@mjasnikovs/pi-task 0.40.44 → 0.40.46

package/dist/shared/child-process.d.ts

@@ -3,6 +3,13 @@ import type { CommandKillReason } from './command-watchdog.js';
 import type { LoopHit } from '../task/loop-detector.js';
 /** Grace period between SIGTERM and SIGKILL (ms). */
 export declare const KILL_GRACE_MS = 5000;
+/**
+ * After a child EXITS, how long its pipes may still deliver buffered data before
+ * the run is reported. Not a wait for the pipes to CLOSE, which a grandchild holding
+ * them can put off for as long as it lives: just the turn or two the reader needs
+ * to hand over what it has.
+ */
+export declare const EXIT_DRAIN_MS = 50;
 /** Base flags shared by all child pi invocations. */
 export declare const CHILD_BASE_ARGS: readonly ["--print", "--no-skills", "--no-extensions", "--no-prompt-templates", "--no-context-files", "--no-session"];
 /** The subset of a child's stdin we use: write the prompt, then close it. */
@@ -27,8 +34,9 @@ export type SpawnFn = (command: string, args: ReadonlyArray<string>, options: {
     cwd: string;
     shell: boolean;
     stdio: ['ignore' | 'pipe', 'pipe', 'pipe'];
-    /** Set only when the invocation needs env overrides — git-state-guard's
-     *  `GIT_INDEX_FILE` throwaway index is the one caller. Absent → the child
+    /** Set when the invocation needs env overrides — git-state-guard's
+     *  `GIT_INDEX_FILE` throwaway index — and for every model child, which
+     *  carries what leftovers.ts finds its descendants by. Absent → the child
      *  inherits this process's environment. */
     env?: NodeJS.ProcessEnv;
     /** true → give the child its own process group (POSIX `detached`), so any
@@ -53,8 +61,8 @@ export type SpawnFn = (command: string, args: ReadonlyArray<string>, options: {
  * `windowsHide` (CREATE_NO_WINDOW) instead: the child gets a windowless console
  * that its descendants inherit. Either/or is load-bearing — Windows ignores
  * CREATE_NO_WINDOW next to DETACHED_PROCESS. The win32 reap is `taskkill /T`,
- * which walks the live tree and needs no flag; unlike a POSIX group kill it
- * cannot catch what the child left behind after it exited.
+ * which walks the live tree and needs no flag. Neither reap reaches what pi's bash
+ * tool backgrounds, since it detaches every command; leftovers.ts finds that.
  */
 export declare function ownGroupSpawnOptions(platform: NodeJS.Platform): OwnGroupSpawnOptions;
 export type OwnGroupSpawnOptions = {
@@ -64,10 +72,16 @@ export type OwnGroupSpawnOptions = {
 };
 /**
  * Tear down a child spawned with `ownGroupSpawnOptions`, and whatever it
- * backgrounded. Best-effort: a group already gone is not an error. Kept beside
- * the spawn shape so a platform change edits one file.
+ * backgrounded that is still in its group. Best-effort: a group already gone is
+ * not an error. Kept beside the spawn shape so a platform change edits one file.
+ *
+ * `leaderExited` has no default: whether the leader still lives decides whether its
+ * pid is still its own. Returns whether a reap went out.
  */
-export declare function reapProcessGroup(pid: number, sig: NodeJS.Signals, platform?: NodeJS.Platform): void;
+export declare function reapProcessGroup(pid: number, sig: NodeJS.Signals, { platform, leaderExited }: {
+    platform?: NodeJS.Platform;
+    leaderExited: boolean;
+}): boolean;
 /**
  * Why runChild killed the child. Five sources converge on one kill path, and
  * each names itself here rather than in its own flag — so a consumer reads ONE

