From 97715565e4319bc3b4c1de9cdc91db5b544b3d28 Mon Sep 17 00:00:00 2001
From: wenshao <shaojin.wensj@alibaba-inc.com>
Date: Sun, 9 Aug 2026 19:34:17 +0800
Subject: [PATCH 1/7] fix(test): stop background-shell tests sharing a fixed
 /tmp sidecar path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`makeEntry` defaulted to `outputPath: '/tmp/s1.output'`, so every entry in
this file — across tests, across workers, across CI jobs on the same host —
mirrored its status sidecar to the single path `/tmp/s1.status`.

`/tmp` carries the sticky bit. Once that file belongs to another uid, the
atomic rename in `atomicWriteFileSync` fails EPERM, and
`renameWithRetrySync` burns its full 50+100+200ms backoff before the
registry swallows the error. Every register/complete then costs ~350ms and
the sidecar never lands.

That is what the loop tests were paying: the retention-cap cases do 68
register/complete calls, and CI measured 23.8s each. The durations across
the whole file were exact multiples of 351ms — 352 / 703 / 1405 / 2113 /
3520 — with no variance, which is the backoff sum, not disk latency.

Give each entry its own temp directory instead. The shared path is gone,
the rename succeeds, and the file drops from 128.9s to 3.2s locally with
`/tmp/s1.status` made immutable to reproduce the CI condition.

#8797 raised these four cases to a 120s timeout to survive the cost. With
the cost removed the band-aid goes too, so a future regression fails loudly
instead of silently taking two minutes.
---
 .../services/backgroundShellRegistry.test.ts  | 161 ++++++++----------
 1 file changed, 75 insertions(+), 86 deletions(-)

diff --git a/packages/core/src/services/backgroundShellRegistry.test.ts b/packages/core/src/services/backgroundShellRegistry.test.ts
index a462c0fa918..1c0fa45052d 100644
--- a/packages/core/src/services/backgroundShellRegistry.test.ts
+++ b/packages/core/src/services/backgroundShellRegistry.test.ts
@@ -54,15 +54,26 @@ function makeTempDir(): string {
 function makeEntry(
   overrides: Partial<ShellTaskRegistration> = {},
 ): ShellTaskRegistration {
+  const shellId = overrides.shellId ?? 's1';
   return {
-    shellId: 's1',
+    shellId,
     command: 'sleep 60',
     cwd: '/tmp',
     status: 'running',
     startTime: 1000,
-    outputPath: '/tmp/s1.output',
     abortController: new AbortController(),
     ...overrides,
+    // Every register/complete/fail/cancel mirrors the entry into a
+    // `<outputPath>.status` sidecar, so the default outputPath decides where
+    // that write lands. A fixed `/tmp/s1.output` pointed every entry in this
+    // file — across tests, across workers, across CI jobs — at the single
+    // path `/tmp/s1.status`. `/tmp` is sticky, so once that file belongs to
+    // another uid the atomic rename fails EPERM, and `renameWithRetrySync`
+    // burns its full 50+100+200ms backoff before the registry swallows the
+    // error. Give each entry its own directory instead: no shared state, and
+    // the sidecar write actually succeeds.
+    outputPath:
+      overrides.outputPath ?? join(makeTempDir(), `shell-${shellId}.output`),
   };
 }
 
@@ -669,95 +680,73 @@ describe('BackgroundShellRegistry', () => {
     });
   });
 
-  // Every register/complete in these loop tests also writes the status
-  // sidecar through atomicWriteFileSync, and a loaded CI runner has been
-  // measured spending ~700ms per sidecar write — ~50s for the ~70 writes
-  // of the longest loop, past the 15s default. The explicit timeout buys
-  // the I/O the time it costs; the assertions are unchanged.
-  const SIDECAR_IO_TIMEOUT = 120_000;
   describe('terminal-entry retention cap', () => {
-    it(
-      'retains only a bounded number of terminal entries (oldest by endTime evicted)',
-      () => {
-        const reg = new BackgroundShellRegistry();
-        // Register and complete one more entry than the cap allows. Use
-        // strictly increasing endTimes so eviction order is deterministic.
-        for (let i = 0; i < MAX_RETAINED_TERMINAL_SHELLS + 2; i++) {
-          reg.register(makeEntry({ shellId: `s-${i}`, startTime: i * 10 }));
-          reg.complete(`s-${i}`, 0, i * 10 + 5);
-        }
-        expect(reg.getAll()).toHaveLength(MAX_RETAINED_TERMINAL_SHELLS);
-        // The two oldest (`s-0`, `s-1`) get pruned; the newest survives.
-        expect(reg.get('s-0')).toBeUndefined();
-        expect(reg.get('s-1')).toBeUndefined();
-        expect(reg.get(`s-${MAX_RETAINED_TERMINAL_SHELLS + 1}`)).toBeDefined();
-      },
-      SIDECAR_IO_TIMEOUT,
-    );
-
-    it(
-      'never evicts running entries even when the cap is exceeded',
-      () => {
-        const reg = new BackgroundShellRegistry();
-        // Register one extra terminal entry beyond the cap, then a single
-        // running entry. The running entry must be retained regardless of
-        // its launch order — pruning a still-running shell would lose the
-        // user's only handle on a live process.
-        reg.register(makeEntry({ shellId: 'live', startTime: 1 }));
-        for (let i = 0; i < MAX_RETAINED_TERMINAL_SHELLS + 1; i++) {
-          reg.register(
-            makeEntry({ shellId: `done-${i}`, startTime: 100 + i * 10 }),
-          );
-          reg.complete(`done-${i}`, 0, 100 + i * 10 + 5);
-        }
-        // Cap-of-32 terminals + 1 running survivor = 33 entries kept.
-        expect(reg.getAll()).toHaveLength(MAX_RETAINED_TERMINAL_SHELLS + 1);
-        expect(reg.get('live')?.status).toBe('running');
-        // The oldest terminal entry (lowest endTime) is the one evicted.
-        expect(reg.get('done-0')).toBeUndefined();
-      },
-      SIDECAR_IO_TIMEOUT,
-    );
+    it('retains only a bounded number of terminal entries (oldest by endTime evicted)', () => {
+      const reg = new BackgroundShellRegistry();
+      // Register and complete one more entry than the cap allows. Use
+      // strictly increasing endTimes so eviction order is deterministic.
+      for (let i = 0; i < MAX_RETAINED_TERMINAL_SHELLS + 2; i++) {
+        reg.register(makeEntry({ shellId: `s-${i}`, startTime: i * 10 }));
+        reg.complete(`s-${i}`, 0, i * 10 + 5);
+      }
+      expect(reg.getAll()).toHaveLength(MAX_RETAINED_TERMINAL_SHELLS);
+      // The two oldest (`s-0`, `s-1`) get pruned; the newest survives.
+      expect(reg.get('s-0')).toBeUndefined();
+      expect(reg.get('s-1')).toBeUndefined();
+      expect(reg.get(`s-${MAX_RETAINED_TERMINAL_SHELLS + 1}`)).toBeDefined();
+    });
 
