fix: bound Linux child process execution

Replace the unbounded POSIX system call with fork, exec, wait, and process-group cleanup. Add native timeout regression coverage and document the Linux runtime and optional WSL PATH setup.

Author: MaxLogic

CHANGELOG.md

@@ -10,6 +10,11 @@
 
 - Changed `EncodingFixTool.sh` to launch the native Linux64 executable directly instead of invoking the Windows EXE through WSL interoperability.
 - Made Git execution, shell quoting, user config discovery, and path containment platform-correct; Linux avoids treating its UTF-8 default encoding as a legacy ANSI candidate while Windows retains active-code-page compatibility.
+- Updated the agent skill with the native Linux runtime layout, optional WSL `PATH` setup, and fresh-shell verification.
+
+### Fixed
+
+- Bounded Linux Git command execution to 30 seconds and terminated the command process group on timeout so child processes are not left running.
 
 ## [v1.5] - 2026-06-24
 

TASKS.md

@@ -1,10 +1,10 @@
 # Tasks
 
-Next task ID: T-010
+Next task ID: T-011
 
 ## Summary
 Open tasks: 1 (In Progress: 0, Next Today: 0, Next This Week: 0, Next Later: 1, Blocked: 0)
-Done tasks: 8
+Done tasks: 9
 
 ## In Progress
 
@@ -14,23 +14,43 @@ Done tasks: 8
 
 ## Next - Later
 
-### T-009 [CLI] Bound POSIX child-process execution
+### T-010 [BUILD] Repair Delphi 12 command-line Linux64 RTL loading
 Outcome:
-- Linux command execution enforces the same 30-second upper bound as Windows without depending on an optional external `timeout` command.
-- Timeout cleanup terminates and reaps the child process without leaving Git processes behind.
-- Native Linux regression coverage verifies successful commands and timeout behavior.
+- Delphi 12 command-line Linux64 builds can load the installed `Posix.Unistd.dcu`.
+- DelphiAIKit and raw MSBuild rebuild Linux64 projects as reliably as the RAD Studio IDE.
 Proof:
-- Run: `wsl.exe -e bash tests/Invoke-EncodingFixTool.Linux64.Tests.sh`
-  Expect: exit=0, timeout regression passes, and no test-owned child process remains.
 - Run: `& $env:DAK_EXE build --project src\EncodingFixTool.dproj --delphi 23.0 --platform Linux64 --config Release --target Rebuild --ai --show-warnings`
   Expect: exit=0, zero warnings, zero errors.
-Touches: src/EncodingFixToolCore.pas, tests/Invoke-EncodingFixTool.Linux64.Tests.sh
-Verify: integration-test, build-only
+- Run a minimal Linux64 program whose only dependency is `System.SysUtils` through `dcclinux64.exe`.
+  Expect: compilation reaches the linker instead of failing with F2063 for `Posix.Unistd`.
+Touches: Delphi 12 installation or DelphiAIKit build environment
+Verify: build-only
+Notes: The project search path contains the expected Delphi 12 Linux64 release RTL folder, and namespace variants do not change the failure. A minimal `uses Posix.Unistd` probe fails under `dcclinux64.exe`; `System.SysUtils` fails transitively on the same unit, while other POSIX DCUs load. Raw MSBuild reproduces DAK, so this is not caused by EncodingFixTool conditionals or DAK command construction. RAD Studio succeeds through its in-process Linux64 compiler DLL.
 
 ## Blocked
 
 ## Done
 
+### T-009 [CLI] Bound POSIX child-process execution
+Completed: 2026-07-11
+Outcome:
+- Linux command execution enforces the same 30-second upper bound as Windows without depending on an optional external `timeout` command.
+- Timeout cleanup terminates and reaps the child process group without leaving Git processes behind.
+- Native Linux regression coverage verifies successful commands and timeout behavior.
+Proof:
+- PASS: RAD Studio Linux64 Release rebuild.
+  Result: zero errors; produced `bin/Linux64/EncodingFixTool` as a native ELF executable.
+- PASS: `wsl.exe -e bash tests/Invoke-EncodingFixTool.Linux64.Tests.sh`
+  Result: exit=0 in 36.2 seconds; timeout regression passed and verified that both the shell and descendant process were gone.
+- PASS: `.\bin\EncodingFixTool.Tests.exe`
+  Result: exit=0, 31 passed, 0 failed, 0 ignored.
+- PASS: `powershell -NoProfile -ExecutionPolicy Bypass -File tests\Invoke-EncodingFixTool.Tests.ps1`
+  Result: exit=0, output contains `EncodingFixTool CLI tests passed.`
+- DIAGNOSTIC: DelphiAIKit, raw MSBuild, and a minimal `dcclinux64.exe` probe all fail in the installed command-line toolchain with F2063 for `Posix.Unistd`; tracked separately as T-010.
+Touches: src/EncodingFixToolCore.pas, tests/Invoke-EncodingFixTool.Linux64.Tests.sh, agent-skill/encodingfix-delphi-cleanup/
+Verify: integration-test, build-only
+Notes: Strict RED/GREEN was completed. RED reached the 35-second emergency harness limit with exit 124. GREEN enforces the production timeout internally, terminates the process group, reaps the child, and emits `process timed out`. The IDE-built Linux64 executable supplied the native runtime proof; T-010 isolates the unrelated standalone compiler installation failure.
+
 ### T-008 [CLI] Add native Linux64 support
 Completed: 2026-07-10
 Outcome:

agent-skill/encodingfix-delphi-cleanup/SKILL.md

@@ -16,6 +16,35 @@ Run EncodingFixTool after AI/editor work may have changed Delphi line endings or
 
 Do not use it for unrelated dirty files, vendored code, non-Delphi cleanup, or as a replacement for the repo's build/test gates. Binary `.dfm` files are safe because EncodingFixTool skips them.
 
+## Runtime Setup
+
+The Linux/WSL runtime consists of both files in this layout:
+
+```text
+bin/EncodingFixTool.sh
+bin/Linux64/EncodingFixTool
+```
+
+The wrapper launches the native Linux64 binary directly. It does not use `EncodingFixTool.exe`, `wslpath`, or WSL Windows interoperability. Keep the wrapper executable and the `Linux64` directory next to it.
+
+Adding `bin` to `PATH` is optional. It is needed only to invoke `EncodingFixTool.sh` by name from any directory; repo-local `./bin/EncodingFixTool.sh` works without it. For Bash login shells, add the native Linux path to `~/.profile`:
+
+```bash
+case ":$PATH:" in
+  *:/absolute/path/to/EncodingFix/bin:*) ;;
+  *) export PATH="/absolute/path/to/EncodingFix/bin:$PATH" ;;
+esac
+```
+
+Add the same idempotent entry to `~/.bashrc` when direct non-login interactive shells must resolve it. Non-interactive automation does not reliably read either file; give the runner an explicit `PATH` or use the absolute/repo-local wrapper path.
+
+For a checkout on a mounted Windows drive, convert the directory once when determining that native path, for example `wslpath -u 'F:\projects\MaxLogic\EncodingFix\bin'`. Verify the shell modes configured by our setup before relying on the command:
+
+```bash
+command -v EncodingFixTool.sh
+EncodingFixTool.sh help >/dev/null
+```
+
 ## Core Workflow
 
 1. Check the dirty set first:
@@ -28,7 +57,7 @@ If unrelated user changes are dirty, avoid broad cleanup. Narrow `path=...`, ove
 
 2. In a Git worktree, prefer the AI cleanup preset.
 
-From Linux or WSL, run the Bash wrapper. It launches the native Linux64 binary directly, so Linux paths are passed through unchanged and WSL Windows interoperability is not involved. If the repo `bin` directory is on `PATH`, prefer:
+From Linux or WSL, run the Bash wrapper. Linux paths are passed through unchanged. If the repo `bin` directory is on `PATH`, prefer:
 
 ```bash
 EncodingFixTool.sh path=. preset=delphi-ai scope=git-changed format=json

agent-skill/encodingfix-delphi-cleanup/evals/evals.json

@@ -15,6 +15,11 @@
       "id": 3,
       "prompt": "The worktree has my unrelated changes plus your generated Delphi units. Fix only your files' line endings and tell me what happened.",
       "expected_output": "The agent should not run a broad scope=git-changed cleanup over all dirty files. It should narrow path or extensions, ask if needed, run dry when scope is unclear, and report scanned/changed/skipped/failed counts."
+    },
+    {
+      "id": 4,
+      "prompt": "Set up EncodingFixTool for an agent running natively in WSL without Windows interop. Explain whether PATH is required and verify the installation.",
+      "expected_output": "The agent should keep bin/EncodingFixTool.sh beside bin/Linux64/EncodingFixTool, explain that PATH is optional unless the wrapper must run by name, use a native Linux bin path in ~/.profile for login shells and ~/.bashrc for non-login interactive Bash when requested, require an explicit path or PATH for non-interactive automation, and verify command resolution plus help output."
     }
   ]
 }

agent-skill/encodingfix-delphi-cleanup/references/encodingfix-tool.md

@@ -6,6 +6,15 @@ Use this reference when the standard `preset=delphi-ai scope=git-changed` workfl
 
 Prefer `EncodingFixTool` from `PATH` on Windows or `EncodingFixTool.sh` on Linux/WSL. Repo-local paths are `.\bin\EncodingFixTool.exe` on Windows and `./bin/EncodingFixTool.sh` on Linux/WSL. The shell launcher executes `bin/Linux64/EncodingFixTool` directly and does not use Windows interoperability.
 
+On Linux/WSL, the wrapper and binary are one runtime bundle:
+
+```text
+bin/EncodingFixTool.sh
+bin/Linux64/EncodingFixTool
+```
+
+`PATH` is optional. Add the absolute native `bin` path to `~/.profile` for login shells and to `~/.bashrc` for direct non-login interactive Bash shells. Non-interactive automation should receive an explicit `PATH` or use the absolute/repo-local wrapper path. Verify configured shells with `command -v EncodingFixTool.sh` followed by `EncodingFixTool.sh help`.
+
 ## Delphi AI Preset
 
 `preset=delphi-ai` is designed for AI/editor cleanup:
@@ -88,4 +97,4 @@ EncodingFixTool path=. preset=agent scope=git-changed format=json
 
 ## Install Or Copy
 
-To install this as an agent skill, copy the `encodingfix-delphi-cleanup/` folder into the agent's skills directory. Keep `SKILL.md`, `references/`, and `evals/` together.
+To install this as an agent skill, copy the `encodingfix-delphi-cleanup/` folder into the agent's skills directory. Keep `SKILL.md`, `references/`, and `evals/` together. The skill files do not install the CLI runtime: install or build the Windows executable separately, and on Linux/WSL keep `EncodingFixTool.sh` together with `Linux64/EncodingFixTool` as shown above.

src/EncodingFixToolCore.pas

@@ -23,7 +23,7 @@
 interface
 
 uses
-  System.Character, System.Classes, System.Diagnostics, System.Generics.Collections, System.IOUtils, System.StrUtils,
+  System.Character, System.Classes, System.Generics.Collections, System.IOUtils, System.StrUtils,
   System.SyncObjs, System.SysUtils, System.Threading;
 
 type
@@ -100,16 +100,75 @@       TSafeConsole = class
 implementation
 
 uses
-  System.JSON,
+  System.Diagnostics, System.JSON,
   System.WideStrUtils,
-{$IFDEF POSIX}
-  Posix.Stdlib,
-{$ELSE}
+{$IFDEF MSWINDOWS}
   Winapi.Windows,
 {$ENDIF}
   AutoFree;
 
+{$IFDEF POSIX}
+type
+  TPosixTimespec = record
+    Seconds: Int64;
+    Nanoseconds: Int64;
+  end;
+
 const
+  cLibC = 'libc.so.6';
+  cPosixInterrupted = 4;
+  cPosixNoHang = 1;
+  cPosixSignalKill = 9;
+
+function PosixClockGetTime(aClockId: integer; aTime: Pointer): integer; cdecl;
+  external cLibC name 'clock_gettime';
+function PosixErrorLocation: PInteger; cdecl; external cLibC name '__errno_location';
+function PosixExecv(aPath: PAnsiChar; aArgv: Pointer): integer; cdecl; external cLibC name 'execv';
+procedure PosixExit(aStatus: integer); cdecl; external cLibC name '_exit';
