[P1 Bug] subprocess spill I/O 失败会直接终止整个 Harness 进程

[npc-dao]

Summary

本地 subprocess 的收集输出超过内存上限后会写入 spill 文件。spill 文件的创建或写入一旦失败，异常会逃出 stdout/stderr 的 EventEmitter data 回调，成为未捕获异常并终止整个 Harness 进程。

Checked commit: 47f9438

Expected behavior

spill 是完整输出的附加保存路径。文件系统不可用时，单次 subprocess 至少应保留受 maxBytes 限制的内存尾部并正常结算；spill 失败不应使宿主进程退出，也不应返回指向不完整文件的 spillPath。

Actual behavior

OutputCollector.spillAll() 直接调用 openSync() 和 writeSync()，调用方的 stream data listener 没有异常隔离：

• spill 文件 I/O
• stdout/stderr data listener

当临时目录失效、磁盘写满或文件系统返回 EIO 时，openSync 或 writeSync 的错误会成为宿主级未捕获异常，而不是 subprocess 结果或受控的 spill 降级。

Minimal reproduction

在仓库根目录运行：

node --import tsx/esm --input-type=module -e "import { spawnSubprocess } from \"./packages/subprocess/subprocess-local/src/spawn.ts\"; const handle = spawnSubprocess({ argv: [\"/bin/sh\", \"-c\", \"printf 12345\"], cwd: process.cwd(), stdio: { stdin: \"ignore\", stdout: { maxBytes: 1, spill: { maxBytes: 1000 } }, stderr: { maxBytes: 1024 } }, graceMs: 100 }, { spillDir: \"/dev/null\" }); await handle.done; console.log(\"survived\")"

stdout.maxBytes = 1 强制 5 字节输出进入 spill；/dev/null 是文件而不是目录，因此首次创建 spill 文件稳定返回 ENOTDIR。

在 macOS、Node.js v24.14.0 上，实际退出码为 1，survived 没有输出，堆栈为：

Error: ENOTDIR: not a directory, open /dev/null/dsh-subprocess-...-stdout.log
    at openSync (node:fs:560:18)
    at OutputCollector.spillAll (.../spawn.ts:169:22)
    at OutputCollector.push (.../spawn.ts:134:80)
    at Socket.<anonymous> (.../spawn.ts:366:54)

Impact

任意能触发 spill 的长输出命令，都可能在 ENOSPC、EIO、临时目录被删除或权限变化时终止整个 Harness。当前会话、其他并发任务和正常 teardown 会一起中断，子进程树也可能失去 Harness 的收尾。

Suggested fix

在 OutputCollector 内隔离 spill 文件操作。首次 I/O 失败后永久停用该 stream 的 spill，继续维护受 maxBytes 限制的内存尾部；如果文件已经打开，则 best-effort 关闭文件描述符并删除不完整文件，且不发布该路径。

Acceptance criteria

• openSync、补写已有 chunks 或后续 writeSync 失败时，异常不逃出 stdout/stderr 的 data 回调，也不触发宿主 uncaughtException 或非零退出。
• 上述复现中的 await handle.done 正常完成，保留子进程退出码 0；stdout 返回尾部 5、truncated: true，且没有 spillPath。
• spill 失败后不再重复文件操作，内存占用继续受 maxBytes 限制。
• 写入中途失败时，清理不完整文件和 fd；清理自身失败仍不终止宿主。
• stdout 与 stderr 都有聚焦回归测试，至少覆盖创建失败和创建成功后的写入失败。

[LouisDM]

我在当前 master（47f943859bef60e4160492346772ded9b24f765a）上独立复现了这个问题。

环境：

• macOS 26.2，Apple Silicon arm64
• Node.js v26.0.0
• pnpm 11.7.0

使用 Discussion 中的最小复现命令，结果稳定为退出码 1，没有输出 survived；异常链仍是：

openSync → OutputCollector.spillAll → OutputCollector.push → Socket data listener
Error: ENOTDIR: not a directory, open '/dev/null/dsh-subprocess-...-stdout.log'

这补充确认了该故障在 Node 26 上同样存在，并且 spill 创建失败仍会逃出 stream 回调、终止宿主进程。仓库首次基线 pnpm run typecheck 已通过，因此不是本地 checkout 的既有构建故障。

鉴于当前贡献指南暂不接受外部 PR，我没有创建分支或 PR；如果维护者希望外部协助，我可以按这里的验收条件准备最小 RED/GREEN 修复。

[Qshuai0213]

补充一个真实生产环境触发案例（Windows + dsh web GUI）：

环境：Windows 11（2026-08-14 重启过）、Node.js v22.19.0、dsh web（@deepseek-ai/dsh 0.1.0-rc.6，dsh-subprocess-local 0.1.0-rc.6，即 npm 当前最新版）

实际触发路径：不是磁盘写满，而是 Windows 存储感知（Storage Sense）在登录后自动清理 %TEMP%，把 dsh 进程持有的 spill 临时目录（%TEMP%\dsh-subprocess-XXXXXX\，进程内 mkdtemp 创建、存活期间保留）整体删掉。之后任意一次长输出任务首次触发 spill 时，进程直接终止：

Error: ENOENT: no such file or directory, open 'C:\Users\20492\AppData\Local\Temp\dsh-subprocess-XInwNR\dsh-subprocess-2756-1-21134668026f-stdout.log'
    at openSync (node:fs:561:18)
    at OutputCollector.spillAll (.../dsh-subprocess-local/lib/index.js:417:19)
    at OutputCollector.push (.../dsh-subprocess-local/lib/index.js:393:75)
    at Socket.<anonymous> (.../dsh-subprocess-local/lib/index.js:562:14)
    at Pipe.onStreamRead (node:internal/stream_base_commons:189:23)

证据时间线（Windows 事件日志 + 注册表 StoragePoliciesLastTrigger）：

• 12:09 开机（EventLog 6005/6009）
• 12:19:52 存储感知触发清理（策略：开启、每日、清理"应用未使用的临时文件"；dsh 的 spill 目录此时被删除）
• 之后某任务输出溢出 → 首次 spill → ENOENT → 整个 dsh web 进程退出（当时任务输出丢失）
• 重启 dsh web 后新实例自动重建新目录（dsh-subprocess-iO9Bt3），恢复正常

补充观点：在 Windows 上"临时目录被外部删除"不是罕见场景（存储感知、磁盘清理 SilentCleanup、各类第三方清理工具都会做），且发生在进程完全无感知的情况下；这次崩溃的是 GUI 主进程，连带当前会话和其他并发任务一起中断。按本 Discussion 的 Suggested fix 降级（保留受 maxBytes 限制的内存尾部、停用 spill、不发布不完整的 spillPath）即可避免宿主退出。另外建议修复时顺带考虑：privateSpillDir() 是进程级缓存，首次 spill 失败时若能用 mkdtempSync 重新申请一次目录，可进一步提升 Windows 上的健壮性。

本地规避办法（治标）：设置 → 系统 → 存储 → 存储感知，关闭"删除我的应用未使用的临时文件"。

[akslcw]

第三个 Windows 复现确认 + 完整候选补丁。

复现：Windows + Node v22.23.2 + dsh web（dsh 0.1.0-rc.5），与 @Qshuai0213 的场景完全一致——存储感知清理 %TEMP%\dsh-subprocess-* 后，首次 spill 触发 openSync ENOENT，整个 GUI 进程退出（本次为 stderr.log，与 stdout.log 同一收集器，无本质区别）。补充了 rc.5 与 Node 22.23 的覆盖。

补丁要点（按本讨论的 Suggested fix 与验收条件）：

• OutputCollector.spillAll() 把惰性打开、既有 chunk 补写、逐 chunk 追加包进一个 try；任何故障复用 discardSpill()：best-effort 关 fd、unlink 不完整文件、对该流永久停用 spill，内存尾部继续收集。push() 不再抛出 spill 故障，失败路径绝不公布 spillPath。
• 回应 @Qshuai0213 的缓存重建建议：spawnSubprocess 改用 refreshPrivateSpillDir()，缓存目录不存在时为下一次 spawn 重新 mkdtemp 全新随机目录（刻意不原路径重建——目录可能被顶替，随机 'wx' 命名正是为此）。观察到删除的当前 collector 仍按流降级。
• 测试：collector 级真实删除 spill 目录（ENOENT）+ 注入 EIO（创建成功后写入失败，并断言 fd 先关闭、目录为空）；spawn 级 stdout/stderr 各一个 ENOTDIR（spillDir=/dev/null，即本讨论的最小复现）；默认目录在两 spawn 之间被删后，下一次 spawn 重建出不同的 0700 目录并完整落盘 spill。
• 验证：RED→GREEN 通过；typecheck、lint 通过；Windows 手动两阶段验证（降级 + 目录重建）全绿；dsh web 启动冒烟返回 200。

按贡献指南不直接提交 PR。完整 patch（可直接 git apply 或 git am 到 47f9438）：

0001-fix-subprocess-local-contain-spill-I-O-failures-and-recover-the-spill-directory.patch

From: SuX <suxin2377@gmail.com>
Date: Sat, 15 Aug 2026 00:25:56 +0800
Subject: [PATCH] fix(subprocess-local): contain spill I/O failures and recover
 the spill directory

Spill open/write faults (e.g. Storage Sense deleting %TEMP%\dsh-subprocess-*) escaped the stream data listener as an uncaught exception and terminated the harness. Contain them in the collector: discard the incomplete spill and keep the bounded in-memory tail, and recreate the cached private spill directory for later spawns. Regression tests cover directory removal, injected write failure, ENOTDIR for both streams, and directory recreation.
---
 ...ess-spill-io-failure-degradation.i18n.yaml |   6 +
 ...subprocess-spill-io-failure-degradation.md |  38 ++++++
 ...process-spill-io-failure-degradation.zh.md |  38 ++++++
 .../subprocess-local/README.i18n.yaml         |   4 +-
 .../subprocess/subprocess-local/README.md     |   2 +-
 .../subprocess/subprocess-local/README.zh.md  |   2 +-
 .../subprocess/subprocess-local/src/spawn.ts  |  60 ++++++---
 .../subprocess-local/tests/spawn.spec.ts      | 116 +++++++++++++++++-
 8 files changed, 245 insertions(+), 21 deletions(-)
 create mode 100644 .agents/notes/implemented/bug-fix/2026-08-14-subprocess-spill-io-failure-degradation.i18n.yaml
 create mode 100644 .agents/notes/implemented/bug-fix/2026-08-14-subprocess-spill-io-failure-degradation.md
 create mode 100644 .agents/notes/implemented/bug-fix/2026-08-14-subprocess-spill-io-failure-degradation.zh.md

