fix(launcher): Campaign LA LA3 review fixes — contract paths omission, probe composition, graceful stop, hygiene
Opus review of LA3 returned FIX FIRST; this addresses every finding in
scope (F1-F5, F7-F12; F6 CI-lane addition excluded per instructions):
- F1 (CRITICAL): SessionProcessSettings.Paths is now nullable and left
null by SessionConfigComposer unless a caller supplies overrides, so
the JSON key is entirely absent instead of "paths":{} — the App-side
loader's strict UnmappedMemberHandling.Disallow would otherwise reject
every gui/guiSelect session-config document at load.
- F2: added SessionConfigComposer.ComposeProbe and a nullable
SessionDescriptor.Mode field ("probe", omitted for normal play) per
the pinned contract — no character/policy/plugins/loginCommands.
- F3: LauncherProcessSupervisor.Stop now tries
ILauncherChildProcess.TryRequestGracefulStop (Linux: libc SIGINT via
LibraryImport, K4-proven graceful headless logout) before
CloseMainWindow. Windows has no reliable no-window-console equivalent
today; filed docs/ISSUES.md #397 with the CREATE_NEW_PROCESS_GROUP +
CTRL_BREAK fix direction. Stop()'s blocking-timeout contract is now
documented for LA4.
- F4: LauncherProfileStore.Save chmods the Linux temp file to 0600
immediately after creation, before any credential is serialized;
failure paths and Load() clean up a stale .tmp.
- F5: added LauncherCoreDependencyBoundaryTests asserting Launcher.Core
references exactly AcDream.Platform and no packages.
- F7: StatusEventParser.Parse no longer throws on a whitespace/null
line; StatusFileTailer.ReadNewEvents swallows the File.Exists/open
TOCTOU window (FileNotFoundException/DirectoryNotFoundException/
IOException) instead of throwing.
- F8: Start() now kills (entire process tree) and disposes a child that
started successfully but failed while being fed its stdin password,
instead of orphaning it.
- F9: SetState is monotonic — once Exited, no later transition applies
or fires StateChanged, closing a Start()-path race where a
synchronously-exiting child could be "resurrected" to Running.
- F10: CharacterIdFormat.TryParse now requires the "0x" prefix (an
unprefixed hand-typed decimal id is also valid hex and was silently
misread); a parsed id of 0 is treated as unusable and falls back to
the name selector; LauncherProfileStore.MergeRoster normalizes both
sides through TryParse/ToHexString instead of raw string equality, so
a legacy unprefixed-hex row self-heals via name match instead of
duplicating.
- F11: StatusCharacterEntry.SecondsGreyedOut is now uint, matching
CharacterRosterEntry and the host writer.
- F12: added MalformedStatusEvent, returned for a recognized `e` whose
payload doesn't match its shape, distinguished from UnknownStatusEvent
(an unrecognized `e`).
AllowUnsafeBlocks was added to AcDream.Launcher.Core.csproj — required
by the LibraryImport source generator's function-pointer marshalling
stub for F3's Linux SIGINT P/Invoke.
Verification: dotnet build AcDream.slnx -c Release green (0 errors);
dotnet test tests/AcDream.Launcher.Core.Tests -c Release green at 94/94
on native Windows and under WSL (Ubuntu, verified across multiple runs
for the timing-sensitive SIGINT/sharing-violation tests, no flakes
observed).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Erik
parent
37d74e4402
commit
26feba8186
19 changed files with 1101 additions and 105 deletions
|
|
@ -109,6 +109,132 @@ public sealed class LauncherProcessSupervisorTests
|
|||
Assert.Equal(0, fake.KillCallCount);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void StopAttemptsTheGracefulStopSignalBeforeCloseMainWindow()
|
||||
{
|
||||
var factory = new FakeChildProcessFactory(exitsWithinStopTimeout: true);
|
||||
using var supervisor = new LauncherProcessSupervisor(factory);
|
||||
supervisor.Start(Spec(), "pw");
|
||||
|
||||
supervisor.Stop(TimeSpan.FromMilliseconds(50));
|
||||
|
||||
FakeChildProcess fake = factory.LastCreated!;
|
||||
Assert.Equal(1, fake.TryRequestGracefulStopCallCount);
|
||||
Assert.Equal(["gracefulStop", "closeMainWindow"], fake.CallOrder);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void GracefulStopSignalSendsSigintToARealChildOnLinux()
|
||||
{
|
||||
// Review finding F3, proven end to end against the real
|
||||
// SystemChildProcess: Stop() sends SIGINT before falling back to
|
||||
// CloseMainWindow/Kill, and the trapped child exits gracefully
|
||||
// with code 0 well within the timeout. A hard SIGKILL fallback
|
||||
// (or a signal arriving before the shell's trap is even armed,
|
||||
// which falls back to the shell's default SIGINT disposition —
|
||||
// terminate with exit 128+2=130) would not produce this clean
|
||||
// exit code, so ExitCode == 0 is a hermetic proof the graceful
|
||||
// path is what actually stopped the child.
|
||||
if (!OperatingSystem.IsLinux())
|
||||
return;
|
||||
|
||||
string readyMarker = Path.Combine(
|
||||
Path.GetTempPath(), "acdream-la3-sigint-" + Guid.NewGuid().ToString("N"));
|
||||
try
|
||||
{
|
||||
using var supervisor = new LauncherProcessSupervisor();
|
||||
var exited = new ManualResetEventSlim(false);
|
||||
supervisor.StateChanged += (_, s) =>
|
||||
{
|
||||
if (s == LauncherSessionState.Exited)
|
||||
exited.Set();
|
||||
};
|
||||
|
||||
supervisor.Start(
|
||||
new LauncherProcessSpec(
|
||||
"/bin/bash",
|
||||
[
|
||||
"-c",
|
||||
"trap 'kill $child 2>/dev/null; exit 0' INT; "
|
||||
+ "sleep 30 & child=$!; "
|
||||
+ $"touch '{readyMarker}'; "
|
||||
+ "wait $child",
|
||||
]),
|
||||
password: null);
|
||||
|
||||
// Wait for the child to prove its SIGINT trap is armed AND
|
||||
// its background `sleep` is tracked (touch runs after both,
|
||||
// in program order) before sending the signal — otherwise
|
||||
// this test would race the shell's own startup and
|
||||
// intermittently observe the shell's default SIGINT
|
||||
// disposition instead of the trap, or leave an untracked
|
||||
// orphaned `sleep`.
|
||||
DateTime readyDeadline = DateTime.UtcNow + TimeSpan.FromSeconds(5);
|
||||
while (!File.Exists(readyMarker) && DateTime.UtcNow < readyDeadline)
|
||||
{
|
||||
Thread.Sleep(10);
|
||||
}
|
||||
|
||||
Assert.True(
|
||||
File.Exists(readyMarker),
|
||||
"child did not signal trap-armed readiness in time");
|
||||
|
||||
supervisor.Stop(TimeSpan.FromSeconds(10));
|
||||
|
||||
Assert.True(exited.Wait(TimeSpan.FromSeconds(5)));
|
||||
Assert.Equal(0, supervisor.ExitCode);
|
||||
}
|
||||
finally
|
||||
{
|
||||
try
|
||||
{
|
||||
File.Delete(readyMarker);
|
||||
}
|
||||
catch (IOException)
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void StartKillsAndDisposesTheChildWhenFeedingStdinThrowsAfterTheProcessHasStarted()
|
||||
{
|
||||
var factory = new FakeChildProcessFactory(
|
||||
exitsWithinStopTimeout: true,
|
||||
throwOnStandardInputWrite: true);
|
||||
using var supervisor = new LauncherProcessSupervisor(factory);
|
||||
|
||||
Assert.ThrowsAny<Exception>(() => supervisor.Start(Spec(), "pw"));
|
||||
|
||||
FakeChildProcess fake = factory.LastCreated!;
|
||||
Assert.True(fake.Started);
|
||||
Assert.Equal(1, fake.KillCallCount);
|
||||
Assert.True(fake.Disposed);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void SetStateIsMonotonicAndIgnoresATransitionAfterExited()
|
||||
{
|
||||
// Simulates the child exiting synchronously from inside
|
||||
// process.Start() itself (a child that dies immediately) — the
|
||||
// trailing SetState(Running) at the end of Start() must not
|
||||
// resurrect State from the terminal Exited it already reached,
|
||||
// nor fire a spurious StateChanged(Running).
|
||||
var factory = new FakeChildProcessFactory(
|
||||
exitsWithinStopTimeout: true,
|
||||
exitDuringStart: true);
|
||||
using var supervisor = new LauncherProcessSupervisor(factory);
|
||||
var states = new List<LauncherSessionState>();
|
||||
supervisor.StateChanged += (_, s) => states.Add(s);
|
||||
|
||||
supervisor.Start(Spec(), "pw");
|
||||
|
||||
Assert.Equal(LauncherSessionState.Exited, supervisor.State);
|
||||
Assert.Equal(
|
||||
[LauncherSessionState.Starting, LauncherSessionState.Exited],
|
||||
states);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void LauncherProcessSpecCarriesNoCredentialLikeMember()
|
||||
{
|
||||
|
|
@ -162,22 +288,34 @@ public sealed class LauncherProcessSupervisorTests
|
|||
// because this test is itself running under `dotnet test`.
|
||||
OperatingSystem.IsWindows() ? "dotnet.exe" : "dotnet";
|
||||
|
||||
private sealed class FakeChildProcessFactory(bool exitsWithinStopTimeout)
|
||||
private sealed class FakeChildProcessFactory(
|
||||
bool exitsWithinStopTimeout,
|
||||
bool exitDuringStart = false,
|
||||
bool throwOnStandardInputWrite = false)
|
||||
: ILauncherChildProcessFactory
|
||||
{
|
||||
public FakeChildProcess? LastCreated { get; private set; }
|
||||
|
||||
public ILauncherChildProcess Create(LauncherProcessSpec spec)
|
||||
{
|
||||
LastCreated = new FakeChildProcess(spec, exitsWithinStopTimeout);
|
||||
LastCreated = new FakeChildProcess(
|
||||
spec,
|
||||
exitsWithinStopTimeout,
|
||||
exitDuringStart,
|
||||
throwOnStandardInputWrite);
|
||||
return LastCreated;
|
||||
}
|
||||
}
|
||||
|
||||
private sealed class FakeChildProcess(LauncherProcessSpec spec, bool exitsWithinStopTimeout)
|
||||
private sealed class FakeChildProcess(
|
||||
LauncherProcessSpec spec,
|
||||
bool exitsWithinStopTimeout,
|
||||
bool exitDuringStart = false,
|
||||
bool throwOnStandardInputWrite = false)
|
||||
: ILauncherChildProcess
|
||||
{
|
||||
private readonly RecordingTextWriter _standardInput = new();
|
||||
private readonly ThrowingTextWriter _throwingStandardInput = new();
|
||||
|
||||
public LauncherProcessSpec Spec { get; } = spec;
|
||||
|
||||
|
|
@ -191,27 +329,59 @@ public sealed class LauncherProcessSupervisorTests
|
|||
|
||||
public int CloseMainWindowCallCount { get; private set; }
|
||||
|
||||
public int TryRequestGracefulStopCallCount { get; private set; }
|
||||
|
||||
public int KillCallCount { get; private set; }
|
||||
|
||||
public bool Disposed { get; private set; }
|
||||
|
||||
/// <summary>Records the order <see cref="TryRequestGracefulStop"/>,
|
||||
/// <see cref="CloseMainWindow"/>, and <see cref="Kill"/> were
|
||||
/// actually invoked in — review finding F3's ordering guarantee.
|
||||
/// </summary>
|
||||
public List<string> CallOrder { get; } = [];
|
||||
|
||||
public bool HasExited { get; private set; }
|
||||
|
||||
public int ExitCode { get; private set; }
|
||||
|
||||
public TextWriter StandardInput => _standardInput;
|
||||
public TextWriter StandardInput =>
|
||||
throwOnStandardInputWrite ? _throwingStandardInput : _standardInput;
|
||||
|
||||
public event EventHandler? Exited;
|
||||
|
||||
public void Start() => Started = true;
|
||||
public void Start()
|
||||
{
|
||||
Started = true;
|
||||
|
||||
if (exitDuringStart)
|
||||
{
|
||||
// Simulates a child that dies synchronously from inside
|
||||
// Process.Start() itself (review finding F9's race).
