[V3RON]

Summary

lease.request accepted any non-empty exact osVersion. With allowDownload: true and a downloadable missing runtime, that raw string went to the installer, skipping componentVersionSchema's bound. On iOS it reached xcodebuild -buildVersion <raw>; on Android a ; could add segments to sdkmanager's package path.

An exact osVersion must now pass componentVersionSchema, which also refuses ;. Ranges are parsed as before.

Changes

• src/contract/operations.ts: refuseBadOsVersion checks an exact constraint against componentVersionSchema; a failure is a 400 BAD_REQUEST on path osVersion that states the rule.
• src/contract/protocol.ts: PROTOCOL_VERSION_RANGE 61 → 62; the contract and daemon manuals match.
• choosing-a-device.mdx states the bound.
• src/daemon/server.test.ts: the long-component test now has the fake driver name the 65-character component, since such an osVersion is refused.

Tests

• src/contract/operations.test.ts: refuses "17.0 -foo", "-1", "34;extras", 65 characters, a control character and a leading space, each with its message; accepts 64 characters and the range forms. component.install refuses "35;extras".

Assumptions

• Assumption: does min move with max? — yes; no compatibility path stays, since an older client differs only in a malformed exact osVersion being refused.

Review

Spec review: skipped. Code review: 0 blocking, 0 fixed, 0 notes. Claims review: skipped.
Rounds: 1. Tokens: n/a.

One combined review by the maintainer's agent on 2026-10-22 (comment below); no blocking findings.

Rebased onto main e1f2f43 on 2026-10-26 as one commit. Main is at protocol 61, so this PR now bumps to 62 (was 58); the src/contract and src/daemon manuals follow (main's still said 59). src/daemon/server.test.ts keeps this PR's version of the oversized-component test, without main's 65-character osVersion that the new bound refuses.

Written by an agent.

[V3RON]

Review (maintainer's agent, round 1)

No blocking findings.

• The bound is applied by reusing componentVersionSchema inside refuseBadOsVersion for the exact form only, so one regex governs both component.install and a downloadable osVersion; ; is now refused in both, which closes the sdkmanager package-path injection on Android, and the leading-- refusal covers xcodebuild -buildVersion on iOS. Range parsing is untouched, and range versions are read numerically so they never reach an installer as text.
• The error names the field (path: ["osVersion"]) and states the rule in words a user can act on. The website's choosing-a-device page, the one place that said "any other text is an exact version", now states the bound; Baklava and 34-ext12 still pass it.
• Protocol 54 → 55 with min moved too, as there is no compatibility path. feat(gateway): a join token is pinned to the first worker that uses it #894 bumps to 55 as well; whichever merges second rebases and bumps to 56.
• The server.test.ts change is legitimate: that test needed a 65-character component only to exceed the progress push's name limit, and it now gets it from the fake driver instead of a request the contract rightly refuses.

Note, no change needed: the one-off timing failures across test:changed runs were in untouched files under a load average of 14 to 24 from parallel agents and pass alone and on base; CI is the arbiter.