@ctrl-spc/cs 0.7.14 → 0.7.15

package/dist/win-shell.js

@@ -29,7 +29,452 @@
  * This module is where all three live, so a further caller cannot take one and
  * miss the others.
  */
-import { spawn } from 'node:child_process';
+import { spawn, execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { ensureLifecycleDir } from './config.js';
+import { windowsJobExecutable, windowsJobName, inspectWindowsJob, inspectWindowsProcess } from './windows-job.js';
+import { spawnMacExecution, readMacExecution, inspectMacCoalition, inspectMacProcess, inspectMacProcesses, signalMacMember, signalMacProcess, unloadMacExecution, removeMacExecutionFiles } from './darwin-coalition.js';
+export { windowsJobName, inspectWindowsJob } from './windows-job.js';
+export { validMacCoalition } from './darwin-coalition.js';
+const execute = promisify(execFile);
+const ownedChildren = new WeakMap();
+const posixGate = String.raw `
+const fs = require('node:fs'); const {spawn} = require('node:child_process');
+const file=process.argv[1]; const launch=JSON.parse(fs.readFileSync(file,'utf8')); fs.unlinkSync(file);
+const byte=Buffer.alloc(1);
+function gate() {
+  fs.read(0,byte,0,1,null,(error,count)=>{
+    if(error && (error.code==='EAGAIN'||error.code==='EINTR')) { setTimeout(gate,10); return; }
+    if(error) { console.error('Execution gate could not read its grant.'); process.exitCode=1; return; }
+    if(count!==1 || byte[0]!==1) return;
+    const child=spawn(launch.bin,launch.args,{cwd:launch.cwd,shell:launch.shell,stdio:[0,1,2]});
+    child.on('error',(error)=>{ console.error('The harness could not start ('+(error.code || 'unknown error')+').'); process.exitCode=1; });
+    child.on('exit',(code,signal)=>{ process.exitCode=code ?? (signal ? 1 : 0); });
+  });
+}
+gate();
+`;
+/** Native executable argv quoting; .cmd arguments have already been escaped by
+ * windowsSafeSpawn and retain the existing cmd.exe /d /s /c path. */
+function windowsArgument(value) {
+    if (value && !/[\s"]/.test(value))
+        return value;
+    return '"' + value.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\*)$/, '$1$1') + '"';
+}
+/** Reserve the id durably before calling this. A gated helper cannot create a
+ * harness before register persists its OS boundary and releases the grant. */
+export function spawnOwnedProcess(bin, args, options, reservationId) {
+    const name = windowsJobName(reservationId);
+    const file = join(ensureLifecycleDir(), `owned-launch-${reservationId}.json`);
+    if (process.platform === 'darwin') {
+        const result = spawnMacExecution(bin, args, options, reservationId, file);
+        const state = { macReady: result.ready, released: false, failed: false };
+        ownedChildren.set(result.child, state);
+        result.child.once('error', () => { state.failed = true; });
+        result.child.once('close', () => { rmSync(file, { force: true }); removeMacExecutionFiles(result.ready); });
+        return result.child;
+    }
+    let executable, argv;
+    if (process.platform === 'win32') {
+        executable = windowsJobExecutable();
+        const shell = options.shell ? (typeof options.shell === 'string' ? options.shell : process.env.ComSpec || join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'cmd.exe')) : null;
+        const application = shell || bin;
+        // The executable path is parsed once, before the npm shim reparses its
+        // arguments. cross-spawn's escapeCommand uses one caret pass here.
+        const shellBin = bin.replace(/([()\][%!^"`<>&|;,\s*?])/g, '^$1');
+        const command = shell ? `${windowsArgument(application)} /d /s /c "${[shellBin, ...args].join(' ')}"` : [bin, ...args].map(windowsArgument).join(' ');
+        writeFileSync(file, JSON.stringify({ application, command, cwd: options.cwd?.toString() ?? process.cwd() }), { flag: 'wx', mode: 0o600 });
+        argv = ['run', name, file];
+    }
+    else {
+        executable = process.execPath;
+        argv = ['-e', posixGate, file];
+        writeFileSync(file, JSON.stringify({ bin, args, cwd: options.cwd?.toString() ?? process.cwd(), shell: options.shell ?? false }), { flag: 'wx', mode: 0o600 });
+    }
+    try {
+        const child = spawn(executable, argv, { ...options, shell: false, detached: process.platform !== 'win32', windowsHide: true });
+        const state = { ...(process.platform === 'win32' ? { job: name } : {}), released: false, failed: false };
+        ownedChildren.set(child, state);
+        child.once('error', () => { state.failed = true; rmSync(file, { force: true }); });
+        child.once('close', () => { rmSync(file, { force: true }); });
+        return child;
+    }
+    catch (error) {
+        rmSync(file, { force: true });
+        throw error;
+    }
+}
+/** null is proven pre-grant closure, never an OS-inspection failure. */
+export async function getOwnedProcessIdentity(child, deadline = Date.now() + 5000) {
+    const gate = ownedChildren.get(child);
+    if (!gate)
+        return child.pid ? inspectProcess(child.pid, deadline) : null;
+    while (Date.now() < deadline) {
+        const identity = child.pid ? await inspectProcess(child.pid, deadline) : null;
+        const job = gate.job ? await inspectWindowsJob(gate.job, deadline) : null;
+        if (gate.macReady) {
+            gate.macCoalition ??= readMacExecution(gate.macReady) ?? undefined;
+            if (identity && gate.macCoalition) {
+                await inspectMacCoalition(gate.macCoalition, deadline);
+                gate.identity = { ...identity, macCoalition: gate.macCoalition };
+                return gate.identity;
+            }
+            if (!identity && !gate.released && (child.exitCode !== null || child.signalCode !== null || gate.failed))
+                return null;
+            await new Promise((resolve) => setTimeout(resolve, 25));
+            continue;
+        }
+        if (identity && (!gate.job || job?.exists))
+            return { ...identity, ...(gate.job ? { windowsJob: gate.job } : {}) };
+        if (!identity && !gate.released && (child.exitCode !== null || child.signalCode !== null || gate.failed) && !job?.exists)
+            return null;
+        await new Promise((resolve) => setTimeout(resolve, 25));
+    }
+    throw new Error('The harness execution boundary could not be verified before its deadline.');
+}
+export function releaseOwnedProcess(child) {
+    const gate = ownedChildren.get(child);
+    if (!gate || gate.released)
+        return;
+    if (!child.stdin || child.stdin.destroyed || child.exitCode !== null || child.signalCode !== null || gate.failed)
+        throw new Error('The execution gate closed before work was admitted.');
+    gate.released = true;
+    child.stdin.write(Buffer.from([1]));
+}
+function remaining(deadline) {
+    const ms = deadline - Date.now();
+    if (ms <= 0)
+        throw new Error('Service operation exceeded its deadline.');
+    return Math.min(ms, 5000);
+}
+export function processIdentityMatches(a, b) {
+    // exec and process.title may change argv without ending this process lifetime.
+    // The command hash records initial provenance; it is not a death signal.
+    // macProcessVersion changes on exec. It is an atomic signal token, not the
+    // process lifetime; native birth retains microsecond precision across exec.
+    return a.pid === b.pid && a.birth === b.birth && a.owner === b.owner;
+}
+/** Raw command lines are hashed here; they can contain harness credentials. */
+async function processTable(pid, deadline, handover) {
+    if (process.platform === 'win32') {
+        const pids = pid === null ? null : [...new Set(Array.isArray(pid) ? pid : [pid])];
+        if (pids && (!pids.length || pids.some((id) => !Number.isSafeInteger(id) || id <= 0 || id > 0xffffffff)))
+            throw new Error('Invalid Windows process identity.');
+        const filter = handover ? ` -Filter \"ProcessId <> $PID AND CommandLine like '%--lifecycle-handover=${handover}%'\"` : pids === null ? '' : ` -Filter '${pids.map((id) => `ProcessId=${id}`).join(' OR ')}'`;
+        const script = `$ErrorActionPreference='Stop'; $sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value; @(Get-CimInstance Win32_Process${filter} | ForEach-Object { $p=$_; $o=Invoke-CimMethod -InputObject $p -MethodName GetOwnerSid; if ($o.ReturnValue -eq 0 -and $o.Sid -eq $sid) { [pscustomobject]@{pid=[int]$p.ProcessId;ppid=[int]$p.ParentProcessId;owner=$o.Sid;birth=$p.CreationDate.ToUniversalTime().ToString('O');command=$p.CommandLine} } }) | ConvertTo-Json -Compress`;
+        const { stdout } = await execute('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], {
+            windowsHide: true, timeout: remaining(deadline), maxBuffer: 8 * 1024 * 1024,
+        });
+        const parsed = JSON.parse(stdout.trim() || '[]');
+        const rows = Array.isArray(parsed) ? parsed : [parsed];
+        return rows.map((raw) => {
+            const r = raw;
+            if (!Number.isInteger(r.pid) || !Number.isInteger(r.ppid) || typeof r.owner !== 'string' || typeof r.birth !== 'string' || typeof r.command !== 'string') {
+                throw new Error('Windows process identity is unavailable.');
+            }
+            return { pid: r.pid, ppid: r.ppid, owner: r.owner, birth: r.birth, commandHash: createHash('sha256').update(r.command).digest('hex') };
+        });
+    }
+    let stdout;
+    try {
+        ({ stdout } = await execute('/bin/ps', [pid === null ? '-axo' : '-o', 'pid=,ppid=,pgid=,uid=,lstart=,command=', ...(pid === null ? [] : ['-p', String(pid)])], {
+            timeout: remaining(deadline), maxBuffer: 8 * 1024 * 1024, env: { ...process.env, LC_ALL: 'C' },
+        }));
+    }
+    catch (error) {
+        if (typeof pid === 'number' && error.code === 1 && !processIsAlive(pid))
+            return [];
+        throw new Error('Could not verify the operating system process identity.', { cause: error });
+    }
+    return stdout.split('\n').filter((line) => line.trim() && (!handover || line.includes('--lifecycle-handover=' + handover))).map((line) => {
+        const match = line.match(/^\s*(\d+)\s+(\d+)\s+(\d+)\s+(\d+)\s+(\S+\s+\S+\s+\d+\s+\d\d:\d\d:\d\d\s+\d{4})\s+(.+)$/);
+        if (!match)
+            throw new Error('Operating system returned an unreadable process identity.');
+        return { pid: Number(match[1]), ppid: Number(match[2]), pgid: Number(match[3]), owner: match[4], birth: match[5].replace(/\s+/g, ' '), commandHash: createHash('sha256').update(match[6]).digest('hex') };
+    });
+}
+/** Non-secret handover identity closes the spawn-before-PID-recording gap. */
+export async function findHandoverProcesses(nonce, deadline) {
+    if (!/^[\da-f-]{36}$/i.test(nonce))
+        throw new Error('Invalid handover identity.');
+    const found = await processTable(null, deadline, nonce);
+    if (process.platform !== 'darwin')
+        return found;
+    const precise = [];
+    for (const candidate of found) {
+        const current = await inspectMacProcess(candidate.pid, deadline);
+        if (current)
+            precise.push({ ...current, commandHash: candidate.commandHash });
+    }
+    return precise;
+}
+export async function inspectProcess(pid, deadline = Date.now() + 5000) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        throw new Error('Invalid process identity.');
+    // The native query distinguishes permission failure from ESRCH and excludes
+    // zombies: an unreaped PID is no longer executing, even if kill(pid, 0) sees it.
+    if (process.platform === 'darwin')
+        return inspectMacProcess(pid, deadline);
+    const found = (await processTable(pid, deadline)).find((row) => row.pid === pid);
+    if (found)
+        return found;
+    if (processIsAlive(pid))
+        throw new Error(`Process ${pid} exists but its ownership could not be verified.`);
+    return null;
+}
+/** Follow only recorded lifetimes; a reused parent cannot acquire older children. */
+export function ownedProcessTree(root, rows, known = []) {
+    const current = rows.find((row) => row.pid === root.pid);
+    const seeds = new Map([root, ...known].map((row) => [row.pid, row]));
+    const found = new Map();
+    for (const seed of seeds.values()) {
+        const alive = rows.find((row) => processIdentityMatches(seed, row));
+        if (alive)
+            found.set(alive.pid, alive);
+    }
+    const born = (row) => {
+        const time = Date.parse(row.birth);
+        if (!Number.isFinite(time))
+            throw new Error('Process creation time is unavailable.');
+        return time;
+    };
+    // Dedicated POSIX process groups outlive their original shell wrapper.
