CodeTerm v1.10.11

Twelve fixes. Every one is a case of CodeTerm reporting something other than what the user asked — and one that had been silently accumulating orphaned processes for a week.

CodeTerm 1.10.11

open_matching_process opened and queried every OpenConsole.exe in the snapshot and propagated failure with ? before testing whether the process was a bundled host, so one inaccessible process aborted the sweep and nothing was terminated. Observed verbatim in a production log:

installer launch cancelled because PTY shutdown failed:
failed to query OpenConsole process 130464 path: Отказано в доступе. (os error 5)

Cleanup also only ran from graceful_shutdown — the update path — so every crash stranded its hosts permanently. 200 orphans across ~97 dead parents had accumulated since 30 August. Adds a startup sweep with HostSelection::Orphaned, selecting hosts whose parent is absent from the same Toolhelp snapshot that produced them, and survives host pid reuse via a second-look confirmation taken once the terminate handle pins the pid.

Tabs were killed for staying silent

Both ack-deadline close sites are gone: CodeTerm never closes a tab because an acknowledgement did not arrive. It delivers a message to the tab and reports to whoever spawned it instead. Deadlines are raised from 30+30s and 60+60s to 120s per phase, derived from 126 Claude and 125 Codex spawn samples (maxima 34s and 38s) against an observed 86s recovery — not chosen by taste.

TabCloseReason was write-only: computed, used for one hidden-tab skip, then discarded. 166 closed records in the production journal carried no reason at all, which is why "why did my terminal die" was unanswerable. Closes now name their seam in the journal and the log.

A send reported success for a delivery that never happened

send_text_when_ready handed the payload to a detached thread and returned Ok(()) before the write was attempted, so /api/tabs/{id}/send answered ok: true for every call. A tab below AgentReady queues forever and each send still reported success — reproduced over the mesh: four sends to a peer tab in pty_reattached all returned ok, none arrived, while a sibling at agent_ready received on the first try.

No heuristic is added. The detached path already called the real send_text, already got a genuine Result, and already separated submit_unconfirmed from a hard failure — it logged that and dropped it. The await returns the answer that was being computed and discarded.

The mesh relay had the matching defect: its ok attested acceptance by the hop, not delivery by the peer, and a deadline inversion (sender 120s, peer loopback 30s, callee readiness 90s) made the innermost hop — the one with zero delivery information — give up first.

Three notices that lied

• "Provider registers no sessions" fired on a working integration. read_installed keys on session_start_hook, which came from a recognizer requiring _source — the field Claude Code's serializer drops whenever it rewrites settings.json. Measured against the real file: both flags flip false → true.
• A superseded worker was refused with worker_ack_no_live_attempt, the same text a stray shell gets, so it retried and burned turns. It now gets worker_ack_attempt_superseded naming the tab that holds the task.
• Codex usage misfiled a per-model weekly reading as the account-wide figure: 0.153.0 moved the model name to its own header two lines above the gauge rows, and the parser's one-line lookback lost it.

Also

• Codex declares xhigh; hook content is instance-agnostic so dev and prod write identical bytes and cannot disarm each other's trust; ensureIntegrationOnStartup refreshes a stale owned hook instead of being a stub.
• Codex session detection reads session_index.jsonl and consults thread_history_1.sqlite, returning null when no trustworthy cwd exists rather than binding a foreign project's session.
• A hot-reloaded plugin rebuilds its open view; one slow plugin call no longer holds the shared VM.
• The secrets panel stopped issuing calls faster than they complete — apiBaseOf returned a fresh headers object every render, so the polling effect re-fired per render.
• A verification run no longer leaks ConPTY hosts into the user's install (measured 0 → 0 against a baseline of 3 per run).

Verification

build.sh verify exit 0. 40+ focused regressions across the sweep, close attribution, ack deadlines, delivery classification, plugin VM isolation, session detection and usage parsing. The orphan sweep — new code that terminates processes — passed an adversarial review against PID reuse, mid-sweep parent exit, shared install directories and a sweep racing an update staging, with the release held pending that verdict.

Licensed under PolyForm Shield 1.0.0 from 2026-10-16