@nowcrew/daemon 0.6.19 → 0.6.21

package/dist/atomic-no-replace-rename.js

@@ -0,0 +1,91 @@
+import { createRequire } from "node:module";
+export class AtomicNoReplaceRenameError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = "AtomicNoReplaceRenameError";
+    }
+}
+const RENAME_NOREPLACE = 1;
+const RENAME_EXCL = 0x0000_0004;
+const MOVEFILE_WRITE_THROUGH = 0x0000_0008;
+const ERROR_FILE_EXISTS = 80;
+const ERROR_ALREADY_EXISTS = 183;
+const AT_FDCWD = -100;
+let cached = null;
+let unavailable = false;
+const loadKoffi = () => {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- optional koffi has no bundled TS declarations.
+    const candidate = createRequire(import.meta.url)("koffi");
+    return candidate;
+};
+const posixApi = (koffi, library, declaration, invoke) => {
+    const native = koffi.load(library).func(declaration);
+    return Object.freeze({
+        rename: (source, destination) => invoke(native, source, destination) === 0,
+        error: () => koffi.errno(),
+        destinationExists: (code) => code === koffi.os.errno.EEXIST || code === koffi.os.errno.ENOTEMPTY,
+    });
+};
+const bindNativeApi = () => {
+    const koffi = loadKoffi();
+    if (process.platform === "darwin") {
+        return posixApi(koffi, "libSystem.B.dylib", "int renamex_np(const char *source, const char *destination, uint32_t flags)", (native, source, destination) => native(source, destination, RENAME_EXCL));
+    }
+    if (process.platform === "linux") {
+        return posixApi(koffi, "libc.so.6", "int renameat2(int olddirfd, const char *source, int newdirfd, const char *destination, uint32_t flags)", (native, source, destination) => native(AT_FDCWD, source, AT_FDCWD, destination, RENAME_NOREPLACE));
+    }
+    if (process.platform === "win32") {
+        const library = koffi.load("kernel32.dll");
+        const moveFileEx = library.func("bool __stdcall MoveFileExW(str16 source, str16 destination, uint32_t flags)");
+        const getLastError = library.func("uint32_t __stdcall GetLastError()");
+        return Object.freeze({
+            rename: (source, destination) => Boolean(moveFileEx(source, destination, MOVEFILE_WRITE_THROUGH)),
+            error: () => getLastError(),
+            destinationExists: (code) => code === ERROR_FILE_EXISTS || code === ERROR_ALREADY_EXISTS,
+        });
+    }
+    throw new AtomicNoReplaceRenameError("atomic_no_replace_rename_unavailable");
+};
+const nativeApi = () => {
+    if (cached !== null)
+        return cached;
+    if (unavailable)
+        throw new AtomicNoReplaceRenameError("atomic_no_replace_rename_unavailable");
+    try {
+        cached = bindNativeApi();
+        return cached;
+    }
+    catch (error) {
+        unavailable = true;
+        if (error instanceof AtomicNoReplaceRenameError)
+            throw error;
+        throw new AtomicNoReplaceRenameError("atomic_no_replace_rename_unavailable");
+    }
+};
+/** Loads the mandatory native binding without mutating the filesystem. */
+export function probeAtomicNoReplaceRenameReadiness() {
+    try {
+        nativeApi();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Atomically renames one filesystem object without replacing any destination occupant. macOS uses
+ * `renamex_np(RENAME_EXCL)`, Linux uses `renameat2(RENAME_NOREPLACE)`, and Windows uses MoveFileExW
+ * without `MOVEFILE_REPLACE_EXISTING`. Missing native support fails closed.
+ */
+export async function atomicRenameNoReplace(source, destination) {
+    const api = nativeApi();
+    if (!api.rename(source, destination)) {
+        const code = api.error();
+        if (api.destinationExists(code))
+            return "destination_exists";
+        throw new AtomicNoReplaceRenameError("atomic_no_replace_rename_failed");
+    }
+    return "published";
+}

package/dist/completion-retransmitter-logging.js

@@ -0,0 +1,16 @@
+import { dslog } from "./slog.js";
+export function completionRetransmitterOptions(execution) {
+    return {
+        ...(execution?.completionRetryDelaysMs === undefined ? {} : { retryDelaysMs: execution.completionRetryDelaysMs }),
+        ...(execution?.completionRetryMaxAttempts === undefined ? {} : { maxAttempts: execution.completionRetryMaxAttempts }),
+        ...(execution?.completionRetryMaxAgeMs === undefined ? {} : { maxAgeMs: execution.completionRetryMaxAgeMs }),
+        onAttempt: ({ kind, executionId, attempt, nextDelayMs }) => {
+            dslog(kind === "sent" ? "execution.completion_sent" : "execution.completion_retried", kind === "sent" ? "execution completion 已发送" : "execution completion 未确认,已重传", { execution_id: executionId, attempt, next_delay_ms: nextDelayMs });
+        },
+        onRetryExhausted: ({ executionId, attempts, reason }) => {
+            dslog("execution.completion_retry_exhausted", "execution completion 重试已耗尽,仍未收到 ACK", {
+                level: "ERROR", execution_id: executionId, attempts, reason,
+            });
+        },
+    };
+}

package/dist/completion-retransmitter.js

@@ -1,7 +1,10 @@
 const DEFAULT_DELAYS = Object.freeze([1_000, 2_000, 4_000, 8_000, 16_000, 30_000]);
 export function createCompletionRetransmitter(options) {
     const delays = options.retryDelaysMs?.length ? [...options.retryDelaysMs] : [...DEFAULT_DELAYS];
+    const maxAttempts = options.maxAttempts ?? 20;
+    const maxAgeMs = options.maxAgeMs ?? 10 * 60 * 1_000;
     const pending = new Map();
+    const exhausted = new Set();
     let active = false;
     let stopped = false;
     const delayFor = (attempts) => delays[Math.min(Math.max(attempts - 1, 0), delays.length - 1)];
@@ -10,11 +13,31 @@ export function createCompletionRetransmitter(options) {
             clearTimeout(entry.timer);
         entry.timer = null;
     };
+    const expire = (entry, reason) => {
+        clear(entry);
+        pending.delete(entry.frame.executionId);
+        exhausted.add(entry.frame.executionId);
+        options.onRetryExhausted?.({
+            executionId: entry.frame.executionId,
+            attempts: entry.attempts,
+            reason,
+        });
+    };
+    const ageRemainingMs = (entry) => maxAgeMs - (Date.now() - entry.startedAtMs);
     function schedule(entry) {
         clear(entry);
         if (!active || stopped)
             return;
-        const delay = delayFor(entry.attempts);
+        if (entry.attempts >= maxAttempts) {
+            expire(entry, "max_attempts");
+            return;
+        }
+        const remainingMs = ageRemainingMs(entry);
+        if (remainingMs <= 0) {
+            expire(entry, "max_age");
+            return;
+        }
+        const delay = Math.min(delayFor(entry.attempts), remainingMs);
         entry.timer = setTimeout(() => {
             entry.timer = null;
             attempt(entry);
@@ -24,10 +47,18 @@ export function createCompletionRetransmitter(options) {
     function attempt(entry) {
         if (!active || stopped)
             return;
+        if (entry.attempts >= maxAttempts) {
+            expire(entry, "max_attempts");
+            return;
+        }
+        if (ageRemainingMs(entry) <= 0) {
+            expire(entry, "max_age");
+            return;
+        }
         const accepted = options.send(entry.frame);
         if (accepted) {
             entry.attempts += 1;
-            const nextDelayMs = delayFor(entry.attempts);
+            const nextDelayMs = Math.min(delayFor(entry.attempts), Math.max(ageRemainingMs(entry), 0));
             options.onAttempt?.({
                 kind: entry.attempts === 1 ? "sent" : "retried",
                 executionId: entry.frame.executionId,
@@ -35,13 +66,17 @@ export function createCompletionRetransmitter(options) {
                 nextDelayMs,
             });
         }
+        if (entry.attempts >= maxAttempts) {
+            expire(entry, "max_attempts");
+            return;
+        }
         schedule(entry);
     }
     return {
         track(frame) {
-            if (stopped || pending.has(frame.executionId))
+            if (stopped || pending.has(frame.executionId) || exhausted.has(frame.executionId))
                 return;
-            const entry = { frame, attempts: 0, timer: null };
+            const entry = { frame, startedAtMs: Date.now(), attempts: 0, timer: null };
             pending.set(frame.executionId, entry);
             if (active)
                 attempt(entry);

