Repository navigation
minimald: FinalizeSession launches activate hooks before publishing the box's handed address, so own_ip + --ingress + on_activate fails with "no published address handed" #2070
Description
What happened
Activating an own-address session that declares static --ingress and has on_activate hooks fails every time on the nightly:
$ min session activate --name webapp --network own_ip --ingress 4321:4321 --ingress 4320:4320 --ingress 4322:4322 --ingress 4323:4323 --attach
Applying loadouts: tailnet-dashboard, dev, agent-claude
BOX REGISTRATION: box 'webapp' registered with the VM host daemon on VM 'default' · switch address 100.64.128.1
HOSTNAME PROXY: VM default listening on 127.0.0.1:7654 · <name>.min.internal routes through it
zone answerer: manager-held: answered by the answerer host service · ...
native DNS is the live name surface · ...
error: FinalizeSession failed: launching the session to run its hooks: session spawn: network attach failed: no published address handed for box webapp
The VM host daemon did hand the box its addresses. minvmd.log:
registered box with the VM host daemon; addresses allocated box=webapp loopback_address=127.0.64.2 switch_address=100.64.128.1
withdrew the box's host row; its addresses admit nothing (3 s later, the CLI's rollback)
and the guest attached at the handed switch address (boot.log):
19:37:08.037 FinalizeSession rpc dispatched
19:37:08.160 minimald::net: attached OwnIp PTask to gvproxy switch at its handed address ip=100.64.128.1
19:37:08.476 minimald::net: detached OwnIp PTask from switch attached=0
19:37:08.642 FinalizeSession rpc served outcome="ok" duration_ms=605 (CLI then DestroySession)
No publish line (loopback-hand-to-interim, loopback-lease, …) appears between them.
Cause
Ordering inside SessionActor::finalize (crates/minimald/src/session.rs):
self.launch_host_for_hooks(LaunchPhase::Activating)— line 2376 — launches the box to run the activate hooks. The own-address attach (crates/minimald/src/net/gvproxy_network.rs~349) readsOwnAddressReporter::published_address()and, for a declared ingress with none, fails withno published address handed for box …by design (NET-010 / NET-121: never bind forwards at an address nobody chose).self.register_hostname(&record, true)— line 2421 — is what publishes the handed loopback address (publish_own_address) and registers the name. It runs after the hooks.
So any own-address box with --ingress plus at least one on_activate hook (project minimal.toml or a loadout) cannot be activated. A session without activate hooks does not launch during finalize, registers first, and works. Introduced by #1798 (2026-10-03, "bind declared ports before the name and refuse unpublished ports instantly"), which turned the previously silent default into the refusal.
Expected behavior
FinalizeSession publishes the box's address and registers its name before launching the box for its activate hooks, so the attach finds the published address and binds the declared forwards; the hooks then run in a box whose ingress is already live.
Reproduction steps
- macOS, nightly, VM
defaultup. - A project whose
minimal.toml(or an applied loadout) declares anon_activatehook. min session activate --name x --network own_ip --ingress 4321:4321 --attach- Observe
FinalizeSession failed: … no published address handed for box x. Drop the hook (--no-hooks) or the--ingress, and it activates.
Suggested fix
Move register_hostname(&record, true) ahead of the has_hooks_for(Activate) block in finalize (keeping the verdict wait bounded as today), and add a regression test: own-address box + declared ingress + activate hook finalizes and exposes its ports. Check that a failed activate hook still withdraws the name/publish on the error path.
Workarounds
- Replace static
--ingresswith--dynamic-ingress allow --dynamic-range 4320-4323(attach needs no published address when no static mappings are declared; untested). - Or keep
--ingressand add--no-hooks, then run the hook steps by hand (note--no-hooksis recorded for the session's life).
Version
Client: minimal 0.7.0-dev.270.g1293f259
Server: minimald 0.7.0-dev.270.g1293f259
minvmd 0.7.0-dev.270.g1293f259
OS/arch
macOS arm64 (Apple Silicon)
Install channel
nightly
Slack: https://minimal-dev.slack.com/archives/C091HGA43NC/p1791401351754129
Activity
fix(minimald): publish the box's address before launching its activat…