feat(launch): add bounded external EPF wait

[zeegin]

Migrated from alkoleft/v8-runner-rust pr #34.
Original author: korolevpavel; created: 2026-07-21T20:24:38Z; last upstream update: 2026-07-23T13:42:25Z.
GitHub shows the migration account as the new author; this block preserves actual attribution.
Upstream historical base: master at be558db1c456f2d3a828c0f4de121b980ba6ccdc; head: korolevpavel:feat/launch-epf-bounded-wait at 82908373539a2e5348beb2b604fa287901161cc1. Active migrated PRs compare that exact head with the current IngvarConsulting/v8-runner-rust:master.
Upstream merged: 2026-07-23T13:42:25Z; merge commit: 2a43c6d02af2e8440376fc50bbc8c697f142175c.

---

Closes upstream #29

• Adds opt-in launch thin --wait-for-exit for explicit external .epf execution.
• Returns structured PID, execute proof, exit/timeout, and artifact paths; timeout terminates the process group.
• Rejects raw/configured /C, /Execute, /Out aliases in wait mode and redacts composite connection credentials.

Validation: focused CLI wait tests, credential-redaction unit test, cargo test --no-run, fmt and diff checks.

Summary by CodeRabbit

• Новые возможности
  • Добавлен опциональный режим ожидания завершения внешнего EPF при launch thin.
  • Результат запуска теперь содержит PID, код завершения, признак тайм-аута и пути к артефактам.
  • Добавлены параметры --wait-for-exit, --wait-timeout-ms и --stderr-output.
• Улучшения
  • Усилена проверка неподдерживаемых параметров и зарезервированных ключей запуска.
  • Команды test и launch mcp не принимают параметры ожидания внешнего EPF.
  • Конфиденциальные данные в строках подключения маскируются при отображении ошибок.

[zeegin]

Upstream comment by coderabbitai[bot] at 2026-07-21T20:24:46Z: original

Warning

Review limit reached

@​alkoleft, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 32 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @​coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 507eca07-9878-4b67-9f5b-a6e59f1fcc2a

📥 Commits

Reviewing files that changed from the base of the PR and between 80bb103 and 8290837.

📒 Files selected for processing (1)

• src/platform/process.rs

Walkthrough

Добавлен opt-in bounded wait для launch thin с внешним EPF: CLI валидирует параметры, процесс запускается в управляемом режиме, ожидается до таймаута, а результат содержит PID, exit code, timeout и пути артефактов. Обычный асинхронный запуск сохраняется.

Changes

External EPF bounded wait

Layer / File(s)	Summary
CLI и доменные контракты src/cli/args.rs, src/domain/runner.rs, src/domain/launch.rs	Добавлены direct-only wait-флаги, отдельные типы аргументов и структуры ExternalEpfWaitOptions/ExternalEpfWaitResult.
Маппинг и валидация CLI src/cli/execute.rs	Проверяются комбинации wait-параметров и reserved raw keys, формируется external_epf_wait, deadline учитывает bounded wait.
Управляемый запуск процесса src/platform/process.rs	Добавлен ManagedWait, ожидание выхода, перенаправление stderr и очистка process group при таймауте или отмене.
Исполнение external EPF src/use_cases/launch_app.rs	Для ThinClient строится план, запускается EPF и возвращается структурированный результат; timeout возвращает runtime failure с payload.
Проверки и документация tests/cli_*.rs, src/mcp/service.rs, docs/CAPABILITIES.md	Проверены help-ограничения, успешное завершение, таймауты, очистка процессов, reserved keys и MCP-запреты; документация описывает режим.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CLI
  participant LaunchApp
  participant ProcessExecutor
  participant ExternalEPF
  CLI->>LaunchApp: launch thin with wait options
  LaunchApp->>ProcessExecutor: spawn managed wait process
  ProcessExecutor->>ExternalEPF: start EPF client
  LaunchApp->>ProcessExecutor: wait for exit or timeout
  ProcessExecutor-->>LaunchApp: exit code, timeout, and artifact paths
  LaunchApp-->>CLI: structured LaunchResult or runtime failure

Loading

Possibly related PRs

• alkoleft/v8-runner-rust#37 — изменяет LaunchResult в тех же доменных и use-case участках.

Suggested reviewers: alkoleft

Poem

Я, кролик, жду EPF в тиши,
PID скачет — хвост дрожит.
Таймер тикнул: группа спит,
Exit code всё объяснит.
Артефакты по следам —
Прыг-скок, порядок тут и там!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	Заголовок точно отражает основное изменение: bounded wait для external EPF в launch.
Linked Issues check	✅ Passed	PR реализует opt-in bounded wait, структурированный результат, таймаут/терминацию и сохранение async-поведения, как требует #29.
Out of Scope Changes check	✅ Passed	Изменения остаются в пределах запуска external EPF, обработки таймаутов, редактирования кредов и сопутствующих тестов/документации.
Docstring Coverage	✅ Passed	Docstring coverage is 84.62% which is sufficient. The required threshold is 80.00%.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @​coderabbitai help to get the list of available commands.}

[zeegin]

Upstream comment by korolevpavel at 2026-07-21T20:46:32Z: original

@​coderabbitai review

[zeegin]

Upstream comment by coderabbitai[bot] at 2026-07-21T20:46:40Z: original

@​korolevpavel: Starting a review of these changes.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[zeegin]

Upstream comment by korolevpavel at 2026-07-22T05:28:41Z: original

@​coderabbitai review

[zeegin]

Upstream comment by coderabbitai[bot] at 2026-07-22T05:28:46Z: original

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[zeegin]

Upstream review by coderabbitai[bot]; state: COMMENTED; submitted: 2026-07-23T13:34:51Z; commit: 80bb103899349b22b0b5df00ea3920999e7fdf9f. Original review

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@​src/platform/process.rs`:
- Around line 995-1010: Update split_infobase_connection_string_inline to avoid
slicing arg at a potentially invalid UTF-8 boundary: replace the direct
arg[..flag_len] access with a safe get(..flag_len) lookup while preserving the
existing case-insensitive prefix check and value_start behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: cd67c42b-71d9-4808-8d1a-f2a243f20b1f

📥 Commits

Reviewing files that changed from the base of the PR and between be558db and 80bb103.

📒 Files selected for processing (12)

• SKILL/SKILL.md
• docs/CAPABILITIES.md
• src/cli/args.rs
• src/cli/execute.rs
• src/domain/launch.rs
• src/domain/runner.rs
• src/mcp/service.rs
• src/platform/process.rs
• src/use_cases/launch_app.rs
• tests/cli_help.rs
• tests/cli_launch.rs
• tests/cli_test.rs

[zeegin]

Upstream inline review comment by coderabbitai[bot] at 2026-07-23T13:34:50Z; path: src/platform/process.rs, original line: 1010. Original comment

🩺 Stability & Availability | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Inspect the slicing site and confirm no char-boundary guard exists.
rg -nP -C3 'arg\[\.\.flag_len\]|split_infobase_connection_string_inline' src/platform/process.rs

Repository: alkoleft/v8-runner-rust

Length of output: 1132

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Read the relevant function and surrounding render logic without running repository code.
sed -n '940,1015p' src/platform/process.rs

# Check whether split_infobase_connection_string_inline is called before any char-boundary guard or safe extraction.
python3 - <<'PY'
from pathlib import Path
text = Path('src/platform/process.rs').read_text()
start = text.find('fn split_infobase_connection_string_inline')
end = text.find('\n}\n', start) + 3
fn = text[start:end]
fn_lines = fn.splitlines()
print('--- function snippet')
for i, line in enumerate(fn_lines, 1):
    print(f'{995+i-1}\t{line}')
print('--- unsafe slicing references')
for i, line in enumerate(fn_lines, 1):
    if 'arg[..flag_len]' in line or '[' in line and '..flag' in line:
        print(f'{995+i-1}\t{line}')
PY

Repository: alkoleft/v8-runner-rust

Length of output: 3412

---

Уберите срез строки по не UTF‑8 границе в split_infobase_connection_string_inline.

arg[..flag_len] в render_command может попасть внутрь многобайтового символа, когда аргумент длиннее флага, но символы идут не на границах ASCII-префикса. Это вызывает панику на штатном пути формирования логов/сообщений; например, /C"<кириллица>" с общим размером ≥ 20 байт. Используйте arg.get(..flag_len), а после совпадения ASCII-префикса текущие value_start значения уже корректны.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@​src/platform/process.rs` around lines 995 - 1010, Update
split_infobase_connection_string_inline to avoid slicing arg at a potentially
invalid UTF-8 boundary: replace the direct arg[..flag_len] access with a safe
get(..flag_len) lookup while preserving the existing case-insensitive prefix
check and value_start behavior.

✅ Addressed in commit 8290837