-    it(
-      'prunes after fail() too, not just complete()',
-      () => {
-        const reg = new BackgroundShellRegistry();
-        for (let i = 0; i < MAX_RETAINED_TERMINAL_SHELLS; i++) {
-          reg.register(makeEntry({ shellId: `done-${i}`, startTime: i * 10 }));
-          reg.complete(`done-${i}`, 0, i * 10 + 5);
-        }
-        const overflowStart = MAX_RETAINED_TERMINAL_SHELLS * 10 + 100;
+    it('never evicts running entries even when the cap is exceeded', () => {
+      const reg = new BackgroundShellRegistry();
+      // Register one extra terminal entry beyond the cap, then a single
+      // running entry. The running entry must be retained regardless of
+      // its launch order — pruning a still-running shell would lose the
+      // user's only handle on a live process.
+      reg.register(makeEntry({ shellId: 'live', startTime: 1 }));
+      for (let i = 0; i < MAX_RETAINED_TERMINAL_SHELLS + 1; i++) {
         reg.register(
-          makeEntry({ shellId: 'overflow', startTime: overflowStart }),
+          makeEntry({ shellId: `done-${i}`, startTime: 100 + i * 10 }),
         );
-        reg.fail('overflow', 'boom', overflowStart + 5);
-        expect(reg.getAll()).toHaveLength(MAX_RETAINED_TERMINAL_SHELLS);
-        expect(reg.get('done-0')).toBeUndefined();
-        expect(reg.get('overflow')?.status).toBe('failed');
-      },
-      SIDECAR_IO_TIMEOUT,
-    );
+        reg.complete(`done-${i}`, 0, 100 + i * 10 + 5);
+      }
+      // Cap-of-32 terminals + 1 running survivor = 33 entries kept.
+      expect(reg.getAll()).toHaveLength(MAX_RETAINED_TERMINAL_SHELLS + 1);
+      expect(reg.get('live')?.status).toBe('running');
+      // The oldest terminal entry (lowest endTime) is the one evicted.
+      expect(reg.get('done-0')).toBeUndefined();
+    });
 
-    it(
-      'prunes after cancel() too, not just complete()',
-      () => {
-        const reg = new BackgroundShellRegistry();
-        for (let i = 0; i < MAX_RETAINED_TERMINAL_SHELLS; i++) {
-          reg.register(makeEntry({ shellId: `done-${i}`, startTime: i * 10 }));
-          reg.complete(`done-${i}`, 0, i * 10 + 5);
-        }
-        const overflowStart = MAX_RETAINED_TERMINAL_SHELLS * 10 + 100;
-        reg.register(
-          makeEntry({ shellId: 'overflow', startTime: overflowStart }),
-        );
-        reg.cancel('overflow', overflowStart + 5);
-        expect(reg.getAll()).toHaveLength(MAX_RETAINED_TERMINAL_SHELLS);
-        expect(reg.get('done-0')).toBeUndefined();
-        expect(reg.get('overflow')?.status).toBe('cancelled');
-      },
-      SIDECAR_IO_TIMEOUT,
-    );
+    it('prunes after fail() too, not just complete()', () => {
+      const reg = new BackgroundShellRegistry();
+      for (let i = 0; i < MAX_RETAINED_TERMINAL_SHELLS; i++) {
+        reg.register(makeEntry({ shellId: `done-${i}`, startTime: i * 10 }));
+        reg.complete(`done-${i}`, 0, i * 10 + 5);
+      }
+      const overflowStart = MAX_RETAINED_TERMINAL_SHELLS * 10 + 100;
+      reg.register(
+        makeEntry({ shellId: 'overflow', startTime: overflowStart }),
+      );
+      reg.fail('overflow', 'boom', overflowStart + 5);
+      expect(reg.getAll()).toHaveLength(MAX_RETAINED_TERMINAL_SHELLS);
+      expect(reg.get('done-0')).toBeUndefined();
+      expect(reg.get('overflow')?.status).toBe('failed');
+    });
+
+    it('prunes after cancel() too, not just complete()', () => {
+      const reg = new BackgroundShellRegistry();
+      for (let i = 0; i < MAX_RETAINED_TERMINAL_SHELLS; i++) {
+        reg.register(makeEntry({ shellId: `done-${i}`, startTime: i * 10 }));
+        reg.complete(`done-${i}`, 0, i * 10 + 5);
+      }
+      const overflowStart = MAX_RETAINED_TERMINAL_SHELLS * 10 + 100;
+      reg.register(
+        makeEntry({ shellId: 'overflow', startTime: overflowStart }),
+      );
+      reg.cancel('overflow', overflowStart + 5);
+      expect(reg.getAll()).toHaveLength(MAX_RETAINED_TERMINAL_SHELLS);
+      expect(reg.get('done-0')).toBeUndefined();
+      expect(reg.get('overflow')?.status).toBe('cancelled');
+    });
   });
 
   describe('cancel', () => {

From cc588b2f6f0f596dd7008a8ed398cb86e6634262 Mon Sep 17 00:00:00 2001
From: wenshao <shaojin.wensj@alibaba-inc.com>
Date: Sun, 9 Aug 2026 14:13:47 +0000
Subject: [PATCH 2/7] fix(test): unify sidecar test helpers and pin per-entry
 outputPath uniqueness

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
---
 .../services/backgroundShellRegistry.test.ts  | 26 +++++++------------
 1 file changed, 10 insertions(+), 16 deletions(-)

diff --git a/packages/core/src/services/backgroundShellRegistry.test.ts b/packages/core/src/services/backgroundShellRegistry.test.ts
index 1c0fa45052d..03f0e5bffff 100644
--- a/packages/core/src/services/backgroundShellRegistry.test.ts
+++ b/packages/core/src/services/backgroundShellRegistry.test.ts
@@ -78,6 +78,10 @@ function makeEntry(
 }
 
 describe('BackgroundShellRegistry', () => {
+  it('gives each entry a unique default outputPath', () => {
+    expect(makeEntry().outputPath).not.toBe(makeEntry().outputPath);
+  });
+
   describe('register / get / getAll', () => {
     it('captures the Todo work-chain owner at registration', () => {
       const reg = new BackgroundShellRegistry();
@@ -334,7 +338,7 @@ describe('BackgroundShellRegistry', () => {
           shellId: 'a&b',
           command: 'echo "<script>"',
           cwd: '/repo&work',
-          outputPath: '/tmp/out&err.log',
+          outputPath: join(makeTempDir(), 'out&err.log'),
         }),
       );
 
@@ -348,9 +352,7 @@ describe('BackgroundShellRegistry', () => {
       );
       expect(modelText).toContain('<cwd>/repo&amp;work</cwd>');
       expect(modelText).toContain('<result>bad &lt;thing&gt;[31m</result>');
-      expect(modelText).toContain(
-        '<output-file>/tmp/out&amp;err.log</output-file>',
-      );
+      expect(modelText).toContain('out&amp;err.log</output-file>');
     });
 
     it('limits output-tail to the retained byte budget', () => {
@@ -406,7 +408,7 @@ describe('BackgroundShellRegistry', () => {
         makeEntry({
           shellId: 'a',
           cwd: '/repo\x01\x02/work',
-          outputPath: '/tmp/out\x03.log',
+          outputPath: join(makeTempDir(), 'out\x03.log'),
         }),
       );
 
@@ -414,7 +416,7 @@ describe('BackgroundShellRegistry', () => {
 
       const [, modelText] = callback.mock.calls[0];
       expect(modelText).toContain('<cwd>/repo/work</cwd>');
-      expect(modelText).toContain('<output-file>/tmp/out.log</output-file>');
+      expect(modelText).toContain('out.log</output-file>');
       expect(modelText).not.toContain('\x01');
       expect(modelText).not.toContain('\x02');
       expect(modelText).not.toContain('\x03');
@@ -782,16 +784,8 @@ describe('BackgroundShellRegistry', () => {
     function makeDirEntry(
       overrides: Partial<ShellTaskRegistration> = {},
     ): ShellTaskRegistration & { statusPath: string } {
-      const dir = makeTempDir();
-      const shellId = (overrides.shellId as string) ?? 's1';
-      const entry = makeEntry({
-        outputPath: join(dir, `shell-${shellId}.output`),
-        ...overrides,
-      });
-      return {
-        ...entry,
-        statusPath: join(dir, `shell-${shellId}.status`),
-      };
+      const entry = makeEntry(overrides);
+      return { ...entry, statusPath: statusFilePathFor(entry.outputPath) };
     }
 
     function readStatus(statusPath: string): Record<string, unknown> {

From 9158922b37fcc07f91f5ed336c62f337893d909e Mon Sep 17 00:00:00 2001
From: wenshao <shaojin.wensj@alibaba-inc.com>
Date: Sun, 9 Aug 2026 23:43:43 +0800
Subject: [PATCH 3/7] test: assert the whole output-file element, not just its
 tail

Unifying the sidecar helpers moved these two entries onto random temp
directories, and the assertions were relaxed to a suffix match to cope.
Rebuild the expected element from the path under test instead: the temp
prefix is random, but the escaping and control-byte stripping these two
cases exist to pin are exact.
---
 .../services/backgroundShellRegistry.test.ts   | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/packages/core/src/services/backgroundShellRegistry.test.ts b/packages/core/src/services/backgroundShellRegistry.test.ts
index 03f0e5bffff..0b06a0acb5d 100644
--- a/packages/core/src/services/backgroundShellRegistry.test.ts
+++ b/packages/core/src/services/backgroundShellRegistry.test.ts
@@ -333,12 +333,13 @@ describe('BackgroundShellRegistry', () => {
       const reg = new BackgroundShellRegistry();
       const callback = vi.fn();
       reg.setNotificationCallback(callback);
+      const outputPath = join(makeTempDir(), 'out&err.log');
       reg.register(
         makeEntry({
           shellId: 'a&b',
           command: 'echo "<script>"',
           cwd: '/repo&work',
-          outputPath: join(makeTempDir(), 'out&err.log'),
+          outputPath,
         }),
       );
 
@@ -352,7 +353,11 @@ describe('BackgroundShellRegistry', () => {
       );
       expect(modelText).toContain('<cwd>/repo&amp;work</cwd>');
       expect(modelText).toContain('<result>bad &lt;thing&gt;[31m</result>');
-      expect(modelText).toContain('out&amp;err.log</output-file>');
+      // Assert the whole element, not just the tail: the temp prefix is
+      // random but the escaping is what this test is about.
+      expect(modelText).toContain(
+        `<output-file>${outputPath.replaceAll('&', '&amp;')}</output-file>`,
+      );
     });
 
     it('limits output-tail to the retained byte budget', () => {
@@ -404,11 +409,12 @@ describe('BackgroundShellRegistry', () => {
       const reg = new BackgroundShellRegistry();
       const callback = vi.fn();
       reg.setNotificationCallback(callback);
+      const dir = makeTempDir();
       reg.register(
         makeEntry({
           shellId: 'a',
           cwd: '/repo\x01\x02/work',
-          outputPath: join(makeTempDir(), 'out\x03.log'),
+          outputPath: join(dir, 'out\x03.log'),
         }),
       );
 
@@ -416,7 +422,11 @@ describe('BackgroundShellRegistry', () => {
 
       const [, modelText] = callback.mock.calls[0];
       expect(modelText).toContain('<cwd>/repo/work</cwd>');
-      expect(modelText).toContain('out.log</output-file>');
+      // Whole element: pins that only the control byte is stripped and the
+      // rest of the path survives intact.
+      expect(modelText).toContain(
+        `<output-file>${join(dir, 'out.log')}</output-file>`,
+      );
       expect(modelText).not.toContain('\x01');
       expect(modelText).not.toContain('\x02');
       expect(modelText).not.toContain('\x03');

From 5549db234855524b9d0f7169957bca3deb7f5738 Mon Sep 17 00:00:00 2001
From: wenshao <shaojin.wensj@alibaba-inc.com>
Date: Mon, 10 Aug 2026 01:00:34 +0800
Subject: [PATCH 4/7] test: escape expected XML paths the way the registry does
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The anchored `<output-file>` assertions built their expected value by hand —
one replaced `&` only, the other nothing at all. `tmpdir()` may legally
contain XML metacharacters (`&` on Windows, `<` on POSIX), so those cases
became environment-dependent the moment they moved off the fixed `/tmp`
path.

Run the expected path through the same `escapeXml(stripDisplayControlChars())`
the registry uses. Verified with `TMPDIR=/tmp/qwen-xml-probe/a&b<c`: the
helper passes all three focused cases, while the hand-rolled version fails
two.
---
 .../services/backgroundShellRegistry.test.ts   | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/packages/core/src/services/backgroundShellRegistry.test.ts b/packages/core/src/services/backgroundShellRegistry.test.ts
index 0b06a0acb5d..c68378c6021 100644
--- a/packages/core/src/services/backgroundShellRegistry.test.ts
+++ b/packages/core/src/services/backgroundShellRegistry.test.ts
@@ -27,6 +27,18 @@ import {
   type ShellTaskRegistration,
 } from './backgroundShellRegistry.js';
 import { todoWorkChainContext } from '../utils/promptIdContext.js';
+import { escapeXml } from '../utils/xml.js';
+import { stripDisplayControlChars } from '../utils/terminalSafe.js';
+
+/**
+ * Mirror of how the registry renders a path into the notification XML. The
+ * expected paths below are built from `tmpdir()`, which can legally contain
+ * XML metacharacters (`&` on Windows, `<` on POSIX), so hand-rolling the
+ * escaping here would make these cases depend on the host's TMPDIR.
+ */
+function expectedOutputFileElement(path: string): string {
+  return `<output-file>${escapeXml(stripDisplayControlChars(path))}</output-file>`;
+}
 
 let tmpDirs: string[] = [];
 
@@ -355,9 +367,7 @@ describe('BackgroundShellRegistry', () => {
       expect(modelText).toContain('<result>bad &lt;thing&gt;[31m</result>');
       // Assert the whole element, not just the tail: the temp prefix is
       // random but the escaping is what this test is about.
-      expect(modelText).toContain(
-        `<output-file>${outputPath.replaceAll('&', '&amp;')}</output-file>`,
-      );
+      expect(modelText).toContain(expectedOutputFileElement(outputPath));
     });
 
     it('limits output-tail to the retained byte budget', () => {
@@ -425,7 +435,7 @@ describe('BackgroundShellRegistry', () => {
       // Whole element: pins that only the control byte is stripped and the
       // rest of the path survives intact.
       expect(modelText).toContain(
-        `<output-file>${join(dir, 'out.log')}</output-file>`,
+        expectedOutputFileElement(join(dir, 'out.log')),
       );
       expect(modelText).not.toContain('\x01');
       expect(modelText).not.toContain('\x02');

From d90e42ec2875aff12a486ea22c98943f76d17cfc Mon Sep 17 00:00:00 2001
From: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>
Date: Sun, 9 Aug 2026 18:33:43 +0000
Subject: [PATCH 5/7] test: escape last dynamic output-file expectation, stop
 sidecar leak

The escape conversion in 5549db2348 covered two of the three dynamic
<output-file> expectations; `emits one task-notification when a shell
completes` still interpolated the temp path raw, so a TMPDIR containing
XML metacharacters (legal on POSIX and Windows) failed it. Route it
through the same expectedOutputFileElement helper.

Also remove the `<dir>.status` sidecar the directory-outputPath test
leaks next to its temp dir on every run; afterEach only tracks the dir.
---
 packages/core/src/services/backgroundShellRegistry.test.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/packages/core/src/services/backgroundShellRegistry.test.ts b/packages/core/src/services/backgroundShellRegistry.test.ts
index c68378c6021..7a6eddf54e6 100644
--- a/packages/core/src/services/backgroundShellRegistry.test.ts
+++ b/packages/core/src/services/backgroundShellRegistry.test.ts
@@ -309,7 +309,7 @@ describe('BackgroundShellRegistry', () => {
       expect(modelText).toContain(
         '<output-tail truncated="false">first line\nfinal result</output-tail>',
       );
-      expect(modelText).toContain(`<output-file>${outputPath}</output-file>`);
+      expect(modelText).toContain(expectedOutputFileElement(outputPath));
       expect(meta).toEqual({
         shellId: 'a',
         status: 'completed',
@@ -498,6 +498,9 @@ describe('BackgroundShellRegistry', () => {
       expect(callback).toHaveBeenCalledTimes(1);
       const [, modelText] = callback.mock.calls[0];
       expect(modelText).not.toContain('<output-tail');
+      // register/complete also mirrored a `<dir>.status` sidecar next to
+      // the temp dir, and afterEach only tracks the dir itself.
+      rmSync(statusFilePathFor(dir), { force: true });
     });
 
     it('skips output-tail when the output file is empty (stat.size === 0)', () => {

From 66c20d806a83890821f566ba8fdaeccaa046e099 Mon Sep 17 00:00:00 2001
From: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>
Date: Mon, 10 Aug 2026 00:03:52 +0000
Subject: [PATCH 6/7] test(core): clean the dir-outputPath sidecar in
 afterEach, not after assertions (#8813)

