Tracking epic for Harper's substituted child_process module — the replacement that security/jsLoader.ts hands to component code in place of the real Node builtin (security/jsLoader.ts:918-1127), and the single-process PID-file supervisor behind it.
The substitute exists to give components a supervised way to run a sidecar process: an allowedSpawnCommands allowlist, a mandatory options.name, a <rootPath>/pids/<name>.pid lock so only one process per name runs across all threads, and an optional options.version that replaces a running process when the caller bumps it. Several of those guarantees do not hold as written.
In scope
- Argument marshalling between the wrapper's fixed
(command, args, options, callback) shape and each wrapped function's real Node signature.
- PID-file lock lifecycle: acquisition, the version-replacement handoff, cleanup on exit, stale-file recovery.
- Validation of
options.name and options.version.
ExistingProcessWrapper — the ChildProcess-like object returned when a process is adopted rather than spawned.- The
<rootPath>/pids/ namespace and how names from independent components share it.
Out of scope
- Whether the substitution is reached at all. Loader paths that hand component code the real
child_process (CJS require, compartment mode, natively-loaded npm dependencies) are an access-control enforcement gap, and live under [Epic] Access-control enforcement gaps with the other allowlist bypasses — see harper#1924 and harper#1929.
- The component install/deploy spawn path in
components/Application.ts (waitForConfirmedTermination, processGroupIsAlive) — a different supervisor with its own defects; see harper#2076 and harper#2072.
Routing rule: if the defect is in what the substitute does once you reach it, it belongs here. If it is about reaching the substitute (or not), it belongs in #1646.
Filed by KrAIs (Claude Opus 5), from source confirmation against origin/main @ f8a5aa90a (v5.2.4) while documenting this module for HarperFast/documentation#634.
Tracking epic for Harper's substituted
child_processmodule — the replacement thatsecurity/jsLoader.tshands to component code in place of the real Node builtin (security/jsLoader.ts:918-1127), and the single-process PID-file supervisor behind it.The substitute exists to give components a supervised way to run a sidecar process: an
allowedSpawnCommandsallowlist, a mandatoryoptions.name, a<rootPath>/pids/<name>.pidlock so only one process per name runs across all threads, and an optionaloptions.versionthat replaces a running process when the caller bumps it. Several of those guarantees do not hold as written.In scope
(command, args, options, callback)shape and each wrapped function's real Node signature.options.nameandoptions.version.ExistingProcessWrapper— the ChildProcess-like object returned when a process is adopted rather than spawned.<rootPath>/pids/namespace and how names from independent components share it.Out of scope
child_process(CJSrequire, compartment mode, natively-loaded npm dependencies) are an access-control enforcement gap, and live under [Epic] Access-control enforcement gaps with the other allowlist bypasses — see harper#1924 and harper#1929.components/Application.ts(waitForConfirmedTermination,processGroupIsAlive) — a different supervisor with its own defects; see harper#2076 and harper#2072.Routing rule: if the defect is in what the substitute does once you reach it, it belongs here. If it is about reaching the substitute (or not), it belongs in #1646.
Filed by KrAIs (Claude Opus 5), from source confirmation against
origin/main@f8a5aa90a(v5.2.4) while documenting this module for HarperFast/documentation#634.