Skip to content

Review Windows IPC follow-up fixes - #7

Open
nsxdavid wants to merge 3 commits into
codex/windows-ipc-review-base-20260626from
codex/windows-ipc-review-fixes-20260626
Open

Review Windows IPC follow-up fixes#7
nsxdavid wants to merge 3 commits into
codex/windows-ipc-review-base-20260626from
codex/windows-ipc-review-fixes-20260626

Conversation

@nsxdavid

@nsxdavid nsxdavid commented Jun 26, 2026

Copy link
Copy Markdown
Owner

Purpose

Review-only PR for the follow-up fixes to upstream PR justrach#641. This PR compares against a fork-local base branch that already contains the rebased Windows IPC PR, so the diff should be limited to the maintainer/Codex review responses.

What changed

  • Harden Windows named-pipe client/server trust with server PID + same-user SID validation.
  • Publish random per-daemon pipe metadata instead of predictable root/username pipe names.
  • Use current-user pipe DACL with medium-integrity no-write-up label.
  • Retry transient CreateNamedPipe failures and keep a replacement pipe instance available before closing the connected one.
  • Resolve bare Windows subprocess executables through safe absolute PATH entries, excluding cwd/relative entries and .bat/.cmd.
  • Keep Windows daemon lock paths Unicode-safe with wide APIs.
  • Teach nuke to terminate matching Windows daemon processes registered in pipe metadata before removing data.
  • Bound broad searchSymbols collection to top-N candidates without hash-order truncation.

Scope note

The updater is intentionally untouched in this review PR.

Validation

  • zig build --global-cache-dir .zig-global-cache test --summary all -> 23/23 steps, 862/866 tests passed, 4 skipped
  • zig build --global-cache-dir .zig-global-cache --summary all -> 3/3 steps succeeded
  • PYTHONUTF8=1 PYTHONIOENCODING=utf-8 python scripts/e2e_mcp_test.py --binary zig-out/bin/codedb.exe --project . -> 20/20 passed

Summary by CodeRabbit

  • New Features

    • Added a way to identify the current process.
    • Improved Windows command launching to find safe executables from the system path.
    • Updated Windows CLI proxying to use secure, per-user pipe handling.
  • Bug Fixes

    • Made Windows daemon and proxy connections more reliable and harder to spoof.
    • Improved process cleanup to target the correct running background service.
  • Tests

    • Added regression coverage for executable resolution, pipe metadata validation, and symbol search limits.

@coderabbitai

coderabbitai Bot commented Jun 26, 2026

Copy link
Copy Markdown

Review Change Stack

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2e4160b5-38a4-4dba-8cd5-d7763e4c273e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

The PR adds Windows process and daemon plumbing, including safe executable lookup, named-pipe metadata and trust checks, updated proxy wiring, and process cleanup. It also changes symbol search allocation behavior and hardens two git command invocations.

Changes

Windows runtime plumbing

Layer / File(s) Summary
Executable and pipe helper contracts
src/cio.zig, src/cli_proxy.zig, src/test_mcp.zig
Current-process lookup, safe PATH executable resolution, and named-pipe metadata helpers are added with Windows tests for executable lookup and pipe metadata parsing.
Daemon wiring
src/cli_proxy.zig, src/commands.zig, src/main.zig, src/test_mcp.zig
Windows daemon startup derives current-user SDDL, publishes random pipe metadata, opens the lock with CreateFileW, and threads data_dir through proxy and spawn call sites.
Windows cleanup
src/nuke.zig
run() now passes currentProcessId() into the Windows cleanup path, and Windows process termination now reads project metadata, resolves image paths, normalizes them, and terminates matching processes.

Symbol search allocation cap

Layer / File(s) Summary
Capped candidate collection
src/explore.zig
searchSymbols uses borrowed Candidate entries, top-K insertion, and a final clone step for owned results.
Allocation cap test
src/test_explore.zig
A regression test uses max_results = 3 and a FailingAllocator to exercise the capped allocation path and returned symbol ordering.

Git command isolation

Layer / File(s) Summary
Git command flags
src/git.zig
Both git command builders prepend the new config flags before their existing arguments.

Sequence Diagram(s)

sequenceDiagram
  participant runCliDaemon
  participant mainImpl
  participant cliTryProxy
  participant cliConnect
  participant cliDaemonListen
  participant "cli-daemon.pipe" as pipeFile
  runCliDaemon->>cliDaemonListen: data_dir
  cliDaemonListen->>pipeFile: write metadata
  cliDaemonListen->>pipeFile: create named pipe instance
  mainImpl->>cliTryProxy: probe_dir
  cliTryProxy->>cliConnect: data_dir
  cliConnect->>pipeFile: read metadata
  cliConnect->>pipeFile: CreateFileW
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~75 minutes

Poem

I hopped through pipes with whiskers bright, 🐇
and sniffed the PATH by moonlit light.
I stacked the symbols, neat and small,
then guarded daemons, one and all.
Thump-thump—these codedb carrots sparkle!

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately reflects that this PR contains follow-up fixes for Windows IPC-related changes.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@nsxdavid

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jun 26, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@github-actions

Copy link
Copy Markdown

Benchmark Regression Report

Thresholds: 10.00% and 50,000 ns absolute delta

NOISE means the percentage threshold was exceeded, but the absolute delta was too small to fail CI.

Tool Base (ns) Head (ns) Delta Abs Delta (ns) Status
codedb_bundle 72421 93958 +29.74% +21537 NOISE
codedb_changes 10625 9914 -6.69% -711 OK
codedb_context 737642 727100 -1.43% -10542 OK
codedb_deps 350 304 -13.14% -46 OK
codedb_edit 44094 43530 -1.28% -564 OK
codedb_find 3022 2649 -12.34% -373 OK
codedb_hot 25822 23328 -9.66% -2494 OK
codedb_outline 15968 16563 +3.73% +595 OK
codedb_read 13160 12489 -5.10% -671 OK
codedb_search 64790 89070 +37.47% +24280 NOISE
codedb_snapshot 65772 65039 -1.11% -733 OK
codedb_status 9240 8717 -5.66% -523 OK
codedb_symbol 57020 59681 +4.67% +2661 OK
codedb_tree 27504 28621 +4.06% +1117 OK
codedb_word 12292 14244 +15.88% +1952 NOISE

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d2638af4aa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/nuke.zig Outdated
defer allocator.free(image_path);
if (!windowsPathsEqual(allocator, image_path, expected_exe)) return false;

return TerminateProcess(process, 0) != .FALSE;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Wait for terminated daemons before deleting files

On Windows with a running codedb daemon, TerminateProcess only initiates termination; the process may still hold the lock, pipe metadata, index, or binary handles when nuke immediately proceeds to remove binaries and ~/.codedb. That can make the uninstall intermittently leave files behind or report failed to remove even though the daemon was counted as killed. Request a waitable handle and wait for the process to exit before returning success here.

Useful? React with 👍 / 👎.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🧹 Nitpick comments (1)
src/main.zig (1)

361-380: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Keep POSIX proxy hits from paying getDataDir cost.

data_dir is only needed for Windows pipe metadata and for the spawn-lock fallback. On POSIX, this now does getDataDir before every successful proxy hit even though cliConnect ignores it.

Proposed refactor
-        const probe_dir = if (abs_root.len > 0) getDataDir(io, allocator, abs_root) catch null else null;
+        var probe_dir: ?[]u8 = null;
         defer if (probe_dir) |d| allocator.free(d);
+
+        if (builtin.os.tag == .windows and abs_root.len > 0) {
+            probe_dir = getDataDir(io, allocator, abs_root) catch null;
+        }
 
         if (cliTryProxy(io, allocator, abs_root, probe_dir, args, use_color)) |code| {
             out.flush();
             std.process.exit(code);
         }
@@
         if (abs_root.len > 0) {
-            const lock_free = if (probe_dir) |d| daemonLockAvailable(d) else true;
+            if (probe_dir == null) {
+                probe_dir = getDataDir(io, allocator, abs_root) catch null;
+            }
+            const lock_free = if (probe_dir) |d| daemonLockAvailable(d) else false;
             if (lock_free) {
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/main.zig` around lines 361 - 380, Move the `getDataDir` lookup out of the
unconditional path in `main` so POSIX proxy hits in `cliTryProxy` don’t pay that
cost unnecessarily. Keep `probe_dir` only for the Windows pipe metadata flow and
the `daemonLockAvailable` fallback, and gate the `getDataDir` call behind the
specific cases that actually need it while preserving the existing `cliTryProxy`
and spawn-lock behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/cli_proxy.zig`:
- Around line 546-557: The retry counter in cli-proxy is being reset too early,
so repeated writeCliPipeMetadata failures always look like the first retry and
never increase the backoff. In the retry path around writeCliPipeMetadata, keep
retry_failures unchanged on failure, only reset it after metadata is
successfully written, and preserve the existing logging and sleep behavior tied
to retry_failures so pipe retry backoff can grow across consecutive failures.

