dsh-ris-yds 0.0.0-stage → 1.1.0

package/test/pidfile.test.mjs

@@ -0,0 +1,105 @@
+// Pidfile handling when the process identity cannot be read. "Could not tell" used to
+// be treated as "not our process", which deleted the pidfile and either started a
+// second YMS/forwarder on top of a live one or left an orphan unreachable by
+// `yds stop` (review D-P1-6). These tests drive the Windows/timeout path through the
+// injectable probe options so they run on the Linux CI too.
+import assert from 'node:assert/strict'
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import test from 'node:test'
+
+import { probeForwarder, socksPidFile, stopForwarder } from '../lib/socks.js'
+import { readRunning, stopYms, ymsPidFile } from '../lib/yms.js'
+
+const WIN = 'win32'
+const unknownExec = () => ({ code: null, stdout: '', stderr: '', error: new Error('powershell timed out') })
+const absentExec = () => ({ code: 0, stdout: 'YDS_PROBE_ABSENT', stderr: '', error: null })
+const aliveExec = (commandLine) => () => ({ code: 0, stdout: `YDS_PROBE_OK:${commandLine}`, stderr: '', error: null })
+
+function makeCfg() {
+  const stateDir = mkdtempSync(join(tmpdir(), 'yds-pid-'))
+  return { stateDir, dbForwardPort: 47431, redisForwardPort: 47432 }
+}
+
+function withCfg(fn) {
+  return async () => {
+    const cfg = makeCfg()
+    try { await fn(cfg) } finally { rmSync(cfg.stateDir, { recursive: true, force: true }) }
+  }
+}
+
+test('yms: an unreadable identity keeps the pidfile and refuses to signal', withCfg(async (cfg) => {
+  writeFileSync(ymsPidFile(cfg), '4242')
+  const running = await readRunning(cfg, { platform: WIN, exec: unknownExec })
+  assert.equal(running.state, 'unknown')
+  assert.equal(running.pid, 4242)
+  assert.equal(existsSync(ymsPidFile(cfg)), true, 'pidfile must survive a probe failure')
+  assert.match(readFileSync(ymsPidFile(cfg), 'utf8'), /4242/)
+
+  const stopped = await stopYms(cfg, { platform: WIN, exec: unknownExec, graceMs: 10 })
+  assert.equal(stopped.stopped, false)
+  assert.match(String(stopped.reason), /未发送停止信号/)
+  assert.equal(existsSync(ymsPidFile(cfg)), true, 'still ours as far as we know: keep the pidfile')
+}))
+
+test('yms: a dead or reused pid is cleaned from the pidfile', withCfg(async (cfg) => {
+  writeFileSync(ymsPidFile(cfg), '4242')
+  assert.equal(await readRunning(cfg, { platform: WIN, exec: absentExec }), null)
+  assert.equal(existsSync(ymsPidFile(cfg)), false)
+
+  writeFileSync(ymsPidFile(cfg), '4242')
+  // Alive but a completely different command line: the pid was reused after a crash.
+  assert.equal(await readRunning(cfg, { platform: WIN, exec: aliveExec('notepad.exe') }), null)
+  assert.equal(existsSync(ymsPidFile(cfg)), false)
+}))
+
+test('yms: a verified owner is reported, and a failed stop keeps the pidfile', withCfg(async (cfg) => {
+  writeFileSync(ymsPidFile(cfg), '4344')
+  const owners = aliveExec('java -cp yms.jar iuap.yms.YMSLauncher')
+  assert.deepEqual(await readRunning(cfg, { platform: WIN, exec: owners }), { pid: 4344 })
+
+  // taskkill failed but the process is still alive: report the failure, keep the
+  // pidfile so `yds status` keeps seeing it (review D-P1-7).
