ab installed before its login stays on the public tier for up to 4 h: re-check updates when a session arrives

by adom

Adom Bridge unleashes your AI onto your full PC: full power, full safety. The AI breaks out of the container it runs in and onto your real machine, managing and running your entire laptop as you: launch apps, move files, drive any window, control KiCad, Fusion 360 or your real signed-in browser. Works with any AI, cloud or local (Claude Desktop, Claude Code, Codex), no Hydrogen required. Bridge and its bridges are an operating system for AI, with managed Node and Python runtimes, and a human-onl

Overview Files Skills Discover Packages Releases Dependencies Issues19 Breadcrumbs Pull Requests1 Activity

Closed general

John Lauer · 2mo ago ·closed by John Lauer

Seen on a from-scratch Hydrogen 1.0.343 install on winvm, 2026-09-11. Hydrogen's cascade installs ab before the Adom sign-in completes; that install resolved the public manifest (2.1.29) while the insiders tier is at 2.1.99. Hydrogen 1.0.344 fixes its own resolver (it now probes adom/insiders/files/adom-bridge/version.json with the session token first), but the other half is ab's: its updater checks at startup, when it has no session yet, and then every 4 h, so a box whose ab arrived public runs a 15-week-old bridge for its first hours even after the login makes it an insider.

Concrete effect today: the mirrored permission prompts (2.1.44+, relay since 2.1.59) did not exist on the fresh box, so the shell-grant dialog showed only inside the VM's RDP window and John asked why the mesh had not brought it to his laptop.

Ask: when ab receives or refreshes a session (the ad-supervisor hand-off from Hydrogen, or its own sign-in), run the update check immediately instead of waiting for the 4 h tick. One extra manifest probe per sign-in.

2 Replies

John Lauer · 2mo ago

Taking it, in 2.1.102 (building): ab now runs the manifest check the moment a session lands, both on its own browser sign-in and on Hydrogen's hand-off token (updater::spawn_check_now, the same code path as the update_check verb), and stages at once when the tier's manifest is newer. One extra probe per sign-in, as asked. Proof: the app log's '[updater] handoff: newer version available - staging now' line on a box after the hand-off, and update_status flipping from public to the insiders version without waiting for the 4 h tick.

John Lauer · 2mo ago

Closed in 2.1.102 (insiders), carried unchanged in 2.1.103.

updater::spawn_check_now(why) runs after both session::save sites in auth.rs: a sign-in and a Hydrogen hand-off each kick a manifest check at once, so a cascade-installed ab that resolved the public manifest before login leaves the public tier within a minute of the session landing instead of waiting for the 4 h tick.

Proof from winvm's app log on 2.1.102 (two Hydrogen restarts, each hand-off followed by the check one second later):

[16:10:32][app_lib::auth][INFO] auth: handoff accepted, session persisted for [email protected]
[16:10:32][app_lib::updater][INFO] [updater] handoff: manifest checked, nothing newer
[16:20:54][app_lib::auth][INFO] auth: handoff accepted, session persisted for [email protected]
[16:20:55][app_lib::updater][INFO] [updater] handoff: manifest checked, nothing newer

"nothing newer" because winvm was already on the insiders build; a box on the public tier at that moment would have staged the insiders release right there. update_status.tier reports which manifest the last check followed.

John Lauer closed this · 2mo ago