Staged Linux CI: builder repair, guest hardening, and remote output#563
Staged Linux CI: builder repair, guest hardening, and remote output#563justinmoon merged 8 commits intomasterfrom
Conversation
|
Caution Review failedPull request was closed or merged during review 📝 WalkthroughWalkthroughThe changes enable remote fulfillment capabilities in the pikaci system by making internal SSH and snapshot synchronization functions accessible within the crate, introducing remote execution pathways for staged outputs with decision logic for remote vs. local fallback, adding an agent allowlist probe disable configuration option, optimizing test executable discovery via precomputed lists, and expanding documentation for remote execution boundaries and design constraints. Changes
Sequence DiagramsequenceDiagram
participant Client as Local Client
participant Detector as Output Detector
participant RemoteCheck as Remote Feasibility
participant SSH as SSH Transport
participant Remote as Remote Host
participant Builder as Remote Builder
Client->>Detector: Detect staged Linux Rust output
Detector->>RemoteCheck: Check if remote realization possible
RemoteCheck->>RemoteCheck: Verify remote host & snapshot dir
alt Remote Available
RemoteCheck->>SSH: Sync snapshot to remote
SSH->>Remote: Transfer snapshot files
Remote->>Remote: Snapshot received
SSH->>Builder: Invoke remote nix build
Builder->>Builder: Execute build on remote
Builder->>SSH: Return build result
SSH->>Client: Remote result delivered
else Remote Unavailable
RemoteCheck->>Client: Fallback decision or error
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~50 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Tip Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs). Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| pub(super) fn refresh_agent_allowlist(&mut self) { | ||
| self.invalidate_agent_allowlist_probe(); | ||
| if !self.agent_allowlist_probe_enabled() { | ||
| self.agent_allowlist_state = AgentAllowlistState::Unknown; |
There was a problem hiding this comment.
🔴 Disabling the agent allowlist probe permanently blocks agent creation instead of bypassing the check
When disable_agent_allowlist_probe is true, refresh_agent_allowlist() sets agent_allowlist_state = AgentAllowlistState::Unknown and returns early (line 455). This creates two broken behaviors:
- "New Agent" button never appears:
sync_agent_menu_item_state()atrust/src/core/mod.rs:2912only renders the button when the state isAllowlisted, so the button is permanently hidden. ensure_agent_kindenters an infinite toast loop: Atrust/src/core/agent.rs:552-555, theUnknownstate triggersrefresh_agent_allowlist()which immediately sets state back toUnknownand returns — the user sees "Checking agent access. Try again in a moment." every time and can never start an agent.
The intent of the config flag is clearly to skip the allowlist probe (e.g., for offline tests), so the state should be set to Allowlisted to bypass the gate, not Unknown which blocks it.
| self.agent_allowlist_state = AgentAllowlistState::Unknown; | |
| self.agent_allowlist_state = AgentAllowlistState::Allowlisted; |
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Summary
Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Chores