@brutalsystems/muster 0.7.11 → 0.7.12

package/README.md

@@ -289,10 +289,22 @@ reader who does not know why they are there:
   session that ended while Muster was not running is reported as ended rather
   than as running.
 
-Process-tree membership is derived from the parent chain, which has a known
-limit: a child reparented after its own parent exits leaves the chain and cannot
-be recovered from it. Tracking that needs a membership signal the chain does not
-carry.
+Process-tree membership uses two signals, because neither is sufficient alone.
+The parent chain is exact while it holds, and stops holding the moment an
+intermediate process exits — its children reparent to launchd and are no longer
+reachable from the root, though they are still doing the session's work. The
+process group survives that, since reparenting changes no process's group.
+
+Muster records the group the launched root leads and takes the union. A stop
+reaches reparented workers, and a session whose root has died but whose group is
+still busy is reported as running rather than ended.
+
+Only a group the root *leads* is used. A process that merely belongs to someone
+else's group shares it with whatever else is there — a shell, a tmux pane, the
+terminal — and treating that as membership would reach far outside the session.
+Both terminal hosts start their root in a new session, so in practice it does
+lead its own group. A process that calls `setsid()` for itself still escapes;
+nothing on macOS prevents that.
 
 ## Configuration and permissions
 

package/dist/identity/processes.js

@@ -16,8 +16,8 @@
  *    on every transaction, so a process that died while Muster was not running
  *    is reported as dead rather than trusted from what was recorded.
  *
- * Membership is derived from the parent chain and inherits its one real limit:
- * a reparented child is unreachable from the root. See issue #24.
+ * Membership is the union of the parent chain and the process group the root
+ * leads, because a reparented child leaves the chain but keeps its group.
  */
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
@@ -41,8 +41,41 @@ export async function processRef(pid) {
 export async function isSame(ref) {
     return (await processRef(ref.pid))?.start === ref.start;
 }
-export async function descendants(root, deadline = Date.now() + 1000) {
-    const rows = (await command("ps", ["-axo", "pid=,ppid="], Math.max(1, Math.min(1000, deadline - Date.now()))))
+/**
+ * The process group a pid leads, or undefined if it leads none.
+ *
+ * Only a leader's group is safe to treat as membership: the group then exists
+ * because this process was started, so everything in it descends from that
+ * start. A process that merely belongs to someone else's group shares it with
+ * whatever else is there — a shell, a tmux pane, the terminal — and sweeping
+ * that would reach far outside the session.
+ *
+ * Both terminal hosts start their root in a new session, so in practice the
+ * launched root does lead its own group.
+ */
+export async function ownedGroup(pid) {
+    try {
+        const pgid = Number((await command("ps", ["-p", String(pid), "-o", "pgid="])).trim());
+        return pgid === pid ? pgid : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Membership by two signals, because neither is sufficient alone.
+ *
+ * The parent chain is exact while it holds, and it stops holding the moment an
+ * intermediate process exits: the children reparent to launchd and are no
+ * longer reachable from the root, though they are still running the session's
+ * work. The process group survives that — reparenting changes no pid's group —
+ * but is only meaningful for a group the root leads, and is escapable by a
+ * process that calls setsid() for itself.
+ *
+ * So: union them. What the chain loses to reparenting, the group usually keeps.
+ */
+export async function descendants(root, deadline = Date.now() + 1000, group) {
+    const rows = (await command("ps", ["-axo", "pid=,ppid=,pgid="], Math.max(1, Math.min(1000, deadline - Date.now()))))
         .split("\n")
         .map((l) => l.trim().split(/\s+/).map(Number));
     const found = new Set([root]);
@@ -54,10 +87,26 @@ export async function descendants(root, deadline = Date.now() + 1000) {
                 changed = true;
             }
     }
+    if (group)
+        for (const [pid, , pgid] of rows)
+            if (pid && pid > 1 && pgid === group)
+                found.add(pid);
     return [...found];
 }
-async function liveTree(root) {
-    return (await Promise.all((await descendants(root)).map(processRef))).filter((r) => !!r);
+/** Whether anything still runs in a group we started. */
+export async function groupAlive(group, deadline = Date.now() + 1000) {
+    try {
+        const rows = (await command("ps", ["-axo", "pid=,pgid="], Math.max(1, Math.min(1000, deadline - Date.now()))))
+            .split("\n")
+            .map((l) => l.trim().split(/\s+/).map(Number));
+        return rows.some(([pid, pgid]) => pid && pid > 1 && pgid === group);
+    }
+    catch {
+        return false;
+    }
+}
+async function liveTree(root, group) {
+    return (await Promise.all((await descendants(root, Date.now() + 1000, group)).map(processRef))).filter((r) => !!r);
 }
 function signal(ref, name) {
     try {
@@ -74,11 +123,10 @@ function signal(ref, name) {
  * every signal, because a pid that exits between discovery and the signal may
  * already belong to something else.
  *
- * Reparented descendants are a separate gap: once an intermediate process dies,
- * its children leave the parent chain entirely and no re-read will find them.
- * That needs a membership signal the chain does not provide (see issue #24).
+ * Reparented descendants are reachable only through the process group, so pass
+ * one when the caller has recorded it; the parent chain alone cannot see them.
  */
-export async function stopTree(ref) {
+export async function stopTree(ref, group) {
     if (!(await isSame(ref)))
         return;
     const known = new Map();
@@ -94,12 +142,12 @@ export async function stopTree(ref) {
         return added;
     };
     const deepestFirst = () => [...known.values()].reverse();
-    remember(await liveTree(ref.pid));
+    remember(await liveTree(ref.pid, group));
     for (const r of deepestFirst())
         if (await isSame(r))
             signal(r, "SIGTERM");
     await delay(150);
-    const late = (await isSame(ref)) ? remember(await liveTree(ref.pid)) : [];
+    const late = remember((await isSame(ref)) || group ? await liveTree(ref.pid, group) : []);
     if (late.length) {
         for (const r of late.reverse())
             if (await isSame(r))

package/dist/registry.js

@@ -1,7 +1,7 @@
 import { mkdir, readFile, writeFile, rename, rm } from "node:fs/promises";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
-import { processRef, isSame, delay, } from "./identity/processes.js";
+import { processRef, isSame, delay, groupAlive, } from "./identity/processes.js";
 /**
  * A request key arrived again with different parameters. Distinct from a launch
  * failure: nothing was attempted, and the caller reused a key it should have
@@ -80,7 +80,11 @@ export class Registry {
                 if (["starting", "running"].includes(entry.status) &&
                     entry.root &&
                     !(await isSame(entry.root))) {
-                    if (!(await Promise.all((entry.descendants ?? []).map(isSame))).some(Boolean))
+                    // The recorded descendants are only those seen during launch, and a
+                    // reparented one is not among them at all. Ask the group before
+                    // concluding the session ended: it is the signal that survives both.
+                    if (!(await Promise.all((entry.descendants ?? []).map(isSame))).some(Boolean) &&
+                        !(entry.group && (await groupAlive(entry.group))))
                         entry.status = "exited";
                 }
             }

package/dist/run.js

@@ -8,7 +8,7 @@ import { runSchema, assertAllowedWorkspace, launchArgs, launchEnv, paramsFingerp
 import { Registry } from "./registry.js";
 import { LaunchLog } from "./log.js";
 import { hosts, selectHost } from "./hosts/index.js";
-import { processRef, isSame, stopTree, delay, descendants, } from "./identity/processes.js";
+import { processRef, isSame, stopTree, delay, descendants, ownedGroup, } from "./identity/processes.js";
 import { resolveCodex } from "./identity/codex.js";
 import { resolveClaude } from "./identity/claude.js";
 import { openCodeEndpointOwnedBy, resolveOpenCode, } from "./identity/opencode.js";
@@ -210,7 +210,14 @@ export class Muster {
                 await driver.stop(launched.hostRef);
                 throw new Error("process exited during launch");
             }
-            entry = { ...entry, root, host: driver.id, hostRef: launched.hostRef };
+            const group = await ownedGroup(launched.pid);
+            entry = {
+                ...entry,
+                root,
+                ...(group ? { group } : {}),
+                host: driver.id,
+                hostRef: launched.hostRef,
+            };
             await this.registry.update(entry.launchId, entry);
             let diagnostic = req.runtime === "claude"
                 ? "no Claude session registry found (check terminal for workspace trust or login prompts)"
@@ -223,7 +230,7 @@ export class Muster {
                 if (deadline - Date.now() < 25)
                     break;
                 if (await isSame(root)) {
-                    const tracked = (await Promise.all((await descendants(root.pid)).map(processRef))).filter((p) => !!p);
+                    const tracked = (await Promise.all((await descendants(root.pid, Date.now() + 1000, entry.group)).map(processRef))).filter((p) => !!p);
                     const refs = [...(entry.descendants ?? [])];
                     for (const ref of tracked)
                         if (!refs.some((r) => r.pid === ref.pid && r.start === ref.start))
@@ -410,9 +417,11 @@ export class Muster {
             child.kill();
             throw new Error("task owner exited during launch");
         }
+        const group = await ownedGroup(child.pid);
         try {
             await this.registry.update(entry.launchId, {
                 root,
+                ...(group ? { group } : {}),
                 outputPath,
                 exitPath,
                 status: "running",
@@ -428,7 +437,7 @@ export class Muster {
             return handle;
         }
         catch (e) {
-            await stopTree(root);
+            await stopTree(root, group);
             await rm(specPath, { force: true });
             throw e;
         }
@@ -458,7 +467,7 @@ export class Muster {
             return;
         if (!(await isSame(entry.root))) {
             for (const ref of entry.descendants ?? [])
-                await stopTree(ref);
+                await stopTree(ref, entry.group);
             return;
         }
         // Validate the persisted process identity before ever using a window reference.
@@ -468,9 +477,9 @@ export class Muster {
             (await driver.list()).some((s) => s.hostRef === entry.hostRef && s.pid === entry.root.pid))
             await driver.stop(entry.hostRef);
         else
-            await stopTree(entry.root);
+            await stopTree(entry.root, entry.group);
         for (const ref of entry.descendants ?? [])
-            await stopTree(ref);
+            await stopTree(ref, entry.group);
     }
     async find(id) {
         const all = await this.registry.all();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brutalsystems/muster",
-  "version": "0.7.11",
+  "version": "0.7.12",
   "description": "Launch instructed, reachable local agent sessions",
   "type": "module",
   "engines": {