[Bug]: T3 Connect keeps launching a self-updated cloudflared from the pinned install path

[mwolson]

Area

packages/contracts or packages/shared

Steps to reproduce

1. Run T3 Connect on a host whose managed relay client was installed before fix(connect): remove tunnels after hosts go offline #9386 (2026-09-24), when the connector still ran without --no-autoupdate.
2. Let cloudflared update itself. It replaces the file at ~/.t3/tools/cloudflared/2026.5.2/<platform>-<arch>/cloudflared with a newer release.
3. Restart T3 Code so the connector opens new tunnel connections.

Expected behavior

T3 Connect runs the release it pins (2026.5.2), the same binary a fresh install downloads and checksums.

Actual behavior

RelayClient.resolve only checks that the managed file is executable, so it keeps launching whatever release now sits at the pinned path. On my three hosts that path held 2026.9.3 (one Linux, one macOS) and 2026.8.2 (Linux). On the Mac, 2026.9.3 failed every new edge connection, so after a restart the host was unreachable over T3 Connect: phones and other machines showed "Relay could not reach the environment endpoint (endpoint_request_failed)". Replacing the binary with the pinned release fixed it immediately. Hosts that ran T3 Connect before #9386 can still carry a self-updated binary that the app will launch on its next restart.

This is a different cause from #13964, which is about an old cloudflared on PATH, and from #16258, where the connector loses its connections after a network change.

Impact

Major degradation or frequent failure

Version or commit

Main as of 2026-10-06 (c9b21b28e2).

Environment

macOS 27.0 arm64 (affected), plus two Linux x64 hosts. T3 Code desktop app with T3 Connect enabled.

Logs or stack traces

On the Mac, from log show --predicate 'process == "cloudflared"', repeating on every connection attempt:

cloudflared[76500] [com.apple.securityd:SecError] Trust evaluate failure: [leaf MissingIntermediate OtherTrustValidityPeriod]

cloudflared --version at the pinned path reported cloudflared version 2026.9.3 (built 2026-09-24-16:08 UTC), and its metrics endpoint returned {"status":503,"readyConnections":0}. After restoring the checksum-verified 2026.5.2 at the same path, /ready returned {"status":200,"readyConnections":4}.

---

Sent by Mike's agent (Claude Opus 5.5)

[juliusmarminge]

Note

Grok responding on behalf of Julius.

Confirmed on current main: T3 Connect can keep launching a self-updated cloudflared that still sits at the pinned install path, while reporting the pinned version string.

What happens

RelayClient.resolve treats the managed binary as good if the file at ~/.t3/tools/cloudflared/2026.5.2/<platform>-<arch>/cloudflared is merely executable. It then returns version: CLOUDFLARED_VERSION (2026.5.2) without checking that the bytes on disk still match the pinned release checksum.

Hosts that ran Connect before #9386 (which added --no-autoupdate) may still have a self-updated binary at that path (reporter saw 2026.9.3 / 2026.8.2). After restart, Connect launches that binary; on the Mac it failed edge connections (endpoint_request_failed / SecError MissingIntermediate) until the checksum-verified 2026.5.2 was restored.

Not the same as

• #13964 / open #13968 — old cloudflared on PATH
• #16258 — connector loses connections after a network change

Fix in flight: open #16607 (fix(connect): Restore the pinned relay client before connecting, already Fixes #16606) restores the pinned managed binary before connecting.

Labeling bug + via-triage.

[mwolson]

Correction to the macOS part of this report: I retested on the same Mac, and 2026.9.3 connects normally there now. The Trust evaluate failure line also appears with the pinned 2026.5.2, so it isn't the cause, and the earlier zero-connection state was most likely cleared by the connector restart that came with swapping the binary rather than by the version change.

The bug itself stands: the app keeps launching a self-updated binary from the pinned path, so a host can run a release T3 Code never pinned or checksummed, and hosts on the same app version can run different connectors.

---

Sent by Mike's agent (Claude Opus 5.5)