@lesliechan721/agent-skill-eval 0.1.0-beta.7 → 0.1.0-beta.9

package/dist/codex-eval-process-tree.js

@@ -0,0 +1,803 @@
+import { execFile, spawn } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+const PROCESS_TERMINATION_GRACE_MS = 1_000;
+const PROCESS_KILL_CONFIRMATION_MS = 1_000;
+const PROCESS_FROZEN_TREE_KILL_CONFIRMATION_MS = 2_000;
+const PROCESS_TREE_POLL_MS = 250;
+const PROCESS_TOKEN_SCAN_TIMEOUT_MS = 3_000;
+export const CODEX_EVAL_PROCESS_TREE_ID_ENV = 'AW_CODEX_EVAL_PROCESS_TREE_ID';
+export const PROCESS_TREE_CLEANUP_UNCONFIRMED_PREFIX = 'Could not confirm process-tree cleanup';
+export function createDirectChildProcessMonitor(child) {
+    let terminationPromise;
+    return {
+        terminate: () => {
+            terminationPromise ??= new Promise((resolve) => {
+                if (child.exitCode !== null || child.signalCode !== null) {
+                    resolve([]);
+                    return;
+                }
+                let closed = false;
+                let settled = false;
+                let forceTimer;
+                let settleTimer;
+                const settle = (diagnostics) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    if (forceTimer)
+                        clearTimeout(forceTimer);
+                    if (settleTimer)
+                        clearTimeout(settleTimer);
+                    child.off('close', onClose);
+                    resolve(diagnostics);
+                };
+                const onClose = () => {
+                    closed = true;
+                    settle([]);
+                };
+                child.once('close', onClose);
+                try {
+                    child.kill('SIGTERM');
+                }
+                catch {
+                    // The direct child can close before SIGTERM is delivered.
+                }
+                forceTimer = setTimeout(() => {
+                    if (closed || child.exitCode !== null || child.signalCode !== null)
+                        return;
+                    try {
+                        child.kill('SIGKILL');
+                    }
+                    catch {
+                        // The direct child can close before SIGKILL is delivered.
+                    }
+                }, 1_000);
+                settleTimer = setTimeout(() => {
+                    settle(closed || child.exitCode !== null || child.signalCode !== null
+                        ? []
+                        : ['Could not confirm direct eval child termination; descendants are not tracked.']);
+                }, 2_000);
+            });
+            return terminationPromise;
+        },
+    };
+}
+export function processTreeCleanupIsUnconfirmed(diagnostics) {
+    return diagnostics.some((entry) => entry.startsWith(PROCESS_TREE_CLEANUP_UNCONFIRMED_PREFIX) ||
+        entry.startsWith('Could not confirm process-tree termination') ||
+        entry.startsWith('Could not confirm Windows process-tree termination') ||
+        entry.startsWith('Could not verify Windows process-tree termination'));
+}
+export function scrubProcessTreeId(value, treeId) {
+    if (typeof value === 'string') {
+        return value.replaceAll(treeId, '[process-tree-id]');
+    }
+    if (Array.isArray(value)) {
+        return value.map((entry) => scrubProcessTreeId(entry, treeId));
+    }
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([key, entry]) => [
+            scrubProcessTreeId(key, treeId),
+            scrubProcessTreeId(entry, treeId),
+        ]));
+    }
+    return value;
+}
+function delay(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+async function readPosixProcessTable(timeoutMs = PROCESS_TERMINATION_GRACE_MS) {
+    const result = await execFileAsync('/bin/ps', ['-Ao', 'pid=,ppid=,state=,lstart='], {
+        encoding: 'utf8',
+        maxBuffer: 4 * 1024 * 1024,
+        timeout: timeoutMs,
+    });
+    const table = new Map();
+    for (const line of result.stdout.split('\n')) {
+        const [pidText, ppidText, state, ...startTimeParts] = line.trim().split(/\s+/u);
+        const pid = Number(pidText);
+        const ppid = Number(ppidText);
+        const startTime = startTimeParts.join(' ');
+        if (Number.isInteger(pid) && Number.isInteger(ppid) && state && startTime) {
+            table.set(pid, { ppid, state, startTime });
+        }
+    }
+    return table;
+}
+async function readTaggedPosixProcessTable(treeId, timeoutMs = PROCESS_TERMINATION_GRACE_MS) {
+    const marker = `${CODEX_EVAL_PROCESS_TREE_ID_ENV}=${treeId}`;
+    const table = new Map();
+    return new Promise((resolve, reject) => {
+        const child = spawn('/bin/ps', ['eww', '-Ao', 'pid=,ppid=,state=,lstart=,command='], { stdio: ['ignore', 'pipe', 'ignore'] });
+        let linePrefix = '';
+        let markerTail = '';
+        let lineHasMarker = false;
+        let settled = false;
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeout);
+            if (error)
+                reject(error);
+            else
+                resolve(table);
+        };
+        const finishLine = () => {
+            if (lineHasMarker) {
+                const match = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(\S+\s+\S+\s+\d+\s+\S+\s+\d+)/u.exec(linePrefix);
+                if (match) {
+                    const pid = Number(match[1]);
+                    const ppid = Number(match[2]);
+                    if (Number.isInteger(pid) && Number.isInteger(ppid)) {
+                        table.set(pid, {
+                            ppid,
+                            state: match[3],
+                            startTime: match[4].split(/\s+/u).join(' '),
+                        });
+                    }
+                }
+            }
+            linePrefix = '';
+            markerTail = '';
+            lineHasMarker = false;
+        };
+        child.stdout.setEncoding('utf8');
+        child.stdout.on('data', (chunk) => {
+            for (const segment of chunk.split(/(\n)/u)) {
+                if (segment === '\n') {
+                    finishLine();
+                    continue;
+                }
+                if (linePrefix.length < 256) {
+                    linePrefix += segment.slice(0, 256 - linePrefix.length);
+                }
+                const markerCandidate = markerTail + segment;
+                if (markerCandidate.includes(marker))
+                    lineHasMarker = true;
+                markerTail = markerCandidate.slice(-(marker.length - 1));
+            }
+        });
+        child.once('error', finish);
+        child.once('close', (exitCode, signal) => {
+            finishLine();
+            if (exitCode === 0)
+                finish();
+            else
+                finish(new Error(`POSIX process-tree token scan failed: exit=${String(exitCode)}, signal=${String(signal)}.`));
+        });
+        const timeout = setTimeout(() => {
+            try {
+                child.kill('SIGKILL');
+            }
+            catch {
+                // The ps subprocess can exit before the timeout fallback.
+            }
+            finish(new Error(`POSIX process-tree token scan exceeded ${timeoutMs}ms.`));
+        }, timeoutMs);
+        timeout.unref();
+    });
+}
+function readTaggedPosixProcessTableWithTimeout(treeId, readTaggedProcessTable, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if ('table' in result)
+                resolve(result.table);
+            else
+                reject(result.error);
+        };
+        const timer = setTimeout(() => finish({
+            error: new Error(`POSIX process-tree token scan exceeded ${timeoutMs}ms.`),
+        }), timeoutMs);
+        timer.unref();
+        Promise.resolve().then(() => readTaggedProcessTable(treeId, timeoutMs)).then((table) => finish({ table }), (error) => finish({ error }));
+    });
+}
+function readPosixProcessTableWithTimeout(readProcessTable, timeoutMs, stage) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if ('table' in result)
+                resolve(result.table);
+            else
+                reject(result.error);
+        };
+        const timer = setTimeout(() => finish({
+            error: new Error(`POSIX process-tree ${stage} scan exceeded ${timeoutMs}ms.`),
+        }), timeoutMs);
+        timer.unref();
