mirror of
https://github.com/Twigpine/zero.git
synced 2026-11-10 05:01:28 -10:00
KRATOS
fbbfdbf3f2
* harden background daemon: stdout integrity, lifecycle, single-instance lock Deep review of internal/daemon (worker pool, launcher, control server, session fan-out, single-instance lock) found and fixes a stdout-integrity bug plus several lifecycle/locking hazards. Each fix has a regression test; the daemon suite passes under -race. Worker stdout integrity - Replace the capped bufio.Scanner (64 KiB) on a worker's stdout with an uncapped bufio.Reader: a legitimately large stream-json line from our own trusted worker is no longer silently dropped (the 1 MiB cap belongs to untrusted network frames, not this local pipe). - Surface a stdout read error as a run failure instead of swallowing it as a clean success, and kill the worker first so it can't block writing to the now-unread pipe and hang Wait. Control-server lifecycle - Track open connections and close them on Shutdown so a single idle/hostile client can no longer wedge drain (and SIGTERM cleanup) forever. - Guard the listener with a mutex and re-check the shutdown signal after bind so a shutdown requested in the bind window is not lost. - Honor shutdown during buffered-history replay too. Session fan-out - A slow subscriber that drops live lines now receives a namespaced gap notice when its channel drains, instead of silently losing output. - Hold the session lock across the (non-blocking) broadcast sends to close a latent send-on-closed-channel panic when a subscriber cancels mid-send. Single-instance lock - Reclaim a stale lock with an atomic rename-with-verify instead of a blind remove, so two instances starting at once cannot both reclaim and end up both holding the lock; a holder that reacquires in the gap is restored. Client + pool - Bound the control handshake with an I/O deadline so a peer that never replies can't wedge Dial/NewClientConn. - Key the active-worker map by a monotonic id rather than PID (the OS reuses PIDs the instant a worker exits). - Group-terminate on context cancel so a stuck worker's children are not orphaned. * daemon: add -race regression test for the Session.Line lock-hold invariant Session.Line holds s.mu across its non-blocking subscriber sends so cancel()/ finish() cannot close a subscriber channel mid-send (send-on-closed-channel panic). That invariant had no concurrency test. Add one that drives Line concurrently with Subscribe/cancel and finish; it panics with a data race if the lock-hold is reverted and passes with it (verified both ways under -race).
25 lines
810 B
Go
25 lines
810 B
Go
package daemon
|
|
|
|
import (
|
|
"bufio"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestReaderLinesHandlesLargeLine(t *testing.T) {
|
|
// A stream-json line far larger than the old 1 MiB scanner cap must be read in
|
|
// full, not dropped, and must not abort the rest of the stream (D1).
|
|
big := strings.Repeat("x", 2<<20) // 2 MiB
|
|
rl := &readerLines{r: bufio.NewReaderSize(strings.NewReader(big+"\nsecond\n"), 64*1024)}
|
|
line, ok, err := rl.Next()
|
|
if err != nil || !ok || len(line) != len(big) {
|
|
t.Fatalf("large line dropped: ok=%v err=%v len=%d want %d", ok, err, len(line), len(big))
|
|
}
|
|
if l2, ok, err := rl.Next(); err != nil || !ok || l2 != "second" {
|
|
t.Fatalf("second line: %q ok=%v err=%v", l2, ok, err)
|
|
}
|
|
if _, ok, err := rl.Next(); ok || err != nil {
|
|
t.Fatalf("expected clean EOF, got ok=%v err=%v", ok, err)
|
|
}
|
|
}
|