context-mode 1.0.168 → 2.0.0-next.5

package/build/util/project-dir.js

@@ -1,340 +0,0 @@
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { workspaceEnvVarsFor } from "../adapters/detect.js";
-/**
- * Universal escape hatch. NEVER appears in any platform's foreignWorkspaceEnv()
- * (because it isn't registered in PLATFORM_ENV_VARS), so it survives strict
- * mode and bridge env scrubs. Documented as the cross-strict user override
- * for every adapter (set in `~/.<host>/mcp.json` env when nothing else works).
- */
-const UNIVERSAL_WORKSPACE_ENV = ["CONTEXT_MODE_PROJECT_DIR"];
-/**
- * Frozen legacy candidate list — preserves bit-for-bit behavior of every
- * non-strict caller (`start.mjs` and any caller that doesn't pass
- * `strictPlatform`). Order is locked for semver compatibility.
- *
- * If a new adapter is added, DO NOT add its workspace var here — register it
- * in `PLATFORM_ENV_VARS` and let strict callers pick it up via
- * `workspaceEnvVarsFor(platform)`. Strict mode is the default forward path.
- */
-const LEGACY_NON_STRICT_CANDIDATES = [
-    "CLAUDE_PROJECT_DIR",
-    "GEMINI_PROJECT_DIR",
-    "VSCODE_CWD",
-    "OPENCODE_PROJECT_DIR",
-    "PI_PROJECT_DIR",
-    "IDEA_INITIAL_DIRECTORY",
-    "CURSOR_CWD",
-    "CONTEXT_MODE_PROJECT_DIR",
-];
-/**
- * Project-dir resolution helpers — shared between `start.mjs` (the MCP entry
- * point) and `src/server.ts getProjectDir()` (the consumer).
- *
- * Background: when Claude Code runs `/ctx-upgrade`, it kills + respawns the
- * MCP server. The respawn happens with `cwd` set to the plugin install
- * directory (`~/.claude/plugins/cache/context-mode/context-mode/<version>/`).
- * The legacy `start.mjs` then set `CLAUDE_PROJECT_DIR = originalCwd`, which
- * poisoned every downstream `ctx_stats` / SessionDB / hash computation —
- * sessions silently re-rooted under the plugin install path.
- *
- * Defense-in-depth fix (v1.0.113):
- *   - `start.mjs` calls `isPluginInstallPath(originalCwd)` and skips the env
- *     auto-set when true (no poisoning at the source).
- *   - `getProjectDir()` calls `resolveProjectDir(...)` which rejects plugin-
- *     pathed env vars and the plugin cwd, preferring `process.env.PWD`
- *     (shell-set, survives `process.chdir`) before falling back.
- */
-/**
- * Detect whether a path lives inside an agent plugin install tree —
- * specifically `<home>/.claude/plugins/cache/<plugin>/<plugin>/<version>/`,
- * `<home>/.codex/plugins/cache/<plugin>/<plugin>/<version>/`, or the
- * marketplace mirror under `<home>/.{claude,codex}/plugins/marketplaces/...`.
- *
- * Cross-OS: matches both POSIX (`/`) and Windows (`\`) path separators.
- * Independent of `home` location — we only care about the agent plugin
- * suffix pattern.
- */
-export function isPluginInstallPath(p) {
-    if (!p)
-        return false;
-    return /[/\\]\.(claude|codex)[/\\]plugins[/\\](cache|marketplaces)[/\\]/.test(p);
-}
-/**
- * Read the per-session project dir from Claude Code's transcript files.
- *
- * Claude Code writes session transcripts under
- * `~/.claude/projects/<encoded-cwd>/<session-id>.jsonl`. Each line is a JSON
- * event; an early line (typically line 2) carries a `cwd` field with the
- * literal project directory the session is running against. The encoded dir
- * name itself is lossy (`/` and `.` both become `-`), so we read the JSONL.
- *
- * This is the strongest available signal when Claude Code does NOT propagate
- * `CLAUDE_PROJECT_DIR` to the spawned MCP env (the common case when Claude
- * Code is launched from the desktop app rather than `cd <project> && claude`).
- *
- * Returns `undefined` when no transcript exists, the projects dir is empty,
- * or no transcript carries a `cwd` field — caller falls through.
- *
- * Multi-window safety: the most-recently-modified jsonl wins. When the user
- * actively talks to one Claude Code window, that window's transcript is the
- * one being written to RIGHT NOW, so its mtime is freshest. Other windows'
- * transcripts have older mtimes and are correctly ignored.
- */
-export function resolveProjectDirFromTranscript(opts) {
-    if (!fs.existsSync(opts.projectsRoot))
-        return undefined;
-    let bestPath;
-    let bestMtime = 0;
-    try {
-        for (const dir of fs.readdirSync(opts.projectsRoot)) {
-            const dirPath = path.join(opts.projectsRoot, dir);
-            let stat;
-            try {
-                stat = fs.statSync(dirPath);
-            }
-            catch {
-                continue;
-            }
-            if (!stat.isDirectory())
-                continue;
-            let files;
-            try {
-                files = fs.readdirSync(dirPath);
-            }
-            catch {
-                continue;
-            }
-            for (const f of files) {
-                if (!f.endsWith(".jsonl"))
-                    continue;
-                const fp = path.join(dirPath, f);
-                try {
-                    const m = fs.statSync(fp).mtimeMs;
-                    if (m > bestMtime) {
-                        bestMtime = m;
-                        bestPath = fp;
-                    }
-                }
-                catch { /* skip */ }
-            }
-        }
-    }
-    catch {
-        return undefined;
-    }
-    if (!bestPath)
-        return undefined;
-    if (typeof opts.maxAgeMs === "number") {
-        const nowMs = opts.nowMs ?? Date.now();
-        if (nowMs - bestMtime > opts.maxAgeMs)
-            return undefined;
-    }
-    // Read first ~10 lines until we find a cwd field. The jsonl is
-    // append-only and can be huge (60+ MB on long sessions) — never load it
-    // into memory; stream a small head buffer.
-    try {
-        const fd = fs.openSync(bestPath, "r");
-        try {
-            const buf = Buffer.alloc(8192);
-            const bytes = fs.readSync(fd, buf, 0, buf.length, 0);
-            const text = buf.subarray(0, bytes).toString("utf-8");
-            for (const line of text.split("\n").slice(0, 10)) {
-                if (!line.trim())
-                    continue;
-                try {
-                    const obj = JSON.parse(line);
-                    if (typeof obj.cwd === "string" && obj.cwd.length > 0)
-                        return obj.cwd;
-                }
-                catch { /* skip malformed line */ }
-            }
-        }
-        finally {
-            fs.closeSync(fd);
-        }
-    }
-    catch { /* file vanished mid-read */ }
-    return undefined;
-}
-/**
- * Issue #45 / c4529042182 — recover the project-cwd from a Codex CLI
- * session log when the spawned MCP child inherits a non-project cwd
- * (e.g. $HOME when Codex was launched from anywhere outside the project).
- *
- * Codex writes its session transcripts to either
- * `${CODEX_HOME ?? ~/.codex}/sessions/<uuid>.jsonl` (CLI) or a dated desktop
- * layout such as
- * `${CODEX_HOME ?? ~/.codex}/sessions/YYYY/MM/DD/rollout-*.jsonl`.
- * The cwd appears on `meta.cwd` for the CLI shape and on
- * `payload.cwd` in `type: "session_meta"` records for Codex Desktop. Codex
- * publishes NO workspace env var to its child MCP processes — so unlike
- * Claude/Pi/Cursor, we have no env signal at all. The session log is the
- * strongest available signal.
- *
- * Mirror of `resolveProjectDirFromTranscript` for Claude Code; differences:
- *   • Sessions may live flat or in a dated hierarchy (no per-project encoded
- *     subdir like Claude's `~/.claude/projects/<encoded>/`).
- *   • The cwd is nested on `meta.cwd` or `payload.cwd`, not top-level `cwd`.
- *
- * Returns `null` when:
- *   • `codexHome` or its `sessions/` subdir does not exist.
- *   • No `.jsonl` files exist or none has a parseable cwd string.
- *   • The newest log is older than `transcriptMaxAgeMs` (multi-window guard).
- *   • The resolved cwd points at a plugin install path (poisoned).
- */
-export function resolveCodexSessionCwd(opts) {
-    const codexHome = opts?.codexHome ?? process.env.CODEX_HOME ?? path.join(os.homedir(), ".codex");
-    const sessionsDir = path.join(codexHome, "sessions");
-    if (!fs.existsSync(sessionsDir))
-        return null;
-    const MAX_SCAN_DEPTH = 4; // sessions/YYYY/MM/DD/<file>.jsonl plus one spare.
-    const MAX_SCAN_ENTRIES = 10_000;
-    let visitedEntries = 0;
-    let bestPath;
-    let bestMtime = 0;
-    const visit = (dir, depth) => {
-        if (visitedEntries >= MAX_SCAN_ENTRIES)
-            return;
-        let entries;
-        try {
-            entries = fs.readdirSync(dir);
-        }
-        catch {
-            return;
-        }
-        entries.sort().reverse();
-        for (const entry of entries) {
-            if (visitedEntries >= MAX_SCAN_ENTRIES)
-                return;
-            visitedEntries++;
-            const fp = path.join(dir, entry);
-            let stat;
-            try {
-                stat = fs.statSync(fp);
-            }
-            catch {
-                continue;
-            }
-            if (stat.isDirectory()) {
-                if (depth < MAX_SCAN_DEPTH)
-                    visit(fp, depth + 1);
-                continue;
-            }
-            if (!stat.isFile() || !entry.endsWith(".jsonl"))
-                continue;
-            const m = stat.mtimeMs;
-            if (m > bestMtime) {
-                bestMtime = m;
-                bestPath = fp;
-            }
-        }
-    };
-    try {
-        visit(sessionsDir, 0);
-    }
-    catch {
-        return null;
-    }
-    if (!bestPath)
-        return null;
-    if (typeof opts?.transcriptMaxAgeMs === "number") {
-        const nowMs = opts.now ?? Date.now();
-        if (nowMs - bestMtime > opts.transcriptMaxAgeMs)
-            return null;
-    }
-    // Read a bounded head chunk. Codex Desktop's first session_meta line can be
-    // larger than Claude/Codex CLI metadata because it includes dynamic tool and
-    // instruction fields, but the full transcript can still be tens of MB.
-    try {
-        const fd = fs.openSync(bestPath, "r");
-        try {
-            const buf = Buffer.alloc(1024 * 1024);
-            const bytes = fs.readSync(fd, buf, 0, buf.length, 0);
-            const text = buf.subarray(0, bytes).toString("utf-8");
-            for (const line of text.split("\n").slice(0, 10)) {
-                if (!line.trim())
-                    continue;
-                try {
-                    const obj = JSON.parse(line);
-                    const cwd = obj?.meta?.cwd ??
-                        (obj?.type === "session_meta" ? obj?.payload?.cwd : undefined);
-                    if (typeof cwd !== "string" || cwd.length === 0)
-                        continue;
-                    if (isPluginInstallPath(cwd))
-                        return null;
-                    return cwd;
-                }
-                catch {
-                    return null; /* malformed session metadata line */
-                }
-            }
-        }
-        finally {
-            fs.closeSync(fd);
-        }
-    }
-    catch {
-        return null; /* file vanished mid-read */
-    }
-    return null;
-}
-/**
- * Pure project-dir resolver. Mirror of the env-var chain inside
- * `src/server.ts getProjectDir()`, but takes its inputs explicitly so the
- * resolver can be exercised under test without process-level mutation.
- *
- * Resolution order:
- *   1. Adapter-priority env vars (CLAUDE / GEMINI / VSCODE / OPENCODE / PI /
- *      IDEA / CONTEXT_MODE) — first non-empty AND non-plugin-path wins.
- *   2. Claude Code transcript heuristic — read `cwd` from the most-recently-
- *      modified `~/.claude/projects/<encoded>/<session>.jsonl`. This is the
- *      most reliable signal when Claude Code launched MCP from a non-project
- *      cwd (desktop-app launch, `/ctx-upgrade` respawn, etc.).
- *   3. `process.env.PWD` — shell-set, NOT updated by `process.chdir()`, so
- *      it survives the `start.mjs` chdir into the plugin dir. Skipped if
- *      it too points at a plugin install path.
- *   4. `cwd` — last resort. Returned even if it is a plugin path; the
- *      caller is responsible for rendering a graceful "no project context"
- *      message rather than panicking. Keeping the function total preserves
- *      operation of project-independent tools (sandbox execute, fetch).
- */
-export function resolveProjectDir(opts) {
-    const { env, cwd, pwd, transcriptsRoot, transcriptMaxAgeMs, nowMs, strictPlatform, codexHome, } = opts;
-    // Build candidate list. Strict path: own workspace vars + universal escape
-    // hatch — NO foreign workspace vars, in any order, can win. Non-strict
-    // path: frozen legacy literal order for backwards compatibility.
-    const candidateVars = strictPlatform
-        ? [...workspaceEnvVarsFor(strictPlatform), ...UNIVERSAL_WORKSPACE_ENV]
-        : LEGACY_NON_STRICT_CANDIDATES;
-    for (const name of candidateVars) {
-        const v = env[name];
-        if (v && !isPluginInstallPath(v))
-            return v;
-    }
-    if (transcriptsRoot) {
-        const fromTranscript = resolveProjectDirFromTranscript({
-            projectsRoot: transcriptsRoot,
-            maxAgeMs: transcriptMaxAgeMs,
-            nowMs,
-        });
-        if (fromTranscript && !isPluginInstallPath(fromTranscript))
-            return fromTranscript;
-    }
-    // Issue #45 — Codex has no workspace env var, so when running under
-    // strictPlatform="codex" we fall back to the session-log heuristic
-    // between env and PWD. Non-codex platforms skip this branch entirely.
-    if (strictPlatform === "codex") {
-        const fromCodex = resolveCodexSessionCwd({
-            codexHome,
-            transcriptMaxAgeMs,
-            now: nowMs,
-        });
-        if (fromCodex)
-            return fromCodex;
-    }
-    if (pwd && !isPluginInstallPath(pwd))
-        return pwd;
-    return cwd;
-}

package/build/util/sibling-mcp.d.ts

@@ -1,79 +0,0 @@
-/**
- * sibling-mcp — discover & terminate previous-version MCP servers.
- *
- * Issue #559: `/ctx-upgrade` historically left the running MCP server
- * alive after copying new files in-place + updating npm global. The next
- * Claude Code launch spawned a fresh process from the new version, but
- * the old one kept its open stdio + DB handles. Across enough upgrades
- * users observed 5+ context-mode `start.mjs` processes pinned to RAM.
- *
- * This module provides two pure helpers:
- *
- *   1. `discoverSiblingMcpPids({ ownPid, ownPpid, platform, runCommand })`
- *      — enumerates node processes whose argv mentions the plugin
- *      `start.mjs` path under `~/.claude/plugins/{cache,marketplaces}/`.
- *      Excludes the caller's own pid + parent pid (Claude Code or the
- *      shell that spawned `/ctx-upgrade`). Cross-platform: POSIX uses
- *      `pgrep -f`, Windows uses PowerShell + Get-CimInstance.
- *
- *   2. `killSiblingMcpServers({ pids, ... })` — sends SIGTERM, polls
- *      liveness, escalates to SIGKILL after `timeoutMs` (default 1500
- *      ms) on stragglers. Returns a kill report so callers can surface
- *      a concise summary without leaking PIDs to user-facing logs.
- *
- * Both helpers accept dependency-injected `runCommand`, `isAlive`, and
- * `sendSignal` parameters so tests can exercise the full behavior tree
- * cross-platform without spawning real processes.
- */
-/** Inject `child_process.execFileSync` for tests. Must return stdout as utf-8. */
-export type RunCommand = (cmd: string, args: readonly string[]) => string;
-/** Inject `process.kill(pid, 0)` for tests. */
-export type IsAlive = (pid: number) => boolean;
-/** Inject `process.kill(pid, signal)` for tests. */
-export type SendSignal = (pid: number, signal: NodeJS.Signals) => void;
-export interface DiscoverOptions {
-    ownPid: number;
-    ownPpid: number;
-    /** `process.platform` injection. Defaults to live process.platform. */
-    platform?: NodeJS.Platform;
-    /** Test injection point — defaults to `child_process.execFileSync`. */
-    runCommand?: RunCommand;
-}
-export interface KillOptions {
-    pids: readonly number[];
-    /** Time to wait for SIGTERM to take effect before escalating. */
-    timeoutMs?: number;
-    /** Poll interval while waiting for SIGTERM. */
-    pollIntervalMs?: number;
-    isAlive?: IsAlive;
-    sendSignal?: SendSignal;
-}
-export interface KillReport {
-    /** PIDs that died after SIGTERM within `timeoutMs`. */
-    terminatedBySigterm: number;
-    /** PIDs that required SIGKILL escalation. */
-    terminatedBySigkill: number;
-    /** Sum of the two — used by the cli summary line. */
-    totalKilled: number;
-}
-/**
- * Enumerate node MCP-server processes spawned from this plugin's
- * start.mjs. Always returns an empty array on tool absence — never
- * throws — so an upgrade is never blocked by a missing pgrep/PowerShell.
- */
-export declare function discoverSiblingMcpPids(opts: DiscoverOptions): number[];
-/**
- * Send SIGTERM to each PID, then poll for liveness. PIDs still alive
- * after `timeoutMs` receive SIGKILL. Returns a per-signal report.
- *
- * Algorithm:
- *   1. Fire SIGTERM at every pid (swallow ESRCH — already dead).
- *   2. Poll every `pollIntervalMs` until either all pids are dead
- *      OR `timeoutMs` elapses.
- *   3. For survivors: SIGKILL (swallow ESRCH).
- *   4. Count via "died-while-we-watched": only PIDs that were observed
- *      alive at any point and then died are reported. PIDs that were
- *      already dead before SIGTERM (ESRCH on first send) are not
- *      counted — they were not ours to kill.
- */
-export declare function killSiblingMcpServers(opts: KillOptions): Promise<KillReport>;

package/build/util/sibling-mcp.js

@@ -1,181 +0,0 @@
-/**
- * sibling-mcp — discover & terminate previous-version MCP servers.
- *
- * Issue #559: `/ctx-upgrade` historically left the running MCP server
- * alive after copying new files in-place + updating npm global. The next
- * Claude Code launch spawned a fresh process from the new version, but
- * the old one kept its open stdio + DB handles. Across enough upgrades
- * users observed 5+ context-mode `start.mjs` processes pinned to RAM.
- *
- * This module provides two pure helpers:
- *
- *   1. `discoverSiblingMcpPids({ ownPid, ownPpid, platform, runCommand })`
- *      — enumerates node processes whose argv mentions the plugin
- *      `start.mjs` path under `~/.claude/plugins/{cache,marketplaces}/`.
- *      Excludes the caller's own pid + parent pid (Claude Code or the
- *      shell that spawned `/ctx-upgrade`). Cross-platform: POSIX uses
- *      `pgrep -f`, Windows uses PowerShell + Get-CimInstance.
- *
- *   2. `killSiblingMcpServers({ pids, ... })` — sends SIGTERM, polls
- *      liveness, escalates to SIGKILL after `timeoutMs` (default 1500
- *      ms) on stragglers. Returns a kill report so callers can surface
- *      a concise summary without leaking PIDs to user-facing logs.
- *
- * Both helpers accept dependency-injected `runCommand`, `isAlive`, and
- * `sendSignal` parameters so tests can exercise the full behavior tree
- * cross-platform without spawning real processes.
- */
-import { execFileSync } from "node:child_process";
-// Match BOTH `~/.claude/plugins/cache/context-mode/context-mode/<v>/start.mjs`
-// AND `~/.claude/plugins/marketplaces/context-mode/start.mjs` shapes.
-// Both can be alive concurrently — VERDICT R1 dump confirmed all four
-// PIDs simultaneously across three different versions on a real Mac.
-const POSIX_PGREP_PATTERN = "node.*plugins/(cache|marketplaces)/.*context-mode.*start\\.mjs";
-// Windows: PowerShell + Get-CimInstance (wmic deprecated since Win11 22H2).
-// Filter on CommandLine because Win32_Process.Name is just "node.exe".
-// Two backslashes inside `start\.mjs` are needed because the Like operator
-// uses regex-ish escaping at the JS layer.
-const WIN_PS_SCRIPT = "Get-CimInstance Win32_Process " +
-    "-Filter \"Name='node.exe'\" | " +
-    "Where-Object { $_.CommandLine -match 'plugins[\\\\/](cache|marketplaces)[\\\\/].*context-mode.*start\\.mjs' } | " +
-    "Select-Object -ExpandProperty ProcessId";
-const defaultRun = (cmd, args) => execFileSync(cmd, [...args], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
-const defaultIsAlive = (pid) => {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
-};
-const defaultSendSignal = (pid, sig) => {
-    // Throws ESRCH if the process is already dead — callers must swallow.
-    process.kill(pid, sig);
-};
-/**
- * Parse newline-separated PID output. Tolerates header rows
- * (`ProcessId`, `----------`), surrounding whitespace, and empty lines.
- * Returns deduplicated, validated integers only.
- */
-function parsePidList(stdout) {
-    const seen = new Set();
-    for (const raw of stdout.split(/\r?\n/)) {
-        const trimmed = raw.trim();
-        if (!trimmed)
-            continue;
-        if (!/^\d+$/.test(trimmed))
-            continue;
-        const n = Number.parseInt(trimmed, 10);
-        if (Number.isFinite(n) && n > 0)
-            seen.add(n);
-    }
-    return [...seen];
-}
-/**
- * Enumerate node MCP-server processes spawned from this plugin's
- * start.mjs. Always returns an empty array on tool absence — never
- * throws — so an upgrade is never blocked by a missing pgrep/PowerShell.
- */
-export function discoverSiblingMcpPids(opts) {
-    const platform = opts.platform ?? process.platform;
-    const run = opts.runCommand ?? defaultRun;
-    let stdout = "";
-    try {
-        if (platform === "win32") {
-            stdout = run("powershell", ["-NoProfile", "-Command", WIN_PS_SCRIPT]);
-        }
-        else {
-            // pgrep exits 1 when no matches; execFileSync throws on non-zero.
-            // Treat that as "no siblings" rather than an error.
-            stdout = run("pgrep", ["-f", POSIX_PGREP_PATTERN]);
-        }
-    }
-    catch {
-        return [];
-    }
-    return parsePidList(stdout).filter((pid) => pid !== opts.ownPid && pid !== opts.ownPpid);
-}
-/** Sleep helper — Promise-based for use inside the kill polling loop. */
-function delay(ms) {
-    return new Promise((resolve) => { setTimeout(resolve, ms); });
-}
-/**
- * Send SIGTERM to each PID, then poll for liveness. PIDs still alive
- * after `timeoutMs` receive SIGKILL. Returns a per-signal report.
- *
- * Algorithm:
- *   1. Fire SIGTERM at every pid (swallow ESRCH — already dead).
- *   2. Poll every `pollIntervalMs` until either all pids are dead
- *      OR `timeoutMs` elapses.
- *   3. For survivors: SIGKILL (swallow ESRCH).
- *   4. Count via "died-while-we-watched": only PIDs that were observed
- *      alive at any point and then died are reported. PIDs that were
- *      already dead before SIGTERM (ESRCH on first send) are not
- *      counted — they were not ours to kill.
- */
-export async function killSiblingMcpServers(opts) {
-    const timeoutMs = opts.timeoutMs ?? 1500;
-    const pollIntervalMs = opts.pollIntervalMs ?? 100;
-    const isAlive = opts.isAlive ?? defaultIsAlive;
-    const sendSignal = opts.sendSignal ?? defaultSendSignal;
-    const empty = { terminatedBySigterm: 0, terminatedBySigkill: 0, totalKilled: 0 };
-    if (opts.pids.length === 0)
-        return empty;
-    // Track which PIDs we observed alive — we only count those.
-    const observedAlive = new Set();
-    const pendingTerm = new Set();
-    // Phase 1 — SIGTERM fan-out.
-    for (const pid of opts.pids) {
-        if (isAlive(pid)) {
-            observedAlive.add(pid);
-            pendingTerm.add(pid);
-        }
-        try {
-            sendSignal(pid, "SIGTERM");
-        }
-        catch (err) {
-            const code = err?.code;
-            if (code !== "ESRCH") {
-                // Permission errors etc. — drop from pending; cannot kill.
-                pendingTerm.delete(pid);
-            }
-        }
-    }
-    // Phase 2 — poll until either all dead or timeout.
-    const deadline = Date.now() + timeoutMs;
-    let terminatedBySigterm = 0;
-    while (pendingTerm.size > 0 && Date.now() < deadline) {
-        await delay(pollIntervalMs);
-        for (const pid of [...pendingTerm]) {
-            if (!isAlive(pid)) {
-                pendingTerm.delete(pid);
-                terminatedBySigterm++;
-            }
-        }
-    }
-    // Phase 3 — SIGKILL survivors.
-    let terminatedBySigkill = 0;
-    for (const pid of pendingTerm) {
-        try {
-            sendSignal(pid, "SIGKILL");
-        }
-        catch (err) {
-            const code = err?.code;
-            if (code === "ESRCH") {
-                // Died between the last poll and SIGKILL — count as SIGTERM win.
-                terminatedBySigterm++;
-                continue;
-            }
-            // Other error: skip — best-effort.
-            continue;
-        }
-        if (observedAlive.has(pid))
-            terminatedBySigkill++;
-    }
-    return {
-        terminatedBySigterm,
-        terminatedBySigkill,
-        totalKilled: terminatedBySigterm + terminatedBySigkill,
-    };
-}