+        Promise.resolve().then(() => readProcessTable(timeoutMs)).then((table) => finish({ table }), (error) => finish({ error }));
+    });
+}
+function recordKnownDescendants(root, knownDescendants, table) {
+    const childrenByParent = new Map();
+    for (const [pid, entry] of table) {
+        const children = childrenByParent.get(entry.ppid) ?? [];
+        children.push(pid);
+        childrenByParent.set(entry.ppid, children);
+    }
+    const roots = [root, ...knownDescendants.values()].filter((identity) => table.get(identity.pid)?.startTime === identity.startTime);
+    const queue = roots.map((identity) => identity.pid);
+    const visited = new Set(queue);
+    while (queue.length > 0) {
+        const parent = queue.shift();
+        for (const childPid of childrenByParent.get(parent) ?? []) {
+            if (visited.has(childPid))
+                continue;
+            visited.add(childPid);
+            const entry = table.get(childPid);
+            const knownIdentity = knownDescendants.get(childPid);
+            if (knownIdentity && knownIdentity.startTime !== entry.startTime)
+                continue;
+            knownDescendants.set(childPid, {
+                pid: childPid,
+                startTime: entry.startTime,
+            });
+            queue.push(childPid);
+        }
+    }
+}
+function processIsRunning(table, identity) {
+    const entry = table.get(identity.pid);
+    return entry !== undefined &&
+        entry.startTime === identity.startTime &&
+        !entry.state.startsWith('Z');
+}
+function signalPosixPid(pid, signal, kill = process.kill.bind(process)) {
+    try {
+        kill(pid, signal);
+        return true;
+    }
+    catch (error) {
+        if (error.code !== 'ESRCH')
+            throw error;
+        return false;
+    }
+}
+function signalKnownPosixTree(root, knownDescendants, table, signal, kill = process.kill.bind(process)) {
+    for (const identity of [...knownDescendants.values()].reverse()) {
+        if (processIsRunning(table, identity))
+            signalPosixPid(identity.pid, signal, kill);
+    }
+    if (processIsRunning(table, root))
+        signalPosixPid(root.pid, signal, kill);
+}
+function signalPosixProcessGroup(rootPid, signal, kill = process.kill.bind(process)) {
+    try {
+        kill(-rootPid, signal);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== 'ESRCH' && code !== 'EPERM')
+            throw error;
+    }
+}
+function posixProcessGroupIsRunning(rootPid, kill = process.kill.bind(process)) {
+    try {
+        kill(-rootPid, 0);
+        return true;
+    }
+    catch (error) {
+        const code = error.code;
+        return code !== 'ESRCH' && code !== 'EPERM';
+    }
+}
+function knownPosixTreeIsFrozen(root, knownDescendants, table) {
+    return [root, ...knownDescendants.values()].every((identity) => {
+        const entry = table.get(identity.pid);
+        return entry === undefined ||
+            entry.startTime !== identity.startTime ||
+            entry.state.startsWith('T') ||
+            entry.state.startsWith('Z');
+    });
+}
+function knownPosixTreeIsRunning(root, knownDescendants, table) {
+    return [root, ...knownDescendants.values()].some((identity) => processIsRunning(table, identity));
+}
+async function terminatePosixProcessGroupFallback(rootPid, kill, allowed = true, deadline = Date.now() + PROCESS_KILL_CONFIRMATION_MS) {
+    if (!allowed)
+        return false;
+    while (Date.now() < deadline) {
+        signalPosixProcessGroup(rootPid, 'SIGKILL', kill);
+        if (!posixProcessGroupIsRunning(rootPid, kill))
+            return true;
+        const remainingMs = deadline - Date.now();
+        if (remainingMs > 0) {
+            await delay(Math.min(PROCESS_TREE_POLL_MS, remainingMs));
+        }
+    }
+    return false;
+}
+async function terminateKnownPosixProcessTree(rootPid, dependencies = {}, observedRoot, observedDescendants = new Map(), observedTable, preFrozen = false) {
+    const readProcessTable = dependencies.readProcessTable ?? readPosixProcessTable;
+    const kill = dependencies.kill ?? process.kill.bind(process);
+    const diagnostics = [];
+    const knownDescendants = new Map(observedDescendants);
+    const canUseProcessGroup = () => dependencies.canUseProcessGroup?.() ?? true;
+    const allowRootIdentityDiscovery = dependencies.allowRootIdentityDiscovery ?? true;
+    let table;
+    let root;
+    if (preFrozen &&
+        observedTable &&
+        (observedRoot || knownDescendants.size > 0)) {
+        root = observedRoot ?? { pid: rootPid, startTime: '<unobserved-root>' };
+        table = observedTable;
+        const killDeadline = Date.now() + PROCESS_FROZEN_TREE_KILL_CONFIRMATION_MS;
+        signalKnownPosixTree(root, knownDescendants, table, 'SIGKILL', kill);
+        while (Date.now() < killDeadline) {
+            try {
+                const remainingMs = killDeadline - Date.now();
+                if (remainingMs <= 0)
+                    break;
+                table = await readPosixProcessTableWithTimeout(readProcessTable, remainingMs, 'kill-confirmation');
+                recordKnownDescendants(root, knownDescendants, table);
+                signalKnownPosixTree(root, knownDescendants, table, 'SIGKILL', kill);
+                if (!knownPosixTreeIsRunning(root, knownDescendants, table)) {
+                    return diagnostics;
+                }
+            }
+            catch (error) {
+                diagnostics.push(`Could not verify the pre-frozen POSIX process tree after SIGKILL: ${error instanceof Error ? error.message : String(error)}`);
+                if (await terminatePosixProcessGroupFallback(rootPid, kill, canUseProcessGroup(), killDeadline))
+                    return diagnostics;
+                break;
+            }
+            const remainingMs = killDeadline - Date.now();
+            if (remainingMs > 0) {
+                await delay(Math.min(PROCESS_TREE_POLL_MS, remainingMs));
+            }
+        }
+        diagnostics.push(`Could not confirm process-tree termination within ` +
+            `${PROCESS_FROZEN_TREE_KILL_CONFIRMATION_MS}ms after SIGKILL; process ${rootPid} ` +
+            'or one of its descendants may still be running.');
+        return diagnostics;
+    }
+    const freezeDeadline = Date.now() + PROCESS_TERMINATION_GRACE_MS;
+    try {
+        const initialRemainingMs = freezeDeadline - Date.now();
+        if (initialRemainingMs <= 0) {
+            throw new Error('POSIX process-tree initial scan deadline was exhausted.');
+        }
+        table = await readPosixProcessTableWithTimeout(readProcessTable, initialRemainingMs, 'initial');
+        const rootEntry = table.get(rootPid);
+        if (observedRoot) {
+            root = observedRoot;
+            recordKnownDescendants(root, knownDescendants, table);
+        }
+        else if (!allowRootIdentityDiscovery ||
+            !rootEntry ||
+            rootEntry.state.startsWith('Z')) {
+            if (knownDescendants.size > 0) {
+                root = { pid: rootPid, startTime: '<unobserved-root>' };
+            }
+            else {
+                const killDeadline = Date.now() + PROCESS_KILL_CONFIRMATION_MS;
+                if (await terminatePosixProcessGroupFallback(rootPid, kill, canUseProcessGroup(), killDeadline))
+                    return diagnostics;
+                diagnostics.push(`${PROCESS_TREE_CLEANUP_UNCONFIRMED_PREFIX}: root identity and process-group ` +
+                    `ownership for ${rootPid} are unavailable.`);
+                return diagnostics;
+            }
+        }
+        else {
+            root = { pid: rootPid, startTime: rootEntry.startTime };
+        }
+        signalKnownPosixTree(root, knownDescendants, table, 'SIGSTOP', kill);
+    }
+    catch (error) {
+        diagnostics.push(`Could not inspect and freeze the POSIX process tree: ${error instanceof Error ? error.message : String(error)}`);
+        const killDeadline = Date.now() + PROCESS_KILL_CONFIRMATION_MS;
+        if (observedTable && (observedRoot || knownDescendants.size > 0)) {
+            const fallbackRoot = observedRoot ?? {
+                pid: rootPid,
+                startTime: '<unobserved-root>',
+            };
+            signalKnownPosixTree(fallbackRoot, knownDescendants, observedTable, 'SIGKILL', kill);
+        }
+        if (!(await terminatePosixProcessGroupFallback(rootPid, kill, canUseProcessGroup(), killDeadline))) {
+            diagnostics.push(`${PROCESS_TREE_CLEANUP_UNCONFIRMED_PREFIX}: no fresh POSIX snapshot or trusted ` +
+                `process-group ownership is available for ${rootPid}.`);
+        }
+        return diagnostics;
+    }
+    let useProcessGroupFallback = false;
+    while (Date.now() < freezeDeadline) {
+        try {
+            const remainingMs = freezeDeadline - Date.now();
+            if (remainingMs <= 0)
+                break;
+            table = await readPosixProcessTableWithTimeout(readProcessTable, remainingMs, 'lineage');
+            recordKnownDescendants(root, knownDescendants, table);
+            signalKnownPosixTree(root, knownDescendants, table, 'SIGSTOP', kill);
+            if (knownPosixTreeIsFrozen(root, knownDescendants, table))
+                break;
+        }
+        catch (error) {
+            diagnostics.push(`Could not refresh the frozen POSIX process tree; used process-group fallback: ${error instanceof Error ? error.message : String(error)}`);
+            useProcessGroupFallback = true;
+            break;
+        }
+        const remainingMs = freezeDeadline - Date.now();
+        if (remainingMs > 0) {
+            await delay(Math.min(PROCESS_TREE_POLL_MS, remainingMs));
+        }
+    }
+    if (!useProcessGroupFallback && !knownPosixTreeIsFrozen(root, knownDescendants, table)) {
+        diagnostics.push(`Could not confirm process-tree freeze within ${PROCESS_TERMINATION_GRACE_MS}ms; ` +
+            'continued with SIGKILL.');
+    }
+    const killDeadline = Date.now() + PROCESS_KILL_CONFIRMATION_MS;
+    signalKnownPosixTree(root, knownDescendants, table, 'SIGKILL', kill);
+    if (useProcessGroupFallback) {
+        if (await terminatePosixProcessGroupFallback(rootPid, kill, canUseProcessGroup(), killDeadline))
+            return diagnostics;
+    }
+    else {
+        while (Date.now() < killDeadline) {
+            try {
+                const remainingMs = killDeadline - Date.now();
+                if (remainingMs <= 0)
+                    break;
+                table = await readPosixProcessTableWithTimeout(readProcessTable, remainingMs, 'kill-confirmation');
+                recordKnownDescendants(root, knownDescendants, table);
+                signalKnownPosixTree(root, knownDescendants, table, 'SIGKILL', kill);
+                if (!knownPosixTreeIsRunning(root, knownDescendants, table))
+                    return diagnostics;
+            }
+            catch (error) {
+                diagnostics.push(`Could not verify the frozen POSIX process tree after SIGKILL; ` +
+                    `used process-group fallback: ${error instanceof Error ? error.message : String(error)}`);
+                useProcessGroupFallback = true;
+                break;
+            }
+            const remainingMs = killDeadline - Date.now();
+            if (remainingMs > 0) {
+                await delay(Math.min(PROCESS_TREE_POLL_MS, remainingMs));
+            }
+        }
+        if (!useProcessGroupFallback) {
+            diagnostics.push(`Could not confirm process-tree termination within ${PROCESS_KILL_CONFIRMATION_MS}ms ` +
+                `after SIGKILL; process ${rootPid} or one of its descendants may still be running.`);
+            return diagnostics;
+        }
+        if (await terminatePosixProcessGroupFallback(rootPid, kill, canUseProcessGroup(), killDeadline))
+            return diagnostics;
+    }
+    diagnostics.push(`Could not confirm process-tree termination within ${PROCESS_KILL_CONFIRMATION_MS}ms after SIGKILL; ` +
+        `process group ${rootPid} may still be running.`);
+    return diagnostics;
+}
+export async function terminatePosixProcessTree(rootPid, dependencies = {}) {
+    return terminateKnownPosixProcessTree(rootPid, dependencies);
+}
+export function createPosixProcessTreeMonitor(rootPid, dependencies = {}) {
+    const readProcessTable = dependencies.readProcessTable ?? readPosixProcessTable;
+    const readTaggedProcessTable = dependencies.readTaggedProcessTable ??
