fix(update): preserve service-home authority during recovery

[luvs01]

Summary

• Keep update recovery scoped to the service home that owns the operation. Distinguish matching, foreign, unknown, and absent authority, and recheck it before manager actions and direct recovery.
• Permit an otherwise-authorized package-only update when the initial service-home probe is unknown. Do not stop or refresh the proxy/tray, repair the service or shim, or restart automatically in that mode; print the refusal and manual-restart guidance. Changed authority, uncertain durable runtime ownership, live package use, and unresolved teardown still block replacement.
• Propagate the no-control restriction from the worker to its child and restricted-success results back to the worker. Use the guarded launcher for Bun package-only worker updates. Preserve the existing v1 probe for already-running updaters, with a separate bounded capability probe for the new restriction protocol.
• Give lease fixtures explicit service-home evidence while retaining their stop/replacement/recovery assertions, correct the stale source oracle, and update the recovery contract and troubleshooting guidance.

Verification

Published correction: 29f34140627d788676a0be51b37c740918949945; sole parent: aef76f43fc7593a37f9ad944eefcaf9b495b6453; tree: 8f03a3a3a28add62eb1f1ed313285798f30f0f96. GitHub reports a valid Verified signature and author luvs01. The 18-file correction matches the validated candidate, including every blob and mode (bin/ocx.mjs remains 100755). Correction patch SHA256: 0df594b99a4aee77087f92569d740c0697eb18cd4246d0d3e76f833a5f1d048f.

Recorded candidate validation used official Bun 1.4.3. This is prepared-candidate evidence, not a claim that tests were rerun during publication.

bun test --timeout 20000 tests/update/update-bun-ownership-lease.test.ts tests/update/update-stop-first.test.ts tests/update/update-service-home-policy.test.ts tests/update/update-home-worker.test.ts tests/update/update-home-launcher.test.ts tests/update/update-home-recovery.test.ts tests/update/update-service-home.test.ts tests/update/update-job-supervised-restart.test.ts tests/update/update-supervised-recovery.test.ts tests/update/update-job.test.ts tests/update/update-desktop-owner.test.ts tests/update/update-npm-cache-preflight.test.ts tests/service/service-desktop-supervision-windows.test.ts tests/cli/ocx-launcher-source.test.ts

Result: 302 passed, 1 skipped, 1 failed; 1683 assertions, 304 tests across 14 files; exit 1. The skip requires a native Windows directory junction. The failure is the sandboxed staged-update recovery case: the history coordinator refuses an unsafe namespace and aborts the fixture's stop. It also fails on baseline 7640a942b35044c974e534b84d5a8049f4a8ae9a; it is not counted as a pass or waived as a product guarantee.

For the maintainer's two-file reproduction, the recorded baseline was 39 passed / 1 failed, while the preceding published HEAD was 29 passed / 11 failed. The ten additional failures were nine updater fixtures and the stale const/let source oracle. Focused subsets overlap the final run and are not added to its total.

Additional final-candidate checks exited 0: bun node_modules/typescript/bin/tsc --noEmit, bun scripts/privacy-scan.ts, bun scripts/file-size-ratchet.ts, bun scripts/structure-ssot.ts, and git diff HEAD --check. The isolated documentation build completed with 577 pages and 81,200 internal links checked. The actual Node capability probe succeeded with a nonexistent Bun override; its extra-argument variant exited 2 without installing Bun or operating a service.

The full suite and test:changed wrapper were not run. Focused direct commands were used during concurrent isolated work to cover updater, lease, worker, home, Desktop, and source-oracle behavior without wrapper-driven installation. Broader exact-head hosted CI and maintainer/security review remain necessary. At publication, Cross-platform CI run 38730943337 was pending; Catalog run 38730943278 and React Doctor run 38730943201 were queued, all on this exact correction HEAD. No hosted pass is claimed.

Tests used injected effects and sandbox fixtures. No live service manager, user installation, application, or provider was operated. Native macOS/Linux/Windows service smoke remains unverified. Already-running old Node parents require compatible guarded launchers for automatic delegation. Capability declarations trust installed files and do not attest tampering. Existing inspection timeout bounds are unchanged. Keep the PR in Draft pending assessment of the baseline failure, broader checks, and review.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.
• Required validation and any focused-test exception are reviewed for the published HEAD.
• Maintainer/code-owner review is complete.
• My PR is ready for review.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[lidge-jun]

Thanks @luvs01. Scoping update recovery to the service home that owns it fills a real gap, and the shared policy module is easy to follow. Two problems block it at aef76f43f:

1. Unknown authority now blocks the package update itself, beyond automatic recovery. src/update/index.ts:494 returns 1 and bin/ocx.mjs:334 exits before any install when the first probe says unknown; src/update/job.ts:1898 does the same for the dashboard worker. unknown covers a missing Bun, a service-manager query timeout (tests/update/update-service-home.test.ts:92) and an unreadable state record, which are the installs a user most often runs ocx update to repair. Suggested fix: let an initial unknown replace the package, skip the stop, refresh and direct-start steps, and finish with the manual restart hint plus the refusal text. Keep the hard refusal for authority that changes during the update.
2. That refusal breaks existing coverage. tests/update/update-bun-ownership-lease.test.ts and tests/update/update-stop-first.test.ts go from 40 pass / 0 fail on dev 7640a942b to 10 failures at this head. Nine of the sandboxed updater fixtures now stop with "service registration ownership could not be verified". The source-oracle test update-stop-first.test.ts:808 still looks for const updateLease = after the rename to let at bin/ocx.mjs:690.

Repro: OPENCODEX_HOME=$(mktemp -d) CODEX_HOME=$(mktemp -d) bun test --timeout 20000 tests/update/update-bun-ownership-lease.test.ts tests/update/update-stop-first.test.ts

[github-actions]

✅ Deterministic PR hygiene checks passed.

[luvs01]

The two regression points are addressed in 29f34140627d788676a0be51b37c740918949945.

Initial unknown service-home evidence now permits an otherwise-authorized package-only update while refusing service/tray control, repair, and restart. Changed authority and unresolved ownership/teardown still block replacement. The worker and child propagate restrictions in both directions, and the existing v1 probe remains compatible with old updaters through a separate package-only capability probe.

The lease fixtures now declare service-home evidence without weakening their original stop/replacement/recovery assertions, and the stale source oracle is corrected. The final focused candidate run recorded 302 pass / 1 Windows skip / 1 fail (exit 1). The remaining sandboxed staged-update recovery failure also occurs on the recorded baseline: the history coordinator refuses an unsafe namespace. Our baseline two-file reproduction was 39 pass / 1 fail, rather than 40 pass / 0 fail; the preceding PR head added the ten regressions described in your report.

The PR body records the exact command, successful static/docs checks, and coverage limits. Exact-head hosted CI is pending; full-suite and native service smoke are unverified, and the PR remains Draft.

[luvs01]

2d8102d0680c388c5a400a54da3cd744a3f66a57 fixes the two stale Windows source assertions after teardown moved to src/update/job-windows-restart.ts. Only the two tests change: they follow the import/call connection, require native WinSW stop-and-return before scheduler cleanup, and retain the matcher, self-exclusion, and injection guards.

Recorded Bun 1.4.3 validation on the candidate:

• bun test --timeout 20000 tests/windows/windows-service-wrappers.test.ts tests/windows/windows-deploy-close-regressions.test.ts: before 22 pass / 29 skip / 2 fail; after 24 pass / 29 skip / 0 fail, 106 assertions. The 29 skips require native Windows.
• Related updater safety/layout coverage: 203 pass / 0 fail, 1525 assertions across 11 files.
• Typecheck, structure, file-size, privacy, and diff checks passed.

Full suite, test:changed, and native Windows execution were not run. The earlier staged-recovery environment failure was not rechecked and is not claimed fixed. Exact-head hosted CI is pending; the PR remains Draft.

[lidge-jun]

Being carried into #7215 with your authorship preserved; this PR will be closed when the bundle lands.

[lidge-jun]

Remote validation of the carry in #7215 found that this change fails 9 existing dev tests in tests/update/update-job.test.ts and tests/update/update-restart-lease.test.ts (it refuses an automatic service restart where dev expects the direct-start fallback). #7154 is held out of that bundle and stays open; the other carried PRs land without it.

[luvs01]

1da3dfbfe19ebeff25e497aae374f94550ca49bc isolates the same-home restart fixtures from the host manager's authority probe. They now explicitly simulate an ordinary manager failure and release the lease before direct fallback reacquires it. A regression test verifies lease release, one direct spawn, and zero calls to the real manager entrypoint. Only two test files change; runtime unknown/changed-authority refusal remains unchanged.

Recorded controlled comparison: baseline 4ae49360 88 pass / 0 fail; this PR and the exact carry candidate 9e66c9c before correction 81 pass / 7 fail, and after the same correction 88 pass / 0 fail. Final normal safety coverage passed 152 tests; layout coverage passed 27 tests. Typecheck, structure, file-size, privacy, and diff checks passed. These scopes overlap and are not additive.

This reproduces and fixes 7 of the 9 reported failures, not all nine. Could you share the exact failing test names and logs for the remaining two so we can check them against this correction? Full-suite, native-platform, and maintainer-host reruns were not performed; the earlier staged-recovery sandbox failure was not rechecked. New-head hosted CI is not yet passing evidence, and the PR remains Draft.