ompchamber 1.2.0 → 2.0.0

package/src/server/lib/lifecycle/identity.ts

@@ -13,53 +13,19 @@
  * stranger. Identity therefore comes from the OS command line, so a recycled
  * PID reads back as `mismatched`.
  *
- * Where `ps` is unavailable (minimal containers) the on-disk `/proc` entry
- * still answers the identity question on Linux; on Windows, where neither is
- * cheap, identity is reported as `unknown` and callers fall back to liveness.
+ * How the OS is asked is per platform and lives in `./probe` — macOS through
+ * `libproc`, Linux through `/proc`, Windows through signal 0 alone, the BSDs
+ * through `ps`. This module only turns those answers into the states callers
+ * reason about.
+ *
+ * Where identity cannot be read, it is reported as `unknown` and callers fall
+ * back to liveness — never treated as confirmation that the PID is ours.
  */
 
-import fs from 'fs';
+import { processProbe } from '@/server/lib/lifecycle/proc';
 
 export type ProcessState = 'dead' | 'matched' | 'mismatched' | 'unknown';
 
-interface ProcessRow {
-  pid: number;
-  /** `ps` state column — `Z…` means defunct (exited, awaiting reaping). */
-  state: string;
-  command: string;
-}
-
-let cachedTable: { at: number; rows: ProcessRow[] } | null = null;
-
-/**
- * One snapshot of the process table, memoized for a startup decision.
- *
- * Every question in a port check happens within milliseconds, so a briefly
- * cached view is strictly better than spawning `ps` per question.
- */
-function readProcessTable(maxAgeMs = 250): ProcessRow[] {
-  if (cachedTable && Date.now() - cachedTable.at < maxAgeMs) return cachedTable.rows;
-  const rows: ProcessRow[] = [];
-  try {
-    const snapshot = Bun.spawnSync({
-      cmd: ['ps', '-ax', '-o', 'pid=,stat=,command='],
-      stdout: 'pipe',
-      stderr: 'ignore',
-    });
-    if (snapshot.success) {
-      for (const line of snapshot.stdout.toString().split('\n')) {
-        const match = /^\s*(\d+)\s+(\S+)\s+(.*)$/.exec(line);
-        if (!match) continue;
-        rows.push({ pid: Number(match[1]), state: match[2], command: match[3].trim() });
-      }
-    }
-  } catch {
-    // No `ps` on PATH: identity falls back to /proc, liveness to signal 0.
-  }
-  cachedTable = { at: Date.now(), rows };
-  return rows;
-}
-
 /**
  * Liveness check. Never throws.
  *
@@ -71,27 +37,7 @@ function readProcessTable(maxAgeMs = 250): ProcessRow[] {
  */
 export function isProcessAlive(pid: number): boolean {
   if (!Number.isFinite(pid) || pid <= 0) return false;
-  try {
-    process.kill(pid, 0);
-  } catch {
-    return false;
-  }
-  const row = readProcessTable().find((entry) => entry.pid === pid);
-  return row ? !row.state.startsWith('Z') : true;
-}
-
-/** Command line for a live PID, or null when this platform cannot report one. */
-function readProcessCommandLine(pid: number): string | null {
-  const row = readProcessTable().find((entry) => entry.pid === pid);
-  if (row) return row.command.length > 0 ? row.command : null;
-  if (process.platform === 'linux') {
-    try {
-      return fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ').trim() || null;
-    } catch {
-      return null;
-    }
-  }
-  return null;
+  return processProbe.isAlive(pid) && !processProbe.isZombie(pid);
 }
 
 /**
@@ -102,7 +48,7 @@ function readProcessCommandLine(pid: number): string | null {
  */
 export function getProcessState(pid: number): ProcessState {
   if (!isProcessAlive(pid)) return 'dead';
-  const command = readProcessCommandLine(pid);
+  const command = processProbe.commandLine(pid);
   if (command === null) return 'unknown';
   return command.toLowerCase().includes('ompchamber') ? 'matched' : 'mismatched';
 }

