running-process 4.5.12__tar.gz → 4.6.0__tar.gz

{running_process-4.5.12 → running_process-4.6.0}/Cargo.lock

@@ -1351,7 +1351,7 @@ dependencies = [
 
 [[package]]
 name = "running-process"
-version = "4.5.12"
+version = "4.6.0"
 dependencies = [
  "anyhow",
  "blake3",
@@ -1390,7 +1390,7 @@ dependencies = [
 
 [[package]]
 name = "running-process-observer"
-version = "4.5.12"
+version = "4.6.0"
 dependencies = [
  "blake3",
  "dirs",
@@ -1400,21 +1400,21 @@ dependencies = [
 
 [[package]]
 name = "running-process-observer-interposer-linux"
-version = "4.5.12"
+version = "4.6.0"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "running-process-observer-interposer-macos"
-version = "4.5.12"
+version = "4.6.0"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "running-process-observer-interposer-windows"
-version = "4.5.12"
+version = "4.6.0"
 dependencies = [
  "retour",
  "windows-sys 0.59.0",
@@ -1422,7 +1422,7 @@ dependencies = [
 
 [[package]]
 name = "running-process-py"
-version = "4.5.12"
+version = "4.6.0"
 dependencies = [
  "interprocess",
  "libc",
@@ -1436,7 +1436,7 @@ dependencies = [
 
 [[package]]
 name = "running-process-win-gnu-bridge"
-version = "4.5.12"
+version = "4.6.0"
 dependencies = [
  "windows-sys 0.59.0",
 ]

{running_process-4.5.12 → running_process-4.6.0}/Cargo.toml

@@ -3,7 +3,7 @@ resolver = "2"
 members = ["crates/running-process", "crates/running-process-py", "crates/test-watchdog"]
 
 [workspace.package]
-version = "4.5.12"
+version = "4.6.0"
 edition = "2021"
 rust-version = "1.85"
 license = "BSD-3-Clause"

{running_process-4.5.12 → running_process-4.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: running_process
-Version: 4.5.12
+Version: 4.6.0
 License-File: LICENSE
 Summary: A Rust-backed subprocess wrapper with split stdout/stderr streaming
 Home-Page: https://github.com/zackees/running-process

{running_process-4.5.12 → running_process-4.6.0}/crates/running-process/Cargo.toml

@@ -220,6 +220,7 @@ windows-sys = { version = "0.59", features = [
     "Win32_System_Registry",
     "Win32_System_Threading",
     "Win32_System_Diagnostics_Debug",
+    "Win32_System_Environment",
 ] }
 # #445: transparent Win10 ConPTY sidecar self-acquisition. The runtime
 # fetches a per-arch zstd-19 compressed tarball from this crate's

{running_process-4.5.12 → running_process-4.6.0}/crates/running-process/src/client/client.rs

@@ -835,33 +835,9 @@ pub fn daemonize_command(command: &str) -> Result<SpawnedDaemon, ClientError> {
 /// Spawn the daemon binary as a detached background process.
 fn spawn_daemon() -> Result<(), ClientError> {
     let exe = daemon_exe_path();
-
-    #[cfg(windows)]
-    {
-        use std::os::windows::process::CommandExt;
-        // DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP
-        const DETACHED: u32 = 0x0000_0008 | 0x0000_0200;
-        std::process::Command::new(&exe)
-            .arg("start")
-            .creation_flags(DETACHED)
-            .stdin(std::process::Stdio::null())
-            .stdout(std::process::Stdio::null())
-            .stderr(std::process::Stdio::null())
-            .spawn()
-            .map_err(ClientError::Io)?;
-    }
-
-    #[cfg(unix)]
-    {
-        std::process::Command::new(&exe)
-            .arg("start")
-            .stdin(std::process::Stdio::null())
-            .stdout(std::process::Stdio::null())
-            .stderr(std::process::Stdio::null())
-            .spawn()
-            .map_err(ClientError::Io)?;
-    }
-
+    let mut command = std::process::Command::new(&exe);
+    command.arg("start");
+    crate::spawn_daemon(&mut command).map_err(ClientError::Io)?;
     Ok(())
 }
 

{running_process-4.5.12 → running_process-4.6.0}/crates/running-process/src/daemon/handlers/kill.rs

@@ -3,7 +3,7 @@
 use crate::proto::daemon::{
     DaemonRequest, DaemonResponse, KillTreeResponse, KillZombiesResponse, StatusCode, ZombieReport,
 };
-use sysinfo::{Pid, System};
+use std::time::Duration;
 
 use crate::daemon::reaper;
 
