intentdna 1.9.0 → 1.9.3

package/native/windows-job-keeper/keeper.c

@@ -0,0 +1,979 @@
+#define WIN32_LEAN_AND_MEAN
+#ifndef UNICODE
+#define UNICODE
+#endif
+#ifndef _UNICODE
+#define _UNICODE
+#endif
+
+#include <windows.h>
+#include <bcrypt.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <wchar.h>
+
+#define CONFIG_MAGIC "IDNA_WINDOWS_JOB_KEEPER_V1"
+#define MAX_LINE_BYTES (1024u * 1024u)
+#define MAX_CONFIG_BYTES (8u * 1024u * 1024u)
+#define MAX_ARGUMENTS 4096u
+#define MAX_ENVIRONMENT_ENTRIES 4096u
+#define MAX_ENVIRONMENT_WCHARS 32767u
+#define MAX_COMMAND_LINE_WCHARS 32766u
+#define MAX_DRAIN_GRACE_MS 300000u
+#define MAX_OUTPUT_BYTES 9007199254740991ull
+#define TERMINATE_EXIT_CODE 0xC000013Au
+
+enum {
+  COMMAND_MODE_ARGV = 1,
+  COMMAND_MODE_VERBATIM = 2,
+};
+
+typedef struct {
+  wchar_t *executable;
+  wchar_t *cwd;
+  wchar_t *stdin_path;
+  wchar_t *stdout_path;
+  wchar_t *stderr_path;
+  int command_mode;
+  wchar_t *verbatim_command_line;
+  wchar_t **argv;
+  DWORD argc;
+  wchar_t **environment;
+  DWORD envc;
+  DWORD natural_drain_grace_ms;
+  DWORD forced_drain_grace_ms;
+  ULONGLONG max_output_bytes;
+} keeper_config;
+
+typedef struct {
+  HANDLE input;
+  HANDLE event;
+  volatile LONG reason;
+} control_state;
+
+typedef struct {
+  HANDLE input;
+  HANDLE output;
+  HANDLE event;
+  ULONGLONG max_bytes;
+  volatile LONG limit_exceeded;
+  volatile LONG failed;
+  DWORD error;
+} output_state;
+
+enum {
+  CONTROL_NONE = 0,
+  CONTROL_TERMINATE = 1,
+  CONTROL_EOF = 2,
+  CONTROL_PROTOCOL_ERROR = 3,
+};
+
+static void emit_error(const char *stage, DWORD error) {
+  fprintf(stderr,
+          "{\"schema_version\":\"intentdna.windows_job_keeper_fact.v1\","
+          "\"kind\":\"error\",\"stage\":\"%s\",\"win32_error\":%lu}\n",
+          stage, (unsigned long)error);
+  fflush(stderr);
+}
+
+static int read_line(HANDLE input, char **line, size_t *length, size_t *total) {
+  size_t capacity = 256;
+  size_t used = 0;
+  char *value = (char *)malloc(capacity);
+  if (value == NULL) {
+    SetLastError(ERROR_OUTOFMEMORY);
+    return -1;
+  }
+  for (;;) {
+    char byte;
+    DWORD read = 0;
+    if (!ReadFile(input, &byte, 1, &read, NULL)) {
+      DWORD error = GetLastError();
+      free(value);
+      if (error == ERROR_BROKEN_PIPE || error == ERROR_HANDLE_EOF) return 0;
+      SetLastError(error);
+      return -1;
+    }
+    if (read == 0) {
+      free(value);
+      return 0;
+    }
+    if (++(*total) > MAX_CONFIG_BYTES || used >= MAX_LINE_BYTES) {
+      free(value);
+      SetLastError(ERROR_BUFFER_OVERFLOW);
+      return -1;
+    }
+    if (byte == '\n') break;
+    if (byte == '\r' || byte == '\0') {
+      free(value);
+      SetLastError(ERROR_INVALID_DATA);
+      return -1;
+    }
+    if (used + 1 >= capacity) {
+      size_t next = capacity * 2;
+      char *grown = (char *)realloc(value, next);
+      if (grown == NULL) {
+        free(value);
+        SetLastError(ERROR_OUTOFMEMORY);
+        return -1;
+      }
+      value = grown;
+      capacity = next;
+    }
+    value[used++] = byte;
+  }
+  value[used] = '\0';
+  *line = value;
+  *length = used;
+  return 1;
+}
+
+static int hex_value(char value) {
+  if (value >= '0' && value <= '9') return value - '0';
+  if (value >= 'a' && value <= 'f') return value - 'a' + 10;
+  if (value >= 'A' && value <= 'F') return value - 'A' + 10;
+  return -1;
+}
+
+static wchar_t *decode_hex_utf8(const char *hex, size_t length, int allow_empty) {
+  if ((length == 0 && !allow_empty) || (length % 2) != 0) {
+    SetLastError(ERROR_INVALID_DATA);
+    return NULL;
+  }
+  if (length == 0) return (wchar_t *)calloc(1, sizeof(wchar_t));
+  size_t byte_count = length / 2;
+  char *bytes = (char *)malloc(byte_count);
+  if (bytes == NULL) {
+    SetLastError(ERROR_OUTOFMEMORY);
+    return NULL;
+  }
+  for (size_t i = 0; i < byte_count; i++) {
+    int high = hex_value(hex[i * 2]);
+    int low = hex_value(hex[i * 2 + 1]);
+    if (high < 0 || low < 0 || (high == 0 && low == 0)) {
+      free(bytes);
+      SetLastError(ERROR_INVALID_DATA);
+      return NULL;
+    }
+    bytes[i] = (char)((high << 4) | low);
+  }
+  int count = MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS, bytes,
+                                  (int)byte_count, NULL, 0);
+  if (count <= 0) {
+    free(bytes);
+    return NULL;
+  }
+  wchar_t *wide = (wchar_t *)calloc((size_t)count + 1, sizeof(wchar_t));
+  if (wide == NULL) {
+    free(bytes);
+    SetLastError(ERROR_OUTOFMEMORY);
+    return NULL;
+  }
+  if (MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS, bytes, (int)byte_count,
+                          wide, count) != count) {
+    DWORD error = GetLastError();
+    free(bytes);
+    free(wide);
+    SetLastError(error);
+    return NULL;
+  }
+  free(bytes);
+  return wide;
+}
+
+static int parse_hex_line(const char *line, size_t length, const char *prefix,
+                          int allow_empty, wchar_t **output) {
+  size_t prefix_length = strlen(prefix);
+  if (length < prefix_length || memcmp(line, prefix, prefix_length) != 0) {
+    SetLastError(ERROR_INVALID_DATA);
+    return 0;
+  }
+  *output = decode_hex_utf8(line + prefix_length, length - prefix_length, allow_empty);
+  return *output != NULL;
+}
+
+static void free_config(keeper_config *config) {
+  free(config->executable);
+  free(config->cwd);
+  free(config->stdin_path);
+  free(config->stdout_path);
+  free(config->stderr_path);
+  free(config->verbatim_command_line);
+  if (config->argv != NULL) {
+    for (DWORD i = 0; i < config->argc; i++) free(config->argv[i]);
+  }
+  free(config->argv);
+  if (config->environment != NULL) {
+    for (DWORD i = 0; i < config->envc; i++) free(config->environment[i]);
+  }
+  free(config->environment);
+  memset(config, 0, sizeof(*config));
+}
+
+static int parse_bounded_decimal(const char *line, size_t length, const char *prefix,
+                                 DWORD maximum, DWORD *output) {
+  size_t prefix_length = strlen(prefix);
+  if (length <= prefix_length || memcmp(line, prefix, prefix_length) != 0) return 0;
+  DWORD parsed = 0;
+  for (size_t i = prefix_length; i < length; i++) {
+    unsigned digit = (unsigned)(line[i] - '0');
+    if (line[i] < '0' || line[i] > '9' || parsed > (maximum - digit) / 10) return 0;
+    parsed = parsed * 10 + digit;
+  }
+  *output = parsed;
+  return 1;
+}
+
+static int parse_bounded_u64(const char *line, size_t length, const char *prefix,
+                             ULONGLONG maximum, ULONGLONG *output) {
+  size_t prefix_length = strlen(prefix);
+  if (length <= prefix_length || memcmp(line, prefix, prefix_length) != 0) return 0;
+  ULONGLONG parsed = 0;
+  for (size_t i = prefix_length; i < length; i++) {
+    unsigned digit = (unsigned)(line[i] - '0');
+    if (line[i] < '0' || line[i] > '9' || parsed > (maximum - digit) / 10) return 0;
+    parsed = parsed * 10 + digit;
+  }
+  if (parsed == 0) return 0;
+  *output = parsed;
+  return 1;
+}
+
+static int valid_environment_entry(const wchar_t *entry) {
+  const wchar_t *equals = wcschr(entry, L'=');
+  return equals != NULL && equals != entry;
+}
+
+static int environment_compare(const void *left, const void *right) {
+  const wchar_t *const *a = (const wchar_t *const *)left;
+  const wchar_t *const *b = (const wchar_t *const *)right;
+  return _wcsicmp(*a, *b);
+}
+
+static int read_config(HANDLE input, keeper_config *config) {
+  char *line = NULL;
+  size_t length = 0;
+  size_t total = 0;
+  int result = read_line(input, &line, &length, &total);
+  if (result != 1 || strcmp(line, CONFIG_MAGIC) != 0) goto invalid;
+  free(line);
+  line = NULL;
+
+  const char *prefixes[5] = { "exe:", "cwd:", "stdin:", "stdout:", "stderr:" };
+  wchar_t **values[5] = {
+    &config->executable, &config->cwd, &config->stdin_path,
+    &config->stdout_path, &config->stderr_path
+  };
+  const int allow_empty[5] = { 0, 1, 1, 0, 0 };
+  for (size_t i = 0; i < 5; i++) {
+    result = read_line(input, &line, &length, &total);
+    if (result != 1 || !parse_hex_line(line, length, prefixes[i], allow_empty[i], values[i]))
+      goto invalid;
+    free(line);
+    line = NULL;
+  }
+
+  result = read_line(input, &line, &length, &total);
+  if (result != 1 || !parse_bounded_u64(line, length, "max_output_bytes:",
+                                        MAX_OUTPUT_BYTES, &config->max_output_bytes))
+    goto invalid;
+  free(line);
+  line = NULL;
+
+  result = read_line(input, &line, &length, &total);
+  if (result != 1) goto invalid;
+  if (strcmp(line, "mode:argv") == 0) config->command_mode = COMMAND_MODE_ARGV;
+  else if (strcmp(line, "mode:verbatim") == 0) config->command_mode = COMMAND_MODE_VERBATIM;
+  else goto invalid;
+  free(line);
+  line = NULL;
+
+  if (config->command_mode == COMMAND_MODE_ARGV) {
+    result = read_line(input, &line, &length, &total);
+    if (result != 1 || !parse_bounded_decimal(line, length, "argc:", MAX_ARGUMENTS,
+                                              &config->argc)) goto invalid;
+    free(line);
+    line = NULL;
+    if (config->argc > 0) {
+      config->argv = (wchar_t **)calloc(config->argc, sizeof(wchar_t *));
+      if (config->argv == NULL) {
+        SetLastError(ERROR_OUTOFMEMORY);
+        return 0;
+      }
+    }
+    for (DWORD i = 0; i < config->argc; i++) {
+      result = read_line(input, &line, &length, &total);
+      if (result != 1 || !parse_hex_line(line, length, "arg:", 1, &config->argv[i]))
+        goto invalid;
+      free(line);
+      line = NULL;
+    }
+  } else {
+    result = read_line(input, &line, &length, &total);
+    if (result != 1 || !parse_hex_line(line, length, "command:", 0,
+                                      &config->verbatim_command_line))
+      goto invalid;
+    free(line);
+    line = NULL;
+    if (wcslen(config->verbatim_command_line) > MAX_COMMAND_LINE_WCHARS) goto invalid;
+  }
+
+  result = read_line(input, &line, &length, &total);
+  if (result != 1 || !parse_bounded_decimal(line, length, "envc:",
+                                            MAX_ENVIRONMENT_ENTRIES, &config->envc))
+    goto invalid;
+  free(line);
+  line = NULL;
+  if (config->envc > 0) {
+    config->environment = (wchar_t **)calloc(config->envc, sizeof(wchar_t *));
+    if (config->environment == NULL) {
+      SetLastError(ERROR_OUTOFMEMORY);
+      return 0;
+    }
+  }
+  size_t environment_wchars = 1;
+  for (DWORD i = 0; i < config->envc; i++) {
+    result = read_line(input, &line, &length, &total);
+    if (result != 1 || !parse_hex_line(line, length, "env:", 0,
+                                      &config->environment[i]) ||
+        !valid_environment_entry(config->environment[i])) goto invalid;
+    environment_wchars += wcslen(config->environment[i]) + 1;
+    if (environment_wchars > MAX_ENVIRONMENT_WCHARS) goto invalid;
+    free(line);
+    line = NULL;
+  }
+  if (config->envc > 1)
+    qsort(config->environment, config->envc, sizeof(wchar_t *), environment_compare);
+  for (DWORD i = 1; i < config->envc; i++) {
+    wchar_t *previous_equals = wcschr(config->environment[i - 1], L'=');
+    wchar_t *current_equals = wcschr(config->environment[i], L'=');
+    size_t previous_length = (size_t)(previous_equals - config->environment[i - 1]);
+    size_t current_length = (size_t)(current_equals - config->environment[i]);
+    if (previous_length == current_length &&
+        _wcsnicmp(config->environment[i - 1], config->environment[i], previous_length) == 0)
+      goto invalid;
+  }
+
+  result = read_line(input, &line, &length, &total);
+  if (result != 1 || !parse_bounded_decimal(line, length, "natural_drain_grace_ms:",
+                                            MAX_DRAIN_GRACE_MS,
+                                            &config->natural_drain_grace_ms)) goto invalid;
+  free(line);
+  line = NULL;
+  result = read_line(input, &line, &length, &total);
+  if (result != 1 || !parse_bounded_decimal(line, length, "forced_drain_grace_ms:",
+                                            MAX_DRAIN_GRACE_MS,
+                                            &config->forced_drain_grace_ms)) goto invalid;
+  free(line);
+  line = NULL;
+  result = read_line(input, &line, &length, &total);
+  if (result != 1 || strcmp(line, "end") != 0) goto invalid;
+  free(line);
+  if (config->cwd[0] == L'\0') {
+    free(config->cwd);
+    config->cwd = NULL;
+  }
+  return 1;
+
+invalid:
+  free(line);
+  SetLastError(ERROR_INVALID_DATA);
+  return 0;
+}
+
+static int is_absolute_path(const wchar_t *path) {
+  if (path == NULL) return 0;
+  size_t length = wcslen(path);
+  int drive_absolute = length >= 3 &&
+    ((path[0] >= L'A' && path[0] <= L'Z') ||
+     (path[0] >= L'a' && path[0] <= L'z')) &&
+    path[1] == L':' && (path[2] == L'\\' || path[2] == L'/');
+  int unc_absolute = length >= 3 && path[0] == L'\\' && path[1] == L'\\'
+    && path[2] != L'\0';
+  return drive_absolute || unc_absolute;
+}
+
+static int open_provider_stdio(const keeper_config *config, HANDLE handles[3],
+                               HANDLE output_reads[2], HANDLE output_files[2]) {
+  if ((config->cwd != NULL && !is_absolute_path(config->cwd)) ||
+      !is_absolute_path(config->executable) ||
+      (config->stdin_path[0] != L'\0' && !is_absolute_path(config->stdin_path)) ||
