1 files changed, 73 insertions, 26 deletions

diff --git a/src/zencompute/runners/windowsrunner.cpp b/src/zencompute/runners/windowsrunner.cpp
index cd4b646e9..92ee65c2d 100644
--- a/src/zencompute/runners/windowsrunner.cpp
+++ b/src/zencompute/runners/windowsrunner.cpp
@@ -21,6 +21,12 @@ ZEN_THIRD_PARTY_INCLUDES_START
 #	include <sddl.h>
 ZEN_THIRD_PARTY_INCLUDES_END
 
+// JOB_OBJECT_UILIMIT_ERRORMODE is defined in winuser.h which may be
+// excluded by WIN32_LEAN_AND_MEAN.
+#	if !defined(JOB_OBJECT_UILIMIT_ERRORMODE)
+#		define JOB_OBJECT_UILIMIT_ERRORMODE 0x00000400
+#	endif
+
 namespace zen::compute {
 
 using namespace std::literals;
@@ -34,38 +40,65 @@ WindowsProcessRunner::WindowsProcessRunner(ChunkResolver&				Resolver,
 : LocalProcessRunner(Resolver, BaseDir, Deleter, WorkerPool, MaxConcurrentActions)
 , m_Sandboxed(Sandboxed)
 {
-	if (!m_Sandboxed)
+	// Create a job object shared by all child processes. Restricting the
+	// error-mode UI prevents crash dialogs (WER / Dr. Watson) from
+	// blocking the monitor thread when a worker process terminates
+	// abnormally.
+	m_JobObject = CreateJobObjectW(nullptr, nullptr);
+	if (m_JobObject)
 	{
-		return;
+		JOBOBJECT_EXTENDED_LIMIT_INFORMATION ExtLimits{};
+		ExtLimits.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE | JOB_OBJECT_LIMIT_DIE_ON_UNHANDLED_EXCEPTION;
+		SetInformationJobObject(m_JobObject, JobObjectExtendedLimitInformation, &ExtLimits, sizeof(ExtLimits));
+
+		JOBOBJECT_BASIC_UI_RESTRICTIONS UiRestrictions{};
+		UiRestrictions.UIRestrictionsClass = JOB_OBJECT_UILIMIT_ERRORMODE;
+		SetInformationJobObject(m_JobObject, JobObjectBasicUIRestrictions, &UiRestrictions, sizeof(UiRestrictions));
+
+		// Set error mode on this process so children inherit it. The
+		// UILIMIT_ERRORMODE restriction above prevents them from clearing
+		// SEM_NOGPFAULTERRORBOX.
+		SetErrorMode(SEM_FAILCRITICALERRORS | SEM_NOGPFAULTERRORBOX);
 	}
 
-	// Build a unique profile name per process to avoid collisions
-	m_AppContainerName = L"zenserver-sandbox-" + std::to_wstring(GetCurrentProcessId());
+	if (m_Sandboxed)
+	{
+		// Build a unique profile name per process to avoid collisions
+		m_AppContainerName = L"zenserver-sandbox-" + std::to_wstring(GetCurrentProcessId());
 
-	// Clean up any stale profile from a previous crash
-	DeleteAppContainerProfile(m_AppContainerName.c_str());
+		// Clean up any stale profile from a previous crash
+		DeleteAppContainerProfile(m_AppContainerName.c_str());
 
-	PSID Sid = nullptr;
+		PSID Sid = nullptr;
 
-	HRESULT Hr = CreateAppContainerProfile(m_AppContainerName.c_str(),
-										   m_AppContainerName.c_str(),	// display name
-										   m_AppContainerName.c_str(),	// description
-										   nullptr,						// no capabilities
-										   0,							// capability count
-										   &Sid);
+		HRESULT Hr = CreateAppContainerProfile(m_AppContainerName.c_str(),
+											   m_AppContainerName.c_str(),	// display name
+											   m_AppContainerName.c_str(),	// description
+											   nullptr,						// no capabilities
+											   0,							// capability count
+											   &Sid);
 
-	if (FAILED(Hr))
-	{
-		throw zen::runtime_error("CreateAppContainerProfile failed: HRESULT 0x{:08X}", static_cast<uint32_t>(Hr));
-	}
+		if (FAILED(Hr))
+		{
+			throw zen::runtime_error("CreateAppContainerProfile failed: HRESULT 0x{:08X}", static_cast<uint32_t>(Hr));
+		}
 
-	m_AppContainerSid = Sid;
+		m_AppContainerSid = Sid;
+
+		ZEN_INFO("AppContainer sandboxing enabled for child processes (profile={})", WideToUtf8(m_AppContainerName));
+	}
 
-	ZEN_INFO("AppContainer sandboxing enabled for child processes (profile={})", WideToUtf8(m_AppContainerName));
+	StartMonitorThread();
 }
 
 WindowsProcessRunner::~WindowsProcessRunner()
 {
+	if (m_JobObject)
+	{
+		CloseHandle(m_JobObject);
+		m_JobObject = nullptr;
+	}
+
 	if (m_AppContainerSid)
 	{
 		FreeSid(m_AppContainerSid);
@@ -172,9 +205,9 @@ WindowsProcessRunner::SubmitAction(Ref<RunnerAction> Action)
 	LPSECURITY_ATTRIBUTES lpProcessAttributes = nullptr;
 	LPSECURITY_ATTRIBUTES lpThreadAttributes  = nullptr;
 	BOOL				  bInheritHandles	  = FALSE;
-	DWORD				  dwCreationFlags	  = DETACHED_PROCESS;
+	DWORD				  dwCreationFlags	  = CREATE_SUSPENDED | DETACHED_PROCESS;
 
-	ZEN_DEBUG("Executing: {} (sandboxed={})", WideToUtf8(CommandLine.c_str()), m_Sandboxed);
+	ZEN_DEBUG("{}: '{}' (sandbox='{}')", m_Sandboxed ? "Sandboxing" : "Executing", WideToUtf8(CommandLine.c_str()), Prepared->SandboxPath);
 
 	CommandLine.EnsureNulTerminated();
 
@@ -260,14 +293,21 @@ WindowsProcessRunner::SubmitAction(Ref<RunnerAction> Action)
 		}
 	}
 
-	CloseHandle(ProcessInformation.hThread);
+	if (m_JobObject)
+	{
+		AssignProcessToJobObject(m_JobObject, ProcessInformation.hProcess);
+	}
 
-	Ref<RunningAction> NewAction{new RunningAction()};
-	NewAction->Action		 = Action;
-	NewAction->ProcessHandle = ProcessInformation.hProcess;
-	NewAction->SandboxPath	 = std::move(Prepared->SandboxPath);
+	ResumeThread(ProcessInformation.hThread);
+	CloseHandle(ProcessInformation.hThread);
 
 	{
+		Ref<RunningAction> NewAction{new RunningAction()};
+		NewAction->Action		 = Action;
+		NewAction->ProcessHandle = ProcessInformation.hProcess;
+		NewAction->Pid			 = ProcessInformation.dwProcessId;
+		NewAction->SandboxPath	 = std::move(Prepared->SandboxPath);
+
 		RwLock::ExclusiveLockScope _(m_RunningLock);
 
 		m_RunningMap[Prepared->ActionLsn] = std::move(NewAction);
@@ -275,6 +315,8 @@ WindowsProcessRunner::SubmitAction(Ref<RunnerAction> Action)
 
 	Action->SetActionState(RunnerAction::State::Running);
 
+	ZEN_DEBUG("Local runner: action LSN {} -> PID {}", Action->ActionLsn, ProcessInformation.dwProcessId);
+
 	return SubmitResult{.IsAccepted = true};
 }
 
@@ -294,6 +336,11 @@ WindowsProcessRunner::SweepRunningActions()
 
 			if (IsSuccess && ExitCode != STILL_ACTIVE)
 			{
+				ZEN_DEBUG("Local runner: action LSN {} + PID {} exited with code " ZEN_BRIGHT_WHITE("{}"),
+						  Running->Action->ActionLsn,
+						  Running->Pid,
+						  ExitCode);
+
 				CloseHandle(Running->ProcessHandle);
 				Running->ProcessHandle = INVALID_HANDLE_VALUE;
 				Running->ExitCode	   = ExitCode;