Repository navigation
Conversation
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 59 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…t mode The pinned native DialogService suppresses prompts when development mode is combined with an extension-test entrypoint. Start the same sealed observer through normal async extension activation and remove only the trusted argv test-entrypoint pair. Keep native workspace and MCP trust UI, exact installed identities, sealed handoff, sandbox, deadlines and cleanup checks unchanged. The restricted-workspace-capable observer remains passive until the existing UI challenge and actual trusted workspace check. Two independent plan and implementation reviews completed; pinned strict TypeScript compilation and inert controller/frontend/toolchain checks passed.
…aming Set the pinned version's startupPrompt to always before preservation baselines so the real native dialog is requested. Keep trust decisions in the actual UI. Use the lifecycle Stager's existing installed digest while preserving separate acquired-source identity and strict held-byte validation.
Place the admitted scanner in the public CLI's supported private cache. Preserve native-owned state and assessment writes while protecting scanner ancestry with held identities and one exact task-owned bind mount. Release only that recorded mount before ordinary root cleanup. Require the genuine hosted UID/cache-route contract before vendor execution. Keep native pins, trust/UI, process isolation, deadlines, artifact admission, and qualification strict. Include reviewed parent runtime admission and Darwin cleanup. Two independent plan/code reviews, fixes, affected lint, focused contracts, and exact integration review passed. Privileged hosted proof remains mandatory.
Exercise exact content integrity separately from metadata identity and preserve monotonic deadline authority on freshly booted hosted runners. Refs #530
Apply independently reviewed plan fc13f083 and implementation c75c26b4. Retain all original entry points and strict native observation, receipt, deadline, isolation and cleanup requirements. Full controller tests pass; unfiltered golangci-lint 2.13.2 reports zero issues. Native qualification remains pending observed scanner failure.
…ostics Stop io.Copy from bypassing the bounded writer through an embedded bytes.Buffer ReaderFrom method. Preserve the original 8 MiB/64 KiB limits and timeout/overflow precedence. For exit-one invalid JSON, retain only bounded stderr and stdout byte count; valid findings still require independent report evaluation. Two independently reviewed plans and final implementation; actual process overflow regressions for both streams and exits, full scanner tests and applicable Required lint gates pass. Five unchanged parent lint findings remain documented. Native root cause and all project qualification remain unclaimed pending genuine hosted capture.
Preserve the accepted plan-only tree before the implementation. Linux amd64 current-source installs select the existing musl pin; frozen producers retain strict GNU provenance and historical cache identity.
Select the existing musl asset and its distinct cache identity for current-source builds, preserving frozen GNU provenance and all other target pins. Couple native, VS Code, and Terminal UI acquisition and cache handoffs to the actual verified asset; retain explicit manual compatibility and truthful limitations. Include inert acquisition/admission/cache/reproduction contracts and the exact reviewed parent CI concurrency alignment. Local native qualification remains unproved pending genuine hosted gates. Exact reviewed local implementation: 553decde4e8533a4ba050b20e19945c80da402b8; tree 1d66a11.
Owner
Author
|
@coderabbitai full review Owner explicitly requested independent review before merge. Current observed head: Prioritize scanner stream bounds and deterministic musl/current-source versus frozen GNU policies, cache/source/receipt ownership, original-UID and user-profile preservation, strict process/display cleanup, and the trusted VS Code project lifecycle. Preserve Ubuntu 22.04, NNP, mount/UID/sandbox, source/pin and artifact-admission guards. Do not treat Prepared support or successful inert contracts as native qualification. Inspect latest native evidence and distinguish the observed ownership refusal from the already corrected GLIBC loader issue. Anchor findings to the reviewed source. |
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Project installation needs genuine VS Code evidence for discovery, restart/removal and MCP operation while preserving original-user authority. This PR implements the narrow trusted project fixture authorized by the owner and retains the existing untrusted-workspace observer and legacy user adapter.
