawner_path_class gains `stable-copy`, classified from
the same path under the private runtime root, and launch_method, its enum
and classifier are removed from all three .strict() daemon origin events.
A deleted copy still reports `missing`.

* refactor(settings): gate terminal-host Full Disk Access on macOS once

The permissions handler already asks for the terminal-host status only on
macOS, so the status function's own platform check and the pane's
'unsupported' branch could never fire. The off-macOS guarantee is now
tested at the handler.

* fix(macos): keep the fork fallback inside the startup PTY gate

The stable launch could run until 55 s after the launch started, so a late
"unavailable" verdict left the fork fallback's own 10 s readiness wait to
finish after the 60 s gate had already moved the app to local PTYs.

The launcher now gives the stable attempt one handoff deadline: the gate
minus the fork's readiness timeout and the 5 s lease/adapter allowance
(45 s). Copy, signature check and plist conversion share one abort signal
that ends early enough for bootstrap and the job's own readiness wait to
meet that deadline; every command otherwise keeps a fixed timeout. An
unavailable verdict past the deadline is reported instead of forking a
daemon that cannot arrive in time. The per-step budget module is gone (its
deletion landed in the previous commit by a staging slip).

The launch body is now two blocks: preparation (plist, plutil, deadline
check) fails as unavailable after removing the copy and job file, and
bootstrap runs in its own try/finally that always deletes the job file.

Retirement is simpler and claims more orphans: one in-flight collection per
process instead of a per-root map and rotating 20-record scan, and the job
record (written before copying) no longer carries a bundle name because
lsof +D scans the whole runtime directory (measured equal cost, same
result on a live copy). A never-submitted copy is retired once its producer
has exited and its job is missing, so a bootstrap timeout or a crash
mid-copy no longer leaves a copy forever; the open-file check still guards
deletion. Collection now starts from the launcher after the attempt.

* docs(macos): ship the daemon launch rules, not the investigation

The signed investigation harness left the tree in the previous telemetry
commit by a staging slip; its results and pinned link stay in the PR. This
trims the reference doc to why the copy and launchd exist, the fallback
states and the cleanup rule, trims the reliability gate to what its
validator needs, and points AGENTS.md at the reference doc next to the
Windows relocation entry.

* fix(macos): hand off to the fork as soon as the stable job exits

A copied daemon refused at exec (for example by Gatekeeper) never answers,
so every fresh start paid the full 10 s readiness wait before the fork
fallback. The readiness loop now reads the job state every 500 ms and
abandons as soon as the job is stopped or missing; a running or
unreadable job is still waited out and never forked beside.

Also drops the dead forkEntryPath the stable launch never read (its
options type now omits it) and un-exports the handoff constant.

* fix(macos): keep daemon copies out of Spotlight and unregister retired ones

Each runtime copy is a full Orca.app, so Spotlight indexed it as an app
and LaunchServices kept a record for it that outlived the copy. A
registered copy claims orca: links and Markdown/CSV files, and becomes
their default handler whenever /Applications/Orca.app is not registered.

New copies go under runtime-*/app.noindex/, which Spotlight skips and which
stops the record LaunchServices made while the bundle was being copied.
Retirement now runs lsregister -u on every bundle in the copy (both the
app.noindex layout and the earlier runtime-*/Orca.app layout) once lsof
shows it unused, then deletes it. A running copy stays registered,
because Local Network access may be resolved through that record.

Collection and stable-copy telemetry match the runtime-* directory, so
copies made before this change are still adopted, classified and retired.

* docs(macos): record the LaunchServices trade-off and the rollback plan

The reference doc now explains why copies sit in a .noindex folder, why
only retired copies are unregistered, and how to turn the copy launch off:
make launchMacDaemonFromStableBundle return null, and keep the retirement
code until no copy-launched daemon can remain, because the old code never
deletes copies.

A test pins that rollback: with the stable launcher returning null, the
launcher forks and still runs the copy collection.