@@ -25,7 +25,17 @@ pub fn handle_kill_tree(request: &DaemonRequest, state: &DaemonState) -> DaemonR
     } else {
         3.0
     };
-    let killed = kill_process_tree_impl(req.pid, timeout);
+    let timeout = Duration::from_secs_f64(timeout.min(30.0));
+    let killed = match crate::process_tree::kill_tree(req.pid, timeout) {
+        Ok(killed) => killed,
+        Err(error) => {
+            return error_response(
+                request.id,
+                StatusCode::Internal,
+                format!("failed to kill process tree: {error}"),
+            );
+        }
+    };
 
     // Unregister from registry (if tracked).
     state.registry.unregister(req.pid);
@@ -41,47 +51,6 @@ pub fn handle_kill_tree(request: &DaemonRequest, state: &DaemonState) -> DaemonR
     }
 }
 
-/// Kill a process tree rooted at `pid`, returning the number of processes killed.
-///
-/// Collects all descendants via sysinfo, then kills them in reverse order
-/// (children before parent) so that parent processes do not respawn children.
-fn kill_process_tree_impl(pid: u32, _timeout_seconds: f64) -> u32 {
-    use sysinfo::Signal;
-
-    let mut sys = System::new();
-    sys.refresh_processes();
-
-    let target = Pid::from_u32(pid);
-
-    // Collect the root and all descendants.
-    let mut to_kill = Vec::new();
-    collect_descendants(&sys, target, &mut to_kill);
-    to_kill.push(target);
-
-    // Kill in reverse order (deepest children first, root last).
-    to_kill.reverse();
-
-    let mut killed_count = 0u32;
-    for &p in &to_kill {
-        if let Some(proc) = sys.process(p) {
-            if proc.kill_with(Signal::Kill).unwrap_or(false) {
-                killed_count += 1;
-            }
-        }
-    }
-    killed_count
-}
-
-/// Recursively collect all descendant PIDs of `parent_pid`.
-fn collect_descendants(sys: &System, parent_pid: Pid, result: &mut Vec<Pid>) {
-    for (child_pid, child_proc) in sys.processes() {
-        if child_proc.parent() == Some(parent_pid) {
-            result.push(*child_pid);
-            collect_descendants(sys, *child_pid, result);
-        }
-    }
-}
-
 /// Handle a `KillZombies` request by scanning for and optionally killing zombie processes.
 pub fn handle_kill_zombies(request: &DaemonRequest, state: &DaemonState) -> DaemonResponse {
     let Some(ref req) = request.kill_zombies else {

running_process-4.6.0/crates/running-process/src/daemon/platform/windows.rs

@@ -0,0 +1,19 @@
+// Windows-specific daemon operations.
+
+/// Re-spawn the current executable as a detached background process.
+///
+/// The spawned child receives all of `args` plus `--daemon-internal` so it
+/// knows it is already running detached. The current process exits after a
+/// successful spawn.
+pub fn daemonize(args: &[String]) -> Result<(), Box<dyn std::error::Error>> {
+    let exe = std::env::current_exe()?;
+
+    let mut cmd = std::process::Command::new(&exe);
+    cmd.args(args);
+    cmd.arg("--daemon-internal");
+    crate::spawn_daemon(&mut cmd)
+        .map_err(|e| format!("failed to spawn detached daemon: {e}").to_string())?;
+
+    // The parent exits, returning the user to the shell.
+    std::process::exit(0);
+}

{running_process-4.5.12 → running_process-4.6.0}/crates/running-process/src/daemon/shadow.rs

@@ -135,17 +135,10 @@ fn reexec_from_shadow(exe: &Path) -> Result<(), Box<dyn std::error::Error>> {
 
 #[cfg(windows)]
 fn reexec_from_shadow(exe: &Path) -> Result<(), Box<dyn std::error::Error>> {
-    use std::os::windows::process::CommandExt;
-
-    const DETACHED_PROCESS: u32 = 0x0000_0008;
-    const CREATE_NEW_PROCESS_GROUP: u32 = 0x0000_0200;
-
     let args: Vec<_> = std::env::args_os().skip(1).collect();
-    std::process::Command::new(exe)
-        .args(&args)
-        .env(SHADOW_MARKER_ENV, "1")
-        .creation_flags(DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP)
-        .spawn()?;
+    let mut command = std::process::Command::new(exe);
+    command.args(&args).env(SHADOW_MARKER_ENV, "1");
+    crate::spawn_daemon(&mut command)?;
     std::process::exit(0);
 }
 

