Skip to content

fix(env): restore USERNAME in Windows baseline env; real login env on Unix (4.6.1) - #655

Merged
zackees merged 7 commits into
mainfrom
fix/env-block-username
Jul 24, 2026
Merged

fix(env): restore USERNAME in Windows baseline env; real login env on Unix (4.6.1)#655
zackees merged 7 commits into
mainfrom
fix/env-block-username

Conversation

@zackees

@zackees zackees commented Jul 24, 2026

Copy link
Copy Markdown
Owner

Summary

Root-caused live on a dev box where soldr's daemon became permanently unreachable (zackees/soldr — daemon pipe-name split).

Windows: user_baseline_environment_block() opened the process token with TOKEN_QUERY only. CreateEnvironmentBlock then succeeds but silently omits the per-user dynamic variables (USERNAME, USERDOMAIN). soldr derives its daemon pipe name from USERNAME, so daemons spawned with the baseline env bound soldr-daemon-soldr-<hash> while clients dialed soldr-daemon-Zach_Vorhies-<hash> — permanent uncached-fallback loop plus a displacement kill war. Fixed by opening the token with TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE per the API docs. Verified empirically: QUERY-only → no USERNAME; QUERY|DUPLICATE → USERNAME=Zach Vorhies.

Unix: EnvironmentPolicy::UserBaseline previously fell back to inheriting the parent env wholesale. It now reconstructs a clean login environment from the user's identity via getpwuid_r: USER/LOGNAME/HOME/SHELL, platform default login PATH, with LANG/LC_*/TZ/TMPDIR carried over. Falls back to inheritance only when no passwd entry resolves.

Tests

  • live_user_baseline_contains_username (Windows): baseline must contain non-empty USERNAME matching the live login value — fails on TOKEN_QUERY-only.
  • login_baseline_contains_identity_and_default_path (Unix)
  • login_baseline_does_not_leak_arbitrary_process_vars (Unix): process-local canary var must not leak into the baseline.
  • Full env test module green on Windows; x86_64-apple-darwin cross-check compiles.

Release

Version bumped 4.6.0 → 4.6.1 in all manifests (ci.version_check green) — merging fires the Auto Release workflow.

🤖 Generated with Claude Code

zackees and others added 7 commits July 23, 2026 20:59
@zackees @claude
fix(env): restore USERNAME in Windows baseline env; real login env on…
3708c3c 
… Unix

CreateEnvironmentBlock silently omits per-user dynamic variables
(USERNAME, USERDOMAIN) when the token is opened with TOKEN_QUERY only;
open it with TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE as the
API documents. Root-caused live: soldr's daemon derived its pipe name
from USERNAME and bound soldr-daemon-soldr-<hash> while clients dialed
soldr-daemon-<user>-<hash>, forcing permanent uncached fallback.

EnvironmentPolicy::UserBaseline on Unix now reconstructs a clean login
environment from getpwuid_r (USER/LOGNAME/HOME/SHELL + default login
PATH, carrying over LANG/LC_*/TZ/TMPDIR) instead of inheriting the
parent environment wholesale.

Release 4.6.1.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zackees @claude
chore(deps): update anyhow 1.0.102 -> 1.0.104 (RUSTSEC-2026-0204)
72a8c47 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zackees @claude
chore(deps): update crossbeam-epoch to >=0.9.20 (RUSTSEC-2026-0204)
1a98782 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zackees @claude
ci: retrigger after cancelling superseded workflow runs
25dd3cf 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zackees @claude
ci: one build per platform — collapse per-task workflow sprawl (#513 …
31d6936 
…follow-up)

Rewrite ci-preflight.yml as ONE job per platform: workspace cargo
build + dev wheel build happen exactly once, then lint, unit tests,
integration tests, servicedef proof, and rustdoc run sequentially
against that build. The warm-then-fan-out shape still re-ran uv sync
and the maturin dev wheel build in every sub-worker and paid 4x
runner spin-up + cache transfer per platform.

Remove the 20 legacy per-platform per-task wrappers, the 3 shared
_<task>.yml templates, preflight-macos.yml, and linux-x86-rustdoc.yml
(all superseded by ci-preflight.yml since #513; soak period served).

Keep the six *-build.yml wheel workflows for ci/publish.py's manual
collection path but make them workflow_dispatch-only. Their
reproducible-spot-check job moves to ci-linux.yml. Restrict the
ci-{linux,macos,windows} dispatchers' push trigger to main so PR
branches stop running the whole matrix twice (push + pull_request).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zackees @claude
ci(coverage): triage the llvm-profdata SIGILL — core-dump backtrace +…
9136e37 
… profraw bisect

Coverage has been red since 2026-06-21 (200+ runs): all tests pass,
then rustup's llvm-profdata crashes with SIGILL merging the profraw
set. The LD_PRELOAD interposer landed the same day — instrumented
processes exiting through hooked file APIs are the prime suspect for
corrupt .profraw output.

On failure the job now: prints llvm-profdata identity, gdb-backtraces
any core dump, validates each profraw individually (uploading the bad
ones as artifacts), and retries the merge with only the valid files
to confirm or refute the poison-file theory.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zackees @claude
fix(coverage): prune truncated .profraw before merge — llvm-profdata …
60acbac 
…SIGILL since #533

Instrumented daemons this suite kills at teardown (broker-v2 accept
loop, #533 — 'production exit is via SIGTERM') never run the atexit
__llvm_profile_write_file flush; a file caught mid-write is truncated
and rustup's llvm-profdata crashes with SIGILL merging it. Coverage
has been red on every run since the #533 merge (2026-06-21).

Split cargo llvm-cov into nextest --no-report / report and validate
each .profraw with llvm-profdata show in between, deleting the ones
it cannot read (loses only the killed processes' counters).
Crash-on-corrupt-input is a known llvm-profdata bug class upstream
(llvm/llvm-project#92358, #63179); --failure-mode does not help when
the parser itself crashes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@codecov

codecov Bot commented Jul 24, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 94.36620% with 4 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
crates/running-process/src/environment.rs 94.36% 4 Missing ⚠️

📢 Thoughts on this report? Let us know!

@zackees
zackees merged commit d9c2dfe into main Jul 24, 2026
13 of 16 checks passed
This was referenced Jul 24, 2026
Merged
Merged
zackees added a commit to FastLED/fbuild that referenced this pull request Jul 24, 2026
@zackees @claude
chore(release): bump 2.5.3 -> 2.5.4 — running-process 4.6.1 (daemon e…
ec976ca 
…nv USERNAME fix) (#1171)

running-process ≤4.6.0 built detached daemons' baseline env via
CreateEnvironmentBlock with a TOKEN_QUERY-only token, silently
omitting the per-user dynamic variables (USERNAME, USERDOMAIN).
4.6.1 opens the token with the documented access mask and, on Unix,
reconstructs a real login environment via getpwuid_r instead of
inheriting the parent env. See zackees/running-process#655.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This was referenced Jul 24, 2026
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@zackees