package/src/server/lib/lifecycle/proc/darwin.ts

@@ -0,0 +1,238 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * macOS process probe: `libproc` + `sysctl`, no subprocess.
+ *
+ * `ps -ax` answers the same questions, but it costs a process spawn and a full
+ * process-table scan per snapshot — measured at ~32 ms here, against ~0.001 ms
+ * for the direct calls — and the CLI's `waitForProcessExit` polls liveness every
+ * 100 ms. These are the same APIs `ps` itself uses.
+ *
+ * `sysctl(KERN_PROC_PID)` is the liveness source rather than
+ * `proc_pidinfo(PROC_PIDTBSDINFO)`: it answers for a ZOMBIE (which `proc_pidinfo`
+ * refuses, returning 0 — verified) and for root-owned PIDs, so one call covers
+ * liveness and the zombie distinction for every PID.
+ *
+ * Every entry point tolerates failure: a PID that vanished between two calls
+ * makes the syscall report zero bytes, which is "not alive", and a sandbox that
+ * denies the call degrades to signal 0 rather than throwing.
+ *
+ * The libraries are opened on the FIRST CALL rather than at module load, so
+ * merely importing this module — which happens on every platform, whatever
+ * `index.ts` dispatches to — cannot fail. See `bindLibs`.
+ */
+
+import { dlopen, FFIType, ptr } from 'bun:ffi';
+import type { FFIFunction, Library } from 'bun:ffi';
+
+import type { ProcessProbe } from '@/server/lib/lifecycle/proc/types';
+
+/** `sysctl` MIB pieces. */
+const CTL_KERN = 1;
+const KERN_PROC = 14;
+const KERN_PROC_PID = 1;
+const KERN_PROCARGS2 = 49;
+
+/**
+ * `struct kinfo_proc` up to its `p_stat` byte: `extern_proc`'s union (16),
+ * `p_vmspace` (8), `p_sigacts` (8), `p_flag` (4). Verified against this
+ * platform: a running process reads 2, a zombie reads 5, `launchd` reads 2.
+ */
+const KINFO_PROC_BYTES = 648;
+const P_STAT_OFFSET = 36;
+/** Darwin `p_stat` values. */
+const SZOMB = 5;
+const SZOMB_LIKE = new Set([SZOMB, 6 /* SDEAD */]);
+
+/** Upper bound on a command line block; the kernel truncates instead. */
+const ARGV_BUFFER_BYTES = 262_144;
+const PATH_BUFFER_BYTES = 4096;
+
+/**
+ * The two Darwin libraries and their symbols, opened on the first probe call.
+ *
+ * `dlopen` at module scope runs on EVERY platform that imports this module —
+ * `index.ts` picks a probe at load, but the import itself is what executes the
+ * call, so the dispatch cannot prevent it. On Linux the Darwin dylibs do not
+ * exist, so the import threw (`Failed to open library "libc.dylib"`) and took
+ * down every module transitively importing the probe, tests included. Opening
+ * them on first use keeps this module importable everywhere, and a host that
+ * cannot open them gets the `null` degradation every method here promises.
+ */
+const LIBC_SYMBOLS = {
+  sysctl: { args: [FFIType.ptr, FFIType.u32, FFIType.ptr, FFIType.ptr, FFIType.ptr, FFIType.u64], returns: FFIType.i32 },
+} satisfies Record<string, FFIFunction>;
+
+const LIBPROC_SYMBOLS = {
+  proc_pidpath: { args: [FFIType.i32, FFIType.ptr, FFIType.u32], returns: FFIType.i32 },
+  proc_pidinfo: { args: [FFIType.i32, FFIType.i32, FFIType.u64, FFIType.ptr, FFIType.i32], returns: FFIType.i32 },
+} satisfies Record<string, FFIFunction>;
+
+/** The opened Darwin libraries, as used by the probe below. */
+interface DarwinLibs {
+  libc: Library<typeof LIBC_SYMBOLS>;
+  libproc: Library<typeof LIBPROC_SYMBOLS>;
+}
+
+let libs: DarwinLibs | null = null;
+let libsAttempted = false;
+
+/** Open the libraries once, and remember a host that cannot as unavailable. */
+function bindLibs(): DarwinLibs | null {
+  if (!libsAttempted) {
+    libsAttempted = true;
+    try {
+      libs = {
+        libc: dlopen('libc.dylib', LIBC_SYMBOLS),
+        libproc: dlopen('/usr/lib/libproc.dylib', LIBPROC_SYMBOLS),
+      };
+    } catch {
+      libs = null;
+    }
+  }
+  return libs;
+}
+
+/** `PROC_PIDTBSDINFO` — the flavor whose reply is a `struct proc_bsdinfo`. */
+const PROC_PIDTBSDINFO = 3;
+/** `sizeof(struct proc_bsdinfo)`, verified against this platform. */
+const BSDINFO_BYTES = 136;
+/** `pbi_pid` — the identity check that guards every offset below. */
+const BSDINFO_PID_OFFSET = 12;
+/** `e_tpgid` — the field `ps -o tpgid=` prints. */
+const BSDINFO_TPGID_OFFSET = 112;
+
+/**
+ * `p_stat` for a live PID, or null when the PID does not exist.
+ *
+ * A zero-length result is the kernel saying "no such process"; the call itself
+ * failing (rc !== 0) is reported as null too, and callers then fall back.
+ */
