fix(runtime-host): honor TMPDIR for control endpoints and sweep only dead directories - #2160

Benjamin-eecs · 2026-08-04T14:01:45Z

Summary

The control endpoint ignored TMPDIR, and startup deleted every same-rootId directory even when another live Host owned it.

What changed:

Resolve the endpoint root from os.tmpdir(), with a /tmp fallback only when the portable 100-byte Unix socket path budget would be exceeded.
Shorten the root tag to 16 base64url characters, matching the existing Windows identity budget.
Encode the owner PID in the mkdtemp prefix. Ownership is therefore published atomically with directory creation; there is no create-then-write pidfile race.
Sweep only directories with the new parseable owner identity whose PID is no longer alive. EPERM is treated conservatively as alive, and ambiguous pre-change names are preserved rather than guessed dead.
Share one endpoint cleanup fixture across the UDS tests and cover TMPDIR, fallback, path length, permissions, live sibling preservation, dead-owner cleanup, legacy preservation, and invalid root IDs.

Closes #2133

Verification

Clean npm ci.
npm run build:test passed.
@maka/runtime-host full suite: 673 passed, 0 failed.
control-endpoint.test.js: 5 passed, 0 failed.
Biome and git diff --check passed.
Desktop and e2e suites were not run; endpoint clients consume the path from Host registration.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

…dead directories The control endpoint hardcoded /tmp, and removeStaleEndpointDirectories deleted every same-rootId directory on startup, including a concurrent live host's socket directory. Resolve the endpoint root from os.tmpdir() and fall back to /tmp when the socket path would exceed the portable sun_path budget; truncating the directory root tag to 16 characters keeps default macOS temp roots under that limit. Each endpoint directory now carries an owner.pid marker written before listen, and the startup sweep reclaims only directories whose owner is provably gone, under both the current naming and the pre-change full-tag naming. Test-harness cleanup rides along: six identical copies of removePosixEndpointDirectories and the host-kernel variant now share one fixture that understands both namings and both roots, and node:os is registered in the dependency-boundary allowlist for the control tree. Closes apache#2133

Benjamin-eecs marked this pull request as ready for review August 4, 2026 14:02

Copilot AI lite review requested due to automatic review settings August 4, 2026 14:02

Copilot AI reviewed Aug 4, 2026

Benjamin-eecs force-pushed the fix/2133-endpoint-tmpdir-liveness branch from 79a7e74 to 18dedf8 Compare August 4, 2026 14:04

jackwener added 2 commits August 4, 2026 23:20

Merge remote-tracking branch 'origin/main' into codex/review-pr-2160

b99e184

fix(runtime-host): make endpoint ownership atomic

8ad68ee

jackwener merged commit 87e9040 into apache:main Aug 4, 2026
10 checks passed

Navigation Menu

Uh oh!

fix(runtime-host): honor TMPDIR for control endpoints and sweep only dead directories - #2160