0.6.0 --- one spawn, a working directory, and an honest refusal of the job

`CreateProcessW' has taken a current directory all along; what was missing until
openkal 0.11 was a caller able to say which. It is now `how->work', obtained
through the same `GetFinalPathNameByHandleW' the image path comes from.

⚠️⚠️ KAL_SPAWN_OWN_JOB IS REFUSED, AND NOT BECAUSE THIS SYSTEM CANNOT DO IT --- it
is the system the idea comes from. A job object with
JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE is exactly the unit the flag describes. What
is missing is somewhere to keep the job: `kal_process' is one machine word and it
holds the process handle, so `kal_process_terminate' could not reach the job
later. The other two implementations need no storage because `getpgid(pid) ==
pid' recovers the fact from the kernel; this one has no equivalent.

⇒ Claiming it would mean a side table keyed by process handle, and a side table
that is wrong under concurrency terminates the WRONG tree. Refused until it can
be done without one --- a smaller lie than "kills sometimes".

The three unclaimed positions and the calls that refuse them are now written
together above kal_process_props, because a word claiming what the next call
declines is the disagreement clause 6.2 exists to prevent.

Author: Sunrisepeak

mcpp.toml

@@ -1,7 +1,7 @@
 [package]
 namespace   = "mcpplibs"
 name        = "openkal-windows"
-version     = "0.5.0"
+version     = "0.6.0"
 description = "An implementation of openkal for Windows, written on the Win32 interfaces and the object manager beneath them, using no C runtime symbol."
 license     = "Apache-2.0"
 
@@ -18,7 +18,7 @@ authors     = ["mcpplibs"]
 repo        = "https://github.com/mcpplibs/openkal-windows"
 
 [dependencies]
-openkal = "0.10.0"
+openkal = "0.11.0"
 
 # The package contributes definitions and no modules. The interface it
 # implements is declared by the specification package, which this package

src/process.cpp

@@ -80,21 +80,55 @@ bool append_quoted(wchar_t* out, okw_uptr cap, okw_uptr& at, const wchar_t* s, o
 
 extern "C" {
 
-int kal_process_spawn(kal_dir base,
+// Starting a program. One function since openkal 0.11.
+//
+// ⚠️ TWO OF THE FIVE POSITIONS IN `kal_spawn' ARE REFUSED HERE, AND EACH REFUSAL
+// IS OLDER THAN 0.11 --- the record moved, the answers did not.
+//
+// `grants': this environment has no numbering a preopen could arrive under, so
+// there is no correspondence to descriptor three. KAL_PROCESS_PROP_GRANT_DIR is
+// not claimed. A count of zero asks for a program with no preopens, which is
+// what a program here gets anyway, so that request IS answerable and is
+// answered.
+//
+// `KAL_SPAWN_BOUND_LIFETIME': no primitive arms it from inside the started image.
+//
+// ⚠️⚠️ `KAL_SPAWN_OWN_JOB' IS REFUSED, AND NOT BECAUSE THIS SYSTEM CANNOT DO IT ---
+// a job object with JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE is exactly the unit the
+// flag describes, and this is the environment the idea comes from. What is
+// missing is somewhere to keep the job: `kal_process' is one machine word and it
+// holds the process handle, so `kal_process_terminate' would have no way to
+// reach the job later. The other two implementations need no such storage
+// because `getpgid(pid) == pid' recovers the fact from the kernel.
+//
+// ⇒ Claiming it would mean a side table keyed by process handle, and a side
+// table that is wrong under concurrency terminates the wrong tree. Refused
+// until it can be done without one, which is a smaller lie than "kills
+// sometimes". Clause 6.2: the position is not claimed and a caller that asks
+// first is told.
+int kal_process_spawn(const kal_spawn* how,
                       const char* path, kal_uintptr path_len,
                       const char** argv, const kal_uintptr* argv_lens, kal_uintptr argc,
                       const char** envp, const kal_uintptr* envp_lens, kal_uintptr envc,
                       const kal_spawn_streams* streams,
                       kal_process* out) {
-    void* dir = okw::unpack(base.h);
-    if (!dir || out == nullptr) return kal_err_invalid;
+    if (how == nullptr || out == nullptr) return kal_err_invalid;
+    void* dir = okw::unpack(how->base.h);
+    void* run = okw::unpack(how->work.h);
+    if (!dir || !run) return kal_err_invalid;
     if (!okw::acceptable(path, path_len)) return kal_err_invalid;
+    if (how->grant_count > 0) return kal_err_not_supported;
+    if (how->flags != 0)      return kal_err_not_supported;
 
     // The directory's own name, and the program's beneath it.
     // Obtained rather than kept in static storage: static storage shared
     // between execution contexts would make two concurrent spawns one.
     struct scratch {
         wchar_t image[okw::kMaxName];
+        // ⭐ THE DIRECTORY THE PROGRAM RUNS IN, WHICH IS NOT THE ONE IT IS NAMED
+        // FROM. `CreateProcessW' has taken a current directory all along; what
+        // was missing until 0.11 was a caller able to say which.
+        wchar_t cwd[okw::kMaxName];
         wchar_t line[kCommandLine];
         wchar_t block[kCommandLine];
     };
@@ -118,6 +152,13 @@ int kal_process_spawn(kal_dir base,
     }
     image[at] = 0;
 
