fix(host): count a destroy that cannot read its session id as inside by ThomasK33 · Pull Request #259 · coder/agent-tty

ThomasK33 · 2026-11-02T19:53:23Z

Why

The operator's goal is to land the open lifecycle issues he filed. #233 made destroy survive an unreadable /proc/self/stat by counting the CLI as outside the program's session. That choice has a gap: a destroy typed into the session's own interactive shell, with AGENT_TTY_SESSION_ID unset, then destroys in place. It stops its own session and dies before it prints its result.

What changed

cliRunsInsideProgramSession counts a Linux CLI that cannot read its session id as inside. destroy then runs again in a new session, as for any destroy from inside.
ownLinuxSessionId reads session id 0 as unknown too. In a PID namespace whose session leader runs outside it (unshare -p -f, bwrap without --new-session), the kernel shows 0, and the old assertion of a positive id made destroy exit 1 with INTERNAL_ERROR.
The copy gets AGENT_TTY_DESTROY_RERUN=1 and skips the check, so a needless copy costs one re-run and never starts another copy.
readProgramGroup names no tokenless group when host.json records a pid namespace other than the CLI's (sharesHostPidNamespace in src/host/hostRecord.ts). Such a CLI would read the program's childPid as another process group.
facts.mjs checks the Linux branch statement by statement, and SKILL.md, docs/USAGE.md and src/host/README.md describe the new rules.

Scope

Only Linux changes. Other POSIX systems compare through ps and the controlling terminal, as before.
An unreadable session id outside the program's session now costs one detached re-run of destroy. The re-run exits with the same code. Ctrl-C does not reach that copy (tracked as a follow-up).
A CLI that reads session id 0 can run in another PID namespace than the host. Its destroy --force then cannot kill an unrelated process that hostPid names there, because fix(host): prove the host pid with a start-up record before reconcile or destroy --force trusts it #260 (merged into this branch) kills only a host that its start-up record proves. Without a token, it also kills no group through the program's childPid there.

Verification

The first test commit fails on main: the unit test on linux reads the caller as inside when /proc/self/stat fails (ENOENT and EACCES) and the integration test destroy typed into an interactive shell that cannot read its session id prints its result. Both pass here. The second test commit, on linux reads the caller as inside when /proc/self/stat shows session id 0, fails on 40b423e with the assertion and passes here.
New integration test destroy --force that reads session id 0 kills no unrelated process that hostPid names: a preload makes /proc/self/stat show session id 0, and hostPid names an unrelated sleep. It fails before the merge of fix(host): prove the host pid with a start-up record before reconcile or destroy --force trusts it #260 (the sleep gets SIGKILL) and passes after it.
Live, host in the parent namespace, destroy --force under sudo unshare -pf --mount-proc setpriv (session id 0): exit 5 HOST_TIMEOUT, nothing killed, the host and the program's group stay alive.
Live, the same with a tokenless session whose childPid is forged to the pgid of a setsid sleep inside the namespace: fcd8a4f kills that group, and 9e8de3c leaves it alive. The unit tests readProgramGroup without a token cover the same rule, and the namespace case fails on fcd8a4f.
CI-shaped gate on 9e8de3c (unit, integration in 4 shards, e2e in 3 shards, --maxWorkers=1 --retry=2): unit 1731, integration 335, e2e 34 passed. The only later commit syncs coverage.json. npm run typecheck, npm run lint and npm run format:check exit 0.
Live, bash -i session, unset AGENT_TTY_SESSION_ID and a preload that fails /proc/self/stat, then destroy <id> --json > out typed into the shell. On main out stays empty, because the destroy died. On this branch out holds ok: true and destroyed: true. Both end destroyed with the group gone.
Live, destroy run under sudo unshare -pf --mount-proc setpriv --reuid=<me>, where /proc/self/stat shows session id 0: main exits 1 with INTERNAL_ERROR ("own session id must be a positive integer") and the session stays running. This branch exits 0 with ok: true, and the session reads destroyed with the group gone.
.agents/skills/verify-session-lifecycle/scripts/check.sh --update-coverage: exit 0, 64 runs as expected, 22,897,048 and 22,308,620 distinct states, after merging main 0945021 (fix(host): prove the host pid with a start-up record before reconcile or destroy --force trusts it #260). The model does not change.

Refs #220

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: xhigh

…session Refs #220

On Linux a CLI that could not read /proc/self/stat counted as outside the program's session. A destroy typed into the session's shell with the session variable unset then stopped its own session and died before it printed. Now it runs again in a new session. The copy skips the check (DESTROY_RERUN_ENV_KEY), so a needless copy costs one re-run and never another copy. Refs #220

Refs #220

ThomasK33 · 2026-11-02T19:53:29Z

@codex review

ThomasK33 · 2026-11-02T19:53:31Z

@codex security review

chatgpt-codex-connector · 2026-11-02T19:53:47Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T03:39:52.472950Z	`2655d71`	Manual request
🔒 Security Review	✅ Completed 2026-11-03T03:41:43.931576Z	`2655d71`	Manual request

Security findings

Advisory findings (1)

🟡 Reject unproven tokenless kills across PID namespaces · Medium

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-11-02T19:55:17Z

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 40b423eccf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-11-02T19:55:43Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 40b423eccf

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

In a PID namespace whose session leader runs outside it, /proc/self/stat shows session id 0, and ownLinuxSessionId's assertion crashed destroy. Refs #220

In a PID namespace whose session leader runs outside it (unshare -p -f, bwrap without --new-session), /proc/self/stat shows session id 0. ownLinuxSessionId asserted a positive id, so destroy crashed. Now it returns null for 0, and the CLI re-runs in a new session. Refs #220

…d-inside # Conflicts: # .agents/skills/verify-session-lifecycle/coverage.json

ThomasK33 · 2026-11-02T20:42:21Z

@codex review

ThomasK33 · 2026-11-02T20:42:23Z

@codex security review

chatgpt-codex-connector · 2026-11-02T20:44:51Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 6fd34746d9

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6fd34746d9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…hostPid names The manifest's hostPid of a host in another PID namespace can name an unrelated process in the CLI's namespace. Red until the host identity check of #260 lands: the forced destroy SIGKILLs the unrelated process. Refs #220

…d-inside # Conflicts: # .agents/skills/verify-session-lifecycle/SKILL.md # .agents/skills/verify-session-lifecycle/coverage.json # src/host/lifecycle.ts # test/unit/host/lifecycle.test.ts

ThomasK33 · 2026-11-03T02:39:40Z

@codex review

ThomasK33 · 2026-11-03T02:39:42Z

@codex security review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fcd8a4f417

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-11-03T02:42:52Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: fcd8a4f417

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

Refs #220

A CLI in a pid namespace other than the host's, for example one that reads session id 0 and re-runs, read the program's childPid in its own namespace, so destroy --force could SIGKILL an unrelated process group through the tokenless fallback. Now readProgramGroup names no group when host.json records another pid namespace, and judgeHost keeps that host unknown, so the session gets no terminal write. Refs #220

ThomasK33 · 2026-11-03T03:37:00Z

@codex review

ThomasK33 · 2026-11-03T03:37:01Z

@codex security review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2655d71b83

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

🛡️ Codex Security Review

Here are some automated security review suggestions for this pull request.

Reviewed commit: 2655d71b83

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

ThomasK33 added 4 commits November 2, 2026 19:33

test: a destroy that cannot read its own session id re-runs in a new …

456beb2

…session Refs #220

chore(skills): sync the lifecycle coverage record

0a857f9

docs(host): say that a CLI without its session id counts as inside

40b423e

Refs #220

ThomasK33 mentioned this pull request Nov 2, 2026

destroy: a Linux host without /proc ends destroy with INTERNAL_ERROR although the session is destroyed #262

Closed

ThomasK33 added 4 commits November 2, 2026 20:26

test: a destroy that sees session id 0 counts as inside

d21f565

In a PID namespace whose session leader runs outside it, /proc/self/stat shows session id 0, and ownLinuxSessionId's assertion crashed destroy. Refs #220

Merge remote-tracking branch 'origin/main' into fix/220-unreadable-si…

07cf2f7

…d-inside # Conflicts: # .agents/skills/verify-session-lifecycle/coverage.json

chore(skills): sync the lifecycle coverage record after merging main

6fd3474

chatgpt-codex-connector Bot reviewed Nov 2, 2026

View reviewed changes

Comment thread src/host/lifecycle.ts Resolved

Comment thread src/host/lifecycle.ts Resolved

ThomasK33 added 3 commits November 2, 2026 21:21

Merge remote-tracking branch 'origin/main' into fix/220-unreadable-si…

d336407

…d-inside # Conflicts: # .agents/skills/verify-session-lifecycle/SKILL.md # .agents/skills/verify-session-lifecycle/coverage.json # src/host/lifecycle.ts # test/unit/host/lifecycle.test.ts

chore(skills): sync the lifecycle coverage record after merging main

fcd8a4f

chatgpt-codex-connector Bot reviewed Nov 3, 2026

View reviewed changes

Comment thread src/host/lifecycle.ts Resolved

ThomasK33 added 3 commits November 3, 2026 03:04

test: a tokenless group fallback names no group in another pid namespace

58ca277

Refs #220

chore(skills): sync the lifecycle coverage record

2655d71

chatgpt-codex-connector Bot reviewed Nov 3, 2026

View reviewed changes

Comment thread src/host/hostRecord.ts Resolved

chatgpt-codex-connector Bot reviewed Nov 3, 2026

View reviewed changes

Comment thread src/host/lifecycle.ts Resolved

ThomasK33 mentioned this pull request Nov 3, 2026

host identity: follow-ups after #260 (time namespace, shared Home across machines, USAGE wording) #267

Closed

ThomasK33 added this pull request to the merge queue Nov 3, 2026

Merged via the queue into main with commit 71d1b0c Nov 3, 2026
12 of 13 checks passed

ThomasK33 deleted the fix/220-unreadable-sid-inside branch November 3, 2026 04:24

github-actions Bot mentioned this pull request Nov 3, 2026

chore(release): 0.6.0 #172

Open

Conversation

ThomasK33 commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What changed

Scope

Verification

Uh oh!

ThomasK33 commented Nov 2, 2026

Uh oh!

ThomasK33 commented Nov 2, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Security findings

Advisory findings (1)

Uh oh!

chatgpt-codex-connector Bot commented Nov 2, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 2, 2026

🛡️ Codex Security Review

Uh oh!

ThomasK33 commented Nov 2, 2026

Uh oh!

ThomasK33 commented Nov 2, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 2, 2026

🛡️ Codex Security Review

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

ThomasK33 commented Nov 3, 2026

Uh oh!

ThomasK33 commented Nov 3, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Nov 3, 2026

🛡️ Codex Security Review

Uh oh!

ThomasK33 commented Nov 3, 2026

Uh oh!

ThomasK33 commented Nov 3, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

🛡️ Codex Security Review

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ThomasK33 commented Nov 2, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Nov 2, 2026 •

edited

Loading