@linzumi/cli 1.0.292 → 1.0.293

package/scripts/terminal-pty-helper.c

@@ -0,0 +1,655 @@
+/* Spec: spec/native-remote-terminal-rules.md (:native-remote-terminal/lifecycle,
+ * :native-remote-terminal/termination, :native-remote-terminal/wire).
+ *
+ * One PTY lifetime per helper process. Commander owns the helper through pipes:
+ *
+ *   argv:   <cols> <rows> <cwd> <shell-path> <argv0>
+ *   stdin:  control frames, each [type:1][length:4 big-endian][payload]
+ *             'i' input bytes, written to the PTY master exactly once
+ *             'r' resize: cols u16 BE, rows u16 BE (clamped 20..400 x 5..200)
+ *             's' stop: SIGHUP+SIGTERM the shell group, SIGKILL after 2s
+ *           EOF on stdin is treated as 's' (Commander died or detached us).
+ *           SIGTERM/SIGHUP/SIGINT delivered to the helper itself are also 's',
+ *           so a stop is never queued behind unconsumed input.
+ *   stdout: raw PTY output bytes, unmodified (non-blocking, bounded buffer:
+ *           when Commander does not drain stdout the helper stops reading the
+ *           PTY - bounded backpressure on the shell - but keeps servicing
+ *           stop, resize and deadlines; it never drops or reorders bytes).
+ *   Input is never discarded while the session runs: a frame is consumed
+ *   only when its bytes fit the bounded pending-input buffer; otherwise stdin
+ *   is left unread (backpressure on Commander) until the shell reads. Stop
+ *   fences input: bytes accepted but not yet written are dropped and nothing
+ *   reaches the PTY afterwards.
+ *   stderr: content-free status lines only:
+ *             LINZUMI_PTY_STARTED pid=<pid>
+ *             LINZUMI_PTY_EXIT code=<n> | signal=<n> group=<absent|present|unknown> discarded=<n>
+ *               (group: every process of the shell's session - its own group
+ *                and every job group, foreground or background - whether the
+ *                shell exited on its own or was stopped; unknown when an
+ *                enumeration or identity lookup failed - never a false absent)
+ *               (discarded: post-Stop output bytes Commander was not draining;
+ *                explicit, never silent)
+ *             LINZUMI_PTY_ERROR <code>
+ *
+ * The helper never logs input/output content. The post-fork child does only
+ * async-signal-safe work (chdir, execve, _exit); argv/envp are built pre-fork.
+ *
+ * The shell is observed exiting with waitid(WNOWAIT) and reaped only after the
+ * last signal is sent: while it is an unreaped zombie its pid - which is also
+ * its process-group and session id - cannot be reused, so no group signal or
+ * session enumeration can ever reach an unrelated process
+ * (:native-remote-terminal/lifecycle: never PID identity alone). */
+#define _DARWIN_C_SOURCE 1
+#define _DEFAULT_SOURCE 1
+#include <errno.h>
+#include <fcntl.h>
+#include <poll.h>
+#include <signal.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <termios.h>
+#include <time.h>
+#include <unistd.h>
+#if defined(__APPLE__)
+#include <sys/event.h>
+#include <sys/sysctl.h>
+#include <util.h>
+#else
+#include <pty.h>
+#endif
+
+#define FRAME_HEADER 5
+#define MAX_FRAME_PAYLOAD (64 * 1024)
+#define MAX_PENDING_INPUT (256 * 1024)
+#define OUTPUT_CHUNK (16 * 1024)
+#define MAX_PENDING_OUTPUT (256 * 1024)
+#define FINAL_DRAIN_MS 2000
+#define STOP_GRACE_MS 2000
+/* After SIGKILL, how long the helper waits (on kqueue exit events, never a
+ * fixed sleep) for the kernel to confirm the processes are gone. */
+#define KILL_CONFIRM_MS 1000
+/* Final cleanup re-enumerates and kills at most this many times. */
+#define CLEANUP_ROUNDS 4
+
+extern char **environ;
+
+static void status_line(const char *line) {
+  size_t length = strlen(line);
+  while (length > 0) {
+    ssize_t wrote = write(STDERR_FILENO, line, length);
+    if (wrote < 0) {
+      if (errno == EINTR) continue;
+      return;
+    }
+    line += wrote;
+    length -= (size_t)wrote;
+  }
+}
+
+static int fail(const char *code, int status) {
+  char line[128];
+  snprintf(line, sizeof(line), "LINZUMI_PTY_ERROR %s\n", code);
+  status_line(line);
+  return status;
+}
+
+static int parse_dimension(const char *text, long min, long max, unsigned short *out) {
+  char *end = NULL;
+  errno = 0;
+  long value = strtol(text, &end, 10);
+  if (errno || !end || *end || value < 1) return -1;
+  if (value < min) value = min;
+  if (value > max) value = max;
+  *out = (unsigned short)value;
+  return 0;
+}
+
+static unsigned short clamp_u16(unsigned int value, unsigned int min, unsigned int max) {
+  if (value < min) return (unsigned short)min;
+  if (value > max) return (unsigned short)max;
+  return (unsigned short)value;
+}
+
+static long long monotonic_ms(void) {
+  struct timespec now;
+  clock_gettime(CLOCK_MONOTONIC, &now);
+  return (long long)now.tv_sec * 1000LL + now.tv_nsec / 1000000LL;
+}
+
+static int set_nonblocking(int fd) {
+  int flags = fcntl(fd, F_GETFL, 0);
+  if (flags < 0) return -1;
+  return fcntl(fd, F_SETFL, flags | O_NONBLOCK);
+}
+
+/* Signals every process group a Stop must reach: the shell's own group and
+ * the terminal's current foreground job group. */
+static void signal_terminal(pid_t shell, int master, int signo) {
+  kill(-shell, signo);
+  if (master >= 0) {
+    pid_t foreground = tcgetpgrp(master);
+    if (foreground > 1 && foreground != shell) kill(-foreground, signo);
+  }
+}
+
+/* Cleanup reaches every process of the shell's session - background jobs
+ * that ignore SIGHUP/SIGTERM included - on Stop AND on the shell's own exit.
+ * The session id outlives the shell's exit (a tty enumeration does not: the
+ * kernel detaches the terminal when the session leader exits), and the
+ * unreaped shell keeps the id from being reused. Each member is recorded as
+ * pid + start time and is signalled only after a fresh lookup proves that
+ * identity; a reused PID never matches, and a failed lookup is never treated
+ * as an exit. Work that left the session (setsid, launchd, cron) is outside
+ * the guarantee (:native-remote-terminal/termination). */
+#define MAX_MEMBERS 512
+typedef struct {
+  pid_t pid;
+  struct timeval started;
+} member_t;
+static member_t members[MAX_MEMBERS];
+static size_t member_count = 0;
+/* An enumeration failed or overflowed: absence can no longer be confirmed. */
+static int membership_incomplete = 0;
+
+typedef enum { MEMBER_ALIVE, MEMBER_GONE, MEMBER_UNKNOWN } member_state_t;
+
+#if defined(LINZUMI_PTY_TEST_FAULTS)
+/* Test-only builds (scripts/test_terminal_pty_helper_darwin.py): force the
+ * per-pid identity lookup to fail, or stop just before the shell is reaped so
+ * the test can observe it is still held. The shipped asset has no hooks. */
+static int test_fault(const char *name) {
+  const char *fault = getenv("LINZUMI_PTY_TEST_FAULT");
+  return fault != NULL && strcmp(fault, name) == 0;
+}
+#define fault_pid_lookup() test_fault("pid_lookup")
+#define fault_pause_before_reap() test_fault("pause_before_reap")
+#define fault_pause_after_fork() test_fault("pause_after_fork")
+#else
+#define fault_pid_lookup() 0
+#define fault_pause_before_reap() 0
+#define fault_pause_after_fork() 0
+#endif
+
+static void add_member(pid_t pid, struct timeval started) {
+  for (size_t i = 0; i < member_count; i++) {
+    if (members[i].pid == pid && members[i].started.tv_sec == started.tv_sec &&
+        members[i].started.tv_usec == started.tv_usec)
+      return;
+  }
+  if (member_count >= MAX_MEMBERS) {
+    membership_incomplete = 1;
+    return;
+  }
+  members[member_count].pid = pid;
+  members[member_count].started = started;
+  member_count++;
+}
+
+#if defined(__APPLE__)
+/* Exiting (P_WEXIT, set before the exit event fires) or a zombie: the
+ * process is gone; only its parent's reap is outstanding. */
+static int process_exited(const struct kinfo_proc *info) {
+  return info->kp_proc.p_stat == SZOMB || (info->kp_proc.p_flag & P_WEXIT) != 0;
+}
+
+/* Tri-state identity check: a lookup failure is UNKNOWN, never GONE. */
+static member_state_t probe_member(const member_t *member) {
+  int mib[4] = {CTL_KERN, KERN_PROC, KERN_PROC_PID, (int)member->pid};
+  struct kinfo_proc info;
+  size_t size = sizeof(info);
+  if (fault_pid_lookup() || sysctl(mib, 4, &info, &size, NULL, 0) != 0) return MEMBER_UNKNOWN;
+  if (size == 0) return MEMBER_GONE; /* no such pid */
+  if (size != sizeof(info)) return MEMBER_UNKNOWN;
+  if (process_exited(&info)) return MEMBER_GONE;
+  if (info.kp_proc.p_starttime.tv_sec != member->started.tv_sec ||
+      info.kp_proc.p_starttime.tv_usec != member->started.tv_usec)
+    return MEMBER_GONE; /* the pid was reused: the recorded process is gone */
+  return MEMBER_ALIVE;
+}
+
+/* Records every live process of session `sid`. Called while the session
+ * leader is unreaped, so `sid` is still this terminal's session. */
+static void collect_session_members(pid_t sid) {
+  int mib[3] = {CTL_KERN, KERN_PROC, KERN_PROC_ALL};
+  size_t size = 0;
+  if (sysctl(mib, 3, NULL, &size, NULL, 0) != 0 || size == 0) {
+    membership_incomplete = 1;
+    return;
+  }
+  size += size / 4 + sizeof(struct kinfo_proc) * 16;
+  struct kinfo_proc *procs = malloc(size);
+  if (procs == NULL) {
+    membership_incomplete = 1;
+    return;
+  }
+  if (sysctl(mib, 3, procs, &size, NULL, 0) != 0) {
+    membership_incomplete = 1;
+    free(procs);
+    return;
+  }
+  size_t count = size / sizeof(struct kinfo_proc);
+  for (size_t i = 0; i < count; i++) {
+    pid_t pid = procs[i].kp_proc.p_pid;
+    if (pid <= 1 || pid == getpid() || process_exited(&procs[i])) continue;
+    pid_t session = getsid(pid);
+    if (session < 0) {
+      if (errno != ESRCH) membership_incomplete = 1; /* ESRCH: exited meanwhile */
+      continue;
+    }
+    if (session == sid) add_member(pid, procs[i].kp_proc.p_starttime);
+  }
+  free(procs);
+}
+
+/* Blocks until every pid has exited (kqueue NOTE_EXIT) or `timeout_ms`
+ * passes. A pid already gone fails registration and is not waited on. */
+static void await_exits(const pid_t *pids, size_t count, int timeout_ms) {
+  int queue = kqueue();
+  if (queue < 0) return;
+  size_t watching = 0;
+  for (size_t i = 0; i < count; i++) {
+    struct kevent change;
+    EV_SET(&change, pids[i], EVFILT_PROC, EV_ADD | EV_ONESHOT, NOTE_EXIT, 0, NULL);
+    if (kevent(queue, &change, 1, NULL, 0, NULL) == 0) watching++;
+  }
+  long long deadline = monotonic_ms() + timeout_ms;
+  while (watching > 0) {
+    long long left = deadline - monotonic_ms();
+    if (left <= 0) break;
+    struct timespec wait = {(time_t)(left / 1000), (long)((left % 1000) * 1000000LL)};
+    struct kevent fired[64];
+    int got = kevent(queue, NULL, 0, fired, 64, &wait);
+    if (got < 0 && errno == EINTR) continue;
+    if (got <= 0) break;
+    watching = (size_t)got >= watching ? 0 : watching - (size_t)got;
+  }
+  close(queue);
+}
+#else
+static void collect_session_members(pid_t sid) {
+  (void)sid;
+  membership_incomplete = 1; /* no process enumeration on this host */
+}
+#endif
+
+/* Signals every recorded member whose identity is freshly proven. */
+static void signal_members(int signo) {
+#if defined(__APPLE__)
+  for (size_t i = 0; i < member_count; i++)
+    if (probe_member(&members[i]) == MEMBER_ALIVE) kill(members[i].pid, signo);
+#else
+  (void)signo;
+#endif
+}
+
+/* Recorded members still alive, into `out`; *unknown is set when any
+ * member's identity could not be looked up. */
+static size_t alive_members(pid_t *out, size_t max, int *unknown) {
+  size_t alive = 0;
+#if defined(__APPLE__)
+  for (size_t i = 0; i < member_count; i++) {
+    member_state_t state = probe_member(&members[i]);
+    if (state == MEMBER_UNKNOWN) *unknown = 1;
+    else if (state == MEMBER_ALIVE && alive < max) out[alive++] = members[i].pid;
+  }
+#else
+  (void)out;
+  (void)max;
+  *unknown = 1;
+#endif
+  return alive;
+}
+
+static volatile sig_atomic_t stop_signal = 0;
+
+static void on_stop_signal(int signo) {
+  (void)signo;
+  stop_signal = 1;
+}
+
+int main(int argc, char **argv) {
+  if (argc != 6) return fail("usage", 64);
+  unsigned short cols = 0, rows = 0;
+  if (parse_dimension(argv[1], 20, 400, &cols) != 0 ||
+      parse_dimension(argv[2], 5, 200, &rows) != 0)
+    return fail("invalid_dimensions", 64);
+  const char *cwd = argv[3];
+  const char *shell = argv[4];
+  const char *argv0 = argv[5];
+  struct stat cwd_stat;
+  if (cwd[0] != '/' || stat(cwd, &cwd_stat) != 0 || !S_ISDIR(cwd_stat.st_mode))
+    return fail("invalid_cwd", 65);
+  if (shell[0] != '/' || access(shell, X_OK) != 0)
+    return fail("invalid_shell", 66);
+  if (argv0[0] == '\0') return fail("invalid_argv0", 64);
+
+  /* Everything the child needs is prepared before fork. */
+  if (setenv("TERM", "xterm-256color", 1) != 0 ||
+      setenv("COLORTERM", "truecolor", 1) != 0)
+    return fail("environment", 70);
+  char *child_argv[2] = {(char *)argv0, NULL};
+  signal(SIGPIPE, SIG_IGN);
+
+  /* Stop signals are blocked from before the shell exists until the
+   * parent's handlers are installed: a Stop that races startup is held
+   * pending, never taken by the default disposition (which would skip the
+   * group cleanup and the attested exit line). */
+  sigset_t stop_signals, prior_mask;
+  sigemptyset(&stop_signals);
+  sigaddset(&stop_signals, SIGTERM);
+  sigaddset(&stop_signals, SIGHUP);
+  sigaddset(&stop_signals, SIGINT);
+  if (sigprocmask(SIG_BLOCK, &stop_signals, &prior_mask) != 0)
+    return fail("signal_mask", 71);
+
+  struct winsize size;
+  memset(&size, 0, sizeof(size));
+  size.ws_col = cols;
+  size.ws_row = rows;
+  int master = -1;
+  pid_t child = forkpty(&master, NULL, NULL, &size);
+  if (child < 0) return fail("forkpty", 71);
+  if (child == 0) {
+    /* POST-FORK CHILD: async-signal-safe calls only. The user's shell gets
+     * the ordinary dispositions: SIGPIPE terminates writers again and the
+     * stop signals are no longer blocked (both survive execve otherwise). */
+    struct sigaction default_action;
+    memset(&default_action, 0, sizeof(default_action));
+    default_action.sa_handler = SIG_DFL;
+    sigemptyset(&default_action.sa_mask);
+    sigaction(SIGPIPE, &default_action, NULL);
+    sigprocmask(SIG_SETMASK, &prior_mask, NULL);
+    if (chdir(cwd) != 0) _exit(126);
+    execve(shell, child_argv, environ);
+    _exit(127);
+  }
+
+  if (fault_pause_after_fork()) {
+    /* Holds the window between fork and handler installation open so the
+     * test can deliver a Stop inside it. */
+    status_line("LINZUMI_PTY_TEST_FORKED\n");
+    raise(SIGSTOP);
+  }
+  {
+    struct sigaction action;
+    memset(&action, 0, sizeof(action));
+    action.sa_handler = on_stop_signal;
+    sigemptyset(&action.sa_mask);
+    sigaction(SIGTERM, &action, NULL);
+    sigaction(SIGHUP, &action, NULL);
+    sigaction(SIGINT, &action, NULL);
+  }
+  /* Handlers are ready: a Stop held pending since before the fork is now
+   * delivered to on_stop_signal and handled by the main loop. */
+  sigprocmask(SIG_SETMASK, &prior_mask, NULL);
+  {
+    char line[64];
+    snprintf(line, sizeof(line), "LINZUMI_PTY_STARTED pid=%d\n", (int)child);
+    status_line(line);
+  }
+  if (set_nonblocking(master) != 0 || set_nonblocking(STDIN_FILENO) != 0) {
+    kill(child, SIGKILL);
+    return fail("nonblocking", 71);
+  }
+  if (set_nonblocking(STDOUT_FILENO) != 0) {
+    kill(child, SIGKILL);
+    return fail("nonblocking", 71);
+  }
+  static unsigned char frame[FRAME_HEADER + MAX_FRAME_PAYLOAD];
+  static unsigned char pending[MAX_PENDING_INPUT];
+  static unsigned char out[MAX_PENDING_OUTPUT];
+  size_t frame_used = 0;
+  size_t pending_used = 0;
+  size_t out_used = 0;
+  unsigned long long discarded = 0; /* post-stop bytes Commander could not take */
+  int stdin_open = 1;
+  int stdout_open = 1;
+  int master_open = 1;
+  int stopping = 0;
+  long long kill_deadline = 0;   /* stop: SIGKILL the group at this instant */
+  long long finish_deadline = 0; /* shell exited: final drain ends here */
+  int group_killed = 0;
+  int child_status = 0;
+  /* The shell exited but is deliberately NOT reaped until cleanup ends. */
+  int child_exited = 0;
+
+#define BEGIN_STOP()                                  \
+  do {                                                \
+    if (!stopping) {                                  \
+      stopping = 1;                                   \
+      pending_used = 0; /* fenced: never reaches PTY */ \
+      kill_deadline = monotonic_ms() + STOP_GRACE_MS; \
+      collect_session_members(child);                 \
+      signal_terminal(child, master, SIGHUP);         \
+      signal_terminal(child, master, SIGTERM);        \
+    }                                                 \
+  } while (0)
+
+  for (;;) {
+    long long now = monotonic_ms();
+    if (stop_signal) BEGIN_STOP();
+    if (!child_exited) {
+      siginfo_t exited;
+      memset(&exited, 0, sizeof(exited));
+      if (waitid(P_PID, (id_t)child, &exited, WEXITED | WNOHANG | WNOWAIT) == 0 &&
+          exited.si_pid == child) {
+        child_exited = 1;
+        finish_deadline = now + FINAL_DRAIN_MS;
+        if (!stopping) {
+          /* The shell's own exit ends the terminal too: its background jobs
+           * are asked to leave now and killed at the drain deadline. */
+          kill_deadline = finish_deadline;
+          collect_session_members(child);
+          signal_members(SIGHUP);
+          signal_members(SIGTERM);
+        }
+      }
+    }
+    /* Deadlines run in every phase, including after the shell exited. */
+    if ((stopping || child_exited) && !group_killed && kill_deadline > 0 && now >= kill_deadline) {
+      signal_terminal(child, master_open ? master : -1, SIGKILL);
+      if (!child_exited) kill(child, SIGKILL);
+      collect_session_members(child);
+      signal_members(SIGKILL);
+      group_killed = 1;
+    }
+    if (child_exited) {
+      int drained = !master_open && out_used == 0;
+      if (drained || !stdout_open || now >= finish_deadline) break;
+    }
+
+    struct pollfd fds[3];
+    nfds_t count = 0;
+    int master_index = -1, stdin_index = -1, stdout_index = -1;
+    short master_events = 0;
+    /* Once stopping, the PTY is drained unconditionally: a dying session
+     * leader cannot finish closing its terminal while the output queue is
+     * full, so stop would otherwise wait on Commander reading stdout. */
+    if (master_open && (stopping || out_used + OUTPUT_CHUNK <= sizeof(out))) master_events |= POLLIN;
+    /* Input accepted before Stop but not yet written is dropped at Stop
+     * (authority is fenced); nothing reaches the PTY afterwards. */
+    if (master_open && !stopping && pending_used > 0) master_events |= POLLOUT;
+    if (master_events) {
+      fds[count].fd = master;
+      fds[count].events = master_events;
+      fds[count].revents = 0;
+      master_index = (int)count++;
+    }
+    /* Read stdin only when a whole maximal frame's input would fit, so a
+     * consumed frame is never discarded - but always watch it: a hangup
+     * (Commander gone) is reported even with no read interest. */
+    int stdin_readable_room =
+        pending_used + MAX_FRAME_PAYLOAD <= sizeof(pending) && frame_used < sizeof(frame);
+    if (stdin_open) {
+      fds[count].fd = STDIN_FILENO;
+      fds[count].events = stdin_readable_room ? POLLIN : 0;
+      fds[count].revents = 0;
+      stdin_index = (int)count++;
+    }
+    if (stdout_open && out_used > 0) {
+      fds[count].fd = STDOUT_FILENO;
+      fds[count].events = POLLOUT;
+      fds[count].revents = 0;
+      stdout_index = (int)count++;
+    }
+    int ready = poll(fds, count, 50);
+    if (ready < 0 && errno != EINTR) break;
+    if (ready <= 0) continue;
+
+    if (master_index >= 0) {
+      short revents = fds[master_index].revents;
+      if ((revents & (POLLIN | POLLHUP | POLLERR)) && (master_events & POLLIN)) {
+        static unsigned char discard[OUTPUT_CHUNK];
+        int room = out_used + OUTPUT_CHUNK <= sizeof(out);
+        ssize_t got = read(master, room ? out + out_used : discard, OUTPUT_CHUNK);
+        if (got > 0) {
+          if (room) out_used += (size_t)got;
+          else discarded += (unsigned long long)got; /* reported in the EXIT line */
+        } else if (got == 0 || (errno != EINTR && errno != EAGAIN && errno != EWOULDBLOCK))
+          master_open = 0; /* EIO: every slave fd closed */
+      } else if (revents & (POLLHUP | POLLERR)) {
+        master_open = 0;
+      }
+      if (master_open && !stopping && (revents & POLLOUT) && pending_used > 0) {
+        ssize_t wrote = write(master, pending, pending_used);
+        if (wrote > 0) {
+          memmove(pending, pending + wrote, pending_used - (size_t)wrote);
+          pending_used -= (size_t)wrote;
+        }
+      }
+    }
+
+    if (stdout_index >= 0 && (fds[stdout_index].revents & (POLLOUT | POLLERR | POLLHUP))) {
+      ssize_t wrote = write(STDOUT_FILENO, out, out_used);
+      if (wrote > 0) {
+        memmove(out, out + wrote, out_used - (size_t)wrote);
+        out_used -= (size_t)wrote;
+      } else if (wrote < 0 && errno != EINTR && errno != EAGAIN && errno != EWOULDBLOCK) {
+        stdout_open = 0; /* Commander is gone: nothing can consume output */
+        discarded += (unsigned long long)out_used;
+        out_used = 0;
+        BEGIN_STOP();
+      }
+    }
+
+    if (stdin_index >= 0 && !stdin_readable_room &&
+        (fds[stdin_index].revents & (POLLHUP | POLLERR))) {
+      /* No room to read, and the owner hung up: nothing can ever drain the
+       * pending input; the session is ownerless, so stop it. */
+      stdin_open = 0;
+      BEGIN_STOP();
+    } else if (stdin_index >= 0 && (fds[stdin_index].revents & (POLLIN | POLLHUP | POLLERR))) {
+      ssize_t got = read(STDIN_FILENO, frame + frame_used, sizeof(frame) - frame_used);
+      if (got == 0) {
+        stdin_open = 0;
+        BEGIN_STOP();
+      } else if (got < 0) {
+        if (errno != EINTR && errno != EAGAIN && errno != EWOULDBLOCK) {
+          stdin_open = 0;
+          BEGIN_STOP();
+        }
+      } else {
+        frame_used += (size_t)got;
+      }
+    }
+
+    /* Consume every complete frame that can be applied without loss. */
+    for (;;) {
+      if (frame_used < FRAME_HEADER) break;
