c3a7ad58

fix: the Darwin arms answer ENOTCONN as a gone peer, not a panic

a73x 2026-09-04 10:16

Commit message

fix: the Darwin arms answer ENOTCONN as a gone peer, not a panic

std.posix.send maps ENOTCONN to unreachable, because for a local fd it can
only mean the caller passed something unconnected. Darwin also uses it for
the FAR end: a peer that has begun closing but not finished answers ENOTCONN
where a moment earlier the socket still takes SO_NOSIGPIPE and a moment later
it answers EPIPE. So the one thing sendNoSig exists to prevent — a gone peer
taking the process down — happened anyway, as an abort instead of a signal.

Caught by a Mac make check on 2026-09-04: "attempt to unwrap error:
SocketNotConnected" out of client_os_macos.sendNoSig, under
mux_main.agentReachable, the probe that asks whether an ssh agent is
listening. The same run's other pass was green, so it is a race and the gate
was flaky rather than red. server_os_macos.sendNoSigNoWait had the identical
hole, on the daemon's own pump, where the abort would take every session
with it.

Both arms go through sendto, which RETURNS the error that send unwraps, and
map it to the contract's BrokenPipe. No test: the window is between a peer's
close starting and finishing, and it does not reproduce on demand — measured
against a peer that had closed and settled, all three shapes (accepted then
closed, closed with no delay, never accepted) answer EPIPE on both systems.
The panic path is gone by construction rather than by assertion.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SakwJEwD9dXBoRP5kWbemW

src/os/client_os_macos.zig

+    if (rc != 0 and std.posix.errno(rc) == .INVAL) return error.BrokenPipe;
+    // Flags 0, not DONTWAIT: this side BLOCKS. The root's doc says why —
+    // the agent probe writes five bytes and then polls for the answer.
+    return std.posix.sendto(fd, bytes, 0, null, 0) catch |err| switch (err) {
+        // Darwin's THIRD spelling of "the peer is gone", and the one that
+        // aborts the process instead of being an error. `std.posix.send` maps
+        // ENOTCONN to `unreachable`, because for a local fd it can only mean
+        // the caller passed something unconnected; Darwin also uses it for the
+        // FAR end, for a peer that has begun closing but not finished. A
+        // moment earlier the socket still takes SO_NOSIGPIPE, a moment later
+        // it answers EPIPE, and in between it answers this.
+        //
+        // Seen once in a Mac `make check` on 2026-09-04, as `attempt to unwrap
+        // error: SocketNotConnected` out of this call, in the probe that asks
+        // whether an ssh agent is listening. It is a race and does not
+        // reproduce on demand: measured against a peer that had closed and
+        // settled, all three shapes — accepted then closed, closed with no
+        // delay, never accepted — answer EPIPE on both systems. `sendto`
+        // RETURNS the error where `send` unwraps it, which is why this arm
+        // goes through it directly and answers the contract's BrokenPipe.
+        error.SocketNotConnected => return error.BrokenPipe,
+        // Only a `sendto` carrying an ADDRESS can raise these, and this one
+        // passes null. `std.posix.send` calls them unreachable for the same
+        // reason.
+        error.AddressFamilyNotSupported,
+        error.SymLinkLoop,
+        error.NameTooLong,
+        error.FileNotFound,
+        error.NotDir,
+        error.NetworkUnreachable,
+        error.AddressNotAvailable,
+        error.UnreachableAddress,
+        => unreachable,
+        else => |e| return e,
+    };
+/// sysctl KERN_PROC_PID: the kernel's own record of the process, the Darwin

src/os/server_os_macos.zig

+        if (fl & nb == 0) _ = std.posix.fcntl(fd, std.posix.F.SETFL, fl | nb) catch {};
+    } else |_| {}
+    return std.posix.sendto(fd, bytes, std.posix.MSG.DONTWAIT, null, 0) catch |err| switch (err) {
+        // Darwin's THIRD spelling of "the peer is gone", and the one that
+        // aborts the process instead of being an error. `std.posix.send` maps
+        // ENOTCONN to `unreachable`, because for a local fd it can only mean
+        // the caller passed something unconnected; Darwin also uses it for the
+        // FAR end, for a peer that has begun closing but not finished. A
+        // moment earlier the socket still takes SO_NOSIGPIPE, a moment later
+        // it answers EPIPE, and in between it answers this.
+        //
+        // Found by READING this arm, not by a trace out of it: the abort was
+        // caught on 2026-09-04 in the CLIENT arm, out of the probe that asks
+        // whether an ssh agent is listening (`client_os_macos.sendNoSig` says
+        // so, and quotes it). This arm reaches `send` the same way, so it had
+        // the same hole — and on the daemon's only pump, where an abort takes
+        // every session with it rather than one probe. It is a race and does
+        // not reproduce on demand: measured against a peer that had closed
+        // and settled, all three shapes — accepted then closed, closed with
+        // no delay, never accepted — answer EPIPE on both systems. `sendto`
+        // RETURNS the error where `send` unwraps it, which is why this arm
+        // goes through it directly and answers the contract's BrokenPipe.
+        error.SocketNotConnected => return error.BrokenPipe,
+        // Only a `sendto` carrying an ADDRESS can raise these, and this one
+        // passes null. `std.posix.send` calls them unreachable for the same
+        // reason.
+        error.AddressFamilyNotSupported,
+        error.SymLinkLoop,
+        error.NameTooLong,
+        error.FileNotFound,
+        error.NotDir,
+        error.NetworkUnreachable,
+        error.AddressNotAvailable,
+        error.UnreachableAddress,
+        => unreachable,
+        else => |e| return e,
+    };
+pub fn sockType(fd: std.posix.fd_t) error{NotASocket}!u32 {