+function PosixFork: integer; cdecl; external cLibC name 'fork';
+function PosixKill(aPid, aSignal: integer): integer; cdecl; external cLibC name 'kill';
+function PosixSetProcessGroup(aPid, aProcessGroup: integer): integer; cdecl; external cLibC name 'setpgid';
+function PosixUSleep(aMicroseconds: Cardinal): integer; cdecl; external cLibC name 'usleep';
+function PosixWaitPid(aPid: integer; aStatus: PInteger; aOptions: integer): integer; cdecl;
+  external cLibC name 'waitpid';
+
+function PosixLastError: integer;
+begin
+  Result := PosixErrorLocation^;
+end;
+
+function PosixMonotonicMilliseconds: Int64;
+var
+  lTime: TPosixTimespec;
+begin
+  if PosixClockGetTime(1, @lTime) <> 0 then
+  begin
+    raise Exception.Create('clock_gettime failed');
+  end;
+  Result := (lTime.Seconds * 1000) + (lTime.Nanoseconds div 1000000);
+end;
+
+function PosixWaitForChild(aPid: integer; out aStatus: integer): boolean;
+var
+  lWaitPid: integer;
+begin
+  repeat
+    lWaitPid := PosixWaitPid(aPid, @aStatus, 0);
+    if lWaitPid = aPid then
+    begin
+      Exit(True);
+    end;
+    if (lWaitPid < 0) and (PosixLastError <> cPosixInterrupted) then
+    begin
+      Exit(False);
+    end;
+  until False;
+end;
+{$ENDIF}
+
+const
+  cCommandPollMs = 10;
+  cCommandTimeoutMs = 30000;
   cUtf8Bom0 = Byte($EF);
   cUtf8Bom1 = Byte($BB);
   cUtf8Bom2 = Byte($BF);
@@ -378,7 +437,16 @@ function TEncodingFixTool.RunCommand(const aCommandLine, aWorkingDirectory: stri
   lStartupInfo: TStartupInfo;
   lWaitResult: Cardinal;
 {$ELSE}
+  lArguments: array[0..3] of PAnsiChar;
   lCommandLine: UTF8String;
+  lPid: integer;
+  lReaped: boolean;
+  lShellArg: UTF8String;
+  lShellName: UTF8String;
+  lShellPath: UTF8String;
+  lStartTime: Int64;
+  lStatus: integer;
+  lWaitPid: integer;
 {$ENDIF}
 begin
 {$IFDEF MSWINDOWS}
@@ -394,7 +462,7 @@ function TEncodingFixTool.RunCommand(const aCommandLine, aWorkingDirectory: stri
     RaiseLastOSError;
   end;
   try
-    lWaitResult := WaitForSingleObject(lProcessInformation.hProcess, 30000);
+    lWaitResult := WaitForSingleObject(lProcessInformation.hProcess, cCommandTimeoutMs);
     if lWaitResult <> WAIT_OBJECT_0 then
     begin
       TerminateProcess(lProcessInformation.hProcess, 1);
@@ -411,7 +479,78 @@ function TEncodingFixTool.RunCommand(const aCommandLine, aWorkingDirectory: stri
   end;
 {$ELSE}
   lCommandLine := UTF8String('cd ' + QuoteShellArg(aWorkingDirectory) + ' && ' + aCommandLine);
-  Result := _system(PAnsiChar(lCommandLine));
+  lShellArg := UTF8String('-c');
+  lShellName := UTF8String('sh');
+  lShellPath := UTF8String('/bin/sh');
+  lArguments[0] := PAnsiChar(lShellName);
+  lArguments[1] := PAnsiChar(lShellArg);
+  lArguments[2] := PAnsiChar(lCommandLine);
+  lArguments[3] := nil;
+  lPid := PosixFork;
+  if lPid < 0 then
+  begin
+    raise Exception.Create('fork failed');
+  end;
+  if lPid = 0 then
+  begin
+    if PosixSetProcessGroup(0, 0) <> 0 then
+    begin
+      PosixExit(126);
+    end;
+    PosixExecv(PAnsiChar(lShellPath), @lArguments[0]);
+    PosixExit(127);
+  end;
+
+  lReaped := False;
+  try
+    PosixSetProcessGroup(lPid, lPid);
+    lStartTime := PosixMonotonicMilliseconds;
+    repeat
+      lWaitPid := PosixWaitPid(lPid, @lStatus, cPosixNoHang);
+      if lWaitPid = lPid then
+      begin
+        lReaped := True;
+        Break;
+      end;
+      if lWaitPid < 0 then
+      begin
+        if PosixLastError = cPosixInterrupted then
+        begin
+          Continue;
+        end;
+        raise Exception.Create('waitpid failed');
+      end;
+      if PosixMonotonicMilliseconds - lStartTime >= cCommandTimeoutMs then
+      begin
+        if PosixKill(-lPid, cPosixSignalKill) <> 0 then
+        begin
+          PosixKill(lPid, cPosixSignalKill);
+        end;
+        if not PosixWaitForChild(lPid, lStatus) then
+        begin
+          raise Exception.Create('waitpid failed after timeout');
+        end;
+        lReaped := True;
+        raise Exception.Create('process timed out');
+      end;
+      PosixUSleep(cCommandPollMs * 1000);
+    until False;
+
+    if (lStatus and $7F) = 0 then
+      Result := (lStatus shr 8) and $FF
+    else
+      Result := 128 + (lStatus and $7F);
+  finally
+    if not lReaped then
+    begin
+      PosixKill(-lPid, cPosixSignalKill);
+      PosixKill(lPid, cPosixSignalKill);
+      if not PosixWaitForChild(lPid, lStatus) then
+      begin
+        raise Exception.Create('waitpid cleanup failed');
+      end;
+    end;
+  end;
 {$ENDIF}
 end;