package/dist/control-plane-url.js

@@ -1,6 +1,6 @@
 import { executionBackendCapability } from "./execution-backend.js";
 import { daemonCapabilities, EXECUTION_PROTOCOL } from "./machine-info.js";
-import { PROJECT_SKILLS_CAPABILITY } from "./project-skills/types.js";
+import { PROJECT_SKILLS_CAPABILITY, PROJECT_SKILL_PROJECTION_V2_CAPABILITY, } from "./project-skills/types.js";
 export function buildControlPlaneUrl(serverUrl, machineToken, runtimePlatform = process.platform, jobObjectProbe, projectSkillsAvailable = true, capabilities = daemonCapabilities(runtimePlatform)) {
     const query = new URLSearchParams({ key: machineToken });
     if (executionBackendCapability(runtimePlatform, jobObjectProbe).supported) {
@@ -8,7 +8,9 @@ export function buildControlPlaneUrl(serverUrl, machineToken, runtimePlatform =
         query.set("execution_max", String(EXECUTION_PROTOCOL.max));
     }
     for (const capability of capabilities) {
-        if (capability !== PROJECT_SKILLS_CAPABILITY || projectSkillsAvailable) {
+        if (projectSkillsAvailable
+            || (capability !== PROJECT_SKILLS_CAPABILITY
+                && capability !== PROJECT_SKILL_PROJECTION_V2_CAPABILITY)) {
             query.append("capability", capability);
         }
     }

package/dist/directory-projection-publication.js

@@ -0,0 +1,105 @@
+import { posix, win32 } from "node:path";
+export class DirectoryProjectionPublicationError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = "DirectoryProjectionPublicationError";
+    }
+}
+const fail = (code) => {
+    throw new DirectoryProjectionPublicationError(code);
+};
+const hasTraversal = (value, platform) => (platform === "win32" ? value.split(/[\\/]/u) : value.split("/"))
+    .some((component) => component === "..");
+const isFullyQualifiedWindowsPath = (value) => {
+    if (/^\\\\[?.]\\/u.test(value))
+        return false;
+    if (/^[A-Za-z]:[\\/]/u.test(value))
+        return true;
+    return /^\\\\[^\\/]+[\\/][^\\/]+(?:[\\/]|$)/u.test(value);
+};
+const normalizeAbsolute = (value, platform, path) => {
+    if (value.length === 0 || value.includes("\0") || hasTraversal(value, platform)) {
+        return fail("directory_projection_path_invalid");
+    }
+    if (platform === "win32" ? !isFullyQualifiedWindowsPath(value) : !path.isAbsolute(value)) {
+        return fail("directory_projection_path_invalid");
+    }
+    return path.normalize(value);
+};
+const samePath = (left, right, path) => path.relative(left, right) === "";
+const isWithin = (parent, candidate, path) => {
+    const relative = path.relative(parent, candidate);
+    return relative !== ""
+        && relative !== ".."
+        && !relative.startsWith(`..${path.sep}`)
+        && !path.isAbsolute(relative);
+};
+const sameComponent = (left, right, path) => (path === win32 ? left.toLowerCase() : left) === (path === win32 ? right.toLowerCase() : right);
+const publicationRootNamesMatch = (stagingRoot, finalRoot, path) => {
+    const finalName = path.basename(finalRoot);
+    const stagingName = path.basename(stagingRoot);
+    const expectedPrefix = `.${finalName}-next-`;
+    const comparableStaging = path === win32 ? stagingName.toLowerCase() : stagingName;
+    const comparablePrefix = path === win32 ? expectedPrefix.toLowerCase() : expectedPrefix;
+    return finalName.length > 0
+        && comparableStaging.startsWith(comparablePrefix)
+        && /^[A-Za-z0-9-]{1,128}$/u.test(stagingName.slice(expectedPrefix.length));
+};
+/**
+ * Maps a projection target through one immutable whole-root publication. Both roots must be direct
+ * siblings, the staging name must bind the exact final basename and a bounded nonce, and the target
+ * must be strictly below staging. No filesystem access or path canonicalization is performed.
+ */
+export function mapDirectoryProjectionFinalTarget(target, publication, platform) {
+    const path = platform === "win32" ? win32 : posix;
+    const normalizedTarget = normalizeAbsolute(target, platform, path);
+    const stagingRoot = normalizeAbsolute(publication.stagingRoot, platform, path);
+    const finalRoot = normalizeAbsolute(publication.finalRoot, platform, path);
+    if (!samePath(path.parse(stagingRoot).root, path.parse(finalRoot).root, path)) {
+        return fail("directory_projection_cross_volume");
+    }
+    if (!samePath(path.dirname(stagingRoot), path.dirname(finalRoot), path)
+        || samePath(stagingRoot, finalRoot, path)
+        || isWithin(stagingRoot, finalRoot, path)
+        || isWithin(finalRoot, stagingRoot, path)
+        || !publicationRootNamesMatch(stagingRoot, finalRoot, path)
+        || !isWithin(stagingRoot, normalizedTarget, path)) {
+        return fail("directory_projection_path_overlap");
+    }
+    const relative = path.relative(stagingRoot, normalizedTarget);
+    const mapped = path.join(finalRoot, relative);
+    if (!isWithin(finalRoot, mapped, path))
+        return fail("directory_projection_path_overlap");
+    return mapped;
+}
+/** Exact marker lineage check used after the whole staging root has moved to its final UUID path. */
+export function hasDirectoryProjectionPublicationLineage(operationTarget, finalTarget, platform) {
+    const path = platform === "win32" ? win32 : posix;
+    let operation;
+    let final;
+    try {
+        operation = normalizeAbsolute(operationTarget, platform, path);
+        final = normalizeAbsolute(finalTarget, platform, path);
+    }
+    catch {
+        return false;
+    }
+    let stagingRoot = operation;
+    let finalRoot = final;
+    while (sameComponent(path.basename(stagingRoot), path.basename(finalRoot), path)) {
+        const nextStaging = path.dirname(stagingRoot);
+        const nextFinal = path.dirname(finalRoot);
+        if (samePath(nextStaging, stagingRoot, path) || samePath(nextFinal, finalRoot, path))
+            return false;
+        stagingRoot = nextStaging;
+        finalRoot = nextFinal;
+    }
+    try {
+        return samePath(mapDirectoryProjectionFinalTarget(operation, { stagingRoot, finalRoot }, platform), final, path);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/directory-projection.js

@@ -3,6 +3,7 @@ import { chmod, cp, lstat, mkdir, open, readFile, readlink, realpath, readdir, r
 import { posix, win32 } from "node:path";
 import { durableAtomicPrivateWrite, durableDirectorySync, durablePrivateUnlink, } from "./atomic-private-write.js";
 import { readExactDirectoryIdentity, sameExactDirectoryIdentity, validExactDirectoryIdentity, } from "./directory-projection-identity.js";
+import { hasDirectoryProjectionPublicationLineage } from "./directory-projection-publication.js";
 export class DirectoryProjectionError extends Error {
     code;
     constructor(code) {
@@ -148,6 +149,9 @@ const normalizedMarker = (marker, path) => {
 const hasPermittedFinalTarget = (operationTarget, finalTarget, path) => {
     if (samePath(operationTarget, finalTarget, path))
         return true;
+    const platform = path === win32 ? "win32" : "linux";
+    if (hasDirectoryProjectionPublicationLineage(operationTarget, finalTarget, platform))
+        return true;
     if (!sameComponent(path.basename(operationTarget), path.basename(finalTarget), path))
         return false;
     const operationRoot = path.dirname(operationTarget);
@@ -824,18 +828,29 @@ export async function isManagedDirectoryProjectionCopy(target, platform, options
         return false;
     const path = platform === "win32" ? win32 : posix;
     let normalizedTarget;
+    let normalizedFinalTarget;
     try {
         normalizedTarget = normalizeAbsolute(target, platform, path);
+        normalizedFinalTarget = options.finalTarget === undefined
+            ? undefined
+            : normalizeAbsolute(options.finalTarget, platform, path);
     }
     catch {
         return false;
     }
     const projectionFs = resolveFileSystem(options);
     const info = await tryLstat(projectionFs, normalizedTarget);
+    const marker = await readMarker(projectionFs, normalizedTarget, path);
+    const normalized = normalizedMarker(marker, path);
     return info !== null
         && info.isDirectory()
         && !info.isSymbolicLink()
-        && markerMatchesFinalTarget(await readMarker(projectionFs, normalizedTarget, path), normalizedTarget, path);
+        && normalized !== null
+        && (normalizedFinalTarget === undefined
+            ? markerMatchesFinalTarget(marker, normalizedTarget, path)
+            : samePath(normalized.target, normalizedTarget, path)
+                && samePath(normalized.finalTarget, normalizedFinalTarget, path)
+                && hasPermittedFinalTarget(normalizedTarget, normalizedFinalTarget, path));
 }
 /**
  * Projects one absolute directory without exposing host paths in errors.
@@ -847,9 +862,10 @@ export async function isManagedDirectoryProjectionCopy(target, platform, options
  * rejected before IO.
  *
  * Windows copy ownership requires a version-2 marker whose normalized `finalTarget` exactly equals the
- * inspected target. A distinct operation target is accepted only for the complete sibling
- * `.skills-next-<id>/<name>` to `skills/<name>` lineage used by Project Skills reconciliation. Legacy,
- * incomplete, POSIX, or mismatched markers never authorize refresh or deletion.
+ * inspected target. A distinct operation target is accepted only when the exact relative suffix maps
+ * through a bounded same-parent staging root: either the legacy `.skills-next-<id>` switch or an immutable
+ * Runtime root `.<rootId>-next-<id>` publication. Legacy, incomplete, POSIX, or mismatched markers never
+ * authorize refresh or deletion.
  *
  * Copy fallback never follows source links, rejects every absolute link form, and permits a relative link
  * only when its completed staging target is both lexically and physically contained by that staging tree.

package/dist/execution-journal.js

@@ -4,6 +4,7 @@ import { basename, join } from "node:path";
 import { z } from "zod";
 import { ExecutionCompletedSchema, EffectivePermissionSchema, } from "./execution-protocol.js";
 import { JournalLockedError, createJournalLease, } from "./execution-journal-lock.js";
+import { provePosixProcessGroupStopped } from "./execution-posix-stop-proof.js";
 export { JournalLockedError, JournalLockCorruptionError } from "./execution-journal-lock.js";
 const ExecutionIdSchema = z.string().uuid();
 const TimestampSchema = z.string().datetime({ offset: true });
@@ -239,6 +240,22 @@ export function createProcessController(dependencies = {}) {
     };
     return {
         inspectIdentity,
+        ownedTreeExists: dependencies.ownedTreeExists ?? (async (pid) => {
+            if (!supervisorTree || platform === "win32")
+                return (await inspectIdentity(pid)) !== null;
+            try {
+                process.kill(-pid, 0);
+                return true;
+            }
+            catch (error) {
+                const code = errorCode(error);
+                if (code === "ESRCH")
+                    return false;
+                if (code === "EPERM")
+                    return true;
+                throw error;
+            }
+        }),
         signal: dependencies.signal ?? (async (pid, signal) => {
             if (!supervisorTree) {
                 process.kill(pid, signal);
@@ -470,6 +487,7 @@ export function createExecutionJournal(agentsRoot, options = {}) {
         }
     };
     const pruneInternal = async () => {
+        const protectedExecutionIds = new Set(options.protectedExecutionIds?.() ?? []);
         const entries = await readAll();
         const acknowledged = entries
             .filter((entry) => (entry.state === "completed" || entry.state === "interrupted")
@@ -477,9 +495,12 @@ export function createExecutionJournal(agentsRoot, options = {}) {
             .sort((left, right) => left.updatedAt.localeCompare(right.updatedAt)
             || left.executionId.localeCompare(right.executionId));
         const cutoff = now().valueOf() - retentionDays * 24 * 60 * 60 * 1_000;
-        const expired = acknowledged.filter((entry) => Date.parse(entry.updatedAt) < cutoff);
-        const retained = acknowledged.filter((entry) => Date.parse(entry.updatedAt) >= cutoff);
-        const overLimit = retained.slice(0, Math.max(0, retained.length - maxEntries));
+        const unprotected = acknowledged.filter((entry) => !protectedExecutionIds.has(entry.executionId));
+        const protectedCount = acknowledged.length - unprotected.length;
+        const expired = unprotected.filter((entry) => Date.parse(entry.updatedAt) < cutoff);
+        const retained = unprotected.filter((entry) => Date.parse(entry.updatedAt) >= cutoff);
+        const unprotectedLimit = Math.max(0, maxEntries - protectedCount);
+        const overLimit = retained.slice(0, Math.max(0, retained.length - unprotectedLimit));
         const toDelete = new Set([...expired, ...overLimit].map((entry) => entry.executionId));
         for (const executionId of toDelete) {
             await unlink(recordPath(executionId));
@@ -546,12 +567,16 @@ export function createExecutionJournal(agentsRoot, options = {}) {
         });
     };
     const inspectForRecovery = async (pid) => {
+        let identity;
         try {
-            return await processController.inspectIdentity(pid);
+            identity = await processController.inspectIdentity(pid);
         }
         catch (error) {
             throw new JournalRecoveryError(`Failed to inspect running process ${pid}`, error);
         }
+        if (identity?.trim() === "")
+            throw new JournalRecoveryError(`Process ${pid} has no identity`);
+        return identity;
     };
     const waitForRecovery = async (milliseconds, phase) => {
         try {
@@ -566,6 +591,17 @@ export function createExecutionJournal(agentsRoot, options = {}) {
             throw new JournalRecoveryError(`Execution ${entry.executionId} lacks process identity`);
         }
         const { pid, processIdentity } = entry;
+        if (platform !== "win32") {
+            await provePosixProcessGroupStopped({
+                pid,
+                expectedIdentity: processIdentity,
+                controller: processController,
+                terminationGraceMs,
+                killVerificationDelayMs,
+                failure: (message, cause) => new JournalRecoveryError(message, cause),
+            });
+            return;
+        }
         const initialIdentity = await inspectForRecovery(pid);
         if (initialIdentity === null || initialIdentity !== processIdentity)
             return;

package/dist/execution-posix-stop-proof.js

@@ -0,0 +1,82 @@
+function errorCode(error) {
+    return error instanceof Error && "code" in error && (typeof error.code === "string"
+        || typeof error.code === "number")
+        ? error.code
+        : undefined;
+}
+/**
+ * Proves a POSIX supervisor process group is gone before its journal is made terminal.
+ * POSIX does not reuse a PGID while that group still exists. A live leader with a
+ * different identity therefore proves the journal-owned group has already ended. A
+ * missing leader while the PGID remains live is not an ownership proof: there is no
+ * portable primitive that atomically binds a later group signal to the journal owner,
+ * so recovery fails closed without signaling that group.
+ */
+export async function provePosixProcessGroupStopped(options) {
+    const { controller, expectedIdentity, failure, pid } = options;
+    const inspect = async () => {
+        let identity;
+        try {
+            identity = await controller.inspectIdentity(pid);
+        }
+        catch (error) {
+            throw failure(`Failed to inspect running process ${pid}`, error);
+        }
+        if (identity !== null && identity.trim().length === 0) {
+            throw failure(`Running process ${pid} has an unverifiable identity`);
+        }
+        return identity;
+    };
+    const treeExists = async () => {
+        try {
+            return await controller.ownedTreeExists(pid);
+        }
+        catch (error) {
+            throw failure(`Failed to inspect owned process tree ${pid}`, error);
+        }
+    };
+    const wait = async (milliseconds, phase) => {
+        try {
+            await controller.wait(milliseconds);
+        }
+        catch (error) {
+            throw failure(`Failed while waiting ${phase}`, error);
+        }
+    };
+    const ownedGroupExists = async () => {
+        const currentIdentity = await inspect();
+        if (currentIdentity !== null && currentIdentity !== expectedIdentity)
+            return false;
+        const exists = await treeExists();
+        if (!exists)
+            return false;
+        if (currentIdentity === null) {
+            throw failure(`Cannot prove ownership of live process group ${pid} without its leader`);
+        }
+        return true;
+    };
+    const signal = async (requestedSignal) => {
+        try {
+            await controller.signal(pid, requestedSignal);
+            return false;
+        }
+        catch (error) {
+            if (errorCode(error) === "ESRCH" && !(await ownedGroupExists()))
+                return true;
+            throw failure(`Failed to ${requestedSignal === "SIGTERM" ? "terminate" : "kill"} process ${pid}`, error);
+        }
+    };
+    if (!(await ownedGroupExists()))
+        return;
+    if (await signal("SIGTERM"))
+        return;
+    await wait(options.terminationGraceMs, "for process-group termination");
+    if (!(await ownedGroupExists()))
+        return;
+    if (await signal("SIGKILL"))
+        return;
+    await wait(options.killVerificationDelayMs, "to verify process-group kill");
+    if (!(await ownedGroupExists()))
+        return;
+    throw failure(`Process group ${pid} still exists after SIGKILL`);
+}