fix(drivers): preserve legacy startup after source removal - #1112
Conversation
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_47724d5e-cde2-4008-ac46-790a5999bcea) |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2e77a0ff43
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } | ||
| // Preserve legacy v1 startup and its autonomous default after a source | ||
| // is removed. Official provenance already selected pinned trust above. | ||
| return nil, nil |
There was a problem hiding this comment.
When a Sourceful control-v2 artifact remains installed after its custom repository is removed and cfg.Control is nil, this return downgrades it to a legacy driver even though an unselected v2 package normally retains a non-nil policy with SiteEnabled == false (sourceful_test.go:449-452). The registry therefore skips DefaultModeV2, calls the absent legacy driver_default_mode, treats that absence as success, and can leave the device in its previous controlled state. Restrict the fallback to artifacts that are actually legacy v1 rather than using the absence of site opt-in as the discriminator.
AGENTS.md reference: AGENTS.md:L36-L36
Useful? React with 👍 / 👎.
1 participant
Removing a repository must not prevent a retained legacy v1 driver from running its normal startup default. #1110 changed the missing-source return into an error for all managed drivers; after an abrupt stop or failed shutdown default, that could leave a legacy driver unable to request autonomous mode in the next process.
This restores the previous v1 return in that one branch. The official installation's pinned trust identity and fresh signature check are unchanged. Explicit control-v2 still requires its trust source, and a failed official signature check still stops loading before any Lua runs. A normal Restart/Reload already attempts default on the old instance; this fix preserves the startup path too.
A regression using the real registry, Lua host and SQLite fails on #1110 because the legacy driver never reaches init/default. It passes with the fix. The two negative cases confirm that control-v2 without trust and an official driver with a bad signature execute no Lua. The complete driverrepo and drivers suites pass with the race detector, and
make verifypasses.The pending trust changeset now describes its official-driver scope precisely. Version Packages #1111 remains open so this correction can ship with that change. No signing key, artifact, state schema, or hardware protocol changes.
Note
Medium Risk
Touches managed-driver trust and startup gating; legacy behavior is relaxed only when control opt-in is off, while control-v2 and official signature paths stay strict.
Overview
Reverts a regression where
RuntimePolicytreated every managed driver without a matching configured trust source as fatal. Legacy v1 drivers with a retained install but no longer-configured repository again getnilpolicy (normal startup and autonomous default). Control v2 opt-in still errors when the Device Support trust root is missing, and official drivers still use pinned trust and manifest re-verification.Adds
TestManagedDriverStartupAfterRepositoryRemoval(registry + Lua + SQLite) for legacy success vs control-v2 and bad official-signature rejection. Updates the beta-trust changeset wording and adds a patch changeset for this fix.unknown_repositorytest now expects an error when the installed repo ID does not match the beta source.Reviewed by Cursor Bugbot for commit 2e77a0f. Bugbot is set up for automated code reviews on this repo. Configure here.