+    if (root.pgid === root.pid) {
+        for (const row of rows)
+            if (row.owner === root.owner && row.pgid === root.pgid && born(row) >= born(root)
+                && (!current || processIdentityMatches(root, current) || born(row) < born(current)))
+                found.set(row.pid, row);
+    }
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const row of rows) {
+            if (row.owner !== root.owner || found.has(row.pid))
+                continue;
+            const parent = found.get(row.ppid) ?? seeds.get(row.ppid);
+            if (!parent || born(row) < born(parent))
+                continue;
+            const replacement = rows.find((candidate) => candidate.pid === parent.pid);
+            if (replacement && !processIdentityMatches(parent, replacement) && born(row) >= born(replacement))
+                continue;
+            found.set(row.pid, row);
+            changed = true;
+        }
+    }
+    return [...found.values()];
+}
+export async function inspectProcessTree(root, deadline = Date.now() + 5000, known = []) {
+    if (process.platform === 'darwin' && root.macCoalition) {
+        const members = await inspectMacCoalition(root.macCoalition, deadline);
+        const bridge = await inspectProcess(root.pid, deadline);
+        const liveBridge = bridge && processIdentityMatches(root, bridge) ? { ...bridge, macCoalition: root.macCoalition } : null;
+        if (!members.length && !liveBridge) {
+            await unloadMacExecution(root.macCoalition, deadline);
+            // No job may be queued to launch again when empty is accepted.
+            if ((await inspectMacCoalition(root.macCoalition, deadline)).length)
+                throw new Error('Owned Mac execution is still closing. Retry the command.');
+        }
+        return [...(liveBridge ? [liveBridge] : []), ...members];
+    }
+    if (process.platform === 'win32' && root.windowsJob) {
+        const job = await inspectWindowsJob(root.windowsJob, deadline);
+        // Inspect only the kernel Job's members and its helper. Querying every
+        // desktop process's owner can consume the whole local recovery deadline.
+        const rows = await processTable([root.pid, ...job.pids], deadline);
+        const helper = rows.find((row) => processIdentityMatches(root, row));
+        if (!job.exists) {
+            // The helper may have closed its empty job just before returning. Its
+            // verified remaining lifetime still counts as owned work until it exits.
+            return helper ? [{ ...helper, windowsJob: root.windowsJob }] : [];
+        }
+        const latest = await inspectWindowsJob(root.windowsJob, deadline);
+        const members = rows.filter((row) => latest.pids.includes(row.pid));
+        if (members.some((row) => row.owner !== root.owner))
+            throw new Error('Windows execution ownership changed.');
+        // Membership can change during the OS table read. A newly observed member
+        // without a verified lifetime is unknown, never successful closure.
+        if (latest.pids.some((pid) => !members.some((row) => row.pid === pid)))
+            throw new Error('Windows execution membership changed during inspection. Retry the command.');
+        return [...(helper ? [{ ...helper, windowsJob: root.windowsJob }] : []), ...members];
+    }
+    if (process.platform === 'win32')
+        throw new Error('This execution has no durable Windows boundary. Its closure cannot be verified.');
+    return ownedProcessTree(root, process.platform === 'darwin' ? await inspectMacProcesses(deadline) : await processTable(null, deadline), known);
+}
+/** The controller first records interruption intent, then ends only this owner. */
+export async function terminateOwnedRoot(root, deadline) {
+    if (process.platform === 'darwin')
+        return signalMacProcess(root, deadline);
+    if (process.platform === 'win32') {
+        await inspectWindowsProcess(root, deadline, true);
+        return;
+    }
+    const current = await inspectProcess(root.pid, deadline);
+    if (!current || !processIdentityMatches(root, current))
+        return;
+    try {
+        process.kill(root.pid, 'SIGKILL');
+    }
+    catch (error) {
+        const after = await inspectProcess(root.pid, deadline);
+        if (after && processIdentityMatches(root, after))
+            throw error;
+    }
+}
+async function signalOwnedProcess(identity, force, deadline) {
+    if (process.platform === 'darwin') {
+        if (!force)
+            throw new Error('Owned Mac execution requires explicit force to interrupt.');
+        return signalMacProcess(identity, deadline);
+    }
+    if (process.platform === 'win32') {
+        if (!force)
+            throw new Error('Windows owned execution requires explicit force to interrupt.');
+        await inspectWindowsProcess(identity, deadline, true);
+        return;
+    }
+    const actual = await inspectProcess(identity.pid, deadline);
+    if (!actual || !processIdentityMatches(identity, actual))
+        return;
+    try {
+        process.kill(identity.pid, force ? 'SIGKILL' : 'SIGTERM');
+    }
+    catch (error) {
+        const after = await inspectProcess(identity.pid, deadline);
+        if (after && processIdentityMatches(identity, after))
+            throw error;
+    }
+}
+/** Only use for recorded owned roots. Absence and inspection failure differ. */
+export async function terminateOwnedTree(root, { force, deadline, known = [] }) {
+    if (process.platform === 'darwin' && root.macCoalition) {
+        if (!force)
+            throw new Error('Owned Mac execution requires explicit force to interrupt.');
+        // Remove the only launch trigger first. AbandonProcessGroup keeps bootout
+        // from making any broader, unverified process-group signal on our behalf.
