fix(permissions): ignore stale permission updates#621
Conversation
Treat permission.updated as an update to an existing pending request instead of a new legacy request. This preserves the V2 reply route and prevents delayed orphan updates from recreating an already-cleared permission modal. Add browser-store regression coverage proving V2 requests still use the V2 reply API and orphan updates stay out of the queue, and run it in PR validation.
pascalandr
left a comment
pascalandr
left a comment
There was a problem hiding this comment.
Gatekeeper review - round 1
Finding (P1): the new orphan permission.updated guard drops valid initial legacy permission requests. Supported older OpenCode binaries can emit permission.updated as the sole initial request event, so their sessions would remain blocked with no permission visible in CodeNomad.
Deterministic result: a standalone legacy permission.updated leaves both UI permission queues empty.
Required fix: accept standalone permission.updated as legacy, preserve the existing source when it updates an already-pending V2 request, and rely on replied-request tombstones to reject delayed post-reply updates.
Status: changes requested; another published gatekeeper round will follow.
Accept standalone permission.updated events as legacy requests for older supported OpenCode binaries while preserving the source of already-pending V2 requests. Extend regression coverage to prove standalone legacy requests remain actionable and delayed updates stay suppressed after a successful local reply.
pascalandr
left a comment
pascalandr
left a comment
There was a problem hiding this comment.
Gatekeeper review - round 2
Zero actionable findings.
Verified:
- standalone permission.updated remains a valid legacy request
- permission.asked remains legacy
- permission.v2.asked followed by permission.updated preserves the V2 reply route
- delayed permission.updated after a successful reply does not re-enter either permission queue
- malformed permission IDs are ignored
Relevant UI tests, browser integration tests, typecheck, and UI build pass. Residual limitation: no direct reproduction on the reporter's Windows device.
|
@shantur LGTM |
|
PR builds are available as GitHub Actions artifacts: https://github.com/NeuralNomadsAI/CodeNomad/actions/runs/29919742236 Artifacts expire in 7 days.
|
1 similar comment
|
PR builds are available as GitHub Actions artifacts: https://github.com/NeuralNomadsAI/CodeNomad/actions/runs/29919742236 Artifacts expire in 7 days.
|
2 participants
Summary
Reproduced failure
The regression test fails on dev before the fix: permission.v2.asked followed by permission.updated changes the request source to legacy, so approval calls the legacy endpoint and never reaches the V2 reply API.
Compatibility coverage
Scope
This PR intentionally does not add speculative timeout, reconnect, or modal-rendering changes. It only fixes the reproduced source-routing bug and preserves verified legacy behavior.
Validation
Closes #566