Adopt the browser bridge with replay, lifecycle, and access guards - #5
Merged
Merged
Conversation
…cess Preserve complete connection/state replay after rename and reject obsolete socket callbacks. Keep long effects alive only for their requested lifetime, settle cancelled effects, and reject retired actuators. Eight deterministic Node regressions cover these behaviors (seven fail on the imported source). Add an opt-in settings window, exact extension-Origin checks, bounded clients and messages, and per-client rumble ownership. GameCube HD rumble is withheld using the existing model capability. Origin checks are not native-process authentication. Exercise the actual Network.framework listener in macOS CI. Adapted browser feature retains attribution to Andrei-Kondrykau's upstream browser-bridge at 24b0cd3.
Move only a conflicting virtual index and announce the old/new indices, without mutating prior snapshots or hiding the native device. A regression fails against the previous shim and all nine Node cases pass after repair.
This was referenced Sep 9, 2026
jmonster
marked this pull request as ready for review
September 9, 2026 23:46
…ns (#6) * feat(retroarch): import the optional network gamepad sink for regression validation Adapted from vialoh/switch2mac retroarch-network-gamepad at 2c7a396 (upstream PR #1). Retain the contributor's opt-in default and attribution; validate actual Swift builds and repair edge/lifecycle behavior before marking ready. * fix(retroarch): preserve edges, refresh releases and retire old destinations Retain the attributed optional fork output and existing remote_message bytes. Replace latest-only button state with a bounded edge queue; overflow explicitly neutralizes this output until disable/re-enable. Include zeros in periodic refreshes and clear the old port before switching destinations. Reject nonfinite axes and remove the imported Array safe-subscript compile failure. Eight synthetic/real-loopback cases pass locally; the tap, release refresh, destination, overflow and finite-axis cases fail against the imported source. UDP acceptance is not acknowledgement; no physical-gameplay claim is made. * fix(retroarch): resume ordered input after cancelling a destination change A partially completed reset left switchIndex active when the user changed back to the original port. Subsequent button edges were never queued. Reassert the desired state and retire that reset; the new real-loopback regression fails against the previous head and the nine-case suite passes. * fix(fork): isolate app identity and disable upstream automatic updates (#9) Use io.github.jmonster.switch2mac and a distinct bundle name/defaults domain. Keep upstream credits but reject default or saved update feeds and updater entry points until a fork-specific signing/update trust path is established. Require explicit signing identities, notary credentials and fork-matching entitlements instead of silently consuming upstream signing configuration. No certificate, profile, notarization request or release is created here. Add metadata, actual feed-resolver and early signing-refusal regressions and build the actual ad-hoc fork app in the existing read-only macOS check.
jmonster
added a commit
that referenced
this pull request
Sep 10, 2026
* test: add protocol fixtures and read-only macOS app build checks * test: run isolated regression groups alongside protocol fixtures * Adopt the browser bridge with replay, lifecycle, and access guards (#5) * feat(browser): stage attributed browser bridge for guarded integration Adapted from Andrei-Kondrykau/switch2mac browser-bridge at 24b0cd3 (upstream PR #2). Keep the output sink unregistered until access and lifecycle guards are added. Retain the contributor's source and documentation, with our read-only checks. * fix(browser): guard replay, rumble ownership, and opt-in WebSocket access Preserve complete connection/state replay after rename and reject obsolete socket callbacks. Keep long effects alive only for their requested lifetime, settle cancelled effects, and reject retired actuators. Eight deterministic Node regressions cover these behaviors (seven fail on the imported source). Add an opt-in settings window, exact extension-Origin checks, bounded clients and messages, and per-client rumble ownership. GameCube HD rumble is withheld using the existing model capability. Origin checks are not native-process authentication. Exercise the actual Network.framework listener in macOS CI. Adapted browser feature retains attribution to Andrei-Kondrykau's upstream browser-bridge at 24b0cd3. * fix(browser): distinguish validated rumble values from clamped magnitudes * docs(browser): document fork opt-in setup and actual compatibility limits * fix(browser): preserve bridged controllers when native gamepads hotplug Move only a conflicting virtual index and announce the old/new indices, without mutating prior snapshots or hiding the native device. A regression fails against the previous shim and all nine Node cases pass after repair. * Adopt optional RetroArch network output with input-delivery regressions (#6) * feat(retroarch): import the optional network gamepad sink for regression validation Adapted from vialoh/switch2mac retroarch-network-gamepad at 2c7a396 (upstream PR #1). Retain the contributor's