@code-yeongyu/senpi-codemode 2026.10.10-9 → 2026.10.11

package/src/kernels/js/group-signal-notice.js

@@ -0,0 +1,117 @@
+// senpi#2995: Bun.$, node:child_process exec/execFile and the synchronous spawners leave their children in the
+// agent's process group (Bun.$ has no such option, Bun ignores `detached` for exec/execFile, and a synchronous call
+// keeps the terminal), so a group-wide signal from the same cell stops the agent. Such a command gets a notice; the
+// notice only warns and never fails the cell.
+
+// A command starts a (possibly indented) line, follows `;`, `|`, `&`, `(`, a backtick, `{`, `!`, a shell keyword
+// (`then`, `do`, `else`) or a runner (`nohup`, `time`, `xargs`, `env`, `exec`, `sudo` with flags), or opens a `-c '...'` script; a
+// `kill` word anywhere else (`git log --grep kill`, `echo kill ...`) is text.
+const COMMAND_POSITION = String.raw`(?:^\s*|[;|&(\x60]\s*|\b(?:then|do|else|nohup|time|xargs|env|exec)\s+|[{!]\s+|\bsudo(?:\s+-\S+)*\s+|\s-[A-Za-z]*c\s+['"]\s*)`;
+
+// A group target is a dash argument after the signal options: a number, `$var`, `${var}` or `$(...)`.
+const GROUP_TARGET = String.raw`-(?:\d+|\$\$|\$\{?\w+\}?|\$\()`;
+const SIGNAL_OPTION = String.raw`(?:-s\s+\w+|-n\s+\d+|-[A-Za-z]+\d*|-\d+)`;
+// The first dash argument is a signal, so a group is one after `--`, after a signal option, or after a plain pid:
+// `kill -- -<pgid>`, `kill -SIG -<pgid>`, `kill -TERM 1234 -5678`, `kill -- -$$`.
+const PID = String.raw`[^\s\-;|&][^\s;|&]*`;
+const KILL_GROUP = new RegExp(
+	String.raw`${COMMAND_POSITION}kill\b(?:` +
+		String.raw`\s+--\s+${GROUP_TARGET}` +
+		String.raw`|(?:\s+${SIGNAL_OPTION})+(?:\s+${PID})*\s+(?:--\s+)?${GROUP_TARGET}` +
+		String.raw`|(?:\s+${SIGNAL_OPTION})*(?:\s+${PID})+\s+${GROUP_TARGET})`,
+	"mu",
+);
+const PKILL_GROUP = new RegExp(String.raw`${COMMAND_POSITION}pkill\b[^\n;|&]*\s(?:-g\d*|--pgroup)\b`, "mu");
+// `killall` in command position (also after `sudo` or as a `-c` script) signals every process with that name, which
+// can include the agent's own (bun, node, senpi). Inside an `echo` string it is only text.
+const KILLALL = new RegExp(String.raw`${COMMAND_POSITION}killall\s`, "mu");
+
+export const GROUP_SIGNAL_NOTICE_TAG = "[senpi:group-signal]";
+
+export function signalsProcessGroup(commandText) {
+	return KILL_GROUP.test(commandText) || PKILL_GROUP.test(commandText) || KILLALL.test(commandText);
+}
+
+export function groupSignalNotice(api, readGroup = agentProcessGroup) {
+	const pgid = readGroup();
+	const group = pgid === undefined ? "the agent's process group" : `the agent's process group (${pgid})`;
+	return (
+		`${GROUP_SIGNAL_NOTICE_TAG} This command signals a process group. Children of ${api} share ${group}, so ` +
+		"signalling that group can stop this session. Start background jobs with Bun.spawn or child_process.spawn, " +
+		"which give them their own group, or signal them by pid.\n"
+	);
+}
+
+let cachedGroup;
+
+// A bounded `ps` lookup, kept once it succeeds; a missing `ps` or a failed run only drops the number from this notice.
+export function agentProcessGroup(spawnSync = globalThis.Bun?.spawnSync) {
+	if (cachedGroup !== undefined) return cachedGroup;
+	let text = "";
+	try {
+		const result = spawnSync?.(["ps", "-o", "pgid=", "-p", String(process.pid)], { timeout: 2_000 });
+		text = result?.success ? String(result.stdout).trim() : "";
+	} catch {
+		text = "";
+	}
+	if (!/^\d+$/u.test(text)) return undefined;
+	cachedGroup = text;
+	return cachedGroup;
+}
+
+export function shellCommandText(strings, expressions) {
+	if (!Array.isArray(strings)) return String(strings ?? "");
+	return strings.reduce((text, part, index) => text + part + (index < expressions.length ? String(expressions[index]) : ""), "");
+}
+
+const { promisify } = process.getBuiltinModule("node:util");
+const SCANNED_SPAWNERS = ["exec", "execFile", "execSync", "execFileSync", "spawnSync"];
+
+function commandTextOf(name, args) {
+	if (name === "exec" || name === "execSync") return String(args[0]);
+	return [args[0], ...(Array.isArray(args[1]) ? args[1] : [])].join(" ");
+}
+
+export function noticeChildProcessGroupSignals(emitText, isActive) {
+	const childProcess = process.getBuiltinModule("node:child_process");
+	const originals = new Map();
+	for (const name of SCANNED_SPAWNERS) {
+		const original = childProcess[name];
+		if (typeof original !== "function") continue;
+		originals.set(name, original);
+		const scan = (args) => {
+			try {
+				if (isActive() && signalsProcessGroup(commandTextOf(name, args))) {
+					emitText("stderr", groupSignalNotice(`child_process.${name}`));
+				}
+			} catch {
+				// The notice is advisory; the call itself always runs.
+			}
+		};
+		const scanned = function scannedSpawner(...args) {
+			scan(args);
+			return original.apply(this, args);
+		};
+		// Every own property, symbols included: `util.promisify.custom` is what makes promisify(exec) resolve to
+		// { stdout, stderr }. That custom function calls the original directly, so it is scanned too.
+		for (const key of Reflect.ownKeys(original)) {
+			if (key === "length" || key === "name" || key === "prototype" || key === promisify.custom) continue;
+			const descriptor = Object.getOwnPropertyDescriptor(original, key);
+			if (descriptor) Object.defineProperty(scanned, key, descriptor);
+		}
+		const customPromisify = original[promisify.custom];
+		if (typeof customPromisify === "function") {
+			Object.defineProperty(scanned, promisify.custom, {
+				configurable: true,
+				value: function scannedPromisified(...args) {
+					scan(args);
+					return customPromisify.apply(this, args);
+				},
+			});
+		}
+		childProcess[name] = scanned;
+	}
+	return () => {
+		for (const [name, original] of originals) childProcess[name] = original;
+	};
+}

package/src/kernels/js/inline-worker.ts

@@ -19,6 +19,8 @@ export function resolveInlineWorkerEntryUrl(options: JavaScriptInlineWorkerEntry
 
 export interface WorkerLike {
 	readonly mode: JavaScriptKernelMode;
+	/** The child pid when `mode` is `"process"`; the slot reports it for orphan accounting after a crash. */
+	readonly pid?: number;
 	postMessage(message: HostToKernelMessage, transfer?: readonly MessagePort[]): void;
 	onMessage(handler: (message: KernelToHostMessage) => void): () => void;
 	onError(handler: (error: Error) => void): () => void;

package/src/kernels/js/local-module-loader.ts

@@ -79,6 +79,14 @@ function loaderPrelude(context: RuntimeModuleContext): string {
 		"  const specifier = String(source);",
 		"  const kernelBun = globalThis[Symbol.for('senpi.kernel.bun')];",
 		"  if (specifier === 'bun' && kernelBun) return { ...(await import('bun')), WebView: kernelBun.WebView, default: kernelBun };",
+		// Under Bun a cell's named import (`import { spawn } from 'node:child_process'`) binds the builtin's original
+		// export even after the worker patched the module object (worker-cwd.js), so the session cwd and the cell
+		// children's own process group (senpi#2995) were skipped. The patched module objects are served instead.
+		"  const patched = /^(?:node:)?(child_process|fs|fs\\/promises|path)$/.exec(specifier);",
+		"  if (patched && typeof process.getBuiltinModule === 'function') {",
+		"    const builtin = process.getBuiltinModule('node:' + patched[1]);",
+		"    if (builtin) return { ...builtin, default: builtin };",
+		"  }",
 		"  const match = /^([a-z][a-z0-9+.-]*):\\/\\/(.*)$/i.exec(specifier);",
 		"  let target = specifier;",
 		"  if (match) {",

package/src/kernels/js/process-tree-host.ts

@@ -1,4 +1,5 @@
 import { execFile } from "node:child_process";
+import { killWindowsTree, listWindowsRows } from "./windows-tree-kill-host.ts";
 
 // Host-side twin of worker-runtime's `process-tree.js`. The worker file must stay plain
 // JavaScript (a Node worker thread spawned from a `.js` entry has no TypeScript loader), and
@@ -100,7 +101,7 @@ function sleep(ms: number): Promise<void> {
 /**
  * Retire whole process trees: snapshot the descendants first (a parent that dies before the
  * snapshot would reparent them to init), SIGTERM everything, wait `graceMs` for the pids to
- * disappear, then SIGKILL whatever is left. On Windows `taskkill /T /F` does the walk and the kill.
+ * disappear, then SIGKILL whatever is left. On Windows the checked tree is killed by pid (`windows-tree-kill.js`).
  */
 export async function terminateProcessTrees(
 	roots: readonly number[],
@@ -109,7 +110,8 @@ export async function terminateProcessTrees(
 	const liveRoots = roots.filter(isProcessAlive);
 	if (liveRoots.length === 0) return;
 	if (process.platform === "win32") {
-		for (const pid of liveRoots) await taskkillTree(pid);
+		const listing = listWindowsRows();
+		for (const pid of liveRoots) await killWindowsTree(pid, listing);
 		return;
 	}
 	const table = await readProcessTable();
@@ -150,9 +152,3 @@ async function withoutZombies(pids: number[]): Promise<number[]> {
 	}
 	return pids.filter((pid) => !zombies.has(pid));
 }
-
-function taskkillTree(pid: number): Promise<void> {
-	return new Promise((resolve) => {
-		execFile("taskkill", ["/T", "/F", "/PID", String(pid)], { windowsHide: true }, () => resolve());
-	});
-}

package/src/kernels/js/process-tree.d.ts

@@ -22,3 +22,14 @@ export function collectDescendants(table: ProcessTable, roots: readonly number[]
 export function ownedRoots(table: ProcessTable, parentPid: number, roots: readonly number[]): number[];
 
 export function terminateProcessTrees(roots: readonly number[], options: TerminateProcessTreesOptions): Promise<void>;
+export interface CellProcessGroup {
+	readonly pgid: number;
+	readonly leaderExited: boolean;
+}
+export interface TerminateProcessGroupsOptions {
+	readonly graceMs: number;
+}
+export function terminateProcessGroups(
+	groups: readonly CellProcessGroup[],
+	options: TerminateProcessGroupsOptions,
+): Promise<void>;

package/src/kernels/js/process-tree.js

@@ -1,4 +1,5 @@
 import { execFile } from "node:child_process";
+import { killWindowsTree, listWindowsRows } from "./windows-tree-kill.js";
 
 // Plain JS (with process-tree.d.ts) because the worker runtime imports it and
 // worker files cannot import TypeScript; the host imports the same module so a
@@ -6,6 +7,8 @@ import { execFile } from "node:child_process";
 
 const PS_MAX_BUFFER = 16 * 1024 * 1024;
 const EXIT_POLL_MS = 25;
+// A hung `ps` must not hold a cell's retirement; empty output then means nothing is signalled.
+const PS_LOOKUP_TIMEOUT_MS = 2_000;
 const ZOMBIE_CHECK_INTERVAL_MS = 250;
 
 export function isProcessAlive(pid) {
@@ -30,7 +33,7 @@ export function signalProcess(pid, signal) {
 