+function procStatus(pid: number): number | null {
+  const bound = bindLibs();
+  if (bound === null) return null;
+  const mib = new Int32Array([CTL_KERN, KERN_PROC, KERN_PROC_PID, pid]);
+  const size = new BigUint64Array([BigInt(KINFO_PROC_BYTES)]);
+  const buffer = new Uint8Array(KINFO_PROC_BYTES);
+  try {
+    if (bound.libc.symbols.sysctl(ptr(mib), 4, ptr(buffer), ptr(size), null, 0) !== 0) return null;
+  } catch {
+    return null;
+  }
+  if (Number(size[0]) === 0) return null;
+  return buffer[P_STAT_OFFSET];
+}
+
+/**
+ * Scratch for `foregroundGroup` below. One module-level buffer, safe because
+ * the whole call is synchronous — no await can interleave another caller.
+ */
+const bsdInfo = new Uint8Array(BSDINFO_BYTES);
+const bsdInfoView = new DataView(bsdInfo.buffer);
+
+/**
+ * Executable path, or null. Also answers for root-owned PIDs (verified: pid 1 →
+ * `/sbin/launchd`), which is what makes it the identity fallback when argv is
+ * denied.
+ */
+function executablePath(pid: number): string | null {
+  const bound = bindLibs();
+  if (bound === null) return null;
+  const buffer = new Uint8Array(PATH_BUFFER_BYTES);
+  try {
+    const written = bound.libproc.symbols.proc_pidpath(pid, ptr(buffer), buffer.length);
+    return written > 0 ? new TextDecoder().decode(buffer.subarray(0, written)) : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * argv of a live PID via `KERN_PROCARGS2`, or null.
+ *
+ * The block is laid out as: `argc` (i32), the executable path (NUL-terminated),
+ * padding NULs, then `argc` NUL-terminated arguments. Denied for root-owned
+ * PIDs, which is why `commandLine` also consults the executable path.
+ */
+function argvOf(pid: number): string[] | null {
+  const bound = bindLibs();
+  if (bound === null) return null;
+  const mib = new Int32Array([CTL_KERN, KERN_PROCARGS2, pid]);
+  const size = new BigUint64Array([BigInt(ARGV_BUFFER_BYTES)]);
+  const buffer = new Uint8Array(ARGV_BUFFER_BYTES);
+  try {
+    if (bound.libc.symbols.sysctl(ptr(mib), 3, ptr(buffer), ptr(size), null, 0) !== 0) return null;
+  } catch {
+    return null;
+  }
+
+  const length = Number(size[0]);
+  if (length <= 4) return null;
+  const argc = new DataView(buffer.buffer, buffer.byteOffset, buffer.byteLength).getInt32(0, true);
+  let cursor = 4;
+  while (cursor < length && buffer[cursor] !== 0) cursor += 1;
+  while (cursor < length && buffer[cursor] === 0) cursor += 1;
+
+  const decoder = new TextDecoder();
+  const args: string[] = [];
+  for (let index = 0; index < argc && cursor < length; index += 1) {
+    let end = cursor;
+    while (end < length && buffer[end] !== 0) end += 1;
+    args.push(decoder.decode(buffer.subarray(cursor, end)));
+    cursor = end + 1;
+  }
+  return args;
+}
+
+function signalAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    // EPERM: the PID exists, we may not signal it (root-owned, another user).
+    return (error as NodeJS.ErrnoException).code === 'EPERM';
+  }
+}
+
+export const darwinProbe: ProcessProbe = {
+  commandLine(pid) {
+    const args = argvOf(pid);
+    if (args && args.length > 0) return args.join(' ');
+    return executablePath(pid);
+  },
+  isAlive(pid) {
+    const status = procStatus(pid);
+    if (status !== null) return !SZOMB_LIKE.has(status);
+    // The syscall itself failed (sandbox) — liveness alone is all that is left.
+    return executablePath(pid) !== null || signalAlive(pid);
+  },
+  isZombie(pid) {
+    const status = procStatus(pid);
+    return status !== null && SZOMB_LIKE.has(status);
+  },
+  /**
+   * `e_tpgid` — the field `ps -o tpgid=` prints. `proc_pidinfo` is the cheap
+   * route to it (measured ~0.9 µs against ~10 ms for the subprocess).
+   *
+   * The reply's own `pbi_pid` is checked against the requested pid before
+   * `e_tpgid` is trusted: a struct-layout drift on a future macOS would
+   * otherwise hand back a garbage group, and a wrong "busy" answer makes the
+   * terminal cap refuse an attach. Returning null keeps the caller on `ps`.
+   */
+  foregroundGroup(pid) {
+    const bound = bindLibs();
+    if (bound === null) return null;
+    let written = 0;
+    try {
+      written = bound.libproc.symbols.proc_pidinfo(pid, PROC_PIDTBSDINFO, 0, ptr(bsdInfo), BSDINFO_BYTES);
+    } catch {
+      return null;
+    }
+    if (written < BSDINFO_BYTES) return null;
+    if (bsdInfoView.getUint32(BSDINFO_PID_OFFSET, true) !== pid) return null;
+    return bsdInfoView.getUint32(BSDINFO_TPGID_OFFSET, true);
+  },
+};

package/src/server/lib/lifecycle/proc/index.ts

@@ -0,0 +1,38 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Which process probe answers on this platform.
+ *
+ * The choice is by `process.platform`, at module load: macOS gets `libproc`,
+ * Linux gets `/proc`, Windows gets the liveness-only probe, and anything else
+ * (the BSDs) falls back to `ps`. No caller knows which one it got.
+ *
+ * macOS and Linux are the native paths because they are the platforms the
+ * chamber actually runs on and where a subprocess-free answer exists; the `ps`
+ * fallback stays for the platforms that have no other option.
+ */
+
+import type { ProcessProbe } from '@/server/lib/lifecycle/proc/types';
+import { darwinProbe } from '@/server/lib/lifecycle/proc/darwin';
+import { linuxProbe } from '@/server/lib/lifecycle/proc/linux';
+import { psProbe } from '@/server/lib/lifecycle/proc/ps';
+import { win32Probe } from '@/server/lib/lifecycle/proc/win32';
+
+function selectProbe(): ProcessProbe {
+  switch (process.platform) {
+    case 'darwin':
+      return darwinProbe;
+    case 'linux':
+      return linuxProbe;
+    case 'win32':
+      return win32Probe;
+    default:
+      return psProbe;
+  }
+}
+
+/** The probe for the running platform. */
+export const processProbe: ProcessProbe = selectProbe();

package/src/server/lib/lifecycle/proc/linux.ts

@@ -0,0 +1,80 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Linux process probe: `/proc`, no subprocess and no FFI.
+ *
+ * `procfs` already holds everything `ps` reads, so this is both faster and
+ * immune to a missing binary in minimal containers (where the previous `ps`
+ * snapshot simply came back empty and identity degraded to `unknown`).
+ *
+ * `stat` is parsed from the LAST `)` because field 2 is the executable name in
+ * parentheses and may itself contain spaces and parentheses.
+ */
+
+import fs from 'fs';
+
+import type { ProcessProbe } from '@/server/lib/lifecycle/proc/types';
+
+/** Field 3 of `/proc/<pid>/stat`, 1-indexed, once the comm field is stripped. */
+const STATE_FIELD = 0;
+const ZOMBIE_STATES = new Set(['Z', 'X']);
+
+function readFile(path: string): string | null {
+  try {
+    return fs.readFileSync(path, 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+/** `/proc/<pid>/stat` fields after the `(comm)` column, or null. */
+function statTail(pid: number): string[] | null {
+  const raw = readFile(`/proc/${pid}/stat`);
+  if (raw === null) return null;
+  const close = raw.lastIndexOf(')');
+  if (close === -1) return null;
+  return raw.slice(close + 1).trim().split(/\s+/);
+}
+
+/**
+ * Index of tpgid in `statTail`'s output.
+ *
+ * `/proc/<pid>/stat` numbers it 8 (1-indexed), and `statTail` has already
+ * dropped fields 1 (`pid`) and 2 (`(comm)`) — so the index is 8 - 3 = 5. At 6
+ * this read field 9, `flags`, which answered every live process with 0x400000
+ * instead of a process group.
+ */
+const TPGID_FIELD = 5;
+
+export const linuxProbe: ProcessProbe = {
+  commandLine(pid) {
+    const raw = readFile(`/proc/${pid}/cmdline`);
+    if (raw === null) return null;
+    // NUL-separated argv, with a trailing NUL; empty for a kernel thread.
+    const args = raw.split('\0').filter((part) => part.length > 0);
+    if (args.length > 0) return args.join(' ');
+    // Kernel threads have no argv — `comm` is all the identity there is.
+    return readFile(`/proc/${pid}/comm`)?.trim() || null;
+  },
+  isAlive(pid) {
+    // A `/proc` entry exists for a zombie too, so liveness is "the directory is
+    // there"; `isZombie` is what separates a corpse from a running process.
+    return fs.existsSync(`/proc/${pid}`);
+  },
+  isZombie(pid) {
+    const fields = statTail(pid);
+    if (fields === null) return false;
+    return ZOMBIE_STATES.has(fields[STATE_FIELD]);
+  },
+  foregroundGroup(pid) {
+    // Already read for `isZombie` on the same question, so this costs no extra
+    // syscall beyond the file read itself.
+    const fields = statTail(pid);
+    if (fields === null) return null;
+    const tpgid = Number(fields[TPGID_FIELD]);
+    return Number.isFinite(tpgid) ? tpgid : null;
+  },
+};

package/src/server/lib/lifecycle/proc/ps.ts

@@ -0,0 +1,86 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * `ps` fallback for POSIX platforms without a native probe (the BSDs).
+ *
+ * Kept because it is the only mechanism left that works everywhere a `ps` is
+ * installed, and because dropping it would make identity worse on those
+ * platforms than it was before the native probes existed. macOS and Linux no
+ * longer reach this path.
+ *
+ * The whole table is read once and cached briefly: every question in a port
+ * check happens within milliseconds, so one snapshot answers all of them.
+ */
+
+import { spawnSync } from 'bun';
+
+import type { ProcessProbe } from '@/server/lib/lifecycle/proc/types';
+
+interface ProcessRow {
+  pid: number;
+  /** `ps` state column — `Z…` means defunct (exited, awaiting reaping). */
+  state: string;
+  command: string;
+}
+
+const TABLE_MAX_AGE_MS = 250;
+let cached: { at: number; rows: ProcessRow[] } | null = null;
+
+function processTable(): ProcessRow[] {
+  if (cached && Date.now() - cached.at < TABLE_MAX_AGE_MS) return cached.rows;
+  const rows: ProcessRow[] = [];
+  try {
+    const snapshot = spawnSync({
+      cmd: ['ps', '-ax', '-o', 'pid=,stat=,command='],
+      stdout: 'pipe',
+      stderr: 'ignore',
+    });
+    if (snapshot.success) {
+      for (const line of snapshot.stdout.toString().split('\n')) {
+        const match = /^\s*(\d+)\s+(\S+)\s+(.*)$/.exec(line);
+        if (!match) continue;
+        rows.push({ pid: Number(match[1]), state: match[2], command: match[3].trim() });
+      }
+    }
+  } catch {
+    // No `ps` on PATH: every question degrades to "unknown".
+  }
+  cached = { at: Date.now(), rows };
+  return rows;
+}
+
+function signalAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    // EPERM: the PID exists, we may not signal it.
+    return (error as NodeJS.ErrnoException).code === 'EPERM';
+  }
+}
+
+export const psProbe: ProcessProbe = {
+  commandLine(pid) {
+    const row = processTable().find((entry) => entry.pid === pid);
+    return row && row.command.length > 0 ? row.command : null;
+  },
+  isAlive(pid) {
+    if (!signalAlive(pid)) return false;
+    const row = processTable().find((entry) => entry.pid === pid);
+    // Absent from the table means no `ps` (or a race) — liveness stands.
+    return row ? !row.state.startsWith('Z') : true;
+  },
+  isZombie(pid) {
+    const row = processTable().find((entry) => entry.pid === pid);
+    return row ? row.state.startsWith('Z') : false;
+  },
+  foregroundGroup() {
+    // The cached table has no `tpgid` column, and adding one would make every
+    // question pay for a field only this one asks. Null keeps the caller on its
+    // own `ps -o pid=,tpgid=` path, which is where the BSDs were anyway.
+    return null;
+  },
+};