What changes
Adds a source-bound public CLI lifecycle for distinct A/B projects: empty baseline, independent user package, A/B install, unchanged reconciliation, intact repair, changed local-source update, missing-component repair from unchanged selected input, fresh workbench restart, removal and repeated removal. Exact receipts, source/package identity, retained data, foreign configuration and sibling-project preservation are checked. Existing TLS Git/ZIP tests retain separate moving-source/recorded-pin coverage.
Adds the sealed observer/UI driver for pinned VS Code 1.143.1. Normal development-extension activation waits for an exact stage/nonce challenge. The driver must grant only the selected folder's trust through native UI with parent trust unchecked, then use the exact native MCP trust/start flow. The observer requires canonical folder identity and actual
workspace.isTrusted=true; initialize/list/call use VS Code's proposed gateway API and correlate definition metadata with fresh probe session/nonce/package/data/cwd facts.Adds pinned TypeScript 7.0.2 preparation and a genuine Ubuntu 22.04 hosted gate. Original-user execution, NNP, zero capabilities, standard Electron sandbox, strict cgroup containment, immutable inputs, the original 900-second deadline and full process/display cleanup remain mandatory. Only two closed evidence ZIPs are uploaded; native profiles, bearer values and gateway endpoints are excluded.
Places the admitted lintai executable in the public CLI's supported private cache. Root-owned scanner ancestors and one exact task-owned security bind mount protect the executable while ordinary user-owned state, lock and assessment-cache writes remain available. Held inode/ownership/mode/mount/hash records cannot be replaced with a later baseline. Cleanup releases only the recorded mount and withholds root deletion on an identity or unmount failure.
Requires a genuine hosted UID/cache-route contract before vendor execution. It uses an inert executable to exercise actual state/lock/cache writers, original-UID mutation refusals and the real scanner cache lookup without network. The selected original UID, zero capabilities, NNP, ordinary mount release and native cleanup requirements stay strict.
Validation and observed blockers
Strict pinned compilation and focused controller/frontend/toolchain/evidence contracts pass. Actual VS Code user/project planner-and-Stager contracts now independently verify installed receipt framing and preserve the distinct acquired-source digest, with negative byte/mode/directory/link checks. These are inert tests; no vendor runs locally.
The genuine hosted preliminary gates pass, but full native qualification remains pending:
--extensionTestsPath.empty-awith focus true/true and no dialog. The pinned startup-prompt default isnever; the current correction explicitly requestsalwaysbefore freezing settings. It also corrects the source-proven installed receipt expectation to existing Stager framing, while leaving acquired source identity unchanged. That receipt correction has not yet been reached by a native lifecycle.Both independent plan and implementation reviews approved the preceding source tree
46a998ba83fc8e6d3f905ab37d7129c598d950d7, published asee4556e222cc14e5e1c355428b42e8d4df4a7ace. Run 40373529167 passed its preliminary contracts but encountered HTTP 504 during frontend preparation after compilation, before creating prepared input or starting the native lifecycle. The paired artifacts record complete frontend cleanup and all five qualifications false. The one same-head retry (job121768023210) passed preparation and completed nativeempty-aandempty-b: both exact folder trust prompts were accepted, actual workspaces were trusted, inherited user skills were discovered and publisher exits were zero. Publicadd-userthen failed because the required scanner tried to download inside the loopback-only namespace: the acquired pinned lintai executable had not been placed in the public CLI’s supported private cache. Installed-package/native MCP stages were not reached, strict display cleanup remained unproved after this failed exchange, and all five qualification flags stayed false. The reviewed scanner cache correction is now implemented and published in the current head below. The earlier failed run remains evidence of the blocker, not proof of the corrected native lifecycle.A subsequent genuine hosted attempt must complete every required stage and cleanup before any of the five
vscode.*qualification cases can pass. Retained failures and source reasoning cannot substitute for native proof.Current source and review
Published head:
1b510b587c8be236b3c40fdad76896c79345109a.Exact tree:
1d66a1151b5222c67c5b058cad0da760170d3339.This is byte-identical to reviewed local implementation
553decde4e8533a4ba050b20e19945c80da402b8. The accepted policy is preserved in separate preceding remote plan commit0f6878cd96fe9712dd1aa3a5ac17970bad4eb1d5; the implementation also incorporates the exact two CI-only files from parentb16b5c5d28cdc734856ac414521d40d9c8d8dfd5. Fresh genuine hosted gates are pending; no native qualification is claimed. Earlier test and artifact results below remain bound to their stated preceding sources.The preceding scanner-cache amendment has two independent plan and code GO reviews, including correction of invalid ancestor exchange operands. Thirteen new lint findings were resolved without suppressions; affected golangci-lint 2.13.2 reports zero issues. Exact-source trusted contracts and frontend contracts pass. That preceding integrated source passed all 18 shared runtime-admission contracts and its combined trusted-contract run. Its separate integration review verified all scanner/workflow files unchanged from that reviewed candidate and the four shared Python files identical to parent
2f7a885ec00622cb500ca1189b93659ca5bd9216.The privileged UID/mount contract was explicitly skipped locally and is not claimed passed. It must run successfully on the genuine hosted runner before the editor starts. No vendor executable ran locally.
Scope and status
This PR remains draft and source-only. The fixture surface is the pinned development host with proposed APIs. Installation state remains Prepared; public user installation, vendor authentication/OAuth, real-model use and released-client qualification remain separately unqualified. No release is published.
Stacked on #520. Exact source/review references are in
docs/plans/project-install-e2e/remaining-native-qualification.md.Deterministic inert contracts after observed hosted failures
The preceding trusted run
40389182925, job121805371213, failed the metadata-only held-nodefile-bytesnegative before native execution. Equal-size rewritten bytes need not produce distinguishable timestamps in the filesystem's current clock quantum; the log contains no stat telemetry, so this cause is a source-backed inference. The current test changes size deterministically and separately exercises the unchanged production hash/inventory tail against equal-size bytes with restored mtime, changed modes and an added empty directory. All production ancestry/mount/hash/inventory checks remain in their original order.The preceding untrusted run
40389182726, job121805371389, separately failed an inert deadline test that subtracted 100 seconds from monotonic uptime. The current test chooses a positive elapsed interval bounded by half actual uptime, retaining the same original origin, unchanged 420/840-second work limits and one-second tolerance. Zero/negative/future origins still reject. No production deadline, execution or cleanup rule changed; actual old-run uptime was not recorded.Both exact plans and implementations (
b1f23a707894d83e7d3f3315304a54de6f265374,ea13f5bd067752b12da917972373a7c2c61bfa0a) have root and independent critic GO reviews. Root independently ran the final Trusted inert contracts: PASS in 0.152 seconds, with the genuine hosted UID/mount case explicitly skipped locally. Changed-lines golangci-lint 2.13.2 against the preceding local source reports zero issues.A separate full-package audit identified 37 lint findings introduced elsewhere in this PR relative to its parent. The reviewed correction below resolves all 37. These inert fixes alone do not qualify any native lifecycle stage.
Required lint correction and latest native evidence
Plan
fc13f083a0c021b300c4cc8884b472bf6eaca8f8(document bloba305e9a66dcaa9bbd20e106d0e4a782363564aab) and implementationc75c26b4069b71dbcfa60d8bd2c2c727df10cf02each received two independent GO reviews. The published tree is byte-identical to the reviewed candidate. All 245 original function entry points remain. Cohesive helper/file extraction preserves native argv, ordering, source/installed digest distinction, receipt authority, observer/probe correlation, immutable assets, deadlines and cleanup. The three formerly ignored descriptor-close errors now fail closed at the original cleanup points. There are no lint suppressions or baseline expansions.Exact-candidate validation: full controller package tests PASS (1.159 s); unfiltered golangci-lint 2.13.2 over the entire controller package reports 0 issues, including the Required size/complexity/import linters; frontend contracts PASS; 8 toolchain contracts PASS; 17 workspace contracts PASS. The genuine hosted UID/mount case remains explicitly skipped locally and mandatory before hosted vendor execution. No vendor binary executed locally.
