fix(cli): Auto restart CLI inner node process on trust change (#8378)

packages/cli/src/utils/processUtils.test.ts

@@ -0,0 +1,22 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { vi } from 'vitest';
+import { RELAUNCH_EXIT_CODE, relaunchApp } from './processUtils.js';
+import * as cleanup from './cleanup.js';
+
+describe('processUtils', () => {
+  const processExit = vi
+    .spyOn(process, 'exit')
+    .mockReturnValue(undefined as never);
+  const runExitCleanup = vi.spyOn(cleanup, 'runExitCleanup');
+
+  it('should run cleanup and exit with the relaunch code', async () => {
+    await relaunchApp();
+    expect(runExitCleanup).toHaveBeenCalledTimes(1);
+    expect(processExit).toHaveBeenCalledWith(RELAUNCH_EXIT_CODE);
+  });
+});

packages/cli/src/utils/processUtils.ts

@@ -0,0 +1,20 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { runExitCleanup } from './cleanup.js';
+
+/**
+ * Exit code used to signal that the CLI should be relaunched.
+ */
+export const RELAUNCH_EXIT_CODE = 42;
+
+/**
+ * Exits the process with a special code to signal that the parent process should relaunch it.
+ */
+export async function relaunchApp(): Promise<void> {
+  await runExitCleanup();
+  process.exit(RELAUNCH_EXIT_CODE);
+}

packages/cli/src/utils/sandbox.ts

@@ -188,7 +188,7 @@ export async function start_sandbox(
   nodeArgs: string[] = [],
   cliConfig?: Config,
   cliArgs: string[] = [],
-) {
+): Promise<number> {
   const patcher = new ConsolePatcher({
     debugMode: cliConfig?.getDebugMode() || !!process.env['DEBUG'],
     stderr: true,
@@ -339,11 +339,17 @@ export async function start_sandbox(
         );
       }
       // spawn child and let it inherit stdio
+      process.stdin.pause();
       sandboxProcess = spawn(config.command, args, {
         stdio: 'inherit',
       });
-      await new Promise((resolve) => sandboxProcess?.on('close', resolve));
-      return;
+      return new Promise((resolve, reject) => {
+        sandboxProcess?.on('error', reject);
+        sandboxProcess?.on('close', (code) => {
+          process.stdin.resume();
+          resolve(code ?? 1);
+        });
+      });
     }
 
     console.error(`hopping into sandbox (command: ${config.command}) ...`);
@@ -790,22 +796,25 @@ export async function start_sandbox(
     }
 
     // spawn child and let it inherit stdio
+    process.stdin.pause();
     sandboxProcess = spawn(config.command, args, {
       stdio: 'inherit',
     });
 
-    sandboxProcess.on('error', (err) => {
-      console.error('Sandbox process error:', err);
-    });
+    return new Promise<number>((resolve, reject) => {
+      sandboxProcess.on('error', (err) => {
+        console.error('Sandbox process error:', err);
+        reject(err);
+      });
 
-    await new Promise<void>((resolve) => {
       sandboxProcess?.on('close', (code, signal) => {
-        if (code !== 0) {
+        process.stdin.resume();
+        if (code !== 0 && code !== null) {
           console.log(
             `Sandbox process exited with code: ${code}, signal: ${signal}`,
           );
         }
-        resolve();
+        resolve(code ?? 1);
       });
     });
   } finally {