+  const denied = () => ({ code: 5, stdout: '', stderr: 'Access is denied.', error: null })
+  const failed = await stopYms(cfg, { platform: WIN, exec: denied, probe: () => ({ state: 'alive', commandLine: '' }), graceMs: 10 })
+  assert.equal(failed.stopped, false)
+  assert.match(String(failed.reason), /已保留 pidfile/)
+  assert.equal(existsSync(ymsPidFile(cfg)), true)
+
+  // A successful stop is the only path that unlinks the pidfile. (The same fake exec
+  // answers the identity probe and taskkill: both exit 0, and the command line still
+  // identifies the YMS.)
+  assert.equal((await stopYms(cfg, { platform: WIN, exec: owners })).stopped, true)
+  assert.equal(existsSync(ymsPidFile(cfg)), false)
+}))
+
+test('socks: an unreadable forwarder identity keeps the pidfile', withCfg(async (cfg) => {
+  writeFileSync(socksPidFile(cfg), '4343')
+  const probe = probeForwarder(cfg, { platform: WIN, exec: unknownExec })
+  assert.equal(probe.state, 'unknown')
+  assert.equal(probe.pid, null, 'no pid is handed out while the identity is unreadable')
+  assert.equal(existsSync(socksPidFile(cfg)), true)
+
+  const stopped = await stopForwarder(cfg, { platform: WIN, exec: unknownExec })
+  assert.equal(stopped.stopped, false)
+  assert.equal(existsSync(socksPidFile(cfg)), true)
+}))
+
+test('socks: a dead or reused forwarder pid is cleaned', withCfg(async (cfg) => {
+  writeFileSync(socksPidFile(cfg), '4343')
+  assert.equal(probeForwarder(cfg, { platform: WIN, exec: absentExec }).state, 'stale')
+  assert.equal(existsSync(socksPidFile(cfg)), false)
+
+  writeFileSync(socksPidFile(cfg), '4343')
+  const foreign = probeForwarder(cfg, { platform: WIN, exec: aliveExec('some-other-daemon') })
+  assert.equal(foreign.state, 'stale')
+  assert.equal(existsSync(socksPidFile(cfg)), false)
+}))
+
+test('socks: the verified forwarder is recognised as ours', withCfg(async (cfg) => {
+  writeFileSync(socksPidFile(cfg), '4343')
+  const probe = probeForwarder(cfg, { platform: WIN, exec: aliveExec('node yds.js socks-fwd --socks=1.2.3.4:1080') })
+  assert.equal(probe.state, 'verified')
+  assert.equal(probe.pid, 4343)
+}))

package/test/proc.test.mjs

@@ -0,0 +1,172 @@
+import assert from 'node:assert/strict'
+import { spawn } from 'node:child_process'
+import test from 'node:test'
+
+import { pidAlive, processCommandLine, stopPid } from '../lib/proc.js'
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+
+test('processCommandLine reads the current command line on this platform', () => {
+  const line = processCommandLine(process.pid)
+  assert.match(line, /node/i, 'contains the node executable')
+  assert.equal(processCommandLine(0), '')
+  assert.equal(processCommandLine(-1), '')
+  assert.equal(processCommandLine('nope'), '')
+})
+
+test('pidAlive tells live from gone pids', () => {
+  assert.equal(pidAlive(process.pid), true)
+  assert.equal(pidAlive(2147480000), false)
+})
+
+test('stopPid ends a real child process and tolerates a dead pid', async () => {
+  const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' })
+  await sleep(300)
+  assert.equal(pidAlive(child.pid), true)
+  await stopPid(child.pid, { graceMs: 3000 })
+  await sleep(800)
+  assert.equal(pidAlive(child.pid), false)
+  await stopPid(child.pid, { graceMs: 500 }) // already gone: must not throw
+})
+
+// ---- Windows branches, driven through the injectable platform/exec -----------------
+// CI runs on Linux, so the Windows path is only exercised when the platform and the
+// command runner are injected. These tests pin the two behaviours the review found
+// broken: "could not tell" must never become "not ours", and a failed taskkill must
+// never be reported as a successful stop.
+
+import { pidIdentity, probePid, signalState, windowsProbeArgs } from '../lib/proc.js'
+
+const WIN = 'win32'
+const okOut = (stdout) => ({ code: 0, stdout, stderr: '', error: null })
+
+test('windowsProbeArgs uses a single-quoted WQL predicate and only the integer pid', () => {
+  const args = windowsProbeArgs(4242)
+  assert.deepEqual(args.slice(0, -1), ['-NoProfile', '-NonInteractive', '-Command'])
+  const script = args.at(-1)
+  assert.match(script, /-Filter 'ProcessId=4242'/)
+  assert.ok(!script.includes('"ProcessId'), 'no double quotes embedded in -Command')
+})
+
+test('probePid distinguishes absent, readable and unknowable on Windows', () => {
+  assert.deepEqual(probePid(11, { platform: WIN, exec: () => okOut('YDS_PROBE_ABSENT\n') }), { state: 'dead', commandLine: '' })
+  const alive = probePid(11, { platform: WIN, exec: () => okOut('YDS_PROBE_OK:C:\\jdk\\bin\\java.exe -jar yms.jar') })
+  assert.equal(alive.state, 'alive')
+  assert.match(alive.commandLine, /yms\.jar/)
+  // Empty output / access denied / timeout: cannot tell => unknown (never dead).
+  assert.equal(probePid(11, { platform: WIN, exec: () => okOut('') }).state, 'unknown')
+  assert.equal(probePid(11, { platform: WIN, exec: () => ({ code: 1, stdout: '', stderr: 'Access is denied.', error: null }) }).state, 'unknown')
+  assert.equal(probePid(11, { platform: WIN, exec: () => ({ code: null, stdout: '', stderr: '', error: new Error('ETIMEDOUT') }) }).state, 'unknown')
+  // An invalid pid is dead without spawning anything.
+  let spawned = 0
+  assert.equal(probePid(0, { platform: WIN, exec: () => { spawned += 1; return okOut('') } }).state, 'dead')
+  assert.equal(spawned, 0)
+})
+
+test('pidIdentity separates ours/foreign/dead/unknown on Windows', () => {
+  const markers = ['yms.jar']
+  const identity = (stdout) => pidIdentity(7, markers, { platform: WIN, exec: () => okOut(stdout) }).state
+  assert.equal(identity('YDS_PROBE_OK:java -jar yms.jar'), 'ours')
+  assert.equal(identity('YDS_PROBE_OK:notepad.exe'), 'foreign')
+  assert.equal(identity('YDS_PROBE_ABSENT'), 'dead')
+  assert.equal(identity('YDS_PROBE_OK:'), 'unknown', 'alive but unreadable command line is NOT foreign')
+  assert.equal(identity('garbage'), 'unknown')
+})
+
+test('a readable process with no command line is unknown, not foreign (POSIX too)', () => {
+  const base = { platform: 'linux', signal: () => 'alive' }
+  assert.equal(pidIdentity(7, ['yms.jar'], { ...base, commandLine: () => '' }).state, 'unknown')
+  assert.equal(pidIdentity(7, ['yms.jar'], { ...base, commandLine: () => '/usr/bin/java -jar yms.jar' }).state, 'ours')
+})
+
+test('signalState maps EPERM to alive and ESRCH to dead', () => {
+  // pid 1 always exists; as an unprivileged user kill(1,0) throws EPERM, which must
+  // count as alive (the old code mapped every error to "dead").
+  assert.equal(signalState(1), 'alive')
+  assert.equal(signalState(2147480000), 'dead')
+})
+
+test('stopPid consumes the taskkill exit code instead of assuming success', async () => {
+  const calls = []
+  const execOk = (command, args) => { calls.push([command, args]); return { code: 0, stdout: '', stderr: '', error: null } }
+  assert.deepEqual(await stopPid(555, { platform: WIN, exec: execOk }), { ok: true, code: 0 })
+  assert.deepEqual(calls[0], ['taskkill', ['/PID', '555', '/T', '/F']])
+
+  // The process exited between probe and taskkill: nonzero exit, but it is gone.
+  const execGone = () => ({ code: 128, stdout: '', stderr: 'not found', error: null })
+  assert.equal((await stopPid(555, { platform: WIN, exec: execGone, probe: () => ({ state: 'dead' }) })).ok, true)
+
+  // A real failure must be reported with the reason, and the caller keeps the pidfile.
+  const execDenied = () => ({ code: 5, stdout: '', stderr: 'Access is denied.', error: null })
+  const failed = await stopPid(555, { platform: WIN, exec: execDenied, probe: () => ({ state: 'alive', commandLine: '' }) })
+  assert.equal(failed.ok, false)
+  assert.match(String(failed.error), /Access is denied/)
+})
+
+test('the absent marker is matched exactly, never as a substring of a command line', async () => {
+  const { probePid } = await import('../lib/proc.js')
+  const WIN = 'win32'
+  const okOut = (stdout) => ({ code: 0, stdout, stderr: '', error: null })
+  // A live java process whose own command line quotes the probe marker must stay alive.
+  const alive = probePid(11, { platform: WIN, exec: () => okOut('YDS_PROBE_OK:java -Dtag=YDS_PROBE_ABSENT -jar yms.jar') })
+  assert.equal(alive.state, 'alive')
+  assert.match(alive.commandLine, /YDS_PROBE_ABSENT/)
+  // Extra noise around the absent marker is not proof: only the exact output is dead.
+  assert.equal(probePid(11, { platform: WIN, exec: () => okOut('YDS_PROBE_ABSENT\nsome warning') }).state, 'unknown')
+})
+
+test('probe results are only cached for the real Windows probe', async () => {
+  const { probePid, clearProbeCache } = await import('../lib/proc.js')
+  const WIN = 'win32'
+  let calls = 0
+  const exec = () => { calls += 1; return { code: 0, stdout: 'YDS_PROBE_ABSENT', stderr: '', error: null } }
+  probePid(4242, { platform: WIN, exec })
+  probePid(4242, { platform: WIN, exec })
+  assert.equal(calls, 2, 'an injected executor is never cached (tests must see every probe)')
+  clearProbeCache(4242)
+  assert.equal(typeof clearProbeCache, 'function')
+})
+
+test('a forced stop signals through the injected kill and verifies the result', async () => {
+  const { stopPid } = await import('../lib/proc.js')
+  const POSIX = 'linux'
+  const signals = []
+  const kill = (pid, sig) => { signals.push([pid, sig]); return { ok: true } }
+  // Gone after SIGKILL: success.
+  assert.deepEqual(
+    await stopPid(777, { force: true, platform: POSIX, kill, probe: () => ({ state: 'dead' }) }),
+    { ok: true, code: null },
+  )
+  assert.deepEqual(signals, [[777, 'SIGKILL']], 'the injected kill is used, not process.kill')
+
+  // SIGKILL did not work (uninterruptible/foreign): report failure instead of claiming it.
+  const stubborn = await stopPid(778, { force: true, platform: POSIX, kill, probe: () => ({ state: 'alive', commandLine: '' }) })
+  assert.equal(stubborn.ok, false)
+  assert.match(String(stubborn.error), /SIGKILL 后进程仍存活/)
+
+  // A kill that fails outright also reports its reason.
+  const denied = await stopPid(779, {
+    force: true, platform: POSIX, kill: () => ({ ok: false, error: 'operation not permitted' }), probe: () => ({ state: 'alive' }),
+  })
+  assert.equal(denied.ok, false)
+  assert.match(String(denied.error), /not permitted/)
+})
+
+test('a graceful stop skips the kill when the injected TERM already succeeded', async () => {
+  const { stopPid } = await import('../lib/proc.js')
+  const POSIX = 'linux'
+  const signals = []
+  const kill = (pid, sig) => { signals.push(sig); return { ok: true } }
+  const result = await stopPid(780, { platform: POSIX, graceMs: 300, kill, probe: () => ({ state: 'dead' }) })
+  assert.deepEqual(result, { ok: true, code: null })
+  assert.deepEqual(signals, ['SIGTERM'])
+})
+
+test('a detached child is stopped as a process group', async () => {
+  const { stopPid } = await import('../lib/proc.js')
+  const signals = []
+  const kill = (pid, sig) => { signals.push([pid, sig]); return { ok: true } }
+  const result = await stopPid(781, { force: true, group: true, platform: 'linux', kill, probe: () => ({ state: 'dead' }) })
+  assert.equal(result.ok, true)
+  assert.deepEqual(signals, [[-781, 'SIGKILL']], 'the group leader pid is negated')
+})

package/test/proxy-standalone.test.mjs

@@ -0,0 +1,121 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import net from 'node:net'
+
+import { run } from '../lib/cli.js'
+
+// The suite inherits the developer's shell: strip every YDS_* override, then
+// force the "dsh-ris-ide is not installed" path — the bundled SOCKS forwarder
+// is the only tunnel left, which is exactly the standalone (public plugin)
+// shape.
+for (const key of Object.keys(process.env)) {
+  if (key.startsWith('YDS_')) delete process.env[key]
+}
+process.env.YDS_IDE_PROXY = 'none'
+// The risd tier reads `~/.dsh-ris-ide` by default; a developer's daemon running on
+// the machine must not decide this test's outcome. Point it at a fresh home.
+process.env.DSH_RIS_IDE_PROXY_HOME = mkdtempSync(join(tmpdir(), 'yds-standalone-risd-'))
+
+const DB_PORT = 24531
+const REDIS_PORT = 26891
+
+const MIDDLEWARE = {
+  connectionPools: {
+    pool1: { url: 'jdbc:oracle:thin:@//172.20.235.80:1521/yonbipdev' },
+  },
+  'redis.pools': {
+    redis1: { host: '172.20.235.81', port: 6890 },
+  },
+}
+
+function ok(result) {
+  // text() reports success without an exitCode; fail() sets 1.
+  assert.equal(result.exitCode ?? 0, 0, result.text)
+}
+
+function portOpen(port) {
+  return new Promise((resolve) => {
+    const socket = net.connect(port, '127.0.0.1')
+    socket.once('connect', () => { socket.destroy(); resolve(true) })
+    socket.once('error', () => resolve(false))
+  })
+}
+
+/** A workspace with a cached confcenter pull; `socks` adds the tunnel .env. */
+function workspace({ socks }) {
+  const dir = mkdtempSync(join(tmpdir(), 'yds-standalone-'))
+  mkdirSync(join(dir, '.dsh-ris-yds', 'confcenter'), { recursive: true })
+  writeFileSync(join(dir, '.dsh-ris-yds', 'yms-port'), '65001')
+  writeFileSync(join(dir, '.dsh-ris-yds', 'confcenter', 'yms_middleware.json'), JSON.stringify(MIDDLEWARE))
+  if (socks === true) {
+    writeFileSync(join(dir, '.env'), [
+      'socks.host = 127.0.0.1',
+      'socks.port = 1080',
+      `socks.dbPort = ${DB_PORT}`,
+      `socks.redisPort = ${REDIS_PORT}`,
+      '',
+    ].join('\n'))
+  }
+  return dir
+}
+
+test('without dsh-ris-ide a direct workspace needs no tunnel at all', async () => {
+  const dir = workspace({ socks: false })
+  try {
+    const sync = await run(['proxy', 'sync'], { cwd: dir })
+    ok(sync)
+    assert.match(sync.text, /直连模式/)
+    const status = await run(['proxy', 'status'], { cwd: dir })
+    ok(status)
+    assert.match(status.text, /代理引擎不可用/)
+    assert.match(status.text, /不适用（未配置 SOCKS，直连模式）/)
+    // No tunnel => the sibling plugin has nothing to offer, so no hint either.
+    const doctor = await run(['doctor'], { cwd: dir })
+    ok(doctor)
+    assert.doesNotMatch(doctor.text, /未检测到 dsh-ris-ide/)
+    assert.equal(await portOpen(DB_PORT), false)
+  } finally {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+test('without dsh-ris-ide the bundled forwarder replaces the borrowed engine', async () => {
+  const dir = workspace({ socks: true })
+  try {
+    const sync = await run(['proxy', 'sync'], { cwd: dir })
+    ok(sync)
+    assert.match(sync.text, /代理引擎不可用/)
+    assert.match(sync.text, /内置 socks 转发器已启动/)
+    assert.equal(await portOpen(DB_PORT), true, 'Oracle 兜底端口由内置转发器监听')
+    assert.equal(await portOpen(REDIS_PORT), true, 'Redis 兜底端口由内置转发器监听')
+
+    const status = await run(['proxy', 'status'], { cwd: dir })
+    ok(status)
+    assert.match(status.text, /内置转发器: 运行中/)
+    assert.match(status.text, /172\.20\.235\.80:1521/)
+
+    // Tunnel without the borrowed engine: recommend the sibling plugin once, as
+    // an optional upgrade — never as a broken setup.
+    const doctor = await run(['doctor'], { cwd: dir })
+    ok(doctor)
+    assert.match(doctor.text, /未检测到 dsh-ris-ide（可选）/)
+    assert.match(doctor.text, /启停本地服务/)
+
+    // Starting twice is idempotent (no duplicate process / EADDRINUSE).
+    const again = await run(['proxy', 'start'], { cwd: dir })
+    ok(again)
+    assert.match(again.text, /已在运行/)
+
+    const stop = await run(['proxy', 'stop'], { cwd: dir })
+    ok(stop)
+    assert.match(stop.text, /内置转发器已停止/)
+    assert.equal(await portOpen(DB_PORT), false)
+    assert.equal(await portOpen(REDIS_PORT), false)
+  } finally {
+    await run(['proxy', 'stop'], { cwd: dir }).catch(() => {})
+    rmSync(dir, { recursive: true, force: true })
+  }
+})

package/test/risd-leases.test.mjs

@@ -0,0 +1,111 @@
+// The lease record on disk is how a short-lived CLI hands a long-lived tunnel
+// ownership to the YMS process, so it must survive two `yds start` runs in
+// different workspaces and a writer that died between read and write.
+//
+// Review D-P2-6: the file used to be a bare read-modify-write (a lost update
+// dropped the other workspace's lease, leaving the daemon to reap an engine a
+// live YMS still needed) and a leftover `.lock` had no recovery path.
+import assert from 'node:assert/strict'
+import { spawn } from 'node:child_process'
+import {
+  existsSync, mkdirSync, mkdtempSync, openSync, closeSync, readFileSync, readdirSync, rmSync, statSync, utimesSync, writeFileSync,
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { after, before, test } from 'node:test'
+
+import { dropDeadLease, forgetLease, readLease, rememberLease } from '../lib/risd-peer.js'
+
+const PEER = pathToFileURL(join(import.meta.dirname, '..', 'lib', 'risd-peer.js')).href
+
+let root
+let home
+
+before(() => {
+  root = mkdtempSync(join(tmpdir(), 'yds-risd-leases-'))
+  home = join(root, '.dsh-ris-ide')
+  mkdirSync(home, { recursive: true })
+})
+
+after(() => {
+  rmSync(root, { recursive: true, force: true })
+})
+
+function leasesFile() {
+  return join(root, '.dsh-ris-yds', 'risd-leases.json')
+}
+
+test('a lease round-trips and is written 0600 without leaving temp files', () => {
+  const cwd = '/ws/one'
+  assert.equal(rememberLease(cwd, { id: 'lease-1', ownerPid: process.pid, port: 11081 }, { home }), true)
+  const entry = readLease(cwd, { home })
+  assert.equal(entry.id, 'lease-1')
+  assert.equal(entry.ownerPid, process.pid)
+  assert.equal(typeof entry.at, 'string', 'timestamp for debugging a stale record')
+  assert.equal(statSync(leasesFile()).mode & 0o777, 0o600)
+  assert.deepEqual(readdirSync(join(root, '.dsh-ris-yds')).filter((name) => name.endsWith('.tmp')), [])
+  forgetLease(cwd, { home })
+  assert.equal(readLease(cwd, { home }), null)
+  assert.equal(existsSync(join(root, '.dsh-ris-yds', 'risd-leases.json.lock')), false, 'lock released')
+})
+
+test('a stale lease is dropped only when its owner is gone', () => {
+  const live = '/ws/live'
+  const dead = '/ws/dead'
+  rememberLease(live, { id: 'lease-live', ownerPid: process.pid, port: 1 }, { home })
+  rememberLease(dead, { id: 'lease-dead', ownerPid: 999999, port: 1 }, { home })
+  assert.equal(dropDeadLease(live, { home }), false)
+  assert.notEqual(readLease(live, { home }), null, 'a live owner keeps its lease')
+  assert.equal(dropDeadLease(dead, { home }), true)
+  assert.equal(readLease(dead, { home }), null, 'a dead owner does not keep the engine alive')
+})
+
+test('an abandoned lock file is stolen instead of blocking every later start', () => {
+  const cwd = '/ws/stale-lock'
+  const lock = `${leasesFile()}.lock`
+  mkdirSync(join(root, '.dsh-ris-yds'), { recursive: true })
+  writeFileSync(lock, '12345')
+  const old = new Date(Date.now() - 60_000)
+  utimesSync(lock, old, old)
+  assert.equal(rememberLease(cwd, { id: 'lease-stale', ownerPid: process.pid, port: 1 }, { home }), true)
+  assert.notEqual(readLease(cwd, { home }), null)
+  assert.equal(existsSync(lock), false)
+})
+
+test('a held lock degrades to a bounded unlocked write instead of hanging yds', () => {
+  const cwd = '/ws/held-lock'
+  const lock = `${leasesFile()}.lock`
+  mkdirSync(join(root, '.dsh-ris-yds'), { recursive: true })
+  const fd = openSync(lock, 'wx')
+  const started = Date.now()
+  try {
+    // The holder is this very process (never released), so the client must give up
+    // on the lock and still record the lease: a missing record is worse.
+    assert.equal(rememberLease(cwd, { id: 'lease-held', ownerPid: process.pid, port: 1 }, { home }), true)
+    const waited = Date.now() - started
+    assert.ok(waited < 4000, `bounded wait (waited ${waited}ms)`)
+    assert.notEqual(readLease(cwd, { home }), null)
+  } finally {
+    closeSync(fd)
+    rmSync(lock, { force: true })
+  }
+})
+
+test('concurrent writers in different workspaces never drop each other', async () => {
+  const count = 6
+  const code = `import { rememberLease } from ${JSON.stringify(PEER)};
+rememberLease(process.argv[1], { id: process.argv[2], ownerPid: process.pid, port: 1 }, { home: process.argv[3] })`
+  const children = Array.from({ length: count }, (_, index) => new Promise((resolve) => {
+    const cwd = `/ws/concurrent-${index}`
+    const child = spawn(process.execPath, ['--input-type=module', '-e', code, cwd, `lease-c${index}`, home], { stdio: 'ignore' })
+    child.once('exit', (code_) => resolve({ cwd, id: `lease-c${index}`, code: code_ }))
+  }))
+  const results = await Promise.all(children)
+  assert.deepEqual(results.filter((row) => row.code !== 0), [], 'every writer exited cleanly')
+  const all = JSON.parse(readFileSync(leasesFile(), 'utf8'))
+  for (const row of results) {
+    assert.equal(all[row.cwd]?.id, row.id, `${row.cwd} kept its lease`)
+  }
+  assert.equal(readdirSync(join(root, '.dsh-ris-yds')).filter((name) => name.endsWith('.tmp')).length, 0)
+})