Skip to content

Pit toggle: ride out the stale-helper window after launch instead of failing - #103

Merged
ralyodio merged 1 commit into
mainfrom
fix/pit-stale-helper
Sep 16, 2026
Merged

ralyodio merged 1 commit into
mainfrom
fix/pit-stale-helper

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

What

First click on 🤘 Pit on bonita right after tron upgrade failed with the generic "The pit resolver couldn't start", and ~/.tronbrowser/tor-helper.log showed the 3.3.0 helper listening with no pit: line at all. The request never reached the new helper.

Why

The launcher replaces an out-of-date helper in the background a moment after launch (kill, settle 1s, exec). A click inside that window reaches the OLD 3.2.8 helper, which has no /pit/* routes and answers 404 {"error":"not-found"} without logging it. The sidebar mapped that to the generic message, so nothing pointed at the real cause.

Fix

  • background.js: /pit/start is retried every 2 s, up to 5 attempts, while the answer is a 404 or nobody is listening; if it never catches up the error is helper-stale. A pit-capable helper's own error (port busy) still returns at once.
  • sidepanel.js: names the stale-helper case (try again, or quit TronBrowser completely and relaunch) and shows the error code on the generic fallback instead of hiding it.
  • tron-tor-helper: logs unknown routes, so a stale-version hit leaves a trace next time. Version 3.3.1, matched in the launcher.
  • Doc updated.

Verified

pnpm lint clean, extension tests 30/30, helper compiles, launcher sh -n ok. Not reproduced on bonita (no SSH from here); the diagnosis is from the log's absence of a pit: line and the launcher's replacement sequence.

🤖 Generated with Claude Code

…failing

First click on bonita after tron upgrade: 'The pit resolver couldn't start', and the helper log showed the 3.3.0 helper listening with no pit: line at all. The request had reached the OLD 3.2.8 helper, which the launcher replaces in the background a moment after launch; it answered 404 {error:not-found} and the sidebar showed the generic message.

The background now retries /pit/start every 2s for up to 5 attempts while the answer is a 404 or nobody is listening, then reports helper-stale; the sidebar names that case (try again, or quit and relaunch) and shows the error code on the generic fallback. The helper logs unknown routes so a stale-version hit leaves a trace next time. Helper version 3.3.1.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

53 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 32 | LOW: 20

Severity Rule Location
HIGH py-ssrf-outbound-request apps/desktop/launcher/tron-tor-helper:298
MEDIUM js-open-redirect apps/desktop/extensions/ai-sidebar/install-helper.js:156
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:34
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:57
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:237
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:266
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:336
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/options.js:305
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:78
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:166
MEDIUM sh-remote-script-execution apps/desktop/launcher/tronbrowser:122
MEDIUM sh-remote-script-execution apps/desktop/launcher/tronbrowser:433
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:77
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:227
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:569
MEDIUM js-unescaped-html-sink apps/web/public/app.js:29
MEDIUM js-unescaped-html-sink apps/web/public/dns.js:54
MEDIUM sh-remote-script-execution apps/web/public/install.sh:161
MEDIUM sh-remote-script-execution apps/web/public/install.sh:166
MEDIUM sh-remote-script-execution apps/web/public/install.sh:279
MEDIUM sh-remote-script-execution apps/web/public/install.sh:297
MEDIUM sh-remote-script-execution apps/web/public/install.sh:704
MEDIUM sh-remote-script-execution apps/web/public/install.sh:985
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:96
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:168
MEDIUM js-dynamic-code-execution packages/sdk/src/mcp/tools.ts:80
MEDIUM js-dynamic-code-execution packages/sdk/src/mcp/tools.ts:92
MEDIUM js-dynamic-code-execution packages/sdk/src/mcp/tools.ts:103
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:65
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:70
MEDIUM sql-template-interpolation services/api/src/store/db.ts:116
MEDIUM js-dynamic-code-execution services/api/src/store/scanner.ts:44
MEDIUM sh-predictable-temp-path start.sh:25
LOW js-dynamic-code-execution apps/desktop/extensions/ai-sidebar/pit-proxy.test.js:8
LOW js-dynamic-code-execution packages/agent-runtime/src/analyze/form-script.test.ts:6
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:26
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:49
LOW js-dynamic-code-execution packages/browser-core/src/automation/extract-script.test.ts:6
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:35
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:47
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:70
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:89
LOW js-dynamic-code-execution packages/browser-core/src/automation/snapshot-script.test.ts:11
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:24
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:63
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:47
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:170
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:216
LOW js-dynamic-code-execution packages/sdk/src/mcp/automate.test.ts:258
LOW secret-generic-api-key packages/storage/src/config.ts:51

…and 3 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit f267db9 into main Sep 16, 2026
8 checks passed
@ralyodio
ralyodio deleted the fix/pit-stale-helper branch September 17, 2026 09:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant