6f9f4886

test: pin cli side-channel atomicity

a73x 2026-08-18 12:27

Commit message

test: pin cli side-channel atomicity

src/client.zig

@@ @@ -1310,38 +1310,24 @@ fn session( @@
+                    try paint_mod.renderScrollback(alloc, frame.payload[6..], size, stdout_fd);
+                },
+                .term_event, .term_modes => {
+                    switch (semantic_core.receive(frame.type, frame.payload)) {
+                        .ignored => {},
+                        .state => |state| {
+                            // Mode samples are deliberately not deduplicated.
+                            // sendResync repeats the current level on attach,
+                            // reconnect and forced re-attach; reasserting
+                            // DECSET/DECRST 2004 is a harmless level-set and
+                            // restores the host after a new connection.
+                            // Occurrence effects take the separate arm below
+                            // and are never covered by this repeat policy.
+                            try writeSideChannel(
+                                alloc,
+                                stdout_fd,
+                                alt_screen,
+                                state,
+                                appendTermState,
+                            );
+                        },
+                        .effect => |effect| try writeSideChannel(
+                            alloc,
+                            stdout_fd,
+fn appendNothing(
+    _: *std.ArrayList(u8),
+    _: std.mem.Allocator,
+    _: void,
+) std.mem.Allocator.Error!void {}
+test "client: side channels write nothing before terminal ownership" {
+    const pipe = try std.posix.pipe();
+    defer std.posix.close(pipe[0]);
+    var write_open = true;
+    defer if (write_open) std.posix.close(pipe[1]);
+    try writeSideChannel(
+        std.testing.allocator,
+        pipe[1],
+        false,
+        client_core.Effect{ .bell = {} },
+        appendHostEffect,
+    );
+    std.posix.close(pipe[1]);
+    write_open = false;
+    var byte: [1]u8 = undefined;
+    try std.testing.expectEqual(@as(usize, 0), try std.posix.read(pipe[0], &byte));
+}
+test "client: an empty side-channel rendering writes nothing" {
+    const pipe = try std.posix.pipe();
+    defer std.posix.close(pipe[0]);
+    var write_open = true;
+    defer if (write_open) std.posix.close(pipe[1]);
+    try writeSideChannel(
+        std.testing.allocator,
+        pipe[1],
+        true,
+        {},
+        appendNothing,
+    );
+    std.posix.close(pipe[1]);
+    write_open = false;
+    var byte: [1]u8 = undefined;
+    try std.testing.expectEqual(@as(usize, 0), try std.posix.read(pipe[0], &byte));
+}
+test "client: an allocation failure discards a partially built side channel" {
+    const pipe = try std.posix.pipe();
+    defer std.posix.close(pipe[0]);
+    // The OSC introducer gets the first allocation. Growing for the payload
+    // then fails both its resize and allocation fallback, after real escape
+    // bytes exist in writeSideChannel's private buffer.
+    var failing = std.testing.FailingAllocator.init(std.testing.allocator, .{
+        .fail_index = 1,
+        .resize_fail_index = 0,
+    });
+    var payload: [128]u8 = undefined;
+    @memset(&payload, 'A');
+    const result = writeSideChannel(
+        failing.allocator(),
+        pipe[1],
+        true,
+        client_core.Effect{ .clipboard_set = .{
+            .target = 'c',
+            .base64 = &payload,
+        } },
+        appendHostEffect,
+    );
+    std.posix.close(pipe[1]);
+    try std.testing.expectError(error.OutOfMemory, result);
+    try std.testing.expectEqual(@as(usize, 1), failing.allocations);
+    try std.testing.expect(failing.has_induced_failure);
+    var byte: [1]u8 = undefined;
+    try std.testing.expectEqual(@as(usize, 0), try std.posix.read(pipe[0], &byte));
+}
+// Forces semantic analysis of every pub decl under `zig build test`, so an
+// unreferenced decl must at least compile (the silent-module-loss hazard,
+// decisions.md). Pub decls only: std.meta.declarations sees nothing private.

