Repository navigation
fleet: proxy serve --help (and any trailing argument) silently starts the session-proxy daemon #5575
Description
fleet: proxy serve --help (and any trailing argument) silently starts the session-proxy daemon
Evidence (verified this run, laptop primary @ 6d7845e, real fleet binary)
pkgs/fleet/crates/fleet/src/main.rs, run_proxy: the serve branch dispatches straight to the daemon without ever inspecting the trailing arguments:
Some("serve") => {
#[cfg(feature = "proxy-serve")]
{
fleet_proxy::serve::run(config)
}
...
}fleet_proxy::serve::run (pkgs/fleet/crates/fleet-proxy/src/serve.rs:346) takes only &Config — it has no argument list at all — so everything after serve is dropped on the floor before the socket is bound. The domain-help shortcut in run_domain (wants_domain_help) only special-cases the serve domain's role position (the #5488 fix); the proxy domain's serve subcommand sits one level deeper and is not covered. The argv0 alias lands in the same place: laptop-agent-broker implies serve, so laptop-agent-broker --help becomes args ["serve", "--help"] and also starts the daemon.
Behavioral probe (real binary built on the laptop, fake HOME, FLEET_BROKER_SOCKET pointed at a temp path, 3s timeout):
$ fleet proxy serve --help
fleet proxy serve on /tmp/probe-proxy-home/broker.sock # killed by timeout, exit 124
$ fleet proxy serve --bogus-junk
fleet proxy serve on /tmp/probe-proxy-home/broker.sock # killed by timeout, exit 124
$ laptop-agent-broker --help # argv0 symlink
fleet proxy serve on /tmp/probe-proxy-home/broker.sock # killed by timeout, exit 124
$ fleet proxy --help # control
fleet proxy — The session proxy: … # domain help, exit 0
$ fleet proxy connect --help # control
fleet: usage: fleet proxy connect … # usage error, exit 2, no daemon
Why it matters
--help is the safe, reflexive first command for any operator or agent meeting a daemon binary; here it silently performs the most consequential action the binary has — binding the session-broker socket and serving — instead of printing help, and a typo'd flag is swallowed the same way. This is exactly the bug class already fixed twice in this binary (#5488 for fleet serve <role> --help, #5560 for fleet dispatch status swallowing its arguments); the proxy domain's serve leaf is the remaining surface with the same shape: a no-argument daemon entry point reached through an argument-discarding dispatch. The §3 dispatch contract in main.rs says domain help is "always available, even where the domain itself is not" — the serve leaf defeats it.
Acceptance criteria
fleet proxy serve --help/-hprints usage for the serve leaf (or the proxy domain help) and exits 0, without binding the socket.fleet proxy serve <any other argument>fails with a usage error (exit 2) before binding anything.- The argv0 form
laptop-agent-broker --helpbehaves the same. - Bare
fleet proxy servestill starts the broker exactly as today;fleet proxy connect,fleet proxy init, andfleet proxy --helpbehavior are unchanged. - A test pins the serve-leaf argument handling at the dispatch level so the implied-arg alias route cannot regress it.
Activity
developing-today commentedon Nov 4, 2026
CODE-1378
dezren39 commentedon Nov 4, 2026
🤖 Agent note · filed
fleet proxy servediscarding all trailing arguments —--help/-hprints serve usage and exits 0 without binding; any other argument is a usage error (exit 2) before binding; bareproxy serveand thelaptop-agent-brokerargv0 route unchanged in behavior apart from the same arg handling. Verified pre-filing with the realfleetbinary on the laptop (main @ 6d7845e, fake HOME, temp broker socket):proxy serve --help,proxy serve --bogus-junk, andlaptop-agent-broker --helpall bound the socket and served until timeout-killed (124); controlsproxy --help(exit 0) andproxy connect --help(exit 2, no daemon) behaved correctly.cargo test -p fleetgreen on the laptop, fixed binary re-probed (help/reject bind nothing, bare serve still serves). Guarded self-solve this run (trivial, small, low-risk — same bug class as fleet: serve <role> --help (and the queue-broker/secrets-broker argv0 aliases) starts the daemon instead of printing help #5488/fleet dispatch status silently ignores all arguments — --help performs a live GET /health and typos are swallowed #5560).FLEET_BROKER_SOCKET.fix(fleet): proxy serve honors --help and rejects stray arguments (#5575
dezren39 commentedon Nov 4, 2026
🤖 Agent note · done
run_proxy's serve branch now gates onclassify_proxy_serve_args— a help flag anywhere in the tail printsPROXY_SERVE_USAGE(exit 0), any other trailing argument is a usage error (exit 2), both before the broker socket is bound; bareproxy serveunchanged. New pinning testproxy_serve_args_classify_help_and_reject_strays;cargo test -p fleetgreen on the laptop (3 passed), fmt applied. Fixed binary re-probed (fake HOME, temp socket): help/reject create no socket file and exit 0/2, argv0laptop-agent-broker --helpprints usage, bare serve still binds and serves.