erik/acdream
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix(launcher): Campaign LA gate-round-1 review findings F1-F6 + hardening

Browse source 
F1: the crash reporter comment claimed the launcher never holds a password
in any field - false (ProfileEditorDialogViewModel, AccountProfile.Password,
StartRequest.Password). Reworded to the true, narrower invariant (no throw
site interpolates a credential VALUE into an exception message) and pinned
it with CrashReportNeverContainsAStoredPassword: a real STJ failure over a
profiles document containing a known password, corrupted after the
credential, must yield a crash file with the stack and without the value.

F2: the co-deploy Inputs covered only Bake own sources; a Content edit
never refreshed the 83 MB exe. Now the full reference closure. Fixing it
surfaced two more incrementality traps, both fixed and comment-documented:
SkipUnchangedFiles left the output older than the triggering input (target
re-ran forever - added an explicit Touch), and %(Item.Metadata) in a plain
Include does not batch (the literal percent-text became a permanently
out-of-date phantom input - globs are now spelled per project). Verified:
Core edit retriggers, then two consecutive clean incremental builds.

F3: RID publishes ran BOTH co-deploy paths (two self-contained bake
publishes). Build-time target now guarded on _IsPublishing; verified a
real win-x64 publish runs zero build-target co-deploys and still ships
both exes.

F4: comment misattributed PublishBakeTool=false to CI lanes; it is
target-local recursion guarding. F5: the x:Name reflection sweep now walks
the markup as XML and tolerates template-scoped names (no generated field
exists for those). F6: dead using removed. Hardening: the crash reporter
positional --data-dir fallback requires a fully-qualified path so a
relative or flag-shaped value cannot create ./crash-reports at an
arbitrary CWD.

Launcher 67/67, Launcher.Core 317/317.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Erik 2026-08-15 08:19:23 +02:00
parent 1f87acf1af
commit 981e168fb9
6 changed files with 178 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/ISSUES.md
View file

@ -112,12 +112,16 @@ isolated root with the full stack; the real root stays empty.
**Redaction, stated exactly (deliberate narrowing of the filed
acceptance):** the report never serializes the command line, environment,
or process state, but exception TEXT may quote an option name or path.
That is safe by construction — credentials never enter launcher state
(child-stdin only; `LauncherProcessSpec` has no credential member, guarded
by its reflection test) — so no scanning pass over this sink exists today.
The code comment carries the standing condition: if a credential ever
becomes reachable from launcher state, this sink needs the status-stream's
credential scanning.
The gate-round-1 review (F1) corrected the original by-construction claim:
the launcher DOES hold credentials (`ProfileEditorDialogViewModel`,
`AccountProfile.Password`, `StartRequest.Password`); the true invariant is
narrower — no code path interpolates a credential VALUE into an exception
message. That invariant is now PINNED by
`MainWindowViewTests.CrashReportNeverContainsAStoredPassword`: a real
STJ parse failure over a profiles document containing a known password,
corrupted after the credential so the parser consumed the value, must
produce a crash file with the stack and without the password. If that test
ever fails, this sink needs the status-stream's credential scanning.
## #397 — Windows: LauncherProcessSupervisor.Stop has no reliable graceful-stop signal for a no-window console host