@with-logic/elwood 0.2.0 → 0.2.2

package/dist/runtime/session/shutdown.d.ts

@@ -14,7 +14,7 @@ import type { SessionReapPolicy } from "./reap.ts";
 export type ShutdownEvidence = "stop_completed" | "kill_completed" | "teardown_completed";
 /** The reap surface shutdown drives: the typed-throw reap plus the retryable one-shot. */
 export type ShutdownReapPolicy = Pick<SessionReapPolicy, "orThrow"> & {
-    readonly reaper: Pick<SessionReapPolicy["reaper"], "reap">;
+    readonly reaper: Pick<SessionReapPolicy["reaper"], "reap" | "reapAndThrowOnDetachedSweepFailure" | "sweepDetached" | "signalLeaderPty">;
 };
 /** The session surface the shutdown/teardown orchestration drives. */
 export type ShutdownHost = {
@@ -43,7 +43,8 @@ export declare function managedShutdown(coordinator: ShutdownCoordinator, host:
  * may be recycled. In that case it performs a one-shot survivor reap that rejects with
  * a typed error on failure and leaves the reap retryable; a first, live shutdown marks
  * signal ownership, terminates the PTY (which reaps on every path), and records
- * shutdown evidence (C-LIFE-10).
+ * shutdown evidence (C-LIFE-10). Either way runtime cleanup follows, even after a
+ * failed termination or reap (see `shutdownAttemptThenCleanUp`).
  */
 export declare function runShutdown(host: ShutdownHost, signal: "SIGTERM" | "SIGKILL", evidence: ShutdownEvidence, ctx: ShutdownContext): Promise<void>;
 /**

package/dist/runtime/session/shutdown.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shutdown.d.ts","sourceRoot":"","sources":["../../../src/runtime/session/shutdown.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnD,kFAAkF;AAClF,MAAM,MAAM,gBAAgB,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAE1F,0FAA0F;AAC1F,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,GAAG;IACpE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;CAC5D,CAAC;AAEF,sEAAsE;AACtE,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACjD,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,mBAAmB,CAAC;IAC3C,QAAQ,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC7D,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,QAAQ,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,QAAQ,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,IAAI,CAAC;CAC7D,CAAC;AAEF,4EAA4E;AAC5E,KAAK,eAAe,GAAG;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC,CAAC;AAEF,yFAAyF;AACzF,wBAAgB,eAAe,CAC7B,WAAW,EAAE,mBAAmB,EAChC,IAAI,EAAE,MAAM,YAAY,GACvB,eAAe,CAMjB;AAuCD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,SAAS,GAAG,SAAS,EAC7B,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,IAAI,CAAC,CAWf;AAkBD;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBzF"}
+{"version":3,"file":"shutdown.d.ts","sourceRoot":"","sources":["../../../src/runtime/session/shutdown.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAGnD,kFAAkF;AAClF,MAAM,MAAM,gBAAgB,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAE1F,0FAA0F;AAC1F,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,GAAG;IACpE,QAAQ,CAAC,MAAM,EAAE,IAAI,CACnB,iBAAiB,CAAC,QAAQ,CAAC,EAC3B,MAAM,GAAG,oCAAoC,GAAG,eAAe,GAAG,iBAAiB,CACpF,CAAC;CACH,CAAC;AAEF,sEAAsE;AACtE,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACjD,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,mBAAmB,CAAC;IAC3C,QAAQ,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC7D,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,QAAQ,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,QAAQ,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,IAAI,CAAC;CAC7D,CAAC;AAEF,4EAA4E;AAC5E,KAAK,eAAe,GAAG;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC,CAAC;AAEF,yFAAyF;AACzF,wBAAgB,eAAe,CAC7B,WAAW,EAAE,mBAAmB,EAChC,IAAI,EAAE,MAAM,YAAY,GACvB,eAAe,CAMjB;AAuCD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,SAAS,GAAG,SAAS,EAC7B,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,IAAI,CAAC,CAWf;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBzF"}

package/dist/runtime/session/shutdown.js

@@ -5,10 +5,10 @@
  * as a typed error (never swallows it), while an already-terminal session is never
  * re-signaled — node-pty does not replay the exit and the pid may be recycled.
  */
-import { elwoodError } from "../../core/errors.js";
 import { terminalStatuses } from "../../core/status-categories.js";
 import { runTeardownSteps } from "../shutdown/teardown.js";
 import { terminatePty } from "../shutdown/terminate.js";
+import { shutdownAttemptThenCleanUp } from "./shutdown-cleanup.js";
 /** Binds `stop`/`kill`/`teardown` to one coordinator + lazily-built host (C-LIFE-10). */
 export function managedShutdown(coordinator, host) {
     return {
@@ -53,36 +53,21 @@ function mustNotSignal(host, ctx) {
  * may be recycled. In that case it performs a one-shot survivor reap that rejects with
  * a typed error on failure and leaves the reap retryable; a first, live shutdown marks
  * signal ownership, terminates the PTY (which reaps on every path), and records
- * shutdown evidence (C-LIFE-10).
+ * shutdown evidence (C-LIFE-10). Either way runtime cleanup follows, even after a
+ * failed termination or reap (see `shutdownAttemptThenCleanUp`).
  */
 export async function runShutdown(host, signal, evidence, ctx) {
     host.claimShutdown(evidence); // Claim the exit before signaling.
+    const cleanupRuntime = () => host.cleanupRuntime();
     if (mustNotSignal(host, ctx)) {
-        host.reapPolicy.orThrow(); // Typed rejection on failure; never swallows.
-        await cleanupOrThrowTermination(host);
-        return; // Already signaled / terminal: no new signal, no evidence to submit.
+        // Already signaled / terminal: no new signal, no evidence to submit.
+        return shutdownAttemptThenCleanUp(() => host.reapPolicy.orThrow(), cleanupRuntime);
     }
     ctx.markSignaled();
-    await terminatePty(host.pty, signal, host.reapPolicy.reaper);
-    await cleanupOrThrowTermination(host);
+    const terminate = () => terminatePty(host.pty, signal, host.reapPolicy.reaper);
+    await shutdownAttemptThenCleanUp(terminate, cleanupRuntime);
     host.submitEvidence(evidence);
 }
-/**
- * Runs runtime cleanup, folding its raw aggregate failure into the stable public
- * `termination_failed` error. `runCleanupSteps` rejects with a bare `Error` on the
- * assumption that its caller wraps it; `stop()`/`kill()` are that caller, so without
- * this an untyped Error would escape the public shutdown boundary (PRD §10).
- */
-async function cleanupOrThrowTermination(host) {
-    try {
-        await host.cleanupRuntime();
-    }
-    catch (error) {
-        throw elwoodError("termination_failed", "Could not clean up the Elwood runtime.", {
-            cause: error instanceof Error ? error.message : String(error),
-        });
-    }
-}
 /**
  * Teardown: terminate a still-live PTY (unless it was already signaled), reap
  * (retrying a prior failed reap), stop the runtime, record teardown evidence, and
@@ -100,7 +85,11 @@ export async function runTeardown(host, ctx) {
             ctx.markSignaled();
             return terminatePty(host.pty, "SIGKILL", host.reapPolicy.reaper);
         },
-        () => host.reapPolicy.reaper.reap(), // No-op once latched; retries a failed reap.
+        // No-op once latched; retries a failed reap, and keeps failing while a detached
+        // sweep is unresolved, so a retry never reports a possibly running hook as reaped.
+        // Typed, so `teardown_failed` keeps its errno, the leader's process-group id, and
+        // any unconfirmed process-group ids (§10).
+        () => host.reapPolicy.orThrow(),
         () => host.cleanupRuntime(),
         () => host.submitEvidence("teardown_completed"),
         host.removeFiles,

package/dist/runtime/session/shutdown.js.map

@@ -1 +1 @@
-{"version":3,"file":"shutdown.js","sourceRoot":"","sources":["../../../src/runtime/session/shutdown.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAInE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAgCxD,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAC7B,WAAgC,EAChC,IAAwB;IAExB,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC;QACzD,IAAI,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC;QACzD,QAAQ,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,uFAAuF;AACvF,MAAM,aAAa,GAAG;IACpB,IAAI,EAAE,CAAC,IAAkB,EAAE,GAAoB,EAAE,EAAE;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,EAAE,CAAC,IAAkB,EAAE,GAAoB,EAAE,EAAE,CACjD,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAClF,QAAQ,EAAE,CAAC,IAAkB,EAAE,GAAoB,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC;CACtE,CAAC;AAEX;;;;;GAKG;AACH,SAAS,kBAAkB,CACzB,WAAgC,EAChC,IAAgC,EAChC,IAAwB;IAExB,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,IAAkB,EAAE,GAAoB;IAC7D,OAAO,GAAG,CAAC,eAAe,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAkB,EAClB,MAA6B,EAC7B,QAA0B,EAC1B,GAAoB;IAEpB,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,mCAAmC;IACjE,IAAI,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,8CAA8C;QACzE,MAAM,yBAAyB,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,CAAC,qEAAqE;IAC/E,CAAC;IACD,GAAG,CAAC,YAAY,EAAE,CAAC;IACnB,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,yBAAyB,CAAC,IAAkB;IACzD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,CAAC,oBAAoB,EAAE,wCAAwC,EAAE;YAChF,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAkB,EAAE,GAAoB;IACxE,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,EAAE,CAAC;IAClB,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,oBAAoB,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAChD,gBAAgB,CAAC;QACf,GAAG,EAAE;YACH,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,SAAS,CAAC;YACtC,GAAG,CAAC,YAAY,EAAE,CAAC;YACnB,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACnE,CAAC;QACD,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,6CAA6C;QAClF,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE;QAC3B,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC;QAC/C,IAAI,CAAC,WAAW;KACjB,CAAC,CACH,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,oBAAoB,CACjC,IAAkB,EAClB,MAA2B,EAC3B,OAA4B;IAE5B,IAAI,WAAoB,CAAC;IACzB,IAAI,cAAuB,CAAC;IAC5B,MAAM,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,CAAC;QACH,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,CAAC;IACf,IAAI,WAAW,KAAK,SAAS;QAAE,MAAM,WAAW,CAAC;IACjD,IAAI,cAAc,KAAK,SAAS;QAAE,MAAM,cAAc,CAAC;AACzD,CAAC;AAED,8FAA8F;AAC9F,KAAK,UAAU,eAAe,CAAC,IAAkB,EAAE,OAA4B;IAC7E,IAAI,CAAC,UAAU,EAAE,CAAC;IAClB,MAAM,OAAO,EAAE,CAAC;IAChB,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"shutdown.js","sourceRoot":"","sources":["../../../src/runtime/session/shutdown.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAInE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAGxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAiCnE,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAC7B,WAAgC,EAChC,IAAwB;IAExB,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC;QACzD,IAAI,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC;QACzD,QAAQ,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,uFAAuF;AACvF,MAAM,aAAa,GAAG;IACpB,IAAI,EAAE,CAAC,IAAkB,EAAE,GAAoB,EAAE,EAAE;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,EAAE,CAAC,IAAkB,EAAE,GAAoB,EAAE,EAAE,CACjD,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAClF,QAAQ,EAAE,CAAC,IAAkB,EAAE,GAAoB,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC;CACtE,CAAC;AAEX;;;;;GAKG;AACH,SAAS,kBAAkB,CACzB,WAAgC,EAChC,IAAgC,EAChC,IAAwB;IAExB,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,IAAkB,EAAE,GAAoB;IAC7D,OAAO,GAAG,CAAC,eAAe,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAkB,EAClB,MAA6B,EAC7B,QAA0B,EAC1B,GAAoB;IAEpB,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,mCAAmC;IACjE,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;IACnD,IAAI,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7B,qEAAqE;QACrE,OAAO,0BAA0B,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;IACrF,CAAC;IACD,GAAG,CAAC,YAAY,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/E,MAAM,0BAA0B,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC5D,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAkB,EAAE,GAAoB;IACxE,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,EAAE,CAAC;IAClB,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,oBAAoB,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAChD,gBAAgB,CAAC;QACf,GAAG,EAAE;YACH,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,SAAS,CAAC;YACtC,GAAG,CAAC,YAAY,EAAE,CAAC;YACnB,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACnE,CAAC;QACD,gFAAgF;QAChF,mFAAmF;QACnF,kFAAkF;QAClF,2CAA2C;QAC3C,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;QAC/B,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE;QAC3B,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC;QAC/C,IAAI,CAAC,WAAW;KACjB,CAAC,CACH,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,oBAAoB,CACjC,IAAkB,EAClB,MAA2B,EAC3B,OAA4B;IAE5B,IAAI,WAAoB,CAAC;IACzB,IAAI,cAAuB,CAAC;IAC5B,MAAM,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,CAAC;QACH,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,CAAC;IACf,IAAI,WAAW,KAAK,SAAS;QAAE,MAAM,WAAW,CAAC;IACjD,IAAI,cAAc,KAAK,SAAS;QAAE,MAAM,cAAc,CAAC;AACzD,CAAC;AAED,8FAA8F;AAC9F,KAAK,UAAU,eAAe,CAAC,IAAkB,EAAE,OAA4B;IAC7E,IAAI,CAAC,UAAU,EAAE,CAAC;IAClB,MAAM,OAAO,EAAE,CAAC;IAChB,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC"}

package/dist/runtime/shell-quote.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Quoting for the POSIX login shells both adapters launch through (PRD §4.2), kept apart from
+ * `shell.ts` so a probe module can quote a path without loading the shell helpers that build
+ * probe scripts (§9.2).
+ */
+/** Quotes one argument: wraps it in single quotes, escaping embedded single quotes as '\''. */
+export declare function shellQuote(value: string): string;
+//# sourceMappingURL=shell-quote.d.ts.map

package/dist/runtime/shell-quote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-quote.d.ts","sourceRoot":"","sources":["../../src/runtime/shell-quote.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,+FAA+F;AAC/F,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD"}

package/dist/runtime/shell-quote.js

@@ -0,0 +1,10 @@
+/**
+ * Quoting for the POSIX login shells both adapters launch through (PRD §4.2), kept apart from
+ * `shell.ts` so a probe module can quote a path without loading the shell helpers that build
+ * probe scripts (§9.2).
+ */
+/** Quotes one argument: wraps it in single quotes, escaping embedded single quotes as '\''. */
+export function shellQuote(value) {
+    return `'${value.replaceAll("'", "'\\''")}'`;
+}
+//# sourceMappingURL=shell-quote.js.map

package/dist/runtime/shell-quote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-quote.js","sourceRoot":"","sources":["../../src/runtime/shell-quote.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,+FAA+F;AAC/F,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AAC/C,CAAC"}

package/dist/runtime/shell.d.ts

@@ -1,21 +1,45 @@
 /**
  * User shell helpers shared by preflight and PTY launch.
- * Implements PRD §4.2.
+ * Implements PRD §4.2, the probe start line of §9.2 (C-PTY-08, C-PERF-05), and the e2e
+ * home guard of §12 (C-E2E-24).
  */
+import { shellQuote } from "./shell-quote.ts";
 export declare function userShell(): string;
-/**
- * Quote one argument for the POSIX login shells used by both adapters: wrap in
- * single quotes, escaping embedded single quotes as '\''.
- */
-export declare function shellQuote(value: string): string;
+export { shellQuote };
+/** The login shell's arguments; the script to run is always the fourth. */
+export type LoginShellArgs = readonly ["-l", "-i", "-c", string];
 /** Interactive login shell for the agent PTY — matches Terminal.app (§4.2). */
-export declare function loginShellCommand(command: string): readonly string[];
+export declare function loginShellCommand(command: string): LoginShellArgs;
 /**
  * Interactive login shell for the non-PTY probes (`--version`, `update`, `--help`).
- * Deliberately IDENTICAL to `loginShellCommand` today (C-PTY-08): the probes and the
- * agent PTY must resolve the same CLI installation, so a probe must load the same
- * user PATH the PTY launch does. Kept as its own name so the CLI's resolution path
- * reads as a probe and any future divergence is a visible, single-site decision.
+ * The same shell and flags as `loginShellCommand` (C-PTY-08): the probes and the agent
+ * PTY must resolve the same CLI installation, so a probe loads the same user PATH the
+ * PTY launch does. Before the command run, in order: the start line, written on the
+ * runner's private control descriptor or, from a shell that closed it, on stdout, so the
+ * probe runner can bound the user's profile and the CLI separately; in the e2e suite, the
+ * home guard; and the removal of the user's not-found handlers, so a missing CLI reads as
+ * missing (C-PERF-05). The command's bound starts at the start line, so it covers what runs
+ * between the line and the CLI too: a few builtins.
+ */
+export declare function probeShellCommand(command: string, lookupCommand?: string): LoginShellArgs;
+/**
+ * The same login shell, for a lookup answered by its exit status alone (`command -v`). The
+ * command's output goes to `/dev/null`, so the probe captures none of it.
+ */
+export declare function probeShellStatus(command: string): LoginShellArgs;
+/** The launch a guard script stops: a session, in its PTY, or a probe, which has no terminal. */
+type GuardedLaunch = "session" | "probe";
+/**
+ * The e2e suite's CLI home guard (PRD §12, C-E2E-24). The suite points `CLAUDE_CONFIG_DIR`
+ * and `CODEX_HOME`, plus `CLAUDE_CODE_TMPDIR`, at private roots listed in
+ * `ELWOOD_E2E_PRIVATE_HOMES`, but
+ * each CLI starts through the user's login shell, whose startup files run after Elwood hands
+ * over its environment and could replace, unset, or unexport them. Each variable that
+ * Elwood's own environment sets to a listed home is guarded: the login shell, after its
+ * startup files, exits `homeGuardExitCode` before the agent or probe command unless the
+ * variable is still exported and its real path is a listed home. A list that cannot be read
+ * stops every launch. With no list, as outside the suite, the script is empty. `launch` picks
+ * where the guard reports a stop (`refuse`).
  */
-export declare function probeShellCommand(command: string): readonly string[];
+export declare function homeGuardScript(launch: GuardedLaunch): string;
 //# sourceMappingURL=shell.d.ts.map

package/dist/runtime/shell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../src/runtime/shell.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAEpE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAEpE"}
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../src/runtime/shell.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkBH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,OAAO,EAAE,UAAU,EAAE,CAAC;AAEtB,2EAA2E;AAC3E,MAAM,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AAOjE,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAEjE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,cAAc,CAOzF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAEhE;AAmBD,iGAAiG;AACjG,KAAK,aAAa,GAAG,SAAS,GAAG,OAAO,CAAC;AA0BzC;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAe7D"}

package/dist/runtime/shell.js

@@ -1,30 +1,106 @@
 /**
  * User shell helpers shared by preflight and PTY launch.
- * Implements PRD §4.2.
+ * Implements PRD §4.2, the probe start line of §9.2 (C-PTY-08, C-PERF-05), and the e2e
+ * home guard of §12 (C-E2E-24).
  */
 import { userInfo } from "node:os";
+import { guardedVariables, homeGuardExitCode, homeGuardHomesKey, homeGuardStopMarker, privateHomes, } from "./home-guard/index.js";
+import { commandLookupScript } from "./probe/lookup.js";
+import { probeControlClose, probeControlFd, probeNotFoundHandlerReset, probeStartScript, } from "./probe/start.js";
+import { shellQuote } from "./shell-quote.js";
 export function userShell() {
     return userInfo().shell || "/bin/zsh";
 }
-/**
- * Quote one argument for the POSIX login shells used by both adapters: wrap in
- * single quotes, escaping embedded single quotes as '\''.
- */
-export function shellQuote(value) {
-    return `'${value.replaceAll("'", "'\\''")}'`;
+export { shellQuote };
+/** The interactive login shell's arguments for `script`, shared by the PTY and the probes. */
+function loginShellArgs(script) {
+    return ["-l", "-i", "-c", script];
 }
 /** Interactive login shell for the agent PTY — matches Terminal.app (§4.2). */
 export function loginShellCommand(command) {
-    return ["-l", "-i", "-c", command];
+    return loginShellArgs(`${homeGuardScript("session")}${command}`);
 }
 /**
  * Interactive login shell for the non-PTY probes (`--version`, `update`, `--help`).
- * Deliberately IDENTICAL to `loginShellCommand` today (C-PTY-08): the probes and the
- * agent PTY must resolve the same CLI installation, so a probe must load the same
- * user PATH the PTY launch does. Kept as its own name so the CLI's resolution path
- * reads as a probe and any future divergence is a visible, single-site decision.
+ * The same shell and flags as `loginShellCommand` (C-PTY-08): the probes and the agent
+ * PTY must resolve the same CLI installation, so a probe loads the same user PATH the
+ * PTY launch does. Before the command run, in order: the start line, written on the
+ * runner's private control descriptor or, from a shell that closed it, on stdout, so the
+ * probe runner can bound the user's profile and the CLI separately; in the e2e suite, the
+ * home guard; and the removal of the user's not-found handlers, so a missing CLI reads as
+ * missing (C-PERF-05). The command's bound starts at the start line, so it covers what runs
+ * between the line and the CLI too: a few builtins.
+ */
+export function probeShellCommand(command, lookupCommand) {
+    // The start line comes first, so the runner still tells a shell that never started the
+    // probe from one the e2e home guard stopped after it (`homeGuardStopped`).
+    const guard = homeGuardScript("probe");
+    const lookup = lookupCommand === undefined ? "" : commandLookupScript(lookupCommand);
+    const script = `${probeStartScript}${guard}${probeNotFoundHandlerReset}${lookup}${probeControlClose}${command}`;
+    return loginShellArgs(script);
+}
+/**
+ * The same login shell, for a lookup answered by its exit status alone (`command -v`). The
+ * command's output goes to `/dev/null`, so the probe captures none of it.
+ */
+export function probeShellStatus(command) {
+    return probeShellCommand(`${command} >/dev/null 2>&1`);
+}
+function refusalReason(refusal) {
+    switch (refusal.kind) {
+        case "unreadable_list":
+            return `${homeGuardHomesKey} is not a JSON array of absolute paths`;
+        case "invalid_home":
+            return `the login shell left ${refusal.variable} unexported or not one of the suite's private homes`;
+    }
+}
+/**
+ * Shell code that writes the stop marker with why the guard stopped the launch, and exits
+ * `homeGuardExitCode`. Not on stderr, nor first on stdout, which a startup file can redirect. A
+ * session's shell writes to its terminal, `/dev/tty`, which its PTY captures however the
+ * startup files redirected stdin, stdout, or stderr. A probe runs in a session of its own, with
+ * no terminal (`runProbe`), so it writes on the runner's control descriptor, where its start
+ * line went. Either falls back to stdout only if it cannot write there: a probe shell that
+ * closed the descriptor wrote its start line on stdout too.
+ */
+function refuse(refusal, launch) {
+    const line = shellQuote(`${homeGuardStopMarker}: ${refusalReason(refusal)}`);
+    const write = `printf '%s\\n' ${line}`;
+    const channel = launch === "session" ? "/dev/tty" : `&${probeControlFd}`;
+    return `{ { ${write} >${channel}; } 2>/dev/null || ${write}; exit ${homeGuardExitCode}; }; `;
+}
+// The real path of `$elwood_home`, resolved as the CLI will, against the shell's cwd. `builtin`
+// skips a user's `cd` function or alias, an empty `CDPATH` keeps a relative name relative,
+// zsh's `-q` skips `chpwd` hooks, and only `pwd` may print: a zsh `cd` can print the
+// directory it changed to.
+const realHome = `elwood_home=$(CDPATH=; if [ -n "\${ZSH_VERSION-}" ]; then builtin cd -q -P -- "$elwood_home"; ` +
+    'else builtin cd -P -- "$elwood_home"; fi >/dev/null 2>&1 && builtin pwd -P)';
+/**
+ * The e2e suite's CLI home guard (PRD §12, C-E2E-24). The suite points `CLAUDE_CONFIG_DIR`
+ * and `CODEX_HOME`, plus `CLAUDE_CODE_TMPDIR`, at private roots listed in
+ * `ELWOOD_E2E_PRIVATE_HOMES`, but
+ * each CLI starts through the user's login shell, whose startup files run after Elwood hands
+ * over its environment and could replace, unset, or unexport them. Each variable that
+ * Elwood's own environment sets to a listed home is guarded: the login shell, after its
+ * startup files, exits `homeGuardExitCode` before the agent or probe command unless the
+ * variable is still exported and its real path is a listed home. A list that cannot be read
+ * stops every launch. With no list, as outside the suite, the script is empty. `launch` picks
+ * where the guard reports a stop (`refuse`).
  */
-export function probeShellCommand(command) {
-    return loginShellCommand(command);
+export function homeGuardScript(launch) {
+    const raw = process.env[homeGuardHomesKey] ?? "";
+    if (raw === "")
+        return "";
+    const homes = privateHomes(raw);
+    if (homes === undefined)
+        return refuse({ kind: "unreadable_list" }, launch);
+    const listed = homes.map(shellQuote).join("|");
+    return guardedVariables(homes)
+        .map(
+    // `printenv` sees only what the shell exports, which is what the CLI inherits.
+    (name) => `elwood_home=$(command printenv ${name}) && ${realHome} && ` +
+        `case "$elwood_home" in ${listed}) true;; *) false;; esac || ` +
+        refuse({ kind: "invalid_home", variable: name }, launch))
+        .join("");
 }
 //# sourceMappingURL=shell.js.map

