A Windows dup2 (UCRT before Windows 11) closes its target before
duplicating, so an OSError from the divert can leave the standard
descriptor closed rather than still carrying the wire. Run the same
dup2(private_fd, fd) restore the exit path uses before serving in
place: an idempotent no-op when fd is already on the wire, and a
re-materialization from the private duplicate when the target was
closed. Adds a regression variant that closes the target as UCRT does.
Also scopes the real-host logging note to the default stderr handler.
The diversion catches output that is actually flushed to stdout while
serving. A print() in a block-buffered process usually stays unflushed
in sys.stdout's user-space buffer, and the interpreter's exit flush
drains it onto the restored protocol stream, so the docs now say so
instead of implying every stray print is diverted. The logging advice
is unchanged: its handler flushes each record.
No-Verification-Needed: docs-only wording change
The null device reports POLLIN (plus POLLOUT under the default event
mask), never POLLERR; the migration note taught the wrong mask. The
Windows handle rebind now uses msvcrt.get_osfhandle, the documented
public API, instead of pywin32's underscore-private equivalent, which
also drops the win32file import. The migration entry also gains the
one API-visible change: a second concurrent stdio_server() raises
RuntimeError.
The transport's text layers now detach instead of closing on garbage
collection. In the in-place paths the wrapped buffer is the sys
stream's own, and closing it destroyed sys.stdout for the rest of the
process (the issue #1933 class, which the claimed path had already
fixed incidentally via the private descriptor).
Also strengthens the fd 0 watchdog migration note (the null device
reports permanently readable, so any-event watchers misfire at startup
rather than merely never firing) and restores the note about child
output volume flowing into the client's stderr channel.
The stdin/stdout claim now engages only in a normal process: the sys
stream backed by its real descriptor and fds 0-2 all open, which makes
it impossible for the private wire duplicates to land in the standard
range. Anything else - replaced streams, an incomplete descriptor
table, a failed dup - is served in place exactly as v1 was, and a
second concurrent stdio_server() raises RuntimeError instead of
contending for the streams.
This replaces the previous hardening (the dup-above-standard-range
loop, stderr-merge detection, and nested transports serving into the
diversion) with guards, and removes the migration entry: no working
code changes behavior, so there is nothing to migrate. Comments and
docstrings trimmed throughout the diff.
While serving on the process's real stdout, stdio_server now moves the
protocol pipe to a private descriptor and points fd 1 - and, on
Windows, the standard output handle - at stderr, restoring it when the
transport exits. A stray print() in handler code or a child process
writing to its inherited stdout lands in the client's log instead of
corrupting the JSON-RPC stream. The null device stands in when stderr
is unusable or, on POSIX, is detected as merged into stdout (2>&1).
The stdin claim generalizes into the shared _claim_fd mechanism: one
lock-guarded sentinel table covers both descriptors, private wire
duplicates are forced above the standard descriptor range so a process
started with a standard descriptor closed cannot hand the wire out as
its "stderr", and a failed claim degrades to serving the sys stream's
buffer in place exactly as v1 did.
Docs now describe the guarded behavior with its remaining gaps (output
flushed before serving begins, injected streams, merged stderr on
Windows), and the transport:stdio:stream-purity divergence narrows
accordingly.
While serving on the process's real stdin, stdio_server() now reads the
protocol from a private duplicate of fd 0 and points fd 0 (and, on
Windows, the standard input handle) at the null device, restoring both
on exit. Children spawned by handler code then inherit the null device
instead of the protocol pipe.
A child that inherited the pipe could consume protocol bytes on any
platform, and on Windows a Python child hangs inside interpreter
startup behind the transport's pending read (CPython gh-78961) until
the next request arrives, so any tool that ran a subprocess without
stdin=DEVNULL appeared to hang until timeout.
Isolation engages only when sys.stdin is backed by the real fd 0, at
most once per process, and degrades to reading stdin in place when the
descriptor table cannot be rearranged.
Fixes#671.
Max Isbey