@basein/runner 0.3.25 → 0.3.26

package/dist/replay/builtins.js

@@ -46,12 +46,17 @@
  * best effort and may drift from a future host's, the same caveat the
  * hook-view threading fallback already carries ("shapes may differ").
  */
-import { execFile } from "node:child_process";
-import { randomBytes } from "node:crypto";
+import { spawn, } from "node:child_process";
+import { randomBytes, randomUUID } from "node:crypto";
 import { existsSync } from "node:fs";
-import { readdir, readFile, realpath, stat, writeFile } from "node:fs/promises";
+import { mkdir, readdir, readFile, realpath, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { Worker } from "node:worker_threads";
+import { ensureDir } from "../control/paths.js";
+import { killTree } from "../upstream/stdio-client.js";
+import { deliveryDir } from "./bash-channel.js";
 // ── configuration ────────────────────────────────────────────────────────────
 /** The built-ins {@link runBuiltin} actually implements. */
 export const EXECUTABLE_BUILTINS = new Set([
@@ -348,12 +353,28 @@ async function runGlob(input, ctx, deadline) {
     const root = await allowedPath(ctx, typeof input.path === "string" ? input.path : ".", "path");
     const startedAt = Date.now();
     const re = globToRegExp(pattern);
-    const found = [];
-    const truncated = await walk(root, deadline, (rel, abs, mtime) => {
+    const matched = [];
+    const truncated = await walk(root, deadline, (rel, abs) => {
         if (re.test(rel))
-            found.push({ path: abs, mtime });
+            matched.push(abs);
         return true;
     });
+    // The time is asked of the files that matched, after the walk, and not of
+    // every file the walk passes: on a tree of 9,576 files that stat was most of
+    // what a Glob took. A file gone since the walk is left out, as a file the
+    // walk could not stat always was.
+    const found = [];
+    for (const path of matched) {
+        if (deadline !== undefined && Date.now() > deadline) {
+            throw new BuiltinTimeout(`Glob ran out of time after ${matched.length} matching files`);
+        }
+        try {
+            found.push({ path, mtime: (await stat(path)).mtimeMs });
+        }
+        catch {
+            continue;
+        }
+    }
     found.sort((a, b) => b.mtime - a.mtime);
     const filenames = found.slice(0, MAX_GLOB_RESULTS).map((f) => f.path);
     return {
@@ -406,26 +427,17 @@ async function runGrep(input, ctx, deadline) {
     const st = await stat(target).catch(() => undefined);
     let truncated = false;
     if (st?.isFile()) {
-        files.push({ path: target, mtime: st.mtimeMs });
+        files.push(target);
     }
     else {
-        truncated = await walk(target, deadline, (rel, abs, mtime) => {
+        truncated = await walk(target, deadline, (rel, abs) => {
             if (!globRe || globRe.test(rel))
-                files.push({ path: abs, mtime });
+                files.push(abs);
             return files.length < MAX_GREP_FILES;
         });
     }
-    const mtimes = new Map(files.map((f) => [f.path, f.mtime]));
-    const matches = [];
-    for (const f of files) {
-        if (deadline !== undefined && Date.now() > deadline) {
-            throw new BuiltinTimeout(`Grep ran out of time after ${files.length} candidate files`);
-        }
-        const lines = await matchFile(f.path, re, mode === "files_with_matches");
-        if (lines)
-            matches.push({ path: f.path, lines });
-    }
-    matches.sort((a, b) => (mtimes.get(b.path) ?? 0) - (mtimes.get(a.path) ?? 0));
+    const matches = await matchFiles(files, re, mode === "files_with_matches", deadline);
+    matches.sort((a, b) => b.mtime - a.mtime);
     if (mode === "count") {
         const shown = matches.slice(0, headLimit);
         return {
@@ -458,31 +470,100 @@ async function runGrep(input, ctx, deadline) {
         truncated: truncated || matches.length > filenames.length,
     };
 }
-/** The matching lines of one file, or undefined when none (or not text). */
-async function matchFile(path, re, firstOnly) {
-    let buf;
+/**
+ * The matching of a Grep, run in a thread of its own. The recorded pattern
+ * runs on JavaScript's backtracking engine, and `(a+)+$` over one line of 26
+ * letters and a `b` takes a second or two, twice that for every letter more:
+ * a call that no clock checked between files can interrupt. Run on the thread
+ * that answers every hook of the user's agent it held them all, and the step's
+ * time limit never came into it. In a worker the limit ends the call and the
+ * thread with it ({@link matchFiles}).
+ *
+ * Source text, not a file of its own: a worker started from a path has to find
+ * that file again from wherever this module is installed, and from `dist/`
+ * that is the path that goes wrong. The worker reads the files itself, so only
+ * their names cross over, and its one `stat` gives both the size to refuse and
+ * the time to sort by.
+ */
+const GREP_WORKER = String.raw `
+const { parentPort, workerData } = require("node:worker_threads");
+const { readFileSync, statSync } = require("node:fs");
+const { source, flags, files, firstOnly, maxBytes, maxLine } = workerData;
+const re = new RegExp(source, flags);
+const hits = [];
+for (const path of files) {
+  let st;
+  let buf;
+  try {
+    st = statSync(path);
+    if (!st.isFile() || st.size > maxBytes) continue;
+    buf = readFileSync(path);
+  } catch {
+    continue; // unreadable is not a match
+  }
+  // A NUL near the start is the classic binary sniff, same as grep's own.
+  if (buf.subarray(0, 4096).includes(0)) continue;
+  const lines = buf.toString("utf8").split(/\r?\n/);
+  const found = [];
+  for (let i = 0; i < lines.length; i += 1) {
+    if (re.test(lines[i])) {
+      found.push({ n: i + 1, text: lines[i].slice(0, maxLine) });
+      if (firstOnly) break;
+    }
+  }
+  if (found.length > 0) hits.push({ path, mtime: st.mtimeMs, lines: found });
+}
+parentPort.postMessage(hits);
+`;
+/**
+ * Match `re` against `files` in {@link GREP_WORKER}, within the step's clock.
+ * Out of time the answer is the time-out error at that moment, whatever the
+ * thread is doing, and the thread is told to stop: a pattern that explodes
+ * ends there instead of holding the process.
+ */
+async function matchFiles(files, re, firstOnly, deadline) {
+    if (files.length === 0)
+        return [];
+    const left = deadline === undefined ? undefined : deadline - Date.now();
+    const outOfTime = () => new BuiltinTimeout(`Grep ran out of time after ${files.length} candidate files`);
+    if (left !== undefined && left <= 0)
+        throw outOfTime();
+    let worker;
     try {
-        const st = await stat(path);
-        if (!st.isFile() || st.size > MAX_GREP_FILE_BYTES)
-            return undefined;
-        buf = await readFile(path);
-    }
-    catch {
-        return undefined; // unreadable is not a match
-    }
-    // A NUL near the start is the classic binary sniff, same as grep's own.
-    if (buf.subarray(0, 4096).includes(0))
-        return undefined;
-    const lines = buf.toString("utf8").split(/\r?\n/);
-    const out = [];
-    for (let i = 0; i < lines.length; i += 1) {
-        if (re.test(lines[i])) {
-            out.push({ n: i + 1, text: lines[i].slice(0, MAX_LINE_CHARS) });
-            if (firstOnly)
-                return out;
-        }
+        worker = new Worker(GREP_WORKER, {
+            eval: true,
+            workerData: {
+                source: re.source,
+                flags: re.flags,
+                files,
+                firstOnly,
+                maxBytes: MAX_GREP_FILE_BYTES,
+                maxLine: MAX_LINE_CHARS,
+            },
+        });
+    }
+    catch (err) {
+        // Nothing has run, so the session can still do the search.
+        throw new BuiltinNotRunnable(`a thread for the search could not be started (${err.message}), so the session runs it`);
+    }
+    let clock;
+    try {
+        return await new Promise((resolvePromise, rejectPromise) => {
+            if (left !== undefined)
+                clock = setTimeout(() => rejectPromise(outOfTime()), left);
+            // The first of these to happen is the answer; the rest are no-ops. The
+            // worker's messages reach this side before its exit does.
+            worker.on("message", resolvePromise);
+            worker.on("error", rejectPromise);
+            worker.on("exit", () => rejectPromise(new Error("the search ended without an answer")));
+        });
+    }
+    finally {
+        clearTimeout(clock);
+        // Not awaited: the answer never waits for a thread that is stuck in a
+        // pattern or in a read.
+        worker.terminate().catch(() => undefined);
     }
-    return out.length > 0 ? out : undefined;
 }
 // ── Edit / Write ─────────────────────────────────────────────────────────────
 async function runEdit(input, ctx) {
@@ -500,16 +581,40 @@ async function runEdit(input, ctx) {
         throw new Error(`file is ${size} bytes, more than the ${MAX_FILE_BYTES} this runner edits`);
     }
     const current = await readFile(filePath, "utf8");
-    const occurrences = current.split(oldString).length - 1;
+    // The model writes its strings with LF whatever the file has, and the host's
+    // Edit finds them in a CRLF file all the same and writes CRLF back. So a
+    // CRLF file is edited on LF copies — of its text and of both strings — and
+    // every line gets its CRLF again. Matched as it lay on disk, a two-line
+    // `old_string` was never found in such a file, and a two-line `new_string`
+    // left LF lines in it. A file with both endings is edited as it lies on disk
+    // while neither string holds a line break, since no ending is written then,
+    // and left to the session when one does: there is no one ending to write
+    // back, and choosing one would change lines the edit never named. Refused
+    // whole, every file an earlier runner left mixed handed over on each replay,
+    // one-line edits included.
+    const crlf = current.split("\r\n").length - 1;
+    const lf = current.split("\n").length - 1 - crlf;
+    const mixed = crlf > 0 && lf > 0;
+    if (mixed && /[\r\n]/.test(oldString + newString)) {
+        throw new BuiltinNotRunnable("the file mixes CRLF and LF line endings and the edit spans lines, so the session edits it");
+    }
+    const onLf = crlf > 0 && !mixed;
+    const asLf = (s) => (onLf ? s.replace(/\r\n/g, "\n") : s);
+    const text = asLf(current);
+    const find = asLf(oldString);
+    const put = asLf(newString);
+    const occurrences = text.split(find).length - 1;
     if (occurrences === 0)
         throw new Error(`old_string was not found in ${filePath}`);
     if (!replaceAll && occurrences > 1) {
         throw new Error(`old_string appears ${occurrences} times in ${filePath}; it must be unique`);
     }
-    const next = replaceAll
-        ? current.split(oldString).join(newString)
-        : current.replace(oldString, newString);
-    await writeFile(filePath, next, "utf8");
+    // A function, never the string itself: `replace` reads `$$`, `$&`, `` $` ``
+    // and `$'` in a replacement string as commands, so `const re = '^[a-z]+$';`
+    // was written with the rest of the file pasted in where `$'` stood, and the
+    // step reported success.
+    const edited = replaceAll ? text.split(find).join(put) : text.replace(find, () => put);
+    await writeFile(filePath, onLf ? edited.replace(/\n/g, "\r\n") : edited, "utf8");
     return {
         filePath,
         oldString,
@@ -526,9 +631,21 @@ async function runWrite(input, ctx) {
     if (typeof content !== "string")
         throw new BuiltinNotRunnable("content is required");
     const existed = await stat(filePath).then((s) => s.isFile(), () => false);
-    // No mkdir: the host's Write does not invent directories, so neither does
-    // the stand-in — a missing parent is a divergence, not a wish.
-    await writeFile(filePath, content, "utf8");
+    // The host's Write makes the folders a new file needs, so the stand-in does
+    // too: a plan whose path holds a value (reports/2026-11/close.md) failed on
+    // every new value without them. Only when the write finds them missing — a
+    // folder that is there is never touched — and only where the file itself may
+    // go: `allowedPath` judged the whole path above by its real, existing
+    // folder, and every folder made here lies between that one and the file.
+    try {
+        await writeFile(filePath, content, "utf8");
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            throw err;
+        await mkdir(dirname(filePath), { recursive: true });
+        await writeFile(filePath, content, "utf8");
+    }
     return {
         type: existed ? "update" : "create",
         filePath,
@@ -588,44 +705,297 @@ async function runBash(input, ctx) {
     // `pwd -W` is Git Bash's Windows-path form; elsewhere it fails quietly and
     // plain `pwd` answers. An explicit `exit` skips the marker, and the
     // previous directory simply stands.
+    //
+    // A blank line after the command: one whose last line ends in `\` ran on
+    // into the wrapper's first line, and `echo hi \` printed `hi __bir_rc=0` and
+    // failed on an `exit` with no number.
     const mark = `__BIR_PWD_${randomBytes(8).toString("hex")}__`;
-    const script = `${command}\n__bir_rc=$?\nprintf '\\n%s%s%s' '${mark}' "$(pwd -W 2>/dev/null || pwd)" '${mark}' 1>&2\nexit "$__bir_rc"`;
+    const script = `${command}\n\n__bir_rc=$?\nprintf '\\n%s%s%s' '${mark}' "$(pwd -W 2>/dev/null || pwd)" '${mark}' 1>&2\nexit "$__bir_rc"`;
+    const file = await scriptFile(script);
+    const unread = `__BIR_UNREAD_${randomBytes(8).toString("hex")}__`;
+    let ran;
+    try {
+        ran = await runShell(readsScript(file, unread), startIn, timeoutMs);
+    }
+    finally {
+        // Whatever became of the command. A file a crash leaves behind goes with
+        // bash-channel.ts's sweep, within the hour.
+        await rm(file, { force: true }).catch(() => undefined);
+    }
+    if (ran.code === 126 && ran.stderr.includes(unread)) {
+        // bash never had the command: it could not read the file it was handed in
+        // (a `bash.exe` that is WSL's sees no C:/ path). Nothing of it ran, so the
+        // session can still run it, where a 126 counted as a failed run.
+        const why = ran.stderr.split(unread).join("").trim().slice(0, 300);
+        throw new BuiltinNotRunnable(`bash could not read the command from its file${why ? ` (${why})` : ""}, so the session runs it`);
+    }
+    const cleaned = takePwdMarker(ran.stderr, mark);
+    if (cleaned.pwd)
+        ctx.onBashCwd?.(cleaned.pwd);
+    if (ran.signal) {
+        // Not the clock's doing (that is `runShell`'s own error): something else
+        // ended the shell, and nobody knows how far the command had got.
+        throw new BuiltinTimeout(`the command's shell was ended by ${ran.signal} and the command may have done part of its work`);
+    }
+    if (ran.code !== 0) {
+        const detail = String(cleaned.text || ran.stdout || "").trim().slice(0, 500);
+        throw new Error(`the command exited with code ${ran.code ?? 1}${detail ? `: ${detail}` : ""}`);
+    }
+    return {
+        stdout: ran.stdout,
+        stderr: cleaned.text,
+        interrupted: false,
+        isImage: false,
+    };
+}
+/**
+ * Put the script in a private file for bash to read ({@link readsScript}),
+ * because a command line cannot be trusted to carry it. Through Git Bash on
+ * Windows only the first 8,186 characters of a `-c` argument ran, and the step
+ * still resolved as a success: a 9,072-byte heredoc was written cut mid-line
+ * and the `echo` after it never ran. Just under that length the command ran
+ * whole and was reported failed, because what was cut were the wrapper's own
+ * last lines; at 40,000 characters nothing started at all (ENAMETOOLONG), and
+ * that was reported as a failed run too.
+ *
+ * The file lives where the runner keeps the texts it hands to a shell
+ * (bash-channel.ts, under `BIR_HOME`, mode 0700) and is named as those are, so
+ * that module's sweep also removes one a crash left behind. Its path is
+ * absolute: bash starts in the step's folder, not in this process's, and a
+ * relative `BIR_HOME` named a file there that did not exist.
+ */
+async function scriptFile(script) {
+    // bash drops a NUL from what it reads and runs the rest: another command
+    // than the one recorded. No command line could carry one either.
+    if (script.includes("\u0000")) {
+        throw new BuiltinNotRunnable("the command holds a NUL character, so the session runs it");
+    }
+    const dir = resolve(deliveryDir());
+    ensureDir(dir);
+    const file = join(dir, `replay-bash-${randomUUID()}.txt`);
+    try {
+        await writeFile(file, script, { encoding: "utf8", mode: 0o600, flag: "wx" });
+    }
+    catch (err) {
+        throw new BuiltinNotRunnable(`the command could not be handed to bash (${err.message}), so the session runs it`);
+    }
+    return file;
+}
+/**
+ * The one short line bash is started with: read the script's file and `eval`
+ * it — as the host evals the command it is given. Run that way `$0`, the line
+ * numbers and the shell's own error text stay what they were when the script
+ * was the `-c` argument (`/usr/bin/bash: line 3: jq: command not found`); run
+ * as `bash <file>` every one of them would carry this file's name instead. A
+ * file that cannot be read is exit 126: evaluated without the check it is an
+ * empty script, which succeeds. And `unread`, a marker unique to the call, goes
+ * to stderr first: a command's own 126 (a file that is not executable) is a
+ * command that ran, and only the marker tells the two apart ({@link runBash}).
+ *
+ * Exported for the tests.
+ */
+export function readsScript(file, unread) {
+    // Forward slashes on Windows, which Git Bash reads as they are.
+    const path = process.platform === "win32" ? file.replace(/\\/g, "/") : file;
+    const quoted = `'${path.replace(/'/g, `'\\''`)}'`;
+    return `__bir_s=$(<${quoted}) || { printf '%s' '${unread}' 1>&2; exit 126; }; eval -- "$__bir_s"`;
+}
+/** After the shell has exited, how long its pipes may stay open before the step stops listening. */
+const BASH_PIPE_GRACE_MS = 100;
+/** How long the processes of a command that is cut off get to end by themselves. */
+const BASH_TERM_GRACE_MS = 300;
+/**
+ * The longest the step waits for a command it cut off to be gone. Ending it is
+ * bounded already ({@link killTree}), but the step's answer must not rest on
+ * that: a step that never reports its time-out is worse than one that reports
+ * it while a process is still dying.
+ */
+const BASH_KILL_WAIT_MS = 5_000;
+/** The longest a Node timer waits; asked for more, it fires at once. */
+const MAX_TIMER_MS = 2 ** 31 - 1;
+/**
+ * Start `bash -lc <line>` in `cwd` and collect what it writes, under the
+ * step's own clock. Resolves when the shell has ended by itself, whatever its
+ * exit code. Rejects {@link BuiltinNotRunnable} when it never started, and
+ * {@link BuiltinTimeout} when it was cut off: at its clock, or at the most
+ * output the runner takes.
+ */
+function runShell(line, cwd, timeoutMs) {
     return new Promise((resolvePromise, rejectPromise) => {
-        execFile(bashExecutable(), ["-lc", script], {
-            cwd: startIn,
-            timeout: timeoutMs,
-            maxBuffer: MAX_BASH_BUFFER,
-            windowsHide: true,
-        }, (err, stdout, stderr) => {
-            const cleaned = takePwdMarker(String(stderr ?? ""), mark);
-            if (cleaned.pwd)
-                ctx.onBashCwd?.(cleaned.pwd);
-            if (err) {
-                const e = err;
-                if (e.code === "ENOENT") {
-                    // No bash on this machine (a Windows runner without Git Bash):
-                    // the step is the session's, exactly as before.
-                    rejectPromise(new BuiltinNotRunnable("no `bash` on the runner's PATH"));
-                    return;
-                }
-                if (e.killed || e.signal === "SIGTERM") {
-                    rejectPromise(new BuiltinTimeout(`the command was stopped after ${timeoutMs}ms and may have done part of its work`));
-                    return;
-                }
-                const code = typeof e.code === "number" ? e.code : 1;
-                const detail = String(cleaned.text || stdout || "").trim().slice(0, 500);
-                rejectPromise(new Error(`the command exited with code ${code}${detail ? `: ${detail}` : ""}`));
+        // Nothing ran, so the session can still run it. A missing bash (a Windows
+        // runner without Git Bash) says so in the words it always had.
+        const notStarted = (err) => err?.code === "ENOENT"
+            ? new BuiltinNotRunnable("no `bash` on the runner's PATH")
+            : new BuiltinNotRunnable(`bash could not be started (${err?.message ?? String(err)}), so the session runs the command`);
+        let child;
+        try {
+            child = spawn(bashExecutable(), ["-lc", line], {
+                cwd,
+                // An empty input, as the host gives its own commands. Left open, a
+                // command that reads it (`cat`) held the step for its whole clock.
+                stdio: ["ignore", "pipe", "pipe"],
+                windowsHide: true,
+                // The leader of its own process group where there are such things, so
+                // one signal reaches everything the command started ({@link endCommand}).
+                detached: process.platform !== "win32",
+            });
+        }
+        catch (err) {
+            rejectPromise(notStarted(err));
+            return;
+        }
+        let stdout = "";
+        let stderr = "";
+        let stdoutBytes = 0;
+        let stderrBytes = 0;
+        let started = false;
+        let exited;
+        let cutOff = false;
+        let settled = false;
+        let grace;
+        const settle = (act) => {
+            if (settled)
                 return;
-            }
-            resolvePromise({
-                stdout: String(stdout ?? ""),
-                stderr: cleaned.text,
-                interrupted: false,
-                isImage: false,
+            settled = true;
+            clearTimeout(clock);
+            clearTimeout(grace);
+            act();
+        };
+        // The step's own timer and its own cap, not `execFile`'s: those end one
+        // process — on Windows, Git's launcher — and the command went on behind a
+        // step already reported as stopped. `(sleep 3; echo late > f)` on a
+        // one-second clock still wrote `f`; and past the cap the next command of
+        // the line ran too, under an error that said "exited with code 1".
+        const cutOffBecause = (why) => {
+            if (settled || cutOff)
+                return;
+            cutOff = true;
+            clearTimeout(clock);
+            clearTimeout(grace);
+            // Stop reading, and keep the pipes open until the command is gone. Read
+            // on, a writer finishes and the line's next command starts; closed, the
+            // writer dies of it and the next command starts just the same.
+            child.stdout.pause();
+            child.stderr.pause();
+            void Promise.race([
+                endCommand(child).catch(() => undefined),
+                delay(BASH_KILL_WAIT_MS, undefined, { ref: false }),
+            ]).then(() => {
+                child.stdout.destroy();
+                child.stderr.destroy();
+                settle(() => rejectPromise(new BuiltinTimeout(`${why}; it may have done part of its work, and a program it started may still be running`)));
             });
+        };
+        const clock = setTimeout(() => cutOffBecause(`the command was cut off at its limit of ${timeoutMs}ms`), Math.min(timeoutMs, MAX_TIMER_MS));
+        // The shell has ended and its output is in: the step's answer.
+        const finish = () => {
+            if (!exited || cutOff)
+                return;
+            const { code, signal } = exited;
+            settle(() => {
+                letGo(child.stdout);
+                letGo(child.stderr);
+                resolvePromise({ code, signal, stdout, stderr });
+            });
+        };
+        const tooMuch = () => cutOffBecause(`the command was cut off after writing more than ${MAX_BASH_BUFFER / (1024 * 1024)} MiB of output`);
+        child.stdout.setEncoding("utf8");
+        child.stderr.setEncoding("utf8");
+        // A pipe broken by a forced end is not news: the shell's own exit, or the
+        // clock, is the answer, and an 'error' nobody listens to would end this
+        // process instead.
+        child.stdout.on("error", () => undefined);
+        child.stderr.on("error", () => undefined);
+        child.stdout.on("data", (chunk) => {
+            stdoutBytes += Buffer.byteLength(chunk);
+            if (stdoutBytes > MAX_BASH_BUFFER)
+                tooMuch();
+            else
+                stdout += chunk;
+        });
+        child.stderr.on("data", (chunk) => {
+            stderrBytes += Buffer.byteLength(chunk);
+            if (stderrBytes > MAX_BASH_BUFFER)
+                tooMuch();
+            else
+                stderr += chunk;
+        });
+        child.once("spawn", () => {
+            started = true;
         });
+        child.on("error", (err) => {
+            // Once the shell runs, an error here is a signal that could not be
+            // sent: the shell's exit, or the clock, still ends the step.
+            if (!started)
+                settle(() => rejectPromise(notStarted(err)));
+        });
+        // The step ends when the shell does, not when its pipes close: a job the
+        // command left behind (`sleep 6 &`) holds them open, and the step waited
+        // out its whole clock for it where the host answers at once. What the
+        // shell itself wrote is already in the pipes, and is read before the
+        // answer: the pipes close first, or the grace and one more turn of the
+        // loop pass.
+        child.once("exit", (code, signal) => {
+            exited = { code, signal };
+            if (cutOff)
+                return;
+            clearTimeout(clock);
+            grace = setTimeout(() => setImmediate(finish), BASH_PIPE_GRACE_MS);
+        });
+        child.once("close", finish);
     });
 }
+/**
+ * Stop listening to a pipe the shell's own exit left open, without closing
+ * it: a job the command left running still writes there, and would be ended by
+ * its first write to a closed pipe — under the host it runs on. What it writes
+ * is read and dropped, and the pipe no longer keeps this process alive.
+ */
+function letGo(pipe) {
+    if (pipe.destroyed)
+        return;
+    pipe.removeAllListeners("data");
+    pipe.resume();
+    pipe.unref?.();
+}
+/**
+ * End a command that is still running, with what it started. Away from
+ * Windows the shell leads its own process group, so the group is told to end
+ * and, after {@link BASH_TERM_GRACE_MS}, made to; {@link killTree} then sees
+ * to the shell itself, and on Windows does the whole job (`taskkill /T`).
+ *
+ * Not everything is reached. On Windows a program Git Bash started by `exec`
+ * (`sleep`, `ssh`, `find`: its own tools) is no child of the shell as Windows
+ * sees it, and runs on; anywhere, a program that left the group does. So the
+ * error says the command may still be running in part, never that it stopped.
+ */
+async function endCommand(child) {
+    // A shell that has ended has no tree to find by its id, and the id may be
+    // another program's by now.
+    if (child.exitCode !== null || child.signalCode !== null)
+        return;
+    const pid = child.pid;
+    if (process.platform !== "win32" && pid !== undefined) {
+        const signalGroup = (signal) => {
+            try {
+                process.kill(-pid, signal);
+                return true;
+            }
+            catch {
+                return false; // no such group any more, or none of it ours to signal
+            }
+        };
+        if (signalGroup("SIGTERM")) {
+            const until = Date.now() + BASH_TERM_GRACE_MS;
+            while (signalGroup(0) && Date.now() < until)
+                await delay(20);
+            signalGroup("SIGKILL");
+        }
+    }
+    // `killTree` reads only the id, the exit state and `kill`; its type names a
+    // child whose stdin is a pipe, which this one (an empty input) is not.
+    await killTree(child);
+}
 /**
  * Split the shell's final `$PWD` out of stderr again: the marked chunk (and
  * the newline the wrapper added before it) is removed, whatever else the
@@ -647,11 +1017,13 @@ function takePwdMarker(stderr, mark) {
 /** Directories no scenario's step means to scan. */
 const SKIP_DIRS = new Set([".git", "node_modules", ".hg", ".svn"]);
 /**
- * Walk `root`, calling `visit(relativePath, absolutePath, mtimeMs)` for every
- * regular file. Never follows directory symlinks — the folder was checked at
- * the root, and under a `BIR_PATH_ALLOW` list a link out of it must not
- * re-open the door (nor may a link loop the walk). Returns whether the walk
- * was cut short (entry cap, deadline, or `visit` saying stop).
+ * Walk `root`, calling `visit(relativePath, absolutePath)` for every regular
+ * file. Never follows directory symlinks — the folder was checked at the
+ * root, and under a `BIR_PATH_ALLOW` list a link out of it must not re-open
+ * the door (nor may a link loop the walk). Returns whether the walk was cut
+ * short (entry cap, deadline, or `visit` saying stop). It asks the disk
+ * nothing about a file but its name: Glob wants a time for the files that
+ * matched, Grep one for the files it opens, and neither wants it for the rest.
  */
 async function walk(root, deadline, visit) {
     let seen = 0;
@@ -680,17 +1052,10 @@ async function walk(root, deadline, visit) {
             }
             if (!entry.isFile())
                 continue; // symlinks and specials stay unfollowed
-            let mtime = 0;
-            try {
-                mtime = (await stat(abs)).mtimeMs;
-            }
-            catch {
-                continue;
-            }
             // `relative`, not a slice: a walk may now start at a drive's or the
             // disk's root (`C:\`, `/`), which already ends in a separator.
             const rel = relative(root, abs).split(sep).join("/");
-            if (!visit(rel, abs, mtime))
+            if (!visit(rel, abs))
                 return true;
         }
     }