Refuse queued run_shell after shell-guard dispose

Latch dispose so overlapping calls join one reap, and refuse
queued shells that would spawn after the guard is gone.

Author: TheGreatAxios

src/plugins/shell-guard-plugin.test.ts

@@ -782,6 +782,106 @@ describe("shellGuardPlugin", () => {
     }
   });
 
+  test("dispose refuses a queued run_shell so it cannot stay running after reap", async () => {
+    if (process.platform === "win32") return;
+    const plugin = shellGuardPlugin(process.cwd());
+    const handler = plugin.middleware!(fallback);
+    const token1 = `ic_guard_queued1_${randomUUID()}`;
+    const token2 = `ic_guard_queued2_${randomUUID()}`;
+    const first = handler(
+      {
+        id: "q-live",
+        name: "run_shell",
+        arguments: { command: `IC_GUARD_TAG=${token1} sleep 600` },
+      },
+      neverAbort(),
+    );
+    try {
+      const started = Date.now();
+      while (Date.now() - started < 5_000) {
+        const probe = spawnSync("pgrep", ["-f", token1], { encoding: "utf8" });
+        if ((probe.stdout?.trim() ?? "").length > 0) break;
+        await new Promise((r) => setTimeout(r, 50));
+      }
+      expect(
+        spawnSync("pgrep", ["-f", token1], { encoding: "utf8" }).stdout?.trim() ?? "",
+      ).not.toBe("");
+
+      const queued = handler(
+        {
+          id: "q-wait",
+          name: "run_shell",
+          arguments: { command: `IC_GUARD_TAG=${token2} sleep 600` },
+        },
+        neverAbort(),
+      );
+
+      let disposeError: unknown;
+      try {
+        await plugin.dispose!();
+      } catch (err) {
+        disposeError = err;
+      }
+
+      await first;
+      await Promise.race([queued, new Promise((r) => setTimeout(r, 400))]);
+      await new Promise((r) => setTimeout(r, 200));
+
+      const leftover1 =
+        spawnSync("pgrep", ["-f", token1], { encoding: "utf8" }).stdout?.trim() ?? "";
+      const leftover2 =
+        spawnSync("pgrep", ["-f", token2], { encoding: "utf8" }).stdout?.trim() ?? "";
+      expect(leftover1).toBe("");
+      expect(leftover2).toBe("");
+      if (leftover2.length > 0) {
+        expect(disposeError).toBeDefined();
+      } else {
+        const queuedResult = await queued;
+        expect(queuedResult.isError).toBe(true);
+        expect(String(queuedResult.content)).toMatch(/disposed/);
+        expect(disposeError).toBeUndefined();
+      }
+      spawnSync("pkill", ["-9", "-f", token2]);
+      await Promise.race([queued, new Promise((r) => setTimeout(r, 1_000))]);
+    } finally {
+      spawnSync("pkill", ["-9", "-f", token1]);
+      spawnSync("pkill", ["-9", "-f", token2]);
+    }
+  }, 15_000);
+
+  test("overlapping dispose joins the in-flight reap", async () => {
+    if (process.platform === "win32") return;
+    const plugin = shellGuardPlugin(process.cwd());
+    const handler = plugin.middleware!(fallback);
+    const token = `ic_guard_join_${randomUUID()}`;
+    const running = handler(
+      {
+        id: "join-live",
+        name: "run_shell",
+        arguments: { command: `IC_GUARD_TAG=${token} sleep 600` },
+      },
+      neverAbort(),
+    );
+    try {
+      const started = Date.now();
+      while (Date.now() - started < 5_000) {
+        const probe = spawnSync("pgrep", ["-f", token], { encoding: "utf8" });
+        if ((probe.stdout?.trim() ?? "").length > 0) break;
+        await new Promise((r) => setTimeout(r, 50));
+      }
+      expect(plugin.dispose).toBeDefined();
+      const first = plugin.dispose!();
+      const second = plugin.dispose!();
+      expect(second).toBe(first);
+      await Promise.all([first, second]);
+      await running;
+      const after = spawnSync("pgrep", ["-f", token], { encoding: "utf8" });
+      expect(after.stdout?.trim() ?? "").toBe("");
+    } finally {
+      spawnSync("pkill", ["-9", "-f", token]);
+    }
+  });
+
   test("dispose fails when a child survives the reap window", async () => {
     const child = Object.assign(new EventEmitter(), {
       exitCode: null,

src/plugins/shell-guard-plugin.ts

@@ -250,8 +250,12 @@ export async function runGuardedShell(
   args: RunShellArgs,
   signal: AbortSignal,
   liveChildren?: Set<ChildProcess>,
+  isDisposed?: () => boolean,
 ): Promise<GuardedShellResult> {
   signal.throwIfAborted();
+  if (isDisposed?.()) {
+    throw new Error("run_shell refused: shell guard disposed");
+  }
 
   // Arm setTimeout only when a positive timeout was resolved. No built-in default.
   const timeoutMs = args.timeout !== undefined && args.timeout > 0 ? args.timeout : undefined;
@@ -395,12 +399,19 @@ export function shellGuardPlugin(
   const sessionRoot = realpathSync(cwd);
   let retainedShellCwd = sessionRoot;
   const liveChildren = new Set<ChildProcess>();
+  let disposed = false;
   let disposal: Promise<void> | undefined;
   // Serialize run_shell so concurrent tools cannot race retained cwd updates
   // (last-writer-wins or a non-cd call finishing after a cd and resetting cwd).
   let shellChain: Promise<unknown> = Promise.resolve();
   const enqueueShell = <T>(fn: () => Promise<T>): Promise<T> => {
-    const run = shellChain.then(fn, fn);
+    const runUnlessDisposed = (): Promise<T> => {
+      if (disposed) {
+        return Promise.reject(new Error("run_shell refused: shell guard disposed"));
+      }
+      return fn();
+    };
+    const run = shellChain.then(runUnlessDisposed, runUnlessDisposed);
     shellChain = run.then(
       () => undefined,
       () => undefined,
@@ -492,6 +503,7 @@ export function shellGuardPlugin(
               },
               signal,
               liveChildren,
+              () => disposed,
             );
             const parsed = parsePwdProbeOutput(output);
             if (perCallCwdRaw === undefined && parsed.finalCwd !== undefined) {
@@ -523,7 +535,11 @@ export function shellGuardPlugin(
               isError: true,
             };
           }
-        });
+        }).catch((err: unknown) => ({
+          callId: call.id,
+          content: err instanceof Error ? err.message : String(err),
+          isError: true,
+        }));
       }
 
       if (SEARCH_TOOLS.has(call.name)) {
@@ -579,7 +595,12 @@ export function shellGuardPlugin(
     },
     dispose: () => {
       if (disposal !== undefined) return disposal;
-      disposal = reapLiveChildren(liveChildren);
+      disposed = true;
+      disposal = (async () => {
+        await reapLiveChildren(liveChildren);
+        await shellChain;
+        await reapLiveChildren(liveChildren);
+      })();
       return disposal;
     },
   };