package/dist/shared/child-process.js

@@ -1,9 +1,17 @@
 import { spawn as defaultSpawn, spawnSync as spawnSyncDefault } from 'node:child_process';
+import { system32, trackLeftovers } from './leftovers.js';
 import { realStreamTimerDeps, StreamWatchdog } from './stream-watchdog.js';
 import { realStallTimerDeps, StallProbe } from './stall-probe.js';
 import { workerChannel } from '../workers/worker-channels.js';
 /** Grace period between SIGTERM and SIGKILL (ms). */
 export const KILL_GRACE_MS = 5000;
+/**
+ * After a child EXITS, how long its pipes may still deliver buffered data before
+ * the run is reported. Not a wait for the pipes to CLOSE, which a grandchild holding
+ * them can put off for as long as it lives: just the turn or two the reader needs
+ * to hand over what it has.
+ */
+export const EXIT_DRAIN_MS = 50;
 /** Base flags shared by all child pi invocations. */
 export const CHILD_BASE_ARGS = [
     '--print',
@@ -23,28 +31,38 @@ export const CHILD_BASE_ARGS = [
  * `windowsHide` (CREATE_NO_WINDOW) instead: the child gets a windowless console
  * that its descendants inherit. Either/or is load-bearing — Windows ignores
  * CREATE_NO_WINDOW next to DETACHED_PROCESS. The win32 reap is `taskkill /T`,
- * which walks the live tree and needs no flag; unlike a POSIX group kill it
- * cannot catch what the child left behind after it exited.
+ * which walks the live tree and needs no flag. Neither reap reaches what pi's bash
+ * tool backgrounds, since it detaches every command; leftovers.ts finds that.
  */
 export function ownGroupSpawnOptions(platform) {
     return platform === 'win32' ? { windowsHide: true } : { detached: true };
 }
 /**
  * Tear down a child spawned with `ownGroupSpawnOptions`, and whatever it
- * backgrounded. Best-effort: a group already gone is not an error. Kept beside
- * the spawn shape so a platform change edits one file.
+ * backgrounded that is still in its group. Best-effort: a group already gone is
+ * not an error. Kept beside the spawn shape so a platform change edits one file.
+ *
+ * `leaderExited` has no default: whether the leader still lives decides whether its
+ * pid is still its own. Returns whether a reap went out.
  */
-export function reapProcessGroup(pid, sig, platform = process.platform) {
+export function reapProcessGroup(pid, sig, { platform = process.platform, leaderExited }) {
+    // taskkill walks the tree down from a live leader. Once the leader has exited its
+    // pid may already be another process's, and /T /F would kill that one instead.
+    if (platform === 'win32' && leaderExited)
+        return false;
     try {
         if (platform === 'win32') {
-            spawnSyncDefault('taskkill', ['/pid', String(pid), '/T', '/F']);
+            // Synchronous, unlike pi's killProcessTree: runChild kills the leader
+            // next, and the walk must end first.
+            spawnSyncDefault(system32('taskkill.exe'), ['/pid', String(pid), '/T', '/F']);
         }
         else {
             process.kill(-pid, sig);
         }
+        return true;
     }
     catch {
-        // group already gone
+        return false;
     }
 }
 /** The cause a signal was aborted with, when its owner attached one. */
@@ -259,17 +277,19 @@ export function runChild(spawn, invocation, cwd, signal, opts) {
         const usesStdin = invocation.stdin !== undefined;
         // Model children (json-events) run arbitrary bash — they can `bun run dev &`
         // a server that outlives the child and holds a port, wrecking the final gate
-        // with a self-inflicted EADDRINUSE. Spawn them in their
-        // OWN process group so every such grandchild can be reaped as a unit on exit.
+        // with a self-inflicted EADDRINUSE. They get their OWN process group, so a
+        // kill takes the child's tree with it, and leftovers.ts finds what escaped it.
         // Plumbing (git, mode:'text') never backgrounds anything and stays in-group.
         const ownGroup = opts?.mode === 'json-events';
         const platform = (ownGroup && opts.platform) || process.platform;
+        const leftovers = ownGroup ? trackLeftovers(platform, invocation.env ?? process.env, KILL_GRACE_MS) : null;
+        const env = leftovers?.env ?? invocation.env;
         const proc = spawn(invocation.command, invocation.args, {
             cwd,
             shell: false,
             stdio: [usesStdin ? 'pipe' : 'ignore', 'pipe', 'pipe'],
             ...(ownGroup ? ownGroupSpawnOptions(platform) : {}),
-            ...(invocation.env ? { env: invocation.env } : {})
+            ...(env ? { env } : {})
         });
         if (usesStdin) {
             // A child killed before it read the prompt leaves the pipe broken, and an
@@ -285,27 +305,27 @@ export function runChild(spawn, invocation, cwd, signal, opts) {
             proc.stdin?.end();
         }
         // Reap the child's whole process group — the child itself AND anything it
-        // backgrounded. No-op unless the child owns a group (ownGroup) and we have a pid.
-        const reapGroup = (sig) => {
-            if (!ownGroup || !proc.pid)
-                return;
