@qwen-code /triage

Thanks for the PR!

Template looks good ✓

On direction: clearly aligned — this fixes a real TUI-breaking bug where systemd-inhibit triggers a PolicyKit auth prompt in headless SSH sessions, completely locking up the interface. The sleep inhibition feature (added in #4434, patched in #4865) has had a rough edge on Linux SSH ever since it shipped, and this is the right place to fix it.

On approach: the scope feels right. The env-var heuristic (SSH vars present + no display vars = headless) is pragmatic and covers the reported scenario. The injectable env config is a clean testability seam with no production cost. The diff is focused — two files, no drive-by refactors, no scope creep. The getUnavailableMessage() addition is slightly unusual (repurposing the "unsupported platform" path for a deliberate skip), but it works because the latch prevents log spam and the message is accurate. One minor question: the isHeadlessSshSession() function gets called twice per acquire() (once in getCommand(), once in getUnavailableMessage()) — a cached boolean on the instance would be marginally cleaner, but it's a pure function on a handful of env vars so the cost is negligible.

Moving on to code review. 🔍

— Qwen Code · qwen3.7-max

✅ Verification report — PR #5295 (fixes #5281)

Verdict: verified, recommend merge. I reproduced the root cause on a real machine and confirmed the fix with a live A/B (base vs. PR) on the actual built CLI, plus the full unit / lint / type-check suite.

This was an unusually clean verification because the test box is itself a genuine headless SSH session — exactly the configuration #5281 is about.

Test environment

1. Root cause confirmed on real hardware

The inhibitor spawns systemd-inhibit --what=sleep --who=Qwen Code --why=… --mode=block sleep infinity, gated by preventSystemSleep which defaults to true, and acquire() fires at the start of every model stream and every tool execution. Taking the inhibit-block-sleep lock requires a polkit authorization that a headless SSH session does not have:

# root (authorized)            → systemd-inhibit … echo  ⇒ "INHIBIT_RAN_OK", rc=0
# non-root user (the reporter) → systemd-inhibit … echo  ⇒ "Failed to inhibit: Access denied", rc=1

On a machine that has a desktop's polkit text agent installed, that same authorization step is what surfaces the interactive AUTHENTICATING FOR org.freedesktop.login1.inhibit-block-sleep prompt. It leaks into the TUI even though the child is spawned with stdio: 'ignore', because pkttyagent opens /dev/tty directly. (Note: the literal password prompt can't be reproduced on this particular box — it runs as root, which polkit auto-authorizes, and has no pkttyagent installed — but the underlying authorization requirement that produces it is reproduced above.)

Real-world proof the released behavior bites here: systemd-inhibit --list showed two orphaned Qwen Code sleep-block holders (PPID=1, ~17 h old) left over from earlier headless-SSH runs of the shipped CLI.

2. Static checks (PR test plan) — all green

3. E2E-A — deterministic harness on the real compiled SleepInhibitor, real env matrix

Imports the exact compiled class the CLI loads; env defaults to the real process.env; observes the in-process decision and the real OS-level systemd-inhibit --list delta.

→ The fix skips the spawn only in the targeted case; SSH-with-display and local sessions still inhibit (no regression). Same env on base → it spawns (the bug).

4. E2E-B — the real qwen TUI in tmux, same headless SSH session

Identical prompt / model / env on both arms; only the compiled sleepInhibitor.js differs. A poller watched for new systemd-inhibit PIDs during the turn.

Both arms completed the same workload (model streamed + ran sleep 15 via the shell tool, replied DONE); only base leaves sleep-inhibitor processes behind.

Residual edges (non-blocking, heuristic limits — noted for completeness)

• ssh -X / -Y sets DISPLAY, so a forwarded-X session is treated as non-headless and still inhibits — it could in theory still hit the polkit prompt if that remote session isn't polkit-authorized. The heuristic deliberately errs toward keeping inhibition when a display is present; the reported plain-SSH case is fully covered.
• sudo / su after SSH can drop SSH_*, so a user-switched headless session would be re-detected as "local" and inhibit again. Minor and not a regression.

Neither affects the reported scenario.

Conclusion

The change is correctly scoped to the Linux branch, the skip is consistent between getCommand() (returns undefined) and getUnavailableMessage(), it latches so there's no per-acquire log spam, macOS/Windows are untouched, and the new env seam is a no-op in production (pure testability). Behavior verified on a real headless SSH host. LGTM.

