{"repo":"NousResearch/hermes-agent","public_id":"23845","display_label":"Tirith security scanner installation and stability issues","summary":"These items concern bugs and fixes around the Tirith security scanner: Windows/MSYS installation failures, SIGSEGV crashes causing agent hangs, repeated warning spam, missing binaries in Docker/Nix, and circuit-breaker logic to handle crash and retry loops.","subsystem":"agent","counts":{"members":19,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":6,"merged_prs":4,"attempt_prs":9},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":23050},"resolution":{"state":"partially_resolved","by":"pr-52997"},"freshness":{"state":"verified","last_verified_at":"2026-06-26T09:56:08+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_PARTIAL","link_density":0.0886549707602339},"fix_edges":[{"issue_number":23845,"pr_number":26618,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false},{"issue_number":23845,"pr_number":26718,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false},{"issue_number":26044,"pr_number":23050,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false},{"issue_number":41400,"pr_number":52997,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true}],"members":[{"kind":"issue","number":23845,"title":"tirith: repeated WARNING spam on every terminal command when binary is not installed (Windows)","url":null,"state":"closed"},{"kind":"issue","number":26044,"title":"[Bug]: Tirith security scanner fails to      install on Windows (MSYS/git-bash) -      \"unsupported_platform\"","url":null,"state":"closed"},{"kind":"issue","number":26140,"title":"[Bug]: Tirith security scanner fails to install on Windows - unsupported_platform","url":null,"state":"closed"},{"kind":"issue","number":41400,"title":"Security scanner (Tirith) SIGSEGV crash causes 20-minute agent hang with no response delivery","url":null,"state":"closed"},{"kind":"issue","number":50831,"title":"[Bug]: Docker image missing tirith","url":null,"state":"closed"},{"kind":"issue","number":57207,"title":"Tirith security scanner cannot install on Windows (unsupported_platform), silently leaving tirith_fail_open permanent there","url":null,"state":"closed"},{"kind":"pr","number":23050,"title":"fix(tirith): add Windows support for auto-install and command scanning","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":[]},{"kind":"pr","number":23855,"title":"Fix/tirith missing binary cache","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"4aec25bc4","number":0}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false,"is_fix_pr":true,"fix_tier":"suggested","fix_detail_withheld":true},{"kind":"pr","number":23880,"title":"fix(tirith): cache OSError spawn failure to suppress repeated WARNING spam","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"4aec25bc4411edb4563292cadbd02c365c846286","number":0},{"kind":"pr","value":"#23855","number":23855},{"kind":"pr","value":"#23845","number":23845},{"kind":"pr","value":"#23845","number":23845},{"kind":"pr","value":"#26618","number":26618},{"kind":"pr","value":"#26718","number":26718}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":26068,"title":"fix(tirith): support Windows/MSYS auto-install","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"a91b1c8b3","number":0},{"kind":"pr","value":"#26044","number":26044}],"category":"duplicate_of","implication":"duplicate"},"merged":false},{"kind":"pr","number":26069,"title":"fix(tools): support Tirith auto-install on Windows (#26044)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#26068","number":26068},{"kind":"pr","value":"#26044","number":26044},{"kind":"pr","value":"#26069","number":26069},{"kind":"pr","value":"#26069","number":26069},{"kind":"pr","value":"#23050","number":23050},{"kind":"pr","value":"#26069","number":26069},{"kind":"pr","value":"#26068","number":26068},{"kind":"pr","value":"#26068","number":26068},{"kind":"pr","value":"#26068","number":26068},{"kind":"pr","value":"#26068","number":26068},{"kind":"pr","value":"#26068","number":26068},{"kind":"pr","value":"#26044","number":26044},{"kind":"pr","value":"#26068","number":26068}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":26132,"title":"fix(tirith): add Windows platform support for auto-install","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#26068","number":26068},{"kind":"pr","value":"#26044","number":26044},{"kind":"pr","value":"#23050","number":23050},{"kind":"pr","value":"#26068","number":26068}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":26618,"title":"fix(windows): stop spamming cwd-missing + tirith-spawn warnings on every terminal call","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["tests/tools/test_local_env_windows_msys.py","tests/tools/test_tirith_security.py","tools/environments/local.py","tools/tirith_security.py"],"fix_hunks":[{"file":"tests/tools/test_local_env_windows_msys.py","hunks":["@@ -0,0 +1,200 @@\n+\"\"\"Tests for the Windows / Git Bash MSYS-path normalization in\n+``LocalEnvironment``.\n+\n+Background\n+----------\n+On Windows, ``pwd -P`` inside Git Bash emits paths like\n+``/c/Users/NVIDIA``. ``subprocess.Popen(..., cwd=...)`` only accepts\n+native Windows paths (``C:\\\\Users\\\\NVIDIA``), and the validation done\n+by ``_resolve_safe_cwd`` was also checking the MSYS form against\n+``os.path.isdir``, which returns ``False`` on Windows. The combined\n+effect was a warning logged on every single terminal call:\n+\n+    LocalEnvironment cwd '/c/Users/NVIDIA' is missing on disk;\n+    falling back to '/' so terminal commands keep working.\n+\n+These tests fake the Windows env on Linux CI by patching ``_IS_WINDOWS``\n+and ``os.path.isdir`` so the MSYS path tests as \"missing\" exactly like\n+on the real OS.\n+\"\"\"\n+\n+import os\n+from unittest.mock import patch\n+\n+import pytest\n+\n+from tools.environments import local as local_mod\n+from tools.environments.local import (\n+    LocalEnvironment,\n+    _msys_to_windows_path,\n+    _resolve_safe_cwd,\n+)\n+\n+\n+# ---------------------------------------------------------------------------\n+# _msys_to_windows_path — pure-function unit tests\n+# ---------------------------------------------------------------------------\n+\n+class TestMsysToWindowsPath:\n+    def test_noop_on_non_windows(self, monkeypatch):\n+        monkeypatch.setattr(local_mod, \"_IS_WINDOWS\", False)\n+        # On a non-Windows host the function must never rewrite the path\n+        # — POSIX-style paths are real paths there.