flowviant 0.103.0 → 0.104.0

package/bin/lib/previewRegistry.mjs

@@ -0,0 +1,235 @@
+/**
+ * THE PREVIEW TUNNEL REGISTRY — which cloudflared groups this box started, so
+ * a daemon that died ungracefully has its public tunnels reaped by the next.
+ *
+ * cloudflared is detached so we can kill its whole group — which also means it
+ * SURVIVES an ungraceful daemon death (SIGKILL, crash, box sleep), leaving a
+ * public hostname pointed at a worktree with nobody minding it. We record each
+ * group's pid + a signature and reap ours at the next start.
+ *
+ * The registry is a read-modify-write over one file in a directory that TWO
+ * daemons can legitimately share (the 0.51.2 instance lock is keyed on a
+ * CREDENTIAL, so two daemons serving two different projects are fine and both
+ * write here). It was unlocked, written back when previews were serial. A lost
+ * entry is precisely the case reaping exists for.
+ *
+ * ── ONE REGISTRY IMPLEMENTATION, NOT TWO (SOLID audit 2026-09-26, F006) ──
+ *
+ * `procRegistry.mjs` was lifted out of `preview.mjs` for the dev-run system and
+ * then the session process groups, and preview kept its ORIGINAL copy of the
+ * lock, the atomic read/write and the process start-time reader — which had
+ * drifted: no bound on the file at all, and a start time with no boot mark.
+ * This file is preview's POLICY over procRegistry's PRIMITIVES:
+ *
+ *  - THE LOCK AND THE ATOMIC WRITE are procRegistry's, same paths and same
+ *    stale-lock recovery as before.
+ *  - THE PRUNE IS PREVIEW'S OWN and it NEVER DISCARDS AN UNREAPED TUNNEL.
+ *    procRegistry's default prune caps the file at 32 rows and ages out dead
+ *    ones after a week; a cap would drop a live public tunnel's only record
+ *    the day a box had 33 of them. So a row survives exactly while its tunnel
+ *    pid is alive (signal 0, EPERM counting as alive) — a dead tunnel has
+ *    nothing left to reap, and the reap pass itself drops those anyway. The
+ *    file is bounded by the tunnels that exist.
+ *  - ONE PROCESS IDENTITY: procRegistry's `processStartTime`, which carries the
+ *    boot mark, in a NEW field, `ownerMark`, which this code prefers.
+ *
+ * ── THE FILE IS SHARED ACROSS DAEMON VERSIONS, SO THE OLD FIELD KEEPS ITS
+ *    OLD SPELLING ──
+ *
+ * The daemon is the one component a deploy cannot upgrade, and previews.json
+ * is shared by every daemon on the box: two projects, the tray's bundled WSL
+ * daemon beside a curl install, a self-update window. A published daemon
+ * compares `ownerStart` EXACTLY against its own reading (`l:<ticks>` on Linux,
+ * `d:<lstart>` on macOS) and SIGKILLs the tunnel when they differ. The first
+ * cut of this move wrote the boot-marked reading INTO `ownerStart`, and an
+ * older daemon starting beside a live new one read every new row as a dead
+ * owner's and killed the peer's public tunnels (review 2026-09-26, reproduced
+ * against 0.103.0's reap). So a row carries BOTH: `ownerStart` in the legacy
+ * spelling, derived from the one reader, for published readers; `ownerMark`,
+ * the boot-marked reading, for this one. A row with no `ownerMark` (written by
+ * an older daemon) is judged on its legacy `ownerStart`, field for field, so a
+ * peer that recorded its tunnels before this change is not reaped either.
+ */
+
+import { readFileSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { join } from 'node:path';
+import { homedir, platform } from 'node:os';
+import { mutateRegistry, processAlive, processStartTime, readRegistry } from './procRegistry.mjs';
+
+const FLOWVIANT_DIR = join(homedir(), '.flowviant');
+const PREVIEW_REGISTRY = join(FLOWVIANT_DIR, 'previews.json');
+const REGISTRY_LOCK = join(FLOWVIANT_DIR, 'previews.lock');
+
+/** A row lives while its tunnel does, uncapped — see the header. */
+export const keepLiveTunnels = (list) => list.filter((e) => processAlive(e?.pid));
+
+function mutatePreviews(fn) {
+  mutateRegistry(FLOWVIANT_DIR, PREVIEW_REGISTRY, REGISTRY_LOCK, fn, { prune: keepLiveTunnels });
+}
+
+/**
+ * The legacy spelling of a `processStartTime` reading, for `ownerStart` — the
+ * field published daemons compare exactly (see the header). Linux readings are
+ * `<boot mark>:<ticks>` and published readers wrote `l:<ticks>`; macOS readings
+ * are the raw `lstart` and published readers wrote `d:<lstart>`. Null where a
+ * published reader could not read a start time either.
+ */
+export function legacyOwnerStart(reading, os = platform()) {
+  if (typeof reading !== 'string' || !reading) return null;
+  if (os === 'linux') return `l:${reading.slice(reading.lastIndexOf(':') + 1)}`;
+  if (os === 'darwin') return `d:${reading}`;
+  return null;
+}
+
+/**
+ * Does `recorded` (an entry's `ownerMark`, else its `ownerStart`) name the
+ * process that holds `pid` NOW? `true`/`false`, or `null` when this box cannot
+ * read a start time — the caller's "cannot tell", never a mismatch.
+ *
+ * `ownerMark` is procRegistry's reading verbatim. A legacy `ownerStart` (the
+ * only mark on a row an older daemon wrote) is compared field for field:
+ * `l:<ticks>` against the ticks after the boot mark, `d:<lstart>` against the
+ * macOS reading, which never had a prefix in procRegistry.
+ */
+export function sameOwnerStart(recorded, pid) {
+  const now = processStartTime(pid);
+  if (now == null) return null;
+  if (recorded.startsWith('l:')) return now.slice(now.lastIndexOf(':') + 1) === recorded.slice(2);
+  if (recorded.startsWith('d:')) return now === recorded.slice(2);
+  return now === recorded;
+}
+
+export function recordPreviewPid(pid, sig) {
+  if (!pid) return;
+  // `owner` is the DAEMON that spawned it. The registry is shared by design —
+  // two daemons serving two projects both write here — so without an owner a
+  // starting daemon reaped its PEER's live tunnels: killed them, wiped their
+  // entries, and the peer kept heartbeating a URL that 530s (its probe watches
+  // the origin port, which was still alive).
+  //
+  // `ownerStart` pins the owner to ONE process (audit 2026-09-24). A daemon that
+  // is SIGKILLed with a share open leaves cloudflared up; if its pid is reused
+  // by the next start — any process, another user's included, since EPERM
+  // counts as alive — a pid-only check read the entry as a live peer's and
+  // skipped it forever, leaving a public hostname aimed at a dead gate's
+  // ephemeral port for anything that binds it next.
+  //
+  // `ownerMark` is that pin in the one identity reader's spelling; `ownerStart`
+  // keeps the spelling published daemons compare — see the header.
+  const ownerMark = processStartTime(process.pid);
+  const ownerStart = legacyOwnerStart(ownerMark);
+  mutatePreviews((list) => [
+    ...list,
+    { pid, sig, owner: process.pid, ...(ownerStart ? { ownerStart } : {}), ...(ownerMark ? { ownerMark } : {}) },
+  ]);
+}
+
+export function forgetPreviewPid(pid) {
+  if (!pid) return;
+  mutatePreviews((list) => list.filter((e) => e.pid !== pid));
+}
+
+/**
+ * Only kill a pid we can VERIFY is still one of ours — its command line must
+ * still contain the signature we stored. A reused pid belonging to something
+ * unrelated won't match, so we never kill a stranger.
+ *
+ * MACOS READS IT THROUGH `ps`, because "Linux-only, elsewhere just clear the
+ * registry" was the worst of both. A macOS daemon killed ungracefully leaves
+ * cloudflared running — it is spawned detached — so the public hostname keeps
+ * resolving to this machine while the gate dies with the daemon. The reaper
+ * then verified nothing, killed nothing, and DELETED the entry, so no later run
+ * could ever find that process. The tunnel served 502 until anything else on
+ * the box bound the gate's old port, which `startAuthProxy` obtained with
+ * `listen(0)` and is therefore squarely inside the kernel's ephemeral reuse
+ * pool — at which point a live public hostname forwarded straight to an
+ * unrelated local service with no gate, no password and no grant check. Exactly
+ * what this file's header says the reap exists to prevent.
+ *
+ * Three states, not two: `true` (ours), `false` (verified NOT ours, or gone),
+ * and `null` (we could not look — the caller keeps the record rather than
+ * dropping it).
+ */
+function stillOurs(pid, sig) {
+  if (typeof sig !== 'string' || sig.length === 0) return false;
+  if (platform() === 'linux') {
+    try {
+      const cmd = readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ');
+      return cmd.includes(sig);
+    } catch {
+      return false; // process gone / unreadable
+    }
+  }
+  if (platform() === 'darwin') {
+    try {
+      const cmd = execFileSync('ps', ['-p', String(pid), '-o', 'command='], {
+        encoding: 'utf8',
+        timeout: 5_000,
+      });
+      return cmd.includes(sig);
+    } catch {
+      // `ps` exits non-zero when the pid is gone — which is a real answer.
+      return false;
+    }
+  }
+  // Windows: no way to check from here. UNKNOWN, never "not ours" — see the
+  // caller, which keeps the record so a later run on a platform that can look
+  // is still able to.
+  return null;
+}
+
+/** Reap tunnel process groups left behind by a previously-crashed daemon.
+ *  Call once at daemon startup, before any work begins.
+ *
+ *  ORPHANS ONLY: an entry whose owning daemon is STILL ALIVE belongs to a
+ *  peer serving another project (or to the process we are replacing, whose
+ *  own teardown handles it) — killing those and wiping their entries was a
+ *  peer daemon's startup silently breaking every live share on the box. Only
+ *  the entries this pass handled are removed; a peer's records survive. */
+/** Is the daemon that recorded an entry still the process at that pid? With
+ *  a recorded start time, only when the pid's start time still matches (a
+ *  recycled pid is an orphaned entry); where this box cannot report a start
+ *  time now, or the entry predates the field, signal 0 is all there is. */
+function ownerStillRunning(owner, ownerStart, ownerMark) {
+  if (!processAlive(owner)) return false;
+  const recorded = typeof ownerMark === 'string' ? ownerMark : ownerStart;
+  if (typeof recorded !== 'string') return true;
+  return sameOwnerStart(recorded, owner) !== false;
+}
+
+export function reapOrphanPreviews(log) {
+  const list = readRegistry(PREVIEW_REGISTRY);
+  if (list.length === 0) return;
+  let killed = 0;
+  const handled = new Set();
+  for (const { pid, sig, owner, ownerStart, ownerMark } of list) {
+    if (Number.isInteger(owner) && owner !== process.pid && ownerStillRunning(owner, ownerStart, ownerMark)) continue;
+    const ours = stillOurs(pid, sig);
+    /**
+     * THE RECORD OUTLIVES A REAP THAT COULD NOT LOOK. `handled.add` ran BEFORE
+     * this check, so an entry was dropped whether or not anything was killed —
+     * and on any platform `stillOurs` could not read, that deleted the only
+     * trace of a tunnel still serving the public internet. Kept on `null`
+     * (unknown); removed on `true` (we killed it) and on `false` (the process
+     * is gone, or the pid now belongs to somebody else and the entry is stale
+     * either way).
+     */
+    if (ours === null) continue;
+    handled.add(pid);
+    if (!ours) continue;
+    try {
+      process.kill(-pid, 'SIGKILL'); // whole group
+      killed++;
+    } catch {
+      try {
+        process.kill(pid, 'SIGKILL');
+        killed++;
+      } catch {
+        /* already gone */
+      }
+    }
+  }
+  if (handled.size) mutatePreviews((cur) => cur.filter((e) => !handled.has(e.pid)));
+  if (killed) log?.(`reaped ${killed} orphaned preview tunnel${killed === 1 ? '' : 's'} from a previous run.`);
+}

