@neuralnomads/codenomad-dev 0.18.0-dev-20260715-07e8ce68 → 0.18.0-dev-20260716-40cee071

package/dist/workspaces/process-identity.js

@@ -0,0 +1,408 @@
+const LINUX_SNAPSHOT_SCRIPT = String.raw `
+boot=$(cat /proc/sys/kernel/random/boot_id 2>/dev/null) || exit 1
+test -n "$boot" || exit 1
+for stat in /proc/[0-9]*/stat; do
+  line=$(cat "$stat" 2>/dev/null) || continue
+  pid=$(printf '%s\n' "$line" | cut -d' ' -f1)
+  rest=$(printf '%s\n' "$line" | sed 's/^.*) //')
+  set -- $rest
+  printf '%s|%s|%s|%s|%s|%s\n' "$pid" "$2" "$3" "$20" "$boot" "$20"
+done
+`;
+const LINUX_GUARDED_SIGNAL_SCRIPT = String.raw `
+boot=$(cat /proc/sys/kernel/random/boot_id 2>/dev/null) || exit 20
+read_stat() {
+  line=$(cat "/proc/$1/stat" 2>/dev/null) || return 1
+  stat_pid=$(printf '%s\n' "$line" | cut -d' ' -f1); rest=$(printf '%s\n' "$line" | sed 's/^.*) //'); set -- $rest
+  stat_ppid=$2; stat_group=$3; stat_start=$20
+}
+emit_target() {
+  printf 'CODENOMAD_TARGET|%s|%s|%s|%s|%s|%s\n' "$stat_pid" "$stat_ppid" "$stat_group" "$stat_start" "$boot" "$stat_start"
+}
+leader_pid=$1; leader_start=$2; leader_boot=$3; expected_group=$4; requested_signal=$5
+shift 5
+matched=0; cutoff=; signal_sent=0
+if read_stat "$leader_pid" && test "$boot" = "$leader_boot" && test "$stat_start" = "$leader_start" && test "$stat_group" = "$expected_group"; then
+  matched=1
+  for stat in /proc/[0-9]*/stat; do
+    candidate=$(basename "$(dirname "$stat")")
+    if read_stat "$candidate" && test "$stat_group" = "$expected_group"; then emit_target; fi
+  done
+  if kill "-$requested_signal" -- "-$expected_group" 2>/dev/null; then
+    signal_sent=1
+    hz=$(getconf CLK_TCK 2>/dev/null) || exit 21
+    uptime=$(cut -d' ' -f1 /proc/uptime 2>/dev/null) || exit 21
+    cutoff=$(awk -v uptime="$uptime" -v hz="$hz" 'BEGIN { printf "%.0f", uptime * hz }')
+  fi
+else
+  while test "$#" -ge 3; do
+    expected_pid=$1; expected_start=$2; expected_boot=$3; shift 3
+    if read_stat "$expected_pid" && test "$boot" = "$expected_boot" && test "$stat_start" = "$expected_start"; then
+      emit_target
+      if kill "-$requested_signal" "$expected_pid" 2>/dev/null; then signal_sent=1; fi
+    fi
+  done
+fi
+printf 'CODENOMAD_RESULT|%s|%s|%s\n' "$matched" "$cutoff" "$signal_sent"
+`;
+const POSIX_GUARDED_SIGNAL_SCRIPT = String.raw `
+encode() { printf '%s' "$1" | base64 | tr -d '\r\n'; }
+read_identity() {
+  current_meta=$(ps -p "$1" -o ppid= -o pgid= -o lstart= 2>/dev/null) || return 1
+  current_command=$(ps -p "$1" -o command= 2>/dev/null) || return 1
+  current_verify=$(ps -p "$1" -o ppid= -o pgid= -o lstart= 2>/dev/null) || return 1
+  test "$current_meta" = "$current_verify" || return 1
+  set -- $current_meta
+  test "$#" -ge 7 || return 1
+  current_ppid=$1; current_group=$2; shift 2
+  current_start="$1 $2 $3 $4 $5"
+  current_identity=$(printf '%s\t%s' "$current_start" "$current_command")
+}
+emit_target() {
+  printf 'CODENOMAD_TARGET_B64|%s|%s|%s|' "$current_pid" "$current_ppid" "$current_group"
+  encode "$current_start"; printf '|'; encode "$current_command"; printf '\n'
+}
+leader_pid=$1; leader_start=$2; expected_group=$3; requested_signal=$4; shift 4
+matched=0; signal_sent=0
+if read_identity "$leader_pid" && test "$current_group" = "$expected_group" && test "$current_identity" = "$leader_start"; then
+  matched=1
+  for current_pid in $(ps -eo pid= 2>/dev/null); do
+    if read_identity "$current_pid" && test "$current_group" = "$expected_group"; then emit_target; fi
+  done
+  if kill "-$requested_signal" -- "-$expected_group" 2>/dev/null; then signal_sent=1; fi
+else
+  while test "$#" -ge 2; do