package/src/server/lib/lifecycle/proc/types.ts

@@ -0,0 +1,33 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * What a platform must be able to answer about a foreign PID, in its own
+ * syscall vocabulary. One implementation per OS, selected in `identity.ts`.
+ *
+ * Every method must degrade rather than throw: a diagnostic question about a
+ * PID is never worth failing a request over, and a platform that cannot answer
+ * says so (`null` / `false`) so the caller can fall back.
+ */
+export interface ProcessProbe {
+  /** Command line of a live PID, or null when unreadable. */
+  commandLine(pid: number): string | null;
+  /** True when the PID exists. */
+  isAlive(pid: number): boolean;
+  /** True when the PID is defunct — exited but not yet reaped by its parent.
+   *  Such a PID still answers signal 0 and holds no port. */
+  isZombie(pid: number): boolean;
+  /**
+   * Foreground process group of the PID's controlling terminal — the value
+   * `ps -o tpgid=` prints, including its `0` for "no controlling terminal".
+   * Null when this platform (or this call) cannot answer, which is the
+   * caller's signal to fall back to `ps`.
+   *
+   * A PTY's `tpgid` is what tells a shell sitting at its prompt (the group is
+   * the shell itself) from one running a command (the group is that command),
+   * so it is the exact answer to "is this terminal busy".
+   */
+  foregroundGroup(pid: number): number | null;
+}

package/src/server/lib/lifecycle/proc/win32.ts

@@ -0,0 +1,53 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Windows process probe.
+ *
+ * Deliberately the thinnest of the three, because Windows is where the other
+ * two mechanisms have no equivalent:
+ *
+ *   - There is no `ps` and no `/proc`.
+ *   - There is no zombie: a process object lives until its last handle closes,
+ *     so "exited but not reaped" is not a state that can be observed. `isZombie`
+ *     is therefore always false rather than a guess.
+ *   - A foreign process's command line is not reachable without walking its PEB
+ *     through `ntdll` while it is suspended — untestable here and far more
+ *     dangerous than the problem it solves. `commandLine` returns null, which
+ *     `getProcessState` already reports as `unknown`, and callers treat
+ *     `unknown` as "alive but unverified" — never as confirmation.
+ *
+ * So identity on Windows is liveness, exactly as before this module existed;
+ * the value here is that the behaviour is stated instead of emerging from a
+ * `ps` snapshot that silently comes back empty.
+ */
+
+import type { ProcessProbe } from '@/server/lib/lifecycle/proc/types';
+
+function signalAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    // EPERM: the PID exists, we may not signal it.
+    return (error as NodeJS.ErrnoException).code === 'EPERM';
+  }
+}
+
+export const win32Probe: ProcessProbe = {
+  commandLine() {
+    return null;
+  },
+  isAlive: signalAlive,
+  isZombie() {
+    return false;
+  },
+  foregroundGroup() {
+    // Windows has no process group tied to a console the way a POSIX PTY has
+    // `tpgid`, and no `ps` either — the caller's own platform check keeps this
+    // from being asked, and null says "unknown" rather than guessing.
+    return null;
+  },
+};

package/src/server/lib/models/provider-registry.server.ts

@@ -11,8 +11,8 @@
  * files and drives the shared utility RPC process.
  */
 
-import { readDisabledProviders } from '@/server/lib/omp/config/roles';
-import { getModelsConfigPath, readNativeProviders } from '@/server/lib/omp/config/providers';
+import { readDisabledProviders } from '@/server/lib/omp/config/disabled-providers';
+import { getModelsConfigPath, readNativeProviders } from '@/server/lib/omp/config/models-config';
 import { runUtilityCommand, type OmpModel } from '@/server/lib/omp/rpc/utility';
 import { isKenariProvider, removeLegacyKenariModels } from '@/shared/lib/models/provider-cleanup';
 import { formatContextWindow } from '@/shared/lib/code/format';

package/src/server/lib/models/registry.server.ts

@@ -15,7 +15,7 @@
 import { getDb } from '@/server/db.server';
 import { PROVIDERS_SETTINGS_KEY } from '@/server/lib/models/provider-registry.server';
 import { readSettingsJson } from '@/server/lib/db/settings-store';
-import { readDisabledProviders } from '@/server/lib/omp/config/roles';
+import { readDisabledProviders } from '@/server/lib/omp/config/disabled-providers';
 import { runUtilityCommand, type OmpModel } from '@/server/lib/omp/rpc/utility';
 import { invalidateModelsCaches } from '@/shared/lib/models/server-cache';
 import type { ModelsData, ProviderItem } from '@/shared/types';