@neuralnomads/codenomad-dev 0.18.0-dev-20260716-40cee071 → 0.18.0-dev-20260720-4c50829d

package/dist/workspaces/process-identity.js

@@ -1,32 +1,26 @@
-const LINUX_SNAPSHOT_SCRIPT = String.raw `
-boot=$(cat /proc/sys/kernel/random/boot_id 2>/dev/null) || exit 1
-test -n "$boot" || exit 1
-for stat in /proc/[0-9]*/stat; do
-  line=$(cat "$stat" 2>/dev/null) || continue
-  pid=$(printf '%s\n' "$line" | cut -d' ' -f1)
-  rest=$(printf '%s\n' "$line" | sed 's/^.*) //')
-  set -- $rest
-  printf '%s|%s|%s|%s|%s|%s\n' "$pid" "$2" "$3" "$20" "$boot" "$20"
-done
-`;
-const LINUX_GUARDED_SIGNAL_SCRIPT = String.raw `
+export const LAUNCH_CLEANUP_TOKEN_ENV = "CODENOMAD_LAUNCH_CLEANUP_TOKEN";
+const LINUX_IDENTITY_FUNCTIONS = String.raw `
 boot=$(cat /proc/sys/kernel/random/boot_id 2>/dev/null) || exit 20
 read_stat() {
   line=$(cat "/proc/$1/stat" 2>/dev/null) || return 1
   stat_pid=$(printf '%s\n' "$line" | cut -d' ' -f1); rest=$(printf '%s\n' "$line" | sed 's/^.*) //'); set -- $rest
   stat_ppid=$2; stat_group=$3; stat_start=$20
 }
-emit_target() {
-  printf 'CODENOMAD_TARGET|%s|%s|%s|%s|%s|%s\n' "$stat_pid" "$stat_ppid" "$stat_group" "$stat_start" "$boot" "$stat_start"
-}
+emit_linux() { printf '%s|%s|%s|%s|%s|%s|%s\n' "$1" "$stat_pid" "$stat_ppid" "$stat_group" "$stat_start" "$boot" "$stat_start"; }
+`;
+const LINUX_SNAPSHOT_SCRIPT = String.raw `${LINUX_IDENTITY_FUNCTIONS}
+for stat in /proc/[0-9]*/stat; do
+  pid=$(basename "$(dirname "$stat")"); read_stat "$pid" && emit_linux "" | cut -c2-
+done
+exit 0
+`;
+const LINUX_GUARDED_SIGNAL_SCRIPT = String.raw `${LINUX_IDENTITY_FUNCTIONS}
 leader_pid=$1; leader_start=$2; leader_boot=$3; expected_group=$4; requested_signal=$5
-shift 5
-matched=0; cutoff=; signal_sent=0
+shift 5; matched=0; cutoff=; signal_sent=0
 if read_stat "$leader_pid" && test "$boot" = "$leader_boot" && test "$stat_start" = "$leader_start" && test "$stat_group" = "$expected_group"; then
   matched=1
   for stat in /proc/[0-9]*/stat; do
-    candidate=$(basename "$(dirname "$stat")")
-    if read_stat "$candidate" && test "$stat_group" = "$expected_group"; then emit_target; fi
+    candidate=$(basename "$(dirname "$stat")"); read_stat "$candidate" && test "$stat_group" = "$expected_group" && emit_linux CODENOMAD_TARGET
   done
   if kill "-$requested_signal" -- "-$expected_group" 2>/dev/null; then
     signal_sent=1
@@ -38,83 +32,106 @@ else
   while test "$#" -ge 3; do
     expected_pid=$1; expected_start=$2; expected_boot=$3; shift 3
     if read_stat "$expected_pid" && test "$boot" = "$expected_boot" && test "$stat_start" = "$expected_start"; then
-      emit_target
+      emit_linux CODENOMAD_TARGET
       if kill "-$requested_signal" "$expected_pid" 2>/dev/null; then signal_sent=1; fi
     fi
   done
 fi
 printf 'CODENOMAD_RESULT|%s|%s|%s\n' "$matched" "$cutoff" "$signal_sent"
 `;
-const POSIX_GUARDED_SIGNAL_SCRIPT = String.raw `
+const POSIX_IDENTITY_FUNCTIONS = String.raw `
+LC_ALL=C; export LC_ALL; set -f
 encode() { printf '%s' "$1" | base64 | tr -d '\r\n'; }
 read_identity() {
-  current_meta=$(ps -p "$1" -o ppid= -o pgid= -o lstart= 2>/dev/null) || return 1
-  current_command=$(ps -p "$1" -o command= 2>/dev/null) || return 1
-  current_verify=$(ps -p "$1" -o ppid= -o pgid= -o lstart= 2>/dev/null) || return 1
+  current_meta=$(ps -p "$1" -o ppid= -o pgid= -o lstart= -o comm= 2>/dev/null) || return 1
+  current_verify=$(ps -p "$1" -o ppid= -o pgid= -o lstart= -o comm= 2>/dev/null) || return 1
   test "$current_meta" = "$current_verify" || return 1
-  set -- $current_meta
-  test "$#" -ge 7 || return 1
-  current_ppid=$1; current_group=$2; shift 2
-  current_start="$1 $2 $3 $4 $5"
+  set -- $current_meta; test "$#" -ge 7 || return 1
+  current_ppid=$1; current_group=$2; shift 2; current_start="$1 $2 $3 $4 $5"
+  shift 5; current_command="$*"; test -n "$current_command" || return 1
   current_identity=$(printf '%s\t%s' "$current_start" "$current_command")
 }
 emit_target() {
   printf 'CODENOMAD_TARGET_B64|%s|%s|%s|' "$current_pid" "$current_ppid" "$current_group"
   encode "$current_start"; printf '|'; encode "$current_command"; printf '\n'
 }
-leader_pid=$1; leader_start=$2; expected_group=$3; requested_signal=$4; shift 4
+group_pids() { ps -axo pid=,pgid= 2>/dev/null | awk -v group="$1" '$2 == group { print $1 }'; }
+has_cleanup_token() {
+  test -n "$cleanup_token" || return 1
+  ps eww -p "$1" -o command= 2>/dev/null | tr ' ' '\n' | grep -Fqx -- "${LAUNCH_CLEANUP_TOKEN_ENV}=$cleanup_token"
+}
+`;
+const LINUX_TOKEN_SCRIPT = String.raw `${LINUX_IDENTITY_FUNCTIONS}
+key=$1; expected=$2; requested_signal=$3
+matches_token() { test -r "/proc/$1/environ" && tr '\0' '\n' < "/proc/$1/environ" 2>/dev/null | grep -Fqx -- "$key=$expected"; }
+signal_sent=0; passes=1; test -n "$requested_signal" && passes=3
+pass=0
+while test "$pass" -lt "$passes"; do
+  pass=$((pass + 1))
+  for environ in /proc/[0-9]*/environ; do
+    pid=$(basename "$(dirname "$environ")")
+    if matches_token "$pid" && read_stat "$pid"; then
+      test -n "$requested_signal" && prefix=CODENOMAD_TARGET || prefix=CODENOMAD_PROCESS
+      emit_linux "$prefix"
+      if test -n "$requested_signal" && matches_token "$pid" && read_stat "$pid" && kill "-$requested_signal" "$pid" 2>/dev/null; then signal_sent=1; fi
+    fi
+  done
+done
+if test -n "$requested_signal"; then printf 'CODENOMAD_RESULT|%s\n' "$signal_sent"; fi
+exit 0
+`;
+const POSIX_GUARDED_SIGNAL_SCRIPT = String.raw `${POSIX_IDENTITY_FUNCTIONS}
+leader_pid=$1; leader_start=$2; expected_group=$3; requested_signal=$4; allow_leaderless=$5; cleanup_token=$6; shift 6
 matched=0; signal_sent=0
 if read_identity "$leader_pid" && test "$current_group" = "$expected_group" && test "$current_identity" = "$leader_start"; then
   matched=1
-  for current_pid in $(ps -eo pid= 2>/dev/null); do
-    if read_identity "$current_pid" && test "$current_group" = "$expected_group"; then emit_target; fi
+  for current_pid in $(group_pids "$expected_group"); do
+    read_identity "$current_pid" && test "$current_group" = "$expected_group" && emit_target
   done
   if kill "-$requested_signal" -- "-$expected_group" 2>/dev/null; then signal_sent=1; fi
+elif test "$allow_leaderless" = 1 && ! read_identity "$expected_group"; then
+  anchor=0
+  while test "$#" -ge 2; do
+    expected_pid=$1; expected_start=$2; shift 2; current_pid=$expected_pid
+    if read_identity "$expected_pid" && test "$current_group" = "$expected_group" && test "$current_identity" = "$expected_start"; then anchor=1; fi
+  done
+  if test "$anchor" = 0; then
+    for current_pid in $(group_pids "$expected_group"); do
+      if has_cleanup_token "$current_pid" && read_identity "$current_pid" && test "$current_group" = "$expected_group"; then anchor=1; break; fi
+    done
+  fi
+  if test "$anchor" = 1; then
+    matched=1
+    for current_pid in $(group_pids "$expected_group"); do
+      read_identity "$current_pid" && test "$current_group" = "$expected_group" && emit_target
+    done
+    if kill "-$requested_signal" -- "-$expected_group" 2>/dev/null; then signal_sent=1; fi
+  fi
 else
   while test "$#" -ge 2; do
-    expected_pid=$1; expected_start=$2; shift 2
-    current_pid=$expected_pid
-    if read_identity "$expected_pid" && test "$current_identity" = "$expected_start"; then
-      emit_target
-      if kill "-$requested_signal" "$expected_pid" 2>/dev/null; then signal_sent=1; fi
+    expected_pid=$1; expected_start=$2; shift 2; current_pid=$expected_pid
