mixdog 1.4.0 → 1.4.2

package/src/runtime/agent/orchestrator/tools/lib/native-spawn-client.mjs

@@ -13,6 +13,51 @@ const RESTART_BACKOFF_MS = 30_000;
 const SERVER_READY_TIMEOUT_MS = 5_000;
 const REQUIRED_LIFECYCLE_CAPS = Object.freeze(['trackedForeground', 'promoteTask', 'cancelOwner']);
 
+// Windows containment. A spawn that asks for it (`spawnOptions.contain`, the
+// shell runner's commands) runs in a job object it cannot break away from, and
+// the server reports what became of that job's tree (`treeOutcome`, below):
+// verified empty, the whole tree is gone, so a kill needs no process-table
+// snapshot first. A program that must start children with
+// CREATE_BREAKAWAY_FROM_JOB (some installers, launchers) fails to under it.
+// `MIXDOG_SHELL_ALLOW_BREAKAWAY=1` in a command's OWN environment
+// (`spawnOptions.env`) opts that command out; in Mixdog's environment it is
+// the emergency switch for every command. Either way the command keeps the
+// conservative process-table tracking. A failed command is never re-run
+// without containment: it may already have had side effects.
+// Servers without the `verifiedContainment` capability are never asked.
+export const ALLOW_BREAKAWAY_ENV = 'MIXDOG_SHELL_ALLOW_BREAKAWAY';
+
+/** Whether a spawn with `spawnOptions` asks the server `caps` for containment. */
+export function nativeSpawnContainmentRequested(
+  caps,
+  spawnOptions = {},
+  { platform = process.platform, env = process.env } = {}
+) {
+  return (
+    spawnOptions?.contain === true &&
+    platform === 'win32' &&
+    caps?.verifiedContainment === true &&
+    env[ALLOW_BREAKAWAY_ENV] !== '1' &&
+    spawnOptions.env?.[ALLOW_BREAKAWAY_ENV] !== '1'
+  );
+}
+
+// treeOutcome of a contained spawn (null until known):
+//   'empty'       verified: every process of the tree has exited (final)
+//   'pending'     killed, the server is still verifying
+//   'preserved'   the root exited on its own before any kill reached it; the
+//                 server keeps its survivors in their job for a while, where a
+//                 targeted cancel (`cancel` by request id, `cancelTask`) still
+//                 kills exactly them and is verified like any kill
+//   'unverified'  killed, but the job was never verified empty (final)
+//   'released'    the kept survivors were let go unobserved (final). With
+//                 `breakawayRestored: false` (on `tree_released`, `exit`, task
+//                 snapshots) they were not even let go: they stay in a job they
+//                 cannot leave. Either way unknown for good, never gone.
+const FINAL_TREE_OUTCOMES = new Set(['empty', 'unverified', 'released']);
+const treeOutcomeOf = (value) =>
+  value === 'pending' || value === 'preserved' || FINAL_TREE_OUTCOMES.has(value) ? value : null;
+
 let _server = null;
 let _binaryPath;
 let _lastFailureAt = 0;
@@ -205,12 +250,19 @@ function normalizeTask(task) {
     stdoutPath: override?.stdoutPath || null,
     stderrPath: override?.stderrPath || null,
     mergeStderr: false,
+    contained: task.contained === true,
+    treeOutcome: treeOutcomeOf(task.treeOutcome),
   };
 }
 
 function acceptTask(message) {
   const task = normalizeTask(message?.task);
   if (!task) return null;
+  const known = _tasks.get(task.jobId);
+  // A final outcome stands: a snapshot taken before its report is late.
+  if (FINAL_TREE_OUTCOMES.has(known?.treeOutcome) && known.requestId === task.requestId) {
+    task.treeOutcome = known.treeOutcome;
+  }
   _tasks.set(task.jobId, task);
   _markTerminalTask(task.jobId, task.status);
   _taskEvents.emit(task.jobId, task);
@@ -260,6 +312,13 @@ class NativeSpawnChild extends EventEmitter {
     this._cancel = cancel;
     this._send = send;
     this._closed = false;
+    // Windows kernel creation time (FILETIME ticks, decimal) from the server's
+    // 'spawned' event; null from servers that do not report it.
+    this.creationTime = null;
+    // Spawned into a job it cannot leave, and what the server reported about
+    // that job's tree (treeOutcomeOf).
+    this.contained = false;
+    this.treeOutcome = null;
   }
 
   // stdinPipe children only (warm shell standby): forward script text to the
@@ -394,6 +453,21 @@ function _teardown(error, { kill = true } = {}) {
   }
 }
 
+// The server's outcome for the tree of request `id`. Only a request of THIS
+// server still awaiting a final outcome takes it: a lost server's trees stay
+// unconfirmed, whatever a new server later says about a reused request id.
+function _settleTree(server, id, outcome) {
+  const entry = server.trees.get(id);
+  if (!entry || FINAL_TREE_OUTCOMES.has(entry.child.treeOutcome)) return;
+  entry.child.treeOutcome = outcome;
+  if (FINAL_TREE_OUTCOMES.has(outcome)) server.trees.delete(id);
+  const task = entry.jobId ? _tasks.get(entry.jobId) : null;
+  if (task && task.requestId === id && !FINAL_TREE_OUTCOMES.has(task.treeOutcome)) {
+    task.treeOutcome = outcome;
+    _taskEvents.emit(entry.jobId, { ...task });
+  }
+}
+
 export async function shutdownNativeSpawnServer(reason = 'process-exit', timeoutMs = 1_000) {
   const server = _server;
   if (!server) return true;
@@ -442,7 +516,9 @@ function _ensureServer() {
     _lastFailureAt = Date.now();
     return null;
   }
-  const server = { child, pending: new Map(), sequence: 0, ready: false, caps: {} };
+  // trees: request id -> { child, jobId } of contained spawns awaiting a final
+  // tree outcome (it may follow their exit).
+  const server = { child, pending: new Map(), trees: new Map(), sequence: 0, ready: false, caps: {} };
   let resolveReady;
   server.readyPromise = new Promise((resolve) => {
     resolveReady = resolve;
@@ -472,7 +548,16 @@ function _ensureServer() {
       const jobId = String(message?.jobId || '');
       if (jobId) _dropTaskEntry(jobId, { notifyServer: false });
     } else if (event.startsWith('task_')) {
-      acceptTask(message);
+      const task = acceptTask(message);
+      // A job id assigned by the server (background) or later (track).
+      const tree = task ? server.trees.get(task.requestId) : null;
+      if (tree) tree.jobId = task.jobId;
+    } else if (event === 'tree_empty') {
+      _settleTree(server, Number(message?.id), 'empty');
+    } else if (event === 'tree_unverified') {
+      _settleTree(server, Number(message?.id), 'unverified');
+    } else if (event === 'tree_released') {
+      _settleTree(server, Number(message?.id), 'released');
     }
     const pending = server.pending.get(Number(message?.id));
     if (!pending) return;
@@ -570,6 +655,7 @@ export function tryNativeSpawn({ shell, argv, spawnOptions = {}, cwd } = {}) {
   // fields and keep piping, so the capability gate decides rather than hope.
   const _fileCapture =
     server.caps?.fileCapture === true && Boolean(spawnOptions.stdoutPath) && Boolean(spawnOptions.stderrPath);
+  const contain = nativeSpawnContainmentRequested(server.caps, spawnOptions);
   const request = {
     id,
     program: String(shell || ''),
@@ -589,6 +675,7 @@ export function tryNativeSpawn({ shell, argv, spawnOptions = {}, cwd } = {}) {
         }
       : {}),
     ...(spawnOptions.stdinPipe === true ? { stdinPipe: true } : {}),
+    ...(contain ? { contain: true } : {}),
     command: spawnOptions.command || undefined,
     shellType: spawnOptions.shellType || undefined,
     ownerSessionId: spawnOptions.ownerSessionId || undefined,
@@ -611,6 +698,12 @@ export function tryNativeSpawn({ shell, argv, spawnOptions = {}, cwd } = {}) {
       const event = String(message?.event || '');
       if (event === 'spawned') {
         fake.pid = Number(message.pid) || undefined;
+        if (/^\d+$/.test(String(message.creationTime ?? ''))) fake.creationTime = String(message.creationTime);
+        // Only a containment the request asked for counts.
+        if (contain && message.contained === true) {
+          fake.contained = true;
+          server.trees.set(id, { child: fake, jobId: request.jobId || null });
+        }
         fake.emit('spawn');
         return;
       }
@@ -628,6 +721,10 @@ export function tryNativeSpawn({ shell, argv, spawnOptions = {}, cwd } = {}) {
         server.pending.delete(id);
         fake.exitCode = message.code == null ? null : Number(message.code);
         fake.signalCode = message.signal || null;
+        // The outcome when the server finished the request; a pending one is
+        // made final by a later report. A contained exit without one (a
+        // malformed or partial report) proves nothing.
+        if (fake.contained) _settleTree(server, id, treeOutcomeOf(message.treeOutcome) ?? 'unverified');
         fake._closed = true;
         fake.emit('close', fake.exitCode, fake.signalCode);
         _recomputeServerRef(server);

package/src/runtime/agent/orchestrator/tools/lib/owned-shell-trees.mjs

@@ -5,6 +5,8 @@
 // PROCESS_TABLE_READ_BOUND_MS, and then sends the kill whether or not they
 // arrived. A missing snapshot leaves the outcome unknown, so the workspace
 // stays held under the observation loop instead of being released blind.
+// A tree the spawn server contains (Windows job) needs no snapshot: its
+// prepareKill answers true, so a cancel of only such trees is sent at once.
 import { cancelNativeTasks } from './native-spawn-client.mjs';
 import { killAfterSnapshot } from './shell-descendants.mjs';
 

package/src/runtime/agent/orchestrator/tools/lib/shell-descendants.mjs

@@ -54,6 +54,17 @@ export function killAfterSnapshot(snapshot, kill) {
 
 const identityKey = (entry) => `${entry.pid}:${entry.token ?? ''}`;
 
+// Windows keeps a process's parent id after that parent exits and hands the
+// pid to a new process within milliseconds, so a parent link can name a
+// process created after the one listing it: an unrelated process then looks
+// like the new holder's child. A child is never created before its parent.
+// (POSIX reparents orphans, so its links never dangle.) Only kernel creation
+// times are compared — the table's tokens and the spawn server's root
+// creation time, both FILETIME ticks — at the table's microsecond precision;
+// a parent whose time is unknown excludes nothing. Any other token (POSIX
+// lstart, scripted test tokens) is unknown.
+const createdUs = (ticks) => (typeof ticks === 'string' && /^\d+$/.test(ticks) ? BigInt(ticks) / 10n : null);
+
 /** Tracks one command's process tree across its termination.
  *
  *  `capture()` records the identities of the root and every descendant while
@@ -66,8 +77,11 @@ const identityKey = (entry) => `${entry.pid}:${entry.token ?? ''}`;
  *      or (POSIX) a member of the command's group is alive   → running
  *    - no complete pre-exit capture exists                   → unknown
  *    - a tracked process without a creation token is present → unknown
- *  A failed table read rejects; callers treat it as unknown. */
-export function createProcessTreeTracker({ pid, members = [], exitObserved = false } = {}) {
+ *  A failed table read rejects; callers treat it as unknown.
+ *
+ *  `rootCreationTime`: the root's kernel creation time from its spawn (see
+ *  native-spawn-client), known even once the root is gone uncaptured. */
+export function createProcessTreeTracker({ pid, members = [], exitObserved = false, rootCreationTime = null } = {}) {
   const rootPid = Number(pid) || 0;
   let rootToken = null;
   let complete = false;
@@ -92,6 +106,12 @@ export function createProcessTreeTracker({ pid, members = [], exitObserved = fal
   // are ours. A different process under that pid is a reuse — not ours.
   const rootPidIsOurs = (table, rootAlive) =>
     rootAlive || !table.tokenOf.has(rootPid) || (rootToken != null && table.tokenOf.get(rootPid) === rootToken);
+  // When `cur` (a live root, or a present identity) was created, if known.
+  const createdAt = (table, cur, rootAlive) => {
+    if (!isWin) return null;
+    if (cur !== rootPid) return createdUs(table.tokenOf.get(cur));
+    return createdUs(rootCreationTime) ?? createdUs(rootAlive ? table.tokenOf.get(rootPid) : rootToken);
+  };
 
