@aiwg/cli 2026.10.3 → 2026.10.4

package/tools/plugin/package-plugins.mjs

@@ -10,12 +10,15 @@
  *   node tools/plugin/package-plugins.mjs --plugin aiwg-sdlc # Package specific plugin
  *   node tools/plugin/package-plugins.mjs --clean            # Clean agentic/code/plugins directory
  *   node tools/plugin/package-plugins.mjs --dry-run          # Show what would be copied
+ *   node tools/plugin/package-plugins.mjs --all --check      # Verify tracked Claude copies
  */
 
 import fs from 'fs';
 import path from 'path';
-import { fileURLToPath } from 'url';
+import os from 'os';
+import { fileURLToPath, pathToFileURL } from 'url';
 import { importImpl } from '../_resolve-impl.mjs';
+import { rewritePublishedMarkdown, reportPluginLinks } from './plugin-links.mjs';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -38,7 +41,9 @@ const PLUGIN_CONFIGS = {
       skills: 'agentic/code/frameworks/sdlc-complete/skills'
     },
     extraCopy: [
-      { from: 'tools/security/threat-assessment.mjs', to: 'tools/security/threat-assessment.mjs' }
+      { from: 'tools/security/threat-assessment.mjs', to: 'tools/security/threat-assessment.mjs' },
+      { from: 'agentic/code/frameworks/sdlc-complete/flows/flow-architecture-evolution.playbook.yaml', to: 'flows/flow-architecture-evolution.playbook.yaml' },
+      { from: 'agentic/code/frameworks/sdlc-complete/flows/flow-release.playbook.yaml', to: 'flows/flow-release.playbook.yaml' }
     ],
     rewrites: [
       {
@@ -136,7 +141,12 @@ Marketing automation framework with 37 specialized agents.
       skills: 'agentic/code/addons/voice-framework/skills'
     },
     extraCopy: [
-      { from: 'agentic/code/addons/voice-framework/voices', to: 'voices' }
+      { from: 'agentic/code/addons/voice-framework/voices', to: 'voices' },
+      { from: 'agentic/code/addons/voice-framework/docs/writing-workflows.md', to: 'docs/writing-workflows.md' },
+      { from: 'agentic/code/addons/voice-framework/docs/voice-output-impact.md', to: 'docs/voice-output-impact.md' },
+      { from: 'agentic/code/addons/voice-framework/docs/natural-voice/ADR-001-evidence-and-ownership.md', to: 'docs/natural-voice/ADR-001-evidence-and-ownership.md' },
+      { from: 'agentic/code/addons/voice-framework/docs/natural-voice/evidence-ledger.v1.json', to: 'docs/natural-voice/evidence-ledger.v1.json' },
+      { from: 'agentic/code/addons/voice-framework/flows/voice-critique-correction.flow.yaml', to: 'flows/voice-critique-correction.flow.yaml' }
     ],
     readme: `# AIWG Voice Framework
 
@@ -227,6 +237,11 @@ Writing quality validation and AI pattern detection.
       agents: 'agentic/code/addons/aiwg-utils/agents',
       skills: 'agentic/code/addons/aiwg-utils/skills'
     },
+    extraCopy: [
+      { from: 'agentic/code/addons/aiwg-utils/rules/skill-discovery.md', to: 'rules/skill-discovery.md' },
+      { from: 'agentic/code/addons/aiwg-utils/rules/skill-discovery-guidance.md', to: 'rules/skill-discovery-guidance.md' },
+      { from: 'agentic/code/addons/aiwg-utils/rules/cli-secondary.md', to: 'rules/cli-secondary.md' }
+    ],
     readme: `# AIWG Utilities
 
 Core AIWG utilities for context regeneration and workspace management.
@@ -269,10 +284,19 @@ Core AIWG utilities for context regeneration and workspace management.
     name: 'codex-sdlc',
     displayName: 'AIWG SDLC for Codex',
     pluginType: 'codex',
+    scriptWrappers: [{
+      file: 'skills/address-issues-threat-assess/scripts/assess.mjs',
+      source: 'agentic/code/frameworks/sdlc-complete/skills/address-issues-threat-assess/scripts/assess.mjs',
+      exports: ['assessIssue', 'assessText', 'runCli'],
+    }],
     description: 'Complete SDLC framework packaged as a Codex plugin with skills, agents, and marketplace entry.',
     sources: {
       skills: 'agentic/code/frameworks/sdlc-complete/skills'
     },
+    extraCopy: [
+      { from: 'agentic/code/frameworks/sdlc-complete/flows/flow-architecture-evolution.playbook.yaml', to: 'flows/flow-architecture-evolution.playbook.yaml' },
+      { from: 'agentic/code/frameworks/sdlc-complete/flows/flow-release.playbook.yaml', to: 'flows/flow-release.playbook.yaml' }
+    ],
     readme: `# AIWG SDLC for Codex
 
 AIWG SDLC framework packaged as a Codex plugin.
@@ -348,6 +372,9 @@ Digital forensics and incident response framework with 14 specialized agents.
       agents: 'agentic/code/frameworks/security-engineering/agents',
       skills: 'agentic/code/frameworks/security-engineering/skills'
     },
+    extraCopy: [
+      { from: 'agentic/code/frameworks/security-engineering/rules/ci-action-pinning.md', to: 'rules/ci-action-pinning.md' }
+    ],
     readme: `# AIWG Security Engineering
 
 Applied security engineering framework for cryptographic primitive selection, chain-of-trust integrity, and physical-threat modeling.
@@ -394,6 +421,10 @@ Applied security engineering framework for cryptographic primitive selection, ch
       agents: 'agentic/code/frameworks/research-complete/agents',
       skills: 'agentic/code/frameworks/research-complete/skills'
     },
+    extraCopy: [
+      { from: 'agentic/code/frameworks/research-complete/docs/bibliographic-services.md', to: 'docs/bibliographic-services.md' },
+      { from: 'agentic/code/frameworks/research-complete/docs/corpus-data-model.md', to: 'docs/corpus-data-model.md' }
+    ],
     readme: `# AIWG Research Complete
 
 Research workflow framework with 9 specialized agents for academic and technical research.
@@ -679,6 +710,9 @@ function parseArgs() {
 
   for (let i = 0; i < args.length; i++) {
     switch (args[i]) {
+      case '--check-links':
+        options.checkLinks = true;
+        break;
       case '--all':
       case '-a':
         options.all = true;
@@ -704,6 +738,9 @@ function parseArgs() {
       case '-n':
         options.dryRun = true;
         break;
+      case '--check':
+        options.check = true;
+        break;
       case '--help':
       case '-h':
         console.log(`
@@ -713,6 +750,7 @@ Usage:
   node tools/plugin/package-plugins.mjs [options]
 
 Options:
+  --check-links         Report payload links without writing; exit 1 on offenders
   --all, -a             Package all plugins
   --plugin, -p NAME     Package specific plugin
   --provider NAME       Package for a specific provider
@@ -722,6 +760,7 @@ Options:
   --output PATH         Standalone archive output (default: dist/plugins)
   --clean, -c           Clean plugins directory before packaging
   --dry-run, -n         Show what would be done without writing
+  --check               Verify all default Claude outputs without writing to the checkout
   --help, -h            Show this help message
 
 Examples:
@@ -823,6 +862,19 @@ function pruneUndeclaredPackagedSkills(pluginDir, declaredSkills) {
   }
 }
 
+
+export function rewritePublishedLinks(pluginDir, payloadRoot = pluginDir) {
+  for (const entry of fs.readdirSync(pluginDir, { withFileTypes: true })) {
+    const target = path.join(pluginDir, entry.name);
+    if (entry.isDirectory()) rewritePublishedLinks(target, payloadRoot);
+    else if (entry.isFile() && entry.name.endsWith('.md')) {
+      const body = fs.readFileSync(target, 'utf8');
+      const rewritten = rewritePublishedMarkdown(body, target, payloadRoot, ROOT_DIR);
+      if (rewritten !== body) fs.writeFileSync(target, rewritten);
+    }
+  }
+}
+
 // Clean plugin directory (except .claude-plugin)
 function cleanPlugin(pluginDir) {
   if (!fs.existsSync(pluginDir)) return;
@@ -844,7 +896,7 @@ function cleanPlugin(pluginDir) {
 function packagePlugin(name, config, options) {
   console.log(`\n📦 Packaging ${config.displayName}...`);
 
-  const pluginDir = path.join(PLUGINS_DIR, name);
+  const pluginDir = path.join(options.pluginsDir || PLUGINS_DIR, name);
 
   if (options.clean) {
     console.log('  🧹 Cleaning existing files...');
@@ -930,6 +982,8 @@ function packagePlugin(name, config, options) {
     }, null, 2)}\n`);
   }
 
+  if (!options.dryRun) rewritePublishedLinks(pluginDir);
+
   console.log(`  ✅ ${config.displayName} packaged successfully`);
 }
 
@@ -975,8 +1029,37 @@ function writeClaudeMarketplaceManifest(options) {
     console.log(`  ${manifest.plugins.length} plugins`);
     return;
   }
-  fs.writeFileSync(existingPath, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
-  console.log(`\n✓ Wrote Claude marketplace: ${existingPath} (${manifest.plugins.length} plugins)`);
+  const outputPath = options.marketplacePath || existingPath;
+  fs.writeFileSync(outputPath, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
+  console.log(`\n✓ Wrote Claude marketplace: ${outputPath} (${manifest.plugins.length} plugins)`);
+}
+
+// Runtime delegates are generated after copying sources, so regeneration cannot
+// replace canonical routing with a checkout-relative implementation copy.
+export function writeCanonicalScriptWrappers(pluginDir, wrappers, repoRoot = ROOT_DIR) {
+  for (const wrapper of wrappers || []) {
+    const target = path.join(pluginDir, wrapper.file);
+    const relativeSource = path.relative(path.dirname(target), path.join(repoRoot, wrapper.source)).split(path.sep).join('/');
+    const source = JSON.stringify(wrapper.source);
+    fs.writeFileSync(target, `#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+const candidates = [
+  new URL(${JSON.stringify(relativeSource)}, import.meta.url),
+  pathToFileURL(path.resolve(process.cwd(), ${source})),
+  pathToFileURL(path.resolve(process.cwd(), 'node_modules/aiwg', ${source})),
+];
+const source = candidates.find(candidate => fs.existsSync(candidate));
+if (!source) throw new Error('Unable to locate the canonical AIWG threat-assessment wrapper');
+const canonical = await import(source.href);
+
+${wrapper.exports.map(name => `export const ${name} = canonical.${name};`).join('\n')}
+
+if (import.meta.url === pathToFileURL(process.argv[1] || '').href) runCli();
+`);
+  }
 }
 
 // Package a Codex-format plugin (generates .codex-plugin/plugin.json + marketplace.json)
@@ -1105,10 +1188,80 @@ function writeCodexMarketplaceManifest(options) {
   console.log(`\n✓ Wrote Codex project marketplace: ${manifestPath} (${codexPlugins.length} plugins)`);
 }
 
+// Compare the same generation logic used by --all, including manifests,
+// rewrites and skill pruning. Only default Claude-owned paths are checked:
+// provider-native metadata and separately maintained templates are preserved.
+export function checkPackagedPlugins({ pluginsDir = PLUGINS_DIR,
+  marketplacePath = path.join(ROOT_DIR, '.claude-plugin/marketplace.json') } = {}) {
+  const temporary = fs.mkdtempSync(path.join(os.tmpdir(), 'aiwg-plugin-check-'));
+  const differences = [];
+  function files(root) {
+    if (!fs.existsSync(root)) return [];
+    if (!fs.statSync(root).isDirectory()) return [''];
+    return fs.readdirSync(root, { withFileTypes: true }).flatMap(entry => (
+      files(path.join(root, entry.name)).map(file => path.join(entry.name, file))
+    ));
+  }
+  function compare(expected, actual, label) {
+    const paths = new Set([...files(expected), ...files(actual)]);
+    for (const file of [...paths].sort()) {
+      const generated = path.join(expected, file);
+      const checkedIn = path.join(actual, file);
+      const name = file ? `${label}/${file}` : label;
+      if (!fs.existsSync(generated)) differences.push(`Unexpected: ${name}`);
+      else if (!fs.existsSync(checkedIn)) differences.push(`Missing: ${name}`);
+      else if (fs.statSync(generated).isDirectory() !== fs.statSync(checkedIn).isDirectory()) differences.push(`Changed type: ${name}`);
+      else if (!fs.readFileSync(generated).equals(fs.readFileSync(checkedIn))) differences.push(`Changed: ${name}`);
+    }
+  }
+  try {
+    const options = { pluginsDir: path.join(temporary, 'plugins'),
+      marketplacePath: path.join(temporary, 'marketplace.json') };
+    for (const [name, config] of Object.entries(PLUGIN_CONFIGS)) {
+      if (config.pluginType && config.pluginType !== 'claude') continue;
+      packagePlugin(name, config, options);
+      const generated = path.join(options.pluginsDir, name);
+      const actual = path.join(pluginsDir, name);
+      const label = `agentic/code/plugins/${name}`;
+      if (config.sourceRoot) {
+        // Entire manifest-backed addon is generated, except other providers'
+        // metadata retained by cleanPlugin().
+        const roots = new Set([...fs.readdirSync(generated), ...files(actual).map(file => file.split(path.sep)[0])]);
+        for (const root of [...roots].sort()) {
+          if ((root.endsWith('-plugin') && root !== '.claude-plugin') || root === 'clawhub.json') continue;
+          compare(path.join(generated, root), path.join(actual, root), `${label}/${root}`);
+        }
+      } else {
+        const roots = [...Object.keys(config.sources || {}),
+          ...(config.extraCopy || []).map(extra => extra.to), '.claude-plugin/plugin.json'];
+        if (config.readme) roots.push('README.md');
+        for (const root of roots) compare(path.join(generated, root), path.join(actual, root), `${label}/${root}`);
+      }
+    }
+    writeClaudeMarketplaceManifest(options);
+    compare(options.marketplacePath, marketplacePath, '.claude-plugin/marketplace.json');
+    return differences;
+  } finally {
+    fs.rmSync(temporary, { recursive: true, force: true });
+  }
+}
+
 // Main function
 async function main() {
   const options = parseArgs();
 
+  if (options.check) {
+    if (!options.all || options.plugin || options.provider || options.source || options.output || options.clean || options.dryRun || options.checkLinks) {
+      throw new Error('--check requires --all and cannot be combined with other packaging options');
+    }
+    const differences = checkPackagedPlugins();
+    if (differences.length) {
+      throw new Error(`Generated plugin copies are stale:\n${differences.join('\n')}\nRun npm run package-plugins and review the diff.`);
+    }
+    console.log('✓ All generated Claude plugin copies match canonical sources.');
+    return;
+  }
+
   if (!options.all && !options.plugin) {
     console.log('Please specify --all or --plugin NAME');
     console.log('Use --help for more information');
@@ -1123,7 +1276,7 @@ async function main() {
     console.log('   Mode: DRY RUN (no files will be changed)');
   }
 
-  if (options.plugin && !options.all) {
+  if (options.plugin && !options.all && !options.checkLinks) {
     const { packageStandalonePlugin } = await importImpl(import.meta.url, 'plugins/standalone-packager.js');
     const standalone = await packageStandalonePlugin({
       cwd: process.cwd(),
@@ -1175,6 +1328,15 @@ async function main() {
     process.exit(1);
   }
 
+  if (options.checkLinks) {
+    let count = 0;
+    for (const [name] of pluginsToPackage) {
+      count += reportPluginLinks(path.join(PLUGINS_DIR, name)).length;
+    }
+    if (count) process.exitCode = 1;
+    return;
+  }
+
   // Package for each (provider, plugin) combination
   for (const provider of providersToRun) {
     for (const [name, config] of pluginsToPackage) {
@@ -1192,6 +1354,22 @@ async function main() {
         // cursor, factory, openclaw — generic provider plugin bundle
         await packageProviderPlugin(name, config, options, effectiveProvider);
       }
+      if (!options.dryRun) {
+        const pluginDir = path.join(PLUGINS_DIR, name);
+        // Claude already copied extras; other providers need the same docs.
+        if (provider !== 'claude') {
+          for (const extra of config.extraCopy || []) {
+            const destination = path.join(pluginDir, extra.to);
+            fs.mkdirSync(path.dirname(destination), { recursive: true });
+            fs.cpSync(path.join(ROOT_DIR, extra.from), destination, { recursive: true });
+          }
+        }
+        if (provider !== 'claude') {
+          writeCanonicalScriptWrappers(pluginDir, config.scriptWrappers);
+          rewritePublishedLinks(pluginDir);
+        }
+        reportPluginLinks(pluginDir);
+      }
     }
 
     if (provider === 'claude') {
@@ -1215,7 +1393,7 @@ async function main() {
   console.log('  aiwg use sdlc --provider openclaw         # OpenClaw (ClawHub publish pending)');
 }
 
-main().catch((error) => {
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) main().catch((error) => {
   console.error(error instanceof Error ? error.message : String(error));
   process.exitCode = 1;
 });

package/tools/plugin/plugin-links.mjs

@@ -0,0 +1,114 @@
+/** Markdown payload-link inventory. No checkout existence can satisfy a plugin link. */
+import fs from 'node:fs';
+import path from 'node:path';
+
+// Mask code/comments without changing offsets, so diagnostics retain source lines.
+function prose(body) {
+  let fence;
+  return body.replace(/<!--[^]*?-->/g, text => text.replace(/[^\n]/g, ' '))
+    .split('\n').map(line => {
+      const marker = line.match(/^\s{0,3}(`{3,}|~{3,})/);
+      if (fence) {
+        if (marker && marker[1][0] === fence[0] && marker[1].length >= fence.length) fence = undefined;
+        return ' '.repeat(line.length);
+      }
+      if (marker) { fence = marker[1]; return ' '.repeat(line.length); }
+      return line.replace(/(`+)[^]*?\1/g, text => ' '.repeat(text.length));
+    }).join('\n');
+}
+
+export function markdownLinks(body) {
+  const content = prose(body);
+  // Inline links/images (including angle destinations and one nested pair of
+  // parentheses), plus reference definitions. Definitions are checked once.
+  const pattern = /!?\[[^\]]*\]\(\s*(?:<([^>\n]+)>|((?:[^\s()\\]|\\.|\([^()]*\))+))(?:\s+(?:"[^"\n]*"|'[^'\n]*'|\([^()\n]*\)))?\s*\)|^\s{0,3}\[[^\]\n]+\]:\s*(?:<([^>\n]+)>|(\S+))/gm;
+  return [...content.matchAll(pattern)].map(match => {
+    const target = match[1] ?? match[2] ?? match[3] ?? match[4];
+    return {
+      target,
+      start: match.index + match[0].indexOf(target, match[0].indexOf(']') + 2),
+      line: content.slice(0, match.index).split('\n').length,
+    };
+  });
+}
+
+function outside(root, target) {
+  const relative = path.relative(root, target);
+  return relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative);
+}
+
+/** Separate from generation/check mode so the copy-drift guard can reuse it. */
+export function checkPluginLinks(pluginDir) {
+  const root = fs.realpathSync(pluginDir);
+  const offenders = [];
+  function visit(dir) {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const file = path.join(dir, entry.name);
+      if (entry.isDirectory()) visit(file);
+      else if (entry.isFile() && /\.md$/i.test(entry.name)) {
+        for (const { target, line } of markdownLinks(fs.readFileSync(file, 'utf8'))) {
+          if (/^(?:[a-z][\w+.-]*:|\/\/|#)/i.test(target)) continue;
+          let destination;
+          try { destination = decodeURIComponent(target.split(/[?#]/)[0]).replace(/\\([ ()])/g, '$1'); }
+          catch { destination = target.split(/[?#]/)[0]; }
+          if (!destination) continue;
+          const resolved = path.resolve(path.dirname(file), destination);
+          const exists = fs.existsSync(resolved);
+          const reason = outside(root, resolved) || (exists && outside(root, fs.realpathSync(resolved)))
+            ? 'outside-payload' : !exists ? 'missing-target' : null;
+          if (reason) offenders.push({ file: path.relative(root, file).split(path.sep).join('/'), line, target, reason });
+        }
+      }
+    }
+  }
+  visit(root);
+  return offenders;
+}
+
+export function reportPluginLinks(pluginDir, log = console.warn) {
+  const offenders = checkPluginLinks(pluginDir);
+  for (const item of offenders) {
+    log(`${path.basename(pluginDir)}/${item.file}:${item.line}: ${item.reason}: ${item.target}`);
+  }
+  log(`${path.basename(pluginDir)}: ${offenders.length} unresolved relative Markdown link(s)`);
+  return offenders;
+}
+
+// Published cross-component docs are available independently of plugin installs.
+// These aliases also repair historical framework-relative paths in source skills.
+const PUBLISHED_LINKS = {
+  '../../../addons/aiwg-utils/rules/skill-discovery.md': 'agentic/code/addons/aiwg-utils/rules/skill-discovery.md',
+  '../../../addons/aiwg-utils/rules/sdlc-right-sizing.md': 'agentic/code/addons/aiwg-utils/rules/sdlc-right-sizing.md',
+  '../../../addons/dataset-intelligence/docs/migration-guide.md': 'agentic/code/addons/dataset-intelligence/docs/migration-guide.md',
+  '../../../dataset-intelligence/docs/migration-guide.md': 'agentic/code/addons/dataset-intelligence/docs/migration-guide.md',
+  '../dataset-intelligence/migration-guide.md': 'agentic/code/addons/dataset-intelligence/docs/migration-guide.md',
+  '../../getting-started/install-connect-verify.md': 'docs/getting-started/install-connect-verify.md',
+  '../../docs/daemon-guide.md': 'docs/daemon-guide.md',
+  '../../../../../../docs/verification-contracts.md': 'docs/verification-contracts.md',
+  '.claude/rules/dev-idempotent-builds.md': 'agentic/code/extensions/dev/rules/dev-idempotent-builds.md',
+  '../../sdlc-complete/rules/token-security.md': 'agentic/code/frameworks/sdlc-complete/rules/token-security.md',
+};
+
+/** Apply the packaging rewrite to prose only; scripts and code examples retain their paths. */
+export function rewritePublishedMarkdown(body, file, payloadRoot, repoRoot = path.resolve(import.meta.dirname, '../..')) {
+  let rewritten = body;
+  for (const link of markdownLinks(body).reverse()) {
+    let published = PUBLISHED_LINKS[link.target];
+    // Root docs appear at different depths in skills and copied docs.
+    // Never let a path into this checkout satisfy an installed plugin.
+    if (!published && /^(?:\.\.\/)+docs\//.test(link.target)) {
+      const document = link.target.replace(/^(?:\.\.\/)+/, '');
+      const local = path.resolve(path.dirname(file), link.target.split(/[?#]/)[0]);
+      const outside = path.relative(payloadRoot, local).startsWith(`..${path.sep}`);
+      if ((outside || !fs.existsSync(local))
+          && fs.existsSync(path.join(repoRoot, document.split(/[?#]/)[0]))) published = document;
+    }
+    if (!published) continue;
+    if (!fs.existsSync(path.join(repoRoot, published.split(/[?#]/)[0]))) {
+      throw new Error(`Published link source not found: ${published}`);
+    }
+    const url = `https://github.com/jmagly/aiwg/blob/main/${published}`;
+    rewritten = rewritten.slice(0, link.start) + url + rewritten.slice(link.start + link.target.length);
+  }
+  return rewritten;
+}

