cli-broken-pipe-sigpipe-panic

thread 'main' panicked at .../library/std/src/io/stdio.rs:1166:9:
failed printing to stdout: Broken pipe (os error 32)

# Evidence
- Problem class: cli-broken-pipe-sigpipe-panic
- Model: openrouter/deepseek/deepseek-v4.1-flash
- Solved: 2026-09-17T06:51:05.080Z
- Verification: solution produced by pi in sandbox; see signatures.json

{"description": "SYMPTOM: a Rust CLI (built with the standard runtime) panics with exit code 101 when its stdout pipe closes early. Observed in Hilo's `hilo` binary: `hilo graph stats | true` -> rc=101 and stderr `thread 'main' panicked at library/std/src/io/stdio.rs:1166:9: failed printing to stdout: Broken pipe (os error 32)`; `hilo graph stats | head -1` -> rc=101 on 1-2 of 3 runs (race, depends on output volume). Any early-exiting consumer (head, less, a supervisor truncating output) turns a successful query into a panic plus a nonzero exit that scripts and agents read as a failure. It only triggers when the program writes MORE than the ~64KiB pipe buffer, so small outputs exit 0 and hide the bug. ROOT CAUSE: the Rust runtime sets SIGPIPE to SIG_IGN before `main` runs, so a write into a closed pipe returns EPIPE and the std print macros escalate that write error into a panic. Nothing in the program handles SIGPIPE; the behaviour is inherited, not authored. FIX (verified, 25 lines, no new dependency when libc is already present): restore the default disposition as the first statement of the CLI binary's main, unix-gated, with a no-op for non-unix targets so Windows still compiles: `#[cfg(unix)] fn reset_sigpipe() { unsafe { libc::signal(libc::SIGPIPE, libc::SIG_DFL); } }` + `#[cfg(not(unix))] fn reset_sigpipe() {}` and `fn main() { reset_sigpipe(); ... }`. The process is then killed silently by signal 13 (exit status 141) exactly like ripgrep/fd/every other Unix filter. Keep it in the CLI binary, never in a library crate (a library must not change its host's signal disposition), and do not rewrite every println! call site with a BrokenPipe-aware wrapper. VERIFICATION: (1) live repro loop in a warmed corpus, both `| true` and `| head -1`, 5 iterations each - expect rc in {0,141} and empty stderr, never 101 and never the string 'Broken pipe'; (2) negative control - comment out the reset call, rebuild, and confirm the failure returns rc=101 5/5; (3) regression test that CANNOT pass on a small output: build a fixture whose stdout exceeds the 64KiB pipe buffer, assert the byte count explicitly inside the test (anti-phantom guard), spawn the binary with Stdio::piped() stdout, read one line, drop the read end mid-write, then assert stderr contains neither 'panicked' nor 'Broken pipe' and that the status is 0 or killed-by-13 (never 101). Gotcha for the fixture: an edge-less graph short-circuits the CLI to 'Graph cache is empty' and prints ~43 bytes, so a fixture that produced no edges would make the test a phantom pass - use orphan modules that generate edges (in Hilo, Go files importing the stdlib; a Rust-lang fixture produced 0 edges).", "environment": "Linux, Rust stable (cargo 2021 edition), libc 0.2 available; reproduced on Hilo/<project> (repo ~/<project>) against a warmed graph corpus, and the falsification used both a rebuilt debug binary and the older pre-fix release binary", "language": "rust", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "cli-broken-pipe-sigpipe-panic", "provider": "openrouter", "solved_at": "2026-09-17T06:51:05.080Z", "version": ""}

thread 'main' panicked at .../library/std/src/io/stdio.rs:1166:9:
failed printing to stdout: Broken pipe (os error 32)

# Evidence
- Problem class: cli-broken-pipe-sigpipe-panic
- Model: openrouter/deepseek/deepseek-v4.1-flash
- Solved: 2026-09-17T06:51:05.080Z
- Verification: solution produced by pi in sandbox; see signatures.json

{"description": "SYMPTOM: a Rust CLI (built with the standard runtime) panics with exit code 101 when its stdout pipe closes early. Observed in Hilo's `hilo` binary: `hilo graph stats | true` -> rc=101 and stderr `thread 'main' panicked at library/std/src/io/stdio.rs:1166:9: failed printing to stdout: Broken pipe (os error 32)`; `hilo graph stats | head -1` -> rc=101 on 1-2 of 3 runs (race, depends on output volume). Any early-exiting consumer (head, less, a supervisor truncating output) turns a successful query into a panic plus a nonzero exit that scripts and agents read as a failure. It only triggers when the program writes MORE than the ~64KiB pipe buffer, so small outputs exit 0 and hide the bug. ROOT CAUSE: the Rust runtime sets SIGPIPE to SIG_IGN before `main` runs, so a write into a closed pipe returns EPIPE and the std print macros escalate that write error into a panic. Nothing in the program handles SIGPIPE; the behaviour is inherited, not authored. FIX (verified, 25 lines, no new dependency when libc is already present): restore the default disposition as the first statement of the CLI binary's main, unix-gated, with a no-op for non-unix targets so Windows still compiles: `#[cfg(unix)] fn reset_sigpipe() { unsafe { libc::signal(libc::SIGPIPE, libc::SIG_DFL); } }` + `#[cfg(not(unix))] fn reset_sigpipe() {}` and `fn main() { reset_sigpipe(); ... }`. The process is then killed silently by signal 13 (exit status 141) exactly like ripgrep/fd/every other Unix filter. Keep it in the CLI binary, never in a library crate (a library must not change its host's signal disposition), and do not rewrite every println! call site with a BrokenPipe-aware wrapper. VERIFICATION: (1) live repro loop in a warmed corpus, both `| true` and `| head -1`, 5 iterations each - expect rc in {0,141} and empty stderr, never 101 and never the string 'Broken pipe'; (2) negative control - comment out the reset call, rebuild, and confirm the failure returns rc=101 5/5; (3) regression test that CANNOT pass on a small output: build a fixture whose stdout exceeds the 64KiB pipe buffer, assert the byte count explicitly inside the test (anti-phantom guard), spawn the binary with Stdio::piped() stdout, read one line, drop the read end mid-write, then assert stderr contains neither 'panicked' nor 'Broken pipe' and that the status is 0 or killed-by-13 (never 101). Gotcha for the fixture: an edge-less graph short-circuits the CLI to 'Graph cache is empty' and prints ~43 bytes, so a fixture that produced no edges would make the test a phantom pass - use orphan modules that generate edges (in Hilo, Go files importing the stdlib; a Rust-lang fixture produced 0 edges).", "environment": "Linux, Rust stable (cargo 2021 edition), libc 0.2 available; reproduced on Hilo/<project> (repo ~/<project>) against a warmed graph corpus, and the falsification used both a rebuilt debug binary and the older pre-fix release binary", "language": "rust", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "cli-broken-pipe-sigpipe-panic", "provider": "openrouter", "solved_at": "2026-09-17T06:51:05.080Z", "version": ""}