+    // The same enquiry the image path comes from, upon the other directory.
+    wchar_t* cwd = work->cwd;
+    const DWORD cn = GetFinalPathNameByHandleW(run, cwd, okw::kMaxName - 1,
+                                               FILE_NAME_NORMALIZED | VOLUME_NAME_DOS);
+    if (cn == 0 || cn >= okw::kMaxName - 1) return okw::translate_win32(GetLastError());
+    cwd[cn] = 0;
+
     // The vector, unaltered, including its first element.
     wchar_t* line = work->line;
     okw_uptr used = 0;
@@ -170,7 +211,7 @@ int kal_process_spawn(kal_dir base,
     const BOOL started = CreateProcessW(image, argc ? line : nullptr, nullptr, nullptr,
                                         inherit ? TRUE : FALSE,
                                         CREATE_UNICODE_ENVIRONMENT,
-                                        envc ? block : nullptr, nullptr, &startup, &info);
+                                        envc ? block : nullptr, cwd, &startup, &info);
     if (!started) return okw::translate_win32(GetLastError());
     CloseHandle(info.hThread);
     *out = kal_process{ okw::pack(info.hProcess) };
@@ -221,36 +262,6 @@ void kal_process_channel_close(kal_stream s) {
     CloseHandle(h);
 }
 
-// Starting a program that receives exactly the directories named.
-//
-// ⚠️ NOT PROVIDED, AND THE REFUSAL IS THE HONEST ANSWER RATHER THAN A GAP. A
-// preopened directory is a handle a started program reads back through
-// kal_fs_preopen by NUMBER, and this environment has no numbering: a handle
-// crosses a spawn by being inheritable, and the started program learns of it
-// through a mechanism the parent has to arrange itself. There is no
-// correspondence here to descriptor three.
-//
-// Clause 6.2 is what makes the refusal conforming rather than a deviation: the
-// operation exists, reports kal_err_not_supported, and the property word does
-// not claim KAL_PROCESS_PROP_GRANT_DIR. A caller therefore learns from the word
-// what it would otherwise learn from a failed call.
-int kal_process_spawn_with(kal_dir base,
-                           const char* path, kal_uintptr path_len,
-                           const char** argv, const kal_uintptr* argv_lens, kal_uintptr argc,
-                           const char** envp, const kal_uintptr* envp_lens, kal_uintptr envc,
-                           const kal_spawn_streams* streams,
-                           const kal_preopen* grants, kal_uintptr grant_count,
-                           kal_process* out) {
-    // A count of zero asks for a program with no preopens, which this
-    // environment gives a started program anyway --- it has none to pass. That
-    // request is therefore answerable, and is answered by the ordinary spawn.
-    if (grant_count == 0)
-        return kal_process_spawn(base, path, path_len,
-                                 argv, argv_lens, argc,
-                                 envp, envp_lens, envc, streams, out);
-    (void)grants;
-    return kal_err_not_supported;
-}
 
 int kal_process_wait(kal_process p, int* status, int* terminated) {
     void* h = okw::unpack(p.h);
@@ -287,31 +298,15 @@ void kal_process_close(kal_process p) {
     if (h) { okw::retire(p.h); CloseHandle(h); }
 }
 
-// KAL_PROCESS_PROP_GRANT_DIR is deliberately absent: kal_process_spawn_with
-// refuses a non-empty set of grants here, and a word claiming a facility the
-// next call refuses is the disagreement clause 6.2 exists to prevent.
-// Starting a program whose lifetime is bound to this one's. Version 0.10.
-//
-// ⚠️⚠️ REFUSED HERE, AND NOT BECAUSE THIS SYSTEM CANNOT --- IT CAN. A job object
-// with `JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE' ends every program in the job when
-// the last handle to it closes, which this system does when a process dies
-// however it dies. That is exactly the binding openkal describes.
+// ⚠️ THREE POSITIONS ARE DELIBERATELY ABSENT, AND EACH IS ABSENT BECAUSE THE
+// NEXT CALL REFUSES IT. A word claiming a facility the operation then declines is
+// the disagreement clause 6.2 exists to prevent, so the two are written together
+// and read together:
 //
-// ⚠️ IT IS NOT CLAIMED IN THIS RELEASE BECAUSE IT HAS NOT BEEN MEASURED HERE.
-// The one consumer that needs it composes `execve', and this system already
-// declines `openkal.space' --- so nothing on this system reaches the operation
-// today, and claiming a binding that has never been exercised is the shape of
-// answer openkal exists to refuse. It is the next thing this implementation
-// should do, and it is recorded as that rather than as an absence.
-//
-// A caller that asks `kal_process_props' first is told before it depends on it.
-int kal_process_spawn_bound(kal_dir, const char*, kal_uintptr,
-                            const char**, const kal_uintptr*, kal_uintptr,
-                            const char**, const kal_uintptr*, kal_uintptr,
-                            const kal_spawn_streams*, kal_process*) {
-    return kal_err_not_supported;
-}
-
+//   GRANT_DIR       kal_process_spawn refuses a non-empty `grants'
+//   BOUND_LIFETIME  no primitive arms it from inside the started image
+//   OWN_JOB         the job exists; somewhere to keep its handle does not ---
+//                   see the note above kal_process_spawn
 kal_uintptr kal_process_props(void) { return
     KAL_PROCESS_PROP_TERMINATE | KAL_PROCESS_PROP_STREAM_PASSING
   | KAL_PROCESS_PROP_EXIT_STATUS