Report sandbox denials before lifecycle completion

This commit is contained in:
Kyle Brown
2026-07-10 00:24:25 +00:00
parent 45924e4ad0
commit 6bd7bd6bec
2 changed files with 4 additions and 2 deletions
@@ -123,6 +123,7 @@ pub(crate) fn spawn_exit_watcher(
output_drained.notified().await;
let duration = Instant::now().saturating_duration_since(started_at);
let _ = process.check_for_sandbox_denial().await;
if let Some(message) = process.failure_message() {
process.notify_lifecycle_finished(/*exit_code*/ None, /*failed*/ true);
emit_failed_exec_end_for_unified_exec(
@@ -599,7 +599,8 @@ impl UnifiedExecProcessManager {
}
let exit_code = process.exit_code();
let exit = exit_code.unwrap_or(-1);
process.notify_lifecycle_finished(exit_code, /*failed*/ false);
let sandbox_denial_result = process.check_for_sandbox_denial_with_text(&text).await;
process.notify_lifecycle_finished(exit_code, sandbox_denial_result.is_err());
emit_exec_end_for_unified_exec(
Arc::clone(&context.session),
Arc::clone(&context.turn),
@@ -615,7 +616,7 @@ impl UnifiedExecProcessManager {
.await;
self.release_process_id(request.process_id).await;
process.check_for_sandbox_denial_with_text(&text).await?;
sandbox_denial_result?;
(None, exit_code)
};