 /**
  * Parent-to-children map of every process visible to `ps`. Windows has no
- * `ps`; callers there kill through `taskkill /T`, which walks the tree itself.
+ * `ps`; callers there kill the checked tree from `windows-tree-kill.js`.
  */
 export async function readProcessTable() {
 	if (process.platform === "win32") return new Map();
@@ -78,13 +81,14 @@ function sleep(ms) {
  * Retire whole process trees: snapshot the descendants first (a parent that
  * dies before the snapshot would reparent them to init), SIGTERM everything,
  * wait `graceMs` for `settled` (or for the pids to disappear), then SIGKILL
- * whatever is left. On Windows `taskkill /T /F` does the walk and the kill.
+ * whatever is left. On Windows the checked tree is killed by pid (`windows-tree-kill.js`).
  */
 export async function terminateProcessTrees(roots, options) {
 	const liveRoots = roots.filter(isProcessAlive);
 	if (liveRoots.length === 0) return;
 	if (process.platform === "win32") {
-		for (const pid of liveRoots) await taskkillTree(pid);
+		const listing = listWindowsRows();
+		for (const pid of liveRoots) await killWindowsTree(pid, listing);
 		return;
 	}
 	const table = await readProcessTable();
@@ -98,6 +102,52 @@ export async function terminateProcessTrees(roots, options) {
 	await waitForExit(survivors, options.killWaitMs ?? options.graceMs, options.settled);
 }
 
+/**
+ * Retire whole process groups the worker created (POSIX): SIGTERM each group that still has members, wait `graceMs`,
+ * then SIGKILL what is left. A group whose leader already exited is skipped while a live process holds the leader's
+ * pid, since that pid was reused. The agent's own group is never signalled.
+ */
+export async function terminateProcessGroups(groups, options) {
+	if (process.platform === "win32") return;
+	const ours = (group) => groupHasMembers(group.pgid) && !(group.leaderExited && isProcessAlive(group.pgid));
+	const candidates = groups.filter((group) => Number.isInteger(group.pgid) && group.pgid > 1 && ours(group));
+	if (candidates.length === 0) return;
+	// Without the agent's own group there is no way to rule it out, so nothing is signalled.
+	const ownGroup = await processGroupOf(process.pid);
+	if (ownGroup === undefined) return;
+	const live = candidates.filter((group) => group.pgid !== ownGroup && ours(group));
+	for (const group of live) signalGroup(group.pgid, "SIGTERM");
+	const deadline = Date.now() + options.graceMs;
+	let remaining = live;
+	while (remaining.length > 0 && Date.now() < deadline) {
+		await sleep(EXIT_POLL_MS);
+		remaining = remaining.filter(ours);
+	}
+	for (const group of remaining) signalGroup(group.pgid, "SIGKILL");
+}
+
+function groupHasMembers(pgid) {
+	try {
+		process.kill(-pgid, 0);
+		return true;
+	} catch (error) {
+		return isRecord(error) && error.code === "EPERM";
+	}
+}
+
+function signalGroup(pgid, signal) {
+	try {
+		process.kill(-pgid, signal);
+	} catch {
+		// The group emptied between the check and the signal.
+	}
+}
+
+async function processGroupOf(pid) {
+	const text = (await ps(["-o", "pgid=", "-p", String(pid)], { timeout: PS_LOOKUP_TIMEOUT_MS })).trim();
+	return /^\d+$/u.test(text) ? Number(text) : undefined;
+}
+
 // `kill(pid, 0)` still succeeds for a zombie, and a child whose owning worker is
 // blocked or gone is never reaped, so liveness also consults `ps` state.
 async function waitForExit(pids, graceMs, settled) {
@@ -132,19 +182,14 @@ async function withoutZombies(pids) {
 }
 
 // `ps -p` exits non-zero when any listed pid is gone but still prints the rest.
-function ps(args) {
+function ps(args, options = {}) {
 	return new Promise((resolve) => {
-		execFile("ps", args, { maxBuffer: PS_MAX_BUFFER, windowsHide: true }, (_error, output) =>
+		execFile("ps", args, { maxBuffer: PS_MAX_BUFFER, windowsHide: true, ...options }, (_error, output) =>
 			resolve(typeof output === "string" ? output : String(output ?? "")),
 		);
 	});
 }
 
-function taskkillTree(pid) {
-	return new Promise((resolve) => {
-		execFile("taskkill", ["/T", "/F", "/PID", String(pid)], { windowsHide: true }, () => resolve());
-	});
-}
 
 function isRecord(value) {
 	return typeof value === "object" && value !== null;