-            reapProcessGroup(proc.pid, sig, platform);
-        };
+        // backgrounded. Set by 'exit' or 'close', whichever a spawn reports first.
+        let leaderExited = false;
+        const reapGroup = (sig) => ownGroup && !!proc.pid && reapProcessGroup(proc.pid, sig, { platform, leaderExited });
         // One kill path for every source: SIGTERM, then SIGKILL after a grace
         // period if the child ignored the term. For a group-owning (model) child,
         // ALSO sweep the group so anything it backgrounded dies with it —
-        // proc.kill hits only the leader, reapGroup the grandchildren. The FIRST
-        // cause wins: a stall kill's SIGTERM can trip the abort path behind it.
+        // proc.kill hits only the leader, reapGroup the grandchildren. The sweep
+        // goes first because win32's taskkill walks the tree down from a live
+        // leader. The FIRST cause wins: a stall kill's SIGTERM can trip the abort
+        // path behind it. A leader that already exited gave its own verdict.
         const killProc = (cause) => {
+            if (leaderExited)
+                return;
             kill ??= cause;
+            reapGroup('SIGTERM');
             proc.kill('SIGTERM');
-            if (ownGroup)
-                reapGroup('SIGTERM');
             setTimeout(() => {
-                if (!proc.killed)
+                reapGroup('SIGKILL');
+                // Not `proc.killed`: that turns true once SIGTERM is delivered.
+                if (!leaderExited)
                     proc.kill('SIGKILL');
-                if (ownGroup)
-                    reapGroup('SIGKILL');
             }, KILL_GRACE_MS);
         };
         // Stream watchdog (json-events children only): a silent stream is killed
@@ -421,15 +441,43 @@ export function runChild(spawn, invocation, cwd, signal, opts) {
             settled = true;
             resolve(result);
         };
-        proc.once('close', (code) => {
-            // The child has exited, but anything it backgrounded (a dev server) may
-            // still hold its process group and a port — reap the group so the next
-            // gate's boot check does not collide with our own orphan. Best-effort:
-            // SIGTERM now, SIGKILL shortly after for anything that ignored it.
-            if (ownGroup) {
-                reapGroup('SIGTERM');
-                setTimeout(() => reapGroup('SIGKILL'), 1_000).unref();
-            }
+        // 'close' waits on every holder of the pipes, and a grandchild that inherited
+        // them holds them for as long as it lives. The run ends with the leader: at
+        // once if its pipes are already at EOF, otherwise after one drain.
+        let finished = false;
+        let exitCode = null;
+        let endedStreams = 0;
+        const expectedStreams = (proc.stdout ? 1 : 0) + (proc.stderr ? 1 : 0);
+        let drain;
+        const finishIfDrained = () => {
+            if (leaderExited && endedStreams >= expectedStreams)
+                finish(exitCode);
+        };
+        proc.stdout?.on('end', () => {
+            endedStreams++;
+            finishIfDrained();
+        });
+        proc.stderr?.on('end', () => {
+            endedStreams++;
+            finishIfDrained();
+        });
+        proc.once('exit', (code) => {
+            leaderExited = true;
+            exitCode = code;
+            finishIfDrained();
+            if (!finished)
+                drain = setTimeout(() => finish(exitCode), EXIT_DRAIN_MS);
+        });
+        proc.once('close', (code) => finish(code ?? exitCode));
+        const finish = (code) => {
+            if (finished)
+                return;
+            finished = true;
+            leaderExited = true;
+            clearTimeout(drain);
+            cleanup();
+            if (reapGroup('SIGTERM'))
+                setTimeout(() => reapGroup('SIGKILL'), KILL_GRACE_MS).unref();
             if (sink)
                 sink.flush();
             const text = sink ? sink.text : undefined;
@@ -437,7 +485,7 @@ export function runChild(spawn, invocation, cwd, signal, opts) {
             // killed means it ran on a prompt that never finished arriving. Its own
             // exit describes that half-spec, so it cannot stand as the verdict.
             const truncated = kill === undefined ? stdinError : undefined;
-            settle({
+            const result = {
                 stdout,
                 stderr: truncated ? `${stderr}\nprompt delivery failed: ${truncated.message}` : stderr,
                 exitCode: truncated ? (code ?? 0) || 1 : (code ?? 0),
@@ -445,9 +493,12 @@ export function runChild(spawn, invocation, cwd, signal, opts) {
                 ...(kill ? { kill } : {}),
                 text,
                 modelError: sink?.modelError
-            });
-        });
+            };
+            // Not settled before the leftovers are gone: the next phase needs their ports.
+            void (leftovers?.reap() ?? Promise.resolve()).then(() => settle(result));
+        };
         proc.once('error', () => {
+            void leftovers?.reap();
             settle({
                 stdout,
                 stderr,