+        await unloadMacExecution(root.macCoalition, deadline);
+        for (const member of await inspectMacCoalition(root.macCoalition, deadline))
+            await signalMacMember(member, deadline, 'TERM');
+        // One bounded grace period lets normal signal handlers save and close.
+        // Its deadline never resets as descendants fork or membership changes.
+        const gracefulUntil = Math.min(deadline, Date.now() + 500);
+        while (Date.now() < gracefulUntil) {
+            if (!(await inspectMacCoalition(root.macCoalition, deadline)).length)
+                break;
+            await new Promise((resolve) => setTimeout(resolve, Math.min(25, gracefulUntil - Date.now())));
+        }
+        while (Date.now() < deadline) {
+            for (const member of await inspectMacCoalition(root.macCoalition, deadline))
+                await signalMacMember(member, deadline);
+            await signalOwnedProcess(root, true, deadline);
+            if (!(await inspectProcessTree(root, deadline)).length)
+                return;
+            await new Promise((resolve) => setTimeout(resolve, 25));
+        }
+        throw new Error('Owned Mac execution is still present. No replacement can start.');
+    }
+    if (process.platform === 'win32' && root.windowsJob) {
+        if (!force)
+            throw new Error('Windows owned execution requires explicit force to interrupt.');
+        await inspectWindowsJob(root.windowsJob, deadline, true);
+        // A helper still waiting for a grant owns an empty job and must also exit.
+        await signalOwnedProcess(root, true, deadline);
+        while (Date.now() < deadline) {
+            if (!(await inspectProcessTree(root, deadline)).length) {
+                remaining(deadline);
+                return;
+            }
+            await new Promise((resolve) => setTimeout(resolve, 25));
+        }
+        throw new Error('Owned execution is still present. No replacement can start.');
+    }
+    const owned = new Map(known.map((identity) => [identity.pid, identity]));
+    owned.set(root.pid, root);
+    for (const identity of await inspectProcessTree(root, deadline, known))
+        owned.set(identity.pid, identity);
+    if (!force && process.platform === 'win32')
+        throw new Error('Windows owned execution requires explicit force to interrupt.');
+    const current = await inspectProcess(root.pid, deadline);
+    if (current && processIdentityMatches(root, current)) {
+        if (process.platform === 'win32') {
+            await signalOwnedProcess(root, true, deadline);
+        }
+        else {
+            // Spawning paths create dedicated groups; never signal a caller's group.
+            for (const identity of [...owned.values()].reverse()) {
+                await signalOwnedProcess(identity, false, deadline);
+            }
+            if (force)
+                await new Promise((resolve) => setTimeout(resolve, Math.min(500, remaining(deadline))));
+        }
+    }
+    while (Date.now() < deadline) {
+        // A child can be created after the first snapshot while its wrapper is
+        // being stopped. The dedicated group remains observable after that wrapper
+        // exits; do not conclude closure from the original PID list alone.
