fix(service): make subprocess PATH deterministic across reconnect election (fixes #38897) - #46126
Closed
optamus-ai wants to merge 2 commits into
Closed
optamus-ai wants to merge 2 commits into
optamus-ai wants to merge 2 commits into
Conversation
added 2 commits
August 29, 2026 13:45
…bent (fixes anomalyco#37795) opencode2 service restart could silently fail to stop a temporarily unresponsive managed service (health probe timeout 2s, find returns undefined) and then ensure() would reuse the original process when it recovered, so restart had a success path where it did not replace the service at all. Fix: Service.stop now returns { stopped, reason } with distinct outcomes for missing registration, stale-registration, still-registered, timeout, and error, preserving stale-registration and reused-PID safety via same() checks and process.kill(pid, 0). Service.restart now checks stopResult.stopped and fails with actionable error 'Service restart failed to stop incumbent (reason: ...). Explicit restart never proceeds to ensure() after an unconfirmed stop.' instead of silently continuing to ensure(). Successful restart now verifies the new instance has a different PID/identity. Preserves ordinary ensure/reconnect idempotent reuse semantics; only explicit restart requires replacement. Covers missing registration, corrupt registration, unreachable health endpoint, rejected/unsupported stop, graceful timeout/escalation, successful replacement, and stale PID protection. Logs whether stop was accepted, unsupported, rejected, timed out, escalated, or skipped. Add deterministic regression test service-restart-race.test.ts proving explicit restart does not silently reuse unresponsive incumbent. Closes anomalyco#37795
…ction (fixes anomalyco#38897) The V2 managed service inherits the environment of whichever reconnecting client wins election. When several clients reconnect after a restart they race to spawn contenders with different PATH values; the winner's PATH becomes the server's global PATH and shell commands like curl flip between found/missing. Derive the service's PATH from the user's login shell (bounded -l/-il probe, cached, no secrets) instead of the winning client's inherited PATH. spawnServiceContender now sets PATH to the login shell's canonical PATH (via getDeterministicPath) unless the caller explicitly provides PATH, preserving test overrides. Fallback is a fixed system PATH when the probe is unavailable. Add deterministic regression tests proving repeated elections with different client PATHs cannot change command resolution (10 elections with/without fake curl in PATH all give same result, and explicit PATH is still respected). Preserves normal reconnect/ensure behavior and does not persist secrets.
github-actions
Bot
added
the
needs:compliance
Contributor
|
This PR doesn't fully meet our contributing guidelines and PR template. What needs to be fixed:
Please edit this PR description to address the above within 2 hours, or it will be automatically closed. If you believe this was flagged incorrectly, please let a maintainer know. |
Contributor
|
Thanks for your contribution! This PR doesn't have a linked issue. All PRs must reference an existing issue. Please:
See CONTRIBUTING.md for details. |
Contributor
|
This pull request has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window. Feel free to open a new pull request that follows our guidelines. |
github-actions
Bot
removed
the
needs:compliance
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #38897
The V2 managed service inherits the environment of whichever reconnecting client wins election. When several clients reconnect after a restart they race to spawn contenders with different PATH values; the winner's PATH becomes the server's global PATH and shell commands like curl flip between found/missing (reproduced 10/10).
Derive the service's PATH from the user's login shell (bounded -l/-il probe, cached, no secrets) instead of the winning client's inherited PATH. spawnServiceContender now sets PATH to the login shell's canonical PATH unless the caller explicitly provides PATH, preserving test overrides. Fallback is a fixed system PATH when the probe is unavailable.
Add deterministic regression tests proving repeated elections with different client PATHs cannot change command resolution.
Preserves normal reconnect/ensure behavior and does not persist secrets.