Public Access
jaap-jan
e2733e5cbc
A terminal whose machine rebooted stayed green for ever. Not "went stale and
recovered late" — for ever: the tab claimed CONNECTED, the elapsed timer went
on counting, and the only thing that ever corrected it was closing the
application. That is the defect this fixes, and it turned out to be two
separate failures wearing one symptom.
◆ THE HANG IS IN SSH.NET, AND KEEP-ALIVE ALONE WOULD NOT HAVE FIXED IT.
ShellStream ends a blocked read from exactly two places: its channel being
closed, and the session raising Disconnected. A shell that exits gives the
first. But Session raises Disconnected from one method only — OnDisconnectReceived,
for a server that politely says goodbye — and a socket that simply fails goes
down a different path entirely: RaiseError fires the error event, sets the
disconnecting flag and disposes the socket, without ever raising Disconnected.
So the stream was never disposed, its Monitor.Wait was never pulsed, and the
read blocked until the process ended. The transport was gone, the client knew
the transport was gone, and nothing woke the one thread that was waiting.
That is why the first attempt at a test for this sat at thirty seconds and
failed. Both halves are needed and neither is sufficient:
- Keep-alive makes the failure HAPPEN. An idle SSH session is a socket
nobody writes to, and TCP has no way to discover that the far end has gone
without writing to it — nothing was asked, so nothing could fail. Thirty
seconds, matching OpenSSH's own ServerAliveInterval examples. It is the
write that matters and not a reply: SSH_MSG_IGNORE need not be answered,
so this is traffic rather than a heartbeat with a deadline, and there is
no timeout invented here to be wrong about a slow link.
- Disposing the stream from the error handler makes it ARRIVE. Queued to the
thread pool and not done inline, which is not tidiness: this runs on
SSH.NET's message-listener thread, and closing a channel waits for the
server's close — processed by that same thread — so an inline dispose is
the listener thread waiting on itself.
SFTP gets the keep-alive too. Its operations are request/response and bounded
by ConnectionInfo.Timeout already, so it needs no equivalent wake-up.
◆ exit AND reboot ARE TOLD APART BY A LATCH, BECAUSE THE OBVIOUS WAY IS A RACE.
Wait for the read to end and then ask whether the transport is still up, and
against a real server the answer is wrong about half the time: this was the
only channel on the connection, so sshd hangs up a millisecond after closing
it. By the time anything could ask, the transport is gone either way — and a
poll would report every ordinary `exit` as a dropped connection.
So ISshShellSession.TransportFailure is set at the moment SSH.NET raises the
failure, which its own ordering puts strictly before the disconnect that wakes
the read. A read that has just returned zero consults a settled value: set if
the transport failed, still null if the remote merely closed the channel. The
pump turns that into a TerminalSessionOutcome — RemoteClosed, ConnectionLost,
ClosedLocally — carried on SessionEnded, which used to hand over a session id
and nothing else. A subscriber cannot work this out afterwards; by the time it
hears, there is no transport left to interrogate.
Deliberately no fourth value for "the remote rebooted". Nothing on the wire
distinguishes a reboot from a cable being pulled, and a name this client
cannot check would be a guess dressed as a fact.
◆ WHAT IS DRAWN, AND WHY IT IS NOT DRAWN OVER THE PANE.
The status bar says DISCONNECTED or SHELL EXITED where it used to say NOT
CONNECTED for both — a word that is honest about a tab still dialling and
useless about one whose shell has stopped. Red for the first and grey for the
second: one is a machine that stopped answering and the other is work
finished, and crying wolf on the ordinary end of every session is its own bug.
The tab strip's dot gains the same fourth state, on both heads.
Under the terminal, a strip carrying the reason and two buttons. It takes its
own Auto grid row rather than overlaying the renderer, and that is forced
rather than chosen: the WebView is a native child view composited above
everything Avalonia draws, so the alternative is collapsing the terminal — and
the scrollback is precisely what the user wants to read, because the last
thing the remote said is usually why it went. terminal.js already writes the
same sentence into the pane; this is the copy that does not scroll away.
RECONNECT reuses the tab in place, which is what the word means to somebody
who pressed it: the terminal they were working in comes back, where it was.
It dials through the vault's ordinary connect path, so every refusal — a key
that has left the keychain, an unknown host key, a group default that has
changed since — is decided in the one place that already decides them; what
this adds is which tab the attempt belongs to. The old session is closed as
part of it, because a dead shell still holds an authenticated connection this
process has stopped reading, and its pane still holds an xterm, a scrollback
and a WebGL context, of which a browser hands out about sixteen.
Two refusals it makes rather than pretending: a host reached by typing an
address has no keychain entry to redial, and one that wants a password typed
goes to the keychain with the sheet raised rather than being dialled with an
empty box. Both say so on the strip where the button was pressed, not only in
the vault's status on a screen that surface is not.
TRY AGAIN appears on a refused connection for the same reason, and it is worth
as much: the commonest refusal is a host that was not up yet.
◆ WHAT IS ACTUALLY VERIFIED.
Two tests against a real sshd in a container. `exit` is reported as the remote
closing the session — the one a polling implementation fails, and a fake shell
cannot show it because a fake has no server behind it deciding to hang up. And
a live shell losing its transport is reported as a lost connection, produced
by dialling through a plain TCP relay the test owns and then cutting it; the
container is shared by the collection, so killing sshd was never an option.
The first draft of that second test used LoopbackProxyTests' SOCKS forward and
timed out: disconnecting the carrier of a ForwardedPortDynamic does not close
the loopback socket it accepted. Recorded in the test, because it is a
property of SSH.NET's forwarder rather than of anything here, and it is not
what a dying machine looks like.
What no test reproduces is the waiting. A relay that closes sends a FIN, so
the socket reports itself at once; a machine switched off sends nothing, and
finding that out is the keep-alive's business and the OS's retransmit budget's
— neither of which a test can hurry along without a clock this code does not
own. A reboot is prompt in practice because the machine comes back and RSTs.
Beside those: three pump outcomes, three workspace announcements, and seven
shell-flow tests covering the drop, the clean exit, reuse of the tab, retry
after a refusal, and both ways a reconnect can honestly come to nothing.
Also fixed in passing: SshNetShellSession.IsOpen read ShellStream.CanRead,
which is documented as always true — the stream stays readable after disposal
so buffered output can be drained — so it had answered "yes" for every shell
that ever existed. It reads CanWrite now. And MainWindowViewModel's session-
ended handler moved from Dispatcher.UIThread.Post to the injected post
delegate, which is what makes any of the shell half testable at all; the
remark listing the three unreachable posts is one shorter.
122 lines
7.5 KiB
XML
122 lines
7.5 KiB
XML
<UserControl xmlns="https://github.com/avaloniaui"
|
|
xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
|
|
xmlns:vm="using:DodoSSH.Client.Shell.ViewModels"
|
|
x:Class="DodoSSH.Client.App.Views.SessionTabRow"
|
|
x:Name="Root"
|
|
x:DataType="vm:MainWindowViewModel">
|
|
|
|
<!--
|
|
── v5b's in-screen tab row, the replacement for TerminalTabs ───────────────────────────────────────────
|
|
One pill per open terminal and the button that opens another — the same list <c>TerminalTabs</c> drew
|
|
above the whole window — now drawn inside each of the two screens the design gives a tab row: the
|
|
terminal surface and the SFTP surface. See <c>MainWindow.axaml</c> for where the strip itself went and
|
|
<c>Palette.axaml</c>'s v5b remark for why the row is 38 tall rather than the old strip's 42.
|
|
|
|
One control rather than two copies of the same markup, because the two rows share everything except two
|
|
things: which colour marks the active tab, and what a click on a tab actually does. Both are handed in
|
|
from the usage site rather than branched on a mode property here.
|
|
|
|
◆ THE COLOUR is <c>Classes="sftp"</c> on this control's own usage in <c>MainWindow.axaml</c> — unmarked
|
|
is the terminal row and reads <c>TerminalTabAccent</c>; <c>.sftp</c> reads <c>Magenta</c>. Both are
|
|
<c>App.axaml</c> selectors keyed off that class on this element, which is why the two rows need no
|
|
binding of their own for it: <c>Button.sesstab.active</c> and <c>.sftp Button.sesstab.active</c> are
|
|
the whole of it.
|
|
|
|
◆ THE CLICK is <see cref="TabCommand"/>, a plain <c>ICommand</c> this control exposes rather than reads
|
|
off the shell — the terminal row binds it to <c>SelectTabCommand</c> and the SFTP row to
|
|
<c>SelectFilesHostCommand</c>, and neither of those is a decision this control has any business making.
|
|
Every tab button's own <c>CommandParameter</c> is the tab itself, exactly as the strip's was.
|
|
|
|
The close box, the middle-click gesture and the "+" are not parameterised: closing a tab ends its shell
|
|
regardless of which screen it was clicked from, and "+" always opens the same palette. See
|
|
<c>MainWindowViewModel.CloseTabCommand</c> and <c>ToggleSearchCommand</c>.
