Skip to content

fix: add process guard to setup.sh and enable pulse RunAtLoad for reboot survival #2940

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
marcusquinn merged 2 commits into from
Mar 6, 2026
Merged

fix: add process guard to setup.sh and enable pulse RunAtLoad for reboot survival #2940

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0825c74
fix: add process guard to setup.sh and enable pulse RunAtLoad for reb…
marcusquinn Mar 5, 2026
97cbf06
fix: address review feedback — dynamic PATH, HOME env, quoted cron pa…
marcusquinn Mar 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
80 changes: 79 additions & 1 deletion setup.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -900,7 +900,7 @@ main() {
<string>1800</string>
</dict>
<key>RunAtLoad</key>
<false/>
<true/>
<key>KeepAlive</key>
<false/>
</dict>
Expand Down Expand Up @@ -977,6 +977,84 @@ PLIST
fi
fi

# Process guard — kills runaway AI processes (ShellCheck bloat, stuck workers)
# before they exhaust memory and cause kernel panics. Always installed when the
# script exists; no consent needed (safety net, not autonomous action).
# macOS: launchd plist (30s interval, RunAtLoad=true) | Linux: cron (every minute)
local guard_script="$HOME/.aidevops/agents/scripts/process-guard-helper.sh"
local guard_label="sh.aidevops.process-guard"
if [[ -x "$guard_script" ]]; then
mkdir -p "$HOME/.aidevops/logs"

if [[ "$(uname -s)" == "Darwin" ]]; then
local guard_plist="$HOME/Library/LaunchAgents/${guard_label}.plist"

# Unload old plist if upgrading
if _launchd_has_agent "$guard_label"; then
launchctl unload "$guard_plist" || true
fi

cat >"$guard_plist" <<GUARD_PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>${guard_label}</string>
<key>ProgramArguments</key>
<array>
<string>${guard_script}</string>

@gemini-code-assist gemini-code-assist Bot Mar 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

The script generates a launchd plist file for the process guard by inserting the ${guard_script} variable directly into an XML template. If the variable contains XML special characters like </string>, it can lead to plist injection. An attacker who can control the directory name where the application is installed could potentially modify the plist structure to execute arbitrary commands via launchd.

<string>kill-runaways</string>
</array>
<key>StartInterval</key>
<integer>30</integer>
<key>StandardOutPath</key>
<string>${HOME}/.aidevops/logs/process-guard.log</string>
<key>StandardErrorPath</key>
<string>${HOME}/.aidevops/logs/process-guard.log</string>
<key>EnvironmentVariables</key>
<dict>
<key>PATH</key>
<string>${PATH}</string>
<key>HOME</key>
<string>${HOME}</string>
<key>SHELLCHECK_RSS_LIMIT_KB</key>
<string>524288</string>
<key>SHELLCHECK_RUNTIME_LIMIT</key>
<string>120</string>
<key>CHILD_RSS_LIMIT_KB</key>
<string>8388608</string>
<key>CHILD_RUNTIME_LIMIT</key>
<string>7200</string>
</dict>
<key>RunAtLoad</key>
<true/>
<key>KeepAlive</key>
<false/>
</dict>
</plist>
GUARD_PLIST

if launchctl load "$guard_plist"; then
print_info "Process guard enabled (launchd, every 30s, survives reboot)"
else
print_warning "Failed to load process guard LaunchAgent"
fi
else
# Linux: cron entry (every minute — cron minimum granularity)
# Always regenerate to pick up config changes (matches macOS behavior)
(
crontab -l 2>/dev/null | grep -v 'aidevops: process-guard'
echo "* * * * * SHELLCHECK_RSS_LIMIT_KB=524288 SHELLCHECK_RUNTIME_LIMIT=120 CHILD_RSS_LIMIT_KB=8388608 CHILD_RUNTIME_LIMIT=7200 /bin/bash \"${guard_script}\" kill-runaways >> \"\$HOME/.aidevops/logs/process-guard.log\" 2>&1 # aidevops: process-guard"
) | crontab - 2>/dev/null || true
if crontab -l 2>/dev/null | grep -qF "aidevops: process-guard" 2>/dev/null; then
print_info "Process guard enabled (cron, every minute)"
else
print_warning "Failed to install process guard cron entry"
fi
fi
fi

echo ""
echo "CLI Command:"
echo " aidevops init - Initialize aidevops in a project"
Expand Down