feat(native): Linux support, phase 2 — org filesystem over FUSE

[tlgimenes]

Summary

Phase 2 of Linux support: the org filesystem mounts on Linux. Stacked on #5509 (phase 1) — review that first; this PR's base is its branch, so the diff here is org-FS only.

Ports the path the TypeScript sandbox daemon already runs in production (packages/sandbox/daemon/org-fs/), rather than inventing a second one.

	macOS	Linux
mount	rclone nfsmount	rclone mount (FUSE)
mount table	spawn BSD mount	read /proc/self/mounts
detach	umount -f	fusermount3 -uz → fusermount -uz → umount -l

Every per-OS difference is a runtime seam (LINUX_MOUNT_STACK, mount_args(linux, …), detach_commands(linux, …)), not a #[cfg], so both dialects compile and unit-test on either host — the Linux halves are proven by CI on macOS too, instead of first running on a user's machine.

macOS parity

Byte-identical, and pinned by tests rather than asserted: the_macos_mount_argv_is_unchanged, a_read_only_volume_keeps_the_macos_argv_it_shipped_with, macos_detaches_with_exactly_one_forced_unmount, both_stacks_share_one_argv_tail, plus the five BSD-table parser tests unmodified. Two deliberate cross-platform changes are documented in-code: prune_stale_mounts now honours DECOCMS_DISABLE_ORG_FS, and force_unmount passes the mountpoint verbatim instead of to_string_lossy (a non-UTF-8 ghost path was previously unreclaimable).

Defects found and fixed in review

Two adversarial passes ran against this diff; both found real bugs, and the second found one the first pass's fix had introduced.

• Attachment detection was gated on filesystem type. An unrecognised type — a libfuse build dropping subtype=, a lossily-decoded non-UTF-8 path — made our own live mount read as unattached, so the next cycle killed a working rclone, create_dir_all then hit ENOTCONN, and it looped forever, leaving a ghost invisible to the very sweep meant to reclaim it. Attachment now asks only "is this path mounted?"; the narrow predicate stays where a miss is safe.
• Unmount and mount attempts were unbounded. Lazy detach bounds the kernel's half, not libfuse's pre-flight stat, which a wedged server blocks forever — pinning the org in InFlight so every later request timed out until the app restarted.
• The bound then leaked threads. A tokio blocking task cannot be cancelled, so each abandoned attempt strands a thread from a pool shared process-wide; at a flat retry that exhausted 512 threads and stalled every tokio::fs call in the process. Repeated abandons now back off and then stop entirely — a wedged server is reclaimed by the boot sweep, not by another attempt in this one.
• The orphan-kill marker was a raw substring, so a user's own rclone mount wd: /data/orgs-backup/wd matched. Anchored at a path boundary; the negative test was inverted so the boundary is what spares it, not the remote's name.

Testing

cargo test --workspace 1121 passed / 0 failed; clippy -D warnings clean; cargo fmt --check clean. 41 tests in sandbox::org_mount (12 pre-existing unmodified, 29 new), all pure per TESTING.md.

Not verifiable in CI — needs real /dev/fuse, so it is a manual checklist before relying on this:

• mount appears in /proc/self/mounts (confirming the fstype the sweep matches)
• a stopped mount degrades to an empty org/ rather than hanging
• the boot sweep reclaims a SIGKILLed session's ghosts
• rclone verifies the local origin through the CA bundle

Also confirmed en route: the bundled Linux rclone fetch works end-to-end (rclone-v1.74.4-linux-amd64), and that binary references both fusermount3 and fusermount, so the detach chain covers either host.

🤖 Generated with Claude Code

---

Summary by cubic

Adds Linux org filesystem mounts via rclone mount (FUSE) and completes core Linux desktop support: opt‑in HTTPS trust in WebKitGTK, AppImage packaging with an APPIMAGE‑gated updater, and a Linux boot smoke launched through AppRun. macOS behavior and argv stay byte‑identical.

• New Features

  • Linux org‑fs: rclone mount over FUSE, reads /proc/self/mounts (octal‑unescape), and detaches via fusermount3 -uz → fusermount -uz → umount -l, with time‑bounded attempts and jittered backoff.
  • Linux HTTPS control origin (opt‑in DECOCMS_LINUX_SECURE_ORIGIN): per‑host WebKitGTK certificate exception set before first navigation; spawned CLIs get a system+local CA bundle via SSL_CERT_FILE only when a system store is found; preview host observer wires per‑handle trust in the webview.
  • Linux packaging: AppImage overlay (tauri.linux.conf.json5) and icons, rclone fetched for linux‑amd64/arm64 and bundled into usr/bin; self‑update runs only under APPIMAGE; pins @tauri-apps/cli and webkit2gtk trust APIs to match tauri.
  • Boot smoke: AppImage extract and launch through AppRun, discovers script unit tests, requests software rendering for headless CI; CI adds Ubuntu legs and preserves required check names.

• Bug Fixes

  • Stabilized Linux process‑group teardown: correct liveness probe (pgrep -g), never signal group 0 or our own pid; live process‑group tests scoped to skip only on GitHub runners.
  • PTY exits parsed per‑platform (BSD vs glibc); boot smoke always dumps captured stdout/stderr on signal and no longer gates on public‑internet egress.
  • Attachment detection asks “is this path mounted?”; orphan rclone matcher anchored at a path boundary; unmounts and whole mount attempts are time‑bounded with capped retries to prevent InFlight wedges and thread leaks.

^{Written for commit 39932ab. Summary will update on new commits.}

[github-actions]

A comment that takes a paragraph to justify a workaround is a signal the code is wrong, not the comment — fix the code, don't explain it away (CLAUDE.md).

[github-actions]

A comment that takes a paragraph to justify a workaround is a signal the code is wrong, not the comment — fix the code, don't explain it away (CLAUDE.md).

[github-actions]

A comment that takes a paragraph to justify a workaround is a signal the code is wrong, not the comment — fix the code, don't explain it away (CLAUDE.md).

[cubic-dev-ai]

7 issues found across 38 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/native/src-tauri/src/webview_trust.rs">

<violation number="1" location="apps/native/src-tauri/src/webview_trust.rs:94">
P2: Preview host registration can race the iframe load on Linux. `preview_url_for` calls the observer and only then returns the URL, but `allow_preview_host` enqueues the actual `allow_tls_certificate_for_host` call onto the GTK main thread via `window.with_webview` (asynchronous from the non-main request thread) and returns immediately — so the URL escapes before the exception is actually registered. A subframe TLS failure never raises the recovery signal (it only fires for main-frame loads), so the first load of a fresh per-handle preview host can fail with no self-heal. The module doc's core guarantee ('registered before it loads') doesn't hold because registration is deferred async. Consider having `allow_preview_host` block until the GTK registration completes (e.g., a oneshot resolved inside the `with_webview` closure that the observer awaits) so the host is trusted before the URL is handed out.</violation>
</file>

<file name=".github/workflows/native.yml">

<violation number="1" location=".github/workflows/native.yml:305">
P2: Linux rust-checks can time out before the replacement test suite completes on a cache miss: this step is capped at 25 minutes even though the workflow documents cold runs taking 25–35 minutes. Raising the step limit above the expected cold duration (while retaining the 60-minute job limit) would avoid turning normal cache misses into false CI failures.</violation>
</file>

<file name="apps/native/src-tauri/src/setup.rs">

<violation number="1" location="apps/native/src-tauri/src/setup.rs:77">
P2: Linux `tauri dev` will wait for/load the configured HTTPS Vite origin while this setup path starts an HTTP localhost origin, so the development shell cannot boot reliably. The Linux fallback needs a matching dev-server/config URL (or a separate Linux-aware dev configuration) rather than changing only the Rust origin.</violation>
</file>

<file name="apps/native/crates/harness/src/run.rs">

<violation number="1" location="apps/native/crates/harness/src/run.rs:169">
P2: Claude runs also receive `SSL_CERT_FILE` even though this replacement-store override is intended for Codex; on Linux this can replace Claude's own trust configuration and break its API/MCP TLS when the generated bundle does not match the runtime's roots. Restrict this export to `HarnessId::Codex` and keep Claude on `NODE_EXTRA_CA_CERTS` only.</violation>
</file>

<file name="apps/native/crates/harness/src/watchdog.rs">

<violation number="1" location="apps/native/crates/harness/src/watchdog.rs:55">
P1: Watchdog cleanup can be permanently wedged, and the predictable `/tmp` name permits same-user symlink/file attacks: use `mktemp` for an exclusive 0600 file, fall back to `/tmp` when `TMPDIR` is unusable, and only park when both creation attempts fail.</violation>
</file>

<file name="apps/native/crates/local-api/src/setup/dev.rs">

<violation number="1" location="apps/native/crates/local-api/src/setup/dev.rs:808">
P2: A Linux dev server whose executable is replaced or unlinked can become unreapable across a quick local-api restart: the saved identity contains `/proc/<pid>/exe`, but the next observation falls back to `ps comm`, so exact matching refuses to signal the orphan and subsequent starts fail. Normalizing the kernel's ` (deleted)` suffix to the underlying executable path would preserve the identity without weakening the birth check.</violation>
</file>

<file name="apps/native/crates/local-api/src/sandbox/org_mount.rs">

<violation number="1" location="apps/native/crates/local-api/src/sandbox/org_mount.rs:852">
P2: Linux org mounts under an app root containing invalid UTF-8 will be treated as unattached because `/proc/self/mounts` is decoded lossily; parsing the mount table as bytes/`OsString` (preserving the kernel path bytes) would avoid killing or repeatedly replacing a working mount.</violation>
</file>

<sub>Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Watchdog cleanup can be permanently wedged, and the predictable /tmp name permits same-user symlink/file attacks: use mktemp for an exclusive 0600 file, fall back to /tmp when TMPDIR is unusable, and only park when both creation attempts fail.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/native/crates/harness/src/watchdog.rs, line 55:

<comment>Watchdog cleanup can be permanently wedged, and the predictable `/tmp` name permits same-user symlink/file attacks: use `mktemp` for an exclusive 0600 file, fall back to `/tmp` when `TMPDIR` is unusable, and only park when both creation attempts fail.</comment>

<file context>
@@ -24,55 +24,75 @@
+# BSD `pgrep` omits its ancestors, which hides the subshell and is why macOS
+# never showed it. A file keeps the enumeration free of any process this
+# script creates to read it.
+members_file="${TMPDIR:-/tmp}/decocms-anchor-$$"
+trap 'rm -f "$members_file"' EXIT
+
</file context>

Suggested change

	members_file="${TMPDIR:-/tmp}/decocms-anchor-$$"
	members_file="$(mktemp "${TMPDIR:-/tmp}/decocms-anchor.XXXXXX" 2>/dev/null || mktemp "/tmp/decocms-anchor.XXXXXX" 2>/dev/null)" || while :; do sleep 60; done

[cubic-dev-ai]

P2: Preview host registration can race the iframe load on Linux. preview_url_for calls the observer and only then returns the URL, but allow_preview_host enqueues the actual allow_tls_certificate_for_host call onto the GTK main thread via window.with_webview (asynchronous from the non-main request thread) and returns immediately — so the URL escapes before the exception is actually registered. A subframe TLS failure never raises the recovery signal (it only fires for main-frame loads), so the first load of a fresh per-handle preview host can fail with no self-heal. The module doc's core guarantee ('registered before it loads') doesn't hold because registration is deferred async. Consider having allow_preview_host block until the GTK registration completes (e.g., a oneshot resolved inside the with_webview closure that the observer awaits) so the host is trusted before the URL is handed out.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/native/src-tauri/src/webview_trust.rs, line 94:

<comment>Preview host registration can race the iframe load on Linux. `preview_url_for` calls the observer and only then returns the URL, but `allow_preview_host` enqueues the actual `allow_tls_certificate_for_host` call onto the GTK main thread via `window.with_webview` (asynchronous from the non-main request thread) and returns immediately — so the URL escapes before the exception is actually registered. A subframe TLS failure never raises the recovery signal (it only fires for main-frame loads), so the first load of a fresh per-handle preview host can fail with no self-heal. The module doc's core guarantee ('registered before it loads') doesn't hold because registration is deferred async. Consider having `allow_preview_host` block until the GTK registration completes (e.g., a oneshot resolved inside the `with_webview` closure that the observer awaits) so the host is trusted before the URL is handed out.</comment>

<file context>
@@ -0,0 +1,277 @@
+) -> tokio::sync::oneshot::Receiver<Result<(), String>> {
+    let _ = LEAF_CERT.set(leaf_cert.clone());
+    let (tx, rx) = tokio::sync::oneshot::channel();
+    let dispatch = window.with_webview(move |platform| {
+        let outcome =
+            register_control_origin(&platform.inner(), &leaf_cert, &control_host, &control_url);
</file context>

[cubic-dev-ai]

P2: Linux rust-checks can time out before the replacement test suite completes on a cache miss: this step is capped at 25 minutes even though the workflow documents cold runs taking 25–35 minutes. Raising the step limit above the expected cold duration (while retaining the 60-minute job limit) would avoid turning normal cache misses into false CI failures.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/native.yml, line 305:

