Repository navigation
feat(agent): add signed Prod updates with explicit restart - #1215
Merged
Merged
Conversation
Accept raw and commented public keys with the real minisign verifier. Reuse byte-identical immutable objects before attempting a conditional write, preserving create-only race handling and fail-closed storage errors. Add real-CLI pointer retry/repair regressions and offline R2 signing and transport coverage. Pin the publisher GitHub CLI, run preparation in its pinned shell, and follow profile/package-contract changes in delivery checks. Configured-bucket lock and pointer-race behavior remains an activation rehearsal gate. Validation: isolated delivery checks passed (94 publisher tests, 6 workflow tests, 10 Worker/workerd tests); selector tests and independent changed-workflow actionlint/ShellCheck passed. Full root flake check and normal hook were attempted but stalled in this host's actionlint/ShellCheck integration and unrelated iOS fixture. Commit hook skipped only after equivalent focused checks; hosted repository checks remain required.
Keep committed updates restartable with process-lifetime host fencing and retired backend admission. Preflight native destination permissions, preserve shared installation exclusion across accounts, and release owned installer locks explicitly. Scan actual Prod archives with the installer parser before final upload or attestation and omit extended tar metadata. Add native ACL/flags, descriptor-lifetime, controller teardown, failed relaunch, and signed-manual-fallback regressions. Pinned Rust/Clippy 1.98 full Agent just ci passed all four feature matrices and workspace/headless tests: 569 desktop, 46 updater, 112 headless. Also passed 80 packaging tests, the full root flake check and actual archive metadata compatibility checks. The normal hook was attempted but its host actionlint/ShellCheck integration stalled. Full root flake validation and standalone checks of the new workflow run blocks and shell scripts passed; bypass only that duplicate hook invocation. Signed live N-to-N+1 rehearsal remains a separate release gate.
AnthonyRonning
marked this pull request as ready for review
October 22, 2026 06:56
The signed fixture has only a macOS download. Linux correctly selects no URL, so its CI exposed the test-only mismatch. Limit this installer-permission regression to macOS instead of changing production platform selection. The production code is unchanged. Pinned formatting and the focused macOS regression passed after the full Agent and packaging validation of the implementation.
AnthonyRonning
changed the base branch from
codex-upd-delivery-maple
to
master
October 22, 2026 19:21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add signed automatic updates for packaged Maple Agent on macOS arm64. Prod authenticates the Agent manifest with two compiled minisign public keys, verifies resumable downloads and the staged app, then offers an explicit Restart to Update confirmation. Settings, About, menus and banners show update state and the automatic-download preference. Dev and unpackaged builds keep updates disabled. Agent starts at
0.0.1for the unadvertised rehearsal.The install transaction validates bounded extraction, file hashes, framework symlinks and native app identity before an atomic same-volume bundle exchange. Permission failures offer the signed manual download. A per-installation lock coordinates competing installers; pre-swap failures preserve the installed app. The previous app remains until the replacement reaches a successful Open-store/settings bootstrap.
Integrate with the SQLite storage rewrite from #1204: flush pending frontend settings before Stop, preserve its durable shutdown behavior, and fence host startup with
startup.lockplus the authoritativestore-v1/owner.lock. Failed durable close prevents replacement. After commit, retire old backend admission and retain both fences until process exit. The terminal restart screen supports relaunch retry and Quit without calling the retired SQL host. Keep updater discovery/anti-rollback state outside resettablestore-v1. Apply current download preferences synchronously so delayed bootstrap cannot undo an opt-out.Prod packaging suppresses native tar metadata and scans the exact final update archive with the trusted installer parser before attestation/upload. The merge preserves SQLCipher verification, Windows provider checks and target-bound license notices, including the prebuilt binary/notices artifact contract.
Validation of the final integrated head:
just cipassed: all four strict Clippy configurations, warning-denied workspace/all-target build, 684 runtime tests, 799 desktop tests, 46 updater tests, 224 headless tests and the remaining workspace suites. Existing ignored tests remain.44ed838360bf1641c812551102264a2ae287012d: 15 concrete jobs across six workflows. Agent CI includes all three platforms; desktop packages include the actual Prod archive scan/upload and downloaded Linux checks. Signed PR jobs remain intentional skips. The merged source tree is identical to this validated head.This PR depends on merged Agent delivery #1214. Research's app, updater, Worker, publisher, feed and routes are unchanged. The existing signing environments and BWS access are reused with their policies intact. Public Agent service activation is complete; publication remains disabled. Trusted signed master producer/consumer checks and the real installed
0.0.1→0.0.2service/UI rehearsal remain required before invitations. Linux automatic installation stays deferred; #1212 contains its independent AppImage prerequisite.