\n+        assert _msys_to_windows_path(\"/c/Users/NVIDIA\") == \"/c/Users/NVIDIA\"\n+        assert _msys_to_windows_path(\"/home/teknium\") == \"/home/teknium\"\n+\n+    def test_translates_drive_path(self, monkeypatch):\n+        monkeypatch.setattr(local_mod, \"_IS_WINDOWS\", True)\n+        assert _msys_to_windows_path(\"/c/Users/NVIDIA\") == r\"C:\\Users\\NVIDIA\"\n+        assert _msys_to_windows_path(\"/d/Projects/foo bar\") == r\"D:\\Projects\\foo bar\"\n+\n+    def test_translates_bare_drive_root(self, monkeypatch):\n+        monkeypatch.setattr(local_mod, \"_IS_WINDOWS\", True)\n+        # Bare \"/c\" alone should resolve to the drive root.\n+        assert _msys_to_windows_path(\"/c\") == \"C:\\\\\"\n+        # Trailing slash on the drive letter is also a root.\n+        assert _msys_to_windows_path(\"/c/\") == \"C:\\\\\"\n+\n+    def test_idempotent_on_already_windows_path(self, monkeypatch):\n+        monkeypatch.setattr(local_mod, \"_IS_WINDOWS\", True)\n+        assert _msys_to_windows_path(r\"C:\\Users\\NVIDIA\") == r\"C:\\Users\\NVIDIA\"\n+\n+    def test_does_not_translate_multi_char_first_segment(self, monkeypatch):\n+        \"\"\"``/tmp/foo`` and ``/home/x`` must NOT be misread as drive paths\n+        just because they start with ``/`` and a single letter — the regex\n+        only matches when the first segment is exactly one character.\"\"\"\n+        monkeypatch.setattr(local_mod, \"_IS_WINDOWS\", True)\n+        assert _msys_to_windows_path(\"/tmp/foo\") == \"/tmp/foo\"\n+        assert _msys_to_windows_path(\"/home/x\") == \"/home/x\"\n+\n+    def test_empty_string(self, monkeypatch):\n+        monkeypatch.setattr(local_mod, \"_IS_WINDOWS\", True)\n+        assert _msys_to_windows_path(\"\") == \"\"\n+\n+\n+# ---------------------------------------------------------------------------\n+# _resolve_safe_cwd — Windows fast path\n+# ---------------------------------------------------------------------------\n+\n+class TestResolveSafeCwdWindows:\n+    def test_msys_path_resolves_to_native_when_native_exists(\n+        self, monkeypatch, tmp_path,\n+    ):\n+        \"\"\"The whole point of this fix: a Git Bash ``/c/Users/x`` value\n+        should resolve to its native equivalent if that native dir exists,\n+        WITHOUT falling back to the temp dir.\"\"\"\n+        monkeypatch.setattr(local_mod, \"_IS_WINDOWS\", True)\n+\n+        # tmp_path is a real native dir on the test host. Build a fake\n+        # MSYS form pointing at it and prove the resolver finds it.\n+        native = str(tmp_path)\n+        # Construct a synthetic MSYS form for whatever tmp_path is.\n+        # On Linux CI tmp_path is /tmp/... ; the resolver shouldn't even\n+        # try to translate that (regex won't match), so emulate the\n+        # mapping by pointing the translator at the real native dir.\n+        with patch.object(\n+            local_mod, \"_msys_to_windows_path\", return_value=native\n+        ):\n+            assert _resolve_safe_cwd(\"/c/whatever\") == native\n+\n+\n+# ---------------------------------------------------------------------------\n+# End-to-end: _update_cwd via marker file (Windows simulation)\n+# ---------------------------------------------------------------------------\n+\n+class TestUpdateCwdWindowsMsys:\n+    def test_marker_file_msys_path_stored_in_native_form(\n+        self, monkeypatch, tmp_path,\n+    ):\n+        \"\"\"When Git Bash writes ``/c/Users/x`` to the cwd marker file on\n+        Windows, ``_update_cwd`` must translate to native form before\n+        validating and storing — otherwise ``os.path.isdir`` rejects a\n+        perfectly real directory.\"\"\"\n+        original = tmp_path / \"starting\"\n+        original.mkdir()\n+\n+        # Fake Windows for the test\n+        monkeypatch.setattr(local_mod, \"_IS_WINDOWS\", True)\n+\n+        with patch.object(\n+            LocalEnvironment, \"init_session\", autospec=True, return_value=None\n+        ):\n+            env = LocalEnvironment(cwd=str(original), timeout=10)\n+\n+        # Pretend Git Bash wrote an MSYS path that maps to tmp_path/\"next\"\n+        new_dir = tmp_path / \"next\"\n+        new_dir.mkdir()\n+\n+        with open(env._cwd_file, \"w\") as f:\n+            f.write(\"/c/whatever/from/bash\")\n+\n+        # Translate the synthetic MSYS string to the real native dir.\n+        def fake_translate(p):\n+            if p == \"/c/whatever/from/bash\":\n+                return str(new_dir)\n+            return p\n+\n+        with patch.object(local_mod, \"_msys_to_windows_path\", side_effect=fake_translate):\n+            env._update_cwd({\"output\": \"\", \"returncode\": 0})\n+\n+        assert env.cwd == str(new_dir)\n+\n+\n+# ---------------------------------------------------------------------------\n+# End-to-end: _extract_cwd_from_output rollback when marker is invalid\n+# ---------------------------------------------------------------------------\n+\n+class TestExtractCwdFromOutputWindowsMsys:\n+    def test_stale_msys_marker_does_not_clobber_cwd(self, monkeypatch, tmp_path):\n+        \"\"\"When the cwd marker in stdout points at a non-existent path,\n+        ``LocalEnvironment._extract_cwd_from_output`` must roll back to\n+        the previous cwd instead of propagating a bad value.\"\"\"\n+        original = tmp_path / \"starting\"\n+        original.mkdir()\n+\n+        monkeypatch.setattr(local_mod, \"_IS_WINDOWS\", True)\n+\n+        with patch.object(\n+            LocalEnvironment, \"init_session\", autospec=True, return_value=None\n+        ):\n+            env = LocalEnvironment(cwd=str(original), timeout=10)\n+\n+        marker = env._cwd_marker\n+        result = {\n+            \"output\": f\"some command output\\n{marker}/c/no/such/path{marker}\\n\",\n+            \"returncode\": 0,\n+        }\n+\n+        # Translation produces a path that doesn't exist on disk → rollback.\n+        with patch.object(\n+            local_mod,\n+            \"_msys_to_windows_path\",\n+            return_value=str(tmp_path / \"definitely-does-not-exist\"),\n+        ):\n+            env._extract_cwd_from_output(result)\n+\n+        assert env.cwd == str(original)\n+\n+    def test_valid_msys_marker_normalized_to_native(self, monkeypatch, tmp_path):\n+        original = tmp_path / \"starting\"\n+        original.mkdir()\n+        new_dir = tmp_path / \"next\"\n+        new_dir.mkdir()\n+\n+        monkeypatch.setattr(local_mod, \"_IS_WINDOWS\", True)\n+\n+        with patch.object(\n+            LocalEnvironment, \"init_session\", autospec=True, return_value=None\n+        ):\n+            env = LocalEnvironment(cwd=str(original), timeout=10)\n+\n+        marker = env._cwd_marker\n+        result = {\n+            \"output\": f\"x\\n{marker}/c/whatever{marker}\\n\",\n+            \"returncode\": 0,\n+        }\n+\n+        with patch.object(local_mod, \"_msys_to_windows_path\", return_value=str(new_dir)):\n+            env._extract_cwd_from_output(result)\n+\n+        assert env.cwd == str(new_dir)"]},{"file":"tests/tools/test_tirith_security.py","hunks":["@@ -1007,3 +1007,120 @@ def test_get_hermes_home_fallback(self):\n             expected = os.path.join(os.path.expanduser(\"~\"), \".hermes\")\n             result = _get_hermes_home()\n         assert result == expected\n+\n+\n+# ---------------------------------------------------------------------------\n+# Warn-once dedupe (issue: tirith spawn failed spamming on Windows)\n+# ---------------------------------------------------------------------------\n+\n+class TestSpawnWarningDedup:\n+    \"\"\"When tirith isn't installed yet (background install in flight, or\n+    install marked failed), every terminal command spammed an identical\n+    ``tirith spawn failed: [WinError 2]`` warning to ``errors.log``. The\n+    dedupe set in ``_warn_once`` collapses repeats by ``(exc class, errno)``\n+    while still surfacing the first occurrence so users see the failure.\n+    \"\"\"\n+\n+    @patch(\"tools.tirith_security.subprocess.run\")\n+    @patch(\"tools.tirith_security._load_security_config\")\n+    def test_repeated_spawn_failure_logs_once(self, mock_cfg, mock_run, caplog):\n+        mock_cfg.return_value = {\n+            \"tirith_enabled\": True, \"tirith_path\": \"tirith\",\n+            \"tirith_timeout\": 5, \"tirith_fail_open\": True,\n+        }\n+        mock_run.side_effect = FileNotFoundError(\"[WinError 2]\")\n+        # Fresh dedupe state — clear any keys left by other tests.\n+        _tirith_mod._reset_spawn_warning_state()\n+\n+        with caplog.at_level(\"WARNING\", logger=\"tools.tirith_security\"):\n+            for _ in range(15):\n+                result = check_command_security(\"echo hi\")\n+                # Behavior must remain the same on every call —\n+                # fail-open allow, with the exception captured in summary.\n+                assert result[\"action\"] == \"allow\"\n+                assert \"unavailable\" in result[\"summary\"]\n+\n+        spawn_warnings = [\n+            rec for rec in caplog.records\n+            if \"tirith spawn failed\" in rec.message\n+        ]\n+        assert len(spawn_warnings) == 1, (\n+            f\"expected exactly 1 spawn-failed warning across 15 commands, \"\n+            f\"got {len(spawn_warnings)}: {[r.message for r in spawn_warnings]}\"\n+        )\n+\n+    @patch(\"tools.tirith_security.subprocess.run\")\n+    @patch(\"tools.tirith_security._load_security_config\")\n+    def test_distinct_exception_types_each_log_once(self, mock_cfg, mock_run, caplog):\n+        \"\"\"``FileNotFoundError`` and ``PermissionError`` are distinct\n+        failure modes and each deserves its own first-occurrence log\n+        line; the dedupe key includes the exception class.\"\"\"\n+        mock_cfg.return_value = {\n+            \"tirith_enabled\": True, \"tirith_path\": \"tirith\",\n+            \"tirith_timeout\": 5, \"tirith_fail_open\": True,\n+        }\n+        _tirith_mod._reset_spawn_warning_state()\n+\n+        with caplog.at_level(\"WARNING\", logger=\"tools.tirith_security\"):\n+            mock_run.side_effect = FileNotFoundError(\"[WinError 2]\")\n+            for _ in range(3):\n+                check_command_security(\"a\")\n+            mock_run.side_effect = PermissionError(\"denied\")\n+            for _ in range(3):\n+                check_command_security(\"b\")\n+\n+        spawn_warnings = [\n+            rec for rec in caplog.records\n+            if \"tirith spawn failed\" in rec.message\n+        ]\n+        assert len(spawn_warnings) == 2, (\n+            f\"expected 2 distinct first-occurrence warnings, \"\n+            f\"got {len(spawn_warnings)}\"\n+        )\n+\n+    @patch(\"tools.tirith_security.subprocess.run\")\n+    @patch(\"tools.tirith_security._load_security_config\")\n+    def test_repeated_timeout_logs_once(self, mock_cfg, mock_run, caplog):\n+        mock_cfg.return_value = {\n+            \"tirith_enabled\": True, \"tirith_path\": \"tirith\",\n+            \"tirith_timeout\": 5, \"tirith_fail_open\": True,\n+        }\n+        mock_run.side_effect = subprocess.TimeoutExpired(cmd=\"tirith\", timeout=5)\n+        _tirith_mod._reset_spawn_warning_state()\n+\n+        with caplog.at_level(\"WARNING\", logger=\"tools.tirith_security\"):\n+            for _ in range(10):\n+                result = check_command_security(\"slow\")\n+                assert result[\"action\"] == \"allow\"\n+\n+        timeout_warnings = [\n+            rec for rec in caplog.records\n+            if \"tirith timed out\" in rec.message\n+        ]\n+        assert len(timeout_warnings) == 1\n+\n+    @patch(\"tools.tirith_security._load_security_config\")\n+    def test_path_none_logs_once(self, mock_cfg, caplog):\n+        \"\"\"``_resolve_tirith_path`` returning ``None`` (explicit path set\n+        but resolver returned None — unusual) should not spam the log\n+        either.\"\"\"\n+        mock_cfg.return_value = {\n+            \"tirith_enabled\": True, \"tirith_path\": \"tirith\",\n+            \"tirith_timeout\": 5, \"tirith_fail_open\": True,\n+        }\n+        _tirith_mod._reset_spawn_warning_state()\n+\n+        with patch(\n+            \"tools.tirith_security._resolve_tirith_path\", return_value=None\n+        ):\n+            with caplog.at_level(\"WARNING\", logger=\"tools.tirith_security\"):\n+                for _ in range(10):\n+                    result = check_command_security(\"echo\")\n+                    assert result[\"action\"] == \"allow\"\n+                    assert \"tirith path unavailable\" in result[\"summary\"]\n+\n+        none_warnings = [\n+            rec for rec in caplog.records\n+            if \"tirith path resolved to None\" in rec.message\n+        ]\n+        assert len(none_warnings) == 1"]},{"file":"tools/environments/local.py","hunks":["@@ -18,18 +18,44 @@\n logger = logging.getLogger(__name__)\n \n \n+def _msys_to_windows_path(cwd: str) -> str:\n+    \"\"\"Translate a Git Bash / MSYS-style POSIX path (``/c/Users/x``) to the\n+    native Windows form (``C:\\\\Users\\\\x``) so ``os.path.isdir`` and\n+    ``subprocess.Popen(..., cwd=...)`` can find it.\n+\n+    No-ops on non-Windows hosts or for paths that aren't in MSYS form.\n+    Returns the input unchanged when no translation applies. This is\n+    idempotent — calling it on an already-Windows path returns it as-is.\n+    \"\"\"\n+    if not _IS_WINDOWS or not cwd:\n+        return cwd\n+    # Match leading \"/<single letter>/\" or exactly \"/<letter>\" (bare drive root).\n+    m = re.match(r'^/([a-zA-Z])(/.*)?$', cwd)\n+    if not m:\n+        return cwd\n+    drive = m.group(1).upper()\n+    tail = (m.group(2) or \"\").replace('/', '\\\\')\n+    return f\"{drive}:{tail or chr(92)}\"  # chr(92) = backslash, avoid raw-string escape\n+\n+\n def _resolve_safe_cwd(cwd: str) -> str:\n     \"\"\"Return ``cwd`` if it exists as a directory, else the nearest existing\n     ancestor.  