dsh-ris-yds 1.0.0 → 1.1.0

package/test/ide-proxy.test.mjs

@@ -10,8 +10,9 @@ import {
   YDS_RULE_SOURCE, applyGitProxy, ensureBorrowedProxy, gitHostOf, ideProxyCandidates,
   isIpv4Literal, isPrivateIpv4, loadIdeProxy, privateSegmentsOf, proxyRulesFromTargets,
   shadowTargetsFromTargets,
-  toProcessPattern, yoncodeRules,
+  toProcessPattern, yoncodeRules, programKeyOf, ydsRulesFor,
 } from '../lib/ide-proxy.js'
+import { mergeYdsRules } from '../lib/rules.js'
 
 test('only a dotted-quad IPv4 literal counts as bindable', () => {
   assert.equal(isIpv4Literal('172.20.235.80'), true)
@@ -20,32 +21,41 @@ test('only a dotted-quad IPv4 literal counts as bindable', () => {
   assert.equal(isIpv4Literal(''), false)
 })
 
-test('rules name real programs: java for the internal segment, git for its remote', () => {
-  const rules = proxyRulesFromTargets([
+test('rules name real programs on both sides: java/git and their WSL-side twins', () => {
+  const targets = [
     { host: '172.20.235.80', port: 1521 },
     { host: '172.20.235.81', port: 6890, isRedis: true },
     { host: '172.20.235.81', port: 6880 },
+    // a second internal /24 must fold into the SAME java row
+    { host: '172.20.63.131', port: 31010 },
     // duplicates collapse, garbage is dropped
     { host: '172.20.235.81', port: 6880 },
     { host: 'srmdev.hanslaser.com', port: 443 },
     { host: '', port: 1 },
     { host: '10.0.0.1', port: 0 },
     { host: '10.0.0.1', port: 70000 },
-  ], '/w', { gitHost: 'gitlab.hanslaser.com', java: true })
-  // Endpoints are NOT rows: two rules, both naming a real process.
-  // Every axis is explicit: "any port" is spelled `*`, because a blank port no
-  // longer makes a rule apply (the dialog rejects half-written rows).
-  assert.deepEqual(rules.map((rule) => `${rule.program}|${rule.hosts}|${rule.ports}`), [
-    'java|172.20.235.*|*',
-    'git|gitlab.hanslaser.com|*',
+  ]
+  // On a WSL/Linux host the WSL side is the one that matters: `java.exe` is the Windows
+  // image, `java` is the process name ProxyBridge matches on the Linux side, and the
+  // missing local rows were why a WSL JVM was never intercepted.
+  const rules = proxyRulesFromTargets(targets, { gitHost: 'gitlab.hanslaser.com', java: true, platform: 'linux' })
+  assert.deepEqual(rules.map((rule) => `${rule.id}|${rule.side}|${rule.program}|${rule.hosts}|${rule.ports}`), [
+    'yds-java|windows|java.exe|172.20.235.*,172.20.63.*|*',
+    'yds-git|windows|git.exe|gitlab.hanslaser.com|*',
+    'yds-java-local|local|java|172.20.235.*,172.20.63.*|*',
+    'yds-git-local|local|git|gitlab.hanslaser.com|*',
   ])
   assert.equal(rules.every((rule) => rule.source === YDS_RULE_SOURCE), true)
   assert.equal(rules.every((rule) => rule.program !== 'jdbc'), true, 'jdbc is not a process name')
+  assert.equal(programKeyOf(rules[0].program), 'java')
+  assert.equal(programKeyOf(rules[2].program), 'java', 'the local row names the same program on its side')
   assert.equal(rules.every((rule) => rule.shadow === false), true, 'the table holds intent only; no mapping rows')
-  assert.equal(rules[0].id, 'yds-java-172-20-235', 'one rule per internal segment, stable id')
-  assert.equal(rules[1].id, 'yds-git')
-  // Without a git URL there is no git rule to write.
-  const noGit = proxyRulesFromTargets([{ host: '172.20.235.80', port: 1521 }], '/w', { gitHost: '', java: true })
+  assert.equal(rules.every((rule) => rule.workspace === undefined), true, 'the table is global: workspace is not part of a row')
+  // Windows has no Linux side: only the `.exe` rows are generated there.
+  const windows = proxyRulesFromTargets(targets, { gitHost: 'gitlab.hanslaser.com', java: true, platform: 'win32' })
+  assert.deepEqual(windows.map((rule) => rule.id), ['yds-java', 'yds-git'])
+  // Without a git URL there is no git rule to write (on either side).
+  const noGit = proxyRulesFromTargets([{ host: '172.20.235.80', port: 1521 }], { gitHost: '', java: true, platform: 'linux' })
   assert.equal(noGit.some((rule) => rule.program === 'git'), false)
 })
 
