An app's terminal that runs without a cell ends with everything it started, on a hangup or its own exit #66

Merged

grokbot merged 1 commit from grokbot/forge:fix/tty-stop-whole-tree into main

2026-10-18 23:58:13 +00:00

grokbot commented

2026-10-18 23:30:13 +00:00

Owner

Where the host cannot hold a cell (CI, a pod without bwrap), an app's
terminal (ssh <slug>@forge, or t in the forge's terminal UI) ran as
a plain /bin/sh -c child in the forge's own process group, and a
hangup sent SIGHUP to the program's pid alone. What the program had
started (a server it left running, a job sent to the background) was
re-parented and kept running in the deployed checkout, with the
environment's data dir, forge token and secrets, after the terminal had
closed; nothing ever stopped it.

The terminal now leads a process group of its own (detached, without
a cell only), a hangup signals the group, and once the program has
exited, what is left of the group is killed: the pattern #63 and #64
gave apps and steps. The spawn moves into startTerminal, so it is
tested without a deploy. A cell is unchanged: its tree dies with
bubblewrap. signalGroup is exported from apps/process.ts for it.

Validation

pipeline/validate on a97b8e6b: baseline in 594s — bun 1.3.14, CI-shaped env (scrubbed vars, runner PATH), exact check.yml shard + forge.json commands.

step	result	time
`bun install --frozen-lockfile`	ok (exit 0)	0s
`forge.json check.fast`	BASELINE (exit 1)	118s
`check.yml gate (1) pull_request`	BASELINE (exit 1)	14s
`check.yml gate (2) pull_request`	ok (exit 0)	268s
`check.yml gate (3) pull_request`	ok (exit 0)	194s

⚠️ node v20.19.2 here, v22 on CI (tsc runs under node)
⚠️ check.yml gate (1) pull_request stopped early at a BASELINE failure (fail-fast): its later files were not run in this step

test output (failures, totals)

▶ bun install --frozen-lockfile
  ok  exit 0  0s
▶ forge.json check.fast
(fail) egress, reported: an undeclared public host goes through and is counted; a private one never does > an undeclared public host is let through and counted [0.98ms] [shard 10]
Ran 2571 tests across 260 files in 98.8s; 1 failed.
classify: reran test/contain.test.ts test/subscriptions.test.ts test/watches.test.ts  alone on origin/main 5881c081 and on this branch
  BASELINE  exit 1  118s
▶ check.yml gate (1) pull_request
(fail) egress, reported: an undeclared public host goes through and is counted; a private one never does > an undeclared public host is let through and counted [1.40ms] [shard 3]
Ran 113 tests across 3 files in 14.2s; 1 failed.
classify: reran test/contain.test.ts  alone on origin/main 5881c081 and on this branch
  BASELINE  exit 1  14s
▶ check.yml gate (2) pull_request
Ran 1339 tests across 137 files in 267.7s (137 shards).
  ok  exit 0  268s
▶ check.yml gate (3) pull_request
Ran 1502 tests across 137 files in 193.2s (137 shards).
  ok  exit 0  194s

Where the host cannot hold a cell (CI, a pod without bwrap), an app's terminal (`ssh <slug>@forge`, or `t` in the forge's terminal UI) ran as a plain `/bin/sh -c` child in the forge's own process group, and a hangup sent SIGHUP to the program's pid alone. What the program had started (a server it left running, a job sent to the background) was re-parented and kept running in the deployed checkout, with the environment's data dir, forge token and secrets, after the terminal had closed; nothing ever stopped it. The terminal now leads a process group of its own (`detached`, without a cell only), a hangup signals the group, and once the program has exited, what is left of the group is killed: the pattern #63 and #64 gave apps and steps. The spawn moves into `startTerminal`, so it is tested without a deploy. A cell is unchanged: its tree dies with bubblewrap. `signalGroup` is exported from `apps/process.ts` for it.  ### Validation `pipeline/validate` on `a97b8e6b`: **baseline** in 594s — bun 1.3.14, CI-shaped env (scrubbed vars, runner PATH), exact check.yml shard + forge.json commands. | step | result | time | |---|---|---| | `bun install --frozen-lockfile` | ok (exit 0) | 0s | | `forge.json check.fast` | BASELINE (exit 1) | 118s | | `check.yml gate (1) pull_request` | BASELINE (exit 1) | 14s | | `check.yml gate (2) pull_request` | ok (exit 0) | 268s | | `check.yml gate (3) pull_request` | ok (exit 0) | 194s | - ⚠️ node v20.19.2 here, v22 on CI (tsc runs under node) - ⚠️ check.yml gate (1) pull_request stopped early at a BASELINE failure (fail-fast): its later files were not run in this step <details><summary>test output (failures, totals)</summary> ``` ▶ bun install --frozen-lockfile ok exit 0 0s ▶ forge.json check.fast (fail) egress, reported: an undeclared public host goes through and is counted; a private one never does > an undeclared public host is let through and counted [0.98ms] [shard 10] Ran 2571 tests across 260 files in 98.8s; 1 failed. classify: reran test/contain.test.ts test/subscriptions.test.ts test/watches.test.ts alone on origin/main 5881c081 and on this branch BASELINE exit 1 118s ▶ check.yml gate (1) pull_request (fail) egress, reported: an undeclared public host goes through and is counted; a private one never does > an undeclared public host is let through and counted [1.40ms] [shard 3] Ran 113 tests across 3 files in 14.2s; 1 failed. classify: reran test/contain.test.ts alone on origin/main 5881c081 and on this branch BASELINE exit 1 14s ▶ check.yml gate (2) pull_request Ran 1339 tests across 137 files in 267.7s (137 shards). ok exit 0 268s ▶ check.yml gate (3) pull_request Ran 1502 tests across 137 files in 193.2s (137 shards). ok exit 0 194s ``` </details>

grokbot added 1 commit

2026-10-18 23:30:13 +00:00

An app's terminal that runs without a cell ends with everything it started, on a hangup or its own exit

check / gate (3) (pull_request) Successful in 4m6s

Details

check / gate (2) (pull_request) Successful in 5m27s

Details

check / gate (1) (pull_request) Successful in 22m9s

Details

check / check (pull_request) Successful in 0s

Details

preview / preview (pull_request) Has been skipped

Details

a97b8e6bb2

Where the host cannot hold a cell (CI, a pod without bwrap), an app's
terminal (`ssh <slug>@forge`, or `t` in the forge's terminal UI) ran as
a plain `/bin/sh -c` child in the forge's own process group, and a
hangup sent SIGHUP to the program's pid alone. What the program had
started (a server it left running, a job sent to the background) was
re-parented and kept running in the deployed checkout, with the
environment's data dir, forge token and secrets, after the terminal had
closed; nothing ever stopped it.

The terminal now leads a process group of its own (`detached`, without
a cell only), a hangup signals the group, and once the program has
exited, what is left of the group is killed: the pattern #63 and #64
gave apps and steps. The spawn moves into `startTerminal`, so it is
tested without a deploy. A cell is unchanged: its tree dies with
bubblewrap. `signalGroup` is exported from `apps/process.ts` for it.

grokbot merged commit 6808423109 into main

2026-10-18 23:58:13 +00:00

grokbot referenced this pull request from a commit

2026-10-18 23:58:14 +00:00

Merge pull request 'An app's terminal that runs without a cell ends with everything it started, on a hangup or its own exit' (#66) from grokbot/forge:fix/tty-stop-whole-tree into main