rush-shell 0.0.2

data/lib/rush/startup.rb

@@ -0,0 +1,75 @@
+# typed: true
+# frozen_string_literal: true
+
+module Rush
+  # The startup files a session runs before its main input, per the dash
+  # oracle (POSIX defines ENV and leaves login files unspecified): a login
+  # shell runs /etc/profile then $HOME/.profile; an interactive shell then
+  # runs the file named by ENV, its value subjected to parameter expansion
+  # only. Missing or unreadable files are skipped silently; errors inside a
+  # file follow the session's normal policy (a batch shell aborts, an
+  # interactive one reports and carries on); `return` is bounded to its file
+  # like a dot script, leaving its code in $?.
+  class Startup
+    extend T::Sig
+
+    PROFILE = '/etc/profile'
+
+    sig { params(login: T::Boolean, interactive: T::Boolean).void }
+    def initialize(login:, interactive:)
+      @login = login
+      @interactive = interactive
+    end
+
+    sig { params(executor: Executor).void }
+    def run(executor)
+      paths(executor).each { |path| source(executor, path) }
+    end
+
+    private
+
+    sig { params(executor: Executor).returns(T::Array[String]) }
+    def paths(executor)
+      paths = @login ? [PROFILE, home_profile(executor)] : [] #: Array[String?]
+      paths << env_file(executor) if @interactive
+      paths.compact
+    end
+
+    sig { params(executor: Executor).returns(T.nilable(String)) }
+    def home_profile(executor)
+      home = executor.state.variables.get('HOME').to_s
+      return if home.empty?
+
+      "#{home}/.profile"
+    end
+
+    # The ENV pathname, parameter-expanded (POSIX); nil when unset or empty.
+    sig { params(executor: Executor).returns(T.nilable(String)) }
+    def env_file(executor)
+      raw = executor.state.variables.get('ENV').to_s
+      return if raw.empty?
+
+      executor.expander.expand_value(ParamText.new(raw).word, tilde: :none)
+    end
+
+    sig { params(executor: Executor, path: String).void }
+    def source(executor, path)
+      text = read(executor, path)
+      run_file(executor, text) if text
+    end
+
+    sig { params(executor: Executor, path: String).returns(T.nilable(String)) }
+    def read(executor, path)
+      executor.system.read_file(path)
+    rescue SystemCallError
+      nil
+    end
+
+    sig { params(executor: Executor, text: String).void }
+    def run_file(executor, text)
+      SourceRunner.new(executor, text).run
+    rescue ReturnSignal => e
+      executor.state.record_status(Status.new(e.code))
+    end
+  end
+end

data/lib/rush/status.rb

@@ -0,0 +1,93 @@
+# typed: true
+# frozen_string_literal: true
+
+module Rush
+  # Immutable result of running a command. $? can hold a value wider than a byte:
+  # dash keeps `return 300` as 300 in-process, and only wraps to 0-255 at a real
+  # process boundary (exit!/the shell's own exit, where the OS truncates). The
+  # operand is validated non-negative and <= INT_MAX before reaching here.
+  # Under job control a WUNTRACED wait can answer for a job that STOPPED rather
+  # than ended: stopsig carries the stopping signal, and the exitstatus is
+  # dash's view of the pair — normally 128+stopsig, but a mixed pipeline keeps
+  # the last stage's exit code while the job as a whole is stopped (probed).
+  class Status
+    extend T::Sig
+
+    sig { returns(Integer) }
+    attr_reader :exitstatus
+
+    sig { returns(T.nilable(Integer)) }
+    attr_reader :stopsig
+
+    sig { returns(T.nilable(Integer)) }
+    attr_reader :termsig
+
+    sig do
+      params(exitstatus: Integer, stopsig: T.nilable(Integer), termsig: T.nilable(Integer),
+             coredump: T.nilable(T::Boolean)).void
+    end
+    def initialize(exitstatus, stopsig: nil, termsig: nil, coredump: nil)
+      @exitstatus = exitstatus
+      @stopsig = stopsig
+      @termsig = termsig
+      @coredump = coredump
+    end
+
+    # The OS recorded a core dump alongside the killing signal (WCOREDUMP,
+    # nil when no dump information accompanied the status): SignalReport
+    # suffixes its message with " (core dumped)" like dash.
+    sig { returns(T::Boolean) }
+    def coredump?
+      !!@coredump
+    end
+
+    sig { returns(T::Boolean) }
+    def success?
+      exitstatus.zero?
+    end
+
+    # The job this status describes is stopped, not gone: the foreground
+    # wait hands it back to the prompt as a Stopped job-table entry.
+    sig { returns(T::Boolean) }
+    def stopped?
+      !!@stopsig
+    end
+
+    # The same verdict, carrying a sibling stage's stop signal: dash keeps
+    # the last stage's exit code even when an earlier stage's ^Z parked the
+    # whole pipeline (probed: stopped|exit5 answers 5, with the job
+    # Stopped), so the job's stoppedness rides along on the chosen status.
+    sig { params(stopsig: T.nilable(Integer)).returns(Status) }
+    def with_stop(stopsig)
+      stopped? || !stopsig ? self : Status.new(exitstatus, stopsig: stopsig)
+    end
+
+    sig { returns(Status) }
+    def self.success
+      new(0)
+    end
+
+    sig { params(code: Integer).returns(Status) }
+    def self.failure(code = 1)
+      new(code)
+    end
+
+    # A signalled process reports no exitstatus; POSIX maps it to 128 + signal.
+    # termsig is Integer? to the type-checker (nil unless signalled); the signalled
+    # branch here is the only one reached when exitstatus is nil, so .to_i pins it
+    # to a plain Integer without changing behaviour on any reachable path. A
+    # stopped child (WUNTRACED) maps to 128 + stopsig with the signal kept.
+    sig { params(process_status: Process::Status).returns(Status) }
+    def self.of(process_status)
+      return stopped(process_status.stopsig.to_i) if process_status.stopped?
+
+      signal = process_status.termsig
+      new(process_status.exitstatus || (signal.to_i + 128), termsig: signal, coredump: process_status.coredump?)
+    end
+
+    sig { params(stopsig: Integer).returns(Status) }
+    def self.stopped(stopsig)
+      new(stopsig + 128, stopsig: stopsig)
+    end
+  end
+end

data/lib/rush/stop_relay.rb

@@ -0,0 +1,32 @@
+# typed: true
+# frozen_string_literal: true
+
+module Rush
+  # The armed stage relay (rush-l4o): a pipeline stage of a monitor-mode job
+  # is a transparent member of it — a stop its own foreground wait reaps is
+  # re-raised onto the stage process itself, so the job's owner sees the
+  # member stop; after fg/bg's SIGCONT the reap loop re-waits the same
+  # target. dash reaches the same picture by exec-ing simple stages in
+  # place. Methods are explicit singletons, like Signals.
+  module StopRelay
+    extend T::Sig
+
+    # The reaped target's stop should be re-raised: relay armed AND the
+    # status is a stop (deaths and exits pass through untouched).
+    sig { params(control: JobTable::Control, status: Process::Status).returns(T::Boolean) }
+    def self.relay?(control, status)
+      control.relay? && status.stopped?
+    end
+
+    # Default disposition first — the -m parent left TSTP/TTOU ignored,
+    # while SIGSTOP takes no disposition and cannot be trapped — then the
+    # stop signal onto this very process. The block never runs: the
+    # command string wins inside trap_signal, as TrapRunner's ignores do.
+    sig { params(system: SystemCalls, status: Process::Status).void }
+    def self.raise_onto_self(system, status)
+      name = Signals::NUMBERS.fetch(T.must(status.stopsig))
+      system.trap_signal(name, 'SYSTEM_DEFAULT') { nil } unless name == 'STOP'
+      system.kill(name, system.pid)
+    end
+  end
+end

data/lib/rush/subshell_runner.rb

@@ -0,0 +1,70 @@
+# typed: true
+# frozen_string_literal: true
+
+module Rush
+  # Runs `( list )` in a forked subshell so cd/variable changes never leak to the
+  # parent. The child runs the body and exits with its status; the parent waits
+  # and adopts that status. fork/exit! are the one irreducible wrapper (covered
+  # by subprocess specs); the child-side `run_body` is tested directly.
+  class SubshellRunner
+    extend T::Sig
+
+    sig { params(executor: Executor, body: AST::Node).void }
+    def initialize(executor, body)
+      @executor = executor
+      @body = body
+    end
+
+    sig { returns(Status) }
+    def call
+      control = @executor.job_control
+      pid = control.launch { run_child }
+      text = control.job_text(AST::Subshell.new(@body))
+      status = control.foreground([pid], text: text) { @executor.jobs.await(pid) }
+      SignalReport.report(status, @executor.io.get(2))
+    end
+
+    # The subshell is a fresh top level: exit (or an uncaught return) ends it
+    # with that code, a stray break/continue is a no-op, and a fatal error
+    # (readonly, ${x:?}, ...) aborts only the subshell — the parent shell carries
+    # on — without letting the exception escape the fork.
+    sig { returns(Status) }
+    def run_body
+      @executor.enter_subshell
+      status = run_body_status
+      Status.new(@executor.trap_runner.run_exit_trap(status.exitstatus))
+    end
+
+    private
+
+    sig { returns(Status) }
+    def run_body_status
+      @executor.run(@body)
+    rescue Error => e
+      resolve(e)
+    end
+
+    sig { params(error: Error).returns(Status) }
+    def resolve(error)
+      decision = ErrorPolicy.decision(:subshell, error)
+      return Status.new(T.cast(error, T.any(ExitSignal, ReturnSignal)).code) if decision == :return_code
+      return @executor.state.last_status if decision == :last_status
+      return report_fatal(error) if decision == :abort2
+
+      raise error
+    end
+
+    sig { params(error: Error).returns(Status) }
+    def report_fatal(error)
+      @executor.io.get(2).puts("rush: #{error.message}")
+      Status.failure(2)
+    end
+
+    sig { returns(T.noreturn) }
+    def run_child
+      # :nocov:
+      @executor.system.exit!(run_body.exitstatus)
+      # :nocov:
+    end
+  end
+end