package/bin/lib/printable.mjs

@@ -11,8 +11,8 @@
  * `evil‮txt.crt⁦` reads backwards on a bidi-aware terminal, so
  * "evil" can visually swap places with an extension that was never there.
  *
- * THIS IS A LEAF MODULE ON PURPOSE. `machines.mjs` and `fleet.mjs` both need
- * it, `machines.mjs` deliberately imports nothing from `fleet.mjs`'s world
+ * THIS IS A LEAF MODULE ON PURPOSE. `machineListing.mjs` and the daemon's
+ * holder/roster modules (`holder.mjs`, `fleetRoster.mjs`) all need it, `machineListing.mjs` deliberately imports nothing from `fleet.mjs`'s world
  * (its own header explains why: it runs before the auth gate, like `stop` and
  * `projects`, and must not pull in the daemon's whole CLI/worktree
  * machinery), and `credentials.mjs` is where `safeName` already lived. A leaf

package/bin/lib/procRegistry.mjs

@@ -1,5 +1,5 @@
 /**
- * A DISK REGISTRY OF DETACHED PROCESSES — one implementation, two users.
+ * A DISK REGISTRY OF DETACHED PROCESSES — one implementation, every user.
  *
  * The daemon spawns things that outlive it: cloudflared tunnels, and now dev
  * servers. If the daemon dies without tearing them down, the successor has to
@@ -7,10 +7,11 @@
  * in a worktree about to be `git worktree remove`d, are both worse than the
  * crash that caused them.
  *
- * Lifted verbatim out of `preview.mjs`, which grew all of this for the tunnel
- * and now shares it rather than being copied. Two things were ADDED on the way
- * out, because a dev server lives for hours where a tunnel lived for minutes
- * and long-lived rows make both matter:
+ * Lifted verbatim out of `preview.mjs`, which grew all of this for the tunnel —
+ * and which kept its own drifted copy until 2026-09-26 (F006); the tunnel
+ * registry is now `previewRegistry.mjs`, a policy over these primitives. Two
+ * things were ADDED on the way out, because a dev server lives for hours where
+ * a tunnel lived for minutes and long-lived rows make both matter:
  *
  *  - an entry CAP, so a registry cannot grow without bound;
  *  - a TTL sweep for entries whose pid is long dead, so a file nobody prunes
@@ -171,26 +172,35 @@ export function processAlive(pid) {
   }
 }
 
+/**
+ * THE DEFAULT PRUNE: a row whose pid is alive, or dead for less than a week,
+ * capped at the newest `MAX_ENTRIES`. An entry whose pid has been dead for a
+ * week is not a process anybody is going to reap, and keeping it only makes
+ * the next reader slower and the next pid collision more likely.
+ */
+export function pruneAgedDead(list, now = Date.now()) {
+  return list
+    .filter((e) => {
+      if (processAlive(e?.pid)) return true;
+      const started = Number(e?.startedAt ?? 0);
+      return started > 0 && now - started < ENTRY_TTL_MS;
+    })
+    .slice(-MAX_ENTRIES);
+}
+
 /**
  * Read-modify-write under the lock, then prune.
  *
  * The prune is here rather than at the call sites so it cannot be forgotten by
- * one of them: an entry whose pid has been dead for a week is not a process
- * anybody is going to reap, and keeping it only makes the next reader slower
- * and the next pid collision more likely.
+ * one of them. A registry whose rows must never be dropped on a count — the
+ * preview tunnels, where the only record of a live public hostname cannot be
+ * the 33rd row — passes its own `prune` and states its bound there
+ * (`previewRegistry.mjs`); everything else takes `pruneAgedDead`.
  */
-export function mutateRegistry(dir, path, lockPath, fn) {
+export function mutateRegistry(dir, path, lockPath, fn, { prune = pruneAgedDead } = {}) {
   const release = acquireLock(dir, lockPath);
   try {
-    const next = fn(readRegistry(path));
-    const now = Date.now();
-    const pruned = next
-      .filter((e) => {
-        if (processAlive(e?.pid)) return true;
-        const started = Number(e?.startedAt ?? 0);
-        return started > 0 && now - started < ENTRY_TTL_MS;
-      })
-      .slice(-MAX_ENTRIES);
+    const pruned = prune(fn(readRegistry(path)));
     writeRegistry(dir, path, pruned);
     return pruned;
   } finally {

package/bin/lib/procScan.mjs

@@ -0,0 +1,146 @@
+/**
+ * WALKING /proc — the one bounded enumeration every process scan shares, and
+ * the one "which processes stand in this directory, holding which sockets"
+ * attribution the listener measurements share.
+ *
+ * ── WHY IT IS ONE FILE (SOLID audit 2026-09-26, F007) ──
+ *
+ * Three scans spelled the runaway bound three ways. `processes.mjs` had
+ * already been fixed to bound the WORK — stop after 4000 matching rows — after
+ * it lost a tab's watcher: readdir answers in STRING order, so cutting the pid
+ * LIST kept '1', '10', '100'… and dropped pid 912345. `listeners.mjs` still
+ * cut the list, twice (the inventory and the dial-address check), so on a busy
+ * box a dev server at a high pid was reported ABSENT by both — "nothing is
+ * listening" about a socket the kernel's own table held. The rule now has one
+ * home: EVERY pid is looked at, and the bound is on the rows a scan collects.
+ *
+ * WHAT THAT COSTS, said plainly (review 2026-09-26). The old slice bounded the
+ * WALK at 4000 pids; the bound here counts MATCHED rows (for the listener
+ * scans, processes standing in the worktree), so on a box of N processes one
+ * scan does N cwd readlinks, and a reconcile runs two per worktree (inventory
+ * and dial check). That is the price of never measuring a high pid as absent,
+ * and it is a readlink each — the fd walk, the expensive part, is paid only
+ * by processes inside the directory. A bound on pids VISITED would bring the
+ * dropped-listener bug straight back, so there is none.
+ *
+ * ── AND A CUT IS SAID ──
+ *
+ * `scanProcs` answers `complete: false` when it stopped with pids unread, so a
+ * caller can refuse to turn "not looked at" into "not there" — the three-state
+ * rule the rest of this product keeps. A /proc that cannot be listed at all is
+ * `null` from `procPids`, which is "cannot look", a third answer again.
+ *
+ * Linux only by construction; callers keep their own macOS paths.
+ */
+
+import { readdirSync, readlinkSync, realpathSync } from 'node:fs';
+import { sep } from 'node:path';
+
+/** Rows collected per scan before the walk stops early — a bound on the ROWS
+ *  held (and the per-row work: an fd walk, a stat read) for one pathological
+ *  box, never on which part of /proc is looked at. Every pid still costs one
+ *  cheap filter read (see the header). The runaway bound, not a capacity
+ *  statement. */
+export const SCAN_MATCH_BOUND = 4000;
+
+/** Every numeric entry of /proc, or null when /proc cannot be listed. */
+export function procPids(list = () => readdirSync('/proc')) {
+  try {
+    return list().filter((d) => /^\d+$/.test(d));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Walk `pids` in order; `match(raw)` returns a row or null. Stops once `bound`
+ * rows are held AND a pid is still unread, answering `complete: false`.
+ */
+export function scanProcs(pids, match, bound = SCAN_MATCH_BOUND) {
+  const rows = [];
+  for (const raw of pids) {
+    if (rows.length >= bound) return { rows, complete: false };
+    const row = match(raw);
+    if (row != null) rows.push(row);
+  }
+  return { rows, complete: true };
+}
+
+/** A predicate for "this path is `dir` or inside it", on the RESOLVED path —
+ *  or null when `dir` is gone (retired under us). */
+export function insideDir(dir) {
+  let root;
+  try {
+    root = realpathSync(dir);
+  } catch {
+    return null;
+  }
+  const prefix = root.endsWith(sep) ? root : root + sep;
+  return (p) => p === root || p.startsWith(prefix);
+}
+
+function cwdOf(raw) {
+  try {
+    return readlinkSync(`/proc/${raw}/cwd`);
+  } catch {
+    return null; // not ours to read, or gone
+  }
+}
+
+/** The socket inodes one process holds open, or null when its fd table is
+ *  unreadable. */
+function socketInodesOf(raw) {
+  let fds;
+  try {
+    fds = readdirSync(`/proc/${raw}/fd`);
+  } catch {
+    return null;
+  }
+  const out = [];
+  for (const fd of fds) {
+    let link;
+    try {
+      link = readlinkSync(`/proc/${raw}/fd/${fd}`);
+    } catch {
+      continue;
+    }
+    const m = /^socket:\[(\d+)\]$/.exec(link);
+    if (m) out.push(m[1]);
+  }
+  return out;
+}
+
+/**
+ * EVERY PROCESS STANDING IN `dir`, with the socket inodes it holds —
+ * `{ holders: [{ pid, inodes }], complete }` in /proc order.
+ *
+ * Attribution is by the CWD of the process, the rule `listeners.mjs` argues
+ * for. The cheap filter runs first — one readlink rejects almost every process
+ * on the box, and only processes inside `dir` pay for a walk of their fd
+ * table — and those are the rows the bound counts. `skip(pid)` drops a process
+ * that is Flowviant itself (the daemon, its tunnels) before its fds are read.
+ *
+ * `{ holders: [], complete: true }` when `dir` is gone; null when /proc cannot
+ * be listed. `io` exists ONLY so a test can hand in a pid list (and a bound)
+ * without a box that runs four thousand processes; nothing in the daemon
+ * passes it.
+ */
+export function socketHoldersIn(dir, { skip = () => false, io = {} } = {}) {
+  const inside = insideDir(dir);
+  if (!inside) return { holders: [], complete: true };
+  const pids = procPids(io.list);
+  if (pids === null) return null;
+  const { rows, complete } = scanProcs(
+    pids,
+    (raw) => {
+      const cwd = cwdOf(raw);
+      if (cwd === null || !inside(cwd)) return null;
+      const pid = Number(raw);
+      if (skip(pid)) return null;
+      const inodes = socketInodesOf(raw);
+      return inodes === null ? null : { pid, inodes };
+    },
+    io.bound
+  );
+  return { holders: rows, complete };
+}

package/bin/lib/processes.mjs

@@ -44,17 +44,18 @@
  */
 
 import { execFileSync } from 'node:child_process';
-import { readFileSync, readdirSync } from 'node:fs';
+import { readFileSync } from 'node:fs';
 import { platform } from 'node:os';
+import { procPids, scanProcs } from './procScan.mjs';
 
-/** Matched rows collected per scan before the walk stops early — a bound on
- *  the WORK done for one pathological group, never on which part of /proc is
- *  looked at. It used to cut the pid LIST before filtering, and readdir answers
- *  in string order, so a busy box kept '1', '10', '100'… and dropped a tab's
- *  watcher at pid 912345 while `liveGroups` (which has no cap) still called its
- *  group alive: the tab read "looked, found none" and a Stop on it answered
- *  not_found. */
-const MAX_PIDS = 4000;
+// THE WALK'S BOUND is `procScan.mjs`'s: matched rows collected before the walk
+// stops early — a bound on the WORK done for one pathological group, never on
+// which part of /proc is looked at. It used to cut the pid LIST before
+// filtering, and readdir answers in string order, so a busy box kept '1',
+// '10', '100'… and dropped a tab's watcher at pid 912345 while `liveGroups`
+// (which has no cap) still called its group alive: the tab read "looked,
+// found none" and a Stop on it answered not_found. The listener scans made
+// the same mistake after this one was fixed, which is why the rule moved.
 /** Rows reported per session. A watcher, a dev server and its child is three;
  *  twenty is somebody's compose stack and the extra rows say nothing. */
 export const MAX_PROCS = 12;
@@ -123,31 +124,26 @@ function cmdlineOf(pid) {
  *  pinned without a box that runs four thousand processes. Nothing in the
  *  daemon passes `io`. */
 export function scanLinux(pgids, io = {}) {
-  const list = io.list ?? (() => readdirSync('/proc'));
   const pgrpFor = io.pgrpOf ?? pgrpOf;
   const cmdFor = io.cmdlineOf ?? cmdlineOf;
   const rssFor = io.rssBytes ?? rssBytes;
-  let pids;
-  try {
-    pids = list().filter((d) => /^\d+$/.test(d));
-  } catch {
-    return [];
-  }
-
-  const out = [];
-  for (const raw of pids) {
-    if (out.length >= MAX_PIDS) break;
-    const pid = Number(raw);
-    const pgrp = pgrpFor(raw);
-    if (pgrp === null || !pgids.has(pgrp)) continue;
-    // The CLI itself — its argv is the prompt. See the header.
-    if (pid === pgrp) continue;
-    const cmd = cmdFor(raw);
-    if (!cmd) continue;
-    const rss = rssFor(raw);
-    out.push({ pid, pgid: pgrp, cmd, ...(rss != null ? { rss } : {}) });
-  }
-  return out;
+  const pids = procPids(io.list);
+  if (pids === null) return [];
+  return scanProcs(
+    pids,
+    (raw) => {
+      const pid = Number(raw);
+      const pgrp = pgrpFor(raw);
+      if (pgrp === null || !pgids.has(pgrp)) return null;
+      // The CLI itself — its argv is the prompt. See the header.
+      if (pid === pgrp) return null;
+      const cmd = cmdFor(raw);
+      if (!cmd) return null;
+      const rss = rssFor(raw);
+      return { pid, pgid: pgrp, cmd, ...(rss != null ? { rss } : {}) };
+    },
+    io.bound
+  ).rows;
 }
 
 function scanDarwin(pgids) {
@@ -242,12 +238,8 @@ export function liveGroups(pgids) {
     }
     return alive;
   }
-  let pids;
-  try {
-    pids = readdirSync('/proc').filter((d) => /^\d+$/.test(d));
-  } catch {
-    return want; // cannot tell — keep what we had rather than forget a live tab
-  }
+  const pids = procPids();
+  if (pids === null) return want; // cannot tell — keep what we had rather than forget a live tab
   for (const raw of pids) {
     const pgrp = pgrpOf(raw);
     if (pgrp !== null && want.has(pgrp)) alive.add(pgrp);