erik/acdream
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix(launcher): Campaign LA LA3 review fixes — contract paths omission, probe composition, graceful stop, hygiene

Browse source 
Opus review of LA3 returned FIX FIRST; this addresses every finding in
scope (F1-F5, F7-F12; F6 CI-lane addition excluded per instructions):

- F1 (CRITICAL): SessionProcessSettings.Paths is now nullable and left
  null by SessionConfigComposer unless a caller supplies overrides, so
  the JSON key is entirely absent instead of "paths":{} — the App-side
  loader's strict UnmappedMemberHandling.Disallow would otherwise reject
  every gui/guiSelect session-config document at load.
- F2: added SessionConfigComposer.ComposeProbe and a nullable
  SessionDescriptor.Mode field ("probe", omitted for normal play) per
  the pinned contract — no character/policy/plugins/loginCommands.
- F3: LauncherProcessSupervisor.Stop now tries
  ILauncherChildProcess.TryRequestGracefulStop (Linux: libc SIGINT via
  LibraryImport, K4-proven graceful headless logout) before
  CloseMainWindow. Windows has no reliable no-window-console equivalent
  today; filed docs/ISSUES.md #397 with the CREATE_NEW_PROCESS_GROUP +
  CTRL_BREAK fix direction. Stop()'s blocking-timeout contract is now
  documented for LA4.
- F4: LauncherProfileStore.Save chmods the Linux temp file to 0600
  immediately after creation, before any credential is serialized;
  failure paths and Load() clean up a stale .tmp.
- F5: added LauncherCoreDependencyBoundaryTests asserting Launcher.Core
  references exactly AcDream.Platform and no packages.
- F7: StatusEventParser.Parse no longer throws on a whitespace/null
  line; StatusFileTailer.ReadNewEvents swallows the File.Exists/open
  TOCTOU window (FileNotFoundException/DirectoryNotFoundException/
  IOException) instead of throwing.
- F8: Start() now kills (entire process tree) and disposes a child that
  started successfully but failed while being fed its stdin password,
  instead of orphaning it.
- F9: SetState is monotonic — once Exited, no later transition applies
  or fires StateChanged, closing a Start()-path race where a
  synchronously-exiting child could be "resurrected" to Running.
- F10: CharacterIdFormat.TryParse now requires the "0x" prefix (an
  unprefixed hand-typed decimal id is also valid hex and was silently
  misread); a parsed id of 0 is treated as unusable and falls back to
  the name selector; LauncherProfileStore.MergeRoster normalizes both
  sides through TryParse/ToHexString instead of raw string equality, so
  a legacy unprefixed-hex row self-heals via name match instead of
  duplicating.
- F11: StatusCharacterEntry.SecondsGreyedOut is now uint, matching
  CharacterRosterEntry and the host writer.
- F12: added MalformedStatusEvent, returned for a recognized `e` whose
  payload doesn't match its shape, distinguished from UnknownStatusEvent
  (an unrecognized `e`).

AllowUnsafeBlocks was added to AcDream.Launcher.Core.csproj — required
by the LibraryImport source generator's function-pointer marshalling
stub for F3's Linux SIGINT P/Invoke.

Verification: dotnet build AcDream.slnx -c Release green (0 errors);
dotnet test tests/AcDream.Launcher.Core.Tests -c Release green at 94/94
on native Windows and under WSL (Ubuntu, verified across multiple runs
for the timing-sensitive SIGINT/sharing-violation tests, no flakes
observed).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Erik 2026-08-14 16:29:39 +02:00
parent 37d74e4402
commit 26feba8186
19 changed files with 1101 additions and 105 deletions
Download patch file Download diff file Expand all files Collapse all files

13
tests/AcDream.Launcher.Core.Tests/Profiles/CharacterIdFormatTests.cs
View file

@ -14,8 +14,8 @@ public sealed class CharacterIdFormatTests
[Theory]
[InlineData("0x5000000A", 0x5000000Au)]
[InlineData("0x5000000a", 0x5000000Au)]
[InlineData("5000000A", 0x5000000Au)]
public void TryParseAcceptsWithAndWithoutPrefixAndCase(string text, uint expected)
[InlineData("0X5000000A", 0x5000000Au)]
public void TryParseAcceptsThe0xPrefixCaseInsensitively(string text, uint expected)
{
Assert.True(CharacterIdFormat.TryParse(text, out uint id));
Assert.Equal(expected, id);
@ -26,8 +26,15 @@ public sealed class CharacterIdFormatTests
[InlineData("")]
[InlineData(" ")]
[InlineData("not-hex")]
public void TryParseRejectsNullEmptyOrNonHex(string? text)
[InlineData("5000000A")]
[InlineData("12345678")]
public void TryParseRejectsNullEmptyNonHexOrAnUnprefixedString(string? text)
{
// "5000000A"/"12345678" are all-hex-digit strings that would
// parse fine as hex WITHOUT the "0x" prefix — review finding F10
// requires the prefix precisely so a hand-typed decimal id (which
// is ALSO syntactically valid hex) is never silently
// misinterpreted as one.
Assert.False(CharacterIdFormat.TryParse(text, out uint id));
Assert.Equal(0u, id);
}