<comment>Linux rust-checks can time out before the replacement test suite completes on a cache miss: this step is capped at 25 minutes even though the workflow documents cold runs taking 25–35 minutes. Raising the step limit above the expected cold duration (while retaining the 60-minute job limit) would avoid turning normal cache misses into false CI failures.</comment>

<file context>
@@ -196,13 +272,56 @@ jobs:
+      - name: cargo test (Linux)
+        if: runner.os == 'Linux' && matrix.task != 'lint'
+        working-directory: apps/native
+        timeout-minutes: 25
+        env:
+          CARGO_BUILD_JOBS: "2"
</file context>

Suggested change

	timeout-minutes: 25
	timeout-minutes: 45

[cubic-dev-ai]

P2: Linux tauri dev will wait for/load the configured HTTPS Vite origin while this setup path starts an HTTP localhost origin, so the development shell cannot boot reliably. The Linux fallback needs a matching dev-server/config URL (or a separate Linux-aware dev configuration) rather than changing only the Rust origin.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/native/src-tauri/src/setup.rs, line 77:

<comment>Linux `tauri dev` will wait for/load the configured HTTPS Vite origin while this setup path starts an HTTP localhost origin, so the development shell cannot boot reliably. The Linux fallback needs a matching dev-server/config URL (or a separate Linux-aware dev configuration) rather than changing only the Rust origin.</comment>

<file context>
@@ -35,6 +35,48 @@ pub enum SetupError {
+    let mut origin = control_origin::current(selftest);
+    #[cfg(target_os = "linux")]
+    {
+        origin.secure = linux_secure_origin_enabled();
+    }
+    origin
</file context>

[cubic-dev-ai]

P2: Claude runs also receive SSL_CERT_FILE even though this replacement-store override is intended for Codex; on Linux this can replace Claude's own trust configuration and break its API/MCP TLS when the generated bundle does not match the runtime's roots. Restrict this export to HarnessId::Codex and keep Claude on NODE_EXTRA_CA_CERTS only.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/native/crates/harness/src/run.rs, line 169:

<comment>Claude runs also receive `SSL_CERT_FILE` even though this replacement-store override is intended for Codex; on Linux this can replace Claude's own trust configuration and break its API/MCP TLS when the generated bundle does not match the runtime's roots. Restrict this export to `HarnessId::Codex` and keep Claude on `NODE_EXTRA_CA_CERTS` only.</comment>

<file context>
@@ -151,6 +166,12 @@ fn mcp_child_env(spec: &RunSpec) -> Vec<(String, String)> {
                 ca_cert.display().to_string(),
             ));
         }
+        if let Some(ca_bundle) = mcp.ca_bundle.as_ref() {
+            env.push((
+                SSL_CERT_FILE_ENV.to_string(),
</file context>

[cubic-dev-ai]

P2: A Linux dev server whose executable is replaced or unlinked can become unreapable across a quick local-api restart: the saved identity contains /proc/<pid>/exe, but the next observation falls back to ps comm, so exact matching refuses to signal the orphan and subsequent starts fail. Normalizing the kernel's (deleted) suffix to the underlying executable path would preserve the identity without weakening the birth check.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/native/crates/local-api/src/setup/dev.rs, line 808:

<comment>A Linux dev server whose executable is replaced or unlinked can become unreapable across a quick local-api restart: the saved identity contains `/proc/<pid>/exe`, but the next observation falls back to `ps comm`, so exact matching refuses to signal the orphan and subsequent starts fail. Normalizing the kernel's ` (deleted)` suffix to the underlying executable path would preserve the identity without weakening the birth check.</comment>

<file context>
@@ -782,10 +782,38 @@ async fn observe_process_identity(
+        if let Ok(target) = std::fs::read_link(format!("/proc/{pid}/exe")) {
+            if let Some(path) = target
+                .to_str()
+                .filter(|path| !path.is_empty() && !path.ends_with(" (deleted)"))
+            {
+                return path.to_string();
</file context>

[cubic-dev-ai]

P2: Linux org mounts under an app root containing invalid UTF-8 will be treated as unattached because /proc/self/mounts is decoded lossily; parsing the mount table as bytes/OsString (preserving the kernel path bytes) would avoid killing or repeatedly replacing a working mount.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/native/crates/local-api/src/sandbox/org_mount.rs, line 852:

<comment>Linux org mounts under an app root containing invalid UTF-8 will be treated as unattached because `/proc/self/mounts` is decoded lossily; parsing the mount table as bytes/`OsString` (preserving the kernel path bytes) would avoid killing or repeatedly replacing a working mount.</comment>

<file context>
@@ -459,80 +825,218 @@ async fn spawn_mount(
+async fn mounted_table() -> Option<String> {
+    if LINUX_MOUNT_STACK {
+        let table = tokio::fs::read(PROC_MOUNTS).await.ok()?;
+        return Some(String::from_utf8_lossy(&table).into_owned());
+    }
+    let output = Command::new("mount")
</file context>

[cubic-dev-ai]

11 issues found and verified against the latest diff

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/native/crates/local-api/src/routes/git.rs">

<violation number="1" location="apps/native/crates/local-api/src/routes/git.rs:2266">
P2: This assertion can pass while the watchdog anchor remains alive because `pid` is the fake git command PID, not the anchored process group's PGID; capture the actual PGID before teardown and pass that value to `process_group_exists` so the test verifies full group cleanup.</violation>
</file>

<file name="apps/native/crates/local-api/src/process_group.rs">

<violation number="1" location="apps/native/crates/local-api/src/process_group.rs:715">
P2: On Unix systems without a usable `ps`, this fallback kills only the shell PID and leaves the fixture's `sleep 30` descendant running, accumulating orphaned test processes across runs. Making the fixture `exec sleep 30` or explicitly cleaning up descendants before allowing the unanchored wait to finish would keep the fallback safe.</violation>
</file>

<file name="apps/native/crates/local-api/src/sandbox/org_mount.rs">

<violation number="1" location="apps/native/crates/local-api/src/sandbox/org_mount.rs:852">
P2: Linux mount tracking loses non-UTF-8 mountpoint bytes before comparing paths. Parsing `/proc/self/mounts` as bytes/`OsString` would preserve the path and prevent valid mounts from being treated as unattached.</violation>
</file>

<file name="apps/native/scripts/boot-smoke.ts">

<violation number="1" location="apps/native/scripts/boot-smoke.ts:223">
P2: The Linux smoke can report success against a stale bundled `rclone` after the sidecar version or fetch script changes, because freshness is based only on the AppImage mtime and skips the rebuild that runs `fetch-rclone.sh`. Include the fetch script and bundled sidecar/marker in the freshness inputs, or otherwise invalidate the AppImage when that dependency changes.</violation>
</file>

<file name=".github/workflows/native.yml">

<violation number="1" location=".github/workflows/native.yml:801">
P1: A failure in the `changes` job can be converted into a green required check: because this aggregator accepts `skipped` without checking `needs.changes.result`, a skipped `rust-checks-os` (and likewise `contract-suite-os`/`tauri-build-os`) passes even though no validation ran. The aggregators should require `needs.changes.result == 'success'` before treating an intentionally skipped matrix as pass.</violation>
</file>

<file name="apps/native/crates/local-api/src/setup/dev.rs">

<violation number="1" location="apps/native/crates/local-api/src/setup/dev.rs:808">
P2: Orphan cleanup becomes permanently unverifiable when a Linux dev executable is replaced or unlinked after the record is written: the record has the original `/proc/<pid>/exe` path, while the next observation uses `ps comm` because of the ` (deleted)` suffix. Normalizing the suffix to a stable executable identity, or persisting a comparable fallback from the initial observation, would preserve cleanup without weakening the fail-closed check.</violation>

<violation number="2" location="apps/native/crates/local-api/src/setup/dev.rs:1012">
P2: Linux local and CI runs skip the real process-group tests entirely, despite the comments saying the exclusion is only for the GitHub runner. A runner-specific setup/condition would preserve these tests on other Linux environments and keep the new `/proc` behavior covered.</violation>
</file>

<file name="apps/native/src-tauri/src/setup.rs">

<violation number="1" location="apps/native/src-tauri/src/setup.rs:77">
P2: The documented Linux secure-mode self-test fails because its new HTTPS origin is not included in the Tauri capability allowlist, so the bundle's `local_api_info`/`selftest_report` invokes are denied; add `https://local.studio.decocms.com:43122/*` (and any required secure preview origin) to the self-test capabilities.</violation>
</file>

<file name="apps/native/crates/harness/src/run.rs">

<violation number="1" location="apps/native/crates/harness/src/run.rs:169">
P2: Claude receives the Codex-only replacement trust store because this branch does not check `spec.harness`; routing `SSL_CERT_FILE` only to Codex preserves Claude's additive `NODE_EXTRA_CA_CERTS` behavior and avoids replacing its bundled public roots.</violation>
</file>

