fix(#486): refuse claude-code-cli spawn when stdin is not a TTY - #489
Conversation
Claude CLI 2.1.220+ auto-switches to --print mode when stdin is not a
TTY, then errors 'Input must be provided either through stdin or as a
prompt argument when using --print' AND exits with code 0 (upstream
Anthropic bug). anet spawns with { stdio: 'inherit' }, so any headless
caller (CI, systemd, docker run without -it, watchdog, project-up child,
any shell whose stdin is redirected) inherited a non-TTY stdin and hit
this: the agent never came online, and downstream saw a false-success
'Claude Code session pinned:' line because anet's exit handler printed
it unconditionally on any child exit and the parent exited 0.
Fix (agent-network/bin/cli.ts, +47/-5 in the claude-code-cli branch of
launchAgent):
- Pre-spawn: refuse when `!process.stdin.isTTY`; print a targeted
error with the `--tmux` escape hatch and exit 1. Fires before any
claude process is launched, so the operator sees the actual cause
instead of an upstream 'invalid --print args' surface. The narrower
--dangerously-load-development-channels + non-TTY warn a few lines
above (~L4211) still coexists; this new gate is broader and fires
first when it applies.
- child.on('exit'): only print the 'session pinned' / 'session saved'
success line when `(code ?? 0) === 0`. Non-zero exits still call
`process.exit(code)`; a hypothetical clean exit that came out of
an upstream argument-parse path stays silent instead of misleading
scripted callers.
- child.on('error'): was `resolve()` (silent → natural exit 0). Now
`process.exit(1)` so spawn ENOENT surfaces as a real failure.
Regression gate (agent-network/src/claude-code-cli-tty-preflight.test.ts,
+127 new): 7 source-order + substring assertions on cli.ts's
launchAgent body (same pattern as copresence-cli-wiring.test.ts).
Verified locally that all three mutations turn tests red:
- remove the whole preflight block → 2 tests fail
- revert child.on('error') to `resolve()` → 1 test fails
- remove the `code === 0` gate around the success prints → 2 tests fail
Full behavioural verification (real anet + real claude in Docker) needs
a Claude subscription and is left to independent validation, per
verify-with-real-run discipline.
Refs #486
|
Corrigendum: evidence tar.gz sha256 in PR body is stale (79ba4ead… from an earlier re-tar). Current sha256 for the same content: c245ec159b9dbd76d74a523701f5657103a28c2c535ebc2b66ef8c982aed4988. File at /tmp/p486-evidence-20260729T065832Z.tar.gz (3358 bytes). Tar contents unchanged; regenerated with the same 5 files. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 07ed361d4f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| console.error(`[anet] • For headless / CI / systemd / docker without -it:`); | ||
| console.error(`[anet] anet node start ${shellQuote(nodeId)} --tmux`); | ||
| console.error(`[anet] (anet allocates a real PTY inside a tmux session)`); |
There was a problem hiding this comment.
For the headless/CI/systemd cases named here, this escape hatch is not usable: the inspected startCommand --tmux path runs tmux new -As ... without -d and inherits the caller's stdio (cli.ts lines 4469-4482), so it attempts to attach a tmux client to the same non-TTY terminal that triggered this branch and fails instead of starting the node. Point these callers to a detached-session path (or add one) rather than the attached-only --tmux option.
Useful? React with 👍 / 👎.
| // below; treating exit 0 as the only success path also protects | ||
| // against upstream claude bugs that emit an error to stderr but | ||
| // still exit 0 (rare but observed pre-#486 fix). | ||
| if ((code ?? 0) === 0) { |
There was a problem hiding this comment.
When Claude is terminated by a signal, such as the SIGTERM sent by stopNode, the child-process exit callback receives code === null; coalescing that value to zero therefore prints Claude Code session pinned or New Claude Code session saved even though the process did not exit cleanly. This preserves the false-success signal that this gate is intended to remove for fresh or --new-session launches, so the success condition should require an actual zero exit code and account for the callback's signal argument.
Useful? React with 👍 / 👎.
| // HONEST SCOPE NOTE (mirrors copresence-cli-wiring.test.ts): bin/cli.ts | ||
| // is a ~12k-line entrypoint that calls process.exit() and spawns claude; | ||
| // it cannot be imported into a unit test. These are SOURCE-ORDER + | ||
| // SUBSTRING assertions on cli.ts, not behavioural tests. They exist to | ||
| // make a regression in the preflight / exit-code / success-gate turn |
There was a problem hiding this comment.
The added suite explicitly provides only source-order and substring checks and says actual behavior requires Docker E2E, but a repo-wide search for claude-code-cli-tty-preflight and #486 found no accompanying Dockerfile or docs/tests report. Consequently the core non-TTY and exit-code behavior cannot be validated through the repository-mandated Docker test workflow; add an independent Docker suite and save its result before merging.
AGENTS.md reference: AGENTS.md:L7-L9
Useful? React with 👍 / 👎.
