Files
browser/openspec/changes/add-scum-source-rcon-transport/specs/run-source-rcon-execution/spec.md
T

27 lines
2.3 KiB
Markdown

## ADDED Requirements
### Requirement: Run executes a frozen Source RCON plan over loopback
Run SHALL execute a `source-rcon` plan only for Windows amd64 and only by dialing `127.0.0.1` at the frozen declared port. It SHALL resolve the plan's generated config through the scoped workspace, read the protected password locally, and use Source RCON authentication and framed command/response packets. It SHALL not accept a browser-provided host, socket, path, or password.
#### Scenario: Valid loopback Source RCON command completes
- **WHEN** Run receives a valid frozen plan and one-time command for a running compatible SCUM server
- **THEN** it authenticates to the local DLL listener, sends the command, consumes the terminal response sentinel, and completes the job with a safe success status.
#### Scenario: Unsafe plan or local configuration is rejected
- **WHEN** a plan is not `source-rcon`, is non-Windows, has an unsafe config key/port, or the local config is missing, non-loopback, or inconsistent with the frozen port
- **THEN** Run fails before opening a socket or sending a command.
### Requirement: Run bounds and redacts Source RCON I/O
Run SHALL bound command bytes, packet sizes, response bytes, response packet count, dialing, authentication, and command execution by the job context. It SHALL classify an RCON error response as a failed job but SHALL NOT persist or return the raw command, password, response body, config contents, or local path in logs, artifacts, progress, or result messages.
#### Scenario: Source RCON error response remains private
- **WHEN** the DLL returns an `error:` response or malformed response framing
- **THEN** Run returns a safe error code/message without exposing the returned body or submitted command.
### Requirement: Source RCON transport is at-most-once
Run SHALL retrieve the command from the active Platform input route once per job and SHALL not retry a command after input, authentication, dial, or response failure. It SHALL not fall back to the placeholder remote adapter, a generic TCP address, `rundll32`, process injection, or a Linux loader.
#### Scenario: Lost one-time input does not replay a command
- **WHEN** Run cannot retrieve a fresh one-time command or loses execution after it was consumed
- **THEN** it fails the job safely and does not send a duplicate command.