Detect shell exit in setup command (#14506)

## Description

Contributes to the largest cluster of
https://linear.app/warpdotdev/issue/REMOTE-2338/sandbox-unexpectedly-failed

When a setup command causes the shell to exit, we weren't reporting this
failure. The run would end up stuck at `Session Started` until
eventually the sandbox closes 12 hours later.

Now, we detect shell exit in setup commands and report the failure with
an error message, closing the sandbox. We also update the
`AgentExitedShell` error to include the command name.

## Testing
<!--
How did you test this change? What automated tests did you add? If you
didn't add any new tests, what's your justification for not adding any?

Manual testing is required for changes that can be manually tested, and
almost all changes can be manually tested. If your change can be
manually tested, please include screenshots or a screen recording that
show it working end to end.

You can run the app locally using `./script/run` - see AGENTS.md for
more details on how to get set up.
-->

- [x] I have manually tested my changes locally with `./script/run`

Reproduced the original issue using an environment with `exit` as a
setup command. In staging the run is stuck at session started. The
sandbox is alive, but the shared session is dead. 12 hours later the
sandbox will close, putting it in error with `Sandbox unexpectedly
closed`


https://oz.staging.warp.dev/runs/019fb010-6a48-7b9e-9ea5-9fe0f0df939c?createdBy=5biMwfUWwagla4lNcR9OSWcZW9H3

Testing locally, it now reports the failure
### Screenshots / Videos
<!-- Attach screenshots or a short video demonstrating the change, where
appropriate. Remove this section if it is not relevant to your PR. -->

<img width="441" height="854" alt="Screenshot 2026-07-29 at 4 15 07 PM"
src="https://github.com/user-attachments/assets/6d3e37ff-fe95-46b3-a89f-6d086baa5cb0"
/>

Author: seemeroland

app/src/ai/agent/mod.rs

@@ -726,9 +726,11 @@ pub enum RenderableAIError {
         is_user_error: bool,
     },
     /// An agent-issued command caused the shell process to exit, so the run
-    /// cannot continue. Surfaced as a terminal failure (FAILED) rather than a
-    /// user cancellation.
-    AgentExitedShell,
+    /// cannot continue. Surfaced as a terminal failure (FAILED).
+    /// `command` is the (secret-redacted) command that exited the shell.
+    AgentExitedShell {
+        command: String,
+    },
     /// A cloud-mode startup failure. Carries the raw server error message and
     /// surfaces it without the generic apology prefix, matching the dedicated
     /// GUI error card (`render_cloud_mode_error_screen`) which shows the
@@ -739,8 +741,6 @@ pub enum RenderableAIError {
 impl RenderableAIError {
     const TRANSIENT_NETWORK_ERROR_MESSAGE: &'static str =
         "Warp lost connection while receiving the agent response. This is usually temporary.";
-    /// User-facing message shown when an agent-issued command exits the shell.
-    pub const AGENT_EXITED_SHELL_MESSAGE: &'static str = "The shell exited while the agent was running a command, so the run could not continue. Ensure the agent is not asked to run commands or source scripts that can exit the shell.";
     /// Creates a transient network error. `kind` is the structured cause (including the raw API
     /// error where one exists), preserved so user reports can disambiguate the different causes
     /// behind the shared user-facing copy.
@@ -918,7 +918,12 @@ impl Display for RenderableAIError {
                 )
             }
             Self::Other { error_message, .. } => write!(f, "{error_message}"),
-            Self::AgentExitedShell => write!(f, "{}", Self::AGENT_EXITED_SHELL_MESSAGE),
+            Self::AgentExitedShell { command } => write!(
+                f,
+                "The shell exited while the agent was running the command `{command}`, so the run \
+                 could not continue. Ensure the agent is not asked to run commands or source \
+                 scripts that can exit the shell."
+            ),
             Self::CloudStartupFailed(msg) => write!(f, "{msg}"),
         }
     }

app/src/ai/agent_sdk/driver.rs

@@ -526,6 +526,15 @@ pub enum AgentDriverError {
     ConversationCancelled { reason: CancellationReason },
     #[error("The agent got stuck waiting for user confirmation on the action: {blocked_action}")]
     ConversationBlocked { blocked_action: String },
+    /// The shell process exited while an environment setup command was
+    /// running (e.g. the command ran `exit`), so the run cannot continue.
+    /// `command` is the (secret-redacted) command that was in flight (or
+    /// most recently submitted) when the shell died.
+    #[error(
+        "The shell exited during setup command `{command}`, so the run could not continue. \
+         Check the setup commands for this environment."
+    )]
+    SetupCommandExitedShell { command: String },
     #[error("Timed out refreshing team metadata")]
     TeamMetadataRefreshTimeout,
     #[error("{0}")]
@@ -1074,7 +1083,11 @@ impl AgentDriver {
             // Success/blocked/cancelled are handled by LocalAgentTaskSyncModel.
             if let (Some(task_id), Err(err)) = (task_id, &result) {
                 report_driver_error(task_id, err, &server_api_for_error).await;
-                if matches!(err, AgentDriverError::EnvironmentSetupFailed(_)) {
+                if matches!(
+                    err,
+                    AgentDriverError::EnvironmentSetupFailed(_)
+                        | AgentDriverError::SetupCommandExitedShell { .. }
+                ) {
                     let _ = foreground_for_error
                         .spawn(|me, ctx| {
                             me.extend_shared_session_retention(

app/src/ai/agent_sdk/driver/error_classification.rs

@@ -173,6 +173,16 @@ pub fn classify_driver_error(error: &AgentDriverError) -> (AgentTaskState, TaskS
                 PlatformErrorCode::EnvironmentSetupFailed,
             ),
         ),
+        // The shell died while an environment setup command was running
+        // (e.g. the command ran `exit`). This is a user-side environment
+        // configuration problem, so classify as FAILED.
+        AgentDriverError::SetupCommandExitedShell { .. } => (
+            AgentTaskState::Failed,
+            TaskStatusUpdate::with_error_code(
+                error.to_string(),
+                PlatformErrorCode::EnvironmentSetupFailed,
+            ),
+        ),
         AgentDriverError::InvalidWorkingDirectory { path, .. } => (
             AgentTaskState::Failed,
             TaskStatusUpdate::with_error_code(

app/src/ai/agent_sdk/driver/error_classification_tests.rs

@@ -163,6 +163,28 @@ fn environment_setup_failed_is_failed() {
     );
 }
 
+#[test]
+fn setup_command_exited_shell_is_failed_with_env_setup_and_names_command() {
+    let (state, update) = classify_driver_error(&AgentDriverError::SetupCommandExitedShell {
+        command: "./setup.sh".into(),
+    });
+    assert_eq!(state, AgentTaskState::Failed);
+    assert_eq!(
+        update.error_code,
+        Some(PlatformErrorCode::EnvironmentSetupFailed)
+    );
+    // The message must name the setup command that exited the shell and
+    // point the user at the environment's setup commands.
+    assert!(update.message.contains("./setup.sh"), "{}", update.message);
+    assert!(
+        update
+            .message
+            .contains("Check the setup commands for this environment"),
+        "{}",
+        update.message
+    );
+}
+
 #[test]
 fn profile_error_is_failed_with_resource_not_found() {
     assert_state_and_code(

app/src/ai/agent_sdk/driver/terminal.rs

@@ -20,6 +20,7 @@ use warpui::r#async::FutureExt;
 use warpui::{AppContext, Entity, ModelContext, ModelHandle, SingletonEntity as _, ViewHandle};
 
