[1987 by GPT-5.6 Sol] Expose a secret-free ProPR Connect discovery contract for desktop - #1989
Open
propr-dev[bot] wants to merge 25 commits into
Conversation
![propr-dev[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
…covery contr Implemented by ProPR AI using gpt-5.6-sol model. Implementation completed successfully.
Contributor
Author
|
/ultrafix |
Contributor
Author
|
🔄 Ultrafix loop started (goal: 8/10, max cycles: 10) First action:
|
Checks FailedValidation failed during setup, tests, CLI packaging, linting, or build checks. View Logs |
Contributor
Author
|
✅ Applied the requested follow-up changes in commit f8ad104 Summary of ChangesFixed PR #1989’s build regression in runtimeConfig.ts. The UI now trims redundant trailing slashes before strict proxy URL validation, while continuing to reject paths, queries, fragments, ports, and userinfo. Validation passed:
Only the requested file was modified; no commit was created. 🤖 Implementation Details
Undo Changes • View Task Execution 💡 ProPR Slash Commands
🤖 Generated by ProPR |
…p/git-processor/worktrees/integry/propr/pr-1989-followup-2026-08-29T21-41-13/propr-ui/src/config/runtimeConfig.ts:121). Fixed PR #1989’s build regression in [runtimeConfig.ts](/tmp/git-processor/worktrees/integry/propr/pr-1989-followup-2026-08-29T21-41-13/propr-ui/src/config/runtimeConfig.ts:121). The UI now trims redundant trailing slashes before strict proxy URL validation, while continuing to reject paths, queries, fragments, ports, and userinfo. Validation passed: - Exact hosted-tunnel regression suite: 317/317 - UI tests: 66/66 - UI typecheck - UI lint - `git diff --check` Only the requested file was modified; no commit was created. PR: #1989 Comment by: @github-actions[bot] (ID: 5465042091) Model: gpt-5.6-sol
Owner
|
/review Review exact Connect discovery head f8ad104 as the CLI and API security gate before desktop consumption. Audit propr connect status --json --root end to end: explicit non-scanning root authority; terminal and ancestor symlink or replacement handling; ownership and private directory assumptions; exactly one bounded machine-readable stdout document; stable exit codes; no env values, connector token, relay token, GitHub token, credential path, private path, Docker output, or secret-bearing error on stdout or stderr. Verify trusted no-shell CLI invocation compatibility and bounded service-state, fetch, redirect, response-size, UTF-8, schema, timeout, and late-settlement behavior. Audit the shared public installation identity for randomness, cross-restart CLI and API consistency, owner-write integrity, atomic concurrent creation, crash or partial-write recovery, stack-data replacement semantics, and zero dependency on installation IDs or credentials. Audit the unauthenticated API discovery route for strict bounded schema, rate limiting, no-store behavior, redacted failures, and exact canonical managed endpoint only. Verify origin plus identity plus compatibility pinning, endpoint mismatch restartRequired, stale or reassigned host rejection, permanent hostname retirement as an explicit Connect control-plane invariant, and strict ASCII HTTPS t-.propr.dev parsing with no IDNA lookalike, alternate spelling, userinfo, port, path, query, or fragment. Preserve propr tunnel behavior and existing setup commands; check old stacks, disabled or stopped sidecars, API 404, non-JSON and oversized responses, Windows and Unix semantics, and the hosted UI trailing-slash compatibility fix. This PR exposes only the discovery contract; desktop execution and confirmation are later integration work. No code changes. Report exact-head blocker IDs and score. |
Contributor
Author
|
✅ AI Code Review Complete requested by @integry Posted 1 review: |
Contributor
Author
🔍 AI Code Review — codex:gpt-5.6-solOverall EvaluationThis PR establishes the Connect discovery contract with strong canonical-origin, identity, and compatibility checks, but it needs significant changes before merge. The current checks are green, yet several security-boundary and durability cases remain incorrect. ✅ Canonical endpoint validation — The shared parser uses ASCII filtering, structured URL parsing, and raw canonical equality to reject IDNA lookalikes, userinfo, ports, paths, queries, fragments, trailing dots, and other spellings. ✅ Secret-minimized failure handling — CLI failures collapse to fixed reason codes and generic stderr, while the unauthenticated API route returns a redacted 503 response with no-store headers. ✅ Multi-factor readiness decision — A ready result requires compatible API metadata plus matching installation identity and canonical endpoint; an origin mismatch correctly requests an API restart. Merge blockersEvery finding below was introduced by this PR and must be resolved before merging. F1: 🔴 Root authority remains replaceable
F2: 🔴 Identity publication is not atomic
F3: 🔴 Identity integrity is not enforced
F4: 🔴 Remote schema validation is incomplete
F5: 🔴 Rejected responses can stream indefinitely
F6: 🔴 Invalid UTF-8 gets the wrong exit class
F7: 🔴 Tunnel setup lost slash compatibility
SuggestionsThese are optional follow-ups and are not sent to S1: 🟢 Add a spawned CLI contract testRun the packaged command through a no-shell argv invocation with sentinel environment values, Docker failures, malformed roots, and captured stdout/stderr. Current tests exercise the state machine directly, so this optional defense would detect future framework or orchestration output contamination. S2: 🟢 Refresh desktop pairing documentation
ScoreThe architecture is promising and all current checks pass, but the unresolved root-authority, identity durability/integrity, probe-bounding, schema, and compatibility regressions prevent using this head as the desktop security gate. Score: 4/10 🤖 Review Details
🤖 Review by ProPR |
Owner
|
/fix F1 F2 F3 F4 F5 F6 F7 Fix all seven exact-head blockers together on f8ad104. Preserve the strict canonical managed-origin design and all green behavior. F1 root authority: resolve config manager and load code before acquiring root authority, then keep every root-dependent read and identity operation inside one anchored, synchronous, identity-checked snapshot with no await gap. Validate terminal root and relevant ancestry against symlinks or reparse points, replacement, non-owner modification, and unsafe ACL or mode using platform-appropriate file identity and permissions; validate before and after and fail closed where authority cannot be proven. Do not return a reusable trusted pathname and do not scan for roots. Deterministically replace or rename the root between acquisition and env, data, and identity access on Unix and Windows simulations; no replacement bytes are read and status is INVALID_ROOT. F2 and F3 identity: centralize CLI and API creation rules. Require a real private non-symlink data directory, created 0700 independent of umask, and a bounded regular single-link identity file with no group or world write. Define the cross-container owner model explicitly: the directory owner is the host caller; an identity file may be owned only by that directory owner or the root API container account, and must be readable but not writable by unrelated principals. Reject replaceable directories, symlinks, hardlinks, special files, unsafe modes, or unexpected owners. Write an exclusive same-directory temporary, fsync full bytes, publish atomically without overwriting a concurrent winner, fsync the parent, clean temp, and read the winner. No empty final file may ever be visible. Handle concurrent winners and safely recover a recognized interrupted first-creation artifact without replacing a valid identity. Test concurrent CLI and API creators, interruption after each boundary, restart durability, umask independence, malicious permissions, root-owned container file plus host read, and data replacement yielding a fresh identity. F4: strictly parse the entire exact v1 response before casting. Validate schemaVersion and product; bounded canonical version and non-empty API and UI compatibility formats; exact public UUID; canonical endpoint; and every required desktopAuthentication key, protocolVersion, and boolean with no capability omission or type coercion. Prefer one shared parser used by producer tests and consumer. Invalid or incomplete documents are incompatible DISCOVERY_INVALID, never ready. F5 and F6: cancel or abort response bodies on every early branch including 404, other non-success, wrong content type, oversized declared length, parse error, invalid schema, and timeout. Ensure no late stream remains after return. Classify fatal UTF-8 and JSON or schema failures as invalid exit 3, transport failures as unreachable exit 2, and hard deadline as timeout exit 5. Add