+        readTaggedPosixProcessTable;
+    const kill = dependencies.kill ?? process.kill.bind(process);
+    let observedRoot;
+    const observedDescendants = new Map();
+    const diagnostics = [];
+    let stopped = false;
+    let pollTimer;
+    let pendingPoll;
+    let latestValidatedTable;
+    let allowLineageRootBinding = false;
+    const observeTable = (table) => {
+        latestValidatedTable = table;
+        const rootEntry = table.get(rootPid);
+        if (allowLineageRootBinding &&
+            !observedRoot &&
+            rootEntry &&
+            !rootEntry.state.startsWith('Z')) {
+            observedRoot = { pid: rootPid, startTime: rootEntry.startTime };
+        }
+        if (observedRoot) {
+            recordKnownDescendants(observedRoot, observedDescendants, table);
+        }
+    };
+    const observeTaggedTable = (taggedTable, freshTable) => {
+        const taggedRoot = taggedTable.get(rootPid);
+        if (!observedRoot &&
+            taggedRoot &&
+            freshTable.get(rootPid)?.startTime === taggedRoot.startTime) {
+            observedRoot = { pid: rootPid, startTime: taggedRoot.startTime };
+        }
+        for (const [pid, entry] of taggedTable) {
+            if (pid === rootPid)
+                continue;
+            if (freshTable.get(pid)?.startTime !== entry.startTime)
+                continue;
+            const knownIdentity = observedDescendants.get(pid);
+            if (knownIdentity && knownIdentity.startTime !== entry.startTime)
+                continue;
+            observedDescendants.set(pid, { pid, startTime: entry.startTime });
+        }
+    };
+    const signalObservedDescendants = (table, signal) => {
+        for (const identity of [...observedDescendants.values()].reverse()) {
+            if (table.get(identity.pid)?.startTime !== identity.startTime)
+                continue;
+            signalPosixPid(identity.pid, signal, kill);
+        }
+    };
+    const observedDescendantsAreFrozen = (table) => [...observedDescendants.values()].every((identity) => {
+        const entry = table.get(identity.pid);
+        return entry === undefined ||
+            entry.startTime !== identity.startTime ||
+            entry.state.startsWith('T') ||
+            entry.state.startsWith('Z');
+    });
+    const observedTreeIsFrozen = (table) => {
+        const rootFrozen = !observedRoot || knownPosixTreeIsFrozen(observedRoot, new Map(), table);
+        return rootFrozen && observedDescendantsAreFrozen(table);
+    };
+    const recordObservedLineage = (table) => {
+        if (observedRoot) {
+            recordKnownDescendants(observedRoot, observedDescendants, table);
+            return;
+        }
+        for (const identity of [...observedDescendants.values()]) {
+            recordKnownDescendants(identity, observedDescendants, table);
+        }
+    };
+    const stopObservedTree = (table) => {
+        if (observedRoot &&
+            table.get(observedRoot.pid)?.startTime === observedRoot.startTime) {
+            signalPosixPid(observedRoot.pid, 'SIGSTOP', kill);
+        }
+        signalObservedDescendants(table, 'SIGSTOP');
+    };
+    const recordMonitorError = (error) => {
+        if (diagnostics.length === 0) {
+            diagnostics.push(`Could not monitor the POSIX process tree before cleanup: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    };
+    const poll = () => {
+        pendingPoll = readPosixProcessTableWithTimeout(readProcessTable, PROCESS_TERMINATION_GRACE_MS, 'lineage')
+            .then(observeTable, recordMonitorError).finally(() => {
+            pendingPoll = undefined;
+            if (!stopped) {
+                pollTimer = setTimeout(poll, PROCESS_TREE_POLL_MS);
+                pollTimer.unref();
+            }
+        });
+    };
+    let initialRootStopped = false;
+    try {
+        initialRootStopped = signalPosixPid(rootPid, 'SIGSTOP', kill);
+        allowLineageRootBinding = initialRootStopped;
+    }
+    catch (error) {
+        recordMonitorError(error);
+    }
+    pendingPoll = readPosixProcessTableWithTimeout(readProcessTable, PROCESS_TERMINATION_GRACE_MS, 'initial')
+        .then(observeTable, recordMonitorError).finally(() => {
+        allowLineageRootBinding = false;
+        try {
+            if (initialRootStopped)
+                signalPosixPid(rootPid, 'SIGCONT', kill);
+        }
+        catch (error) {
+            recordMonitorError(error);
+        }
+        pendingPoll = undefined;
+        if (!stopped) {
+            pollTimer = setTimeout(poll, PROCESS_TREE_POLL_MS);
+            pollTimer.unref();
+        }
+    });
+    return {
+        terminate: async () => {
+            if (!stopped) {
+                stopped = true;
+                if (pollTimer)
+                    clearTimeout(pollTimer);
+                await pendingPoll;
+            }
+            let tokenCleanupConfirmed = false;
+            if (dependencies.treeId) {
+                const tokenScanDeadline = Date.now() + PROCESS_TOKEN_SCAN_TIMEOUT_MS;
+                while (Date.now() < tokenScanDeadline) {
+                    try {
+                        const preFreezeRemainingMs = tokenScanDeadline - Date.now();
+                        if (preFreezeRemainingMs <= 0)
+                            break;
+                        const preFreezeTable = await readPosixProcessTableWithTimeout(readProcessTable, preFreezeRemainingMs, 'lineage');
+                        latestValidatedTable = preFreezeTable;
+                        recordObservedLineage(preFreezeTable);
+                        stopObservedTree(preFreezeTable);
+                        const freezeConfirmationRemainingMs = tokenScanDeadline - Date.now();
+                        if (freezeConfirmationRemainingMs <= 0)
+                            break;
+                        const freezeConfirmationTable = await readPosixProcessTableWithTimeout(readProcessTable, freezeConfirmationRemainingMs, 'confirmation');
+                        latestValidatedTable = freezeConfirmationTable;
+                        recordObservedLineage(freezeConfirmationTable);
+                        stopObservedTree(freezeConfirmationTable);
+                        if (!observedTreeIsFrozen(freezeConfirmationTable)) {
+                            continue;
+                        }
+                        const remainingMs = tokenScanDeadline - Date.now();
+                        if (remainingMs <= 0)
+                            break;
+                        const taggedTable = await readTaggedPosixProcessTableWithTimeout(dependencies.treeId, readTaggedProcessTable, Math.min(PROCESS_TERMINATION_GRACE_MS, remainingMs));
+                        const tagContainsOnlyFrozenKnownIdentities = [...taggedTable].every(([pid, entry]) => {
+                            const identity = pid === rootPid
+                                ? observedRoot
+                                : observedDescendants.get(pid);
+                            const frozenEntry = freezeConfirmationTable.get(pid);
+                            return identity?.startTime === entry.startTime &&
+                                frozenEntry?.startTime === entry.startTime &&
+                                (frozenEntry.state.startsWith('T') || frozenEntry.state.startsWith('Z'));
+                        });
+                        if (tagContainsOnlyFrozenKnownIdentities) {
+                            tokenCleanupConfirmed = true;
+                            latestValidatedTable = freezeConfirmationTable;
+                            break;
+                        }
+                        const lineageRemainingMs = tokenScanDeadline - Date.now();
+                        if (lineageRemainingMs <= 0)
+                            break;
+                        const lineageTable = await readPosixProcessTableWithTimeout(readProcessTable, lineageRemainingMs, 'lineage');
+                        latestValidatedTable = lineageTable;
+                        observeTaggedTable(taggedTable, lineageTable);
+                        recordObservedLineage(lineageTable);
+                        stopObservedTree(lineageTable);
+                    }
+                    catch (error) {
+                        recordMonitorError(error);
+                        const remainingMs = tokenScanDeadline - Date.now();
+                        if (remainingMs > 0) {
+                            await delay(Math.min(PROCESS_TREE_POLL_MS, remainingMs));
+                        }
+                    }
+                }
+                if (!tokenCleanupConfirmed) {
+                    diagnostics.push(`${PROCESS_TREE_CLEANUP_UNCONFIRMED_PREFIX}: the POSIX token scan did not ` +
+                        `reach a frozen fixed point within ${PROCESS_TOKEN_SCAN_TIMEOUT_MS}ms.`);
+                }
+            }
+            return [
+                ...diagnostics,
+                ...(await terminateKnownPosixProcessTree(rootPid, { ...dependencies, allowRootIdentityDiscovery: false }, observedRoot, observedDescendants, latestValidatedTable, tokenCleanupConfirmed)),
+            ];
+        },
+    };
+}
+function observeChildClose(child) {
+    let closed = Boolean((child.exitCode !== null || child.signalCode !== null) &&
+        child.stdout?.destroyed &&
+        child.stderr?.destroyed);
+    let resolveClose;
+    const closePromise = new Promise((resolve) => {
+        resolveClose = resolve;
+    });
+    const onClose = () => {
+        closed = true;
+        resolveClose?.();
+    };
+    child.once('close', onClose);
+    return {
+        wait: async (timeoutMs) => {
+            if (closed)
+                return true;
+            let timer;
+            const timedOut = new Promise((resolve) => {
+                timer = setTimeout(() => resolve(false), timeoutMs);
+            });
+            const result = await Promise.race([closePromise.then(() => true), timedOut]);
+            if (timer)
+                clearTimeout(timer);
+            return result;
+        },
+        dispose: () => child.off('close', onClose),
+    };
+}
+export function releaseChildProcessHandles(child) {
+    child.stdin?.destroy();
+    child.stdout?.destroy();
+    child.stderr?.destroy();
+    child.unref();
+}
+export async function terminateWindowsProcessTree(child, options = {}) {
+    if (child.pid === undefined)
+        return [];
+    const closeTimeoutMs = options.closeTimeoutMs ?? PROCESS_KILL_CONFIRMATION_MS;
+    const closeObserver = observeChildClose(child);
+    const runTaskkill = options.runTaskkill ?? (async (pid) => {
+        await execFileAsync('taskkill.exe', ['/pid', String(pid), '/t', '/f'], {
+            encoding: 'utf8',
+            timeout: PROCESS_TERMINATION_GRACE_MS * 5,
+            windowsHide: true,
+        });
+    });
+    try {
+        await runTaskkill(child.pid);
+        if (await closeObserver.wait(closeTimeoutMs))
+            return [];
+        releaseChildProcessHandles(child);
+        return [
+            `Could not confirm Windows process-tree termination within ${closeTimeoutMs}ms after taskkill; ` +
+                `process ${child.pid} may still be running.`,
+        ];
+    }
+    catch (error) {
+        const diagnostics = [
+            `Could not verify Windows process-tree termination after taskkill failure: ${error instanceof Error ? error.message : String(error)}`,
+        ];
+        const usedSigkillFallback = child.exitCode === null && child.signalCode === null;
+        if (usedSigkillFallback) {
+            try {
+                child.kill('SIGKILL');
+            }
+            catch (killError) {
+                diagnostics.push(`Windows SIGKILL fallback failed: ${killError instanceof Error ? killError.message : String(killError)}`);
+            }
+        }
+        if (!(await closeObserver.wait(closeTimeoutMs))) {
+            diagnostics.push(`Could not confirm Windows process-tree termination within ${closeTimeoutMs}ms ` +
+                `after taskkill failure${usedSigkillFallback ? ' and SIGKILL fallback' : ''}; ` +
+                `process ${child.pid} may still be running.`);
+            releaseChildProcessHandles(child);
+        }
+        return diagnostics;
+    }
+    finally {
+        closeObserver.dispose();
+    }
+}
+export function createWindowsChildProcessTreeMonitor(child, options = {}) {
+    return {
+        terminate: () => {
+            if (child.exitCode !== null || child.signalCode !== null) {
+                return Promise.resolve([
+                    'Skipped Windows process-tree termination after the root exited to avoid signaling ' +
+                        'a potentially reused PID; detached descendants require Job Object containment.',
+                ]);
+            }
+            return terminateWindowsProcessTree(child, options);
+        },
+    };
+}
+export async function terminateChildProcessTree(child) {
+    if (child.pid === undefined)
+        return [];
+    if (process.platform === 'win32')
+        return terminateWindowsProcessTree(child);
+    return terminatePosixProcessTree(child.pid);
+}
+export function createChildProcessTreeMonitor(child, options = {}) {
+    if (child.pid === undefined) {
+        return { terminate: () => terminateChildProcessTree(child) };
+    }
+    if (process.platform === 'win32') {
+        return createWindowsChildProcessTreeMonitor(child);
+    }
+    return createPosixProcessTreeMonitor(child.pid, {
+        treeId: options.treeId,
+        canUseProcessGroup: () => child.exitCode === null && child.signalCode === null,
+    });
+}
+export async function assertProcessTreeInspectionAvailable(options = {}) {
+    const platform = options.platform ?? process.platform;
+    if (platform === 'win32') {
+        throw new Error('Managed Windows descendant cleanup requires Job Object containment, which is not available.');
+    }
+    try {
+        await readPosixProcessTable();
+    }
+    catch (error) {
+        throw new Error(`Cannot start a Codex eval process because POSIX process-tree inspection is unavailable: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+//# sourceMappingURL=codex-eval-process-tree.js.map