An app that runs without a cell stops with everything it started, and leaves no child running once it has gone #63

Merged

grokbot merged 1 commit from grokbot/forge:fix/app-stop-whole-tree into main 2026-10-18 14:54:30 +00:00

Conversation 0 Commits 1 Files changed 3 +148 -3

grokbot commented 2026-10-18 14:31:10 +00:00

Owner

Copy link

Where the host cannot hold a cell, an app ran as a plain child in the
forge's own process group, and stop() signalled its pid alone. A child
it had started (a worker, bun run's script, a sleep) was re-parented
and kept running on the environment's data and token after the forge
called it stopped; one that outlived a crash ran beside the restart.

The app now leads a process group of its own (detached, without a
cell only), stop() asks and then kills the group, and once the app has
exited, however it went, what is left of the group is killed. A cell is
unchanged: its tree is bubblewrap's.

Since a terminal's hangup no longer reaches those apps directly, the
forge takes SIGHUP the way it takes Ctrl-C: it drains and stops them.

test/apps-stop-tree.test.ts: red on main (3 of 3), green here.

Regression test

test/apps-stop-tree.test.ts (3 tests: a stop ends the app's children; a child that ignores SIGTERM is killed once the app has gone; an app that dies on its own takes its children with it). Pinned bun 1.3.14:

• origin/main dc68048e source + this test: 0 pass, 3 fail (each child still alive 3 s after the stop/exit)
• this branch: 3 pass, 0 fail

Also on the box, CI-shaped PATH (no bwrap, so every app runs uncelled — the path this changes): all 24 gated test/apps*.test.ts + app.test.ts + standing-every-process.test.ts: 212 pass, 0 fail.

SIGHUP: the forge started in a pty, the pty then killed: this branch logs forge draining … why=SIGHUP and exits; main dies on the hangup without draining.

Security

Process control. The group signal is only ever -proc.pid of a group this spawn just made the app lead (detached, i.e. setsid), never the forge's own group, and a cell's spawn is unchanged. Linux keeps a pid from reuse while it is any live process's pgid, so the kill after exit reaches only what is left of the app's group, or nothing (ESRCH, ignored). What it closes: an app's children outliving a stop or a crash, still running on the environment's data dir and forge token after the forge recorded it stopped (or its token revoked) — and beside its restart. An app that calls setsid itself still escapes, as before; a cell is the containment for that.

Validation

pipeline/validate on 077b8561: baseline in 595s — bun 1.3.14, CI-shaped env (scrubbed vars, runner PATH), exact check.yml shard + forge.json commands.

step	result	time
bun install --frozen-lockfile	ok (exit 0)	0s
forge.json check.fast	BASELINE (exit 1)	121s
check.yml gate (1) pull_request	BASELINE (exit 1)	14s
check.yml gate (2) pull_request	ok (exit 0)	270s
check.yml gate (3) pull_request	ok (exit 0)	190s

• ⚠️ node v20.19.2 here, v22 on CI (tsc runs under node)
• ⚠️ check.yml gate (1) pull_request stopped early at a BASELINE failure (fail-fast): its later files were not run in this step

test output (failures, totals)

▶ bun install --frozen-lockfile
  ok  exit 0  0s
▶ forge.json check.fast
(fail) egress, reported: an undeclared public host goes through and is counted; a private one never does > an undeclared public host is let through and counted [1.24ms] [shard 10]
Ran 2986 tests across 296 files in 106.7s; 1 failed.
classify: reran test/contain.test.ts test/usage.test.ts test/web-code.test.ts  alone on origin/main dc68048e and on this branch
  BASELINE  exit 1  121s
▶ check.yml gate (1) pull_request
(fail) egress, reported: an undeclared public host goes through and is counted; a private one never does > an undeclared public host is let through and counted [3.03ms] [shard 3]
Ran 112 tests across 3 files in 14.2s; 1 failed.
classify: reran test/contain.test.ts  alone on origin/main dc68048e and on this branch
  BASELINE  exit 1  14s
▶ check.yml gate (2) pull_request
Ran 1334 tests across 136 files in 269.3s (136 shards).
  ok  exit 0  270s
▶ check.yml gate (3) pull_request
Ran 1501 tests across 136 files in 190.4s (136 shards).
  ok  exit 0  190s

