fix: wait for gpg-agent forward readiness before opening browser IDEs by skevetter · Pull Request #893 · devsy-org/devsy

skevetter · 2026-08-06T15:00:33Z

Summary

GPG-agent forwarding for browser IDEs (vscode-web, openvscode, code-server, jupyter, marimo, rstudio) was set up by a fire-and-forget background process (pkg/gpg.ForwardAgent), so the browser terminal could open before the forwarding child had finished connecting and running remote setup-gpg. The first gpg command in that terminal would then create a fresh local keyring instead of seeing the forwarded agent.
ForwardAgent now waits for its child's first attempt to signal readiness over an inherited pipe (bounded by a timeout so a stuck forward can't block the caller indefinitely), mirroring the synchronous wait the SSH-terminal path (cmd/workspace/gpg_tunnel.go) already had.
Normal interactive devsy ssh sessions are unaffected — the readiness signal is a no-op unless the process was spawned by ForwardAgent.

Summary by CodeRabbit

Bug Fixes
- Improved GPG agent forwarding startup reliability by detecting when forwarding is ready.
- Added a timeout so startup can continue when readiness is not explicitly reported.
- Preserved automatic forwarding restarts and cancellation behavior after failures.
- Improved handling of missing, invalid, unavailable, or unsuccessful readiness signals.
- Improved resilience when SSH forwarding listeners need to be rebound after transport interruptions.

ForwardAgent spawned its forwarding child fire-and-forget and returned immediately, so browser IDEs (vscode-web, etc.) could open a terminal before the child had finished connecting and running remote setup-gpg. The first gpg command in that terminal would then create a fresh local keyring instead of seeing the forwarded agent. ForwardAgent now waits for the child's first attempt to signal readiness over an inherited pipe (with a timeout so a stuck forward can't block the caller indefinitely), mirroring the synchronous wait the SSH-terminal path already had.

netlify · 2026-08-06T15:00:41Z

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	`22d8332`
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6a7601ee6861d000080578f8

coderabbitai · 2026-08-06T15:00:42Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a891203b-9ef2-44a2-b698-69108f629dcf

📥 Commits

Reviewing files that changed from the base of the PR and between fa95f47 and 22d8332.

📒 Files selected for processing (2)

cmd/workspace/gpg_tunnel.go
pkg/ssh/forward_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

cmd/workspace/gpg_tunnel.go

📝 Walkthrough

Walkthrough

GPG forwarding now uses a readiness file descriptor to synchronize startup. ForwardAgent waits up to 30 seconds for readiness from a successful child attempt. The workspace tunnel signals readiness after successful setup or recovery.

Changes

GPG forwarding readiness

Layer / File(s)	Summary
Forwarding contract and supervision `pkg/gpg/forward.go`, `pkg/gpg/forward_test.go`, `pkg/ssh/forward_test.go`	`ForwardAgent` starts supervised forwarding with `forwardSpec` and waits for readiness, timeout, or cancellation. Restart backoff remains intact. The SSH transport-death test retries listener rebinding until success or its deadline.
Child readiness execution `pkg/gpg/forward.go`, `pkg/gpg/forward_test.go`	`runForwardOnce` passes descriptor 3 through `EnvForwardReadyFD` and signals readiness only after a child byte is received. Tests cover successful writes, child errors, cancellation, and readiness after retry.
Workspace tunnel readiness integration `cmd/workspace/gpg_tunnel.go`	The tunnel parses the readiness descriptor and signals it once after successful initial setup or recovery. Failed signaling retains the descriptor for later retries.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ForwardAgent
  participant superviseForward
  participant runForwardOnce
  participant ChildProcess
  participant WorkspaceTunnel
  ForwardAgent->>superviseForward: start supervised forwarding
  superviseForward->>runForwardOnce: execute forwarding attempt
  runForwardOnce->>ChildProcess: provide EnvForwardReadyFD on descriptor 3
  ChildProcess-->>runForwardOnce: write readiness byte
  runForwardOnce-->>ForwardAgent: report readiness
  WorkspaceTunnel->>WorkspaceTunnel: signal readiness after successful setup

Possibly related PRs

devsy-org/devsy#790: Extends GPG forwarding supervision with readiness signaling.
devsy-org/devsy#854: Modifies the related GPG forwarding and workspace tunnel lifecycle.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: waiting for GPG-agent forwarding readiness before opening browser IDEs.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

netlify · 2026-08-06T15:00:49Z

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	`22d8332`
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6a7601eeb10b220007e7707b

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cmd/workspace/gpg_tunnel.go`:
- Line 288: Update the GPG tunnel setup flow around ensure and
signalGPGForwardReady so ensure reports whether the tunnel is running, and only
signal readiness after successful initial setup or retry. Ensure failures do not
send the readiness byte or allow ForwardAgent to return early, and add coverage
for an initial setup failure.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 44c6d8b8-92d1-470f-a1ff-7524798e1011

📥 Commits

Reviewing files that changed from the base of the PR and between ffb6784 and 511239f.

📒 Files selected for processing (3)

cmd/workspace/gpg_tunnel.go
pkg/gpg/forward.go
pkg/gpg/forward_test.go

ensure() previously reported nothing, so runGPGTunnelInBackground always signaled readiness right after the first synchronous ensure call even when that setup failed. ForwardAgent would then return believing the tunnel was up, letting a browser IDE terminal race a gpg-agent that was never forwarded. ensure now reports whether the tunnel is live, and readiness is only signaled the first time that's true - whether from the initial call or a later health-check retry. Also make signalGPGForwardReady report write success so a failed readiness write doesn't get latched as already-signaled, which would strand ForwardAgent until its timeout despite the tunnel being live.

superviseForward cleared the readiness channel after the first attempt regardless of outcome, and runForwardOnce treated a child exiting without ever writing to its readiness fd the same as a real readiness signal. A transient failure on the very first attempt therefore made ForwardAgent return immediately as "ready" and permanently gave up reporting readiness for any later successful retry - defeating the point of waiting at all. runForwardOnce now only reports readiness after an actual byte is read from the pipe, and superviseForward keeps the readiness channel live across restarts until an attempt actually reports it.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cmd/workspace/gpg_tunnel.go`:
- Around line 268-278: Update signalGPGForwardReady to retain the *os.File
created by os.NewFile on gpgTunnel when the readiness write fails, keeping it
reachable until a later retry succeeds; release or clear the retained file only
after a successful write. Preserve the existing invalid-descriptor handling and
retry behavior.

🪄 Autofix

✅ Autofix completed

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fc3794b5-aa4e-475e-b3c5-bf105fa174b1

📥 Commits

Reviewing files that changed from the base of the PR and between 511239f and fa95f47.

📒 Files selected for processing (3)

cmd/workspace/gpg_tunnel.go
pkg/gpg/forward.go
pkg/gpg/forward_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

pkg/gpg/forward.go

coderabbitai · 2026-08-07T15:07:28Z

Fixes Applied Successfully

Fixed 1 file(s) based on 1 unresolved review comment.

Files modified:

cmd/workspace/gpg_tunnel.go

Commit: 4669f4365a4c578af04f16247b5f403f763eda72

The changes have been pushed to the tame-mayfly branch.

Time taken: 6m 58s

Fixed 1 file(s) based on 1 unresolved review comment. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>

github-actions Bot added the size/l label Aug 6, 2026

Merge branch 'main' into tame-mayfly

511239f

skevetter marked this pull request as ready for review August 7, 2026 01:09

coderabbitai Bot reviewed Aug 7, 2026

View reviewed changes

Comment thread cmd/workspace/gpg_tunnel.go Outdated

skevetter marked this pull request as draft August 7, 2026 01:18

skevetter added 5 commits August 7, 2026 01:39

fix(lint): extract /bin/sh test literal to constant (goconst)

1b7847d

style: update comments

8fd932f

style: update env var name

9032ce2

skevetter marked this pull request as ready for review August 7, 2026 13:41

skevetter marked this pull request as draft August 7, 2026 13:52

Merge branch 'main' into tame-mayfly

fa95f47

skevetter marked this pull request as ready for review August 7, 2026 15:02

coderabbitai Bot reviewed Aug 7, 2026

View reviewed changes

Comment thread cmd/workspace/gpg_tunnel.go Outdated

skevetter marked this pull request as draft August 7, 2026 15:06

coderabbitai Bot and others added 2 commits August 7, 2026 15:15

fix: apply CodeRabbit auto-fixes

4669f43

Fixed 1 file(s) based on 1 unresolved review comment. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>

fix: retain readiness fd across retries, deflake rebind test

22d8332

skevetter marked this pull request as ready for review August 7, 2026 16:41

skevetter merged commit 6f8361a into main Aug 7, 2026
67 checks passed

skevetter deleted the tame-mayfly branch August 7, 2026 17:07

This was referenced Aug 8, 2026

fix(workspace): forward gpg on browser open #904

Merged

fix(ide): pass flag to browser tunnel ide opener to forward gpg agent #908

Merged

Navigation Menu

Uh oh!

fix: wait for gpg-agent forward readiness before opening browser IDEs - #893

fix: wait for gpg-agent forward readiness before opening browser IDEs#893
skevetter merged 10 commits into
mainfrom
tame-mayfly

skevetter commented Aug 6, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

netlify Bot commented Aug 6, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 6, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

netlify Bot commented Aug 6, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

coderabbitai Bot commented Aug 7, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

skevetter commented Aug 6, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Summary by CodeRabbit

Uh oh!

netlify Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for devsydev canceled.

Uh oh!

coderabbitai Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

netlify Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for images-devsy-sh canceled.

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Fixes Applied Successfully

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

skevetter commented Aug 6, 2026 •

edited by coderabbitai Bot

Loading

netlify Bot commented Aug 6, 2026 •

edited

Loading

coderabbitai Bot commented Aug 6, 2026 •

edited

Loading

netlify Bot commented Aug 6, 2026 •

edited

Loading

coderabbitai Bot left a comment •

edited

Loading

coderabbitai Bot commented Aug 7, 2026 •

edited

Loading