package/tools/providers/antigravity-transport.mjs

@@ -1,4 +1,6 @@
+import { importImpl } from '../_resolve-impl.mjs';
 import { spawn } from 'node:child_process';
+const { signalChild } = await importImpl(import.meta.url, 'process/signal-child.mjs');
 
 export const ANTIGRAVITY_CONTRACT_VERSION = '1.0.0';
 export const ANTIGRAVITY_QUALIFIED_CLI_VERSION = '1.1.26';
@@ -92,7 +94,7 @@ export function runAntigravity(prompt, options = {}) {
     let settled = false;
     const timer = setTimeout(() => {
       settled = true;
-      child.kill('SIGTERM');
+      signalChild(child, 'SIGTERM');
       reject(new Error(`Antigravity invocation timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     child.stdout.on('data', chunk => { stdout += chunk; });

package/tools/providers/deepseek-harness-transport.mjs

@@ -1,8 +1,10 @@
+import { importImpl } from '../_resolve-impl.mjs';
 import { createHash } from 'node:crypto';
 import { mkdtemp, readFile, rm, writeFile, chmod } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { spawn } from 'node:child_process';
+const { signalChild } = await importImpl(import.meta.url, 'process/signal-child.mjs');
 
 export const DSH_SUPPORTED_VERSIONS = Object.freeze(['0.1.1-rc.2', '0.1.2-rc.1', '0.1.3-alpha.1']);
 export const DSH_MAX_FRAME_BYTES = 1024 * 1024;
@@ -240,9 +242,9 @@ export class DshJsonRpcClient {
   shutdown() { return this.request('shutdown', {}); }
   abort(error = new Error('DeepSeek Harness JSON-RPC client closed')) {
     if (this.child && !this.child.killed) {
-      this.child.kill('SIGTERM');
+      signalChild(this.child, 'SIGTERM');
       const child = this.child;
-      const escalation = setTimeout(() => { if (child.exitCode === null) child.kill('SIGKILL'); }, 1_000);
+      const escalation = setTimeout(() => { if (child.exitCode === null) signalChild(child, 'SIGKILL'); }, 1_000);
       child.once('exit', () => clearTimeout(escalation));
     }
     this.rejectAll(error);
@@ -327,10 +329,10 @@ function runBounded(binary, args, { cwd, env, timeoutMs, terminateGraceMs = 1_00
         finish(error);
         return;
       }
-      child.kill('SIGTERM');
+      signalChild(child, 'SIGTERM');
       if (settled) return;
       escalation = setTimeout(() => {
-        if (child.exitCode === null && child.signalCode === null) child.kill('SIGKILL');
+        if (child.exitCode === null && child.signalCode === null) signalChild(child, 'SIGKILL');
       }, terminateGraceMs);
     };
     const cancel = () => terminate(new Error('DeepSeek Harness run cancelled'));

package/tools/providers/omp-transport.mjs

@@ -1,11 +1,13 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { readFile } from 'node:fs/promises';
 import { importImpl } from '../_resolve-impl.mjs';
+const { signalChild } = await importImpl(import.meta.url, 'process/signal-child.mjs');
 
 const { positiveTimeoutMs } = await importImpl(import.meta.url, 'process/bounded-child-process.mjs');
 
 /** Preserve process identity and state: zombies still fail the cleanup gate. */
 export async function inspectOmpProcess({ pid, startTime }) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return { pid, present: false };
   try {
     const stat = await readFile(`/proc/${pid}/stat`, 'utf8');
     const fields = stat.slice(stat.lastIndexOf(')') + 2).trim().split(/\s+/);
@@ -145,7 +147,7 @@ export class OmpRpcClient {
     } catch (error) { await this.close(); throw error; } finally { this.running = false; }
   }
   fail(error) { if (this.failure) return; this.failure = error; clearTimeout(this.readyTimer); this.readyReject(error); this.promptReject?.(error); for (const p of this.pending.values()) { clearTimeout(p.timer); p.reject(error); } this.pending.clear(); if (!this.isClosed) this.kill('SIGKILL'); }
-  kill(signal) { try { if (process.platform !== 'win32' && this.child.pid) process.kill(-this.child.pid, signal); else this.child.kill(signal); } catch { /* already exited */ } }
+  kill(signal) { try { if (process.platform !== 'win32' && Number.isSafeInteger(this.child.pid) && this.child.pid > 0) process.kill(-this.child.pid, signal); else signalChild(this.child, signal); } catch { /* already exited */ } }
   async close() {
     if (this.isClosed) return this.closed;
     if (this.closing) return this.closing;
@@ -181,7 +183,7 @@ export async function warmAndConnectOmpRpcClient({ binary, cwd, env, warmArgs =
   const warmStarted = Date.now();
   // warmTimeoutMs is caller-controlled; clamp it so a caller passing 0 (or
   // anything else non-positive) can't disable the bound (#3062 B/C finding 8).
-  const warmup = spawnSync(binary, warmArgs, { cwd, env, encoding: 'utf8', timeout: positiveTimeoutMs(warmTimeoutMs, 15000) });
+  const warmup = spawnSync(binary, warmArgs, { cwd, env, encoding: 'utf8', timeout: positiveTimeoutMs(warmTimeoutMs, 15000), killSignal: 'SIGKILL' });
   const warmedMs = Date.now() - warmStarted;
   const warmupResult = { status: warmup.status ?? null, signal: warmup.signal ?? null, error: warmup.error ? String(warmup.error.message ?? warmup.error) : null };
   const readyStarted = Date.now();