feat(pass): forward signals from pass run to the child

Replace `child.Run()` with explicit `Start`/`Wait` bracketed by a signal
forwarder. SIGINT, SIGTERM, and SIGHUP delivered to `pass run` are now
relayed to the child instead of killing both processes through the
foreground process group. The wrapper waits for the child to exit on
its own terms before returning, so trapped cleanup handlers in the
child run to completion.

When the child is killed by a signal, the exit code reported by
`pass run` is now `128 + signum` instead of `-1`, matching shell
convention.

Platform split for the signal set and exit-code translation:
SIGINT/SIGTERM/SIGHUP on Unix, SIGINT only on Windows.

Author: joe0BAB

plugins/pass/commands/run.go

@@ -20,6 +20,7 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
+	"os/signal"
 	"strings"
 
 	"github.com/spf13/cobra"
@@ -67,18 +68,43 @@ started and exits non-zero.`,
 				return err
 			}
 
-			child := exec.CommandContext(cmd.Context(), args[0], args[1:]...)
+			// No CommandContext: the signal forwarder owns the child's
+			// lifecycle. Tying the child to cmd.Context() would let cobra's
+			// ctx cancellation SIGKILL the child out from under the forwarder.
+			child := exec.Command(args[0], args[1:]...)
 			child.Env = env
 			child.Stdin = os.Stdin
 			child.Stdout = os.Stdout
 			child.Stderr = os.Stderr
 
-			if err := child.Run(); err != nil {
+			if err := child.Start(); err != nil {
+				return err
+			}
+
+			sigCh := make(chan os.Signal, 1)
+			signal.Notify(sigCh, forwardableSignals()...)
+			done := make(chan struct{})
+			go func() {
+				for {
+					select {
+					case sig := <-sigCh:
+						_ = child.Process.Signal(sig)
+					case <-done:
+						return
+					}
+				}
+			}()
+
+			waitErr := child.Wait()
+			signal.Stop(sigCh)
+			close(done)
+
+			if waitErr != nil {
 				var exitErr *exec.ExitError
-				if errors.As(err, &exitErr) {
-					os.Exit(exitErr.ExitCode())
+				if errors.As(waitErr, &exitErr) {
+					os.Exit(childExitCode(exitErr.ProcessState))
 				}
-				return err
+				return waitErr
 			}
 			return nil
 		},

plugins/pass/commands/run_test.go

@@ -15,12 +15,18 @@
 package commands
 
 import (
+	"bufio"
 	"context"
 	"errors"
+	"fmt"
+	"io"
 	"os"
 	"os/exec"
+	"runtime"
 	"strconv"
+	"syscall"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -38,6 +44,7 @@ const (
 	helperWrapperEnv = "GO_PASS_RUN_WRAPPER"
 	helperActiveEnv  = "GO_PASS_RUN_HELPER_ACTIVE"
 	helperExitEnv    = "GO_PASS_RUN_HELPER_EXIT"
+	helperSleepEnv   = "GO_PASS_RUN_HELPER_SLEEP"
 )
 
 func TestMain(m *testing.M) {
@@ -48,6 +55,13 @@ func TestMain(m *testing.M) {
 		return // unreachable; runAsWrapper exits
 	}
 	if os.Getenv(helperActiveEnv) != "" {
+		if os.Getenv(helperSleepEnv) != "" {
+			// Signal-handling test: announce readiness, then block until a
+			// signal kills us with its default disposition (so the wrapper
+			// observes a signaled exit, not a normal one).
+			_, _ = fmt.Fprintln(os.Stderr, "READY")
+			select {}
+		}
 		code := 0
 		if v := os.Getenv(helperExitEnv); v != "" {
 			if n, err := strconv.Atoi(v); err == nil {
@@ -192,6 +206,54 @@ func TestRunCommand(t *testing.T) {
 		require.True(t, errors.As(err, &exitErr), "expected ExitError, got %v", err)
 		assert.Equal(t, 42, exitErr.ExitCode())
 	})
+
+	t.Run("forwards SIGINT and exits 130", func(t *testing.T) {
+		if runtime.GOOS == "windows" {
+			t.Skip("SIGINT cross-process semantics differ on Windows")
+		}
+
+		sub := exec.CommandContext(t.Context(), exe)
+		sub.Env = append(os.Environ(),
+			helperWrapperEnv+"=1",
+			helperActiveEnv+"=1",
+			helperSleepEnv+"=1",
+		)
+		stderr, err := sub.StderrPipe()
+		require.NoError(t, err)
+		require.NoError(t, sub.Start())
+
+		waitForReady(t, stderr)
+
+		require.NoError(t, sub.Process.Signal(syscall.SIGINT))
+
+		err = sub.Wait()
+		var exitErr *exec.ExitError
+		require.True(t, errors.As(err, &exitErr), "expected ExitError, got %v", err)
+		assert.Equal(t, 130, exitErr.ExitCode())
+	})
+}
+
+func waitForReady(t *testing.T, r io.Reader) {
+	t.Helper()
+	scanner := bufio.NewScanner(r)
+	done := make(chan bool, 1)
+	go func() {
+		for scanner.Scan() {
+			if scanner.Text() == "READY" {
+				done <- true
+				return
+			}
+		}
+		done <- false
+	}()
+	select {
+	case ok := <-done:
+		require.True(t, ok, "subprocess closed stderr before printing READY")
+	case <-time.After(5 * time.Second):
+		t.Fatal("timed out waiting for READY from subprocess")
+	}
+	// Drain remaining stderr in the background so the pipe never blocks.
+	go func() { _, _ = io.Copy(io.Discard, r) }()
 }
 
 // testWriter forwards cobra output to t.Log so it does not leak onto stderr.

plugins/pass/commands/run_unix.go

@@ -0,0 +1,36 @@
+// Copyright 2025-2026 Docker, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build !windows
+
+package commands
+
+import (
+	"os"
+	"syscall"
+)
+
+func forwardableSignals() []os.Signal {
+	return []os.Signal{syscall.SIGINT, syscall.SIGTERM, syscall.SIGHUP}
+}
+
+func childExitCode(state *os.ProcessState) int {
+	if state.Exited() {
+		return state.ExitCode()
+	}
+	if ws, ok := state.Sys().(syscall.WaitStatus); ok && ws.Signaled() {
+		return 128 + int(ws.Signal())
+	}
+	return state.ExitCode()
+}

plugins/pass/commands/run_windows.go

@@ -0,0 +1,35 @@
+// Copyright 2025-2026 Docker, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build windows
+
+package commands
+
+import (
+	"os"
+	"syscall"
+)
+
+// On Windows only SIGINT can be sent to another process via os.Process.Signal;
+// SIGTERM and SIGHUP are accepted by signal.Notify but cannot be forwarded to
+// a child process.
+func forwardableSignals() []os.Signal {
+	return []os.Signal{syscall.SIGINT}
+}
+
+// Windows does not surface a signaled-process state through ProcessState;
+// ExitCode() is authoritative for both normal and abnormal termination.
+func childExitCode(state *os.ProcessState) int {
+	return state.ExitCode()
+}