package/dist/shared/leftovers.d.ts

@@ -0,0 +1,45 @@
+export declare const LEFTOVER_TOKEN_ENV = "PI_TASK_LEFTOVER_TOKEN";
+export interface Leftovers {
+    /** The environment to spawn the child with. */
+    env: NodeJS.ProcessEnv;
+    /** End whatever the child left running. Never rejects. */
+    reap(): Promise<void>;
+}
+/** Start tracking a child about to be spawned with `base` as its environment. */
+export declare function trackLeftovers(platform: NodeJS.Platform, base: NodeJS.ProcessEnv, graceMs: number): Leftovers;
+/**
+ * A System32 executable by absolute path, so neither PATH nor the working directory
+ * can supply another. `||`, not `??`: an empty SystemRoot would make it relative.
+ */
+export declare function system32(...segments: string[]): string;
+/** Pids whose environment holds `marker`, read from `<procRoot>/<pid>/environ`. */
+export declare function linuxPidsWith(marker: string, procRoot?: string): number[];
+/** Pids of the `ps -E` rows that carry `marker`. The pid is each row's first field. */
+export declare function pidsInPsTable(table: string, marker: string): number[];
+/**
+ * Sourced by every bash the child starts, after the user's own BASH_ENV so that one
+ * cannot replace the exit trap. Builtins only: a fork costs tens of milliseconds
+ * under MSYS. `/proc/$$/winpid` maps MSYS's pid to the Windows one.
+ */
+export declare const BASH_ENV_SCRIPT: string;
+/** A shell the registry recorded: its Windows pid and when it ran, as FILETIMEs. */
+export interface Shell {
+    pid: number;
+    ranAt: bigint;
+    /** Absent when the shell was killed, exec'd into its command, or is still running. */
+    exitedAt?: bigint;
+}
+/** Rows are `ran <pid> <time>` and `exited <pid> <time>`. Each exit closes its pid's latest run. */
+export declare function parseShells(text: string): Shell[];
+export interface ProcessRow {
+    pid: number;
+    ppid: number;
+    createdAt: bigint;
+}
+/**
+ * The processes a recorded shell started: those created while it lived. Windows
+ * hands a dead shell's pid to the next process, whose children carry the same
+ * parent pid, so only the shell's lifetime tells them apart.
+ */
+export declare function startedByShells(rows: ProcessRow[], shells: Shell[]): number[];
+export declare function parseProcessTable(text: string): ProcessRow[];

package/dist/shared/leftovers.js

@@ -0,0 +1,237 @@
+/**
+ * leftovers — what a model child started that is still running after it ended.
+ *
+ * A process-group reap misses it. pi's bash tool starts every command detached, in
+ * a group of its own, so a server a command backgrounds is in no group of the
+ * child's; on win32 the tree it hung from is gone once its shell exits. Measured
+ * with pi's own bash tool: the server outlived the group reap and `taskkill /T`,
+ * of the exited child and of the live one, on linux and on the windows runner.
+ *
+ * So descendants are found by what they inherit. On linux and darwin that is an
+ * environment token, read back from the process table. Windows cannot read another
+ * process's environment, so there `BASH_ENV` has every bash the child runs record
+ * its pid and lifetime, and whatever those shells started is found by parent pid.
+ */
+import { spawn, spawnSync } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+export const LEFTOVER_TOKEN_ENV = 'PI_TASK_LEFTOVER_TOKEN';
+const SHELL_REGISTRY_ENV = 'PI_TASK_SHELL_REGISTRY';
+const USER_BASH_ENV = 'PI_TASK_USER_BASH_ENV';
+/** Start tracking a child about to be spawned with `base` as its environment. */
+export function trackLeftovers(platform, base, graceMs) {
+    if (platform === 'win32')
+        return trackShells(base);
+    if (platform === 'linux' || platform === 'darwin')
+        return trackToken(platform, base, graceMs);
+    return { env: base, reap: () => Promise.resolve() };
+}
+/**
+ * A System32 executable by absolute path, so neither PATH nor the working directory
+ * can supply another. `||`, not `??`: an empty SystemRoot would make it relative.
+ */
+export function system32(...segments) {
+    return path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', ...segments);
+}
+// ─── linux, darwin: the environment token ───────────────────────────────────
+function trackToken(platform, base, graceMs) {
+    const token = randomUUID();
+    const marker = `${LEFTOVER_TOKEN_ENV}=${token}`;
+    const find = () => platform === 'linux' ? linuxPidsWith(marker) : pidsInPsTable(darwinPsTable(), marker);
+    return {
+        env: { ...base, [LEFTOVER_TOKEN_ENV]: token },
+        reap: () => {
+            // Found again for the SIGKILL, never remembered: a pid that died in the
+            // grace period may already be someone else's.
+            if (signalEach(find(), 'SIGTERM') > 0) {
+                setTimeout(() => signalEach(find(), 'SIGKILL'), graceMs).unref();
+            }
+            return Promise.resolve();
+        }
+    };
+}
+/** Pids whose environment holds `marker`, read from `<procRoot>/<pid>/environ`. */
+export function linuxPidsWith(marker, procRoot = '/proc') {
+    const inner = Buffer.from(`\0${marker}\0`);
+    const first = Buffer.from(`${marker}\0`);
+    let names;
+    try {
+        names = fs.readdirSync(procRoot);
+    }
+    catch {
+        return [];
+    }
+    const pids = [];
+    for (const name of names) {
+        if (!/^\d+$/.test(name))
+            continue;
+        try {
+            const environ = fs.readFileSync(path.join(procRoot, name, 'environ'));
+            if (environ.includes(inner) || environ.subarray(0, first.length).equals(first)) {
+                pids.push(Number(name));
+            }
+        }
+        catch {
+            // exited meanwhile, or not ours to read
+        }
+    }
+    return pids;
+}
+/** darwin's `ps -E` appends each process's environment to its command line. */
+function darwinPsTable() {
+    const r = spawnSync('/bin/ps', ['-Aww', '-o', 'pid=,ppid=,pgid=,lstart=,command=', '-E'], {
+        encoding: 'utf8',
+        maxBuffer: 64 * 1024 * 1024
+    });
+    return r.stdout ?? '';
+}
+/** Pids of the `ps -E` rows that carry `marker`. The pid is each row's first field. */
+export function pidsInPsTable(table, marker) {
+    return table
+        .split('\n')
+        .filter(row => row.includes(marker))
+        .map(row => Number.parseInt(row, 10))
+        .filter(pid => pid > 0);
+}
+function signalEach(pids, sig) {
+    let sent = 0;
+    for (const pid of pids) {
+        try {
+            process.kill(pid, sig);
+            sent++;
+        }
+        catch {
+            // already gone
+        }
+    }
+    return sent;
+}
+// ─── win32: the shells `BASH_ENV` recorded ──────────────────────────────────
+/**
+ * Sourced by every bash the child starts, after the user's own BASH_ENV so that one
+ * cannot replace the exit trap. Builtins only: a fork costs tens of milliseconds
+ * under MSYS. `/proc/$$/winpid` maps MSYS's pid to the Windows one.
+ */
+export const BASH_ENV_SCRIPT = [
+    `if [ -n "\${${USER_BASH_ENV}:-}" ]; then . "$${USER_BASH_ENV}"; fi`,
+    '__pi_task_winpid=$$',
+    'if [ -r /proc/$$/winpid ]; then read -r __pi_task_winpid < /proc/$$/winpid; fi',
