@wrongstack/tools 0.291.0 → 0.291.1

package/dist/exec.js

@@ -5,7 +5,7 @@ import {
   emitProcessOutput,
   emitProcessStarted
 } from "@wrongstack/core";
-import { toErrorMessage } from "@wrongstack/core/utils/error";
+import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils/error";
 
 // src/_env.ts
 import { buildChildEnv } from "@wrongstack/core";
@@ -734,8 +734,8 @@ var ProcessRegistryImpl = class {
     if (p.killed) return true;
     if (p.protected) return false;
     const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
-    const isWin2 = os.platform() === "win32";
-    if (isWin2) {
+    const isWin3 = os.platform() === "win32";
+    if (isWin3) {
       const liveRealChild = p.child.exitCode === null && typeof p.child.pid === "number";
       const directFallback = () => {
         if (p.child.exitCode === null) {
@@ -1164,8 +1164,655 @@ function levelRank(level) {
   }
 }
 
+// src/exec-kill-guard.ts
+import * as os3 from "node:os";
+import * as path5 from "node:path";
+
+// src/process-registry-persistent.ts
+import * as fs2 from "node:fs/promises";
+import * as os2 from "node:os";
+import * as path4 from "node:path";
+var REGISTRY_FILE = ".wrongstack/process-registry.json";
+function toErrorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function emitStructuredLog(level, event, message, error) {
+  const payload = {
+    level,
+    event,
+    message,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  if (error !== void 0) {
+    payload.error = toErrorMessage(error);
+  }
+  console.log(JSON.stringify(payload));
+}
+var HEARTBEAT_INTERVAL_MS = 5e3;
+var STALE_THRESHOLD_MS = 3e4;
+var LOCKFILE = ".wrongstack/.process-registry.lock";
+function generateInstanceId() {
+  const hostname2 = os2.hostname();
+  const pid = process.pid;
+  const random = Math.random().toString(36).slice(2, 8);
+  return `${hostname2}:${pid}:${random}`;
+}
+function isNodeError(err) {
+  return typeof err === "object" && err !== null && "code" in err;
+}
+async function acquireLock(lockfilePath, timeoutMs = 5e3) {
+  const start = Date.now();
+  const pidStr = String(process.pid);
+  const hostStr = os2.hostname();
+  while (Date.now() - start < timeoutMs) {
+    try {
+      await fs2.writeFile(lockfilePath, `${pidStr}:${hostStr}:${Date.now()}`, { flag: "wx" });
+      return async () => {
+        try {
+          await fs2.unlink(lockfilePath);
+        } catch {
+        }
+      };
+    } catch (err) {
+      if (isNodeError(err) && err.code === "EEXIST") {
+        try {
+          const content = await fs2.readFile(lockfilePath, "utf-8");
+          const parts = content.split(":");
+          const lockPidStr = parts[0] ?? "0";
+          const lockPid = parseInt(lockPidStr, 10);
+          if (process.platform !== "win32") {
+            try {
+              process.kill(lockPid, 0);
+            } catch {
+              await fs2.unlink(lockfilePath);
+              continue;
+            }
+          }
+        } catch {
+          try {
+            await fs2.unlink(lockfilePath);
+          } catch {
+          }
+        }
+        await new Promise((r) => setTimeout(r, 100));
+        continue;
+      }
+      throw err;
+    }
+  }
+  throw new Error(`Failed to acquire lock after ${timeoutMs}ms`);
+}
+async function readRegistryFile(filePath) {
+  try {
+    const content = await fs2.readFile(filePath, "utf-8");
+    const parsed = JSON.parse(content);
+    if (parsed.instances && Array.isArray(parsed.instances)) {
+      parsed.instances = new Map(parsed.instances);
+    }
+    return parsed;
+  } catch (err) {
+    if (isNodeError(err) && err.code === "ENOENT") {
+      return {
+        version: 1,
+        instances: /* @__PURE__ */ new Map(),
+        protectedPatterns: ["wrongstack", "node"],
+        lastCleanup: Date.now()
+      };
+    }
+    throw err;
+  }
+}
+async function writeRegistryFile(filePath, data) {
+  const tmpPath = `${filePath}.tmp.${process.pid}`;
+  const content = JSON.stringify(data, (_k, v) => {
+    if (v instanceof Map) {
+      return Array.from(v.entries());
+    }
+    return v;
+  }, 2);
+  await fs2.writeFile(tmpPath, content, "utf-8");
+  await fs2.rename(tmpPath, filePath);
+}
+var PersistentProcessRegistry = class {
+  instanceId;
+  registryPath;
+  lockPath;
+  baseRegistry;
+  heartbeatInterval = null;
+  isShuttingDown = false;
+  constructor(baseRegistry) {
+    this.instanceId = generateInstanceId();
+    const homeDir = os2.homedir();
+    this.registryPath = path4.join(homeDir, REGISTRY_FILE);
+    this.lockPath = path4.join(homeDir, LOCKFILE);
+    this.baseRegistry = baseRegistry ?? getProcessRegistry();
+    this.ensureDirectory().catch((err) => {
+      emitStructuredLog("warn", "process_registry.dir_create_failed", "PersistentProcessRegistry: failed to create .wrongstack directory", err);
+    });
+  }
+  async ensureDirectory() {
+    const dir = path4.dirname(this.registryPath);
+    try {
+      await fs2.mkdir(dir, { recursive: true });
+    } catch (err) {
+      if (!isNodeError(err) || err.code !== "EEXIST") throw err;
+    }
+  }
+  /**
+   * Start the heartbeat and periodic cleanup tasks.
+   */
+  start() {
+    if (this.heartbeatInterval) return;
+    this.syncToPersistent();
+    this.heartbeatInterval = setInterval(() => {
+      this.heartbeat();
+    }, HEARTBEAT_INTERVAL_MS);
+    this.heartbeatInterval.unref?.();
+    setInterval(() => {
+      this.cleanupStaleEntries();
+    }, STALE_THRESHOLD_MS).unref?.();
+    this.registerMainProcess();
+    process.on("exit", () => this.syncToPersistent());
+  }
+  /**
+   * Stop the heartbeat and clean up.
+   */
+  stop() {
+    this.isShuttingDown = true;
+    if (this.heartbeatInterval) {
+      clearInterval(this.heartbeatInterval);
+      this.heartbeatInterval = null;
+    }
+    this.syncToPersistent();
+  }
+  /**
+   * Register the main WrongStack process as protected.
+   */
+  registerMainProcess() {
+    const mainPid = process.pid;
+    this.updatePersistentEntry({
+      pid: mainPid,
+      name: "wrongstack-main",
+      command: process.argv.slice(0, 3).join(" "),
+      startedAt: Date.now(),
+      lastHeartbeat: Date.now(),
+      instanceId: this.instanceId,
+      hostname: os2.hostname(),
+      protected: true,
+      spawnMode: "main",
+      parentPid: process.ppid,
+      platform: process.platform
+    });
+  }
+  /**
+   * Register a spawned child process with the persistent registry.
+   */
+  registerChildProcess(pid, name, command, sessionId, spawnMode = "spawn") {
+    const entry = {
+      pid,
+      name,
+      command,
+      startedAt: Date.now(),
+      lastHeartbeat: Date.now(),
+      instanceId: this.instanceId,
+      hostname: os2.hostname(),
+      protected: true,
+      // All WrongStack child processes are protected by default
+      spawnMode,
+      parentPid: process.pid,
+      platform: process.platform
+    };
+    if (sessionId) {
+      entry.sessionId = sessionId;
+    }
+    this.updatePersistentEntry(entry);
+  }
+  /**
+   * Update or add an entry in the persistent registry.
+   */
+  async updatePersistentEntry(entry) {
+    const release = await acquireLock(this.lockPath);
+    try {
+      const data = await readRegistryFile(this.registryPath);
+      data.instances.set(String(entry.pid), entry);
+      const child = null;
+      this.baseRegistry.register({
+        pid: entry.pid,
+        name: entry.name,
+        command: entry.command,
+        startedAt: entry.startedAt,
+        sessionId: entry.sessionId,
+        protected: entry.protected,
+        child
+      });
+      await writeRegistryFile(this.registryPath, data);
+    } finally {
+      await release();
+    }
+  }
+  /**
+   * Unregister a process from the persistent registry.
+   */
+  async unregister(pid) {
+    const release = await acquireLock(this.lockPath);
+    try {
+      const data = await readRegistryFile(this.registryPath);
+      data.instances.delete(String(pid));
+      await writeRegistryFile(this.registryPath, data);
+    } finally {
+      await release();
+    }
+  }
+  /**
+   * Send heartbeat to mark all this instance's processes as alive.
+   */
+  heartbeat() {
+    if (this.isShuttingDown) return;
+    this.syncToPersistent();
+  }
+  /**
+   * Sync this instance's processes to the persistent registry.
+   */
+  async syncToPersistent() {
+    const release = await acquireLock(this.lockPath);
+    try {
+      const data = await readRegistryFile(this.registryPath);
+      const now = Date.now();
+      const updatedInstances = /* @__PURE__ */ new Map();
+      for (const [_pidStr, entry] of data.instances) {
+        if (entry.instanceId === this.instanceId) {
+          entry.lastHeartbeat = now;
+        }
+        if (entry.instanceId === this.instanceId || now - entry.lastHeartbeat < STALE_THRESHOLD_MS) {
+          updatedInstances.set(_pidStr, entry);
+        }
+      }
+      data.instances = updatedInstances;
+      data.lastCleanup = now;
+      await writeRegistryFile(this.registryPath, data);
+    } catch (err) {
+      emitStructuredLog("warn", "process_registry.sync_failed", "PersistentProcessRegistry: sync failed", err);
+    } finally {
+      await release();
+    }
+  }
+  /**
+   * Remove entries for processes that are no longer running.
+   */
+  async cleanupStaleEntries() {
+    const release = await acquireLock(this.lockPath);
+    try {
+      const data = await readRegistryFile(this.registryPath);
+      const now = Date.now();
+      const stalePids = [];
+      for (const [_pidStr, entry] of data.instances) {
+        const age = now - entry.lastHeartbeat;
+        if (age > STALE_THRESHOLD_MS) {
+          try {
+            if (process.platform !== "win32") {
+              process.kill(entry.pid, 0);
+            } else {
+              emitStructuredLog(
+                "debug",
+                "process_registry.stale_pid_check",
+                `PersistentProcessRegistry: checking stale pid ${entry.pid} (${age}ms old)`
+              );
+            }
+          } catch {
+            stalePids.push(_pidStr);
+          }
+        }
+      }
+      if (stalePids.length > 0) {
+        for (const pidStr of stalePids) {
+          data.instances.delete(pidStr);
+        }
+        await writeRegistryFile(this.registryPath, data);
+      }
+    } catch (err) {
+      emitStructuredLog("warn", "process_registry.cleanup_failed", "PersistentProcessRegistry: cleanup failed", err);
+    } finally {
+      await release();
+    }
+  }
+  /**
+   * Check if a PID belongs to a WrongStack process and should be protected.
+   */
+  async isProtectedPid(pid) {
+    const release = await acquireLock(this.lockPath);
+    try {
+      const data = await readRegistryFile(this.registryPath);
+      const entry = data.instances.get(String(pid));
+      if (!entry) return false;
+      if (Date.now() - entry.lastHeartbeat > STALE_THRESHOLD_MS) {
+        return false;
+      }
+      return entry.protected;
+    } finally {
+      await release();
+    }
+  }
+  /**
+   * Get all protected PIDs from all WrongStack instances.
+   */
+  async getAllProtectedPids() {
+    const release = await acquireLock(this.lockPath);
+    try {
+      const data = await readRegistryFile(this.registryPath);
+      const now = Date.now();
+      const protectedPids = [];
+      for (const [_pidStr, entry] of data.instances) {
+        if (entry.protected && now - entry.lastHeartbeat < STALE_THRESHOLD_MS) {
+          protectedPids.push(entry.pid);
+        }
+      }
+      return protectedPids;
+    } finally {
+      await release();
+    }
+  }
+  /**
+   * Get complete status of all tracked processes across all instances.
+   */
+  async getGlobalStatus() {
+    const release = await acquireLock(this.lockPath);
+    try {
+      const data = await readRegistryFile(this.registryPath);
+      const now = Date.now();
+      const instances = /* @__PURE__ */ new Map();
+      let protectedCount = 0;
+      let staleCount = 0;
+      for (const [_pidStr, entry] of data.instances) {
+        const instanceEntries = instances.get(entry.instanceId) ?? [];
+        instanceEntries.push(entry);
+        instances.set(entry.instanceId, instanceEntries);
+        if (entry.protected) protectedCount++;
+        if (now - entry.lastHeartbeat > STALE_THRESHOLD_MS) staleCount++;
+      }
+      return {
+        instances,
+        totalProcesses: data.instances.size,
+        protectedCount,
+        staleCount
+      };
+    } finally {
+      await release();
+    }
+  }
+  /**
+   * Get the instance ID for this process.
+   */
+  getInstanceId() {
+    return this.instanceId;
+  }
+  /**
+   * Check if a kill command should be blocked.
+   * Returns true if the kill should be blocked (target is a WrongStack process).
+   */
+  async shouldBlockKill(pid) {
+    const protectedPids = await this.getAllProtectedPids();
+    return protectedPids.includes(pid);
+  }
+  /**
+   * Add a pattern-based protection rule.
+   * Processes whose command matches any protected pattern are protected.
+   */
+  async addProtectedPattern(pattern) {
+    const release = await acquireLock(this.lockPath);
+    try {
+      const data = await readRegistryFile(this.registryPath);
+      if (!data.protectedPatterns.includes(pattern)) {
+        data.protectedPatterns.push(pattern);
+        await writeRegistryFile(this.registryPath, data);
+      }
+    } finally {
+      await release();
+    }
+  }
+};
+var _persistentRegistry;
+function getPersistentProcessRegistry() {
+  if (!_persistentRegistry) {
+    _persistentRegistry = new PersistentProcessRegistry();
+  }
+  return _persistentRegistry;
+}
+
+// src/exec-kill-guard.ts
+var isWin = os3.platform() === "win32";
+async function checkExecKillCommand(cmd, args) {
+  if (!cmd) return { blocked: false };
+  const cmdLower = cmd.toLowerCase().trim();
+  const fullCommand = [cmdLower, ...args].join(" ").replace(/\s+/g, " ").trim();
+  if (isWin) {
+    if (cmdLower === "taskkill" || cmdLower === "taskkill.exe") {
+      const hasForce = args.some((a) => a.toUpperCase() === "/F" || a.toUpperCase() === "-F");
+      const signal = hasForce ? "FORCE" : "TERM";
+      for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a.toUpperCase() === "/IM" || a.toUpperCase() === "-IM") {
+          const nameArg = args[i + 1];
+          if (nameArg) {
+            const result = await checkKillTarget({ name: nameArg, signal, cmd: fullCommand });
+            if (result.blocked) return result;
+          }
+        }
+      }
+      for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a.toUpperCase() === "/PID" || a.toUpperCase() === "-PID") {
+          const pidArg = args[i + 1];
+          if (pidArg && /^\d+$/.test(pidArg)) {
+            const result = await checkKillTarget({
+              pid: parseInt(pidArg, 10),
+              signal,
+              cmd: fullCommand
+            });
+            if (result.blocked) return result;
+          }
+        }
+      }
+      for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a.toUpperCase() === "/FI" || a.toUpperCase() === "-FI") {
+          const filterArg = args[i + 1];
+          if (filterArg) {
+            const nameMatch = filterArg.match(/IMAGENAME\s+eq\s+"?([^"\s]+)/i);
+            if (nameMatch?.[1]) {
+              const result = await checkKillTarget({ name: nameMatch[1], signal, cmd: fullCommand });
+              if (result.blocked) return result;
+            }
+          }
+        }
+      }
+      return { blocked: false };
+    }
+    if (cmdLower === "powershell" || cmdLower === "powershell.exe" || cmdLower === "pwsh" || cmdLower === "pwsh.exe" || cmdLower === "cmd" || cmdLower === "cmd.exe") {
+      const shellFlagIndex = args.findIndex((arg) => {
+        const lower = arg.toLowerCase();
+        return lower === "-c" || lower === "-command" || lower === "/c";
+      });
+      if (shellFlagIndex >= 0) {
+        const innerTokens = tokenizeShellCommand(args.slice(shellFlagIndex + 1).join(" "));
+        const innerCommand = innerTokens[0];
+        if (innerCommand) {
+          const result = await checkExecKillCommand(innerCommand, innerTokens.slice(1));
+          if (result.blocked) return result;
+        }
+      }
+    }
+    if (cmdLower === "stop-process" || cmdLower === "kill") {
+      for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "-Name" || a === "-n") {
+          const nameArg = args[i + 1]?.replace(/^['"]|['"]$/g, "");
+          if (nameArg) {
+            const result = await checkKillTarget({
+              name: nameArg,
+              signal: "FORCE",
+              cmd: fullCommand
+            });
+            if (result.blocked) return result;
+          }
+        }
+        if (a === "-Id" || a === "-PID" || a === "-pid") {
+          const pidArg = args[i + 1];
+          if (pidArg && /^\d+$/.test(pidArg)) {
+            const result = await checkKillTarget({
+              pid: parseInt(pidArg, 10),
+              signal: "FORCE",
+              cmd: fullCommand
+            });
+            if (result.blocked) return result;
+          }
+        }
+      }
+      const firstNonFlag = args.find((a) => !a.startsWith("-"));
+      if (firstNonFlag) {
+        const name = firstNonFlag.replace(/^['"]|['"]$/g, "");
+        const result = await checkKillTarget({ name, signal: "TERM", cmd: fullCommand });
+        if (result.blocked) return result;
+      }
+    }
+    if (cmdLower === "wmic" || cmdLower === "wmic.exe") {
+      const joined = args.join(" ").toLowerCase();
+      if (/\bprocess\b/.test(joined) && /\bdelete\b/.test(joined)) {
+        const nameMatch = joined.match(/name\s*=\s*['"]?([^'"]+)/);
+        if (nameMatch?.[1]) {
+          const result = await checkKillTarget({
+            name: nameMatch[1].trim(),
+            signal: "FORCE",
+            cmd: fullCommand
+          });
+          if (result.blocked) return result;
+        }
+        return {
+          blocked: true,
+          reason: "Blocked: wmic process delete targets all matched processes \u2014 would include protected WrongStack processes."
+        };
+      }
+    }
+    if (cmdLower === "node" || cmdLower === "node.exe") {
+      if (args.includes("-e") || args.includes("--eval")) {
+        const evalIdx = args.indexOf("-e") !== -1 ? args.indexOf("-e") : args.indexOf("--eval");
+        const evalCode = args[evalIdx + 1] ?? "";
+        if (/\bprocess\.kill\s*\(/.test(evalCode)) {
+          const pidMatch = evalCode.match(/process\.kill\s*\(\s*(\d+)/);
+          if (pidMatch?.[1]) {
+            const pid = parseInt(pidMatch[1], 10);
+            const result = await checkKillTarget({ pid, signal: "SIGTERM", cmd: fullCommand });
+            if (result.blocked) return result;
+          }
+          return {
+            blocked: true,
+            reason: "Blocked: node -e with process.kill() \u2014 would target protected WrongStack process(es)."
+          };
+        }
+      }
+    }
+  } else {
+    if (cmdLower === "kill") {
+      for (const a of args) {
+        const num = a.replace(/^-/, "");
+        if (/^\d+$/.test(num)) {
+          const pid = parseInt(num, 10);
+          const result = await checkKillTarget({ pid, signal: "SIGTERM", cmd: fullCommand });
+          if (result.blocked) return result;
+        }
+      }
+    }
+    if (cmdLower === "pkill" || cmdLower === "killall") {
+      const firstNonFlag = args.find((a) => !a.startsWith("-"));
+      if (firstNonFlag) {
+        const result = await checkKillTarget({
+          name: firstNonFlag,
+          signal: "SIGTERM",
+          cmd: fullCommand
+        });
+        if (result.blocked) return result;
+      }
+    }
+  }
+  return { blocked: false };
+}
+function tokenizeShellCommand(command) {
+  const tokens = [];
+  let current = "";
+  let quote = null;
+  for (const char of command.trim()) {
+    if (quote) {
+      if (char === quote) quote = null;
+      else current += char;
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+    } else if (/\s/.test(char)) {
+      if (current) {
+        tokens.push(current);
+        current = "";
+      }
+    } else {
+      current += char;
+    }
+  }
+  if (current) tokens.push(current);
+  return tokens;
+}
+async function checkKillTarget(target) {
+  const registry = getPersistentProcessRegistry();
+  if (target.pid !== void 0) {
+    const blocked = await registry.shouldBlockKill(target.pid);
+    if (blocked) {
+      return {
+        blocked: true,
+        reason: `Blocked: kill ${target.signal} PID ${target.pid} targets a protected WrongStack process (${target.cmd.slice(0, 80)}).`
+      };
+    }
+    if (target.pid === process.pid) {
+      return {
+        blocked: true,
+        reason: "Blocked: cannot kill the current WrongStack process."
+      };
+    }
+    if (target.pid === process.ppid) {
+      return {
+        blocked: true,
+        reason: "Blocked: cannot kill the parent terminal hosting WrongStack."
+      };
+    }
+    return { blocked: false };
+  }
+  if (target.name) {
+    const nameLower = target.name.toLowerCase().replace(/\.exe$/, "");
+    if (nameLower.includes("wrongstack")) {
+      return {
+        blocked: true,
+        reason: `Blocked: kill ${target.signal} '${target.name}' targets a WrongStack process name.`
+      };
+    }
+    const currentImage = path5.basename(process.execPath).toLowerCase().replace(/\.exe$/, "");
+    const targetsNodeRuntime = nameLower === "node" || nameLower.startsWith("node");
+    if (targetsNodeRuntime && currentImage === "node") {
+      return {
+        blocked: true,
+        reason: `Blocked: kill ${target.signal} '${target.name}' would kill the active WrongStack node.exe runtime.`
+      };
+    }
+    const protectedPids = await registry.getAllProtectedPids();
+    if (protectedPids.length > 0 && targetsNodeRuntime) {
+      return {
+        blocked: true,
+        reason: `Blocked: kill ${target.signal} '${target.name}' would kill all node.exe processes including active WrongStack instance(s).`
+      };
+    }
+    return { blocked: false };
+  }
+  return { blocked: false };
+}
+
 // src/exec.ts
-var isWin = process.platform === "win32";
+var isWin2 = process.platform === "win32";
 var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   // JS / TS toolchain
   "node",
@@ -1970,6 +2617,19 @@ var execTool = {
     const args = (input.args ?? []).slice(0, MAX_ARGS);
     const timeout = Math.max(1, Math.min(input.timeout ?? DEFAULT_TIMEOUT_MS, DEFAULT_TIMEOUT_MS));
     const danger = detectDanger(cmd, args, dangerBypass);
+    const killCheck = await checkExecKillCommand(cmd, args);
+    if (killCheck.blocked) {
+      return {
+        command: cmd,
+        args,
+        stdout: "",
+        stderr: killCheck.reason ?? "Kill command blocked: targets a protected WrongStack process.",
+        exitCode: 1,
+        truncated: false,
+        allowed: false,
+        danger
+      };
+    }
     const argError = validateArgs(cmd, args);
     if (argError) {
       return {
@@ -2020,7 +2680,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
     let timedOut = false;
     const spool = createOutputSpool({ tool: `exec-${cmd}`, thresholdBytes: MAX_OUTPUT });
     const resolved = resolveWin32Command(cmd);
-    const needsShell = isWin && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
+    const needsShell = isWin2 && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
     const shim = needsShell ? buildWin32CmdShimInvocation(resolved, args) : null;
     const spawnCmd = shim?.command ?? resolved;
     const spawnArgs = shim?.args ?? args;
@@ -2045,7 +2705,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
         env: buildChildEnv(sessionId),
         stdio: ["ignore", "pipe", "pipe"],
         windowsHide: true,
-        ...isWin ? {} : { signal },
+        ...isWin2 ? {} : { signal },
         ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {}
       });
     } catch (err) {
@@ -2063,7 +2723,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
         command: cmd,
         args,
         stdout: "",
-        stderr: `spawn failed: ${toErrorMessage(err)}`,
+        stderr: `spawn failed: ${toErrorMessage2(err)}`,
         exitCode: 1,
         truncated: false,
         allowed: true,
@@ -2084,7 +2744,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
       const isAbort = err && err.code === "ABORT_ERR";
       const stderrText = isAbort ? `Aborted: ${err.message}` : err.message;
       clearTimeout(timer);
-      if (isWin) signal.removeEventListener("abort", onAbort);
+      if (isWin2) signal.removeEventListener("abort", onAbort);
       if (typeof pid === "number") registry.unregister(pid);
       registry.afterCall(Date.now() - startedAt, true);
       spool.finalize();
@@ -2117,7 +2777,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
       if (typeof pid === "number") registry.kill(pid, { force: true });
       else child.kill("SIGTERM");
     };
-    if (isWin) {
+    if (isWin2) {
       if (signal.aborted) onAbort();
       else signal.addEventListener("abort", onAbort, { once: true });
     }
@@ -2137,7 +2797,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      if (isWin) signal.removeEventListener("abort", onAbort);
+      if (isWin2) signal.removeEventListener("abort", onAbort);
       if (typeof pid === "number") registry.unregister(pid);
       const durationMs = Date.now() - startedAt;
       const exitCode = killed ? 124 : code ?? 1;