@rehearsal-labs/retest 0.2.0 → 0.3.0

package/media/src/recording.rs

@@ -307,13 +307,14 @@ impl Recording {
             plan.fps,
             &plan.partial_path(),
         );
-        let mut child = encoder::spawn_in_group(ffmpeg, &arguments, Stdio::piped(), Stdio::null())
-            .map_err(|error| EncoderFailure {
-                message: format!("{} could not be started: {error}", ffmpeg.display()),
-                exit: None,
-            })?;
+        let (mut child, mut ownership) =
+            encoder::spawn_owned(ffmpeg, &arguments, Stdio::piped(), Stdio::null()).map_err(
+                |error| EncoderFailure {
+                    message: format!("{} could not be started: {error}", ffmpeg.display()),
+                    exit: None,
+                },
+            )?;
         let encoder_pid = child.id();
-        let mut ownership = Ownership::new(encoder_pid);
         let mut problems = ownership.capture();
         if !problems.is_empty() {
             drop(child.stdin.take());
@@ -1364,6 +1365,13 @@ fn finalize_within(
         .stdin(Stdio::null())
         .stdout(Stdio::piped())
         .stderr(Stdio::null());
+    // A media process started without a console would give the finalizer a console window of its own, which on a
+    // desktop opens at each recording's end and can take the focus from a browser under test.
+    #[cfg(windows)]
+    {
+        use std::os::windows::process::CommandExt;
+        command.creation_flags(windows_sys::Win32::System::Threading::CREATE_NO_WINDOW);
+    }
     #[cfg(debug_assertions)]
     for name in [
         "RETEST_MEDIA_TEST_NO_HARD_LINKS",
@@ -1399,7 +1407,7 @@ fn finalize_within(
         };
         match status {
             Some(status) => {
-                #[cfg(debug_assertions)]
+                #[cfg(all(debug_assertions, unix))]
                 if std::env::var_os("RETEST_MEDIA_TEST_KILL_DURING_COPY").is_some()
                     && encoder::signal_of(status) == Some(9)
                 {

package/media/src/replies.rs

@@ -19,6 +19,7 @@ const ADMISSION_WAIT: Duration = Duration::from_millis(100);
 const WRITER_CLOSE_WAIT: Duration = Duration::from_millis(500);
 
 /// Duplicating stdout keeps a blocked writer away from Rust's global stdout shutdown flush.
+#[cfg(unix)]
 pub fn stdout_pipe() -> io::Result<std::fs::File> {
     use std::os::fd::FromRawFd;
     // SAFETY: F_DUPFD_CLOEXEC creates a separately owned descriptor, atomically closed on child exec. File
@@ -31,6 +32,30 @@ pub fn stdout_pipe() -> io::Result<std::fs::File> {
     Ok(unsafe { std::fs::File::from_raw_fd(fd) })
 }
 
+/// Duplicating stdout keeps a blocked writer away from Rust's global stdout shutdown flush. The duplicate cannot be
+/// inherited. Windows gives a new process every inheritable handle of its parent, not only its standard ones, so the
+/// standard handles the client gave this process stop being inheritable too: an encoder, or anything it leaves
+/// running, then holds none of the client's pipes open.
+#[cfg(windows)]
+pub fn stdout_pipe() -> io::Result<std::fs::File> {
+    use std::os::windows::io::{AsHandle, AsRawHandle};
+    use windows_sys::Win32::Foundation::{HANDLE_FLAG_INHERIT, SetHandleInformation};
+    let streams = [
+        io::stdin().as_raw_handle(),
+        io::stdout().as_raw_handle(),
+        io::stderr().as_raw_handle(),
+    ];
+    for handle in streams.into_iter().filter(|handle| !handle.is_null()) {
+        // SAFETY: a standard handle of this process; only its inheritance flag changes. A console handle that refuses
+        // the change was never inheritable by an encoder, which gets its own pipes and no console.
+        unsafe { SetHandleInformation(handle, HANDLE_FLAG_INHERIT, 0) };
+    }
+    // `try_clone_to_owned` duplicates without inheritance.
+    Ok(std::fs::File::from(
+        io::stdout().as_handle().try_clone_to_owned()?,
+    ))
+}
+
 #[derive(Debug, Default, PartialEq, Eq)]
 pub struct ReplyClose {
     pub replies_dropped: u64,
@@ -332,6 +357,7 @@ mod tests {
         })
     }
 
+    #[cfg(unix)]
     #[test]
     fn the_writer_stdout_descriptor_is_closed_when_an_encoder_executes() {
         use std::os::fd::AsRawFd;
@@ -347,6 +373,35 @@ mod tests {
         );
     }
 
+    #[cfg(windows)]
+    #[test]
+    fn the_writer_stdout_handle_and_the_standard_handles_are_not_inherited_by_an_encoder() {
+        use std::os::windows::io::AsRawHandle;
+        use windows_sys::Win32::Foundation::{GetHandleInformation, HANDLE_FLAG_INHERIT};
+        let flags_of = |handle| {
+            let mut flags = 0u32;
+            // SAFETY: GetHandleInformation only reads the flags of a live handle of this process.
+            let read = unsafe { GetHandleInformation(handle, &mut flags) };
+            assert_ne!(read, 0, "handle flags are readable");
+            flags
+        };
+        let output = stdout_pipe().expect("stdout duplicate");
+        // HANDLE_FLAG_INHERIT is the property that would let a lingering encoder retain the media pipe.
+        assert_eq!(
+            flags_of(output.as_raw_handle()) & HANDLE_FLAG_INHERIT,
+            0,
+            "an encoder child must never inherit the reply pipe"
+        );
+        let stdout = io::stdout().as_raw_handle();
+        if !stdout.is_null() {
+            assert_eq!(
+                flags_of(stdout) & HANDLE_FLAG_INHERIT,
+                0,
+                "nor the stdout the client reads"
+            );
+        }
+    }
+
     #[test]
     fn replies_are_written_whole_and_in_order() {
         let output = Shared::default();

package/media/src/server.rs

@@ -831,7 +831,7 @@ impl Server {
         };
         let output = Path::new(&request.output);
         if !output.is_absolute()
-            || request.output.ends_with('/')
+            || request.output.ends_with(std::path::is_separator)
             || request.output.len() > MAX_PATH_BYTES
         {
             let message = format!(
@@ -841,6 +841,12 @@ impl Server {
                 .replies
                 .send(&Reply::Leftovers(reply("invalid", Some(message))));
         }
+        #[cfg(windows)]
+        if let Some(message) = windows_name_problem(output) {
+            return self
+                .replies
+                .send(&Reply::Leftovers(reply("invalid", Some(message))));
+        }
         if let Some(user) = self.output_user(output) {
             return self.replies.send(&Reply::Leftovers(reply(
                 "in_use",
@@ -1227,18 +1233,53 @@ fn in_range<T: PartialOrd + std::fmt::Display>(
 
 fn check_output(output: &str) -> Result<PathBuf, String> {
     let path = Path::new(output);
-    if !path.is_absolute() || output.ends_with('/') || output.len() > MAX_PATH_BYTES {
+    if !path.is_absolute()
+        || output.ends_with(std::path::is_separator)
+        || output.len() > MAX_PATH_BYTES
+    {
         return Err(format!(
             "the output must be an absolute file path without its extension, at most {MAX_PATH_BYTES} bytes; it is {}",
             output.chars().take(200).collect::<String>()
         ));
     }
+    #[cfg(windows)]
+    if let Some(message) = windows_name_problem(path) {
+        return Err(message);
+    }
     match path.parent() {
         Some(folder) if folder.is_dir() => Ok(path.to_path_buf()),
         _ => Err(format!("the output's folder does not exist: {output}")),
     }
 }
 
+// Why Windows would not take the output's file name as a file of its own: a character it refuses, among them `:`, which
+// names a stream inside another file, or a device name such as `con` or `nul`, with any extension.
+#[cfg(windows)]
+fn windows_name_problem(output: &Path) -> Option<String> {
+    let name = output.file_name()?.to_string_lossy();
+    if name
+        .chars()
+        .any(|character| character < ' ' || "<>:\"|?*".contains(character))
+    {
+        return Some(format!(
+            "the output's file name {name} holds a character Windows refuses in a file name"
+        ));
+    }
+    let stem = name
+        .split('.')
+        .next()
+        .unwrap_or_default()
+        .trim_end_matches(' ');
+    let upper = stem.to_ascii_uppercase();
+    let numbered = |prefix: &str| {
+        upper.strip_prefix(prefix).is_some_and(|number| {
+            number.chars().count() == 1 && "0123456789\u{b9}\u{b2}\u{b3}".contains(number)
+        })
+    };
+    (["CON", "PRN", "AUX", "NUL"].contains(&upper.as_str()) || numbered("COM") || numbered("LPT"))
+        .then(|| format!("the output's file name {name} is a device name on Windows"))
+}
+
 // The encoder's answer to what it can do, asked once in the background as the process starts. Nothing waits for it
 // but a shutdown, which waits for it to end so no encoder of it is left running; the loop polls it.
 struct Probe {
@@ -1555,4 +1596,33 @@ mod tests {
             }
         );
     }
+
+    #[cfg(windows)]
+    #[test]
+    fn output_names_windows_refuses_are_refused_by_name() {
+        let folder = std::env::temp_dir();
+        for name in [
+            "con",
+            "NUL",
+            "com1",
+            "Lpt9",
+            "aux.recording",
+            "prn ",
+            "recording:stream",
+            "a?b",
+            "a|b",
+        ] {
+            let refused = check_output(&folder.join(name).to_string_lossy()).expect_err(name);
+            assert!(refused.contains("Windows"), "{refused}");
+        }
+        for name in ["recording-1", "console", "com10", "nullable", "lpt"] {
+            let output = folder.join(name);
+            assert!(check_output(&output.to_string_lossy()).is_ok(), "{name}");
+        }
+        let folder_named = format!("{}\\", folder.join("recording").display());
+        assert!(
+            check_output(&folder_named).is_err(),
+            "a trailing backslash names a folder"
+        );
+    }
 }

package/media/src/store.rs

@@ -5,9 +5,14 @@
 //! reader never sees a place whose bytes are not there yet. The file is the process's own working file: it is
 //! removed when the recording is released, when the process shuts down, or, after the process was killed, by the
 //! client or by a `leftovers` request.
+//!
+//! A reader reads at an offset and never moves the writer's place. On Unix a cloned handle reads with `pread`; on
+//! Windows a cloned handle would share the writer's file pointer, which a positioned read moves, so a reader has a
+//! handle of its own on the same file.
 
 use std::fs::{self, File, OpenOptions};
 use std::io::{self, Write};
+#[cfg(unix)]
 use std::os::unix::fs::FileExt;
 use std::path::{Path, PathBuf};
 use std::sync::Mutex;
@@ -117,7 +122,7 @@ impl FrameStore {
             .as_ref()
             .ok_or_else(|| io::Error::from(io::ErrorKind::NotFound))?;
         Ok(StoreReader {
-            file: file.try_clone()?,
+            file: reading_handle(file)?,
         })
     }
 
@@ -146,11 +151,62 @@ pub struct StoreReader {
 impl StoreReader {
     pub fn read(&self, offset: u64, length: u32) -> io::Result<Vec<u8>> {
         let mut bytes = vec![0u8; length as usize];
-        self.file.read_exact_at(&mut bytes, offset)?;
+        read_exact_at(&self.file, &mut bytes, offset)?;
         Ok(bytes)
     }
 }
 
+#[cfg(unix)]
+fn reading_handle(file: &File) -> io::Result<File> {
+    file.try_clone()
+}
+
+#[cfg(unix)]
+fn read_exact_at(file: &File, bytes: &mut [u8], offset: u64) -> io::Result<()> {
+    file.read_exact_at(bytes, offset)
+}
+
+// ReOpenFile opens the very file the handle names, not its path, with a file pointer of its own. The writer's handle
+// was opened sharing reads, writes and removal, so this one can share them too.
+#[cfg(windows)]
+fn reading_handle(file: &File) -> io::Result<File> {
+    use std::os::windows::io::{AsRawHandle, FromRawHandle};
+    use windows_sys::Win32::Storage::FileSystem::{
+        FILE_GENERIC_READ, FILE_SHARE_DELETE, FILE_SHARE_READ, FILE_SHARE_WRITE, ReOpenFile,
+    };
+    // SAFETY: the handle is the writer's live file handle; ReOpenFile returns a new handle or INVALID_HANDLE_VALUE.
+    let handle = unsafe {
+        ReOpenFile(
+            file.as_raw_handle(),
+            FILE_GENERIC_READ,
+            FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+            0,
+        )
+    };
+    if handle == windows_sys::Win32::Foundation::INVALID_HANDLE_VALUE {
+        return Err(io::Error::last_os_error());
+    }
+    // SAFETY: the new handle is valid and owned by nothing else.
+    Ok(unsafe { File::from_raw_handle(handle) })
+}
+
+#[cfg(windows)]
+fn read_exact_at(file: &File, mut bytes: &mut [u8], mut offset: u64) -> io::Result<()> {
+    use std::os::windows::fs::FileExt;
+    while !bytes.is_empty() {
+        match file.seek_read(bytes, offset) {
+            Ok(0) => return Err(io::Error::from(io::ErrorKind::UnexpectedEof)),
+            Ok(read) => {
+                bytes = &mut bytes[read..];
+                offset += read as u64;
+            }
+            Err(error) if error.kind() == io::ErrorKind::Interrupted => {}
+            Err(error) => return Err(error),
+        }
+    }
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -176,6 +232,19 @@ mod tests {
         assert!(!store.path().exists());
     }
 
+    #[test]
+    fn reading_frames_back_never_moves_where_the_next_frame_is_written() {
+        let store = FrameStore::create(path("interleaved"), 1024).expect("created");
+        assert_eq!(store.append(b"first"), Ok(0));
+        let reader = store.reader().expect("opens");
+        assert_eq!(reader.read(0, 2).expect("reads"), b"fi");
+        assert_eq!(store.append(b"second"), Ok(5));
+        assert_eq!(reader.read(1, 3).expect("reads"), b"irs");
+        assert_eq!(store.append(b"third"), Ok(11));
+        assert_eq!(reader.read(0, 16).expect("reads"), b"firstsecondthird");
+        assert!(store.remove());
+    }
+
     #[test]
     fn a_reader_reads_the_store_s_own_file_even_after_its_path_names_another() {
         let target = path("reopen");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rehearsal-labs/retest",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "One test across web, mobile and desktop. Built for software engineers and coding agents.",
   "type": "module",
   "license": "Apache-2.0",
@@ -57,6 +57,11 @@
     "media/Cargo.lock",
     "media/build.rs",
     "media/src/*.rs",
+    "supervisor/Cargo.toml",
+    "supervisor/Cargo.lock",
+    "supervisor/build.rs",
+    "supervisor/src/*.rs",
+    "supervisor/NOTICES",
     "LICENSE",
     "src/cli/install/media-notices.txt",
     "src/cli/install/licences/**"
@@ -66,9 +71,9 @@
     "provenance": true
   },
   "scripts": {
-    "build": "node -e \"fs.rmSync('dist', { recursive: true, force: true })\" && node_modules/typescript/bin/tsc -p tsconfig.build.json && node scripts/write-schemas.ts",
-    "typecheck": "node_modules/typescript/bin/tsc -p tsconfig.json && node_modules/typescript-7/bin/tsc -p tsconfig.json && node_modules/typescript/bin/tsc -p examples/tasks/tsconfig.json",
-    "typecheck:proofs": "node_modules/typescript/bin/tsc -p proofs/firefox/tsconfig.json && node_modules/typescript-7/bin/tsc -p proofs/firefox/tsconfig.json && node_modules/typescript/bin/tsc -p proofs/webkit/tsconfig.json && node_modules/typescript-7/bin/tsc -p proofs/webkit/tsconfig.json && node_modules/typescript/bin/tsc -p proofs/native/tsconfig.json && node_modules/typescript-7/bin/tsc -p proofs/native/tsconfig.json && node_modules/typescript/bin/tsc -p proofs/media/tsconfig.json && node_modules/typescript-7/bin/tsc -p proofs/media/tsconfig.json",
+    "build": "node -e \"fs.rmSync('dist', { recursive: true, force: true })\" && node node_modules/typescript/bin/tsc -p tsconfig.build.json && node scripts/write-schemas.ts",
+    "typecheck": "node node_modules/typescript/bin/tsc -p tsconfig.json && node node_modules/typescript-7/bin/tsc -p tsconfig.json && node node_modules/typescript/bin/tsc -p examples/tasks/tsconfig.json",
+    "typecheck:proofs": "node node_modules/typescript/bin/tsc -p proofs/firefox/tsconfig.json && node node_modules/typescript-7/bin/tsc -p proofs/firefox/tsconfig.json && node node_modules/typescript/bin/tsc -p proofs/webkit/tsconfig.json && node node_modules/typescript-7/bin/tsc -p proofs/webkit/tsconfig.json && node node_modules/typescript/bin/tsc -p proofs/native/tsconfig.json && node node_modules/typescript-7/bin/tsc -p proofs/native/tsconfig.json && node node_modules/typescript/bin/tsc -p proofs/media/tsconfig.json && node node_modules/typescript-7/bin/tsc -p proofs/media/tsconfig.json",
     "test:unit": "node --conditions=retest-source --test \"tests/unit/**/*.test.ts\"",
     "test:types": "node tests/types/run.ts",
     "test:integration": "node --conditions=retest-source --test --test-concurrency=1 \"tests/integration/**/*.test.ts\"",