never-ending body and late-settlement regressions for each rejected branch. F7: restore existing propr tunnel setup compatibility by normalizing redundant trailing slashes before its strict parser, without weakening canonical parsing at the discovery trust boundary. Keep userinfo, ports, paths, query, fragment, encoded authority, IDNA, and trailing dots rejected. Required integration proof beyond the review: spawn the actually built CLI through a no-shell argv call for propr connect status --json --root with sentinel env values, Docker output and failures, malformed and replaced roots, all exit classes, and captured stdout plus stderr. Ready and every failure must emit exactly one bounded parseable JSON document on stdout; stderr is fixed and bounded and contains no env value, connector token, relay token, GitHub token, credential path, private root path, Docker text, raw URL, or sentinel. Update desktop-pairing docs to the v1 schema, endpoint, identity, and capability contract. Run CLI/API/shared/tunnel/launcher/hosted-UI tests, spawned packaged CLI tests on Unix and Windows semantics, typechecks, full suite, package guard, and git diff --check. Do not implement desktop consumption in this PR and do not merge to main. |
Contributor
Author
|
✅ Applied the requested follow-up changes in commit c54a68f
Summary of ChangesImplemented all selected blockers F1–F7. Key results:
Verification:
🤖 Implementation Details
Undo Changes • View Task Execution 💡 ProPR Slash Commands
🤖 Generated by ProPR |
Owner
|
Independent exact-head additions for the active discovery fix on f8ad104: A. Explicit-root CLI isolation is currently broken. B. Docker execution failure is captured but its status/error is ignored, so missing Docker, daemon failure, timeout, or spawn error becomes SIDECAR_NOT_RUNNING exit 2. Classify tool/internal failures as bounded internalFailure exit 1; reserve exit 2 for a successful bounded inspection proving a legitimate not-ready state. C. Global D. Scheme-less fallback reconstructs only Add actual spawned CLI and middleware regressions for all four; preserve F1-F7 and fail-closed identity behavior. |
Implemented all selected blockers F1–F7. Key results: - Root access now uses one synchronous, descriptor-anchored, identity-checked snapshot; replacements and unsafe ancestry fail with `INVALID_ROOT`. Windows semantics fail closed when authority cannot be proven. - CLI/API identity creation is centralized, permission-checked, atomic, durable, concurrency-safe, and interruption-recoverable. - Discovery v1 parsing is strict and shared between producer and consumer. - Every rejected/timeout response body is cancelled; invalid, unreachable, and timeout exit classes are separated correctly. - Tunnel setup again normalizes redundant trailing slashes before strict validation. - Added packaged CLI, replacement, concurrency, interruption, body-stream, schema, and Unix/Windows-semantics regressions. - Updated desktop-pairing documentation. - No commit or PR operations performed. Verification: - Focused CLI/API/shared/tunnel/launcher/hosted-UI tests: passed. - Packaged CLI integration tests: passed. - Typechecks and lint: passed. - CLI package guard (`npm run cli:pack`): passed. - `git diff --check`: passed. - Full suite: 322/323 runners passed; all 69 UI files and 496 UI tests passed. The sole exception was the pre-existing Redis-backed `llmMetrics.test.ts`, which timed out because Redis and a Docker daemon are unavailable in the agent image. PR: #1989 Comment by: @integry (ID: 5465164512) Model: gpt-5.6-sol
Checks FailedValidation failed during setup, tests, CLI packaging, linting, or build checks. View Logs |
Owner
|
!propr Fix only the remaining independent exact-head blockers on c54a68f while preserving F1-F7. Do not merge or sync the base. A. Make explicit-root discovery hermetic. Skipping dotenv for one argv position is insufficient: B. Preserve Docker execution result, not a boolean. Missing binary, spawn error, daemon failure, timeout, signal, malformed/truncated inspection or nonzero status is C. Put discovery cache prohibition ahead of every limiter/response path or attach it at the earliest D. Strictly validate raw scheme-less Connect selectors before URL reconstruction. Accept only one canonical Run spawned packaged CLI tests, discovery/API rate-limit tests, shared/hosted pairing and tunnel tests, CLI/API/shared/UI typechecks, CLI pack, configured full suite and git diff --check. No unrelated changes. |
Contributor
Author
|
✅ Applied the requested follow-up changes in commit c551b65 Summary of ChangesImplemented the remaining A–D blockers on the exact existing head without merging, syncing, or committing. Key fixes:
Validation passed:
The configured full suite passed 322/323 runs. The sole failure was the unrelated Redis-dependent 🤖 Implementation Details
Undo Changes • View Task Execution 💡 ProPR Slash Commands
🤖 Generated by ProPR |
Owner
|
Additional independent exact-head blockers to preserve through the active/following c54a68f fix cycle: E. F1 is incomplete cross-platform. F. Identity no-replace publication uses G. Close the response-body abort-listener race. After the pre-read signal check and before/during H. Reject redundant origin spellings at the discovery boundary. The launcher currently removes exactly one trailing slash, so F3/F4/F6/F7 otherwise look materially fixed. Do not weaken the exact schema/UTF-8/identity mismatch guarantees. |
Owner
|
Exact c54a68f CI integration blocker: |
…g head without merging, syncing, or committing. Implemented the remaining A–D blockers on the exact existing head without merging, syncing, or committing. Key fixes: - Hermetic explicit-root discovery with robust `--root` parsing and a minimal non-ProPR environment allowlist. - Docker execution failures now produce `internalFailure`/exit 1; exit 2 is reserved for proven not-ready states. - No-store headers apply at the earliest `/api` boundary, including limiter and error responses. - Strict raw Connect selector validation and consistent case normalization across shared, API, UI, CLI, and launcher paths. - Added packaged hostile-CWD/env CLI tests, Docker failure regressions, real global limiter saturation, and selector parity tests. Validation passed: - CLI/API/shared/UI typechecks - CLI/API/UI lint - Focused CLI, API, pairing, tunnel, rate-limit, and UI tests - CLI packaging - `git diff --check` The configured full suite passed 322/323 runs. The sole failure was the unrelated Redis-dependent `test/llmMetrics.test.ts`, which timed out while Redis at `127.0.0.1:6379` was unavailable. PR: #1989 Comment by: @integry (ID: 5465371272) Model: gpt-5.6-sol
…ompletion until the exact-head hosted Windows jobs and packed-install smoke pass. Changes are staged, but I’m intentionally not claiming PR completion until the exact-head hosted Windows jobs and packed-install smoke pass. Implemented: - Pinned modern Roslyn/MSVC build with bounded, redacted diagnostics and nine failure regressions in [build-windows-authority-helper.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1989-followup-2026-08-30T10-12-53/packages/cli/scripts/build-windows-authority-helper.mjs). - Canonical provenance manifest, derived Authenticode leaf/SPKI pins, retained build leases, source/tool hashes, and signed-package validation. - Native suspended Windows helper launch with identity/hash/signature checks, kill-on-close jobs, and expanded 56-counter Windows proof. - Fresh packed-install discovery and missing/tampered/wrong-target fail-closed smoke in [verify-packed-windows-connect.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1989-followup-2026-08-30T10-12-53/scripts/verify-packed-windows-connect.mjs). - CI wiring for helper artifacts, diagnostics, native proof, and packed smoke. Locally passed: - CLI typecheck - Compiler diagnostics: 9/9 - Platform-safe Connect: 65/65 - Unit suite: 281/281 - Script syntax and ESLint: no errors - Source-hash verification and `git diff --check` Hosted Windows compilation/native/package execution, macOS native proof, and actionlint remain unverified here; this runner lacks Windows and Docker/actionlint. No commit was created. PR: #1989 Comment by: @integry (ID: 5468072824) Model: gpt-5.6-sol
Owner
|
!propr Fix the exact-head hosted Windows bootstrap, initial launcher authority, toolchain provenance and real installed Connect smoke blockers on a5503d1. Do not merge or sync transport. Preserve modern Roslyn intent, bounded fixed diagnostics, no-replace publication/cleanup, derived production signer pins embedded and cross-checked, native held helper fd/full ID/hash/suspended job launch, split-chunk framing, settling invalidation, green macOS 65/65 plus native 6/6/29, and actual npm pack/install entrypoint coverage.
|
Contributor
Author
|
✅ Applied the requested follow-up changes in commit c2f049b Summary of ChangesImplemented the requested follow-up without merging, syncing, or committing. Key changes:
Validation passed:
Windows-native compilation and packed smoke require the hosted Windows runner and could not be executed locally. 🤖 Implementation Details
Undo Changes • View Task Execution 💡 ProPR Slash Commands
🤖 Generated by ProPR |
…g, or committing. Implemented the requested follow-up without merging, syncing, or committing. Key changes: - Replaced invalid `GLOBALROOT` PowerShell spawning with a checksum-authenticated native Windows directory probe and valid canonical Win32 path. - Added alternate-drive, x64/arm64, hostile environment, UNC, and NT-alias validation. - Added native pre-CreateProcess broker leasing, full file identity/hash checks, protected DACLs, suspended job launch, loaded-image verification, and mutation handshake. - Hardened compiler provenance, private staging, exact Microsoft signer subjects, include/lib inventories, and explicit held `link.exe` invocation. - Replaced hollow manifest/publication/runtime-compiler credits with real mutation probes; unsigned validation no longer claims signer pins. - Reworked packed-install smoke around the actual npm-installed `propr.cmd`, a real local HTTPS discovery endpoint, and native Docker-status fixture. It now covers ready, missing, malformed, wrong-target, stale, missing-helper, tampered-helper, and wrong-helper cases. Validation passed: - CLI lint - CLI build and typecheck - Windows build diagnostics: 12/12 - Connect status tests: 13/13 - Platform-safe Connect suite: 65/65 - Source hashes, syntax, and `git diff --check` Windows-native compilation and packed smoke require the hosted Windows runner and could not be executed locally. PR: #1989 Comment by: @integry (ID: 5468316123) Model: gpt-5.6-sol
Owner
|
!propr Fix the exact-head bootstrap deadlock and remaining first-launch/toolchain/evidence authority blockers on c2f049b. Do not merge or sync transport. Preserve protected private staging, explicit linker intent, include/lib inventories, exact subject strings, real npm-installed propr.cmd plus native docker fixture and local TLS Connect-compatible endpoint, negative tunnel cases, forbidden runtime compiler hooks, derived production pin embedding, held staged-helper identity/suspended jobs, framing and macOS 65/65 plus native 6/6/29.
|
Contributor
Author
|
✅ Applied the requested follow-up changes in commit 5d31921 Summary of ChangesImplemented the requested follow-up without merging, syncing, committing, or changing transport. Key changes:
Main files: windows-authority-bootstrap.c, build-windows-authority-helper.mjs, and connectRootAuthority.ts. Local validation:
Hosted Windows x64/arm64, macOS, native 6/6 evidence, and real Windows npm-installed Connect smoke require their CI runners and were not credited locally. No skipped native prerequisites were counted as passing. 🤖 Implementation Details
Undo Changes • View Task Execution 💡 ProPR Slash Commands
🤖 Generated by ProPR |
…g, committing, or changing transport. Implemented the requested follow-up without merging, syncing, committing, or changing transport. Key changes: - Added an independently hash-pinned Windows bootstrap probe for OS directory discovery, removing the old-broker `system-paths-v1` deadlock. - Placed the packaged broker’s first `CreateProcess` behind native deny-write/delete authority, identity/hash/signature checks, suspended launch, job containment, and loaded-image proof. - Added a real pre-execution replacement attacker fixture whose marker must remain absent. - Authority-leased compiler, linker, references, sources, include trees, libraries, objects, and signing inputs through tool exit. - Added explicit signature-kind/leaf/SPKI policies and fail-closed catalog/signature substitution handling. - Replaced hollow build-stage and atomic-publication counters with actual mutation and no-replace collision attacks. - Packaged and hash-verified the new bootstrap through npm pack/install verification. - Preserved exactly 56 unique Windows and 29 unique macOS evidence scenarios. Main files: [windows-authority-bootstrap.c](/tmp/git-processor/worktrees/integry/propr/pr-1989-followup-2026-08-30T11-43-49/packages/cli/native/windows-authority-bootstrap.c), [build-windows-authority-helper.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1989-followup-2026-08-30T11-43-49/packages/cli/scripts/build-windows-authority-helper.mjs), and [connectRootAuthority.ts](/tmp/git-processor/worktrees/integry/propr/pr-1989-followup-2026-08-30T11-43-49/packages/cli/src/connectRootAuthority.ts). Local validation: - Focused Connect: 65/65, 0 skipped - Build authority tests: 12/12 - Unit: 281/281 - Desktop tests: 24/24 - CLI build, lint, root typecheck, release verification: passed - Desktop Linux package: passed - Full suite: 323/325 files; one Redis-dependent timeout because Redis/Docker was unavailable, plus one transient WebPush failure that passed 17/17 in isolation Hosted Windows x64/arm64, macOS, native 6/6 evidence, and real Windows npm-installed Connect smoke require their CI runners and were not credited locally. No skipped native prerequisites were counted as passing. PR: #1989 Comment by: @integry (ID: 5468472980) Model: gpt-5.6-sol
Owner
|
!propr Fix the exact-head Windows EOL bootstrap failure and remaining bootstrap-first-launch, tool authorization and real build-stage evidence blockers on 5d31921. Do not merge or sync transport. Preserve the genuine held packaged-broker CreateProcess boundary, protected staging, real installed propr.cmd plus native docker and local TLS Connect endpoint, 56/29 scenario contracts, derived production helper pins, clean package layout and green macOS 65/65 plus native 6/6/29.
