From 0fcebc55c193f53d9d7a35cf82a602dcca0608f9 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 08:41:58 +0000
Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20Fix=20p?=
 =?UTF-8?q?ipe=20deadlock=20DoS=20in=20AutomationExecutor?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: NSEvent <44446865+NSEvent@users.noreply.github.com>
---
 .../Sources/TriggerKitRuntime/AutomationExecutor.swift       | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/TriggerKit/Sources/TriggerKitRuntime/AutomationExecutor.swift b/TriggerKit/Sources/TriggerKitRuntime/AutomationExecutor.swift
index 59854205..b2d1fdbd 100644
--- a/TriggerKit/Sources/TriggerKitRuntime/AutomationExecutor.swift
+++ b/TriggerKit/Sources/TriggerKitRuntime/AutomationExecutor.swift
@@ -354,9 +354,8 @@ public final class AutomationExecutor {
 			} catch {
 				return .failure("\(name) launch failed: \(error.localizedDescription)")
 			}
-			process.waitUntilExit()
-
 			let data = pipe.fileHandleForReading.readDataToEndOfFile()
+			process.waitUntilExit()
 			let output = String(data: data, encoding: .utf8)?
 				.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
 
@@ -731,11 +730,11 @@ private final class ShellCommandRunner: @unchecked Sendable {
 		pgrep.standardError = FileHandle.nullDevice
 		do {
 			try pgrep.run()
-			pgrep.waitUntilExit()
 		} catch {
 			return []
 		}
 		let data = pipe.fileHandleForReading.readDataToEndOfFile()
+		pgrep.waitUntilExit()
 		let output = String(data: data, encoding: .utf8) ?? ""
 		return output
 			.split(whereSeparator: \.isNewline)

From cff26a507a19b25927eae7b26aecdc52563fa11c Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 09:09:53 +0000
Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20Fix=20D?=
 =?UTF-8?q?oS=20pipe=20deadlock=20in=20AutomationExecutor?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When executing shell commands via Foundation.Process, `process.waitUntilExit()` was called before draining the standard output/error pipes (`pipe.fileHandleForReading.readDataToEndOfFile()`). If the shell command outputs more data than the OS pipe buffer capacity (~64KB), the child process hangs waiting for space in the pipe, while the parent hangs waiting for the process to exit. This was fixed by reversing the order.

Co-authored-by: NSEvent <44446865+NSEvent@users.noreply.github.com>