ipc: add windows support #32387

Previously ipc_test.cpp contained tests which depended on
libmultiprocess and ipc_tests.cpp contained tests which didn't.
Separation was needed because libmultiprocess tests need to be built
with additional include and link paths, and cmake only has good support
for setting these on libraries, not source files. The separation also
allowed the add_boost_test custom cmake function to work with no changes,
because it could find the boost test registration in ipc_tests.cpp, and
then ipc_tests.cpp would run the tests in ipc_test.cpp without them
needing to be registered in boost.

But with windows support being added, the parse address test can't
easily avoid a dependecy on libmultiprocess, because it depends on the
ipc/process.h header, and ipc/process.h header will now need
platform-specific ProcessId and SocketId types defined by
libmultiprocess, rather than plain ints.

With all ipc tests depending on libmultiprocess, there is not really a
rationale for having separate test files anymore, so this change
combines them, and move the cmake add_boost_test function definition so
it can be used instead of target_sources to register ipc_tests.cpp with
ctest.

The change prevents CI errors from including ipc/process.h in
ipc_tests.cpp:

In file included from /Users/runner/work/bitcoin/bitcoin/repo_archive/src/ipc/test/ipc_tests.cpp:5:
In file included from /Users/runner/work/bitcoin/bitcoin/repo_archive/src/ipc/process.h:11:
/Users/runner/work/bitcoin/bitcoin/repo_archive/src/ipc/util.h:14:10: fatal error: 'kj/debug.h' file not found
   14 | #include <kj/debug.h>

https://github.com/bitcoin/bitcoin/actions/runs/24465865499/job/71492617687?pr=35084

Pass exe_name parameter to ipc::Protocol class constructor instead. It never
really made sense to have exe parameters as part of the protocol interface and
removing them makes adding new features like windows support easier.

The exe name values are only used for logging and debuggging purposes to
distinguish log messages from different processes.

This just changes Protocol class field order to make sure class members are not
destroyed before the event loop thread exits. There is no change in behavior.
The change is just being made to clarify intent and avoid potential bugs.

Avoid hardcoded forward slashes is ParseAddress test, use native path
separators instead.

Keep standard headers separate from posix headers

Use ProcessId type instead of int to represent process ids to be
compatible with an upcoming version of libmultiprocess which adds
windows support.

Use SocketId type instead of int to represent socket ids to be
compatible with an upcoming version of libmultiprocess which adds
windows support.

Use ConnectInfo type instead of int to represent socket ids that are
passed between processes, to be compatible with an upcoming version of
libmultiprocess which adds windows support.

Use Stream type to abstract socket ids and be compatible with updated
mp::ConnectStream() and mp::ServeStream() functions that use streams
instead of socket ids in an upcoming version of libmultiprocess which
adds windows support.

Since creating Stream objects from socket ids can require the event loop
to be running, the ipc::Protocol::serve() method is also updated to
accept the server stream though a callback parameter instead of a normal
parameter.

Add ProcessId = int type alias and apply it to WaitProcess, SpawnProcess
(pid output argument), and callers.

Add SocketId = int and SocketError = -1 type aliases and apply SocketId
to SpawnProcess (return type and callback parameter) and callers.

Add ConnectInfo type alias to pass socket handle from parent process to
child process in more platform independent way.

gen.cpp used fork() directly via <unistd.h> to invoke the capnp compiler as a
subprocess, but fork() is not available on Windows, so shouldn't be used in
application code.

Add an ExecProcess(const std::vector<std::string>& args) function to
util.h/util.cpp that spawns a process and returns its ProcessId, leaving
the caller responsible for WaitProcess. On POSIX it uses fork() (via
KJ_SYSCALL) + execvp; on Windows it can use CreateProcess.

Update gen.cpp to replace the inline fork/exec/wait with
mp::WaitProcess(mp::ExecProcess(args)).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Replace the m_wait_fd/m_post_fd raw int members with
m_wait_stream/m_post_stream kj::Own<kj::AsyncIoStream> and
m_post_writer kj::Own<kj::OutputStream>.

The constructor uses provider->newTwoWayPipe() instead of calling
socketpair() directly. The loop() and post() methods write through
m_post_writer instead of calling write() with a raw fd, and
EventLoopRef::reset does the same.

kj::AsyncIoStream::getFd() was added in capnproto 0.9 (commit
d27bfb8a4175b32b783de68d93dd1dbafadddea5, first released in 0.9.0). The
code now uses getFd() in proxy.cpp, so 0.7 is no longer a sufficient
minimum.

Set olddeps version to 0.9.2, which is the patched 0.9.x release for
CVE-2022-46149.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Extract socket pair creation from SpawnProcess into a standalone
SocketPair() function, and use it to replace the inline socketpair()
call. No behavior change.

