fix: accommodate Windows atomic writes and process probes

Author: vitry

scripts/lib/fs.mjs

@@ -13,7 +13,7 @@ import { basename, dirname, join } from 'node:path';
 import { PluginError, wrapError } from './errors.mjs';
 
 const require = createRequire(import.meta.url);
-const { tryLock, unlock } = /** @type {{ tryLock(fd: number): boolean, unlock(fd: number): void }} */ (
+const { tryLock, unlock, swap } = /** @type {{ tryLock(fd: number): boolean, unlock(fd: number): void, swap(from: string, to: string): Promise<void> }} */ (
   require('fs-native-extensions')
 );
 
@@ -54,7 +54,18 @@ export async function atomicWriteJson(path, value) {
     await handle.sync();
     await handle.close();
     handle = undefined;
-    await rename(temporaryPath, path);
+    try {
+      await rename(temporaryPath, path);
+    } catch (error) {
+      // Node's Windows rename cannot replace an existing destination.  The
+      // native swap helper uses MoveFileEx(REPLACE_EXISTING) on Windows and
+      // keeps the replacement operation within the filesystem primitive
+      // instead of opening an unlink/rename window.  The old destination is
+      // left at temporaryPath and is removed after the swap.
+      if (process.platform !== 'win32' || /** @type {NodeJS.ErrnoException} */ (error)?.code !== 'EPERM') throw error;
+      await swap(temporaryPath, path);
+      await unlink(temporaryPath);
+    }
     await chmod(path, 0o600);
     await syncDirectory(directory);
   } catch (error) {

tests/process-zcode.test.mjs

@@ -24,12 +24,14 @@ async function assertProcessGone(pid) {
 
 test('grace timer does not retain the caller after the child exits', async () => {
   const moduleUrl = new URL('../scripts/lib/process.mjs', import.meta.url).href;
-  const source = `import { spawn } from 'node:child_process'; import { terminateProcess } from ${JSON.stringify(moduleUrl)}; const child=spawn(process.execPath,['-e','setInterval(()=>{},10000)']); await terminateProcess(child,{graceMs:1000});`;
+  const graceMs = process.platform === 'win32' ? 5_000 : 1_000;
+  const source = `import { spawn } from 'node:child_process'; import { terminateProcess } from ${JSON.stringify(moduleUrl)}; const child=spawn(process.execPath,['-e','setInterval(()=>{},10000)']); await terminateProcess(child,{graceMs:${graceMs}});`;
   const started = Date.now();
   const runner = spawn(process.execPath, ['--input-type=module', '-e', source], { stdio: 'ignore' });
   const code = await new Promise((resolve) => runner.once('exit', resolve));
   assert.equal(code, 0);
-  assert.ok(Date.now() - started < 700, 'the cancelled grace timer must not keep the event loop alive');
+  const budgetMs = process.platform === 'win32' ? 3_000 : 700;
+  assert.ok(Date.now() - started < budgetMs, 'the cancelled grace timer must not keep the event loop alive');
 });
 
 test('runProcess fails closed on timeout and bounded output', async () => {
@@ -130,7 +132,7 @@ test('close aborts and detaches a never-settling permission task under strict re
     assert.equal(firstClose, secondClose);
     await firstClose;
     const elapsedMs = Date.now() - started;
-    assert.ok(elapsedMs <= 200, 'close took ' + elapsedMs + 'ms');
+    assert.ok(elapsedMs <= (process.platform === 'win32' ? 2_000 : 200), 'close took ' + elapsedMs + 'ms');
     await new Promise((resolve) => setImmediate(resolve));
     assert.ok(handlerSignals.every((signal) => signal.aborted));
     assert.equal(protocol.serverTasks.size, 0);
@@ -143,7 +145,7 @@ test('close aborts and detaches a never-settling permission task under strict re
   runner.stderr.setEncoding('utf8'); runner.stderr.on('data', (chunk) => { stderr += chunk; });
   const outcome = await Promise.race([
     new Promise((resolve) => runner.once('exit', (code, signal) => resolve({ code, signal }))),
-    new Promise((resolve) => { const timer = setTimeout(() => resolve({ timeout: true }), 1_000); timer.unref(); }),
+    new Promise((resolve) => { const timer = setTimeout(() => resolve({ timeout: true }), process.platform === 'win32' ? 5_000 : 1_000); timer.unref(); }),
   ]);
   if (outcome.timeout) runner.kill('SIGKILL');
   assert.deepEqual(outcome, { code: 0, signal: null }, stderr || 'strict child did not finish');

tests/recovery.test.mjs

@@ -385,7 +385,11 @@ test('successful internal response writes unref the protected socket instead of
 });
 
 test('real fd4 writer is bounded for no-reader, slow-reader, and early-close pipes', async () => {
-  const noRead = await runWriterProbe('no-read'); assert.equal(noRead.code, 0); assert.match(noRead.stdout, /INTERNAL_RESPONSE_WRITE_TIMEOUT/);
+  // Windows anonymous pipes may buffer this bounded frame without a reader;
+  // the no-reader timeout probe is specific to POSIX pipe backpressure. The
+  // deterministic writer timeout/failure cases above still cover the same
+  // contract on every platform.
+  if (process.platform !== 'win32') { const noRead = await runWriterProbe('no-read'); assert.equal(noRead.code, 0); assert.match(noRead.stdout, /INTERNAL_RESPONSE_WRITE_TIMEOUT/); }
   const slowRead = await runWriterProbe('slow-read'); assert.equal(slowRead.code, 0); assert.match(slowRead.stdout, /ok/); assert.equal(slowRead.internalError, null);
   const earlyClose = await runWriterProbe('early-close'); assert.equal(earlyClose.code, 0); assert.match(earlyClose.stdout, /INTERNAL_RESPONSE_WRITE_FAILED/);
 });