<file name="apps/native/src-tauri/selftest/bundle.js">

<violation number="1" location="apps/native/src-tauri/selftest/bundle.js:584">
P3: The new non-gating treatment of remoteImageLoads is only applied in one half of the smoke. bundle.js no longer counts it toward allPass, but boot-smoke.ts's `gatingKeys` list still includes "remoteImageLoads", so the summary table will keep tagging it `[FAIL]` whenever it fails even though the overall smoke still passes. That leaves an operator-facing inconsistency with the intent documented in this comment ("Its result is still reported, so a real regression is visible" — reported as informational, not as a gating failure). Consider removing "remoteImageLoads" from the `gatingKeys` set in scripts/boot-smoke.ts so the informational check renders as INFO, matching the non-gating behavior introduced here.</violation>
</file>

<file name="apps/native/src-tauri/src/webview_trust.rs">

<violation number="1" location="apps/native/src-tauri/src/webview_trust.rs:112">
P2: A preview host is recorded in the `granted` allow-list *before* its registration is confirmed to have succeeded. `allow_preview_host` then bails on the dedup for that host on every later call, and the only failure handling is a `tracing::warn!` inside the `with_webview` dispatch. A registration that fails for any reason (webview unreachable at that instant, leaf read error, `allow_tls_certificate_for_host` error) is never retried for the rest of the process. Because a sandbox preview is an iframe, it has no `load-failed-with-tls-errors` recovery signal, so that single failure permanently breaks TLS previews for that sandbox until the app restarts. Consider tracking hosts in `granted` only after a successful `allow_host` (or keeping a separate retry path), so a transient failure can recover on the next preview URL instead of being silently wedged for the whole run.</violation>
</file>

<sub>Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: A failure in the changes job can be converted into a green required check: because this aggregator accepts skipped without checking needs.changes.result, a skipped rust-checks-os (and likewise contract-suite-os/tauri-build-os) passes even though no validation ran. The aggregators should require needs.changes.result == 'success' before treating an intentionally skipped matrix as pass.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/native.yml, line 801:

<comment>A failure in the `changes` job can be converted into a green required check: because this aggregator accepts `skipped` without checking `needs.changes.result`, a skipped `rust-checks-os` (and likewise `contract-suite-os`/`tauri-build-os`) passes even though no validation ran. The aggregators should require `needs.changes.result == 'success'` before treating an intentionally skipped matrix as pass.</comment>

<file context>
@@ -561,3 +785,54 @@ jobs:
+    steps:
+      - name: Verify rust-checks legs
+        run: |
+          case "${{ needs.rust-checks-os.result }}" in
+            success|skipped) echo "rust-checks: ${{ needs.rust-checks-os.result }}"; exit 0 ;;
+            *) echo "rust-checks: ${{ needs.rust-checks-os.result }}"; exit 1 ;;
</file context>

[cubic-dev-ai]

P2: This assertion can pass while the watchdog anchor remains alive because pid is the fake git command PID, not the anchored process group's PGID; capture the actual PGID before teardown and pass that value to process_group_exists so the test verifies full group cleanup.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/native/crates/local-api/src/routes/git.rs, line 2266:

<comment>This assertion can pass while the watchdog anchor remains alive because `pid` is the fake git command PID, not the anchored process group's PGID; capture the actual PGID before teardown and pass that value to `process_group_exists` so the test verifies full group cleanup.</comment>

<file context>
@@ -2236,10 +2249,21 @@ mod tests {
-        tokio::time::timeout(Duration::from_secs(1), async {
-            while process_exists(format!("-{pid}")) {
+        tokio::time::timeout(Duration::from_secs(15), async {
+            while process_group_exists(pid) {
                 tokio::task::yield_now().await;
             }
</file context>

[cubic-dev-ai]

P2: On Unix systems without a usable ps, this fallback kills only the shell PID and leaves the fixture's sleep 30 descendant running, accumulating orphaned test processes across runs. Making the fixture exec sleep 30 or explicitly cleaning up descendants before allowing the unanchored wait to finish would keep the fallback safe.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/native/crates/local-api/src/process_group.rs, line 715:

<comment>On Unix systems without a usable `ps`, this fallback kills only the shell PID and leaves the fixture's `sleep 30` descendant running, accumulating orphaned test processes across runs. Making the fixture `exec sleep 30` or explicitly cleaning up descendants before allowing the unanchored wait to finish would keep the fallback safe.</comment>