   function absorb(table, rootAlive) {
     const from = [];
@@ -100,8 +120,11 @@ export function createProcessTreeTracker({ pid, members = [], exitObserved = fal
     const seen = new Set(from);
     while (from.length) {
       const cur = from.pop();
+      const parentCreated = createdAt(table, cur, rootAlive);
       for (const child of table.childrenOf.get(cur) ?? []) {
         if (seen.has(child)) continue;
+        const childCreated = parentCreated == null ? null : createdUs(table.tokenOf.get(child));
+        if (childCreated != null && childCreated < parentCreated) continue;
         seen.add(child);
         track(table, child);
         from.push(child);
@@ -173,19 +196,77 @@ export function createProcessTreeTracker({ pid, members = [], exitObserved = fal
   };
 }
 
+/** The tracker of a KILLED tree the native spawn server contains (a Windows
+ *  job object nothing can break away from), driven only by the server's
+ *  outcome for that job (`outcome()`, see native-spawn-client treeOutcome).
+ *  It never reads the process table: membership is the job's, never a guess
+ *  from parent links, which a reused root pid makes point at the wrong
+ *  processes. So the kill never waits for a snapshot.
+ *    'empty'                 gone
+ *    'preserved'             the root exited on its own before the kill
+ *                            reached the server, which kept its survivors in
+ *                            the job: `cancel()` re-sends the kill to exactly
+ *                            that job (once), and its verdict follows
+ *    'unverified'/'released' unknown for good, and incomplete, so a
+ *                            force-release ends the watch: never gone
+ *    anything else           unknown until the server reports (a lost server
+ *                            never does) */
+export function createContainedTreeTracker({ outcome, cancel }) {
+  let cancelled = false;
+  return {
+    contained: true,
+    get complete() {
+      const value = outcome();
+      return value !== 'unverified' && value !== 'released';
+    },
+    live: [],
+    capture: async () => true,
+    acceptExitObservation() {},
+    async observe() {
+      const value = outcome();
+      if (value === 'empty') return 'gone';
+      if (value === 'preserved' && !cancelled) {
+        cancelled = true;
+        try {
+          cancel();
+        } catch {
+          /* the server link is gone: the outcome stays unknown */
+        }
+      }
+      return 'unknown';
+    },
+  };
+}
+
 /** Terminate every identity the last observation found alive (console hosts
  *  excepted: they are witnesses, never workers). These are processes of a tree
  *  that was KILLED — they escaped its process group (setsid, job control, a
  *  double fork that kept its parent link) or outlived the root on Windows —
  *  so the kill is not finished while they run. Windows: taskkill /T /F;
  *  POSIX: SIGTERM, then SIGKILL after a short grace. */
-function sweepLiveIdentities(tracker) {
+export function sweepLiveIdentities(tracker) {
   const targets = tracker.live
     .filter((entry) => entry.token != null && !CONSOLE_HOST.test(entry.name))
     .map((entry) => entry.pid);
   return targets.length > 0 ? killProcessTrees(targets) : Promise.resolve();
 }
 