Explicitly clear FD_CLOEXEC on the child's socket before calling exec,
so the fd survives into the spawned process regardless of how the socket
was created. Previously this relied on socketpair() not setting
FD_CLOEXEC by default, which is not guaranteed if the caller creates
sockets with SOCK_CLOEXEC or if the flag gets set by other means.

Instead of accepting raw file descriptor integers and wrapping them
internally, ConnectStream and ServeStream now accept
kj::Own<kj::AsyncIoStream> directly. This removes the assumption that
the transport is always a local unix fd, making the API easier to adapt
to other I/O types (e.g. Windows handles).

The Stream type alias (kj::Own<kj::AsyncIoStream>) is added as a
convenience, along with StreamSocketId() to extract the underlying fd
from a Stream when needed.

Callers are updated to wrap their fd with wrapSocketFd() before calling.

Flush pending Cap'n Proto release messages before closing the stream.
When one side of a socket pair closes, the other side does not receive
an onDisconnect event, so it relies on receiving release messages from
the closing side to free its ProxyServer objects and shut down cleanly.
Without this, Server objects are not freed by Cap'n Proto on
disconnection.

Add Windows-specific code to support building and running on Windows:

- util.h: Guard ProcessId/SocketId/SocketError type aliases with WIN32
  ifdefs so they use SOCKET/uintptr_t on Windows and int on Unix.
  Add winsock2.h include on Windows.
- util.cpp: Guard Unix-specific system headers with WIN32 ifdefs. Add
  Windows-specific includes (windows.h, winsock2.h). Guard MaxFd() with
  #ifndef WIN32. Add GetCurrentThreadId() branch in ThreadName(). Add
  win32Socketpair() forward-declare. Add Windows branch in SocketPair()
  using win32Socketpair(). Add CommandLineFromArgv() helper needed to
  construct CreateProcess command lines. Add Windows branch in
  SpawnProcess() using named pipes and WSADuplicateSocket to pass socket
  to child. Add Windows branch in StartSpawned() reading socket from
  named pipe. Add Windows branch in WaitProcess() using
  WaitForSingleObject/GetExitCodeProcess.
- proxy-io.h: Add Windows branch in StreamSocketId() using
  getWin32Handle().
- proxy.cpp: Add SocketOutputStream class on Windows (analogous to
  FdOutputStream but using SOCKET/send()). Add Windows branch in
  EventLoop constructor to create m_post_writer using SocketOutputStream.

Remove POSIX and pthread calls from util.cpp to avoid relying on MinGW's POSIX
compatibility layer. This lets code be compiled with MSVC.

MSVC error when building multiprocess.vcxproj:

  mp/util.h(146,46): error C2280:
    'std::variant<T *,T>::variant(const std::variant<T *,T> &)':
    attempting to reference a deleted function [with T=mp::Lock]

The PtrOrValue constructor used a ternary expression to initialize data:

  data(ptr ? ptr : std::variant<T*, T>{std::in_place_type<T>, args...})

Both arms are prvalues of type std::variant<T*,T>, so under C++17's
mandatory copy elision no copy/move constructor should be invoked. GCC
and Clang apply this correctly. MSVC does not apply guaranteed copy
elision to ternary expressions in this context: it materializes the
temporary and then attempts to copy-construct data from it. Since
std::variant<Lock*,Lock> has a deleted copy constructor (Lock holds a
std::unique_lock which is move-only), MSVC fails.

Fix by initializing data to hold T*=ptr in the member initializer list,
then emplacing T in-place in the constructor body if ptr is null. This
avoids the ternary entirely and requires only the in-place constructor
of T, not any variant copy or move.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

This repo has introduced API changes to add Windows support to
libmultiprocess (HANDLE-based IPC alongside the existing fd-based IPC).
These changes require corresponding updates to Bitcoin Core, which are
pending in bitcoin/bitcoin#35084. Until that PR merges, the Bitcoin Core
CI jobs fail against master because Bitcoin Core has not yet been updated
to use the new API.

Switch the Bitcoin Core checkout in both jobs to use
refs/pull/35084/merge so CI tests against the compatible version. A
BITCOIN_CORE_REF env var is introduced at the top of the file; once
(and keep the var in place for any future API compatibility cycles).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

On macOS, when libcapnp is built as a dynamic library and Bitcoin Core
REDUCE_EXPORT option is used the RTTI typeinfo for kj::Exception has a
different address in libcapnp.dylib versus the calling binary. This
means catch (const kj::Exception& e) in the calling binary silently
fails to match exceptions thrown by capnp, so the DISCONNECTED exception
from shutdownWrite() propagates as a fatal uncaught exception instead of
being suppressed as intended.

