@synopackageland/cli 0.5.0 → 0.6.0

package/dist/templates/native-go-delegate/backend/internal/background/delegated.go

@@ -0,0 +1,277 @@
+package background
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"os"
+	"strings"
+	"time"
+
+	"golang.org/x/sys/unix"
+)
+
+const WorkerDownloadV1 = "download-to-folder-v1"
+
+// DelegationBinding is job metadata, never a session credential. It stays until
+// executor revocation succeeds, even if cancellation removes the job input.
+type DelegationBinding struct {
+	JobID           string    `json:"job_id"`
+	ExpiresAt       time.Time `json:"expires_at,omitzero"`
+	WaitingExecutor bool      `json:"waiting_executor,omitempty"`
+	DelegationID    string    `json:"delegation_id"`
+}
+
+func bindingName(id string) string { return "delegate-" + id + ".json" }
+
+// SubmitDelegated reserves a job under the spool lock, creates its grant without
+// the lock, then commits the binding. Workers cannot claim a pending reservation.
+func (s *Store) SubmitDelegated(ctx context.Context, req SubmitRequest, create func(string) (DelegationBinding, error), rollback func(DelegationBinding)) (Job, error) {
+	if len(req.Data) == 0 || len(req.Data) > MaxInputBytes || !keyRE.MatchString(req.Key) || !validName(req.Name) || !req.Submitter.Valid() {
+		return Job{}, ErrInvalid
+	}
+	digest := sha256hex(req.Data)
+	var out Job
+	reserved := false
+	err := s.withJournal(ctx, func(root *os.Root, j *journal) (bool, error) {
+		for _, job := range j.Jobs {
+			if job.Submitter == req.Submitter && job.Key == req.Key && !job.PurgeRequested {
+				if job.InputDigest != digest || job.Worker != WorkerDownloadV1 {
+					return false, ErrKeyConflict
+				}
+				if job.AdmissionPending {
+					return false, ErrBusy
+				}
+				out = job
+				return false, nil
+			}
+		}
+		pending, ownerBytes := j.ownerUsage(req.Submitter)
+		if pending >= MaxOwnerPending {
+			return false, ErrOwnerQueueFull
+		}
+		if ownerBytes+int64(len(req.Data)+resultReserve) > MaxOwnerBytes {
+			return false, ErrOwnerQuota
+		}
+		count, used := j.pending()
+		if count >= MaxQueued {
+			return false, ErrQueueFull
+		}
+		if used+int64(len(req.Data)+resultReserve) > s.limits.MaxTotalBytes {
+			return false, ErrQuota
+		}
+		// Executor outages must not create an unbounded cleanup journal.
+		dir, e := root.Open(".")
+		if e != nil {
+			return false, e
+		}
+		entries, e := dir.ReadDir(-1)
+		dir.Close()
+		if e != nil {
+			return false, e
+		}
+		bindings := 0
+		for _, entry := range entries {
+			if strings.HasPrefix(entry.Name(), "delegate-") && strings.HasSuffix(entry.Name(), ".json") {
+				bindings++
+			}
+		}
+		// Pending admissions can each create one cleanup record outside this lock.
+		for _, job := range j.Jobs {
+			if job.AdmissionPending {
+				bindings++
+			}
+		}
+		if bindings >= MaxHistory+MaxQueued {
+			return false, ErrQuota
+		}
+
+		id, e := newID()
+		if e != nil {
+			return false, e
+		}
+
+		if e = writeInput(root, id, req.Data); e != nil {
+			return false, e
+		}
+		reserved = true
+		out = Job{AdmissionPending: true, ID: id, Key: req.Key, Name: req.Name, State: StateQueued, Submitter: req.Submitter, Worker: WorkerDownloadV1, WorkerRevision: s.revision, InputDigest: digest, InputBytes: len(req.Data), SubmittedAt: s.now().UTC()}
+		j.Jobs = append(j.Jobs, out)
+		j.trim()
+		return true, nil
+	})
+	if err != nil || !reserved {
+		return out, err
+	}
+	binding, err := create(out.ID)
+	binding.JobID = out.ID
+	grant := binding.DelegationID
+	if err == nil && grant == "" {
+		err = ErrInvalid
+	}
+	if err == nil {
+		err = s.withJournal(ctx, func(root *os.Root, j *journal) (bool, error) {
+			if e := writeAtomic(root, bindingName(out.ID), binding); e != nil {
+				return false, e
+			}
+			job := find(j, out.ID)
+			if job == nil || !job.AdmissionPending || job.State != StateQueued || job.CancelRequested || job.PurgeRequested {
+				return false, ErrNotCancelable
+			}
+			job.AdmissionPending = false
+			job.DelegationID = grant
+			out = *job
+			return true, nil
+		})
+	}
+	if err != nil {
+		// Retain failed revocations independently of the request's canceled context.
