This repository was archived by the owner on Nov 14, 2026. It is now read-only.
Repository navigation
Conversation
Two fixes from the adversarial safety review: 1) Never-brick on a bad bundle: validate the staged .app is structurally launchable (Info.plist + a runnable Contents/MacOS executable) BEFORE the atomic swap, so a minisign-valid-but-malformed archive is rejected before any irreversible op. And keep the swapped-out OLD bundle as a rollback backup for ~60s (detached cleanup) instead of deleting it before relaunch is proven. 2) No updater race: in the migrate-to-hq-desktop build, do NOT start the hard version-gate or the soft updater — both replace the same .app via the Tauri updater and would race the one-shot migration swap. Only the handoff runs. Adds a unit test for the launchability guard. cargo check + cargo test green in both default and --features migrate-to-hq-desktop.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
The single 15s request timeout capped the whole request, so the ~90MB hq-desktop-app bundle download aborted with 'error decoding response body' on any link slower than ~6 MB/s (VM-observed: 15.17s at 6.3 MB/s — just over). Split the timeouts: keep 15s for the small latest.json manifest, add a 20s connect-timeout + a 600s total timeout for the bundle download. Without this the handoff fails the download for most real users (failing safe, but never migrating).
Contributor
Author
|
Closing as part of an org-wide backlog cleanup. This has been open since 2026-07-07, more than two weeks, so it is being closed by age rather than on its merits. This repository is archived, so this PR could not have been merged in any case. This is not a judgment on the work. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One-shot migration build: hand legacy hq-sync users off to hq-desktop-app
Because hq-sync and hq-desktop-app use different updater signing keys, the Tauri updater can't
cross-grade between them (it rejects the other app's signature — confirmed in production). This ships a
normal hq-sync release that performs the handoff with its own code — a plain, minisign-verified,
atomic in-place bundle swap — which isn't subject to the updater's cross-key check.
Safety gate — default OFF
Everything is behind a
migrate-to-hq-desktopcargo feature that is off by default, so merging this is ano-op for every normal hq-sync build. Only the designated migration release is built with the feature on.
What it does (
commands/migrate.rs, run once, a few seconds after launch)~/.hq/menubar.json) + single-instance lock.(this is the supply-chain gate; the exact check that stops a wrong-key bundle).
renamex_npRENAME_SWAP) preserving the bundle path; keep the old bundle as a~60s rollback backup (detached self-cleanup) rather than deleting before relaunch is proven.
~/.hq⇒ config, keychain, and sign-in carry over.In the migration build, the legacy hard version-gate and soft updater are cfg-gated off so they can't
race the swap.
Verification
cargo check+cargo testgreen in both default and--features migrate-to-hq-desktop.place, and relaunched as hq-desktop-app 0.9.6, with seeded
~/.hqconfig preserved and the app syncing.Build the migration release with:
pnpm tauri build --features migrate-to-hq-desktop(+ the usualrecall-symlink + sign steps). Rollout (cut the signed migration release, then raise the hq-pro
hq-syncminVersion to it) is deliberately not part of this PR.