Main loop now calls a single helper for cont/suspend/Ctrl-Z
state instead of inlining the signal-handling block. Comment blocks in
profanity.c / editor.c / inputwin.c shortened to trailing form.
The SIGUSR1 -> editor_emergency_kill wiring was a contrived escape
hatch. A console user with a stuck editor reaches for kill / pkill /
SIGKILL on the editor, not undocumented signals on the chat client.
editor_emergency_kill() stays for the internal Ctrl-Z abort path.
ncurses didn't know the editor clobbered the physical screen, so the
first refresh after vim exit was a no-op diff. Stale frame stayed
visible until the next keystroke triggered readline redisplay.
Replaces the SIGTSTP=SIG_IGN inheritance approach (was commit 8) with a
detect-and-abort design that matches user expectation: Ctrl-Z inside
the editor brings you back to profanity instead of leaving the session
suspended.
- src/tools/editor.c: SIGTSTP reset back to SIG_DFL in the child so
vim's :stop / Ctrl-Z actually stop the editor (revert previous
SIG_IGN inheritance).
- src/tools/editor.c: new editor_check_stopped() — non-reaping waitpid
poll for WIFSTOPPED. Lets prof_run detect Ctrl-Z / :stop / gdb-attach
on the editor child.
- src/tools/editor.c: editor_emergency_kill() now sends SIGCONT before
SIGTERM so the abort works on a STOPPED child too.
- src/tools/editor.c: _editor_exit_cb handles WIFSIGNALED cleanly with
"Editor session cancelled." instead of printing garbage via
WEXITSTATUS on a signaled child.
- src/profanity.c: SIGTSTP / SIGCONT signal handlers set flags consumed
by the main loop. Editor STOPPED -> editor_emergency_kill (returns to
the chat with the pre-alt+c readline buffer intact). Plain Ctrl-Z
with no editor -> mutt-style drop the process group to the shell.
SIGCONT -> refresh curses with clearok + ui_resize. While editor is
active, swallow suspend_requested (race: vim's kill(0,SIGTSTP) beats
waitpid seeing STOPPED — next poll catches it).
- src/tools/editor.h: declare editor_check_stopped and editor_is_active.
Verbose comment blocks across the branch tightened to one to two lines.
Upstream's "guard terminal writes while suspended" fix and commit 2 of
this branch both work by sprinkling `if (!isendwin())` (or
`!is_suspended && !isendwin()`) guards around every doupdate() reachable
during a suspended session. That keeps isendwin() a valid signal but
turns the no-stray-write invariant into a whitelist: every new
doupdate / refresh / wrefresh added later in src/ has to remember the
guard, and the original bug class came from exactly such an oversight
in _inp_write.
Introduce a single primitive, prof_doupdate(), that flushes only when
not suspended (via the existing _ui_redraw_suspended() helper). Replace
every direct doupdate() in src/ui/inputwin.c (inp_get_line,
inp_get_password, _inp_write) and the trailing doupdate in ui_update
with the wrapper, collapsing their inline guards. ui_suspend() now
flushes via prof_doupdate() before flipping ui_suspended, so upstream's
pre-endwin flush is preserved.
The flag-based gate in ui_update / ui_resize / ui_redraw is kept as
belt-and-suspenders: even if a future raw doupdate slips in elsewhere,
ui_update has not been refreshing the virtual screen, so the blit finds
stale content rather than a fresh status-bar clock or chat line.
The async editor rewrite (g_child_watch + ui_suspend / ui_resume) lost
the editor_task.active check the old pthread implementation had at the
top of get_message_from_editor_async. With the guard gone, a second
launch_editor call while the first session is in flight would call
ui_suspend a second time, fork another editor, and register a second
child watch; whichever child exits first runs ui_resume and clears
suspension while the other still owns the terminal. Triggering this
needs a code path other than the main-loop alt+c / /editor (those can't
fire while the main loop is parked in the suspended iteration), so the
realistic source is a plugin firing launch_editor from a
g_main_context_iteration dispatch.
Restore an explicit editor_active static in src/tools/editor.c: check it
at the start of launch_editor (bail with a console error), set it just
before ui_suspend, and clear it on the fork-error path and at the start
of _editor_exit_cb. Keeps the same simple semantics the pre-merge code
had, without exposing a new ui.h API.
inp_get_line() / inp_get_password() loop `while (!x) { inp_readline();
ui_update(); }` with no g_main_context_iteration call. If such a prompt
is raised from a network handler during an editor session — realistic
triggers are TLS-cert verification on a reconnect (sv_ev_certfail ->
ui_get_line() in src/event/server_events.c) and PGP passphrase on an
incoming encrypted message (ui_ask_pgp_passphrase() in src/pgp/gpg.c) —
the main thread is parked in this loop. inp_readline returns NULL
(suspended), ui_update returns (ui_suspended), and the editor child
watch never dispatches because the main loop never reaches its own
g_main_context_iteration. is_suspended stays TRUE forever, the loop
never receives input, and the app deadlocks until killed externally.
Run the GLib iteration inside the loop body so the child watch can
dispatch, _editor_exit_cb fires, ui_resume clears suspension, and the
next inp_readline reads from the terminal — letting the user answer the
deferred prompt once the editor is closed.
The normal path of inp_readline unlocks the global `lock` around
select(), giving worker threads (http_upload / http_download / ai_client
in src/tools and src/ai) a window to acquire it and update the UI.
The suspend branch (entered while an external editor is active) used to
g_usleep(100000) and return NULL while holding the lock, so the main
thread monopolised it for the whole editor session and every in-flight
transfer froze; on a long composition (the customer's main /editor use
case) this could be long enough for server-side timeouts to fire.
Mirror the normal-path unlock / sleep / lock pattern so the same window
exists during the editor session. Workers in the suspended state print
through wnoutrefresh paths only (no direct doupdate / refresh / wrefresh
in src outside core.c / inputwin.c, all of which are already guarded
against suspended writes), so opening the window introduces no new race.
Builds on the upstream "guard terminal writes while suspended" fix. That
fix keeps isendwin() a valid "suspended" signal by guarding stray writes
(_inp_write, beep, flash) so the existing isendwin() checks in
ui_update/ui_resize/ui_redraw hold. That is correct but fail-open: any
future unguarded doupdate()/refresh() reachable during an editor session
clears isendwin() and the ~10Hz ui_update() repaints over the editor
again (the original bug class).
Track suspension explicitly with a ui_suspended flag set in
ui_suspend()/ui_resume() and gate the three redraw entry points on
ui_suspended || isendwin() via _ui_redraw_suspended(). The flag is set
exactly at the suspend/resume boundary, so the dominant repaint path
fails safe regardless of isendwin() flapping. isendwin() is kept in the
condition for the shutdown/closed-screen case.
inp_get_line()/inp_get_password() issued an unconditional doupdate()
before their input loop. If such a prompt is raised while an external
editor is active (e.g. a reconnect password or TLS-cert prompt arriving
via session_process_events), that doupdate() writes over the editor.
Guard it with is_suspended || isendwin(), matching the inp_readline()
guard, so it fails safe even if a stray write later clears isendwin().
This closes the one suspended-write path the upstream fix left open.
