e2756961

feat: a stderr pipe's last line, kept

a73x 2026-08-30 10:58

Commit message

feat: a stderr pipe's last line, kept

`Reason` is what an ssh diagnostic becomes once mux reads it instead of
letting it land on a screen: fed arbitrary chunks, it keeps the last
COMPLETE line, drops control bytes so nothing the far side prints can
move a cursor in a wall, and caps at `reason_max`.

Pure, in handoff.zig beside the announce grammar, so the whole policy
tests without a process.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wi2HnuF1EK8HgViU11YLV

src/client/handoff.zig

@@ @@ -82,6 +82,76 @@ pub const ReadLineError = error{ @@
+    LineTooLong,
+};
+/// How much of one stderr line is kept. Wide enough for ssh's longest
+/// ordinary complaint (`ssh: connect to host <name> port <n>: No route to
+/// host`) and narrow enough to sit on a picker row beside a spelling.
+pub const reason_max = 120;
+/// The last COMPLETE line a stderr pipe carried, kept across any
+/// fragmentation the pipe imposes.
+///
+/// Why a struct and not a buffer the reader appends to: ssh says several
+/// things and dies on the last one, the reader sees arbitrary chunks, and
+/// what a caller wants is one sentence. Pure — no fd, no allocator — so
+/// the whole policy is testable without a process.
+pub const Reason = struct {
+    buf: [reason_max]u8 = undefined,
+    len: usize = 0,
+    /// Bytes still accumulating toward the next line end. Separate from
+    /// `buf` so a dial that fails mid-sentence quotes the last finished
+    /// line rather than half of the one ssh was still writing.
+    tail: [reason_max]u8 = undefined,
+    tail_len: usize = 0,
+    pub fn feed(self: *Reason, bytes: []const u8) void {
+        for (bytes) |c| {
+            // '\n' and '\r' EACH end a line, and an empty one ends
+            // nothing: a remote on a pty writes `\r\n`, and treating the
+            // pair as two line ends would clear the reason on exactly the
+            // hosts whose ssh allocated a tty.
+            if (c == '\n' or c == '\r') {
+                if (self.tail_len > 0) {
+                    @memcpy(self.buf[0..self.tail_len], self.tail[0..self.tail_len]);
+                    self.len = self.tail_len;
+                    self.tail_len = 0;
+                }
+                continue;
+            }
+            // PRINTABLE ASCII, and nothing else. This string is painted
+            // into a picker row inside a wall's alternate screen, RAW —
+            // it never goes through the VT engine that makes a session's
+            // remote bytes safe — so a byte that reached the terminal
+            // could move a cursor or open a sequence in somebody else's
+            // tile, which is the bug this whole change closes.
+            //
+            // The high half goes too, not just C0: UTF-8-encoded C1 is
+            // two bytes (`\xc2\x9b` is CSI) and xterm honours it in UTF-8
+            // mode, so a rule that stopped at 0x7f would let an escape
+            // through in a second spelling. Dropping the whole half also
+            // ends the split-codepoint question at `reason_max`. The
+            // picker's own spelling editor already takes printable ASCII
+            // only; ssh's diagnostics are ASCII, and a hostname with
+            // other bytes in it loses them from this row alone.
+            if (c < 0x20 or c > 0x7e) continue;
+            // Cut, not wrapped: the head of an ssh diagnostic is the part
+            // that names the cause.
+            if (self.tail_len == reason_max) continue;
+            self.tail[self.tail_len] = c;
+            self.tail_len += 1;
+        }
+    }
+    /// "" until a line has finished; the caller's own wording stands.
+    pub fn slice(self: *const Reason) []const u8 {
+        return self.buf[0..self.len];
+    }
+    pub fn clear(self: *Reason) void {
+        self.len = 0;
+        self.tail_len = 0;
+    }
+};
+pub const CacheError = error{
+    CacheMissing,
+    CachePermissive,
@@ @@ -491,6 +561,109 @@ fn afterAnnounce(s: *State, ep: Endpoint) Step { @@
+    return .{ .dial_quic = ep };
+test "Reason: a line split across three feeds is still one line" {
+    // The pipe is what fragments: ssh writes a sentence and the reader
+    // sees whatever one `read` happened to hold. A reason that only
+    // survived a whole-line read would be the truncated half of a real
+    // diagnostic, which reads as mux's own words.
+    var r: Reason = .{};
+    r.feed("ssh: connect to host ");
+    r.feed("10.255.255.1 port 22: ");
+    r.feed("No route to host\n");
+    try std.testing.expectEqualStrings(
+        "ssh: connect to host 10.255.255.1 port 22: No route to host",
+        r.slice(),
+    );
+}
+test "Reason: two lines keep the LAST one" {
+    // ssh narrates before it fails ("Warning: Permanently added..."), so
+    // the first line it says is rarely the reason it died.
+    var r: Reason = .{};
+    r.feed("Warning: Permanently added 'box' to the list of known hosts.\n");
+    r.feed("box: Permission denied (publickey).\n");
+    try std.testing.expectEqualStrings("box: Permission denied (publickey).", r.slice());
+}
+test "Reason: a CRLF pair does not put an empty line between the two halves" {
+    // A remote on a pty ends its lines `\r\n`. Taking `\n` as a second
+    // line end would leave the reason empty on exactly the hosts whose
+    // ssh allocated a tty.
+    var r: Reason = .{};
+    r.feed("bad host\r\n");
+    try std.testing.expectEqualStrings("bad host", r.slice());
+}
+test "Reason: a bare CR ends a line too, so an overwritten one is not glued to the next" {
+    // `mux d endpoint: starting` narrates with a CR and no LF — a dot per
+    // interval, then an up-line. Counting only `\n` would hand the picker
+    // one run-on line built out of every progress step, with the sentence
+    // that actually failed buried in the middle of it.
+    var r: Reason = .{};
+    r.feed("starting\rgave up\n");
+    try std.testing.expectEqualStrings("gave up", r.slice());
+}
+test "Reason: a partial line is not the reason until its newline arrives" {
+    // The dial can fail with bytes still unterminated in the pipe. Half a
+    // sentence quoted as the cause is worse than the error name it
+    // replaces, so it is not the reason until ssh has finished saying it.
+    var r: Reason = .{};
+    r.feed("still typ");
+    try std.testing.expectEqualStrings("", r.slice());
+    r.feed("ing\n");
+    try std.testing.expectEqualStrings("still typing", r.slice());
+}
+test "Reason: control bytes are dropped, so nothing ssh says can move a cursor" {
+    // This string is painted into a picker row inside a full-screen wall.
+    // A byte below 0x20 (or DEL) that reached the terminal would move the
+    // cursor or start a sequence in the middle of somebody else's tile.
+    var r: Reason = .{};
+    r.feed("a\tb\x07c\x7fd\n");
+    try std.testing.expectEqualStrings("abcd", r.slice());
+}
+test "Reason: the high half is dropped, so a C1 escape has no second spelling" {
+    // The row is painted RAW — no VT engine between this string and the
+    // terminal — and C1 has a two-byte UTF-8 form that xterm honours in
+    // UTF-8 mode: `\xc2\x9b` is CSI, which would open a sequence inside
+    // somebody else's tile from a machine the user merely listed.
+    var r: Reason = .{};
+    r.feed("down \xc2\x9b31mred\xc2\x9b0m now\n");
+    try std.testing.expectEqualStrings("down 31mred0m now", r.slice());
+}
+test "Reason: an over-long line keeps its first reason_max bytes" {
+    // A remote can print anything. The cap is the struct's whole storage,
+    // so the row's width — not the far side — decides how much is kept.
+    var r: Reason = .{};
+    r.feed("x" ** (reason_max + 40));
+    r.feed("\n");
+    try std.testing.expectEqual(@as(usize, reason_max), r.slice().len);
+    try std.testing.expectEqualStrings("x" ** reason_max, r.slice());
+}
+test "Reason: an empty feed changes nothing" {
+    // poll can report readable on a pipe whose write end just closed, and
+    // the read that follows returns 0. That is EOF, not a new reason.
+    var r: Reason = .{};
+    r.feed("kept\n");
+    r.feed("");
+    try std.testing.expectEqualStrings("kept", r.slice());
+}
+test "Reason: clear forgets the last line and the partial one behind it" {
+    // A poll that succeeded says the host is reachable; the sentence that
+    // explained the last failure must not outlive it on the row.
+    var r: Reason = .{};
+    r.feed("gone\nhalf");
+    r.clear();
+    try std.testing.expectEqualStrings("", r.slice());
+    r.feed(" a line\n");
+    try std.testing.expectEqualStrings(" a line", r.slice());
+}
+test "announce: format → parse round-trip, with and without the newline" {
+    var buf: [announce_max_len]u8 = undefined;