fix: bound PTY overflow abort latency (#2805)

Author: steipete

CHANGELOG.md

@@ -6,6 +6,7 @@
 - Fireworks: track 30-day rated billing spend with an API key and account slug (#2687). Thanks @x0mh0x!
 
 ### Fixed
+- PTY probes: abort output-overflow children through a bounded process-group kill path, avoiding minute-long cleanup stalls under load (refs #2792).
 - Cost store: give the store actor's custom serial executor an `isIsolatingCurrentContext()` implementation — macOS 26+ runtimes consult it before `checkIsolated()`, and its default cannot see through `DispatchQueue.sync`, so every synchronous store bridge tripped "Incorrect actor executor assumption" and the app died on launch.
 - Codex: reject Standard/Fast pricing rows that exceed canonical fork-deduplicated usage, preventing copied fork rows and their Fast surcharge from inflating cost estimates (#2754). Thanks @1328189205 for the report and @Yuxin-Qiao for the initial fix and regression-test approach!
 - Claude: stop rotating Claude Code's own refresh-token chain on keychain-only installs — ownership evidence is now tri-state with indeterminate treated as CLI-owned, so delegated refreshes can never invalidate credentials CodexBar cannot read (#2745, refs #2634). Thanks @avenoxai!

Sources/CodexBarCore/Host/PTY/TTYCommandRunner.swift

@@ -266,6 +266,7 @@ enum TTYProcessTreeTerminator {
 
 private enum TTYCommandRunnerTestingOverrides {
     @TaskLocal static var postDeadlineDrainDuration: TimeInterval?
+    @TaskLocal static var outputLimitBytes: Int?
 }
 
 /// Executes an interactive CLI inside a pseudo-terminal and returns all captured text.
@@ -661,13 +662,14 @@ public struct TTYCommandRunner {
 
         var cleanedUp = false
         var launchedProcess: SpawnedProcessGroup?
+        var didExceedOutputLimit = false
         /// Always tear down the PTY child (and its process group) even if we throw early
         /// while bootstrapping the CLI (e.g. when it prompts for login/telemetry).
         func cleanup() {
             guard !cleanedUp else { return }
             cleanedUp = true
 
-            if let launchedProcess, launchedProcess.isRunning {
+            if !didExceedOutputLimit, let launchedProcess, launchedProcess.isRunning {
                 Self.log.debug("PTY stopping", metadata: ["binary": binaryName])
                 let exitData = Data("/exit\n".utf8)
                 try? writeAllToPrimary(exitData)
@@ -679,8 +681,16 @@ public struct TTYCommandRunner {
                 try? primaryHandle.close()
                 return
             }
-            launchedProcess.terminateSynchronously()
-            try? primaryHandle.close()
+            if didExceedOutputLimit {
+                // Once the bounded buffer overflows, do not spend seconds sweeping every process's
+                // descriptors before signaling. Closing the master unblocks a child stuck writing,
+                // and the scoped abort escalates within its fixed grace window.
+                try? primaryHandle.close()
+                launchedProcess.abortSynchronously()
+            } else {
+                launchedProcess.terminateSynchronously()
+                try? primaryHandle.close()
+            }
             TTYCommandRunnerActiveProcessRegistry.unregister(pid: launchedProcess.pid)
         }
 
@@ -740,8 +750,8 @@ public struct TTYCommandRunner {
         let isCodex = ttyStatusCommand != nil || options.forceCodexStatusMode
         let isCodexStatus = isCodex && trimmed == (ttyStatusCommand ?? "/status")
 
-        var buffer = BoundedOutputBuffer()
-        var didExceedOutputLimit = false
+        let outputLimitBytes = TTYCommandRunnerTestingOverrides.outputLimitBytes ?? BoundedOutputBuffer.defaultMaxBytes
+        var buffer = BoundedOutputBuffer(maxBytes: outputLimitBytes)
 
         func checkOutputLimit() throws {
             if didExceedOutputLimit {
@@ -1177,6 +1187,13 @@ extension TTYCommandRunner {
         try TTYCommandRunnerTestingOverrides.$postDeadlineDrainDuration.withValue(duration, operation: operation)
     }
 
+    static func withOutputLimitOverrideForTesting<T>(
+        _ maxBytes: Int,
+        operation: () throws -> T) rethrows -> T
+    {
+        try TTYCommandRunnerTestingOverrides.$outputLimitBytes.withValue(maxBytes, operation: operation)
+    }
+
     public static func which(_ tool: String) -> String? {
         if let cli = ProviderDescriptorRegistry.all.first(where: { $0.cli.name == tool })?.cli,
            cli.prefersBinaryLocatorForWhich,

Sources/CodexBarCore/Host/Process/SpawnedProcessGroup.swift

@@ -590,6 +590,35 @@ package final class SpawnedProcessGroup: @unchecked Sendable {
         return self.finishSynchronously()
     }
 
