@tiphareth/dsh-hardssh 0.1.2 → 0.2.2

package/src/remote/remote-process.ts

@@ -1,203 +1,265 @@
-/**
- * One asynchronously-started SSH command projected onto the subprocess seam.
- * Ported from UynajGI/dsh-ssh (MIT) — the raw ssh2 channel is replaced by the
- * engine's streaming ExecSession.
- */
-
-import { PassThrough } from 'node:stream'
-import type { SshEngine, ExecSession } from '../ssh/engine.ts'
-import type {
-  SubprocessCollect,
-  SubprocessHandle,
-  SubprocessOutcome,
-  SubprocessOutputMode,
-  SubprocessSpawnSpec,
-} from '@deepseek-ai/dsh-subprocess'
-import type { WorkspaceState } from '../protocol.ts'
-import { quoteShellArg, readScrubbedRemoteEnvironment, serializeEnvironment } from './environment.ts'
-import { SshOutputCollector } from './output.ts'
-
-function isCollect(mode: SubprocessOutputMode): mode is SubprocessCollect {
-  return mode !== 'pipe' && mode !== 'inherit'
-}
-
-/** Resolve the remote working directory for one spawn spec. */
-function resolveRemoteCwd(state: WorkspaceState, cwd: string | undefined): string {
-  const root = state.remoteRoot
-  if (root === undefined) throw new Error('subprocess-ssh: remote workspace root is not set')
-  if (cwd !== undefined && cwd.startsWith('/')) return cwd
-  return root
-}
-
-/** Build the remote command text: cd, env -i scrub, exec the argv. */
-async function buildCommand(engine: SshEngine, alias: string, state: WorkspaceState, spec: SubprocessSpawnSpec): Promise<string> {
-  const environment = serializeEnvironment(await readScrubbedRemoteEnvironment(engine, alias), spec.env)
-  const argv = spec.argv.map(quoteShellArg).join(' ')
-  return `cd -- ${quoteShellArg(resolveRemoteCwd(state, spec.cwd))} && exec env -i -- ${environment} ${argv}`
-}
-
-/** SSH-backed subprocess handle. The channel does not expose a remote pid, so `pid` is `-1`. */
-export class SshSubprocessHandle implements SubprocessHandle {
-  readonly stdin: PassThrough | undefined
-  readonly stdout: PassThrough | undefined
-  readonly stderr: PassThrough | undefined
-  readonly collected: SubprocessHandle['collected']
-  readonly done: Promise<SubprocessOutcome>
-
-  private readonly terminationController = new AbortController()
-  private readonly stdoutCollector: SshOutputCollector | undefined
-  private readonly stderrCollector: SshOutputCollector | undefined
-  private session: ExecSession | undefined
-  private graceTimer: NodeJS.Timeout | undefined
-  private settled = false
-
-  constructor(
-    private readonly engine: SshEngine,
-    private readonly getState: () => WorkspaceState,
-    private readonly spec: SubprocessSpawnSpec,
-    private readonly spillDir: string,
-  ) {
-    const outMode = spec.stdio.stdout
-    const errMode = spec.stdio.stderr
-    this.stdout = outMode === 'pipe' ? new PassThrough() : undefined
-    this.stderr = errMode === 'pipe' ? new PassThrough() : undefined
-    this.stdoutCollector = isCollect(outMode)
-      ? new SshOutputCollector(outMode.maxBytes, outMode.spill?.maxBytes, 'stdout', spillDir)
-      : undefined
-    this.stderrCollector = isCollect(errMode)
-      ? new SshOutputCollector(errMode.maxBytes, errMode.spill?.maxBytes, 'stderr', spillDir)
-      : undefined
-    this.collected = {
-      ...(this.stdoutCollector !== undefined ? { stdout: this.stdoutCollector } : {}),
-      ...(this.stderrCollector !== undefined ? { stderr: this.stderrCollector } : {}),
-    }
-    this.stdin = spec.stdio.stdin === 'pipe' ? new PassThrough() : undefined
-
-    spec.signal?.addEventListener('abort', this.onAbort, { once: true })
-    this.done = this.run()
-    void this.done.catch(() => {})
-    if (spec.signal?.aborted === true) this.terminate()
-  }
-
-  /** Remote process id; `-1` because the SSH channel does not expose one. */
-  get pid(): number {
-    return -1
-  }
-
-  /** @inheritdoc */
-  terminate(): void {
-    if (this.settled || this.terminationController.signal.aborted) return
-    this.terminationController.abort(new Error('subprocess-ssh: command terminated'))
-    const session = this.session
-    if (session !== undefined) this.signalTerm(session)
-  }
-
-  /** @inheritdoc */
-  waitForExit(signal?: AbortSignal): Promise<boolean> {
-    if (this.settled) return Promise.resolve(true)
-    if (signal?.aborted === true) return Promise.resolve(false)
-    if (signal === undefined) {
-      return this.done.then(() => true, () => true)
-    }
-    return new Promise<boolean>((resolve) => {
-      const onAbort = (): void => { cleanup(); resolve(false) }
-      const cleanup = (): void => { signal.removeEventListener('abort', onAbort) }
-      signal.addEventListener('abort', onAbort, { once: true })
-      void this.done.then(() => { cleanup(); resolve(true) }, () => { cleanup(); resolve(true) })
-    })
-  }
-
-  private readonly onAbort = (): void => { this.terminate() }
-
-  private signalTerm(session: ExecSession): void {
-    try {
-      session.signal('TERM')
-    } catch {
-      // The channel closed before the signal could be delivered; close is authoritative.