|
Contributor
Author
|
✅ Applied the requested follow-up changes in commit 7dc8c7e Summary of ChangesImplemented the EOL, toolchain authorization, production build-evidence, manifest, and negative-test changes on exact HEAD Key results:
Two items remain unproven:
🤖 Implementation Details
Undo Changes • View Task Execution 💡 ProPR Slash Commands
🤖 Generated by ProPR |
…ild-evidence, manifest, and negative-test changes on exact HEAD `5d31921e...`. No merge, sync, or commit was performed. Implemented the EOL, toolchain authorization, production build-evidence, manifest, and negative-test changes on exact HEAD `5d31921e...`. No merge, sync, or commit was performed. Key results: - Canonical LF enforcement for pinned C/C#/fixture sources, with LF/CRLF hash-binding tests: 17/17 passed. - Fixed reviewed leaf/SPKI policies for `csc`, `cl`, and `link`; fixed Roslyn/MSVC dependency inventories and lease preservation. - Real BUILD_COMPILER/SOURCE/OUTPUT mutation evidence wired into Windows CI with strict receipts and cleanup checks. - Added packaged bootstrap/supervisor missing, tampered, wrong-identity, and malicious replacement tests. - Platform-safe Connect: 65/65 passed. - Fast unit: 281/281 passed. - CLI typecheck, lint, affected builds, release metadata, syntax checks, and `git diff --check`: passed. Two items remain unproven: - The exact bootstrap first-CreateProcess race is not fully closed. [connectRootAuthority.ts](/tmp/git-processor/worktrees/integry/propr/pr-1989-followup-2026-08-30T12-49-54/packages/cli/src/connectRootAuthority.ts:296) now blocks deterministic pre-launch replacement, but Node does not expose the required `FILE_SHARE_READ` lease plus suspended `CreateProcess`/loaded-image boundary. Claiming the post-check race is eliminated would be incorrect. - Full suite finished 323/325 runs; `webPushDispatcher.test.ts` failed and `llmMetrics.test.ts` timed out because Redis was unavailable. Hosted Windows/macOS, native 56/29, npm pack/install, Docker/TLS Connect evidence was not run locally and is not credited. PR: #1989 Comment by: @integry (ID: 5468785088) Model: gpt-5.6-sol
Owner
|
!propr Fix the exact-head production lease-readiness timeout and the explicitly unclosed bootstrap first-CreateProcess race on 7dc8c7e. Do not merge or sync transport. Preserve canonical LF enforcement and LF/CRLF binding tests, fixed reviewed csc/cl/link pins and dependency inventories, production build-stage receipts, packaged bootstrap and supervisor negatives, real installed propr.cmd plus native Docker and TLS Connect fixture, macOS 65/65 with native 6/6/29, and all framing/cleanup invariants.
