mini-kode executes a tool side effect after SIGINT cancellation

[N0zoM1z0]

Summary

mini-kode can continue consuming a delayed provider tool call after a user interrupt has already been delivered, execute the local tool side effect, and then fail with a message-validation error.

The standalone reproducer installs public mini-kode@0.2.3, starts a local mock provider, schedules SIGINT 500 ms after the CLI starts, delays the provider tool call for 1200 ms, and verifies that the delayed tool call still writes a marker file after cancellation.

Affected target

• Target: mini-kode
• Affected version checked with the public reproducer: 0.2.3
• Current public latest checked on 2026-06-22: 0.2.3
• Environment: Linux x86_64 Docker, public npm package install
• Provider/model: local OpenAI-compatible mock provider, gpt-4

Steps to reproduce

Prerequisites: Docker, Python 3, and the GitHub CLI (gh) for the clone command below. The linked reproducer is self-contained and uses only Python standard-library modules plus Docker. It installs the affected CLI version from the public package registry, starts a local mock provider, and runs the CLI in an isolated workspace. The Docker run is limited to 2 CPUs and 4 GiB RAM by default.

Complete self-contained reproducer: https://gist.github.com/N0zoM1z0/0fe3498ad6d965d62da55a96e9b1c3c6

The Gist contains mini-kode-late-effect-after-cancel.reproduce.py. Download and run:

gh gist clone 0fe3498ad6d965d62da55a96e9b1c3c6 mini-kode-late-effect-after-cancel-reproducer
cd mini-kode-late-effect-after-cancel-reproducer
python3 mini-kode-late-effect-after-cancel.reproduce.py

To reuse an already-built local image:

python3 mini-kode-late-effect-after-cancel.reproduce.py --skip-build

Expected successful reproduction output includes:

provider_requests_at_least: observed=... expected>=1
tool_result_after_signal: observed=... expected>=1
side_effect_file_contains mini-kode-late-effect-after-cancel.log 'late-effect-after-signal': observed=True
REPRODUCED

Actual behavior

mini-kode receives SIGINT before the delayed provider tool call is emitted, but it still executes the later shell tool side effect. The public reproducer then exits with a message-validation error about duplicate/missing tool messages for late_after_cancel.

Expected behavior

After user cancellation, mini-kode should stop consuming later provider-stream tool calls and should not execute their local side effects.

Public upstream status: This report targets stock public mini-kode@0.2.3, which is the current npm latest checked on 2026-06-22. This is separate from the already filed repeated-tool-loop issue because it validates cancellation semantics.