-    }
-    this.graceTimer = setTimeout(() => {
-      try {
-        session.signal('KILL')
-      } catch {
-        // Escalation after a graceful close is a no-op.
-      }
-    }, this.spec.graceMs)
-  }
-
-  private settle(): void {
-    if (this.settled) return
-    this.settled = true
-    if (this.graceTimer !== undefined) clearTimeout(this.graceTimer)
-    this.graceTimer = undefined
-    this.stdoutCollector?.seal()
-    this.stderrCollector?.seal()
-    this.spec.signal?.removeEventListener('abort', this.onAbort)
-  }
-
-  private async run(): Promise<SubprocessOutcome> {
-    let session: ExecSession
-    try {
-      const state = this.getState()
-      if (state.mode !== 'remote' || state.alias === undefined) {
-        throw new Error('subprocess-ssh: not in remote mode — switch the GUI to SSH mode first')
-      }
-      const command = await buildCommand(this.engine, state.alias, state, this.spec)
-      session = await this.engine.openExec(state.alias, command)
-    } catch (error) {
-      this.settle()
-      throw error
-    }
-    this.session = session
-    if (this.terminationController.signal.aborted) this.signalTerm(session)
-
-    this.wireStdout(session)
-    this.wireStderr(session)
-    if (this.stdin !== undefined) {
-      this.stdin.pipe({
-        write: (chunk: Buffer, encoding: BufferEncoding, callback?: (error?: Error | null) => void) => {
-          try {
-            session.send(chunk.toString(encoding ?? 'utf8'))
-            callback?.()
-          } catch (error) {
-            callback?.(error instanceof Error ? error : new Error(String(error)))
-          }
-        },
-        end: (callback?: () => void) => {
-          session.end()
-          callback?.()
-        },
-      } as unknown as NodeJS.WritableStream)
-    } else if (typeof this.spec.stdio.stdin === 'object') {
-      session.end(this.spec.stdio.stdin.data)
-    }
-
-    return await new Promise<SubprocessOutcome>((resolve, reject) => {
-      session.onExit = (code: number | null, error?: string) => {
-        this.settle()
-        if (error !== undefined) {
-          reject(new Error(`subprocess-ssh: ${error}`))
-        } else {
-          resolve({ exitCode: code, signal: null })
-        }
-      }
-    })
-  }
-
-  private wireStdout(session: ExecSession): void {
-    const mode = this.spec.stdio.stdout
-    session.onData = (data: Buffer) => {
-      if (mode === 'pipe') this.stdout?.write(data)
-      else if (mode === 'inherit') process.stdout.write(data)
-      else this.stdoutCollector?.push(data)
-    }
-  }
-
-  private wireStderr(session: ExecSession): void {
-    const mode = this.spec.stdio.stderr
-    session.onErrData = (data: Buffer) => {
-      if (mode === 'pipe') this.stderr?.write(data)
-      else if (mode === 'inherit') process.stderr.write(data)
-      else this.stderrCollector?.push(data)
-    }
-  }
-}
+/**
+ * One asynchronously-started SSH command projected onto the subprocess seam.
+ * Ported from UynajGI/dsh-ssh (MIT) — the raw ssh2 channel is replaced by the
+ * engine's streaming ExecSession.
+ */
+
+import { PassThrough, type Writable } from 'node:stream'
+import type { SshEngine, ExecSession } from '../ssh/engine.ts'
+import type {
+  SubprocessCollect,
+  SubprocessHandle,
+  SubprocessOutcome,
+  SubprocessOutputMode,
+  SubprocessSpawnSpec,
+} from '@deepseek-ai/dsh-subprocess'
+import type { WorkspaceState } from '../protocol.ts'
+import { quoteShellArg, readScrubbedRemoteEnvironment, serializeEnvironment } from './environment.ts'
+import { SshOutputCollector } from './output.ts'
+
+function isCollect(mode: SubprocessOutputMode): mode is SubprocessCollect {
+  return mode !== 'pipe' && mode !== 'inherit'
+}
+
+/** Resolve the remote working directory for one spawn spec. */
+function resolveRemoteCwd(state: WorkspaceState, cwd: string | undefined): string {
+  const root = state.remoteRoot
+  if (root === undefined) throw new Error('subprocess-ssh: remote workspace root is not set')
+  if (cwd !== undefined && cwd.startsWith('/')) return cwd
+  return root
+}
+
+/** Build the remote command text: cd, env -i scrub, exec the argv. */
+async function buildCommand(engine: SshEngine, alias: string, state: WorkspaceState, spec: SubprocessSpawnSpec): Promise<string> {
+  const environment = serializeEnvironment(await readScrubbedRemoteEnvironment(engine, alias), spec.env)
+  const argv = spec.argv.map(quoteShellArg).join(' ')
+  return `cd -- ${quoteShellArg(resolveRemoteCwd(state, spec.cwd))} && exec env -i -- ${environment} ${argv}`
+}
+
+function toError(error: unknown): Error {
+  return error instanceof Error ? error : new Error(String(error))
+}
+
+/** SSH-backed subprocess handle. The channel does not expose a remote pid, so `pid` is `-1`. */
+export class SshSubprocessHandle implements SubprocessHandle {
+  readonly stdin: PassThrough | undefined
+  readonly stdout: PassThrough | undefined
+  readonly stderr: PassThrough | undefined
+  readonly collected: SubprocessHandle['collected']
+  readonly done: Promise<SubprocessOutcome>
+
+  private readonly terminationController = new AbortController()
+  private readonly stdoutCollector: SshOutputCollector | undefined
+  private readonly stderrCollector: SshOutputCollector | undefined
+  private session: ExecSession | undefined
+  private inputSink: Writable | undefined
+  private inputErrorListener: ((error: unknown) => void) | undefined
+  private terminationPhase: 'none' | 'term' | 'kill' = 'none'
+  private graceTimer: NodeJS.Timeout | undefined
+  private forceTimer: NodeJS.Timeout | undefined
+  private resolveForced: ((outcome: SubprocessOutcome) => void) | undefined
+  private forceClosed = false
+  private settled = false
+
+  constructor(
+    private readonly engine: SshEngine,
+    private readonly getState: () => WorkspaceState,
+    private readonly spec: SubprocessSpawnSpec,
+    private readonly spillDir: string,
+  ) {
+    const outMode = spec.stdio.stdout
+    const errMode = spec.stdio.stderr
+    this.stdout = outMode === 'pipe' ? new PassThrough() : undefined
+    this.stderr = errMode === 'pipe' ? new PassThrough() : undefined
+    this.stdoutCollector = isCollect(outMode)
+      ? new SshOutputCollector(outMode.maxBytes, outMode.spill?.maxBytes, 'stdout', spillDir)
+      : undefined
+    this.stderrCollector = isCollect(errMode)
+      ? new SshOutputCollector(errMode.maxBytes, errMode.spill?.maxBytes, 'stderr', spillDir)
+      : undefined
+    this.collected = {
+      ...(this.stdoutCollector !== undefined ? { stdout: this.stdoutCollector } : {}),
+      ...(this.stderrCollector !== undefined ? { stderr: this.stderrCollector } : {}),
+    }
+    this.stdin = spec.stdio.stdin === 'pipe' ? new PassThrough() : undefined
+
+    const forced = new Promise<SubprocessOutcome>((resolve) => { this.resolveForced = resolve })
+    spec.signal?.addEventListener('abort', this.onAbort, { once: true })
+    // The force branch exists from construction time, so runtime disposal can
+    // settle `done` even while environment lookup/openExec is still pending.
+    this.done = Promise.race([this.run(), forced]).finally(() => { this.settle() })
+    void this.done.catch(() => {})
+    if (spec.signal?.aborted === true) this.terminate()
+  }
+
+  /** Remote process id; `-1` because the SSH channel does not expose one. */
+  get pid(): number {
+    return -1
+  }
+
+  /** @inheritdoc */
+  terminate(): void {
+    if (this.settled || this.terminationController.signal.aborted) return
+    this.terminationController.abort(new Error('subprocess-ssh: command terminated'))
+    this.startTermination()
+  }
+
+  /** @inheritdoc */
+  waitForExit(signal?: AbortSignal): Promise<boolean> {
+    if (this.settled) return Promise.resolve(true)
+    if (signal?.aborted === true) return Promise.resolve(false)
+    if (signal === undefined) return this.done.then(() => true, () => true)
+    return new Promise<boolean>((resolve) => {
+      const onAbort = (): void => { cleanup(); resolve(false) }
+      const cleanup = (): void => { signal.removeEventListener('abort', onAbort) }
+      signal.addEventListener('abort', onAbort, { once: true })
+      void this.done.then(() => { cleanup(); resolve(true) }, () => { cleanup(); resolve(true) })
+    })
+  }
+
+  private readonly onAbort = (): void => { this.terminate() }
+
+  private signalCurrentPhase(session: ExecSession): void {
+    if (this.terminationPhase === 'none') return
+    try { session.signal(this.terminationPhase === 'term' ? 'TERM' : 'KILL') } catch { /* channel already closed */ }
+  }
+
+  private startTermination(): void {
+    if (this.terminationPhase !== 'none' || this.settled) return
+    this.terminationPhase = 'term'
+    if (this.session !== undefined) this.signalCurrentPhase(this.session)
+    this.graceTimer = setTimeout(() => {
+      if (this.settled) return
+      this.terminationPhase = 'kill'
+      if (this.session !== undefined) this.signalCurrentPhase(this.session)
+      this.forceTimer = setTimeout(() => { this.forceClose() }, this.spec.graceMs)
+      this.forceTimer.unref?.()
+    }, this.spec.graceMs)
+    this.graceTimer.unref?.()
+  }
+
+  /** Immediately close the owned channel and settle `done`, including while
+   * openExec is still pending. A late-opened channel observes forceClosed and
+   * closes itself before any stream wiring is installed. */
+  forceClose(): void {
+    if (this.settled || this.forceClosed) return
+    this.forceClosed = true
+    const error = new Error('subprocess-ssh: command forcibly closed during teardown')
+    if (!this.terminationController.signal.aborted) this.terminationController.abort(error)
+    try { this.session?.close() } catch { /* channel already closed */ }
+    this.resolveForced?.({ exitCode: null, signal: 'SIGKILL' })
+  }
+
+  private settle(): void {
+    if (this.settled) return
+    this.settled = true
+    if (this.graceTimer !== undefined) clearTimeout(this.graceTimer)
+    if (this.forceTimer !== undefined) clearTimeout(this.forceTimer)
+    this.graceTimer = undefined
+    this.forceTimer = undefined
+    this.resolveForced = undefined
+    if (this.inputSink !== undefined && this.inputErrorListener !== undefined) {
+      this.inputSink.off('error', this.inputErrorListener)
+    }
+    if (this.stdin !== undefined && this.inputSink !== undefined) this.stdin.unpipe(this.inputSink)
+    this.stdin?.destroy()
+    this.inputSink = undefined
+    this.inputErrorListener = undefined
+    this.stdout?.end()
+    this.stderr?.end()
+    this.stdoutCollector?.seal()
+    this.stderrCollector?.seal()
+    this.spec.signal?.removeEventListener('abort', this.onAbort)
+  }
+
+  private async run(): Promise<SubprocessOutcome> {
+    const state = this.getState()
+    if (state.mode !== 'remote' || state.alias === undefined) {
+      throw new Error('subprocess-ssh: not in remote mode — switch the GUI to SSH mode first')
+    }
+    const command = await buildCommand(this.engine, state.alias, state, this.spec)
+    const session = await this.engine.openExec(state.alias, command)
+    this.session = session
+    if (this.forceClosed) {
+      try { session.close() } catch { /* channel already closed */ }
+      throw new Error('subprocess-ssh: command opened after its owner was disposed')
+    }
+    if (this.terminationController.signal.aborted) {
+      if (this.terminationPhase === 'none') this.startTermination()
+      else this.signalCurrentPhase(session)
+    }
+    return this.runSession(session)
+  }
+
+  /** Install every callback under one ownership boundary. Any synchronous
+   * wiring failure or async stdin sink failure closes the established session
+   * and rejects the handle instead of leaking it. */
+  private runSession(session: ExecSession): Promise<SubprocessOutcome> {
+    return new Promise<SubprocessOutcome>((resolve, reject) => {
+      let finished = false
+      const fail = (error: unknown): void => {
+        if (finished) return
+        finished = true
+        try { session.close() } catch { /* retain the primary error */ }
+        reject(toError(error))
+      }
+      session.onExit = (code: number | null, error?: string) => {
+        if (finished) return
+        finished = true
+        if (error !== undefined) reject(new Error(`subprocess-ssh: ${error}`))
+        else resolve({ exitCode: code, signal: null })
+      }
+
+      try {
+        this.wireStdout(session)
+        this.wireStderr(session)
+        if (this.stdin !== undefined) {
+          this.inputSink = session.stdin
+          this.inputErrorListener = fail
+          session.stdin.once('error', fail)
+          this.stdin.pipe(session.stdin)
+        } else if (typeof this.spec.stdio.stdin === 'object') {
+          session.stdin.end(this.spec.stdio.stdin.data)
+        } else {
+          // `ignore` is remote /dev/null semantics: close fd 0 immediately so
+          // commands waiting for EOF cannot hang forever.
+          session.stdin.end()
+        }
+      } catch (error) {
+        fail(error)
+      }
+    })
+  }
+
+  /** Route one stream through the engine's leak guard before it reaches the
+   *  consumer. Without this, a remote `bash`/subprocess channel bypassed the
+   *  redaction that every exec/cluster result already applies. Redaction is
+   *  exact-match over known secrets, so it is best-effort and may change byte
+   *  length — the same trade-off the PTY route documents. */
+  private redactBytes(data: Buffer): Buffer {
+    if (typeof this.engine.redact !== 'function') return data
+    const text = data.toString('utf8')
+    const safe = this.engine.redact(text)
+    return safe === text ? data : Buffer.from(safe, 'utf8')
+  }
+
+  private wireStdout(session: ExecSession): void {
+    const mode = this.spec.stdio.stdout
+    session.onData = (data: Buffer) => {
+      const safe = this.redactBytes(data)
+      if (mode === 'pipe') this.stdout?.write(safe)
+      else if (mode === 'inherit') process.stdout.write(safe)
+      else this.stdoutCollector?.push(safe)
+    }
+  }
+
+  private wireStderr(session: ExecSession): void {
+    const mode = this.spec.stdio.stderr
+    session.onErrData = (data: Buffer) => {
+      const safe = this.redactBytes(data)
+      if (mode === 'pipe') this.stderr?.write(safe)
+      else if (mode === 'inherit') process.stderr.write(safe)
+      else this.stderrCollector?.push(safe)
+    }
+  }
+}

package/src/remote/remote-subprocess.ts

@@ -7,7 +7,7 @@
  * @module dsh-hardssh/remote-subprocess
  */
 
-import { mkdtempSync } from 'node:fs'
+import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join, posix } from 'node:path'
 import type { Context } from '@deepseek-ai/cordis'
@@ -34,12 +34,23 @@ function requireRepresentableGrace(graceMs: number): void {
   }
 }
 
+/** Hard upper bound for plugin/workspace teardown, independent of a caller's
+ * potentially very large per-process TERM/KILL grace setting. */
+export const SUBPROCESS_DISPOSE_DEADLINE_MS = 5_000
+
+function delay(ms: number): Promise<void> {
+  return new Promise(resolve => {
+    const timer = setTimeout(resolve, ms)
+    timer.unref?.()
+  })
+}
+
 /** SSH command manager registered as `ctx.subprocess` (remote mode). */
 export class SshSubprocessRuntime extends SubprocessRuntime {
   private readonly live = new Set<SshSubprocessHandle>()
   private readonly terminals = new Set<SshTerminalHandle>()
   private readonly spillDir = mkdtempSync(join(tmpdir(), 'dsh-subprocess-ssh-'))
-  private disposing = false
+  private closePromise: Promise<void> | undefined
 
   constructor(
     ctx: Context,
@@ -48,22 +59,54 @@ export class SshSubprocessRuntime extends SubprocessRuntime {
   ) {
     super(ctx)
     ctx.effect(() => async () => {
-      this.disposing = true
-      const handles = [...this.live]
-      const terminals = [...this.terminals]
-      const pending: Promise<unknown>[] = []
-      for (const handle of handles) {
-        handle.terminate()
-        pending.push(handle.waitForExit().then(() => { this.live.delete(handle) }))
-      }
-      for (const terminal of terminals) {
-        pending.push(terminal.terminate().then(() => { this.terminals.delete(terminal) }))
-      }
-      const outcomes = await Promise.allSettled(pending)
+      // The effect's own body would duplicate close(); delegating keeps one
+      // idempotent teardown path for host shutdown and on-demand connection close.
+      await this.close()
+    }, 'ssh subprocess teardown')
+  }
+
+  /**
+   * Public idempotent close that releases every workspace-owned live process
+   * and terminal. The ctx.effect teardown cannot be invoked by a workspace
+   * connection (it only runs when the cordis scope disposes, which would also
+   * tear down the shared engine's scope), so a SshWorkspaceConnection calls
+   * this on-demand close() instead — the engine pool itself stays untouched.
+   */
+  close(): Promise<void> {
+    this.closePromise ??= this.closeOwnedResources()
+    return this.closePromise
+  }
+
+  private async closeOwnedResources(): Promise<void> {
+    const handles = [...this.live]
+    const terminals = [...this.terminals]
+    const pending: Promise<unknown>[] = []
+    for (const handle of handles) {
+      handle.terminate()
+      pending.push(handle.waitForExit().then(() => { this.live.delete(handle) }))
+    }
+    for (const terminal of terminals) {
+      pending.push(terminal.terminate().then(() => { this.terminals.delete(terminal) }))
+    }
+
+    const all = Promise.allSettled(pending)
+    const graceful = await Promise.race([
+      all.then(outcomes => ({ outcomes })),
+      delay(SUBPROCESS_DISPOSE_DEADLINE_MS).then(() => undefined),
+    ])
+    if (graceful === undefined) {
+      for (const handle of handles) handle.forceClose()
+      for (const terminal of terminals) terminal.forceClose()
+    }
+
+    try {
+      const outcomes = graceful?.outcomes ?? await all
       const failures = outcomes.flatMap<unknown>(outcome => outcome.status === 'rejected' ? [outcome.reason as unknown] : [])
       if (failures.length === 1) throw failures[0]
       if (failures.length > 1) throw new AggregateError(failures, 'subprocess-ssh: teardown failed')
-    }, 'ssh subprocess teardown')
+    } finally {
+      rmSync(this.spillDir, { recursive: true, force: true })
+    }
   }
 
   /** @inheritdoc */
@@ -113,7 +156,7 @@ export class SshSubprocessRuntime extends SubprocessRuntime {
 
   /** @inheritdoc */
   spawn(spec: SubprocessSpawnSpec): SubprocessHandle {
-    if (this.disposing) throw new Error('subprocess-ssh: service is disposing')
+    if (this.closePromise !== undefined) throw new Error('subprocess-ssh: service is disposing')
     const program = spec.argv[0]
     if (program === undefined || program.length === 0) {
       throw new Error('invalid argv: expected a non-empty program name at argv[0]')
@@ -134,7 +177,7 @@ export class SshSubprocessRuntime extends SubprocessRuntime {
 
   /** @inheritdoc */
   async spawnTerminal(spec: SubprocessTerminalSpawnSpec): Promise<SubprocessTerminalHandle> {
-    if (this.disposing) throw new Error('subprocess-ssh: service is disposing')
+    if (this.closePromise !== undefined) throw new Error('subprocess-ssh: service is disposing')
     const program = spec.argv[0]
     if (program === undefined || program.length === 0) {
       throw new Error('subprocess-ssh: terminal argv must contain a program')
@@ -142,7 +185,7 @@ export class SshSubprocessRuntime extends SubprocessRuntime {
     requireRepresentableGrace(spec.graceMs)
     spec.signal?.throwIfAborted()
     const terminal = await spawnSshTerminal(this.engine, this.getState, spec)
-    if (this.disposing) {
+    if (this.closePromise !== undefined) {
       await terminal.terminate()
       throw new Error('subprocess-ssh: service disposed during terminal setup')
     }