<file context>
@@ -697,8 +697,25 @@ mod tests {
+        let target = if leads_own_group {
+            format!("-{pid}")
+        } else {
+            pid.to_string()
+        };
         let _ = std::process::Command::new("kill")
</file context>

[cubic-dev-ai]

P2: Linux mount tracking loses non-UTF-8 mountpoint bytes before comparing paths. Parsing /proc/self/mounts as bytes/OsString would preserve the path and prevent valid mounts from being treated as unattached.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/native/crates/local-api/src/sandbox/org_mount.rs, line 852:

<comment>Linux mount tracking loses non-UTF-8 mountpoint bytes before comparing paths. Parsing `/proc/self/mounts` as bytes/`OsString` would preserve the path and prevent valid mounts from being treated as unattached.</comment>

<file context>
@@ -459,80 +825,218 @@ async fn spawn_mount(
+async fn mounted_table() -> Option<String> {
+    if LINUX_MOUNT_STACK {
+        let table = tokio::fs::read(PROC_MOUNTS).await.ok()?;
+        return Some(String::from_utf8_lossy(&table).into_owned());
+    }
+    let output = Command::new("mount")
</file context>

[cubic-dev-ai]

P2: The Linux smoke can report success against a stale bundled rclone after the sidecar version or fetch script changes, because freshness is based only on the AppImage mtime and skips the rebuild that runs fetch-rclone.sh. Include the fetch script and bundled sidecar/marker in the freshness inputs, or otherwise invalidate the AppImage when that dependency changes.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/native/scripts/boot-smoke.ts, line 223:

<comment>The Linux smoke can report success against a stale bundled `rclone` after the sidecar version or fetch script changes, because freshness is based only on the AppImage mtime and skips the rebuild that runs `fetch-rclone.sh`. Include the fetch script and bundled sidecar/marker in the freshness inputs, or otherwise invalidate the AppImage when that dependency changes.</comment>

<file context>
@@ -147,7 +220,7 @@ async function ensureBuilt(forceRebuild: boolean): Promise<void> {
     // prevent. When source IS newer, the rebuild's own beforeBuildCommand
     // (`build:native`) regenerates dist/native before bundling.
-    const bundleBin = statSync(binaryPath()).mtimeMs;
+    const bundleBin = bundleStampMs(existing);
     const webDir = join(DESKTOP_DIR, "..", "web");
     const inputs = [
</file context>

[cubic-dev-ai]

P2: Orphan cleanup becomes permanently unverifiable when a Linux dev executable is replaced or unlinked after the record is written: the record has the original /proc/<pid>/exe path, while the next observation uses ps comm because of the (deleted) suffix. Normalizing the suffix to a stable executable identity, or persisting a comparable fallback from the initial observation, would preserve cleanup without weakening the fail-closed check.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/native/crates/local-api/src/setup/dev.rs, line 808:

<comment>Orphan cleanup becomes permanently unverifiable when a Linux dev executable is replaced or unlinked after the record is written: the record has the original `/proc/<pid>/exe` path, while the next observation uses `ps comm` because of the ` (deleted)` suffix. Normalizing the suffix to a stable executable identity, or persisting a comparable fallback from the initial observation, would preserve cleanup without weakening the fail-closed check.</comment>

<file context>
@@ -782,10 +782,38 @@ async fn observe_process_identity(
+        if let Ok(target) = std::fs::read_link(format!("/proc/{pid}/exe")) {
+            if let Some(path) = target
+                .to_str()
+                .filter(|path| !path.is_empty() && !path.ends_with(" (deleted)"))
+            {
+                return path.to_string();
</file context>

[cubic-dev-ai]

P2: The documented Linux secure-mode self-test fails because its new HTTPS origin is not included in the Tauri capability allowlist, so the bundle's local_api_info/selftest_report invokes are denied; add https://local.studio.decocms.com:43122/* (and any required secure preview origin) to the self-test capabilities.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/native/src-tauri/src/setup.rs, line 77:

<comment>The documented Linux secure-mode self-test fails because its new HTTPS origin is not included in the Tauri capability allowlist, so the bundle's `local_api_info`/`selftest_report` invokes are denied; add `https://local.studio.decocms.com:43122/*` (and any required secure preview origin) to the self-test capabilities.</comment>

<file context>
@@ -35,6 +35,48 @@ pub enum SetupError {
+    let mut origin = control_origin::current(selftest);
+    #[cfg(target_os = "linux")]
+    {
+        origin.secure = linux_secure_origin_enabled();
+    }
+    origin
</file context>

[cubic-dev-ai]

P2: Claude receives the Codex-only replacement trust store because this branch does not check spec.harness; routing SSL_CERT_FILE only to Codex preserves Claude's additive NODE_EXTRA_CA_CERTS behavior and avoids replacing its bundled public roots.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/native/crates/harness/src/run.rs, line 169:

<comment>Claude receives the Codex-only replacement trust store because this branch does not check `spec.harness`; routing `SSL_CERT_FILE` only to Codex preserves Claude's additive `NODE_EXTRA_CA_CERTS` behavior and avoids replacing its bundled public roots.</comment>

<file context>
@@ -151,6 +166,12 @@ fn mcp_child_env(spec: &RunSpec) -> Vec<(String, String)> {
                 ca_cert.display().to_string(),
             ));
         }
+        if let Some(ca_bundle) = mcp.ca_bundle.as_ref() {
+            env.push((
+                SSL_CERT_FILE_ENV.to_string(),
</file context>

[cubic-dev-ai]

P2: A preview host is recorded in the granted allow-list before its registration is confirmed to have succeeded. allow_preview_host then bails on the dedup for that host on every later call, and the only failure handling is a tracing::warn! inside the with_webview dispatch. A registration that fails for any reason (webview unreachable at that instant, leaf read error, allow_tls_certificate_for_host error) is never retried for the rest of the process. Because a sandbox preview is an iframe, it has no load-failed-with-tls-errors recovery signal, so that single failure permanently breaks TLS previews for that sandbox until the app restarts. Consider tracking hosts in granted only after a successful allow_host (or keeping a separate retry path), so a transient failure can recover on the next preview URL instead of being silently wedged for the whole run.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/native/src-tauri/src/webview_trust.rs, line 112:

<comment>A preview host is recorded in the `granted` allow-list *before* its registration is confirmed to have succeeded. `allow_preview_host` then bails on the dedup for that host on every later call, and the only failure handling is a `tracing::warn!` inside the `with_webview` dispatch. A registration that fails for any reason (webview unreachable at that instant, leaf read error, `allow_tls_certificate_for_host` error) is never retried for the rest of the process. Because a sandbox preview is an iframe, it has no `load-failed-with-tls-errors` recovery signal, so that single failure permanently breaks TLS previews for that sandbox until the app restarts. Consider tracking hosts in `granted` only after a successful `allow_host` (or keeping a separate retry path), so a transient failure can recover on the next preview URL instead of being silently wedged for the whole run.</comment>

<file context>
@@ -0,0 +1,277 @@
+pub fn allow_preview_host(app: &tauri::AppHandle, host: &str) {
+    {
+        let mut state = state();
+        if !state.granted.insert(host.to_string()) {
+            return;
+        }
</file context>

[cubic-dev-ai]

P3: The new non-gating treatment of remoteImageLoads is only applied in one half of the smoke. bundle.js no longer counts it toward allPass, but boot-smoke.ts's gatingKeys list still includes "remoteImageLoads", so the summary table will keep tagging it [FAIL] whenever it fails even though the overall smoke still passes. That leaves an operator-facing inconsistency with the intent documented in this comment ("Its result is still reported, so a real regression is visible" — reported as informational, not as a gating failure). Consider removing "remoteImageLoads" from the gatingKeys set in scripts/boot-smoke.ts so the informational check renders as INFO, matching the non-gating behavior introduced here.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/native/src-tauri/selftest/bundle.js, line 584:

<comment>The new non-gating treatment of remoteImageLoads is only applied in one half of the smoke. bundle.js no longer counts it toward allPass, but boot-smoke.ts's `gatingKeys` list still includes "remoteImageLoads", so the summary table will keep tagging it `[FAIL]` whenever it fails even though the overall smoke still passes. That leaves an operator-facing inconsistency with the intent documented in this comment ("Its result is still reported, so a real regression is visible" — reported as informational, not as a gating failure). Consider removing "remoteImageLoads" from the `gatingKeys` set in scripts/boot-smoke.ts so the informational check renders as INFO, matching the non-gating behavior introduced here.</comment>

<file context>
@@ -581,7 +581,13 @@
     results.authStatusInvoke,
     results.domMountedEarly,
-    results.remoteImageLoads,
+    // remoteImageLoads is deliberately NOT gating: it fetches a real asset
+    // over the public internet, so a runner with no egress fails it for
+    // reasons that say nothing about this app. The property it exists to
</file context>