Trusted run 40400045559, job
121843130833, on preceding source73f6b9c3e26709409d8ad9e1502683675683ebadpassed its preliminary contracts and completed realempty-aandempty-bobservations with exact folder trust and inherited user-skill discovery. First publicadd-userthen failed withsecurity assessment failed before installation: lintai returned invalid JSON. The scanner cache acquisition blocker is passed, but the scanner's actual stdout/stderr cause is not yet observed: current code discards stderr for accepted exit 0/1 and the artifact contains only the generic report refusal. A subsequent real-process overflow test found that the embedded bytes.Buffer can bypass the intended stream limiter through io.ReaderFrom. Therefore the old error establishes empty, oversized, or syntactically invalid stdout after accepted exit 0/1; it does not establish which case occurred or that the intended internal stream cap held. No format/auth/network workaround is inferred from this failure. The failed exchange also did not prove strict display cleanup. All five qualifications remain false.Native artifact
12687549067outer SHA-256:3e2a3dc681d590f9119cb734e7ada607e52d1731d9de9385a6a0f89652c1bf48. Frontend artifact12687508997outer SHA-256:0e54ab23ef3ca0ba1be60bc97d14f6f988ad60311564879d32d6dcc71e3cad62. Both were independently retained and inspected with their source identities. The next scanner amendment will be based on this observed failure, with its own plan and reviews.The same native boundary recurred on published lint-corrected source
5942dc4cafbb2b2c4d793e2f32e375ff96736e1b, tree42cda5c7ea6d236d54c77b46db010f6bbc66c457, run 40402247458, job121850850891. Its mandatory inert gates passed;empty-a/empty-bcompleted, publicadd-userreturned the same generic scanner refusal, strict display cleanup remained false and all five qualification flags remained false. Native artifact12688239063SHA-256c17a204dd816c3a4648615a0b91a90c1fdc10b912fa9eb0658d454009035ceff; frontend12689503601SHA-256cdff0ae109f29f61b1e8740822e1faa8d183afe0dd817eb7d15169278d9f5cbe. The runner header reports Ubuntu 22.04 image20261012.322.1; captured ImageVersion environment reports20261023.322.3. Both observations are retained; the environment value alone is not proof of the actual runner image revision. The scanner diagnostic candidate was withheld from publication when its new actual overflow test exposed the limiter defect; a separately reviewed amendment will restore the intended bounds before any new diagnostic is published.Enforced scanner bounds and actual failed-process diagnostics
The new real-process regression exposed a pre-existing capture defect: anonymously embedding
bytes.BufferpromotedReadFrom, allowingos/exec/io.Copyto bypass the scanner's boundedWrite. The published correction uses private named storage and only the three required read accessors. The original 8 MiB stdout and 64 KiB stderr bounds, stream draining, timeout/overflow precedence, child argv/cwd/environment and report policy remain unchanged; output exceeding the declared bounds now reliably fails.An actual exit-one process with invalid JSON now fails with the exit, stdout byte count and already bounded trimmed stderr. Raw stdout is not disclosed. Valid exit-one findings remain byte-identical and still require the full independent evaluator/report identity checks; exit-zero and other process-error behavior remain unchanged. No additional execution, artifact member, auth/environment selector, host, pin or permission change is introduced.