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
---
 .../src/services/backgroundShellRegistry.test.ts     | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/packages/core/src/services/backgroundShellRegistry.test.ts b/packages/core/src/services/backgroundShellRegistry.test.ts
index 7a6eddf54e6..0739fc4beb8 100644
--- a/packages/core/src/services/backgroundShellRegistry.test.ts
+++ b/packages/core/src/services/backgroundShellRegistry.test.ts
@@ -41,12 +41,17 @@ function expectedOutputFileElement(path: string): string {
 }
 
 let tmpDirs: string[] = [];
+let tmpFiles: string[] = [];
 
 afterEach(() => {
   for (const dir of tmpDirs) {
     rmSync(dir, { recursive: true, force: true });
   }
+  for (const file of tmpFiles) {
+    rmSync(file, { force: true });
+  }
   tmpDirs = [];
+  tmpFiles = [];
 });
 
 function makeOutputFile(content: string): string {
@@ -490,6 +495,10 @@ describe('BackgroundShellRegistry', () => {
       const reg = new BackgroundShellRegistry();
       const callback = vi.fn();
       const dir = makeTempDir();
+      // A dir outputPath gets its `<dir>.status` sidecar as a sibling of
+      // the temp dir, which the dir cleanup above never removes; tracking
+      // it here lets afterEach delete it even if the assertions fail.
+      tmpFiles.push(statusFilePathFor(dir));
       reg.setNotificationCallback(callback);
       reg.register(makeEntry({ shellId: 'a', outputPath: dir }));
 
@@ -498,9 +507,6 @@ describe('BackgroundShellRegistry', () => {
       expect(callback).toHaveBeenCalledTimes(1);
       const [, modelText] = callback.mock.calls[0];
       expect(modelText).not.toContain('<output-tail');
-      // register/complete also mirrored a `<dir>.status` sidecar next to
-      // the temp dir, and afterEach only tracks the dir itself.
-      rmSync(statusFilePathFor(dir), { force: true });
     });
 
     it('skips output-tail when the output file is empty (stat.size === 0)', () => {

From cb794cdecc21260438fab4d0e1476f98aa2829bf Mon Sep 17 00:00:00 2001
From: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>
Date: Mon, 10 Aug 2026 01:14:43 +0000
Subject: [PATCH 7/7] fix(core): reuse shared display sanitizer in background
 shell registry (#8813)

The registry kept a private stripDisplayControlChars that only removed
C0/C1 controls, while the shared terminalSafe helper also strips Unicode
bidi overrides and isolates. With a TMPDIR containing one of those
characters the test expectations (built with the shared helper) lost a
character the notification XML retained. Reuse the shared helper so both
background notification surfaces apply the same Trojan-Source defense and
the expectations cannot drift from the implementation again; extend the
control-character test to pin the bidi stripping.
---
 .../services/backgroundShellRegistry.test.ts  | 18 ++++++++-------
 .../src/services/backgroundShellRegistry.ts   | 22 +------------------
 2 files changed, 11 insertions(+), 29 deletions(-)

diff --git a/packages/core/src/services/backgroundShellRegistry.test.ts b/packages/core/src/services/backgroundShellRegistry.test.ts
index 0739fc4beb8..e0ac88d316b 100644
--- a/packages/core/src/services/backgroundShellRegistry.test.ts
+++ b/packages/core/src/services/backgroundShellRegistry.test.ts
@@ -31,10 +31,11 @@ import { escapeXml } from '../utils/xml.js';
 import { stripDisplayControlChars } from '../utils/terminalSafe.js';
 
