@seekrit/cli 0.23.3 → 0.23.4

package/dist/index.js

@@ -1976,7 +1976,7 @@ function isServiceToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.23.3";
+var version = "0.23.4";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -4575,45 +4575,70 @@ async function materializeForRun(options) {
 	}
 }
 /**
-* Every live descendant of `root`, from a single `ps(1)` snapshot of the
-* process table. We follow the parent chain rather than the process group
-* because a process that calls setsid(2)/setpgid(2) leaves the group — nodemon
-* does exactly that for the script it watches — while the parent chain still
-* leads to it. Returns nothing if `ps` is unavailable; callers fall back to
-* signalling the immediate child.
+* Every live process `seekrit run` is responsible for tearing down, from a
+* single `ps(1)` snapshot: each descendant of `root`, plus — when we lead our
+* own process group — every other member of that group.
+*
+* Two mechanisms, because each covers the other's blind spot:
+*
+* - The parent-chain walk reaches a process that left our group via
+*   setsid(2)/setpgid(2), which no group-wide kill and no tty-generated signal
+*   can touch. But it loses anything whose chain up to `root` has already
+*   broken — teardown kills the middle layers first, and an orphan reparents to
+*   init, out of reach of any walk down from `root`.
+* - Group membership survives exactly that: a pgid outlives the parent that
+*   passed it down. But it misses the ones that left the group.
+*
+* The group half applies only when our pid *is* our pgid, which is the shell-job
+* case: the shell put this command in a new group, so every other member of it
+* descends from us. Nested inside a shell script or a CI runner we are not the
+* leader and the group holds processes we did not start, so there we use the
+* walk alone.
+*
+* Zombies are skipped: they are already dead and waiting to be reaped, so
+* counting them would stall teardown for the full grace period and then report
+* a kill that did nothing. Returns nothing if `ps` is unavailable; callers fall
+* back to signalling the immediate child.
 */
-function descendantsOf(root) {
+function teardownTargets(root) {
 	const ps = spawnSync("ps", [
 		"-A",
 		"-o",
-		"pid=,ppid=,pgid="
+		"pid=,ppid=,pgid=,stat="
 	], { encoding: "utf8" });
 	if (ps.status !== 0 || typeof ps.stdout !== "string") return [];
 	const childrenOf = /* @__PURE__ */ new Map();
 	const groupOf = /* @__PURE__ */ new Map();
 	const isId = (value) => value !== void 0 && Number.isInteger(value);
 	for (const line of ps.stdout.split("\n")) {
-		const [pid, ppid, pgid] = line.trim().split(/\s+/, 3).map(Number);
-		if (!isId(pid) || !isId(ppid) || !isId(pgid)) continue;
-		const siblings = childrenOf.get(ppid);
-		if (siblings) siblings.push(pid);
-		else childrenOf.set(ppid, [pid]);
-		groupOf.set(pid, pgid);
-	}
-	const ourGroup = groupOf.get(process.pid);
-	const found = [];
+		const [pid, ppid, pgid, stat] = line.trim().split(/\s+/, 4);
+		const [id, parent, group] = [
+			pid,
+			ppid,
+			pgid
+		].map(Number);
+		if (!isId(id) || !isId(parent) || !isId(group)) continue;
+		if (stat?.startsWith("Z")) continue;
+		const siblings = childrenOf.get(parent);
+		if (siblings) siblings.push(id);
+		else childrenOf.set(parent, [id]);
+		groupOf.set(id, group);
+	}
+	const found = /* @__PURE__ */ new Set();
 	const queue = [root];
 	const seen = new Set(queue);
 	for (let pid = queue.shift(); pid !== void 0; pid = queue.shift()) for (const kid of childrenOf.get(pid) ?? []) {
 		if (seen.has(kid)) continue;
 		seen.add(kid);
-		found.push({
-			pid: kid,
-			escaped: ourGroup === void 0 || groupOf.get(kid) !== ourGroup
-		});
+		found.add(kid);
 		queue.push(kid);
 	}
-	return found;
+	if (groupOf.get(process.pid) === process.pid) {
+		for (const [pid, group] of groupOf) if (group === process.pid) found.add(pid);
+	}
+	found.delete(process.pid);
+	found.delete(root);
+	return [...found];
 }
 /** Whether `pid` still exists — signal 0 tests reachability, delivers nothing. */
 function isAlive(pid) {
@@ -4624,25 +4649,37 @@ function isAlive(pid) {
 		return false;
 	}
 }
-/** How long a signalled escapee gets to exit on its own before SIGKILL. */
-const ESCAPEE_GRACE_MS = 2e3;
+/** How long a straggler gets to finish shutting down before SIGKILL. */
+const STRAGGLER_GRACE_MS = 2e3;
 /**
-* Give already-signalled processes that left our group a moment to finish
-* shutting down, then SIGKILL the holdouts. We are the last process that knows
-* their pids: the tty won't hang them up, and once their parent exits they
-* reparent to init, out of reach of any walk down from our own child — which is
-* how one survives for days, invisible to `ps -a` for want of a tty. Only
-* processes that already ignored a termination signal are killed; the command
-* itself and anything still in our group shut down at their own pace.
+* Once the command has exited, make sure nothing it started outlives us.
+*
+* Anything still alive here has ignored the signal we forwarded *and* lost the
+* parent that launched it, and we are the last process that knows its pid:
+* the tty won't hang it up (it is no longer in the foreground group, and the
+* shell has moved on), so it survives until the machine reboots. That is how
+* `tsx` and the server under it stacked up for days.
+*
+* So escalate rather than trust. SIGTERM first — it costs no extra time and is
+* a rung the SIGINT-only handlers common in dev servers don't catch — then
+* SIGKILL whatever is left after the grace period. Nothing is killed unless it
+* was asked to stop first and declined, and this runs only when we forwarded a
+* termination signal: a command that exits on its own having deliberately left a
+* daemon behind keeps working.
 */
-async function reapEscapees(pids) {
-	if (pids.size === 0) return;
-	const deadline = Date.now() + ESCAPEE_GRACE_MS;
+async function reapStragglers(pids, signal) {
 	let live = [...pids].filter(isAlive);
+	if (live.length === 0) return;
+	for (const pid of live) try {
+		process.kill(pid, "SIGTERM");
+	} catch {}
+	const deadline = Date.now() + STRAGGLER_GRACE_MS;
 	while (live.length > 0 && Date.now() < deadline) {
 		await new Promise((resolve) => setTimeout(resolve, 50));
 		live = live.filter(isAlive);
 	}
+	if (live.length === 0) return;
+	console.error(`seekrit: force-killed ${live.length} leftover process(es) that ignored ${signal} and SIGTERM (${live.join(", ")})`);
 	for (const pid of live) try {
 		process.kill(pid, "SIGKILL");
 	} catch {}
@@ -4669,21 +4706,27 @@ program.command("run").description("run a command with decrypted secrets injecte
 		"SIGHUP",
 		"SIGQUIT"
 	];
-	const escapees = /* @__PURE__ */ new Set();
+	const stragglers = /* @__PURE__ */ new Set();
+	let forwarded;
+	const collect = () => {
+		if (!posix || !child.pid) return;
+		for (const pid of teardownTargets(child.pid)) stragglers.add(pid);
+	};
 	const forward = (signal) => {
 		if (child.exitCode !== null || child.signalCode !== null) return;
+		forwarded ??= signal;
+		collect();
 		child.kill(signal);
-		if (!posix || !child.pid) return;
-		for (const { pid, escaped } of descendantsOf(child.pid)) {
-			if (escaped) escapees.add(pid);
-			try {
-				process.kill(pid, signal);
-			} catch {}
-		}
+		for (const pid of stragglers) try {
+			process.kill(pid, signal);
+		} catch {}
 	};
 	for (const signal of signals) process.on(signal, forward);
 	child.on("exit", async (code, signal) => {
-		await reapEscapees(escapees);
+		if (forwarded) {
+			collect();
+			await reapStragglers(stragglers, forwarded);
+		}
 		for (const s of signals) process.off(s, forward);
 		if (signal) process.kill(process.pid, signal);
 		else process.exit(code ?? 1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.23.3",
+  "version": "0.23.4",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {