feat(session): secure daemon upgrades

[benvinegar]

Problem

Hunk session windows and CLI callers need to share one local daemon without trusting public health metadata, PID files, or reusable bearer credentials. Incompatible binaries must not terminate an incumbent daemon that may still own active sessions, while upgraded interactive windows must recover automatically after it becomes quiescent.

Approach

• authenticate producers and CLI callers with owner-private Ed25519 credentials, exact signed transcripts, scoped grants, replay protection, and signed responses;
• derive producer ownership and reconnect authority from the authenticated connection, including revocation checks before inbound work and outbound command delivery;
• keep public health liveness-only and remove PID-based daemon replacement;
• let interactive windows wait via health-only polling, detect a new launch generation as a hint, then establish authority through a signed hello while one persistent connection retains command budgets;
• keep one-shot hunk session commands fail-fast with actionable upgrade guidance;
• strengthen Node/Bun transport bounds, resource accounting, and terminal shutdown behavior;
• add checksum-attested real-binary Firecracker A→B upgrade fixtures and a delayed-client migration scenario.

Non-goals include forced live handoff, random endpoints/coordinators, service installation, remote-host support, and using generic broker credentials for browser-review routes.

Verification

• bun run test — 1,754 passed, 9 skipped
• bun run test:integration — 137 passed, 1 platform skip
• bun run test:session-broker-node — 3 passed
• bun run typecheck
• bun run lint
• bun run deps:check
• ShellCheck on the authenticated upgrade scenario
• scoped oxfmt --check and git diff --check
• committed-source targeted Firecracker authenticated-daemon-upgrade scenario and semantic evidence validator passed:
  • result: tmp/install-vm/runs/2026-08-30T21-38-57-326Z-2065238/result.json
  • source identity: f723b096c241a9d8844b6ed65db6b146f7067cdaa1a8d1e54c94ddfda723df1a
  • build-input identity: f763790815dd1ee32569932962185131329182789d0ccf887d66e8c3cd35606f
  • revision A/B binary SHA-256: bf880afa07b7742d165cdafe17e87174175e05be22236db4bf71c2580db2f908 / a0671e1ce4495b356da09c242fb75fab04241522dcd3ea794784200060ed2b34

No visual evidence is included because this changes daemon/session lifecycle rather than terminal rendering.

Known limitations

• The complete Firecracker install matrix was not rerun; only the new authenticated upgrade scenario was targeted.
• Native Windows owner/DACL and reparse-point validation remains a publication gate.
• Durable staged reconnect-key rotation remains a publication gate.
• Hung or idle-disabled incompatible incumbents still require manual termination; this change deliberately does not add forced replacement authority.

This PR description was generated by Pi using gpt-5.6-sol

[greptile-apps]

Too many files changed for review (68 files, 50 file limit).

Bypass the limit by tagging @greptile-apps to review.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
hunk-web	Ignored		Aug 30, 2026 9:39pm

[benvinegar]

Superseded by GitHub stack #935: #932 → #933 → #934. The top stack tree is byte-identical to this PR, with validation reported per layer.

This comment was generated by Pi using gpt-5.6-sol