# root（已授权）       → systemd-inhibit … echo  ⇒ "INHIBIT_RAN_OK", rc=0
# 非 root 用户（报告者）→ systemd-inhibit … echo  ⇒ "Failed to inhibit: Access denied", rc=1

_{Verification methodology: real headless-SSH host with systemd; dist-level A/B against the merge-base; deterministic harness + real TUI under tmux; live systemd-inhibit --list and per-session debug log as independent observables.}

@qwen-code /triage

@qwen-code /triage

Code Review

The diff is clean and minimal — two files, no drive-by refactors. The isHeadlessSshSession() function is a pure predicate on env vars, exactly what this needs. The injectable env config is a clean testability seam with zero production cost. The getUnavailableMessage() refactor repurposes the "unsupported platform" log path for the deliberate skip, which works because the latch (spawnFailedForCurrentRun) prevents repeated logging.

No correctness bugs, no security concerns, no AGENTS.md violations. The tests were refactored well — the old env-allowlist test no longer mutates process.env directly, instead passing env through the config. Cleaner.

Static Checks

Real-Scenario E2E Test (tmux)

Imported the compiled SleepInhibitor class directly from each build's dist/, exercised all three environment configurations with a fake spawn that logs calls. Same harness, only the build differs.

===== BASE (main) =====
--- headless-ssh ---
=== Scenario: headless-ssh (BASE) ===
Env: {"SSH_CONNECTION":"10.0.0.1 55555 10.0.0.2 22","SSH_TTY":"/dev/pts/0","SSH_CLIENT":"10.0.0.1 55555 22"}
isRunning: true
activeCount: 1
Logs:
  [SPAWN] systemd-inhibit --what=sleep --who=Qwen Code --why=test reason --mode=block sleep infinity
After release - activeCount: 0
--- ssh-with-display ---
=== Scenario: ssh-with-display (BASE) ===
Env: {"SSH_TTY":"/dev/pts/3","DISPLAY":":10","DBUS_SESSION_BUS_ADDRESS":"unix:path=/run/user/1000/bus"}
isRunning: true
Logs:
  [SPAWN] systemd-inhibit --what=sleep --who=Qwen Code --why=test reason --mode=block sleep infinity
--- local-headless ---
=== Scenario: local-headless (BASE) ===
Env: {"DBUS_SESSION_BUS_ADDRESS":"unix:path=/run/user/1000/bus"}
isRunning: true
Logs:
  [SPAWN] systemd-inhibit --what=sleep --who=Qwen Code --why=test reason --mode=block sleep infinity

===== PR (fix) =====
--- headless-ssh ---
=== Scenario: headless-ssh (PR) ===
Env: {"SSH_CONNECTION":"10.0.0.1 55555 10.0.0.2 22","SSH_TTY":"/dev/pts/0","SSH_CLIENT":"10.0.0.1 55555 22"}
isRunning: false
activeCount: 1
Logs:
  [DEBUG] Sleep inhibition skipped for headless SSH session.
After release - activeCount: 0
--- ssh-with-display ---
=== Scenario: ssh-with-display (PR) ===
Env: {"SSH_TTY":"/dev/pts/3","DISPLAY":":10","DBUS_SESSION_BUS_ADDRESS":"unix:path=/run/user/1000/bus"}
isRunning: true
Logs:
  [SPAWN] systemd-inhibit --what=sleep --who=Qwen Code --why=test reason --mode=block sleep infinity
--- local-headless ---
=== Scenario: local-headless (PR) ===
Env: {"DBUS_SESSION_BUS_ADDRESS":"unix:path=/run/user/1000/bus"}
isRunning: true
Logs:
  [SPAWN] systemd-inhibit --what=sleep --who=Qwen Code --why=test reason --mode=block sleep infinity

Result: The fix works exactly as intended. BASE spawns systemd-inhibit in all three scenarios (including headless SSH — the bug). PR skips it only for headless SSH while preserving behavior for SSH-with-display and local-headless sessions. No regressions.

— Qwen Code · qwen3.7-max

Final Assessment

This is a clean, surgical fix for a real TUI-locking bug. The approach — detecting headless SSH via env vars and skipping the sleep inhibitor — is exactly what I'd propose independently. The diff is minimal (2 files, +105/-28), every line serves the stated goal, and there's no scope creep.

What makes this PR strong:

• The bug is real and impactful (TUI completely unusable in headless SSH)
• The fix is correctly scoped — only Linux headless SSH is affected, no regressions in SSH-with-display or local sessions
• The injectable env config is a clean testability seam, not a speculative abstraction
• Tests were refactored to stop mutating process.env directly — a genuine improvement
• @wenshao's independent verification on real hardware with A/B testing against the merge-base adds strong corroboration

No reservations. Approving.

— Qwen Code · qwen3.7-max