|
Contributor
Author
|
✅ Applied the requested follow-up changes in commit d0d3742 Summary of ChangesImplemented both follow-up fixes on exact head Key changes:
Local validation:
The production Windows build-evidence attacks, native Windows 6/6/56, installed 🤖 Implementation Details
Undo Changes • View Task Execution 💡 ProPR Slash Commands
🤖 Generated by ProPR |
…ithout merging, syncing transport, or committing. Implemented both follow-up fixes on exact head `7dc8c7e…` without merging, syncing transport, or committing. Key changes: - Replaced the 10-second lease readiness timeout with bounded inventory batches, fixed progress stages, file/byte/process limits, and an inventory-derived 180-second hard ceiling. - Added x64/arm64 slow-host and intentional-stall coverage. - Added a distinct outer native bootstrap launch barrier in [windows-authority-broker.c](</tmp/git-processor/worktrees/integry/propr/pr-1989-followup-2026-08-30T13-33-44/packages/cli/native/windows-authority-broker.c>). - The authority now holds deny-write/delete leases, validates identity/hash/DACL and production signer/SPKI, creates suspended, assigns a kill-on-close job, proves the loaded image, then resumes. - Added the deterministic post-verification/pre-CreateProcess replacement attack; the attacker marker must remain absent. - Updated canonical source pins and retained LF/CRLF enforcement. Local validation: - Windows diagnostic/pinning tests: **19/19**, skipped 0 - Platform-safe Connect: **65/65**, skipped 0 - CLI typecheck: passed - CLI lint: passed - CLI build: passed - `git diff --check`: passed The production Windows build-evidence attacks, native Windows 6/6/56, installed `propr.cmd` Docker/TLS fixture, and macOS 65/65 plus 6/6/29 require their hosted OS runners and could not be executed on this Linux workspace. PR: #1989 Comment by: @integry (ID: 5468995656) Model: gpt-5.6-sol
Owner
|
!propr Fix the exact-head hosted Windows pre-readiness timeout, genuinely close the first executable launch boundary, and preserve the nested authority handle on d0d3742. Do not merge or sync transport. Preserve the bounded inventory plan, canonical LF/source pins, fixed tool policies, production build receipt attacks, real installed propr.cmd Docker/TLS fixture, macOS coverage, package invariants and secret-free fixed diagnostics.
|
Contributor
Author
|
✅ Applied the requested follow-up changes in commit 29e185b Summary of ChangesImplemented the timeout/progress and nested-handle fixes without committing or syncing:
Validation:
Hosted Windows/macOS native, receipt, and Docker/TLS tests were not runnable on Linux. Local packaging failed closed because the Windows-generated AnyCPU supervisor prerequisite is absent. One architectural limitation remains: Node still initially path-spawns the mutable packaged broker. Closing that earlier loading boundary requires an already-installed immutable native/OS authority; the new native lease closes the broker’s own final-verification-to-first-child-launch gap but cannot retroactively authenticate bytes before the broker itself begins executing. 🤖 Implementation Details
Undo Changes • View Task Execution 💡 ProPR Slash Commands
🤖 Generated by ProPR |
…thout committing or syncing: Implemented the timeout/progress and nested-handle fixes without committing or syncing: - Resolver now has eight validated progress stages and a 180-second hard deadline. - Lease readiness validates monotonic batch/file/byte counters and rejects duplicate, regressing, overflowing, missing, slow, and stalled frames. - Signer-pin calls now allow a bounded 60 seconds. - fd 6 is independently duplicated and passed via `PROC_THREAD_ATTRIBUTE_HANDLE_LIST`; cleanup covers failure and normal exits. - Added the exact outer-authority final-check/pre-`CreateProcess` mutation attack. Validation: - Diagnostics: 22/22, skipped 0 - Focused Connect: 65/65, skipped 0 - Root and CLI builds: passed - CLI typecheck/lint: passed - `git diff --check`: passed Hosted Windows/macOS native, receipt, and Docker/TLS tests were not runnable on Linux. Local packaging failed closed because the Windows-generated AnyCPU supervisor prerequisite is absent. One architectural limitation remains: Node still initially path-spawns the mutable packaged broker. Closing that earlier loading boundary requires an already-installed immutable native/OS authority; the new native lease closes the broker’s own final-verification-to-first-child-launch gap but cannot retroactively authenticate bytes before the broker itself begins executing. PR: #1989 Comment by: @integry (ID: 5469106864) Model: gpt-5.6-sol
Full Test Suite ResultsValidation failed during: Full test suite.
