ttsc 0.31.0 → 0.31.1

package/cmd/platform/main.go

@@ -3,8 +3,8 @@
 // The real compiler and runner commands live in the JavaScript launchers so
 // they can resolve the consuming project's `typescript` and
 // plugin descriptors. This binary supplies version/platform metadata, and the
-// hidden `__watch` command: the Linux directory notification helper the
-// unplugin adapter runs.
+// hidden `__watch` command: the native Linux and Windows directory notification
+// helper the unplugin adapter runs.
 package main
 
 import (

package/internal/sourceprocess/contain_windows.go

@@ -125,6 +125,7 @@ func runCommand(req request, cancel <-chan struct{}, out, errOut io.Writer) (com
   targetPid := 0
   targetHandle := windows.Handle(0)
   var targetErr error
+  targetPending := false
   innerResult := false
   defer func() {
     if targetHandle != 0 {
@@ -133,21 +134,17 @@ func runCommand(req request, cancel <-chan struct{}, out, errOut io.Writer) (com
       }
     }
   }()
-  retainTarget := func() error {
-    data, readErr := os.ReadFile(filepath.Join(dir, "started.json"))
+  retainTarget := func() (bool, error) {
+    target, pending, readErr := readWindowsStarted(filepath.Join(dir, "started.json"))
     if readErr != nil {
-      return readErr
-    }
-    var target windowsStarted
-    if decodeErr := json.Unmarshal(data, &target); decodeErr != nil {
-      return decodeErr
+      return pending, readErr
     }
     retained, retainErr := retainWindowsTarget(target, job)
     if retainErr != nil {
-      return retainErr
+      return false, retainErr
     }
     targetHandle, targetPid = retained, int(target.Pid)
-    return nil
+    return false, nil
   }
   for !finished {
     select {
@@ -196,8 +193,8 @@ func runCommand(req request, cancel <-chan struct{}, out, errOut io.Writer) (com
         }
       }
       if started && !running && !finished {
-        targetErr = retainTarget()
-        if targetErr != nil && !os.IsNotExist(targetErr) {
+        targetPending, targetErr = retainTarget()
+        if targetErr != nil && !targetPending {
           value = failure("EPROCESS", targetErr.Error())
           finished = true
         }
@@ -233,8 +230,8 @@ func runCommand(req request, cancel <-chan struct{}, out, errOut io.Writer) (com
   // identity can still be retained here, before termination. Missing identity
   // after START is unknown, even if the job subsequently becomes empty.
   noTarget := !started || (innerResult && value.Version == 1 && value.Pid == 0 && value.Error != nil)
-  if started && targetHandle == 0 && !noTarget && (targetErr == nil || os.IsNotExist(targetErr)) {
-    targetErr = retainTarget()
+  if started && targetHandle == 0 && !noTarget && (targetErr == nil || targetPending) {
+    targetPending, targetErr = retainTarget()
   }
   originalJoined := innerResult && targetPid > 0 && value.Pid == targetPid && value.Cleanup.DirectChildJoined
   value.Cancelled = cancelled

package/internal/sourceprocess/started_windows.go

@@ -0,0 +1,41 @@
+//go:build windows
+
+package sourceprocess
+
+import (
+  "encoding/json"
+  "errors"
+  "os"
+
+  "golang.org/x/sys/windows"
+)
+
+// readWindowsStarted acquires the helper's suspended-target publication. An
+// absent file or an actual Windows sharing violation means acquisition is
+// pending, not that the helper failed or that any target was enrolled. Windows
+// can briefly refuse reads while the complete file is atomically published.
+// The command owner continues observing helper exit, cancellation and deadline.
+//
+// WARNING (#1718): keep pending file acquisition separate from process identity
+// validation. Malformed JSON and other I/O failures refuse immediately; even
+// readable bytes grant no RUN permission. retainWindowsTarget must still obtain
+// the original process by PID, creation identity and owned Job membership.
+// Never classify its native errors as a pending publication, fabricate a joined
+// target from an empty Job, or replace identity proof with a retry grace period.
+//
+// Each attempt reads and decodes the current complete bytes with no historical
+// positive cache. Work and temporary memory scale with receipt bytes, and the
+// native file handle closes within os.ReadFile. Only the owning command loop
+// retries; final retirement still reports unknown if original authority could
+// not be acquired. The Windows build constraint owns the native error code.
+func readWindowsStarted(file string) (windowsStarted, bool, error) {
+  data, err := os.ReadFile(file)
+  if err != nil {
+    return windowsStarted{}, os.IsNotExist(err) || errors.Is(err, windows.ERROR_SHARING_VIOLATION), err
+  }
+  var started windowsStarted
+  if err := json.Unmarshal(data, &started); err != nil {
+    return windowsStarted{}, false, err
+  }
+  return started, false, nil
+}

package/internal/sourceprocess/windows_started_publication_distinguishes_pending_from_refusal_test.go

@@ -0,0 +1,76 @@
+//go:build windows
+
+package sourceprocess
+
+import (
+  "errors"
+  "os"
+  "path/filepath"
+  "testing"
+
+  "golang.org/x/sys/windows"
+)
+
+// TestWindowsStartedPublicationDistinguishesPendingFromRefusal verifies native
+// publication acquisition without treating its readable bytes as enrollment.
+//
+// 1. Keep missing input pending, then lock a real complete receipt exclusively.
+// 2. Require an actual sharing violation to remain pending and recover on close.
+// 3. Refuse malformed bytes and a native directory read, then recover a repair.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual Windows CreateFile with no sharing makes the maintained receipt reader fail with ERROR_SHARING_VIOLATION; releasing that handle yields the literal decoded record. Missing input stays pending, while malformed JSON and a real directory read refuse without pending authority. Repair is observed without historical success or failure caching.
+// @evidence contracts/testing.md#independent-expectations Authored schema-one bytes declare PID 7 and creation 42 solely as decoding inputs; Windows' exclusive sharing contract supplies the expected native error. These literals do not certify a real process, which remains retainWindowsTarget's separate admission responsibility.
+// @evidence contracts/testing.md#distinguishing-cases Missing and temporarily unreadable complete publications contrast with readable valid bytes, corrupt JSON and other native I/O refusal. Real release and repair distinguish acquisition recovery from a cached verdict. TestWindowsTargetOwnsSuspendedAdmission separately rejects foreign/missing PID, creation and Job identity; ordinary owned-process E2E covers actual RPC cancellation and cleanup.
+// @evidence contracts/testing.md#execution-ownership This Windows package unit directly calls its owning reader with t.TempDir files and one real exclusive native handle, closed on every path before directory cleanup. It builds or starts no compiler, plugin, product host or consumer and does not replace filesystem/process methods.
+func TestWindowsStartedPublicationDistinguishesPendingFromRefusal(t *testing.T) {
+  directory := t.TempDir()
+  file := filepath.Join(directory, "started.json")
+  if target, pending, err := readWindowsStarted(file); !pending || !os.IsNotExist(err) || target != (windowsStarted{}) {
+    t.Fatalf("missing publication: target=%+v pending=%t error=%v", target, pending, err)
+  }
+  data := []byte(`{"version":1,"pid":7,"created":42}`)
+  if err := os.WriteFile(file, data, 0600); err != nil {
+    t.Fatal(err)
+  }
+  name, err := windows.UTF16PtrFromString(file)
+  if err != nil {
+    t.Fatal(err)
+  }
+  handle, err := windows.CreateFile(name, windows.GENERIC_READ, 0, nil, windows.OPEN_EXISTING, windows.FILE_ATTRIBUTE_NORMAL, 0)
+  if err != nil {
+    t.Fatal(err)
+  }
+  defer func() {
+    if handle != 0 {
+      if err := windows.CloseHandle(handle); err != nil {
+        t.Error(err)
+      }
+    }
+  }()
+  if target, pending, err := readWindowsStarted(file); !pending || !errors.Is(err, windows.ERROR_SHARING_VIOLATION) || target != (windowsStarted{}) {
+    t.Fatalf("locked publication: target=%+v pending=%t error=%v", target, pending, err)
+  }
+  if err := windows.CloseHandle(handle); err != nil {
+    t.Fatal(err)
+  }
+  handle = 0
+  expected := windowsStarted{Version: 1, Pid: 7, Created: 42}
+  if target, pending, err := readWindowsStarted(file); err != nil || pending || target != expected {
+    t.Fatalf("released publication: target=%+v pending=%t error=%v", target, pending, err)
+  }
+  if err := os.WriteFile(file, []byte(`{"version":1`), 0600); err != nil {
+    t.Fatal(err)
+  }
+  if target, pending, err := readWindowsStarted(file); err == nil || pending || target != (windowsStarted{}) {
+    t.Fatalf("malformed publication: target=%+v pending=%t error=%v", target, pending, err)
+  }
+  if _, pending, err := readWindowsStarted(directory); err == nil || pending {
+    t.Fatalf("directory refusal: pending=%t error=%v", pending, err)
+  }
+  if err := os.WriteFile(file, data, 0600); err != nil {
+    t.Fatal(err)
+  }
+  if target, pending, err := readWindowsStarted(file); err != nil || pending || target != expected {
+    t.Fatalf("repaired publication: target=%+v pending=%t error=%v", target, pending, err)
+  }
+}

package/internal/watchhelper/run.go

@@ -2,31 +2,41 @@ package watchhelper
 
 import "io"
 
-// Run serves the protocol over stdin and stdout and returns an exit code.
+// Run serves the platform watch protocol over caller-owned stdin and stdout.
 // End of scanned input, including a scanner error, ends the request stream;
 // backend failures or an output flush failure can also end service.
 //
-// One loop polls the inotify instance and a wake pipe the stdin reader writes
-// after queueing each request. That loop serializes emitted messages and a
-// `sync` drains the instance to an observed empty read before answering. This
-// is not a total ordering of kernel event creation and request arrival, nor a
-// guarantee that no event arrives after that read.
+// Linux uses the inotify protocol. One loop polls the instance and a wake pipe
+// the stdin reader writes after queueing each request. A sync drains the instance
+// to an observed empty read before answering. Windows uses the unplugin broker
+// protocol. One OS-thread-locked completion loop drains currently queued native
+// completions before a request, so a joining subscriber does not receive those
+// older events. Neither frontier totally orders concurrent kernel writes and
+// request arrival, nor guarantees no event arrives after the empty observation.
+// Continuous activity can prolong either drain; elapsed quiet is never proof.
 //
-// stdin and the output streams remain caller-owned. The helper owns its inotify
-// and wake descriptors and attempts their closure on every return. Its reader can remain
-// blocked on caller input after an early backend failure; the command process
-// ends when Run returns, while a library caller must close its input.
-// Queue sends are canceled on return, and wake writes are synchronized with
-// descriptor closure so a delayed reader cannot write to a reused descriptor.
+// Windows excludes access-only notifications at native acquisition (#1719).
+// NEVER discard an actual mutation by comparing its final hash or timestamps:
+// edits restored to the original bytes still invalidate compiler input proof.
+// Overflow, malformed notifications, directory loss and native failures also
+// withdraw coverage. Linux retains its native loss and directory-loss semantics.
 //
-// @evidence contracts/common.md#principled-implementation The Linux inotify instance reports actual overflow and directory loss. One poll loop drains queued events before acknowledging sync, preserving the protocol's observation ordering without guessing that quiet means unchanged.
-// @evidence contracts/common.md#clear-and-simple-design A stdin reader only decodes and queues requests; one helper loop owns watch state, ordered emission and synchronization. Kernel handles remain behind this native backend.
-// @evidence contracts/common.md#prohibited-implementation-shortcuts Supported syscalls supply watch capabilities; no foreign runtime method is replaced and no test event substitutes for an actual ready or drain boundary.
-// @evidence contracts/common.md#meaningful-documentation Native paragraphs state ordering, exit and stream ownership, including the blocked-reader limitation. The package describes every protocol message separately under documentation-skill guidance.
-// @evidence contracts/portability.md#os-neutral-implementation A Linux build constraint isolates inotify and poll. Native directory paths remain syscall inputs, not shell text; other platforms select an explicit unsupported implementation that reports usage code 2 and use adapter-owned watching.
-// @evidence contracts/performance.md#efficient-algorithms Each kernel batch is decoded linearly in its bytes; fanout visits K subscribers and JSON output also costs the repeated name bytes. Sorting O(K log K) is shared until membership changes. Removal uses indexed descriptor lookup, and the loop performs no userspace directory traversal. A drain has no event-count or time cap and may keep reading under continuous activity; native syscalls and caller writes have their own blocking costs.
-// @evidence contracts/performance.md#reuse-equivalent-work Kernel watch descriptors are shared by subscribers of the same directory. Ordered subscriber IDs are cached per descriptor and invalidated on add, remove or directory loss; all mutation belongs to the same event loop.
-// @evidence contracts/performance.md#bound-retention-and-release-resources Deferred cleanup cancels queued reader sends and attempts closure of all three owned descriptors; a mutex prevents late wake writes after closure. Blocking input reads and output writes remain caller-owned. The request channel holds at most 256 values, the scanner buffer is limited to 16 MiB, and event decoding reuses 64 KiB. Subscription maps and order slices have no independent numeric cap; matching remove/gone paths reclaim entries and process exit releases state. Reusing an ID for another descriptor without removal can leave its earlier subscription until that directory is gone or the process exits.
+// The backend owns its native handles. Linux closes its inotify and wake
+// descriptors on return. Windows cancels reads, retains each overlapped buffer
+// until its completion, then closes the completion port. A mutex synchronizes
+// reader wakes with closure, and queued sends are canceled on return. A reader
+// can remain blocked on caller input after early backend failure: the command
+// exits when Run returns, while a library caller must close that input. Blocking
+// output also remains caller-owned; this function has no independent deadline.
+//
+// @evidence contracts/common.md#principled-implementation Native inotify/completion queues establish the actual observation frontier; loss and native failure withdraw coverage. Windows omits access semantics at subscription rather than erasing delivered mutations. A joining subscriber is attached only after currently queued completions were consumed, under the documented concurrent-write limit.
+// @evidence contracts/common.md#clear-and-simple-design A stdin reader only decodes and queues requests; one backend loop owns watch state, ordered emission and synchronization. Platform protocol and kernel handles remain behind this native boundary.
+// @evidence contracts/common.md#prohibited-implementation-shortcuts Supported native APIs supply watch capabilities; no runtime method or system access-time setting is changed. Equal final bytes do not excuse A-B-A writes, and no test event substitutes for native ready/drain authority.
+// @evidence contracts/common.md#meaningful-documentation Native paragraphs state each protocol, frontier limits, mutation policy, EOF cleanup and caller stream ownership. The package documents protocol messages separately; private backend comments explain acquisition, fanout, loss and pending buffer ownership.
+// @evidence contracts/portability.md#os-neutral-implementation Build constraints isolate Linux inotify/poll and Windows overlapped completion APIs. Paths remain native API inputs, not shell text. Other native helper platforms return explicit usage code 2; the unplugin macOS adapter owns its separate FSEvents broker.
+// @evidence contracts/performance.md#efficient-algorithms Each native batch is decoded linearly in its bytes; fanout visits K subscribers and encoded name bytes. Sorting O(K log K) is shared until membership changes. Indexed native descriptors/keys serve removal and completion without userspace project traversal. Continuous activity can prolong drains; native calls and caller writes can block independently of event counts.
+// @evidence contracts/performance.md#reuse-equivalent-work Linux descriptors and Windows exact directory/recursion keys share native observation among subscribers. Ordered subscriber IDs are invalidated on membership changes; each owner retains distinct readiness and event policy. One loop serializes mutation, and Windows completion keys are never reused for another watch.
+// @evidence contracts/performance.md#bound-retention-and-release-resources Deferred cleanup cancels queued sends and closes owned handles, retaining Windows buffers until cancellation completion. A mutex prevents late wake operations against a closed/reused native handle. The request channel holds at most 256 values, scanner framing is limited to 16 MiB and native buffers use 64 KiB each. Active subscriptions/order slices have no numeric cap; removal/loss reclaim live entries, with retiring Windows entries retained until completion. Caller stream blocking has no independent bound. Linux callers must remove before reusing an ID for a different descriptor, or its earlier subscription lasts until loss or process exit.
 func Run(stdin io.Reader, stdout io.Writer, stderr io.Writer) int {
   return run(stdin, stdout, stderr)
 }

package/internal/watchhelper/run_other.go

@@ -1,4 +1,4 @@
-//go:build !linux
+//go:build !linux && !windows
 
 package watchhelper
 
@@ -7,10 +7,10 @@ import (
   "io"
 )
 
-// run reports that the helper serves Linux only. Windows and macOS watch in
-// the adapter's own broker instead.
+// run reports that the helper serves Linux and Windows. macOS uses the
+// adapter's FSEvents broker instead.
 // This alternative acquires no watch or reader task and returns usage code 2.
 func run(stdin io.Reader, stdout io.Writer, stderr io.Writer) int {
-  fmt.Fprintln(stderr, "ttsc __watch: only Linux is supported")
+  fmt.Fprintln(stderr, "ttsc __watch: only Linux and Windows are supported")
   return 2
 }