Repository navigation
Kiln's Node range admits Windows releases where an RPC launch can crash at exit #218
Description
Summary
Kiln's package.json declares "node": ">=22.19.0". That range admits Node releases on which a Windows --rpc launch can end with a crash status even though its work completed. The crash is a Node defect, not Kiln's, and is fixed in Node 24.20.0. Kiln neither documents nor checks the affected versions.
Follow-up to #206, which attributed the crash and was closed with no Kiln change.
Evidence
From #206, measured on Windows 11 with Pi 0.87.1:
| Node | Result |
|---|---|
| 22.23.3 | no crash |
| 24.18.0 | crashes |
| 24.19.0 | crashes |
| 24.20.0 | no crash |
| 24.21.0 | no crash |
On an affected version, Pi's RPC shutdown calls process.exit() and Node can abort with Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), file src\win\async.c and exit code 0xC0000409. Since #200 the supervisor reports that code correctly, so the launch ends with a crash status.
Upstream: nodejs/node#56645, fixed by nodejs/node#61999 in 24.20.0. earendil-works/pi#9507 is the same crash seen from Pi.
Not measured: Node 23.x, Node 24 releases before 24.18.0, and Node 25 and later. The Node issue names 23.x and later as affected. Which 25.x or later release first carries the fix has not been checked. Only Windows is affected.
Scope
Document or enforce the Node versions on which Windows RPC launches are safe. Out of scope: any delay, retry or suppression around Pi's exit, and any change to how the job host or supervisor reports the exit code.
Questions to decide
- Document only, warn at launch, or refuse at launch on an affected Windows version.
- Whether a check applies to every Windows launch or only to
--rpc. Both captured occurrences in Windows: Pi's Node process intermittently aborts at exit with a libuv async-handle assertion #206 were--rpclaunches, and other launch modes were not measured. - Whether the
enginesrange changes. A single range cannot express "Windows only", and Node 22 is unaffected.
Suggested acceptance criteria
- The affected range is established for every Node major Kiln supports, including the first fixed release after 24.x.
- The decision above is implemented: documentation, a launch warning, or a launch refusal with a stable code.
- A check, if added, reads only the Node version and platform, and has a test for an affected and an unaffected version.
- Linux and macOS launches are unchanged.
Activity
don-milsey-miller commentedon Oct 13, 2026
Investigation outcome
Measured on Windows 11 Pro 10.0.26300 from
mainatbc7d8ca, with Pi 0.87.1 started directly: no Kiln extension, supervisor or job host, and the loopback provider fixture. Every Node build is the officialwin-x64/node.exe, checked against its release'sSHASUMS256.txt.Each run is two launches on one session id. The first creates the session and the second resumes it with a 256 KB answer, which makes Pi compact its context. That resumed launch is the workload #206 found to crash.
1.
--mode rpcacross every Node major theenginesrange admitsTen runs per version. The client closes standard input after
agent_settled.Every crash was exit code
0xC0000409withAssertion failed: !(handle->flags & UV_HANDLE_CLOSING), file src\win\async.c. The first launch of each run, which creates the session, crashed 0 of 160 times.2. The other launch modes
The same workload, on affected versions 23.0.0, 23.11.1, 24.0.0, 24.19.0, 25.9.0 and 26.6.0, and on 22.23.3, 24.20.0 and 26.7.0 as controls. Counts are resumed launches.
/quitagent_end-p)--mode json -p)Only RPC mode crashed. Reading Pi's code gives a reason that matches: RPC mode calls
process.exit()straight after disposing the runtime, interactive mode first waits up to one second for terminal input to drain, and print modes return frommainand let Node exit on its own.3. Affected range, from Node's history and from the boundaries above
Unsafe: all of 23.x, 24.0 through 24.19, all of 25.x, and 26.0 through 26.6. Safe: 22.x, 24.20.0 and later 24.x, 26.7.0 and later 26.x, and 27 onward.
4. Determinism
Not strictly deterministic. Two affected versions crashed 9 of 10, and the crash depends on the workload: a new session never crashed, and in #206 the same Pi with short answers crashed 0 of 160 launches on 24.18.0. In Kiln's own
test/rpc-start.test.mjson 24.18.0 the rate was 1 of 6 onmainand 2 of 5 on a feature branch.5. Where Kiln can check
Pi runs under
process.execPath, so the launcher's Node is Pi's.maininbin/start-kiln.mjsknows the mode once arguments are parsed. A check fits immediately after the output mode is set, before the project root is resolved, before the launch checks, and before any process starts.6. Decision
Refuse
start-kiln --rpcon Windows under an unsafe Node, before anything starts, with exit status 2 and the stable codenode-version-unsafe-for-rpc. There is no override. Terminal and piped launches and every non-Windows launch are unchanged.engines.nodestays>=22.19.0: Node 22 is safe, the defect is Windows-only and one launch mode is affected, so there is no platform-independent unsafe range. The README anddocs/running-the-shell.mdwill state the range.Not measured
process.exit().Merge pull request #222 from don-milsey-miller/claude/issue-218-windo…