[BUG]: AzureKeyVaultV2 exits with 57005 (0xDEAD) and no diagnostic output

[bryanchen-d]

Task

AzureKeyVault@2 — version 2.273.1

Environment

• Agent: hosted Windows 1ES pool (Microsoft-managed), Agent.Version 4.273.0
• Node runtime: node24 (C:\vss-agent\4.273.0\externals\node24\bin\node.exe)
• Authentication: Workload Identity Federation (OIDC) service connection
• Org: monacotools ADO, pipeline: microsoft/vscode product build

Problem

The task exits with exit code 57005 (0xDEAD) and the only output emitted is the agent's generic launcher message:

Exit code 57005 returned from process: file name 'C:\vss-agent\4.273.0\externals\node24\bin\node.exe',
  arguments '"D:\a\_work\_tasks\AzureKeyVault_1e244d32-2dd4-4165-96fb-b7441ca9331e\2.273.1\run.js"'

There is zero diagnostic output from the task itself — no stdout, no stderr, no ##[error], no indication of which phase failed (OIDC token exchange, AAD auth, vault data-plane connection, secret enumeration, individual secret fetch). The Node process is clearly being killed/crashing before the task can flush anything.

Example failing build (internal): https://dev.azure.com/monacotools/Monaco/_build/results?buildId=441275&view=logs&j=15ec5277-fdc6-550c-b203-acb65f44f31c&t=44617740-cedf-5dec-9e84-fa378148cb58

Step: Azure Key Vault: Get Secrets fetching github-distro-mixin-password.

The same exit-code signature was reported broadly across many ADO pipelines on 2026-05-20 (see Azure/azure-sdk-for-js#38609), so this is not isolated to one pipeline.

Why this matters

57005 / 0xDEAD alone tells the consumer nothing actionable. The root cause could be any of:

• OIDC token endpoint timeout / network egress issue on the agent
• AAD throttling or transient 5xx
• Key Vault data-plane regional issue
• DNS resolution failure (e.g. vault.azure.net, login.microsoftonline.com, vstoken.dev.azure.com)
• An uncaught exception / unhandledRejection inside the task
• The Node process being killed by the OS (OOM, signal, antivirus, etc.)
• A regression in the 2.273.x task or node24 runner combo

Without any task-side log, every consumer has to guess and wait. Two prior 57005 issues (#20156, #20221) hit the same opaque exit code in AzurePowerShell@5 / AzureFileCopy@6 and required deep external investigation to attribute to a pwsh stack overflow — let's not repeat that for the Node tasks.

Ask

Improve diagnostic surface in AzureKeyVaultV2:

1. Top-level safety net in the entry point — wrap main() in a try/catch that calls tl.error(err.stack ?? err.message) and tl.setResult(tl.TaskResult.Failed, ...) before the process exits, so anything that throws gets logged.
2. uncaughtException / unhandledRejection handlers that log the error and call tl.setResult before exit. These are not redundant with (1) — they catch async failures that escape the awaited chain.
3. Phase heartbeat logs at tl.debug or even info level so the last line printed identifies the phase that died:
   • resolving service connection auth scheme
   • requesting OIDC token from <endpoint>
   • exchanging OIDC token for AAD access token
   • connecting to vault <name>.vault.azure.net
   • listing secrets / fetching secret <name>
4. Distinguish signal-kill from thrown error — on process.on('exit'), log the exit code and whether a signal was received, so consumers can tell "task threw" vs. "OS killed Node" vs. "exited cleanly with non-zero code".
5. Optionally: surface the underlying @azure/identity / @azure/keyvault-secrets error details (status code, request ID, endpoint) instead of letting a rejection propagate raw.

Even a one-line "phase X failed: " would turn this from "ticket-the-platform-team" into "fix-the-network/secret/cred-immediately" for the vast majority of consumers.

Repro

Not deterministic — observed transiently on hosted Windows 1ES agents under WIF auth. Cannot reproduce on demand; the diagnostic improvements above are precisely what's needed to attribute future occurrences.

[cmconti]

We've been seeing something very similar to this too, intermittently since 15 May. Most, though not all, have been in the azure key vault pre-job task

FWIW, we are running in a Managed DevOps pool, using windows-2022 runner image version 20260105.167.1

For the AzureKeyVault pre-job failures, some are the first AzureKeyVault pre-job, but others are not.

