[Xuepoo]

Priority: P2 | Area: area:ipc | Labels: feat,P2,area:ipc | Milestone: 0.0.25 | RFC: accepted IPC boundary (OQ-018) + devtools RFC (OQ-019) | Task: CTX-1405

Summary

Windows named-pipe transport for terminal-instance IPC (#2244) and the existing devtools inspection surface (#2243), reusing the shared bitty-ipc transport rather than adding a second protocol.

• ipc_serve.rs: Windows servo mirrors the Unix lifecycle (resolve, bind, attest, accept loop, 16-connection shed) on \\.\pipe\bitty-<instance> with a protected current-user DACL. The dispatcher registration is shared through build_dispatcher, so ping, snapshots, consent, panel list, and bitty.debug/* inspection are identical.
• ctl/client.rs: Windows client connects through the shared pipe adapter (server process SID verified before returning) and uses the same exchange envelope/framing/response parser as Unix. Target resolution derives the pipe from instance identity, accepts only \\.\pipe\ overrides, and supports the exactly-one-live shortcut.
• list.rs: Windows instance discovery probes through the authenticated client, so only current-user-served pipes report live; pipe-namespace rows are ownership-filtered.
• Failure behavior: a genuine pipe bind/attest failure returns the typed failure reason (so --fail-loud aborts); there is no allow-all fallback, no TCP listener, and no hardcoded pipe name.
• bitty-ipc dependency bumped to merged main 9493674 (PR [CTX-0016] feat(ipc): Windows named-pipe transport with current-user SID checks bitty-ipc#37), which adds bitty-ipc-winpipe, Windows VerifiedPeer SID verification, and the shared Windows serve loop.

Tests

• Windows: windows_named_pipe_serves_ctl_roundtrip (named mutation target: disabling the Windows serve path fails it), including bitty.debug/getGridText denied without debug.inspect; peer/SID, oversize-frame, bind-collision, proof-cross-connection, short-lived-probe, authorized/ungranted inspection tests live in bitty-ipc and run in its Windows CI job.
• Platform-neutral: pipe-path derivation from instance identity, non-pipe override rejection, and shared frame/continuation-bound assertions.
• Unix behavior unchanged; all existing Unix servo/ctl/list tests pass.

Verification

• cargo check -p bitty-terminal (Linux) green.
• cargo check -p bitty-terminal --all-targets --target x86_64-pc-windows-msvc green.
• cargo nextest run -p bitty-terminal -p bitty-runtime 3680 passed, 1 skipped (before final pin-only bump; remote CI is authoritative).
• cargo clippy --workspace --all-targets --locked -- -D warnings green.
• cargo +1.85 MSRV check green on the bitty-ipc side.
• Remote Windows check and test runs the Windows-gated tests; no local act/ci-local was used per task instruction.

Closes #2244, #2243
Closes #2244
Closes #2243

Review follow-ups (head after re-push)

• The Windows mutation test now drives the production serve_in_background entry point through a cfg(test) advisory-environment seam (serve_in_background_for_tests), not windows_serve directly. Replacing the Windows arm of serve_in_background with degraded_guard() now fails windows_named_pipe_serves_ctl_roundtrip.
• Synced stale transport comments in test_mode.rs, the shared panel-list registration, and the Windows probe doc.
• Pipe-namespace rows are probed and filtered for current-user ownership before the MAX_LIST_INSTANCES cap.
• discover_live_pipes propagates a typed InstanceError on registry/namespace read failure; only instance list stays best-effort.
• Filed bitty-terminal-docs#265 for the stale lua-and-xdg.md Windows pipe name (bitty-<username>-<instance-id> vs the RFC/implementation bitty-<instance-id>).
• Unrelated CI deflake: component_request_surface now widens only its test-harness VM wall budget (10x, same precedent as bitty#2259/[P2] composer_headless_driver wall-clock budget flakes under CI load #1727/[P2] plugin_ui mount_loop wall-clock budget flakes under CI load #1744). The macOS failure was WallClockExceeded at 130 ms vs the 50 ms production budget; production budgets are unchanged.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 41 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository UI (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: b2447fbe-f9db-4746-95ae-519c6f2ed644

📥 Commits

Reviewing files that changed from the base of the PR and between d9fd635 and fe6bdf5.

⛔ Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing: 11

• crates/bitty-rich/Cargo.toml
• crates/bitty-runtime/Cargo.toml
• crates/bitty-runtime/tests/component_request_surface.rs
• crates/bitty-runtime/tests/final_integration.rs
• crates/bitty-terminal/Cargo.toml
• crates/bitty-terminal/src/ctl/client.rs
• crates/bitty-terminal/src/ctl/request.rs
• crates/bitty-terminal/src/ctl/tests.rs
• crates/bitty-terminal/src/ipc_serve.rs
• crates/bitty-terminal/src/list.rs
• crates/bitty-terminal/src/test_mode.rs

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Xuepoo]

Review fixes pushed at a99a2cd1:

1. windows_named_pipe_serves_ctl_roundtrip now calls the production serve_in_background through a cfg(test) advisory-env seam, so replacing the Windows arm with degraded_guard() fails the named test.
2. Synced the test_mode.rs, panel-list registration, and Windows-probe comments.
3. Namespace rows are ownership-probed before the list cap; discover_live_pipes propagates a typed InstanceError; docs follow-up filed as bitty-terminal-docs#265.
4. Noted the unrelated macOS harness wall-budget deflake in the PR body (test-only; production budgets unchanged).

CI is running on this head.

[Xuepoo]

Doc-link cleanup amended; current head: 6e0d0d83.

[Xuepoo]

Merged as 1cad613e79d1731f810ba5b56d8cb38ee0d33f69 from head fe6bdf54d83c9a8f6c84a0f834510dd8ad7fad24. #2244 and #2243 are closed. All required checks passed (Windows 24m25s, macOS 17m29s, Quality gates, MSRV, CodeQL neutral, aggregate M1/compat).