+    expected_pid=$1; expected_start=$2; shift 2
+    current_pid=$expected_pid
+    if read_identity "$expected_pid" && test "$current_identity" = "$expected_start"; then
+      emit_target
+      if kill "-$requested_signal" "$expected_pid" 2>/dev/null; then signal_sent=1; fi
+    fi
+  done
+fi
+printf 'CODENOMAD_RESULT|%s||%s\n' "$matched" "$signal_sent"
+`;
+const POSIX_OWNED_GROUP_SIGNAL_SCRIPT = String.raw `
+encode() { printf '%s' "$1" | base64 | tr -d '\r\n'; }
+read_identity() {
+  current_meta=$(ps -p "$1" -o ppid= -o pgid= -o lstart= 2>/dev/null) || return 1
+  current_command=$(ps -p "$1" -o command= 2>/dev/null) || return 1
+  current_verify=$(ps -p "$1" -o ppid= -o pgid= -o lstart= 2>/dev/null) || return 1
+  test "$current_meta" = "$current_verify" || return 1
+  set -- $current_meta
+  test "$#" -ge 7 || return 1
+  current_ppid=$1; current_group=$2; shift 2
+  current_start="$1 $2 $3 $4 $5"
+  current_identity=$(printf '%s\t%s' "$current_start" "$current_command")
+}
+emit_target() {
+  printf 'CODENOMAD_TARGET_B64|%s|%s|%s|' "$current_pid" "$current_ppid" "$current_group"
+  encode "$current_start"; printf '|'; encode "$current_command"; printf '\n'
+}
+root_pid=$1; requested_signal=$2; matched=0; signal_sent=0
+if read_identity "$root_pid" && test "$current_group" = "$root_pid"; then
+  matched=1
+  for current_pid in $(ps -eo pid= 2>/dev/null); do
+    if read_identity "$current_pid" && test "$current_group" = "$root_pid"; then emit_target; fi
+  done
+  if kill "-$requested_signal" -- "-$root_pid" 2>/dev/null; then signal_sent=1; fi
+  for current_pid in $(ps -eo pid= 2>/dev/null); do
+    if read_identity "$current_pid" && test "$current_group" = "$root_pid"; then emit_target; fi
+  done
+fi
+printf 'CODENOMAD_RESULT|%s||%s\n' "$matched" "$signal_sent"
+`;
+function commandError(result) {
+    return result.error?.message || String(result.stderr ?? result.stdout ?? "").trim() || `exit code ${result.status}`;
+}
+function parseDelimitedSnapshot(output, requireBootId = false) {
+    const processes = new Map();
+    for (const line of output.split(/\r?\n/)) {
+        if (!line)
+            continue;
+        const fields = line.split("|");
+        if (fields.length !== 6)
+            return null;
+        const [pidText, parentPidText, groupIdText, startTime = "", bootId = "", startOrder = ""] = fields;
+        const pid = Number.parseInt(pidText ?? "", 10);
+        const parentPid = Number.parseInt(parentPidText ?? "", 10);
+        const groupId = Number.parseInt(groupIdText ?? "", 10);
+        if (!/^\d+$/.test(pidText ?? "") || !/^\d+$/.test(parentPidText ?? "") || !/^\d+$/.test(groupIdText ?? "") ||
+            !Number.isInteger(pid) || pid <= 0 || !Number.isInteger(parentPid) || !startTime || (requireBootId && !bootId))
+            return null;
+        processes.set(pid, {
+            pid,
+            parentPid,
+            groupId: Number.isInteger(groupId) && groupId > 0 ? groupId : pid,
+            startTime,
+            ...(bootId ? { bootId } : {}),
+            ...(startOrder ? { startOrder } : {}),
+        });
+    }
+    return processes;
+}
+function decodeBase64Field(value) {
+    if (value.length === 0 || value.length % 4 !== 0 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {
+        return null;
+    }
+    try {
+        const bytes = Buffer.from(value, "base64");
+        if (bytes.toString("base64") !== value)
+            return null;
+        return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        return null;
+    }
+}
+function parseBase64Snapshot(output, prefix = "CODENOMAD_B64|") {
+    const processes = new Map();
+    for (const line of output.split(/\r?\n/)) {
+        if (!line)
+            continue;
+        if (!line.startsWith(prefix))
+            return null;
+        const fields = line.slice(prefix.length).split("|");
+        if (fields.length !== 5)
+            return null;
+        const [pidText = "", parentPidText = "", groupIdText = "", startEncoded = "", commandEncoded = ""] = fields;
+        if (!/^\d+$/.test(pidText) || !/^\d+$/.test(parentPidText) || !/^\d+$/.test(groupIdText))
+            return null;
+        const pid = Number.parseInt(pidText, 10);
+        const parentPid = Number.parseInt(parentPidText, 10);
+        const groupId = Number.parseInt(groupIdText, 10);
+        const start = decodeBase64Field(startEncoded);
+        const command = decodeBase64Field(commandEncoded);
+        if (pid <= 0 || parentPid < 0 || groupId <= 0 || start === null || command === null)
+            return null;
+        processes.set(pid, { pid, parentPid, groupId, startTime: `${start}\t${command}` });
+    }
+    return processes;
+}
+function parsePortablePosixSnapshot(output) {
+    const processes = new Map();
+    for (const line of output.split(/\r?\n/)) {
+        if (!line.trim())
+            continue;
+        const match = line.match(/^\s*(\d+)\s+(\d+)\s+(\d+)\s+(\S+\s+\S+\s+\d+\s+\d{2}:\d{2}:\d{2}\s+\d{4})\s+(.+)$/);
+        if (!match)
+            return null;
+        const [, pidText = "", parentPidText = "", groupIdText = "", start = "", command = ""] = match;
+        const pid = Number.parseInt(pidText, 10);
+        const parentPid = Number.parseInt(parentPidText, 10);
+        const groupId = Number.parseInt(groupIdText, 10);
+        if (pid <= 0 || parentPid < 0 || groupId <= 0)
+            return null;
+        processes.set(pid, { pid, parentPid, groupId, startTime: `${start}\t${command}` });
+    }
+    return processes;
+}
+function snapshotOrFailure(processes) {
+    return processes && processes.size > 0
+        ? { ok: true, processes }
+        : { ok: false, error: "process identity query returned no parseable processes" };
+}
+function parseGuardedResult(result) {
+    const signaled = new Map();
+    const failure = (error) => ({
+        ok: false,
+        error,
+        ...(signaled.size > 0 ? { observed: Array.from(signaled.values()) } : {}),
+    });
+    let matched;
+    let signalSent = false;
+    let cutoff;
+    for (const line of String(result.stdout ?? "").split(/\r?\n/)) {
+        if (line.startsWith("CODENOMAD_TARGET|")) {
+            const parsed = parseDelimitedSnapshot(line.slice("CODENOMAD_TARGET|".length));
+            if (!parsed)
+                return failure("guarded signal command returned a malformed target record");
+            for (const identity of parsed.values())
+                signaled.set(identity.pid, identity);
+            continue;
+        }
+        if (line.startsWith("CODENOMAD_TARGET_B64|")) {
+            const parsed = parseBase64Snapshot(line, "CODENOMAD_TARGET_B64|");
+            if (!parsed)
+                return failure("guarded signal command returned a malformed target record");
+            for (const identity of parsed.values())
+                signaled.set(identity.pid, identity);
+            continue;
+        }
+        if (line.startsWith("CODENOMAD_RESULT|")) {
+            const fields = line.split("|");
+            if (fields.length !== 4 || !/^[01]$/.test(fields[1] ?? "") || !/^[01]$/.test(fields[3] ?? "")) {
+                return failure("guarded signal command returned a malformed result record");
+            }
+            const [, matchedText, cutoffText, signalSentText] = fields;