…iveness check + non-zero exit Prior candidate (07ed361) told headless callers to use `anet node start --tmux`, but the --tmux path itself required a TTY: `tmux new -As <alias>` + stdio:"inherit" is attached mode. Result in CI/systemd/docker: user follows the hint, tmux quick-fails with "open terminal failed: not a terminal", and because the synchronous spawn + child.on("exit") returned so fast, the parent exited 0. Same "假成功" pattern as the mainline #486 bug, sub-path edition. An error message that leads to a second silent failure is worse than the original problem. Fix (agent-network/bin/cli.ts, +82/-4 in startCommand's --tmux branch): - Bifurcate on process.stdin.isTTY: - TTY present → keep the existing attached foreground shape (`tmux new -As … stdio:"inherit"`); interactive users have relied on this since #122 and setRawMode inside claude still needs the real PTY chain. - TTY absent → detached: spawnSync `tmux new-session -d -A -s <alias> -c <cwd> <inner>` with stdio:["ignore","pipe","pipe"] (captures tmux stderr, does NOT inherit caller's stdin). Bounded 2 s poll with `tmuxSessionRunning(alias)` to prove liveness before reporting success. - Failure propagation on the headless path (three separate exit points): - spawnSync returned non-zero → print tmux stderr, exit with proc.status - spawnSync threw → print message, exit 1 - Session never appeared in 2 s poll → print diagnostic + inspect commands, exit 1 Silent exit 0 on tmux quick-fail is the exact regression this prevents. - On success: print "tmux session started detached" + explicit attach and stop commands, then return. Regression gate (agent-network/src/claude-code-cli-tty-preflight.test.ts, +112 new): 6 additional source-order + substring assertions on startCommand's --tmux branch. Anchored on the unique "// --tmux path:" comment so the older --accept-dev-channels detached-tmux block does not cross-match. Existing 7 tests preserved. Mutation self-check (all three turn RED as expected): 1. Regress stdio to "inherit" on detached spawn → "does NOT inherit stdin" test RED 2. Replace tmuxSessionRunning(alias) with false → "verifies session liveness" test RED 3. Swap every non-zero process.exit in the headless block to exit(0) → "propagates non-zero exit" test RED Restored between mutations; final committed state is baseline (13/13 pass). Behavioural verification of the headless path in Docker (tmux quick-fail is testable without a Claude subscription) is deferred to independent validation, consistent with 07ed361. Refs #486
CR follow-up pushed — new HEAD
|
|
独立复核结论：PASS（第二轮）。合入。 复核经过首轮 NOT PASS —— 复核方按报错文案的指引执行 本轮修法： 我额外做的独立验证复核笔记里三次 mutation 有两次未转红（），与作者「mutation 3/3 转红」的说法不一致。这类不一致不能带着合入，所以我自己拉 PR head 复验：
结论：存活门是真门。 复核方那两次未转红的 mutation 应是命中了别处的 遗留（合入后仍未覆盖）真 Claude 订阅下的端到端 —— 即「修完之后 agent 真的连上中枢」。本 PR 证明的是无 TTY 时明确拒绝、并提供一条真能走通的替代路径，不是「主线端到端已通」。这条边界作者在 PR 里主动声明过，我在此重申，避免后续被误读成「合了就通了」。 |
2 participants
AWAITING INDEPENDENT VALIDATION — do NOT merge without 通信龙 sign
Refs #486
Root cause (verified on this host with claude 2.1.220)
Claude CLI 2.1.220+ auto-switches to
--printmode when its stdin is not a TTY, then errorsInput must be provided either through stdin or as a prompt argument when using --print. anet spawns claude with{ stdio: "inherit" }, so any headless caller (CI, systemd,docker runwithout-it, watchdog, project-up child, any shell whose stdin is redirected) inherits a non-TTY stdin and hits this — the agent never comes online, and downstream sees a false-success "Claude Code session pinned:" line.Direct probe (no claude subscription required) on this host reproduces the exact error signature — see evidence bundle
02-witnessed-red-baseline-probe.log.Fix (agent-network/bin/cli.ts — +47/-5 in the claude-code-cli branch of
launchAgent)Pre-spawn TTY preflight: refuse when
!process.stdin.isTTY; print a targeted error with the--tmuxescape hatch and exit1. Fires before any claude process is launched, so the operator sees the actual cause instead of an upstream--print argssurface. Coexists with the narrower dev-channels-non-TTY warn a few lines above.Success-message gate: only print
Claude Code session pinned:/New Claude Code session saved:when(code ?? 0) === 0. Was unconditional on any child exit → false-success signal for scripted callers.child.on('error') propagation: was
resolve()→ natural exit 0. Nowprocess.exit(1)so spawn ENOENT (missing binary etc.) surfaces as a real failure.Regression gate (agent-network/src/claude-code-cli-tty-preflight.test.ts — NEW +130 lines, 7 tests)
Source-order + substring assertions on cli.ts's
launchAgentbody (same pattern ascopresence-cli-wiring.test.ts). Verified locally that all three intended mutations turn tests red — evidence03-mutation-self-check.log:child.on('error')to silentresolve()code === 0gate around success printsEvidence bundle
/tmp/p486-evidence-20260729T065832Z.tar.gz79ba4eadbfb23f0d905ae798fbb168edc992c22cf697f6039b2cc3367af9b596Provenance manifest highlights
07ed361d…(this PR's tip)$(cd /tmp/anet-486 && git rev-parse HEAD^{tree})git status --porcelain: 0 bytes at push timeANET_*_DISABLE|_MUTATE|_BYPASS): 0 hits in HEAD tree (DI-free, structurally cannot repeat the 9f2ec28 evidence-integrity failure)[[feedback/tmcode//home/vansin— all 0Honest scope note
What THIS PR verifies: source-order structural invariants in cli.ts + upstream claude CLI's failure signature on non-TTY stdin (direct probe on real claude 2.1.220 on this host).
What THIS PR does NOT verify (out of scope; needs claude subscription): end-to-end
anet node startin Docker with real hub + real claude, showing (a) baseline red (pre-fix hangs 120s + false success), (b) fixed behavior (either refuses fast when non-TTY, or the agent truly connects when TTY). The走查 reportdocs/tests/p-v0110-mainline-e2e/covers baseline; independent validator should re-run with the fix applied.Not merged: PR opened for independent validation per brief. 通信龙 routes; do NOT self-merge.