@@ -160,14 +170,14 @@ test('YonCode own executables get their own labelled rules', async () => {
   })
   assert.deepEqual(rules.map((rule) => rule.id), ['yds-yoncode-java', 'yds-yoncode-git'])
   assert.deepEqual(rules.map((rule) => rule.label), ['YonCode java', 'YonCode git'])
-  // `jdk*\bin\*.exe`: scoped to the JDK trees (devkit also holds maven/node) and
-  // covering java.exe/javaw.exe, so a JDK upgrade does not invalidate the rule.
-  assert.equal(rules[0].program, join(home, 'devkit', 'jdk*', 'bin', '*.exe'))
+  // The image name, not a file under the devkit: a JDK upgrade keeps working and
+  // every java.exe on the machine is covered.
+  assert.equal(rules[0].program, 'java.exe')
   // The range comes from the endpoints we resolved, never from a hardcoded vendor range.
   assert.equal(rules[0].hosts, '172.20.235.*,172.20.63.*')
   assert.equal(rules[0].ports, '*')
   assert.equal(rules[0].shadow, false)
-  assert.equal(rules[1].program, gitExe)
+  assert.equal(rules[1].program, 'git.exe')
   assert.equal(rules[1].hosts, 'gitlab.example.com')
   assert.equal(rules.every((rule) => rule.source === 'yds'), true)
   // No YonCode install and no git: no rows invented.
@@ -187,8 +197,60 @@ test('executable rows inherit the private ranges of the resolved endpoints', ()
   assert.deepEqual(privateSegmentsOf([], []), [])
 })
 
+test('the yds rows are a whole-table write: the global set replaces the old yds rows', () => {
+  // The table is one global list. A save carries the complete table: the user's rows
+  // pass through, the previous yds rows are replaced by this run's set (never unioned
+  // with another project's, because there is no other project's share any more).
+  const merged = mergeYdsRules(
+    [
+      { id: 'user-1', program: 'navicat.exe', hosts: '10.9.9.*', source: 'user' },
+      { id: 'yds-java-old', program: 'java.exe', hosts: '172.20.235.*', ports: '*', enabled: true, source: 'yds', workspace: '/ws-a' },
+      { id: 'yds-git-old', program: 'git.exe', hosts: 'gitlab.example.com', ports: '*', enabled: true, source: 'yds', workspace: '/ws-a' },
+    ],
+    [
+      { id: 'yds-java', program: 'java.exe', side: 'windows', hosts: '172.20.235.*,172.20.63.*', ports: '*', enabled: true, source: 'yds' },
+      { id: 'yds-java-local', program: 'java', side: 'local', hosts: '172.20.235.*,172.20.63.*', ports: '*', enabled: true, source: 'yds' },
+    ],
+  )
+  assert.deepEqual(merged.map((row) => row.id), ['user-1', 'yds-java', 'yds-java-local'])
+  assert.equal(merged.filter((row) => row.source === 'yds').length, 2, 'one row per side, not per workspace')
+  assert.equal(merged[1].hosts, '172.20.235.*,172.20.63.*')
+  assert.equal(merged.every((row) => row.workspace === undefined || row.source !== 'yds'), true, 'no workspace column on global rows')
+})
+
+test('the rules this project writes are the full side-aware set', () => {
+  const rows = ydsRulesFor(
+    { workspace: '/w', proxyJavaRules: true, git: { url: 'https://gitlab.hanslaser.com/x/y.git' } },
+    [{ host: '172.20.235.80', port: 1521 }],
+    { platform: 'linux' },
+  )
+  assert.deepEqual(rows.map((row) => row.id), ['yds-java', 'yds-git', 'yds-java-local', 'yds-git-local'])
+  assert.deepEqual(rows.map((row) => row.side), ['windows', 'windows', 'local', 'local'])
+  // A second start from another workspace produces the same shape: the last save wins.
+  const again = ydsRulesFor(
+    { workspace: '/other', proxyJavaRules: true, git: { url: 'https://gitlab.hanslaser.com/x/y.git' } },
+    [{ host: '172.20.63.131', port: 1521 }],
+    { platform: 'linux' },
+  )
+  assert.equal(again.find((row) => row.id === 'yds-java').hosts, '172.20.63.*', 'the fresh run owns the row')
+})
+
 test('a mounted YonCode path becomes a drive-letter pattern', () => {
   assert.equal(toProcessPattern('/mnt/d/Program Files/YonCode/devkit/x/bin/java.exe'), 'D:\\Program Files\\YonCode\\devkit\\x\\bin\\java.exe')
   assert.equal(toProcessPattern('C:\\Program Files\\YonCode\\x\\java.exe'), 'C:\\Program Files\\YonCode\\x\\java.exe')
   assert.equal(toProcessPattern('/opt/YonCode/devkit/x/bin/java'), '/opt/YonCode/devkit/x/bin/java')
 })
+
+test('duplicates collapse only within one side+program, never across programs', () => {
+  const rows = mergeYdsRules([], [
+    { id: 'a', program: 'java.exe', side: 'windows', hosts: '10.0.0.*' },
+    { id: 'b', program: 'C:\\Program Files\\YonCode\\devkit\\jdk21\\bin\\java.exe', side: 'windows', hosts: '10.0.0.*' },
+    { id: 'c', program: 'git.exe', side: 'windows', hosts: 'gitlab.example.com' },
+    { id: 'd', program: 'git', side: 'local', hosts: 'gitlab.example.com' },
+    { id: 'e', program: '' },
+  ])
+  assert.deepEqual(rows.map((row) => row.id), ['a', 'c', 'd'])
+  assert.equal(rows[0].hosts, '10.0.0.*', 'the duplicate spelling contributes no new host')
+  assert.equal(programKeyOf('C:\\Program Files\\Git\\bin\\git.exe'), 'git')
+  assert.equal(programKeyOf('java'), 'java')
+})

package/test/lease-release.test.mjs

@@ -0,0 +1,76 @@
+// A failed lease release must keep the local record: forgetting it turned a
+// transient daemon failure into "nobody owns the engine", resolved only by the
+// daemon's pid sweep (review D-P2-6).
+import assert from 'node:assert/strict'
+import { createServer } from 'node:http'
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import test from 'node:test'
+
+const home = mkdtempSync(join(tmpdir(), 'yds-lease-'))
+const WS = mkdtempSync(join(tmpdir(), 'yds-lease-ws-'))
+let mode = 'ok'
+let server = null
+let port = 0
+
+test.before(async () => {
+  server = createServer((req, res) => {
+    const send = (status, payload) => {
+      res.writeHead(status, { 'content-type': 'application/json' })
+      res.end(`${JSON.stringify(payload)}\n`)
+    }
+    if (req.method === 'GET' && req.url === '/v1/health') {
+      return send(200, { ok: true, apiVersion: 1, version: 'test' })
+    }
+    if (req.method === 'POST' && req.url === '/v1/leases') {
+      return send(200, { ok: true, lease: { id: 'lease-1' } })
+    }
+    if (req.method === 'DELETE' && req.url.startsWith('/v1/leases/')) {
+      if (mode === 'fail') return send(500, { ok: false, error: 'daemon broke' })
+      return send(200, { ok: true, released: true })
+    }
+    return send(404, { ok: false })
+  })
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve))
+  port = server.address().port
+  writeFileSync(join(home, 'risd.json'), `${JSON.stringify({
+    apiVersion: 1, version: 'test', pid: process.pid, port, token: 'test-token',
+  })}\n`, { mode: 0o600 })
+  process.env.DSH_RIS_IDE_PROXY_HOME = home
+  process.env.YDS_IDE_PROXY = 'none'
+})
+
+test.after(() => {
+  server?.close()
+  rmSync(home, { recursive: true, force: true })
+  rmSync(join(home, '..', '.dsh-ris-yds'), { recursive: true, force: true })
+  rmSync(WS, { recursive: true, force: true })
+})
+
+function cfg() {
+  return { workspace: WS, socks: { host: '1.2.3.4', port: 1080 }, git: null, proxyJavaRules: true }
+}
+
+test('a failed release keeps the lease record so a retry can finish the job', async () => {
+  const { holdBorrowedLease, releaseBorrowedLease } = await import('../lib/ide-proxy.js')
+  const { readLease } = await import('../lib/risd-peer.js')
+  const held = await holdBorrowedLease(cfg(), { ownerPid: process.pid })
+  assert.equal(held.ok, true)
+  assert.equal(readLease(WS)?.id, 'lease-1')
+
+  mode = 'fail'
+  const failed = await releaseBorrowedLease(cfg())
+  assert.equal(failed.ok, false)
+  assert.match(failed.reason, /daemon broke|释放租约失败/)
+  assert.equal(readLease(WS)?.id, 'lease-1', 'the record survives a failed release')
+
+  mode = 'ok'
+  const retried = await releaseBorrowedLease(cfg())
+  assert.equal(retried.ok, true)
+  assert.equal(retried.released, true)
+  assert.equal(readLease(WS), null, 'a successful release forgets the record')
+
+  const leases = JSON.parse(readFileSync(join(home, '..', '.dsh-ris-yds', 'risd-leases.json'), 'utf8'))
+  assert.equal(leases[WS], undefined)
+})

package/test/pidfile.test.mjs

@@ -0,0 +1,105 @@
+// Pidfile handling when the process identity cannot be read. "Could not tell" used to
+// be treated as "not our process", which deleted the pidfile and either started a
+// second YMS/forwarder on top of a live one or left an orphan unreachable by
+// `yds stop` (review D-P1-6). These tests drive the Windows/timeout path through the
+// injectable probe options so they run on the Linux CI too.
+import assert from 'node:assert/strict'
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import test from 'node:test'
+
+import { probeForwarder, socksPidFile, stopForwarder } from '../lib/socks.js'
+import { readRunning, stopYms, ymsPidFile } from '../lib/yms.js'
+
+const WIN = 'win32'
+const unknownExec = () => ({ code: null, stdout: '', stderr: '', error: new Error('powershell timed out') })
+const absentExec = () => ({ code: 0, stdout: 'YDS_PROBE_ABSENT', stderr: '', error: null })
+const aliveExec = (commandLine) => () => ({ code: 0, stdout: `YDS_PROBE_OK:${commandLine}`, stderr: '', error: null })
+
+function makeCfg() {
+  const stateDir = mkdtempSync(join(tmpdir(), 'yds-pid-'))
+  return { stateDir, dbForwardPort: 47431, redisForwardPort: 47432 }
+}
+
+function withCfg(fn) {
+  return async () => {
+    const cfg = makeCfg()
+    try { await fn(cfg) } finally { rmSync(cfg.stateDir, { recursive: true, force: true }) }
+  }
+}
+
+test('yms: an unreadable identity keeps the pidfile and refuses to signal', withCfg(async (cfg) => {
+  writeFileSync(ymsPidFile(cfg), '4242')
+  const running = await readRunning(cfg, { platform: WIN, exec: unknownExec })
+  assert.equal(running.state, 'unknown')
+  assert.equal(running.pid, 4242)
+  assert.equal(existsSync(ymsPidFile(cfg)), true, 'pidfile must survive a probe failure')
+  assert.match(readFileSync(ymsPidFile(cfg), 'utf8'), /4242/)
+
+  const stopped = await stopYms(cfg, { platform: WIN, exec: unknownExec, graceMs: 10 })
+  assert.equal(stopped.stopped, false)
+  assert.match(String(stopped.reason), /未发送停止信号/)
+  assert.equal(existsSync(ymsPidFile(cfg)), true, 'still ours as far as we know: keep the pidfile')
+}))
+
+test('yms: a dead or reused pid is cleaned from the pidfile', withCfg(async (cfg) => {
+  writeFileSync(ymsPidFile(cfg), '4242')
+  assert.equal(await readRunning(cfg, { platform: WIN, exec: absentExec }), null)
+  assert.equal(existsSync(ymsPidFile(cfg)), false)
+
+  writeFileSync(ymsPidFile(cfg), '4242')
+  // Alive but a completely different command line: the pid was reused after a crash.
+  assert.equal(await readRunning(cfg, { platform: WIN, exec: aliveExec('notepad.exe') }), null)
+  assert.equal(existsSync(ymsPidFile(cfg)), false)
+}))
+
+test('yms: a verified owner is reported, and a failed stop keeps the pidfile', withCfg(async (cfg) => {
+  writeFileSync(ymsPidFile(cfg), '4344')
+  const owners = aliveExec('java -cp yms.jar iuap.yms.YMSLauncher')
+  assert.deepEqual(await readRunning(cfg, { platform: WIN, exec: owners }), { pid: 4344 })
+
+  // taskkill failed but the process is still alive: report the failure, keep the
+  // pidfile so `yds status` keeps seeing it (review D-P1-7).
+  const denied = () => ({ code: 5, stdout: '', stderr: 'Access is denied.', error: null })
+  const failed = await stopYms(cfg, { platform: WIN, exec: denied, probe: () => ({ state: 'alive', commandLine: '' }), graceMs: 10 })
+  assert.equal(failed.stopped, false)
+  assert.match(String(failed.reason), /已保留 pidfile/)
+  assert.equal(existsSync(ymsPidFile(cfg)), true)
+
+  // A successful stop is the only path that unlinks the pidfile. (The same fake exec
+  // answers the identity probe and taskkill: both exit 0, and the command line still
+  // identifies the YMS.)
+  assert.equal((await stopYms(cfg, { platform: WIN, exec: owners })).stopped, true)
+  assert.equal(existsSync(ymsPidFile(cfg)), false)
+}))
+
+test('socks: an unreadable forwarder identity keeps the pidfile', withCfg(async (cfg) => {
+  writeFileSync(socksPidFile(cfg), '4343')
+  const probe = probeForwarder(cfg, { platform: WIN, exec: unknownExec })
+  assert.equal(probe.state, 'unknown')
+  assert.equal(probe.pid, null, 'no pid is handed out while the identity is unreadable')
+  assert.equal(existsSync(socksPidFile(cfg)), true)
+
+  const stopped = await stopForwarder(cfg, { platform: WIN, exec: unknownExec })
+  assert.equal(stopped.stopped, false)
+  assert.equal(existsSync(socksPidFile(cfg)), true)
+}))
+
+test('socks: a dead or reused forwarder pid is cleaned', withCfg(async (cfg) => {
+  writeFileSync(socksPidFile(cfg), '4343')
+  assert.equal(probeForwarder(cfg, { platform: WIN, exec: absentExec }).state, 'stale')
+  assert.equal(existsSync(socksPidFile(cfg)), false)
+
+  writeFileSync(socksPidFile(cfg), '4343')
+  const foreign = probeForwarder(cfg, { platform: WIN, exec: aliveExec('some-other-daemon') })
+  assert.equal(foreign.state, 'stale')
+  assert.equal(existsSync(socksPidFile(cfg)), false)
+}))
+
+test('socks: the verified forwarder is recognised as ours', withCfg(async (cfg) => {
+  writeFileSync(socksPidFile(cfg), '4343')
+  const probe = probeForwarder(cfg, { platform: WIN, exec: aliveExec('node yds.js socks-fwd --socks=1.2.3.4:1080') })
+  assert.equal(probe.state, 'verified')
+  assert.equal(probe.pid, 4343)
+}))

package/test/proc.test.mjs

@@ -0,0 +1,172 @@
+import assert from 'node:assert/strict'
+import { spawn } from 'node:child_process'
+import test from 'node:test'
+
+import { pidAlive, processCommandLine, stopPid } from '../lib/proc.js'
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+
+test('processCommandLine reads the current command line on this platform', () => {
+  const line = processCommandLine(process.pid)
+  assert.match(line, /node/i, 'contains the node executable')
+  assert.equal(processCommandLine(0), '')
+  assert.equal(processCommandLine(-1), '')
+  assert.equal(processCommandLine('nope'), '')
+})
+
+test('pidAlive tells live from gone pids', () => {
+  assert.equal(pidAlive(process.pid), true)
+  assert.equal(pidAlive(2147480000), false)
+})
+
+test('stopPid ends a real child process and tolerates a dead pid', async () => {
+  const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' })
+  await sleep(300)
+  assert.equal(pidAlive(child.pid), true)
+  await stopPid(child.pid, { graceMs: 3000 })
+  await sleep(800)
+  assert.equal(pidAlive(child.pid), false)
+  await stopPid(child.pid, { graceMs: 500 }) // already gone: must not throw
+})
+
+// ---- Windows branches, driven through the injectable platform/exec -----------------
+// CI runs on Linux, so the Windows path is only exercised when the platform and the
+// command runner are injected. These tests pin the two behaviours the review found
+// broken: "could not tell" must never become "not ours", and a failed taskkill must
+// never be reported as a successful stop.
+
+import { pidIdentity, probePid, signalState, windowsProbeArgs } from '../lib/proc.js'
+
+const WIN = 'win32'
+const okOut = (stdout) => ({ code: 0, stdout, stderr: '', error: null })
+
+test('windowsProbeArgs uses a single-quoted WQL predicate and only the integer pid', () => {
+  const args = windowsProbeArgs(4242)
+  assert.deepEqual(args.slice(0, -1), ['-NoProfile', '-NonInteractive', '-Command'])
+  const script = args.at(-1)
+  assert.match(script, /-Filter 'ProcessId=4242'/)
+  assert.ok(!script.includes('"ProcessId'), 'no double quotes embedded in -Command')
+})
+
+test('probePid distinguishes absent, readable and unknowable on Windows', () => {
+  assert.deepEqual(probePid(11, { platform: WIN, exec: () => okOut('YDS_PROBE_ABSENT\n') }), { state: 'dead', commandLine: '' })
+  const alive = probePid(11, { platform: WIN, exec: () => okOut('YDS_PROBE_OK:C:\\jdk\\bin\\java.exe -jar yms.jar') })
+  assert.equal(alive.state, 'alive')
+  assert.match(alive.commandLine, /yms\.jar/)
+  // Empty output / access denied / timeout: cannot tell => unknown (never dead).
+  assert.equal(probePid(11, { platform: WIN, exec: () => okOut('') }).state, 'unknown')
+  assert.equal(probePid(11, { platform: WIN, exec: () => ({ code: 1, stdout: '', stderr: 'Access is denied.', error: null }) }).state, 'unknown')
+  assert.equal(probePid(11, { platform: WIN, exec: () => ({ code: null, stdout: '', stderr: '', error: new Error('ETIMEDOUT') }) }).state, 'unknown')
+  // An invalid pid is dead without spawning anything.
+  let spawned = 0
+  assert.equal(probePid(0, { platform: WIN, exec: () => { spawned += 1; return okOut('') } }).state, 'dead')
+  assert.equal(spawned, 0)
+})
+
+test('pidIdentity separates ours/foreign/dead/unknown on Windows', () => {
+  const markers = ['yms.jar']
+  const identity = (stdout) => pidIdentity(7, markers, { platform: WIN, exec: () => okOut(stdout) }).state
+  assert.equal(identity('YDS_PROBE_OK:java -jar yms.jar'), 'ours')
+  assert.equal(identity('YDS_PROBE_OK:notepad.exe'), 'foreign')
+  assert.equal(identity('YDS_PROBE_ABSENT'), 'dead')
+  assert.equal(identity('YDS_PROBE_OK:'), 'unknown', 'alive but unreadable command line is NOT foreign')
+  assert.equal(identity('garbage'), 'unknown')
+})
+
+test('a readable process with no command line is unknown, not foreign (POSIX too)', () => {
+  const base = { platform: 'linux', signal: () => 'alive' }
+  assert.equal(pidIdentity(7, ['yms.jar'], { ...base, commandLine: () => '' }).state, 'unknown')
+  assert.equal(pidIdentity(7, ['yms.jar'], { ...base, commandLine: () => '/usr/bin/java -jar yms.jar' }).state, 'ours')
+})
+
+test('signalState maps EPERM to alive and ESRCH to dead', () => {
+  // pid 1 always exists; as an unprivileged user kill(1,0) throws EPERM, which must
+  // count as alive (the old code mapped every error to "dead").
+  assert.equal(signalState(1), 'alive')
+  assert.equal(signalState(2147480000), 'dead')
+})
+
+test('stopPid consumes the taskkill exit code instead of assuming success', async () => {
+  const calls = []
+  const execOk = (command, args) => { calls.push([command, args]); return { code: 0, stdout: '', stderr: '', error: null } }
+  assert.deepEqual(await stopPid(555, { platform: WIN, exec: execOk }), { ok: true, code: 0 })
+  assert.deepEqual(calls[0], ['taskkill', ['/PID', '555', '/T', '/F']])
+
+  // The process exited between probe and taskkill: nonzero exit, but it is gone.
+  const execGone = () => ({ code: 128, stdout: '', stderr: 'not found', error: null })
+  assert.equal((await stopPid(555, { platform: WIN, exec: execGone, probe: () => ({ state: 'dead' }) })).ok, true)
+
+  // A real failure must be reported with the reason, and the caller keeps the pidfile.
+  const execDenied = () => ({ code: 5, stdout: '', stderr: 'Access is denied.', error: null })
+  const failed = await stopPid(555, { platform: WIN, exec: execDenied, probe: () => ({ state: 'alive', commandLine: '' }) })
+  assert.equal(failed.ok, false)
+  assert.match(String(failed.error), /Access is denied/)
+})
+
+test('the absent marker is matched exactly, never as a substring of a command line', async () => {
+  const { probePid } = await import('../lib/proc.js')
+  const WIN = 'win32'
+  const okOut = (stdout) => ({ code: 0, stdout, stderr: '', error: null })
+  // A live java process whose own command line quotes the probe marker must stay alive.
+  const alive = probePid(11, { platform: WIN, exec: () => okOut('YDS_PROBE_OK:java -Dtag=YDS_PROBE_ABSENT -jar yms.jar') })
+  assert.equal(alive.state, 'alive')
+  assert.match(alive.commandLine, /YDS_PROBE_ABSENT/)
+  // Extra noise around the absent marker is not proof: only the exact output is dead.
+  assert.equal(probePid(11, { platform: WIN, exec: () => okOut('YDS_PROBE_ABSENT\nsome warning') }).state, 'unknown')
+})
+
+test('probe results are only cached for the real Windows probe', async () => {
+  const { probePid, clearProbeCache } = await import('../lib/proc.js')
+  const WIN = 'win32'
+  let calls = 0
+  const exec = () => { calls += 1; return { code: 0, stdout: 'YDS_PROBE_ABSENT', stderr: '', error: null } }
+  probePid(4242, { platform: WIN, exec })
+  probePid(4242, { platform: WIN, exec })
+  assert.equal(calls, 2, 'an injected executor is never cached (tests must see every probe)')
+  clearProbeCache(4242)
+  assert.equal(typeof clearProbeCache, 'function')
+})
+
+test('a forced stop signals through the injected kill and verifies the result', async () => {
+  const { stopPid } = await import('../lib/proc.js')
+  const POSIX = 'linux'
+  const signals = []
+  const kill = (pid, sig) => { signals.push([pid, sig]); return { ok: true } }
+  // Gone after SIGKILL: success.
+  assert.deepEqual(
+    await stopPid(777, { force: true, platform: POSIX, kill, probe: () => ({ state: 'dead' }) }),
+    { ok: true, code: null },
+  )
+  assert.deepEqual(signals, [[777, 'SIGKILL']], 'the injected kill is used, not process.kill')
+
+  // SIGKILL did not work (uninterruptible/foreign): report failure instead of claiming it.
+  const stubborn = await stopPid(778, { force: true, platform: POSIX, kill, probe: () => ({ state: 'alive', commandLine: '' }) })
+  assert.equal(stubborn.ok, false)
+  assert.match(String(stubborn.error), /SIGKILL 后进程仍存活/)
+
+  // A kill that fails outright also reports its reason.
+  const denied = await stopPid(779, {
+    force: true, platform: POSIX, kill: () => ({ ok: false, error: 'operation not permitted' }), probe: () => ({ state: 'alive' }),
+  })
+  assert.equal(denied.ok, false)
+  assert.match(String(denied.error), /not permitted/)
+})
+
+test('a graceful stop skips the kill when the injected TERM already succeeded', async () => {
+  const { stopPid } = await import('../lib/proc.js')
+  const POSIX = 'linux'
+  const signals = []
+  const kill = (pid, sig) => { signals.push(sig); return { ok: true } }
+  const result = await stopPid(780, { platform: POSIX, graceMs: 300, kill, probe: () => ({ state: 'dead' }) })
+  assert.deepEqual(result, { ok: true, code: null })
+  assert.deepEqual(signals, ['SIGTERM'])
+})
+
+test('a detached child is stopped as a process group', async () => {
+  const { stopPid } = await import('../lib/proc.js')
+  const signals = []
+  const kill = (pid, sig) => { signals.push([pid, sig]); return { ok: true } }
+  const result = await stopPid(781, { force: true, group: true, platform: 'linux', kill, probe: () => ({ state: 'dead' }) })
+  assert.equal(result.ok, true)
+  assert.deepEqual(signals, [[-781, 'SIGKILL']], 'the group leader pid is negated')
+})

package/test/proxy-standalone.test.mjs

@@ -15,6 +15,9 @@ for (const key of Object.keys(process.env)) {
   if (key.startsWith('YDS_')) delete process.env[key]
 }
 process.env.YDS_IDE_PROXY = 'none'
+// The risd tier reads `~/.dsh-ris-ide` by default; a developer's daemon running on
+// the machine must not decide this test's outcome. Point it at a fresh home.
+process.env.DSH_RIS_IDE_PROXY_HOME = mkdtempSync(join(tmpdir(), 'yds-standalone-risd-'))
 
 const DB_PORT = 24531
 const REDIS_PORT = 26891

package/test/risd-leases.test.mjs

@@ -0,0 +1,111 @@
+// The lease record on disk is how a short-lived CLI hands a long-lived tunnel
+// ownership to the YMS process, so it must survive two `yds start` runs in
+// different workspaces and a writer that died between read and write.
+//
+// Review D-P2-6: the file used to be a bare read-modify-write (a lost update
+// dropped the other workspace's lease, leaving the daemon to reap an engine a
+// live YMS still needed) and a leftover `.lock` had no recovery path.
+import assert from 'node:assert/strict'
+import { spawn } from 'node:child_process'
+import {
+  existsSync, mkdirSync, mkdtempSync, openSync, closeSync, readFileSync, readdirSync, rmSync, statSync, utimesSync, writeFileSync,
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { after, before, test } from 'node:test'
+
+import { dropDeadLease, forgetLease, readLease, rememberLease } from '../lib/risd-peer.js'
+
+const PEER = pathToFileURL(join(import.meta.dirname, '..', 'lib', 'risd-peer.js')).href
+
+let root
+let home
+
+before(() => {
+  root = mkdtempSync(join(tmpdir(), 'yds-risd-leases-'))
+  home = join(root, '.dsh-ris-ide')
+  mkdirSync(home, { recursive: true })
+})
+
+after(() => {
+  rmSync(root, { recursive: true, force: true })
+})
+
+function leasesFile() {
+  return join(root, '.dsh-ris-yds', 'risd-leases.json')
+}
+
+test('a lease round-trips and is written 0600 without leaving temp files', () => {
+  const cwd = '/ws/one'
+  assert.equal(rememberLease(cwd, { id: 'lease-1', ownerPid: process.pid, port: 11081 }, { home }), true)
+  const entry = readLease(cwd, { home })
+  assert.equal(entry.id, 'lease-1')
+  assert.equal(entry.ownerPid, process.pid)
+  assert.equal(typeof entry.at, 'string', 'timestamp for debugging a stale record')
+  assert.equal(statSync(leasesFile()).mode & 0o777, 0o600)
+  assert.deepEqual(readdirSync(join(root, '.dsh-ris-yds')).filter((name) => name.endsWith('.tmp')), [])
+  forgetLease(cwd, { home })
+  assert.equal(readLease(cwd, { home }), null)
+  assert.equal(existsSync(join(root, '.dsh-ris-yds', 'risd-leases.json.lock')), false, 'lock released')
+})
+
+test('a stale lease is dropped only when its owner is gone', () => {
+  const live = '/ws/live'
+  const dead = '/ws/dead'
+  rememberLease(live, { id: 'lease-live', ownerPid: process.pid, port: 1 }, { home })
+  rememberLease(dead, { id: 'lease-dead', ownerPid: 999999, port: 1 }, { home })
+  assert.equal(dropDeadLease(live, { home }), false)
+  assert.notEqual(readLease(live, { home }), null, 'a live owner keeps its lease')
+  assert.equal(dropDeadLease(dead, { home }), true)
+  assert.equal(readLease(dead, { home }), null, 'a dead owner does not keep the engine alive')
+})
+
+test('an abandoned lock file is stolen instead of blocking every later start', () => {
+  const cwd = '/ws/stale-lock'
+  const lock = `${leasesFile()}.lock`
+  mkdirSync(join(root, '.dsh-ris-yds'), { recursive: true })
+  writeFileSync(lock, '12345')
+  const old = new Date(Date.now() - 60_000)
+  utimesSync(lock, old, old)
+  assert.equal(rememberLease(cwd, { id: 'lease-stale', ownerPid: process.pid, port: 1 }, { home }), true)
+  assert.notEqual(readLease(cwd, { home }), null)
+  assert.equal(existsSync(lock), false)
+})
+
+test('a held lock degrades to a bounded unlocked write instead of hanging yds', () => {
+  const cwd = '/ws/held-lock'
+  const lock = `${leasesFile()}.lock`
+  mkdirSync(join(root, '.dsh-ris-yds'), { recursive: true })
+  const fd = openSync(lock, 'wx')
+  const started = Date.now()
+  try {
+    // The holder is this very process (never released), so the client must give up
+    // on the lock and still record the lease: a missing record is worse.
+    assert.equal(rememberLease(cwd, { id: 'lease-held', ownerPid: process.pid, port: 1 }, { home }), true)
+    const waited = Date.now() - started
+    assert.ok(waited < 4000, `bounded wait (waited ${waited}ms)`)
+    assert.notEqual(readLease(cwd, { home }), null)
+  } finally {
+    closeSync(fd)
+    rmSync(lock, { force: true })
+  }
+})
+
+test('concurrent writers in different workspaces never drop each other', async () => {
+  const count = 6
+  const code = `import { rememberLease } from ${JSON.stringify(PEER)};
+rememberLease(process.argv[1], { id: process.argv[2], ownerPid: process.pid, port: 1 }, { home: process.argv[3] })`
+  const children = Array.from({ length: count }, (_, index) => new Promise((resolve) => {
+    const cwd = `/ws/concurrent-${index}`
+    const child = spawn(process.execPath, ['--input-type=module', '-e', code, cwd, `lease-c${index}`, home], { stdio: 'ignore' })
+    child.once('exit', (code_) => resolve({ cwd, id: `lease-c${index}`, code: code_ }))
+  }))
+  const results = await Promise.all(children)
+  assert.deepEqual(results.filter((row) => row.code !== 0), [], 'every writer exited cleanly')
+  const all = JSON.parse(readFileSync(leasesFile(), 'utf8'))
+  for (const row of results) {
+    assert.equal(all[row.cwd]?.id, row.id, `${row.cwd} kept its lease`)
+  }
+  assert.equal(readdirSync(join(root, '.dsh-ris-yds')).filter((name) => name.endsWith('.tmp')).length, 0)
+})