@relayflows/sdk 2.0.16 → 2.0.18

package/src/preflight.ts

@@ -133,7 +133,9 @@ export function preflightWebhookTriggers(
   triggers: readonly TriggerSource[],
   executors: readonly string[],
 ): PreflightRefusal[] {
-  return [...new Set(triggers.map(trigger => trigger.name))]
+  // Schedule sources are driven by the CLI's own tick runner, not an inbox
+  // executor, so they need no flows.json registration.
+  return [...new Set(triggers.filter(trigger => trigger.kind === 'webhook').map(trigger => trigger.name))]
     .filter(name => !executors.includes(name))
     .map(name => ({
       severity: 'refusal',
@@ -584,8 +586,8 @@ function warnOnUnprovableEffects(
   diagnostics: PreflightDiagnostic[],
 ): void {
   if (step.type !== 'deterministic') return;
-  const binary = firstCommandWord(step.command);
-  if (binary === undefined) {
+  const first = firstCommandWordDetailed(step.command);
+  if (first === undefined) {
     diagnostics.push({
       severity: 'warning',
       kind: 'command_unprovable',
@@ -594,6 +596,19 @@ function warnOnUnprovableEffects(
     });
     return;
   }
+  if (first.shell) {
+    // `set -e`, `if …`, `cd …`: the shell supplies these, so there is nothing
+    // to resolve on PATH — and nothing to refuse. What they go on to run is
+    // the rest of the script, whose effects preflight never claimed to prove.
+    diagnostics.push({
+      severity: 'warning',
+      kind: 'unprovable_effects',
+      stepId: step.id,
+      message: `Step "${step.id}" starts with the shell ${first.kind} "${first.word}", whose effects cannot be proven before execution.`,
+    });
+    return;
+  }
+  const binary = first.word;
   let exists: boolean;
   try {
     exists = probes.command(binary);
@@ -628,7 +643,115 @@ function warnOnUnprovableEffects(
     });
 }
 
+/** POSIX special builtins and reserved words: the shell supplies them, PATH never does. */
+const SHELL_SPECIAL_BUILTINS = new Set([
+  '.', ':', 'break', 'continue', 'eval', 'exec', 'exit', 'export', 'readonly', 'return', 'set',
+  'shift', 'times', 'trap', 'unset',
+  // Regular builtins that no sane flow ships as an executable.
+  'cd', 'alias', 'unalias', 'local', 'source', 'wait', 'umask', 'ulimit', 'read', 'command', 'type',
+]);
+const SHELL_RESERVED_WORDS = new Set([
+  'if', 'then', 'else', 'elif', 'fi', 'for', 'while', 'until', 'do', 'done', 'case', 'esac', 'in',
+  'function', 'select', 'time', '{', '}', '(', ')', '!', '[[', ']]',
+]);
+
+interface FirstCommandWord {
+  word: string;
+  /** True when the shell itself provides the word, so there is nothing to look up. */
+  shell: boolean;
+  kind: 'command' | 'builtin' | 'reserved word';
+}
+
 function firstCommandWord(command: string): string | undefined {
+  return firstCommandWordDetailed(command)?.word;
+}
+
+function firstCommandWordDetailed(command: string): FirstCommandWord | undefined {
+  // A lightweight lexical pass — not a shell parser. It walks the script once,
+  // quote-aware: comments outside quotes are dropped, quoted text is opaque
+  // (an apostrophe in `# don't` or a `<<EOF` inside `VALUE='<<EOF'` is data),
+  // and the script is split into simple-command segments on unquoted `;`,
+  // `&&`, `||`, `|` and newlines. The first segment that is not only
+  // assignments and redirections holds the command word (cloud#3777).
+  //
+  // A heredoc opener or a quote left open at the end of the script means the
+  // following text is data the shell never executes; if no command word was
+  // found before it, the answer is "cannot be proven", not "missing".
+  const segments = lexSimpleCommands(command);
+  if (segments === undefined) return undefined;
+  for (const segment of segments) {
+    const remainder = stripShellPrefixes(segment);
+    if (remainder === '') continue;
+    const match = remainder.match(/^(?:"([^"]*)"|'([^']*)'|([^\s]+))/);
+    const word = match?.[1] ?? match?.[2] ?? match?.[3];
+    if (word === undefined || word === '') continue;
+    if (SHELL_SPECIAL_BUILTINS.has(word)) return { word, shell: true, kind: 'builtin' };
+    if (SHELL_RESERVED_WORDS.has(word)) return { word, shell: true, kind: 'reserved word' };
+    return { word, shell: false, kind: 'command' };
+  }
+  return undefined;
+}
+
+/**
+ * Split a script into simple-command segments, comments removed, quotes kept.
+ * Returns undefined when a heredoc or an unclosed quote begins before any
+ * segment could be completed past it — the rest is data.
+ */
+function lexSimpleCommands(script: string): string[] | undefined {
+  const segments: string[] = [];
+  let current = '';
+  let quote: string | undefined;
+  let heredoc = false;
+  const flush = (): void => {
+    if (current.trim() !== '') segments.push(current.trim());
+    current = '';
+  };
+  for (let i = 0; i < script.length; i += 1) {
+    const char = script[i]!;
+    if (quote !== undefined) {
+      current += char;
+      if (char === '\\' && quote === '"' && i + 1 < script.length) { current += script[++i]; continue; }
+      if (char === quote) quote = undefined;
+      continue;
+    }
+    if (char === '\\' && i + 1 < script.length) { current += char + script[++i]; continue; }
+    if (char === '"' || char === "'") { quote = char; current += char; continue; }
+    if (char === '#' && (current === '' || /\s$/.test(current))) {
+      // Comment to end of line, outside quotes only.
+      while (i + 1 < script.length && script[i + 1] !== '\n') i += 1;
+      continue;
+    }
+    if (char === '<' && script[i + 1] === '<') {
+      // A heredoc: everything after this line is its body, so the current
+      // segment is the last one the shell reads as a command.
+      heredoc = true;
+      while (i + 1 < script.length && script[i + 1] !== '\n') i += 1;
+      flush();
+      break;
+    }
+    if (char === '\n' || char === ';') { flush(); continue; }
+    if ((char === '&' && script[i + 1] === '&') || (char === '|' && script[i + 1] === '|')) { flush(); i += 1; continue; }
+    if (char === '|') { flush(); continue; }
+    if (char === '&') {
+      // `&` is a boundary only as a background operator. In `2>&1`, `>&2`,
+      // `<&0` and `&>file` it is part of a redirection: the `&` after a `>`
+      // or `<` (with an optional fd number before that), or the `&` that
+      // starts `&>`.
+      const afterRedirect = /[<>]\s*$/.test(current);
+      if (afterRedirect || script[i + 1] === '>') { current += char; continue; }
+      flush();
+      continue;
+    }
+    current += char;
+  }
+  if (!heredoc && quote === undefined) flush();
+  // Whatever was accumulated when a heredoc or an open quote cut the scan is
+  // not a complete command; only the segments closed before it count.
+  if (segments.length === 0 && (heredoc || quote !== undefined)) return undefined;
+  return segments;
+}
+
+function stripShellPrefixes(segment: string): string {
   // Skip the shell prefixes that can legally precede the command word.
   //
   // Review caught this on PR #47: the new path-like refusal keys on the first
@@ -638,16 +761,16 @@ function firstCommandWord(command: string): string | undefined {
   // which is exactly the "refusing would reject valid flows" failure the warn
   // behaviour exists to avoid.
   //
-  // An assignment is NAME=value with a shell-legal name; a redirection starts
-  // with < or > (optionally with a leading fd number). Neither is the command.
-  let rest = command.trim();
+  // An assignment is NAME=value with a shell-legal name and an opaque quoted
+  // value; a redirection starts with < or > (optionally with a leading fd
+  // number). Neither is the command. Segments never contain `;`/newlines.
+  let rest = segment;
   for (;;) {
-    const prefix = rest.match(/^(?:[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|[^\s]*)|[0-9]*[<>]{1,2}\s*[^\s]+)\s+/);
+    const prefix = rest.match(/^(?:[A-Za-z_][A-Za-z0-9_]*=(?:"(?:[^"\\]|\\.)*"|'[^']*'|[^\s]*)|(?:[0-9]*[<>]{1,2}&?|&>>?)\s*[^\s]+)(?:\s+|$)/);
     if (prefix === null) break;
     rest = rest.slice(prefix[0].length);
   }
-  const match = rest.match(/^(?:"([^"]+)"|'([^']+)'|([^\s]+))/);
-  return match?.[1] ?? match?.[2] ?? match?.[3];
+  return rest.trim();
 }
 
 function probeNamedGate(step: StepSpec, probes: PreflightProbes, diagnostics: PreflightDiagnostic[]): void {

package/src/progress.ts

@@ -1,8 +1,10 @@
 import type { CompletionReason } from './protocol.js';
 import type { StepType } from './spec.js';
+import { AuthoredHumanParked } from './authored-flow-error.js';
 
 export interface ProgressEvent {
-  type: 'step.started' | 'step.running' | 'step.completed' | 'step.failed';
+  /** `step.parked`: an `f.human` reached without an answer; the run parks, nothing failed. */
+  type: 'step.started' | 'step.running' | 'step.completed' | 'step.failed' | 'step.parked';
   stepId: string;
   stepType: StepType;
   elapsedMs: number;
@@ -12,13 +14,15 @@ export interface ProgressEvent {
 /** Pure terminal rendering: caller owns the event source, clock, and output. */
 export function renderProgress(events: Iterable<ProgressEvent>): string[] {
   return Array.from(events, event => {
-    const icon = { 'step.started': '○', 'step.running': '↻', 'step.completed': '✓', 'step.failed': '✗' }[event.type];
+    const icon = { 'step.started': '○', 'step.running': '↻', 'step.completed': '✓', 'step.failed': '✗', 'step.parked': '⏸' }[event.type];
     const state = event.type.slice('step.'.length);
+    // A parked `f.human` is a question, not a step type the kernel ran.
+    const kind = event.type === 'step.parked' ? 'human' : event.stepType;
     const agent = event.stepType === 'agent' ? ` [agent: ${state === 'started' ? 'preparing' : state}]` : '';
     const reason = event.completionReason ? ` completionReason: ${event.completionReason}` : '';
     // Agent-authored names cannot inject terminal control sequences.
     const name = event.stepId.replace(/[\x00-\x1f\x7f-\x9f]/g, '?');
-    return `${icon} ${name} (${event.stepType})${agent} ${(Math.max(0, event.elapsedMs) / 1000).toFixed(2)}s${reason}`;
+    return `${icon} ${name} (${kind})${agent} ${(Math.max(0, event.elapsedMs) / 1000).toFixed(2)}s${reason}`;
   });
 }
 
@@ -45,7 +49,10 @@ export async function observeStep<T>(
     publish({ type: 'step.completed', stepId, stepType, elapsedMs: performance.now() - started, completionReason: 'success' });
     return result;
   } catch (error) {
-    publish({ type: 'step.failed', stepId, stepType, elapsedMs: performance.now() - started });
+    publish({
+      type: error instanceof AuthoredHumanParked ? 'step.parked' : 'step.failed',
+      stepId, stepType, elapsedMs: performance.now() - started,
+    });
     throw error;
   }
 }

package/src/protocol.ts

@@ -52,6 +52,7 @@ export type Verb =
   | 'effect.record'
   | 'effect.confirm'
   | 'step.complete'
+  | 'step.wait'
   | 'event.emit'
   | 'event.submit'
   | 'stream.append'
@@ -329,6 +330,27 @@ export interface StepCompleteParams {
 }
 export type StepCompleteResult = RunOutcome;
 
+/**
+ * Park a leased attempt on a durable human question (`wait.human`, kernel
+ * DESIGN.md §1.5). The attempt is not completed and no iteration is charged;
+ * the lease is released once the wait is journaled. The answer arrives through
+ * `event.emit` with `event_key` = `wait_id`, which closes the wait as
+ * `human_responded` and makes the step runnable for a fresh attempt.
+ */
+export interface StepWaitParams {
+  run_id: string;
+  step_id: string;
+  attempt: number;
+  idempotency_key: string;
+  /** Names the question for the life of the run; the kernel refuses a reuse. */
+  wait_id: string;
+  prompt: string;
+  requested_of: string;
+  options?: string[];
+  timeout_at_ms?: number;
+}
+export type StepWaitResult = RunOutcome;
+
 export interface EventEmitParams {
   run_id: string;
   event_key: string;
@@ -401,6 +423,7 @@ export interface VerbContract {
   'effect.record': { params: EffectRecordParams; result: EffectRecordResult };
   'effect.confirm': { params: EffectConfirmParams; result: EffectConfirmResult };
   'step.complete': { params: StepCompleteParams; result: StepCompleteResult };
+  'step.wait': { params: StepWaitParams; result: StepWaitResult };
   'event.emit': { params: EventEmitParams; result: EventEmitResult };
   'event.submit': { params: EventSubmitParams; result: EventSubmitResult };
   'stream.append': { params: StreamAppendParams; result: StreamAppendResult };

package/src/schedule-trigger.ts

@@ -0,0 +1,73 @@
+import {
+  TICK_EVENT_TYPE, TICK_DEDUPE_KEY_TEMPLATE,
+} from './tick-source.js';
+import { cronMaxGapMs, parseCron, scheduleIdFor, type ScheduleTriggerSource } from '@relayflows/surface';
+import type { TriggerSpec } from './spec.js';
+
+/**
+ * The executor name a schedule subscription is registered under. It is the
+ * name `flows tick start` submits through, and `testdata/tick-heartbeat.flow.yaml`
+ * binds by hand; unlike a provider inbox it needs no `flows.json` entry, because
+ * the tick source ships with the CLI itself.
+ */
+export const SCHEDULE_EXECUTOR = 'flows.tick';
+
+/** Three missed slots before the kernel's liveness sweep journals `subscription.stale`. */
+export const SCHEDULE_STALE_SLOTS = 3;
+
+export interface ScheduleLowering {
+  readonly scheduleId: string;
+  /** The `flows tick start --interval-ms` value, when the schedule is exactly a tick grid. */
+  readonly intervalMs?: number;
+  /** The `flows tick start --epoch-ms` value: the grid's phase past the Unix epoch. Present with `intervalMs`. */
+  readonly epochMs?: number;
+  readonly cron?: string;
+  readonly tz?: string;
+  /** The silence budget the subscription declares, in milliseconds. */
+  readonly staleAfterMs?: number;
+  /** Why the local tick runner cannot drive this schedule, when it cannot. */
+  readonly localUnsupported?: string;
+}
+
+export function scheduleLowering(flowName: string, source: ScheduleTriggerSource): ScheduleLowering {
+  const scheduleId = scheduleIdFor(flowName, source);
+  const base = {
+    scheduleId,
+    ...(source.cron === undefined ? {} : { cron: source.cron }),
+    ...(source.tz === undefined ? {} : { tz: source.tz }),
+  };
+  if (source.intervalMs === undefined || source.epochMs === undefined) {
+    // Not a grid. The kernel's default silence budget is five minutes, which
+    // a daily cron would trip every day at 09:05 — so the budget is declared
+    // from the cron's own longest quiet period instead of left to default.
+    const gap = source.cron === undefined ? undefined : cronMaxGapMs(parseCron(source.cron));
+    return {
+      ...base,
+      ...(gap === undefined ? {} : { staleAfterMs: gap * SCHEDULE_STALE_SLOTS }),
+      localUnsupported: `cron "${source.cron}"${source.tz === undefined ? '' : ` in ${source.tz}`} is not a UTC tick grid `
+        + '(a fixed period dividing the hour or day, one fixed phase); the local tick runner cannot reproduce it. '
+        + 'Run it on Cloud with `flows schedule`, or declare schedule.every(...) for local runs.',
+    };
+  }
+  return { ...base, intervalMs: source.intervalMs, epochMs: source.epochMs, staleAfterMs: source.intervalMs * SCHEDULE_STALE_SLOTS };
+}
+
+/**
+ * Lower a `schedule.*` declaration to the `flows.tick` subscription the tick
+ * source drives: one event type, a pattern pinned to this flow's schedule id,
+ * the shared dedupe key so a re-delivered slot spawns one run, and a silence
+ * budget of three slots — three intervals for a grid, three times the cron's
+ * longest quiet period otherwise — so a dead source is journaled rather than
+ * silent, and a weekly cron is not declared stale on Monday at 09:05.
+ */
+export function scheduleTriggerSpec(id: string, flowName: string, source: ScheduleTriggerSource): TriggerSpec {
+  const lowering = scheduleLowering(flowName, source);
+  return {
+    id,
+    executor: SCHEDULE_EXECUTOR,
+    eventType: TICK_EVENT_TYPE,
+    pattern: { schedule_id: lowering.scheduleId },
+    dedupeKeyTemplate: TICK_DEDUPE_KEY_TEMPLATE,
+    ...(lowering.staleAfterMs === undefined ? {} : { staleAfterMs: lowering.staleAfterMs }),
+  };
+}

package/src/spec.ts

@@ -82,7 +82,18 @@ export interface RegexMatchGate {
   flags?: string;
 }
 
-export type NamedDataGate = ReferencesInputGate | SubprocessGate | WordCountBoundsGate | RegexMatchGate;
+/**
+ * Passes when the step's journaled `output.artifacts` lists `path`: a file the
+ * agent's worker measured as created or changed under its working directory.
+ * Reads the journal, never the disk, so replay and resume see the same verdict.
+ */
+export interface ArtifactExistsGate {
+  type: 'artifact_exists';
+  /** Working-directory-relative POSIX path, as the worker journals it. */
+  path: string;
+}
+
+export type NamedDataGate = ReferencesInputGate | SubprocessGate | WordCountBoundsGate | RegexMatchGate | ArtifactExistsGate;
 export type OutputVerificationSpec = OutputContainsGate | JsonSchemaGate | NamedDataGate;
 export type VerificationSpec = ExitCodeGate | OutputVerificationSpec;
 

package/src/trigger-executor.ts

@@ -3,7 +3,7 @@ import type { TriggerSpec } from './spec.js';
 
 /** Lower a surface subscription to the existing inbox executor contract. */
 export function webhookTriggerSpec(id: string, source: TriggerSource): TriggerSpec {
-  if (source.kind !== 'webhook') throw new TypeError('unsupported trigger kind');
+  if (source.kind !== 'webhook') throw new TypeError('unsupported trigger kind: use scheduleTriggerSpec for schedule sources');
   const trigger = webhook(source.name, source.filter);
   return {
     id,

package/src/validate.ts

@@ -446,7 +446,7 @@ class Validator {
     } else if (Object.hasOwn(NAMED_GATE_KEYS, gate.type)) {
       for (const error of namedGateErrors(v, input, at)) this.fail(error);
     } else {
-      this.fail(`${at}.type: unknown_gate_kind: expected exit_code | output_contains | json_schema | references_input | subprocess_gate | word_count_bounds | regex_match`);
+      this.fail(`${at}.type: unknown_gate_kind: expected exit_code | output_contains | json_schema | references_input | subprocess_gate | word_count_bounds | regex_match | artifact_exists`);
     }
   }
 

package/src/worker-cli.ts

@@ -1,3 +1,5 @@
+import { resolve } from 'node:path';
+import { diffWorkspaceFiles, snapshotWorkspaceFiles } from './agent-artifacts.js';
 import { decodeProviderResult, decodeWrapperResult, requirePricedUsage } from './worker-usage.js';
 import { openSidechannel, type SidechannelContext } from './pty-sidechannel.js';
 import { spawn } from 'node:child_process';
@@ -38,6 +40,16 @@ export interface WorkerCliResult {
   exit_code: number | null;
   stdout_tail: string;
   stderr_tail: string;
+  /**
+   * Files the agent created or changed under its working directory,
+   * cwd-relative POSIX paths, sorted. Measured by the worker that spawned the
+   * CLI — the one process provably sharing the agent's filesystem — as a
+   * content-hash diff of the directory before and after the run, so it is a
+   * journaled fact rather than a later guess. Present for every direct agent
+   * execution; absent for `llm` mode and for the relay transport, where the
+   * agent runs on another host.
+   */
+  artifacts?: string[];
 }
 
 /**
@@ -75,6 +87,22 @@ export async function runAgentCli(
     return runViaAgentRelay(kind, instruction, wakeContext, effectiveModel, relayContext, cwd, signal);
   }
 
+  // Artifact detection brackets the spawn: the directory the CLI runs in is
+  // snapshotted before and diffed after, by this process, on this
+  // filesystem. Only an agent execution writes artifacts; an llm step has no
+  // workspace to change. Executions sharing a working directory are
+  // serialized around their snapshot-spawn-snapshot interval, so one agent's
+  // writes are never attributed to a concurrent one in the same directory.
+  const artifactRoot = mode === 'agent' ? resolve(cwd ?? process.cwd()) : undefined;
+  return artifactRoot === undefined
+    ? execute()
+    : serializedByDirectory(artifactRoot, async () => {
+      const before = await snapshotWorkspaceFiles(artifactRoot);
+      const result = await execute();
+      return { ...result, artifacts: diffWorkspaceFiles(before, await snapshotWorkspaceFiles(artifactRoot)) };
+    });
+
+  async function execute(): Promise<WorkerCliResult> {
   if (kind === 'relayflows-wrapper-v1') {
     return requirePricedUsage(decodeWrapperResult(await runWrapperSession(
       cli,
@@ -84,6 +112,7 @@ export async function runAgentCli(
       wrapperEnvironment(process.env),
       wrapperLimits,
       signal,
+      cwd,
     )), effectiveModel);
   }
 
@@ -109,6 +138,18 @@ export async function runAgentCli(
   const args = [...invocation.args];
   args.splice(args.length - 1, 0, ...(kind === 'claude' ? ['--output-format', 'json'] : ['--json']));
   return requirePricedUsage(decodeProviderResult(await spawnInvocation(cli, { ...invocation, args }, env, signal, sidechannel, cwd), kind), effectiveModel);
+  }
+}
+
+/** One agent at a time per canonical working directory, for the artifact interval. */
+const directoryQueues = new Map<string, Promise<unknown>>();
+function serializedByDirectory<T>(directory: string, task: () => Promise<T>): Promise<T> {
+  const previous = directoryQueues.get(directory) ?? Promise.resolve();
+  const run = previous.then(task, task);
+  const settled = run.then(() => undefined, () => undefined);
+  directoryQueues.set(directory, settled);
+  void settled.then(() => { if (directoryQueues.get(directory) === settled) directoryQueues.delete(directory); });
+  return run;
 }
 
 /** Wait under the same worker lease for an authoritative task receipt. */

package/src/worker.ts

@@ -133,6 +133,15 @@ export class AgentWorker extends EventEmitter {
     // emitting an error JSON with exit 0. `completionReason` is
     // derived from exit code, so a CLI that exits 0 while emitting
     // `{"error":...}` will report success with an error payload.
+    //
+    // `artifacts` (worker-cli.ts) rides inside the CliResult wrapper, so on
+    // the wrapper path it is journaled in `output`, where the kernel's output
+    // binding — and therefore an `artifact_exists` gate — can read it. On the
+    // JSON path the author's object IS the output and is left exactly as the
+    // agent emitted it: no key is added that a schema, a downstream binding
+    // or `summary` never asked for. An agent that answers with a JSON object
+    // therefore journals no artifacts; gate such a step on a deterministic
+    // check instead. The relay transport reports none (the agent ran elsewhere).
     const output = result.relay_task?.status === 'completed' && result.exit_code === 0
       ? result.relay_task.output : parseJsonOutput(result.stdout_tail) ?? result;
 

package/src/wrapper-session.ts

@@ -49,6 +49,8 @@ export function runWrapperSession(
   env: NodeJS.ProcessEnv,
   overrides: Partial<WrapperSessionLimits> = {},
   signal?: AbortSignal,
+  /** Working directory for the wrapper process; the artifact scanner uses the same root. */
+  cwd?: string,
 ): Promise<WrapperSessionResult> {
   if (signal?.aborted) return Promise.reject(signal.reason);
   if (signal !== undefined && process.platform === 'win32') {
@@ -77,7 +79,7 @@ export function runWrapperSession(
     ));
   }
 
-  return executePinnedWrapper(cli, identity, request, env, limits, signal);
+  return executePinnedWrapper(cli, identity, request, env, limits, signal, cwd);
 }
 
 function executePinnedWrapper(
@@ -87,6 +89,7 @@ function executePinnedWrapper(
   env: NodeJS.ProcessEnv,
   limits: WrapperSessionLimits,
   signal?: AbortSignal,
+  cwd?: string,
 ): Promise<WrapperSessionResult> {
   return new Promise((resolve) => {
     const ownsGroup = ownsProcessGroup(signal);
@@ -94,6 +97,7 @@ function executePinnedWrapper(
       stdio: ['pipe', 'pipe', 'pipe'],
       env,
       detached: ownsGroup,
+      ...(cwd === undefined ? {} : { cwd }),
     });
     const stop = childStop(child, ownsGroup);
     const stdout: string[] = [];