nexus-agents 8.104.2 → 8.104.4

package/dist/{ast-rule-runner-FPQQQLBT.js → ast-rule-runner-RDUGQF2T.js}

@@ -9,8 +9,8 @@ import {
   getBuiltInAstRulesPath,
   loadRules,
   runAstQaRules
-} from "./chunk-7ZQ52O5I.js";
-import "./chunk-CVOJYSBP.js";
+} from "./chunk-TTSGRUYH.js";
+import "./chunk-5255FSWF.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
 import "./chunk-PX6F3LHL.js";
@@ -26,4 +26,4 @@ export {
   loadRules,
   runAstQaRules
 };
-//# sourceMappingURL=ast-rule-runner-FPQQQLBT.js.map
+//# sourceMappingURL=ast-rule-runner-RDUGQF2T.js.map

package/dist/{child-mcp-config-OU674OG4.js → child-mcp-config-UA3R4INF.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-OITVVSWO.js";
 import {
   createLogger
-} from "./chunk-CVOJYSBP.js";
+} from "./chunk-5255FSWF.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
 import "./chunk-PX6F3LHL.js";
@@ -56,4 +56,4 @@ async function generateMcpConfig(options) {
 export {
   generateMcpConfig
 };
-//# sourceMappingURL=child-mcp-config-OU674OG4.js.map
+//# sourceMappingURL=child-mcp-config-UA3R4INF.js.map

package/dist/{chunk-LFGUXWV4.js → chunk-3CAYUVSE.js}

@@ -1,14 +1,14 @@
 import {
   ensureGatewayDiscovered,
   gatewayDiscoveryGeneration
-} from "./chunk-ZOGXBT7D.js";
+} from "./chunk-S74JTO6K.js";
 import {
   createAutoAdapter
-} from "./chunk-NYMBXK57.js";
+} from "./chunk-DRB64KKE.js";
 import {
   getDefaultCliCircuitBreakerRegistry,
   mapModelErrorToCategory
-} from "./chunk-NZ7F62NM.js";
+} from "./chunk-MKNJZXPH.js";
 import {
   CircularBuffer,
   ConfigError,
@@ -34,7 +34,7 @@ import {
   resolveModelIdentitySync,
   toRateLimitError,
   warnIfGatewayCostUndeclared
-} from "./chunk-CVOJYSBP.js";
+} from "./chunk-5255FSWF.js";
 
 // src/config/model-equivalence.ts
 var VARIANT_QUIRKS = /* @__PURE__ */ new Set(["small", "image"]);
@@ -1068,4 +1068,4 @@ export {
   getGlobalRegistry,
   resetGlobalRegistry
 };
-//# sourceMappingURL=chunk-LFGUXWV4.js.map
+//# sourceMappingURL=chunk-3CAYUVSE.js.map

package/dist/{chunk-JWOBCZOI.js → chunk-4BC6HM2G.js}

@@ -2,10 +2,10 @@ import {
   stringifyValue,
   tokenize,
   tokenizeFiltered
-} from "./chunk-7LP6VJRP.js";
+} from "./chunk-SX5DB6UR.js";
 import {
   SessionMemory
-} from "./chunk-Z2WHITKG.js";
+} from "./chunk-6XGZZCLV.js";
 import {
   StatsOnlyAdapter,
   ensureSharedMemoryRegistry
@@ -15,7 +15,7 @@ import {
 } from "./chunk-MUJCGBZW.js";
 import {
   generateId
-} from "./chunk-BBUGUS2S.js";
+} from "./chunk-L7BHYU7J.js";
 import {
   ErrorCode,
   NexusError,
@@ -29,7 +29,7 @@ import {
   ok,
   openSqliteDatabase,
   setSharedMobiMemDbPathResolver
-} from "./chunk-CVOJYSBP.js";
+} from "./chunk-5255FSWF.js";
 import {
   nexusDataPath
 } from "./chunk-LWOX65CP.js";
@@ -5768,4 +5768,4 @@ export {
   shutdownToolMemory,
   ToolMemoryManager
 };
-//# sourceMappingURL=chunk-JWOBCZOI.js.map
+//# sourceMappingURL=chunk-4BC6HM2G.js.map

package/dist/{chunk-CVOJYSBP.js → chunk-5255FSWF.js}

@@ -2729,7 +2729,7 @@ function setDefaultRegistry(registry) {
 }
 async function reloadDefaultRegistry() {
   globalRegistry = buildDefaultRegistry();
-  const { resetGlobalRegistry } = await import("./unified-registry-EPPMS473.js");
+  const { resetGlobalRegistry } = await import("./unified-registry-4C3T4SNP.js");
   resetGlobalRegistry();
   return globalRegistry;
 }
@@ -17358,7 +17358,7 @@ var CompositeRouter = class _CompositeRouter {
    */
   async consultUnifiedContext(task) {
     try {
-      const { getContextForTask, inferTaskCategory } = await import("./context-retriever-CRMH7I27.js");
+      const { getContextForTask, inferTaskCategory } = await import("./context-retriever-BVZ7TGH5.js");
       const ctx = await getContextForTask({
         task: task.content,
         category: inferTaskCategory(task.content),
@@ -19043,4 +19043,4 @@ export {
   AgentCapability,
   OrchestratorError
 };
-//# sourceMappingURL=chunk-CVOJYSBP.js.map
+//# sourceMappingURL=chunk-5255FSWF.js.map

package/dist/{chunk-HGZ2EVGZ.js → chunk-5O3KZ4SQ.js}

@@ -4,10 +4,10 @@ import {
   createOpenAICompatAdapter,
   discoverGatewayCatalog,
   readOpenAICompatEnv
-} from "./chunk-HA762GRI.js";
+} from "./chunk-6JCLZ5YS.js";
 import {
   gatewayProxyUrl
-} from "./chunk-PTL3Y3GG.js";
+} from "./chunk-XWAYOEIZ.js";
 import {
   DEFAULT_OPENAI_COMPAT_ENDPOINT,
   GATEWAY_COST_ENV,
@@ -23,7 +23,7 @@ import {
   getTimeProvider,
   symbols,
   writeLine
-} from "./chunk-CVOJYSBP.js";
+} from "./chunk-5255FSWF.js";
 
 // src/cli/doctor-gateway.ts
 var PROBE_FAMILIES = ["anthropic", "openai", "google"];
@@ -333,4 +333,4 @@ export {
   formatGatewayReport,
   formatGatewaySlotWarnings
 };
-//# sourceMappingURL=chunk-HGZ2EVGZ.js.map
+//# sourceMappingURL=chunk-5O3KZ4SQ.js.map

package/dist/{chunk-VBOI5NLK.js → chunk-6IDKVAZ6.js}

@@ -5,7 +5,7 @@ import {
   err,
   getErrorMessage,
   ok
-} from "./chunk-CVOJYSBP.js";
+} from "./chunk-5255FSWF.js";
 import {
   findRepoRoot,
   getActiveWorkspaceRoot,
@@ -290,4 +290,4 @@ export {
   loadPapersRegistry,
   savePapersRegistry
 };
-//# sourceMappingURL=chunk-VBOI5NLK.js.map
+//# sourceMappingURL=chunk-6IDKVAZ6.js.map

package/dist/{chunk-HA762GRI.js → chunk-6JCLZ5YS.js}

@@ -7,12 +7,12 @@ import {
   readGatewayTransport,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-PTL3Y3GG.js";
+} from "./chunk-XWAYOEIZ.js";
 import {
   assertCustomApiHostResolvesPublic,
   hostnameOf,
   redactApiKey
-} from "./chunk-3IBRN6HM.js";
+} from "./chunk-WQFODDSA.js";
 import {
   sanitizeErrorDetails
 } from "./chunk-2NDA4DHW.js";
@@ -40,7 +40,7 @@ import {
   readModelAllowlist,
   recordUsageEvent,
   refineGatewayCatalog
-} from "./chunk-CVOJYSBP.js";
+} from "./chunk-5255FSWF.js";
 
 // src/adapters/openai-compat-adapter.ts
 import OpenAI2 from "openai";
@@ -1038,4 +1038,4 @@ export {
   createOpenAICompatAdapter,
   buildOpenAICompatAdapters
 };
-//# sourceMappingURL=chunk-HA762GRI.js.map
+//# sourceMappingURL=chunk-6JCLZ5YS.js.map

package/dist/{chunk-Z2WHITKG.js → chunk-6XGZZCLV.js}

@@ -4,7 +4,7 @@ import {
   getErrorMessage,
   getTimeProvider,
   ok
-} from "./chunk-CVOJYSBP.js";
+} from "./chunk-5255FSWF.js";
 
 // src/context/session-memory.ts
 import * as fs from "node:fs";
@@ -370,4 +370,4 @@ export {
   SessionMemory,
   createSessionMemory
 };
-//# sourceMappingURL=chunk-Z2WHITKG.js.map
+//# sourceMappingURL=chunk-6XGZZCLV.js.map

package/dist/{chunk-AI44QZEQ.js → chunk-A3BBWT6J.js}

@@ -4,7 +4,7 @@ import {
 import {
   assessReputation,
   sanitizeInput
-} from "./chunk-4237N3VG.js";
+} from "./chunk-UWKJVCAW.js";
 import {
   allOf
 } from "./chunk-EZNIYU5T.js";
@@ -13,7 +13,7 @@ import {
   err,
   getTimeProvider,
   ok
-} from "./chunk-CVOJYSBP.js";
+} from "./chunk-5255FSWF.js";
 
 // src/dogfooding/pr-reviewer-helpers.ts
 import { randomUUID } from "node:crypto";
@@ -477,4 +477,4 @@ export {
   createFailedReview,
   reviewPostingBlock
 };
-//# sourceMappingURL=chunk-AI44QZEQ.js.map
+//# sourceMappingURL=chunk-A3BBWT6J.js.map

package/dist/{chunk-DOCQDEP6.js → chunk-BAIQLM5D.js}

@@ -4,7 +4,7 @@ import {
   err,
   getErrorMessage,
   ok
-} from "./chunk-CVOJYSBP.js";
+} from "./chunk-5255FSWF.js";
 
 // src/scm/types.ts
 var ScmError = class extends Error {
@@ -281,4 +281,4 @@ export {
   ScmError,
   GitHubProvider
 };
-//# sourceMappingURL=chunk-DOCQDEP6.js.map
+//# sourceMappingURL=chunk-BAIQLM5D.js.map

package/dist/{chunk-I6B4SVW2.js → chunk-DN2N7I6D.js}

@@ -4,7 +4,7 @@ import {
 import {
   createLogger,
   getTimeProvider
-} from "./chunk-CVOJYSBP.js";
+} from "./chunk-5255FSWF.js";
 
 // src/mcp/tools/scanner-registry-fetcher.ts
 import { z } from "zod";
@@ -740,4 +740,4 @@ export {
   generateSecurityPlan,
   buildPlanFromAnalysis
 };
-//# sourceMappingURL=chunk-I6B4SVW2.js.map
+//# sourceMappingURL=chunk-DN2N7I6D.js.map

package/dist/{chunk-J5KHI3AJ.js → chunk-DNJSJZHV.js}

@@ -1,6 +1,6 @@
 import {
   resolveClassGuardMs
-} from "./chunk-CVOJYSBP.js";
+} from "./chunk-5255FSWF.js";
 
 // src/cli/cli-readiness.ts
 var READINESS_LEVELS = ["installed", "authenticated", "serves"];
@@ -90,4 +90,4 @@ export {
   SERVES_PROBE_PROMPT,
   probeServes
 };
-//# sourceMappingURL=chunk-J5KHI3AJ.js.map
+//# sourceMappingURL=chunk-DNJSJZHV.js.map

package/dist/{chunk-NYMBXK57.js → chunk-DRB64KKE.js}

@@ -1,6 +1,6 @@
 import {
   CUSTOM_API_DEFAULT_MODEL
-} from "./chunk-TSC6QE5D.js";
+} from "./chunk-S7A6OFUF.js";
 import {
   AdapterModelError,
   BaseAdapter,
@@ -10,7 +10,7 @@ import {
   readGatewayTransport,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-PTL3Y3GG.js";
+} from "./chunk-XWAYOEIZ.js";
 import {
   assertCustomApiHostResolvesPublic,
   hostnameOf,
@@ -19,7 +19,7 @@ import {
   readGatewayEnv,
   redactApiKey,
   validateCustomApiBaseUrl
-} from "./chunk-3IBRN6HM.js";
+} from "./chunk-WQFODDSA.js";
 import {
   sanitizeOutput
 } from "./chunk-2NDA4DHW.js";
@@ -28,13 +28,13 @@ import {
 } from "./chunk-OITVVSWO.js";
 import {
   getAvailabilityCache
-} from "./chunk-O6CKXSGL.js";
+} from "./chunk-FCB2OKVG.js";
 import {
   extractSystemPrompt
 } from "./chunk-QZUG667L.js";
 import {
   generateHyphenId
-} from "./chunk-BBUGUS2S.js";
+} from "./chunk-L7BHYU7J.js";
 import {
   CliCircuitBreaker,
   DEFAULT_CIRCUIT_BREAKER_CONFIG,
@@ -45,7 +45,7 @@ import {
   getDefaultCliCircuitBreakerRegistry,
   isCallerInputCliError,
   isTimeoutText
-} from "./chunk-NZ7F62NM.js";
+} from "./chunk-MKNJZXPH.js";
 import {
   CLI_NAMES,
   CLI_SUBPROCESS_TIMEOUTS,
@@ -101,7 +101,7 @@ import {
   resolveRetryAfterMs,
   toModelTokenUsage,
   warnIfGatewayCostUndeclared
-} from "./chunk-CVOJYSBP.js";
+} from "./chunk-5255FSWF.js";
 import {
   parseBoolValue
 } from "./chunk-LWOX65CP.js";
@@ -262,7 +262,10 @@ var CliToModelAdapter = class {
   async complete(request) {
     const task = this.toCliTask(request);
     const effectiveTimeoutMs = request.timeoutMs ?? this.defaultTimeoutMs;
-    const opts = effectiveTimeoutMs !== void 0 ? { timeoutMs: effectiveTimeoutMs } : void 0;
+    const opts = effectiveTimeoutMs !== void 0 || request.signal !== void 0 ? {
+      ...effectiveTimeoutMs !== void 0 ? { timeoutMs: effectiveTimeoutMs } : {},
+      ...request.signal !== void 0 ? { signal: request.signal } : {}
+    } : void 0;
     const result = await this.cliAdapter.execute(task, opts);
     if (!result.ok) {
       return err(this.toModelError(result.error));
@@ -2179,6 +2182,7 @@ function buildChildEnv(cliName) {
       if (value !== void 0 && key !== "CLAUDECODE") childEnv[key] = value;
     }
     childEnv[NEXUS_SUBPROCESS_DEPTH_ENV] = nextDepth;
+    stampNoRelaunch(cliName, childEnv);
     return childEnv;
   }
   const vendorKeys = CLI_VENDOR_KEYS[cliName];
@@ -2189,8 +2193,123 @@ function buildChildEnv(cliName) {
     if (isAllowed(key, vendorKeys, extraEnv)) childEnv[key] = value;
   }
   childEnv[NEXUS_SUBPROCESS_DEPTH_ENV] = nextDepth;
+  stampNoRelaunch(cliName, childEnv);
   return childEnv;
 }
+function stampNoRelaunch(cliName, childEnv) {
+  if (cliName === "gemini") childEnv["GEMINI_CLI_NO_RELAUNCH"] = "true";
+}
+
+// src/cli-adapters/process-tree-kill.ts
+import { execFileSync } from "node:child_process";
+import { readdirSync, readFileSync } from "node:fs";
+var MAX_DESCENDANTS = 1e3;
+function isSpawnedProcess(child) {
+  return typeof child.pid === "number" && typeof child.spawnfile === "string" && Array.isArray(child.spawnargs);
+}
+function procChildren(pid) {
+  try {
+    const tasks = readdirSync(`/proc/${String(pid)}/task`);
+    const kids = [];
+    for (const tid of tasks) {
+      const raw = readFileSync(`/proc/${String(pid)}/task/${tid}/children`, "utf8");
+      for (const token of raw.split(/\s+/)) {
+        const kid = Number(token);
+        if (token !== "" && Number.isInteger(kid)) kids.push(kid);
+      }
+    }
+    return kids;
+  } catch {
+    return void 0;
+  }
+}
+function psChildMap() {
+  if (process.platform === "win32") return void 0;
+  try {
+    const out = execFileSync("ps", ["-A", "-o", "pid=,ppid="], {
+      encoding: "utf8",
+      timeout: 2e3
+    });
+    const map = /* @__PURE__ */ new Map();
+    for (const line of out.split("\n")) {
+      const [pidText, ppidText] = line.trim().split(/\s+/);
+      const pid = Number(pidText);
+      const ppid = Number(ppidText);
+      if (!Number.isInteger(pid) || !Number.isInteger(ppid)) continue;
+      map.set(ppid, [...map.get(ppid) ?? [], pid]);
+    }
+    return map;
+  } catch {
+    return void 0;
+  }
+}
+function collectDescendants(root) {
+  const useProc = process.platform === "linux" && procChildren(root) !== void 0;
+  const psMap = useProc ? void 0 : psChildMap();
+  const childrenOf = (pid) => (useProc ? procChildren(pid) : psMap?.get(pid)) ?? [];
+  const seen = /* @__PURE__ */ new Set([root]);
+  const out = [];
+  const queue = [root];
+  while (queue.length > 0 && out.length < MAX_DESCENDANTS) {
+    const pid = queue.shift();
+    for (const kid of childrenOf(pid)) {
+      if (seen.has(kid)) continue;
+      seen.add(kid);
+      out.push(kid);
+      queue.push(kid);
+    }
+  }
+  return out;
+}
+function isPidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code !== "ESRCH";
+  }
+}
+function signalProcessTree(child, signal, known = []) {
+  const pid = child.pid;
+  const fresh = isSpawnedProcess(child) && pid !== void 0 ? collectDescendants(pid) : [];
+  const tree = [.../* @__PURE__ */ new Set([...known, ...fresh])];
+  child.kill(signal);
+  for (const descendant of tree) {
+    try {
+      process.kill(descendant, signal);
+    } catch {
+    }
+  }
+  return tree;
+}
+function isProcessTreeAlive(child, tree = []) {
+  if (child.exitCode === null && child.signalCode === null) return true;
+  return tree.some(isPidAlive);
+}
+var liveTrees = /* @__PURE__ */ new Map();
+var exitHookInstalled = false;
+function trackProcessTree(child) {
+  if (!isSpawnedProcess(child)) return child;
+  liveTrees.set(child, []);
+  child.once("close", () => {
+    liveTrees.delete(child);
+  });
+  if (!exitHookInstalled) {
+    exitHookInstalled = true;
+    process.on("exit", () => {
+      signalTrackedProcessTrees("SIGKILL");
+    });
+  }
+  return child;
+}
+function signalTrackedProcessTrees(signal) {
+  let count = 0;
+  for (const [child, known] of liveTrees) {
+    liveTrees.set(child, signalProcessTree(child, signal, known));
+    count++;
+  }
+  return count;
+}
 
 // src/cli-adapters/subprocess-adapter.ts
 var PLAINTEXT_FALLBACK_MIN_LENGTH = 30;
@@ -2265,7 +2384,18 @@ var SIGKILL_GRACE_MS = 5e3;
 function isTransientError(code) {
   return TRANSIENT_ERROR_CODES.has(code);
 }
-function shouldRetryInPlace(error) {
+function spawnCliChild(cliName, cmdConfig, workDir) {
+  const childEnv = buildChildEnv(cliName);
+  return trackProcessTree(
+    spawn(cmdConfig.command, cmdConfig.args, {
+      stdio: ["pipe", "pipe", "pipe"],
+      env: childEnv,
+      ...typeof workDir === "string" && workDir.trim().length > 0 ? { cwd: workDir } : {}
+    })
+  );
+}
+function shouldRetryInPlace(error, signal) {
+  if (signal?.aborted === true) return false;
   return isTransientError(error.code) && !isDurableCapacityText(error.message);
 }
 var TRANSIENT_EXIT_CODES = /* @__PURE__ */ new Set([137, 143]);
@@ -2335,7 +2465,22 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
   attachAbortSignal(child, signal, resolve) {
     const onAbort = () => {
       if (child.exitCode === null && child.signalCode === null) {
-        child.kill("SIGTERM");
+        const tree = signalProcessTree(child, "SIGTERM");
+        const sigkillTimer = setTimeout(() => {
+          if (isProcessTreeAlive(child, tree)) {
+            this.logger.warn("Child ignored SIGTERM after abort, escalating to SIGKILL", {
+              cli: this.name,
+              sigkillGraceMs: SIGKILL_GRACE_MS
+            });
+            signalProcessTree(child, "SIGKILL", tree);
+          }
+        }, SIGKILL_GRACE_MS);
+        sigkillTimer.unref();
+        if (tree.length === 0) {
+          child.once("close", () => {
+            clearTimeout(sigkillTimer);
+          });
+        }
       }
       resolve(err(this.createError("TIMEOUT", "Aborted by caller signal")));
     };
@@ -2354,7 +2499,7 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
     const requestId = generateHyphenId("cli-req", 8);
     const result = await this.spawnSubprocess(task, options, requestId);
     if (result.ok || !this.transientRetry.enabled) return result;
-    if (!shouldRetryInPlace(result.error)) return result;
+    if (!shouldRetryInPlace(result.error, options.signal)) return result;
     return this.retryTransient(task, options, result, 0, requestId);
   }
   /**
@@ -2377,7 +2522,7 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
     const retryOptions = isTimeout ? { ...options, timeoutMs: Math.round(options.timeoutMs * TIMEOUT_RETRY_MULTIPLIER) } : options;
     const result = await this.spawnSubprocess(task, retryOptions, requestId);
     if (result.ok) return result;
-    if (!shouldRetryInPlace(result.error)) return result;
+    if (!shouldRetryInPlace(result.error, options.signal)) return result;
     return this.retryTransient(task, retryOptions, result, attempt + 1, requestId);
   }
   /**
@@ -2423,14 +2568,14 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
     };
   }
   spawnSubprocess(task, options, requestId) {
-    const cmdConfig = this.getCommand(
-      task.timeoutMs === void 0 ? { ...task, timeoutMs: options.timeoutMs } : task
-    );
-    const startTime = getTimeProvider().now();
     const signal = options.signal;
     if (signal?.aborted === true) {
       return Promise.resolve(err(this.createError("TIMEOUT", "Aborted before spawn")));
     }
+    const cmdConfig = this.getCommand(
+      task.timeoutMs === void 0 ? { ...task, timeoutMs: options.timeoutMs } : task
+    );
+    const startTime = getTimeProvider().now();
     return new Promise((resolveOuter) => {
       const runCleanupOnce = this.onceCleanup(cmdConfig.cleanup);
       const resolve = (r) => {
@@ -2438,13 +2583,7 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
         resolveOuter(r);
       };
       try {
-        const childEnv = buildChildEnv(this.name);
-        const workDir = task.options?.["workDir"];
-        const child = spawn(cmdConfig.command, cmdConfig.args, {
-          stdio: ["pipe", "pipe", "pipe"],
-          env: childEnv,
-          ...typeof workDir === "string" && workDir.trim().length > 0 ? { cwd: workDir } : {}
-        });
+        const child = spawnCliChild(this.name, cmdConfig, task.options?.["workDir"]);
         const onProgress = options.onProgress;
         this.setupChildProcessHandlers({
           child,
@@ -2500,7 +2639,9 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
     });
     child.on("close", (code) => {
       clearTimeout(timers.timeoutId);
-      if (timers.sigkillTimerId !== void 0) clearTimeout(timers.sigkillTimerId);
+      if (timers.sigkillTimerId !== void 0 && timers.tree.length === 0) {
+        clearTimeout(timers.sigkillTimerId);
+      }
       this.logTimingBreakdown(state, startTime, code, requestId);
       resolveOnce(this.classifyCloseResult(code, state, startTime));
     });
@@ -2522,17 +2663,18 @@ var SubprocessCliAdapter = class extends BaseCliAdapter {
   scheduleTimeoutWithSigkillEscalation(opts) {
     const { child, timeoutMs, requestId, resolveOnce } = opts;
     const timers = {
+      tree: [],
       timeoutId: setTimeout(() => {
-        child.kill("SIGTERM");
+        timers.tree = signalProcessTree(child, "SIGTERM");
         resolveOnce(err(this.createError("TIMEOUT", "Execution timed out")));
         timers.sigkillTimerId = setTimeout(() => {
-          if (child.exitCode === null && child.signalCode === null) {
+          if (isProcessTreeAlive(child, timers.tree)) {
             this.logger.warn("Child ignored SIGTERM, escalating to SIGKILL", {
               cli: this.name,
               requestId,
               sigkillGraceMs: SIGKILL_GRACE_MS
             });
-            child.kill("SIGKILL");
+            signalProcessTree(child, "SIGKILL", timers.tree);
           }
         }, SIGKILL_GRACE_MS);
         timers.sigkillTimerId.unref();
@@ -4612,7 +4754,7 @@ ${task.content}` : task.content;
 // src/cli/cli-auth-probe.ts
 import { execFile as execFile2 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync as readFileSync2 } from "node:fs";
 import { homedir } from "node:os";
 import { join as join2 } from "node:path";
 var execFileAsync = promisify2(execFile2);
@@ -4638,7 +4780,7 @@ function probeClaude() {
     );
   }
   try {
-    const parsed = JSON.parse(readFileSync(credPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync2(credPath, "utf-8"));
     if (!isClaudeCredsShape(parsed)) {
       return claudeNeedsLogin(
         "Credentials file present but not in expected shape (missing claudeAiOauth.accessToken)"
@@ -4765,7 +4907,7 @@ async function probeAllClis() {
 }
 
 // src/cli-adapters/codex-mcp-server-probe.ts
-import { execFileSync } from "node:child_process";
+import { execFileSync as execFileSync2 } from "node:child_process";
 var CODEX_MCP_SERVER_UNAVAILABLE_REASON = "codex-cli \u22650.154 has no mcp-server subcommand";
 var CodexMcpServerUnavailableError = class extends Error {
   constructor() {
@@ -4779,7 +4921,7 @@ var PROBE_ARGS = ["mcp-server", "--help"];
 var SUBCOMMAND_PATTERN = /\bmcp-server\b/;
 var defaultExec = (command, args) => {
   try {
-    const stdout = execFileSync(command, [...args], {
+    const stdout = execFileSync2(command, [...args], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       timeout: CLI_SUBPROCESS_TIMEOUTS.statusProbeMs
@@ -4959,6 +5101,7 @@ export {
   BaseCliAdapter,
   NEXUS_SUBPROCESS_DEPTH_ENV,
   readSubprocessDepth,
+  signalTrackedProcessTrees,
   SubprocessCliAdapter,
   asRecord,
   isRecord,
@@ -4993,4 +5136,4 @@ export {
   SdkAdapter,
   createAutoAdapter
 };
-//# sourceMappingURL=chunk-NYMBXK57.js.map
+//# sourceMappingURL=chunk-DRB64KKE.js.map