A normal run dumped the whole host↔runner trace (spawn, handshake, every
per-command dispatch and request/response) to the terminal. Gate that
behind OCS_PLUGIN_VERBOSE and, in normal runs, print just one line per
plugin: `Loaded plugin: <name> (<id> <version>)`.
The chatty host-side `[plugin]` lines now go through a `vlog!` macro that
only fires when OCS_PLUGIN_VERBOSE is set. Runner-side logs were already
suppressed (the runner is spawned with stderr = null); the remaining
`[plugin]` lines in the IPC client are genuine error messages, left as-is.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
The handshake verification used a raw blocking `recv`, the one unbounded
read in the spawn path: `accept` is guarded by `spawn_timeout` and every
host->runner `call` by `call_timeout`, but a process that won the accept
race and then sent nothing — or a runner that died mid-handshake — would
hang the host forever.
Route the handshake through the existing `recv_with_deadline` helper so
the first frame is bounded too (marking the process dead on timeout), and
reduce `verify_runner_handshake` to a pure token check on the received
message. Tests updated to match.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
The call-timeout test asserted the real 10 s Dispatch floor, adding 10 s+
to every suite run. Add a cfg(test)-only OCS_PLUGIN_TEST_FLOOR_SECS seam
so the test fires at its 1 s base instead; production still enforces the
hard safety floors. Test now finishes in ~1 s.
Also document in mark_dead that the host-side socket is closed indirectly
by killing the child (which unblocks and drops the detached reader
thread's Stream), not by the take() in mark_dead itself.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Follow-ups after merging the out-of-process plugin isolation work:
- Convert the out-of-process interactive adapter's `on_point` /
`on_entity_pick` to `glam::DVec3`, matching the `CadCommand` trait,
which moved to f64 pick coordinates. The branch predated that change
and no longer compiled against the trait.
- Contain plugin constructor panics in `export_plugin!`: the constructor
runs across the C ABI boundary in `ocs_plugin_register`, where an
unwinding panic is undefined behavior. Catch it and return null, which
the loader already treats as a failed registration.
- Reap killed runner processes. The spawn-timeout and disconnect paths
called `child.kill()` without `wait()`, leaving a zombie on Unix until
the host exited. Route both — and `shutdown()` — through a shared
`reap()` that kills and waits on a detached thread.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