diff --git a/.agents/notes/implemented/bug-fix/2026-08-14-subprocess-spill-io-failure-degradation.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-08-14-subprocess-spill-io-failure-degradation.i18n.yaml
new file mode 100644
index 0000000000..2e9083ab93
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-08-14-subprocess-spill-io-failure-degradation.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-08-14-subprocess-spill-io-failure-degradation.md
+2026-08-14-subprocess-spill-io-failure-degradation.md: 4501652952786e1a8d4208b0e1c8aef33a55303e
+2026-08-14-subprocess-spill-io-failure-degradation.zh.md: a88cb53c251977de2622a86bf53c12db578d3c82
diff --git a/.agents/notes/implemented/bug-fix/2026-08-14-subprocess-spill-io-failure-degradation.md b/.agents/notes/implemented/bug-fix/2026-08-14-subprocess-spill-io-failure-degradation.md
new file mode 100644
index 0000000000..4501652952
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-08-14-subprocess-spill-io-failure-degradation.md
@@ -0,0 +1,38 @@
+# Agent Note: Contain subprocess spill I/O failures and recover the spill directory
+
+Status: implemented
+
+English | [涓枃](2026-08-14-subprocess-spill-io-failure-degradation.zh.md)
+
+## Problem
+
+`OutputCollector.spillAll()` opens and writes the spill file from the stdout/stderr stream `data` listener without containment. Any open or write failure 鈥?a full disk, an I/O fault, or the reported Windows trigger where Storage Sense deletes `%TEMP%\dsh-subprocess-*` while the process still caches the directory 鈥?escapes as an uncaught exception and terminates the whole harness process mid-session (community report: GitHub Discussion #260).
+
+## Decision
+
+`spillAll()` wraps the lazy open, the backfill of already-collected chunks, and the per-chunk append in one try. Any fault calls the existing `discardSpill()`: close the descriptor best-effort, unlink the incomplete file, and disable further spilling for that collector while the in-memory tail keeps collecting. `push()` therefore never throws for a spill fault, so no `data` listener can take the host down, and a failed spill never advertises its path.
+
+`spawnSubprocess()` additionally uses `refreshPrivateSpillDir()`: when the cached process-wide default directory no longer exists, the next spawn `mkdtemp`s a fresh random directory instead of reusing the deleted path, so later spawns keep full-output spilling after an external cleanup. The collector that observed the removal still degrades per stream; recovery applies to later spawns only.
+
+## Alternatives considered
+
+- **Let the exception crash the host.** Rejected: the spill is an auxiliary recovery copy of output whose tail the memory cap already bounds; losing the session and all concurrent work over a temp-file fault is disproportionate.
+- **Contain at the `data` listener attach point.** Rejected: the collector owns the spill state (descriptor, path, disabled flag); containment inside it covers every caller and keeps the disable-and-cleanup invariant next to the state it governs.
+- **Rebuild the deleted spill directory in place, or retry the same path.** Rejected: the removed directory may be replaced by another local user; recreating a path the process no longer owns invites tampering, and random `'wx'` names exist to avoid predictable paths. A fresh `mkdtemp` for the next spawn is the recovery ceiling.
+- **Drop spill files entirely.** Rejected, as before ([drop-bash-output-spill-files](../../rejected/simplification/2026-06-20-drop-bash-output-spill-files.md)): full-output recovery is real bash behavior.
+
+## Consequences
+
+Spill I/O faults no longer terminate the harness; the affected stream settles with its bounded tail, `truncated: true`, and no `spillPath`. Complete-output recovery is lost only for streams whose own spill failed.
+
+Each spawn pays one `existsSync` on the cached default directory; Windows hosts keep spilling across Storage Sense cleanups because the next spawn recreates a fresh private directory.
+
+`discardSpill()` now serves both its original oversize path and the fault path; its contract and the collector class contract state both.
+
+## Testing
+
+Collector regressions stage the real Windows trigger (the spill directory removed before the first spill) and an injected EIO on the first spill write; both assert no throw, a byte-exact tail, no advertised path, and 鈥?observable on Windows 鈥?a closed descriptor and an empty spill directory. POSIX spawn-level tests pin the same containment for stdout and stderr through a spill directory that is not a directory (`/dev/null`, ENOTDIR). A default-directory test deletes the private spill directory between spawns and asserts the next spawn recreates a distinct `0700` directory and spills the full stream.
+
+## Related
+
+The [subprocess seam](../../implemented/architecture/2026-07-26-subprocess-seam.md) note owns the provider/collector split this behavior lives in.
diff --git a/.agents/notes/implemented/bug-fix/2026-08-14-subprocess-spill-io-failure-degradation.zh.md b/.agents/notes/implemented/bug-fix/2026-08-14-subprocess-spill-io-failure-degradation.zh.md
new file mode 100644
index 0000000000..a88cb53c25
--- /dev/null
+++ b/.agents/notes/implemented/bug-fix/2026-08-14-subprocess-spill-io-failure-degradation.zh.md
@@ -0,0 +1,38 @@
+# Agent Note: 閬忓埗 subprocess spill I/O 鏁呴殰骞舵仮澶?spill 鐩綍
+
+Status: implemented
+
+[English](2026-08-14-subprocess-spill-io-failure-degradation.md) | 涓枃
+
+## 闂
+
+`OutputCollector.spillAll()` 鍦?stdout/stderr 娴佺殑 `data` 鐩戝惉鍣ㄥ唴鎵撳紑骞跺啓鍏?spill 鏂囦欢锛屾病鏈変换浣曞紓甯搁殧绂汇€備换浣曟墦寮€鎴栧啓鍏ュけ璐モ€斺€旂鐩樺啓婊°€両/O 鏁呴殰锛屾垨宸叉姤鍛婄殑 Windows 瑙﹀彂鍦烘櫙锛堝瓨鍌ㄦ劅鐭ュ湪杩涚▼浠嶇紦瀛樼洰褰曟椂鍒犻櫎 `%TEMP%\dsh-subprocess-*`锛夆€斺€旈兘浼氫互鏈崟鑾峰紓甯搁€冮€革紝骞跺湪浼氳瘽涓€旂粓姝㈡暣涓?harness 杩涚▼锛堢ぞ鍖烘姤鍛婏細GitHub Discussion #260锛夈€?+
+## 鍐崇瓥
+
+`spillAll()` 鎶婃儼鎬ф墦寮€銆佸宸叉敹闆?chunk 鐨勮ˉ鍐欏拰閫?chunk 杩藉姞鍖呰繘鍚屼竴涓?try銆備换浣曟晠闅滈兘浼氳皟鐢ㄦ棦鏈夌殑 `discardSpill()`锛氬敖鍔涘叧闂枃浠舵弿杩扮銆佸垹闄や笉瀹屾暣鏂囦欢銆佸璇?collector 姘镐箙鍋滅敤鍚庣画 spill锛屽悓鏃跺唴瀛樺熬閮ㄧ户缁敹闆嗐€傚洜姝?`push()` 涓嶄細鍥?spill 鏁呴殰鎶涘嚭寮傚父锛屼换浣?`data` 鐩戝惉鍣ㄩ兘鏃犳硶鎷栧灝瀹夸富锛屽け璐ョ殑 spill 涔熺粷涓嶄細鍏竷鍏惰矾寰勩€?+
+`spawnSubprocess()` 杩樻敼鐢?`refreshPrivateSpillDir()`锛氬綋杩涚▼绾х紦瀛樼殑榛樿鐩綍涓嶅瀛樺湪鏃讹紝涓嬩竴娆?spawn 浼?`mkdtemp` 涓€涓叏鏂扮殑闅忔満鐩綍锛岃€屼笉鏄鐢ㄥ凡鍒犻櫎鐨勮矾寰勶紝鍥犳澶栭儴娓呯悊涔嬪悗锛屽悗缁?spawn 浠嶄繚鐣欏畬鏁磋緭鍑?spill銆傝瀵熷埌鐩綍琚垹鐨勯偅涓?collector 浠嶆寜娴侀檷绾э紱鎭㈠鍙綔鐢ㄤ簬鍚庣画 spawn銆?+
+## 鑰冭檻杩囩殑鏇夸唬鏂规
+
+- **璁╁紓甯哥粓姝㈠涓汇€?* 鍚﹀喅锛歴pill 鍙槸鍐呭瓨涓婇檺宸茬粡绾︽潫浣忓熬閮ㄧ殑杈撳嚭涔嬪鐨勪竴浠借緟鍔╂仮澶嶅壇鏈紱涓轰复鏃舵枃浠舵晠闅滀涪鎺夋暣涓細璇濆拰鎵€鏈夊苟鍙戝伐浣滐紝浠ｄ环涓嶆垚姣斾緥銆?+- **鍦?`data` 鐩戝惉鍣ㄦ寕杞界偣鍋氶殧绂汇€?* 鍚﹀喅锛歝ollector 鎷ユ湁 spill 鐘舵€侊紙鎻忚堪绗︺€佽矾寰勩€佸仠鐢ㄦ爣蹇楋級锛涘湪鍏跺唴閮ㄩ殧绂诲彲瑕嗙洊鎵€鏈夎皟鐢ㄦ柟锛屽苟璁┿€屽仠鐢ㄥ苟娓呯悊銆嶈繖涓€涓嶅彉閲忕揣閭诲畠鎵€娌荤悊鐨勭姸鎬併€?+- **鍘熻矾寰勯噸寤哄凡鍒犻櫎鐨?spill 鐩綍锛屾垨瀵瑰悓涓€璺緞閲嶈瘯銆?* 鍚﹀喅锛氬凡鍒犻櫎鐩綍鍙兘琚叾浠栨湰鍦扮敤鎴烽《鏇匡紱閲嶅缓杩涚▼涓嶅啀鎷ユ湁鐨勮矾寰勪細鎷涜嚧绡℃敼锛岃€岄殢鏈?`'wx'` 鍚嶇О姝ｆ槸涓轰簡閬垮厤鍙娴嬭矾寰勩€備负涓嬩竴娆?spawn 閲嶆柊 `mkdtemp` 灏辨槸鎭㈠涓婇檺銆?+- **褰诲簳绉婚櫎 spill 鏂囦欢銆?* 涓嶽姝ゅ墠鐨勫惁鍐砞(../../rejected/simplification/2026-06-20-drop-bash-output-spill-files.md)涓€鑷达紝鍐嶆鍚﹀喅锛氬畬鏁磋緭鍑烘仮澶嶆槸鐪熷疄鐨?bash 琛屼负銆?+
+## 褰卞搷
+
+spill I/O 鏁呴殰涓嶅啀缁堟 harness锛涘彈褰卞搷鐨勬祦浠ユ湁鐣屽熬閮ㄧ粨绠楋紝`truncated: true` 涓旀棤 `spillPath`銆傚彧鏈夎嚜韬?spill 纭疄澶辫触鐨勬祦鎵嶅け鍘诲畬鏁磋緭鍑烘仮澶嶃€?+
+姣忔 spawn 瀵圭紦瀛樼殑榛樿鐩綍浠樺嚭涓€娆?`existsSync`锛沇indows 瀹夸富鍦ㄥ瓨鍌ㄦ劅鐭ユ竻鐞嗕箣鍚庝粛鑳界户缁?spill锛屽洜涓轰笅涓€娆?spawn 浼氶噸寤哄叏鏂扮殑绉佹湁鐩綍銆?+
+`discardSpill()` 鐜板湪鍚屾椂鏈嶅姟浜庡師鏈夌殑瓒呴檺璺緞涓庢晠闅滆矾寰勶紱鍏跺绾﹀拰 collector 绫诲绾﹂兘鍐欐槑浜嗚繖涓€鐐广€?+
+## 娴嬭瘯
+
+collector 绾у洖褰掓祴璇曞鐜扮湡瀹炵殑 Windows 瑙﹀彂鍦烘櫙锛堥娆?spill 鍓?spill 鐩綍琚Щ闄わ級锛屽苟瀵归娆?spill 鍐欏叆娉ㄥ叆 EIO锛涗袱鑰呴兘鏂█涓嶆姏寮傚父銆佸瓧鑺傜簿纭殑灏鹃儴銆佷笉鍏竷璺緞锛屼互鍙娾€斺€斿湪 Windows 涓婂彲瑙傚療鍒扮殑鈥斺€旀弿杩扮宸插叧闂€乻pill 鐩綍涓虹┖銆侾OSIX spawn 绾ф祴璇曢€氳繃涓€涓€屼笉鏄洰褰曠殑 spill 鐩綍銆嶏紙`/dev/null`锛孍NOTDIR锛変负 stdout 涓?stderr 鍒嗗埆閿佸畾鍚屾牱鐨勯殧绂昏涓恒€傞粯璁ょ洰褰曟祴璇曞湪涓ゆ spawn 涔嬮棿鍒犻櫎绉佹湁 spill 鐩綍锛屽苟鏂█涓嬩竴娆?spawn 閲嶅缓鍑轰笉鍚岀殑 `0700` 鐩綍涓斿畬鏁磋惤鐩?spill銆?+
+## 鐩稿叧
+
+[subprocess seam](../../implemented/architecture/2026-07-26-subprocess-seam.md) 绗旇鎷ユ湁 provider 涓?collector 鐨勬媶鍒嗭紝鏈涓轰綅浜庡叾涓€?diff --git a/packages/subprocess/subprocess-local/README.i18n.yaml b/packages/subprocess/subprocess-local/README.i18n.yaml
index 10c7c1cd62..77ac916e7d 100644
--- a/packages/subprocess/subprocess-local/README.i18n.yaml
+++ b/packages/subprocess/subprocess-local/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/subprocess/subprocess-local/README.md
-README.md: a88eab6776c7259bb8ee8fdad2d6002d8f57e133
-README.zh.md: ce088557875daceb5643f13bef78d6ea9a61e12f
+README.md: e0db35febd6ae6776d344851ab10d2bdaf3805a4
+README.zh.md: 85f555b1b4320bdf176bca8fa1a4663d2529554a
diff --git a/packages/subprocess/subprocess-local/README.md b/packages/subprocess/subprocess-local/README.md
index a88eab6776..e0db35febd 100644
--- a/packages/subprocess/subprocess-local/README.md
+++ b/packages/subprocess/subprocess-local/README.md
@@ -7,7 +7,7 @@ Local Service Provider for the [`@deepseek-ai/dsh-subprocess`](../subprocess/REA
 ## Behavior
 
