Skip to content

Stale persisted server PIDs are killed without identity verification #31

Description

@TheRealDinghyDog

Server teardown can SIGTERM an unrelated process after PID reuse (M-03)

Surfaced by the gpt-5.6-sol final review.

When a persisted server URL fails a short health check, ensureServer() treats the record as stale and killServerPid() (server-lifecycle.mjs) sends SIGTERM to the stored PID and its process group, with no check of command line, start time, executable, or a plugin-owned nonce. If the original opencode serve exited and the OS reused the PID, an unrelated process (or group) gets killed; a transiently slow health check can also restart a legitimate server.

The branch already added identity verification for background task-worker termination (#13); server termination needs the same protection.

Fix: persist a server instance nonce plus process identity (command signature, start time where available); verify before signalling; group-kill only a verified plugin-owned opencode serve leader; if identity cannot be verified, clear the stale metadata and leave the process alone.

Source: gpt-5.6-sol final review M-03 (opencode-plugin-cc-analysis.md).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions