Split from #195, fix 1. Smallest of the four and the one that destroyed work.
afx send --interrupt sends Ctrl+C to a builder unconditionally. That signal does not mean the
same thing to every harness:
- claude and codex treat Ctrl+C as pause the turn.
- opencode treats it as quit.
Verified 2026-08-29 in the Tower log. Ctrl+C delivered to builder-bugfix-189 (opencode) at
16:59:52; by 17:00:22 the shellper was gone:
16:59:52 Message delivered (interrupt): architect → builder-bugfix-189 (terminal 8a713e8b...)
17:00:22 On-the-fly shellper reconnect for 8a713e8b-...
17:00:22 Session ... reconnect failed: socket missing or lstat error
The work survived because it was already committed, but the session did not — and opencode has no
conversation resume, so the replacement woke with no memory of what it had done. It only avoided
starting over because an architect hand-wrote a briefing.
Nothing in the flag's name, help text, or output warns that it is fatal on one of the three
shipped harnesses. The operator learns by losing a session.
The fix
Record the safe interrupt signal per harness, next to the other per-harness facts in
utils/harness.ts / gate-profiles.ts:
interruptSignal: 'esc'|'ctrl-c'
Then afx send --interrupt and any other caller must resolve the signal from the harness
rather than hardcoding \x03. On a harness whose signal is esc, either refuse with a named
reason or downgrade to ESC — never send a byte recorded as fatal for that app.
Derive, do not restate. One table, read by every caller. A second hardcoded \x03 anywhere
else reintroduces this.
Tests
- Ctrl+C is sent for a
ctrl-c harness. - Ctrl+C is never sent for an
esc harness — assert on the bytes written, not on a return
value. - The mapping covers every harness in the registry: iterate
PROFILES_BY_HARNESS (or the harness
registry) and fail if any entry lacks a signal. A new harness must not default into ctrl-c
by omission — that is exactly how this would come back.
Test 3 is the one that matters. It makes the guard assert its own reach.
Scope
Do not touch commands/spawn.ts or commands/spawn-worktree.ts — builder/spir-146 has
substantial uncommitted-to-main changes there and will conflict.
Related: #195 (parent), #190.
Split from #195, fix 1. Smallest of the four and the one that destroyed work.
afx send --interruptsends Ctrl+C to a builder unconditionally. That signal does not mean thesame thing to every harness:
Verified 2026-08-29 in the Tower log. Ctrl+C delivered to
builder-bugfix-189(opencode) at16:59:52; by 17:00:22 the shellper was gone:
The work survived because it was already committed, but the session did not — and opencode has no
conversation resume, so the replacement woke with no memory of what it had done. It only avoided
starting over because an architect hand-wrote a briefing.
Nothing in the flag's name, help text, or output warns that it is fatal on one of the three
shipped harnesses. The operator learns by losing a session.
The fix
Record the safe interrupt signal per harness, next to the other per-harness facts in
utils/harness.ts/gate-profiles.ts:Then
afx send --interruptand any other caller must resolve the signal from the harnessrather than hardcoding
\x03. On a harness whose signal isesc, either refuse with a namedreason or downgrade to ESC — never send a byte recorded as fatal for that app.
Derive, do not restate. One table, read by every caller. A second hardcoded
\x03anywhereelse reintroduces this.
Tests
ctrl-charness.escharness — assert on the bytes written, not on a returnvalue.
PROFILES_BY_HARNESS(or the harnessregistry) and fail if any entry lacks a signal. A new harness must not default into
ctrl-cby omission — that is exactly how this would come back.
Test 3 is the one that matters. It makes the guard assert its own reach.
Scope
Do not touch
commands/spawn.tsorcommands/spawn-worktree.ts—builder/spir-146hassubstantial uncommitted-to-main changes there and will conflict.
Related: #195 (parent), #190.