Task
dign hangs forever if whatever holds the CLI endpoint accepts the connection and then never answers. Give the lane a read deadline so a person gets a refusal instead of a dead terminal.
Context
Found while closing the pre-authentication rendering finding on #215 (parent epic: https://github.com/DIG-Network/dig_ecosystem/issues/908). Pre-existing, not introduced by that PR, and no peer-authored bytes are involved — so it was logged rather than folded into that diff.
crates/dig-app-core/src/cli_session/ sets no timeout anywhere: grep -rn timeout crates/dig-app-core/src/cli_session/*.rs returns nothing. client::send_via blocks in frames.recv_frame() with no deadline, and the endpoint address is derived from the login name and needs no privilege to claim, so any local principal can hold it and stall. It does not even need to be hostile — a crashed or wedged process holding the pipe does the same thing.
The mutual handshake landed in PR#215 means such a peer can no longer harvest the secret or choose what dign prints. It can still stop dign from ever returning.
Scope
A read (and write) deadline on the CLI lane's client side, surfaced as NOT_CONNECTED with the existing remedy — the honest answer, since a peer that will not speak is indistinguishable from an app that is not running. The server side wants one too, so one stalled client cannot pin an accept slot.
Evidence
A test that binds the endpoint, accepts, and never writes; send_via must return rather than block. That test would hang today, so it is also the reproduction.
Task
dignhangs forever if whatever holds the CLI endpoint accepts the connection and then never answers. Give the lane a read deadline so a person gets a refusal instead of a dead terminal.Context
Found while closing the pre-authentication rendering finding on #215 (parent epic: https://github.com/DIG-Network/dig_ecosystem/issues/908). Pre-existing, not introduced by that PR, and no peer-authored bytes are involved — so it was logged rather than folded into that diff.
crates/dig-app-core/src/cli_session/sets no timeout anywhere:grep -rn timeout crates/dig-app-core/src/cli_session/*.rsreturns nothing.client::send_viablocks inframes.recv_frame()with no deadline, and the endpoint address is derived from the login name and needs no privilege to claim, so any local principal can hold it and stall. It does not even need to be hostile — a crashed or wedged process holding the pipe does the same thing.The mutual handshake landed in PR#215 means such a peer can no longer harvest the secret or choose what
dignprints. It can still stopdignfrom ever returning.Scope
A read (and write) deadline on the CLI lane's client side, surfaced as
NOT_CONNECTEDwith the existing remedy — the honest answer, since a peer that will not speak is indistinguishable from an app that is not running. The server side wants one too, so one stalled client cannot pin an accept slot.Evidence
A test that binds the endpoint, accepts, and never writes;
send_viamust return rather than block. That test would hang today, so it is also the reproduction.