Both diagnostic and bound-repair plans received independent root/CLI GO reviews. Final implementation
56856d510e3342db2472fbd354cfbbe7cb3f58f0and validation-only addendumb4bf0b3b9a0718153ecddefef6537c8fc74dac0dalso received independent GO reviews; the published tree exactly matches the reviewed final tree. The initially failing candidate7eefe3c9was withheld.Actual final full securityscan package tests PASS (0.281 s), including both real process streams at limit+1 for exits zero and one, byte-exact valid reports, real evaluator classification, private-stdout exclusion and independent schema refusal. All enabled linters on changed lines report zero issues; the actual Required whole-file size/architecture linters also report zero issues. A broader unfiltered invocation reports five inherited findings in byte-unchanged parent
cache.go/release.go, and none in the changed scanner/tests. Parent blobs were independently verified atb16b5c5d28cdc734856ac414521d40d9c8d8dfd5; no linter setting, exclusion or unrelated source changed. The earlier full VS controller test/lint results remain tied to their recorded source.Before run
40404315364, the retained GNU archive's static strong GLIBC_2.39 requirement was a compatibility hypothesis for the Ubuntu 22 failure; actual runtime stderr had not yet been captured. That diagnostic amendment was published to obtain the failure through the existing public log before a separate asset/host policy amendment. The subsequently captured failure and reviewed policy change are recorded below. No vendor executed locally; complete native lifecycle and cleanup qualification still requires a successful genuine hosted result.Captured loader failure and portable source policy
Run 40404315364, native job
121858008835, on preceding source160906e8d9cc6ef15e07ca9775aa78b22b505f84passed preliminary contracts and completed realempty-aandempty-b. At the first publicadd-user, the new bounded diagnostic captured actual scanner exit 1, zero stdout bytes and the loader's missingGLIBC_2.39error. This confirms the loader boundary for that run; it does not retroactively identify the cause of older generic JSON refusals. Installation and native MCP stages were not reached, strict display cleanup remained unproved, and all five qualifications remained false.Retained native artifact
12690158855outer SHA-256:682c1914a94b00b3b80d89bed716b7dba9fdea2bbbb83d2e05cc2eae44b23fe1. Frontend artifact12689949178outer SHA-256:fe69f497ef77ec826cda976a935feaa0000289e1693228c0a8dcbda734c9d565. Root and independent critics reviewed the closed raw artifacts and their exact source/provenance. The differing runner setup image revision and captured ImageVersion environment are retained rather than treated as equivalent evidence.The separately planned and reviewed implementation now selects the existing pinned
linux-amd64-musllintai 0.1.3 asset/cache for current-source Linux amd64 installs on every declared Linux amd64 host. Other targets are unchanged. Native/VS/TUI acquisition and cache handoffs follow the actual verified asset; source execution rejects a conflicting GNU producer receipt before a build. Frozen release/draft/prepared producers retain their strict original GNU pin/schema/cache route. Manual supplied binaries retain an explicit harness-only legacy cache option; trusted raw bytes stay caller-declared and unclassified. There is no ABI probe, fallback, relabelling, dual cache, new public runtime selector, host/sandbox change or release.The plan and each implementation slice have two independent GO reviews; the final 32-file assembly was independently rehashed and reviewed by root and CLI. Actual inert checks: full scanner and VS controller packages PASS; final resolver tests PASS; shared Python 145 PASS plus offline frozen-pin substitution negative; VS acquisition 3, workspace 17 and toolchain 8 PASS; new Go cache/admission tests PASS. Terminal discovery completed 99 tests (three existing expected opt-in/native-Windows skips), followed by all 8 final flow/reproduction contracts. Affected Required changed-line and whole-file size/architecture lint gates report zero issues; five inherited all-linter findings remain explicitly recorded.
A broader local native-fixture run failed in the unchanged Git acquisition preflight because this environment lacks the required live-task children interface. No full fixture PASS, bypass, new skip or native qualification is claimed. The exact published source must still pass genuine hosted UID/mount/cache, public scan/evaluate/install, complete editor/MCP lifecycle and cleanup, plus retained Claude/Codex/OpenCode and affected remaining-client gates. No vendor executed locally.
Current exact-source trusted hosted run 40411515088, job
121883109116, has been registered for1b510b587c8be236b3c40fdad76896c79345109aand is being followed for actual raw evidence. No successful native result from this head is claimed.