Repository navigation
fix(desktop): Chrome login mirror hangs startup on Macs that are not the source #541
Description
What: The desktop app starts normally on every Mac; the Chrome login mirror runs only where the user turned it on, and never blocks the app.
Why: e5936c2 (#530) starts the Chrome mirror on every macOS desktop and reads Chrome's key through @napi-rs/keyring on the Electron main thread, so Rocky hung at startup waiting for a Keychain prompt and its server never came up.
So what: A worker fixes it and an independent review checks it; the planner then reinstalls on Rocky and bestia and stages on cavallo for the #520 live proof.
Reproduction (Rocky, 2026-10-19 17:13 Warsaw)
Installed e5936c2 on Rocky (server-only Mac). Main process PID 8842 blocked in SecKeychainFindGenericPassword called from keyring.darwin-arm64.node; no server trace after start; 127.0.0.1:3773 unreachable. Rolled back to f31c797.
Acceptance criteria
- The Chrome mirror source is off unless the user enabled it on that machine (for example by setting the Chrome key command in Settings); a fresh install on a server Mac never touches the Keychain.
- No Keychain or key-command call runs on the Electron main thread; a pending prompt or slow command cannot delay window creation or the bundled server.
- Test: with the source enabled and the key read never resolving, the app and server still start and report healthy.
Non-goals
- Changing the mirror protocol or server side.
Blockers
- None.
Required proof
- Focused tests for both criteria; independent review of the exact head; live: Rocky starts healthy on the fixed build without any prompt.
Elon record
- Requirements and who asked: user wants spec: mirror Mac browser logins into Chromeria and out to bestia and Rocky #520 live on cavallo, bestia and Rocky; observed Rocky hang at 17:13 on e5936c2.
- Deleted: mirror auto-start on Macs that are not the user's source; main-thread key reads.
- Bottleneck: this hang blocks every install of feat(preview): mirror Mac Chrome logins to connected environments #530.
- Checked myself: deploy worker's read-only sample of PID 8842 and trace files;
ChromiumKeys.tsadding@napi-rs/keyringin feat(preview): mirror Mac Chrome logins to connected environments #530.
Activity
lukemaj commentedon Oct 19, 2026
What: The exact
e5936c25383afe05638b8e6390f5363513a3f7b3signed desktop was installed, failed startup, and was rolled back to healthyf31c79770472.Why: The Electron main process blocked in
SecKeychainFindGenericPasswordthroughkeyring.darwin-arm64.node; the bundled server never listened on port 3773.So what: Further fleet activation is stopped for this issue; candidate artifacts are retained unarmed.
The same signed package had passed strict signature/embedded-commit checks and an isolated bundled-server smoke with a fresh home and empty PATH. That smoke therefore does not cover this desktop startup failure.
Candidate signed ZIP SHA-256:
15f4a202a1f7407f05e1962769ec46a1b4f6a66de621c8460d7899f958dcb7ff; ASAR:94fde90a3d7528af57c66bf4a278a85c519bc005f049d124479c1e06faa436e5.After the documented rollback and settings restoration, independent live verification at 17:23:39 Warsaw returned HTTP 200 for health and discovery, loaded three existing threads through the authenticated orchestration API, and found no uncontinued cut threads or held queues. No Keychain permission was granted during the rollout.
lukemaj commentedon Oct 19, 2026
What: Draft PR #545 fixes the Chrome-source default and isolates native key reads at
0727249d45c20bcb044b80054c835390d2aae7c1.Why: Every Mac previously started the Chrome source, and the shared Chromium importer called synchronous Keychain code on Electron main.
So what: The planner owns independent exact-head review, any approved production artifacts/installations, Rocky startup proof, and branch/worktree retirement at merge; #544 records the separate baseline Knip findings.
Base:
e5936c25383afe05638b8e6390f5363513a3f7b3. Branchfix/541-mirror-startupis pushed and clean. Existing nonemptychromeCookieKeyCommandenables this Mac's Chrome observation; unset/empty/invalid leaves it off. The command remains an asynchronous child process. Both one-off BrowserImport and the mirror's shared Keychain fallback use the same native worker. Missing-key/consent reasons are preserved; arbitrary native errors are redacted. No version bump, protocol, server or web-component change.The PR contains exact focused commands, upstream findings and evidence limits. Three selected regressions fail on the original production code. Final source: 20 files / 190 tests PASS; desktop typecheck, nine-file scoped lint, 14-file formatting and full fork-stack/registry checks PASS. Desktop bundle and blocked-worker artifact probe PASS on identical runtime source. The startup proof runs actual DesktopApp.program and BackendManager to ready while the enabled source's real key cache waits forever; process, HTTP and native-window boundaries are synthetic, not a native macOS claim. No React Compiler test applies.
vp run knip:checkexits 1 for@clerk/expo-native-components,drizzle-kit, andvite, identically after restoring every tracked task edit to the base. The desktop-only exports check passes. #544 records dependency-setup limits; no unrelated dependency declarations changed.An early test import unexpectedly invoked Electron's automatic downloader in a reused local dependency cache. No package-manager install, app launch/restart, dev server, production installation, Keychain read or real-cookie access was performed. The fixture now mocks eager Clerk/updater imports; final tests used an explicit existing Electron path. The dependency-cache fetch was reported during the task and is recorded on the PR.
Independent review is not claimed. No merge, production build, installation/restart or native Rocky acceptance was attempted. Keep the exclusive task workspace for the planner.
Requirements and who asked: User and #541: opt-in Chrome source, no main-thread key access, unresolved-key startup regression, shared importer fix, focused proof and one PR.
Deleted: Automatic source activation, main-thread native reads, new settings/design surface and unrelated dependency fixes.
Bottleneck: Native consent previously blocked all window/server startup.