+		cleanup, cancel := context.WithTimeout(context.Background(), RequestLockTimeout)
+		_ = s.withJournal(cleanup, func(root *os.Root, j *journal) (bool, error) {
+			if grant != "" {
+				if e := writeAtomic(root, bindingName(out.ID), binding); e != nil {
+					return false, e
+				}
+			}
+			job := find(j, out.ID)
+			if job == nil || !job.AdmissionPending {
+				return false, nil
+			}
+			job.AdmissionPending = false
+			if job.State == StateQueued {
+				s.finishJob(root, job, StateFailed, "delegation-uncommitted")
+			}
+			return true, nil
+		})
+		cancel()
+		if grant != "" {
+			rollback(binding)
+		}
+		return Job{}, err
+	}
+	return out, nil
+}
+func readBinding(root *os.Root, id string) (DelegationBinding, error) {
+	var b DelegationBinding
+	if !jobID.MatchString(id) {
+		return b, ErrInvalid
+	}
+	f, e := root.OpenFile(bindingName(id), os.O_RDONLY|unix.O_NOFOLLOW, 0)
+	if e != nil {
+		return b, e
+	}
+	defer f.Close()
+	if e = checkPrivate(f); e != nil {
+		return b, e
+	}
+	data, e := io.ReadAll(io.LimitReader(f, 4097))
+	if e != nil || len(data) > 4096 || json.Unmarshal(data, &b) != nil || b.JobID != id || b.DelegationID == "" {
+		return b, ErrInvalid
+	}
+	return b, nil
+}
+func (s *Store) Delegation(ctx context.Context, id string) (DelegationBinding, error) {
+	var b DelegationBinding
+	e := s.withJournal(ctx, func(root *os.Root, _ *journal) (bool, error) {
+		var e error
+		b, e = readBinding(root, id)
+		return false, e
+	})
+	return b, e
+}
+
+// DelegationCleanup includes orphaned grants and canceled/running jobs. The
+// independent metadata record makes restart and executor outages retryable.
+func (s *Store) DelegationCleanup(ctx context.Context) ([]DelegationBinding, error) {
+	out := []DelegationBinding{}
+	e := s.withJournal(ctx, func(root *os.Root, j *journal) (bool, error) {
+		dir, e := root.Open(".")
+		if e != nil {
+			return false, e
+		}
+		defer dir.Close()
+		entries, e := dir.ReadDir(-1)
+		if e != nil {
+			return false, e
+		}
+		for _, entry := range entries {
+			n := entry.Name()
+			if !strings.HasPrefix(n, "delegate-") || !strings.HasSuffix(n, ".json") {
+				continue
+			}
+			id := strings.TrimSuffix(strings.TrimPrefix(n, "delegate-"), ".json")
+			b, e := readBinding(root, id)
+			if e != nil {
+				return false, e
+			}
+			job := find(j, id)
+			if job == nil || job.State.terminal() || job.CancelRequested || job.PurgeRequested {
+				out = append(out, b)
+			}
+		}
+		return false, nil
+	})
+	return out, e
+}
+func (s *Store) ForgetDelegation(ctx context.Context, id string) error {
+	return s.withJournal(ctx, func(root *os.Root, _ *journal) (bool, error) {
+		if !jobID.MatchString(id) {
+			return false, ErrInvalid
+		}
+		e := root.Remove(bindingName(id))
+		if errors.Is(e, os.ErrNotExist) {
+			return false, nil
+		}
+		if e != nil {
+			return false, e
+		}
+		return false, syncDir(root, ".")
+	})
+}
+
+// SetExecutorWaiting updates only the delegation sidecar. The claimed journal
+// slot remains reserved, preserving quotas and cancellation/recovery semantics.
+// No journal lock survives this method, a socket call, or a retry timer.
+func (s *Store) SetExecutorWaiting(ctx context.Context, id string, waiting bool) error {
+	return s.withJournal(ctx, func(root *os.Root, j *journal) (bool, error) {
+		job := find(j, id)
+		if job == nil || job.State != StateRunning {
+			return false, ErrNotRunning
+		}
+		if job.CancelRequested || job.PurgeRequested {
+			return false, context.Canceled
+		}
+		binding, err := readBinding(root, id)
+		if err != nil {
+			return false, err
+		}
+		binding.WaitingExecutor = waiting
+		return false, writeAtomic(root, bindingName(id), binding)
+	})
+}
+
+// ListDelegatedFor reads job state and waiting metadata in one short snapshot,
+// avoiding a race with terminal cleanup removing the delegation sidecar.
+func (s *Store) ListDelegatedFor(ctx context.Context, access Access) ([]Job, error) {
+	out := []Job{}
+	err := s.withJournal(ctx, func(root *os.Root, j *journal) (bool, error) {
+		for _, job := range j.Jobs {
+			if job.Worker != WorkerDownloadV1 || !access.sees(job) {
+				continue
+			}
+			if job.State == StateRunning {
+				binding, err := readBinding(root, job.ID)
+				if err != nil {
+					return false, err
+				}
+				if binding.WaitingExecutor {
+					job.State = "waiting_executor"
+				}
+			}
+			out = append(out, job)
+		}
+		return false, nil
+	})
+	return out, err
+}

package/dist/templates/native-go-delegate/backend/internal/background/delegated_test.go

@@ -0,0 +1,34 @@
+package background
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestPendingRevocationJournalBoundsAdmission(t *testing.T) {
+	s := NewStore(filepath.Join(t.TempDir(), "spool"))
+	ctx := context.Background()
+	e := s.withJournal(ctx, func(root *os.Root, _ *journal) (bool, error) {
+		for i := 0; i < MaxHistory+MaxQueued; i++ {
+			id := fmt.Sprintf("%032x", i)
+			if e := writeAtomic(root, bindingName(id), DelegationBinding{JobID: id, DelegationID: "grant"}); e != nil {
+				return false, e
+			}
+		}
+		return false, nil
+	})
+	if e != nil {
+		t.Fatal(e)
+	}
+	_, e = s.SubmitDelegated(ctx, SubmitRequest{Key: "key", Name: "file", Data: []byte("input"), Submitter: Submitter{User: "alice", UID: "1205"}}, func(string) (DelegationBinding, error) {
+		t.Error("created grant despite cleanup backlog")
+		return DelegationBinding{DelegationID: "grant"}, nil
+	}, func(DelegationBinding) {})
+	if !errors.Is(e, ErrQuota) {
+		t.Fatalf("got %v, want revocation backlog quota", e)
+	}
+}

package/dist/templates/native-go-delegate/backend/internal/delegate/busy_review_test.go

@@ -0,0 +1,15 @@
+package delegate
+
+import (
+	"dsmapp/internal/api"
+	"dsmapp/internal/background"
+	"errors"
+	"testing"
+)
+
+func TestReviewBusyJournalHasRetryableStableCode(t *testing.T) {
+	var out *api.Error
+	if !errors.As(jobError(background.ErrBusy), &out) || out.Code != "jobs_busy" {
+		t.Fatalf("bounded lock timeout mapped to generic error: %+v", out)
+	}
+}

package/dist/templates/native-go-delegate/backend/internal/delegate/client.go

@@ -0,0 +1,143 @@
+// Package delegate provides the fixed v1 executor protocol. Credentials exist
+// only in a live request; workers carry a delegation and job binding instead.
+package delegate
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"dsmapp/internal/api"
+	"encoding/json"
+	"errors"
+	"io"
+	"net"
+	"regexp"
+	"time"
+	"unicode/utf8"
+)
+
+const MaxFrame = 64 * 1024
+
+var stableCode = regexp.MustCompile(`^[A-Za-z][A-Za-z0-9_-]{0,127}$`)
+
+type Request struct {
+	V      int               `json:"v"`
+	Op     string            `json:"op"`
+	Auth   map[string]string `json:"auth,omitempty"`
+	Params json.RawMessage   `json:"params"`
+}
+type Client struct {
+	Socket  string
+	Timeout time.Duration
+}
+
+func Local(packageID string) *Client {
+	return &Client{Socket: "/run/synopkgland/" + packageID + "/executor.sock", Timeout: 20 * time.Second}
+}
+func fail(code string) error {
+	return &api.Error{Code: code, Message: "Executor operation refused (" + code + ")"}
+}
+
+// dialFailure means no connection was established and no request bytes were
+// sent. Unwrap preserves the public API code without exposing socket details.
+type dialFailure struct{ error }
+
+func (e *dialFailure) Unwrap() error { return e.error }
+
+// Call uses one connection per request, including its newline in the size
+// budget. Refusal codes survive unchanged; executor messages never expose
+// cookie values or internal paths through the CGI response.
+func (c *Client) Call(parent context.Context, op string, auth map[string]string, params any, result any) error {
+	if parent.Err() != nil {
+		return fail("canceled")
+	}
+	if c == nil || c.Socket == "" {
+		return fail("EXECUTOR_UNAVAILABLE")
+	}
+	p, e := json.Marshal(params)
+	if e != nil {
+		return fail("invalid-request")
+	}
+	if params == nil {
+		p = []byte("{}")
+	}
+	b, e := json.Marshal(Request{V: 1, Op: op, Auth: auth, Params: p})
+	if e != nil {
+		return fail("invalid-request")
+	}
+	b = append(b, '\n')
+	if len(b) > MaxFrame {
+		return fail("EXECUTOR_TOO_LARGE")
+	}
+	timeout := c.Timeout
+	if timeout <= 0 {
+		timeout = 20 * time.Second
+	}
+	ctx, cancel := context.WithTimeout(parent, timeout)
+	defer cancel()
+	transport := func(err error) error {
+		if parent.Err() != nil {
+			return fail("canceled")
+		}
+		if ctx.Err() != nil {
+			return fail("EXECUTOR_TIMEOUT")
+		}
+		var ne net.Error
+		if errors.As(err, &ne) && ne.Timeout() {
+			return fail("EXECUTOR_TIMEOUT")
+		}
+		return fail("EXECUTOR_UNAVAILABLE")
+	}
+	conn, e := (&net.Dialer{}).DialContext(ctx, "unix", c.Socket)
+	if e != nil {
+		if parent.Err() != nil {
+			return fail("canceled")
+		}
+		return &dialFailure{transport(e)}
+	}
+	defer conn.Close()
+	stop := context.AfterFunc(ctx, func() { conn.Close() })
+	defer stop()
+	deadline, _ := ctx.Deadline()
+	if e = conn.SetDeadline(deadline); e != nil {
+		return transport(e)
+	}
+	if _, e = io.Copy(conn, bytes.NewReader(b)); e != nil {
+		return transport(e)
+	}
+	line, e := bufio.NewReader(io.LimitReader(conn, MaxFrame+1)).ReadBytes('\n')
+	if len(line) > MaxFrame {
+		return fail("EXECUTOR_TOO_LARGE")
+	}
+	if e != nil {
+		if !errors.Is(e, io.EOF) {
+			return transport(e)
+		}
+		return fail("EXECUTOR_PROTOCOL")
+	}
+	if !utf8.Valid(line) {
+		return fail("EXECUTOR_PROTOCOL")
+	}
+	var reply struct {
+		OK      *bool           `json:"ok"`
+		Result  json.RawMessage `json:"result"`
+		Code    string          `json:"code"`
+		Message string          `json:"message"`
+	}
+	if json.Unmarshal(line, &reply) != nil || reply.OK == nil {
+		return fail("EXECUTOR_PROTOCOL")
+	}
+	if !*reply.OK {
+		if !stableCode.MatchString(reply.Code) {
+			return fail("EXECUTOR_PROTOCOL")
+		}
+		return fail(reply.Code)
+	}
+	if len(reply.Result) == 0 || string(reply.Result) == "null" || reply.Result[0] != '{' {
+		return fail("EXECUTOR_PROTOCOL")
+	}
+	if result != nil && json.Unmarshal(reply.Result, result) != nil {
+		return fail("EXECUTOR_PROTOCOL")
+	}
+	return nil
+}

package/dist/templates/native-go-delegate/backend/internal/delegate/client_test.go

@@ -0,0 +1,214 @@
+package delegate
+
+import (
+	"bufio"
+	"context"
+	"dsmapp/internal/api"
+	"encoding/json"
+	"errors"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func executor(t *testing.T, serve func(Request) string) *Client {
+	t.Helper()
+	dir, err := os.MkdirTemp("", "ds-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.RemoveAll(dir) })
+	socket := filepath.Join(dir, "s")
+	l, err := net.Listen("unix", socket)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { l.Close() })
+	go func() {
+		for {
+			conn, e := l.Accept()
+			if e != nil {
+				return
+			}
+			go func() {
+				defer conn.Close()