In `@src/git.zig`:
- Line 10: The git invocation in src/git.zig uses an empty core.hooksPath value,
which is not a reliable way to disable hooks across Git versions and platforms.
Update the argument list in the git command setup to use a specific non-existent
absolute hooks path instead, and keep the change localized to the same command
construction so the rev-parse flow still works with deterministic hook
isolation.

In `@src/nuke.zig`:
- Around line 163-171: In terminateWindowsProcessIfMatches, the process is
terminated but the function returns before the Windows daemon has fully exited
and released file handles. After the successful TerminateProcess call, wait on
the process handle with WaitForSingleObject before returning so callers like the
deleteTree flow only proceed once the process is fully gone. Keep the existing
OpenProcess, windowsProcessImagePath, and windowsPathsEqual checks unchanged,
and only add the post-termination wait in this function.

---

Nitpick comments:
In `@src/main.zig`:
- Around line 361-380: Move the `getDataDir` lookup out of the unconditional
path in `main` so POSIX proxy hits in `cliTryProxy` don’t pay that cost
unnecessarily. Keep `probe_dir` only for the Windows pipe metadata flow and the
`daemonLockAvailable` fallback, and gate the `getDataDir` call behind the
specific cases that actually need it while preserving the existing `cliTryProxy`
and spawn-lock behavior.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 248af07e-c238-4b27-bfa3-ef0ffbc16f34

📥 Commits

Reviewing files that changed from the base of the PR and between 9f36ed6 and d2638af.

📒 Files selected for processing (9)
  • src/cio.zig
  • src/cli_proxy.zig
  • src/commands.zig
  • src/explore.zig
  • src/git.zig
  • src/main.zig
  • src/nuke.zig
  • src/test_explore.zig
  • src/test_mcp.zig

Comment thread src/cli_proxy.zig Outdated
Comment thread src/git.zig Outdated
Comment thread src/nuke.zig Outdated
@github-actions

Copy link
Copy Markdown

Benchmark Regression Report

Thresholds: 10.00% and 50,000 ns absolute delta

NOISE means the percentage threshold was exceeded, but the absolute delta was too small to fail CI.

Tool Base (ns) Head (ns) Delta Abs Delta (ns) Status
codedb_bundle 74422 98635 +32.53% +24213 NOISE
codedb_changes 11881 11132 -6.30% -749 OK
codedb_context 798580 795676 -0.36% -2904 OK
codedb_deps 606 342 -43.56% -264 OK
codedb_edit 47594 43529 -8.54% -4065 OK
codedb_find 3031 2754 -9.14% -277 OK
codedb_hot 28360 26261 -7.40% -2099 OK
codedb_outline 20146 17295 -14.15% -2851 OK
codedb_read 13630 13719 +0.65% +89 OK
codedb_search 71100 88015 +23.79% +16915 NOISE
codedb_snapshot 88926 78300 -11.95% -10626 OK
codedb_status 10439 9769 -6.42% -670 OK
codedb_symbol 56885 59920 +5.34% +3035 OK
codedb_tree 29185 29838 +2.24% +653 OK
codedb_word 14059 12146 -13.61% -1913 OK

@nsxdavid

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jun 26, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@github-actions

Copy link
Copy Markdown

Benchmark Regression Report

Thresholds: 10.00% and 50,000 ns absolute delta

NOISE means the percentage threshold was exceeded, but the absolute delta was too small to fail CI.

Tool Base (ns) Head (ns) Delta Abs Delta (ns) Status
codedb_bundle 48790 68508 +40.41% +19718 NOISE
codedb_changes 6236 11335 +81.77% +5099 NOISE
codedb_context 641960 647935 +0.93% +5975 OK
codedb_deps 323 290 -10.22% -33 OK
codedb_edit 34151 35254 +3.23% +1103 OK
codedb_find 1724 1579 -8.41% -145 OK
codedb_hot 13916 14971 +7.58% +1055 OK
codedb_outline 10713 10460 -2.36% -253 OK
codedb_read 8010 13982 +74.56% +5972 NOISE
codedb_search 41403 63025 +52.22% +21622 NOISE
codedb_snapshot 69432 70045 +0.88% +613 OK
codedb_status 4996 5651 +13.11% +655 NOISE
codedb_symbol 45377 44454 -2.03% -923 OK
codedb_tree 16403 19306 +17.70% +2903 NOISE
codedb_word 6793 6901 +1.59% +108 OK

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant