Repository navigation
[PR] fix: make startup-failure paths self-contained and actionable (#5104) - #5157
Merged
ranxianglei merged 12 commits intoOct 30, 2026
Merged
Conversation
…dvice under OS-level refusals (Follows #4614)
…ot this PR's master 146b34f fails the unused-exports gate on this exact line (INTERNAL_ONLY src/agent/client-build-note.ts: ClientBuildCheck): the type-only export #4545 introduced was missed by the 4d34abf de-export sweep. This PR touches none of it — every PR rebased past that master inherits the red (#4599 storm log). Same one-word fix as #4606 commit 1 and the in-branch precedents (#4607/#4595/#4540/#4618/#4622): drop the leading export on a symbol referenced only within its own file. Drop this commit when rebasing after #4606 merges.
…-open-hint # Conflicts: # src/storage/shadow.ts
A forced power loss left the DSH-spawned child dying on EPERM at the combined-CA bundle rewrite while a manually started proxy held the lane port for 11 hours; every failure surface stayed silent or unactionable. - ca: a write-refused combined-bundle rebuild now reuses the existing bundle when it still carries the current root CA (loud warn pointing at the AV-exclusion remedy) instead of exiting before the port binds; stays fail-fast when no usable bundle exists - launcher: the "port answers health but is not the proxy this launcher spawned" info line and the final timeout error now carry the remedy (kill pid X / native.attachExternal); an explicit attachUrl target that is found but refused gets one loud line naming the reason (e.g. code-fingerprint-mismatch after a version skew) and the remedy; a dead/absent target says so instead of waiting silently - index: "bili: failed to start" gains errno-classified hints (EPERM/EACCES -> OS-level write-refusal guidance) - storage: the FIRST unified-store ingest failure now warns naming the db file (was silent until strike three); the disable warning keeps naming it; sqliteOpenFailureHint also matches "attempt to write a readonly database" (the field shape where the db opens but writes are refused) Tests: tests/issue5103-startup-recovery-visibility.test.ts (new), tests/ca-combined.test.ts (+2), tests/storage-cantopen-hint.test.ts (+1)
ranxianglei
changed the title
This was referenced Oct 29, 2026
Contributor
📦 Built Package ArtifactBranch: Latest build — install this exact versionnpm install -g billion-context@0.0.6825-pr.5157.cd8942dThis exact version is immutable and reproducible. The rolling Recent builds (commit → version)
Download artifact
tar xzf billion-context-pr5157.tgz
npm install -g packageInstall instructions are refreshed on each push. |
Contributor
📦 Merged Build PublishedThis merge to master was published as npm install -g billion-context@0.0.919-master.577406a # this exact build
npm install -g billion-context@master # always the newest merged build
|
ranxianglei
added a commit
to fathonix/billion-context
that referenced
this pull request
Oct 30, 2026
…p; Low-label-aware failure hints (ranxianglei#5154) A node.exe carrying an inherited Low mandatory-integrity label cannot write Medium-labeled files: the CA bundle rebuild, index.db, and session envelopes all fail EPERM while every ACL check passes — the field repro of the whole ranxianglei#5096 crash-loop class. The label usually arrives from a parent dir once labeled Low (OI)(CI) and survives reboots; ACL tooling never shows it. - src/integrity-label.ts: parseIcaclsMandatoryLabel() + a non-blocking startup self-check (icacls by ABSOLUTE path on process.execPath — PATH resolution fails under some PowerShell/cmd profiles) that logs a loud [integrity] warn with the exact fix command when the runtime is Low/Untrusted. Observability, not a gate: the proxy keeps running. - startupFailureHints (moved out of index.ts): integrity-label check FIRST (ranxianglei#5154: the label was the real switch; the AV detour cost the most hours), antivirus exclusions second (ranxianglei#3823). - ca.ts / shadow.ts CANTOPEN hints reordered integrity-first. - CONFIGURATION.md / .zh-CN.md: 'Windows: node runtime labeled Low' section — mechanism, diagnosis, fix (Medium, not Low!), non-recursive dir-root convergence, ACL backup tip. Stacked on ranxianglei#5157 (ranxianglei#5103) — merge that first.
This was referenced Oct 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
(ai: zai/glm-5.3)
Closes #5104
Stacked on #4625 — merge that first; the 2 lower commits are its head, GitHub retargets this PR automatically once it merges.
What & why
「启动问题」这一类(现场:#5104/#5154/#3823/#4614)的共同形态:listen 之前任何一步失败,用户只看到死端口 + %TEMP% 里的原始错误,自己排查数小时。本 PR 把启动失败路径变成自查自明:失败的每一类都说清「这是哪类问题、第一步该做什么」。
Changes
writeCombinedBundle:重写组合 CA bundle 遇到 OS 级写拒绝(EPERM/EACCES — AV/Defender 锁、完整性控制、低完整性启动器)不再exit(1)砸掉整个代理:若磁盘上的既有 bundle 仍含当前根 CA(功能正确性所需),复用它并大声 warn,下次启动重试重建。无可用 bundle(全新安装/缺根)仍按原样快速失败。main()失败时,EPERM/EACCES 追加一段人话提示(OS 级写拒绝 ≠ 代码故障;AV 排除、低完整性启动器、瞬态锁)再退出。diagnosePort对「端口被外来进程占用」从只报事实改为给出补救动作(kill 该 pid,或native.attachExternal=true/BILI_NATIVE_ATTACH_EXTERNAL=1挂上去);保留 [PR] fix(launcher): adopt proven-healthy child at spawn timeout instead of killing it (#4994) #5010 的{text, selfHealthy}结构与收养判定。index.db路径;sqliteOpenFailureHint保持 [PR] fix: name the win32 READONLY index.db open failure; drop the delete advice under OS-level refusals (#4614) #4625 的 CANTOPEN/READONLY 双分支文案(含 [Bug][dsh] EPERM on startup data writes: the real switch is the node runtime's NTFS mandatory integrity label (Low IL), not Defender/ACL — reproducible A/B, and it explains the #5096 crash loop #5154 方向修正:恢复 node.exe 为 Medium,不再建议把数据目录降 Low)。Behavior changes
CA 重写失败但旧 bundle 可用时:进程存活并 warn(以前:退出)。存储 ingest 失败:第一次就 warn(以前:静默递增计数)。其余为文案/提示增强。
Verification
npm run typecheckclean(rebased head)tests/issue5103-startup-recovery-visibility.test.ts5/5、tests/storage-cantopen-hint.test.ts9/9(含 [Bug][dsh] EPERM on startup data writes: the real switch is the node runtime's NTFS mandatory integrity label (Low IL), not Defender/ACL — reproducible A/B, and it explains the #5096 crash loop #5154 方向的正反两向断言)、tests/ca-combined.test.ts15/15、tests/issue5096-startup-failure-page.test.ts9/9、tests/issue4994-*12/12、tests/issue5012-stdout-leg-mute.test.ts3/3testlanes 为准Config surface
无新增。launcher 提示里宣传的
native.attachExternal/BILI_NATIVE_ATTACH_EXTERNAL是既有面(#1335),本 PR 未改动。