opt-in default and attribution; validate actual Swift builds and repair edge/lifecycle behavior before marking ready. * fix(retroarch): preserve edges, refresh releases and retire old destinations Retain the attributed optional fork output and existing remote_message bytes. Replace latest-only button state with a bounded edge queue; overflow explicitly neutralizes this output until disable/re-enable. Include zeros in periodic refreshes and clear the old port before switching destinations. Reject nonfinite axes and remove the imported Array safe-subscript compile failure. Eight synthetic/real-loopback cases pass locally; the tap, release refresh, destination, overflow and finite-axis cases fail against the imported source. UDP acceptance is not acknowledgement; no physical-gameplay claim is made. * fix(retroarch): resume ordered input after cancelling a destination change A partially completed reset left switchIndex active when the user changed back to the original port. Subsequent button edges were never queued. Reassert the desired state and retire that reset; the new real-loopback regression fails against the previous head and the nine-case suite passes. * fix(fork): isolate app identity and disable upstream automatic updates (#9) Use io.github.jmonster.switch2mac and a distinct bundle name/defaults domain. Keep upstream credits but reject default or saved update feeds and updater entry points until a fork-specific signing/update trust path is established. Require explicit signing identities, notary credentials and fork-matching entitlements instead of silently consuming upstream signing configuration. No certificate, profile, notarization request or release is created here. Add metadata, actual feed-resolver and early signing-refusal regressions and build the actual ad-hoc fork app in the existing read-only macOS check. * Neutralize disconnected UDP controllers and bound subscriber processing (#4) * fix(udp): neutralize disconnected slots and bound subscriber handling * test(udp): synchronize real datagram arrival before subscriber assertions * Fix session response matching, fallback sticks, and GameCube motor gating (#3) * fix(session): preserve command correlation and respect model capabilities * fix(session): retire callbacks before teardown and require usable input for readiness (#8) Guard late notifications, queued commands and timers after session retirement. Clear notify completion before invocation to preserve reentrant replacement. Require isNotifying on essential channels and one existing-decoder input report before readiness, retaining the established keep-alive and handshake bytes. Eleven synthetic production-session tests pass locally; five new targeted cases fail against the prior session source. Full Apple-framework build and regressions remain the hosted gate. No new connection deadline or protocol.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ready for review — attributed, opt-in browser integration
Head
1babdaf6b802d9e78db97c1cec32dcecd9778af7. Exact-head macOS tests and actual app build passed. Depends on #1; #6 now follows this PR to avoid overlapping app-entry changes.Adapted from Andrei-Kondrykau/switch2mac
browser-bridgeat24b0cd3d225c77c9efcfca42cb4fd4325e2fccf3, with attribution retained. This is a browser-specific output, not system-wide HID or an entitlement workaround.The app registers the sink but does not open its listener unless explicitly enabled with a valid extension-ID allowlist. It binds to loopback and checks the exact extension Origin. Eight clients (including pending handshakes), 64 KiB received messages, 200 messages/client/second and pending-send limits of 128 messages/256 KiB bound client processing. Origin checks do not authenticate other native programs on the same machine.
Connection replay retains identity after rename and includes current state. Obsolete socket callbacks cannot retire replacements. Rumble refreshes for its requested lifetime and cancels/settles on disconnect or preemption. Native-client rumble ownership prevents an unrelated departing observer stopping another client's effect. Unsupported GameCube HD rumble is not forwarded.
The latest repair prevents a newly plugged native gamepad from silently hiding a bridged controller at the same index. It relocates only the conflict, announces old/new indices and preserves earlier snapshots and unrelated virtual indices. That new regression fails against the prior shim.
Nine Node regression cases pass with simulated browser objects. Hosted macOS validation additionally exercises the actual Network.framework WebSocket listener using raw loopback clients, compiles the full Apple-framework app and verifies the ad-hoc bundle. The combined nine-PR integration check passed. No physical controller, Chromium/cloud-game or latency qualification is claimed.
Setup:
browser/README.mdandbrowser/FORK-INTEGRATION.md. Configuration changes require relaunch. Both optional outputs stay disabled by default. Per-report dispatch admission is not globally byte-bounded; multiple tabs sharing one extension socket do not have separate rumble ownership. Nintendo pairing, GATT operations, controller commands, decoding and keep-alives are unchanged.Merge #1 first, retarget to main and recheck. No merge or release performed.