Out-of-process modules granted the hyprland permission get bread.hyprland == nil #41
Breadway
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
How it was found
Found 2026-10-13 while gathering compositor evidence for BREAD-28 (PR28, head
346f6f3) in an isolated BOS test VM (BOS 2026.10.13 ISO, Hyprland 0.56.2 with hyprland.lua). Evidence: /tmp/opencode/vm-hypr/evidence-BREAD-28.md on hermes (section "Separate finding").Bug
A manifest-declared module that requests the
hyprlandpermission runs out of process in bread-module-host. It loads and authenticates with the permission listed as granted (authenticated ... permissions=[... Hyprland ...]), butbread.hyprlandis nil in the module, so the first call fails withattempt to index a nil value (field 'hyprland').The out-of-process bridge (breadd/src/ipc/module_host_bridge.rs) exposes no
module_host.hyprland*method, so the hyprland API is only available to in-process modules. A granted permission therefore grants nothing.Reproduced with both the ISO's bread-module-host and the one built from fix/hyprland-lua-dispatch, so this is not a PR28 regression.
Expected
Either bridge bread.hyprland (dispatch, keyword, eval and the checked variants) through the module host with the same permission gate, or refuse the permission at manifest load with a clear error, so a module author is not told a permission was granted when it was not.
Confidence
High: observed directly in the VM with both host builds. The exact bridge file and method list were not independently re-read by the coordinator.
PR opened: #44
Head:
44a5a0b7407a4c4b8052a75134e3a478dcc64503. Focused subprocess tests (3/3), clippy, and check-docs pass. Workspace tests have one unrelated failure in the protectedbreadd/tests/ipc_integration.rs:rules_toml_malformed_rule_surfaces_doctor_visible_errorat line 1484 (bread.rules present); 42 other tests in that binary passed. The suite output also indicates currentorigin/maincontains two commits not in this branch; PR #44 was opened and left unmerged as requested.Independent exact-head review: changes requested at
44a5a0b740. Full criterion mapping, evidence and R1-R3 checklist persisted at #44 (comment). Exact-head run149 check job2509 and all steps green; local subprocess3/3, Hyprland unit45/45 and check-docs pass. R1 high: actual private daemon/host probe returns timeout then sends eval fallback at11.1s; uncancelled blocking socket work lacks IO deadlines and size bounds, tracked BREAD-47. R2 authenticated denied-host wire spoof/replay/two-host isolation evidence missing; existing fixture tests only nil plus unauthenticated denial. R3 four new IPC methods absent from api-schema.toml; check-docs does not read the bridge. Repair all three on existing PR44, fresh exact-head checks/review. No merge, no done. Known unrelated IPC race disregarded because exact-head CI is green. Returning BREAD-42 to todo under change-request workflow.Exact-head re-review5ed063907adae3e44e0799a18586efb3298a9624: changes requested. Full criterion mapping and C1/C2 persisted #44 (comment). R2 authenticated denial/identity/isolation PASS; R3 schema/check-docs PASS. Original R1 late-after-timeout/resource/type fixes independently pass (deadline5,wire4,Lua3,Hyprland54,xtask17; full locked workspace/clippy/fmt/docs all pass). Remaining C1 high: real authenticated host SIGKILL during stalled dispatch at0.083s still followed by daemon eval fallback at2.083s, because handler awaits operation before observing EOF and dropping session. Retained BREAD-47, high-confidence real private-socket probe. C2 shutdown regression never starts second call because fake host script is one-shot; fix regression to observe real inflight work before SIGTERM. Separate reviewer probe verifies actual inflight shutdown exits0 in0.007s. CI run151 exact head still FAILURE: build-lock timeout before cargo clippy; build/test skipped. Different-head run152 not used. No pass/merge. BREAD-42 stays todo for repair on existing PR44; fresh head review and exact-head green CI required.
Coordinator verification on integrated
d5748d6093(PR44 merge). Clean detached merge-tree worktree, breadd module_host_hyprland suites: wire 3/3, module_host 4/4, deadlines 6/6 pass. Independent exact-head pass atb05a6f6(comment 5360: R1 timeouts/bounds, C1 real host disconnect, C2 in-flight shutdown, R2 adversarial isolation, R3 schema/docs) retained; merge parents40ee494andb05a6f6. Granted hyprland modules now reach bread.hyprland through the module-host bridge. No live compositor touched, fake-socket fixtures only.