data/lib/rush/system_calls/collation.rb

@@ -0,0 +1,155 @@
+# typed: true
+# frozen_string_literal: true
+
+require 'fiddle'
+
+module Rush
+  class SystemCalls
+    # Optional glibc bridge for the locale data Ruby does not expose. POSIX ERE
+    # matching supplies bracket classes/equivalence/collating elements/ranges;
+    # strcoll supplies pathname order. The fixed regex buffer is deliberately
+    # glibc-gated (regex_t is opaque at the Fiddle boundary).
+    # One cohesive native-resource boundary; splitting function loading from
+    # regex ownership would separate lifecycle halves only to satisfy a metric.
+    # rubocop:disable Metrics/ClassLength
+    class Collation
+      extend T::Sig
+
+      LC_CTYPE = 0
+      LC_COLLATE = 3
+      REG_EXTENDED = 1
+      REGEX_BYTES = 256
+      MUTEX = Thread::Mutex.new
+      SIGNATURES = {
+        setlocale: [[Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP], Fiddle::TYPE_VOIDP],
+        regcomp: [[Fiddle::TYPE_VOIDP, Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT], Fiddle::TYPE_INT],
+        regexec: [[Fiddle::TYPE_VOIDP, Fiddle::TYPE_VOIDP, Fiddle::TYPE_SIZE_T,
+                   Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT], Fiddle::TYPE_INT],
+        regfree: [[Fiddle::TYPE_VOIDP], Fiddle::TYPE_VOID],
+        strcoll: [[Fiddle::TYPE_VOIDP, Fiddle::TYPE_VOIDP], Fiddle::TYPE_INT]
+      }.freeze
+
+      sig { void }
+      def initialize
+        @functions = T.let(load_functions, T::Hash[Symbol, T.untyped])
+      end
+
+      sig { returns(T::Boolean) }
+      def available?
+        @functions.any?
+      end
+
+      sig do
+        params(pattern: String, text: String, settings: T::Array[String],
+               fallback: T.proc.returns(T::Boolean)).returns(T::Boolean)
+      end
+      def match_shell?(pattern, text, settings, &fallback)
+        return yield unless available?
+
+        match?(PosixPattern.new(pattern).source, text, settings)
+      end
+
+      sig do
+        params(pattern: String, settings: T::Array[String],
+               fallback: T.proc.returns(T::Array[String])).returns(T::Array[String])
+      end
+      def glob(pattern, settings, &fallback)
+        return yield unless available?
+
+        regex = PosixPattern.new(pattern).source
+        matches = candidates(pattern).select { |path| match?(regex, path, settings) }
+        matches.sort { |left, right| compare(left, right, settings) }
+      end
+
+      sig { returns(T::Array[String]) }
+      def default_settings
+        %w[LC_COLLATE LC_CTYPE].map { |category| locale_value(category) }
+      end
+
+      sig { params(regex: String, text: String, settings: T::Array[String]).returns(T::Boolean) }
+      def match?(regex, text, settings)
+        MUTEX.synchronize do
+          activate(settings)
+          compiled(regex) { |pointer| call(:regexec, pointer, text, 0, nil, 0).zero? }
+        end
+      end
+
+      sig { params(left: String, right: String, settings: T::Array[String]).returns(Integer) }
+      def compare(left, right, settings)
+        MUTEX.synchronize do
+          activate(settings)
+          verdict = call(:strcoll, left, right)
+          verdict.zero? ? T.must(left.b <=> right.b) : verdict
+        end
+      end
+
+      private
+
+      sig { params(pattern: String).returns(T::Array[String]) }
+      def candidates(pattern)
+        source = PosixPattern.new(pattern).glob_source
+        Dir.glob(source, sort: false)
+      end
+
+      sig { params(category: String).returns(String) }
+      def locale_value(category)
+        values = [ENV.fetch('LC_ALL', nil), ENV.fetch(category, nil), ENV.fetch('LANG', nil)].compact
+        values.find { |value| !value.empty? } || 'C'
+      end
+
+      sig { returns(T::Hash[Symbol, T.untyped]) }
+      def load_functions
+        handle = Fiddle::Handle::DEFAULT
+        handle['gnu_get_libc_version']
+        SIGNATURES.to_h { |name, signature| [name, native_function(handle, name, signature)] }
+      rescue Fiddle::DLError
+        {}
+      end
+
+      sig { params(handle: T.untyped, name: Symbol, signature: T.untyped).returns(T.untyped) }
+      def native_function(handle, name, signature)
+        arguments, result = signature
+        Fiddle::Function.new(handle[name.to_s], arguments, result)
+      end
+
+      sig { params(name: Symbol, args: T.untyped).returns(T.untyped) }
+      def call(name, *args)
+        @functions.fetch(name).call(*args)
+      end
+
+      sig { params(regex: String, blk: T.proc.params(pointer: T.untyped).returns(T::Boolean)).returns(T::Boolean) }
+      def compiled(regex, &blk)
+        pointer = Fiddle::Pointer.malloc(REGEX_BYTES, Fiddle::RUBY_FREE)
+        return false if call(:regcomp, pointer, regex, REG_EXTENDED).nonzero?
+
+        free_after(pointer, &blk)
+      end
+
+      sig do
+        params(pointer: T.untyped,
+               blk: T.proc.params(pointer: T.untyped).returns(T::Boolean)).returns(T::Boolean)
+      end
+      def free_after(pointer, &blk)
+        yield(pointer)
+      ensure
+        call(:regfree, pointer)
+      end
+
+      sig { params(settings: T::Array[String]).void }
+      def activate(settings)
+        install(LC_COLLATE, settings.fetch(0))
+        install(LC_CTYPE, settings.fetch(1))
+      end
+
+      sig { params(category: Integer, requested: String).returns(String) }
+      def install(category, requested)
+        result = call(:setlocale, category, requested)
+        return requested unless result.null?
+
+        call(:setlocale, category, 'C')
+        'C'
+      end
+    end
+    # rubocop:enable Metrics/ClassLength
+  end
+end

data/lib/rush/system_calls/file_tests.rb

@@ -0,0 +1,95 @@
+# typed: true
+# frozen_string_literal: true
+
+module Rush
+  class SystemCalls
+    # File-test queries for the test/[ builtin (-e -f -d -r -w -x -s -h/-L,
+    # the file types -p -b -c -S, the mode bits -g -u, and the fd probe -t),
+    # mixed into SystemCalls. Thin File/IO delegations, like the rest of the
+    # syscall port.
+    module FileTests
+      extend T::Sig
+
+      sig { params(path: String).returns(T::Boolean) }
+      def exist?(path)
+        File.exist?(path)
+      end
+
+      sig { params(path: String).returns(T::Boolean) }
+      def file?(path)
+        File.file?(path)
+      end
+
+      sig { params(path: String).returns(T::Boolean) }
+      def directory?(path)
+        File.directory?(path)
+      end
+
+      sig { params(path: String).returns(T::Boolean) }
+      def readable?(path)
+        File.readable?(path)
+      end
+
+      sig { params(path: String).returns(T::Boolean) }
+      def writable?(path)
+        # !! because Sorbet's stdlib RBI types File.writable? as T.nilable(Integer)
+        # (it returns a real Boolean at runtime, like the other File predicates here).
+        !!File.writable?(path)
+      end
+
+      sig { params(path: String).returns(T::Boolean) }
+      def executable?(path)
+        File.executable?(path)
+      end
+
+      sig { params(path: String).returns(T::Boolean) }
+      def file_nonempty?(path)
+        File.size?(path).to_i.positive?
+      end
+
+      sig { params(path: String).returns(T::Boolean) }
+      def symlink?(path)
+        File.symlink?(path)
+      end
+
+      sig { params(path: String).returns(T::Boolean) }
+      def pipe?(path)
+        File.pipe?(path)
+      end
+
+      sig { params(path: String).returns(T::Boolean) }
+      def blockdev?(path)
+        File.blockdev?(path)
+      end
+
+      sig { params(path: String).returns(T::Boolean) }
+      def chardev?(path)
+        File.chardev?(path)
+      end
+
+      sig { params(path: String).returns(T::Boolean) }
+      def socket?(path)
+        File.socket?(path)
+      end
+
+      sig { params(path: String).returns(T::Boolean) }
+      def setgid?(path)
+        File.setgid?(path)
+      end
+
+      sig { params(path: String).returns(T::Boolean) }
+      def setuid?(path)
+        File.setuid?(path)
+      end
+
+      # isatty(fd) for test -t: any unusable descriptor number (closed, huge,
+      # negative) is simply not a terminal, as in dash.
+      sig { params(fd: Integer).returns(T::Boolean) }
+      def tty_fd?(fd)
+        IO.new(fd, autoclose: false).tty?
+      rescue ArgumentError, RangeError, SystemCallError
+        false
+      end
+    end
+  end
+end

