erik/acdream
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix(launcher): Campaign LA LA3 narrow review fixes

Browse source
This commit is contained in:
Erik 2026-08-14 17:06:47 +02:00
parent 26feba8186
commit 347a1a5d16
9 changed files with 495 additions and 145 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/AcDream.Launcher.Core/AcDream.Launcher.Core.csproj
View file

@ -12,6 +12,9 @@
context. -->
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
</PropertyGroup>
<ItemGroup>
<InternalsVisibleTo Include="AcDream.Launcher.Core.Tests" />
</ItemGroup>
<ItemGroup>
<ProjectReference Include="..\AcDream.Platform\AcDream.Platform.csproj" />
</ItemGroup>

105
src/AcDream.Launcher.Core/Launching/LauncherProcessSupervisor.cs
View file

@ -1,3 +1,5 @@
using System.Runtime.ExceptionServices;
namespace AcDream.Launcher.Core.Launching;
/// <summary>
@ -10,19 +12,41 @@ public sealed class LauncherProcessSupervisor : IDisposable
{
private readonly ILauncherChildProcessFactory _factory;
private readonly object _gate = new();
private readonly Queue<LauncherSessionState> _pendingStateChanges = [];
private ILauncherChildProcess? _process;
private LauncherSessionState _state = LauncherSessionState.Starting;
private int? _exitCode;
private bool _publishingStateChanges;
public LauncherProcessSupervisor(ILauncherChildProcessFactory? factory = null)
{
_factory = factory ?? new SystemChildProcessFactory();
}
public LauncherSessionState State { get; private set; } = LauncherSessionState.Starting;
public LauncherSessionState State
{
get
{
lock (_gate)
{
return _state;
}
}
}
/// <summary>Set once <see cref="State"/> reaches
/// <see cref="LauncherSessionState.Exited"/>; null before then.
/// </summary>
public int? ExitCode { get; private set; }
public int? ExitCode
{
get
{
lock (_gate)
{
return _exitCode;
}
}
}
/// <summary>Fires on every <see cref="LauncherSessionState"/>
/// transition, in order.</summary>
@ -148,14 +172,15 @@ public sealed class LauncherProcessSupervisor : IDisposable
private void OnProcessExited(object? sender, EventArgs e)
{
ILauncherChildProcess? process;
int? exitCode;
lock (_gate)
{
process = _process;
exitCode = _process is { HasExited: true } process
? process.ExitCode
: null;
}
ExitCode = process is { HasExited: true } ? process.ExitCode : null;
SetState(LauncherSessionState.Exited);
SetState(LauncherSessionState.Exited, exitCode);
}
/// <summary>
@ -171,19 +196,79 @@ public sealed class LauncherProcessSupervisor : IDisposable
/// — without this guard, "Running" would silently resurrect a
/// process that has already reported its exit.
/// </summary>
private void SetState(LauncherSessionState state)
private void SetState(LauncherSessionState state, int? exitCode = null)
{
bool publish;
lock (_gate)
{
if (State == LauncherSessionState.Exited)
if (_state == LauncherSessionState.Exited)
{
return;
}
State = state;
_state = state;
if (state == LauncherSessionState.Exited)
{
_exitCode = exitCode;
}
_pendingStateChanges.Enqueue(state);
publish = !_publishingStateChanges;
if (publish)
{
_publishingStateChanges = true;
}
}
StateChanged?.Invoke(this, state);
if (publish)
{
PublishPendingStateChanges();
}
}
/// <summary>
/// Drains state notifications through one publisher. Transition storage
/// stays under <see cref="_gate"/>, but user callbacks run outside it so
/// they may re-enter the supervisor or wait for another thread reading
/// state without deadlocking. A concurrent/re-entrant transition queues
/// behind the notification already in flight, preserving storage order in
/// the externally observed event stream.
/// </summary>
private void PublishPendingStateChanges()
{
Exception? firstException = null;
while (true)
{
LauncherSessionState state;
lock (_gate)
{
if (_pendingStateChanges.Count == 0)
{
_publishingStateChanges = false;
break;
}
state = _pendingStateChanges.Dequeue();
}
try
{
StateChanged?.Invoke(this, state);
}
catch (Exception ex)
{
// Preserve the previous propagation behavior, but finish
// publishing any transition already committed concurrently
// (especially terminal Exited) before rethrowing the first
// observer failure to the initiating caller.
firstException ??= ex;
}
}
if (firstException is not null)
{
ExceptionDispatchInfo.Capture(firstException).Throw();
}
}
public void Dispose()

60
src/AcDream.Launcher.Core/Profiles/LauncherProfileStore.cs
View file

@ -19,6 +19,8 @@ namespace AcDream.Launcher.Core.Profiles;
public sealed class LauncherProfileStore
{
internal const int CurrentVersion = 1;
internal const UnixFileMode OwnerOnlyFileMode =
UnixFileMode.UserRead | UnixFileMode.UserWrite;
private static readonly JsonSerializerOptions SerializerOptions = new()
{
@ -115,14 +117,12 @@ public sealed class LauncherProfileStore
/// <summary>
/// Persists <see cref="Document"/> to <see cref="FilePath"/> via a
/// write-then-atomic-rename so a crash mid-write never leaves a
/// truncated credentials file. On Linux, the temp file is chmod'd to
/// owner read/write (0600) immediately after creation — BEFORE any
/// plaintext credential is serialized into it — so there is no window
/// where the temp file carries the process umask's (potentially
/// world/group-readable) default permissions while holding a
/// password; the final path gets the same restriction after the
/// rename (Campaign LA's plaintext-credential decision, spec §5,
/// decisions log; the temp-file window itself is review finding F4).
/// truncated credentials file. On Linux, the temp file is created
/// atomically with owner read/write (0600) as its requested creation
/// mode — before its path is observable and before any plaintext
/// credential is serialized into it. The final path retains that mode
/// through the rename (Campaign LA's plaintext-credential decision,
/// spec §5, decisions log).
/// A failure between temp-file creation and the rename deletes the
/// stale temp file rather than leaving it behind.
/// </summary>
@ -135,15 +135,18 @@ public sealed class LauncherProfileStore
}
string tempPath = FilePath + ".tmp";
DeleteStaleTempFile(tempPath);
try
{
using (FileStream stream = File.Create(tempPath))
using (FileStream stream = CreateCredentialTempFile(tempPath))
{
if (OperatingSystem.IsLinux())
{
File.SetUnixFileMode(
tempPath,
UnixFileMode.UserRead | UnixFileMode.UserWrite);
// UnixCreateMode is subject to the process umask. It
// guarantees the file is never created with group/other
// access; normalize the owner bits while the still-empty
// file is open so the persisted contract is exactly 0600.
File.SetUnixFileMode(tempPath, OwnerOnlyFileMode);
}
JsonSerializer.Serialize(stream, Document, SerializerOptions);
@ -159,12 +162,39 @@ public sealed class LauncherProfileStore
if (OperatingSystem.IsLinux())
{
File.SetUnixFileMode(
FilePath,
UnixFileMode.UserRead | UnixFileMode.UserWrite);
File.SetUnixFileMode(FilePath, OwnerOnlyFileMode);
}
}
/// <summary>
/// Builds the exact options used for the plaintext-credential temp
/// file. <see cref="FileMode.CreateNew"/> makes creation atomic and
/// refuses to follow an existing stale or raced path. On Linux,
/// <see cref="FileStreamOptions.UnixCreateMode"/> supplies 0600 to
/// the OS create operation itself, eliminating the observable
/// create-then-chmod window. Windows leaves UnixCreateMode unset and
/// therefore retains its normal user-profile ACL behavior.
/// </summary>
internal static FileStreamOptions CreateCredentialTempFileOptions()
{
var options = new FileStreamOptions
{
Mode = FileMode.CreateNew,
Access = FileAccess.Write,
Share = FileShare.None,
};
if (OperatingSystem.IsLinux())
{
options.UnixCreateMode = OwnerOnlyFileMode;
}
return options;
}
internal static FileStream CreateCredentialTempFile(string tempPath) =>
new(tempPath, CreateCredentialTempFileOptions());
private static void DeleteStaleTempFile(string tempPath)
{
try

14
src/AcDream.Launcher.Core/Status/StatusEvent.cs
View file

@ -69,9 +69,9 @@ public sealed record ExitedStatusEvent : StatusEvent
}
/// <summary>
/// A well-formed status line whose <c>e</c> value (or overall envelope
/// shape) this reader does not recognize. The tailer never throws on an
/// unrecognized event — an older launcher reading a newer host's stream
/// A JSON-object status line whose non-empty string <c>e</c> value this
/// reader does not recognize. The tailer never throws on an unrecognized
/// event — an older launcher reading a newer host's stream
/// degrades to seeing <see cref="UnknownStatusEvent"/> rows instead of
/// crashing.
/// </summary>
@ -81,10 +81,10 @@ public sealed record UnknownStatusEvent : StatusEvent
}
/// <summary>
/// A status line whose <c>e</c> value IS one of the recognized event
/// names, but whose payload does not match that event's expected shape
/// (a missing required field, or a field present with the wrong JSON
/// kind). Distinguished from <see cref="UnknownStatusEvent"/> (Campaign
/// A complete JSON value that is not an object, an object without a
/// usable event name, or a known event whose pinned v1 envelope/payload
/// does not match its expected shape. Distinguished from
/// <see cref="UnknownStatusEvent"/> (Campaign
/// LA plan §LA3 review finding F12) so a launcher can tell "a newer/older
/// host sent an event I've never heard of" apart from "a host I recognize
/// sent me garbage for an event I do know" — the two cases call for

202
src/AcDream.Launcher.Core/Status/StatusEventParser.cs
View file

@ -11,13 +11,13 @@ namespace AcDream.Launcher.Core.Status;
/// "accountName":"...","slotCount":6,"characters":[...]}</c>.
///
/// <para>
/// Never throws: a null/blank/malformed-JSON line, an unrecognized
/// <c>e</c> value, or a recognized <c>e</c> whose payload doesn't match
/// that event's expected shape, all degrade to a typed event
/// (<see cref="UnknownStatusEvent"/> or <see cref="MalformedStatusEvent"/>
/// — see each type's docs) rather than an exception — a launcher must
/// keep tailing a session's status stream even against a host running a
/// newer/older wire version, or a host that briefly writes a torn line.
/// Never throws: a null/blank/malformed-JSON line, a complete JSON value
/// with a non-object root, an unrecognized <c>e</c> value, or a recognized
/// <c>e</c> whose envelope/payload does not match the pinned v1 shape all
/// degrade to a typed event (<see cref="UnknownStatusEvent"/> or
/// <see cref="MalformedStatusEvent"/>) rather than an exception. A launcher
/// must keep tailing a session's status stream even against a host running a
/// newer/older wire version or a host that writes a bad line.
/// </para>
/// </summary>
public static class StatusEventParser
@ -26,10 +26,6 @@ public static class StatusEventParser
{
if (string.IsNullOrWhiteSpace(line))
{
// Campaign LA plan §LA3 review finding F7: a blank/whitespace
// line is a normal "nothing complete here yet" degrade, not a
// caller error — the old ArgumentException.ThrowIfNullOrWhiteSpace
// guard ran BEFORE the try/catch below and escaped uncaught.
return UnknownEvent(line ?? string.Empty);
}
@ -46,14 +42,51 @@ public static class StatusEventParser
using (document)
{
JsonElement root = document.RootElement;
if (root.ValueKind != JsonValueKind.Object)
{
return MalformedEvent(
v: 0,
e: string.Empty,
t: default,
sessionId: string.Empty,
"status event root is not a JSON object.");
}
int v = GetInt32OrDefault(root, "v");
string e = GetStringOrDefault(root, "e");
DateTimeOffset t = GetDateTimeOffsetOrDefault(root, "t");
string sessionId = GetStringOrDefault(root, "sessionId");
if (!TryGetEventName(root, out string e, out string eventNameError))
{
return MalformedEvent(
GetInt32OrDefault(root, "v"),
e,
GetDateTimeOffsetOrDefault(root, "t"),
GetStringOrDefault(root, "sessionId"),
eventNameError);
}
// A genuinely unknown event name is the forward-compatibility
// case. Retain its best-effort envelope and raw JSON without
// imposing this launcher's known-event envelope/payload schema.
if (!IsKnownEventName(e))
{
return new UnknownStatusEvent
{
V = GetInt32OrDefault(root, "v"),
E = e,
T = GetDateTimeOffsetOrDefault(root, "t"),
SessionId = GetStringOrDefault(root, "sessionId"),
RawJson = line,
};
}
try
{
// The pinned v1 envelope applies to every known event,
// including payload-free started/connected rows. Defaulting
// malformed fields would turn corrupt or cross-version input
// into an apparently valid typed event.
int v = RequireVersionOne(root);
DateTimeOffset t = RequireUtcTimestamp(root, "t");
string sessionId = RequireNonEmptyString(root, "sessionId");
return e switch
{
"started" =>
@ -72,40 +105,62 @@ public static class StatusEventParser
ParseDisconnected(root, v, e, t, sessionId),
"exited" =>
ParseExited(root, v, e, t, sessionId),
_ =>
new UnknownStatusEvent
{
V = v,
E = e,
T = t,
SessionId = sessionId,
RawJson = line,
},
_ => throw new InvalidOperationException("known event dispatch is incomplete."),
};
}
catch (Exception ex) when (ex is FormatException or InvalidOperationException)
{
// FormatException: a Require* helper found a missing
// field or a field of the wrong JSON kind (e.g.
// "secondsGreyedOut": true"). InvalidOperationException:
// a JsonElement API call (EnumerateArray, TryGetProperty)
// against an element of the wrong ValueKind (e.g.
// "characters" present but not an array). Both mean `e`
// WAS recognized but its payload wasn't — distinguished
// from UnknownStatusEvent (Campaign LA plan §LA3 review
// finding F12).
return new MalformedStatusEvent
{
V = v,
E = e,
T = t,
SessionId = sessionId,
Error = ex.Message,
};
return MalformedEvent(
GetInt32OrDefault(root, "v"),
e,
GetDateTimeOffsetOrDefault(root, "t"),
GetStringOrDefault(root, "sessionId"),
ex.Message);
}
}
}
private static bool IsKnownEventName(string eventName) =>
eventName is
"started" or
"connected" or
"characterList" or
"enteredWorld" or
"pluginLoaded" or
"pluginFailed" or
"disconnected" or
"exited";
private static bool TryGetEventName(
JsonElement root,
out string eventName,
out string error)
{
if (!root.TryGetProperty("e", out JsonElement element))
{
eventName = string.Empty;
error = "status event is missing 'e'.";
return false;
}
if (element.ValueKind != JsonValueKind.String)
{
eventName = string.Empty;
error = "status event field 'e' is not a string.";
return false;
}
eventName = element.GetString() ?? string.Empty;
if (string.IsNullOrWhiteSpace(eventName))
{
error = "status event field 'e' is empty.";
return false;
}
error = string.Empty;
return true;
}
private static UnknownStatusEvent UnknownEvent(string rawLine) =>
new()
{
@ -116,6 +171,21 @@ public static class StatusEventParser
RawJson = rawLine,
};
private static MalformedStatusEvent MalformedEvent(
int v,
string e,
DateTimeOffset t,
string sessionId,
string error) =>
new()
{
V = v,
E = e,
T = t,
SessionId = sessionId,
Error = error,
};
private static StatusEvent ParseCharacterList(
JsonElement root,
int v,
@ -244,11 +314,8 @@ public static class StatusEventParser
string name) =>
root.TryGetProperty(name, out JsonElement element)
&& element.ValueKind == JsonValueKind.String
&& DateTimeOffset.TryParse(
element.GetString(),
System.Globalization.CultureInfo.InvariantCulture,
System.Globalization.DateTimeStyles.None,
out DateTimeOffset value)
&& element.TryGetDateTimeOffset(out DateTimeOffset value)
&& value.Offset == TimeSpan.Zero
? value
: default;
@ -273,11 +340,52 @@ public static class StatusEventParser
: throw new FormatException($"status event field '{name}' is not an integer.");
}
private static int RequireVersionOne(JsonElement root)
{
int version = RequireInt32(root, "v");
return version == 1
? version
: throw new FormatException(
$"status event version is {version}; expected 1.");
}
private static string RequireNonEmptyString(JsonElement root, string name)
{
string value = RequireString(root, name);
return !string.IsNullOrWhiteSpace(value)
? value
: throw new FormatException($"status event field '{name}' is empty.");
}
private static DateTimeOffset RequireUtcTimestamp(JsonElement root, string name)
{
JsonElement element = RequireProperty(root, name);
if (element.ValueKind != JsonValueKind.String)
{
throw new FormatException(
$"status event field '{name}' is not an ISO-8601 UTC string.");
}
string text = element.GetString() ?? string.Empty;
bool hasExplicitUtcOffset = text.EndsWith('Z')
|| text.EndsWith("+00:00", StringComparison.Ordinal);
if (!hasExplicitUtcOffset
|| !element.TryGetDateTimeOffset(out DateTimeOffset value)
|| value.Offset != TimeSpan.Zero)
{
throw new FormatException(
$"status event field '{name}' is not an ISO-8601 UTC timestamp.");
}
return value;
}
private static uint RequireUInt32(JsonElement root, string name)
{
JsonElement element = RequireProperty(root, name);
return element.ValueKind == JsonValueKind.Number && element.TryGetUInt32(out uint value)
? value
: throw new FormatException($"status event field '{name}' is not an unsigned integer.");
: throw new FormatException(
$"status event field '{name}' is not an unsigned integer.");
}
}