running_process-4.6.0/crates/running-process/src/environment.rs

@@ -0,0 +1,142 @@
+//! Process environment baselines.
+//!
+//! Windows exposes the logged-in user's machine + user environment through
+//! `CreateEnvironmentBlock`. Unix has no equivalent stable OS API, so the
+//! conservative fallback is a snapshot of the current process environment.
+
+#[cfg(windows)]
+use std::ffi::c_void;
+use std::ffi::OsString;
+use std::io;
+
+/// Return the logged-in user's baseline environment.
+///
+/// On Windows this is freshly constructed from machine and user settings and
+/// therefore excludes variables that exist only in the current process. On
+/// Unix this currently falls back to the current process environment.
+pub fn user_baseline_environment() -> io::Result<Vec<(OsString, OsString)>> {
+    #[cfg(windows)]
+    {
+        let block = user_baseline_environment_block()?;
+        Ok(parse_windows_environment_block(&block))
+    }
+    #[cfg(not(windows))]
+    {
+        Ok(std::env::vars_os().collect())
+    }
+}
+
+/// Return a CreateProcessW-compatible Unicode user environment block.
+///
+/// The returned buffer is sorted and double-NUL terminated by Windows. It is
+/// useful to callers that own a manual `CreateProcessW` path.
+#[cfg(windows)]
+pub fn user_baseline_environment_block() -> io::Result<Vec<u16>> {
+    use windows_sys::Win32::Foundation::CloseHandle;
+    use windows_sys::Win32::Security::TOKEN_QUERY;
+    use windows_sys::Win32::System::Environment::{
+        CreateEnvironmentBlock, DestroyEnvironmentBlock,
+    };
+    use windows_sys::Win32::System::Threading::{GetCurrentProcess, OpenProcessToken};
+
+    let mut token = std::ptr::null_mut();
+    let opened = unsafe { OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &mut token) };
+    if opened == 0 {
+        return Err(io::Error::last_os_error());
+    }
+
+    let mut raw_block: *mut c_void = std::ptr::null_mut();
+    let created = unsafe { CreateEnvironmentBlock(&mut raw_block, token, 0) };
+    let create_error = if created == 0 {
+        Some(io::Error::last_os_error())
+    } else {
+        None
+    };
+    unsafe {
+        CloseHandle(token);
+    }
+    if let Some(error) = create_error {
+        return Err(error);
+    }
+
+    let copied = unsafe { copy_windows_environment_block(raw_block.cast::<u16>()) };
+    unsafe {
+        DestroyEnvironmentBlock(raw_block);
+    }
+    Ok(copied)
+}
+
+#[cfg(windows)]
+unsafe fn copy_windows_environment_block(cursor: *const u16) -> Vec<u16> {
+    let mut len = 0usize;
+    loop {
+        if *cursor.add(len) == 0 && *cursor.add(len + 1) == 0 {
+            len += 2;
+            break;
+        }
+        len += 1;
+    }
+    std::slice::from_raw_parts(cursor, len).to_vec()
+}
+
+#[cfg(windows)]
+fn parse_windows_environment_block(block: &[u16]) -> Vec<(OsString, OsString)> {
+    use std::os::windows::ffi::OsStringExt;
+
+    let mut env = Vec::new();
+    let mut offset = 0usize;
+    while offset < block.len() && block[offset] != 0 {
+        let Some(relative_end) = block[offset..].iter().position(|value| *value == 0) else {
+            break;
+        };
+        let end = offset + relative_end;
+        let entry = &block[offset..end];
+        // Drive-current-directory pseudo variables have the shape
+        // `=C:=C:\path`; skip index zero so their second '=' is the
+        // key/value separator.
+        if let Some(separator) = entry
+            .iter()
+            .enumerate()
+            .skip(1)
+            .find_map(|(index, value)| (*value == b'=' as u16).then_some(index))
+        {
+            let key = OsString::from_wide(&entry[..separator]);
+            let value = OsString::from_wide(&entry[separator + 1..]);
+            env.push((key, value));
+        }
+        offset = end + 1;
+    }
+    env
+}
+
+#[cfg(all(test, windows))]
+mod tests {
+    use super::*;
+    use std::ffi::OsStr;
+    use std::os::windows::ffi::OsStrExt;
+
+    #[test]
+    fn parser_preserves_drive_current_directory_entries() {
+        let block: Vec<u16> = OsStr::new("=C:=C:\\work")
+            .encode_wide()
+            .chain(std::iter::once(0))
+            .chain(OsStr::new("Path=C:\\Windows").encode_wide())
+            .chain(std::iter::once(0))
+            .chain(std::iter::once(0))
+            .collect();
+        assert_eq!(
+            parse_windows_environment_block(&block),
+            vec![
+                (OsString::from("=C:"), OsString::from("C:\\work")),
+                (OsString::from("Path"), OsString::from("C:\\Windows")),
+            ]
+        );
+    }
+
+    #[test]
+    fn live_user_baseline_is_double_nul_terminated() {
+        let block = user_baseline_environment_block().unwrap();
+        assert!(block.len() >= 2);
+        assert_eq!(&block[block.len() - 2..], &[0, 0]);
+    }
+}

{running_process-4.5.12 → running_process-4.6.0}/crates/running-process/src/lib.rs

@@ -18,6 +18,7 @@ use crate::observer::ObserverEmitter;
 
 pub mod console_detect;
 pub mod containment;
+pub mod environment;
 mod helpers;
 // Phase 1 of #221: process-observation capability model + portable
 // lifecycle baseline. Core-feature-clean (std-only: mpsc + SystemTime),
@@ -92,6 +93,7 @@ pub mod telemetry;
 #[cfg(feature = "daemon")]
 /// Daemon runtime APIs and helpers enabled by the `daemon` feature.
 pub mod daemon;
+pub mod process_tree;
 #[cfg(feature = "pty")]
 /// PTY-backed process APIs.
 pub mod pty;
@@ -116,8 +118,8 @@ pub use observer::{
 pub use originator::{find_processes_by_originator, OriginatorProcessInfo};
 pub use rust_debug::{render_rust_debug_traces, RustDebugScopeGuard};
 pub use spawn::{
-    spawn, spawn_daemon, spawn_daemon_with_clear_env, DaemonChild, SpawnStdio, SpawnedChild,
-    StdioSource,
+    spawn, spawn_daemon, spawn_daemon_with_clear_env, spawn_daemon_with_env_policy,
+    spawn_with_env_policy, DaemonChild, EnvironmentPolicy, SpawnStdio, SpawnedChild, StdioSource,
 };
 pub use terminal_graphics::{
     current_terminal_capabilities, current_terminal_capabilities_with_timeout,

running_process-4.6.0/crates/running-process/src/process_tree.rs

@@ -0,0 +1,202 @@
+//! Best-effort local process-tree termination.
+//!
+//! This API does not require the running-process daemon. It snapshots the
+//! tree, terminates the root first so it cannot create more descendants,
+//! then terminates the captured descendants deepest-first. Process start
+//! times are retained while waiting so a recycled PID is not treated as
+//! the original target. On Windows these are exact kernel creation times;
+//! other platforms use the best timestamp exposed by `sysinfo`.
+
+use std::collections::HashSet;
+use std::io;
+use std::time::{Duration, Instant};
+
+use sysinfo::{Pid, Process, System};
+
+#[derive(Clone, Copy, Debug, Eq, Hash, PartialEq)]
+struct ProcessInstance {
+    pid: Pid,
+    start_time: u64,
+}
+
+impl ProcessInstance {
+    fn from_process(pid: Pid, process: &Process) -> io::Result<Self> {
+        Ok(Self {
+            pid,
+            start_time: process_start_key(pid, process)?,
+        })
+    }
+
+    fn still_matches(self, system: &System) -> bool {
+        system.process(self.pid).is_some_and(|process| {
+            process_start_key(self.pid, process)
+                .is_ok_and(|start_time| start_time == self.start_time)
+        })
+    }
+}
+
+/// Kill the process tree rooted at `pid`.
+///
+/// Returns the number of distinct process instances for which the OS accepted
+/// a kill request. A missing PID is a successful no-op. `timeout` bounds the
+/// post-signal wait and retry loop; the initial termination attempt always
+/// occurs even when the timeout is zero.
+///
+/// The tree is a point-in-time snapshot. A process created in the narrow race
+/// between enumeration and root termination can escape unless the caller also
+/// owns an OS containment primitive such as a Windows Job Object.
+pub fn kill_tree(pid: u32, timeout: Duration) -> io::Result<u32> {
+    let mut system = System::new();
+    system.refresh_processes();
+
+    let root_pid = Pid::from_u32(pid);
+    let Some(root_process) = system.process(root_pid) else {
+        return Ok(0);
+    };
+    let root = match ProcessInstance::from_process(root_pid, root_process) {
+        Ok(root) => root,
+        Err(error) => {
+            // The process may have exited between the sysinfo snapshot and
+            // the exact identity query. Treat that race like a missing PID,
+            // but preserve access-denied and other errors for a live target.
+            system.refresh_processes();
+            if system.process(root_pid).is_none() {
+                return Ok(0);
+            }
+            return Err(error);
+        }
+    };
+
+    let mut descendants = Vec::new();
+    let mut visited = HashSet::new();
+    collect_descendants(&system, root, 1, &mut visited, &mut descendants);
+    descendants.sort_unstable_by_key(|(_, depth)| std::cmp::Reverse(*depth));
+
+    // Root first: once it exits it can no longer respawn a descendant that
+    // was present in the snapshot. Descendants then go deepest-first.
+    let mut targets = Vec::with_capacity(descendants.len() + 1);
+    targets.push(root);
+    targets.extend(descendants.into_iter().map(|(instance, _)| instance));
+
+    let mut signaled = HashSet::new();
+    signal_matching(&system, &targets, &mut signaled);
+
+    let started = Instant::now();
+    loop {
+        system.refresh_processes();
+        let remaining: Vec<_> = targets
+            .iter()
+            .copied()
+            .filter(|target| target.still_matches(&system))
+            .collect();
+        if remaining.is_empty() || started.elapsed() >= timeout {
+            break;
+        }
+
+        signal_matching(&system, &remaining, &mut signaled);
+        let sleep_for = timeout
+            .saturating_sub(started.elapsed())
+            .min(Duration::from_millis(25));
+        if sleep_for.is_zero() {
+            break;
+        }
+        std::thread::sleep(sleep_for);
+    }
+
+    Ok(signaled.len() as u32)
+}
+
+fn signal_matching(
+    system: &System,
+    targets: &[ProcessInstance],
+    signaled: &mut HashSet<ProcessInstance>,
+) {
+    for target in targets {
+        let Some(process) = system.process(target.pid) else {
+            continue;
+        };
+        if process_start_key(target.pid, process)
+            .is_ok_and(|start_time| start_time == target.start_time)
+            && process.kill()
+        {
+            signaled.insert(*target);
+        }
+    }
+}
+
+fn collect_descendants(
+    system: &System,
+    parent: ProcessInstance,
+    depth: usize,
+    visited: &mut HashSet<Pid>,
+    descendants: &mut Vec<(ProcessInstance, usize)>,
+) {
+    for (pid, process) in system.processes() {
+        if process.parent() != Some(parent.pid) || visited.contains(pid) {
+            continue;
+        }
+
+        // A process cannot be the child of a process instance created after
+        // it. This rejects stale PPID links after PID reuse. If an exact
+        // identity cannot be read, skip the ambiguous branch rather than
+        // risking termination of an unrelated process.
+        let Ok(child) = ProcessInstance::from_process(*pid, process) else {
+            continue;
+        };
+        if child.start_time < parent.start_time {
+            continue;
+        }
+
+        visited.insert(*pid);
+        descendants.push((child, depth));
+        collect_descendants(system, child, depth + 1, visited, descendants);
+    }
+}
+
+#[cfg(not(windows))]
+fn process_start_key(_pid: Pid, process: &Process) -> io::Result<u64> {
+    Ok(process.start_time())
+}
+
+#[cfg(windows)]
+fn process_start_key(pid: Pid, _process: &Process) -> io::Result<u64> {
+    use windows_sys::Win32::Foundation::{CloseHandle, FILETIME};
+    use windows_sys::Win32::System::Threading::{
+        GetProcessTimes, OpenProcess, PROCESS_QUERY_LIMITED_INFORMATION,
+    };
+
+    let handle = unsafe { OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, 0, pid.as_u32()) };
+    if handle.is_null() {
+        return Err(io::Error::last_os_error());
+    }
+
+    let mut creation: FILETIME = unsafe { std::mem::zeroed() };
+    let mut exit: FILETIME = unsafe { std::mem::zeroed() };
+    let mut kernel: FILETIME = unsafe { std::mem::zeroed() };
+    let mut user: FILETIME = unsafe { std::mem::zeroed() };
+    let queried =
+        unsafe { GetProcessTimes(handle, &mut creation, &mut exit, &mut kernel, &mut user) };
+    let query_error = if queried == 0 {
+        Some(io::Error::last_os_error())
+    } else {
+        None
+    };
+    unsafe {
+        CloseHandle(handle);
+    }
+    if let Some(error) = query_error {
+        return Err(error);
+    }
+
+    Ok((u64::from(creation.dwHighDateTime) << 32) | u64::from(creation.dwLowDateTime))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn missing_pid_is_a_successful_noop() {
+        assert_eq!(kill_tree(u32::MAX, Duration::ZERO).unwrap(), 0);
+    }
+}