data/lib/rush/system_calls/process_control.rb

@@ -0,0 +1,165 @@
+# typed: false
+# frozen_string_literal: true
+
+module Rush
+  class SystemCalls
+    # Child-process control for the job machinery, mixed into SystemCalls:
+    # reaping (JobTable is the sole consumer), process grouping, terminal
+    # handover (tcsetpgrp/tcgetpgrp via IO#ioctl), and the platform gate.
+    module ProcessControl
+      # ioctl request codes for tcgetpgrp/tcsetpgrp, keyed on the build's
+      # host_os: Ruby exposes no tc[gs]etpgrp, but IO#ioctl is core and the
+      # codes are stable ABI constants — the asm-generic pair on Linux, the
+      # sizeof-encoded form on darwin and the BSDs. An unmatched Unix gets
+      # no codes: tcgetpgrp answers nil, the terminal is never acquired, and
+      # job control degrades to grouping-only (the epic's Fiddle-into-libc
+      # fallback was judged not worth a dependency for platforms rush cannot
+      # test; revisit if one materialises).
+      TIOCGPGRP = { linux: 0x540F, bsd: 0x40047477 }.freeze
+      TIOCSPGRP = { linux: 0x5410, bsd: 0x80047476 }.freeze
+      TERMINAL_FAMILIES = { /linux/ => :linux, /darwin|bsd|dragonfly/ => :bsd }.freeze
+
+      # EINTR-style retry: an interactive SIGINT raises Interrupted at a safe
+      # point inside the blocking wait; the child is dying from the same signal,
+      # so wait again and reap it rather than leaking a zombie.
+      def waitpid2(pid)
+        Process.waitpid2(pid)
+      rescue Interrupted
+        retry
+      end
+
+      # The monitor-mode blocking wait (rush-mv8.4): WUNTRACED also returns a
+      # child the terminal (or a kill) has STOPPED, so ^Z hands control back
+      # to the shell instead of hanging it — dash waits this way whenever
+      # mflag is on, interactive or not (probed: $? = 148 off-tty too).
+      def wait_stoppable(pid)
+        Process.waitpid2(pid, Process::WUNTRACED)
+      rescue Interrupted
+        retry
+      end
+
+      # Non-blocking reap of any finished child: [pid, status], or nil while
+      # children exist but none has exited. Raises ECHILD, like waitpid2, when
+      # there are no children at all.
+      def poll_child
+        Process.waitpid2(-1, Process::WNOHANG)
+      end
+
+      def poll_pid(pid)
+        Process.waitpid2(pid, Process::WNOHANG)
+      end
+
+      # The monitor-mode poll (pairs with wait_stoppable as poll_child pairs
+      # with waitpid2): WUNTRACED, so the jobs builtin also sees a background
+      # job freshly SIGSTOPped since the last wait.
+      def poll_stopped
+        Process.waitpid2(-1, Process::WNOHANG | Process::WUNTRACED)
+      end
+
+      def poll_pid_stopped(pid)
+        Process.waitpid2(pid, Process::WNOHANG | Process::WUNTRACED)
+      end
+
+      # Place a process into a process group (pid 0 = the caller, pgid 0 = its
+      # own pid): the grouping seam. Failure means the double-setpgid race was
+      # lost benignly — EACCES: the child already exec'd (its own setpgid won);
+      # ESRCH/EPERM: it already exited — so the group is settled either way and
+      # the error is swallowed, as dash void-casts the same call.
+      # :nocov:
+      def setpgid(pid, pgid)
+        Process.setpgid(pid, pgid)
+      rescue Errno::EACCES, Errno::ESRCH, Errno::EPERM
+        nil
+      end
+
+      # Fork a child directly into a process group (pgid 0 = the child's own
+      # pid, per POSIX, so the kernel does the leader/joiner defaulting): the
+      # double setpgid, issued on both sides of the fork, means whichever side
+      # runs first settles the group before the child can exec or the parent
+      # can wait — the same dance as dash's forkchild/forkparent. A foreground
+      # job leader is also handed the terminal (tty given), child-side before
+      # the body runs, exactly where dash's forkchild calls xtcsetpgrp — so
+      # the job can never touch the tty before it owns it.
+      def fork_grouped(group, tty = nil, &child_main)
+        pid = fork { grouped_child(group, tty, &child_main) }
+        setpgid(pid, group) if pid
+        pid
+      end
+
+      def grouped_child(group, tty)
+        setpgid(0, group)
+        tcsetpgrp(tty, Process.pid) if tty
+        yield
+      end
+
+      # The controlling terminal, for handing between process groups:
+      # /dev/tty when the process has one, else a duplicate of the first
+      # standard stream that is a tty (dash walks fds 2..0 the same way; the
+      # dup means the caller always owns — and closes — its handle, immune
+      # to later redirections of the original). nil without a terminal.
+      def open_tty
+        File.open('/dev/tty', 'r+')
+      rescue SystemCallError
+        [$stderr, $stdout, $stdin].find(&:tty?)&.dup
+      end
+
+      # The terminal's foreground process group, or nil when the fd is not a
+      # tty or the platform has no known request code: dash's setjobctl uses
+      # the same call as the "can we do the tty dance at all" probe.
+      def tcgetpgrp(tty)
+        family = terminal_family
+        read_pgrp(tty, TIOCGPGRP.fetch(family)) if family
+      end
+
+      def read_pgrp(tty, request)
+        buffer = [0].pack('l')
+        tty.ioctl(request, buffer)
+        buffer.unpack1('l').then { |pgid| pgid.is_a?(Integer) ? pgid : nil }
+      rescue SystemCallError, IOError
+        nil
+      end
+
+      # Hand the terminal to a process group. The caller's group often does
+      # not own the terminal at that moment (reclaiming after a foreground
+      # job): the kernel answers such an ioctl with SIGTTOU, and a caught
+      # handler would abort it with EINTR while a default disposition would
+      # stop the shell — so the signal is ignored for real (SIG_IGN, not a
+      # handler block) for the call's duration, as dash holds TTOU ignored
+      # around xtcsetpgrp. Failure (the group already dead, the fd revoked)
+      # is swallowed like setpgid's: the reclaim that follows every
+      # foreground job settles ownership either way.
+      def tcsetpgrp(tty, pgid)
+        family = terminal_family
+        return unless family
+
+        ignoring_ttou { tty.ioctl(TIOCSPGRP.fetch(family), [pgid].pack('l')) }
+      rescue SystemCallError, IOError
+        nil
+      end
+      # :nocov:
+
+      # Job control needs POSIX process groups, which Windows builds lack (the
+      # rush-mv8 platform gate); everywhere else Process.setpgid is real.
+      def job_control_supported?
+        !RbConfig::CONFIG['host_os'].match?(/mswin|mingw|cygwin/)
+      end
+
+      # Which ioctl vocabulary this build speaks.
+      def terminal_family
+        host = RbConfig::CONFIG['host_os']
+        TERMINAL_FAMILIES.find { |pattern, _family| host.match?(pattern) }&.last
+      end
+
+      private
+
+      # :nocov:
+      def ignoring_ttou
+        previous = Signal.trap('TTOU', 'IGNORE')
+        yield
+      ensure
+        Signal.trap('TTOU', previous || 'DEFAULT')
+      end
+      # :nocov:
+    end
+  end
+end