* fix(macos): keep daemon copies registered so Local Network can resolve them

The `.noindex` folder kept copies out of Spotlight and LaunchServices, but
Local Network access is resolved from the signing identifier through
LaunchServices to the executable's Mach-O UUID. After an update that changes
Electron only the copy carries the running daemon's UUID, so an unregistered
copy risks the same Local Network loss main has today. Copies go back to
`runtime-*/Orca.app`; retirement still unregisters each copy before deleting
it, so deleted copies leave no LaunchServices entry. The remaining trade-off:
while `/Applications/Orca.app` is missing, a running registered copy can be
picked for `orca:` links and documents.

* fix(macos): hide daemon copies from Spotlight and tie the job to Orca

Spotlight listed each runtime copy as a second Orca app. New copies go
back under runtime-*/app.noindex/Orca.app, which Spotlight skips.
Retirement and stable-copy telemetry match the runtime-* directory, so
copies in the earlier runtime-*/Orca.app layout still retire and classify
the same way.

Local Network access identifies the daemon by its code signature and
main-executable UUID, not by a LaunchServices record, so an unregistered
copy keeps it. The launchd job now sets AssociatedBundleIdentifiers to
com.stablyai.orca, which is how a job not installed through SMAppService
names the app it belongs to. Copies are never registered explicitly;
retirement still runs lsregister -u before deleting each one.

* feat(macos): package a signed terminal host helper that runs the daemon on the pinned Node

Contents/Helpers/Orca Terminal Host.app carries the pinned Node, the daemon's
out/main JS and this slice's node-pty, signed inside-out as com.stablyai.orca.
afterPack boots it through one PTY round trip, then fails the build on layout,
Info.plist, macOS floor (NODE_RUNTIME_DARWIN_MINIMUM_OS vs Node's minos),
architecture or signature drift.

* ci(macos): cache and prefetch the pinned Node before packaging

Packaging now fetches the darwin Node from nodejs.org, whose download has no
retry. Each mac workflow caches it with the electron-builder downloads, keyed on
the pin, and warms both darwin targets inside the existing retry wrapper.

* feat(macos): launch the daemon from a copy of the terminal host helper, not the whole app

The stable launch now clones Contents/Helpers/Orca Terminal Host.app (~124 MiB
instead of ~628 MiB) and runs its Node on its daemon entry, without
ELECTRON_RUN_AS_NODE. The copy must still match the running app's designated
requirement. A missing helper falls back to the fork, and macOS below the
helper's Node floor forks without copying.

* docs(macos): describe the terminal host helper, its floor and its identity

* fix(macos): bound the terminal host boot check by its deadline and always clean up

A daemon that stayed silent hung packaging past the 20 s deadline; one that closed the
connection left the hello unsettled so Node exited 0 without cleanup; a malformed line threw
uncaught. Every connect, hello and PTY wait now races the deadline, close/error/parse failures
reject, and the daemon and scratch dir are removed on every path.

* ci(macos): cache the pinned Node on its own key with no restore-keys fallback

Sharing the electron-builder cache let old Node archives accumulate through restore-keys.
Also moves release-mac-build's Electron cache comment back onto its step.

* fix(macos): reject a universal slice for the terminal host and pin its name in one test

packageMacTerminalHost turned an unknown arch into darwin-undefined; it now throws through the
shared mac arch mapping. A test asserts the packager and the desktop agree on the helper bundle
and executable names, replacing a Linux/Windows test that could not fail.

* fix(macos): pass the launchd adoption lease its options object after the main merge

* test(macos): accept a reset as the daemon closing the boot-check connection; keep only passing gate commands

* fix(daemon): bump the terminal daemon protocol to v45 so new macOS tabs start in the terminal host helper

* fix(macos): ship the daemon's required packages in the terminal host and boot it outside the build tree

* style(macos): use a template literal in the terminal host resolution check

* fix(macos): derive the terminal host's packages from the daemon's own module graph

* fix(macos): treat any non-literal daemon load as computed, follow directory loads, and keep nested dependencies

* refactor(macos): move terminal-host telemetry, Settings status and Helper folder strings to a follow-up

Keeps this change to the update-safe terminal host itself. The follow-up restores:
- the `stable-copy` spawner path class in daemon adoption telemetry;
- the per-terminal-host Full Disk Access row in Settings and its daemon RPC;
- writing folder usage descriptions into the app's Electron Helpers for the fork fallback.

