Prevent background agents from mislabeling terminal tabs (#39778)

* Prevent background agents from mislabeling terminal tabs

* fix: isolate background agent hook recovery

src/main/command-code/command-code-managed-script.ts

@@ -1,4 +1,5 @@
 import { posixCurlCommand } from '../agent-hooks/installation/scripts/hook-post-command'
+import { ORCA_AGENT_HOOKS_DISABLED_ENV } from '../../shared/agent-hook-listener/transport/agent-hook-suppression-env'
 import { buildWindowsAgentHookPostCommand } from '../agent-hooks/installation/commands/windows-agent-hook-post-command'
 import {
   buildPosixHookPayloadCapture,
@@ -15,6 +16,7 @@ export function buildCommandCodeManagedScript(
     return [
       '@echo off',
       'setlocal',
+      `if "%${ORCA_AGENT_HOOKS_DISABLED_ENV}%"=="1" exit /b 0`,
       'if "%ORCA_AGENT_HOOK_PORT%"=="" if defined ORCA_AGENT_HOOK_ENDPOINT if exist "%ORCA_AGENT_HOOK_ENDPOINT%" call "%ORCA_AGENT_HOOK_ENDPOINT%" 2>nul',
       'if "%ORCA_AGENT_HOOK_TOKEN%"=="" if not "%ORCA_AGENT_HOOK_PORT%"=="" call :sourceEndpointByPort',
       ...buildWindowsHookEnvironmentGuardLines(),
@@ -42,18 +44,22 @@ export function buildCommandCodeManagedScript(
   return [
     '#!/bin/sh',
     ...buildPosixHookPayloadCapture(),
+    `if [ "\${${ORCA_AGENT_HOOKS_DISABLED_ENV}:-}" = 1 ]; then exit 0; fi`,
     ...buildPosixHookSpoolLines('command-code'),
     '__orca_read_ancestor_var() {',
     '  __orca_name="$1"',
     '  __orca_pid="${PPID:-}"',
     '  while [ -n "$__orca_pid" ] && [ "$__orca_pid" != "0" ] && [ "$__orca_pid" != "1" ]; do',
-    '    __orca_value=""',
+    '    __orca_env=""',
     '    if [ -r "/proc/$__orca_pid/environ" ]; then',
-    '      __orca_value=$(tr "\\000" "\\n" < "/proc/$__orca_pid/environ" 2>/dev/null | sed -n "s/^${__orca_name}=//p" | head -n 1)',
+    '      __orca_env=$(tr "\\000" "\\n" < "/proc/$__orca_pid/environ" 2>/dev/null)',
     '    fi',
-    '    if [ -z "$__orca_value" ]; then',
-    '      __orca_value=$(ps eww -p "$__orca_pid" -o command= 2>/dev/null | tr " " "\\n" | sed -n "s/^${__orca_name}=//p" | head -n 1)',
+    '    if [ -z "$__orca_env" ]; then',
+    '      __orca_env=$(ps eww -p "$__orca_pid" -o command= 2>/dev/null | tr " " "\\n")',
     '    fi',
+    // A scrubbed hook may recover identity, but must never cross a background launch.
+    `    if printf '%s\\n' "$__orca_env" | grep -qx '${ORCA_AGENT_HOOKS_DISABLED_ENV}=1'; then return 1; fi`,
+    '    __orca_value=$(printf "%s\\n" "$__orca_env" | sed -n "s/^${__orca_name}=//p" | head -n 1)',
     '    if [ -n "$__orca_value" ]; then',
     '      printf "%s\\n" "$__orca_value"',
     '      return 0',

src/main/command-code/hook-service.test.ts

@@ -1,5 +1,6 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { spawn } from 'node:child_process'
+import { spawnProcess } from '@orca/process-host'
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { createServer } from 'node:http'
 import { tmpdir } from 'node:os'
@@ -35,6 +36,80 @@ describe('CommandCodeHookService', () => {
 
   const itPosix = process.platform === 'win32' ? it.skip : it
 
+  itPosix(
+    'stops identity recovery at a background ancestor even when the hook env is scrubbed',
+    async () => {
+      new CommandCodeHookService().install()
+      const requests: string[] = []
+      const server = createServer((req, res) => {
+        let body = ''
+        req.setEncoding('utf8')
+        req.on('data', (chunk) => (body += chunk))
+        req.on('end', () => {
+          requests.push(new URLSearchParams(body).get('paneKey') ?? '')
+          res.writeHead(204).end()
+        })
+      })
+      const ancestor = join(homeDir, 'ancestor.cjs')
+      writeFileSync(
+        ancestor,
+        `const { spawn } = require('node:child_process')
+const [hook, disabled, stage] = process.argv.slice(2)
+const env = { PATH: process.env.PATH, HOME: process.env.HOME }
+const child = stage === 'ancestor'
+  ? spawn(process.execPath, [__filename, hook, disabled, 'background'], {
+      env: { ...env, ORCA_AGENT_HOOKS_DISABLED: disabled },
+      stdio: ['ignore', 'inherit', 'inherit']
+    })
+  : spawn('/bin/sh', [hook], { env, stdio: ['pipe', 'inherit', 'inherit'] })
+if (stage !== 'ancestor') child.stdin.end(JSON.stringify({ hook_event_name: 'Stop' }))
+child.on('error', error => { throw error })
+child.on('close', code => { process.exitCode = code ?? 1 })
+`
+      )
+      try {
+        await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
+        const address = server.address() as AddressInfo
+        const run = async (disabled: string) => {
+          const child = spawnProcess({
+            program: process.execPath,
+            args: [
+              ancestor,
+              join(homeDir, '.orca', 'agent-hooks', 'command-code-hook.sh'),
+              disabled,
+              'ancestor'
+            ],
+            env: {
+              ...process.env,
+              HOME: homeDir,
+              ORCA_AGENT_HOOKS_DISABLED: '0',
+              ORCA_AGENT_HOOK_PORT: String(address.port),
+              ORCA_AGENT_HOOK_TOKEN: 'test-token',
+              ORCA_PANE_KEY: 'recovered-tab:leaf',
+              ORCA_TAB_ID: 'recovered-tab',
+              ORCA_WORKTREE_ID: 'folder-workspace',
+              ORCA_AGENT_LAUNCH_TOKEN: 'parent-launch'
+            },
+            stdio: ['ignore', 'ignore', 'pipe']
+          })
+          let stderr = ''
+          child.stderr?.on('data', (chunk) => (stderr += chunk))
+          const code = await new Promise<number | null>((resolve, reject) => {
+            child.on('error', reject)
+            child.on('close', resolve)
+          })
+          expect(code, stderr).toBe(0)
+        }
+        await run('0')
+        expect(requests).toEqual(['recovered-tab:leaf'])
+        await run('1')
+        expect(requests).toEqual(['recovered-tab:leaf'])
+      } finally {
+        await new Promise<void>((resolve) => server.close(() => resolve()))
+      }
+    }
+  )
+
   itPosix('does not let stale endpoint files clobber recovered connection fields', async () => {
     new CommandCodeHookService().install()