[/diagnose] spawnSync can fail to spawn the child process entirely (e.g., if sudo is absent from PATH), returning { error: Error, status: null }. Checking only .status means a spawn-level failure silently falls into the else branch without surfacing the underlying error.

const awfChrootHomeCleanupResult = spawnSync(
  "sudo", ["sh", "-c", "rm -rf /tmp/awf-*-chroot-home"],
  { stdio: "inherit" }
);
if (awfChrootHomeCleanupResult.error) {
  console.warn(`Warning: failed to spawn AWF chroot-home cleanup: ${awfChrootHomeCleanupResult.error.message}`);
} else if (awfChrootHomeCleanupResult.status === 0) {
  console.log("Cleaned up /tmp/awf-*-chroot-home");
} else {
  console.warn(`Warning: AWF chroot-home cleanup exited with status ${awfChrootHomeCleanupResult.status}`);
}

@copilot please address this.

[/diagnose] The failure branch uses console.log — so a cleanup failure is indistinguishable from normal output in runner logs. Use console.warn (or console.error) to make this visible when scanning logs for problems.

} else {
  console.warn(`Warning: failed to clean /tmp/awf-*-chroot-home (exit ${awfChrootHomeCleanupResult.status})`);
}

@copilot please address this.

[/diagnose] The if block silently ignores a non-zero exit code — 2>/dev/null already suppresses stderr, and there is no else branch. post.js at least logs a message on failure; clean.sh drops the signal entirely, making future debugging harder.

if sudo rm -rf /tmp/awf-*-chroot-home 2>/dev/null; then
  echo "Cleaned up /tmp/awf-*-chroot-home (sudo)"
else
  echo "Warning: failed to clean /tmp/awf-*-chroot-home" >&2
fi

@copilot please address this.

[/zoom-out] clean.sh uses a shell-glob rm -rf approach while install_copilot_cli.sh (line 54) uses the safer sudo find /tmp -maxdepth 1 -name 'awf-*-chroot-home' -type d -exec rm -rf {} +. The find-based approach is more explicit (only removes directories, never ambiguous if glob expands to a file), and it is already established in this PR. Aligning both scripts reduces divergence.

# Remove AWF chroot home directories under /tmp (e.g. /tmp/awf-*-chroot-home).
if sudo find /tmp -maxdepth 1 -name 'awf-*-chroot-home' -type d -exec rm -rf {} + 2>/dev/null; then
  echo "Cleaned up /tmp/awf-*-chroot-home (sudo)"
else
  echo "Warning: failed to clean /tmp/awf-*-chroot-home" >&2
fi

@copilot please address this.

[/tdd] This bug fix has no accompanying regression test. Without one, the EACCES failure path could silently return if this cleanup code is ever refactored or removed. A unit test that mocks spawnSync and asserts it is called with the correct sudo arguments would guard against regressions.

it('calls sudo rm -rf for awf chroot-home dirs on cleanup', () => {
  const spawnSyncMock = jest.fn().mockReturnValue({ status: 0, error: null });
  // inject mock and run the cleanup step
  expect(spawnSyncMock).toHaveBeenCalledWith(
    'sudo',
    ['sh', '-c', 'rm -rf /tmp/awf-*-chroot-home'],
    expect.objectContaining({ stdio: 'inherit' })
  );
});

@copilot please address this.

Failure path uses console.log instead of console.error, so a genuine sudo failure blends into normal output and won't surface as an error in CI log scanning or ::error:: annotations.

} else {
  console.error("Failed to clean /tmp/awf-*-chroot-home: sudo returned non-zero");
}

When sudo rm -rf returns non-zero (actual sudo failure, not the no-match case), there is no warning emitted — the script silently continues. The tmpDir cleanup just above (lines 34–42) uses a three-branch pattern ending with echo "Warning: ..." >&2. This new block is missing that fallback, making it impossible to distinguish a successful no-op from a failed cleanup in CI logs.

if sudo rm -rf /tmp/awf-*-chroot-home 2>/dev/null; then
  echo "Cleaned up /tmp/awf-*-chroot-home (sudo)"
else
  echo "Warning: failed to clean up /tmp/awf-*-chroot-home" >&2
fi