Adding runner handshake

crates/ocs_plugin_api/src/ipc/client.rs

@@ -13,7 +13,7 @@ use interprocess::local_socket::{GenericNamespaced, Stream, ToNsName};
 
 use crate::host::{DocumentReader, HostApi, InteractiveCommand, ReaderEntity};
 use crate::ipc::protocol::{
-    HostResponse, HostToPlugin, PluginRequest, PluginResponse, PluginToHost,
+    HostResponse, HostToPlugin, PluginRequest, PluginResponse, PluginToHost, RunnerHandshake,
 };
 use crate::ipc::transport::{recv, send};
 use crate::shm::{DocumentViewInfo, SharedDocumentReader};
@@ -46,6 +46,14 @@ impl IpcClient {
         self.stream.borrow_mut()
     }
 
+    /// Send the initial runner handshake presenting the pre-shared token.
+    pub fn send_handshake(&self, token: &str) -> Result<(), crate::ipc::transport::TransportError> {
+        send(
+            &mut self.stream.borrow_mut(),
+            &RunnerHandshake::Token(token.to_string()),
+        )
+    }
+
     /// Send a plugin request and wait for the matching response. Any nested
     /// host requests that arrive while we are waiting are treated as errors.
     pub fn request(

crates/ocs_plugin_api/src/ipc/protocol.rs

@@ -22,6 +22,20 @@ pub enum InteractiveEvent {
     ObjectPick { handle: Handle, pt: [f64; 3] },
 }
 
+/// Initial handshake sent by the plugin runner immediately after connecting.
+///
+/// The runner proves it was spawned by this host by presenting a pre-shared
+/// token delivered through the `OCS_PLUGIN_TOKEN` environment variable. A
+/// mismatch causes the host to close the connection.
+#[derive(Debug, Serialize, Deserialize)]
+pub enum RunnerHandshake {
+    Token(String),
+}
+
+/// Environment variable through which the host passes the pre-shared
+/// authentication token to the plugin runner child process.
+pub const PLUGIN_TOKEN_ENV: &str = "OCS_PLUGIN_TOKEN";
+
 /// Requests the host sends to the plugin runner.
 #[derive(Debug, Serialize, Deserialize)]
 pub enum HostRequest {