102
tests/AcDream.Launcher.Core.Tests/Profiles/LauncherProfileStoreTests.cs
View file

@ -1,3 +1,4 @@
using System.Threading;
using AcDream.Launcher.Core.Profiles;
namespace AcDream.Launcher.Core.Tests.Profiles;
@ -284,4 +285,105 @@ public sealed class LauncherProfileStoreTests : IDisposable
UnixFileMode.UserRead | UnixFileMode.UserWrite,
mode);
}
[Fact]
public void SaveNeverLeavesTheTempFileWorldOrGroupReadableDuringTheWrite()
{
// Review finding F4: the temp file used to be created with the
// process's default umask and only chmod'd AFTER the atomic
// rename, leaving a window where the plaintext-credential temp
// file could be world/group-readable. The fix chmods the temp
// file immediately after creation, BEFORE any content (including
// the password) is serialized into it. A large document makes
// the write take long enough for a concurrent poller to have a
// real chance at observing a regression.
if (!OperatingSystem.IsLinux())
return;
var store = new LauncherProfileStore(_filePath);
store.Load();
store.AddServer("Local ACE", "127.0.0.1", 9000);
for (int i = 0; i < 300; i++)
{
store.AddAccount("Local ACE", $"account{i}", new string('x', 4096));
}
string tempPath = _filePath + ".tmp";
bool observedLooseMode = false;
bool stop = false;
var poller = new Thread(() =>
{
while (!Volatile.Read(ref stop))
{
if (File.Exists(tempPath))
{
try
{
// The platform-compat analyzer can't see the
// enclosing test method's `OperatingSystem.IsLinux()`
// guard across this lambda boundary; suppressed
// rather than restructured, since the guard is
// real and this whole method is a no-op off Linux.
#pragma warning disable CA1416
UnixFileMode mode = File.GetUnixFileMode(tempPath);
#pragma warning restore CA1416
if ((mode & ~(UnixFileMode.UserRead | UnixFileMode.UserWrite)) != 0)
{
observedLooseMode = true;
}
}
catch (IOException)
{
// Renamed/deleted between the Exists check and
// GetUnixFileMode — not a finding, just keep
// polling.
}
}
}
});
poller.Start();
store.Save();
Volatile.Write(ref stop, true);
poller.Join();
Assert.False(observedLooseMode);
}
[Fact]
public void SaveDeletesTheStaleTempFileWhenTheFinalRenameFails()
{
// Review finding F4: force the rename step to fail (the
// destination path names an existing DIRECTORY, which
// File.Move(..., overwrite: true) refuses to replace — Windows
// reports this as UnauthorizedAccessException, Linux as
// IOException, so the assertion below accepts either) and assert
// the temp file — which still carries the just-serialized
// plaintext credentials — doesn't linger on disk afterward.
Directory.CreateDirectory(_filePath);
var store = new LauncherProfileStore(_filePath);
store.Load();
store.AddServer("Local ACE", "127.0.0.1", 9000);
store.AddAccount("Local ACE", "testaccount", "testpassword");
Assert.ThrowsAny<Exception>(() => store.Save());
Assert.False(File.Exists(_filePath + ".tmp"));
}
[Fact]
public void LoadDeletesAStaleTempFileLeftBehindByACrashedSave()
{
// Review finding F4: a Save() that crashed between creating the
// temp file and the atomic rename leaves a ".tmp" carrying the
// same plaintext credentials as the real store. Load() cleans it
// up opportunistically the next time the store is opened.
File.WriteAllText(_filePath + ".tmp", """{"version":1,"servers":[]}""");
var store = new LauncherProfileStore(_filePath);
store.Load();
Assert.False(File.Exists(_filePath + ".tmp"));
}
}

26
tests/AcDream.Launcher.Core.Tests/Profiles/RosterMergeTests.cs
View file

@ -126,6 +126,32 @@ public sealed class RosterMergeTests
Assert.Contains(characters, c => c.Name == "+PendingDelete");
}
[Fact]
public void MergeNormalizesAnUnprefixedHexIdInsteadOfCreatingADuplicateRow()
{
// Review finding F10: a hand-edited row can carry an id without
// the "0x" prefix (e.g. copy-pasted from somewhere that dropped
// it). CharacterIdFormat.TryParse now REJECTS that string
// outright (it no longer guesses hex-without-a-prefix), so the
// old raw string-equality comparison against the roster's
// canonical "0x..." form would never match and would add a
// second row forever. The name-fallback match must still
// recognize this as the SAME character and self-heal its id.
LauncherProfileStore store = NewStoreWithServerAndAccount();
store.Document.Servers.Single().Accounts.Single().Characters.Add(
new CharacterProfile { Id = "5000000A", Name = "+Acdream" });
store.MergeRoster(
"Local ACE",
"testaccount",
[new CharacterRosterEntry(0x5000000A, "+Acdream", 0)]);
CharacterProfile character = Assert.Single(
store.Document.Servers.Single().Accounts.Single().Characters);
Assert.Equal("0x5000000A", character.Id);
Assert.Equal("+Acdream", character.Name);
}
[Fact]
public void MergeThrowsForUnknownServerOrAccount()
{