+            matched = matchedText === "1";
+            cutoff = cutoffText || undefined;
+            signalSent = signalSentText === "1";
+            continue;
+        }
+        if (line)
+            return failure("guarded signal command returned unexpected output");
+    }
+    if (result.status !== 0)
+        return failure(commandError(result));
+    return matched === undefined
+        ? failure("guarded signal command returned no structured result")
+        : { ok: true, matched, signalSent, signaled: Array.from(signaled.values()), ...(cutoff ? { cutoff } : {}) };
+}
+function runGuardedCommand(spawnCommand, command, args, timeoutMs) {
+    try {
+        return parseGuardedResult(spawnCommand(command, args, { encoding: "utf8", timeout: timeoutMs }));
+    }
+    catch (error) {
+        return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+}
+function signalName(signal) {
+    return signal === "SIGKILL" ? "KILL" : "TERM";
+}
+function shellGuardArgs(request, linux) {
+    const leader = request.leader;
+    const args = linux
+        ? [String(leader?.pid ?? 0), leader?.startTime ?? "", leader?.bootId ?? "", String(request.groupId ?? 0), signalName(request.signal)]
+        : [String(leader?.pid ?? 0), leader?.startTime ?? "", String(request.groupId ?? 0), signalName(request.signal)];
+    for (const member of request.members) {
+        args.push(String(member.pid), member.startTime);
+        if (linux)
+            args.push(member.bootId ?? "");
+    }
+    return args;
+}
+function quotePowerShell(value) {
+    return `'${value.replace(/'/g, "''")}'`;
+}
+function buildWindowsGuardedScript(request) {
+    const leaderPid = request.leader?.pid ?? 0;
+    const leaderStart = quotePowerShell(request.leader?.startTime ?? "");
+    const expected = request.members
+        .map((identity) => `@{ Pid = ${identity.pid}; Start = ${quotePowerShell(identity.startTime)} }`)
+        .join(", ");
+    return [
+        "$ErrorActionPreference = 'Stop'",
+        `$leaderPid = ${leaderPid}`,
+        `$leaderStart = ${leaderStart}`,
+        `$expected = @(${expected})`,
+        "function Get-CodeNomadStart($process) { return ([datetime]$process.CreationDate).ToUniversalTime().Ticks.ToString() }",
+        "$all = @(Get-CimInstance Win32_Process -ErrorAction Stop)",
+        "$byPid = @{}; $all | ForEach-Object { $byPid[[int]$_.ProcessId] = $_ }",
+        "$leader = $byPid[$leaderPid]",
+        "$matched = $null -ne $leader -and (Get-CodeNomadStart $leader) -eq $leaderStart",
+        "$selected = @()",
+        "if ($matched) {",
+        "  $ids = @($leaderPid); $changed = $true",
+        "  while ($changed) { $changed = $false; foreach ($process in $all) { if ($ids -contains [int]$process.ParentProcessId -and $ids -notcontains [int]$process.ProcessId) { $ids += [int]$process.ProcessId; $changed = $true } } }",
+        "  $selected = @($all | Where-Object { $ids -contains [int]$_.ProcessId } | Sort-Object ProcessId -Descending)",
+        "} else {",
+        "  foreach ($item in $expected) { $process = $byPid[[int]$item.Pid]; if ($null -ne $process -and (Get-CodeNomadStart $process) -eq [string]$item.Start) { $selected += $process } }",
+        "}",
+        "foreach ($process in $selected) {",
+        "  $start = Get-CodeNomadStart $process",
+        "  '{0}|{1}|0|{2}||{2}' -f [int]$process.ProcessId, [int]$process.ParentProcessId, $start | ForEach-Object { 'CODENOMAD_TARGET|' + $_ }",
+        "}",
+        "foreach ($process in $selected) {",
+        "  Invoke-CimMethod -InputObject $process -MethodName Terminate -Arguments @{ Reason = 1 } -ErrorAction Stop | Out-Null",
