amicus 1.7.6 → 1.7.7

package/.claude-plugin/plugin.json

@@ -1,19 +1,40 @@
 {
   "name": "amicus",
-  "version": "1.7.6",
+  "version": "1.7.7",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
-  "author": { "name": "Christian Wagner" },
+  "author": {
+    "name": "Christian Wagner"
+  },
   "homepage": "https://bourbondog.github.io/amicus/",
   "repository": "https://github.com/BourbonDog/amicus",
   "bugs": "https://github.com/BourbonDog/amicus/issues",
   "license": "MIT",
-  "keywords": ["claude-code", "multi-model", "llm", "council", "second-opinion", "sidecar", "gemini", "gpt", "deepseek"],
-  "skills": ["./skills/sidecar", "./skills/second-opinion"],
+  "keywords": [
+    "claude-code",
+    "multi-model",
+    "llm",
+    "council",
+    "second-opinion",
+    "sidecar",
+    "gemini",
+    "gpt",
+    "deepseek"
+  ],
+  "skills": [
+    "./skills/sidecar",
+    "./skills/second-opinion"
+  ],
   "mcpServers": {
     "amicus": {
       "command": "npx",
-      "args": ["-y", "amicus@latest", "mcp"],
-      "env": { "AMICUS_SKIP_POSTINSTALL": "1" }
+      "args": [
+        "-y",
+        "amicus@latest",
+        "mcp"
+      ],
+      "env": {
+        "AMICUS_SKIP_POSTINSTALL": "1"
+      }
     }
   }
 }

package/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to Amicus are documented here. Format follows
 
 ## [Unreleased]
 
+## [1.7.7] - 2026-07-01
+
+Correctness patch from the 2026-07-01 full product review (multi-agent review, every finding adversarially
+verified against source), executed subagent-driven with per-task adversarial review plus a final whole-branch review.
+
+### Fixed
+- **Terminal errors now show their actionable hint.** Human-mode errors printed only the message while `--json`
+  carried a `hint` field; the hint now prints on a second `  → …` line. Budget-gate refusals finally tell you the
+  offending model, the threshold, and the `--max-cost` / `--no-cost-gate` overrides.
+- **Spawned sidecars no longer inherit Amicus's own MCP server.** The recursive-spawn guard only excluded a server
+  literally named `sidecar`, but the product registers as `amicus` — so every child model inherited the full
+  Amicus toolset and could spawn recursively. Children now exclude any inherited entry that *is* Amicus, matched
+  by name **or** by what the command actually runs (`amicus mcp`, `npx … amicus … mcp`, a `bin/amicus.js … mcp`
+  path). Note: this strip has no opt-out — a deliberately configured nested Amicus MCP entry is also removed from
+  spawned children.
+- **Shared-server crash detection actually works.** The crash/restart machinery listened on an event emitter the
+  real server handle never exposed, so it was dead code — a dead engine silently degraded every later session.
+  A pid liveness poll now drives detection and restart, and shutting down during the restart backoff cancels the
+  pending restart instead of spawning a server nobody asked for.
+
+### Changed
+- **`amicus continue` and `amicus resume` now report failures truthfully** (behavior change): error exits 1,
+  timeout exits 2, abort exits 130/143/2 — previously both always exited 0 and recorded the session as
+  `complete` even when the model errored or timed out. The session record now finalizes `error`/`timed-out`
+  accordingly (interactive sessions that legitimately end with an empty summary still finalize `complete`).
+  Scripts that gated on exit code 0 for these verbs will now see real failures.
+
 ## [1.7.6] - 2026-07-01
 
 A second independent review (GLM 5.2), adversarially verified against source, then fixed across 11 lanes.

package/LICENSE

@@ -1,27 +1,7 @@
 MIT License
 
-Copyright (c) 2025 John Renaldi Claude Sidecar
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-
-Copyright (c) 2026 Christian Wagner Amicus
+Copyright (c) 2026 Christian Wagner
+Copyright (c) 2025 John Renaldi
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -57,13 +57,37 @@ Claude is the orchestrator. The council and chat skills run *on top of* the engi
 
 ## Quick start
 
-**Install:**
+**Install** — pick whichever fits; all deliver the same CLI, MCP server, and both skills:
+
+**As a Claude Code plugin** — the most native path if you use Claude Code:
+
+```text
+/plugin marketplace add BourbonDog/amicus
+/plugin install amicus@bourbondog-amicus
+/reload-plugins
+```
+
+Claude Code registers the MCP server and both skills for you — nothing to configure. (The standalone Electron window is npm-only, and the first council/sidecar call downloads the OpenCode engine.)
+
+**With the install script** — macOS, Linux, or Windows (needs [Node.js](https://nodejs.org) ≥ 18):
+
+```bash
+# macOS / Linux
+curl -fsSL https://raw.githubusercontent.com/BourbonDog/amicus/main/install.sh | sh
+```
+
+```powershell
+# Windows (PowerShell)
+irm https://raw.githubusercontent.com/BourbonDog/amicus/main/install.ps1 | iex
+```
+
+**With npm** — the canonical path (needs [Node.js](https://nodejs.org) ≥ 18):
 
 ```bash
 npm install -g amicus
 ```
 
-The postinstall step auto-configures everything — no manual registration:
+For the **npm** and **install-script** paths, a postinstall auto-configures everything — no manual registration:
 
 - Registers the **MCP server** in Claude Code and in Claude Desktop / Cowork, so the Amicus tools appear natively.
 - Installs **both skills** into `~/.claude/skills/` — `second-opinion` (the council) and `sidecar` (the chat skill).

package/bin/amicus.js

@@ -95,10 +95,10 @@ async function main() {
         await handleList(args);
         break;
       case 'resume':
-        await handleResume(args);
+        exitCode = await handleResume(args);
         break;
       case 'continue':
-        await handleContinue(args);
+        exitCode = await handleContinue(args);
         break;
       case 'read':
         await handleRead(args);
@@ -188,7 +188,7 @@ async function handleResume(args) {
 
   const { resumeSidecar } = require('../src/index');
 
-  await resumeSidecar({
+  return await resumeSidecar({
     taskId,
     project: args.cwd,
     headless: args['no-ui'],
@@ -242,7 +242,7 @@ async function handleContinue(args) {
 
   const { continueSidecar } = require('../src/index');
 
-  await continueSidecar({
+  return await continueSidecar({
     taskId,
     newTaskId: args['task-id'],
     briefing: args.prompt || args.briefing,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "1.7.6",
+  "version": "1.7.7",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [
     "claude",

package/src/sidecar/continue.js

@@ -108,7 +108,10 @@ function createContinueSessionMetadata(taskId, project, options, oldTaskId) {
   return sessionDir;
 }
 
-/** Continue from a previous sidecar session - Spec Reference: §4.4, §8.5 */
+/**
+ * Continue from a previous sidecar session - Spec Reference: §4.4, §8.5
+ * @returns {Promise<number>} process exit code
+ */
 async function continueSidecar(options) {
   const {
     taskId: oldTaskId,
@@ -171,10 +174,11 @@ async function continueSidecar(options) {
   const heartbeat = createHeartbeat();
 
   let summary;
+  let result;
 
   try {
     if (headless) {
-      const result = await runHeadless(
+      result = await runHeadless(
         model, systemPrompt, userMessage, newTaskId, project,
         timeout * 60 * 1000, effectiveAgent, { mcp: mcpServers }
       );
@@ -185,7 +189,7 @@ async function continueSidecar(options) {
       if (result.error) { logger.error('Continuation task error', { taskId: newTaskId, error: result.error }); }
     } else {
       logger.info('Launching interactive continue', { taskId: newTaskId, model });
-      const result = await runInteractive(
+      result = await runInteractive(
         model, systemPrompt, userMessage, newTaskId, project,
         { agent: effectiveAgent, mcp: mcpServers }
       );
@@ -205,9 +209,23 @@ async function continueSidecar(options) {
   const metaPath = SessionPaths.metadataFile(sessionDir);
   const meta = JSON.parse(fs.readFileSync(metaPath, 'utf-8'));
 
-  // Finalize session. Interactive mode legitimately returns an empty summary,
-  // so pass status explicitly to stay out of the #36 empty-summary guard.
-  finalizeSession(sessionDir, summary, project, meta, { status: 'complete' });
+  // Map the run result to the canonical terminal status + exit code — mirrors
+  // start.js; resolveTerminalState is the single source of truth. Passing the
+  // status explicitly also preserves the interactive empty-summary carve-out:
+  // a clean interactive run finalizes 'complete' without tripping the #36
+  // empty-summary guard.
+  const { resolveTerminalState } = require('./session-finalize');
+  const terminal = resolveTerminalState(result);
+  if (terminal.status === 'error') {
+    meta.status = 'error';
+    meta.reason = (result && result.error) ? String(result.error) : 'Incomplete';
+    meta.completedAt = new Date().toISOString();
+    fs.writeFileSync(metaPath, JSON.stringify(meta, null, 2), { mode: 0o600 });
+    logger.error('Continuation completed with error', { taskId: newTaskId, error: meta.reason });
+  } else {
+    finalizeSession(sessionDir, summary, project, meta, { status: terminal.status });
+  }
+  return terminal.exitCode;
 }
 
 module.exports = {

package/src/sidecar/resume.js

@@ -110,7 +110,10 @@ function updateSessionStatus(sessionDir, status) {
   return meta;
 }
 
-/** Resume a previous sidecar session - Spec Reference: §4.3, §8.3 */
+/**
+ * Resume a previous sidecar session - Spec Reference: §4.3, §8.3
+ * @returns {Promise<number>} process exit code
+ */
 async function resumeSidecar(options) {
   const {
     taskId, project = process.cwd(), headless = false, timeout = 15,
@@ -163,6 +166,7 @@ async function resumeSidecar(options) {
     heartbeat = createHeartbeat();
 
     let summary;
+    let result;
     const effectiveAgent = metadata.agent || 'Build';
 
     // Load conversation for both paths (interactive already did this, headless didn't)
@@ -173,7 +177,7 @@ async function resumeSidecar(options) {
 
     if (headless) {
       const userMessage = buildResumeUserMessage(metadata.briefing || '', existingConversation);
-      const result = await runHeadless(
+      result = await runHeadless(
         metadata.model, resumePrompt, userMessage,
         taskId, project, timeout * 60 * 1000, effectiveAgent, { mcp: mcpServers }
       );
@@ -184,7 +188,7 @@ async function resumeSidecar(options) {
     } else {
       logger.info('Launching interactive resume', { taskId, model: metadata.model });
 
-      const result = await runInteractive(
+      result = await runInteractive(
         metadata.model, resumePrompt, metadata.briefing || '',
         taskId, project,
         {
@@ -202,10 +206,22 @@ async function resumeSidecar(options) {
     // Output summary
     outputSummary(summary);
 
-    // Finalize session (use updatedMetadata which has resumedAt). Pass status
-    // explicitly to preserve the pre-#36 default ('complete') and stay out of
-    // the empty-summary guard — interactive resume legitimately has no summary.
-    finalizeSession(sessionDir, summary, project, updatedMetadata, { status: 'complete' });
+    // Map the run result to the canonical terminal status + exit code —
+    // mirrors start.js. Explicit status preserves the interactive
+    // empty-summary carve-out (the #36 guard never re-classifies it).
+    const { resolveTerminalState } = require('./session-finalize');
+    const terminal = resolveTerminalState(result);
+    const metaPath = SessionPaths.metadataFile(sessionDir);
+    if (terminal.status === 'error') {
+      updatedMetadata.status = 'error';
+      updatedMetadata.reason = (result && result.error) ? String(result.error) : 'Incomplete';
+      updatedMetadata.completedAt = new Date().toISOString();
+      fs.writeFileSync(metaPath, JSON.stringify(updatedMetadata, null, 2), { mode: 0o600 });
+      logger.error('Resume completed with error', { taskId, error: updatedMetadata.reason });
+    } else {
+      finalizeSession(sessionDir, summary, project, updatedMetadata, { status: terminal.status });
+    }
+    return terminal.exitCode; // finally below still releases the lock first
   } finally {
     if (heartbeat) { heartbeat.stop(); }
     releaseLock(sessionDir);

package/src/sidecar/start.js

@@ -23,6 +23,7 @@ const { acquireLock, releaseLock } = require('../utils/session-lock');
 const { loadMcpConfig, parseMcpSpec } = require('../opencode-client');
 const { mapAgentToOpenCode } = require('../utils/agent-mapping');
 const { discoverParentMcps } = require('../utils/mcp-discovery');
+const { stripSelfMcpEntries } = require('../utils/mcp-self-identity');
 
 /** Generate a unique 8-character hex task ID */
 function generateTaskId() {
@@ -117,13 +118,11 @@ function buildMcpConfig(options) {
     }
   }
 
-  // Always exclude the sidecar itself to prevent recursive spawning.
-  // When launched from Cowork, the discovered MCP list includes "sidecar"
-  // which would cause an infinite spawn loop.
-  if (mcpServers && mcpServers.sidecar) {
-    delete mcpServers.sidecar;
-    logger.debug('Auto-excluded sidecar MCP (recursive spawn prevention)');
-  }
+  // Always exclude amicus itself — under ANY registered name or aliased
+  // invocation — to prevent recursive spawning. When launched from Cowork or
+  // Claude Code the discovered list includes 'amicus'/'sidecar' (and possibly
+  // a user alias), which would cause an infinite spawn loop.
+  if (mcpServers) { stripSelfMcpEntries(mcpServers, logger); }
 
   // Apply explicit exclusions
   if (excludeMcp && Array.isArray(excludeMcp) && mcpServers) {

package/src/utils/error-doc.js

@@ -48,6 +48,9 @@ function failJson(useJson, { code, message, hint = null, command = null }) {
     process.stdout.write(JSON.stringify(buildErrorDoc({ code, message, hint, command }), null, 2) + '\n');
   } else {
     process.stderr.write(message + '\n');
+    // Parity with --json (whose envelope carries error.hint): surface the
+    // actionable hint to humans too, in doctor's arrow style.
+    if (hint) { process.stderr.write(`  → ${hint}\n`); }
   }
   return 1;
 }

package/src/utils/mcp-discovery.js

@@ -12,6 +12,7 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const { logger } = require('./logger');
+const { stripSelfMcpEntries } = require('./mcp-self-identity');
 
 /**
  * Normalize .mcp.json to a flat { name: config } map.
@@ -70,15 +71,13 @@ function discoverClaudeCodeMcps(claudeDir, claudeJsonPath) {
     const settingsPath = path.join(baseDir, 'settings.json');
     if (!fs.existsSync(settingsPath)) {
       // No settings.json — skip plugin discovery, may still have claude.json servers
-      const merged = { ...claudeJsonServers };
-      delete merged.sidecar;
+      const merged = stripSelfMcpEntries({ ...claudeJsonServers }, logger);
       return Object.keys(merged).length > 0 ? merged : null;
     }
     const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
     const enabledPlugins = settings.enabledPlugins;
     if (!enabledPlugins || typeof enabledPlugins !== 'object') {
-      const merged = { ...claudeJsonServers };
-      delete merged.sidecar;
+      const merged = stripSelfMcpEntries({ ...claudeJsonServers }, logger);
       return Object.keys(merged).length > 0 ? merged : null;
     }
 
@@ -133,11 +132,9 @@ function discoverClaudeCodeMcps(claudeDir, claudeJsonPath) {
     logger.debug('Failed to read Claude Code settings', { error: err.message });
   }
 
-  // Merge: plugin servers first, then claude.json overwrites (higher priority)
-  const merged = { ...pluginServers, ...claudeJsonServers };
-
-  // Always exclude sidecar itself to prevent recursive spawning
-  delete merged.sidecar;
+  // Merge: plugin servers first, then claude.json overwrites (higher priority).
+  // Recursive-spawn guard: drop every entry that resolves to amicus itself.
+  const merged = stripSelfMcpEntries({ ...pluginServers, ...claudeJsonServers }, logger);
 
   return Object.keys(merged).length > 0 ? merged : null;
 }

package/src/utils/mcp-self-identity.js

@@ -0,0 +1,69 @@
+'use strict';
+
+/**
+ * @module mcp-self-identity
+ * Recursive-spawn guard. A child sidecar that inherits an MCP entry launching
+ * amicus itself would spawn amicus inside amicus, forever. The shipped server
+ * registers as 'amicus' (scripts/postinstall.js, .claude-plugin/plugin.json)
+ * plus a deprecated 'sidecar' shim — and users can alias it under ANY name —
+ * so we exclude both reserved names AND any entry whose command+args resolve
+ * to an amicus MCP invocation.
+ */
+
+/** Server names amicus registers itself under. */
+const SELF_MCP_NAMES = Object.freeze(['amicus', 'sidecar']);
+
+/** Shipped bin aliases (package.json "bin") → ./bin/amicus.js */
+const SELF_BIN_NAMES = new Set(['amicus', 'am', 'sidecar', 'claude-sidecar']);
+
+/**
+ * Normalize one command/arg token for identity matching: lower-case, forward
+ * slashes, basename, strip a trailing .exe/.cmd/.js, strip an @version spec.
+ * 'C:\\x\\bin\\amicus.js' → 'amicus'; 'amicus@latest' → 'amicus'; 'npx' → 'npx'.
+ * @param {unknown} token
+ * @returns {string}
+ */
+function normalizeToken(token) {
+  const t = String(token).toLowerCase().replace(/\\/g, '/');
+  const base = t.includes('/') ? t.slice(t.lastIndexOf('/') + 1) : t;
+  return base.replace(/\.(exe|cmd|js)$/, '').replace(/@[^@]*$/, '');
+}
+
+/**
+ * True when this MCP server config would launch amicus's own MCP server:
+ * some non-flag token resolves to an amicus binary/package and a LATER token
+ * is 'mcp'. URL-only (command-less) configs are never self.
+ * @param {{command?:string, args?:unknown[]}|null|undefined} config
+ * @returns {boolean}
+ */
+function isAmicusMcpConfig(config) {
+  if (!config || typeof config !== 'object' || !config.command) { return false; }
+  const tokens = [config.command, ...(Array.isArray(config.args) ? config.args : [])].map(String);
+  for (let i = 0; i < tokens.length; i++) {
+    if (tokens[i].startsWith('-')) { continue; } // flags (-y, --yes) are never the binary
+    if (SELF_BIN_NAMES.has(normalizeToken(tokens[i]))) {
+      return tokens.slice(i + 1).some((t) => String(t).toLowerCase() === 'mcp');
+    }
+  }
+  return false;
+}
+
+/**
+ * Delete every self entry (reserved name OR command identity) from an
+ * mcpServers map. Mutates and returns the same object.
+ * @param {object|null|undefined} mcpServers
+ * @param {{debug?:Function}} [log]
+ * @returns {object|null|undefined}
+ */
+function stripSelfMcpEntries(mcpServers, log) {
+  if (!mcpServers || typeof mcpServers !== 'object') { return mcpServers; }
+  for (const name of Object.keys(mcpServers)) {
+    if (SELF_MCP_NAMES.includes(name) || isAmicusMcpConfig(mcpServers[name])) {
+      delete mcpServers[name];
+      if (log && log.debug) { log.debug('Auto-excluded amicus MCP entry (recursive spawn prevention)', { name }); }
+    }
+  }
+  return mcpServers;
+}
+
+module.exports = { SELF_MCP_NAMES, isAmicusMcpConfig, stripSelfMcpEntries, normalizeToken };

package/src/utils/shared-server.js

@@ -11,6 +11,7 @@ const { getCompatEnv } = require('./env-compat');
 const MAX_RESTARTS = 3;
 const RESTART_WINDOW = 5 * 60 * 1000;
 const RESTART_BACKOFF = 2000;
+const CRASH_POLL_INTERVAL = 5000; // ms; env-tunable via AMICUS_CRASH_POLL_MS
 
 /**
  * SharedServerManager - manages a single shared OpenCode server for MCP sessions.
@@ -45,6 +46,16 @@ class SharedServerManager {
 
     /** @type {number[]} Timestamps of recent restart attempts */
     this._restartTimestamps = [];
+
+    /** @type {NodeJS.Timeout|null} goPid liveness poll (H7) */
+    this._crashPoll = null;
+
+    /** @type {NodeJS.Timeout|null} Pending crash-restart backoff timer */
+    this._restartTimer = null;
+
+    /** Pid-liveness probe (test seam). Lazy default keeps construction light. */
+    this._isProcessAlive = options.isProcessAlive
+      || ((pid) => require('../sidecar/session-utils').isProcessAlive(pid));
   }
 
   /**
@@ -163,6 +174,8 @@ class SharedServerManager {
       this._serverWatchdog.cancel();
       this._serverWatchdog = null;
     }
+    this._stopCrashPoll();
+    if (this._restartTimer) { clearTimeout(this._restartTimer); this._restartTimer = null; }
     if (this.server) {
       this.server.close();
       this.server = null;
@@ -171,12 +184,10 @@ class SharedServerManager {
   }
 
   /**
-   * Wire crash detection onto a freshly started server handle so an unexpected
-   * exit triggers _onServerCrash (and the restart machinery). The OpenCode
-   * server handle is a plain wrapper; it may surface lifecycle events either on
-   * itself or on an underlying child `process`. Attach to whichever is an event
-   * emitter, guarding against double-wiring across restarts.
-   *
+   * Wire crash detection onto a freshly started server handle. The REAL handle
+   * from buildServerHandle is { url, goPid, close } — it surfaces NO lifecycle
+   * events, so the emitter path alone was dead code (H7). Detection now polls
+   * the Go engine pid; emitter wiring is kept for handles that do expose events.
    * @param {object} server - Server handle returned by _doStartServer
    */
   _wireCrashListener(server) {
@@ -185,19 +196,38 @@ class SharedServerManager {
       : (server && server.process && typeof server.process.on === 'function')
         ? server.process
         : null;
-    if (!emitter || emitter._amicusCrashWired) {
-      return;
+    if (emitter && !emitter._amicusCrashWired) {
+      emitter._amicusCrashWired = true;
+      const onExit = (code) => {
+        if (this.server !== server) { return; } // stale handle already replaced/closed
+        this._onServerCrash(code);
+      };
+      emitter.on('exit', onExit);
+      emitter.on('close', onExit);
+    }
+    if (server && server.goPid) {
+      this._startCrashPoll(server);
+    } else if (!emitter) {
+      this.logger.debug?.('Server handle has no goPid and no emitter — crash detection unavailable');
     }
-    emitter._amicusCrashWired = true;
-    const onExit = (code) => {
-      // Ignore exits from a stale handle we have already replaced/closed.
-      if (this.server !== server) {
-        return;
+  }
+
+  /** Poll the Go engine pid; pid death IS the crash signal (H7). */
+  _startCrashPoll(server) {
+    this._stopCrashPoll();
+    const interval = Number(getCompatEnv('CRASH_POLL_MS')) || CRASH_POLL_INTERVAL;
+    this._crashPoll = setInterval(() => {
+      if (this.server !== server) { this._stopCrashPoll(); return; }
+      if (!this._isProcessAlive(server.goPid)) {
+        this._stopCrashPoll();
+        this._onServerCrash(null);
       }
-      this._onServerCrash(code);
-    };
-    emitter.on('exit', onExit);
-    emitter.on('close', onExit);
+    }, interval);
+    if (this._crashPoll.unref) { this._crashPoll.unref(); }
+  }
+
+  _stopCrashPoll() {
+    if (this._crashPoll) { clearInterval(this._crashPoll); this._crashPoll = null; }
   }
 
   /**
@@ -206,13 +236,15 @@ class SharedServerManager {
    * @param {number} exitCode - Process exit code from the crashed server
    */
   _onServerCrash(exitCode) {
+    this._stopCrashPoll();
     this.logger.error?.('Shared server crashed', { exitCode });
     for (const [id] of this._sessionWatchdogs) {
       this.logger.warn?.('Session interrupted by server crash', { sessionId: id });
     }
     this.server = null;
     this.client = null;
-    setTimeout(() => this._handleRestart(), RESTART_BACKOFF);
+    this._restartTimer = setTimeout(() => this._handleRestart(), RESTART_BACKOFF);
+    if (this._restartTimer.unref) { this._restartTimer.unref(); }
   }
 
   /**