Skip to content

Harden updater rebuild environment #941

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
tjdonley wants to merge 4 commits into from
Closed

Harden updater rebuild environment #941

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
870accc
Harden updater rebuild environment
tjdonley Jul 13, 2026
f8215dd
Align wrapper dependency preflight
tjdonley Jul 13, 2026
0548aad
Complete wrapper dependency preflight
tjdonley Jul 13, 2026
6f1988d
Preflight native package builders
tjdonley Jul 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions docs/updater.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,6 +153,17 @@ is refused and the working app remains unchanged until Electron exits. Failed
promotion candidates are disposable by default; opt in to diagnostic retention
with `CODEX_KEEP_REJECTED_CANDIDATE=1`.

Automated rebuild commands run with a clean environment, a private temporary
home/config/cache tree, and an executable search path limited to root-owned,
non-writable system directories and a trusted packaged Node.js runtime. User
`PATH`, nvm, Cargo home, and Linux feature source overrides are not inherited.
The updater copies only the saved enabled feature IDs and their data-only
settings into a private build input after verifying that every ID resolves to
the matching manifest in the bundled feature catalog. Automatic rebuilds
therefore fail closed when their required build tools are available only from
user-managed toolchain directories; install those tools system-wide or use the
documented manual update flow instead.

Transactional user-local installs retain one previous-app directory for manual
recovery. Each successful promotion replaces that retained backup with the
version that was working immediately beforehand; older exact managed backup
Expand Down
Loading
Loading