This causes the Bitcoin Core macOS native CI job to fail with:
  Fatal uncaught kj::Exception: kj/async-io-unix.c++:491: disconnected:
    shutdown(fd, SHUT_WR): Socket is not connected

The fix is to use kj::runCatchingExceptions/kj::throwRecoverableException,
which use KJ's own thread-level exception interception mechanism rather
than C++ RTTI-based matching, and therefore work correctly across dynamic
library boundaries. This is the same approach used elsewhere in the
codebase (proxy.cpp EventLoop::post, type-context.h server request handler)
for the same reason.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

On MSVC, std::terminate() does not print the exception message before
calling abort()/fastfail, so exceptions thrown during mpgen execution
appear as a bare 0xC0000409 exit code with no diagnostic output. Wrap
main() in a try-catch to explicitly print the error to stderr and
return 1 instead of crashing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Bitcoin Core linter rejects it:
https://github.com/bitcoin/bitcoin/actions/runs/24568789956/job/71835997334?pr=32387

Use target_compile_definitions on mpgen to expose CAPNP_EXECUTABLE,
CAPNPC_CXX_EXECUTABLE (via $<TARGET_FILE:...> generator expressions on
the CapnProto::capnp_tool and CapnProto::capnpc_cpp imported targets),
and CAPNP_INCLUDE_DIRS (from the CAPNP_INCLUDE_DIRS variable set by
find_package). gen.cpp uses these directly instead of constructing paths
from capnp_PREFIX. Remove capnp_PREFIX from config.h.in as it is no
longer needed there. Add compat fallbacks in compat_config.cmake to
synthesize the tool imported targets and CAPNP_INCLUDE_DIRS from older
variables when using an older CapnProto package.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Various small fixes for making ENABLE_IPC build work on windows.

On Windows, _wexecvp (like all _exec* variants in the MSVC CRT) works by
calling CreateProcess to start the child, then immediately calling
ExitProcess(0) on the parent. Unlike POSIX execvp, which replaces the
current process image so the parent's PID becomes the child, this means
the child is orphaned from the original caller's perspective: the shell
or test framework waiting on bitcoin.exe sees it exit with code 0 while
bitcoind.exe continues running in the background independently.

This breaks functional tests that invoke bitcoin.exe as a wrapper (e.g.
`bitcoin node -regtest`) because the test process has no way to wait for
the node to stop or retrieve its exit code.

Fix by switching to _wspawnvp(_P_WAIT, ...), which spawns the child and
blocks until it exits, then calling _exit() with the child's exit code.
From the caller's perspective ExecVp still never returns on success (the
parent process exits inside it), so call sites don't need to change. On
error the existing errno / -1 return convention is preserved.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Now that util::ExecVp on Windows uses _wspawnvp(_P_WAIT) instead of
_wexecvp, the bitcoin wrapper process blocks until the child exits and
Python can capture its stdout/stderr and exit code normally. Remove the
Windows skip added in #33229.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add a helper function that generates a target-specific resource file from a
template and links it along with an application manifest, replacing the static
per-binary *-res.rc files previously used by non-GUI executables and the
bitcoin-qt-res.rc previously used by GUI executables.

The new add_windows_exe_resources(target description [ICON_DIR dir]) function
in AddWindowsResources.cmake handles both GUI and non-GUI executables through a
single cmake/windows-res.rc.in template. When ICON_DIR is provided, the
function prepends icon declarations to the generated RC file and sets
ProductName to the project name, matching the previous GUI-specific behavior.

Also adds the missing add_windows_exe_resources() call for bitcoin-node, which
previously had no resource section and caused the Windows CI manifest
validation check (mt.exe -validate_manifest) to fail.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Remove -DENABLE_IPC=OFF from both win64 cross-build environment files
and install pycapnp in the Windows cross-build test runner. The
depends/ system already builds capnp for the MinGW target (NO_IPC is
not set), so cmake will find it via the toolchain file. This lets
interface_ipc.py and related tests run in the "Windows, test
cross-built" CI jobs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add an "ipc" feature to vcpkg.json with capnproto as a dependency and
include it in default-features, so the Windows native VS CI job installs
capnproto when ENABLE_IPC is ON (the default). The fuzz build already
uses VCPKG_MANIFEST_NO_DEFAULT_FEATURES=ON, so it is unaffected.

Also install pycapnp in ci-windows.py alongside pyzmq so the IPC
functional tests (interface_ipc.py) have their required Python library,
matching what every other CI platform already does.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

WARNING: DO NOT MERGE — this draft PR modifies the libmultiprocess
subtree directly (intentionally, for testing purposes) which causes
the subtree link check to fail. Disabling the check here to avoid
masking unrelated lint failures while the PR is open for testing.

Restore the omitted entry before any merge attempt.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>