+    if read_identity "$expected_pid" && test "$current_group" = "$expected_group" && test "$current_identity" = "$expected_start"; then
+      emit_target; if kill "-$requested_signal" "$expected_pid" 2>/dev/null; then signal_sent=1; fi
     fi
   done
 fi
 printf 'CODENOMAD_RESULT|%s||%s\n' "$matched" "$signal_sent"
 `;
-const POSIX_OWNED_GROUP_SIGNAL_SCRIPT = String.raw `
-encode() { printf '%s' "$1" | base64 | tr -d '\r\n'; }
-read_identity() {
-  current_meta=$(ps -p "$1" -o ppid= -o pgid= -o lstart= 2>/dev/null) || return 1
-  current_command=$(ps -p "$1" -o command= 2>/dev/null) || return 1
-  current_verify=$(ps -p "$1" -o ppid= -o pgid= -o lstart= 2>/dev/null) || return 1
-  test "$current_meta" = "$current_verify" || return 1
-  set -- $current_meta
-  test "$#" -ge 7 || return 1
-  current_ppid=$1; current_group=$2; shift 2
-  current_start="$1 $2 $3 $4 $5"
-  current_identity=$(printf '%s\t%s' "$current_start" "$current_command")
-}
-emit_target() {
-  printf 'CODENOMAD_TARGET_B64|%s|%s|%s|' "$current_pid" "$current_ppid" "$current_group"
-  encode "$current_start"; printf '|'; encode "$current_command"; printf '\n'
-}
+const POSIX_OWNED_GROUP_SIGNAL_SCRIPT = String.raw `${POSIX_IDENTITY_FUNCTIONS}
 root_pid=$1; requested_signal=$2; matched=0; signal_sent=0
 if read_identity "$root_pid" && test "$current_group" = "$root_pid"; then
   matched=1
-  for current_pid in $(ps -eo pid= 2>/dev/null); do
-    if read_identity "$current_pid" && test "$current_group" = "$root_pid"; then emit_target; fi
+  for current_pid in $(group_pids "$root_pid"); do
+    read_identity "$current_pid" && test "$current_group" = "$root_pid" && emit_target
   done
   if kill "-$requested_signal" -- "-$root_pid" 2>/dev/null; then signal_sent=1; fi
-  for current_pid in $(ps -eo pid= 2>/dev/null); do
-    if read_identity "$current_pid" && test "$current_group" = "$root_pid"; then emit_target; fi
+  for current_pid in $(group_pids "$root_pid"); do
+    read_identity "$current_pid" && test "$current_group" = "$root_pid" && emit_target
   done
 fi
 printf 'CODENOMAD_RESULT|%s||%s\n' "$matched" "$signal_sent"
 `;
-function commandError(result) {
-    return result.error?.message || String(result.stderr ?? result.stdout ?? "").trim() || `exit code ${result.status}`;
-}
+const commandError = (result) => result.error?.message || String(result.stderr ?? result.stdout ?? "").trim() || `exit code ${result.status}`;
 function parseDelimitedSnapshot(output, requireBootId = false) {
     const processes = new Map();
     for (const line of output.split(/\r?\n/)) {
@@ -130,14 +147,8 @@ function parseDelimitedSnapshot(output, requireBootId = false) {
         if (!/^\d+$/.test(pidText ?? "") || !/^\d+$/.test(parentPidText ?? "") || !/^\d+$/.test(groupIdText ?? "") ||
             !Number.isInteger(pid) || pid <= 0 || !Number.isInteger(parentPid) || !startTime || (requireBootId && !bootId))
             return null;
-        processes.set(pid, {
-            pid,
-            parentPid,
-            groupId: Number.isInteger(groupId) && groupId > 0 ? groupId : pid,
-            startTime,
-            ...(bootId ? { bootId } : {}),
-            ...(startOrder ? { startOrder } : {}),
-        });
+        processes.set(pid, { pid, parentPid, groupId: Number.isInteger(groupId) && groupId > 0 ? groupId : pid, startTime,
+            ...(bootId ? { bootId } : {}), ...(startOrder ? { startOrder } : {}) });
     }
     return processes;
 }
@@ -179,50 +190,69 @@ function parseBase64Snapshot(output, prefix = "CODENOMAD_B64|") {
     }
     return processes;
 }
-function parsePortablePosixSnapshot(output) {
+function parsePortablePosixSnapshot(output, filter) {
     const processes = new Map();
+    const requestedPids = filter?.pids ? new Set(filter.pids) : undefined;
     for (const line of output.split(/\r?\n/)) {
         if (!line.trim())
             continue;
         const match = line.match(/^\s*(\d+)\s+(\d+)\s+(\d+)\s+(\S+\s+\S+\s+\d+\s+\d{2}:\d{2}:\d{2}\s+\d{4})\s+(.+)$/);
-        if (!match)
-            return null;
+        if (!match) {
+            const numeric = line.match(/^\s*(\d+)\s+(\d+)\s+(\d+)\s+/);
+            if (!filter || !numeric || requestedPids?.has(Number(numeric[1])) || Number(numeric[3]) === filter.groupId)
+                return null;
+            continue;
+        }
         const [, pidText = "", parentPidText = "", groupIdText = "", start = "", command = ""] = match;
         const pid = Number.parseInt(pidText, 10);
         const parentPid = Number.parseInt(parentPidText, 10);
         const groupId = Number.parseInt(groupIdText, 10);
         if (pid <= 0 || parentPid < 0 || groupId <= 0)
             return null;
+        if (filter && !requestedPids?.has(pid) && groupId !== filter.groupId)
+            continue;
         processes.set(pid, { pid, parentPid, groupId, startTime: `${start}\t${command}` });
     }
     return processes;
 }
-function snapshotOrFailure(processes) {
-    return processes && processes.size > 0
-        ? { ok: true, processes }
-        : { ok: false, error: "process identity query returned no parseable processes" };
+function querySnapshot(run, parse, options = {}) {
+    const sanitize = options.redact ?? ((error) => error);
+    try {
+        const result = run();
+        if (result.status !== 0)
+            return { ok: false, error: sanitize(commandError(result)) };
+        const processes = parse(String(result.stdout ?? ""));
+        if (processes && (options.allowEmpty || processes.size > 0))
+            return { ok: true, processes };
+        return { ok: false, error: options.malformedError ?? "process identity query returned no parseable processes" };
+    }
+    catch (error) {
+        return { ok: false, error: sanitize(error instanceof Error ? error.message : String(error)) };
+    }
+}
+function parsePrefixedSnapshot(output, prefix) {
+    const records = [];
+    for (const line of output.split(/\r?\n/)) {
+        if (!line)
+            continue;
+        if (!line.startsWith(prefix))
+            return null;
+        records.push(line.slice(prefix.length));
+    }
+    return parseDelimitedSnapshot(records.join("\n"), true);
 }
 function parseGuardedResult(result) {
     const signaled = new Map();
-    const failure = (error) => ({
-        ok: false,
-        error,
-        ...(signaled.size > 0 ? { observed: Array.from(signaled.values()) } : {}),
-    });
+    const failure = (error) => ({ ok: false, error,
+        ...(signaled.size > 0 ? { observed: Array.from(signaled.values()) } : {}) });
     let matched;
     let signalSent = false;
     let cutoff;
     for (const line of String(result.stdout ?? "").split(/\r?\n/)) {
-        if (line.startsWith("CODENOMAD_TARGET|")) {
-            const parsed = parseDelimitedSnapshot(line.slice("CODENOMAD_TARGET|".length));
-            if (!parsed)
-                return failure("guarded signal command returned a malformed target record");
-            for (const identity of parsed.values())
-                signaled.set(identity.pid, identity);
-            continue;
-        }
-        if (line.startsWith("CODENOMAD_TARGET_B64|")) {
-            const parsed = parseBase64Snapshot(line, "CODENOMAD_TARGET_B64|");
+        if (line.startsWith("CODENOMAD_TARGET|") || line.startsWith("CODENOMAD_TARGET_B64|")) {
+            const parsed = line.startsWith("CODENOMAD_TARGET_B64|")
+                ? parseBase64Snapshot(line, "CODENOMAD_TARGET_B64|")
+                : parseDelimitedSnapshot(line.slice("CODENOMAD_TARGET|".length));
             if (!parsed)
                 return failure("guarded signal command returned a malformed target record");
             for (const identity of parsed.values())
@@ -249,22 +279,27 @@ function parseGuardedResult(result) {
         ? failure("guarded signal command returned no structured result")
         : { ok: true, matched, signalSent, signaled: Array.from(signaled.values()), ...(cutoff ? { cutoff } : {}) };
 }
-function runGuardedCommand(spawnCommand, command, args, timeoutMs) {
+function runGuardedCommand(run) {
     try {
-        return parseGuardedResult(spawnCommand(command, args, { encoding: "utf8", timeout: timeoutMs }));
+        return parseGuardedResult(run());
     }
     catch (error) {
         return { ok: false, error: error instanceof Error ? error.message : String(error) };
     }
 }
-function signalName(signal) {
-    return signal === "SIGKILL" ? "KILL" : "TERM";
+const signalName = (signal) => signal === "SIGKILL" ? "KILL" : "TERM";
+function runLinuxScript(spawnCommand, script, args, timeoutMs, label, distro) {
+    return distro
+        ? spawnCommand("wsl.exe", ["--distribution", distro, "--exec", "sh", "-c", script, label, ...args], { encoding: "utf8", timeout: timeoutMs })
+        : spawnCommand("sh", ["-c", script, label, ...args], { encoding: "utf8", timeout: timeoutMs });
 }
+const redactToken = (value, token) => value.split(token).join("[REDACTED]");
 function shellGuardArgs(request, linux) {
     const leader = request.leader;
     const args = linux
         ? [String(leader?.pid ?? 0), leader?.startTime ?? "", leader?.bootId ?? "", String(request.groupId ?? 0), signalName(request.signal)]
-        : [String(leader?.pid ?? 0), leader?.startTime ?? "", String(request.groupId ?? 0), signalName(request.signal)];
+        : [String(leader?.pid ?? 0), leader?.startTime ?? "", String(request.groupId ?? 0), signalName(request.signal),
+            request.allowLeaderlessGroup ? "1" : "0", request.cleanupToken ?? ""];
     for (const member of request.members) {
         args.push(String(member.pid), member.startTime);
         if (linux)
@@ -272,15 +307,11 @@ function shellGuardArgs(request, linux) {
     }
     return args;
 }
-function quotePowerShell(value) {
-    return `'${value.replace(/'/g, "''")}'`;
-}
+const quotePowerShell = (value) => `'${value.replace(/'/g, "''")}'`;
 function buildWindowsGuardedScript(request) {
     const leaderPid = request.leader?.pid ?? 0;
     const leaderStart = quotePowerShell(request.leader?.startTime ?? "");
-    const expected = request.members
-        .map((identity) => `@{ Pid = ${identity.pid}; Start = ${quotePowerShell(identity.startTime)} }`)
-        .join(", ");
+    const expected = request.members.map((identity) => `@{ Pid = ${identity.pid}; Start = ${quotePowerShell(identity.startTime)} }`).join(", ");
     return [
         "$ErrorActionPreference = 'Stop'",
         `$leaderPid = ${leaderPid}`,
@@ -340,69 +371,61 @@ export function descendantsOf(processes, rootPid) {
     }
     return descendants;
 }
-export function probePosixProcesses(spawnCommand, timeoutMs, platform = process.platform) {
-    try {
-        if (platform === "linux") {
-            const result = spawnCommand("sh", ["-c", LINUX_SNAPSHOT_SCRIPT, "codenomad-posix-identity"], {
-                encoding: "utf8",
-                timeout: timeoutMs,
-            });
-            if (result.status !== 0)
-                return { ok: false, error: commandError(result) };
-            return snapshotOrFailure(parseDelimitedSnapshot(String(result.stdout ?? ""), true));
-        }
-        // POSIX has no portable pidfd/start ticks; collect one coherent table instead of probing every PID.
-        const result = spawnCommand("ps", ["-axo", "pid=,ppid=,pgid=,lstart=,command="], {
-            encoding: "utf8",
-            timeout: timeoutMs,
-        });
-        if (result.status !== 0)
-            return { ok: false, error: commandError(result) };
-        return snapshotOrFailure(parsePortablePosixSnapshot(String(result.stdout ?? "")));
-    }
-    catch (error) {
-        return { ok: false, error: error instanceof Error ? error.message : String(error) };
-    }
+export function probePosixProcesses(spawnCommand, timeoutMs, platform = process.platform, filter) {
+    if (platform === "linux")
+        return querySnapshot(() => runLinuxScript(spawnCommand, LINUX_SNAPSHOT_SCRIPT, [], timeoutMs, "codenomad-posix-identity"), (output) => parseDelimitedSnapshot(output, true));
+    // POSIX has no portable pidfd/start ticks; collect one coherent table instead of probing every PID.
+    return querySnapshot(() => spawnCommand("ps", ["-axo", "pid=,ppid=,pgid=,lstart=,comm="], {
+        encoding: "utf8", timeout: timeoutMs, env: { ...process.env, LC_ALL: "C", LANG: "C" },
+    }), (output) => parsePortablePosixSnapshot(output, filter), { allowEmpty: Boolean(filter) });
 }
 export function probeWindowsProcesses(spawnCommand, timeoutMs) {
     const script = [
         "$all = @(Get-CimInstance Win32_Process -ErrorAction Stop)",
         "$all | Where-Object { [int]$_.ProcessId -gt 0 } | ForEach-Object { $start = ([datetime]$_.CreationDate).ToUniversalTime().Ticks.ToString(); '{0}|{1}|0|{2}||{2}' -f [int]$_.ProcessId, [int]$_.ParentProcessId, $start }",
     ].join("; ");
-    try {
-        const result = spawnCommand("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
-            encoding: "utf8",
-            timeout: timeoutMs,
-        });
-        if (result.status !== 0)
-            return { ok: false, error: commandError(result) };
-        return snapshotOrFailure(parseDelimitedSnapshot(String(result.stdout ?? "")));
-    }
-    catch (error) {
-        return { ok: false, error: error instanceof Error ? error.message : String(error) };
-    }
+    return querySnapshot(() => spawnCommand("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { encoding: "utf8", timeout: timeoutMs }), parseDelimitedSnapshot);
 }
 export function probeWslProcesses(spawnCommand, distro, timeoutMs) {
-    try {
-        const result = spawnCommand("wsl.exe", ["--distribution", distro, "--exec", "sh", "-c", LINUX_SNAPSHOT_SCRIPT, "codenomad-wsl-identity"], { encoding: "utf8", timeout: timeoutMs });
-        if (result.status !== 0)
-            return { ok: false, error: commandError(result) };
-        return snapshotOrFailure(parseDelimitedSnapshot(String(result.stdout ?? ""), true));
-    }
-    catch (error) {
-        return { ok: false, error: error instanceof Error ? error.message : String(error) };
-    }
+    return querySnapshot(() => runLinuxScript(spawnCommand, LINUX_SNAPSHOT_SCRIPT, [], timeoutMs, "codenomad-wsl-identity", distro), (output) => parseDelimitedSnapshot(output, true));
 }
 export function signalPosixProcesses(spawnCommand, request, timeoutMs, platform) {
     const linux = platform === "linux";
-    return runGuardedCommand(spawnCommand, "sh", ["-c", linux ? LINUX_GUARDED_SIGNAL_SCRIPT : POSIX_GUARDED_SIGNAL_SCRIPT, "codenomad-guarded-signal", ...shellGuardArgs(request, linux)], timeoutMs);
+    return runGuardedCommand(() => spawnCommand("sh", ["-c", linux ? LINUX_GUARDED_SIGNAL_SCRIPT : POSIX_GUARDED_SIGNAL_SCRIPT, "codenomad-guarded-signal", ...shellGuardArgs(request, linux)], { encoding: "utf8", timeout: timeoutMs }));
 }
 export function signalOwnedPosixProcessGroup(spawnCommand, rootPid, signal, timeoutMs) {
-    return runGuardedCommand(spawnCommand, "sh", ["-c", POSIX_OWNED_GROUP_SIGNAL_SCRIPT, "codenomad-owned-group-cleanup", String(rootPid), signalName(signal)], timeoutMs);
+    return runGuardedCommand(() => spawnCommand("sh", ["-c", POSIX_OWNED_GROUP_SIGNAL_SCRIPT, "codenomad-owned-group-cleanup", String(rootPid), signalName(signal)], { encoding: "utf8", timeout: timeoutMs }));
 }
 export function signalWslProcesses(spawnCommand, distro, request, timeoutMs) {
-    return runGuardedCommand(spawnCommand, "wsl.exe", ["--distribution", distro, "--exec", "sh", "-c", LINUX_GUARDED_SIGNAL_SCRIPT, "codenomad-wsl-guarded-signal", ...shellGuardArgs(request, true)], timeoutMs);
+    return runGuardedCommand(() => runLinuxScript(spawnCommand, LINUX_GUARDED_SIGNAL_SCRIPT, shellGuardArgs(request, true), timeoutMs, "codenomad-wsl-guarded-signal", distro));
 }
 export function signalWindowsProcesses(spawnCommand, request, timeoutMs) {
-    return runGuardedCommand(spawnCommand, "powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", buildWindowsGuardedScript(request)], timeoutMs);
+    return runGuardedCommand(() => spawnCommand("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", buildWindowsGuardedScript(request)], { encoding: "utf8", timeout: timeoutMs }));
+}
+export function probeLaunchCleanupToken(spawnCommand, token, timeoutMs, distro) {
+    return querySnapshot(() => runLinuxScript(spawnCommand, LINUX_TOKEN_SCRIPT, [LAUNCH_CLEANUP_TOKEN_ENV, token, ""], timeoutMs, "codenomad-token-cleanup", distro), (output) => parsePrefixedSnapshot(output, "CODENOMAD_PROCESS|"), {
+        allowEmpty: true,
+        malformedError: "launch cleanup probe returned malformed or unexpected output",
+        redact: (error) => redactToken(error, token),
+    });
+}
+export function signalLaunchCleanupToken(spawnCommand, token, signal, timeoutMs, distro) {
+    const failed = (error) => ({ ok: false, signalSent: false, targets: [], error });
+    try {
+        const result = runLinuxScript(spawnCommand, LINUX_TOKEN_SCRIPT, [LAUNCH_CLEANUP_TOKEN_ENV, token, signalName(signal)], timeoutMs, "codenomad-token-cleanup", distro);
+        if (result.status !== 0)
+            return failed(redactToken(commandError(result), token));
+        const lines = String(result.stdout ?? "").split(/\r?\n/).filter(Boolean);
+        const resultLines = lines.filter((line) => line.startsWith("CODENOMAD_RESULT|"));
+        if (resultLines.length !== 1 || !/^CODENOMAD_RESULT\|[01]$/.test(resultLines[0] ?? "")) {
+            return failed("launch cleanup signal returned no valid structured result");
+        }
+        const targets = parsePrefixedSnapshot(lines.filter((line) => !line.startsWith("CODENOMAD_RESULT|")).join("\n"), "CODENOMAD_TARGET|");
+        return targets
+            ? { ok: true, signalSent: resultLines[0].endsWith("1"), targets: Array.from(targets.values()) }
+            : failed("launch cleanup signal returned malformed or unexpected output");
+    }
+    catch (error) {
+        return failed(redactToken(error instanceof Error ? error.message : String(error), token));
+    }
 }