+      uint32_t length = ((uint32_t)frame[1] << 24) | ((uint32_t)frame[2] << 16) |
+                        ((uint32_t)frame[3] << 8) | (uint32_t)frame[4];
+      if (length > MAX_FRAME_PAYLOAD) {
+        status_line("LINZUMI_PTY_ERROR frame_too_large\n");
+        stdin_open = 0;
+        frame_used = 0;
+        BEGIN_STOP();
+        break;
+      }
+      if (frame_used < FRAME_HEADER + length) break;
+      unsigned char type = frame[0];
+      unsigned char *payload = frame + FRAME_HEADER;
+      if (type == 'i') {
+        if (pending_used + length > sizeof(pending)) break; /* wait; never drop */
+        if (!stopping && master_open) {
+          memcpy(pending + pending_used, payload, length);
+          pending_used += length;
+        }
+      } else if (type == 'r' && length == 4 && master_open) {
+        struct winsize next;
+        memset(&next, 0, sizeof(next));
+        next.ws_col = clamp_u16(((unsigned)payload[0] << 8) | payload[1], 20, 400);
+        next.ws_row = clamp_u16(((unsigned)payload[2] << 8) | payload[3], 5, 200);
+        ioctl(master, TIOCSWINSZ, &next);
+      } else if (type == 's') {
+        BEGIN_STOP();
+      }
+      size_t consumed = FRAME_HEADER + length;
+      memmove(frame, frame + consumed, frame_used - consumed);
+      frame_used -= consumed;
+    }
+  }
+
+  if (!child_exited) {
+    kill(-child, SIGKILL);
+    kill(child, SIGKILL);
+    /* Wait for the exit WITHOUT reaping: the pid stays reserved. */
+    siginfo_t exited;
+    while (waitid(P_PID, (id_t)child, &exited, WEXITED | WNOWAIT) != 0 && errno == EINTR) {
+    }
+  }
+  if (master >= 0) close(master);
+  /* Output still buffered when the helper ends was never delivered. */
+  discarded += (unsigned long long)out_used;
+  /* Absence is confirmed only when every process of the shell's session is
+   * gone and every enumeration and identity lookup succeeded. The shell is
+   * still unreaped, so its group/session id cannot name anything else here.
+   * Exits are awaited on kernel exit events, bounded by KILL_CONFIRM_MS. */
+  int group_present = 0;
+#if defined(__APPLE__)
+  {
+    static pid_t live[MAX_MEMBERS];
+    int unknown = 0;
+    size_t alive = 0;
+    /* Bounded rounds: each re-enumerates the session, so a member forked
+     * while the previous round was killing is recorded and killed too. */
+    for (int round = 0; round <= CLEANUP_ROUNDS; round++) {
+      collect_session_members(child);
+      unknown = 0;
+      alive = alive_members(live, MAX_MEMBERS, &unknown);
+      if (alive == 0 || round == CLEANUP_ROUNDS) break;
+      kill(-child, SIGKILL);
+      signal_members(SIGKILL);
+      await_exits(live, alive, KILL_CONFIRM_MS);
+    }
+    if (alive > 0) group_present = 1;
+    if (unknown || membership_incomplete) group_present = 2;
+  }
+#else
+  /* No process enumeration on this host: absence is never confirmed. */
+  group_present = 2;
+#endif
+  if (fault_pause_before_reap()) {
+    status_line("LINZUMI_PTY_TEST_REAP_PENDING\n");
+    raise(SIGSTOP);
+  }
+  /* Only now - after the last signal - release the shell's pid. */
+  while (waitpid(child, &child_status, 0) < 0 && errno == EINTR) {
+  }
+  char line[128];
+  if (WIFSIGNALED(child_status)) {
+    snprintf(line, sizeof(line), "LINZUMI_PTY_EXIT signal=%d group=%s discarded=%llu\n",
+             WTERMSIG(child_status), group_present == 2 ? "unknown" : (group_present ? "present" : "absent"), discarded);
+  } else {
+    snprintf(line, sizeof(line), "LINZUMI_PTY_EXIT code=%d group=%s discarded=%llu\n",
+             WIFEXITED(child_status) ? WEXITSTATUS(child_status) : 0,
+             group_present == 2 ? "unknown" : (group_present ? "present" : "absent"), discarded);
+  }
+  status_line(line);
+  return 0;
+}