Skip to content

Fix Apple resident network recovery service label #47

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gitcommit90 merged 1 commit into from
Aug 1, 2026
+2 −1
Merged

Fix Apple resident network recovery service label #47

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/server/channel-computers.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -593,7 +593,7 @@ async function repairAppleGuestNetwork(computer: ChannelComputer): Promise<void>
// the same fleet-wide outage during one reconciliation pass.
if (now() - appleNetworkRepairAt > 30_000) {
if (platform() === "darwin") {
const label = `gui/${process.getuid?.() ?? 501}/com.apple.container.container-network-vmnet.default`;
const label = `gui/${process.getuid?.() ?? 501}/com.apple.container.network.container-network-vmnet.default`;
const kicked = await spawnCollected("/bin/launchctl", ["kickstart", "-k", label], { timeoutMs: 30_000 });
if (kicked.code !== 0) throw new Error(kicked.stderr.toString("utf8").trim() || "Apple shared VM network service could not restart");
}
Expand Down
1 change: 1 addition & 0 deletions test/channel-computers.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,6 +154,7 @@ test("Apple channel-computer contract preserves isolation, files, wakes, archive
assert.ok(calls.some((call) => call.includes("-w") && call.includes("/workspace") && call.some((word) => word.includes("/bin/bash")) && call.some((word) => word.includes("-lc"))), "resident commands execute in the correct VM workspace");
assert.equal(db.q1("SELECT disk_bytes FROM channel_computers WHERE channel_id=?", beta.channelId).disk_bytes, computers.MANAGED_CHANNEL_DISK_BYTES, "reported storage is the managed writable allocation, not Apple's host-backed virtual capacity");
const backend = await readFile(join(root, "src", "server", "channel-computers.ts"), "utf8");
assert.match(backend, /com\.apple\.container\.network\.container-network-vmnet\.default/, "network recovery restarts Apple's installed vmnet launch service");

@coderabbitai coderabbitai Bot Aug 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Bind the regression assertion to the launchctl invocation.

The current assertion passes if the service label appears anywhere in backend. It does not prove that launchctl kickstart uses this label. Match the label together with the ["kickstart", "-k", label] arguments, or also assert that the old label is absent.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/channel-computers.mjs` at line 157, Update the regression assertion in
the network recovery test to verify that the Apple vmnet service label is passed
specifically to the launchctl kickstart invocation with the "-k" argument,
rather than merely appearing somewhere in backend. Keep the assertion focused on
the generated command and optionally ensure the old label is absent.

assert.match(backend, /terminal \? \["-it"\] : pipeInput \? \["-i"\]/, "Apple terminal and streamed-stdin invocations request the exact interactive mode they need");
assert.match(backend, /isolatedInvocation\(\["\/bin\/bash", "-l"\][\s\S]*true\)/, "interactive isolated terminals request an explicit guest login shell");
assert.match(backend, /args: \[\.\.\.words, \.\.\.guestWords\(\.\.\.args\)\]/, "Apple guest argv remains quoted for the runtime's documented second shell parse");
Expand Down
Loading