Antigravity: reap MCP servers left behind by the usage probe

[bcharleson]

Summary

CodexBar's Antigravity print-usage probe (agy -p /usage in a codexbar-agy-usage-* temp directory) starts the user's configured MCP servers and then exits. On agy 1.2.2 and later the managed local-server path is skipped because of the CSRF token, so every refresh takes this print path.

Servers launched with npx / npm exec call setsid. When agy exits they are reparented to launchd, stay in that temp directory, and each sit at about 100% CPU. The next refresh adds another set. SubprocessRunner only reaps descendants on timeout or cancellation, and only while the parent is still alive, so a successful or already-exited probe leaves them running.

This records descendant identities while the probe process is alive and signals any that are still running after it exits. It also kills whatever is left with that temp directory as its cwd before the directory is removed. Both signals re-check the process start token, so a PID reused during the wait is not killed. Both cases are covered by new SubprocessRunner tests, including a child that called start_new_session.

Test plan

• swift test --filter 'reapDescendants kills|working directory reaper kills'
• Refresh Antigravity usage with agy 1.2.2+ and several npx MCP servers configured, then confirm no npm exec processes remain parented to launchd

Redacted macOS refresh (agy 1.2.12, MCP servers configured)

.build/debug/CodexBarCLI usage --provider antigravity --source cli --format json
exit 0
provider=antigravity source=cli
primary.usedPercent=0.16 secondary.usedPercent=0

npm exec processes immediately after, and again 2 seconds later, were the same set as before the command. Every one was parented to an already-running app. None were parented to launchd, and the refresh did not add any.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 27, 2026, 10:30 PM ET / September 28, 2026, 02:30 UTC (Revision 2).

ClawSweeper review

What this changes

The PR tracks processes started by Antigravity’s CLI usage probe and stops surviving descendants or processes still using the probe’s temporary directory.

Merge readiness

⛔ Blocked before merge - 6 items remain

The cleanup is still useful because current main does not reap detached MCP servers after a successful Antigravity usage probe. The updated head fixes the previously reported child PID escalation gap, but the parent PID can still be reused while descendant polling continues, and the supplied macOS trace does not show the process observations needed to verify cleanup.

Priority: P2
Reviewed head: 6ae8c7c1107112905d6fbbf5271cb76ae563c7be

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The focused repair and tests provide useful signal, but process-selection safety and observable runtime cleanup proof remain incomplete.
Proof confidence	🦪 silver shellfish (2/6)	Needs stronger real behavior proof before merge: Authority-chain proof required: the Antigravity CLI entrypoint has a reported agy 1.2.12 macOS refresh with successful usage output, but the captured evidence does not show before and after process identities or prove that a reassigned probe PID is rejected before signaling. A redacted process trace and a focused final-effect PID-reassignment check would close those gaps; no stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: Authority-chain proof required: the Antigravity CLI entrypoint has a reported agy 1.2.12 macOS refresh with successful usage output, but the captured evidence does not show before and after process identities or prove that a reassigned probe PID is rejected before signaling. A redacted process trace and a focused final-effect PID-reassignment check would close those gaps; no stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	7 items	Introduced polling behavior: The introduced detached task repeatedly scans descendants of the numeric probe PID without checking the probe’s start identity; a final scan also runs after exit. Final signaling path: Tracked descendant identities are signaled after probe completion. Child identity checks protect against child PID reuse, but they do not establish that a subsequently scanned parent PID is still the probe. Prior finding addressed: The new directory sweep records process start tokens and checks them again before SIGTERM and SIGKILL, addressing the previous review’s escalation finding.
Findings	1 actionable finding	[P2] Verify the probe identity before each descendant scan
Security	Needs attention	Reassigned parent PID can select another process’s children: Child start-token checks do not authenticate the parent whose descendants are discovered; a reused parent PID can lead to signals against processes outside the probe.

How this fits together

CodexBar runs Antigravity’s CLI to obtain usage data. The CLI can start configured MCP servers; the new cleanup runs after the usage command exits and before its temporary directory is removed.

flowchart LR
A[Usage refresh] --> B[Antigravity CLI probe]
B --> C[Configured MCP servers]
B --> D[Process tracking]
C --> E[Temporary directory scan]
D --> F[Identity check and cleanup]
E --> F
F --> G[Usage result]

Loading

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: Authority-chain proof required: the Antigravity CLI entrypoint has a reported agy 1.2.12 macOS refresh with successful usage output, but the captured evidence does not show before and after process identities or prove that a reassigned probe PID is rejected before signaling. A redacted process trace and a focused final-effect PID-reassignment check would close those gaps; no stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Verify the probe identity before each descendant scan (P2) - The poller and final scan use the saved numeric PID after the probe may have exited. If that PID is reassigned before polling stops, the tracker can collect the new process’s children and later signal them. Capture the probe’s start identity and stop scanning when it no longer matches.
• Resolve security concern: Reassigned parent PID can select another process’s children - Child start-token checks do not authenticate the parent whose descendants are discovered; a reused parent PID can lead to signals against processes outside the probe.
• Resolve merge risk (P1) - If the exited probe’s PID is reused before polling stops, cleanup can record and signal descendants of an unrelated process.
• Resolve merge risk (P1) - The supplied refresh output does not include the process listing or equivalent diagnostic trace needed to verify that configured MCP servers were cleaned up.
• Complete next step (P2) - Guard polling against probe PID reassignment, demonstrate rejection before signaling an unrelated process, and add a redacted before and after process trace from the reported macOS refresh. Updating the PR body should trigger re-review; if it does not, a maintainer can request @clawsweeper re-review.

Findings

• [P2] Verify the probe identity before each descendant scan — Sources/CodexBarCore/Host/Process/SubprocessRunner.swift:211-215
• [medium] Reassigned parent PID can select another process’s children — Sources/CodexBarCore/Host/Process/SubprocessRunner.swift:214

Agent review details

Security

Needs attention: The process tracker can signal descendants of an unrelated process if the probe PID is reassigned before polling ends.

Review metrics

Metric	Value	Why it matters
Code growth	production +159, tests +101	The new process sweep and tracker account for most of the production growth and need focused process-identity validation.

Merge-risk options

Maintainer options:

1. Guard the probe identity (recommended)
   Stop descendant scans when the recorded probe start identity no longer matches, and cover PID reassignment before a signal reaches an unrelated process.
2. Pause pending process proof
   Hold the PR until the contributor supplies a redacted before and after process trace from the reported macOS setup.

Technical review

Best possible solution:

Bind descendant polling to the probe’s PID and start identity, then show a redacted macOS refresh with before and after PID and parent-PID observations from configured MCP servers.

Do we have a high-confidence way to reproduce the issue?

No high-confidence current-main runtime reproduction was performed in this read-only review. Current source shows the missing successful-exit cleanup, and the PR body reports a macOS reproduction without a captured process listing.

Is this the best way to solve the issue?

The temporary-directory sweep and descendant tracking target the reported leak. The tracker also needs to verify the parent process identity before each scan, and the reported runtime result needs observable process evidence.

Full review comments:

• [P2] Verify the probe identity before each descendant scan — Sources/CodexBarCore/Host/Process/SubprocessRunner.swift:211-215
  The poller and final scan use the saved numeric PID after the probe may have exited. If that PID is reassigned before polling stops, the tracker can collect the new process’s children and later signal them. Capture the probe’s start identity and stop scanning when it no longer matches.
  Confidence: 0.86

Overall correctness: patch is incorrect
Overall confidence: 0.84

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against cda264c299ad.

Labels

Label changes:

No label changes.

Label justifications:

• P2: The patch addresses recurring CPU use during Antigravity refreshes, with a bounded but material process safety concern.
• merge-risk: 🚨 availability: A reused probe PID could cause the new cleanup path to terminate an unrelated running process.
• merge-risk: 🚨 security-boundary: The tracker can turn a reassigned numeric PID into authority to signal another process without revalidating the original probe identity.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Authority-chain proof required: the Antigravity CLI entrypoint has a reported agy 1.2.12 macOS refresh with successful usage output, but the captured evidence does not show before and after process identities or prove that a reassigned probe PID is rejected before signaling. A redacted process trace and a focused final-effect PID-reassignment check would close those gaps; no stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

Security concerns:

• [medium] Reassigned parent PID can select another process’s children — Sources/CodexBarCore/Host/Process/SubprocessRunner.swift:214
  Child start-token checks do not authenticate the parent whose descendants are discovered; a reused parent PID can lead to signals against processes outside the probe.
  Confidence: 0.82

What I checked:

• Introduced polling behavior: The introduced detached task repeatedly scans descendants of the numeric probe PID without checking the probe’s start identity; a final scan also runs after exit. (Sources/CodexBarCore/Host/Process/SubprocessRunner.swift:211, 6ae8c7c11071)
• Final signaling path: Tracked descendant identities are signaled after probe completion. Child identity checks protect against child PID reuse, but they do not establish that a subsequently scanned parent PID is still the probe. (Sources/CodexBarCore/Host/Process/SubprocessRunner.swift:343, 6ae8c7c11071)
• Prior finding addressed: The new directory sweep records process start tokens and checks them again before SIGTERM and SIGKILL, addressing the previous review’s escalation finding. (Sources/CodexBarCore/Host/Process/ProcessWorkingDirectoryReaper.swift:19, 6ae8c7c11071)
• Existing process identity helper: The existing helper identifies a process by PID and start time, providing a way to guard each parent scan. (Sources/CodexBarCore/Host/PTY/TTYCommandRunner.swift:215, 6ae8c7c11071)
• Current main still needs the fix: Current main launches the subprocess without descendant tracking and removes the temporary directory without a process sweep. (Sources/CodexBarCore/Providers/Antigravity/AntigravityProviderDescriptor.swift:580, cda264c299ad)
• Contributor runtime evidence: The captured PR body reports an agy 1.2.12 macOS CLI refresh and says the npm process set was unchanged afterward. Its copied command output shows usage values, but it omits the before and after PID and parent-PID observations supporting that process claim.

Likely related people:

• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• sobczi: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Niclas: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Guard every descendant scan with the original probe’s start identity and prove a reassigned PID is rejected before a signal is sent.
• Add a redacted macOS before and after PID/parent-PID trace for configured MCP servers; remove private paths, endpoints, and credentials.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-09-27T22:54:32.358Z sha 190dbfc :: needs real behavior proof before merge. :: [P2] Verify the process identity before escalating to SIGKILL