+    /// Abort a process whose output channel is no longer safe to inspect.
+    ///
+    /// Unlike normal cleanup, this deliberately avoids the system-wide output-holder scan. The caller closes
+    /// the output descriptor first, then this method targets only the launch process tree and dedicated process
+    /// group so TERM-to-KILL escalation remains bounded even when process enumeration is slow under load.
+    @discardableResult
+    package func abortSynchronously(grace: TimeInterval = 0.4) -> Int32? {
+        let grace = max(0, grace)
+        let termDeadline = Date().addingTimeInterval(grace)
+        var processIdentities = self.currentAbortProcessIdentities()
+
+        self.signalOwnedProcessGroup(SIGTERM)
+        Self.signal(processIdentities: processIdentities, signal: SIGTERM)
+
+        while self.abortTargetsRemain(processIdentities), Date() < termDeadline {
+            usleep(20000)
+        }
+
+        processIdentities.formUnion(self.currentAbortProcessIdentities())
+        self.signalOwnedProcessGroup(SIGKILL)
+        Self.signal(processIdentities: processIdentities, signal: SIGKILL)
+
+        let killDeadline = Date().addingTimeInterval(grace)
+        while self.abortTargetsRemain(processIdentities), Date() < killDeadline {
+            usleep(20000)
+        }
+        return self.finishSynchronously()
+    }
+
     @discardableResult
     package func finishSynchronously(timeout: TimeInterval = 1) -> Int32? {
         self.termination.requestReap()
@@ -753,6 +782,35 @@ package final class SpawnedProcessGroup: @unchecked Sendable {
         return identities
     }
 
+    private func currentAbortProcessIdentities() -> Set<TTYProcessTreeTerminator.ProcessIdentity> {
+        var identities = self.observedProcessGroupMembers.snapshot
+        identities.formUnion(self.currentProcessGroupMemberIdentities())
+        guard let rootIdentity = self.rootIdentity,
+              TTYProcessTreeTerminator.isCurrent(rootIdentity)
+        else {
+            return identities
+        }
+
+        identities.insert(rootIdentity)
+        identities.formUnion(
+            TTYProcessTreeTerminator.descendantPIDs(of: self.pid)
+                .compactMap(TTYProcessTreeTerminator.processIdentity(for:)))
+        return identities
+    }
+
+    private func signalOwnedProcessGroup(_ signal: Int32) {
+        guard let rootIdentity = self.rootIdentity,
+              TTYProcessTreeTerminator.isCurrent(rootIdentity)
+        else { return }
+        _ = kill(-self.processGroup, signal)
+    }
+
+    private func abortTargetsRemain(
+        _ processIdentities: Set<TTYProcessTreeTerminator.ProcessIdentity>) -> Bool
+    {
+        processIdentities.contains(where: TTYProcessTreeTerminator.isCurrent(_:)) || self.hasResidualProcessGroup
+    }
+
     private func currentOutputHolderIdentities() -> Set<TTYProcessTreeTerminator.ProcessIdentity> {
         let excludedPIDs: Set<pid_t> = [getpid(), self.pid]
         var holderPIDs = OutputPipeIdentity.holderPIDs(for: self.outputPipes)

Tests/CodexBarTests/BoundedChildProcessProofTests.swift

@@ -33,19 +33,20 @@ struct BoundedChildProcessProofTests {
         let runner = TTYCommandRunner()
         let start = ContinuousClock.now
         do {
-            _ = try runner.run(
-                binary: scriptURL.path,
-                send: "",
-                options: .init(timeout: 60, baseEnvironment: environment, initialDelay: 0))
+            _ = try TTYCommandRunner.withOutputLimitOverrideForTesting(64 * 1024) {
+                try runner.run(
+                    binary: scriptURL.path,
+                    send: "",
+                    options: .init(timeout: 60, baseEnvironment: environment, initialDelay: 0))
+            }
             Issue.record("Expected the synthetic child to exceed the PTY output limit")
         } catch TTYCommandRunner.Error.outputTooLarge {
             // Expected: the production runner propagated the bounded-output error.
         } catch {
             Issue.record("Unexpected overflow error: \(error)")
         }
-        // Prove early abort (well under the 60s timeout) without a load-sensitive tight bound:
-        // heavily loaded CI shards have taken >10s for PTY drain alone (refs #2792 fallout).
-        #expect(start.duration(to: .now) < .seconds(30))
+        // A small test-only limit isolates abort latency from the host's PTY throughput.
+        #expect(start.duration(to: .now) < .seconds(5))
 
         let pidText = try String(contentsOf: pidURL, encoding: .utf8)
             .trimmingCharacters(in: .whitespacesAndNewlines)