View Test Output |
Owner
|
!propr Fix the exact-head false-positive Windows build evidence and replace the explicitly unclosed mutable outer-broker root with a genuine OS-installed authority on 29e185b. Do not merge or sync transport. Preserve the real eight-frame resolver progress, 180-second hard bound, fixed 22/22 diagnostics, canonical LF/pins/inventories, separate fd6 duplicate and explicit handle list, macOS 65/65 plus native 6/6/29, package invariants, fixed output framing and cleanup.
|
Contributor
Author
|
✅ Applied the requested follow-up changes in commit 4346c9c Summary of ChangesImplemented the requested follow-up without merging, syncing transport, or committing. Key changes:
Validated locally:
Hosted Windows/macOS, MSI execution, Docker/TLS, and native 56/29 scenario runs require their respective runners. The local Full run could not complete because this environment has neither Redis nor Docker; it was stopped at the Redis-dependent boundary rather than reported as green. 🤖 Implementation Details
Undo Changes • View Task Execution 💡 ProPR Slash Commands
🤖 Generated by ProPR |
…g transport, or committing. Implemented the requested follow-up without merging, syncing transport, or committing. Key changes: - Replaced stage-only build evidence with nonce/HMAC-authenticated receipts emitted exclusively from the production mutation hook. All three BUILD_COMPILER/SOURCE/OUTPUT attacks preserve baseline finals and verify cleanup, termination, and artifact invariants. - Added the signed machine-wide `ProPRConnectAuthority` MSI/service running as LocalSystem with protected SYSTEM/TrustedInstaller ACLs, bounded named-pipe protocol, signer/hash/file-identity validation, replay protection, repair/upgrade/uninstall behavior, and actionable absence errors. - Added real first-boundary Windows probes for mutation, malicious broker, pipe squatting, replay, malformed frames, service stop/restart, and uninstall during an active request. - Native lease workers now emit their own nonce/HMAC-authenticated batch/file/byte frames and close the progress handle after one frame, rejecting duplicates, regressions, overflow, ordering errors, stalls, and post-ready output. - Preserved the 56-scenario Windows and 29-scenario macOS inventories, canonical pins/LF rules, packaging, explicit handles, and existing transport. Validated locally: - Focused Connect: 65/65, skipped 0 - Windows diagnostics: 22/22, skipped 0 - Installed-authority protocol: 12/12, skipped 0 - CLI typecheck: passed - Syntax and `git diff --check`: passed - Bootstrap reproducibility: deterministic binary comparison passed Hosted Windows/macOS, MSI execution, Docker/TLS, and native 56/29 scenario runs require their respective runners. The local Full run could not complete because this environment has neither Redis nor Docker; it was stopped at the Redis-dependent boundary rather than reported as green. PR: #1989 Comment by: @integry (ID: 5469685188) Model: gpt-5.6-sol
Owner
|
!propr Please remediate the remaining exact-head discovery/authority blockers on 4346c9c.
|
Contributor
Author
|
🔄 Starting work on follow-up changes requested by @integry I'll analyze the 1 request and implement the necessary changes. Processing comment ID: 5470038562✓ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AI Implementation Summary
Closes #1987
Branch:
1987/gpt-5.6-sol-expose-a-secret-free-prop-20260829-2120-4hcCommits: ✅ Changes committed (6543c04)
AI Processing Completed
Execution Details:
Summary:
Implemented issue #1987.
Key changes:
propr connect status --json --root <explicit-root>with bounded secret-free output and stable exit codes./api/desktop/discovery.https://t-<id>.propr.devvalidation, including IDNA/lookalike, userinfo, port, path, and symlink-root rejection.restartRequireddetection.Validation completed:
Detailed Logs:
01a04f65-dc34-7b02-a83e-8eaa1c9dc8c3Log files stored at:
/tmp/claude-logs/issue-1987-2026-08-29T21-39-44-494Z-conversation.json/tmp/claude-logs/issue-1987-2026-08-29T21-39-44-494Z-output.txtLatest Conversation Messages
This PR was created automatically by ProPR after processing issue #1987.
💡 Need changes?
Comment on this PR to request refinements — the AI agent monitors comments and will update the implementation based on your feedback. Keep iterating until you're satisfied!