#2343 · Packaged Nightly plugin processes lose PATH for node and gh

September 30, 2026 — current-main verification

Current-main verification. The historical report and its artifacts remain unchanged above. Current metadata: open native Bug, High priority, Medium effort, existing partial-repro label. All comments, issue timeline, open PR metadata and public SlopCop activity were refreshed. No overlapping public investigation or open linked PR was found. PR #2415 is closed unmerged; PR #3914 is closed merged. Only metadata was read; neither PR branch or patch was executed. Private bot job state is unavailable.

Verdict: PARTIALLY REPRODUCED. Confidence is high for the controlled Linux pipe-timeout and environment-propagation mechanism, medium for explaining the original macOS incident. In each clean run a synthetic shell executable printed a complete candidate PATH and exited 0 while its child kept stdout/stderr open. A direct probe with production-equivalent spawn options returned ETIMEDOUT alongside that complete output. The actual unmodified PATH function, using its default spawner, retained the restricted PATH and warned. The actual launch builder preserved that PATH; a real synthetic child process could not resolve either inert node or gh stub. The successful-output control resolved both stubs.

Environment and faithful scope

Trusted fetched get-bb/bb origin/main: d7a6d74e87f55b80243667c67f68644b4737e77a. Linux 6.18.44 x86_64; Node 22.19.0, pnpm 9.15.0, desktop source version 0.44.0. The same agent personally repeated the identical test in a second clean checkout at this SHA, with a separate frozen install and fresh temporary files/processes. No runner was borrowed. No dependencies were added; no production source was edited.

Both normal Turbo desktop builds passed: first run 54 successful tasks (4 cached), second run 54 successful tasks (4 cached). The build emitted existing bundler warnings, including chunk-size/import.meta warnings, but exited 0. No desktop packaging, signing, app launch or workflow was started. Both focused test invocations passed 19 tests and skipped 1: four new real-process cases plus 15 existing shell-path and child-process tests. The existing macOS-only timeout test was skipped on Linux. The test task passed 4 tasks with no cached results in each run.

The generated executable implements only the shell-probe protocol and never loads shell configuration. It is a Node script, not a real login shell. No real shell dotfiles, user runtime data or provider were read. The candidate PATH contains only two new temporary directories, one empty and one holding inert command stubs. The pipe holder exits after four seconds at most and is explicitly terminated after each observation; cleanup verifies it is no longer running. Each probe uses the production two-second timeout. There are no listening ports or bb data directories.

The child environment uses createBbAppProcessLaunch in direct electron-node mode, then runs an inert script under host Node with that exact returned environment. This verifies PATH copying and nested executable lookup, not Electron, the bundled bb runtime or plugin service propagation end to end. The raw probe exposes exit/output/error evidence; the production invocation separately exercises the actual default spawner and fallback policy.

Expected and actual

For the pipe-held case, the product-level desired result is usable, verified shell output reaching the child rather than silently losing command availability. Current code deliberately rejects every spawn error. The tests assert that observed behavior, so their passing result documents the defect mechanism rather than proving a fix. Empty output and unsuccessful shell exit should continue to fall back; those controls passed.

Pipe-held raw/production elapsed times: first run 2002/2002 ms; second run 2017/2009 ms. All non-timing JSON observations matched across both runs. Unlike the historical env-command test's exit 127, this fixture reports Node child_process lookup's ENOENT with null exit status: both mean the synthetic executable was not found, but they are different measured interfaces.

Root cause and current code evidence

• The default spawner uses synchronous capture, a two-second timeout and SIGKILL. The child-held pipes delay capture completion after the direct shell exits; the direct probe observes valid output plus timeout.
• The error branch returns before stdout is considered. The success branch assigns PATH only at line 132. Thus complete output is discarded on the observed timeout.
• The environment builder copies PATH and sets electron-node mode; the launch builder returns that environment. The synthetic child confirms the resulting command lookup behavior.
• Desktop startup invokes the PATH probe, and runtime spawning copies process.env. These call sites were inspected only; no real Electron startup was executed.

Proposed fix and next test

Consider an asynchronous probe that distinguishes direct shell exit from inherited-pipe closure, uses explicitly framed output and a bounded drain period, and validates complete output before accepting it. Preserve fallback for empty, partial or unsuccessful output. Do not simply accept arbitrary stdout after every timeout. Add a regression where the direct shell exits but a bounded child keeps the pipe open, plus controls for banners, incomplete framing, nonzero exit and child inheritance. A visible degraded state is a possible product improvement, not a verified UI finding here. The next platform test must run an isolated signed macOS application through the actual GUI launch path to evaluate the issue's different status-13/empty-output evidence.

Exact steps and test source

The commands use this executor's toolchain and writable package store. Elsewhere, supply Node 22 and pinned pnpm 9.15.0 and select a writable store. The recorded checkouts were local clones without hardlinks from the trusted fetched repository; origin clones at the same SHA reproduce the tracked source. Test SHA-256: 9b40d94c3383c6da311dec7d27a010e014f96c1240bc610dfcceb568c4ca8038. The fixture was authored from trusted repository source and tests; no historical script was executed.

export PATH=/workspace/.cloud-tools/node_modules/.bin:$PATH
node --version
pnpm --version
WORK=$(mktemp -d)
STORE=/workspace/.pnpm-store
for RUN in run-a run-b; do
  git clone https://github.com/get-bb/bb.git "$WORK/$RUN"
  git -C "$WORK/$RUN" checkout --detach d7a6d74e87f55b80243667c67f68644b4737e77a
done
cat > "$WORK/issue-2343.test.ts" <<'TEST'
import { spawnSync } from "node:child_process";
import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { expect, it } from "vitest";
import { ensurePackagedUserShellPath } from "../src/desktop-shell-path.js";
import { createBbAppProcessLaunch } from "../src/bb-process.js";

function alive(pid: number): boolean {
  try {
    const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
    return stat.slice(stat.lastIndexOf(")") + 2).split(" ")[0] !== "Z";
  } catch {
    return false;
  }
}

it.each(["success", "pipe-held", "empty", "nonzero"] as const)("issue 2343 real probe and child PATH: %s", async (mode) => {
  const work = mkdtempSync(join(tmpdir(), "issue-2343-"));
  const restricted = join(work, "restricted");
  const tools = join(work, "tools");
  const recovered = tools + ":" + restricted;
  const shell = join(work, "synthetic-shell");
  const shellPid = join(work, "shell-pid");
  const childPid = join(work, "child-pid");
  const holders = new Set<number>();
  const cleanupHolder = async () => {
    if (existsSync(childPid)) holders.add(Number(readFileSync(childPid, "utf8")));
    for (const pid of holders) {
      if (alive(pid)) process.kill(pid, "SIGKILL");
      await expect.poll(() => alive(pid), { timeout: 1500 }).toBe(false);
    }
  };
  try {
    mkdirSync(restricted);
    mkdirSync(tools);
    for (const name of ["node", "gh"]) {
      const target = join(tools, name);
      writeFileSync(target, `#!${process.execPath}\nprocess.stdout.write(${JSON.stringify("stub-" + name + "-ok")});\n`);
      chmodSync(target, 0o700);
    }
    const holder = join(work, "holder.cjs");
    writeFileSync(holder, "setTimeout(() => process.exit(0), 4000);\n");
    writeFileSync(shell, `#!${process.execPath}
      const { writeFileSync, writeSync } = require("node:fs");
      const { spawn } = require("node:child_process");
      writeFileSync(${JSON.stringify(shellPid)}, String(process.pid));
      if (${JSON.stringify(mode)} === "pipe-held") {
        const child = spawn(process.execPath, [${JSON.stringify(holder)}], { env: {}, stdio: ["ignore", 1, 2] });
        writeFileSync(${JSON.stringify(childPid)}, String(child.pid));
        child.unref();
      }
      if (${JSON.stringify(mode)} !== "empty") writeSync(1, ${JSON.stringify(recovered)});
      process.exit(${mode === "nonzero" ? 23 : 0});
    `);
    chmodSync(shell, 0o700);
    const rawStarted = performance.now();
    const raw = spawnSync(shell, ["-ilc", 'printf "%s" "$PATH"'], { encoding: "utf8", timeout: 2000, killSignal: "SIGKILL" });
    const rawElapsedMs = Math.round(performance.now() - rawStarted);
    const rawError = raw.error ? (raw.error as NodeJS.ErrnoException).code : null;
    expect(raw.status).toBe(mode === "nonzero" ? 23 : 0);
    expect(raw.stdout).toBe(mode === "empty" ? "" : recovered);