 - **Detached process trees with platform-correct signalling** 鈥?POSIX children are spawned `detached` (own process group) and signalled by negative pgid with a direct-child fallback; Windows terminates the tree via `taskkill /PID <pid> /T /F`. `terminate()` 鈥?the handle's only termination verb 鈥?sends SIGTERM then SIGKILL after the spec's grace (OpenCode's escalation; pipelines and subshells die with the parent) and is a no-op once the tree is gone; `waitForExit()` polls whole-tree liveness so consumer teardown confirms real quiescence. After the leader exits, still-open pipes receive the same bounded drain grace so a surviving descendant cannot hold the outcome open indefinitely. ESRCH is tolerated; daemons that re-parent away from the group can still survive.
-- **Per-stream dispositions** 鈥?`'pipe'` hands the raw stream to the caller untouched (protocol framing stays consumer-owned); `'inherit'` passes the parent descriptor through; collect mode keeps the in-memory TAIL beyond its cap (errors and results cluster at the end 鈥?pi/OpenCode rationale) while the FULL stream is appended to a private temp file when a spill cap is configured 鈥?omitting `spill` keeps only the tail, the diagnostic shape. A stream larger than the spill cap discards its now-incomplete spill and returns only the marked truncated tail; spill fds are sealed at settlement, and a failed final close withholds the path rather than advertising an incomplete file. Spill files are `0600` with random names under a lazily-created `0700` per-process directory.
+- **Per-stream dispositions** 鈥?`'pipe'` hands the raw stream to the caller untouched (protocol framing stays consumer-owned); `'inherit'` passes the parent descriptor through; collect mode keeps the in-memory TAIL beyond its cap (errors and results cluster at the end 鈥?pi/OpenCode rationale) while the FULL stream is appended to a private temp file when a spill cap is configured 鈥?omitting `spill` keeps only the tail, the diagnostic shape. A stream larger than the spill cap, or a spill whose open or write fails (an external tmp cleaner can remove the private spill directory), discards the now-incomplete spill and returns only the marked truncated tail; spill fds are sealed at settlement, and a failed final close withholds the path rather than advertising an incomplete file. Spill files are `0600` with random names under a lazily-created `0700` per-process directory, recreated through a fresh `mkdtemp` once an external cleaner removes it.
 - **Credential scrub + explicit merge** 鈥?`process.env` minus credential-shaped vars (`*KEY*`/`*PASSWORD*`/`*SECRET*`/`*TOKEN*`) and all ambient `DSH_*` names; the spec's explicit `env` merges after that scrub with no namespace validation, so a deliberately supplied credential or current `DSH_*` fact wins while stale nested-harness identity cannot leak in ambiently. Supplied stdin is written and closed; otherwise fd 0 is `/dev/null`. See the [stdin/env Agent Note](../../../.agents/notes/implemented/architecture/2026-06-30-bash-stdin-env-trusted-plugin-api.md) and [managed environment Agent Note](../../../.agents/notes/implemented/feature/2026-07-10-agent-session-identity-and-log-location.md).
 - **Offset-based reads** 鈥?collect-mode readers return deltas in whole-stream byte coordinates; the service never holds a cursor, so consumer-owned cursors (the bash background read path) and full-stream re-reads coexist, before and after settlement.
 - **Executable lookup** 鈥?`resolveExecutable` checks absolute files or searches the scrubbed effective PATH with platform-aware executable extensions; relative paths containing separators are rejected at the seam, and relative PATH entries resolve from the host process cwd.
diff --git a/packages/subprocess/subprocess-local/README.zh.md b/packages/subprocess/subprocess-local/README.zh.md
index ce08855787..85f555b1b4 100644
--- a/packages/subprocess/subprocess-local/README.zh.md
+++ b/packages/subprocess/subprocess-local/README.zh.md
@@ -7,7 +7,7 @@
 ## 琛屼负
 
 - **浠ラ€傚悎骞冲彴鐨勬柟寮忓彂閫佷俊鍙风殑 detached 杩涚▼鏍?*锛歅OSIX 瀛愯繘绋嬩娇鐢?`detached` spawn锛堟嫢鏈夌嫭绔嬭繘绋嬬粍锛夛紝淇″彿浠ヨ礋 pgid 鍙戦€佸苟浠ョ洿鎺ュ瓙杩涚▼浣滀负鍥為€€锛沇indows 閫氳繃 `taskkill /PID <pid> /T /F` 缁堟杩涚▼鏍戙€俙terminate()`锛堝彞鏌勫敮涓€鐨勭粓姝㈡搷浣滐級鍏堝彂閫?SIGTERM锛岀粡杩?spec 鐨勫闄愭湡鍚庡啀鍙戦€?SIGKILL锛堟部鐢?OpenCode 鐨勫崌绾х瓥鐣ワ紱娴佹按绾夸笌瀛?shell 浼氶殢鐖惰繘绋嬩竴璧风粨鏉燂級锛岃繘绋嬫爲娑堜骸鍚庝负绌烘搷浣滐紱`waitForExit()` 杞鏁存５杩涚▼鏍戠殑瀛樻椿鐘舵€侊紝浣挎秷璐规柟鐨勬媶鍗歌兘纭鐪熸鐨勫畬鍏ㄥ仠绋炽€傜粍闀胯繘绋嬮€€鍑哄悗锛屼粛鐒舵墦寮€鐨勭閬撲篃鍙幏寰楀悓鏍锋湁鐣岀殑鎺掔┖瀹介檺鏈燂紝鍥犳瀛樻椿鐨勫悗浠ｈ繘绋嬫棤娉曟棤闄愭湡鍦版嫋浣忕粨鏋滀笉缁撶畻銆傜郴缁熶細瀹瑰繊 ESRCH锛涢噸鏂版寚瀹氱埗杩涚▼骞惰劚绂昏缁勭殑 daemon 浠嶅彲鑳藉瓨娲汇€?-- **鎸夋祦鍒掑垎鐨勫缃柟寮?*锛歚'pipe'` 鎶婂師濮嬫祦鍘熸牱浜ょ粰璋冪敤鏂癸紙鍗忚鍒嗗抚浠嶅綊娑堣垂鏂规墍鏈夛級锛沗'inherit'` 鐩撮€氱埗杩涚▼鐨勬弿杩扮锛涙敹闆嗘ā寮忥紙collect锛夊湪杈撳嚭瓒呰繃涓婇檺鍚庝簬鍐呭瓨涓繚鐣欏熬閮紙閿欒涓庣粨鏋滈€氬父鑱氶泦鍦ㄦ湯灏撅紝娌跨敤 pi/OpenCode 鐨勭悊鐢憋級锛屽苟鍦ㄩ厤缃簡 spill 涓婇檺鏃舵妸瀹屾暣娴佽拷鍔犲埌涓€涓鏈変复鏃舵枃浠讹紱鐪佺暐 `spill` 鍒欏彧淇濈暀鐢ㄤ簬璇婃柇鐨勫熬閮ㄣ€傛煇鏉℃祦澶т簬 spill 涓婇檺鏃讹紝浼氫涪寮冨凡涓嶅畬鏁寸殑 spill锛屼粎杩斿洖甯︽埅鏂爣璁扮殑灏鹃儴锛泂pill 鏂囦欢鎻忚堪绗﹀湪缁撶畻鏃跺皝瀛橈紝鏈€缁堝叧闂け璐ユ椂鍒欎笉鍏竷璺緞锛屼互鍏嶅０绉板瓨鍦ㄤ笉瀹屾暣鐨勬枃浠躲€俿pill 鏂囦欢鏉冮檺涓?`0600`銆佸悕绉伴殢鏈猴紝浣嶄簬鎸夐渶鍒涘缓銆佹潈闄愪负 `0700` 鐨勬瘡杩涚▼鐩綍涔嬩笅銆?+- **鎸夋祦鍒掑垎鐨勫缃柟寮?*锛歚'pipe'` 鎶婂師濮嬫祦鍘熸牱浜ょ粰璋冪敤鏂癸紙鍗忚鍒嗗抚浠嶅綊娑堣垂鏂规墍鏈夛級锛沗'inherit'` 鐩撮€氱埗杩涚▼鐨勬弿杩扮锛涙敹闆嗘ā寮忥紙collect锛夊湪杈撳嚭瓒呰繃涓婇檺鍚庝簬鍐呭瓨涓繚鐣欏熬閮紙閿欒涓庣粨鏋滈€氬父鑱氶泦鍦ㄦ湯灏撅紝娌跨敤 pi/OpenCode 鐨勭悊鐢憋級锛屽苟鍦ㄩ厤缃簡 spill 涓婇檺鏃舵妸瀹屾暣娴佽拷鍔犲埌涓€涓鏈変复鏃舵枃浠讹紱鐪佺暐 `spill` 鍒欏彧淇濈暀鐢ㄤ簬璇婃柇鐨勫熬閮ㄣ€傛煇鏉℃祦澶т簬 spill 涓婇檺锛屾垨 spill 鎵撳紑锛忓啓鍏ュけ璐ワ紙澶栭儴 tmp 娓呯悊鍣ㄥ彲鑳界Щ闄ょ鏈?spill 鐩綍锛夋椂锛屼細涓㈠純宸蹭笉瀹屾暣鐨?spill锛屼粎杩斿洖甯︽埅鏂爣璁扮殑灏鹃儴锛泂pill 鏂囦欢鎻忚堪绗﹀湪缁撶畻鏃跺皝瀛橈紝鏈€缁堝叧闂け璐ユ椂鍒欎笉鍏竷璺緞锛屼互鍏嶅０绉板瓨鍦ㄤ笉瀹屾暣鐨勬枃浠躲€俿pill 鏂囦欢鏉冮檺涓?`0600`銆佸悕绉伴殢鏈猴紝浣嶄簬鎸夐渶鍒涘缓銆佹潈闄愪负 `0700` 鐨勬瘡杩涚▼鐩綍涔嬩笅锛涜鐩綍琚閮ㄦ竻鐞嗗櫒绉婚櫎鍚庯紝浼氶€氳繃鏂扮殑 `mkdtemp` 閲嶆柊鍒涘缓銆? - **鍑嵁娓呴櫎 + 鏄惧紡鍚堝苟**锛氫互 `process.env` 涓哄熀纭€锛岀Щ闄ゅ舰浼煎嚟鎹殑鍙橀噺锛坄*KEY*`锛廯*PASSWORD*`锛廯*SECRET*`锛廯*TOKEN*`锛夊拰鎵€鏈夌幆澧冧腑宸叉湁鐨?`DSH_*` 鍚嶇О锛泂pec 鐨勬樉寮?`env` 鍦ㄨ娓呴櫎涔嬪悗鍚堝苟涓斾笉鍋氬懡鍚嶇┖闂存牎楠岋紝鍥犳鏈夋剰鎻愪緵鐨勫嚟鎹垨褰撳墠 `DSH_*` 浜嬪疄浼氳儨鍑猴紝鑰岄檲鏃х殑宓屽 harness 韬唤鏃犳硶浠庣幆澧冧腑闅愬紡婕忓叆銆傛彁渚涚殑 stdin 浼氳鍐欏叆鍚庡叧闂紱鍚﹀垯 fd 0 鎸囧悜 `/dev/null`銆傚弬瑙?[stdin/env Agent Note](../../../.agents/notes/implemented/architecture/2026-06-30-bash-stdin-env-trusted-plugin-api.md)涓嶽鍙楃鐜 Agent Note](../../../.agents/notes/implemented/feature/2026-07-10-agent-session-identity-and-log-location.md)銆? - **鍩轰簬鍋忕Щ閲忕殑璇诲彇**锛氭敹闆嗘ā寮忕殑璇诲彇鍣ㄦ寜瀹屾暣娴佺殑瀛楄妭鍧愭爣杩斿洖澧為噺锛涙湇鍔¤嚜韬粠涓嶆寔鏈夋父鏍囷紝鍥犳娑堣垂鏂硅嚜鏈夌殑娓告爣锛坆ash 鐨勫悗鍙拌鍙栬矾寰勶級涓庡畬鏁存祦閲嶈鍙互鍏卞瓨锛岀粨绠楀墠鍚庣殕鐒躲€? - **鍙墽琛屾枃浠舵煡鎵?*锛歚resolveExecutable` 妫€鏌ョ粷瀵规枃浠讹紝鎴栨牴鎹钩鍙板彲鎵ц鏂囦欢鎵╁睍鍚嶅湪娓呯悊鍚庣殑鏈夋晥 PATH 涓悳绱紱鍚垎闅旂鐨勭浉瀵硅矾寰勫湪璇?seam 澶勮鎷掔粷锛岀浉瀵?PATH 鏉＄洰浠庡涓昏繘绋?cwd 瑙ｆ瀽銆?diff --git a/packages/subprocess/subprocess-local/src/spawn.ts b/packages/subprocess/subprocess-local/src/spawn.ts
index 433ba01791..7f93dee3dd 100644
--- a/packages/subprocess/subprocess-local/src/spawn.ts
+++ b/packages/subprocess/subprocess-local/src/spawn.ts
@@ -10,7 +10,7 @@
 import { type ChildProcess, spawn, spawnSync } from 'node:child_process'
 import type { Readable } from 'node:stream'
 import { randomBytes } from 'node:crypto'
-import { closeSync, mkdtempSync, openSync, unlinkSync, writeSync } from 'node:fs'
+import { closeSync, existsSync, mkdtempSync, openSync, unlinkSync, writeSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { setTimeout as sleepMs } from 'node:timers/promises'
@@ -91,12 +91,27 @@ function privateSpillDir(): string {
   return defaultSpillDir
 }
 
+/**
+ * The default spill directory for a new spawn, recreating it when an external
+ * tmp cleaner removed the cached one. The collector that observed the removal
+ * keeps its in-memory tail; this refresh restores spilling for later spawns
+ * with a fresh mkdtemp directory rather than rebuilding the deleted path.
+ */
+function refreshPrivateSpillDir(): string {
+  if (defaultSpillDir !== undefined && !existsSync(defaultSpillDir)) defaultSpillDir = undefined
+  return privateSpillDir()
+}
+
 /**
  * Collects one stream with a bounded in-memory tail. With a spill cap, on
  * first overflow a spill file is created and every chunk (including those
  * already collected) is appended there while the full stream remains within
  * the cap; without one, only the in-memory tail is ever retained (the
- * diagnostic-tail shape 鈥?a language server's stderr).
+ * diagnostic-tail shape 鈥?a language server's stderr). An open or write
+ * failure 鈥?for example an external tmp cleaner removing the private spill
+ * directory 鈥?discards the spill and disables further spilling while the
+ * in-memory tail keeps collecting; auxiliary log writing never fails the
+ * collection.
  *
  * Tail-keep rationale (pi/OpenCode): errors and final results cluster at the
  * end of command output; the spill file covers the head.
@@ -158,21 +173,36 @@ export class OutputCollector {
       this.discardSpill()
       return
     }
-    if (this.spillFd === undefined) {
-      // Random suffix + O_EXCL + no-follow-equivalent ('wx' fails on any
-      // existing path, symlink or not) + owner-only mode: defeats spill-path
-      // prediction and symlink planting in shared tmp dirs.
-      this.spillFile = join(
-        this.spillDir,
-        `dsh-subprocess-${process.pid}-${++spillCounter}-${randomBytes(6).toString('hex')}-${this.label}.log`,
-      )
-      this.spillFd = openSync(this.spillFile, 'wx', 0o600)
-      for (const prior of this.chunks) writeSync(this.spillFd, prior)
+    try {
+      if (this.spillFd === undefined) {
+        // Random suffix + O_EXCL + no-follow-equivalent ('wx' fails on any
+        // existing path, symlink or not) + owner-only mode: defeats spill-path
+        // prediction and symlink planting in shared tmp dirs.
+        this.spillFile = join(
+          this.spillDir,
+          `dsh-subprocess-${process.pid}-${++spillCounter}-${randomBytes(6).toString('hex')}-${this.label}.log`,
+        )
+        this.spillFd = openSync(this.spillFile, 'wx', 0o600)
+        for (const prior of this.chunks) writeSync(this.spillFd, prior)
+      }
+      writeSync(this.spillFd, chunk)
+    } catch {
+      // An external tmp cleaner can delete the private spill directory after
+      // its creation but before the first spill (Windows reports open ENOENT),
+      // and any open or write fault leaves a spill that cannot hold the
+      // complete stream. Discard it 鈥?close and unlink what exists, disable
+      // further spills 鈥?and keep the in-memory tail collecting; this push
+      // runs in a stream 'data' listener, so a spill fault must never become
+      // an uncaught exception that terminates the harness.
+      this.discardSpill()
     }
-    writeSync(this.spillFd, chunk)
   }
 
