Repository navigation
Open apps, including Chat, stay connected while Home runs and reconnect by themselves - #532
Conversation
Expose the issued launch expiry and bound projected frame tokens by the active parent grant and existing TTL. Preserve verifier-owned projection scope and sign malformed Wallet fixtures directly so the bridge's rejection checks still reach provider admission. Verification: 142 focused server tests passed. The full server run had 3229 passed, 7 missing-provider-fixture failures also reproduced on clean develop, and 27 ignored. Server Clippy passed with -D warnings; workspace formatting passed.
Use Home's current authority to replace a registered frame token without replacing its document. Keep source, origin, target, request and principal checks through prepare and commit. Move picker ownership, Clipboard state, Browser renewals, external-link prompts and Wallet effect state to the fresh context. Verification: focused Node suite passed 158 tests, including renewal and association transfer controls. Source gate passed 621 counted tests plus artifact, smoke and integrity checks. A final whitespace check and the 20-test renewal file passed before commit.
Renew the room session before expiry and recover frame and room authority after temporary failures. Keep the cursor, history and drafts, show Reconnecting, and use jittered backoff capped at thirty seconds. Rebuild the committed Chat UI artifacts. Verification: 95 Chat Rust tests and 10 browser fault tests passed, including Community and Direct recovery, expiry, connection loss, 503 responses and the long-outage retry bound. Chat Clippy passed with -D warnings; formatting and source/artifact matching passed.
Connect People, Documents, Assistant and Library to the shared renewal callback and Browser to its existing renewal adapter. Refresh request and Clipboard credentials while retaining the open document and draft. Add the user-facing Unreleased changelog entry. Verification: all five token-consumer tests passed in the 158-test focused Node suite; Assistant regression tests and the source gate passed. Final behavior suite: 2092 passed with zero failures. Source gate: 621 counted tests plus artifact, smoke and integrity checks passed. Installed 12-hour use, physical sleep and a real Runtime restart remain human acceptance gates.
Goal: keep server session-start details private during bootstrap, room renewal and Home recovery, while running the real Chat journeys with the behaviour gate inputs. Return typed bootstrap failures from the session helper, classify authorization loss by variant, and render only bounded detail text. Add three call-site browser regressions that track secret-looking error bodies across rendered UI transitions. Load pinned Playwright Core from BROWSER_OPERATOR_PLAYWRIGHT_CORE and rebuild the committed Chat artifacts. Verification: 95 Chat Rust tests and all-target Clippy with -D warnings passed through elastos-heavy. All 13 Chat browser tests passed with the pinned input and no checkout-local node_modules. The three privacy regressions failed against the prior WASM. Formatting, product-data checks and artifact parity passed.
Goal: each app renews only its own presentation selectors, and Library retains picker ownership with the requesting frame. Allow only the keys each renewal consumer uses. Accept pickerRequestId only for the current Library frame and an active owned picker, then transfer that association without opening a new picker. Add rejection controls for arbitrary keys and foreign, retired or copied picker authority, plus valid selector controls. Verification: the 33 renewal tests passed; eight regressions failed before this fix. The focused Node run passed 87 tests, including Chat reconnect, token consumers and external-link association coverage.
Serve the Home navigation client in People and Library performance fixtures. Let Community selection trigger recovery in the initial Direct-401 Chat journey, while retaining the one-launch, selected-conversation and same-document checks. Verification: product-ui-source and product-ui-browser passed with pinned Playwright 1.59.1 Chromium. People timed out before the fixture fix and passed after; Library performance failed with the missing module and passed after. The full behaviour suite passed 2108 tests with zero failures or skips. Product-data checks, 105 data tests, both Rust formatting checks and git diff --check passed.
|
Independent source review: bounded PASS on |
Independent adversarial security review — Home/app frame session renewalScope: Verdict: PASS (bounded). No blocking issue. Both security invariants hold, and the remaining observations are tracked privately. Security claims under test
Verified controls
One pre-existing session-lifetime behavior found during this review is recorded as S5–S7 in the private security advisory and does not affect this verdict. Remaining gates (unchanged, owned elsewhere)Installed 12-hour use, physical sleep, real Runtime restart, and the Library |
Deepen notes
gateway_home_token.rs:301(12-hour launch token),room_service.rs:47(12-hour room session),gateway_room.rs:1962-1994(polling never renews it),chat-room-ui/src/lib.rs:4370-4404(Chat stops polling after a 401 until Reconnect),home-shell-host.js(Home renews its own session but never open frames).Problem
Anders, 4 Nov: Chat goes offline after about 12 hours and needs a page refresh, and should instead stay connected while Home runs and reconnect by itself after a network drop or restart. Two 12-hour expiries were never renewed for open windows (the app launch token and the configured room session), and Chat stopped polling for good after its first 401.
Change
/session/start; one recovery loop with backoff capped at 30 s and jitter; shows Reconnecting and keeps history, draft and cursor; on 401 asks Home for fresh authority first; session-start errors stay typed and bounded (no raw server text reaches the UI).Tests (fail before, pass after)
scripts/chat-online-behavior.test.mjs(runs in./scripts/test-behaviour.sh): Community and Direct Chat resume without a click after frame expiry, 401 and room expiry; network and 503 recovery; a long outage bounds retries and resumes when back online; server error text never reaches the page.scripts/home-frame-renewal.test.mjs33,scripts/open-app-token-consumers.test.mjs5; Rust:frame_renewal_is_bounded_by_launch_ttl_and_current_parent_grant,chat_online_configured_poll_does_not_renew_room_session.Not proven
A real Home kept open 12 hours, physical sleep, a real Runtime restart. #497 (the sign-in screen tearing down app windows) is separate.
Known small gap from review: a Library picker window loses its
mode=attachquery when its own authority renews; the selection itself still transfers.Security review requested from Irzhy before this goes into a release (sign-in renewal).
CI fixtures (2d03c35, found by the push queue CI precheck): People and Library smokes serve the Home navigation module the apps now import; the configured Chat layout smoke no longer clicks Reconnect after choosing Community, because choosing it now recovers by itself.