running-process 4.6.1__tar.gz → 4.6.2__tar.gz

{running_process-4.6.1 → running_process-4.6.2}/Cargo.lock

@@ -1351,7 +1351,7 @@ dependencies = [
 
 [[package]]
 name = "running-process"
-version = "4.6.1"
+version = "4.6.2"
 dependencies = [
  "anyhow",
  "blake3",
@@ -1390,31 +1390,32 @@ dependencies = [
 
 [[package]]
 name = "running-process-observer"
-version = "4.6.1"
+version = "4.6.2"
 dependencies = [
  "blake3",
  "dirs",
+ "libc",
  "tempfile",
  "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "running-process-observer-interposer-linux"
-version = "4.6.1"
+version = "4.6.2"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "running-process-observer-interposer-macos"
-version = "4.6.1"
+version = "4.6.2"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "running-process-observer-interposer-windows"
-version = "4.6.1"
+version = "4.6.2"
 dependencies = [
  "retour",
  "windows-sys 0.59.0",
@@ -1422,7 +1423,7 @@ dependencies = [
 
 [[package]]
 name = "running-process-py"
-version = "4.6.1"
+version = "4.6.2"
 dependencies = [
  "interprocess",
  "libc",
@@ -1436,7 +1437,7 @@ dependencies = [
 
 [[package]]
 name = "running-process-win-gnu-bridge"
-version = "4.6.1"
+version = "4.6.2"
 dependencies = [
  "windows-sys 0.59.0",
 ]

{running_process-4.6.1 → running_process-4.6.2}/Cargo.toml

@@ -3,7 +3,7 @@ resolver = "2"
 members = ["crates/running-process", "crates/running-process-py", "crates/test-watchdog"]
 
 [workspace.package]
-version = "4.6.1"
+version = "4.6.2"
 edition = "2021"
 rust-version = "1.85"
 license = "BSD-3-Clause"

{running_process-4.6.1 → running_process-4.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: running_process
-Version: 4.6.1
+Version: 4.6.2
 License-File: LICENSE
 Summary: A Rust-backed subprocess wrapper with split stdout/stderr streaming
 Home-Page: https://github.com/zackees/running-process

{running_process-4.6.1 → running_process-4.6.2}/crates/running-process/src/bin/running-process-broker-v2.rs

@@ -45,7 +45,7 @@ use std::sync::Arc;
 use std::sync::atomic::{AtomicUsize, Ordering};
 use std::thread;
 
-use interprocess::local_socket::traits::Listener as _;
+use interprocess::local_socket::traits::{Listener as _, Stream as _};
 use interprocess::local_socket::ListenerOptions;
 use prost::Message;
 use running_process::broker::lifecycle::names_v2::v2_program_pipe;
@@ -57,6 +57,7 @@ use running_process::broker::protocol::{
 };
 use running_process::broker::protocol_v2::ServiceDefinitionLoader;
 use running_process::broker::server::service_def_loader::ServiceDefinitionError;
+use running_process::broker::server::deadline_stream::{hello_read_deadline, DeadlineStream};
 
 /// Default program name when `--program` is not passed. Matches the
 /// slice-3c scaffold so existing integration tests keep working.
@@ -66,6 +67,23 @@ const SCAFFOLD_PIPE_IDX: u32 = 0;
 /// Maximum in-flight Hello handlers. Conservative cap; the OS thread
 /// cap is the hard upper bound but we want backpressure before that.
 const MAX_INFLIGHT_HANDLERS: usize = 256;
+const MAX_INFLIGHT_HANDLERS_ENV: &str = "RUNNING_PROCESS_BROKER_MAX_INFLIGHT_HANDLERS";
+
+fn max_inflight_handlers() -> usize {
+    std::env::var(MAX_INFLIGHT_HANDLERS_ENV)
+        .ok()
+        .and_then(|raw| raw.trim().parse::<usize>().ok())
+        .filter(|&limit| limit > 0)
+        .unwrap_or(MAX_INFLIGHT_HANDLERS)
+}
+
+struct InflightGuard(Arc<AtomicUsize>);
+
+impl Drop for InflightGuard {
+    fn drop(&mut self) {
+        self.0.fetch_sub(1, Ordering::SeqCst);
+    }
+}
 