 use super::AgentDriverError;
+use crate::ai::agent::redaction::redact_secrets;
 use crate::ai::ambient_agents::AmbientAgentTaskId;
 use crate::ai::attachment_utils::attachments_download_dir;
 use crate::pane_group::NewTerminalOptions;
@@ -145,12 +146,33 @@ pub(crate) struct TerminalDriver {
     /// and `wait_for_session_shared` has not yet been called.
     session_share_rx: Option<oneshot::Receiver<Result<(), ShareSessionError>>>,
     pending_share_requests: Vec<ShareRequest>,
-    waiting_command: Option<oneshot::Sender<ExitCode>>,
+    /// Resolves the in-flight command's exit status. Sent `Ok` when the
+    /// command's block completes, or
+    /// `Err(AgentDriverError::SetupCommandExitedShell)` if the shell process
+    /// exits while the command is still running.
+    waiting_command: Option<oneshot::Sender<Result<ExitCode, AgentDriverError>>>,
 
     /// State for the pending command we're expecting to start executing.
     /// The `String` is the expected command text, and the sender is used
-    /// to send the block ID to the waiting caller.
-    pending_command_start: Option<(String, oneshot::Sender<BlockId>)>,
+    /// to send the block ID to the waiting caller (or a shell-exit error if
+    /// the shell dies before the command starts).
+    pending_command_start: Option<(String, oneshot::Sender<Result<BlockId, AgentDriverError>>)>,
+
+    /// True once the shell process backing this session has exited
+    /// post-bootstrap. No further commands can execute, so
+    /// [`Self::execute_command`] fails fast with
+    /// [`AgentDriverError::SetupCommandExitedShell`].
+    shell_exited: bool,
+
+    /// The most recently submitted command (secret-redacted), used to
+    /// attribute a shell exit to the command that caused it. When the shell
+    /// dies mid-command, the exit path force-finishes the command's block
+    /// (with exit code 0) before `Event::Exited` is delivered, so at exit
+    /// time this — not any still-pending command — names the culprit.
+    ///
+    /// Stored redacted because it flows into error reports (server task
+    /// status, Sentry) via [`AgentDriverError::SetupCommandExitedShell`].
+    last_command: Option<String>,
 }
 
 impl Entity for TerminalDriver {
@@ -303,6 +325,8 @@ impl TerminalDriver {
             pending_share_requests: Vec::new(),
             waiting_command: None,
             pending_command_start: None,
+            shell_exited: false,
+            last_command: None,
         }
     }
 
@@ -464,6 +488,17 @@ impl TerminalDriver {
         })
     }
 
+    /// The error reported for commands affected by a shell exit, attributing
+    /// the most recently submitted command as the cause.
+    fn shell_exited_error(&self) -> AgentDriverError {
+        AgentDriverError::SetupCommandExitedShell {
+            command: self
+                .last_command
+                .clone()
+                .unwrap_or_else(|| "<unknown>".to_string()),
+        }
+    }
+
     /// Execute a command in the terminal and return a future that resolves to a
     /// [`CommandHandle`] once the command starts executing.
     pub fn execute_command(
@@ -474,8 +509,16 @@ impl TerminalDriver {
         impl Future<Output = Result<CommandHandle, AgentDriverError>> + use<>,
         AgentDriverError,
     > {
-        let (exit_tx, exit_rx) = oneshot::channel::<ExitCode>();
-        let (start_tx, start_rx) = oneshot::channel::<BlockId>();
+        // The shell process has exited, so no further commands can run in
+        // this session. Fail fast with the shell-exit error so callers
+        // (e.g. environment setup) report the failure instead of waiting
+        // forever on a command that can never start.
+        if self.shell_exited {
+            return Err(self.shell_exited_error());
+        }
+
+        let (exit_tx, exit_rx) = oneshot::channel::<Result<ExitCode, AgentDriverError>>();
+        let (start_tx, start_rx) = oneshot::channel::<Result<BlockId, AgentDriverError>>();
 
         // We should not be able to execute a command while we are still waiting on another one.
         // This is enforced by the caller by waiting on rx before continuing.
@@ -484,6 +527,12 @@ impl TerminalDriver {
         }
 
         let command_string = command.to_string();
+        // Store a secret-redacted copy for shell-exit attribution: the text
+        // flows into error reports (server task status, Sentry) if the shell
+        // dies, so never retain the raw command here.
+        let mut redacted_command = command_string.clone();
+        redact_secrets(&mut redacted_command);
+        self.last_command = Some(redacted_command);
         self.terminal_view.update(ctx, |terminal, ctx| {
             self.waiting_command = Some(exit_tx);
             self.pending_command_start = Some((command_string, start_tx));
@@ -493,7 +542,7 @@ impl TerminalDriver {
         Ok(async move {
             let block_id = start_rx
                 .await
-                .map_err(|_| AgentDriverError::InvalidRuntimeState)?;
+                .map_err(|_| AgentDriverError::InvalidRuntimeState)??;
             Ok(CommandHandle {
                 exit_status_rx: exit_rx,
                 block_id,
@@ -689,7 +738,7 @@ pub(crate) struct BlockOutputMatch {
 /// Also carries the [`BlockId`] so callers can retrieve the block snapshot
 /// after completion.
 pub(crate) struct CommandHandle {
-    exit_status_rx: oneshot::Receiver<ExitCode>,
+    exit_status_rx: oneshot::Receiver<Result<ExitCode, AgentDriverError>>,
     block_id: BlockId,
 }
 
@@ -706,7 +755,10 @@ impl Future for CommandHandle {
     fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
         Pin::new(&mut self.exit_status_rx)
             .poll(cx)
-            .map(|result| result.map_err(|_| AgentDriverError::InvalidRuntimeState))
+            .map(|result| match result {
+                Ok(exit_status) => exit_status,
+                Err(_) => Err(AgentDriverError::InvalidRuntimeState),
+            })
     }
 }
 
@@ -742,6 +794,18 @@ impl TerminalDriver {
                 if let Some(tx) = self.bootstrap_tx.take() {
                     let _ = tx.send(Err(BootstrapError::PtySpawnFailed { reason: None }));
                 }
+
+                // The shell is gone: no further command can start or finish.
+                // Fail any in-flight command (e.g. an environment setup
+                // command) with the shell-exit error so the run reports the
+                // failure instead of hanging until the sandbox is killed.
+                self.shell_exited = true;
+                if let Some((_, sender)) = self.pending_command_start.take() {
+                    let _ = sender.send(Err(self.shell_exited_error()));
+                }
+                if let Some(sender) = self.waiting_command.take() {
+                    let _ = sender.send(Err(self.shell_exited_error()));
+                }
             }
             crate::terminal::view::Event::SlowBootstrap => {
                 ctx.emit(TerminalDriverEvent::SlowBootstrap);
@@ -777,7 +841,7 @@ impl TerminalDriver {
                     let block_id = self.terminal_view.read(ctx, |terminal, _| {
                         terminal.model.lock().block_list().active_block_id().clone()
                     });
-                    let _ = sender.send(block_id);
+                    let _ = sender.send(Ok(block_id));
                 }
             }
             crate::terminal::view::Event::BlockCompleted { block, .. } => {
@@ -796,7 +860,7 @@ impl TerminalDriver {
                     // we instead simply make sure it was not a background block.
                     bootstrapping_done && !block.is_background
                 }) {
-                    let _ = sender.send(block.exit_code);
+                    let _ = sender.send(Ok(block.exit_code));
                 }
             }
             _ => (),

app/src/ai/agent_sdk/driver/terminal_tests.rs

@@ -1,10 +1,14 @@
 use std::cell::RefCell;
 use std::rc::Rc;
 
+use regex::Regex;
+use serial_test::serial;
 use session_sharing_protocol::sharer::SessionRetentionReason;
 use warpui::App;
 
 use super::TerminalDriver;
+use crate::ai::agent_sdk::driver::AgentDriverError;
+use crate::terminal::model::secrets::set_user_and_enterprise_secret_regexes;
 use crate::terminal::shared_session::SharedSessionStatus;
 use crate::terminal::view::Event;
 use crate::test_util::add_window_with_terminal;
@@ -56,3 +60,75 @@ fn extend_shared_session_retention_emits_event_for_active_sharer() {
         ));
     });
 }
+
+// #[serial] because the secret regexes configured below are global state.
+#[test]
+#[serial]
+fn shell_exit_fails_in_flight_and_subsequent_commands() {
+    App::test((), |mut app| async move {
+        initialize_app_for_terminal_view(&mut app);
+
+        // Configure a secret pattern (a GitHub classic PAT). In production
+        // these are populated from the user's/enterprise's privacy settings
+        // via CustomSecretRegexUpdater.
+        set_user_and_enterprise_secret_regexes(
+            [&Regex::new(r"\bghp_[A-Za-z0-9_]{36}\b").expect("pattern should compile")],
+            std::iter::empty(),
+        );
+
+        let terminal_view = add_window_with_terminal(&mut app, None);
+        let terminal_driver =
+            app.update(|ctx| TerminalDriver::create_from_existing_view(terminal_view.clone(), ctx));
+
+        // A command containing a secret matching the configured pattern. The
+        // attributed command in the shell-exit error must have the token
+        // redacted, since the error flows into server task status and Sentry
+        // reports.
+        let token = "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghij";
+        let submitted = format!("echo {token}");
+        let expected_redacted = format!("echo {}", "*".repeat(token.len()));
+
+        // Start a command (e.g. an environment setup command) so the driver
+        // has an in-flight command waiting on the terminal session.
+        let command_future = terminal_driver
+            .update(&mut app, |driver, ctx| {
+                driver.execute_command(&submitted, ctx)
+            })
+            .expect("command should be accepted before the shell exits");
+
+        // The shell process dies (e.g. the command ran `exit 1`).
+        terminal_view.update(&mut app, |_, ctx| ctx.emit(Event::Exited));
+
+        // The in-flight command must resolve with the shell-exit error
+        // instead of hanging forever, regardless of whether it had already
+        // started executing. The error must name the (redacted) command that
+        // was running when the shell died.
+        let result = match command_future.await {
+            Ok(handle) => handle.await,
+            Err(error) => Err(error),
+        };
+        match &result {
+            Err(AgentDriverError::SetupCommandExitedShell { command }) => {
+                assert_eq!(command, &expected_redacted);
+            }
+            other => {
+                panic!("in-flight command should fail with SetupCommandExitedShell, got {other:?}")
+            }
+        }
+
+        // Any further command must fail fast with the same error, still
+        // attributing the (redacted) command that killed the shell (not the
+        // newly attempted one).
+        let fail_fast = terminal_driver.update(&mut app, |driver, ctx| {
+            driver.execute_command("echo again", ctx).err()
+        });
+        match &fail_fast {
+            Some(AgentDriverError::SetupCommandExitedShell { command }) => {
+                assert_eq!(command, &expected_redacted);
+            }
+            other => panic!(
+                "commands after shell exit should fail fast with SetupCommandExitedShell, got {other:?}"
+            ),
+        }
+    });
+}

app/src/ai/blocklist/agent_view/agent_message_bar.rs

@@ -782,7 +782,7 @@ fn should_fork_from_last_known_good_state(
         | RenderableAIError::GeminiEnterpriseCredentialsExpiredOrInvalid => false,
         // A shell-exit failure can't resume in this (now-dead) pane, but the user
         // can fork from the last known good state to continue in a fresh one.
-        RenderableAIError::InternalWarpError | RenderableAIError::AgentExitedShell => true,
+        RenderableAIError::InternalWarpError | RenderableAIError::AgentExitedShell { .. } => true,
         RenderableAIError::Other {
             will_attempt_resume,
             ..