+        "}",
+        "'CODENOMAD_RESULT|' + ($(if ($matched) { '1' } else { '0' })) + '||' + ($(if ($selected.Count -gt 0) { '1' } else { '0' }))",
+    ].join("; ");
+}
+export function sameProcess(left, right) {
+    return Boolean(left && right && left.pid === right.pid && left.startTime === right.startTime &&
+        (!left.bootId || !right.bootId || left.bootId === right.bootId));
+}
+export function startedNoLaterThan(identity, cutoff) {
+    const startOrder = identity.startOrder ?? identity.startTime;
+    if (!/^\d+$/.test(startOrder) || !/^\d+$/.test(cutoff))
+        return false;
+    try {
+        return BigInt(startOrder) <= BigInt(cutoff);
+    }
+    catch {
+        return false;
+    }
+}
+export function descendantsOf(processes, rootPid) {
+    const descendants = [];
+    const pending = [rootPid];
+    const seen = new Set(pending);
+    while (pending.length > 0) {
+        const parentPid = pending.shift();
+        for (const process of processes.values()) {
+            if (process.parentPid !== parentPid || seen.has(process.pid))
+                continue;
+            seen.add(process.pid);
+            pending.push(process.pid);
+            descendants.push(process);
+        }
+    }
+    return descendants;
+}
+export function probePosixProcesses(spawnCommand, timeoutMs, platform = process.platform) {
+    try {
+        if (platform === "linux") {
+            const result = spawnCommand("sh", ["-c", LINUX_SNAPSHOT_SCRIPT, "codenomad-posix-identity"], {
+                encoding: "utf8",
+                timeout: timeoutMs,
+            });
+            if (result.status !== 0)
+                return { ok: false, error: commandError(result) };
+            return snapshotOrFailure(parseDelimitedSnapshot(String(result.stdout ?? ""), true));
+        }
+        // POSIX has no portable pidfd/start ticks; collect one coherent table instead of probing every PID.
+        const result = spawnCommand("ps", ["-axo", "pid=,ppid=,pgid=,lstart=,command="], {
+            encoding: "utf8",
+            timeout: timeoutMs,
+        });
+        if (result.status !== 0)
+            return { ok: false, error: commandError(result) };
+        return snapshotOrFailure(parsePortablePosixSnapshot(String(result.stdout ?? "")));
+    }
+    catch (error) {
+        return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+}
+export function probeWindowsProcesses(spawnCommand, timeoutMs) {
+    const script = [
+        "$all = @(Get-CimInstance Win32_Process -ErrorAction Stop)",
+        "$all | Where-Object { [int]$_.ProcessId -gt 0 } | ForEach-Object { $start = ([datetime]$_.CreationDate).ToUniversalTime().Ticks.ToString(); '{0}|{1}|0|{2}||{2}' -f [int]$_.ProcessId, [int]$_.ParentProcessId, $start }",
+    ].join("; ");
+    try {
+        const result = spawnCommand("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
+            encoding: "utf8",
+            timeout: timeoutMs,
+        });
+        if (result.status !== 0)
+            return { ok: false, error: commandError(result) };
+        return snapshotOrFailure(parseDelimitedSnapshot(String(result.stdout ?? "")));
+    }
+    catch (error) {
+        return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+}
+export function probeWslProcesses(spawnCommand, distro, timeoutMs) {
+    try {
+        const result = spawnCommand("wsl.exe", ["--distribution", distro, "--exec", "sh", "-c", LINUX_SNAPSHOT_SCRIPT, "codenomad-wsl-identity"], { encoding: "utf8", timeout: timeoutMs });
+        if (result.status !== 0)
+            return { ok: false, error: commandError(result) };
+        return snapshotOrFailure(parseDelimitedSnapshot(String(result.stdout ?? ""), true));
+    }
+    catch (error) {
+        return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+}
+export function signalPosixProcesses(spawnCommand, request, timeoutMs, platform) {
+    const linux = platform === "linux";
+    return runGuardedCommand(spawnCommand, "sh", ["-c", linux ? LINUX_GUARDED_SIGNAL_SCRIPT : POSIX_GUARDED_SIGNAL_SCRIPT, "codenomad-guarded-signal", ...shellGuardArgs(request, linux)], timeoutMs);
+}
+export function signalOwnedPosixProcessGroup(spawnCommand, rootPid, signal, timeoutMs) {
+    return runGuardedCommand(spawnCommand, "sh", ["-c", POSIX_OWNED_GROUP_SIGNAL_SCRIPT, "codenomad-owned-group-cleanup", String(rootPid), signalName(signal)], timeoutMs);
+}
+export function signalWslProcesses(spawnCommand, distro, request, timeoutMs) {
+    return runGuardedCommand(spawnCommand, "wsl.exe", ["--distribution", distro, "--exec", "sh", "-c", LINUX_GUARDED_SIGNAL_SCRIPT, "codenomad-wsl-guarded-signal", ...shellGuardArgs(request, true)], timeoutMs);
+}
+export function signalWindowsProcesses(spawnCommand, request, timeoutMs) {
+    return runGuardedCommand(spawnCommand, "powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", buildWindowsGuardedScript(request)], timeoutMs);
+}

package/dist/workspaces/process-identity.test.js

@@ -0,0 +1,165 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { probePosixProcesses, probeWindowsProcesses, probeWslProcesses, sameProcess, signalOwnedPosixProcessGroup, signalPosixProcesses, signalWindowsProcesses, startedNoLaterThan, } from "./process-identity";
+function result(stdout = "", status = 0, stderr = "") {
+    return { pid: 1, output: [null, stdout, stderr], stdout, stderr, status, signal: null };
+}
+function b64(value) {
+    return Buffer.from(value).toString("base64");
+}
+describe("process identity probes", () => {
+    it("parses Linux PID, PGID, and kernel process start ticks", () => {
+        let invocation;
+        const probe = probePosixProcesses(((command, args) => {
+            invocation = { command, args };
+            return result("42|1|42|123456|boot-a|123456\n");
+        }), 25, "linux");
+        assert.equal(invocation?.command, "sh");
+        assert.ok(invocation?.args.includes("codenomad-posix-identity"));
+        assert.equal(probe.ok, true);
+        if (probe.ok) {
+            assert.deepEqual(probe.processes.get(42), {
+                pid: 42,
+                parentPid: 1,
+                groupId: 42,
+                startTime: "123456",
+                bootId: "boot-a",
+                startOrder: "123456",
+            });
+        }
+    });
+    it("uses one process-table query on non-Linux POSIX platforms", () => {
+        let invocation;
+        const probe = probePosixProcesses(((command, args) => {
+            invocation = { command, args };
+            return result("  42     1    42 Fri Jul 10 12:34:56 2026 /usr/bin/opencode serve\n");
+        }), 25, "darwin");
+        assert.equal(invocation?.command, "ps");
+        assert.deepEqual(invocation?.args, ["-axo", "pid=,ppid=,pgid=,lstart=,command="]);
+        assert.equal(probe.ok && probe.processes.get(42)?.startTime, "Fri Jul 10 12:34:56 2026\t/usr/bin/opencode serve");
+    });
+    it("round trips delimiter-heavy non-Linux POSIX command identities", () => {
+        const command = "/opt/opencode 'pipe|value'\t\"quoted\" café";
+        const start = "Fri Jul 10 12:34:56 2026";
+        const probe = probePosixProcesses((() => result(`42 1 42 ${start} ${command}\n`)), 25, "darwin");
+        assert.equal(probe.ok && probe.processes.get(42)?.startTime, `${start}\t${command}`);
+    });
+    it("uses delimiter-safe identities during non-Linux POSIX escalation", () => {
+        const command = "/opt/opencode pipe|value\nnext\t'quoted'";
+        const startTime = `Fri Jul 10 12:34:56 2026\t${command}`;
+        const identity = { pid: 42, parentPid: 1, groupId: 42, startTime };
+        const guarded = signalPosixProcesses((() => result(`CODENOMAD_TARGET_B64|42|1|42|${b64("Fri Jul 10 12:34:56 2026")}|${b64(command)}\nCODENOMAD_RESULT|1||1\n`)), { leader: identity, groupId: 42, members: [identity], signal: "SIGKILL" }, 25, "darwin");
+        assert.equal(guarded.ok, true);
+        assert.equal(guarded.ok && guarded.signaled[0]?.startTime, startTime);
+    });
+    it("signals and rescans a still-owned portable POSIX process group", () => {
+        const command = "/opt/opencode pipe|value\nchild";
+        let script = "";
+        const cleanup = signalOwnedPosixProcessGroup(((_command, args) => {
+            script = args[1] ?? "";
+            return result(`CODENOMAD_TARGET_B64|42|1|42|${b64("Fri Jul 10 12:34:56 2026")}|${b64(command)}\n` +
+                "CODENOMAD_RESULT|1||1\n");
+        }), 42, "SIGTERM", 25);
+        assert.equal(cleanup.ok && cleanup.matched, true);
+        assert.equal(cleanup.ok && cleanup.signaled[0]?.startTime, `Fri Jul 10 12:34:56 2026\t${command}`);
+        assert.ok(script.indexOf('kill "-$requested_signal"') < script.lastIndexOf("for current_pid"));
+    });
+    it("rejects malformed portable process rows", () => {
+        const probe = probePosixProcesses((() => result("42 malformed process row\n")), 25, "darwin");
+        assert.deepEqual(probe, { ok: false, error: "process identity query returned no parseable processes" });
+    });
+    it("queries WSL identities inside the selected distro", () => {
+        let invocation;
+        const probe = probeWslProcesses(((command, args) => {
+            invocation = { command, args };
+            return result("99|1|99|123456|boot-a|123456\n101|99|99|123460|boot-a|123460\n");
+        }), "Ubuntu Test", 25);
+        assert.equal(invocation?.command, "wsl.exe");
+        assert.deepEqual(invocation?.args.slice(0, 4), ["--distribution", "Ubuntu Test", "--exec", "sh"]);
+        assert.ok(invocation?.args.includes("codenomad-wsl-identity"));
+        assert.equal(probe.ok && probe.processes.get(101)?.startTime, "123460");
+    });
+    it("parses Windows CIM CreationDate as the immutable identity", () => {
+        let script = "";
+        const probe = probeWindowsProcesses(((_command, args) => {
+            script = args.at(-1) ?? "";
+            return result("4242|100|0|20260710123456.123456+000||20260710123456\n");
+        }), 25);
+        assert.match(script, /Get-CimInstance Win32_Process/);
+        assert.match(script, /ProcessId -gt 0/);
+        assert.equal(probe.ok && probe.processes.get(4242)?.startTime, "20260710123456.123456+000");
+    });
+    it("matches only the same numeric PID and start identity", () => {
+        const original = { pid: 42, parentPid: 1, groupId: 42, startTime: "start-a" };
+        assert.equal(sameProcess(original, { ...original }), true);
+        assert.equal(sameProcess(original, { ...original, startTime: "start-b" }), false);
+        assert.equal(sameProcess(original, { ...original, pid: 43 }), false);
+    });
+    it("compares Linux start ticks numerically and rejects non-numeric fallbacks", () => {
+        const identity = { pid: 42, parentPid: 1, groupId: 42, startTime: "9", startOrder: "9" };
+        assert.equal(startedNoLaterThan(identity, "10"), true);
+        assert.equal(startedNoLaterThan({ ...identity, startOrder: "11" }, "10"), false);
+        assert.equal(startedNoLaterThan({ ...identity, startOrder: "Fri Jul 10" }, "10"), false);
+    });
+    it("returns mismatch without scheduling a second POSIX signal command", () => {
+        const invocations = [];
+        const identity = {
+            pid: 42,
+            parentPid: 1,
+            groupId: 42,
+            startTime: "123456",
+            bootId: "boot-a",
+            startOrder: "123456",
+        };
+        const guarded = signalPosixProcesses(((command, args) => {
+            invocations.push({ command, args });
+            return result("CODENOMAD_RESULT|0||0\n");
+        }), { leader: identity, groupId: 42, members: [identity], signal: "SIGTERM" }, 25, "linux");
+        assert.deepEqual(guarded, { ok: true, matched: false, signalSent: false, signaled: [] });
+        assert.equal(invocations.length, 1);
+        assert.equal(invocations[0]?.command, "sh");
+        assert.match(invocations[0]?.args[2] ?? "", /codenomad-guarded-signal/);
+        assert.ok(invocations[0]?.args.includes("123456"));
+        const script = invocations[0]?.args[1] ?? "";
+        assert.ok(script.indexOf('kill "-$requested_signal"') < script.indexOf("uptime=$(cut"));
+    });
+    it("uses one guarded Windows CIM selection and termination invocation", () => {
+        const invocations = [];
+        const identity = { pid: 4242, parentPid: 1, groupId: 4242, startTime: "created" };
+        const guarded = signalWindowsProcesses(((command, args) => {
+            invocations.push({ command, args });
+            return result("CODENOMAD_TARGET|4242|1|0|created||99\nCODENOMAD_RESULT|1||1\n");
+        }), { leader: identity, groupId: 4242, members: [identity], signal: "SIGKILL" }, 25);
+        assert.equal(guarded.ok && guarded.matched, true);
+        assert.equal(invocations.length, 1);
+        assert.equal(invocations[0]?.command, "powershell.exe");
+        const script = invocations[0]?.args.at(-1) ?? "";
+        assert.match(script, /CreationDate/);
+        assert.match(script, /Invoke-CimMethod -InputObject/);
+        assert.equal(script.match(/foreach \(\$process in \$selected\)/g)?.length, 2);
+        assert.ok(script.indexOf("CODENOMAD_TARGET|") < script.indexOf("Invoke-CimMethod"));
+        assert.doesNotMatch(script, /taskkill/i);
+    });
+    it("preserves observed Windows targets when guarded termination fails partway", () => {
+        const identity = { pid: 4242, parentPid: 1, groupId: 4242, startTime: "created" };
+        const guarded = signalWindowsProcesses((() => result([
+            "CODENOMAD_TARGET|4242|1|0|created||99",
+            "CODENOMAD_TARGET|4243|4242|0|descendant||100",
+        ].join("\n"), 1, "termination failed")), {
+            leader: identity,
+            groupId: 4242,
+            members: [identity],
+            signal: "SIGTERM",
+        }, 25);
+        assert.equal(guarded.ok, false);
+        assert.deepEqual(!guarded.ok && guarded.observed?.map((target) => target.pid), [4242, 4243]);
+    });
+    it("reports command failures without fabricating identities", () => {
+        const probe = probeWindowsProcesses((() => result("", 1, "CIM unavailable")), 25);
+        assert.deepEqual(probe, { ok: false, error: "CIM unavailable" });
+    });
+    it("rejects successful commands with unparseable or empty output", () => {
+        const probe = probeWslProcesses((() => result("not an identity")), "Ubuntu", 25);
+        assert.deepEqual(probe, { ok: false, error: "process identity query returned no parseable processes" });
+    });
+});