package/src/kernels/js/windows-tree-kill-host.ts

@@ -0,0 +1,117 @@
+import { execFile } from "node:child_process";
+
+// Host-side twin of windows-tree-kill.js (the worker imports that one; .ts files may not import .js). `taskkill /T`
+// adopts every process whose recorded ParentProcessId equals the root's pid, and Windows never rewrites that
+// field when a parent exits and reuses pids (senpi#2999). The tree is computed from one process listing instead: a process
+// belongs to it only when it started at or after the parent it names, and each pid is killed by name.
+
+const LISTING_TIMEOUT_MS = 5_000;
+const LISTING_MAX_BUFFER = 16 * 1024 * 1024;
+
+const ROWS_SCRIPT = `Get-CimInstance Win32_Process | Where-Object { $_.ProcessId -ne $PID } | ForEach-Object {
+$created = if ($_.CreationDate) { $_.CreationDate.ToFileTimeUtc() } else { 0 }
+"{0} {1} {2} {3}" -f $_.ProcessId, $_.ParentProcessId, $created, $_.Name }`;
+
+const PROTECTED_IMAGES = new Set([
+	"system",
+	"smss.exe",
+	"csrss.exe",
+	"wininit.exe",
+	"winlogon.exe",
+	"services.exe",
+	"lsass.exe",
+	"lsaiso.exe",
+	"svchost.exe",
+]);
+
+export interface WindowsProcessRow {
+	readonly pid: number;
+	readonly parentPid: number;
+	readonly createdAt: bigint;
+	readonly name: string;
+}
+
+export function parseWindowsRows(stdout: string): WindowsProcessRow[] {
+	const rows: WindowsProcessRow[] = [];
+	for (const line of stdout.split(/\r?\n/u)) {
+		const [pidText, parentText, createdText, ...nameParts] = line.trim().split(/\s+/u);
+		const pid = Number(pidText);
+		const parentPid = Number(parentText);
+		if (!Number.isInteger(pid) || pid <= 0 || !Number.isInteger(parentPid) || !/^\d+$/u.test(createdText ?? ""))
+			continue;
+		rows.push({ pid, parentPid, createdAt: BigInt(createdText ?? "0"), name: nameParts.join(" ") });
+	}
+	return rows;
+}
+
+/** The root and its genuine descendants; any protected image or ancestor of `selfPid` in it shrinks the kill to the root. */
+export function windowsTreeKillPids(rows: readonly WindowsProcessRow[], rootPid: number, selfPid: number): number[] {
+	const byPid = new Map(rows.map((row) => [row.pid, row]));
+	if (!byPid.has(rootPid)) return [];
+	const tree = new Set<number>([rootPid]);
+	let grew = true;
+	while (grew) {
+		grew = false;
+		for (const row of rows) {
+			if (tree.has(row.pid) || !tree.has(row.parentPid)) continue;
+			const parent = byPid.get(row.parentPid);
+			if (parent === undefined || row.createdAt < parent.createdAt) continue;
+			tree.add(row.pid);
+			grew = true;
+		}
+	}
+	const ancestors = new Set<number>([selfPid]);
+	for (let current = byPid.get(selfPid); current !== undefined; ) {
+		const parent = byPid.get(current.parentPid);
+		if (parent === undefined || ancestors.has(parent.pid) || parent.createdAt > current.createdAt) break;
+		ancestors.add(parent.pid);
+		current = parent;
+	}
+	const refused = [...tree].some(
+		(pid) => PROTECTED_IMAGES.has((byPid.get(pid)?.name ?? "").toLowerCase()) || ancestors.has(pid),
+	);
+	if (!refused) return [...tree];
+	const rootRefused = PROTECTED_IMAGES.has((byPid.get(rootPid)?.name ?? "").toLowerCase()) || ancestors.has(rootPid);
+	return rootRefused ? [] : [rootPid];
+}
+
+/** `taskkill` arguments: the checked tree pid by pid, or `/T` on the root when no listing could be read. */
+export function windowsTreeKillArgs(
+	rootPid: number,
+	rows: readonly WindowsProcessRow[] | undefined,
+	selfPid: number = process.pid,
+): string[] {
+	if (rows === undefined) return ["/F", "/T", "/PID", String(rootPid)];
+	const pids = windowsTreeKillPids(rows, rootPid, selfPid);
+	if (pids.length === 0) return [];
+	return ["/F", ...pids.flatMap((pid) => ["/PID", String(pid)])];
+}
+
+export function listWindowsRows(): Promise<WindowsProcessRow[] | undefined> {
+	return new Promise((resolve) => {
+		execFile(
+			"powershell.exe",
+			["-NoProfile", "-NonInteractive", "-Command", ROWS_SCRIPT],
+			{ timeout: LISTING_TIMEOUT_MS, maxBuffer: LISTING_MAX_BUFFER, windowsHide: true },
+			(error, stdout) => {
+				const rows = error ? [] : parseWindowsRows(String(stdout ?? ""));
+				resolve(rows.length > 0 ? rows : undefined);
+			},
+		);
+	});
+}
+
+/**
+ * Kills the checked process tree rooted at `pid`; resolves once taskkill has run (or nothing needed killing).
+ * A batch passes one shared `listing` so every tree is planned from the same snapshot.
+ */
+export async function killWindowsTree(
+	pid: number,
+	listing: Promise<readonly WindowsProcessRow[] | undefined> = listWindowsRows(),
+): Promise<void> {
+	const args = windowsTreeKillArgs(pid, await listing);
+	if (args.length === 0) return;
+	await new Promise<void>((resolve) => {
+		execFile("taskkill", args, { timeout: LISTING_TIMEOUT_MS, windowsHide: true }, () => resolve());
+	});
+}

package/src/kernels/js/windows-tree-kill.d.ts

@@ -0,0 +1,19 @@
+export interface WindowsProcessRow {
+	readonly pid: number;
+	readonly parentPid: number;
+	readonly createdAt: bigint;
+	readonly name: string;
+}
+
+export function parseWindowsRows(stdout: string): WindowsProcessRow[];
+export function windowsTreeKillPids(rows: readonly WindowsProcessRow[], rootPid: number, selfPid: number): number[];
+export function windowsTreeKillArgs(
+	rootPid: number,
+	rows: readonly WindowsProcessRow[] | undefined,
+	selfPid?: number,
+): string[];
+export function listWindowsRows(): Promise<WindowsProcessRow[] | undefined>;
+export function killWindowsTree(
+	pid: number,
+	listing?: Promise<readonly WindowsProcessRow[] | undefined>,
+): Promise<void>;

package/src/kernels/js/windows-tree-kill.js

@@ -0,0 +1,100 @@
+import { execFile } from "node:child_process";
+
+// Plain JS (with windows-tree-kill.d.ts) because the worker runtime imports it. `taskkill /T`
+// adopts every process whose recorded ParentProcessId equals the root's pid, and Windows never rewrites that
+// field when a parent exits and reuses pids (senpi#2999). The tree is computed from one process listing instead: a process
+// belongs to it only when it started at or after the parent it names, and each pid is killed by name.
+
+const LISTING_TIMEOUT_MS = 5_000;
+const LISTING_MAX_BUFFER = 16 * 1024 * 1024;
+
+const ROWS_SCRIPT = `Get-CimInstance Win32_Process | Where-Object { $_.ProcessId -ne $PID } | ForEach-Object {
+$created = if ($_.CreationDate) { $_.CreationDate.ToFileTimeUtc() } else { 0 }
+"{0} {1} {2} {3}" -f $_.ProcessId, $_.ParentProcessId, $created, $_.Name }`;
+
+const PROTECTED_IMAGES = new Set([
+	"system",
+	"smss.exe",
+	"csrss.exe",
+	"wininit.exe",
+	"winlogon.exe",
+	"services.exe",
+	"lsass.exe",
+	"lsaiso.exe",
+	"svchost.exe",
+]);
+
+export function parseWindowsRows(stdout) {
+	const rows = [];
+	for (const line of stdout.split(/\r?\n/u)) {
+		const [pidText, parentText, createdText, ...nameParts] = line.trim().split(/\s+/u);
+		const pid = Number(pidText);
+		const parentPid = Number(parentText);
+		if (!Number.isInteger(pid) || pid <= 0 || !Number.isInteger(parentPid) || !/^\d+$/u.test(createdText ?? "")) continue;
+		rows.push({ pid, parentPid, createdAt: BigInt(createdText ?? "0"), name: nameParts.join(" ") });
+	}
+	return rows;
+}
+
+/** The root and its genuine descendants; any protected image or ancestor of `selfPid` in it shrinks the kill to the root. */
+export function windowsTreeKillPids(rows, rootPid, selfPid) {
+	const byPid = new Map(rows.map((row) => [row.pid, row]));
+	if (!byPid.has(rootPid)) return [];
+	const tree = new Set([rootPid]);
+	let grew = true;
+	while (grew) {
+		grew = false;
+		for (const row of rows) {
+			if (tree.has(row.pid) || !tree.has(row.parentPid)) continue;
+			const parent = byPid.get(row.parentPid);
+			if (parent === undefined || row.createdAt < parent.createdAt) continue;
+			tree.add(row.pid);
+			grew = true;
+		}
+	}
+	const ancestors = new Set([selfPid]);
+	for (let current = byPid.get(selfPid); current !== undefined; ) {
+		const parent = byPid.get(current.parentPid);
+		if (parent === undefined || ancestors.has(parent.pid) || parent.createdAt > current.createdAt) break;
+		ancestors.add(parent.pid);
+		current = parent;
+	}
