Conversation
…setup Windows MCP now has a kernel boot-environment clock, pollable stdio adapter, crash-safe journal store, and a toast session backend that never falls back to beeep after a possible toast effect. Existing installer enable --navigation none provisions a journal without the macOS native helper; local .app routing stays rejected. Co-authored-by: Илия <iliyazelenkog@gmail.com>
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## feat/agent-notify-e2e #187 +/- ##
=========================================================
- Coverage 65.27% 65.25% -0.02%
=========================================================
Files 168 172 +4
Lines 17182 17287 +105
=========================================================
+ Hits 11215 11281 +66
- Misses 4360 4383 +23
- Partials 1607 1623 +16 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Windows CI go vet failed on setup_windows_test.go because windowsContext used time.Second without importing time. Co-authored-by: Илия <iliyazelenkog@gmail.com>
Elevated Windows runners own newly created files as Administrators. RestrictPrivate now sets the current-user owner, and RequirePrivate accepts SYSTEM/Administrators plus inherit-only ACEs like the config store. Anonymous pipes stay pollable when SetDeadline is unsupported. Co-authored-by: Илия <iliyazelenkog@gmail.com>
Windows identityMode stores 0666/0444 only, and clientsetup previously always returned ErrConflict from the non-unix reader. Add confined NT document reads and accept ledger-owned regular commands on Windows. Co-authored-by: Илия <iliyazelenkog@gmail.com>
NT directory handles need READ_CONTROL before GetSecurityInfo, otherwise Initialize/Apply report state_repair_required or unsafe setup directory. GENERIC_ALL ACEs make SetSecurityInfo return ERROR_INVALID_PARAMETER on GitHub runners; apply the same SDDL FA DACL the config store already uses. Control-root checks now skip inherit-only ACEs and accept SYSTEM or Administrators owners, matching journal/setup RequirePrivate. Co-authored-by: Илия <iliyazelenkog@gmail.com>
os.File.Sync maps to FlushFileBuffers, which rejects directory handles opened list/traverse-only. Keep ancestor walks read-only; open the private leaf (and setup children) with GENERIC_WRITE so journal Initialize and none-setup provision can fsync on GitHub runners. Co-authored-by: Илия <iliyazelenkog@gmail.com>
FlushFileBuffers does not support directory handles, so os.File.Sync on journal/setup dirs returns Access is denied even after GENERIC_WRITE. File contents are already flushed before rename; match installruntime.syncDir. Co-authored-by: Илия <iliyazelenkog@gmail.com>
Plan §13.4/§13.7 requires a confined portable/locator adapter. Reuse NT relative opens, private FA DACLs, and identityMode primaries so Publish and Acquire work without Unix execute bits. Co-authored-by: Илия <iliyazelenkog@gmail.com>
…e files NtCreateFile does not map GENERIC_WRITE, so FA DACLs on GitHub runners denied journal Initialize. Request FILE_GENERIC_WRITE instead, and treat identityMode(0600)=0666 as the private policy mode on Windows. Co-authored-by: Илия <iliyazelenkog@gmail.com>
§13.5 requires the new boot time base to persist when Admit is refused, and unavailable clocks must not disable rate limits. These tests use the Windows NT journal so GitHub runners prove the storage adapter, not only the unix journal_test.go copies. Co-authored-by: Илия <iliyazelenkog@gmail.com>
Lock create succeeded because it already requested FILE_GENERIC_READ. Exclusive oWRONLY creates (namespace, journal.json) used FILE_GENERIC_WRITE only, so RestrictPrivate's GetFileInformationByHandle returned Access is denied. Match the lock/installruntime mask and name open vs restrict errors. Co-authored-by: Илия <iliyazelenkog@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is the R3/P7 Windows runtime slice on top of #177. It is independent of the wizard/SDK stack (#180/#182/#183), of the R0 configure PR (#185), and of the Linux P7 PR (#186).
What landed
journal.PlatformClockon Windows usesNtQuerySystemInformation(SystemBootEnvironmentInformation)plusQueryInterruptTime(suspend-inclusive, 100ns units) withGetTickCount64fallback.notifier.SystemBootClockuses that same sample so runtime and journal share one boot ID.FILE_TYPE_PIPEvs disk vsFILE_TYPE_CHAR(NUL stays local if deadlines fail), and never claims pollable I/O it cannot cancel. Anonymous pipes stay pollable whenSetDeadlineis unsupported.LockFileEx, private DACLs, and atomic replace ofjournal.json. RestrictPrivate sets the current-user owner so elevated runners (Administrators-owned new files) still initialize. RequirePrivate accepts SYSTEM/Administrators owners and inherit-only ACEs, matching the config store.os.File.Syncis a no-op on Windows (FlushFileBuffersdoes not support directory handles), matchinginstallruntime.syncDir. File contents are flushed before rename. Leaf directories and files requestFILE_GENERIC_WRITE/FILE_GENERIC_READforNtCreateFile—GENERIC_WRITEis outside anFAACE and wasACCESS_DENIEDon GitHub runners. RestrictPrivate uses SDDLFAbecauseGENERIC_ALLACEs makeSetSecurityInforeturnERROR_INVALID_PARAMETERon GitHub Windows runners.installruntime.IdentityMode(0600)as the private policy mode (0666 on Windows, 0600 on Unix) so explicit policy CAS survives WindowsidentityMode.identityModeprimaries (0666/0444, no Unix execute bits).WindowsToastDeliveryinstead of the macOS native helper:navigation=nonenavigation=requiredstaysnavigation_unavailableStatusiseligiblefor a managed non-recovery install withoutDecoderFloornative.setup.Apply/Inspectaccept Windows for navigation none, initialize the journal, and still reject local.approuting. Darwin still requires the native helper.setup-notifications enable --navigation noneworks withPlatform: windowswithout a native helper.clientsetupnow has a confined NT document reader. WindowsidentityModestores 0666/0444 only, so ledger-owned regular commands are accepted without Unix execute bits.Honest non-goals (still open)
--agent-notifyon Windows is a child of this PR (fix(notify): wire Windows MCP configure onto navigation-none setup #189), not folded into fix(notify): capability-aware default MCP configure #185.FileModenever sets 0111 on regular files).Tests
TestWindowsPlatformClockAvailableAndStableWithinBoot/TestSystemBootClockMatchesJournalTestWindowsToastNavigationNoneSubmitsWithoutBeeepand timeout →unknown/handoff_unconfirmedwithout beeepTestWindowsNoneSetupProvisionsJournalWithoutNative/TestWindowsSetupNotificationsEnableNoneWithoutNativeTestWindowsInitializeOpenAdmit/TestWindowsAgentNotifyPipeIsPollableTestWindowsRateLimitPersistsClockAcrossSyntheticReboot/TestWindowsUnavailableClockKeepsRateLimitTestWindowsApplyAcceptsIdentityModeWithoutUnixExecute/TestWindowsReadConfinedDocumentAndDirectoryTestWindowsPublishAcquireRevoke/TestWindowsIdentityModePrimaryAcceptedPlatform: windowssetup seam against unix journal storage; native Windows FS/DACL tests areGOOS=windows.