Falls back to ``tempfile.gettempdir()`` only if walking up the\n     path can't find any existing directory (effectively never on a healthy\n     filesystem, but cheap belt-and-braces).\n \n+    On Windows, also normalizes Git Bash / MSYS-style POSIX paths\n+    (``/c/Users/x``) to native Windows form before the isdir check so a\n+    perfectly valid ``pwd -P`` result from bash doesn't get rejected as\n+    \"missing\" (see ``_msys_to_windows_path``).\n+\n     Used by ``_run_bash`` to recover when the configured cwd is gone — most\n     commonly because a previous tool call deleted its own working directory\n     (issue #17558).  Without this guard, ``subprocess.Popen(..., cwd=...)``\n     raises ``FileNotFoundError`` before bash starts, wedging every subsequent\n     terminal call until the gateway restarts.\n     \"\"\"\n+    cwd = _msys_to_windows_path(cwd) if _IS_WINDOWS else cwd\n     if cwd and os.path.isdir(cwd):\n         return cwd\n     parent = os.path.dirname(cwd) if cwd else \"\"","@@ -455,21 +481,27 @@ def _run_bash(self, cmd_string: str, *, login: bool = False,\n         # (issue #17558).  Popen would otherwise raise FileNotFoundError on\n         # the cwd before bash starts, wedging every subsequent call until the\n         # gateway restarts.\n+        #\n+        # On Windows, ``_resolve_safe_cwd`` also normalises Git Bash-style\n+        # POSIX paths (``/c/Users/...``) to native form so a perfectly valid\n+        # ``pwd -P`` result from bash isn't mistakenly treated as \"missing\"\n+        # and spammed as a warning on every command.\n         safe_cwd = _resolve_safe_cwd(self.cwd)\n         if safe_cwd != self.cwd:\n-            logger.warning(\n-                \"LocalEnvironment cwd %r is missing on disk; \"\n-                \"falling back to %r so terminal commands keep working.\",\n-                self.cwd,\n-                safe_cwd,\n-            )\n+            # MSYS → Windows translation alone shouldn't surface as a warning\n+            # (it's a benign normalization, not a recovery). Only warn when\n+            # the directory really doesn't exist on disk.\n+            normalized = _msys_to_windows_path(self.cwd) if _IS_WINDOWS else self.cwd\n+            if safe_cwd != normalized:\n+                logger.warning(\n+                    \"LocalEnvironment cwd %r is missing on disk; \"\n+                    \"falling back to %r so terminal commands keep working.\",\n+                    self.cwd,\n+                    safe_cwd,\n+                )\n             self.cwd = safe_cwd\n \n-        # On Windows, self.cwd may be a Git Bash-style path (/c/Users/...)\n-        # from pwd output. subprocess.Popen needs a native Windows path.\n         _popen_cwd = self.cwd\n-        if _IS_WINDOWS and _popen_cwd and re.match(r'^/[a-zA-Z]/', _popen_cwd):\n-            _popen_cwd = _popen_cwd[1].upper() + ':' + _popen_cwd[2:].replace('/', '\\\\')\n \n         proc = subprocess.Popen(\n             args,","@@ -571,10 +603,19 @@ def _update_cwd(self, result: dict):\n         ``pwd -P`` on a deleted cwd can leave a stale value in the marker\n         file, and propagating it would re-wedge the next ``Popen``.  The\n         ``_run_bash`` recovery path will resolve a safe fallback if needed.\n+\n+        On Windows, the value written by Git Bash's ``pwd -P`` is in\n+        MSYS form (``/c/Users/x``). Translate it to native Windows form\n+        before validating with ``os.path.isdir`` and before storing on\n+        ``self.cwd``; otherwise the isdir check rejects every valid\n+        result and ``_run_bash`` later prints a misleading \"cwd is\n+        missing\" warning on every command.\n         \"\"\"\n         try:\n             with open(self._cwd_file, encoding=\"utf-8\") as f:\n                 cwd_path = f.read().strip()\n+            if _IS_WINDOWS:\n+                cwd_path = _msys_to_windows_path(cwd_path)\n             if cwd_path and os.path.isdir(cwd_path):\n                 self.cwd = cwd_path\n         except (OSError, FileNotFoundError):","@@ -583,6 +624,30 @@ def _update_cwd(self, result: dict):\n         # Still strip the marker from output so it's not visible\n         self._extract_cwd_from_output(result)\n \n+    def _extract_cwd_from_output(self, result: dict):\n+        \"\"\"Same semantics as the base class, but on Windows the value\n+        emitted by ``pwd -P`` inside Git Bash is in MSYS form\n+        (``/c/Users/x``). Normalize to native Windows form and validate\n+        the directory exists before assigning to ``self.cwd`` — otherwise\n+        ``_run_bash``'s safe-cwd recovery would warn on every subsequent\n+        command.\n+\n+        Always defers to the base class for stripping the marker text from\n+        ``result[\"output\"]`` so output formatting is identical.\n+        \"\"\"\n+        # Snapshot pre-existing cwd, defer to base for parsing + marker\n+        # stripping, then validate / normalize whatever it assigned.\n+        prev_cwd = self.cwd\n+        super()._extract_cwd_from_output(result)\n+        if self.cwd != prev_cwd:\n+            normalized = _msys_to_windows_path(self.cwd) if _IS_WINDOWS else self.cwd\n+            if normalized and os.path.isdir(normalized):\n+                self.cwd = normalized\n+            else:\n+                # Stale / non-existent path — keep previous cwd; _run_bash\n+                # will resolve a safe fallback on the next call if needed.\n+                self.cwd = prev_cwd\n+\n     def cleanup(self):\n         \"\"\"Clean up temp files.\"\"\"\n         for f in (self._snapshot_path, self._cwd_file):"]},{"file":"tools/tirith_security.py","hunks":["@@ -101,6 +101,34 @@ def _load_security_config() -> dict:\n _install_lock = threading.Lock()\n _install_thread: threading.Thread | None = None\n \n+# Warning de-duplication. The spawn/path warnings live in the hot path —\n+# without this dedupe set, a Windows install where ``tirith`` isn't on PATH\n+# (e.g. background install thread still running, or install marked failed)\n+# spams ``tirith spawn failed: [WinError 2]...`` once per terminal command,\n+# easily filling errors.log with hundreds of identical lines.\n+_warned_messages: set[str] = set()\n+_warned_lock = threading.Lock()\n+\n+\n+def _warn_once(key: str, message: str, *args) -> None:\n+    \"\"\"``logger.warning`` but at-most-once per ``key`` for the process\n+    lifetime. Used to avoid drowning the log when a fail-open tirith\n+    misconfiguration fires on every command.\"\"\"\n+    with _warned_lock:\n+        if key in _warned_messages:\n+            return\n+        _warned_messages.add(key)\n+    logger.warning(message, *args)\n+\n+\n+def _reset_spawn_warning_state() -> None:\n+    \"\"\"Clear the warn-once dedupe set. Called when tirith is freshly\n+    (re)installed so a subsequent failure surfaces again — e.g. user\n+    deletes the binary mid-session.\n+    \"\"\"\n+    with _warned_lock:\n+        _warned_messages.clear()\n+\n # Disk-persistent failure marker — avoids retry across process restarts\n _MARKER_TTL = 86400  # 24 hours\n ","@@ -168,6 +196,10 @@ def _mark_install_failed(reason: str = \"\"):\n \n def _clear_install_failed():\n     \"\"\"Remove the failure marker after successful install.\"\"\"\n+    # Reset the warn-once dedupe set so a subsequent failure (e.g. user\n+    # deletes the binary) surfaces in the log again instead of being\n+    # silently suppressed by a stale dedupe key from before the fix.\n+    _reset_spawn_warning_state()\n     try:\n         os.unlink(_failure_marker_path())\n     except OSError:","@@ -632,7 +664,10 @@ def check_command_security(command: str) -> dict:\n     fail_open = cfg[\"tirith_fail_open\"]\n \n     if tirith_path is None:\n-        logger.warning(\"tirith path resolved to None; scanning disabled\")\n+        _warn_once(\n+            \"tirith_path_none\",\n+            \"tirith path resolved to None; scanning disabled\",\n+        )\n         if fail_open:\n             return {\"action\": \"allow\", \"findings\": [], \"summary\": \"tirith path unavailable\"}\n         return {\"action\": \"block\", \"findings\": [], \"summary\": \"tirith path unavailable (fail-closed)\"}","@@ -646,13 +681,23 @@ def check_command_security(command: str) -> dict:\n             timeout=timeout,\n         )\n     except OSError as exc:\n-        # Covers FileNotFoundError, PermissionError, exec format error\n-        logger.warning(\"tirith spawn failed: %s\", exc)\n+        # Covers FileNotFoundError, PermissionError, exec format error.\n+        # Dedupe by ``(errno, exc class)`` so a transient failure mode\n+        # surfaces once but doesn't drown the log on every command —\n+        # commonly seen on Windows when the configured path \"tirith\"\n+        # isn't on PATH yet (background install still running, or\n+        # install marked failed for the day).\n+        spawn_key = f\"tirith_spawn_failed:{type(exc).__name__}:{getattr(exc, 'errno', '')}\"\n+        _warn_once(spawn_key, \"tirith spawn failed: %s\", exc)\n         if fail_open:\n             return {\"action\": \"allow\", \"findings\": [], \"summary\": f\"tirith unavailable: {exc}\"}\n         return {\"action\": \"block\", \"findings\": [], \"summary\": f\"tirith spawn failed (fail-closed): {exc}\"}\n     except subprocess.TimeoutExpired:\n-        logger.warning(\"tirith timed out after %ds\", timeout)\n+        _warn_once(\n+            f\"tirith_timeout:{timeout}\",\n+            \"tirith timed out after %ds\",\n+            timeout,\n+        )\n         if fail_open:\n             return {\"action\": \"allow\", \"findings\": [], \"summary\": f\"tirith timed out ({timeout}s)\"}\n         return {\"action\": \"block\", \"findings\": [], \"summary\": \"tirith timed out (fail-closed)\"}\n"]}]},{"kind":"pr","number":26718,"title":"fix(windows): silence tirith-unavailable CLI banner on platforms with no tirith build","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["cli.py","tests/tools/test_tirith_security.py","tools/tirith_security.py","website/docs/user-guide/security.md"],"fix_hunks":[{"file":"cli.py","hunks":["@@ -11736,11 +11736,13 @@ def run(self):\n \n         # Ensure tirith security scanner is available (downloads if needed).\n         # Warn the user if tirith is enabled in config but not available,\n-        # so they know command security scanning is degraded.\n+        # so they know command security scanning is degraded.  Suppressed\n+        # on platforms where tirith ships no binary (Windows etc.) — the\n+        # user can't act on it and pattern-matching guards still run.\n         try:\n-            from tools.tirith_security import ensure_installed\n+            from tools.tirith_security import ensure_installed, is_platform_supported\n             tirith_path = ensure_installed(log_failures=False)\n-            if tirith_path is None:\n+            if tirith_path is None and is_platform_supported():\n                 security_cfg = self.config.get(\"security\", {}) or {}\n                 tirith_enabled = security_cfg.get(\"tirith_enabled\", True)\n                 if tirith_enabled:"]},{"file":"tests/tools/test_tirith_security.py","hunks":["@@ -333,6 +333,103 @@ def test_startup_prefetch_can_suppress_install_failure_logs(self, mock_cfg):\n         _tirith_mod._resolved_path = None\n \n \n+# ---------------------------------------------------------------------------\n+# Unsupported platform (Windows etc.) — silent fast-path everywhere\n+# ---------------------------------------------------------------------------\n+\n+class TestUnsupportedPlatform:\n+    \"\"\"When _detect_target() returns None (no tirith binary for this OS+arch),\n+    the entire subsystem must stay silent: no PATH probes, no download thread,\n+    no disk failure marker, no spawn attempts, no CLI banner. Pattern-matching\n+    guards still cover the gap; tirith content scanning is just absent.\"\"\"\n+\n+    def test_is_platform_supported_true_on_linux_x86_64(self):\n+        with patch(\"tools.tirith_security.platform.system\", return_value=\"Linux\"), \\\n+             patch(\"tools.tirith_security.platform.machine\", return_value=\"x86_64\"):\n+            assert _tirith_mod.is_platform_supported() is True\n+\n+    def test_is_platform_supported_true_on_darwin_arm64(self):\n+        with patch(\"tools.tirith_security.platform.system\", return_value=\"Darwin\"), \\\n+             patch(\"tools.tirith_security.platform.machine\", return_value=\"arm64\"):\n+            assert _tirith_mod.is_platform_supported() is True\n+\n+    def test_is_platform_supported_false_on_windows(self):\n+        with patch(\"tools.tirith_security.platform.system\", return_value=\"Windows\"), \\\n+             patch(\"tools.tirith_security.platform.machine\", return_value=\"AMD64\"):\n+            assert _tirith_mod.is_platform_supported() is False\n+\n+    def test_is_platform_supported_false_on_unknown_arch(self):\n+        with patch(\"tools.tirith_security.platform.system\", return_value=\"Linux\"), \\\n+             patch(\"tools.tirith_security.platform.machine\", return_value=\"riscv64\"):\n+            assert _tirith_mod.is_platform_supported() is False\n+\n+    @patch(\"tools.tirith_security._load_security_config\")\n+    def test_ensure_installed_unsupported_returns_none_no_thread(self, mock_cfg):\n+        \"\"\"Windows: don't start a background install thread, don't write a\n+        failure marker — just cache the verdict and return None.\"\"\"\n+        mock_cfg.return_value = {\"tirith_enabled\": True, \"tirith_path\": \"tirith\",\n+                                 \"tirith_timeout\": 5, \"tirith_fail_open\": True}\n+        _tirith_mod._resolved_path = None\n+        with patch(\"tools.tirith_security.is_platform_supported\", return_value=False), \\\n+             patch(\"tools.tirith_security.threading.Thread\") as MockThread, \\\n+             patch(\"tools.tirith_security._mark_install_failed\") as mock_mark, \\\n+             patch(\"tools.tirith_security.shutil.which\") as mock_which:\n+            result = ensure_installed()\n+            assert result is None\n+            MockThread.assert_not_called()\n+            mock_mark.assert_not_called()\n+            mock_which.assert_not_called()\n+            assert _tirith_mod._resolved_path is _tirith_mod._INSTALL_FAILED\n+            assert _tirith_mod._install_failure_reason == \"unsupported_platform\"\n+\n+    @patch(\"tools.tirith_security._load_security_config\")\n+    def test_check_command_security_unsupported_allows_silently(self, mock_cfg):\n+        \"\"\"Windows: skip the resolver and spawn entirely — return allow with\n+        an empty summary so callers can't accidentally surface 'tirith\n+        unavailable' messaging to the user.\"\"\"\n+        mock_cfg.return_value = {\"tirith_enabled\": True, \"tirith_path\": \"tirith\",\n+                                 \"tirith_timeout\": 5, \"tirith_fail_open\": True}\n+        with patch(\"tools.tirith_security.is_platform_supported\", return_value=False), \\\n+             patch(\"tools.tirith_security.subprocess.run\") as mock_run, \\\n+             patch(\"tools.tirith_security._resolve_tirith_path\") as mock_resolve:\n+            result = check_command_security(\"rm -rf /\")\n+            assert result == {\"action\": \"allow\", \"findings\": [], \"summary\": \"\"}\n+            mock_run.assert_not_called()\n+            mock_resolve.assert_not_called()\n+\n+    @patch(\"tools.tirith_security._load_security_config\")\n+    def test_resolve_path_unsupported_caches_failure_without_probing(self, mock_cfg):\n+        \"\"\"The per-command resolver must also short-circuit on Windows so\n+        long-running gateways don't churn through `shutil.which` and disk\n+        I/O for every scanned command.\"\"\"\n+        mock_cfg.return_value = {\"tirith_enabled\": True, \"tirith_path\": \"tirith\",\n+                                 \"tirith_timeout\": 5, \"tirith_fail_open\": True}\n+        _tirith_mod._resolved_path = None\n+        with patch(\"tools.tirith_security.is_platform_supported\", return_value=False), \\\n+             patch(\"tools.tirith_security.shutil.which\") as mock_which:\n+            result = _tirith_mod._resolve_tirith_path(\"tirith\")\n+            assert result == \"tirith\"\n+            mock_which.assert_not_called()\n+            assert _tirith_mod._resolved_path is _tirith_mod._INSTALL_FAILED\n+            assert _tirith_mod._install_failure_reason == \"unsupported_platform\"\n+\n+    @patch(\"tools.tirith_security._load_security_config\")\n+    def test_explicit_path_still_honored_on_unsupported_platform(self, mock_cfg):\n+        \"\"\"If a user explicitly configured a tirith_path (e.g. they built it\n+        themselves under WSL), the unsupported-platform short-circuit must\n+        NOT override that — explicit config wins.\"\"\"\n+        mock_cfg.return_value = {\"tirith_enabled\": True,\n+                                 \"tirith_path\": \"/opt/custom/tirith\",\n+                                 \"tirith_timeout\": 5, \"tirith_fail_open\": True}\n+        _tirith_mod._resolved_path = None\n+        with patch(\"tools.tirith_security.is_platform_supported\", return_value=False), \\\n+             patch(\"os.path.isfile\", return_value=True), \\\n+             patch(\"os.access\", return_value=True):\n+            result = _tirith_mod._resolve_tirith_path(\"/opt/custom/tirith\")\n+            assert result == \"/opt/custom/tirith\"\n+            assert _tirith_mod._resolved_path == \"/opt/custom/tirith\"\n+\n+\n # ---------------------------------------------------------------------------\n # Failed download caches the miss (Finding #1)\n # ---------------------------------------------------------------------------"]},{"file":"tools/tirith_security.py","hunks":["@@ -214,7 +214,12 @@ def _hermes_bin_dir() -> str:\n \n \n def _detect_target() -> str | None:\n-    \"\"\"Return the Rust target triple for the current platform, or None.\"\"\"\n+    \"\"\"Return the Rust target triple for the current platform, or None.\n+\n+    Windows is intentionally unsupported — tirith does not ship a Windows\n+    build. Callers should treat `None` as \"this platform will never have\n+    tirith\" and silently fall back to pattern-matching guards.\n+    \"\"\"\n     system = platform.system()\n     machine = platform.machine().lower()\n ","@@ -236,6 +241,16 @@ def _detect_target() -> str | None:\n     return f\"{arch}-{plat}\"\n \n \n+def is_platform_supported() -> bool:\n+    \"\"\"True when tirith ships a prebuilt binary for this OS+arch.\n+\n+    Used by callers (CLI banner, etc.) to distinguish \"tirith failed to\n+    install\" from \"tirith was never going to install here\" — the latter\n+    is silent because there is nothing the user can do about it.\n+    \"\"\"\n+    return _detect_target() is not None\n+\n+\n def _download_file(url: str, dest: str, timeout: int = 10):\n     \"\"\"Download a URL to a local file.\"\"\"\n     req = urllib.request.Request(url)","@@ -448,6 +463,15 @@ def _resolve_tirith_path(configured_path: str) -> str:\n     explicit = _is_explicit_path(configured_path)\n     install_failed = _resolved_path is _INSTALL_FAILED\n \n+    # Platform has no tirith build (Windows etc.). Cache the verdict and\n+    # return the unexpanded configured path — the spawn loop will fail-open\n+    # via the dedupe'd OSError handler, but only after the first call; on\n+    # subsequent calls the fast-path above short-circuits before spawning.\n+    if not explicit and not is_platform_supported():\n+        _resolved_path = _INSTALL_FAILED\n+        _install_failure_reason = \"unsupported_platform\"\n+        return expanded\n+\n     # Explicit path: check it and stop. Never auto-download a replacement.\n     if explicit:\n         if os.path.isfile(expanded) and os.access(expanded, os.X_OK):","@@ -574,6 +598,14 @@ def ensure_installed(*, log_failures: bool = True):\n             return path\n         return None\n \n+    # Platform has no tirith build (e.g. Windows) — don't probe PATH,\n+    # don't start a download thread, don't write a disk failure marker.\n+    # Pattern-matching guards still run; this path stays silent.\n+    if not is_platform_supported():\n+        _resolved_path = _INSTALL_FAILED\n+        _install_failure_reason = \"unsupported_platform\"\n+        return None\n+\n     configured_path = cfg[\"tirith_path\"]\n     explicit = _is_explicit_path(configured_path)\n     expanded = os.path.expanduser(configured_path)","@@ -659,6 +691,12 @@ def check_command_security(command: str) -> dict:\n     if not cfg[\"tirith_enabled\"]:\n         return {\"action\": \"allow\", \"findings\": [], \"summary\": \"\"}\n \n+    # Unsupported platform (Windows etc.) — tirith has no binary here and\n+    # never will. Skip the resolver entirely so we don't even try to spawn.\n+    # Pattern-matching guards still run via the rest of approval.py.\n+    if not is_platform_supported():\n+        return {\"action\": \"allow\", \"findings\": [], \"summary\": \"\"}\n+\n     tirith_path = _resolve_tirith_path(cfg[\"tirith_path\"])\n     timeout = cfg[\"tirith_timeout\"]\n     fail_open = cfg[\"tirith_fail_open\"]"]},{"file":"website/docs/user-guide/security.md","hunks":["@@ -537,6 +537,8 @@ security:\n \n When `tirith_fail_open` is `true` (default), commands proceed if tirith is not installed or times out. Set to `false` in high-security environments to block commands when tirith is unavailable.\n \n+Tirith ships prebuilt binaries for Linux (x86_64 / aarch64) and macOS (x86_64 / arm64). On platforms with no prebuilt binary (Windows, etc.), tirith is silently skipped — pattern-matching guards still run, and the CLI does not surface an \"unavailable\" banner. To use tirith on Windows, run Hermes under WSL.\n+\n Tirith's verdict integrates with the approval flow: safe commands pass through, while both suspicious and blocked commands trigger user approval with the full tirith findings (severity, title, description, safer alternatives). Users can approve or deny — the default choice is deny to keep unattended scenarios secure.\n \n ### Context File Injection Protection\n"]}]},{"kind":"pr","number":41423,"title":"fix(#41400): add circuit breaker to prevent tirith retry loops","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#52997","number":52997},{"kind":"pr","value":"#41446","number":41446}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":41446,"title":"fix(security): handle tirith SIGSEGV crash and disable broken binary (#41400)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#52997","number":52997}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":52997,"title":"fix(security): circuit breaker for tirith crashes to prevent agent hangs (#41400)","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["tests/tools/test_tirith_security.py","tools/tirith_security.py"],"fix_hunks":[{"file":"tests/tools/test_tirith_security.py","hunks":["@@ -17,17 +17,20 @@\n @pytest.fixture(autouse=True)\n def _reset_resolved_path():\n     \"\"\"Pre-set cached path to skip auto-install in scan tests.\n-\n     Tests that specifically test ensure_installed / resolve behavior\n     reset this to None themselves.\n     \"\"\"\n     _tirith_mod._resolved_path = \"tirith\"\n     _tirith_mod._install_thread = None\n     _tirith_mod._install_failure_reason = \"\"\n+    _tirith_mod._crash_count = 0\n+    _tirith_mod._circuit_open = False\n     yield\n     _tirith_mod._resolved_path = None\n     _tirith_mod._install_thread = None\n     _tirith_mod._install_failure_reason = \"\"\n+    _tirith_mod._crash_count = 0\n+    _tirith_mod._circuit_open = False\n \n \n # ---------------------------------------------------------------------------","@@ -1216,12 +1219,17 @@ def test_repeated_spawn_failure_logs_once(self, mock_cfg, mock_run, caplog):\n         _tirith_mod._reset_spawn_warning_state()\n \n         with caplog.at_level(\"WARNING\", logger=\"tools.tirith_security\"):\n-            for _ in range(15):\n+            for i in range(15):\n                 result = check_command_security(\"echo hi\")\n                 # Behavior must remain the same on every call —\n                 # fail-open allow, with the exception captured in summary.\n                 assert result[\"action\"] == \"allow\"\n-                assert \"unavailable\" in result[\"summary\"]\n+                if i < _tirith_mod._CRASH_LIMIT:\n+                    # Before circuit breaker opens, summary has the exception\n+                    assert \"unavailable\" in result[\"summary\"]\n+                else:\n+                    # After circuit breaker opens, summary is generic\n+                    assert \"circuit breaker\" in result[\"summary\"]\n \n         spawn_warnings = [\n             rec for rec in caplog.records","@@ -1237,7 +1245,11 @@ def test_repeated_spawn_failure_logs_once(self, mock_cfg, mock_run, caplog):\n     def test_distinct_exception_types_each_log_once(self, mock_cfg, mock_run, caplog):\n         \"\"\"``FileNotFoundError`` and ``PermissionError`` are distinct\n         failure modes and each deserves its own first-occurrence log\n-        line; the dedupe key includes the exception class.\"\"\"\n+        line; the dedupe key includes the exception class.\n+        \n+        After _CRASH_LIMIT consecutive failures the circuit breaker opens\n+        and subsequent calls short-circuit without spawning, so we only\n+        see the warnings from the first batch.\"\"\"\n         mock_cfg.return_value = {\n             \"tirith_enabled\": True, \"tirith_path\": \"tirith\",\n             \"tirith_timeout\": 5, \"tirith_fail_open\": True,","@@ -1248,6 +1260,9 @@ def test_distinct_exception_types_each_log_once(self, mock_cfg, mock_run, caplog\n             mock_run.side_effect = FileNotFoundError(\"[WinError 2]\")\n             for _ in range(3):\n                 check_command_security(\"a\")\n+            # Circuit breaker is now open — switching to PermissionError\n+            # won't generate a new warning because the function returns\n+            # before reaching subprocess.run.\n             mock_run.side_effect = PermissionError(\"denied\")\n             for _ in range(3):\n                 check_command_security(\"b\")","@@ -1256,8 +1271,8 @@ def test_distinct_exception_types_each_log_once(self, mock_cfg, mock_run, caplog\n             rec for rec in caplog.records\n             if \"tirith spawn failed\" in rec.message\n         ]\n-        assert len(spawn_warnings) == 2, (\n-            f\"expected 2 distinct first-occurrence warnings, \"\n+        assert len(spawn_warnings) == 1, (\n+            f\"expected 1 warning before circuit breaker opens, \"\n             f\"got {len(spawn_warnings)}\"\n         )\n "]},{"file":"tools/tirith_security.py","hunks":["@@ -97,6 +97,35 @@ def _load_security_config() -> dict:\n _INSTALL_FAILED = False  # sentinel: distinct from \"not yet tried\"\n _install_failure_reason: str = \"\"  # reason tag when _resolved_path is _INSTALL_FAILED\n \n+# Circuit breaker: after _CRASH_LIMIT consecutive spawn/execution failures,\n+# disable tirith for the rest of the process to prevent agent hangs (#41400).\n+# Reset on successful execution (see _record_tirith_crash / check_command_security).\n+#\n+# Thread safety: _crash_count and _circuit_open are module-level globals\n+# mutated without a lock. check_command_security can be called from\n+# concurrent agent threads (gateway multi-session). The race is benign —\n+# at worst two threads both increment past _CRASH_LIMIT and both set\n+# _circuit_open = True, opening the breaker one call early. No data\n+# corruption or security bypass is possible. This intentionally matches\n+# the lock-free style of error counters in mcp_tool.py rather than the\n+# locked _warn_once pattern, because the worst case is harmless.\n+_CRASH_LIMIT = 3\n+_crash_count: int = 0\n+_circuit_open: bool = False\n+\n+\n+def _record_tirith_crash() -> None:\n+    \"\"\"Increment the crash counter and open the circuit breaker if needed.\"\"\"\n+    global _crash_count, _circuit_open\n+    _crash_count += 1\n+    if _crash_count >= _CRASH_LIMIT:\n+        _circuit_open = True\n+        logger.warning(\n+            \"tirith circuit breaker opened after %d consecutive failures; \"\n+            \"disabling for the rest of the process\",\n+            _crash_count,\n+        )\n+\n # Background install thread coordination\n _install_lock = threading.Lock()\n _install_thread: threading.Thread | None = None","@@ -708,11 +737,21 @@ def check_command_security(command: str) -> dict:\n     Returns:\n         {\"action\": \"allow\"|\"warn\"|\"block\", \"findings\": [...], \"summary\": str}\n     \"\"\"\n+    global _crash_count, _circuit_open\n+\n     cfg = _load_security_config()\n \n     if not cfg[\"tirith_enabled\"]:\n         return {\"action\": \"allow\", \"findings\": [], \"summary\": \"\"}\n \n+    # Circuit breaker: if tirith has crashed _CRASH_LIMIT times in a row,\n+    # stop trying for the rest of the process.  Without this, a corrupted\n+    # or missing binary causes every tool call to hit the same spawn failure\n+    # → fail-open → agent retry loop, hanging the user for 20+ minutes\n+    # (issue #41400).\n+    if _circuit_open:\n+        return {\"action\": \"allow\", \"findings\": [], \"summary\": \"tirith disabled (circuit breaker)\"}\n+\n     # Unsupported platform (Windows etc.) — tirith has no binary here and\n     # never will. Skip the resolver entirely so we don't even try to spawn.\n     # Pattern-matching guards still run via the rest of approval.py.","@@ -750,6 +789,7 @@ def check_command_security(command: str) -> dict:\n         # install marked failed for the day).\n         spawn_key = f\"tirith_spawn_failed:{type(exc).__name__}:{getattr(exc, 'errno', '')}\"\n         _warn_once(spawn_key, \"tirith spawn failed: %s\", exc)\n+        _record_tirith_crash()\n         if fail_open:\n             return {\"action\": \"allow\", \"findings\": [], \"summary\": f\"tirith unavailable: {exc}\"}\n         return {\"action\": \"block\", \"findings\": [], \"summary\": f\"tirith spawn failed (fail-closed): {exc}\"}","@@ -759,6 +799,7 @@ def check_command_security(command: str) -> dict:\n             \"tirith timed out after %ds\",\n             timeout,\n         )\n+        _record_tirith_crash()\n         if fail_open:\n             return {\"action\": \"allow\", \"findings\": [], \"summary\": f\"tirith timed out ({timeout}s)\"}\n         return {\"action\": \"block\", \"findings\": [], \"summary\": \"tirith timed out (fail-closed)\"}","@@ -767,13 +808,17 @@ def check_command_security(command: str) -> dict:\n     exit_code = result.returncode\n     if exit_code == 0:\n         action = \"allow\"\n+        # Successful execution — reset circuit breaker\n+        _crash_count = 0\n     elif exit_code == 1:\n         action = \"block\"\n     elif exit_code == 2:\n         action = \"warn\"\n     else:\n-        # Unknown exit code — respect fail_open\n+        # Unknown exit code (includes signal-killed processes like -11/SIGSEGV)\n+        # — respect fail_open\n         logger.warning(\"tirith returned unexpected exit code %d\", exit_code)\n+        _record_tirith_crash()\n         if fail_open:\n             return {\"action\": \"allow\", \"findings\": [], \"summary\": f\"tirith exit code {exit_code} (fail-open)\"}\n         return {\"action\": \"block\", \"findings\": [], \"summary\": f\"tirith exit code {exit_code} (fail-closed)\"}\n"]}]},{"kind":"pr","number":53797,"title":"fix(tirith): honour tirith_fail_open=false when the circuit breaker is open","url":null,"state":"closed","close_reason":{"category":"duplicate_of","implication":"duplicate"},"merged":false},{"kind":"pr","number":69646,"title":"fix(tirith): add Windows support for auto-install","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"a91b1c8b3","number":0},{"kind":"commit","value":"a91b1c8b3","number":0},{"kind":"commit","value":"d664ff7e5a9b","number":0},{"kind":"pr","value":"#8615","number":8615},{"kind":"pr","value":"#26069","number":26069},{"kind":"pr","value":"#26132","number":26132},{"kind":"pr","value":"#69646","number":69646},{"kind":"pr","value":"#26068","number":26068},{"kind":"pr","value":"#23050","number":23050},{"kind":"pr","value":"#8615","number":8615},{"kind":"pr","value":"#23050","number":23050},{"kind":"pr","value":"#26068","number":26068},{"kind":"pr","value":"#26044","number":26044},{"kind":"pr","value":"#26140","number":26140},{"kind":"pr","value":"#26069","number":26069},{"kind":"pr","value":"#26068","number":26068},{"kind":"pr","value":"#26132","number":26132},{"kind":"pr","value":"#26068","number":26068},{"kind":"pr","value":"#69646","number":69646},{"kind":"pr","value":"#26068","number":26068},{"kind":"pr","value":"#69646","number":69646},{"kind":"pr","value":"#8615","number":8615},{"kind":"pr","value":"#26068","number":26068},{"kind":"pr","value":"#26069","number":26069},{"kind":"pr","value":"#26132","number":26132},{"kind":"pr","value":"#69646","number":69646},{"kind":"pr","value":"#26069","number":26069},{"kind":"pr","value":"#26132","number":26132},{"kind":"pr","value":"#26068","number":26068},{"kind":"pr","value":"#23050","number":23050},{"kind":"pr","value":"#26068","number":26068},{"kind":"pr","value":"#69646","number":69646},{"kind":"pr","value":"#26068","number":26068},{"kind":"pr","value":"#69646","number":69646},{"kind":"pr","value":"#26068","number":26068},{"kind":"pr","value":"#374151","number":374151},{"kind":"pr","value":"#26044","number":26044},{"kind":"pr","value":"#26140","number":26140},{"kind":"pr","value":"#8615","number":8615},{"kind":"pr","value":"#23050","number":23050},{"kind":"pr","value":"#26068","number":26068},{"kind":"pr","value":"#26069","number":26069},{"kind":"pr","value":"#26132","number":26132},{"kind":"pr","value":"#69646","number":69646}],"category":"partial_fix","implication":"needs_llm"},"merged":false}],"trust":{"default_tier":"verified","includes_suggested":false}}