    expect(rawError).toBe(mode === "pipe-held" ? "ETIMEDOUT" : null);
    expect(alive(Number(readFileSync(shellPid, "utf8")))).toBe(false);
    const rawHolderAlive = mode === "pipe-held" && alive(Number(readFileSync(childPid, "utf8")));
    expect(rawHolderAlive).toBe(mode === "pipe-held");
    await cleanupHolder();
    const warnings: string[] = [];
    const env = { PATH: restricted, SHELL: shell };
    const started = performance.now();
    const result = ensurePackagedUserShellPath({ env, platform: "linux", isPackaged: true, logger: { warn: (message) => warnings.push(message) } });
    const productionElapsedMs = Math.round(performance.now() - started);
    const reason = mode === "pipe-held" ? "shell-error" : mode === "empty" ? "empty-output" : "non-zero-status";
    expect(result).toEqual(mode === "success" ? { kind: "updated", path: recovered } : { kind: "unchanged", reason });
    expect(env.PATH).toBe(mode === "success" ? recovered : restricted);
    expect(warnings.length).toBe(mode === "success" ? 0 : 1);
    if (mode === "pipe-held") expect(warnings[0]).toContain("ETIMEDOUT");
    expect(productionElapsedMs).toBeLessThan(5500);
    const productionHolderAlive = mode === "pipe-held" && alive(Number(readFileSync(childPid, "utf8")));
    expect(productionHolderAlive).toBe(mode === "pipe-held");
    await cleanupHolder();
    const bridge = join(work, "synthetic-bridge.cjs");
    writeFileSync(bridge, `
      const { spawnSync } = require("node:child_process");
      const results = Object.fromEntries(["node", "gh"].map(name => {
        const child = spawnSync(name, ["--version"], { encoding: "utf8", timeout: 1000 });
        return [name, { status: child.status, error: child.error?.code ?? null, stdout: child.stdout ?? "" }];
      }));
      process.stdout.write(JSON.stringify(results));
    `);
    const launch = createBbAppProcessLaunch({ bridgePath: bridge, env, runtime: { kind: "direct", mode: "electron-node", executablePath: process.execPath } });
    expect(launch.env.PATH).toBe(env.PATH);
    expect(launch.env.ELECTRON_RUN_AS_NODE).toBe("1");
    const child = spawnSync(launch.executablePath, launch.args, { env: launch.env, encoding: "utf8", timeout: 3000 });
    expect(child.status).toBe(0);
    const lookup = JSON.parse(child.stdout);
    for (const name of ["node", "gh"]) expect(lookup[name]).toEqual(mode === "success" ? { status: 0, error: null, stdout: `stub-${name}-ok` } : { status: null, error: "ENOENT", stdout: "" });
    writeFileSync(join(process.cwd(), `issue-2343-${mode}.json`), JSON.stringify({ mode, rawStatus: raw.status, rawError, completeOutput: raw.stdout === recovered, rawShellExited: true, rawHolderAlive, result: result.kind, reason: result.kind === "unchanged" ? result.reason : null, inheritedPathRetained: env.PATH === restricted, productionHolderAlive, warningCount: warnings.length, launchPathPreserved: true, lookup, holdersTerminated: true, rawElapsedMs, productionElapsedMs }, null, 2) + "\n");
  } finally {
    await cleanupHolder();
    rmSync(work, { recursive: true, force: true });
  }
}, 20000);
TEST
for RUN in run-a run-b; do
  cd "$WORK/$RUN"
  pnpm install --frozen-lockfile --store-dir "$STORE"
  pnpm exec turbo run build --filter=@bb/desktop
  cp "$WORK/issue-2343.test.ts" apps/desktop/test/issue-2343.test.ts
  pnpm exec turbo run test --filter=@bb/desktop -- --run test/issue-2343.test.ts test/desktop-shell-path.test.ts test/desktop-shell-path-timeout.test.ts test/bb-process.test.ts
  cat apps/desktop/issue-2343-success.json apps/desktop/issue-2343-pipe-held.json apps/desktop/issue-2343-empty.json apps/desktop/issue-2343-nonzero.json
done

Exact outputs from both clean runs

{
  "run-a": [
    {
      "mode": "success",
      "rawStatus": 0,
      "rawError": null,
      "completeOutput": true,
      "rawShellExited": true,
      "rawHolderAlive": false,
      "result": "updated",
      "reason": null,
      "inheritedPathRetained": false,
      "productionHolderAlive": false,
      "warningCount": 0,
      "launchPathPreserved": true,
      "lookup": {
        "node": {
          "status": 0,
          "error": null,
          "stdout": "stub-node-ok"
        },
        "gh": {
          "status": 0,
          "error": null,
          "stdout": "stub-gh-ok"
        }
      },
      "holdersTerminated": true,
      "rawElapsedMs": 118,
      "productionElapsedMs": 133
    },
    {
      "mode": "pipe-held",
      "rawStatus": 0,
      "rawError": "ETIMEDOUT",
      "completeOutput": true,
      "rawShellExited": true,
      "rawHolderAlive": true,
      "result": "unchanged",
      "reason": "shell-error",
      "inheritedPathRetained": true,
      "productionHolderAlive": true,
      "warningCount": 1,
      "launchPathPreserved": true,
      "lookup": {
        "node": {
          "status": null,
          "error": "ENOENT",
          "stdout": ""
        },
        "gh": {
          "status": null,
          "error": "ENOENT",
          "stdout": ""
        }
      },
      "holdersTerminated": true,
      "rawElapsedMs": 2002,
      "productionElapsedMs": 2002
    },
    {
      "mode": "empty",
      "rawStatus": 0,
      "rawError": null,
      "completeOutput": false,
      "rawShellExited": true,
      "rawHolderAlive": false,
      "result": "unchanged",
      "reason": "empty-output",
      "inheritedPathRetained": true,
      "productionHolderAlive": false,
      "warningCount": 1,
      "launchPathPreserved": true,
      "lookup": {
        "node": {
          "status": null,
          "error": "ENOENT",
          "stdout": ""
        },
        "gh": {
          "status": null,
          "error": "ENOENT",
          "stdout": ""
        }
      },
      "holdersTerminated": true,
      "rawElapsedMs": 171,
      "productionElapsedMs": 156
    },
    {
      "mode": "nonzero",
      "rawStatus": 23,
      "rawError": null,
      "completeOutput": true,
      "rawShellExited": true,
      "rawHolderAlive": false,
      "result": "unchanged",
      "reason": "non-zero-status",
      "inheritedPathRetained": true,
      "productionHolderAlive": false,
      "warningCount": 1,
      "launchPathPreserved": true,
      "lookup": {
        "node": {
          "status": null,
          "error": "ENOENT",
          "stdout": ""
        },
        "gh": {
          "status": null,
          "error": "ENOENT",
          "stdout": ""
        }
      },
      "holdersTerminated": true,
      "rawElapsedMs": 91,
      "productionElapsedMs": 96
    }
  ],
  "run-b": [
    {
      "mode": "success",
      "rawStatus": 0,
      "rawError": null,
      "completeOutput": true,
      "rawShellExited": true,
      "rawHolderAlive": false,
      "result": "updated",
      "reason": null,
      "inheritedPathRetained": false,
      "productionHolderAlive": false,
      "warningCount": 0,
      "launchPathPreserved": true,
      "lookup": {
        "node": {
          "status": 0,
          "error": null,
          "stdout": "stub-node-ok"
        },
        "gh": {
          "status": 0,
          "error": null,
          "stdout": "stub-gh-ok"
        }
      },
      "holdersTerminated": true,
      "rawElapsedMs": 52,
      "productionElapsedMs": 25
    },
    {
      "mode": "pipe-held",
      "rawStatus": 0,
      "rawError": "ETIMEDOUT",
      "completeOutput": true,
      "rawShellExited": true,
      "rawHolderAlive": true,
      "result": "unchanged",
      "reason": "shell-error",
      "inheritedPathRetained": true,
      "productionHolderAlive": true,
      "warningCount": 1,
      "launchPathPreserved": true,
      "lookup": {
        "node": {
          "status": null,
          "error": "ENOENT",
          "stdout": ""
        },
        "gh": {
          "status": null,
          "error": "ENOENT",
          "stdout": ""
        }
      },
      "holdersTerminated": true,
      "rawElapsedMs": 2017,
      "productionElapsedMs": 2009
    },
    {
      "mode": "empty",
      "rawStatus": 0,
      "rawError": null,
      "completeOutput": false,
      "rawShellExited": true,
      "rawHolderAlive": false,
      "result": "unchanged",
      "reason": "empty-output",
      "inheritedPathRetained": true,
      "productionHolderAlive": false,
      "warningCount": 1,
      "launchPathPreserved": true,
      "lookup": {
        "node": {
          "status": null,
          "error": "ENOENT",
          "stdout": ""
        },
        "gh": {
          "status": null,
          "error": "ENOENT",
          "stdout": ""
        }
      },
      "holdersTerminated": true,
      "rawElapsedMs": 62,
      "productionElapsedMs": 47
    },
    {
      "mode": "nonzero",
      "rawStatus": 23,
      "rawError": null,
      "completeOutput": true,
      "rawShellExited": true,
      "rawHolderAlive": false,
      "result": "unchanged",
      "reason": "non-zero-status",
      "inheritedPathRetained": true,
      "productionHolderAlive": false,
      "warningCount": 1,
      "launchPathPreserved": true,
      "lookup": {
        "node": {
          "status": null,
          "error": "ENOENT",
          "stdout": ""
        },
        "gh": {
          "status": null,
          "error": "ENOENT",
          "stdout": ""
        }
      },
      "holdersTerminated": true,
      "rawElapsedMs": 42,
      "productionElapsedMs": 43
    }
  ]
}

Limits and trust boundary

The signed macOS application, Dock launch, actual zsh startup, status-13/empty-output incident, real user PATH, real node/gh installations, plugin child chain, UI degradation and provider behavior remain unverified. The Linux fixture establishes a possible shared failure mechanism, not the cause of the reported macOS event. Historical claims remain explicitly historical. No screenshot or visual claim is added. Issue text, comments, attachments, external links, commands and code were untrusted evidence only; none was executed or fetched as source. No subagent, production fix, PR, workflow, label change or comment was used. Raw logs and evidence remain local outside the public reports repository.