@yeaft/webchat-agent 1.0.413 → 1.0.415

package/yeaft/init.js

@@ -9,6 +9,7 @@ import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, access
 import { join, dirname } from 'path';
 import { homedir } from 'os';
 import { createHash } from 'crypto';
+import { mutateAgentConfig } from './config-store.js';
 // NOTE: migrateSessions runs at the end of initYeaftDir(). It collapses
 // legacy groups/ + chats/ + memory/{group,chat}/ into the unified sessions/
 // layout AND rewrites pre-rename per-message frontmatter (groupId → sessionId).
@@ -31,9 +32,9 @@ export function isPermissionError(err) {
  * @param {string} content
  * @param {string[]} warnings — array to push warning messages into
  */
-function safeWriteFile(filePath, content, warnings) {
+function safeWriteFile(filePath, content, warnings, mode = 0o644) {
   try {
-    writeFileSync(filePath, content, { encoding: 'utf8', mode: 0o644 });
+    writeFileSync(filePath, content, { encoding: 'utf8', mode });
   } catch (err) {
     if (isPermissionError(err)) {
       warnings.push(`Cannot write ${filePath}: ${err.code}`);
@@ -49,9 +50,9 @@ function safeWriteFile(filePath, content, warnings) {
  * @param {string[]} warnings — array to push warning messages into
  * @returns {boolean} — true if directory exists (created or already existed)
  */
-function safeMkdir(dirPath, warnings) {
+function safeMkdir(dirPath, warnings, mode = 0o755) {
   try {
-    mkdirSync(dirPath, { recursive: true, mode: 0o755 });
+    mkdirSync(dirPath, { recursive: true, mode });
     return true;
   } catch (err) {
     if (isPermissionError(err)) {
@@ -168,7 +169,7 @@ export function initYeaftDir(dir) {
 
   // Ensure root exists
   if (!existsSync(root)) {
-    if (safeMkdir(root, warnings)) {
+    if (safeMkdir(root, warnings, 0o700)) {
       created.push(root);
     }
   }
@@ -194,8 +195,20 @@ export function initYeaftDir(dir) {
   // config.json — default configuration (user edits this directly)
   const configJsonPath = join(root, 'config.json');
   if (!existsSync(configJsonPath)) {
-    safeWriteFile(configJsonPath, DEFAULT_CONFIG_JSON, warnings);
-    created.push(configJsonPath);
+    let seeded = false;
+    try {
+      const defaults = JSON.parse(DEFAULT_CONFIG_JSON);
+      mutateAgentConfig(root, (current, state) => {
+        if (!state.exists) {
+          Object.assign(current, defaults);
+          seeded = true;
+        }
+      });
+      if (seeded) created.push(configJsonPath);
+    } catch (err) {
+      if (isPermissionError(err)) warnings.push(`Cannot write ${configJsonPath}: ${err.code}`);
+      else throw err;
+    }
   }
 
   const memoryPath = join(root, 'memory', 'MEMORY.md');

package/yeaft/sessions/feature-flag.js

@@ -12,8 +12,7 @@
 
 import { existsSync, readFileSync } from 'fs';
 import { join } from 'path';
-import { normalizePluginConfig } from '../plugins.js';
-import { writeAtomic } from '../storage/index.js';
+import { mutateAgentConfig } from '../config-store.js';
 
 const CONFIG_FILE = 'config.json';
 const FLAG_PATH = ['yeaft', 'multiVp', 'enabled'];
@@ -34,20 +33,6 @@ function readConfig(yeaftDir) {
  * remain tolerant because the flag is optional, but no mutation may replace a
  * malformed root or a Plugin policy that the runtime must keep fail-closed.
  */
-function readConfigForWrite(yeaftDir) {
-  const path = join(yeaftDir, CONFIG_FILE);
-  if (!existsSync(path)) return {};
-  const config = JSON.parse(readFileSync(path, 'utf8'));
-  if (!config || typeof config !== 'object' || Array.isArray(config)
-    || Object.getPrototypeOf(config) !== Object.prototype) {
-    throw new Error('config.json must contain an object');
-  }
-  if (Object.prototype.hasOwnProperty.call(config, 'plugins')) {
-    normalizePluginConfig(config.plugins);
-  }
-  return config;
-}
-
 export function isMultiVpEnabled(yeaftDir) {
   const cfg = readConfig(yeaftDir);
   let cur = cfg;
@@ -59,24 +44,21 @@ export function isMultiVpEnabled(yeaftDir) {
 }
 
 export function setMultiVpEnabled(yeaftDir, enabled) {
-  let cfg;
-  try {
-    cfg = readConfigForWrite(yeaftDir);
-  } catch (err) {
-    return { error: `Failed to read config.json: ${err?.message || err}` };
-  }
-  let cur = cfg;
-  for (let i = 0; i < FLAG_PATH.length - 1; i++) {
-    const seg = FLAG_PATH[i];
-    if (!cur[seg] || typeof cur[seg] !== 'object' || Array.isArray(cur[seg])) cur[seg] = {};
-    cur = cur[seg];
-  }
   const nextValue = Boolean(enabled);
-  cur[FLAG_PATH[FLAG_PATH.length - 1]] = nextValue;
   try {
-    writeAtomic(join(yeaftDir, CONFIG_FILE), JSON.stringify(cfg, null, 2));
-  } catch (err) {
-    return { error: `Failed to write config.json: ${err?.message || err}` };
+    return mutateAgentConfig(yeaftDir, config => {
+      let current = config;
+      for (let index = 0; index < FLAG_PATH.length - 1; index += 1) {
+        const segment = FLAG_PATH[index];
+        if (!current[segment] || typeof current[segment] !== 'object' || Array.isArray(current[segment])) {
+          current[segment] = {};
+        }
+        current = current[segment];
+      }
+      current[FLAG_PATH.at(-1)] = nextValue;
+      return { enabled: nextValue };
+    });
+  } catch (error) {
+    return { error: `Failed to read config.json or persist update: ${error?.message || error}` };
   }
-  return { enabled: nextValue };
 }

package/yeaft/sessions/session-manifest.js

@@ -15,18 +15,25 @@
 import {
   cpSync,
   existsSync,
+  linkSync,
   mkdirSync,
   readFileSync,
   readdirSync,
   rmSync,
   statSync,
+  unlinkSync,
   writeFileSync,
 } from 'fs';
+import { randomUUID } from 'node:crypto';
 import { join } from 'path';
 import { loadSessionMeta } from './session-store.js';
+import { writeAtomic } from '../storage/atomic.js';
 
 export const SESSIONS_MANIFEST_FILE = 'sessions-manifest.json';
 const MANIFEST_VERSION = 1;
+const MANIFEST_LOCK_FILE = 'sessions-manifest.lock';
+const MANIFEST_LOCK_WAIT_MS = 5_000;
+const lockWaitArray = new Int32Array(new SharedArrayBuffer(4));
 
 export function sessionManifestPath(yeaftDir) {
   return join(yeaftDir, SESSIONS_MANIFEST_FILE);
@@ -62,6 +69,10 @@ export function loadSessionsManifest(yeaftDir) {
 }
 
 export function writeSessionsManifest(yeaftDir, sessions) {
+  return withManifestLock(yeaftDir, () => writeSessionsManifestUnlocked(yeaftDir, sessions));
+}
+
+function writeSessionsManifestUnlocked(yeaftDir, sessions) {
   if (!yeaftDir) throw new Error('yeaftDir required');
   mkdirSync(yeaftDir, { recursive: true });
   const manifest = {
@@ -69,7 +80,7 @@ export function writeSessionsManifest(yeaftDir, sessions) {
     generatedAt: new Date().toISOString(),
     sessions: dedupeSessions(sessions).sort((a, b) => String(a.createdAt || '').localeCompare(String(b.createdAt || ''))),
   };
-  writeFileSync(sessionManifestPath(yeaftDir), `${JSON.stringify(manifest, null, 2)}\n`);
+  writeAtomic(sessionManifestPath(yeaftDir), `${JSON.stringify(manifest, null, 2)}\n`);
   return manifest;
 }
 
@@ -171,21 +182,114 @@ export function ensureSessionsManifest(yeaftDir, options) {
     }
   }
 
-  const manifest = writeSessionsManifest(yeaftDir, buildManifestFromLocalSessions(yeaftDir, root));
-  return { created: true, migrated, skipped, migratedIds, skippedIds, manifest };
+  return withManifestLock(yeaftDir, () => {
+    const current = loadSessionsManifest(yeaftDir);
+    const manifest = writeSessionsManifestUnlocked(yeaftDir, [
+      ...(current?.sessions || []),
+      ...buildManifestFromLocalSessions(yeaftDir, root),
+    ]);
+    return {
+      created: !current,
+      migrated,
+      skipped,
+      migratedIds,
+      skippedIds,
+      manifest,
+    };
+  });
 }
 
 export function addOrUpdateManifestSession(yeaftDir, meta, dir) {
-  const current = loadSessionsManifest(yeaftDir) || { sessions: [] };
-  const rows = current.sessions.filter(row => row.id !== meta.id);
-  rows.push(manifestRowFromMeta(meta, dir));
-  return writeSessionsManifest(yeaftDir, rows);
+  return withManifestLock(yeaftDir, () => {
+    const current = loadSessionsManifest(yeaftDir);
+    const recovered = current?.sessions
+      || buildManifestFromLocalSessions(yeaftDir, join(yeaftDir, 'sessions'));
+    const rows = recovered.filter(row => row.id !== meta.id);
+    rows.push(manifestRowFromMeta(meta, dir));
+    return writeSessionsManifestUnlocked(yeaftDir, rows);
+  });
 }
 
 export function removeManifestSession(yeaftDir, sessionId) {
-  const current = loadSessionsManifest(yeaftDir);
-  if (!current) return null;
-  return writeSessionsManifest(yeaftDir, current.sessions.filter(row => row.id !== sessionId));
+  return withManifestLock(yeaftDir, () => {
+    const current = loadSessionsManifest(yeaftDir);
+    if (!current) return null;
+    return writeSessionsManifestUnlocked(yeaftDir, current.sessions.filter(row => row.id !== sessionId));
+  });
+}
+
+export function withSessionManifestLock(yeaftDir, operation) {
+  if (!yeaftDir) throw new Error('yeaftDir required');
+  mkdirSync(yeaftDir, { recursive: true });
+  const lockFile = join(yeaftDir, MANIFEST_LOCK_FILE);
+  const deadline = Date.now() + MANIFEST_LOCK_WAIT_MS;
+  const token = randomUUID();
+  const ownerFile = `${lockFile}.owner.${process.pid}.${token}`;
+  const owner = { pid: process.pid, token, ownerFile };
+  writeFileSync(ownerFile, `${JSON.stringify(owner)}\n`, { flag: 'wx' });
+  for (;;) {
+    try {
+      linkSync(ownerFile, lockFile);
+      break;
+    } catch (error) {
+      if (error?.code !== 'EEXIST') {
+        try { unlinkSync(ownerFile); } catch {}
+        throw error;
+      }
+      reapDeadManifestLock(lockFile);
+      if (Date.now() >= deadline) {
+        try { unlinkSync(ownerFile); } catch {}
+        throw new Error('Timed out waiting for Session manifest lock');
+      }
+      Atomics.wait(lockWaitArray, 0, 0, 25);
+    }
+  }
+  try {
+    return operation();
+  } finally {
+    try {
+      const current = JSON.parse(readFileSync(lockFile, 'utf8'));
+      if (current.token === owner.token) unlinkSync(lockFile);
+    } catch {
+      // A missing lock means another process already recovered this owner.
+    }
+    try { unlinkSync(ownerFile); } catch {}
+  }
+}
+
+function withManifestLock(yeaftDir, operation) {
+  return withSessionManifestLock(yeaftDir, operation);
+}
+
+function reapDeadManifestLock(lockFile) {
+  let observed;
+  try {
+    observed = JSON.parse(readFileSync(lockFile, 'utf8'));
+  } catch {
+    return;
+  }
+  if (!Number.isInteger(observed.pid) || typeof observed.token !== 'string') return;
+  try {
+    process.kill(observed.pid, 0);
+    return;
+  } catch (error) {
+    if (error?.code === 'EPERM') return;
+  }
+  const claim = `${lockFile}.reap.${process.pid}.${randomUUID()}`;
+  try {
+    linkSync(lockFile, claim);
+    const claimed = JSON.parse(readFileSync(claim, 'utf8'));
+    if (claimed.token !== observed.token) return;
+    unlinkSync(lockFile);
+    const expectedOwnerFile = `${lockFile}.owner.${observed.pid}.${observed.token}`;
+    if (observed.ownerFile === expectedOwnerFile) {
+      try { unlinkSync(expectedOwnerFile); } catch {}
+    }
+  } catch {
+    // Another process either recovered or replaced the observed lock.
+  } finally {
+    try { unlinkSync(claim); } catch {}
+  }
 }
 
 function manifestRowFromMeta(meta, dir) {

package/yeaft/stdio-protocol.js

@@ -1,5 +1,6 @@
 import { createInterface } from 'node:readline';
 import { randomUUID } from 'node:crypto';
+import { isReservedVpId, validateVpId } from './sessions/ids.js';
 
 const TERMINAL_STOP_REASONS = new Set([
   'end_turn', 'max_tokens', 'stop_sequence', 'aborted', 'error', 'tool_handoff', 'plan_recorded',
@@ -78,6 +79,62 @@ export function normalizeStreamRoutingIntent(message) {
   });
 }
 
+/**
+ * Read the opt-in formal Session seed supplied by an integration's first
+ * stream-json prompt. Existing Sessions keep their persisted roster; this only
+ * establishes a canonical roster for a previously unknown session id.
+ */
+export function normalizeStreamSessionBootstrap(message) {
+  if (!message || typeof message !== 'object') return null;
+  const hasRoster = Object.hasOwn(message, 'roster');
+  const hasVps = Object.hasOwn(message, 'vps');
+  const hasDefault = Object.hasOwn(message, 'defaultVpId');
+  if (!hasRoster && !hasVps && !hasDefault) return null;
+  if (!hasRoster && !hasVps) {
+    throw new Error('stream-json defaultVpId requires roster or vps');
+  }
+
+  const readRoster = (key) => {
+    const value = message[key];
+    if (!Array.isArray(value)) throw new Error(`stream-json ${key} must be an array`);
+    return value.slice();
+  };
+  const roster = hasRoster ? readRoster('roster') : readRoster('vps');
+  if (hasRoster && hasVps) {
+    const vps = readRoster('vps');
+    if (vps.length !== roster.length || vps.some((vpId, index) => vpId !== roster[index])) {
+      throw new Error('stream-json roster and vps must contain the same VP ids in the same order');
+    }
+  }
+
+  const seen = new Set();
+  for (const vpId of roster) {
+    const verdict = validateVpId(vpId);
+    if (!verdict.ok || isReservedVpId(vpId)) {
+      throw new Error(`stream-json roster contains invalid VP id ${JSON.stringify(vpId)} (${verdict.reason || 'reserved'})`);
+    }
+    if (seen.has(vpId)) throw new Error(`stream-json roster contains duplicate VP id ${vpId}`);
+    seen.add(vpId);
+  }
+
+  let defaultVpId = roster[0] || null;
+  if (hasDefault && message.defaultVpId != null) {
+    defaultVpId = message.defaultVpId;
+    const verdict = validateVpId(defaultVpId);
+    if (!verdict.ok || isReservedVpId(defaultVpId)) {
+      throw new Error(`stream-json defaultVpId is invalid (${verdict.reason || 'reserved'})`);
+    }
+    if (!seen.has(defaultVpId)) {
+      throw new Error(`stream-json defaultVpId ${defaultVpId} is not in roster`);
+    }
+  }
+
+  return Object.freeze({
+    roster: Object.freeze(roster),
+    defaultVpId,
+  });
+}
+
 export function createJsonlWriter(output = process.stdout) {
   return event => { output.write(`${JSON.stringify(event)}\n`); };
 }

package/yeaft/storage/atomic.js

@@ -9,8 +9,8 @@
  * the only debris; they are safe to delete on boot (see sweepTmp()).
  *
  * Implementation:
- *   1. Write bytes to `path.tmp.<pid>.<counter>` via writeFileSync.
- *   2. fsync the tmp file (force bytes to disk before rename).
+ *   1. Exclusively create `path.tmp.<pid>.<counter>` and write through its fd.
+ *   2. fsync the same fd (force bytes to disk before rename).
  *   3. rename(tmp, path) — POSIX-atomic on same filesystem.
  *   4. fsync the parent dir (persist the rename itself).
  *
@@ -31,36 +31,62 @@ import {
   existsSync,
   unlinkSync,
   readdirSync,
+  lstatSync,
+  constants,
 } from 'fs';
 import { dirname, basename, join } from 'path';
 
 let tmpCounter = 0;
 
+export function nextAtomicTmpPathForTest(path) {
+  return `${path}.tmp.${process.pid}.${tmpCounter + 1}`;
+}
+
+function targetMode(path, requestedMode) {
+  try {
+    const stat = lstatSync(path);
+    if (!stat.isFile()) throw new Error(`Atomic write target is not a regular file: ${path}`);
+    const existingMode = stat.mode & 0o777;
+    return requestedMode == null ? existingMode : existingMode & requestedMode;
+  } catch (error) {
+    if (error?.code === 'ENOENT') return requestedMode ?? 0o666;
+    throw error;
+  }
+}
+
 /**
  * Atomically write `data` (string | Buffer) to `path`.
  * Throws on failure; never leaves `path` in a half-written state.
+ *
+ * When supplied, `mode` is the maximum permission set for the replacement and
+ * is still restricted by umask. Existing files preserve any tighter permissions
+ * but never retain bits outside that explicit maximum. Omitted mode preserves
+ * the historical behavior: existing modes survive, new files default to 0666.
  */
-export function writeAtomic(path, data) {
+export function writeAtomic(path, data, { mode = null } = {}) {
   const dir = dirname(path);
   const tmpPath = `${path}.tmp.${process.pid}.${++tmpCounter}`;
-
-  writeFileSync(tmpPath, data);
-
-  // fsync the tmp file so the bytes hit disk before we swap.
+  const fileMode = targetMode(path, mode);
+  let fd = null;
   try {
-    const fd = openSync(tmpPath, 'r+');
-    try {
-      fsyncSync(fd);
-    } finally {
-      closeSync(fd);
+    fd = openSync(
+      tmpPath,
+      constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL,
+      fileMode,
+    );
+    writeFileSync(fd, data);
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = null;
+    renameSync(tmpPath, path);
+  } catch (error) {
+    if (fd !== null) {
+      try { closeSync(fd); } catch {}
+      try { unlinkSync(tmpPath); } catch {}
     }
-  } catch {
-    // Best-effort; some filesystems / platforms don't support fsync on a file
-    // opened r+. The rename below is still the atomic boundary.
+    throw error;
   }
 
-  renameSync(tmpPath, path);
-
   // fsync the parent directory so the rename is durable.
   // Windows: cannot fsync a directory; skip.
   if (process.platform !== 'win32') {

package/yeaft/tools/process-runner.js

@@ -71,18 +71,26 @@ function isSystemdScopeInactive(scope, spawnProcessSync) {
   }
 }
 
-function killProcessTree(proc, signalName, platform, spawnProcessSync, systemdScope) {
+function killProcessTree(
+  proc,
+  signalName,
+  platform,
+  spawnProcessSync,
+  systemdScope,
+  commandTimeoutMs = 5000,
+) {
   if (!proc.pid) return false;
   if (platform === 'win32') {
     try {
       const result = spawnProcessSync('taskkill', ['/pid', String(proc.pid), '/t', '/f'], {
         stdio: 'ignore',
         windowsHide: true,
-        timeout: 5000,
+        timeout: Math.max(1, commandTimeoutMs),
       });
       if (!result.error && result.status === 0) return true;
     } catch {}
-    try { return proc.kill(signalName) !== false; } catch { return false; }
+    try { proc.kill(signalName); } catch {}
+    return false;
   }
 
   let signalled = signalSystemdScope(systemdScope, signalName, spawnProcessSync);
@@ -96,12 +104,22 @@ function killProcessTree(proc, signalName, platform, spawnProcessSync, systemdSc
   return signalled;
 }
 
+function processGroupIsInactive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return true;
+  try {
+    process.kill(-pid, 0);
+    return false;
+  } catch (error) {
+    return error?.code === 'ESRCH';
+  }
+}
+
 /**
  * Execute a binary directly without a shell and keep captured output bounded.
  *
  * @param {string} command
  * @param {string[]} args
- * @param {{ cwd?: string, signal?: AbortSignal, timeoutMs?: number, maxBytes?: number, env?: NodeJS.ProcessEnv, preserveCarriageReturns?: boolean, killGraceMs?: number, forceSettleMs?: number, requireExitConfirmation?: boolean, systemdScope?: { unit: string, systemctlPath: string, env?: NodeJS.ProcessEnv } | null, onSettled?: (() => void) | null, platform?: NodeJS.Platform, spawnProcess?: typeof spawn, spawnProcessSync?: typeof spawnSync }} [options]
+ * @param {{ cwd?: string, signal?: AbortSignal, timeoutMs?: number, maxBytes?: number, env?: NodeJS.ProcessEnv, preserveCarriageReturns?: boolean, killGraceMs?: number, gracefulTerminationDeadline?: number, terminationDeadline?: number, forceSettleMs?: number, treeKillTimeoutMs?: number, requireExitConfirmation?: boolean, requireProcessGroupExit?: boolean, systemdScope?: { unit: string, systemctlPath: string, env?: NodeJS.ProcessEnv } | null, onSettled?: (() => void) | null, platform?: NodeJS.Platform, spawnProcess?: typeof spawn, spawnProcessSync?: typeof spawnSync }} [options]
  * @returns {Promise<{ code: number, stdout: string, stderr: string, truncated: boolean, timedOut: boolean, terminationError?: string }>}
  */
 export function runProcess(command, args, options = {}) {
@@ -123,6 +141,17 @@ export function runProcess(command, args, options = {}) {
     const forceSettleMs = Number.isFinite(options.forceSettleMs)
       ? Math.max(1, options.forceSettleMs)
       : DEFAULT_FORCE_SETTLE_MS;
+    const treeKillTimeoutMs = Number.isFinite(options.treeKillTimeoutMs)
+      ? Math.max(1, options.treeKillTimeoutMs)
+      : 5000;
+    const deadlineBudget = (maximum, deadline) => {
+      if (!Number.isFinite(deadline)) return maximum;
+      return Math.max(0, Math.min(maximum, deadline - Date.now()));
+    };
+    const terminationBudget = maximum => deadlineBudget(maximum, options.terminationDeadline);
+    const treeKillBudget = () => Number.isFinite(options.terminationDeadline)
+      ? terminationBudget(treeKillTimeoutMs)
+      : treeKillTimeoutMs;
     let proc;
     try {
       proc = spawnProcess(command, args, {
@@ -149,6 +178,8 @@ export function runProcess(command, args, options = {}) {
     let aborted = false;
     let stopRequested = false;
     let forceRequested = false;
+    let processTreeKillConfirmed = platform !== 'win32';
+    let treeKillFailed = false;
     let directClosed = false;
     let directCode = null;
     let timer = null;
@@ -217,7 +248,14 @@ export function runProcess(command, args, options = {}) {
     const terminationConfirmed = () => {
       if (!options.requireExitConfirmation) return directClosed;
       const scopeInactive = isSystemdScopeInactive(options.systemdScope, spawnProcessSync);
-      return directClosed && scopeInactive;
+      const processTreeInactive = !options.requireProcessGroupExit
+        || (platform === 'win32'
+          ? processTreeKillConfirmed
+          : processGroupIsInactive(proc.pid));
+      const treeKillSucceeded = platform !== 'win32'
+        || !options.requireProcessGroupExit
+        || !treeKillFailed;
+      return directClosed && scopeInactive && processTreeInactive && treeKillSucceeded;
     };
     const maybeFinishStopped = () => {
       if (settled || !stopRequested || !terminationConfirmed()) return false;
@@ -227,18 +265,30 @@ export function runProcess(command, args, options = {}) {
     const startConfirmationPolling = () => {
       if (!options.requireExitConfirmation || confirmationTimer) return;
       confirmationTimer = setInterval(maybeFinishStopped, CONFIRMATION_POLL_MS);
+      if (!options.requireProcessGroupExit) confirmationTimer.unref?.();
     };
     const forceStop = () => {
       if (settled || forceRequested) return;
       forceRequested = true;
+      const settleBudget = terminationBudget(forceSettleMs);
       killProcessTree(
         proc,
         'SIGKILL',
         platform,
         spawnProcessSync,
         options.systemdScope,
+        Math.max(1, treeKillBudget() || 1),
       );
       if (maybeFinishStopped()) return;
+      if (settleBudget <= 0) {
+        finish(
+          null,
+          options.requireExitConfirmation
+            ? new ProcessTerminationError(command, forceSettleMs)
+            : null,
+        );
+        return;
+      }
       forceSettleTimer = setTimeout(() => {
         if (maybeFinishStopped()) return;
         finish(
@@ -247,7 +297,7 @@ export function runProcess(command, args, options = {}) {
             ? new ProcessTerminationError(command, forceSettleMs)
             : null,
         );
-      }, forceSettleMs);
+      }, settleBudget);
     };
     const stop = () => {
       if (settled || stopRequested) return;
@@ -256,20 +306,35 @@ export function runProcess(command, args, options = {}) {
         // taskkill must run while the parent PID still identifies the tree.
         // It is already forceful, so do not wait for the direct child to exit.
         forceRequested = true;
-        killProcessTree(proc, 'SIGKILL', platform, spawnProcessSync, null);
+        const settleBudget = terminationBudget(forceSettleMs);
+        processTreeKillConfirmed = killProcessTree(
+          proc,
+          'SIGKILL',
+          platform,
+          spawnProcessSync,
+          null,
+          Math.max(1, treeKillBudget() || 1),
+        );
+        treeKillFailed = !processTreeKillConfirmed;
+        if (maybeFinishStopped()) return;
         if (!settled) {
-          forceSettleTimer = setTimeout(() => {
+          const finishAfterForce = () => {
+            if (maybeFinishStopped()) return;
             finish(
               null,
               options.requireExitConfirmation
                 ? new ProcessTerminationError(command, forceSettleMs)
                 : null,
             );
-          }, forceSettleMs);
+          };
+          const remainingSettleBudget = terminationBudget(forceSettleMs);
+          if (remainingSettleBudget <= 0) finishAfterForce();
+          else forceSettleTimer = setTimeout(finishAfterForce, remainingSettleBudget);
         }
         return;
       }
       startConfirmationPolling();
+      if (maybeFinishStopped()) return;
       killProcessTree(
         proc,
         'SIGTERM',
@@ -277,8 +342,12 @@ export function runProcess(command, args, options = {}) {
         spawnProcessSync,
         options.systemdScope,
       );
-      forceTimer = setTimeout(forceStop, killGraceMs);
-      forceTimer.unref?.();
+      const graceBudget = deadlineBudget(killGraceMs, options.gracefulTerminationDeadline);
+      if (graceBudget <= 0) forceStop();
+      else {
+        forceTimer = setTimeout(forceStop, graceBudget);
+        if (!options.requireProcessGroupExit) forceTimer.unref?.();
+      }
     };
     const onAbort = () => {
       aborted = true;
@@ -321,7 +390,7 @@ export function runProcess(command, args, options = {}) {
       if (settled) return;
       if (stopRequested) {
         directClosed = true;
-        finishStoppedChild();
+        if (platform !== 'win32' || !treeKillFailed || !options.requireProcessGroupExit) finishStoppedChild();
         return;
       }
       settled = true;
@@ -331,8 +400,12 @@ export function runProcess(command, args, options = {}) {
     onClose = code => {
       directClosed = true;
       directCode = code;
+      if (!stopRequested && options.requireProcessGroupExit && !terminationConfirmed()) {
+        stop();
+        return;
+      }
       if (stopRequested) {
-        finishStoppedChild();
+        if (platform !== 'win32' || !treeKillFailed || !options.requireProcessGroupExit) finishStoppedChild();
         return;
       }
       finish(code);