CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-14 00:49:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(codex-probe): bash-native watchdog when no timeout binary exists; negative-cache the deterministic model 400

Browse Source 
Stock macOS ships neither coreutils gtimeout nor timeout(1); the wrapper's
fallback ran the command unwrapped, so a hung codex exec blocked the probe
and the calling workflow indefinitely. The fallback now backgrounds the
command, TERMs it at the deadline, and mirrors timeout(1)'s exit-124
contract — with the watchdog's stdout detached so an early finish never
blocks a caller's $(...) capture on the orphaned sleep.

MODEL_UNUSABLE is now negative-cached for 15 minutes (same exit-1 + hints
from cache). The deterministic 400 is config-driven, so re-probing every
preflight charged the affected user a 30s round trip plus real tokens per
review section, forever. Editing config.toml — the fix — changes the cache
signature and re-probes immediately; MODEL_PROBE_INCONCLUSIVE stays uncached.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-08-16 13:32:56 -07:00
co-authored by Claude Fable 5
parent c10a9736b8
commit 998aeb835f
3 changed files with 99 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/codex-hardening.test.ts
+23
View File
@@ -287,6 +287,29 @@ describe('gstack-codex-probe: timeout wrapper + namespace hygiene', () => {
}
});
test('bash-native watchdog kills a hung command at the deadline (exit 124, no timeout binary)', () => {
// Stock macOS ships neither gtimeout nor timeout(1) — the old fallback ran
// the command unwrapped, so a hung `codex exec` blocked the calling
// workflow forever. Force the fallback everywhere (Linux /bin has timeout
// via usrmerge) with a PATH holding ONLY bash and sleep, then prove a
// 30s sleep dies at the 1s deadline with timeout(1)'s exit code. The
// runProbe 5s spawnSync cap doubles as the "actually killed fast" bound.
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-watchdog-'));
try {
const which = (tool: string) =>
spawnSync('bash', ['-c', `command -v ${tool}`]).stdout.toString().trim() || `/bin/${tool}`;
fs.symlinkSync(which('bash'), path.join(dir, 'bash'));
fs.symlinkSync(which('sleep'), path.join(dir, 'sleep'));
const r = runProbe({
snippet: `_gstack_codex_timeout_wrapper 1 sleep 30; echo "rc=$?"`,
env: { PATH: dir },
});
expect(r.stdout).toContain('rc=124');
} finally {
fs.rmSync(dir, { recursive: true, force: true });
}
});
test('sourcing probe does NOT set errexit/trap/IFS in caller shell (namespace hygiene)', () => {
// Capture `set -o` output before and after sourcing. Any drift means the
// probe polluted the caller.