+				var q Request
+				json.NewDecoder(bufio.NewReader(conn)).Decode(&q)
+				_, _ = conn.Write([]byte(serve(q)))
+			}()
+		}
+	}()
+	return &Client{Socket: socket, Timeout: 100 * time.Millisecond}
+}
+func code(t *testing.T, err error, want string) {
+	t.Helper()
+	var e *api.Error
+	if !errors.As(err, &e) || e.Code != want {
+		t.Fatalf("got %v, want %s", err, want)
+	}
+}
+func TestClientProtocolAndStableRefusals(t *testing.T) {
+	for _, stable := range []string{"DENIED", "DELEGATION_EXPIRED", "SCOPE_DENIED", "ACCOUNT_DISABLED", "POLICY_DENIED", "FILE_EXISTS", "FUTURE_CODE"} {
+		t.Run(stable, func(t *testing.T) {
+			c := executor(t, func(q Request) string {
+				if q.V != 1 || q.Op != "status" {
+					t.Errorf("wire: %+v", q)
+				}
+				return `{"ok":false,"code":"` + stable + `","message":"secret cookie"}` + "\n"
+			})
+			code(t, c.Call(context.Background(), "status", nil, nil, nil), stable)
+		})
+	}
+}
+func TestClientUnavailableTimeoutAndCancellation(t *testing.T) {
+	c := &Client{Socket: filepath.Join(t.TempDir(), "absent")}
+	code(t, c.Call(context.Background(), "status", nil, nil, nil), "EXECUTOR_UNAVAILABLE")
+	c = executor(t, func(Request) string { time.Sleep(150 * time.Millisecond); return "" })
+	code(t, c.Call(context.Background(), "status", nil, nil, nil), "EXECUTOR_TIMEOUT")
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	code(t, c.Call(ctx, "status", nil, nil, nil), "canceled")
+}
+func TestClientBoundsAndMalformedResponses(t *testing.T) {
+	for _, response := range []string{`{}`, `{"ok":true}`, `{"ok":true,"result":{}} trailing` + "\n", strings.Repeat("x", MaxFrame+1), `{"ok":true,"result":{}}`} {
+		t.Run(response[:min(len(response), 24)], func(t *testing.T) {
+			c := executor(t, func(Request) string { return response })
+			if c.Call(context.Background(), "status", nil, nil, nil) == nil {
+				t.Fatal("accepted invalid frame")
+			}
+		})
+	}
+	c := executor(t, func(Request) string { t.Error("oversized request sent"); return "" })
+	code(t, c.Call(context.Background(), "status", nil, map[string]string{"x": strings.Repeat("x", MaxFrame)}, nil), "EXECUTOR_TOO_LARGE")
+}
+func TestFilesStagingAndTypedOperations(t *testing.T) {
+	dir := t.TempDir()
+	os.Chmod(dir, 0700)
+	seen := map[string]bool{}
+	c := executor(t, func(q Request) string {
+		seen[q.Op] = true
+		if q.Auth != nil {
+			t.Error("offline op had auth")
+		}
+		var p map[string]any
+		json.Unmarshal(q.Params, &p)
+		if p["delegation_id"] != "d1" || p["job_id"] != "j1" {
+			t.Errorf("binding %+v", p)
+		}
+		if q.Op == "files.write" {
+			name := p["staging"].(string)
+			if filepath.Base(name) != name || name == "chosen.txt" {
+				t.Error("unsafe staging")
+			}
+			b, e := os.ReadFile(filepath.Join(dir, name))
+			if e != nil || string(b) != "content" {
+				t.Errorf("staged %q %v", b, e)
+			}
+		}
+		switch q.Op {
+		case "files.list":
+			for key := range p {
+				if key != "path" && key != "delegation_id" && key != "job_id" {
+					return `{"ok":false,"code":"INVALID_REQUEST"}` + "\n"
+				}
+			}
+			return `{"ok":true,"result":{"files":[],"total":0,"offset":0}}` + "\n"
+		case "files.info":
+			return `{"ok":true,"result":{"files":[{"path":"/home","name":"home","isdir":true}]}}` + "\n"
+		default:
+			return `{"ok":true,"result":{}}` + "\n"
+		}
+	})
+	f := JobContext{Client: c, JobID: "j1", DelegationID: "d1", StagingDir: dir}.Files()
+	if _, e := f.List(context.Background(), "/home", ListOptions{}); e != nil {
+		t.Fatal(e)
+	}
+	if info, e := f.Info(context.Background(), "/home"); e != nil || !info.IsDir || info.Path != "/home" {
+		t.Fatalf("info: %+v %v", info, e)
+	}
+	if e := f.CreateFolder(context.Background(), "/home", "new"); e != nil {
+		t.Fatal(e)
+	}
+	if e := f.CheckPermission(context.Background(), "/home"); e != nil {
+		t.Fatal(e)
+	}
+	if e := f.Write(context.Background(), "/home", "chosen.txt", strings.NewReader("content"), 7); e != nil {
+		t.Fatal(e)
+	}
+	entries, _ := os.ReadDir(dir)
+	if len(entries) != 0 || len(seen) != 5 {
+		t.Fatalf("cleanup %v ops %v", entries, seen)
+	}
+}
+func TestStagingCleanupOnRefusalLimitAndReadFailure(t *testing.T) {
+	c := executor(t, func(Request) string { return `{"ok":false,"code":"DENIED"}` + "\n" })
+	dir := t.TempDir()
+	os.Chmod(dir, 0700)
+	f := JobContext{Client: c, JobID: "j", DelegationID: "d", StagingDir: dir}.Files()
+	code(t, f.Write(context.Background(), "/home", "a", strings.NewReader("abc"), 3), "DENIED")
+	code(t, f.Write(context.Background(), "/home", "../bad", strings.NewReader("a"), 1), "invalid-request")
+	code(t, f.Write(context.Background(), "/home", "a", strings.NewReader("abc"), 2), "limit-exceeded")
+	if files, _ := os.ReadDir(dir); len(files) != 0 {
+		t.Fatal("staging leaked")
+	}
+}
+
+func TestClientRejectsNonObjectAndInvalidRefusalCodes(t *testing.T) {
+	for _, response := range []string{`{"ok":true,"result":[]}`, `{"ok":false,"code":"secret\nvalue"}`} {
+		c := executor(t, func(Request) string { return response + "\n" })
+		code(t, c.Call(context.Background(), "status", nil, nil, nil), "EXECUTOR_PROTOCOL")
+	}
+}
+
+type brokenReader struct{}
+
+func (brokenReader) Read([]byte) (int, error) { return 0, errors.New("source failed") }
+func TestWriteCleansStagingWhenSourceFails(t *testing.T) {
+	c := executor(t, func(Request) string { t.Error("failed read reached executor"); return "" })
+	dir := t.TempDir()
+	os.Chmod(dir, 0700)
+	f := JobContext{Client: c, JobID: "j", DelegationID: "d", StagingDir: dir}.Files()
+	code(t, f.Write(context.Background(), "/home", "file", brokenReader{}, 3), "STAGING_UNAVAILABLE")
+	if files, _ := os.ReadDir(dir); len(files) != 0 {
+		t.Fatal("staging leaked")
+	}
+}
+
+func TestDialFailureIsDistinctFromAcceptedRequestFailure(t *testing.T) {
+	c := &Client{Socket: filepath.Join(t.TempDir(), "missing")}
+	var dial *dialFailure
+	err := c.Call(context.Background(), "files.write", nil, nil, nil)
+	if !errors.As(err, &dial) {
+		t.Fatalf("missing socket must be safe to retry: %v", err)
+	}
+	code(t, err, "EXECUTOR_UNAVAILABLE")
+	// A socket inode without a listener produces ECONNREFUSED.
+	c = executor(t, func(Request) string { return "" })
+	l, err := net.Listen("unix", filepath.Join(t.TempDir(), "refused"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	l.(*net.UnixListener).SetUnlinkOnClose(false)
+	c.Socket = l.Addr().String()
+	l.Close()
+	err = c.Call(context.Background(), "files.write", nil, nil, nil)
+	if !errors.As(err, &dial) {
+		t.Fatalf("refused dial must be safe to retry: %v", err)
+	}
+	c = executor(t, func(Request) string { return "" })
+	err = c.Call(context.Background(), "files.write", nil, nil, nil)
+	dial = nil
+	if errors.As(err, &dial) {
+		t.Fatalf("accepted request must never be replayed: %v", err)
+	}
+	code(t, err, "EXECUTOR_PROTOCOL")
+	c = executor(t, func(Request) string { return `{"ok":false,"code":"EXECUTOR_UNAVAILABLE"}` + "\n" })
+	err = c.Call(context.Background(), "files.write", nil, nil, nil)
+	if errors.As(err, &dial) {
+		t.Fatal("executor refusal must not be treated as a dial failure")
+	}
+	code(t, err, "EXECUTOR_UNAVAILABLE")
+}