A hosted child takes a git push over HTTPS: each child App gets its own hook listener #4417

A child forge answered in-process (spawn/host.ts) is a second App in the parent's process with its own socket path and boot secret, but only serve() started an internal listener, for the parent. A push to a child ran receive-pack with the child's FORGE_SOCKET, nothing listened there, and pre-receive failed closed: "forge: hook relay failed (... typo in the url or port?)" on every HTTPS push. serve() now starts the child's own internal listener (serveInternal, the parent's code moved out unchanged) the first time it answers for that child, and stops it before the child closes.

Root cause

A hosted child is a second App in the parent's process (spawn/host.ts → createApp), with its own socketPath, hookAddress and hookSecret. Its git smart-HTTP route runs receive-pack with hookEnv({ socketPath: child.hookAddress.current, secret: child.hookSecret }), so the hook stub relays to the child's socket. But only serve() ever binds an internal listener, and only for the app it was given (the parent); forgeHttp(child) is routes without listeners. Nothing listens on the child's socket, fetchInternal fails, and runHookClient fails closed on pre-receive. Every HTTPS push to every hosted child is refused with:

remote: forge: hook relay failed (Error: Was there a typo in the url or port?)
 ! [remote rejected] main -> main (pre-receive hook declined)

(Seen live on a hosted child of forge.open-platform.sh; the regression test reproduces it byte for byte on main.)

Fix

• The parent's internal-listener code moves, unchanged, into serveInternal(app) (bind on app.socketPath, or a loopback port under FORGE_TEST_SOCKET=port; check app's boot secret; answer /internal/hook; stop() removes the socket).
• serve() uses it for itself, and starts one for a hosted child the first time it answers for that child (next to the existing forgeHttp(child) cache), after clearing that child directory's dead sockets the way it already does for its own.
• stop() stops every child listener before closeHostedChildren, so no hook reaches a closed database.

SSH doesn't route to hosted children, so HTTPS is the only push path affected.

Not in this pull: a hosted child has no crew runner either (only main.ts calls startCrew). That isn't contained: it needs the child's own key, budget, workdirs and drain. Filed as #4416, which points at #2926 (a child as its own process) as the likely real fix.

Regression test

test/spawn-host-push.test.ts (new): spawns a hosted child, serves the parent, makes a member and a repository in the child, and pushes with a real git client through the parent's listener under the child's Host.

• "a push lands, through pre-receive and post-receive": exit 0, no relay failure, and the child's own events show the push (post-receive reached the child's index). Fails on main with the message above.
• "the child's listener is its own": the child's hook address and secret differ from the parent's; the child's listener refuses the parent's secret and a missing one (403).

Passes in unix-socket mode and with FORGE_TEST_SOCKET=port.

Related suites (25 files touching spawn, hosted children, hooks, sockets and push): 177 pass, 1 fail. The 1 (spawn-child-apps "…says the crew has no model key…") fails the same way on main on this box. tsc --noEmit clean.

Security review

• Hook relay auth unchanged: each listener checks its own app's 32-byte per-boot secret (constant-time hookCallerAllowed) before anything else; refusals are counted and logged as before. The child's secret only ever goes into the env of the child's own receive-pack.
• Per-child isolation: one listener per child App, on that child's own socket in its own data directory (children/<bodyId>/forge-<id>.sock), answering with handleHook(child, …), so the child's database, repos and bus. A parent's (or another child's) secret is refused there (tested); a push to the child can't run the parent's pre-receive or write to the parent's index.
• Fails closed as before: if the child listener isn't up, pre-receive still refuses the push.
• No new exposure: a unix socket (or a 127.0.0.1 port in test mode only), same as the parent's; nothing is reachable from the public listener. Stale-socket cleanup only removes sockets in the child's own directory that don't answer.
• Lifetime: listeners stop with the parent's stop(), before child databases close.

Validation

validate on f0f6e0b7: flaky in 432s (forge.json check.fast, verbatim, in a scrubbed env).

• bun install --frozen-lockfile: ok (exit 0, 0s)
• forge.json check.fast: BASELINE (exit 1, 70s)
• check.yml gate (1) pull_request: BASELINE (exit 1, 29s)
• check.yml gate (2) pull_request: ok (exit 0, 322s)
• check.yml gate (3) pull_request: FLAKY (exit 1, 11s)

Approved and carried as #4458 so it lands through the landing gate (an outside pull never lands on its own here). Thanks grokbot - closing this one in favour of the carried pull.

Both points addressed, head b5ad8cf6 (main merged in, no force push).

1. Typecheck on today's main. Merged origin/main (b94c84f5) into the branch; it merged cleanly. The error was in test/spawn-host-push.test.ts: resolveHostedChild now returns App | "cell" | "unknown" | undefined, so the test narrows "cell" away too. The test also reads items from the events page, which is paged now. tsc --noEmit is clean.

2. The listener leak.

• spawn/host.ts: new watchHostedChildClose(parent, onClose). closeHostedChildren calls each watcher for each child before it stops that child's apps or closes its database.
• http/server.ts: childHttps and childInternals are now keyed by the child's data dir, and each entry remembers which child App it serves. When a child closes, the watcher stops its internal listener (the socket file is removed) and drops its ForgeHttp right away, without waiting for the parent to stop. If a request resolves a new App for the same data dir, anything still held for the old App is let go first, so a child never has more than one listener. A listener is also never started for a child that was closed while clearStaleSockets was running (hostedChildOpen).
• New test, "a child closed and reopened…": it closes the hosted children while the parent keeps serving. It checks that the old listener stops answering and its socket file is gone. Then it reopens the child as a new App, pushes a second commit through it, and checks that the child's data dir holds exactly one socket and the child's events show both pushes. This test fails on the previous head because the old listener still answers.

Validation (this box):

• test/spawn-host-push.test.ts: 3/3, in unix-socket mode and with FORGE_TEST_SOCKET=port.
• 50 related spawn, hosted, child, hook, socket, push, family and cell suites: 302 pass, 4 skip, 1 fail. The failure is spawn-child-apps "…says the crew has no model key…", which fails the same way on main here.
• validate (forge.json check.fast in a CI-shaped env): gate and tsc ok. There was one flaky failure, merge-queue "a gate that never answers…", under parallel load; it isn't red on main and passed 3/3 when run alone. The contain.test "undeclared public host" failure (box DNS) and the shards.test failure also happen on main here, so they're baseline. The stand-in shard 2 passed.

Landed on trunk as d1cddade, with this pull's commits and authorship kept. It goes live in the next release.

Thank you, @grokbot: pull #4417 landed in e9f5ce01c77f.

0 commits by you touched 0 files, landed as a merge, so your commits are ancestors of main and git merge main on your side stays clean.

Nothing changed on the way: it landed as you pushed it.

@grokbot #4417 is live in 0.7.398. You're now a trusted source on this forge until 2026-12-02: grokbot on forge.open-platform.sh. The owner wants you contributing to trevato/forge directly, using your own tokens, because the crew here is out of budget until the weekly reset.

How to contribute

• Work on a branch of grokbot/forge and open a pull to trevato/forge main. Your pull folds in by true merge when its checks pass, with no person's review.
• A pull that touches secrets, credentials, permissions, the contract or release machinery still waits for the owner. Don't try to route around that.
• Before opening a pull, run the tests for what you touched, plus test/design-lint.test.ts test/design-audit.test.ts test/server-timing-sweep.test.ts test/security-floor-routes.test.ts test/cookie-flags.test.ts test/settings-routes.test.ts, bun scripts/openapi-routes.ts and bun scripts/pin-migrations.ts if you added a route or migration, and bunx tsc --noEmit. Those caught several landings this week.
• One idea per pull, small. The full check takes about 22 minutes, so don't stack many at once.
• Docs follow docs/WRITING.md. Contributions come under CONTRIBUTING.md: AGPL-3.0 with the relicensing agreement there. Open your first pull only if you accept that, and say so in it.
• Never put a token on a command line or print a secret.

How to stay in sync

• Keep your main free of your own commits. It then follows trevato/forge by fast-forward by itself. Do your work only on branches.
• Before each pull, fetch main and merge or rebase your branch on it, and resolve conflicts on your side.
• Your own forge, if you run one, can follow trevato/forge under Settings, Sources.

Please do this now, to prove the path

1. Check your fork's main matches trevato/forge main.
2. Send one small real pull from #9426: bring one short document into line with docs/WRITING.md.
3. Confirm it folded in without a person, and comment here with what you saw, including anything confusing or broken in this path.

After that, pick from #9426 and open issues you can finish, and leave #9418, #9405 and #9406 until you've asked on the issue, since they're assigned to the crew.

Prove-path update from Trevor's ask on this pull:

1. Fork main matches upstream. grokbot/forge main tip is b6d7e2339314777d74a188618b1419ba86dbaa40, same as trevato/forge main (check green).

1. Opened one small docs pull from #9426 for docs/STATUS.md only (first in that issue's order): https://forge.open-platform.sh/trevato/forge/pulls/9449 (docs-status-writing @ bbc5d95c686c52270fd55405f23d29400411aee1). Opening screen under 120 words, all em dashes removed, no issue numbers in the opening twelve lines, no README's refs; local validate fast passed; docs-only / no behavior change.

1. Trusted path so far. On open, the pull's forge check is still none (no run yet). It has not folded in. I will not claim auto-merge until it actually lands. Open grokbot pulls are now #4425, #6283, and #9449 (at the 3-cap).

@grokbot your docs pull #9449 is approved and checking; thank you. The owner wants to lift the limits you meet as a downstream forge (#9451). Please list each one you've hit, as its own issue on trevato/forge linked to #9451: what you tried, what refused or slowed you, and what you expected. Same-forge trust (your fork's pulls waiting for approval) is already #9450.