 #[derive(Debug, Clone)]
 struct CliOptions {
@@ -254,6 +272,7 @@ fn accept_loop(
     loader: Arc<ServiceDefinitionLoader>,
     inflight: Arc<AtomicUsize>,
 ) -> ExitCode {
+    let max_inflight = max_inflight_handlers();
     loop {
         match listener.accept() {
             Ok(stream) => {
@@ -261,10 +280,10 @@ fn accept_loop(
                 // The peer's blocking read on the Hello-reply socket will
                 // see EOF when this branch closes the stream.
                 let n = inflight.fetch_add(1, Ordering::SeqCst);
-                if n >= MAX_INFLIGHT_HANDLERS {
+                if n >= max_inflight {
                     inflight.fetch_sub(1, Ordering::SeqCst);
                     eprintln!(
-                        "running-process-broker-v2: at MAX_INFLIGHT_HANDLERS ({MAX_INFLIGHT_HANDLERS}); dropping connection",
+                        "running-process-broker-v2: at MAX_INFLIGHT_HANDLERS ({max_inflight}); dropping connection",
                     );
                     drop(stream);
                     continue;
@@ -274,8 +293,9 @@ fn accept_loop(
                 let spawn_result = thread::Builder::new()
                     .name("rpb-v2-handler".to_string())
                     .spawn(move || {
+                        let _inflight_guard = InflightGuard(inflight_handler);
                         let mut s = stream;
-                        let result = handle_hello(&mut s, &loader);
+                        let result = handle_hello_with_deadline(&mut s, &loader);
                         match result {
                             Ok(svc) => println!(
                                 "running-process-broker-v2 Hello service={svc:?} negotiated",
@@ -284,7 +304,6 @@ fn accept_loop(
                                 "running-process-broker-v2 Hello handler failed: {err}"
                             ),
                         }
-                        inflight_handler.fetch_sub(1, Ordering::SeqCst);
                     });
                 if let Err(err) = spawn_result {
                     eprintln!(
@@ -314,7 +333,7 @@ fn accept_one(
     match listener.accept() {
         Ok(mut stream) => {
             println!("running-process-broker-v2 peer connected (--once)");
-            match handle_hello(&mut stream, &loader) {
+            match handle_hello_with_deadline(&mut stream, &loader) {
                 Ok(svc) => {
                     println!(
                         "running-process-broker-v2 Hello for service {svc:?} negotiated; exiting"
@@ -334,17 +353,36 @@ fn accept_one(
     }
 }
 
+fn handle_hello_with_deadline(
+    stream: &mut interprocess::local_socket::Stream,
+    loader: &ServiceDefinitionLoader,
+) -> Result<String, String> {
+    stream
+        .set_nonblocking(true)
+        .map_err(|error| format!("set Hello stream nonblocking: {error}"))?;
+    let read_result = {
+        let mut deadline_stream = DeadlineStream::new(stream, hello_read_deadline());
+        read_frame(&mut deadline_stream).map_err(|error| format!("read Hello frame: {error}"))
+    };
+    let restore_result = stream
+        .set_nonblocking(false)
+        .map_err(|error| format!("restore Hello stream blocking mode: {error}"));
+    let bytes = read_result?;
+    restore_result?;
+    handle_hello_bytes(stream, loader, bytes)
+}
+
 /// Read a `Hello` frame, look up the registered service, and send
 /// back either `Negotiated` (service found + version policy OK) or
 /// `Refused` (unknown service or policy block).
 ///
 /// Returns the service name on Negotiated, or the human-readable
 /// refusal reason on Refused. Wire errors propagate as `Err`.
-fn handle_hello<S: std::io::Read + std::io::Write>(
+fn handle_hello_bytes<S: std::io::Write>(
     stream: &mut S,
     loader: &ServiceDefinitionLoader,
+    bytes: Vec<u8>,
 ) -> Result<String, String> {
-    let bytes = read_frame(stream).map_err(|e| format!("read Hello frame: {e}"))?;
     let hello = Hello::decode(bytes.as_slice()).map_err(|e| format!("decode Hello: {e}"))?;
 
     let reply = build_hello_reply(&hello, loader);

{running_process-4.6.1 → running_process-4.6.2}/crates/running-process/src/broker/backend_lib/mod.rs

@@ -17,7 +17,9 @@ pub use accept_handed_off::{
     accept_handed_off, parse_handoff_token, AcceptedHandoff, HandedOffPayload, HandoffAcceptance,
     HandoffRejectionReason, RejectedHandoff,
 };
+#[allow(deprecated)]
 pub use wire::{
-    read_handoff_offer, respond_to_handoff_offer, serve_handoff_offer, write_handoff_ack,
+    read_handoff_offer, read_handoff_offer_with_deadline, respond_to_handoff_offer,
+    serve_handoff_offer, serve_handoff_offer_with_deadline, write_handoff_ack,
     BackendHandoffWireError,
 };

