claude-dev-env 2.7.1 → 2.8.0

package/skills/autoconverge/workflow/converge.contract.test.mjs

@@ -411,8 +411,13 @@ test('the shared verdict-fence builder names the binding-hash command and the ve
     /verification_verdict_store\.py/,
     'expected the verdict-store script that computes the binding hash to be named',
   );
-  assert.match(fenceBuilder, /```verdict/, 'expected the verdict fence to be specified');
-  assert.match(fenceBuilder, /manifest_sha256/, 'expected the verdict fence to carry manifest_sha256');
+  assert.match(fenceBuilder, /buildVerdictFenceTail\(/, 'expected the fence builder to close with the shared fence tail');
+  const renderedFenceTail = loadVerdictFenceTailBuilder()('');
+  assert.match(renderedFenceTail, /```verdict/, 'expected the verdict fence to be specified');
+  assert.ok(
+    renderedFenceTail.includes(VERDICT_FENCE_JSON_LINE),
+    'expected the verdict fence to carry manifest_sha256',
+  );
   assert.match(
     fenceBuilder,
     /gh pr view/,
@@ -425,6 +430,100 @@ test('the shared verdict-fence builder names the binding-hash command and the ve
   );
 });
 
+test('the incomplete-verdict contract sentence is written once and used by both verify paths', () => {
+  const sentenceOccurrences = convergeSource.split(
+    'name that check in prose directly above the fence rather than in findings',
+  ).length - 1;
+  assert.equal(
+    sentenceOccurrences,
+    1,
+    'expected the incomplete-verdict contract sentence to be written exactly once so the two verify paths cannot drift',
+  );
+  assert.match(
+    lensPromptBody('buildVerdictFenceTail'),
+    /VERDICT_FENCE_CONTRACT_SENTENCE/,
+    'expected the shared fence tail to use the one contract sentence',
+  );
+  assert.match(
+    lensPromptBody('buildVerdictFenceSteps'),
+    /buildVerdictFenceTail\(/,
+    'expected the gh-lookup fence builder to reach the contract sentence through the shared fence tail',
+  );
+  assert.match(
+    lensPromptBody('runVerifierTask'),
+    /buildVerdictFenceTail\(/,
+    'expected the hardening-verify prompt to reach the contract sentence through the shared fence tail',
+  );
+});
+
+const VERDICT_FENCE_JSON_LINE = '{"all_pass": true, "findings": [], "manifest_sha256": "<that hash>"}';
+const VERDICT_FENCE_LEAD_IN = 'END your message with a fenced verdict block exactly in this shape';
+
+function countOccurrences(haystack, needle) {
+  return haystack.split(needle).length - 1;
+}
+
+function loadVerdictFenceTailBuilder() {
+  const sentenceMatch = /const VERDICT_FENCE_CONTRACT_SENTENCE =\s*\n?\s*'[^']*'/.exec(convergeSource);
+  assert.notEqual(sentenceMatch, null, 'expected VERDICT_FENCE_CONTRACT_SENTENCE to be declared as one string literal');
+  const builderSource = lensPromptBody('buildVerdictFenceTail');
+  return new Function(
+    `${sentenceMatch[0]}\n${builderSource}\nreturn buildVerdictFenceTail;`,
+  )();
+}
+
+test('the verdict fence recipe is written once — no verify path re-inlines its own copy', () => {
+  assert.equal(
+    countOccurrences(convergeSource, VERDICT_FENCE_JSON_LINE),
+    1,
+    'expected the verdict fence JSON skeleton to be written exactly once so no verify path can drift from the shared recipe',
+  );
+  assert.equal(
+    countOccurrences(convergeSource, VERDICT_FENCE_LEAD_IN),
+    1,
+    'expected the fence lead-in sentence to be written exactly once so no verify path can drift from the shared recipe',
+  );
+  assert.match(
+    lensPromptBody('buildVerdictFenceSteps'),
+    /buildVerdictFenceTail\(/,
+    'expected the gh-lookup binding path to render its fence through the shared tail builder',
+  );
+  assert.match(
+    lensPromptBody('runVerifierTask'),
+    /buildVerdictFenceTail\(/,
+    'expected the hardening-verify path to render its fence through the shared tail builder',
+  );
+});
+
+test('the shared fence tail renders the same fence JSON and contract sentence at every indent', () => {
+  const buildVerdictFenceTail = loadVerdictFenceTailBuilder();
+  const topLevelTail = buildVerdictFenceTail('');
+  const nestedTail = buildVerdictFenceTail('   ');
+  for (const [siteName, renderedTail] of [['top-level', topLevelTail], ['nested', nestedTail]]) {
+    assert.ok(
+      renderedTail.includes(VERDICT_FENCE_JSON_LINE),
+      `expected the ${siteName} fence tail to carry the verdict JSON skeleton`,
+    );
+    assert.ok(
+      renderedTail.includes(VERDICT_FENCE_LEAD_IN),
+      `expected the ${siteName} fence tail to carry the fence lead-in sentence`,
+    );
+    assert.ok(
+      renderedTail.includes('```verdict'),
+      `expected the ${siteName} fence tail to open a verdict fence`,
+    );
+    assert.ok(
+      renderedTail.includes('name that check in prose directly above the fence rather than in findings'),
+      `expected the ${siteName} fence tail to carry the one incomplete-verdict contract sentence`,
+    );
+  }
+  assert.equal(
+    nestedTail,
+    topLevelTail.split('\n').map((eachLine) => `   ${eachLine}`).join('\n'),
+    'expected indent to be the only difference between the two rendered fence tails',
+  );
+});
+
 test('the verdict-fence binding does not self-resolve a cwd via git rev-parse for the manifest hash', () => {
   const fenceBuilder = lensPromptBody('buildVerdictFenceSteps');
   assert.doesNotMatch(
@@ -1006,6 +1105,7 @@ test('the whole priming spawn-agent family is removed — every dispatcher spawn
 
 test('parseLastVerdictFence returns non-null for a verdict fence with valid JSON', () => {
   const parseModule = new Function(
+    `${functionSource('findLastVerdictFence')}\n` +
     `${functionSource('parseLastVerdictFence')}\n` +
     'return { parseLastVerdictFence };',
   )();
@@ -1016,6 +1116,7 @@ test('parseLastVerdictFence returns non-null for a verdict fence with valid JSON
 
 test('parseLastVerdictFence returns null for non-string input', () => {
   const parseModule = new Function(
+    `${functionSource('findLastVerdictFence')}\n` +
     `${functionSource('parseLastVerdictFence')}\n` +
     'return { parseLastVerdictFence };',
   )();
@@ -1025,6 +1126,7 @@ test('parseLastVerdictFence returns null for non-string input', () => {
 
 test('parseLastVerdictFence returns null when no verdict fence is present', () => {
   const parseModule = new Function(
+    `${functionSource('findLastVerdictFence')}\n` +
     `${functionSource('parseLastVerdictFence')}\n` +
     'return { parseLastVerdictFence };',
   )();
@@ -1033,6 +1135,7 @@ test('parseLastVerdictFence returns null when no verdict fence is present', () =
 
 test('parseLastVerdictFence returns null for malformed JSON in the fence', () => {
   const parseModule = new Function(
+    `${functionSource('findLastVerdictFence')}\n` +
     `${functionSource('parseLastVerdictFence')}\n` +
     'return { parseLastVerdictFence };',
   )();

package/skills/autoconverge/workflow/converge.fix-recovery.test.mjs

@@ -255,7 +255,8 @@ test('the round-loop fix-stalled blockers survive the recovery wiring', () => {
 });
 
 const verifyObjectionModule = new Function(
-  `${functionSource('parseLastVerdictFence')}\n` +
+  `${functionSource('findLastVerdictFence')}\n` +
+    `${functionSource('parseLastVerdictFence')}\n` +
     `${constantLine('VERIFY_OBJECTION_FALLBACK')}\n` +
     `${functionSource('renderVerifyObjectionLine')}\n` +
     `${functionSource('extractPreFenceProse')}\n` +
@@ -350,6 +351,38 @@ test('the prose reader anchors on the last CLOSED fence, not a stray unterminate
   assert.doesNotMatch(objection, /all_pass/, 'expected the verdict body never to be read back as prose');
 });
 
+test('both fence readers locate the fence through the one shared locator', () => {
+  assert.match(
+    functionSource('parseLastVerdictFence'),
+    /findLastVerdictFence\(/,
+    'expected the verdict parser to locate its fence through findLastVerdictFence',
+  );
+  assert.match(
+    functionSource('extractPreFenceProse'),
+    /findLastVerdictFence\(/,
+    'expected the prose reader to locate its fence through findLastVerdictFence, not a second search',
+  );
+  assert.doesNotMatch(
+    functionSource('extractPreFenceProse'),
+    /lastIndexOf\(/,
+    'expected no second fence-search procedure in the prose reader to drift from the parser',
+  );
+});
+
+test('the prose reader and the verdict parser land on the same fence when a later marker carries no newline', () => {
+  const transcript =
+    'check X never showed red\n\n' +
+    '```verdict\n{"all_pass": false, "findings": []}\n```\n\n' +
+    '```verdict {"all_pass": true, "findings": []}```';
+  const objection = extractVerifyObjection(transcript);
+  assert.doesNotMatch(
+    objection,
+    /all_pass/,
+    'expected the prose reader to anchor on the fence the parser read, never to slice a verdict body in as prose',
+  );
+  assert.equal(objection, 'check X never showed red');
+});
+
 test('the prose reader skips a scaffolding-only paragraph above the fence', () => {
   const transcript =
     'check X never showed red\n\n' + '## Verdict\n\n' + '```verdict\n{"all_pass": false, "findings": []}\n```';

package/skills/autoconverge/workflow/converge.mjs

@@ -466,11 +466,7 @@ function runVerifierTask(task, context) {
       `   Run exactly:\n` +
       `      "C:\\Python313\\python.exe" "<REPO>/packages/claude-dev-env/hooks/blocking/verification_verdict_store.py" --manifest-hash-for-branch "${context.hardeningBranch}"\n` +
       `   (substitute the REPO path you resolved for the script path). That prints a single 64-char hex hash on stdout — capture it.\n` +
-      `   Then END your message with a fenced verdict block exactly in this shape, on its own, carrying that hash:\n` +
-      "      ```verdict\n" +
-      `      {"all_pass": true, "findings": [], "manifest_sha256": "<that hash>"}\n` +
-      "      ```\n" +
-      `      Set all_pass to false when verification fails, and list every code defect you found in findings. When the verdict is incomplete because a check it rests on never showed red, set all_pass to false and name that check in prose directly above the fence rather than in findings. Always include the manifest_sha256. The verdict fence must be the last thing in your message.`,
+      buildVerdictFenceTail('   '),
     { label, phase: 'Converge', agentType: 'code-verifier', ...TIERS.sonnetMedium },
   )
 }
@@ -849,6 +845,29 @@ const HARDENING_COMMIT_SCHEMA = {
   required: ['hardeningPrUrl', 'summary'],
 }
 
+const VERDICT_FENCE_CONTRACT_SENTENCE =
+  'Set all_pass to false when verification fails, and list every code defect you found in findings. When the verdict is incomplete because a check it rests on never showed red, set all_pass to false and name that check in prose directly above the fence rather than in findings. Always include the manifest_sha256. The verdict fence must be the last thing in your message.'
+
+/**
+ * Build the closing fence recipe every verify prompt ends with: the lead-in
+ * sentence, the ```verdict block shape carrying the binding hash, and the
+ * contract sentence. Each verify path resolves the binding hash its own way
+ * and sits at its own nesting depth, so the caller passes the indent its
+ * surrounding prose uses; the fence body itself sits one level deeper.
+ * @param {string} indent leading whitespace the caller's prose sits at
+ * @returns {string} the fence recipe tail for a verify prompt
+ */
+function buildVerdictFenceTail(indent) {
+  const fenceIndent = `${indent}   `
+  return (
+    `${indent}Then END your message with a fenced verdict block exactly in this shape, on its own, carrying that hash:\n` +
+    `${fenceIndent}` + "```verdict\n" +
+    `${fenceIndent}{"all_pass": true, "findings": [], "manifest_sha256": "<that hash>"}\n` +
+    `${fenceIndent}` + "```\n" +
+    `${fenceIndent}${VERDICT_FENCE_CONTRACT_SENTENCE}`
+  )
+}
+
 /**
  * Build the verdict-fence step instructions for a verify agent, binding the
  * surface hash by branch name rather than by a self-resolved cwd. Resolving
@@ -869,11 +888,7 @@ function buildVerdictFenceSteps(prOwner, prRepo, prNumber) {
     `   b. Run exactly:\n` +
     `         "C:\\Python313\\python.exe" "<REPO>/packages/claude-dev-env/hooks/blocking/verification_verdict_store.py" --manifest-hash-for-branch "<that branch>"\n` +
     `      (substitute the REPO path you resolved for the script path, and the branch name for <that branch>). That prints a single 64-char hex hash on stdout — capture it.\n` +
-    `Then END your message with a fenced verdict block exactly in this shape, on its own, carrying that hash:\n` +
-    "   ```verdict\n" +
-    `   {"all_pass": true, "findings": [], "manifest_sha256": "<that hash>"}\n` +
-    "   ```\n" +
-    `   Set all_pass to false when verification fails, and list every code defect you found in findings. When the verdict is incomplete because a check it rests on never showed red, set all_pass to false and name that check in prose directly above the fence rather than in findings. Always include the manifest_sha256. The verdict fence must be the last thing in your message.`
+    buildVerdictFenceTail('')
   )
 }
 
@@ -1282,23 +1297,45 @@ function normalizeShaForComparison(sha) {
 }
 
 /**
- * Parse the LAST ```verdict ...``` fenced JSON block from a transcript.
- * Guards against non-string input, iterates all fence matches for the last one,
- * parses the JSON, and returns the object or null on any failure.
+ * Locate the LAST ```verdict ...``` fence in a transcript: the marker, optional
+ * whitespace, a required newline, then a body closed by ```. This is the ONE
+ * definition of "the verdict fence" — the verdict parser and the pre-fence prose
+ * reader both anchor here, so they cannot land on different fences.
+ *
+ * ::
+ *
+ *   ok:   'note\n\n```verdict\n{}\n```'  -> body '{}\n' starting at index 6
+ *   flag: 'note\n\n```verdict {}```'     -> null (no newline after the marker)
+ *
+ * A marker with no newline after it is not a fence, so a later one cannot pull
+ * either reader off the fence the other reads.
+ *
  * @param {string|null|undefined} transcript the agent transcript text
- * @returns {object|null} the parsed verdict object, or null when absent or malformed
+ * @returns {{bodyText: string, startIndex: number}|null} the last fence, or null when there is none
  */
-function parseLastVerdictFence(transcript) {
+function findLastVerdictFence(transcript) {
   if (typeof transcript !== 'string') return null
   const fencePattern = /```verdict\s*\n([\s\S]*?)```/g
-  let lastFenceBody = null
+  let lastFence = null
   let eachMatch
   while ((eachMatch = fencePattern.exec(transcript)) !== null) {
-    lastFenceBody = eachMatch[1]
+    lastFence = { bodyText: eachMatch[1], startIndex: eachMatch.index }
   }
-  if (lastFenceBody === null) return null
+  return lastFence
+}
+
+/**
+ * Parse the LAST ```verdict ...``` fenced JSON block from a transcript.
+ * Guards against non-string input, takes the fence findLastVerdictFence locates,
+ * parses the JSON, and returns the object or null on any failure.
+ * @param {string|null|undefined} transcript the agent transcript text
+ * @returns {object|null} the parsed verdict object, or null when absent or malformed
+ */
+function parseLastVerdictFence(transcript) {
+  const lastFence = findLastVerdictFence(transcript)
+  if (lastFence === null) return null
   try {
-    return JSON.parse(lastFenceBody)
+    return JSON.parse(lastFence.bodyText)
   } catch {
     return null
   }
@@ -1351,12 +1388,13 @@ function renderVerifyObjectionLine(eachFinding) {
  * is not a code defect, so the fence contract puts that reason here rather than
  * in findings; this reader is how the reason survives into the re-fix step.
  *
- * Anchors on the same fence parseLastVerdictFence reads — the last CLOSED
- * verdict fence, not the last bare marker — so a stray unterminated marker after
- * the real fence can never make this read the verdict body itself as prose. A
- * candidate paragraph carrying only markdown scaffolding (a heading, a fence
- * delimiter) is skipped, since handing the fixer a heading is worse than the
- * generic fallback the caller keeps.
+ * Anchors through findLastVerdictFence, the single locator parseLastVerdictFence
+ * reads its JSON from, so both readers see the same fence by construction rather
+ * than by two searches that happen to agree: a stray marker after the real fence
+ * — unterminated, or closed but carrying no newline after the marker — moves
+ * neither reader. A candidate paragraph carrying only markdown scaffolding (a
+ * heading, a fence delimiter) is skipped, since handing the fixer a heading is
+ * worse than the generic fallback the caller keeps.
  *
  * ::
  *
@@ -1368,15 +1406,10 @@ function renderVerifyObjectionLine(eachFinding) {
  * @returns {string|null} the last prose paragraph above the final fence, or null when there is none
  */
 function extractPreFenceProse(verifyTranscript) {
-  if (typeof verifyTranscript !== 'string') return null
-  const fenceMarker = '```verdict'
-  let lastFenceStart = verifyTranscript.lastIndexOf(fenceMarker)
-  while (lastFenceStart !== -1 && !verifyTranscript.slice(lastFenceStart + fenceMarker.length).includes('```')) {
-    lastFenceStart = verifyTranscript.lastIndexOf(fenceMarker, lastFenceStart - 1)
-  }
-  if (lastFenceStart === -1) return null
+  const lastFence = findLastVerdictFence(verifyTranscript)
+  if (lastFence === null) return null
   const proseParagraphs = verifyTranscript
-    .slice(0, lastFenceStart)
+    .slice(0, lastFence.startIndex)
     .split(/\n\s*\n/)
     .map((eachParagraph) => eachParagraph.trim())
     .filter((eachParagraph) =>

package/skills/codex-review/scripts/codex_review_scripts_constants/codex_usage_probe_constants.py

@@ -22,10 +22,6 @@ WINDOWS_OS_NAME = "nt"
 WINDOWS_COMMAND_SHELL = "cmd"
 WINDOWS_COMMAND_SHELL_RUN_FLAG = "/c"
 ALL_WINDOWS_SCRIPT_SUFFIXES = (".cmd", ".bat")
-WINDOWS_TASKKILL_COMMAND = "taskkill"
-WINDOWS_TASKKILL_FORCE_FLAG = "/F"
-WINDOWS_TASKKILL_TREE_FLAG = "/T"
-WINDOWS_TASKKILL_PID_FLAG = "/PID"
 
 JSONRPC_VERSION = "2.0"
 JSONRPC_KEY_ID = "id"

package/skills/codex-review/scripts/codex_usage_probe.py

@@ -40,9 +40,21 @@ import sys
 import threading
 from collections.abc import Mapping, Sequence
 from datetime import datetime, timezone
+from pathlib import Path
 from typing import IO, Protocol
 
-from codex_review_scripts_constants.codex_usage_probe_constants import (
+_shared_process_tree_scripts_directory = (
+    Path(__file__).resolve().parents[3] / "_shared" / "process-tree" / "scripts"
+)
+if str(_shared_process_tree_scripts_directory) not in sys.path:
+    sys.path.insert(0, str(_shared_process_tree_scripts_directory))
+
+from process_tree_kill import (  # noqa: E402
+    should_start_new_session,
+    terminate_process_tree,
+)
+
+from codex_review_scripts_constants.codex_usage_probe_constants import (  # noqa: E402
     ALL_APP_SERVER_COMMAND_PARTS,
     ALL_WINDOWS_SCRIPT_SUFFIXES,
     APP_SERVER_TIMEOUT_SECONDS,
@@ -94,10 +106,6 @@ from codex_review_scripts_constants.codex_usage_probe_constants import (
     WINDOWS_COMMAND_SHELL,
     WINDOWS_COMMAND_SHELL_RUN_FLAG,
     WINDOWS_OS_NAME,
-    WINDOWS_TASKKILL_COMMAND,
-    WINDOWS_TASKKILL_FORCE_FLAG,
-    WINDOWS_TASKKILL_PID_FLAG,
-    WINDOWS_TASKKILL_TREE_FLAG,
 )
 
 
@@ -387,41 +395,19 @@ def _collect_server_lines(
 
 
 def _terminate_process_tree(server_process: subprocess.Popen[str]) -> None:
-    """Stop the app-server process and any children it launched.
+    """Stop the app-server process and any children it launched, then reap it.
 
     On Windows the probe may wrap a ``.cmd``/``.bat`` shim as ``cmd /c``, so
     ``Popen.pid`` is ``cmd.exe``. Killing only that process leaves the real
-    Codex app-server grandchild alive and holding stdout. ``taskkill /T``
-    tears down the whole tree; other platforms use ``kill()``.
+    Codex app-server grandchild alive and holding stdout. The shared tree kill
+    ends the whole tree on either platform; the timed wait that follows reaps
+    the direct child so the enclosing ``with`` block exits without a long wait.
     """
-    if server_process.poll() is not None:
-        return
-    process_id = server_process.pid
-    if process_id is None:
-        return
-    if os.name == WINDOWS_OS_NAME:
-        subprocess.run(
-            [
-                WINDOWS_TASKKILL_COMMAND,
-                WINDOWS_TASKKILL_FORCE_FLAG,
-                WINDOWS_TASKKILL_TREE_FLAG,
-                WINDOWS_TASKKILL_PID_FLAG,
-                str(process_id),
-            ],
-            check=False,
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-        )
-        try:
-            server_process.wait(timeout=PROCESS_TREE_WAIT_TIMEOUT_SECONDS)
-        except subprocess.TimeoutExpired:
-            server_process.kill()
-        return
-    server_process.kill()
+    terminate_process_tree(server_process)
     try:
         server_process.wait(timeout=PROCESS_TREE_WAIT_TIMEOUT_SECONDS)
     except subprocess.TimeoutExpired:
-        pass
+        return
 
 
 def _teardown_app_server_exchange(
@@ -467,6 +453,7 @@ def _exchange_app_server_messages_via_subprocess(
         text=True,
         encoding=UTF8_ENCODING,
         shell=False,
+        start_new_session=should_start_new_session(),
     ) as server_process:
         server_stdin = server_process.stdin
         server_stdout = server_process.stdout

package/skills/codex-review/scripts/run_codex_review.py

@@ -18,22 +18,29 @@ import json
 import os
 import re
 import shutil
-import signal
 import subprocess
+import sys
 from dataclasses import dataclass
 from pathlib import Path
 
-from codex_review_scripts_constants.codex_usage_probe_constants import (
+_shared_process_tree_scripts_directory = (
+    Path(__file__).resolve().parents[3] / "_shared" / "process-tree" / "scripts"
+)
+if str(_shared_process_tree_scripts_directory) not in sys.path:
+    sys.path.insert(0, str(_shared_process_tree_scripts_directory))
+
+from process_tree_kill import (  # noqa: E402
+    should_start_new_session,
+    terminate_process_tree,
+)
+
+from codex_review_scripts_constants.codex_usage_probe_constants import (  # noqa: E402
     ALL_WINDOWS_SCRIPT_SUFFIXES,
     WINDOWS_COMMAND_SHELL,
     WINDOWS_COMMAND_SHELL_RUN_FLAG,
     WINDOWS_OS_NAME,
-    WINDOWS_TASKKILL_COMMAND,
-    WINDOWS_TASKKILL_FORCE_FLAG,
-    WINDOWS_TASKKILL_PID_FLAG,
-    WINDOWS_TASKKILL_TREE_FLAG,
 )
-from codex_review_scripts_constants.run_constants import (
+from codex_review_scripts_constants.run_constants import (  # noqa: E402
     ALL_SHAPE_PROBE_REQUIRED_FLAGS,
     BASE_TARGET_FLAG,
     CAPTURE_STREAMS_KEYWORD,
@@ -74,61 +81,6 @@ from codex_review_scripts_constants.run_constants import (
 )
 
 
-def _kill_windows_process_tree(process_identifier: int) -> None:
-    """Kill a Windows process and every descendant it started, by PID.
-
-    Swallows taskkill failures so the caller can fall back to ``Popen.kill()``
-    and a timed drain. A raised ``TimeoutExpired`` here would replace the
-    original review-timeout exception and skip that drain path.
-    """
-    try:
-        subprocess.run(
-            [
-                WINDOWS_TASKKILL_COMMAND,
-                WINDOWS_TASKKILL_TREE_FLAG,
-                WINDOWS_TASKKILL_FORCE_FLAG,
-                WINDOWS_TASKKILL_PID_FLAG,
-                str(process_identifier),
-            ],
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-            check=False,
-            timeout=PROCESS_TREE_KILL_TIMEOUT_SECONDS,
-        )
-    except (subprocess.TimeoutExpired, OSError):
-        return
-
-
-def _kill_posix_process_group(process_identifier: int) -> None:
-    """Kill a POSIX process group so no grandchild keeps the capture pipe open."""
-    try:
-        process_group_identifier = os.getpgid(process_identifier)
-        os.killpg(process_group_identifier, signal.SIGKILL)
-    except (ProcessLookupError, PermissionError):
-        return
-
-
-def _terminate_process_tree(review_process: subprocess.Popen[str]) -> None:
-    """Kill the review process and every descendant it spawned.
-
-    Tree kill first (taskkill /T or killpg). When the direct child is still
-    alive after that, fall back to ``Popen.kill()`` so ``Popen.__exit__`` never
-    hits an unbounded wait on a surviving process.
-    """
-    if review_process.poll() is not None:
-        return
-    if os.name == WINDOWS_OS_NAME:
-        _kill_windows_process_tree(review_process.pid)
-    else:
-        _kill_posix_process_group(review_process.pid)
-    if review_process.poll() is not None:
-        return
-    try:
-        review_process.kill()
-    except ProcessLookupError:
-        return
-
-
 def _open_codex_popen(
     all_arguments: list[str],
     all_keyword_arguments: dict[str, object],
@@ -147,7 +99,7 @@ def _open_codex_popen(
         text=bool(all_keyword_arguments.get(TEXT_MODE_KEYWORD, False)),
         encoding=stream_encoding if isinstance(stream_encoding, str) else None,
         env=process_environment if isinstance(process_environment, dict) else None,
-        start_new_session=os.name != WINDOWS_OS_NAME,
+        start_new_session=should_start_new_session(),
     )
 
 
@@ -198,7 +150,7 @@ def _communicate_with_tree_kill_on_timeout(
     try:
         return review_process.communicate(timeout=timeout_seconds)
     except subprocess.TimeoutExpired:
-        _terminate_process_tree(review_process)
+        terminate_process_tree(review_process)
         _drain_process_after_tree_kill(review_process)
         raise