 /**
- * Mirror of how the registry renders a path into the notification XML. The
- * expected paths below are built from `tmpdir()`, which can legally contain
- * XML metacharacters (`&` on Windows, `<` on POSIX), so hand-rolling the
- * escaping here would make these cases depend on the host's TMPDIR.
+ * Builds the expected `<output-file>` element with the same
+ * `stripDisplayControlChars` + `escapeXml` pipeline the registry applies.
+ * Expected paths below come from `tmpdir()`, which can legally contain XML
+ * metacharacters (`&` on Windows, `<` on POSIX) or bidi overrides, so
+ * hand-rolling the escaping would make these cases depend on the host's TMPDIR.
  */
 function expectedOutputFileElement(path: string): string {
   return `<output-file>${escapeXml(stripDisplayControlChars(path))}</output-file>`;
@@ -420,7 +421,7 @@ describe('BackgroundShellRegistry', () => {
       expect(modelText).not.toContain('\uFFFD');
     });
 
-    it('strips control characters from cwd and output-file XML fields', () => {
+    it('strips control and bidi characters from cwd and output-file XML fields', () => {
       const reg = new BackgroundShellRegistry();
       const callback = vi.fn();
       reg.setNotificationCallback(callback);
@@ -429,7 +430,7 @@ describe('BackgroundShellRegistry', () => {
         makeEntry({
           shellId: 'a',
           cwd: '/repo\x01\x02/work',
-          outputPath: join(dir, 'out\x03.log'),
+          outputPath: join(dir, 'out\x03\u202e.log'),
         }),
       );
 
@@ -437,14 +438,15 @@ describe('BackgroundShellRegistry', () => {
 
       const [, modelText] = callback.mock.calls[0];
       expect(modelText).toContain('<cwd>/repo/work</cwd>');
-      // Whole element: pins that only the control byte is stripped and the
-      // rest of the path survives intact.
+      // Whole element: pins exactly which characters are stripped and that
+      // the rest of the path survives intact.
       expect(modelText).toContain(
         expectedOutputFileElement(join(dir, 'out.log')),
       );
       expect(modelText).not.toContain('\x01');
       expect(modelText).not.toContain('\x02');
       expect(modelText).not.toContain('\x03');
+      expect(modelText).not.toContain('\u202e');
     });
 
     const itNoFollow = fsConstants.O_NOFOLLOW === undefined ? it.skip : it;
diff --git a/packages/core/src/services/backgroundShellRegistry.ts b/packages/core/src/services/backgroundShellRegistry.ts
index 094f647c70c..fb2fc31335c 100644
--- a/packages/core/src/services/backgroundShellRegistry.ts
+++ b/packages/core/src/services/backgroundShellRegistry.ts
@@ -24,6 +24,7 @@ import type { TaskBase, TaskRegistration } from '../agents/tasks/types.js';
 import { atomicWriteFileSync } from '../utils/atomicFileWrite.js';
 import { createDebugLogger } from '../utils/debugLogger.js';
 import { todoWorkChainContext } from '../utils/promptIdContext.js';
+import { stripDisplayControlChars } from '../utils/terminalSafe.js';
 import { escapeXml } from '../utils/xml.js';
 
 const debugLogger = createDebugLogger('BACKGROUND_SHELLS');
@@ -31,27 +32,6 @@ const MAX_NOTIFICATION_COMMAND_LENGTH = 80;
 const MAX_NOTIFICATION_MODEL_COMMAND_LENGTH = 500;
 export const MAX_NOTIFICATION_OUTPUT_TAIL_BYTES = 8192;
 
-/**
- * Strip C0 control characters (except tab) and C1 control characters from
- * terminal/UI display strings. Shell commands and errors are usually
- * user-authored, but this keeps escape sequences out of the visible
- * notification surface if a caller passes unsanitized text.
- */
-function stripDisplayControlChars(text: string): string {
-  let out = '';
-  for (let i = 0; i < text.length; i++) {
-    const code = text.charCodeAt(i);
-    if (code === 0x09) {
-      out += text[i];
-      continue;
-    }
-    if (code < 0x20) continue;
-    if (code >= 0x80 && code <= 0x9f) continue;
-    out += text[i];
-  }
-  return out;
-}
-
 function stripOutputControlChars(text: string): string {
   let out = '';
   for (let i = 0; i < text.length; i++) {