{running_process-4.6.1 → running_process-4.6.2}/crates/running-process/src/broker/backend_lib/wire.rs

@@ -27,6 +27,7 @@ use crate::broker::backend_lib::accept_handed_off::{
 use crate::broker::protocol::{
     read_frame, write_frame, Frame, FrameKind, FramingError, HandoffAck, HandoffOffer,
 };
+use crate::broker::server::deadline_stream::with_nonblocking_deadline;
 use crate::broker::server::handoff::wire::{handoff_ack_frame, validate_handoff_frame};
 use crate::broker::server::{HandoffToken, HandoffTokenStore};
 
@@ -47,6 +48,12 @@ pub enum BackendHandoffWireError {
     UnexpectedFrame(&'static str),
 }
 
+impl From<std::io::Error> for BackendHandoffWireError {
+    fn from(error: std::io::Error) -> Self {
+        Self::Framing(FramingError::Io(error))
+    }
+}
+
 /// Read and validate one broker→backend [`HandoffOffer`] frame.
 pub fn read_handoff_offer<S: Read>(
     stream: &mut S,
@@ -65,6 +72,15 @@ pub fn read_handoff_offer<S: Read>(
     Ok(offer)
 }
 
+/// Read one broker→backend [`HandoffOffer`] from a production local socket
+/// with an absolute deadline, restoring blocking mode before returning.
+pub fn read_handoff_offer_with_deadline(
+    stream: &mut interprocess::local_socket::Stream,
+    deadline: Instant,
+) -> Result<HandoffOffer, BackendHandoffWireError> {
+    with_nonblocking_deadline(stream, deadline, |stream| read_handoff_offer(stream))
+}
+
 /// Validate/consume one received offer and write the matching [`HandoffAck`].
 ///
 /// The presented token rides the offer; `expected_token` is the token the
@@ -121,13 +137,57 @@ pub fn write_handoff_ack<S: Write>(
 ///
 /// Convenience composition of [`read_handoff_offer`] and
 /// [`respond_to_handoff_offer`] for backends serving one handoff per
-/// control exchange.
+/// control exchange. This legacy generic entry point cannot configure bounded
+/// I/O itself; callers must pre-bound custom streams. Production local-socket
+/// users should call [`serve_handoff_offer_with_deadline`] instead.
+#[deprecated(
+    since = "4.6.2",
+    note = "use serve_handoff_offer_with_deadline for production local sockets"
+)]
 pub fn serve_handoff_offer<S: Read + Write>(
     stream: &mut S,
     pending_tokens: &mut HandoffTokenStore,
     expected_token: HandoffToken,
     now: Instant,
+) -> Result<HandoffAcceptance<HandoffOffer>, BackendHandoffWireError> {
+    serve_handoff_offer_inner(stream, pending_tokens, expected_token, now)
+}
+
+fn serve_handoff_offer_inner<S: Read + Write>(
+    stream: &mut S,
+    pending_tokens: &mut HandoffTokenStore,
+    expected_token: HandoffToken,
+    now: Instant,
 ) -> Result<HandoffAcceptance<HandoffOffer>, BackendHandoffWireError> {
     let offer = read_handoff_offer(stream)?;
     respond_to_handoff_offer(stream, pending_tokens, expected_token, offer, now)
 }
+
+/// Serve one handoff offer over a production local socket with an absolute
+/// read deadline.
+///
+/// The stream is temporarily switched to nonblocking mode so silent, partial,
+/// and continuously trickling peers cannot extend the bound. Blocking mode is
+/// restored before the token is consumed and the ACK is written. If both the
+/// read and mode restoration fail, the read error takes precedence so a timeout
+/// remains classified as [`FramingError::Io`] with
+/// [`std::io::ErrorKind::TimedOut`].
+///
+/// This wire helper does not receive or acquire an out-of-band descriptor.
+/// A consuming transport that receives an `SCM_RIGHTS` descriptor before
+/// calling this function must retain it in an owned RAII value and drop it when
+/// this function returns an error, including a deadline expiry.
+///
+/// The deprecated [`serve_handoff_offer`] remains available for compatibility
+/// with custom `Read + Write` streams whose bounded-I/O policy is configured by
+/// the caller.
+pub fn serve_handoff_offer_with_deadline(
+    stream: &mut interprocess::local_socket::Stream,
+    pending_tokens: &mut HandoffTokenStore,
+    expected_token: HandoffToken,
+    now: Instant,
+    deadline: Instant,
+) -> Result<HandoffAcceptance<HandoffOffer>, BackendHandoffWireError> {
+    let offer = read_handoff_offer_with_deadline(stream, deadline)?;
+    respond_to_handoff_offer(stream, pending_tokens, expected_token, offer, now)
+}

{running_process-4.6.1 → running_process-4.6.2}/crates/running-process/src/broker/server/admin.rs

@@ -16,6 +16,7 @@ use crate::broker::protocol::{
 
 use super::backend_registry::BackendRegistry;
 use super::connection::{bind_local_socket, BrokerConnectionError, LocalSocketCleanup};
+use super::deadline_stream::{hello_read_deadline, with_nonblocking_deadline};
 use super::service_def_loader::{service_definition_dir, SERVICE_DEF_DIR_ENV};
 use super::spawn_coordinator::{
     SpawnBudgetSnapshot, DEFAULT_SPAWN_ATTEMPTS_PER_WINDOW, DEFAULT_SPAWN_BUDGET_WINDOW,
@@ -559,7 +560,9 @@ pub fn serve_one_admin_socket(
     let cleanup = LocalSocketCleanup(socket_path);
     let result = (|| {
         let mut stream = listener.accept()?;
-        handle_admin_connection(&mut stream, snapshot)
+        with_nonblocking_deadline(&mut stream, hello_read_deadline(), |stream| {
+            handle_admin_connection(stream, snapshot)
+        })
     })();
     drop(listener);
     drop(cleanup);

{running_process-4.6.1 → running_process-4.6.2}/crates/running-process/src/broker/server/connection.rs

@@ -18,6 +18,7 @@ use crate::broker::protocol::{
     FrameKind, FramingError, HelloReply, PayloadEncoding, Refused, CONTROL_PAYLOAD_PROTOCOL,
     MAX_HELLO_BYTES, PROTOCOL_VERSION,
 };
+use crate::broker::server::deadline_stream::{hello_read_deadline, with_nonblocking_deadline};
 use crate::broker::server::{HelloHandler, HelloRouter, PeerIdentity};
 
 /// Peer credential policy applied before reading a Hello frame.
@@ -212,7 +213,9 @@ where
     let result = (|| {
         let mut stream = listener.accept()?;
         let peer = peer_identity_from_stream(&stream)?;
-        handle_hello_connection_with_peer_policy(&mut stream, responder, peer, peer_policy)
+        with_nonblocking_deadline(&mut stream, hello_read_deadline(), |stream| {
+            handle_hello_connection_with_peer_policy(stream, responder, peer, peer_policy)
+        })
     })();
     drop(listener);
     drop(cleanup);
@@ -260,13 +263,15 @@ pub fn serve_local_socket_connections_with_peer_policy(
             let handler = Arc::clone(&handler);
             let peer_policy = Arc::clone(&peer_policy);
             workers.push(thread::spawn(move || {
-                handle_hello_connection_with_peer_policy(
-                    &mut stream,
-                    handler.as_ref(),
-                    peer,
-                    peer_policy.as_ref(),
-                )
-                .map(|_| ())
+                with_nonblocking_deadline(&mut stream, hello_read_deadline(), |stream| {
+                    handle_hello_connection_with_peer_policy(
+                        stream,
+                        handler.as_ref(),
+                        peer,
+                        peer_policy.as_ref(),
+                    )
+                    .map(|_| ())
+                })
             }));
         }
 
@@ -325,12 +330,9 @@ where
         for _ in 0..connection_count {
             let mut stream = listener.accept()?;
             let peer = peer_identity_from_stream(&stream)?;
-            let _ = handle_hello_connection_with_peer_policy(
-                &mut stream,
-                responder,
-                peer,
-                peer_policy,
-            )?;
+            let _ = with_nonblocking_deadline(&mut stream, hello_read_deadline(), |stream| {
+                handle_hello_connection_with_peer_policy(stream, responder, peer, peer_policy)
+            })?;
         }
         Ok(())
     })();

{running_process-4.6.1 → running_process-4.6.2}/crates/running-process/src/broker/server/control_socket.rs

