@sylad/cadence 0.27.0 → 0.27.1

package/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "cadence",
       "description": "Session start and close rituals driven by a versioned plan (raf), and deliveries proven by their effect. Needs the cadence CLI (npm i -g @sylad/cadence).",
-      "version": "0.27.0",
+      "version": "0.27.1",
       "source": "./",
       "author": {
         "name": "Sylvain Ladoire"
@@ -17,7 +17,7 @@
     {
       "name": "cadence-hud",
       "description": "A status band above the Claude Code prompt: context, 5 h / 7 d quota windows, cost per model, agents of the session and the running cadence orchestrate waves. Works without the cadence CLI, except the per-project plan progress, which needs `cadence` on the PATH.",
-      "version": "0.4.2",
+      "version": "0.4.3",
       "source": "./plugins/cadence-hud",
       "author": {
         "name": "Sylvain Ladoire"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cadence",
   "description": "A repo-native working method: session start and close rituals driven by a versioned plan (raf), deliveries proven by their effect, and three reviewer agents (UX, code, QA).",
-  "version": "0.27.0",
+  "version": "0.27.1",
   "author": { "name": "Sylvain Ladoire" },
   "homepage": "https://github.com/Sylad/cadence",
   "repository": "https://github.com/Sylad/cadence",

package/README.md

@@ -24,7 +24,7 @@ Code prompt that shows the session's context, quota, cost and the orchestrate wa
 
 ## What's new
 
-**0.27.0**: a compliant review of `cadence orchestrate` settles the open sub-tasks that commits of the lot cite (`feat(L3/t2): …`, comma lists included), closed in the same plan commit as the verdict or, on a read-only plan, returned as `[sous-tâche clore]` proposals, so `raf done` no longer refuses a lot over sub-tasks whose work is done; on a foreign-format plan the ids are read as the plan reads them (L82); the test suite stays green with two full suites running in parallel (L150). **0.26.0**: `cadence orchestrate` raises the floor of a lot's budget from 200 k to 450 k tokens, enough to pay a write pass, its review, one fix pass and the short review that follows, so a lot of 0.5 or 1 day is no longer handed back at its second or third pass; a `--continue` wave draws fewer lots as a result (L128). **0.25.0**: the project line of the plans' progress in the `cadence-hud` band names the lots in progress after their count, three at most then `…` (L153, `cadence-hud` 0.4.2); the progress follows the folder the session was launched from, so a `cd` into a sub-project no longer shrinks the band, and the session context keeps the `session.start` folder (L154). **0.24.0**: `cadence orchestrate --drop <project:lot>` and `--stop-after-current` steer a live wave from another terminal, `--resume --drop` removes a lot before replaying a stopped wave (L79); the final table of a wave says « livrable jusqu'à <sha> » for a ready lot stacked under a lot handed back, with `git push origin <sha>:main && cadence deliver --sha <sha>` (L76); a version commit (version fields, `CHANGELOG.md`, the README's « What's new ») no longer asks for a new code review (L72). **0.23.0**: the progress bar of each project in the `cadence-hud` band is coloured by the share of lots done, red below 33 %, orange below 66 %, green beyond (L152, `cadence-hud` 0.4.1); `cadence deliver` under a wave lock refuses only when a lot of the wave still works in that very repository, a linked worktree included (L127). **0.22.0**: `cadence orchestrate --continue` draws the next ready lot of the plan itself, in the declared priority, until the budget, the time window or a question stops it (L147); `cadence session context` prints the context of the session, which the `cadence-hud` band publishes, and the `lead` skill chains lots without the human while it stays under 60 % (L148); the band shows the progress of each project's plan, and `cadence lead tour --json` gains `progress` (L149, `cadence-hud` 0.4.0); the final review of a lot is always played, the lot's own budget bounding the writing passes only, with 65 k tokens reserved for it (L145); the cause « tests rouges après … » names the pass whose tests were red (L151). **0.21.0**: `cadence orchestrate --status` and `cadence lead tour` print the free session slots, which the `lead` skill reads (L141); `orchestrate.effort` sets the effort level of each pass of a wave (L137); `docs.sync` makes `raf check`, `lead tour` and the review brief report a document that does not follow the code (L143); `docs.articles` opens, after a green `cadence deliver`, a lot `Article <project> à rafraîchir` in the neighbouring repository (L144). **0.20.0**: `cadence-hud` no longer misleads once the work is over: `/hud cmd` lists the background commands it counts (id, tool, origin, age, name), any other argument answers `argument inconnu` instead of hiding the band, commands with no end seen for an hour or no record go to a grey `N cmd sans fin vue`, a finished subagent takes its commands with it, two races that left a `1 cmd` counted forever are closed, and a finished wave shows grey without its budget then disappears after 30 minutes (L142); the `qa-reviewer` and `ux-reviewer` agents are read-only for real, their frontmatter listing Read, Grep, Glob, Bash and the Playwright tools (L140). **0.19.1**: `cadence-hud`'s `N cmd` counter goes back down when a Monitor expires, when the background commands a subagent started end with it, and at session start or plugin reload (L135); its `tool.call` and `prompt.submit` guard hooks carry a `.catch` on registration, which clears the `claude plugin validate` warning (L136). **0.19.0**: `cadence orchestrate` lifts a repository's lock and `pre-push` guard as soon as every lot of the wave that touches it is finished, so `cadence deliver` works there while the wave continues elsewhere (L132); a review that leaves a repository dirty hands back that lot only, suspends the lots still queued in that repository and keeps the other repositories running, its verdict reported instead of lost (L133); `cadence session close` re-run without a `session start` keeps the window since the last opening (L131); `cadence-hud` draws the lot rows of a wave in aligned columns on every surface (L134). **0.18.0**: `cadence session next` prints what it records (issue #6); `cadence session close` covers the period since the last `session start` (or the last close) and says so in its title, `--since` still wins (issue #7). **0.17.0**: `cadence-hud` shows an `N cmd` segment next to the agents, the background commands of the session (Bash run in the background and Monitor, subagents' included), tracked from the tool results and ended by the task's notification or `TaskStop`. **0.16.0**: a lot can declare **neighbouring repositories** (`repos:` key of the lot, `{ path, cite }` for a repository shared between projects): `cadence orchestrate` refuses, locks and guards them, gives them to every session as `--add-dir`, and `raf commits`, `raf show` and the review verdict read the commits that cite the lot there too. **0.15.0**: `hook.autostart` in `cadence.yaml` (`warn` by default, `refuse` or `start`): a pre-commit hook that refuses, or starts in the same commit, a lot still todo that the commit cites; `cadence session start|close --all [--depth n]`, one section per project under a folder. **0.14.0**: `cadence lead tour`, the lead's morning table of every project in a folder, printed by a program (one line per project: lots in progress, gaps, last notes, next ready lot, repository) in place of one subagent per project; the `lead` skill calls it. **0.13.1**: `cadence-hud` takes back the segments that fit once a big one has dropped (reset times, then the per-model consumption, now short: `opus 1.2M sonnet 800k`); `CADENCE_HUD_AMBIGUOUS=1` for a terminal that draws `▰ ▱ ⚙ │ ↻` in one cell. **0.13.0**: `cadence orchestrate --status --watch` (a wave's table redrawn in the terminal, which
+**0.27.1**: `cadence orchestrate` no longer leaves a session's child processes alive: a dev server started in its own process group, or orphaned by a shell that exits (`nohup srv &`), is killed with the session through its process tree and its `CADENCE_SESSION` mark, a tmux server, `screen`, `gpg-agent` or `dirmngr` started on demand being spared; a session that exits with code 0 while a descendant holds its output open is no longer reported as « délai dépassé » (L83); the `ux-reviewer` and `qa-reviewer` agents carry the briefs' Playwright rule outside `cadence orchestrate` (L84). **0.27.0**: a compliant review of `cadence orchestrate` settles the open sub-tasks that commits of the lot cite (`feat(L3/t2): …`, comma lists included), closed in the same plan commit as the verdict or, on a read-only plan, returned as `[sous-tâche clore]` proposals, so `raf done` no longer refuses a lot over sub-tasks whose work is done; on a foreign-format plan the ids are read as the plan reads them (L82); the test suite stays green with two full suites running in parallel (L150). **0.26.0**: `cadence orchestrate` raises the floor of a lot's budget from 200 k to 450 k tokens, enough to pay a write pass, its review, one fix pass and the short review that follows, so a lot of 0.5 or 1 day is no longer handed back at its second or third pass; a `--continue` wave draws fewer lots as a result (L128). **0.25.0**: the project line of the plans' progress in the `cadence-hud` band names the lots in progress after their count, three at most then `…` (L153, `cadence-hud` 0.4.2); the progress follows the folder the session was launched from, so a `cd` into a sub-project no longer shrinks the band, and the session context keeps the `session.start` folder (L154). **0.24.0**: `cadence orchestrate --drop <project:lot>` and `--stop-after-current` steer a live wave from another terminal, `--resume --drop` removes a lot before replaying a stopped wave (L79); the final table of a wave says « livrable jusqu'à <sha> » for a ready lot stacked under a lot handed back, with `git push origin <sha>:main && cadence deliver --sha <sha>` (L76); a version commit (version fields, `CHANGELOG.md`, the README's « What's new ») no longer asks for a new code review (L72). **0.23.0**: the progress bar of each project in the `cadence-hud` band is coloured by the share of lots done, red below 33 %, orange below 66 %, green beyond (L152, `cadence-hud` 0.4.1); `cadence deliver` under a wave lock refuses only when a lot of the wave still works in that very repository, a linked worktree included (L127). **0.22.0**: `cadence orchestrate --continue` draws the next ready lot of the plan itself, in the declared priority, until the budget, the time window or a question stops it (L147); `cadence session context` prints the context of the session, which the `cadence-hud` band publishes, and the `lead` skill chains lots without the human while it stays under 60 % (L148); the band shows the progress of each project's plan, and `cadence lead tour --json` gains `progress` (L149, `cadence-hud` 0.4.0); the final review of a lot is always played, the lot's own budget bounding the writing passes only, with 65 k tokens reserved for it (L145); the cause « tests rouges après … » names the pass whose tests were red (L151). **0.21.0**: `cadence orchestrate --status` and `cadence lead tour` print the free session slots, which the `lead` skill reads (L141); `orchestrate.effort` sets the effort level of each pass of a wave (L137); `docs.sync` makes `raf check`, `lead tour` and the review brief report a document that does not follow the code (L143); `docs.articles` opens, after a green `cadence deliver`, a lot `Article <project> à rafraîchir` in the neighbouring repository (L144). **0.20.0**: `cadence-hud` no longer misleads once the work is over: `/hud cmd` lists the background commands it counts (id, tool, origin, age, name), any other argument answers `argument inconnu` instead of hiding the band, commands with no end seen for an hour or no record go to a grey `N cmd sans fin vue`, a finished subagent takes its commands with it, two races that left a `1 cmd` counted forever are closed, and a finished wave shows grey without its budget then disappears after 30 minutes (L142); the `qa-reviewer` and `ux-reviewer` agents are read-only for real, their frontmatter listing Read, Grep, Glob, Bash and the Playwright tools (L140). **0.19.1**: `cadence-hud`'s `N cmd` counter goes back down when a Monitor expires, when the background commands a subagent started end with it, and at session start or plugin reload (L135); its `tool.call` and `prompt.submit` guard hooks carry a `.catch` on registration, which clears the `claude plugin validate` warning (L136). **0.19.0**: `cadence orchestrate` lifts a repository's lock and `pre-push` guard as soon as every lot of the wave that touches it is finished, so `cadence deliver` works there while the wave continues elsewhere (L132); a review that leaves a repository dirty hands back that lot only, suspends the lots still queued in that repository and keeps the other repositories running, its verdict reported instead of lost (L133); `cadence session close` re-run without a `session start` keeps the window since the last opening (L131); `cadence-hud` draws the lot rows of a wave in aligned columns on every surface (L134). **0.18.0**: `cadence session next` prints what it records (issue #6); `cadence session close` covers the period since the last `session start` (or the last close) and says so in its title, `--since` still wins (issue #7). **0.17.0**: `cadence-hud` shows an `N cmd` segment next to the agents, the background commands of the session (Bash run in the background and Monitor, subagents' included), tracked from the tool results and ended by the task's notification or `TaskStop`. **0.16.0**: a lot can declare **neighbouring repositories** (`repos:` key of the lot, `{ path, cite }` for a repository shared between projects): `cadence orchestrate` refuses, locks and guards them, gives them to every session as `--add-dir`, and `raf commits`, `raf show` and the review verdict read the commits that cite the lot there too. **0.15.0**: `hook.autostart` in `cadence.yaml` (`warn` by default, `refuse` or `start`): a pre-commit hook that refuses, or starts in the same commit, a lot still todo that the commit cites; `cadence session start|close --all [--depth n]`, one section per project under a folder. **0.14.0**: `cadence lead tour`, the lead's morning table of every project in a folder, printed by a program (one line per project: lots in progress, gaps, last notes, next ready lot, repository) in place of one subagent per project; the `lead` skill calls it. **0.13.1**: `cadence-hud` takes back the segments that fit once a big one has dropped (reset times, then the per-model consumption, now short: `opus 1.2M sonnet 800k`); `CADENCE_HUD_AMBIGUOUS=1` for a terminal that draws `▰ ▱ ⚙ │ ↻` in one cell. **0.13.0**: `cadence orchestrate --status --watch` (a wave's table redrawn in the terminal, which
 stops with the wave) and the lead skill that names the wave and follows its journal; lot ids with `/`
 (sub-tasks of a read-only plan) accepted by `orchestrate`; `cadence-hud`'s first line measured in
 terminal cells and kept to ASCII; `publish.yml` on the v5 actions. **0.12.0**: the `cadence-hud` plugin (a status band above the Claude Code prompt),
@@ -1111,6 +1111,23 @@ kept apart, session ids, commits, verdicts), the JSON output of every session an
 cut (Ctrl-C, WSL closed) `--resume` replays an interrupted step entirely in a new session whose brief
 lists the commits already present; finished steps are never replayed.
 
+When a session ends — success, error, time limit (`timeouts`) or interruption of the wave — nothing it started
+survives it: besides its process group, the tree of its descendants is tracked while it runs and killed with it, and
+every session carries a `CADENCE_SESSION=<id>` mark in its environment that all its descendants inherit, even those
+re-parented to init (`nohup srv &` or `setsid srv &` from a shell that exits at once): at the end — as soon as the session's root process exits, not when its output closes, so a descendant holding stdout open cannot turn a session that exited with code 0 into a "time limit" failure — every process
+bearing the mark is killed (read from `/proc/<pid>/environ`, or, where there is no `/proc`, from `ps -axEww` on macOS — `-E` is the BSD option that prints the environment, `-e` only means "all processes" there — and `ps axeww` with procps on Linux).
+
+Limits of the mark, stated rather than hidden: it is read from the process environment, so a descendant that
+dropped it (`env -i`, `env -u CADENCE_SESSION`) is only reached by the tree tracking, and only if it was seen under
+the session between two samples (every 200 ms); a process whose environment is unreadable (another user) is never
+found; a process started through a daemon that already ran before the session (`docker compose up -d` talks to the
+Docker daemon, which owns the containers) is out of reach. **Shared daemons are spared**: a tmux server, `screen`,
+`gpg-agent` or `dirmngr` started on demand by a session carries its mark and would pass it to clients and panes opened
+later from elsewhere, so killing by mark would kill the lead's own tmux panes; those daemons (only when they carry the mark: the lead's own tmux, where cadence itself may run, does not, and spares nothing), and everything that
+descends from them, are left alone (a dev server started inside a tmux pane therefore survives its session). Not in
+that list, because their name does not tell them from an ordinary client: the ssh master (`ControlPersist`), the
+Gradle daemon (java) and pm2 (node) — they are killed if they carry the mark.
+
 Briefs are the templates of `templates/orchestrate/` (`implement.md` is the `lead` skill's standard
 brief; `--dry-run` writes the rendered ones). The `implement` brief of a `visible` lot also carries the
 News instruction (`cadence news new <lot>`, factual user-side text, a screenshot in `docs/nouveautes/captures/` or
@@ -1252,7 +1269,7 @@ repository with `cadence skills install` (to `.claude/skills/cadence-*` and
   `raf add --parent` sub-tasks, and a one-line verdict for `raf ux`. It never
   edits code. Read-only for real: its `tools:` list is `Read, Grep, Glob, Bash` and the
   Playwright tools (`mcp__playwright`, and `mcp__plugin_playwright_playwright` when the
-  browser comes from the Playwright plugin) — no `Edit`, no `Write`.
+  browser comes from the Playwright plugin) — no `Edit`, no `Write`. Outside a wave it gives its captures a relative file name only, which the Playwright MCP writes under `.playwright-mcp/` (the same rule as the wave's briefs); `qa-reviewer` follows it too.
 - **code-reviewer** (agent): any stack; given a repository and a lot id, it reads
   the diff itself from the commits that cite the lot — not the author's summary —
   and the project's CLAUDE.md, when there is one, for its conventions; findings grounded in a

package/agents/qa-reviewer.md

@@ -76,7 +76,7 @@ missing, or the URL does not answer, say so and stop.
 5. **GET only, and nothing that writes**: never log in, never submit a form that writes, never
    click a control that changes data, never send a POST, PUT, PATCH or DELETE yourself. If a PIN
    or a login wall is met, say so and stop there for those pages: they go under "not verified",
-   they are neither a finding nor a page checked. GET only is not "without effect": a probe on an asset name that does not exist was cached for 4 hours by the CDN and then served to real visitors. Request only URLs the app itself uses, or add a cache-busting query parameter.
+   they are neither a finding nor a page checked. GET only is not "without effect": a probe on an asset name that does not exist is cached by a CDN and then served to real visitors. Request only URLs the app itself uses, or add a cache-busting query parameter.
 6. **Classify** what you see:
    - *defect* — a line of the expectations is broken, or a universal check fails with a visible
      effect on the page: an error message shown, a failed API call whose content is missing on
@@ -135,7 +135,7 @@ A short report:
   (/players shows no player)", "no expectations file: 13 pages walked, 1 defect, 8 suspects, draft
   returned". It is the last line of the report.
 
-Captures and temporary files go in a temporary directory outside the repository, or in the one
+Give screenshots and snapshots a relative file name only (e.g. `page-home.png`), never an absolute path: the Playwright MCP writes them under `.playwright-mcp/` (list them in the report if git does not ignore that folder), or in the wave's output directory outside the repository when a wave launched it. Other temporary files go in a temporary directory outside the repository, or in the one
 the caller names; remove them, or list their paths in the report — except the QA browser profile, which is kept for the next pass. The working tree is left as you
 found it.
 

package/agents/ux-reviewer.md

@@ -17,7 +17,7 @@ identity (colours, density, tone) is a constraint, not something to "fix".
 
 1. **Look before judging.** Capture the screen with the browser tool available (Playwright or
    equivalent) at **1440 px** and **390 px** wide, in its main states: empty, loaded, error, loading,
-   and the key interaction. Look at every capture. Store them in the project's temporary folder.
+   and the key interaction. Look at every capture. Give screenshots and snapshots a relative file name only (e.g. `page-home.png`), never an absolute path: the Playwright MCP writes them under `.playwright-mcp/` (list them in the report if git does not ignore that folder), or in the wave's output directory outside the repository when a wave launched it. Anything else you create goes in a temporary directory outside the repository, removed afterwards.
 2. **Walk the main task** a real user comes for (find, read, compare, act, undo) and count the steps.
 3. **Check, and measure where a number exists:**
    - Nielsen's 10 heuristics — especially visibility of system status, match with the user's words,

package/dist/orchestrate/launch.js

@@ -1,8 +1,10 @@
 import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { delimiter, join, resolve } from 'node:path';
 import { parse } from 'yaml';
 import { RafError } from '../plan.js';
+import { killMarked, SESSION_MARK_VAR, TreeTracker } from '../proc.js';
 import { isQuotaMessage, lacksStructuredOutput, parseSession, salvageUsage, sumTokens, tokensOf } from './result.js';
 /**
  * Serveurs MCP d'une étape : Playwright pour `ux` et, sur un lot `visible`, pour `implement` et `fix` (fix-minors compris) ;
@@ -147,6 +149,8 @@ function classify(out) {
     return { kind: 'ok', result };
 }
 const live = new Set();
+const trees = new Set();
+const marks = new Set();
 /** Suit un groupe de processus lancé par l'orchestrateur (commande du projet) : tué avec les sessions au signal. */
 export function trackGroup(pid) {
     live.add(pid);
@@ -163,17 +167,33 @@ export function killSessions() {
         }
     }
     live.clear();
+    for (const t of trees)
+        t.kill();
+    trees.clear();
+    for (const m of marks)
+        killMarked(m);
+    marks.clear();
 }
 /** Vrai lanceur : `claude` (ou CADENCE_CLAUDE_BIN) dans son propre groupe de processus, tué en bloc au délai. */
 export function realClaude(bin, base = process.env) {
     return (args, opts) => new Promise((resolve) => {
-        const child = spawn(bin, args, { cwd: opts.cwd, env: { ...base, ...opts.env }, stdio: ['ignore', 'pipe', 'pipe'], detached: true });
+        // Marque héritée par tous les descendants, même orphelins rattachés à init (un shell qui sort aussitôt après
+        // `nohup srv &` échappe à tout relevé de l'arbre) : à la fin de la session, tout ce qui la porte est tué.
+        const mark = randomUUID();
+        marks.add(mark);
+        const child = spawn(bin, args, { cwd: opts.cwd, env: { ...base, ...opts.env, [SESSION_MARK_VAR]: mark }, stdio: ['ignore', 'pipe', 'pipe'], detached: true });
         const pid = child.pid;
         if (pid === undefined) {
+            marks.delete(mark);
             child.once('error', (e) => resolve({ code: 127, stdout: '', stderr: String(e.message), timedOut: false }));
             return;
         }
         live.add(pid);
+        // Le groupe ne suffit pas : un serveur de dev lancé par la session (setsid, nohup, npm qui se détache) a son propre
+        // groupe et survivait à la session (L83). L'arbre est suivi pendant toute la session ; la marque rattrape ce
+        // qui a quitté l'arbre entre deux relevés.
+        const tree = new TreeTracker(pid);
+        trees.add(tree);
         opts.onSpawn?.(pid);
         const out = [];
         const err = [];
@@ -182,6 +202,8 @@ export function realClaude(bin, base = process.env) {
         let timedOut = false;
         const timer = setTimeout(() => {
             timedOut = true;
+            tree.kill();
+            killMarked(mark);
             try {
                 process.kill(-pid, 'SIGKILL');
             }
@@ -189,16 +211,27 @@ export function realClaude(bin, base = process.env) {
                 // déjà mort
             }
         }, Math.max(1_000, opts.timeoutMs));
-        child.once('close', (code, signal) => {
-            clearTimeout(timer);
-            live.delete(pid);
-            // Un enfant resté dans le groupe ne survit pas à la session.
+        // Aucun descendant ne survit à la session, dans son groupe ou hors de lui. Dès que la racine sort (`exit`), pas
+        // à `close` : un descendant qui tient stdout/stderr ouverts retarderait `close` jusqu'au délai (« délai dépassé »
+        // pour une session pourtant sortie en code 0).
+        const reap = () => {
+            tree.rootExited();
+            tree.kill();
+            trees.delete(tree);
+            killMarked(mark);
             try {
                 process.kill(-pid, 'SIGKILL');
             }
             catch {
                 // groupe vide
             }
+        };
+        child.once('exit', reap);
+        child.once('close', (code, signal) => {
+            clearTimeout(timer);
+            live.delete(pid);
+            reap();
+            marks.delete(mark);
             resolve({ code: code ?? (signal ? 137 : 1), stdout: Buffer.concat(out).toString('utf8'), stderr: Buffer.concat(err).toString('utf8'), timedOut });
         });
     });

package/dist/proc.js

@@ -62,6 +62,21 @@ export function readPsProcs(run = execFileSync) {
     }
     return procs;
 }
+/**
+ * Nom (comm), état, parent et heure de démarrage (champ 22) lus dans `<procRoot>/<pid>/stat` ; null s'il est sorti ou
+ * illisible. Seul lecteur de ce fichier : « pid (comm) état ppid … starttime … », comm peut contenir espaces et parenthèses.
+ */
+export function readStat(procRoot, pid) {
+    try {
+        const stat = readFileSync(`${procRoot}/${pid}/stat`, 'utf8');
+        const close = stat.lastIndexOf(')');
+        const f = stat.slice(close + 2).split(' ');
+        return { name: stat.slice(stat.indexOf('(') + 1, close), state: f[0], ppid: Number(f[1]), start: f[19] };
+    }
+    catch {
+        return null;
+    }
+}
 /** Tous les processus visibles : /proc sous Linux (starttime, champ 22 de stat), `ps` ailleurs (lstart) ; null si illisibles. */
 export function readProcs() {
     const procs = new Map();
@@ -74,15 +89,9 @@ export function readProcs() {
     }
     if (names) {
         for (const n of names) {
-            try {
-                const stat = readFileSync(`/proc/${n}/stat`, 'utf8');
-                // « pid (comm) état ppid … starttime … » — comm peut contenir espaces et parenthèses
-                const f = stat.slice(stat.lastIndexOf(')') + 2).split(' ');
-                procs.set(Number(n), { ppid: Number(f[1]), start: f[19], zombie: f[0] === 'Z' });
-            }
-            catch {
-                // sorti entre-temps
-            }
+            const st = readStat('/proc', Number(n));
+            if (st)
+                procs.set(Number(n), { ppid: st.ppid, start: st.start, zombie: st.state === 'Z' });
         }
     }
     else {
@@ -94,13 +103,10 @@ export function readProcs() {
 export function processStart(pid) {
     if (!Number.isInteger(pid) || pid <= 0)
         return null;
-    try {
-        const stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
-        return stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19] ?? null;
-    }
-    catch {
-        // pas de /proc (macOS) ou processus sorti : ps
-    }
+    const st = readStat('/proc', pid);
+    if (st?.start)
+        return st.start;
+    // pas de /proc (macOS) ou processus sorti : ps
     try {
         const out = execFileSync('ps', ['-p', String(pid), '-o', 'lstart='], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
         return out || null;
@@ -277,3 +283,125 @@ export class TreeTracker {
         }
     }
 }
+/** Variable d'environnement qui marque une session de l'orchestrateur : héritée par tous ses descendants, même orphelins. */
+export const SESSION_MARK_VAR = 'CADENCE_SESSION';
+/**
+ * Démons partagés : lancés à la demande par la première session qui en a besoin, ils portent sa marque et la passent à
+ * tout client ou panneau venu d'ailleurs (serveur tmux, screen, gpg-agent, dirmngr). Ils servent d'autres que la session :
+ * tuer le serveur tmux d'une session tue les panneaux que le lead ouvre ensuite. Épargnés, avec tout ce qui en descend.
+ * Hors liste, faute de pouvoir les distinguer d'un client ordinaire par leur nom : le maître ssh (ControlPersist), le
+ * démon Gradle (java), pm2 (node) — ils restent tués s'ils portent la marque.
+ */
+const SHARED_DAEMONS = new Set(['tmux', 'screen', 'gpg-agent', 'dirmngr']);
+/** Nom d'un processus (comm ou premier mot de sa commande) : `tmux: server` → `tmux`, `/usr/bin/screen` → `screen`. */
+function isSharedDaemon(name) {
+    const base = name.trim().split(/\s/)[0].replace(/:$/, '');
+    return SHARED_DAEMONS.has((base.split('/').pop() ?? '').toLowerCase());
+}
+/**
+ * Vrai si `pid` ou l'un de ses ancêtres est un démon partagé QUI PORTE LA MARQUE (`info` : nom et parent d'un pid, null
+ * s'il est illisible ; `marked` : pids marqués). Un tmux sans la marque est celui du lead, où cadence tourne peut-être :
+ * il n'épargne rien. La remontée s'arrête à cadence.
+ */
+function underSharedDaemon(pid, info, marked) {
+    for (let cur = pid, depth = 0; cur > 1 && cur !== process.pid && depth < 64; depth++) {
+        const i = info(cur);
+        if (!i)
+            return false;
+        if (marked.has(cur) && isSharedDaemon(i.name))
+            return true;
+        cur = i.ppid;
+    }
+    return false;
+}
+/**
+ * Arguments de `ps` qui listent pid, ppid et commande suivie de l'ENVIRONNEMENT, sans limite de largeur, selon la plateforme.
+ * macOS (ps BSD), page de manuel officielle : « -E  Display the environment as well.  This does not reflect changes
+ * in the environment after process launch. » — alors que « -e  Display information about other users' processes,
+ * including those without controlling terminals. Identical to -A. » : sur macOS, `-e` n'affiche PAS l'environnement.
+ * Linux (procps), man ps : « e  Show the environment after the command. » (lettre sans tiret, style BSD ; avec un
+ * tiret, `-e` y signifie « tous les processus »).
+ */
+export function psEnvArgs(platform = process.platform) {
+    return [platform === 'darwin' ? '-axEww' : 'axeww', '-o', 'pid=,ppid=,command='];
+}
+/**
+ * Pids des processus (hors cadence) dont l'environnement porte `<SESSION_MARK_VAR>=<mark>` : /proc, sinon `ps` (`-E` sur
+ * macOS, `e` sur Linux). Les démons partagés (SHARED_DAEMONS) qui portent la marque, et leurs descendants, n'en font pas partie.
+ */
+export function findMarked(mark, io = {}) {
+    const { procRoot = '/proc', run = execFileSync, platform = process.platform, onUnavailable } = io;
+    const entry = `${SESSION_MARK_VAR}=${mark}`;
+    const found = [];
+    let names = null;
+    try {
+        names = readdirSync(procRoot);
+    }
+    catch {
+        // pas de /proc (macOS) : ps
+    }
+    if (names) {
+        for (const name of names) {
+            const pid = Number(name);
+            if (!Number.isInteger(pid) || pid <= 0 || pid === process.pid)
+                continue;
+            try {
+                if (readFileSync(`${procRoot}/${pid}/environ`, 'utf8').split('\0').includes(entry))
+                    found.push(pid);
+            }
+            catch {
+                // sorti, zombie ou illisible (autre utilisateur)
+            }
+        }
+        const markedSet = new Set(found);
+        return found.filter((pid) => !underSharedDaemon(pid, (p) => readStat(procRoot, p), markedSet));
+    }
+    try {
+        const out = run('ps', psEnvArgs(platform), { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 64 * 1024 * 1024 });
+        const table = new Map();
+        const marked = [];
+        for (const line of out.split('\n')) {
+            const m = /^\s*(\d+)\s+(\d+)\s(.*)$/.exec(line);
+            if (!m)
+                continue;
+            const pid = Number(m[1]);
+            table.set(pid, { name: m[3], ppid: Number(m[2]) });
+            // la marque est un mot entier : `s1` ne reconnaît pas `s10` (comme la comparaison exacte des entrées de /proc)
+            if (pid !== process.pid && ` ${m[3]} `.includes(` ${entry} `))
+                marked.push(pid);
+        }
+        const markedSet = new Set(marked);
+        found.push(...marked.filter((pid) => !underSharedDaemon(pid, (p) => table.get(p) ?? null, markedSet)));
+    }
+    catch {
+        // ps absent ou en échec : rien à tuer de plus, mais on le dit
+        onUnavailable?.();
+    }
+    return found;
+}
+function defaultMarkedUnavailable() {
+    process.stderr.write('cadence : processus de la session illisibles (ni /proc ni ps), des orphelins marqués ont pu survivre\n');
+}
+/** Tue (SIGKILL) tout processus marqué de la session, où qu'il soit rattaché ; repasse tant qu'un descendant en crée. */
+export function killMarked(mark, io = {}) {
+    let said = false;
+    const onUnavailable = () => {
+        if (said)
+            return;
+        said = true;
+        (io.onUnavailable ?? defaultMarkedUnavailable)();
+    };
+    for (let pass = 0; pass < 5; pass++) {
+        const pids = findMarked(mark, { ...io, onUnavailable });
+        if (pids.length === 0)
+            return;
+        for (const pid of pids) {
+            try {
+                process.kill(pid, 'SIGKILL');
+            }
+            catch {
+                // déjà mort
+            }
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sylad/cadence",
-  "version": "0.27.0",
+  "version": "0.27.1",
   "description": "A small, repo-native working method: a versioned plan linked to your commits, a changelog with screenshots, session rituals and deliveries proven by their effect.",
   "license": "MIT",
   "author": "Sylvain Ladoire",