feat(helper)!: wire reconciliation into startup and apply - #636
feat(helper)!: wire reconciliation into startup and apply#636Alex Shabalin (alex-sparus) wants to merge 1 commit into
Conversation
This stack of pull requests is managed by jj-ryu. |
🎨 Storybook previewUpdated for 6764b13
|
📋 PR Overview
🔬 Coverage
|
f37d30e to
4017a23
Compare
4017a23 to
afa1af3
Compare
afa1af3 to
8ab401e
Compare
8ab401e to
41710b3
Compare
41710b3 to
7dd9067
Compare
| use std::time::Duration; | ||
|
|
||
| const CLIENT_TIMEOUT: Duration = Duration::from_secs(30); | ||
| /// The one generous bound in this client, and deliberately not one of the short |
There was a problem hiding this comment.
This good comment makes me think the line below should be changed to a from_mins for emphasis and future-proofing.
| @@ -0,0 +1,958 @@ | |||
| // Which of the two activation paths one apply may use. | |||
There was a problem hiding this comment.
//!
There was a problem hiding this comment.
Same as #620 (comment)
So of the files in play, // is mandatory only in protocol.rs, peer_auth.rs, client.rs, helper_runtime.rs, and rebuild/out_link.rs. socket_probe.rs, reconcile.rs, and activation_path.rs are style-matching their neighbors.
| stdout: String, | ||
| stderr: String, | ||
| /// | ||
| /// Also how a refused activation is reported: `success: false` with the reason |
There was a problem hiding this comment.
I was curious if we knew all the possible things that could happen if the condition of the worker changed in the middle of a long-running activation.
There was a problem hiding this comment.
The only thing that can disrupt the activation is the helper being suddenly killed
AI comment:
Closed set, by construction: the path is chosen before any bytes are dispatched and nothing after re-reads the preference, status, or displacement gates — so post-dispatch the only inputs are that one connection's reply (reply_refusal, total over HelperReply) and its failure (exchange_failure, total over HelperClientError). Helper killed → ClosedBeforeReply; 30-min timeout → Io; both become UnknownOutcome and are reported, never a password fallback. A concurrent replacement can't cut the activation short: retirement latches and the in-flight activation finishes (helper_runtime.rs:125), with reconcile waiting on Busy unbounded. Residual we accept: if the helper dies mid-run, nixmac can't know whether activation completed, and says so.
7dd9067 to
8346193
Compare
8346193 to
6764b13
Compare
One reconciliation function decides everything about the installed helper. Apply chooses between it and the administrator-password prompt before any bytes reach the helper, from reconciled service state, and reports every refusal instead of substituting a prompt. Startup, Grant, Disable and the permission refresh each drive the function until the stored decision is carried out, then stop: one run is often not enough and nothing re-ran it, so convergence depended on relaunches and user gestures — the manual test took six runs across five launches. - delete the App Management bypass: skipping the helper for applies that touch managed app bundles was a silent password substitution while an enabled registration could still admit sync-agent work - delete the status-probe admission gate and the pre-dispatch error fallback, both of which could select the password path after an exchange had been attempted - do not count a pass that attempted nothing: a pending approval may last weeks and registers nothing, and a caller turned away never began, so only passes that try to change something spend the bound - publish by replacing the helper's row rather than refreshing every permission, which would run a second, unbudgeted reconciliation - refuse to start when permissions are reported granted without probing, so a build running on that fiction cannot register a real helper - offer one action per permission row, at a size that does not change while it runs: the helper's is a toggle of the standing decision, except while macOS holds the registration pending approval, where the row deep-links into Login Items instead - open Login Items from the click rather than from a report, so a background pass that reports first cannot swallow it BREAKING CHANGE: helperRegister and helperUnregister are replaced by helperGrant and helperDisable; helperStatus returns the reconciliation report.
6764b13 to
4808b73
Compare
2 participants
not done yet
Summary
internal code
E1dTest Plan
Docs