+        for (const identity of await inspectProcessTree(root, deadline, [...owned.values()]))
+            owned.set(identity.pid, identity);
+        let surviving = false;
+        for (const identity of owned.values()) {
+            const actual = await inspectProcess(identity.pid, deadline);
+            if (!actual || !processIdentityMatches(identity, actual))
+                continue;
+            surviving = true;
+            for (const child of await inspectProcessTree(actual, deadline))
+                owned.set(child.pid, child);
+            await signalOwnedProcess(actual, force, deadline);
+        }
+        if (!surviving)
+            return;
+        await new Promise((resolve) => setTimeout(resolve, 40));
+    }
+    throw new Error('Owned execution is still present. No replacement can start.');
+}
+export async function osBootIdentity(deadline = Date.now() + 5000) {
+    if (process.platform === 'darwin') {
+        const { stdout } = await execute('/usr/sbin/sysctl', ['-n', 'kern.bootsessionuuid'], { timeout: remaining(deadline) });
+        if (!/^[\da-f-]{36}$/i.test(stdout.trim()))
+            throw new Error('Mac boot identity is unavailable.');
+        return stdout.trim();
+    }
+    if (process.platform === 'win32') {
+        const { stdout } = await execute('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', "(Get-CimInstance Win32_OperatingSystem).LastBootUpTime.ToUniversalTime().ToString('O')"], { windowsHide: true, timeout: remaining(deadline) });
+        if (!Number.isFinite(Date.parse(stdout.trim())))
+            throw new Error('Windows boot identity is unavailable.');
+        return stdout.trim();
+    }
+    return (await readFile('/proc/sys/kernel/random/boot_id', 'utf8')).trim();
+}
+export async function loopbackListenerPid(port, deadline) {
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        throw new Error('Invalid local listener port.');
+    try {
+        if (process.platform === 'win32') {
+            const { stdout } = await execute('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', `@(Get-NetTCPConnection -LocalPort ${port} -State Listen -ErrorAction SilentlyContinue | Where-Object { $_.LocalAddress -eq '127.0.0.1' } | Select-Object -ExpandProperty OwningProcess -Unique) | ConvertTo-Json -Compress`], { windowsHide: true, timeout: remaining(deadline) });
+            const value = JSON.parse(stdout.trim() || '[]');
+            const pids = Array.isArray(value) ? value : [value];
+            if (pids.length === 0)
+                return null;
+            if (pids.length !== 1 || !Number.isInteger(pids[0]))
+                throw new Error('Listener ownership is ambiguous.');
+            return pids[0];
+        }
+        const { stdout } = await execute('/usr/sbin/lsof', ['-nP', '-a', '-iTCP:' + port, '-sTCP:LISTEN', '-Fp'], { timeout: remaining(deadline) });
+        const pids = [...new Set(stdout.split('\n').filter((s) => /^p\d+$/.test(s)).map((s) => Number(s.slice(1))))];
+        if (pids.length !== 1)
+            throw new Error('Listener ownership is ambiguous.');
+        return pids[0];
+    }
+    catch (error) {
+        if (error.code === 1)
+            return null;
+        throw error;
+    }
+}
 /** Does this binary have to go through `cmd.exe` to run at all? Scoped to the
  *  binary rather than to the platform: a real `.exe` on Windows runs directly,
  *  and putting it through a shell would re-parse its argv for nothing. */
@@ -122,6 +567,24 @@ export function killTree(child, { platform = process.platform, spawnProcess = sp
             /* Already gone. `close` still fires and reports the outcome. */
         }
     };
+    if (ownedChildren.has(child)) {
+        const owned = ownedChildren.get(child);
+        if (platform === 'darwin' && owned.identity?.macCoalition) {
+            void (async () => {
+                // Preserve the registered bridge lifetime even after its PID is reused.
+                await terminateOwnedTree(owned.identity, { force: true, deadline: Date.now() + 30000 });
+            })().catch(() => { console.error('The owned Mac execution could not be stopped. Run cs stop --force to retry.'); });
+            return;
+        }
+        if (platform !== 'win32' && typeof child.pid === 'number' && child.exitCode === null && child.signalCode === null) {
+            try {
+                process.kill(-child.pid, 'SIGKILL');
+                return;
+            }
+            catch { /* The native handle below confirms root closure. */ }
+        }
+        return direct();
+    }
     if (platform !== 'win32' || typeof child.pid !== 'number')
         return direct();
     try {