chainlesschain 0.162.184 → 0.162.185

package/src/harness/background-task-command-runner.js

@@ -0,0 +1,234 @@
+import fs from "node:fs";
+import path from "node:path";
+import executionBroker from "../lib/process-execution-broker/index.js";
+
+const SUPPORTED_BOUNDARIES = new Set(["filesystem", "network"]);
+
+export const _backgroundTaskCommandDeps = {
+  execSync: (...args) => executionBroker.execSync(...args),
+  execFile: (...args) => executionBroker.execFile(...args),
+  issueLinuxWorkspaceSandboxExecutionContract: (...args) =>
+    executionBroker.issueLinuxWorkspaceSandboxExecutionContract(...args),
+  platform: process.platform,
+};
+
+function sandboxError(code, reason, message, requiredBoundaries = []) {
+  const error = new Error(message);
+  error.code = code;
+  error.sandboxReason = reason;
+  error.sandboxFailClosed = true;
+  error.requiredBoundaries = [...requiredBoundaries];
+  error.actualGuarantees = [];
+  error.missingBoundaries = [...requiredBoundaries];
+  error.sandboxBackend = null;
+  error.sandboxCandidateBackend =
+    _backgroundTaskCommandDeps.platform === "linux"
+      ? "linux-bwrap-workspace"
+      : null;
+  return error;
+}
+
+function normalizeRequiredBoundaries(raw) {
+  if (raw === undefined || raw === null || raw === "") return [];
+  let parsed;
+  try {
+    parsed = typeof raw === "string" ? JSON.parse(raw) : raw;
+  } catch (cause) {
+    const error = sandboxError(
+      "ERR_BACKGROUND_TASK_SANDBOX_ENVELOPE_INVALID",
+      "background_sandbox_envelope_invalid",
+      "Background task sandbox boundary envelope is invalid.",
+    );
+    error.cause = cause;
+    throw error;
+  }
+  if (!Array.isArray(parsed)) {
+    throw sandboxError(
+      "ERR_BACKGROUND_TASK_SANDBOX_ENVELOPE_INVALID",
+      "background_sandbox_envelope_invalid",
+      "Background task sandbox boundaries must use filesystem/network.",
+    );
+  }
+  if (parsed.length === 0) return [];
+  if (
+    parsed.some(
+      (boundary) =>
+        typeof boundary !== "string" || !SUPPORTED_BOUNDARIES.has(boundary),
+    )
+  ) {
+    throw sandboxError(
+      "ERR_BACKGROUND_TASK_SANDBOX_ENVELOPE_INVALID",
+      "background_sandbox_envelope_invalid",
+      "Background task sandbox boundaries must use filesystem/network.",
+    );
+  }
+  return [...new Set(parsed)].sort();
+}
+
+function canonicalBinding(workspaceCwd, executionCwd, boundaries) {
+  try {
+    if (
+      typeof workspaceCwd !== "string" ||
+      !path.isAbsolute(workspaceCwd) ||
+      typeof executionCwd !== "string" ||
+      !path.isAbsolute(executionCwd)
+    ) {
+      throw new Error("sandbox paths must be absolute");
+    }
+    const canonicalRoot = fs.realpathSync.native(workspaceCwd);
+    const canonicalCwd = fs.realpathSync.native(executionCwd);
+    if (
+      canonicalRoot !== workspaceCwd ||
+      canonicalCwd !== executionCwd ||
+      !fs.statSync(canonicalRoot).isDirectory() ||
+      !fs.statSync(canonicalCwd).isDirectory()
+    ) {
+      throw new Error("sandbox paths must be canonical directories");
+    }
+    const relative = path.relative(canonicalRoot, canonicalCwd);
+    if (
+      relative === ".." ||
+      relative.startsWith(`..${path.sep}`) ||
+      path.isAbsolute(relative)
+    ) {
+      throw new Error("execution cwd escapes workspace");
+    }
+    return { workspaceRoot: canonicalRoot, workingDirectory: canonicalCwd };
+  } catch (cause) {
+    const error = sandboxError(
+      "ERR_BACKGROUND_TASK_SANDBOX_BINDING_INVALID",
+      "background_sandbox_binding_invalid",
+      "Background task sandbox workspace/cwd binding is invalid.",
+      boundaries,
+    );
+    error.cause = cause;
+    throw error;
+  }
+}
+
+function explicitShellInvocation(command) {
+  if (_backgroundTaskCommandDeps.platform === "win32") {
+    return {
+      file: process.env.ComSpec || "cmd.exe",
+      args: ["/d", "/s", "/c", command],
+    };
+  }
+  return { file: "/bin/sh", args: ["-c", command] };
+}
+
+export function executeBackgroundTaskCommand({
+  command,
+  cwd,
+  type,
+  workspaceCwd = "",
+  requiredBoundaries = [],
+}) {
+  if (
+    typeof command !== "string" ||
+    command.length === 0 ||
+    command.includes("\0")
+  ) {
+    throw new TypeError("background task command must be non-empty");
+  }
+  const boundaries = normalizeRequiredBoundaries(requiredBoundaries);
+  const hasSandboxEnvelope =
+    typeof workspaceCwd === "string" && workspaceCwd.length > 0;
+  if (hasSandboxEnvelope !== boundaries.length > 0) {
+    throw sandboxError(
+      "ERR_BACKGROUND_TASK_SANDBOX_ENVELOPE_INVALID",
+      "background_sandbox_envelope_invalid",
+      "Background task sandbox root and boundaries must be supplied together.",
+      boundaries,
+    );
+  }
+  if (
+    boundaries.length > 0 &&
+    _backgroundTaskCommandDeps.platform !== "linux"
+  ) {
+    throw sandboxError(
+      "ERR_PROCESS_SANDBOX_BOUNDARY_UNSATISFIED",
+      "background_platform_backend_unavailable",
+      "Background task strong sandbox execution is only available on Linux.",
+      boundaries,
+    );
+  }
+
+  const commonOptions = {
+    cwd: cwd || process.cwd(),
+    encoding: "utf-8",
+    timeout: 300000,
+    maxBuffer: 10 * 1024 * 1024,
+    origin: `background-task:command:${type || "unknown"}`,
+    policy: "allow",
+    scope: "background-task",
+  };
+  if (boundaries.length === 0) {
+    return _backgroundTaskCommandDeps.execSync(command, {
+      ...commonOptions,
+      shell: true,
+    });
+  }
+
+  const binding = canonicalBinding(workspaceCwd, commonOptions.cwd, boundaries);
+  const sandboxPolicy = Object.freeze({
+    requiredBoundaries: Object.freeze(boundaries),
+  });
+  const invocation = explicitShellInvocation(command);
+  const spawnOptions = {
+    ...commonOptions,
+    cwd: binding.workingDirectory,
+    stdio: ["ignore", "pipe", "pipe"],
+    shell: false,
+    sandboxPolicy,
+  };
+  let sandboxExecutionContract;
+  try {
+    sandboxExecutionContract =
+      _backgroundTaskCommandDeps.issueLinuxWorkspaceSandboxExecutionContract(
+        invocation.file,
+        invocation.args,
+        spawnOptions,
+        binding.workspaceRoot,
+        { sync: false },
+      );
+  } catch (cause) {
+    const error = sandboxError(
+      "ERR_PROCESS_SANDBOX_BOUNDARY_UNSATISFIED",
+      "background_linux_execution_contract_unavailable",
+      "Background task could not bind its Linux sandbox contract.",
+      boundaries,
+    );
+    error.cause = cause;
+    throw error;
+  }
+  if (
+    _backgroundTaskCommandDeps.platform === "linux" &&
+    !sandboxExecutionContract
+  ) {
+    throw sandboxError(
+      "ERR_PROCESS_SANDBOX_BOUNDARY_UNSATISFIED",
+      "background_linux_execution_contract_unavailable",
+      "Background task could not bind its Linux sandbox contract.",
+      boundaries,
+    );
+  }
+  return new Promise((resolve, reject) => {
+    const options = {
+      ...spawnOptions,
+      ...(sandboxExecutionContract ? { sandboxExecutionContract } : {}),
+    };
+    try {
+      _backgroundTaskCommandDeps.execFile(
+        invocation.file,
+        invocation.args,
+        options,
+        (error, stdout) => {
+          if (error) reject(error);
+          else resolve(stdout);
+        },
+      );
+    } catch (error) {
+      reject(error);
+    }
+  });
+}

package/src/harness/background-task-manager.js

@@ -8,8 +8,15 @@
  * Feature-flag gated: BACKGROUND_TASKS
  */
 
-import { existsSync, mkdirSync, appendFileSync, readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import {
+  existsSync,
+  mkdirSync,
+  appendFileSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+} from "node:fs";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { createHash } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { getHomeDir } from "../lib/paths.js";
@@ -17,6 +24,7 @@ import executionBroker from "../lib/process-execution-broker/index.js";
 
 export const _deps = {
   spawn: executionBroker.spawn.bind(executionBroker),
+  platform: process.platform,
 };
 
 function getTasksDir() {
@@ -41,6 +49,7 @@ const RECOVERABLE_TASK_STATUSES = new Set([
   TaskStatus.PENDING,
   TaskStatus.RUNNING,
 ]);
+const SUPPORTED_STRONG_BOUNDARIES = new Set(["filesystem", "network"]);
 
 function validatePinnedSandboxPolicy(policy) {
   if (policy == null) return null;
@@ -51,7 +60,9 @@ function validatePinnedSandboxPolicy(policy) {
     !Array.isArray(policy.requiredBoundaries) ||
     policy.requiredBoundaries.length === 0 ||
     policy.requiredBoundaries.some(
-      (boundary) => typeof boundary !== "string" || boundary.length === 0,
+      (boundary) =>
+        typeof boundary !== "string" ||
+        !SUPPORTED_STRONG_BOUNDARIES.has(boundary),
     ) ||
     !Object.isFrozen(policy) ||
     !Object.isFrozen(policy.requiredBoundaries)
@@ -65,22 +76,88 @@ function validatePinnedSandboxPolicy(policy) {
   return policy;
 }
 
-function createUnsupportedSandboxError(sandboxPolicy) {
-  const requiredBoundaries = [...sandboxPolicy.requiredBoundaries];
-  const error = new Error(
-    `Background tasks cannot run without their required sandbox boundaries: ${requiredBoundaries.join(", ")}`,
-  );
-  error.code = "ERR_BACKGROUND_TASK_SANDBOX_UNSUPPORTED";
-  error.sandboxReason = "background_execution_unsupported";
+function createSandboxError(code, reason, message, requiredBoundaries = []) {
+  const error = new Error(message);
+  error.code = code;
+  error.sandboxReason = reason;
   error.sandboxFailClosed = true;
-  error.requiredBoundaries = requiredBoundaries;
+  error.requiredBoundaries = [...requiredBoundaries];
   error.actualGuarantees = [];
   error.missingBoundaries = [...requiredBoundaries];
   error.sandboxBackend = null;
-  error.sandboxCandidateBackend = null;
+  error.sandboxCandidateBackend =
+    _deps.platform === "linux" ? "linux-bwrap-workspace" : null;
   return error;
 }
 
+function canonicalSandboxBinding(workspaceCwd, executionCwd) {
+  try {
+    if (
+      typeof workspaceCwd !== "string" ||
+      !isAbsolute(workspaceCwd) ||
+      typeof executionCwd !== "string"
+    ) {
+      throw new Error("sandbox paths must be absolute");
+    }
+    const workspaceRoot = realpathSync.native(resolve(workspaceCwd));
+    const workingDirectory = realpathSync.native(resolve(executionCwd));
+    if (
+      !statSync(workspaceRoot).isDirectory() ||
+      !statSync(workingDirectory).isDirectory()
+    ) {
+      throw new Error("sandbox paths must be directories");
+    }
+    const rel = relative(workspaceRoot, workingDirectory);
+    if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+      throw new Error("execution cwd escapes workspace");
+    }
+    return { workspaceRoot, workingDirectory };
+  } catch (cause) {
+    const error = createSandboxError(
+      "ERR_BACKGROUND_TASK_SANDBOX_BINDING_INVALID",
+      "background_sandbox_binding_invalid",
+      "Background task sandbox workspace/cwd binding is invalid.",
+    );
+    error.cause = cause;
+    throw error;
+  }
+}
+
+function sameBoundaries(left, right) {
+  const normalizedLeft = Array.isArray(left) ? [...left].sort() : null;
+  const normalizedRight = Array.isArray(right) ? [...right].sort() : null;
+  return (
+    normalizedLeft &&
+    normalizedRight &&
+    normalizedLeft.length === normalizedRight.length &&
+    normalizedLeft.every((value, index) => value === normalizedRight[index])
+  );
+}
+
+function strongWorkerEnvironment(taskId) {
+  const blocked = new Set([
+    "BASH_ENV",
+    "CC_TASK_ID",
+    "ELECTRON_RUN_AS_NODE",
+    "ENV",
+    "GCONV_PATH",
+    "OPENSSL_CONF",
+    "RUBYOPT",
+  ]);
+  const blockedPrefixes = ["DYLD_", "LD_", "NODE_", "PYTHON"];
+  return Object.fromEntries([
+    ...Object.entries(process.env).filter(([key, value]) => {
+      const normalizedKey = key.toUpperCase();
+      return (
+        value != null &&
+        !blocked.has(normalizedKey) &&
+        !blockedPrefixes.some((prefix) => normalizedKey.startsWith(prefix))
+      );
+    }),
+    ["CC_TASK_ID", taskId],
+  ]);
+}
+
 export class BackgroundTaskManager extends EventEmitter {
   constructor(options = {}) {
     super();
@@ -123,14 +200,17 @@ export class BackgroundTaskManager extends EventEmitter {
     }
 
     const cwd = spec.cwd || process.cwd();
-    this._assertSandboxSupported(cwd);
+    const sandboxPolicy = this._resolvePinnedSandboxPolicy(cwd);
+    const sandboxBinding = sandboxPolicy
+      ? canonicalSandboxBinding(this._policyCwd, cwd)
+      : null;
 
     const id = `task-${Date.now()}-${createHash("sha256").update(Math.random().toString()).digest("hex").slice(0, 6)}`;
     const task = {
       id,
       type: spec.type || "shell",
       command: spec.command,
-      cwd,
+      cwd: sandboxBinding?.workingDirectory || cwd,
       description: spec.description || spec.command,
       status: TaskStatus.PENDING,
       createdAt: Date.now(),
@@ -145,6 +225,10 @@ export class BackgroundTaskManager extends EventEmitter {
       recoverySourceStatus: null,
       ownerNodeId: spec.ownerNodeId || this.nodeId,
       recoveryDecision: null,
+      sandboxWorkspaceCwd: sandboxBinding?.workspaceRoot || null,
+      sandboxRequiredBoundaries: sandboxPolicy
+        ? [...sandboxPolicy.requiredBoundaries].sort()
+        : null,
       _seq: ++this._createSeq,
     };
 
@@ -164,7 +248,34 @@ export class BackgroundTaskManager extends EventEmitter {
       throw new Error(`Task ${taskId} is not pending (status: ${task.status})`);
     }
 
-    this._assertSandboxSupported(task.cwd);
+    const sandboxPolicy = this._resolvePinnedSandboxPolicy(task.cwd);
+    const pinnedBoundaries = task.sandboxRequiredBoundaries;
+    if (
+      Boolean(sandboxPolicy) !== Array.isArray(pinnedBoundaries) ||
+      (sandboxPolicy &&
+        !sameBoundaries(sandboxPolicy.requiredBoundaries, pinnedBoundaries))
+    ) {
+      throw createSandboxError(
+        "ERR_BACKGROUND_TASK_SANDBOX_POLICY_CHANGED",
+        "background_sandbox_policy_changed",
+        "Background task sandbox policy changed after creation; recreate the task.",
+        sandboxPolicy?.requiredBoundaries || pinnedBoundaries || [],
+      );
+    }
+    if (sandboxPolicy) {
+      const currentBinding = canonicalSandboxBinding(this._policyCwd, task.cwd);
+      if (
+        currentBinding.workspaceRoot !== task.sandboxWorkspaceCwd ||
+        currentBinding.workingDirectory !== task.cwd
+      ) {
+        throw createSandboxError(
+          "ERR_BACKGROUND_TASK_SANDBOX_BINDING_CHANGED",
+          "background_sandbox_binding_changed",
+          "Background task sandbox workspace/cwd identity changed after creation; recreate the task.",
+          pinnedBoundaries,
+        );
+      }
+    }
 
     task.status = TaskStatus.RUNNING;
     task.startedAt = Date.now();
@@ -179,11 +290,21 @@ export class BackgroundTaskManager extends EventEmitter {
     );
     const child = _deps.spawn(
       process.execPath,
-      [...process.execArgv, workerPath, task.command, task.cwd, task.type],
+      [
+        ...(sandboxPolicy ? [] : process.execArgv),
+        workerPath,
+        task.command,
+        task.cwd,
+        task.type,
+        task.sandboxWorkspaceCwd || "",
+        JSON.stringify(task.sandboxRequiredBoundaries || []),
+      ],
       {
         cwd: task.cwd,
         stdio: ["pipe", "pipe", "pipe", "ipc"],
-        env: { ...process.env, CC_TASK_ID: taskId },
+        env: sandboxPolicy
+          ? strongWorkerEnvironment(taskId)
+          : { ...process.env, CC_TASK_ID: taskId },
         origin: "background-task:worker",
         policy: "allow",
         scope: "background-task",
@@ -199,6 +320,9 @@ export class BackgroundTaskManager extends EventEmitter {
       } else if (msg.type === "result") {
         this._complete(taskId, TaskStatus.COMPLETED, msg.data, null);
       } else if (msg.type === "error") {
+        task.errorCode = msg.code || null;
+        task.sandboxReason = msg.sandboxReason || null;
+        task.sandboxFailClosed = msg.sandboxFailClosed === true;
         this._complete(taskId, TaskStatus.FAILED, null, msg.error);
       }
     });
@@ -240,7 +364,7 @@ export class BackgroundTaskManager extends EventEmitter {
     return task;
   }
 
-  _assertSandboxSupported(executionCwd) {
+  _resolvePinnedSandboxPolicy(executionCwd) {
     if (!this._resolveSandboxPolicy) return;
     const sandboxPolicy = validatePinnedSandboxPolicy(
       this._resolveSandboxPolicy({
@@ -248,9 +372,15 @@ export class BackgroundTaskManager extends EventEmitter {
         executionCwd,
       }),
     );
-    if (sandboxPolicy) {
-      throw createUnsupportedSandboxError(sandboxPolicy);
+    if (sandboxPolicy && _deps.platform !== "linux") {
+      throw createSandboxError(
+        "ERR_BACKGROUND_TASK_SANDBOX_UNSUPPORTED",
+        "background_platform_backend_unavailable",
+        "Background task strong sandbox execution is only available on Linux.",
+        sandboxPolicy.requiredBoundaries,
+      );
     }
+    return sandboxPolicy;
   }
 
   get(taskId) {

package/src/harness/background-task-worker.js

@@ -5,24 +5,27 @@
  * Sends messages to parent: { type: "heartbeat"|"result"|"error", ... }
  */
 
-import executionBroker from "../lib/process-execution-broker/index.js";
+import { executeBackgroundTaskCommand } from "./background-task-command-runner.js";
 
-const [command, cwd, type] = process.argv.slice(2);
+const [
+  command,
+  cwd,
+  type,
+  sandboxWorkspaceCwd = "",
+  sandboxRequiredBoundaries = "",
+] = process.argv.slice(2);
 
 const heartbeat = setInterval(() => {
   if (process.send) process.send({ type: "heartbeat" });
 }, 5000);
 
 try {
-  const result = executionBroker.execSync(command, {
-    cwd: cwd || process.cwd(),
-    encoding: "utf-8",
-    timeout: 300000,
-    maxBuffer: 10 * 1024 * 1024,
-    origin: `background-task:command:${type || "unknown"}`,
-    policy: "allow",
-    scope: "background-task",
-    shell: true,
+  const result = await executeBackgroundTaskCommand({
+    command,
+    cwd,
+    type,
+    workspaceCwd: sandboxWorkspaceCwd,
+    requiredBoundaries: sandboxRequiredBoundaries,
   });
 
   if (process.send) {
@@ -33,6 +36,9 @@ try {
     process.send({
       type: "error",
       error: err.stderr || err.message || String(err),
+      code: err.code || null,
+      sandboxReason: err.sandboxReason || null,
+      sandboxFailClosed: err.sandboxFailClosed === true,
     });
   }
   process.exitCode = 1;

package/src/lib/background-agent-supervisor.js

@@ -201,6 +201,52 @@ export const _deps = {
   killProcessTree: defaultKillProcessTree,
 };
 
+/**
+ * Stop the active turn launched by an attached background session.
+ * Windows must terminate the complete descendant tree; a bare ChildProcess
+ * kill only reaches the top-level CLI process and can orphan tool children.
+ */
+export function stopBackgroundAgentChildTree(
+  pid,
+  { platform = process.platform, signal = "SIGTERM" } = {},
+) {
+  const target = Number(pid);
+  if (!Number.isInteger(target) || target <= 0 || target === process.pid) {
+    const error = new Error("background_agent_child_pid_invalid");
+    error.code = "ERR_BACKGROUND_AGENT_CHILD_PID_INVALID";
+    throw error;
+  }
+  if (platform === "win32") {
+    const result = runSupervisorCommand(
+      "taskkill",
+      ["/PID", String(target), "/T", "/F"],
+      {
+        windowsHide: true,
+        encoding: "utf8",
+      },
+      "background-agent:session-stop-tree",
+    );
+    if (result?.error || result?.status !== 0) {
+      const error = new Error(
+        `background_agent_child_tree_stop_failed: ${
+          result?.error?.message ||
+          result?.stderr ||
+          `taskkill exited ${result?.status}`
+        }`,
+      );
+      error.code = "ERR_BACKGROUND_AGENT_CHILD_TREE_STOP_FAILED";
+      throw error;
+    }
+    return true;
+  }
+  try {
+    _deps.kill(-target, signal);
+  } catch {
+    _deps.kill(target, signal);
+  }
+  return true;
+}
+
 /** Cached probe (default impl only — injected probes run uncached for tests). */
 function processStartTimeMs(pid) {
   if (_deps.readProcessStartTimeMs !== defaultReadProcessStartTimeMs) {

package/src/lib/event-runtime-host.js

@@ -9,6 +9,7 @@
 import { EventEmitter } from "node:events";
 import { EventRuntimeStore } from "./event-runtime-store.js";
 import { EventRuntimeWorker } from "./event-runtime-worker.js";
+import { registerHostHooksV2Workspace } from "./hooks-v2-workspace-context.js";
 
 function routeType(event) {
   return String(
@@ -63,10 +64,8 @@ export class EventRuntimeHost extends EventEmitter {
       worker ||
       new EventRuntimeWorker({
         store,
-        onInbox: (event, record) =>
-          this._dispatch("inbox", event, record),
-        onOutbox: (event, record) =>
-          this._dispatch("outbox", event, record),
+        onInbox: (event, record) => this._dispatch("inbox", event, record),
+        onOutbox: (event, record) => this._dispatch("outbox", event, record),
       });
   }
 
@@ -89,10 +88,7 @@ export class EventRuntimeHost extends EventEmitter {
     }
   }
 
-  registerHandler(
-    handler,
-    { queue = "inbox", type = "*", origin = "*" } = {},
-  ) {
+  registerHandler(handler, { queue = "inbox", type = "*", origin = "*" } = {}) {
     if (typeof handler !== "function") {
       throw new TypeError("Event Runtime handler must be a function");
     }
@@ -223,8 +219,7 @@ export class EventRuntimeHost extends EventEmitter {
           break;
         }
         const claimed =
-          Number(stats?.inboxClaimed || 0) +
-          Number(stats?.outboxClaimed || 0);
+          Number(stats?.inboxClaimed || 0) + Number(stats?.outboxClaimed || 0);
         if (claimed === 0) break;
       }
     }
@@ -272,7 +267,14 @@ export function startDefaultEventRuntimeHost(options = {}) {
   if (process.env.CC_EVENT_RUNTIME_DURABLE !== "1" && options.force !== true) {
     return null;
   }
+  // The CLI process startup directory is host state. Register it before the
+  // first durable claim so a recovered Hooks v2 record can resolve its opaque
+  // workspace ID without accepting any path from the record itself.
+  const hooksV2WorkspaceBinding = registerHostHooksV2Workspace(
+    options.workspaceRoot ?? process.cwd(),
+  );
   const host = getDefaultEventRuntimeHost(options);
+  host.hooksV2WorkspaceBindingId = hooksV2WorkspaceBinding.bindingId;
   host.start({ immediate: options.immediate !== false });
   return host;
 }

package/src/lib/hook-runner.cjs

@@ -438,7 +438,13 @@ function _runCommandHookInner(command, input = {}, opts = {}) {
 function interpretHookOutcome(res) {
   // A surfaced spawn error (timeout / ENOENT, status null) is non-blocking — a
   // broken hook must never wedge the agent; only an explicit block blocks.
-  if (res.error) {
+  // spawnSync can also report EPIPE after a fast-exiting hook closes stdin,
+  // even though the child has a real exit status and complete output. The
+  // async runner already treats that early stdin close as harmless; preserve
+  // the exit-code/stdout protocol on the sync path as well.
+  const inputClosedAfterExit =
+    res.error?.code === "EPIPE" && Number.isInteger(res.status);
+  if (res.error && !inputClosedAfterExit) {
     return {
       decision: HOOK_DECISIONS.CONTINUE,
       reason: `hook error: ${res.error.message}`,

package/src/lib/hook-runner.js

@@ -107,6 +107,8 @@ function runHookProcessSync(file, argsOrOptions, maybeOptions) {
 }
 
 export function _restoreProcessRunners() {
+  _processDeps.run = brokerRunner;
+  _processDeps.runSync = brokerSyncRunner;
   runner._deps.run = runHookProcess;
   runner._deps.runSync = runHookProcessSync;
 }