Checked myself: Full task context, both key paths, upstream search/source, red/green regressions, 190 tests, actual bundle/worker output, scoped checks, restored-base Knip comparison, fork registry and live pushed PR head.
lukemaj commentedon Oct 19, 2026
What: PR #545 is rebased onto
1e83a3169f77d5dbbd6727c929ffb8b0c1118754and lease-pushed at2a511fa8e900b28fdc949d6b03305b7348296b59.Why: The stale four-worker synthetic bundle fixture caused Test to fail; Check only aggregated that failure.
So what: The planner reviews the new exact head and its fresh CI, then owns any approved rollout; no installs or restarts were performed in this follow-up.
Current PR body with complete commands, failure logs and comparisons.
One rebase conflict:
scripts/fork-upstream-edits.txt. Retained both main's secret/OAuth/research additions and #541's paths. Range-diff:749e3369e1->4be08dfb65differs only in allowlist context;0727249d45->2265c34febis identical;2a511fa8e9adds the fixture repair and fork metadata. No merges or version bump.Read both failing jobs: Test 118154631974 reports
[UNRESOLVED_ENTRY] Cannot resolve entry module src/preview/BrowserImport/ChromiumKeychainWorker.ts; aggregate Check 118158145217 reportstest: failure. The fixture now derives worker entries from the actual build configuration, creates nested worker paths and uses the correct relative shared import. Every worker still executes in the bundle harness and the final desktop-startup count must stay exactly one.Comparison: rebased candidate before repair reproduces 1 failure / 1 pass; the byte-identical test and config from current main pass 2/2, and main CI run 39334964453 is green. Corrected fixture: 2/2 PASS. This is our PR regression, not a pre-existing main defect.
Final-source commands/results:
vp test runselection in the PR, now includingapps/desktop/scripts/main-process-bundle.test.mjs: 21 files / 192 tests PASS.vp run --filter @t3tools/desktop typecheck: PASS, five existing suggestions.vp linton all 10 changed JS/TS files: PASS.vp fmt --checkon all 15 supported touched files: PASS.vp run knip:check: both phases PASS, 0/2 cache hit; no dependency declarations changed.(cd apps/desktop && vp pack): PASS, existing optional x11/import-meta warnings only.scripts/fork-check.sh,node scripts/fork-features.mjs check,git diff --check: PASS.Explicit lease was against remote
0727249d45c20bcb044b80054c835390d2aae7c1. The old Opus review status does not cover this new exact SHA. Fresh review/CI, native Rocky acceptance and rollout remain planner-owned. Existing cached dependencies were reused with an explicit Electron path; no installer, app launch/restart, dev server or live Keychain/cookie read was used. Keep this task worktree for review and retirement at merge.Requirements and who asked: Planner: rebase, fix both failing checks, preserve worker/startup isolation, rerun focused gates and vp pack, and push with a lease.
Deleted: Stale fixture inventory, treating a production bundle pass as synthetic bundle-test proof, and a separate patch for the aggregate Check job.
Bottleneck: Fixture compilation failed before reaching its desktop-startup isolation assertions.
Checked myself: Both failed logs, red/main/green bundle comparison, 192 focused tests, real bundle output, all scoped checks, full Knip, range-diff, fork ownership and lease target.
lukemaj commentedon Oct 19, 2026
What: Rocky's actual signed5898397 desktop boot succeeded after one supported restart, and its real backend serves discovery successfully.
Why: The prior e593 startup hang tracked here prevented the bundled server from starting; the reviewed #545 fix is now running natively on Rocky.
So what: The sole #560 rollout callback continues required ten-minute and provider verification; the daily coordinator owns fleet acceptance and tracked runbook finalization, with bestia held.
Exact source5898397a657e9e1df162d2ddc48dbdf6a748d1c0, signed ZIP9136dcca663c5ad22b92d65b96888c5be97365590b82f6d46ae656b9cc69bf0a. Actual native main61402 and port3773 backend61440/parent61402; embedded5898397a657e, ASAR9da06732adb5e4ad95451fee0736689477b01c3564fe6e0e46b6145339d915f1/executable8bd311db67710d9f7dd5d9e77ca8b1f59b257b9df7011806dc27a2c2cb37094a and strict deep signature match the promoted artifact. Quit23:25:49Z/swap23:25:56Z/healthy23:27:24Z/resume23:27:27Z; one own-thread resume delivered. This is actual desktop boot, not the earlier isolated packaged-server smoke.
Three existing histories load via authenticated API; migration63, existing peer links and no uncontinued cut threads/held queues. Endpoint identities and repeated HTTP discovery200 are recorded privately under the authorized delivery cache. No Keychain consent, Chrome-secret request, source opt-in, credential/login change, browser/mobile action, rebuild or global install. Immediate verified f31 rollback and both protected held bundles remain preserved. Provider snapshot readiness recovery is being verified separately and does not change this observed native boot result. Final stability proof will be linked on #411.
Requirements and who asked: User authorized native Rocky activation of reviewed #560+#545 and requested actual boot outcome reported to #541 owner.
Deleted: Server-only proof as substitute for desktop boot, rebuild/restage, repeated restart, Keychain consent and bestia activity.
Bottleneck: Native startup passed; sustained endpoint/provider verification continues under #411.
Checked myself: Real main61402/backend61440 parent and start identities, listener3773, embedded source/digests/strict signature, watchdog quit/swap/healthy/resume lines and authenticated histories.
lukemaj commentedon Oct 19, 2026
Live acceptance passed on Rocky with signed 5898397 (contains #545): native main and backend booted without Keychain consent, health and discovery stable for >= 600 s across 22 checks, existing threads loaded; cavallo also verified for 612 s / 22 checks. Receipts: #541 (comment) and #411 (comment) . bestia remains held by the user.