+	const refused = [...tree].some((pid) => PROTECTED_IMAGES.has((byPid.get(pid)?.name ?? "").toLowerCase()) || ancestors.has(pid));
+	if (!refused) return [...tree];
+	const rootRefused = PROTECTED_IMAGES.has(byPid.get(rootPid).name.toLowerCase()) || ancestors.has(rootPid);
+	return rootRefused ? [] : [rootPid];
+}
+
+/** `taskkill` arguments: the checked tree pid by pid, or `/T` on the root when no listing could be read. */
+export function windowsTreeKillArgs(rootPid, rows, selfPid = process.pid) {
+	if (rows === undefined) return ["/F", "/T", "/PID", String(rootPid)];
+	const pids = windowsTreeKillPids(rows, rootPid, selfPid);
+	if (pids.length === 0) return [];
+	return ["/F", ...pids.flatMap((pid) => ["/PID", String(pid)])];
+}
+
+export function listWindowsRows() {
+	return new Promise((resolve) => {
+		execFile(
+			"powershell.exe",
+			["-NoProfile", "-NonInteractive", "-Command", ROWS_SCRIPT],
+			{ timeout: LISTING_TIMEOUT_MS, maxBuffer: LISTING_MAX_BUFFER, windowsHide: true },
+			(error, stdout) => {
+				const rows = error ? [] : parseWindowsRows(String(stdout ?? ""));
+				resolve(rows.length > 0 ? rows : undefined);
+			},
+		);
+	});
+}
+
+/**
+ * Kills the checked process tree rooted at `pid`; resolves once taskkill has run (or nothing needed killing).
+ * A batch passes one shared `listing` so every tree is planned from the same snapshot.
+ */
+export async function killWindowsTree(pid, listing = listWindowsRows()) {
+	const args = windowsTreeKillArgs(pid, await listing);
+	if (args.length === 0) return;
+	await new Promise((resolve) => {
+		execFile("taskkill", args, { timeout: LISTING_TIMEOUT_MS, windowsHide: true }, () => resolve());
+	});
+}

package/src/kernels/js/worker-cwd.js

@@ -51,6 +51,7 @@ const FS_PATH_ARGS = {
 
 const CHILD_PROCESS_FILE_ARGS = ["spawn", "spawnSync", "execFile", "execFileSync", "fork"];
 const CHILD_PROCESS_COMMAND_ARGS = ["exec", "execSync"];
+const ASYNC_GROUP_SPAWNERS = new Set(["spawn", "fork"]);
 
 export function installSessionCwd(cwd, options) {
 	// A process-mode kernel child IS the main thread; the worker guard relaxes only for that entry.
@@ -95,7 +96,9 @@ function patchFs(fs, promises, at, root) {
 function patchChildProcess(childProcess, at, root) {
 	for (const name of CHILD_PROCESS_FILE_ARGS) {
 		replace(childProcess, name, (fn) => {
-			const withCwd = withOptionsCwd(fn, fileOptionsIndex, root);
+			// Only asynchronous spawners start a new group: a synchronous call keeps the terminal (ssh/sudo/git prompts),
+			// and Bun ignores `detached` for execFile. Those calls get a notice instead (group-signal-notice.js).
+			const withCwd = withOptionsCwd(fn, fileOptionsIndex, root, ASYNC_GROUP_SPAWNERS.has(name));
 			return name === "fork" ? resolvingArgs(withCwd, [0], at) : withCwd;
 		});
 	}
@@ -107,7 +110,7 @@ function patchBun(bun, at, root) {
 	replace(bun, "file", (fn) => resolvingArgs(fn, [0], at));
 	replace(bun, "write", (fn) => resolvingArgs(fn, [0], at));
 	replace(bun, "spawn", (fn) => withBunSpawnCwd(fn, root));
-	replace(bun, "spawnSync", (fn) => withBunSpawnCwd(fn, root));
+	replace(bun, "spawnSync", (fn) => withBunSpawnCwd(fn, root, false));
 	if (typeof bun.$?.cwd === "function") bun.$.cwd(root);
 	const glob = bun.Glob?.prototype;
 	if (glob) {
@@ -149,32 +152,60 @@ function fileOptionsIndex(args) {
 	return Array.isArray(args[1]) || (args[1] == null && args.length > 2) ? 2 : 1;
 }
 
-function withOptionsCwd(fn, optionsIndex, root) {
+function withOptionsCwd(fn, optionsIndex, root, inOwnGroup = false) {
+	const group = inOwnGroup ? ownGroup : (options) => options;
 	return function withSessionCwd(...args) {
 		const index = optionsIndex(args);
 		const options = args[index];
-		if (options === undefined || options === null) args[index] = { cwd: root };
-		else if (typeof options === "function") args.splice(index, 0, { cwd: root });
-		else if (typeof options === "object") args[index] = { ...options, cwd: cwdFrom(options.cwd, root) };
-		return fn.apply(this, args);
+		if (options === undefined || options === null) args[index] = group({ cwd: root });
+		else if (typeof options === "function") args.splice(index, 0, group({ cwd: root }));
+		else if (typeof options === "object") args[index] = group({ ...options, cwd: cwdFrom(options.cwd, root) });
+		if (!inOwnGroup || process.platform === "win32" || (isPlainOptions(options) && options.detached !== undefined)) {
+			return fn.apply(this, args);
+		}
+		// Bun's child_process spawns through Bun.spawn, whose child tracking skips `detached` children as ones the
+		// cell keeps on purpose. While this call runs, `detached` is ours, so the child is still retired with the cell.
+		const depth = globalThis[INJECTED_GROUP] ?? 0;
+		globalThis[INJECTED_GROUP] = depth + 1;
+		try {
+			return fn.apply(this, args);
+		} finally {
+			globalThis[INJECTED_GROUP] = depth;
+		}
 	};
 }
 
-function withBunSpawnCwd(fn, root) {
+function withBunSpawnCwd(fn, root, inOwnGroup = true) {
+	const group = inOwnGroup ? ownGroup : (options) => options;
 	return function spawnInSessionCwd(...args) {
 		const [first, second] = args;
 		if (Array.isArray(first)) {
 			const options = second === undefined || second === null ? {} : second;
 			if (typeof options !== "object") return fn.apply(this, args);
-			return fn.call(this, first, { ...options, cwd: cwdFrom(options.cwd, root) }, ...args.slice(2));
+			return fn.call(this, first, group({ ...options, cwd: cwdFrom(options.cwd, root) }), ...args.slice(2));
 		}
 		if (first !== null && typeof first === "object") {
-			return fn.call(this, { ...first, cwd: cwdFrom(first.cwd, root) }, ...args.slice(1));
+			return fn.call(this, group({ ...first, cwd: cwdFrom(first.cwd, root) }), ...args.slice(1));
 		}
 		return fn.apply(this, args);
 	};
 }
 
+// senpi#2995: a JS kernel runs inside the agent process, so a child spawned from a cell would join the agent's
+// process group, and a cell that later signals that group (`kill -TERM -- -$PGID`) stops the agent itself. On
+// POSIX every cell child starts its own group instead; kernel teardown still retires it by pid and descendants.
+// A cell that sets `detached` itself keeps its choice. Windows is left alone: there `detached` opens a console.
+export const INJECTED_GROUP = Symbol.for("senpi.kernel.injectedProcessGroup");
+
+function isPlainOptions(value) {
+	return value !== null && typeof value === "object";
+}
+
+function ownGroup(options) {
+	if (process.platform === "win32" || options.detached !== undefined) return options;
+	return { ...options, detached: true };
+}
+
 function globScanOptions(options, root) {
 	if (options === undefined || options === null) return { cwd: root };
 	if (typeof options === "string") return cwdFrom(options, root);