Skip to content

fix(daemon): isolate empty application state storage - #300

Merged
hyperb1iss merged 10 commits into
mainfrom
nova/isolated-app-state
Sep 20, 2026
Merged

hyperb1iss merged 10 commits into
mainfrom
nova/isolated-app-state

Conversation

@hyperb1iss

@hyperb1iss hyperb1iss commented Sep 20, 2026

Copy link
Copy Markdown
Owner

What this changes

Empty application-state constructors now use unique temporary storage in every build mode. Explicit directory builders and live daemon composition retain their selected storage.

Why

Dependent crates compile the daemon library without cfg(test). The previous constructor consequently sent downstream tests to the developer's real data and state directories. The temporary directory now belongs to the state and is removed after its stores are dropped.

Verification

  • Added or updated tests
  • Added or updated docs (README, AGENTS.md, relevant spec, or guide)
  • just verify passes locally (Rust fmt + lint + test)
  • just deny passes (required for dependency or license changes)
  • just ui-test and just ui-build pass (required for crates/hypercolor-ui/)
  • just sdk-lint, just sdk-check, and just sdk-build pass (required for sdk/)
  • just python-verify passes (required for python/)
  • just compat-check passes (required for data/drivers/vendors/*.toml)
  • just docs-build passes (required for docs or README changes)
  • cd docs && zola check passes (required for docs link/content changes)
  • Packaging scripts were syntax-checked (required for scripts/ or packaging/)
  • just e2e-build passes with the normal Servo stack (required for daemon/UI/effect integration changes)
  • just e2e-build-cpu passes when validating the CPU smoke fallback
  • just e2e passes against the Servo stack (required for end-to-end behavior changes; starts daemon/browser)
  • Tested on real hardware, simulator, or e2e harness (describe below)

The external integration regression, strict Clippy for that target, and rustfmt pass. The regression substitutes disposable ambient directories before constructing any state, so even a future failure cannot touch developer data. It checks independent fixtures, cleanup, and explicit-directory persistence. An independent source review passed.

The full daemon suite passes all 1,847 tests with the CI feature set (builtin-drivers,persistence-test-hooks). Persistence fixtures now pass their directories explicitly so seeded files and API stores share the intended path. The fixture changes also passed independent review.

Notes for reviewers

The host transport and CSP foundation (#299) is merged. This PR targets main and contains the constructor change, its regression test, and persistence fixture updates.

Summary by CodeRabbit

  • Bug Fixes

    • Improved temporary application-state handling to keep separate instances isolated from one another.
    • Temporary state directories are now cleaned up automatically when their associated state is released.
    • Explicitly configured data directories continue to be honored and remain available after temporary state cleanup.
  • Tests

    • Added coverage for state isolation, directory placement, cleanup behavior, and attachment persistence.

hyperb1iss and others added 8 commits September 20, 2026 11:40
Resolve the UI directory before extension installation and publish the same
path through DaemonState. Remote extensions can now inspect the exact static
root used by the local router during install and startup.

Co-Authored-By: Nova (GPT-6) <noreply@openai.com>
Discover the versioned host bridge at runtime and install streaming HTTP and
WebSocket transports alongside native discovery. Remote URL resolution is
confined to the selected daemon's /api/v1 namespace, including encoded path
traversal checks, while the bridge carries abortable request streams.

Co-Authored-By: Nova (GPT-6) <noreply@openai.com>
Retire request cancellation watchers at EOF and abort pending exchanges on
drop. Split browser chunks to each consumer's requested capacity. Socket
drops clear JavaScript callbacks before closing. Startup rejects incomplete
or malformed bridge contracts before installing transports.

Co-Authored-By: Nova (GPT-6) <noreply@openai.com>
Let extension crates detect the browser Remote bridge before app transport
initialization, preventing accidental same-origin requests during bootstrap.
Pin the current reviewed raw HTML sinks so new injection surfaces fail CI.

Co-Authored-By: Nova (GPT-5.6 Sol) <noreply@openai.com>
Render shapes through typed SVG nodes. Load vendor marks as rebased CSS mask
assets so tinting works without injected SVG markup.

Reject every future inner_html attribute in the UI security gate.

Co-Authored-By: Nova (GPT-5.6 Sol) <noreply@openai.com>
Vendor tachys 0.2.18 with a narrow hc-static policy for compiler-generated
DOM templates. Validate owned icon SVG against an inert structural grammar
before conversion and leave general raw HTML assignments browser-blocked.

Create preview workers through the private policy. Only registered blob URLs
from embedded static source can become TrustedScriptURL values.

Co-Authored-By: Nova (GPT-5.6 Sol) <noreply@openai.com>
Reject escaped paint URLs and limit owned SVG conversion to the SVG
renderer. An embedding host can provide the sole static DOM policy so
verified service workers and compiler templates share one named policy.

Restore all other vendored source bytes to the published tachys package.
Keep upstream formatting intact so future patch audits stay narrow.
Downstream tests compile the daemon without cfg(test), so the default
application-state builder previously selected the real user directories.
Empty-state constructors now own unique temporary storage in every build
mode. Explicit storage builders and live daemon composition keep their
selected directories.

An external integration test proves dependency-mode isolation, independent
fixtures, cleanup, and persistence for an explicitly supplied directory.
Ambient overrides keep the regression test away from developer data even
if the constructor regresses.

Co-Authored-By: Nova (GPT-6) <noreply@openai.com>
@coderabbitai

coderabbitai Bot commented Sep 20, 2026

Copy link
Copy Markdown

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 228a4962-431f-43c9-ab25-c8a44eddc7b0

📥 Commits

Reviewing files that changed from the base of the PR and between a0c4779 and ac99755.

📒 Files selected for processing (4)
  • crates/hypercolor-daemon/src/app_state.rs
  • crates/hypercolor-daemon/tests/app_state_isolation_tests.rs
  • crates/hypercolor-daemon/tests/attachment_api_tests.rs
  • crates/hypercolor-daemon/tests/effect_registry_invalidation_tests.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.


📝 Walkthrough

Walkthrough

AppState now creates isolated temporary storage for default construction and retains it through state-owned stores. New and updated tests verify directory isolation, cleanup, explicit directory behavior, and test-specific persistence paths.

Changes

AppState isolation

Layer / File(s) Summary
Temporary storage lifecycle
crates/hypercolor-daemon/src/app_state.rs
Default AppState construction creates a TempDir. The builder transfers ownership to AppState, while daemon-backed state stores no temporary directory.
Isolation validation and test setup
crates/hypercolor-daemon/tests/app_state_isolation_tests.rs, crates/hypercolor-daemon/tests/attachment_api_tests.rs, crates/hypercolor-daemon/tests/effect_registry_invalidation_tests.rs
Tests verify unique temporary directories, cleanup, explicit directory behavior, and persistence within test-specific data directories. Shared ambient storage overrides are removed from effect-registry test setup.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed Docstring coverage is 83.33% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 12 functions across 4 files.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly describes the main change: isolating empty daemon application-state storage. It is concise and specific.
✨ Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR

Comment @coderabbitai help to get the list of available commands.

Persistence tests must use the same directory for seeded files and API
stores. Pass those paths explicitly now that empty AppState constructors
own isolated temporary storage instead of reading ambient overrides.

Remove the effect registry fixture's unused global override and lock.
The full daemon suite passes with the CI feature set: 1,847 tests.
@hyperb1iss
hyperb1iss changed the base branch from nova/remote-host-ui-bridge to main September 20, 2026 21:46
Bring the merged public transport and CSP base into the isolation branch.
The persistence change can now be reviewed directly against main.
@hyperb1iss
hyperb1iss merged commit 472f8d5 into main Sep 20, 2026
40 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant