mixdog 1.4.1 → 1.4.2

package/src/runtime/agent/orchestrator/tools/builtin/shell-jobs.mjs

@@ -22,7 +22,7 @@ import {
   waitNativeTask,
 } from '../lib/native-spawn-client.mjs';
 import { attachJobInsights, shellJobPublicTaskResult } from './lib/shell-job-insights.mjs';
-import { tryAdmitWorkspaceActivity } from '../../../../shared/worktrees/activity-gate.mjs';
+import { tryAdmitWorkspaceActivityAsync } from '../../../../shared/worktrees/activity-gate.mjs';
 import { worktreeError } from '../../../../shared/worktrees/contract.mjs';
 import {
   adoptShellWorkspaceAdmission,
@@ -30,6 +30,7 @@ import {
   completeShellJobRecord,
   listShellJobRecords,
   markShellJobTerminationUnconfirmed,
+  pendingWorkspaceAdmission,
   publishShellJobRecord,
   recordShellJobHop,
   registerTerminationHold,
@@ -37,9 +38,12 @@ import {
   takeReleaseRequest,
 } from './lib/shell-job-records.mjs';
 import {
+  createContainedTreeTracker,
   createProcessTreeTracker,
+  endWatchWhenUnconfirmable,
   killAfterSnapshot,
   PROCESS_TABLE_READ_BOUND_MS,
+  sweepLiveIdentities,
   watchTermination,
   withinBound,
 } from '../lib/shell-descendants.mjs';
@@ -61,13 +65,33 @@ const PRE_DEADLINE_CAPTURE_MS = PROCESS_TABLE_READ_BOUND_MS + 1_000;
 // the promotion baseline predates whatever the job started since (a server,
 // an npm child); the baseline still stands when the fresh read fails. Marks
 // the job killed, so its settle relies on this snapshot instead of an
-// after-exit observation.
+// after-exit observation. A job the spawn server contains needs none (true at
+// once): its kill is verified by the server's empty-job report.
 function prepareTrackedKill(entry) {
   entry.killed = true;
+  if (entry.contained) return true;
   return (entry.baseline || Promise.resolve(false)).then(() =>
     entry.tracker.capture().catch(() => entry.tracker.complete)
   );
 }
+
+const FINAL_TREE_OUTCOMES = new Set(['empty', 'unverified', 'released']);
+
+/** The tracker of a contained job's killed or emptied tree, driven by the
+ *  server's outcome (a final one latched: the task entry may expire).
+ *  Survivors the server kept in the job are cancelled through it. */
+function containedJobTracker(jobId) {
+  let final = null;
+  return createContainedTreeTracker({
+    outcome: () => {
+      if (final) return final;
+      const outcome = getNativeTask(jobId)?.treeOutcome ?? null;
+      if (FINAL_TREE_OUTCOMES.has(outcome)) final = outcome;
+      return outcome;
+    },
+    cancel: () => cancelNativeTask(jobId),
+  });
+}
 import { isPidAlive } from '../../../../shared/pid-liveness.mjs';
 import { hopOf } from '../../../../shared/bot-hops.mjs';
 import {
@@ -110,22 +134,30 @@ function demoteBackgroundShellPriority(pid) {
 // The workspace admission a job record holds is released only once the job's
 // processes are confirmed gone — the same confirmation path a foreground run
 // uses, not the native terminal status alone.
-function trackShellJobRecord(task, options) {
+// Resolves once both workspace leases are written; the promoted run's own
+// admission is released only after that (handOverLease).
+async function trackShellJobRecord(task, options) {
   const jobId = String(task?.jobId || '').trim();
   if (!jobId) return;
-  publishShellJobRecord(task, options);
+  const published = publishShellJobRecord(task, options);
   if (task?.cwd) {
     // The record's own reader is filed under the job's root pid, which the
     // gate drops the moment that pid dies. Survivors must keep the folder
     // reserved, so this runtime holds it under its own live pid as well.
-    const hold = tryAdmitWorkspaceActivity(options?.ownerSessionId || jobId, task.cwd, { kind: 'command' });
-    if (!hold) throw worktreeError('WORKTREE_BUSY_JOBS', 'The command folder is being managed.');
-    adoptShellWorkspaceAdmission(jobId, hold);
+    await published;
+    const holding = tryAdmitWorkspaceActivityAsync(options?.ownerSessionId || jobId, task.cwd, { kind: 'command' });
+    adoptShellWorkspaceAdmission(jobId, pendingWorkspaceAdmission(holding));
+    if (!(await holding)) throw worktreeError('WORKTREE_BUSY_JOBS', 'The command folder is being managed.');
   }
   const tracker = task?.cwd ? createProcessTreeTracker({ pid: task.pid }) : null;
+  // Killed, or emptied on its own, a contained job is confirmed by the server
+  // (containedJobTracker); the process tracker still observes the survivors a
+  // root that exited on its own leaves.
+  const contained = task?.contained === true;
   let resolveTerminated = null;
   const entry = {
     tracker,
+    contained,
     killed: false,
     baseline: null,