+      !is_absolute_path(config->stdout_path) || !is_absolute_path(config->stderr_path)) {
+    SetLastError(ERROR_BAD_PATHNAME);
+    return 0;
+  }
+  SECURITY_ATTRIBUTES security = { sizeof(security), NULL, TRUE };
+  const wchar_t *stdin_name = config->stdin_path[0] == L'\0' ? L"NUL" : config->stdin_path;
+  handles[0] = CreateFileW(stdin_name, GENERIC_READ, FILE_SHARE_READ, &security,
+                           OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
+  if (handles[0] == INVALID_HANDLE_VALUE) return 0;
+  SECURITY_ATTRIBUTES private_security = { sizeof(private_security), NULL, FALSE };
+  output_files[0] = CreateFileW(config->stdout_path, GENERIC_WRITE, 0, &private_security,
+                                CREATE_NEW, FILE_ATTRIBUTE_NORMAL, NULL);
+  if (output_files[0] == INVALID_HANDLE_VALUE) return 0;
+  output_files[1] = CreateFileW(config->stderr_path, GENERIC_WRITE, 0, &private_security,
+                                CREATE_NEW, FILE_ATTRIBUTE_NORMAL, NULL);
+  if (output_files[1] == INVALID_HANDLE_VALUE) return 0;
+  for (size_t i = 0; i < 2; i++) {
+    if (!CreatePipe(&output_reads[i], &handles[i + 1], &security, 0)) return 0;
+    if (!SetHandleInformation(output_reads[i], HANDLE_FLAG_INHERIT, 0)) return 0;
+  }
+  return 1;
+}
+
+static DWORD WINAPI output_thread(void *context) {
+  output_state *state = (output_state *)context;
+  unsigned char buffer[64 * 1024];
+  ULONGLONG written_total = 0;
+  for (;;) {
+    DWORD read = 0;
+    if (!ReadFile(state->input, buffer, sizeof(buffer), &read, NULL)) {
+      DWORD error = GetLastError();
+      if (error == ERROR_BROKEN_PIPE || error == ERROR_HANDLE_EOF) break;
+      state->error = error;
+      InterlockedExchange(&state->failed, 1);
+      SetEvent(state->event);
+      return 1;
+    }
+    if (read == 0) break;
+    ULONGLONG remaining = state->max_bytes - written_total;
+    DWORD accepted = remaining < read ? (DWORD)remaining : read;
+    DWORD offset = 0;
+    while (offset < accepted) {
+      DWORD written = 0;
+      if (!WriteFile(state->output, buffer + offset, accepted - offset, &written, NULL)
+          || written == 0) {
+        state->error = GetLastError();
+        InterlockedExchange(&state->failed, 1);
+        SetEvent(state->event);
+        return 1;
+      }
+      offset += written;
+    }
+    written_total += accepted;
+    if (accepted < read) {
+      InterlockedExchange(&state->limit_exceeded, 1);
+      SetEvent(state->event);
+    }
+  }
+  if (!FlushFileBuffers(state->output)) {
+    state->error = GetLastError();
+    InterlockedExchange(&state->failed, 1);
+    SetEvent(state->event);
+    return 1;
+  }
+  return 0;
+}
+
+static int append_wchar(wchar_t *buffer, size_t capacity, size_t *used, wchar_t value) {
+  if (*used + 1 >= capacity) {
+    SetLastError(ERROR_BUFFER_OVERFLOW);
+    return 0;
+  }
+  buffer[(*used)++] = value;
+  return 1;
+}
+
+static int append_quoted_arg(wchar_t *buffer, size_t capacity, size_t *used,
+                             const wchar_t *arg) {
+  int quote = arg[0] == L'\0' || wcspbrk(arg, L" \t\"") != NULL;
+  if (!quote) {
+    while (*arg != L'\0') if (!append_wchar(buffer, capacity, used, *arg++)) return 0;
+    return 1;
+  }
+  if (!append_wchar(buffer, capacity, used, L'\"')) return 0;
+  size_t backslashes = 0;
+  for (; *arg != L'\0'; arg++) {
+    if (*arg == L'\\') {
+      backslashes++;
+      continue;
+    }
+    size_t count = *arg == L'\"' ? backslashes * 2 + 1 : backslashes;
+    for (size_t i = 0; i < count; i++)
+      if (!append_wchar(buffer, capacity, used, L'\\')) return 0;
+    backslashes = 0;
+    if (!append_wchar(buffer, capacity, used, *arg)) return 0;
+  }
+  for (size_t i = 0; i < backslashes * 2; i++)
+    if (!append_wchar(buffer, capacity, used, L'\\')) return 0;
+  return append_wchar(buffer, capacity, used, L'\"');
+}
+
+static wchar_t *build_command_line(const keeper_config *config) {
+  if (config->command_mode == COMMAND_MODE_VERBATIM) {
+    size_t length = wcslen(config->verbatim_command_line);
+    wchar_t *command = (wchar_t *)malloc((length + 1) * sizeof(wchar_t));
+    if (command == NULL) {
+      SetLastError(ERROR_OUTOFMEMORY);
+      return NULL;
+    }
+    memcpy(command, config->verbatim_command_line, (length + 1) * sizeof(wchar_t));
+    return command;
+  }
+  const size_t capacity = 32768;
+  wchar_t *command = (wchar_t *)calloc(capacity, sizeof(wchar_t));
+  if (command == NULL) {
+    SetLastError(ERROR_OUTOFMEMORY);
+    return NULL;
+  }
+  size_t used = 0;
+  if (!append_quoted_arg(command, capacity, &used, config->executable)) goto fail;
+  for (DWORD i = 0; i < config->argc; i++) {
+    if (!append_wchar(command, capacity, &used, L' ') ||
+        !append_quoted_arg(command, capacity, &used, config->argv[i])) goto fail;
+  }
+  return command;
+fail:
+  free(command);
+  return NULL;
+}
+
+static wchar_t *build_environment_block(const keeper_config *config) {
+  size_t total = config->envc == 0 ? 2 : 1;
+  for (DWORD i = 0; i < config->envc; i++) total += wcslen(config->environment[i]) + 1;
+  if (total > MAX_ENVIRONMENT_WCHARS) {
+    SetLastError(ERROR_BUFFER_OVERFLOW);
+    return NULL;
+  }
+  wchar_t *block = (wchar_t *)calloc(total, sizeof(wchar_t));
+  if (block == NULL) {
+    SetLastError(ERROR_OUTOFMEMORY);
+    return NULL;
+  }
+  wchar_t *cursor = block;
+  for (DWORD i = 0; i < config->envc; i++) {
+    size_t length = wcslen(config->environment[i]);
+    memcpy(cursor, config->environment[i], (length + 1) * sizeof(wchar_t));
+    cursor += length + 1;
+  }
+  *cursor = L'\0';
+  return block;
+}
+
+static int sha256_bytes(const void *bytes, ULONG length, unsigned char digest[32]) {
+  BCRYPT_ALG_HANDLE algorithm = NULL;
+  BCRYPT_HASH_HANDLE hash = NULL;
+  int ok = 0;
+  if (BCryptOpenAlgorithmProvider(&algorithm, BCRYPT_SHA256_ALGORITHM, NULL, 0) < 0)
+    goto cleanup;
+  if (BCryptCreateHash(algorithm, &hash, NULL, 0, NULL, 0, 0) < 0) goto cleanup;
+  if (BCryptHashData(hash, (PUCHAR)bytes, length, 0) < 0) goto cleanup;
+  if (BCryptFinishHash(hash, digest, 32, 0) < 0) goto cleanup;
+  ok = 1;
+cleanup:
+  if (hash != NULL) BCryptDestroyHash(hash);
+  if (algorithm != NULL) BCryptCloseAlgorithmProvider(algorithm, 0);
+  if (!ok) SetLastError(ERROR_GEN_FAILURE);
+  return ok;
+}
+
+static int create_job(HANDLE *job, HANDLE *completion_port,
+                      ULONG_PTR *completion_key, char identifier[65]) {
+  unsigned char nonce[32];
+  if (BCryptGenRandom(NULL, nonce, sizeof(nonce), BCRYPT_USE_SYSTEM_PREFERRED_RNG) < 0) {
+    SetLastError(ERROR_GEN_FAILURE);
+    return 0;
+  }
+  *job = CreateJobObjectW(NULL, NULL);
+  if (*job == NULL) return 0;
+  JOBOBJECT_EXTENDED_LIMIT_INFORMATION limits;
+  memset(&limits, 0, sizeof(limits));
+  limits.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
+  if (!SetInformationJobObject(*job, JobObjectExtendedLimitInformation, &limits,
+                               sizeof(limits))) goto fail;
+  *completion_port = CreateIoCompletionPort(INVALID_HANDLE_VALUE, NULL, 0, 1);
+  if (*completion_port == NULL) goto fail;
+  *completion_key = (ULONG_PTR)*job;
+  JOBOBJECT_ASSOCIATE_COMPLETION_PORT association;
+  association.CompletionKey = (PVOID)*completion_key;
+  association.CompletionPort = *completion_port;
+  if (!SetInformationJobObject(*job, JobObjectAssociateCompletionPortInformation,
+                               &association, sizeof(association))) goto fail;
+  unsigned char digest[32];
+  if (!sha256_bytes(nonce, sizeof(nonce), digest)) goto fail;
+  static const char hex[] = "0123456789abcdef";
+  for (size_t i = 0; i < 32; i++) {
+    identifier[i * 2] = hex[digest[i] >> 4];
+    identifier[i * 2 + 1] = hex[digest[i] & 15];
+  }
+  identifier[64] = '\0';
+  return 1;
+fail: {
+    DWORD error = GetLastError();
+    if (*completion_port != NULL) {
+      CloseHandle(*completion_port);
+      *completion_port = NULL;
+    }
+    CloseHandle(*job);
+    *job = NULL;
+    SetLastError(error);
+    return 0;
+  }
+}
+
+static int process_identity(HANDLE process, ULONGLONG *created) {
+  FILETIME creation, exit, kernel, user;
+  if (!GetProcessTimes(process, &creation, &exit, &kernel, &user)) return 0;
+  ULARGE_INTEGER value;
+  value.LowPart = creation.dwLowDateTime;
+  value.HighPart = creation.dwHighDateTime;
+  *created = value.QuadPart;
+  return 1;
+}
+
+static int wait_for_active_process_zero(HANDLE completion_port,
+                                        ULONG_PTR completion_key,
+                                        DWORD grace_ms, int *drained) {
+  ULONGLONG deadline = GetTickCount64() + grace_ms;
+  *drained = 0;
+  for (;;) {
+    ULONGLONG now = GetTickCount64();
+    DWORD remaining = now >= deadline ? 0 : (DWORD)(deadline - now);
+    DWORD message = 0;
+    ULONG_PTR received_key = 0;
+    LPOVERLAPPED overlapped = NULL;
+    if (!GetQueuedCompletionStatus(completion_port, &message, &received_key,
+                                   &overlapped, remaining)) {
+      DWORD error = GetLastError();
+      if (error == WAIT_TIMEOUT) return 1;
+      SetLastError(error);
+      return 0;
+    }
+    if (received_key == completion_key &&
+        message == JOB_OBJECT_MSG_ACTIVE_PROCESS_ZERO) {
+      *drained = 1;
+      return 1;
+    }
+  }
+}
+
+static DWORD WINAPI control_thread(void *context) {
+  control_state *state = (control_state *)context;
+  size_t total = 0;
+  char *line = NULL;
+  size_t length = 0;
+  int result = read_line(state->input, &line, &length, &total);
+  LONG reason = CONTROL_PROTOCOL_ERROR;
+  if (result == 0) reason = CONTROL_EOF;
+  else if (result == 1 && strcmp(line, "terminate") == 0) reason = CONTROL_TERMINATE;
+  free(line);
+  InterlockedCompareExchange(&state->reason, reason, CONTROL_NONE);
+  SetEvent(state->event);
+  return 0;
+}
+
+static int await_release(HANDLE input) {
+  size_t total = 0;
+  char *line = NULL;
+  size_t length = 0;
+  int result = read_line(input, &line, &length, &total);
+  int released = result == 1 && strcmp(line, "release") == 0;
+  free(line);
+  if (!released) SetLastError(result == 0 ? ERROR_BROKEN_PIPE : ERROR_INVALID_DATA);
+  return released;
+}
+
+int wmain(void) {
+  int exit_status = 1;
+  HANDLE input = GetStdHandle(STD_INPUT_HANDLE);
+  HANDLE output = GetStdHandle(STD_OUTPUT_HANDLE);
+  HANDLE error_output = GetStdHandle(STD_ERROR_HANDLE);
+  keeper_config config;
+  memset(&config, 0, sizeof(config));
+  HANDLE stdio[3] = { INVALID_HANDLE_VALUE, INVALID_HANDLE_VALUE, INVALID_HANDLE_VALUE };
+  HANDLE output_reads[2] = { INVALID_HANDLE_VALUE, INVALID_HANDLE_VALUE };
+  HANDLE output_files[2] = { INVALID_HANDLE_VALUE, INVALID_HANDLE_VALUE };
+  HANDLE output_threads[2] = { NULL, NULL };
+  HANDLE output_event = NULL;
+  output_state outputs[2];
+  memset(outputs, 0, sizeof(outputs));
+  HANDLE job = NULL;
+  HANDLE job_completion_port = NULL;
+  ULONG_PTR job_completion_key = 0;
+  HANDLE control_event = NULL;
+  HANDLE reader = NULL;
+  PROCESS_INFORMATION root;
+  memset(&root, 0, sizeof(root));
+  wchar_t *command_line = NULL;
+  wchar_t *environment_block = NULL;
+  LPPROC_THREAD_ATTRIBUTE_LIST attributes = NULL;
+  int attributes_initialized = 0;
+  int contained = 0;
+  char job_identifier[65];
+  DWORD root_exit_code = STILL_ACTIVE;
+  int root_exit_observed = 0;
+  const char *completion_reason = "root_exit";
+
+  if (input == NULL || input == INVALID_HANDLE_VALUE || output == NULL ||
+      output == INVALID_HANDLE_VALUE || error_output == NULL ||
+      error_output == INVALID_HANDLE_VALUE) {
+    emit_error("stdio", ERROR_INVALID_HANDLE);
+    goto cleanup;
+  }
+  if (!read_config(input, &config)) {
+    emit_error("config", GetLastError());
+    goto cleanup;
+  }
+  if (!open_provider_stdio(&config, stdio, output_reads, output_files)) {
+    emit_error("provider_stdio", GetLastError());
+    goto cleanup;
+  }
+  output_event = CreateEventW(NULL, TRUE, FALSE, NULL);
+  if (output_event == NULL) {
+    emit_error("output_event", GetLastError());
+    goto cleanup;
+  }
+  for (size_t i = 0; i < 2; i++) {
+    outputs[i].input = output_reads[i];
+    outputs[i].output = output_files[i];
+    outputs[i].event = output_event;
+    outputs[i].max_bytes = config.max_output_bytes;
+    output_threads[i] = CreateThread(NULL, 0, output_thread, &outputs[i], 0, NULL);
+    if (output_threads[i] == NULL) {
+      emit_error("output_thread", GetLastError());
+      goto cleanup;
+    }
+  }
+  if (!create_job(&job, &job_completion_port, &job_completion_key,
+                  job_identifier)) {
+    emit_error("create_job", GetLastError());
+    goto cleanup;
+  }
+  command_line = build_command_line(&config);
+  if (command_line == NULL) {
+    emit_error("command_line", GetLastError());
+    goto cleanup;
+  }
+  environment_block = build_environment_block(&config);
+  if (environment_block == NULL) {
+    emit_error("environment_block", GetLastError());
+    goto cleanup;
+  }
+
+  SIZE_T attribute_bytes = 0;
+  InitializeProcThreadAttributeList(NULL, 1, 0, &attribute_bytes);
+  attributes = (LPPROC_THREAD_ATTRIBUTE_LIST)malloc(attribute_bytes);
+  if (attributes == NULL) {
+    emit_error("attribute_memory", ERROR_OUTOFMEMORY);
+    goto cleanup;
+  }
+  if (!InitializeProcThreadAttributeList(attributes, 1, 0, &attribute_bytes)) {
+    emit_error("attribute_list", GetLastError());
+    goto cleanup;
+  }
+  attributes_initialized = 1;
+  if (!UpdateProcThreadAttribute(attributes, 0, PROC_THREAD_ATTRIBUTE_HANDLE_LIST,
+                                 stdio, sizeof(stdio), NULL, NULL)) {
+    emit_error("attribute_handles", GetLastError());
+    goto cleanup;
+  }
+  STARTUPINFOEXW startup;
+  memset(&startup, 0, sizeof(startup));
+  startup.StartupInfo.cb = sizeof(startup);
+  startup.StartupInfo.dwFlags = STARTF_USESTDHANDLES;
+  startup.StartupInfo.hStdInput = stdio[0];
+  startup.StartupInfo.hStdOutput = stdio[1];
+  startup.StartupInfo.hStdError = stdio[2];
+  startup.lpAttributeList = attributes;
+  if (!CreateProcessW(config.executable, command_line, NULL, NULL, TRUE,
+                      CREATE_SUSPENDED | CREATE_UNICODE_ENVIRONMENT |
+                        EXTENDED_STARTUPINFO_PRESENT,
+                      environment_block, config.cwd, &startup.StartupInfo, &root)) {
+    emit_error("create_process", GetLastError());
+    goto cleanup;
+  }
+  CloseHandle(stdio[1]);
+  stdio[1] = INVALID_HANDLE_VALUE;
+  CloseHandle(stdio[2]);
+  stdio[2] = INVALID_HANDLE_VALUE;
+  if (!AssignProcessToJobObject(job, root.hProcess)) {
+    emit_error("assign_process", GetLastError());
+    goto cleanup;
+  }
+  contained = 1;
+  ULONGLONG keeper_created = 0;
+  ULONGLONG root_created = 0;
+  if (!process_identity(GetCurrentProcess(), &keeper_created) ||
+      !process_identity(root.hProcess, &root_created)) {
+    emit_error("process_times", GetLastError());
+    goto cleanup;
+  }
+
+  printf("{\"schema_version\":\"intentdna.windows_job_keeper_fact.v1\","
+         "\"kind\":\"contained_ready\",\"job_identifier\":\"sha256:%s\","
+         "\"keeper_pid\":%lu,\"keeper_creation_filetime\":\"%llu\","
+         "\"root_pid\":%lu,\"root_creation_filetime\":\"%llu\"}\n",
+         job_identifier, (unsigned long)GetCurrentProcessId(),
+         (unsigned long long)keeper_created, (unsigned long)root.dwProcessId,
+         (unsigned long long)root_created);
+  fflush(stdout);
+
+  if (!await_release(input)) {
+    emit_error("release_gate", GetLastError());
+    goto cleanup;
+  }
+  if (ResumeThread(root.hThread) == (DWORD)-1) {
+    emit_error("resume_process", GetLastError());
+    goto cleanup;
+  }
+  printf("{\"schema_version\":\"intentdna.windows_job_keeper_fact.v1\","
+         "\"kind\":\"released\",\"root_pid\":%lu}\n",
+         (unsigned long)root.dwProcessId);
+  fflush(stdout);
+
+  control_event = CreateEventW(NULL, TRUE, FALSE, NULL);
+  if (control_event == NULL) {
+    emit_error("control_event", GetLastError());
+    goto cleanup;
+  }
+  control_state control = { input, control_event, CONTROL_NONE };
+  reader = CreateThread(NULL, 0, control_thread, &control, 0, NULL);
+  if (reader == NULL) {
+    emit_error("control_thread", GetLastError());
+    goto cleanup;
+  }
+
+  HANDLE waits[3] = { root.hProcess, control_event, output_event };
+  DWORD wait_result = WaitForMultipleObjects(3, waits, FALSE, INFINITE);
+  int force_termination = 0;
+  if (wait_result == WAIT_OBJECT_0) {
+    root_exit_observed = 1;
+    if (!GetExitCodeProcess(root.hProcess, &root_exit_code)) {
+      emit_error("root_exit_code", GetLastError());
+      goto cleanup;
+    }
+    ULONGLONG deadline = GetTickCount64() + config.natural_drain_grace_ms;
+    for (;;) {
+      ULONGLONG now = GetTickCount64();
+      DWORD wait_ms = now >= deadline ? 0 :
+        (DWORD)((deadline - now) < 10 ? deadline - now : 10);
+      int drained = 0;
+      if (!wait_for_active_process_zero(job_completion_port, job_completion_key,
+                                        wait_ms, &drained)) {
+        emit_error("drain_job", GetLastError());
+        goto cleanup;
+      }
+      if (drained) break;
+      if (WaitForSingleObject(output_event, 0) == WAIT_OBJECT_0) {
+        if (outputs[0].failed || outputs[1].failed) {
+          emit_error("provider_output", outputs[0].failed ? outputs[0].error : outputs[1].error);
+          goto cleanup;
+        }
+        completion_reason = "output_limit";
+        force_termination = 1;
+        break;
+      }
+      if (WaitForSingleObject(control_event, 10) == WAIT_OBJECT_0) {
+        LONG reason = InterlockedCompareExchange(&control.reason, CONTROL_NONE, CONTROL_NONE);
+        completion_reason = reason == CONTROL_TERMINATE ? "terminate" :
+                            reason == CONTROL_EOF ? "parent_eof" : "protocol_error";
+        force_termination = 1;
+        break;
+      }
+      if (GetTickCount64() >= deadline) {
+        completion_reason = "drain_timeout";
+        force_termination = 1;
+        break;
+      }
+    }
+  } else if (wait_result == WAIT_OBJECT_0 + 1) {
+    LONG reason = InterlockedCompareExchange(&control.reason, CONTROL_NONE, CONTROL_NONE);
+    completion_reason = reason == CONTROL_TERMINATE ? "terminate" :
+                        reason == CONTROL_EOF ? "parent_eof" : "protocol_error";
+    force_termination = 1;
+  } else if (wait_result == WAIT_OBJECT_0 + 2) {
+    if (outputs[0].failed || outputs[1].failed) {
+      emit_error("provider_output", outputs[0].failed ? outputs[0].error : outputs[1].error);
+      goto cleanup;
+    }
+    completion_reason = "output_limit";
+    force_termination = 1;
+  } else {
+    emit_error("wait", GetLastError());
+    goto cleanup;
+  }
+
+  if (force_termination) {
+    if (!TerminateJobObject(job, TERMINATE_EXIT_CODE)) {
+      emit_error("terminate_job", GetLastError());
+      goto cleanup;
+    }
+    int drained = 0;
+    if (!wait_for_active_process_zero(job_completion_port, job_completion_key,
+                                      config.forced_drain_grace_ms, &drained)) {
+      emit_error("drain_job", GetLastError());
+      goto cleanup;
+    }
+    if (!drained) {
+      SetLastError(WAIT_TIMEOUT);
+      emit_error("drain_job", GetLastError());
+      goto cleanup;
+    }
+    if (!root_exit_observed &&
+        WaitForSingleObject(root.hProcess, config.forced_drain_grace_ms) == WAIT_OBJECT_0) {
+      root_exit_observed = GetExitCodeProcess(root.hProcess, &root_exit_code) != 0;
+    }
+  }
+
+  if (WaitForMultipleObjects(2, output_threads, TRUE, INFINITE) != WAIT_OBJECT_0) {
+    emit_error("join_output", GetLastError());
+    goto cleanup;
+  }
+  if (outputs[0].failed || outputs[1].failed) {
+    emit_error("provider_output", outputs[0].failed ? outputs[0].error : outputs[1].error);
+    goto cleanup;
+  }
+  if (outputs[0].limit_exceeded || outputs[1].limit_exceeded)
+    completion_reason = "output_limit";
+
+  printf("{\"schema_version\":\"intentdna.windows_job_keeper_fact.v1\","
+         "\"kind\":\"completed\",\"reason\":\"%s\","
+         "\"root_exit_observed\":%s,\"root_exit_code\":%lu,"
+         "\"windows_signal\":null,\"active_processes\":0,"
+         "\"process_tree_drained\":true}\n",
+         completion_reason, root_exit_observed ? "true" : "false",
+         (unsigned long)root_exit_code);
+  fflush(stdout);
+  exit_status = strcmp(completion_reason, "protocol_error") == 0 ? 2 : 0;
+
+cleanup:
+  if (exit_status != 0 && contained && job != NULL) {
+    TerminateJobObject(job, TERMINATE_EXIT_CODE);
+    int drained = 0;
+    wait_for_active_process_zero(job_completion_port, job_completion_key,
+                                 config.forced_drain_grace_ms, &drained);
+  } else if (exit_status != 0 && root.hProcess != NULL) {
+    if (!TerminateProcess(root.hProcess, TERMINATE_EXIT_CODE))
+      emit_error("terminate_uncontained_process", GetLastError());
+    if (WaitForSingleObject(root.hProcess, INFINITE) != WAIT_OBJECT_0)
+      emit_error("wait_uncontained_process", GetLastError());
+  }
+  if (reader != NULL) {
+    CancelSynchronousIo(reader);
+    WaitForSingleObject(reader, INFINITE);
+  }
+  if (root.hThread != NULL) CloseHandle(root.hThread);
+  if (root.hProcess != NULL) CloseHandle(root.hProcess);
+  if (reader != NULL) CloseHandle(reader);
+  if (control_event != NULL) CloseHandle(control_event);
+  if (output_event != NULL) CloseHandle(output_event);
+  if (job != NULL) CloseHandle(job);
+  if (job_completion_port != NULL) CloseHandle(job_completion_port);
+  for (size_t i = 0; i < 3; i++)
+    if (stdio[i] != INVALID_HANDLE_VALUE) CloseHandle(stdio[i]);
+  for (size_t i = 0; i < 2; i++) {
+    if (output_threads[i] != NULL) CloseHandle(output_threads[i]);
+    if (output_reads[i] != INVALID_HANDLE_VALUE) CloseHandle(output_reads[i]);
+    if (output_files[i] != INVALID_HANDLE_VALUE) CloseHandle(output_files[i]);
+  }
+  if (attributes != NULL) {
+    if (attributes_initialized) DeleteProcThreadAttributeList(attributes);
+    free(attributes);
+  }
+  free(command_line);
+  free(environment_block);
+  free_config(&config);
+  return exit_status;
+}