From 68fefa51cd5a06982b076061d3fd60635820898a Mon Sep 17 00:00:00 2001
From: pander <>
Date: Tue, 12 May 2026 00:09:44 +0800
Subject: [PATCH] fix(tirith): cache OSError spawn failure to suppress repeated
 WARNING spam

When tirith is not installed on Windows but 'tirith' appears in PATH
(e.g. from MSYS/Git Bash), shutil.which() returns a MSYS-style path
(/mingw64/bin/tirith) that exists on disk but cannot be executed by
Windows subprocess.  The OSError was raised on every command without
caching the failure, causing the same WARNING to fire 20+ times per
session.

Fix: mark _resolved_path = _INSTALL_FAILED in the OSError handler so
subsequent check_command_security() calls short-circuit to 'path
unavailable' (one WARNING) instead of retrying the same broken path.

Closes #23845
---
 tools/tirith_security.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/tools/tirith_security.py b/tools/tirith_security.py
index bad94c96f7fad..a290ed1d71b4b 100644
--- a/tools/tirith_security.py
+++ b/tools/tirith_security.py
@@ -646,7 +646,14 @@ def check_command_security(command: str) -> dict:
             timeout=timeout,
         )
     except OSError as exc:
-        # Covers FileNotFoundError, PermissionError, exec format error
+        # Covers FileNotFoundError, PermissionError, exec format error.
+        # On Windows with MSYS/Git Bash in PATH, shutil.which("tirith") may
+        # return a MSYS-style path (/mingw64/bin/tirith) that exists on disk
+        # but cannot be executed by Windows subprocess.  Cache this failure
+        # so we don't retry and re-log on every subsequent command.
+        global _resolved_path, _install_failure_reason
+        _resolved_path = _INSTALL_FAILED
+        _install_failure_reason = "spawn_failed"
         logger.warning("tirith spawn failed: %s", exc)
         if fail_open:
             return {"action": "allow", "findings": [], "summary": f"tirith unavailable: {exc}"}