package/dist/runtime/shell.js.map

@@ -1 +1 @@
-{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/runtime/shell.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,MAAM,UAAU,SAAS;IACvB,OAAO,QAAQ,EAAE,CAAC,KAAK,IAAI,UAAU,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC"}
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/runtime/shell.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EACL,gBAAgB,EAEhB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,GACb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,yBAAyB,EACzB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,MAAM,UAAU,SAAS;IACvB,OAAO,QAAQ,EAAE,CAAC,KAAK,IAAI,UAAU,CAAC;AACxC,CAAC;AAED,OAAO,EAAE,UAAU,EAAE,CAAC;AAKtB,8FAA8F;AAC9F,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,cAAc,CAAC,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,OAAO,EAAE,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,aAAsB;IACvE,uFAAuF;IACvF,2EAA2E;IAC3E,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,GAAG,gBAAgB,GAAG,KAAK,GAAG,yBAAyB,GAAG,MAAM,GAAG,iBAAiB,GAAG,OAAO,EAAE,CAAC;IAChH,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,iBAAiB,CAAC,GAAG,OAAO,kBAAkB,CAAC,CAAC;AACzD,CAAC;AAUD,SAAS,aAAa,CAAC,OAAgB;IACrC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,iBAAiB;YACpB,OAAO,GAAG,iBAAiB,wCAAwC,CAAC;QACtE,KAAK,cAAc;YACjB,OAAO,wBAAwB,OAAO,CAAC,QAAQ,qDAAqD,CAAC;IACzG,CAAC;AACH,CAAC;AAKD;;;;;;;;GAQG;AACH,SAAS,MAAM,CAAC,OAAgB,EAAE,MAAqB;IACrD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,mBAAmB,KAAK,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,kBAAkB,IAAI,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC;IACzE,OAAO,OAAO,KAAK,KAAK,OAAO,sBAAsB,KAAK,UAAU,iBAAiB,OAAO,CAAC;AAC/F,CAAC;AAED,gGAAgG;AAChG,2FAA2F;AAC3F,qFAAqF;AACrF,2BAA2B;AAC3B,MAAM,QAAQ,GACZ,gGAAgG;IAChG,6EAA6E,CAAC;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,OAAO,gBAAgB,CAAC,KAAK,CAAC;SAC3B,GAAG;IACF,+EAA+E;IAC/E,CAAC,IAAI,EAAE,EAAE,CACP,kCAAkC,IAAI,QAAQ,QAAQ,MAAM;QAC5D,0BAA0B,MAAM,8BAA8B;QAC9D,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAC3D;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC"}

package/dist/runtime/shutdown/coalesce.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Joins concurrent process-table reads into one, for a fleet of sessions shutting down
+ * together (PRD §5.3 and §9.4, C-LIFE-10). Each still gets its own timeout.
+ */
+/**
+ * Joins every request made before a listing starts into that one listing, so a fleet
+ * shutting down together runs one `ps` instead of one per session. A request never
+ * joins a listing that has already started: each sweep needs a table read after its
+ * own leader was frozen. The listing starts on the next turn of the event loop and may
+ * run for the largest timeout any of its requests asked for, while each request still
+ * rejects with `ETIMEDOUT` at its own timeout: one session's nearly spent deadline never
+ * cuts short another's read.
+ */
+export declare function coalesceUnstarted<T>(run: (timeoutMs: number) => Promise<T>): (timeoutMs: number) => Promise<T>;
+//# sourceMappingURL=coalesce.d.ts.map

package/dist/runtime/shutdown/coalesce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coalesce.d.ts","sourceRoot":"","sources":["../../../src/runtime/shutdown/coalesce.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,GAAG,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GACrC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAiBnC"}

package/dist/runtime/shutdown/coalesce.js

@@ -0,0 +1,42 @@
+/**
+ * Joins concurrent process-table reads into one, for a fleet of sessions shutting down
+ * together (PRD §5.3 and §9.4, C-LIFE-10). Each still gets its own timeout.
+ */
+import { processReadTimeout } from "./read-timeout.js";
+/**
+ * Joins every request made before a listing starts into that one listing, so a fleet
+ * shutting down together runs one `ps` instead of one per session. A request never
+ * joins a listing that has already started: each sweep needs a table read after its
+ * own leader was frozen. The listing starts on the next turn of the event loop and may
+ * run for the largest timeout any of its requests asked for, while each request still
+ * rejects with `ETIMEDOUT` at its own timeout: one session's nearly spent deadline never
+ * cuts short another's read.
+ */
+export function coalesceUnstarted(run) {
+    let open;
+    const startBatch = (timeoutMs) => {
+        const { promise: started, resolve: start } = Promise.withResolvers();
+        const batch = { timeoutMs, result: started.then(() => run(batch.timeoutMs)) };
+        setImmediate(() => {
+            open = undefined;
+            start();
+        });
+        return batch;
+    };
+    return (timeoutMs) => {
+        open ??= startBatch(timeoutMs);
+        open.timeoutMs = Math.max(open.timeoutMs, timeoutMs);
+        return withinOwnTimeout(open.result, timeoutMs);
+    };
+}
+/** `result`, or an `ETIMEDOUT` rejection once `timeoutMs` passes first. */
+function withinOwnTimeout(result, timeoutMs) {
+    let timer;
+    const timedOut = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+            reject(processReadTimeout("process table read timed out"));
+        }, timeoutMs);
+    });
+    return Promise.race([result, timedOut]).finally(() => clearTimeout(timer));
+}
+//# sourceMappingURL=coalesce.js.map

package/dist/runtime/shutdown/coalesce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coalesce.js","sourceRoot":"","sources":["../../../src/runtime/shutdown/coalesce.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAsC;IAGtC,IAAI,IAAuB,CAAC;IAC5B,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAS,EAAE;QAC9C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;QAC3E,MAAM,KAAK,GAAU,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACrF,YAAY,CAAC,GAAG,EAAE;YAChB,IAAI,GAAG,SAAS,CAAC;YACjB,KAAK,EAAE,CAAC;QACV,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,OAAO,CAAC,SAAS,EAAE,EAAE;QACnB,IAAI,KAAK,UAAU,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACrD,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,gBAAgB,CAAI,MAAkB,EAAE,SAAiB;IAChE,IAAI,KAAiC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACvD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAC7D,CAAC,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7E,CAAC"}

package/dist/runtime/shutdown/detached-sweep/failures.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Failure accounting for the detached-descendant sweep (PRD §5.3 and §9.4, C-LIFE-10):
+ * fixed reason phrases, an errno-shaped token when one applies, and a bounded list of
+ * the process-group ids involved, so a failure never carries raw process or `ps` output.
+ */
+/** A sweep that could not confirm every group reaped, naming (some of) those groups. */
+export type SweepFailure = Error & {
+    readonly processGroupIds: readonly number[];
+    /** The first errno token among the failures, when one applies. */
+    readonly code?: string;
+};
+/** At most this many process-group ids travel with a failure: enough to inspect, bounded. */
+export declare const MAX_REPORTED_GROUPS = 16;
+export type FailureReason = "process table unreadable" | "process groups not confirmed stopped by the deadline" | "the leader exited before every group was confirmed stopped" | "could not stop the leader's group" | "could not stop a live descendant group" | "could not kill a signaled descendant group" | "could not resume a group spared for Codex's shared daemon" | "no read showed the leader's tree";
+/** Collects one sweep's failures: each reason once, the first errno token, the group ids. */
+export declare class SweepFailures {
+    private readonly reasons;
+    private readonly processGroupIds;
+    private code;
+    record(reason: FailureReason, error: unknown, processGroupIds: readonly number[]): void;
+    /** The combined failure, or `undefined` when nothing was recorded. */
+    result(): SweepFailure | undefined;
+}
+//# sourceMappingURL=failures.d.ts.map

package/dist/runtime/shutdown/detached-sweep/failures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"failures.d.ts","sourceRoot":"","sources":["../../../../src/runtime/shutdown/detached-sweep/failures.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,wFAAwF;AACxF,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG;IACjC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,6FAA6F;AAC7F,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC,MAAM,MAAM,aAAa,GACrB,0BAA0B,GAC1B,sDAAsD,GACtD,4DAA4D,GAC5D,mCAAmC,GACnC,wCAAwC,GACxC,4CAA4C,GAC5C,2DAA2D,GAC3D,kCAAkC,CAAC;AAEvC,6FAA6F;AAC7F,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IACrD,OAAO,CAAC,IAAI,CAAqB;IAEjC,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAQvF,sEAAsE;IACtE,MAAM,IAAI,YAAY,GAAG,SAAS;CAOnC"}

package/dist/runtime/shutdown/detached-sweep/failures.js

@@ -0,0 +1,32 @@
+/**
+ * Failure accounting for the detached-descendant sweep (PRD §5.3 and §9.4, C-LIFE-10):
+ * fixed reason phrases, an errno-shaped token when one applies, and a bounded list of
+ * the process-group ids involved, so a failure never carries raw process or `ps` output.
+ */
+import { errnoCode, isErrnoToken } from "../../../core/errors.js";
+/** At most this many process-group ids travel with a failure: enough to inspect, bounded. */
+export const MAX_REPORTED_GROUPS = 16;
+/** Collects one sweep's failures: each reason once, the first errno token, the group ids. */
+export class SweepFailures {
+    reasons = new Set();
+    processGroupIds = new Set();
+    code;
+    record(reason, error, processGroupIds) {
+        const code = errnoCode(error);
+        const token = isErrnoToken(code) ? code : undefined;
+        this.reasons.add(token === undefined ? reason : `${reason} (${token})`);
+        this.code ??= token;
+        for (const id of processGroupIds)
+            this.processGroupIds.add(id);
+    }
+    /** The combined failure, or `undefined` when nothing was recorded. */
+    result() {
+        if (this.reasons.size === 0)
+            return undefined;
+        const message = `Could not reap detached descendants: ${[...this.reasons].join("; ")}`;
+        const processGroupIds = [...this.processGroupIds].slice(0, MAX_REPORTED_GROUPS);
+        const code = this.code === undefined ? {} : { code: this.code };
+        return Object.assign(new Error(message), { processGroupIds, ...code });
+    }
+}
+//# sourceMappingURL=failures.js.map

package/dist/runtime/shutdown/detached-sweep/failures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"failures.js","sourceRoot":"","sources":["../../../../src/runtime/shutdown/detached-sweep/failures.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AASlE,6FAA6F;AAC7F,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAYtC,6FAA6F;AAC7F,MAAM,OAAO,aAAa;IACP,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5B,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,IAAI,CAAqB;IAEjC,MAAM,CAAC,MAAqB,EAAE,KAAc,EAAE,eAAkC;QAC9E,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,KAAK,GAAG,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,eAAe;YAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,sEAAsE;IACtE,MAAM;QACJ,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,OAAO,GAAG,wCAAwC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvF,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAChF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QAChE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;CACF"}

package/dist/runtime/shutdown/detached-sweep/index.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Stops and SIGKILLs every process group a LIVE PTY leader's linked descendants have
+ * moved into, before Elwood kills the leader, but Codex's shared daemon, its updater,
+ * and what they started (below). Implements PRD §5.3 and §9.4 (C-LIFE-10).
+ * Claude and Codex start each hook command with `setsid()`, so a hook in flight at
+ * teardown sits in its own session and process group: the leader-group SIGKILL misses
+ * it, and once the leader dies the hook is reparented to PID 1 and nothing links it to
+ * the session any more. The walk therefore has to happen first. It finds only what is
+ * still linked by parent pid (see `detachedDescendantGroups`).
+ *
+ * A group id read from the table is a snapshot, free for reuse once the group is gone,
+ * and a `kill()` that returns has only sent the SIGSTOP. So the sweep acts only on what
+ * two consecutive reads show (see `rounds.ts`): a group is sent SIGSTOP once a parent of
+ * one of its members is held, read stopped in this read and the one before inside a
+ * group the sweep signaled. The walk succeeds only on a read that converges: it shows
+ * the leader live, leaves no live group unreached, and holds every live member of every
+ * signaled group, the leader's included. A read that shows a signaled group's member
+ * running stops that group again. With no hook in flight that takes two reads; each
+ * level of nesting adds two more. Then the signaled groups are SIGKILLed deepest first
+ * (`kill.ts`). Codex's app-server daemon and its updater loop are shared by every Codex
+ * on the same `CODEX_HOME`, the user's own included, so the walk never descends into
+ * either: neither one nor anything it started is killed (`shared-daemon.ts`). A group it
+ * stopped as its process became one is resumed with SIGCONT, never SIGKILLed, even once
+ * the leader's exit left it under PID 1. (A parent that ignores SIGCHLD would have its
+ * exited children reaped while stopped; the CLIs and hook shells don't.)
+ */
+import { type SweepFailure } from "./failures.ts";
+import { type SweepOps } from "./rounds.ts";
+export type { SweepOps } from "./rounds.ts";
+/**
+ * The whole sweep's deadline. A hook that started a setsid child of its own takes six
+ * reads, and on a loaded host one read can take over half a second (docs/cli-behavior.md).
+ */
+export declare const DETACHED_SWEEP_BUDGET_MS = 10000;
+/**
+ * Sweeps `leaderPid`'s detached descendant groups and resolves to the unresolved
+ * failure, or `undefined` once a read converged and every group it signaled was killed,
+ * or resumed as holding Codex's daemon.
+ * The leader's own group is left to the group reap. A leader whose exit was observed
+ * before the sweep, or whose group refuses its SIGSTOP because it already exited (see
+ * `leaderStopFailure`), exited before Elwood signaled it: nothing more is sent and nothing
+ * fails. Otherwise `leaderExited` is read after each table read that does not converge;
+ * a read that converges ends the walk before that check. Once the leader has exited its
+ * pid may be reused, so the sweep stops no further group and never signals the leader's
+ * group again, though it still SIGKILLs the groups it already signaled (resuming any
+ * that hold Codex's daemon).
+ * `onLeaderGroupGone` publishes only whole-group ESRCH or fresh empty-group evidence,
+ * never merely a leader exit notification. These are
+ * failures: a leader's group that refuses its stop, so no descendant group is signaled;
+ * an unreadable table; the deadline passing, or the leader exiting, before a read
+ * converged; a live group that could not be stopped or killed; and a group spared for
+ * Codex's daemon that could not be resumed (a SIGCONT refused but for its being gone).
+ */
+export declare function sweepDetachedGroups(leaderPid: number, ops: SweepOps, leaderExited: () => boolean, budgetMs?: number, onLeaderGroupGone?: () => void): Promise<SweepFailure | undefined>;
+//# sourceMappingURL=index.d.ts.map

package/dist/runtime/shutdown/detached-sweep/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/runtime/shutdown/detached-sweep/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAKH,OAAO,EAAE,KAAK,YAAY,EAAiB,MAAM,eAAe,CAAC;AAOjE,OAAO,EAIL,KAAK,QAAQ,EAMd,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C;;;GAGG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,QAAQ,EACb,YAAY,EAAE,MAAM,OAAO,EAC3B,QAAQ,GAAE,MAAiC,EAC3C,iBAAiB,GAAE,MAAM,IAAsB,GAC9C,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAcnC"}