-  /** Stop spilling and remove the file once it can no longer hold the complete stream. */
+  /**
+   * Abandon the spill: close and remove the spill file, disable further
+   * spilling, and keep the in-memory tail. Used when the stream exceeds the
+   * spill cap and when opening or writing the spill file fails.
+   */
   private discardSpill(): void {
     const fd = this.spillFd
     const file = this.spillFile
@@ -327,7 +357,7 @@ export function spawnSubprocess(spec: SubprocessSpawnSpec, internals: SpawnInter
   if (!Number.isFinite(spec.graceMs) || spec.graceMs <= 0 || spec.graceMs > MAX_TIMER_DELAY_MS) {
     throw new Error(`subprocess graceMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`)
   }
-  const spillDir = internals.spillDir ?? privateSpillDir()
+  const spillDir = internals.spillDir ?? refreshPrivateSpillDir()
   const platform = internals.platform ?? process.platform
   const taskkill = internals.taskkill ?? taskkillProcessTree
   const linuxGroupHasLiveMembers = internals.linuxProcessGroupHasLiveMembers ?? linuxProcessGroupHasLiveMembers
diff --git a/packages/subprocess/subprocess-local/tests/spawn.spec.ts b/packages/subprocess/subprocess-local/tests/spawn.spec.ts
index 1f87fd67cc..e24e1f1bda 100644
--- a/packages/subprocess/subprocess-local/tests/spawn.spec.ts
+++ b/packages/subprocess/subprocess-local/tests/spawn.spec.ts
@@ -1,4 +1,4 @@
-import { mkdtempSync, readFileSync, statSync, unlinkSync } from 'node:fs'
+import { mkdtempSync, readdirSync, readFileSync, rmSync, statSync, unlinkSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { describe, expect, it, vi } from 'vitest'
@@ -11,9 +11,10 @@ import {
 import type { SubprocessHandle, SubprocessOutputReader } from '@deepseek-ai/dsh-subprocess'
 import { MAX_TIMER_DELAY_MS } from '@deepseek-ai/dsh-timeout'
 
-const { failNextClose, failNextUnlink } = vi.hoisted(() => ({
+const { failNextClose, failNextUnlink, failNextWrite } = vi.hoisted(() => ({
   failNextClose: { value: false },
   failNextUnlink: { value: false },
+  failNextWrite: { value: false },
 }))
 vi.mock('node:fs', async (importOriginal) => {
   const actual = await importOriginal<typeof import('node:fs')>()
@@ -33,6 +34,23 @@ vi.mock('node:fs', async (importOriginal) => {
       }
       actual.unlinkSync(path)
     },
+    writeSync(
+      fd: number,
+      data: Buffer | string,
+      offset?: number | null,
+      lengthOrPosition?: number | BufferEncoding | null,
+      position?: number | null,
+    ): number {
+      if (failNextWrite.value) {
+        failNextWrite.value = false
+        throw Object.assign(new Error('simulated EIO on write'), { code: 'EIO' })
+      }
+      const write = actual.writeSync as (
+        fd: number, data: Buffer | string, offset?: number | null,
+        lengthOrPosition?: number | BufferEncoding | null, position?: number | null,
+      ) => number
+      return write(fd, data, offset, lengthOrPosition, position)
+    },
   }
 })
 
@@ -428,6 +446,30 @@ describe('output truncation and spill', () => {
     expect(result.stdout.text).toContain('line-0200')
     expect(result.stdout.spillPath).toBeUndefined()
   })
+
+  it('settles with the tail and no spill path when stdout spill creation fails (ENOTDIR)', async () => {
+    // A spill directory that is a file makes the first open fail; the run
+    // settles on the bounded tail instead of failing the collection.
+    const result = await finish(spawnSubprocess(
+      spec('printf 12345', { stdoutMaxBytes: 1, stderrMaxBytes: 1024 }),
+      { spillDir: '/dev/null' },
+    ))
+    expect(result.exitCode).toBe(0)
+    expect(result.stdout.text).toBe('5')
+    expect(result.stdout.truncated).toBe(true)
+    expect(result.stdout.spillPath).toBeUndefined()
+  })
+
+  it('settles with the tail and no spill path when stderr spill creation fails (ENOTDIR)', async () => {
+    const result = await finish(spawnSubprocess(
+      spec('printf 12345 >&2', { stdoutMaxBytes: 1024, stderrMaxBytes: 1 }),
+      { spillDir: '/dev/null' },
+    ))
+    expect(result.exitCode).toBe(0)
+    expect(result.stderr.text).toBe('5')
+    expect(result.stderr.truncated).toBe(true)
+    expect(result.stderr.spillPath).toBeUndefined()
+  })
 })
 
 describe('OutputCollector', () => {
@@ -529,6 +571,57 @@ describe('OutputCollector', () => {
     expect(collector.finalize().spillPath).toBeUndefined()
     unlinkSync(spillPath)
   })
+
+  it('degrades to the in-memory tail when the spill directory is removed before the first spill', () => {
+    // Windows tmp cleaners can delete the private per-process spill directory
+    // while it is still cached; opening the first spill file then fails with
+    // ENOENT and must not take the harness down.
+    const dir = mkdtempSync(join(tmpdir(), 'dsh-spill-loss-'))
+    try {
+      const collector = new OutputCollector(4, 100, 'dir-loss', dir)
+      collector.push(Buffer.from('aaaa'))
+      rmSync(dir, { recursive: true, force: true }) // the external cleaner removes the directory
+      expect(() => { collector.push(Buffer.from('bbbb')) }).not.toThrow()
+
+      const read = collector.readFrom(0)
+      expect(read.lossy).toBe(true)
+      expect(read.text).toBe('bbbb')
+      expect(read.spillPath).toBeUndefined()
+
+      // Spilling stays disabled for later chunks and the tail keeps collecting.
+      collector.push(Buffer.from('cccc'))
+      const out = collector.finalize()
+      expect(out.text).toBe('cccc')
+      expect(out.truncated).toBe(true)
+      expect(out.spillPath).toBeUndefined()
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it('closes and removes a spill file whose write fails and keeps collecting', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'dsh-spill-write-fail-'))
+    try {
+      const collector = new OutputCollector(4, 100, 'write-fail', dir)
+      collector.push(Buffer.from('aaaa'))
+      failNextWrite.value = true
+      expect(() => { collector.push(Buffer.from('bbbb')) }).not.toThrow()
+      expect(failNextWrite.value).toBe(false)
+
+      // The half-written spill was closed and unlinked, so nothing remains or
+      // is advertised; a close before unlink is observable on Windows, which
+      // refuses to unlink an open file.
+      expect(readdirSync(dir)).toEqual([])
+      collector.push(Buffer.from('cccc'))
+      const out = collector.finalize()
+      expect(out.text).toBe('cccc')
+      expect(out.truncated).toBe(true)
+      expect(out.spillPath).toBeUndefined()
+    } finally {
+      failNextWrite.value = false
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
 })
 
 describe('killGroup', () => {
@@ -951,6 +1044,25 @@ describe('environment and spill-file hardening', () => {
     expect(mode).toBe(0o700)
   })
 
+  it('recreates the private spill directory after an external cleaner removed it', async () => {
+    const first = await finish(spawnSubprocess(
+      spec('for i in $(seq 1 200); do printf "line-%04d\\n" $i; done', { stdoutMaxBytes: 500, stderrMaxBytes: 500 }),
+    ))
+    const firstDir = dirname(first.stdout.spillPath!)
+    rmSync(firstDir, { recursive: true, force: true })
+
+    // The next spawn must not reuse the deleted directory: a fresh mkdtemp
+    // directory restores spilling instead of degrading to the tail only.
+    const second = await finish(spawnSubprocess(
+      spec('for i in $(seq 1 200); do printf "line-%04d\\n" $i; done', { stdoutMaxBytes: 500, stderrMaxBytes: 500 }),
+    ))
+    const secondDir = dirname(second.stdout.spillPath!)
+    expect(secondDir).toMatch(/dsh-subprocess-/)
+    expect(secondDir).not.toBe(firstDir)
+    expect(statSync(secondDir).mode & 0o777).toBe(0o700)
+    expect(second.stdout.spillPath).toBeDefined()
+  })
+
   it('killGroup never throws, even for EPERM-style failures', () => {
     const spy = vi.spyOn(process, 'kill').mockImplementation(() => {
       throw Object.assign(new Error('EPERM'), { code: 'EPERM' })
-- 
2.49.0.windows.1```

</details>

[Electricitysheep]

subprocess spill I/O 失败直接终止整个进程——一个子进程的输出溢出把主进程带崩，这确实该修（spill 失败应该降级成丢弃而不是未捕获异常）。

长任务/大输出的稳定性问题第 6 章有相关讨论：https://github.com/Electricitysheep/dsh-handbook/blob/main/docs/06-advanced.md