[ashwind-nvidia]

Summary

With the MXC driver built into the gateway, hard-killing the gateway left its sandbox processes running with no owner, and they kept the gateway's listening socket open so a new gateway could not bind the port. The gateway now puts itself in a kill-on-close job object so every sandbox process ends with it, and its listening sockets are no longer inheritable, so no child can keep the port bound.

Related Issue

Closes #5298

Changes

• Add openshell_gateway::process_lifetime::kill_children_on_exit(), called first in the gateway's main. It puts the process in a job object with JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE; every sandbox process joins it and Windows ends them when the gateway exits for any reason. If the job cannot be created, a warning is printed and the gateway continues. It does nothing on other platforms.
• Clear the inherit flag on the gateway, health and metrics listening sockets right after bind (disable_handle_inheritance). mio 1.2.0 creates Windows sockets with plain socket(), which leaves the handle inheritable, and children are started with handle inheritance enabled.
• Add the windows crate as a Windows-only dependency of openshell-server and openshell-gateway (Cargo.lock updated).
• Two unit tests for the listener (not inheritable, still accepts connections) and one for the job object (the process is in a kill-on-close job).

Behavior change: sandboxes now end when the gateway process exits, including a normal restart. Before, they were left running without an owner.

Testing

• Checks appropriate to the affected code and behavior pass.
• Unit tests added: gateway_listener::tests (2) and process_lifetime::tests (1) pass on Windows x64; the server tests that ran alongside (4) pass.
• Native reproduction on Windows 11 x64 with three running sandboxes. Before: hard-killing the gateway left 9 processes (3 each of wxc-exec, openshell-supervisor, openshell-windows-sandbox), the port could not be bound, and a new gateway failed with os error 10048, in 5 of 5 runs. After: no process survived, the port could be bound and a new gateway started in 3 of 3 runs on the final build, and in 5 of 5 runs on an earlier build that differed only by two lint-driven edits.
• Each change on its own, using a temporary test build with switches that turned the other off (not committed): the job object alone leaves no survivors and a free port (2 of 2 runs); the non-inheritable listener alone leaves the processes running but the port free (2 of 2 runs).
• Existing MXC end-to-end scenarios (run-mxc-e2e.ps1): 6 of 7 pass with and without the change; host-service fails in both, so it is not caused by this change. The runner's port probe did not detect the listening gateway on this host, so a scratch copy with a loopback connect probe was used; the repository copy was not modified.
• cargo fmt --all -- --check passes. cargo clippy with the CI flags reports 322 diagnostics (319 large future) both with and without this change and none in the changed files. cargo check --locked and cargo clippy --locked --all-targets -D warnings pass for openshell-gateway and openshell-server on Linux (Rust 1.95.0).

Not tested: ARM64, a graceful gateway shutdown, and the full workspace test suite.

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Architecture docs updated (if applicable): no architecture change.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[ashwind-nvidia]

I have read the DCO document and I hereby sign the DCO.