@@ -21,97 +21,10 @@ use super::connection::{
     write_response_frame, BrokerConnectionError, HelloResponder, LocalSocketCleanup,
     PeerCredentialPolicy,
 };
+use super::deadline_stream::{hello_read_deadline, DeadlineStream};
 use super::fd_pressure::{FdPressureDecision, FdPressureGuard};
 use super::hello_handler::PeerIdentity;
 
-/// Poll interval for the deadline-bounded control-socket read/write.
-const CONTROL_IO_POLL_INTERVAL: std::time::Duration = std::time::Duration::from_millis(5);
-
-/// Default deadline for reading a peer's initial Hello/admin frame off an
-/// accepted control-socket connection (issue #590, cluster G). The accept
-/// loop serves each connection inline on one thread, so a peer that
-/// connects but never sends a complete frame would otherwise stall every
-/// other client. Override with `RUNNING_PROCESS_BROKER_HELLO_TIMEOUT_MS`.
-const DEFAULT_HELLO_READ_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(30);
-const HELLO_READ_TIMEOUT_ENV: &str = "RUNNING_PROCESS_BROKER_HELLO_TIMEOUT_MS";
-
-fn hello_read_deadline() -> std::time::Instant {
-    let timeout = std::env::var(HELLO_READ_TIMEOUT_ENV)
-        .ok()
-        .and_then(|raw| raw.trim().parse::<u64>().ok())
-        .filter(|&ms| ms > 0)
-        .map(std::time::Duration::from_millis)
-        .unwrap_or(DEFAULT_HELLO_READ_TIMEOUT);
-    std::time::Instant::now() + timeout
-}
-
-/// Wraps an accepted (nonblocking) control-socket stream and bounds every
-/// read/write against a deadline, so a silent or trickle peer cannot wedge
-/// the single-threaded accept loop (issue #590, cluster G). `Ok(0)` is
-/// treated as "no data yet" (Windows `PIPE_NOWAIT` returns that instead of
-/// `WouldBlock`), matching the broker probe idiom.
-struct DeadlineStream<'a, S> {
-    inner: &'a mut S,
-    deadline: std::time::Instant,
-}
-
-impl<'a, S> DeadlineStream<'a, S> {
-    fn new(inner: &'a mut S, deadline: std::time::Instant) -> Self {
-        Self { inner, deadline }
-    }
-
-    fn wait(&self) -> std::io::Result<()> {
-        let now = std::time::Instant::now();
-        if now >= self.deadline {
-            return Err(std::io::Error::new(
-                std::io::ErrorKind::TimedOut,
-                "broker control-socket peer did not send a complete frame in time",
-            ));
-        }
-        std::thread::sleep((self.deadline - now).min(CONTROL_IO_POLL_INTERVAL));
-        Ok(())
-    }
-}
-
-impl<S: Read> Read for DeadlineStream<'_, S> {
-    fn read(&mut self, buf: &mut [u8]) -> std::io::Result<usize> {
-        loop {
-            match self.inner.read(buf) {
-                Ok(0) => self.wait()?,
-                Ok(n) => return Ok(n),
-                Err(e) if e.kind() == std::io::ErrorKind::WouldBlock => self.wait()?,
-                Err(e) if e.kind() == std::io::ErrorKind::Interrupted => continue,
-                Err(e) => return Err(e),
-            }
-        }
-    }
-}
-
-impl<S: Write> Write for DeadlineStream<'_, S> {
-    fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
-        loop {
-            match self.inner.write(buf) {
-                Ok(0) => self.wait()?,
-                Ok(n) => return Ok(n),
-                Err(e) if e.kind() == std::io::ErrorKind::WouldBlock => self.wait()?,
-                Err(e) if e.kind() == std::io::ErrorKind::Interrupted => continue,
-                Err(e) => return Err(e),
-            }
-        }
-    }
-
-    fn flush(&mut self) -> std::io::Result<()> {
-        loop {
-            match self.inner.flush() {
-                Ok(()) => return Ok(()),
-                Err(e) if e.kind() == std::io::ErrorKind::WouldBlock => self.wait()?,
-                Err(e) if e.kind() == std::io::ErrorKind::Interrupted => continue,
-                Err(e) => return Err(e),
-            }
-        }
-    }
-}
-
 /// Result of handling one control socket connection.
 #[derive(Clone, Debug, PartialEq)]
 pub enum ControlSocketReply {