The helper still takes its Desktop, Documents and Downloads descriptions from
`macos-folder-usage-descriptions.cjs`, so that constant stays.

* fix(i18n): restore en.json to this branch's base, not newer main

The previous commit took the file from a newer main, which pulled unrelated strings into this PR.

* refactor(macos): publish one terminal-host copy per helper build under a fixed launchd label

Name the copy after the helper's CDHash, reuse it when present, and
publish a new one by cloning into a staging dir, verifying it once
against the app's designated requirement and renaming it into place.
One launchd label per profile and protocol replaces per-launch labels,
so job.json, producer pids and per-label collection go away. Retirement
deletes any other copy lsof shows unused. The stable launcher returns
null for every fork fallback and logs its reason.

* fix(packaging): copy terminal-host dependencies from where Node resolves them

A nested package's own dependencies were never walked, so a hoisted
dependency of a nested package was left out of the helper. Resolve each
dependency through the node_modules lookup Node performs from its parent
and copy it to the same relative place, unless a copied package already
carries it.

* fix(packaging): fail release and CI mac builds that cannot boot a terminal-host slice

An arm64 runner without Rosetta skipped the x64 helper's PTY boot check
and shipped the slice untested. Release channels and CI now fail there;
local cross-arch builds still skip with a log line.

* docs(macos): describe the per-build terminal-host copy and its fallback reasons

* docs(macos): keep the codesign command on one line

* test(macos): type the launchd test state without an assertion

* docs(macos): name what the login-session flag gates in the stable launcher

* fix(macos): wait for launchd to drop a booted-out terminal job before reusing its label

---------

Co-authored-by: Neil <neil@stably.ai>
2026-10-11 14:54:36 -04:00

154 lines
5.5 KiB
JavaScript

import { mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
import { createRequire } from 'node:module'
import { tmpdir } from 'node:os'
import { join } from 'node:path'
import { afterEach, beforeEach, describe, expect, it } from 'vitest'
const require = createRequire(import.meta.url)
const {
assertPackagedDaemonEntryExists,
runTerminalHostRoundTrip,
verifyPackagedDaemonEntryBoots,
verifyPackagedMacTerminalHostBoots
} = require('./verify-packaged-daemon-entry.cjs')
describe('verify-packaged-daemon-entry', () => {
let resourcesDir
beforeEach(() => {
resourcesDir = mkdtempSync(join(tmpdir(), 'orca-daemon-entry-verify-'))
})
afterEach(() => {
rmSync(resourcesDir, { recursive: true, force: true })
})
function writePackagedEntry(source) {
const entryDir = join(resourcesDir, 'app.asar.unpacked', 'out', 'main')
mkdirSync(entryDir, { recursive: true })
writeFileSync(join(entryDir, 'daemon-entry.js'), source)
}
// Why: a silent skip on a missing entry false-passed exactly the packaged
// layout regression this gate exists to catch (rc.1 daemon-load incident).
it('throws when the unpacked daemon entry is missing', () => {
expect(() => assertPackagedDaemonEntryExists(resourcesDir)).toThrow(
/missing unpacked daemon entry/
)
expect(() => verifyPackagedDaemonEntryBoots(resourcesDir)).toThrow(
/missing unpacked daemon entry/
)
})
it('passes when the packaged entry loads and reaches argv parsing', () => {
writePackagedEntry('console.error("Usage: daemon-entry <socket>"); process.exit(1)\n')
expect(() => verifyPackagedDaemonEntryBoots(resourcesDir)).not.toThrow()
})
it('fails when the packaged entry cannot resolve its module graph', () => {
writePackagedEntry('require("orca-module-that-does-not-exist")\n')
expect(() => verifyPackagedDaemonEntryBoots(resourcesDir)).toThrow(
/failed to load under plain Node/
)
})
it('fails when the packaged entry never reaches argv parsing', () => {
writePackagedEntry('process.exit(0)\n')
expect(() => verifyPackagedDaemonEntryBoots(resourcesDir)).toThrow(/did not reach argv parsing/)
})
})
describe('terminal host boot check on a slice this host cannot run', () => {
// No Mac runs a riscv64 binary, so this is the same path as an x64 slice without Rosetta.
it('fails a release or CI build', async () => {
await expect(
verifyPackagedMacTerminalHostBoots('/Orca.app', { arch: 'riscv64', required: true })
).rejects.toThrow(/riscv64 cannot run on this/)
})
it('lets a local build skip it', async () => {
await expect(
verifyPackagedMacTerminalHostBoots('/Orca.app', { arch: 'riscv64', required: false })
).resolves.toBeUndefined()
})
})
describe.skipIf(process.platform === 'win32')('terminal host round trip', () => {
let root
beforeEach(() => {
root = mkdtempSync(join(tmpdir(), 'vpd-'))
})
afterEach(() => {
rmSync(root, { recursive: true, force: true })
})
// Listens, publishes its token, records its pid, then treats each connection with `onConnection`.
function fakeDaemon(onConnection) {
const entry = join(root, 'daemon.cjs')
writeFileSync(
entry,
[
"const net = require('node:net'), fs = require('node:fs')",
'const arg = (name) => process.argv[process.argv.indexOf(name) + 1]',
`fs.writeFileSync(${JSON.stringify(join(root, 'pid'))}, String(process.pid))`,
`net.createServer(${onConnection}).listen(arg('--socket'), () => fs.writeFileSync(arg('--token'), 'tok'))`
].join('\n')
)
return entry
}
async function roundTrip(entry, timeoutMs) {
const startedAt = Date.now()
const error = await runTerminalHostRoundTrip({
command: [process.execPath],
entry,
deadline: startedAt + timeoutMs,
stderr: [],
scratchPrefix: join(root, 'oth-')
}).then(
() => null,
(rejection) => rejection
)
const pid = Number(readFileSync(join(root, 'pid'), 'utf8'))
let daemonAlive = true
try {
process.kill(pid, 0)
} catch {
daemonAlive = false
}
return {
error,
elapsedMs: Date.now() - startedAt,
daemonAlive,
scratchDirs: readdirSync(root).filter((name) => name.startsWith('oth-'))
}
}
it('rejects by the deadline and cleans up when the daemon never answers the hello', async () => {
const result = await roundTrip(fakeDaemon('() => {}'), 1_500)
expect(result.error?.message).toMatch(/timed out waiting for the control hello reply/)
expect(result.elapsedMs).toBeLessThan(1_500 + 5_000)
expect(result.daemonAlive).toBe(false)
expect(result.scratchDirs).toEqual([])
})
it('rejects at once and cleans up when the daemon closes the connection', async () => {
const result = await roundTrip(fakeDaemon('(socket) => socket.destroy()'), 10_000)
// A destroyed socket with unread input may surface as a reset instead of a clean close.
expect(result.error?.message).toMatch(/closed the control connection|ECONNRESET/)
expect(result.elapsedMs).toBeLessThan(10_000)
expect(result.daemonAlive).toBe(false)
expect(result.scratchDirs).toEqual([])
})
it('rejects and cleans up when the daemon replies with malformed JSON', async () => {
const result = await roundTrip(fakeDaemon("(socket) => socket.write('{not json\\n')"), 10_000)
expect(result.error?.message).toMatch(/non-JSON control line: \{not json/)
expect(result.elapsedMs).toBeLessThan(10_000)
expect(result.daemonAlive).toBe(false)
expect(result.scratchDirs).toEqual([])
})
})