Repository navigation
VS Code: a revocation whose save failed lasts until the broker window closes, not until Dormouse quits #1484
Description
In VS Code, a phone revocation whose ACL save failed lasts only as long as the broker window, not until Dormouse quits. docs/specs/remote-security-model.md → "Revocation" says "quitting Dormouse before one undoes it". The error the user sees says "refused until Dormouse quits". In VS Code, closing one window is enough.
How it happens. #unsavedRevocations is held in memory on a single BurrowService (service.ts#L539). VS Code runs that service only in the broker window (startService in vscode-ext/src/burrow.ts). When the broker window closes and another window takes over, the new service loads the stored ACL, which never received the revocation, so the revoked phone is paired again. Standalone runs one sidecar per app, so the spec's wording is accurate there.
This only happens after an ACL save has already failed, which is rare. Two directions, and the choice is a maintainer's:
- Narrow the promise. Change the spec sentence and the error text to say the refusal lasts until the window running remote control closes, or until Dormouse quits.
- Keep the promise. Hand pending revocations to the next broker, either through the peer link at handoff or a small separate record. A record has to be written somewhere, and the ACL write just failed, so this is the larger change.
A related note from the same review of #1459 (not a bug)
- The public
BurrowService.revoke(service.ts#L1172) has no caller, tests included. Settings anddor remote revokeboth go through#revokeDevice.security-remote.mdS292 and the spec's passkey-target sentence name it as the entry point.
Activity
dormouse-bot commentedon Oct 31, 2026
#1485 takes the "narrow the promise" option. Each host now gets its own error text: VS Code says the phone is "refused until the window running remote control closes", and standalone keeps "until Dormouse quits". The Revocation spec sentence and its rationale now say the hold ends when the service stops, and they name both cases. The existing failed-save test fails on the old text and passes with the change. A new test pins the standalone wording. Build & Test and Library Tests are green. Argos flags one visual change, and #1482 and #1483 show the same one, so it doesn't come from this diff. A maintainer still needs to review it.
That PR uses
Refs, so this issue stays open for the other option: handing pending revocations to the next broker so "until Dormouse quits" holds in VS Code too. The unused publicBurrowService.revokefrom the details section is not touched.