[MylesShannon]

Changelog title

Recover stale macOS helper registrations after upgrades

Changelog body

• Allow a delayed, bounded retry when macOS retains the privileged helper's old signing identity after an upgrade.
• Preserve the retry limit across application restarts and pending background-item approval.

Bumps

• services: patch
• nvpair-cluster-manager: none
• nvpair-engine-manager: none
• nvpair-errors: none
• nvpair-job-scheduler: none
• nvpair-manual-nodes: none
• nvpair-node-info: none
• nvpair-node-scanner: none
• nvpair-node-settings: none
• nvpair-proxy: none
• nvpair-tui: none
• nvpair-ui-broker: none
• nvpair-workload-manager: none

Summary

Follow-up to #192, related to #175. Depends on #192. This branch includes its two commits and merges the latest develop; the new recovery change is isolated in a4dd4bf. The PR diff currently includes the prerequisite signing fix.

Testing the signed build on my Apple Silicon Mac confirmed that both native binaries satisfy the pinned signing requirements. However, launchd retained a launch constraint requiring the old helper identifier, com.nvidia.nvpair, and rejected the correctly signed com.nvidia.nvpair.helper. macOS invalidated the old registration about 10 seconds later, but the job continued failing. An additional unregister/register cycle recovered XPC communication, firewall configuration, and setup persistence across app restarts.

The existing once-per-version repair marker prevented that additional cycle. This change permits at most two replacement attempts per app version, saving the count and clearing setup completion before each unregister. Before the second attempt, it waits 12 seconds and checks status again. A recovered helper is left running, and pending approval stops recovery until a subsequent launch. A saved version without a count consumes the first attempt.

Scope

macOS helper recovery, persisted attempt bookkeeping, regression tests, and the existing helper documentation. The follow-up leaves signing requirements, helper identifiers, privileged operations, and Windows/Linux behavior unchanged. services: patch records the desktop bug fix in release notes; all Go component bumps remain none because their compiled output is unchanged.

Validation

• make -o desktop/package-lock.json check: SPDX headers, build-script verification, lint, all three TypeScript targets, service contracts, 26 Node tests, and 303 Vitest tests passed. The make option reuses installed dependencies; the upstream lockfile change only updates the application version.
• cd desktop && npm run dead-code:check: passed.
• cd desktop && ./node_modules/.bin/vitest run --project unit tests/modular/mac-privilege-service.test.ts: 21 tests passed. The five initial recovery regressions failed against the previous implementation before the fix.
• Coverage includes waiting before a second unregister, recovery during the wait, approval before/during recovery, interrupted attempts, persisted limits across reloads, a new app version, and the previous version-only repair marker.
• git diff --check: passed.
• Manual evidence above is from the signed prerequisite build plus a controlled CLI recovery, not a signed build of this follow-up.

Risk and remaining test

The 12-second delay is based on the observed launchd repair window, not an Apple timing guarantee. A failed retry leaves setup incomplete and cannot repeat replacement indefinitely. Signature pinning remains enforced throughout.

• Validate this commit in an NVIDIA-signed build by upgrading an affected installation in place, without manually unregistering the helper or clearing its data. Confirm the automatic second attempt, XPC status, firewall configuration, and setup persistence across full app restarts and a reboot. Exercise approval followed by relaunch as well.

Checklist

• I have read the contributing guidelines.
• Every commit is signed off for the Developer Certificate of Origin.
• Tests cover the change and relevant documentation is updated.
• I checked the diff, changed filenames, and commit messages for credentials, private data, internal URLs, internal issue identifiers, and generated artifacts.
• Validation commands and limitations are recorded above.
• Release intent is declared without editing automation-owned version files.

[Noah-Tervalon-Nvidia]

minor doc change requested. I'm waiting on a build right now to verify this upgrade path works, but code looks fine.

[Noah-Tervalon-Nvidia]

One more thing - I tried this with the signed build - when I just uninstalled my other copy and then installed this one I was left with the old helper because we never ran an upgrade flow or a first install flow. This is very niche, but possible. When I reset all app data and it ran through the setup flow again it had fixed this. You can choose to fix this or not, but might be combo of very difficult to detect and also not worth it.

[MylesShannon]

One more thing - I tried this with the signed build - when I just uninstalled my other copy and then installed this one I was left with the old helper because we never ran an upgrade flow or a first install flow. This is very niche, but possible. When I reset all app data and it ran through the setup flow again it had fixed this. You can choose to fix this or not, but might be combo of very difficult to detect and also not worth it.

Done. Thanks for the feedback!

[Noah-Tervalon-Nvidia]

thx!