     // Settles once every process of the job is confirmed gone (or the user
@@ -150,7 +182,7 @@ function trackShellJobRecord(task, options) {
   // identities of what the job started since its promotion.
   const deadlineMs = Math.floor(Number(options?.timeoutMs) || 0);
   const deadlineCapture =
-    tracker && deadlineMs > 0
+    tracker && !contained && deadlineMs > 0
       ? setTimeout(
           () => {
             if (!settled) void tracker.capture().catch(() => false);
@@ -177,31 +209,45 @@ function trackShellJobRecord(task, options) {
     // settle does. A killed one relies on the snapshot taken before the kill.
     const killed = entry.killed || detail.killed || detail.timedOut || String(detail.status) === 'cancelled';
     if (!killed) tracker.acceptExitObservation();
+    const watched =
+      contained && (killed || detail.treeOutcome === 'empty') ? containedJobTracker(jobId) : tracker;
     // The completion notice is already on its way (watchBackgroundShellJob);
     // the record — and with it the workspace admission — completes only once
     // every process is confirmed gone, or the user releases it explicitly.
+    // A force-release only drops the workspace hold (the record completes);
+    // the job stays tracked and observed until its processes are confirmed
+    // gone, and only that confirmation reports it terminated.
+    let released = null;
+    const releaseHold = () => {
+      clearTerminationHold(jobId);
+      released ??= completeShellJobRecord(jobId, normalized);
+      return released;
+    };
     let finished = false;
     const finish = () => {
       if (finished) return;
       finished = true;
       stop();
-      clearTerminationHold(jobId);
       if (backgroundTrackers.get(jobId) === entry) backgroundTrackers.delete(jobId);
       resolveTerminated(true);
-      return completeShellJobRecord(jobId, normalized);
+      return releaseHold();
     };
     const stop = watchTermination({
-      tracker,
+      tracker: endWatchWhenUnconfirmable(watched, { released: () => released !== null, stop: () => stop() }),
       // A killed job is not over while processes it started still run.
       sweep: killed,
       onTerminated: finish,
-      releaseRequested: () => takeReleaseRequest(jobId),
+      // A release requested from another process is the same force-release.
+      releaseRequested: () => {
+        if (takeReleaseRequest(jobId)) void releaseHold();
+        return false;
+      },
       onUnconfirmed: () => {
         void markShellJobTerminationUnconfirmed(jobId);
         registerTerminationHold(jobId, {
           ownerSessionId: options?.ownerSessionId || null,
           cwd: task.cwd,
-          release: finish,
+          release: releaseHold,
         });
       },
     });
@@ -415,7 +461,27 @@ export function killShellJob(jobId) {
     // complete, a fresh read). The kill waits for it at most the read bound
     // and is sent regardless; without a snapshot the outcome stays unknown and
     // the folder stays held under the observation loop.
-    void killAfterSnapshot(prepareTrackedKill(tracked), () => cancelNativeTask(jobId));
+    // The kill never outruns the promotion baseline itself: a read still in
+    // flight takes its table after a kill sent beside it, finds the root gone,
+    // and the job could never be confirmed terminated. That read ends by its
+    // own enumeration deadline. A contained job is cancelled at once.
+    const snapshot = prepareTrackedKill(tracked);
+    tracked.killSent =
+      snapshot === true
+        ? new Promise((resolve) => resolve(cancelNativeTask(jobId)))
+        : tracked.baseline.then(() => killAfterSnapshot(snapshot, () => cancelNativeTask(jobId)));
+    return { ...attachJobInsights(normalizeShellJobDetail(current)), killed: true };
+  }
+  if (tracked) {
+    // The root already exited but its tracked descendants run on: the stop
+    // reaches them through the tracker alone, whether or not the native task
+    // is still cached; the termination watch then releases the folder.
+    void tracked.tracker
+      .observe({ rootExited: true })
+      .then(() => sweepLiveIdentities(tracked.tracker))
+      .catch(() => {});
+    // An expired native entry says nothing about the root, so none is claimed.
+    if (!current) return { jobId, killed: true };
     return { ...attachJobInsights(normalizeShellJobDetail(current)), killed: true };
   }
   const detail = cancelNativeTask(jobId);
@@ -424,6 +490,12 @@ export function killShellJob(jobId) {
   return { ...attachJobInsights(normalizeShellJobDetail(detail)), killed: wasRunning };
 }
 