+    `printf 'ran %s %s\\n' "$__pi_task_winpid" "\${EPOCHREALTIME:-}" >> "$${SHELL_REGISTRY_ENV}"`,
+    `trap 'printf "exited %s %s\\n" "$__pi_task_winpid" "\${EPOCHREALTIME:-}" >> "$${SHELL_REGISTRY_ENV}"' EXIT`,
+    ''
+].join('\n');
+function trackShells(base) {
+    let dir;
+    try {
+        dir = fs.mkdtempSync(path.join(os.tmpdir(), 'pi-task-shells-'));
+        fs.writeFileSync(path.join(dir, 'bash-env.sh'), BASH_ENV_SCRIPT);
+    }
+    catch {
+        return { env: base, reap: () => Promise.resolve() };
+    }
+    const registry = path.join(dir, 'shells');
+    const env = {
+        ...base,
+        BASH_ENV: forwardSlashes(path.join(dir, 'bash-env.sh')),
+        [SHELL_REGISTRY_ENV]: forwardSlashes(registry)
+    };
+    if (base.BASH_ENV)
+        env[USER_BASH_ENV] = base.BASH_ENV;
+    return {
+        env,
+        reap: async () => {
+            try {
+                const shells = parseShells(fs.existsSync(registry) ? fs.readFileSync(registry, 'utf8') : '');
+                if (shells.length === 0)
+                    return;
+                const started = startedByShells(parseProcessTable(await processTable()), shells);
+                await Promise.all(started.map(taskkillTree));
+            }
+            catch {
+                // best-effort, like every other reap
+            }
+            finally {
+                fs.rmSync(dir, { recursive: true, force: true });
+            }
+        }
+    };
+}
+/** Git Bash reads MSYS paths; forward slashes are the spelling both sides accept. */
+function forwardSlashes(p) {
+    return p.replace(/\\/g, '/');
+}
+/** FILETIME counts 100ns ticks from 1601; the Unix epoch is this many ticks in. */
+const UNIX_EPOCH_FILETIME = 116444736000000000n;
+/** `EPOCHREALTIME` as a FILETIME. Its decimal mark follows bash's locale. */
+function filetimeOf(epochRealtime) {
+    const m = /^(\d+)[.,](\d{6})$/.exec(epochRealtime);
+    return m ? (BigInt(m[1]) * 1000000n + BigInt(m[2])) * 10n + UNIX_EPOCH_FILETIME : undefined;
+}
+/** Rows are `ran <pid> <time>` and `exited <pid> <time>`. Each exit closes its pid's latest run. */
+export function parseShells(text) {
+    const shells = [];
+    for (const row of text.split('\n')) {
+        const m = /^(ran|exited) (\d+) (\S+)$/.exec(row.trim());
+        const at = m ? filetimeOf(m[3]) : undefined;
+        if (!m || at === undefined)
+            continue;
+        const pid = Number(m[2]);
+        if (m[1] === 'ran') {
+            shells.push({ pid, ranAt: at });
+        }
+        else {
+            const open = shells.findLast(s => s.pid === pid && s.exitedAt === undefined);
+            if (open)
+                open.exitedAt = at;
+        }
+    }
+    return shells;
+}
+/**
+ * The processes a recorded shell started: those created while it lived. Windows
+ * hands a dead shell's pid to the next process, whose children carry the same
+ * parent pid, so only the shell's lifetime tells them apart.
+ */
+export function startedByShells(rows, shells) {
+    const startedBy = (shell, row) => {
+        if (shell.pid !== row.ppid || row.createdAt < shell.ranAt)
+            return false;
+        if (shell.exitedAt !== undefined)
+            return row.createdAt <= shell.exitedAt;
+        // No exit on record: a process holding the pid since before the run is the shell.
+        return rows.some(r => r.pid === shell.pid && r.createdAt <= shell.ranAt);
+    };
+    return rows.filter(row => shells.some(shell => startedBy(shell, row))).map(row => row.pid);
+}
+export function parseProcessTable(text) {
+    const rows = [];
+    for (const line of text.split('\n')) {
+        const m = /^(\d+) (\d+) (\d+)$/.exec(line.trim());
+        if (m)
+            rows.push({ pid: Number(m[1]), ppid: Number(m[2]), createdAt: BigInt(m[3]) });
+    }
+    return rows;
+}
+/** Every process as `pid ppid creation-FILETIME`, one per line. */
+function processTable() {
+    const query = 'Get-CimInstance Win32_Process -Property ProcessId,ParentProcessId,CreationDate'
+        + ' | ForEach-Object { "$($_.ProcessId) $($_.ParentProcessId) $($_.CreationDate.ToFileTimeUtc())" }';
+    return new Promise(resolve => {
+        let out = '';
+        const ps = spawn(system32('WindowsPowerShell', 'v1.0', 'powershell.exe'), ['-NoProfile', '-NonInteractive', '-Command', query], { stdio: ['ignore', 'pipe', 'ignore'] });
+        ps.stdout.on('data', (d) => (out += d.toString()));
+        ps.on('error', () => resolve(''));
+        ps.on('close', () => resolve(out));
+    });
+}
+function taskkillTree(pid) {
+    return new Promise(resolve => {
+        const tk = spawn(system32('taskkill.exe'), ['/pid', String(pid), '/T', '/F'], {
+            stdio: 'ignore'
+        });
+        tk.on('error', () => resolve());
+        tk.on('close', () => resolve());
+    });
+}

package/dist/task/boot-probe.d.ts

@@ -163,9 +163,9 @@ export interface BootDeps {
      * a fake child has no group to kill and a real `process.kill(pid)` against a
      * fake pid would signal something else entirely.
      */
-    killGroup?: (pid: number, signal: NodeJS.Signals) => void;
-    /** Which platform's group options to spawn with. Tests drive the win32 arm
-     *  from a POSIX host; production leaves it to `process.platform`. */
+    killGroup?: (pid: number, signal: NodeJS.Signals, leaderExited: boolean) => void;
+    /** Which platform's spawn options, served-app rule and reap to use. Tests drive
+     *  the win32 arm from a POSIX host; production leaves it to `process.platform`. */
     platform?: NodeJS.Platform;
 }
 /** What `runBootCheck` passes to its spawn. */
@@ -249,6 +249,7 @@ export declare function defaultFindPortHolder(port: number): {
     pid: number;
     command: string;
 } | null;
+export declare const BOOT_KILL_GRACE_MS = 2000;
 /**
  * Exercise the start command ONCE. All four outcomes below were run against real
  * child processes in throwaway projects.

package/dist/task/boot-probe.js

@@ -501,14 +501,11 @@ function holderIsOurs(command, boot) {
     return ((c.includes('bun') || c.includes('node') || c.includes('npm') || c.includes('make'))
         && (c.includes(` ${script}`) || c.endsWith(script)));
 }
+export const BOOT_KILL_GRACE_MS = 2_000;
 /** The real spawn. Kept beside the seam so the default is one line to read. */
 function defaultSpawnBoot(bin, args, o) {
     return spawn(bin, args, o);
 }
-/** The real group teardown; the spawn shape's twin lives beside it. */
-function defaultKillGroup(pid, sig) {
-    reapProcessGroup(pid, sig);
-}
 /**
  * Exercise the start command ONCE. All four outcomes below were run against real
  * child processes in throwaway projects.
@@ -557,7 +554,8 @@ function defaultKillGroup(pid, sig) {
  * reports it that way — see isCommandNotFound) → skip.
  */
 export async function runBootCheck(cwd, [bin, args], graceMs = 10_000, opts = {}) {
-    const expectServer = (opts.expectServer ?? false) && process.platform !== 'win32';
+    const platform = opts.deps?.platform ?? process.platform;
+    const expectServer = (opts.expectServer ?? false) && platform !== 'win32';
     const groupHasListener = opts.deps?.groupHasListener ?? defaultGroupHasListener;
     const httpProbe = opts.deps?.httpProbe ?? defaultHttpProbe;
     const canEnumerate = expectServer ? (opts.deps?.enumerationCapable ?? canEnumerateListeners)() : true;
@@ -579,7 +577,7 @@ export async function runBootCheck(cwd, [bin, args], graceMs = 10_000, opts = {}
     return new Promise(resolve => {
         const child = spawnBoot(runner.bin, args, {
             cwd,
-            ...ownGroupSpawnOptions(opts.deps?.platform ?? process.platform),
+            ...ownGroupSpawnOptions(platform),
             stdio: ['ignore', 'pipe', 'pipe'],
             env: {
                 ...runnerEnv(runner),
@@ -612,7 +610,9 @@ export async function runBootCheck(cwd, [bin, args], graceMs = 10_000, opts = {}
                 clearInterval(poll);
             resolve(r);
         };
-        const reapGroup = opts.deps?.killGroup ?? defaultKillGroup;
+        let leaderExited = false;
+        const reapGroup = opts.deps?.killGroup
+            ?? ((pid, sig, exited) => reapProcessGroup(pid, sig, { platform, leaderExited: exited }));
         const killGroup = (sig) => {
             // Truthiness, deliberately: `process.kill(0, sig)` signals the
             // CALLER's own process group, so a pid of 0 turns a best-effort
@@ -620,17 +620,17 @@ export async function runBootCheck(cwd, [bin, args], graceMs = 10_000, opts = {}
             // `spawnBoot` is a seam now and a fake or future child could.
             if (!child.pid)
                 return;
-            reapGroup(child.pid, sig);
+            reapGroup(child.pid, sig, leaderExited);
         };
         const passAndKill = (renderNote) => {
             settle(renderNote ? { outcome: 'pass', renderNote } : { outcome: 'pass' });
             killGroup('SIGTERM');
-            setTimeout(() => killGroup('SIGKILL'), 2_000).unref();
+            setTimeout(() => killGroup('SIGKILL'), BOOT_KILL_GRACE_MS).unref();
         };
         const failAndKill = (detail) => {
             settle({ outcome: 'fail', detail });
             killGroup('SIGTERM');
-            setTimeout(() => killGroup('SIGKILL'), 2_000).unref();
+            setTimeout(() => killGroup('SIGKILL'), BOOT_KILL_GRACE_MS).unref();
         };
         // Served apps only: poll for a listening socket owned by our process group.
         // As soon as one appears the boot has demonstrably served → run the render
@@ -717,7 +717,7 @@ export async function runBootCheck(cwd, [bin, args], graceMs = 10_000, opts = {}
                     detail: `still running after ${graceMs}ms but never opened a listening socket — the spec/dependencies promise an HTTP server`
                 });
                 killGroup('SIGTERM');
-                setTimeout(() => killGroup('SIGKILL'), 2_000).unref();
+                setTimeout(() => killGroup('SIGKILL'), BOOT_KILL_GRACE_MS).unref();
                 return;
             }
             passAndKill();
@@ -725,6 +725,7 @@ export async function runBootCheck(cwd, [bin, args], graceMs = 10_000, opts = {}
         let timer = setTimeout(onGrace, graceMs);
         child.on('error', () => settle({ outcome: 'skip', spawnFailed: true }));
         child.on('exit', (status, signal) => {
+            leaderExited = true;
             if (status === 0) {
                 if (expectServer && !listenerSeen) {
                     if (!canEnumerate) {

package/dist/task/command-run.js

@@ -29,6 +29,7 @@
  * the gate's boot half, while its command half had none.
  */
 import { spawn } from 'node:child_process';
+import { EXIT_DRAIN_MS } from '../shared/child-process.js';
 import { isCommandNotFound, resolveRunner, runnerEnv } from './runner-resolve.js';
 /**
  * How much of ONE stream may be held in the HOST process, and how it is split.
@@ -71,12 +72,6 @@ class BoundedOutput {
             : this.head + this.tail;
     }
 }
-/**
- * After the child EXITS, how long its pipes may still deliver buffered data
- * before the run is reported. Not a wait for the pipes to CLOSE — that is the
- * bug below — just the turn or two the reader needs to hand over what it has.
- */
-const DRAIN_MS = 50;
 /**
  * The real runner: one bounded child, output collected, never rejects.
  *
@@ -147,7 +142,7 @@ export const spawnCommand = spec => new Promise(resolve => {
     const killAndSettle = () => {
         kill();
         clearTimeout(drain);
-        drain = setTimeout(() => done(null), DRAIN_MS);
+        drain = setTimeout(() => done(null), EXIT_DRAIN_MS);
     };
     // NOT unref'd. This timer is the only bound left on every gate command,
     // repo-health command and ACCEPT-debt re-run, and an unref'd timer is only
@@ -182,7 +177,7 @@ export const spawnCommand = spec => new Promise(resolve => {
         settleIfDrained();
         if (!settled) {
             clearTimeout(drain);
-            drain = setTimeout(() => done(exitStatus), DRAIN_MS);
+            drain = setTimeout(() => done(exitStatus), EXIT_DRAIN_MS);
         }
     });
 });

package/dist/task/deep-render-check.js

@@ -616,6 +616,7 @@ async function drive(url, bin, userDataDir, credentials, onFacts, quietMs, signa
 export async function launchBrowser(bin, userDataDir, { signal } = {}) {
     let child = null;
     let socket = null;
+    let reaped = false;
     const close = () => {
         try {
             socket?.close();
@@ -623,8 +624,13 @@ export async function launchBrowser(bin, userDataDir, { signal } = {}) {
         catch {
             // socket already gone
         }
-        if (child?.pid)
-            reapProcessGroup(child.pid, 'SIGKILL');
+        // Once: a later pass would signal a pid the browser may have given up.
+        if (child?.pid && !reaped) {
+            reaped = true;
+            reapProcessGroup(child.pid, 'SIGKILL', {
+                leaderExited: child.exitCode !== null || child.signalCode !== null
+            });
+        }
         return Promise.resolve();
     };
     signal?.addEventListener('abort', () => void close(), { once: true });

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.40.44",
+    "version": "0.40.46",
     "description": "Deterministic task planning and spec-orchestration for local models — crash-safe /task pipelines with verify/enforce gates, a real-time remote web view, and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",