test/e2e.sh

Old		New
@@ -2779,8 +2779,8 @@ set -e
2779	# are the same failure line.	2779	# are the same failure line.
2780	grep -qa 'CLIPDONE' "$OUT.clip" \|\| {	2780	grep -qa 'CLIPDONE' "$OUT.clip" \|\| {
2781	echo "e2e FAIL: the session never ran (no marker on the host)"; exit 1; }	2781	echo "e2e FAIL: the session never ran (no marker on the host)"; exit 1; }
2782	# Terminator included: the client builds the escape whole or writes nothing	2782	# Terminator included: appendHostEffect builds into writeSideChannel's private
2783	# at all (client.zig, appendTermEvent), and a needle stopping at the payload	2783	# buffer, which is written whole or not at all; a needle stopping at the payload
2784	# could not tell a complete escape from half of one left painting on the	2784	# could not tell a complete escape from half of one left painting on the
2785	# user's tty. -F because the needle is bytes, not a pattern.	2785	# user's tty. -F because the needle is bytes, not a pattern.
2786	CLIPESC=$(printf '\033]52;c;aGVsbG8gZnJvbSB0aGUgc2Vzc2lvbg==\007')	2786	CLIPESC=$(printf '\033]52;c;aGVsbG8gZnJvbSB0aGUgc2Vzc2lvbg==\007')
@@ -3032,13 +3032,13 @@ ok "a paste into nvim keeps its indentation"
3032		3032
3033	# --- side channel: a burst of bells reaches the host as exactly one ------	3033	# --- side channel: a burst of bells reaches the host as exactly one ------
3034	#	3034	#
3035	# This leg exists for the COALESCING, not for the bell. The client's	3035	# This leg exists for the COALESCING, not for the bell. The shared client core
3036	# term_event dispatch is kind-agnostic — every event goes through one	3036	# decodes every term_event, then every accepted effect follows the same
3037	# writeSideChannel call with no per-kind branch — so the clipboard leg above	3037	# writeSideChannel → appendHostEffect path, so the clipboard leg above already
3038	# already proves frame → decode → builder → host tty for the whole frame	3038	# proves frame → decode → adapter → host tty for the whole frame type. A bell
3039	# type, and a bell that merely ARRIVED would add no coverage: the one	3039	# that merely ARRIVED would add no coverage: the bell-specific adapter line is
3040	# bell-specific line past the wire is pinned directly in client.zig. What	3040	# pinned directly in client.zig. What only e2e can see is the NUMBER. Five rings
3041	# only e2e can see is the NUMBER. Five rings inside one pty chunk must reach	3041	# inside one pty chunk must reach
3042	# the host as one (server.zig, drainSideEvents), and a regression there is	3042	# the host as one (server.zig, drainSideEvents), and a regression there is
3043	# silent — every assertion anyone would think to write about a bell still	3043	# silent — every assertion anyone would think to write about a bell still
3044	# passes while 256 frames per chunk go out.	3044	# passes while 256 frames per chunk go out.

test/xversion.sh

Old		New
@@ -444,7 +444,7 @@ SCRIPT
444	# reasonable and would retire that instrument silently. The clipboard's is	444	# reasonable and would retire that instrument silently. The clipboard's is
445	# a transform mux CANNOT avoid: `TermEvent.clipboard` carries a target and	445	# a transform mux CANNOT avoid: `TermEvent.clipboard` carries a target and
446	# base64 and has no field for a terminator, so the session's ST cannot	446	# base64 and has no field for a terminator, so the session's ST cannot
447	# survive the wire, and `appendTermEvent` appends 0x07 unconditionally	447	# survive the wire, and `appendHostEffect` appends 0x07 unconditionally
448	# (client.zig). Only a protocol change could break that one. So if one of	448	# (client.zig). Only a protocol change could break that one. So if one of
449	# these needles has to be trusted, trust the clipboard's.	449	# these needles has to be trusted, trust the clipboard's.
450	#	450	#