+/** A tracker for a watch that goes on after its hold was force-released: an
+ *  observation that stays 'unknown' on a tracker that can never complete (the
+ *  root is gone and its pre-kill capture was incomplete) ends the watch via
+ *  `stop`. Termination is never reported by it. */
+export function endWatchWhenUnconfirmable(tracker, { released, stop }) {
+  return Object.create(tracker, {
+    observe: {
+      value: async (options) => {
+        const state = await tracker.observe(options);
+        if (released() && state === 'unknown' && !tracker.complete) stop();
+        return state;
+      },
+    },
+  });
+}
+
 /** One observation loop: observe now, then every `intervalMs` until the tree
  *  is confirmed gone, then run `onTerminated` once. 'running', 'unknown', a
  *  failed or unanswered (by the next cadence tick) observation and a failing
@@ -194,8 +275,9 @@ function sweepLiveIdentities(tracker) {
  *  timer; nothing else (listener, timer) outlives the loop. Nothing in it ever
  *  releases on time alone.
  *
- *  `sweep` (a killed tree): a pass that finds captured identities alive
- *  terminates them and observes again in the same pass, so a cancellation
+ *  `sweep` (a killed tree; a boolean, or a predicate read on every pass so a
+ *  cancel that arrives later is retried each cadence): a pass that finds
+ *  captured identities alive terminates them and observes again in the same pass, so a cancellation
  *  ends with the tree gone instead of a held folder over live processes.
  *  A missing pre-kill capture stays unknown even if the owning session
  *  closes: its lifetime is not evidence that every descendant has exited. */
@@ -230,7 +312,7 @@ export function watchTermination({
         observation.catch(() => {});
         // A pass that has not answered by the next cadence tick is unknown.
         state = await withinBound(observation, intervalMs, 'unknown');
-        if (state === 'running' && sweep && !stopped) {
+        if (state === 'running' && !stopped && (typeof sweep === 'function' ? sweep() : sweep)) {
           await withinBound(
             sweepLiveIdentities(tracker).catch(() => {}),
             intervalMs,
@@ -315,24 +397,26 @@ function delay(ms) {
  *               by pid (Windows re-parents nothing: a process whose parent
  *               exited keeps a dangling parent id, so an intermediate that
  *               already exited breaks the link).
- *  Rejects when the process table cannot be read completely. */
-export async function probeShellDescendants({ pid } = {}) {
+ *  Rejects when the process table cannot be read completely.
+ *  `rootCreationTime`: see createProcessTreeTracker. */
+export async function probeShellDescendants({ pid, rootCreationTime = null } = {}) {
   const root = Number(pid) || 0;
   if (root <= 0) return null;
   // POSIX fast path: no member of the command's group at all.
   if (!isWin && !groupAlive(root)) return null;
-  const tracker = createProcessTreeTracker({ pid: root, exitObserved: true });
+  const tracker = createProcessTreeTracker({ pid: root, exitObserved: true, rootCreationTime });
   const state = await tracker.observe({ rootExited: true });
   if (state === 'gone') return null;
   if (state === 'unknown') throw new Error('Remaining child processes could not be verified.');
-  return survivorHandle(root, tracker.live);
+  return survivorHandle(root, tracker.live, rootCreationTime);
 }
 
-function survivorHandle(rootPid, live) {
+function survivorHandle(rootPid, live, rootCreationTime) {
   const watch = live.map(({ pid, token, name }) => ({ pid, token, name }));
   const killPids = watch.filter((entry) => !CONSOLE_HOST.test(entry.name)).map((entry) => entry.pid);
   return {
     rootPid,
+    rootCreationTime,
     groupPid: isWin ? null : rootPid,
     killPids,
     watchPids: watch.map((entry) => entry.pid),
@@ -342,13 +426,18 @@ function survivorHandle(rootPid, live) {
 }
 
 const trackerFor = (handle) =>
-  createProcessTreeTracker({ pid: handle.rootPid, members: handle.watch, exitObserved: true });
+  createProcessTreeTracker({
+    pid: handle.rootPid,
+    members: handle.watch,
+    exitObserved: true,
+    rootCreationTime: handle.rootCreationTime,
+  });
 
 /** Resolve once every observed survivor (by identity) has exited, or false
  *  once `signal` aborts. These processes are not our children any more, so
  *  there is no exit event to subscribe to; the shared observation loop
  *  re-checks them at the termination cadence. */
-export function waitForShellDescendants(handle, { signal = null } = {}) {
+export function waitForShellDescendants(handle, { signal = null, sweep = false } = {}) {
   if (!handle) return Promise.resolve(true);
   return new Promise((resolve) => {
     if (signal?.aborted) {
@@ -361,6 +450,7 @@ export function waitForShellDescendants(handle, { signal = null } = {}) {
     };
     const stop = watchTermination({
       tracker: trackerFor(handle),
+      sweep,
       onTerminated: () => {
         signal?.removeEventListener('abort', onAbort);
         resolve(true);

package/src/runtime/agent/orchestrator/tools/lib/shell-run-background/promote-job.mjs

@@ -92,6 +92,8 @@ export async function handOverLease(run) {
   const lease = run.resourceLease;
   run.resourceLease = null;
   await lease?.release();
-  run.workspaceAdmission?.();
+  const released = run.workspaceAdmission?.();
   run.workspaceAdmission = null;
+  // Fails only when workspace admission stopped (reported there), which keeps the folder held.
+  await Promise.resolve(released).catch(() => {});
 }

package/src/runtime/agent/orchestrator/tools/lib/shell-run-settle.mjs

@@ -3,7 +3,7 @@
 // lease cleanup that a promoted or unconfirmed-kill child defers to its own
 // real exit.
 import { ExecResult, SHELL_OUTPUT_INLINE_CAP } from '../shell-exec-output.mjs';
-import { createProcessTreeTracker, probeShellDescendants, watchTermination } from './shell-descendants.mjs';
+import { endWatchWhenUnconfirmable, probeShellDescendants, watchTermination } from './shell-descendants.mjs';
 import { unregisterOwnedShellTree } from './owned-shell-trees.mjs';
 import {
   adoptShellWorkspaceAdmission,
@@ -17,6 +17,7 @@ import {
   detachAbortHandler,
   keepTerminationUnconfirmedRecord,
   releaseResourceLease,
+  runTreeTracker,
 } from './shell-run-state.mjs';
 
 // Unconfirmed-kill cleanup ceiling: the result is already reported, but the
@@ -26,8 +27,8 @@ import {
 // it follows confirmed termination only (see below).
 const UNCONFIRMED_KILL_CLEANUP_CEILING_MS = 60_000;
 
-/** Settles once a held run's whole tree is confirmed gone (or its hold was
- *  force-released): what its result left in use defers to this. */
+/** Settles once a held run's whole tree is confirmed gone: what its result
+ *  left in use defers to this. A force-release does not settle it. */
 function treeSettled(run) {
   if (!run.treeSettled) {
     run.treeSettled = new Promise((resolve) => {
@@ -52,28 +53,56 @@ export function releaseAdmissionOnConfirmedTermination(run, { markNow = true, sw
   // gone only once its first observation is not 'gone'.
   if (markNow) keepTerminationUnconfirmedRecord(run);
   treeSettled(run);
+  // The workspace leases stop counting here; the returned promise settles once
+  // their removal is on disk. A force-release only drops the hold: the tree
+  // stays observed, and only its confirmed exit settles it (`terminated`).
+  let released;
+  let holdDropped = false;
   const release = () => {
-    run.workspaceAdmission?.();
-    run.workspaceAdmission = null;
-    run.stopTerminationWatch?.();
     clearTerminationHold(run.foregroundRecordId);
-    clearForegroundRecord(run);
+    if (!holdDropped) {
+      released = run.workspaceAdmission?.();
+      run.workspaceAdmission = null;
+      clearForegroundRecord(run);
+      holdDropped = true;
+    }
+    return released;
+  };
+  const terminated = () => {
+    const dropped = release();
+    run.stopTerminationWatch?.();
     run.resolveTreeSettled();
+    return dropped;
   };
   registerTerminationHold(run.foregroundRecordId, {
     ownerSessionId: run.foregroundRecordInput?.ownerSessionId || null,
     cwd: run.foregroundRecordInput?.cwd || null,
     release,
   });
-  run.terminationTracker = run.terminationTracker || createProcessTreeTracker({ pid: child.pid });
+  runTreeTracker(run);
+  // After a force-release the watch only waits for a confirmed exit. An
+  // incomplete pre-kill capture of a root that is gone can never be completed,
+  // so an observation that stays unknown on it ends the watch (never settling
+  // the tree: `treeSettled` follows a confirmed exit only).
   run.stopTerminationWatch = watchTermination({
-    tracker: run.terminationTracker,
+    tracker: endWatchWhenUnconfirmable(run.terminationTracker, {
+      released: () => holdDropped,
+      stop: () => run.stopTerminationWatch?.(),
+    }),
     rootExited: () => child.exitCode != null || child.signalCode != null,
     // A killed run is not over while processes it started still run.
     sweep,
-    onTerminated: release,
-    onUnconfirmed: markNow ? null : () => keepTerminationUnconfirmedRecord(run),
-    releaseRequested: () => takeReleaseRequest(run.foregroundRecordId),
+    onTerminated: terminated,
+    onUnconfirmed: markNow
+      ? null
+      : () => {
+          if (!holdDropped) keepTerminationUnconfirmedRecord(run);
+        },
+    // A release requested from another process is the same force-release.
+    releaseRequested: () => {
+      if (takeReleaseRequest(run.foregroundRecordId)) void release();
+      return false;
+    },
   });
 }
 
@@ -165,8 +194,11 @@ export async function readCapturedOutput(taskOutput, final = false) {
 // instead of a clean finish; null means nothing survived.
 async function probeSurvivingDescendants(run) {
   if (run.killed || run.timedOut || !run.child?.pid) return null;
+  // The spawn server verified the command's job empty: nothing survived.
+  if (run.child.treeOutcome === 'empty') return null;
   const descendants = await probeShellDescendants({
     pid: run.child.pid,
+    rootCreationTime: run.child.creationTime,
   });
   if (descendants) descendants.taskId = run.foregroundRecordId;
   return descendants;
@@ -240,8 +272,7 @@ export function createSettle(run, releasePromotedCapture) {
       // explicit force-release, and the record is kept, marked unconfirmed.
       // (The probe runs only for an unkilled root, so the lifecycle is not
       // already held here.)
-      run.terminationTracker = run.terminationTracker || createProcessTreeTracker({ pid: run.child.pid });
-      run.terminationTracker.acceptExitObservation();
+      runTreeTracker(run).acceptExitObservation();
       releaseAdmissionOnConfirmedTermination(run);
     }
     // Marked unconfirmed (with its force-release) only once an observation
@@ -249,9 +280,12 @@ export function createSettle(run, releasePromotedCapture) {
     if (confirmKill) releaseAdmissionOnConfirmedTermination(run, { markNow: false });
     if (!lifecycleHeld && !descendantsUnknown && run.workspaceAdmission) {
       try {
+        let released = null;
         if (descendants) adoptShellWorkspaceAdmission(run.foregroundRecordId, run.workspaceAdmission);
-        else run.workspaceAdmission();
+        else released = run.workspaceAdmission();
         run.workspaceAdmission = null;
+        // The result is reported once the removal is on disk, as when it was written synchronously.
+        await released;
       } catch (error) {
         taskOutput.writeError = taskOutput.writeError || error;
         exitCode = exitCode || 1;

package/src/runtime/agent/orchestrator/tools/lib/shell-run-spawn.mjs

@@ -18,8 +18,9 @@ import { _maybeEncodePowerShellCommand } from '../shell-powershell.mjs';
 import { spawnShellWithRetry as _spawnShellWithRetry } from './shell-spawn-retry.mjs';
 import { STANDBY_ARGS, takeWarmShellStandby } from './shell-warm-standby.mjs';
 import { SHELL_OUTPUT_DISK_CAP } from '../shell-exec-output.mjs';
-import { admitWorkspaceActivity, tryAdmitWorkspaceActivity } from '../../../../shared/worktrees/activity-gate.mjs';
+import { admitWorkspaceActivity, tryAdmitWorkspaceActivityAsync } from '../../../../shared/worktrees/activity-gate.mjs';
 import { worktreeError } from '../../../../shared/worktrees/contract.mjs';
+import { bothReleased } from '../builtin/lib/shell-job-records.mjs';
 import { capturePreKill, registerForegroundOwnedTree, treeKillForceSettle } from './shell-run-state.mjs';
 import { releaseAdmissionOnConfirmedTermination } from './shell-run-settle.mjs';
 import { killAfterSnapshot } from './shell-descendants.mjs';
@@ -135,6 +136,8 @@ async function gatedSpawn({
         command,
         ownerSessionId,
         clientHostPid,
+        // Windows: the whole tree stays in the command's job (native-spawn-client).
+        contain: true,
         ...(stdinPipe ? { stdinPipe: true } : {}),
         ...(capture
           ? {
@@ -223,20 +226,25 @@ async function spawnAdmittedShellChild({
     }));
   run.child = spawned.child;
   registerForegroundOwnedTree(run, ownerSessionId);
+  // Attached before the admission below yields: until the caller attaches its
+  // listeners, the child's output is buffered and its close replayed.
+  spawned.attachErrorHandler(onChildError);
   const parentAdmission = run.workspaceAdmission;
-  const childAdmission = tryAdmitWorkspaceActivity(ownerSessionId || run.foregroundRecordId, cwd || process.cwd(), {
-    pid: Number(run.child.pid) || process.pid,
-    kind: 'command',
-  });
+  // The command's own lease (under its pid: what keeps the folder reserved
+  // should this runtime die). The parent's lease covers the folder until this
+  // one is written to both copies, and stays the only release until then.
+  const childAdmission = await tryAdmitWorkspaceActivityAsync(
+    ownerSessionId || run.foregroundRecordId,
+    cwd || process.cwd(),
+    {
+      pid: Number(run.child.pid) || process.pid,
+      kind: 'command',
+    }
+  );
   if (!childAdmission) throw worktreeError('WORKTREE_BUSY_JOBS', 'The command workspace changed during spawn.');
-  run.workspaceAdmission = () => {
-    childAdmission();
-    parentAdmission();
-  };
-  spawned.attachErrorHandler(onChildError);
-  // Feed the script only after the error handler is attached; server
-  // messages cannot be processed before this synchronous block yields.
-  // Single atomic write+EOF, as for the standby.
+  run.workspaceAdmission = () => bothReleased(childAdmission, parentAdmission);
+  // Feed the script only once its lease is written. Single atomic write+EOF,
+  // as for the standby.
   abortSignal?.throwIfAborted();
   if (standby) standby.feed(spawnCommand, cwd);
   else if (stdinScript !== null) spawned.child.writeStdin(stdinScript, { close: true });
@@ -249,18 +257,23 @@ async function spawnAdmittedShellChild({
     run.foregroundRecordTimer = null;
     if (run.settled || run.autoBackgrounded || !run.child?.pid) return;
     run.foregroundRecordPublished = true;
-    try {
-      publishForegroundShellRecord({
-        ...run.foregroundRecordInput,
-        jobId: run.foregroundRecordId,
-        pid: run.child.pid,
-        startedAtMs: run.commandStartedAtMs,
-      });
-    } catch (error) {
-      run.spawnError = error;
-      run.failureReason = 'workspace publication failed';
-      treeKillForceSettle(run, 'workspace-publication-failed');
-    }
+    void (async () => {
+      try {
+        await publishForegroundShellRecord({
+          ...run.foregroundRecordInput,
+          jobId: run.foregroundRecordId,
+          pid: run.child.pid,
+          startedAtMs: run.commandStartedAtMs,
+        });
+      } catch (error) {
+        // The record's lease could not be written: the command is stopped, as
+        // before — unless it ended or was promoted (its own leases) meanwhile.
+        if (run.settled || run.autoBackgrounded) return;
+        run.spawnError = error;
+        run.failureReason = 'workspace publication failed';
+        treeKillForceSettle(run, 'workspace-publication-failed');
+      }
+    })();
   }, FOREGROUND_RECORD_DELAY_MS);
   run.foregroundRecordTimer.unref?.();
 }
@@ -278,11 +291,16 @@ export async function spawnShellChild(input) {
     return await spawnAdmittedShellChild(input);
   } catch (error) {
     if (!input.run.child) {
-      input.run.workspaceAdmission();
+      const released = input.run.workspaceAdmission();
       input.run.workspaceAdmission = null;
+      // The spawn's own error is the one reported; a release fails only when
+      // workspace admission stopped (which keeps the folder held).
+      await Promise.resolve(released).catch(() => {});
     } else {
       try {
-        // Identities first: the kill may break the parent chain.
+        input.run.killed = true;
+        // Identities first: the kill may break the parent chain (a contained
+        // tree needs none: its kill is at once and verified by the server).
         // Bounded: the kill is sent even if the snapshot hangs or fails.
         await killAfterSnapshot(capturePreKill(input.run), () => killShellJob(input.run.foregroundRecordId));
         const detail = await waitForShellJob(input.run.foregroundRecordId);