From d9edd441614ab2c4b7b9017b12c501790001d6a0 Mon Sep 17 00:00:00 2001
From: pdparchitect <pdp@gnucitizen.org>
Date: Fri, 31 Jul 2026 16:40:26 +0000
Subject: [PATCH] - feat: update Launcher desktop base to version 0.1.6;
 enhance Chromium authentication in Apple fixed-mount sessions - feat: update
 Launcher desktop base to version 0.1.5; bump version to 0.5.8 and document
 changes - feat: update Launcher desktop base to version 0.1.4; enhance X
 display authentication for agent processes

---
 CHANGELOG.md             | 17 +++++++++++++++++
 Dockerfile               |  2 +-
 Makefile                 |  2 +-
 VERSION                  |  2 +-
 tests/smoke-container.sh | 15 +++++++++++++++
 5 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c9df4f6..656794d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,23 @@ All notable changes to Buzznode are documented here, following
 
 ## [Unreleased]
 
+## [0.5.8] - 2026-07-31
+
+### Fixed
+
+- Update the shared Launcher desktop base to `0.1.6`, keeping Chrome's software
+  renderer available without a GPU and allowing root-launched Chromium
+  processes to authenticate to the X display and paint their browser surfaces
+  in Apple fixed-mount sessions.
+
+## [0.5.7] - 2026-07-31
+
+### Fixed
+
+- Update the shared Launcher desktop base to `0.1.4`, allowing the
+  unprivileged agent harness to authenticate to the display when Apple
+  fixed-ownership mounts require the desktop session itself to run as root.
+
 ## [0.5.6] - 2026-07-31
 
 ### Fixed
diff --git a/Dockerfile b/Dockerfile
index e2777a7..e4751a8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -10,7 +10,7 @@
 # Buzznode connects to an existing relay and deliberately contains neither the
 # Buzz Desktop client nor local relay/backing services.
 
-ARG DESKTOP_IMAGE=ghcr.io/pdparchitect/launcher-image-base-desktop:0.1.3
+ARG DESKTOP_IMAGE=ghcr.io/pdparchitect/launcher-image-base-desktop:0.1.6
 
 # Upstream publishes a Linux package only for AMD64. Extract its headless tools
 # there; on ARM64, build the same immutable tag and exact commit from source.
diff --git a/Makefile b/Makefile
index bdad243..b233586 100644
--- a/Makefile
+++ b/Makefile
@@ -12,7 +12,7 @@ TARGETARCH ?= $(word 2,$(subst /, ,$(PLATFORM)))
 BUZZ_VERSION ?= 0.5.2
 BUZZ_DEB_SHA256 ?= 3f022bc31ed579e045946e6acab8483639bcb94e62c1e70f67b97b22f8f879c5
 BUZZ_SOURCE_SHA ?= 3e48f1b2365d326ee1c9582448d86a99b44ecd5d
-DESKTOP_IMAGE ?= ghcr.io/pdparchitect/launcher-image-base-desktop:0.1.3
+DESKTOP_IMAGE ?= ghcr.io/pdparchitect/launcher-image-base-desktop:0.1.6
 CODEX_VERSION ?= 0.145.0
 CLAUDE_CODE_VERSION ?= 2.1.220
 CODEX_ACP_VERSION ?= 1.1.7
diff --git a/VERSION b/VERSION
index b49b253..659914a 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.5.6
+0.5.8
diff --git a/tests/smoke-container.sh b/tests/smoke-container.sh
index 9c4269a..0e39038 100644
--- a/tests/smoke-container.sh
+++ b/tests/smoke-container.sh
@@ -46,6 +46,21 @@ fi
     curl -fsS http://127.0.0.1:6901/ >/dev/null
 '
 
+# The desktop base owns this contract. Product processes must be able to use
+# the inherited display environment without locating or copying X11 cookies.
+x_access=false
+for attempt in $(seq 1 20); do
+    if "$docker" exec --user agent "$container" xprop -root >/dev/null 2>&1; then
+        x_access=true
+        break
+    fi
+    sleep 1
+done
+if [ "$x_access" != "true" ]; then
+    echo "The agent account could not authenticate to the X display." >&2
+    exit 1
+fi
+
 # Prove that the architecture's actual headed browser reaches the desktop, not
 # merely that its executable loader and --version path work.
 "$docker" exec --detach \