|
||||
HasExited = true;
|
||||
ExitCode = 0;
|
||||
Exited?.Invoke(this, EventArgs.Empty);
|
||||
}
|
||||
}
|
||||
|
||||
public bool TryRequestGracefulStop()
|
||||
{
|
||||
TryRequestGracefulStopCallCount++;
|
||||
CallOrder.Add("gracefulStop");
|
||||
return false;
|
||||
}
|
||||
|
||||
public bool CloseMainWindow()
|
||||
{
|
||||
CloseMainWindowCallCount++;
|
||||
CallOrder.Add("closeMainWindow");
|
||||
return true;
|
||||
}
|
||||
|
||||
public void Kill()
|
||||
{
|
||||
KillCallCount++;
|
||||
CallOrder.Add("kill");
|
||||
HasExited = true;
|
||||
ExitCode = -1;
|
||||
Exited?.Invoke(this, EventArgs.Empty);
|
||||
|
|
@ -230,6 +400,7 @@ public sealed class LauncherProcessSupervisorTests
|
|||
|
||||
public void Dispose()
|
||||
{
|
||||
Disposed = true;
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -243,4 +414,16 @@ public sealed class LauncherProcessSupervisorTests
|
|||
base.Dispose(disposing);
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>Simulates a broken stdin pipe (review finding F8): the
|
||||
/// child process started successfully, but feeding it the password
|
||||
/// fails.</summary>
|
||||
private sealed class ThrowingTextWriter : StringWriter
|
||||
{
|
||||
public override void Write(string? value) =>
|
||||
throw new IOException("simulated broken stdin pipe");
|
||||
|
||||
public override void Write(char value) =>
|
||||
throw new IOException("simulated broken stdin pipe");
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -135,6 +135,45 @@ public sealed class SessionConfigComposerTests
|
|||
Assert.Equal("+Acdream", (string?)session["character"]!["name"]);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void GuiModeFallsBackToNameSelectorWhenIdIsAHandTypedDecimalWithoutThe0xPrefix()
|
||||
{
|
||||
// Review finding F10: an 8-digit all-decimal-digit string is ALSO
|
||||
// a syntactically valid hex number. Without requiring the "0x"
|
||||
// prefix, this used to silently reinterpret a hand-typed decimal
|
||||
// id as hex and select the wrong character; it must now fall
|
||||
// through to the name selector instead of guessing.
|
||||
ComposedSessionConfig composed = SessionConfigComposer.Compose(
|
||||
Server(),
|
||||
Account(),
|
||||
Character(LaunchMode.Gui, id: "12345678"),
|
||||
Install,
|
||||
Paths,
|
||||
sessionId: "session-gui-decimal-id");
|
||||
|
||||
JsonObject session = SingleSession(composed);
|
||||
Assert.Null(session["character"]!["id"]);
|
||||
Assert.Equal("+Acdream", (string?)session["character"]!["name"]);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void GuiModeFallsBackToNameSelectorWhenTheParsedIdIsZero()
|
||||
{
|
||||
// Review finding F10: both host loaders reject `id: 0` outright,
|
||||
// so a parsed-but-zero id is not a usable selector either.
|
||||
ComposedSessionConfig composed = SessionConfigComposer.Compose(
|
||||
Server(),
|
||||
Account(),
|
||||
Character(LaunchMode.Gui, id: "0x00000000"),
|
||||
Install,
|
||||
Paths,
|
||||
sessionId: "session-gui-zero-id");
|
||||
|
||||
JsonObject session = SingleSession(composed);
|
||||
Assert.Null(session["character"]!["id"]);
|
||||
Assert.Equal("+Acdream", (string?)session["character"]!["name"]);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void PluginsAndLoginCommandsAreOmittedWhenEmptyRatherThanEmptyArrays()
|
||||
{
|
||||
|
|
@ -156,7 +195,7 @@ public sealed class SessionConfigComposerTests
|
|||
}
|
||||
|
||||
[Fact]
|
||||
public void ProcessContentCarriesInstallRecordAndPathsIsAlwaysPresent()
|
||||
public void ProcessContentCarriesInstallRecordAndPathsIsOmittedByDefault()
|
||||
{
|
||||
ComposedSessionConfig composed = SessionConfigComposer.Compose(
|
||||
Server(),
|
||||
|
|
@ -169,11 +208,15 @@ public sealed class SessionConfigComposerTests
|
|||
JsonObject root = ParseRoot(composed);
|
||||
Assert.Equal(1, (int?)root["version"]);
|
||||
JsonObject process = root["process"]!.AsObject();
|
||||
AssertKeys(process, "paths", "content");
|
||||
|
||||
// Paths is always present as an object; every member is omitted
|
||||
// when unset (hosts resolve their own default ApplicationPathSet).
|
||||
Assert.Empty(process["paths"]!.AsObject());
|
||||
// PINNED CONTRACT (review finding F1): process.paths is OMITTED
|
||||
// entirely — not an empty object — unless a caller explicitly
|
||||
// supplies overrides. The App-side loader parses with strict
|
||||
// UnmappedMemberHandling.Disallow and has no `paths` member of
|
||||
// its own, so an emitted "paths":{} would reject the whole
|
||||
// document at config load for every gui/guiSelect launch.
|
||||
AssertKeys(process, "content");
|
||||
Assert.False(process.ContainsKey("paths"));
|
||||
|
||||
JsonObject content = process["content"]!.AsObject();
|
||||
AssertKeys(content, "datDirectory", "preparedAssetPath");
|
||||
|
|
@ -181,6 +224,92 @@ public sealed class SessionConfigComposerTests
|
|||
Assert.Equal(Install.PreparedAssetPath, (string?)content["preparedAssetPath"]);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void NormalPlaySessionsOmitTheModeFieldEntirely()
|
||||
{
|
||||
foreach (LaunchMode mode in new[] { LaunchMode.Gui, LaunchMode.GuiSelect, LaunchMode.Headless })
|
||||
{
|
||||
ComposedSessionConfig composed = SessionConfigComposer.Compose(
|
||||
Server(),
|
||||
Account(),
|
||||
Character(mode),
|
||||
Install,
|
||||
Paths,
|
||||
sessionId: $"session-mode-omit-{mode}");
|
||||
|
||||
JsonObject session = SingleSession(composed);
|
||||
Assert.False(session.ContainsKey("mode"));
|
||||
}
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ProbeModeSetsModeAndOmitsCharacterPolicyPluginsAndLoginCommands()
|
||||
{
|
||||
ComposedSessionConfig composed = SessionConfigComposer.ComposeProbe(
|
||||
Server(),
|
||||
Account(),
|
||||
Install,
|
||||
Paths,
|
||||
sessionId: "session-probe");
|
||||
|
||||
JsonObject session = SingleSession(composed);
|
||||
|
||||
AssertKeys(
|
||||
session,
|
||||
"id", "mode", "endpoint", "account", "credential", "statusFile");
|
||||
|
||||
Assert.Equal("session-probe", (string?)session["id"]);
|
||||
Assert.Equal("probe", (string?)session["mode"]);
|
||||
Assert.Equal("127.0.0.1", (string?)session["endpoint"]!["host"]);
|
||||
Assert.Equal(9000, (int?)session["endpoint"]!["port"]);
|
||||
Assert.Equal("testaccount", (string?)session["account"]);
|
||||
Assert.Equal("standardInput", (string?)session["credential"]!["provider"]);
|
||||
Assert.False(session.ContainsKey("character"));
|
||||
Assert.False(session.ContainsKey("policy"));
|
||||
Assert.False(session.ContainsKey("plugins"));
|
||||
Assert.False(session.ContainsKey("loginCommands"));
|
||||
Assert.False(session.ContainsKey("loginCommandDelayMs"));
|
||||
Assert.Equal(
|
||||
Path.Combine(
|
||||
Paths.CacheDirectory, "launcher", "sessions", "session-probe", "status.jsonl"),
|
||||
(string?)session["statusFile"]);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ProbeModeDocumentNeverContainsThePassword()
|
||||
{
|
||||
AccountProfile account = Account();
|
||||
|
||||
ComposedSessionConfig composed = SessionConfigComposer.ComposeProbe(
|
||||
Server(),
|
||||
account,
|
||||
Install,
|
||||
Paths,
|
||||
sessionId: "session-probe-pw");
|
||||
|
||||
string json = SessionConfigComposer.Serialize(composed.Document);
|
||||
Assert.DoesNotContain(account.Password, json, StringComparison.Ordinal);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ProbeModeProcessSettingsMatchNormalComposition()
|
||||
{
|
||||
ComposedSessionConfig composed = SessionConfigComposer.ComposeProbe(
|
||||
Server(),
|
||||
Account(),
|
||||
Install,
|
||||
Paths,
|
||||
sessionId: "session-probe-content");
|
||||
|
||||
JsonObject root = ParseRoot(composed);
|
||||
JsonObject process = root["process"]!.AsObject();
|
||||
AssertKeys(process, "content");
|
||||
|
||||
JsonObject content = process["content"]!.AsObject();
|
||||
Assert.Equal(Install.DatDirectory, (string?)content["datDirectory"]);
|
||||
Assert.Equal(Install.PreparedAssetPath, (string?)content["preparedAssetPath"]);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ComposedDocumentNeverContainsThePassword()
|
||||
{
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue