fix(cli): name the rule that refused CLI coordination, not just the stage - #1627
Merged
Conversation
…tage 'secure CLI coordination could not be created (endpoint)' is what four separate reporters were left with in #1533 and #1574. On those machines every mode fails, config list included, so the product cannot be reconfigured out of the failure, and CBM_LOG_LEVEL=debug adds nothing. One reporter had to build an instrumented binary to discover the cause was a single ACE on an ancestor of %LOCALAPPDATA%. cbm_daemon_ipc_validation_detail() already holds exactly what they needed - the refusing directory, the offending SID and the right it granted - and the daemon-endpoint path has printed it since #1582. This path never did, so the same refusal was actionable through one entry point and opaque through the other. Quoting one of them: printing the refusing ancestor and the offending SID in the default error would turn a multi-hour investigation into a one-line fix. Fixes nothing by itself; it is the difference between a report we can act on and a report that costs a reporter an evening. Builds clean. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On the machines in #1533 and #1574,
codebase-memory-mcp: secure CLI coordination could not be created (endpoint)is the entire diagnostic. Every mode fails —config listincluded, so the product cannot be reconfigured out of it — andCBM_LOG_LEVEL=debugadds nothing. One reporter built an instrumented binary to discover that a single ACE on an ancestor of%LOCALAPPDATA%was the cause.cbm_daemon_ipc_validation_detail()already holds precisely what they needed: the refusing directory, the offending SID, and the right it granted. The daemon-endpoint path a few hundred lines below has printed it since #1582 — this path never did. So the same refusal was actionable through one entry point and opaque through the other.As one reporter put it: "printing the refusing ancestor and the offending SID in the default error would turn a multi-hour investigation into a one-line fix."
This closes nothing on its own. It is the difference between a report we can act on and a report that costs someone an evening — and it would have short-circuited most of the filings in that cluster.
Builds clean.