+/** Settles once the kill a stop of the tracked job queued has been sent (at
+ *  once when none is pending). */
+export function shellJobKillSent(jobId) {
+  return Promise.resolve(backgroundTrackers.get(String(jobId || ''))?.killSent).catch(() => {});
+}
+
 /** True once every process of a tracked background job is confirmed gone,
  *  false while any is still alive when `timeoutMs` passes. A job without a
  *  process tracker (or one already finished) has nothing left to confirm. */
@@ -572,7 +644,7 @@ export async function promoteForegroundShellJob({
   }
   // Added before tracking: the record's settlement removes it again.
   promotedJobIds.add(native.jobId);
-  trackShellJobRecord(native, { ownerSessionId, clientHostPid, startedAtMs: started, timeoutMs });
+  await trackShellJobRecord(native, { ownerSessionId, clientHostPid, startedAtMs: started, timeoutMs });
   return native;
 }
 
@@ -606,8 +678,8 @@ export function publishForegroundShellRecord({
   clientHostPid = null,
   terminationUnconfirmed = false,
 }) {
-  if (!jobId || !Number.isFinite(Number(pid)) || Number(pid) <= 0) return;
-  publishShellJobRecord(
+  if (!jobId || !Number.isFinite(Number(pid)) || Number(pid) <= 0) return Promise.resolve();
+  return publishShellJobRecord(
     { jobId, command, cwd, pid: Number(pid), shellType },
     {
       ownerSessionId,
@@ -696,8 +768,9 @@ export async function shutdownShellJobs(_reason = 'runtime-close', { scope = nul
   let cancelledWatchers = 0;
   // Identities first, as every other kill does: once a root dies, what it
   // started outside its process group is reparented and can no longer be
-  // found. The cancel is sent at the snapshot bound regardless.
-  await killAfterSnapshot(Promise.all(prepareOwnedShellTreeKills(scoped ? ownerSessionId : null)), () => {
+  // found. The cancel is sent at the snapshot bound regardless — and at once
+  // when no snapshot is pending (every tree contained, or already captured).
+  const cancelAll = () => {
     for (const task of jobs) {
       if (cancelBackgroundShellJobWatch(task.jobId)) cancelledWatchers += 1;
       try {
@@ -705,7 +778,10 @@ export async function shutdownShellJobs(_reason = 'runtime-close', { scope = nul
       } catch {}
       jobNotifyCtxByJobId.delete(task.jobId);
     }
-  });
+  };
+  const snapshots = prepareOwnedShellTreeKills(scoped ? ownerSessionId : null);
+  if (snapshots.length === 0) cancelAll();
+  else await killAfterSnapshot(Promise.all(snapshots), cancelAll);
   const settled = await Promise.all(jobs.map((task) => waitNativeTask(task.jobId, 1_200).catch(() => null)));
   // A process still running after the wait is not forgotten: it keeps being
   // stopped until its exit is confirmed.

package/src/runtime/agent/orchestrator/tools/builtin/task-tool.mjs

@@ -1,11 +1,13 @@
 // Generic background-task tool (status/wait/cancel).
 import {
   buildJobNotFoundMessage,
+  isShellJobRunning,
   peekShellJob,
   killShellJob,
   otherSessionBackgroundShellJobCount,
   cancelBackgroundShellJobWatch,
   clearShellJobNotifyCtx,
+  shellJobKillSent,
   shellJobPublicTaskResult,
   shellJobTaskStatus,
   waitForShellJob,
@@ -21,6 +23,7 @@ import {
   cancelBackgroundTask,
   completeBackgroundTask,
   getBackgroundTask,
+  listBackgroundTasks,
   registerBackgroundTask,
   renderBackgroundTask,
   renderBackgroundTaskList,
@@ -227,12 +230,16 @@ async function cancelShellTaskOutcome(task, taskId, options) {
   // their shell). Remember that it WAS live so the outcome is
   // reported as a cancellation rather than "task not found".
   const wasRunning = task.status === 'running';
+  // A tracked tree outlives the native task's cache entry: its own
+  // termination watch, not the native task, confirms the stop.
+  const trackedTree = isShellJobRunning(taskId);
   const job = killShellJob(taskId);
   if (job) {
     // Confirm the process actually terminated before reporting a
     // terminal status. Removing the watcher on the strength of a
     // delivered signal left a live, unmonitored process behind a
-    // false 'cancelled'.
+    // false 'cancelled'. The window opens once the kill is actually sent.
+    await shellJobKillSent(taskId);
     const confirmed = await waitForShellJob(taskId, { timeoutMs: TASK_CANCEL_CONFIRM_MS });
     if (confirmed && confirmed.status === 'running') {
       // Watcher and notify context stay armed: the eventual exit
@@ -248,10 +255,10 @@ async function cancelShellTaskOutcome(task, taskId, options) {
     }
     // The root exited; what it started outside its process group is swept
     // by the job's termination watch. Cancelled means all of it is gone.
-    if (confirmed && !(await waitShellJobTerminated(taskId, TASK_CANCEL_TREE_CONFIRM_MS))) {
+    if ((confirmed || trackedTree) && !(await waitShellJobTerminated(taskId, TASK_CANCEL_TREE_CONFIRM_MS))) {
       return { outcome: 'unconfirmed', text: cancelPendingText(taskId) };
     }
-    if (!confirmed) {
+    if (!confirmed && !trackedTree) {
       // No terminal event and no observable task: absence of
       // state is not proof of termination. Stop tracking it so it
       // cannot hang as 'running' forever, but never claim it died.
@@ -273,7 +280,7 @@ async function cancelShellTaskOutcome(task, taskId, options) {
   cancelBackgroundTask(taskId, 'cancelled by task control');
   // A task whose own cancel hook kills (what a finished command left running)
   // reports what that kill confirmed.
-  const hookKill = job ? null : await task.cancelOutcome;
+  const hookKill = await task.cancelOutcome;
   if (hookKill && hookKill.terminated !== true) return { outcome: 'unconfirmed', text: cancelPendingText(taskId) };
   return job || wasRunning
     ? {
@@ -298,22 +305,64 @@ export async function stopBackgroundShellJob(taskId, options = {}) {
   const id = typeof taskId === 'string' ? taskId.trim() : '';
   if (!id) return { stopped: false, error: 'task_id is required' };
   const task = getBackgroundTask(id, { context: options });
-  if (!task || task.surface !== 'shell') return { stopped: false, error: `task not found: ${id}` };
+  if (task?.surface !== 'shell') return { stopped: false, error: `task not found: ${id}` };
   const job = peekShellJob(id);
   const status = job ? job.status : task.status;
-  if (status !== 'running') return { stopped: false, error: `task already ${status}: ${id}` };
+  // A root that exited while tracked descendants run is still stoppable, and
+  // so is the survivors task of a finished command (`detached`): its own
+  // registry status, not the finished command's cached native entry, says
+  // whether anything still runs.
+  const survivors = task.detached === true && task.status === 'running';
+  if (status !== 'running' && !isShellJobRunning(id) && !survivors)
+    return { stopped: false, error: `task already ${status}: ${id}` };
   try {
     const { outcome, text } = await cancelShellTaskOutcome(task, id, options);
     if (outcome === 'cancelled') return { stopped: true };
-    return {
-      stopped: false,
-      error: outcome === 'unconfirmed' ? `cancellation not confirmed: ${id}` : text.replace(/^Error:\s*/, ''),
-    };
+    if (outcome === 'unconfirmed')
+      return { stopped: false, unconfirmed: true, error: `cancellation not confirmed: ${id}` };
+    return { stopped: false, error: text.replace(/^Error:\s*/, '') };
   } catch (error) {
     return { stopped: false, error: error instanceof Error ? error.message : String(error) };
   }
 }
 
+// The running shell tasks the caller's session owns (promoted jobs and the
+// survivors a finished command left), including a task whose command already
+// exited while its tracked descendants still run (what the island lists as
+// termination unconfirmed). A foreground command holds no background task, so
+// it never appears here.
+function sessionShellTasks(options) {
+  const sessionId = String(options.callerSessionId || '').trim();
+  if (!sessionId) return [];
+  return listBackgroundTasks({ ...options, surface: 'shell' })
+    .filter((row) => row.status === 'running' || isShellJobRunning(row.task_id))
+    .map((row) => getBackgroundTask(row.task_id))
+    .filter((task) => task?.ownerSessionId === sessionId);
+}
+
+/** What `/stop` would stop: this session's running background shells. */
+export function listStoppableShellJobs(options = {}) {
+  return sessionShellTasks(options).map((task) => ({
+    taskId: task.taskId,
+    command: String(task.input?.command || task.label || ''),
+  }));
+}
+
+/**
+ * Stop every background shell of the caller's session, each through the same
+ * confirmed cancel as a single stop. `stopping` counts the ones whose
+ * processes are not yet confirmed gone (they keep being terminated).
+ */
+export async function stopBackgroundShellJobs(options = {}) {
+  const results = await Promise.all(
+    sessionShellTasks(options).map((task) => stopBackgroundShellJob(task.taskId, options))
+  );
+  return {
+    stopped: results.filter((result) => result.stopped).length,
+    stopping: results.filter((result) => result.unconfirmed).length,
+  };
+}
+
 export async function executeTaskTool(args, options = {}) {
   const action = typeof args.action === 'string' ? args.action.toLowerCase() : '';
   if (!action) return 'Error: task action is required';

package/src/runtime/agent/orchestrator/tools/graph-manifest.json

@@ -1,30 +1,30 @@
 {
-  "version": "0.1.34",
+  "version": "0.1.35",
   "_comment": "Synced from immutable graph-v release assets.",
   "assets": {
     "darwin-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.34/mixdog-graph-darwin-arm64",
-      "sha256": "5bcf8c79135224d2e77eec70a57debd06d462bab01418ce1a6c1656a858eedad"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.35/mixdog-graph-darwin-arm64",
+      "sha256": "f7a6a0bf10e4a541e9f7c529388fc14401b5f1727a5e8629fbeaf17c094300b2"
     },
     "darwin-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.34/mixdog-graph-darwin-x64",
-      "sha256": "2845ea2afa2802841589bd74c8785670cfe8c6b58b2ad5b258ac928afccbaa94"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.35/mixdog-graph-darwin-x64",
+      "sha256": "a0d2bc124e264f7c5699af71adae3f047ee07591ddff415274bea23935bdbb75"
     },
     "linux-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.34/mixdog-graph-linux-arm64",
-      "sha256": "0364bc1c3741683fbdb45ed755f2baabb50a0556e2354c13a05f3d816bc1c461"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.35/mixdog-graph-linux-arm64",
+      "sha256": "ed5d75b8cd3a4de5366c233cfd55b07931b56fac7dd82fadad6a7b172ced97ed"
     },
     "linux-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.34/mixdog-graph-linux-x64",
-      "sha256": "4f9091b2c5a89631efade89aae17e5411dda8bfec99e15ff64948906f9fa20d0"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.35/mixdog-graph-linux-x64",
+      "sha256": "b9b54529264d93648c16142ad05ba706c2757304688ccbf7d89e1a46762f4c13"
     },
     "win32-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.34/mixdog-graph-win32-arm64.exe",
-      "sha256": "03abef6f09b095b86c5cc32c6bead3f5d82f77961220c31221ab0b3f60974110"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.35/mixdog-graph-win32-arm64.exe",
+      "sha256": "dd9fb667ddeb366dbfeabf58b3023e8b0f40b09edccc50dc5902b33de97de233"
     },
     "win32-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.34/mixdog-graph-win32-x64.exe",
-      "sha256": "650cffe82ccbe9898e7ac8fc9b025c92098a810ad3ca95276c0bb8c19a328993"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.35/mixdog-graph-win32-x64.exe",
+      "sha256": "be2abdb0b1c28647332531ac149a4ebba17e8cfb7093b7d5694a4be8bd21e369"
     }
   }
 }

package/src/runtime/agent/orchestrator/tools/lib/native-spawn-client.mjs

@@ -13,6 +13,51 @@ const RESTART_BACKOFF_MS = 30_000;
 const SERVER_READY_TIMEOUT_MS = 5_000;
 const REQUIRED_LIFECYCLE_CAPS = Object.freeze(['trackedForeground', 'promoteTask', 'cancelOwner']);
 
+// Windows containment. A spawn that asks for it (`spawnOptions.contain`, the
+// shell runner's commands) runs in a job object it cannot break away from, and
+// the server reports what became of that job's tree (`treeOutcome`, below):
+// verified empty, the whole tree is gone, so a kill needs no process-table
+// snapshot first. A program that must start children with
+// CREATE_BREAKAWAY_FROM_JOB (some installers, launchers) fails to under it.
+// `MIXDOG_SHELL_ALLOW_BREAKAWAY=1` in a command's OWN environment
+// (`spawnOptions.env`) opts that command out; in Mixdog's environment it is
+// the emergency switch for every command. Either way the command keeps the
+// conservative process-table tracking. A failed command is never re-run
+// without containment: it may already have had side effects.
+// Servers without the `verifiedContainment` capability are never asked.
+export const ALLOW_BREAKAWAY_ENV = 'MIXDOG_SHELL_ALLOW_BREAKAWAY';
+
+/** Whether a spawn with `spawnOptions` asks the server `caps` for containment. */
+export function nativeSpawnContainmentRequested(
+  caps,
+  spawnOptions = {},
+  { platform = process.platform, env = process.env } = {}
+) {
+  return (
+    spawnOptions?.contain === true &&
+    platform === 'win32' &&
+    caps?.verifiedContainment === true &&
+    env[ALLOW_BREAKAWAY_ENV] !== '1' &&
+    spawnOptions.env?.[ALLOW_BREAKAWAY_ENV] !== '1'
+  );
+}
+
+// treeOutcome of a contained spawn (null until known):
+//   'empty'       verified: every process of the tree has exited (final)
+//   'pending'     killed, the server is still verifying
+//   'preserved'   the root exited on its own before any kill reached it; the
+//                 server keeps its survivors in their job for a while, where a
+//                 targeted cancel (`cancel` by request id, `cancelTask`) still
+//                 kills exactly them and is verified like any kill
+//   'unverified'  killed, but the job was never verified empty (final)
+//   'released'    the kept survivors were let go unobserved (final). With
+//                 `breakawayRestored: false` (on `tree_released`, `exit`, task
+//                 snapshots) they were not even let go: they stay in a job they
+//                 cannot leave. Either way unknown for good, never gone.
+const FINAL_TREE_OUTCOMES = new Set(['empty', 'unverified', 'released']);
+const treeOutcomeOf = (value) =>
+  value === 'pending' || value === 'preserved' || FINAL_TREE_OUTCOMES.has(value) ? value : null;
+
 let _server = null;
 let _binaryPath;
 let _lastFailureAt = 0;
@@ -205,12 +250,19 @@ function normalizeTask(task) {
     stdoutPath: override?.stdoutPath || null,
     stderrPath: override?.stderrPath || null,
     mergeStderr: false,
+    contained: task.contained === true,
+    treeOutcome: treeOutcomeOf(task.treeOutcome),
   };
 }
 
 function acceptTask(message) {
   const task = normalizeTask(message?.task);
   if (!task) return null;
+  const known = _tasks.get(task.jobId);
+  // A final outcome stands: a snapshot taken before its report is late.
+  if (FINAL_TREE_OUTCOMES.has(known?.treeOutcome) && known.requestId === task.requestId) {
+    task.treeOutcome = known.treeOutcome;
+  }
   _tasks.set(task.jobId, task);
   _markTerminalTask(task.jobId, task.status);
   _taskEvents.emit(task.jobId, task);
@@ -260,6 +312,13 @@ class NativeSpawnChild extends EventEmitter {
     this._cancel = cancel;
     this._send = send;
     this._closed = false;
+    // Windows kernel creation time (FILETIME ticks, decimal) from the server's
+    // 'spawned' event; null from servers that do not report it.
+    this.creationTime = null;
+    // Spawned into a job it cannot leave, and what the server reported about
+    // that job's tree (treeOutcomeOf).
+    this.contained = false;
+    this.treeOutcome = null;
   }
 
   // stdinPipe children only (warm shell standby): forward script text to the
@@ -394,6 +453,21 @@ function _teardown(error, { kill = true } = {}) {
   }
 }
 
+// The server's outcome for the tree of request `id`. Only a request of THIS
+// server still awaiting a final outcome takes it: a lost server's trees stay
+// unconfirmed, whatever a new server later says about a reused request id.
+function _settleTree(server, id, outcome) {
+  const entry = server.trees.get(id);
+  if (!entry || FINAL_TREE_OUTCOMES.has(entry.child.treeOutcome)) return;
+  entry.child.treeOutcome = outcome;
+  if (FINAL_TREE_OUTCOMES.has(outcome)) server.trees.delete(id);
+  const task = entry.jobId ? _tasks.get(entry.jobId) : null;
+  if (task && task.requestId === id && !FINAL_TREE_OUTCOMES.has(task.treeOutcome)) {
+    task.treeOutcome = outcome;
+    _taskEvents.emit(entry.jobId, { ...task });
+  }
+}
+
 export async function shutdownNativeSpawnServer(reason = 'process-exit', timeoutMs = 1_000) {
   const server = _server;
   if (!server) return true;
@@ -442,7 +516,9 @@ function _ensureServer() {
     _lastFailureAt = Date.now();
     return null;
   }
-  const server = { child, pending: new Map(), sequence: 0, ready: false, caps: {} };
+  // trees: request id -> { child, jobId } of contained spawns awaiting a final
+  // tree outcome (it may follow their exit).
+  const server = { child, pending: new Map(), trees: new Map(), sequence: 0, ready: false, caps: {} };
   let resolveReady;
   server.readyPromise = new Promise((resolve) => {
     resolveReady = resolve;
@@ -472,7 +548,16 @@ function _ensureServer() {
       const jobId = String(message?.jobId || '');
       if (jobId) _dropTaskEntry(jobId, { notifyServer: false });
     } else if (event.startsWith('task_')) {
-      acceptTask(message);
+      const task = acceptTask(message);
+      // A job id assigned by the server (background) or later (track).
+      const tree = task ? server.trees.get(task.requestId) : null;
+      if (tree) tree.jobId = task.jobId;
+    } else if (event === 'tree_empty') {
+      _settleTree(server, Number(message?.id), 'empty');
+    } else if (event === 'tree_unverified') {
+      _settleTree(server, Number(message?.id), 'unverified');
+    } else if (event === 'tree_released') {
+      _settleTree(server, Number(message?.id), 'released');
     }
     const pending = server.pending.get(Number(message?.id));
     if (!pending) return;
@@ -570,6 +655,7 @@ export function tryNativeSpawn({ shell, argv, spawnOptions = {}, cwd } = {}) {
   // fields and keep piping, so the capability gate decides rather than hope.
   const _fileCapture =
     server.caps?.fileCapture === true && Boolean(spawnOptions.stdoutPath) && Boolean(spawnOptions.stderrPath);
+  const contain = nativeSpawnContainmentRequested(server.caps, spawnOptions);
   const request = {
     id,
     program: String(shell || ''),
@@ -589,6 +675,7 @@ export function tryNativeSpawn({ shell, argv, spawnOptions = {}, cwd } = {}) {
         }
       : {}),
     ...(spawnOptions.stdinPipe === true ? { stdinPipe: true } : {}),
+    ...(contain ? { contain: true } : {}),
     command: spawnOptions.command || undefined,
     shellType: spawnOptions.shellType || undefined,
     ownerSessionId: spawnOptions.ownerSessionId || undefined,
@@ -611,6 +698,12 @@ export function tryNativeSpawn({ shell, argv, spawnOptions = {}, cwd } = {}) {
       const event = String(message?.event || '');
       if (event === 'spawned') {
         fake.pid = Number(message.pid) || undefined;
+        if (/^\d+$/.test(String(message.creationTime ?? ''))) fake.creationTime = String(message.creationTime);
+        // Only a containment the request asked for counts.
+        if (contain && message.contained === true) {
+          fake.contained = true;
+          server.trees.set(id, { child: fake, jobId: request.jobId || null });
+        }
         fake.emit('spawn');
         return;
       }
@@ -628,6 +721,10 @@ export function tryNativeSpawn({ shell, argv, spawnOptions = {}, cwd } = {}) {
         server.pending.delete(id);
         fake.exitCode = message.code == null ? null : Number(message.code);
         fake.signalCode = message.signal || null;
+        // The outcome when the server finished the request; a pending one is
+        // made final by a later report. A contained exit without one (a
+        // malformed or partial report) proves nothing.
+        if (fake.contained) _settleTree(server, id, treeOutcomeOf(message.treeOutcome) ?? 'unverified');
         fake._closed = true;
         fake.emit('close', fake.exitCode, fake.signalCode);
         _recomputeServerRef(server);

package/src/runtime/agent/orchestrator/tools/lib/owned-shell-trees.mjs

@@ -5,6 +5,8 @@
 // PROCESS_TABLE_READ_BOUND_MS, and then sends the kill whether or not they
 // arrived. A missing snapshot leaves the outcome unknown, so the workspace
 // stays held under the observation loop instead of being released blind.
+// A tree the spawn server contains (Windows job) needs no snapshot: its
+// prepareKill answers true, so a cancel of only such trees is sent at once.
 import { cancelNativeTasks } from './native-spawn-client.mjs';
 import { killAfterSnapshot } from './shell-descendants.mjs';