Where the host cannot hold a cell, an app ran as a plain child in the forge's own process group, and stop() signalled its pid alone. A child it had started (a worker, `bun run`'s script, a `sleep`) was re-parented and kept running on the environment's data and token after the forge called it stopped; one that outlived a crash ran beside the restart. The app now leads a process group of its own (`detached`, without a cell only), stop() asks and then kills the group, and once the app has exited, however it went, what is left of the group is killed. A cell is unchanged: its tree is bubblewrap's. Since a terminal's hangup no longer reaches those apps directly, the forge takes SIGHUP the way it takes Ctrl-C: it drains and stops them. test/apps-stop-tree.test.ts: red on main (3 of 3), green here. ### Regression test `test/apps-stop-tree.test.ts` (3 tests: a stop ends the app's children; a child that ignores SIGTERM is killed once the app has gone; an app that dies on its own takes its children with it). Pinned bun 1.3.14: - origin/main `dc68048e` source + this test: **0 pass, 3 fail** (each child still alive 3 s after the stop/exit) - this branch: **3 pass, 0 fail** Also on the box, CI-shaped PATH (no bwrap, so every app runs uncelled — the path this changes): all 24 gated `test/apps*.test.ts` + `app.test.ts` + `standing-every-process.test.ts`: 212 pass, 0 fail. SIGHUP: the forge started in a pty, the pty then killed: this branch logs `forge draining … why=SIGHUP` and exits; main dies on the hangup without draining. ### Security Process control. The group signal is only ever `-proc.pid` of a group this spawn just made the app lead (`detached`, i.e. setsid), never the forge's own group, and a cell's spawn is unchanged. Linux keeps a pid from reuse while it is any live process's pgid, so the kill after exit reaches only what is left of the app's group, or nothing (ESRCH, ignored). What it closes: an app's children outliving a stop or a crash, still running on the environment's data dir and forge token after the forge recorded it stopped (or its token revoked) — and beside its restart. An app that calls setsid itself still escapes, as before; a cell is the containment for that. <!-- pipeline:validation --> ### Validation `pipeline/validate` on `077b8561`: **baseline** in 595s — bun 1.3.14, CI-shaped env (scrubbed vars, runner PATH), exact check.yml shard + forge.json commands. | step | result | time | |---|---|---| | `bun install --frozen-lockfile` | ok (exit 0) | 0s | | `forge.json check.fast` | BASELINE (exit 1) | 121s | | `check.yml gate (1) pull_request` | BASELINE (exit 1) | 14s | | `check.yml gate (2) pull_request` | ok (exit 0) | 270s | | `check.yml gate (3) pull_request` | ok (exit 0) | 190s | - ⚠️ node v20.19.2 here, v22 on CI (tsc runs under node) - ⚠️ check.yml gate (1) pull_request stopped early at a BASELINE failure (fail-fast): its later files were not run in this step <details><summary>test output (failures, totals)</summary> ``` ▶ bun install --frozen-lockfile ok exit 0 0s ▶ forge.json check.fast (fail) egress, reported: an undeclared public host goes through and is counted; a private one never does > an undeclared public host is let through and counted [1.24ms] [shard 10] Ran 2986 tests across 296 files in 106.7s; 1 failed. classify: reran test/contain.test.ts test/usage.test.ts test/web-code.test.ts alone on origin/main dc68048e and on this branch BASELINE exit 1 121s ▶ check.yml gate (1) pull_request (fail) egress, reported: an undeclared public host goes through and is counted; a private one never does > an undeclared public host is let through and counted [3.03ms] [shard 3] Ran 112 tests across 3 files in 14.2s; 1 failed. classify: reran test/contain.test.ts alone on origin/main dc68048e and on this branch BASELINE exit 1 14s ▶ check.yml gate (2) pull_request Ran 1334 tests across 136 files in 269.3s (136 shards). ok exit 0 270s ▶ check.yml gate (3) pull_request Ran 1501 tests across 136 files in 190.4s (136 shards). ok exit 0 190s ``` </details>

grokbot added 1 commit 2026-10-18 14:31:11 +00:00

An app that runs without a cell stops with everything it started, and leaves no child running once it has gone ... 077b8561fb

Where the host cannot hold a cell, an app ran as a plain child in the
forge's own process group, and stop() signalled its pid alone. A child
it had started (a worker, `bun run`'s script, a `sleep`) was re-parented
and kept running on the environment's data and token after the forge
called it stopped; one that outlived a crash ran beside the restart.

The app now leads a process group of its own (`detached`, without a
cell only), stop() asks and then kills the group, and once the app has
exited, however it went, what is left of the group is killed. A cell is
unchanged: its tree is bubblewrap's.

Since a terminal's hangup no longer reaches those apps directly, the
forge takes SIGHUP the way it takes Ctrl-C: it drains and stops them.

test/apps-stop-tree.test.ts: red on main (3 of 3), green here.

grokbot merged commit b27bb0c3c2 into main 2026-10-18 14:54:30 +00:00

grokbot referenced this pull request from a commit 2026-10-18 14:54:32 +00:00

Merge pull request 'An app that runs without a cell stops with everything it started, and leaves no child running once it has gone' (#63) from grokbot/forge:fix/app-stop-whole-tree into main

grokbot referenced this pull request 2026-10-18 17:37:06 +00:00

A step that runs without a cell ends with everything it started, on a cancel, a timeout, or its own exit #64

grokbot referenced this pull request from a commit 2026-10-18 18:01:34 +00:00

A step that runs without a cell ends with everything it started, on a cancel, a timeout, or its own exit

grokbot referenced this pull request 2026-10-18 23:30:13 +00:00

An app's terminal that runs without a cell ends with everything it started, on a hangup or its own exit #66

grokbot referenced this pull request from a commit 2026-10-18 23:58:14 +00:00

An app's terminal that runs without a cell ends with everything it started, on a hangup or its own exit

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent-work

Queue this for an agent: it will build it and open a PR

  

agent-working

An agent is actively working on this

  

ultracode

Operators: run a Fable ultracode orchestrator on this issue

No labels

agent-work

agent-working

ultracode

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

trevato-apps/forge!63

No description provided.