Date (UTC)	Error Header	Exit Code String
22-05-26 11:20	AzureKeyVault pre-job	Exit code -1073740791 returned from process: file name 'C:\vss-agent\4.273.0\externals\node24\bin\node.exe', arguments '"D:\a_work_tasks\AzureKeyVault_1e244d32-2dd4-4165-96fb-b7441ca9331e\2.273.1\runprejob.js"'.
21-05-26 21:54	AzureKeyVault pre-job	Exit code -1073740791 returned from process: file name 'C:\vss-agent\4.273.0\externals\node24\bin\node.exe', arguments '"D:\a_work_tasks\AzureKeyVault_1e244d32-2dd4-4165-96fb-b7441ca9331e\2.273.1\runprejob.js"'.
21-05-26 09:37	AzureKeyVault pre-job	Exit code -1073740791 returned from process: file name 'C:\vss-agent\4.273.0\externals\node24\bin\node.exe', arguments '"D:\a_work_tasks\AzureKeyVault_1e244d32-2dd4-4165-96fb-b7441ca9331e\2.273.1\runprejob.js"'.
20-05-26 09:56	NuGet Tool installer	Exit code -1073740791 returned from process: file name 'C:\vss-agent\4.273.0\externals\node24\bin\node.exe', arguments '"D:\a_work_tasks\NuGetToolInstaller_2c65196a-54fd-4a02-9be8-d9d1837b7c5d\1.273.0\nugettoolinstaller.js"'.
19-05-26 21:03	AzureKeyVault pre-job	Exit code -1073740791 returned from process: file name 'C:\vss-agent\4.273.0\externals\node24\bin\node.exe', arguments '"D:\a_work_tasks\AzureKeyVault_1e244d32-2dd4-4165-96fb-b7441ca9331e\2.273.1\runprejob.js"'.
19-05-26 16:48	VSTest	Exit code -1073740791 returned from process: file name 'C:\vss-agent\4.273.0\externals\node24\bin\node.exe', arguments '"D:\a_work_tasks\VSTest_ef087383-ee5e-42c7-9a53-ab56c98420f9\3.271.0\runvstest.js"'.
19-05-26 15:49	AzureKeyVault pre-job	Exit code -1073740791 returned from process: file name 'C:\vss-agent\4.273.0\externals\node24\bin\node.exe', arguments '"D:\a_work_tasks\AzureKeyVault_1e244d32-2dd4-4165-96fb-b7441ca9331e\2.273.1\runprejob.js"'.
18-05-26 18:49	VSTest	Exit code -1073740791 returned from process: file name 'C:\vss-agent\4.273.0\externals\node24\bin\node.exe', arguments '"D:\a_work_tasks\VSTest_ef087383-ee5e-42c7-9a53-ab56c98420f9\3.271.0\runvstest.js"'.
15-05-26 17:17	NuGet Tool installer	Exit code -1073740791 returned from process: file name 'C:\vss-agent\4.273.0\externals\node24\bin\node.exe', arguments '"D:\a_work_tasks\NuGetToolInstaller_2c65196a-54fd-4a02-9be8-d9d1837b7c5d\1.273.0\nugettoolinstaller.js"'.

[JoshHariz]

We've been seeing the same as the above comment for AzureCLI tasks

##[error]Exit code -1073740791 returned from process: file name 'C:\agent\externals\node24\bin\node.exe', arguments '"C:\a_tasks\AzureCLI_46e4be58-730b-4389-8a2f-ea10b3e5e815\2.274.1\azureclitask.js"'.

Occurs intermittently but very commonly. I'm not sure if its the same as the original commenter's issue. @cmconti perhaps we should raise another Issue specifically on this Exit code -1073740791 bug

[Deekshitha2812]

@bryanchen-d, this is a known bug in Node.js v24.15.0 - nodejs/node#62991. node.exe v24.15.0 intermittently crashes with a native fault (exit code 57005 / 0xDEAD). The latest agent (v4.273.0) bundles Node 24.15.0, which is why this started appearing. This is not a bug in the pipeline tasks or the agent — it's a Node.js runtime regression.

[JoshHariz]

@Deekshitha2812 do you think this is node bug is also causing the exit code -1073740791 issue? We run self-hosted agents and our image hasn't been rebuilt since March 11th, but the issue only started occurring on May 14th. It seems unlikely that the node issue is the root cause for this issue.

Do you think the two issues are related at all?

[v-dko]

@bryanchen-d @JoshHariz can you let us know which node version you are using?

[bryanchen-d]

@Deekshitha2812 , @v-dko , the node js version is v24 as mentioned in the bug.
And it is pinned to 24.15.0 by the azure-pipelines-agent@4.273.0
https://raw.githubusercontent.com/microsoft/azure-pipelines-agent/v4.273.0/src/Misc/externals.sh

[v-dko]

@bryanchen-d The issue was resolved in azure-pipelines-agent@4.274.1 by downgrading the Node.js version to v24.14.1, which was previously working and deployments are in process.
As a workaround you can:
-- If you use self hosted agent you can downgrade the node version on machine.
-- Use AGENT_USE_NODE20_1:"true" variable

[bryanchen-d]

@v-dko , it seems 4.271.1 carries a pre-release badge so our 1ES managed pools' auto-update hasnn't picked it up.
When will 4.271.1 be released?

[v-dko]

@bryanchen-d azure-pipelines-agent@4.274.1 deployments have just begun and will take a few weeks to finish. I will update you once the deployments are completed.