Repository navigation
T27 OS: the PTY server reads the keys itself through /usr/bin/security at start and when a spawn finds none, so every pane gets a key without the window - #11278
Merged
Conversation
…ith no window connected still has its key Measured 2026-10-20 on the bench Mac: after the key store moved to /usr/bin/security (no Keychain dialog), three Claude Code panes spawned with T27OS_CTL=spawn all showed "key -" in T27OS_CTL=list. The server learned keys only from the window (OP_SETKEY), so a pane spawned while the window was not connected, and every pane of a restarted server, started keyless. pty_server.t27: load_keys reads every number of every provider through keys_host kc_get_n (the same /usr/bin/security reader, scan_goes_on) and puts each key in the table by put_key, the code path OP_SETKEY now shares (extracted, not copied). It runs once at start, after the socket listens and before panes are restored, so a restored pane's wait for a key resolves at once; and at a spawn that finds no key for the pane's agent when the last read is older than a minute. A window's OP_SETKEY still adds and overrides (the same key again keeps its cooldown). The start prints a count, never a key. pty_logic.t27: the decisions, with tests: load_all_mask, load_mask_agent (claude: the four profile providers; others: AGENT_PROVIDERS), load_wants, keys_reload_due, KEYS_RELOAD_MS, G_KLOAD (table word 228). 34 -> 37 tests; sealed again. keys_probe.t27 (new, moved from keys_host.t27, not copied): the check button with its CoreFoundation and Objective-C externs. A module's @extern imports travel with it and t27b put CFRelease, CFStringCreateWithBytes and NSClassFromString into pty_server.o, which links libSystem only; keys_host.t27 is now libSystem only. glass_window imports probe from keys_probe; the server's nm -u lists _posix_spawn and _pipe and nothing from CoreFoundation. Refs #11265 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…y at start and when a spawn finds none, so every pane gets a key without the window (Closes #11265) Merge of master plus sealing, gates run on the merged tree with t27c from master: tests clean with vacuous passes 0, seal --verify MATCH, tri types ratchet CLEAN, dupe_scan failure set a subset of master's. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
gHashTag
enabled auto-merge (squash)
October 20, 2026 08:08
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #11265
T27 OS: the PTY server reads the keys itself through /usr/bin/security at start and when a spawn finds none, so every pane gets a key without the window
Gates run on the merged tree (t27c from master): 2 spec(s) with tests clean and vacuous passes 0, seal --verify MATCH, tri types ratchet CLEAN, dupe_scan failure set a subset of master's (inherited red).
TEST specs/t27os/pty_logic.t27 tests=[37] fail=[0] vacuous=[0]
TEST specs/t27os/keys.t27 tests=[81] fail=[0] vacuous=[0]
SEAL specs/t27os/pty_logic.t27 :: all hashes MATCH
SEAL specs/t27os/keys.t27 :: all hashes MATCH
TYPES RATCHET: CLEAN
DUPE failing=4 extra-vs-master=[]
🤖 Generated with Claude Code