background-unbounded
A deny rule by default: it refuses a shell command run in the background with nothing to end it, and names what to run instead.
What it catches
A shell command run in the background with nothing to end it.
Why
A backgrounded command outlives the agent that started it, and the host stops it only when asked. It fires when the wiring reports that the host runs the call in the background and some command in the line is not bounded: timeout N or gtimeout N in front of it (stock macOS ships neither; Homebrew's coreutils installs gtimeout), a magus target run (bounded by its target's timeout), or a builtin that returns at once. A pipeline is bounded by its first command; a while or until loop never is. The refusal names a ceiling, timeout 30m unless ceiling_minutes sets another, the span after which background-silent starts speaking of a quiet task. timeout signals its own process group, so a child that starts its own session escapes it; --kill-after ends a command that ignores TERM. A watcher's command is bounded by its own expiry and is not judged here.
Default and override
By default this rule takes the decision deny. A workspace sets it by name, in its root
magusfile, to deny, advise or off:
magus\guard.builtins({"background-unbounded": "advise"})
A loosening takes effect once it is committed; a tightening applies at once.
Seeing it
A verdict names its rule in brackets, which is how you got here:
deny [background-unbounded]: ...
A workspace that sets this rule to advise sees advise [background-unbounded]: ... instead.
magus describe rule background-unbounded prints the same entry at a terminal, and
magus describe rules lists every rule this workspace enforces.
See also
- All rules - what this workspace enforces, deny first
- The guard - how a verdict is reached and wired
- Setting a built-in rule - how a workspace changes this default