|
|
-->
|
|
|
|
<Border Height="38">
|
|
<ScrollViewer HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Disabled">
|
|
<StackPanel Orientation="Horizontal" Spacing="6">
|
|
|
|
<ItemsControl ItemsSource="{Binding Tabs}">
|
|
<ItemsControl.ItemsPanel>
|
|
<ItemsPanelTemplate>
|
|
<StackPanel Orientation="Horizontal" Spacing="6" />
|
|
</ItemsPanelTemplate>
|
|
</ItemsControl.ItemsPanel>
|
|
<ItemsControl.ItemTemplate>
|
|
<DataTemplate x:DataType="vm:TerminalTabViewModel">
|
|
|
|
<!--
|
|
Marked on IsSelected rather than IsShowing, unlike the old strip: IsShowing is "the terminal
|
|
surface is showing this tab's pane", which the SFTP row's own active tab is never true of. A
|
|
selected tab survives navigating away from the terminal surface — that is the whole point of
|
|
a selection outliving a screen — so both rows agree on what "active" means without either
|
|
one needing a flag scoped to just one surface. See App.axaml's own remark on Button.sesstab.
|
|
-->
|
|
<Button Classes="sesstab"
|
|
Classes.active="{Binding IsSelected}"
|
|
Command="{Binding #Root.TabCommand}"
|
|
CommandParameter="{Binding}"
|
|
PointerPressed="OnTabPointerPressed"
|
|
ToolTip.Tip="{Binding Address}">
|
|
<StackPanel Orientation="Horizontal" Spacing="9" VerticalAlignment="Center">
|
|
<!--
|
|
Three states now, where there were two. Green while the shell behind this tab is running
|
|
and grey once it has ended, as the strip's dots always were — and amber while it is
|
|
connecting, which used to be grey as well.
|
|
|
|
The design's amber had no meaning here while nothing in this application knew how far a
|
|
connection had got; that changed with the step list, and the note this comment used to
|
|
carry — that amber is for a host merely reachable, so it is not drawn — is answered
|
|
rather than ignored. It is not being reachable that is amber, it is being underway. See
|
|
ConnectingCard.axaml, whose track and running step are the same colour for the same
|
|
reason, and design-notes/v5b-fidelity-notes.md for the state this is not.
|
|
|
|
Worth the third colour because the two it replaces were the same one: a tab still
|
|
dialling and a tab whose shell has exited both drew grey, which are the two states in
|
|
this strip with the least in common — one is worth waiting for and the other is over.
|
|
|
|
── and a fourth since, splitting that grey ────────────────────────────────────────────
|
|
A shell that ended and a connection that broke were still one dot, and they are the two
|
|
dead states with the least in common: one is work finished, the other is a machine that
|
|
stopped answering and may well still be there. Red for the second, matching the strip
|
|
under the terminal — see TerminalTabViewModel.IsDropped and SessionEndedBar.axaml, which
|
|
is where the sentence and the way back live.
|
|
-->
|
|
<Ellipse Classes="dot" Width="8" Height="8" Classes.live="{Binding IsLive}"
|
|
Classes.connecting="{Binding IsConnecting}"
|
|
Classes.dropped="{Binding IsDropped}"
|
|
VerticalAlignment="Center" />
|
|
<TextBlock Text="{Binding Label}" VerticalAlignment="Center" />
|
|
|
|
<Button Classes="flat close inline" Width="16" Height="16" Padding="0"
|
|
VerticalAlignment="Center"
|
|
Command="{Binding #Root.((vm:MainWindowViewModel)DataContext).CloseTabCommand}"
|
|
CommandParameter="{Binding}"
|
|
ToolTip.Tip="Closes this terminal and ends its shell. Middle-click the tab does the same.">
|
|
<TextBlock Text="✕" FontSize="10" HorizontalAlignment="Center"
|
|
VerticalAlignment="Center" />
|
|
</Button>
|
|
</StackPanel>
|
|
</Button>
|
|
|
|
</DataTemplate>
|
|
</ItemsControl.ItemTemplate>
|
|
</ItemsControl>
|
|
|
|
<!--
|
|
Opens the quick-connect palette, on both rows: "the existing new-connection/quick-connect meaning"
|
|
the notes ask this button to keep. See TerminalTabs' own remark, carried over unchanged, on why
|
|
this is a palette and never a flyout menu over the terminal's own rectangle.
|
|
-->
|
|
<Button Classes="sesstab plus"
|
|
Command="{Binding ToggleSearchCommand}"
|
|
ToolTip.Tip="Open a connection · Ctrl+K">
|
|
<TextBlock Text="+" FontSize="15" HorizontalAlignment="Center" VerticalAlignment="Center" />
|
|
</Button>
|
|
|
|
</StackPanel>
|
|
</ScrollViewer>
|
|
</Border>
|
|
|
|
</UserControl>
|