ompchamber 3.1.1 → 3.2.0

package/src/client/hooks/workspace/expanded-sessions.ts

@@ -0,0 +1,62 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Expanded-session rows, shared by the desktop and mobile session sidebars.
+ *
+ * A session row's roster (its `SubagentList`) is shown while that row's id is
+ * in the expanded set, so both sidebars must read and write ONE set — persisted
+ * in `app_settings.omp_sidebar_expanded_sessions` — or a row expanded on the
+ * phone would come back collapsed on the desktop.
+ *
+ * The `?subagent=` deep link auto-expands its session row: a reload on a
+ * subagent transcript must leave the roster entry that opened it visible.
+ */
+
+import { useCallback, useEffect, useState } from 'preact/hooks';
+import { useSearchParams } from '@/client/lib/router/search-params';
+import { loadExpandedSessionIds, saveExpandedSessionIds } from '@/shared/lib/workspace/sidebar-expanded';
+
+export interface ExpandedSessionsHandle {
+  expandedSessionIds: Set<string>;
+  /** Collapse an expanded row, or expand a collapsed one. Persists the result. */
+  toggleSession: (sessionId: string) => void;
+}
+
+export function useExpandedSessions(): ExpandedSessionsHandle {
+  const [searchParams] = useSearchParams();
+  const urlSubagentId = searchParams.get('subagent');
+  const urlSessionId = searchParams.get('sessionId');
+  const [expandedSessionIds, setExpandedSessionIds] = useState<Set<string>>(() => new Set());
+
+  useEffect(() => {
+    const saved = loadExpandedSessionIds();
+    if (saved && saved.size > 0) {
+      setExpandedSessionIds(saved);
+    }
+  }, []);
+
+  useEffect(() => {
+    if (!urlSubagentId || !urlSessionId) return;
+    setExpandedSessionIds(prev => {
+      if (prev.has(urlSessionId)) return prev;
+      const next = new Set(prev);
+      next.add(urlSessionId);
+      return next;
+    });
+  }, [urlSubagentId, urlSessionId]);
+
+  const toggleSession = useCallback((sessionId: string) => {
+    setExpandedSessionIds((prev) => {
+      const next = new Set(prev);
+      if (next.has(sessionId)) next.delete(sessionId);
+      else next.add(sessionId);
+      saveExpandedSessionIds(next);
+      return next;
+    });
+  }, []);
+
+  return { expandedSessionIds, toggleSession };
+}

package/src/server/lib/db/client.ts

@@ -44,7 +44,11 @@ export function createDb(path: string): DbClient {
       return prep(sql).all(...(params as never[])) as T[];
     },
     async run(sql: string, params: any[] = []) {
-      const result = raw.run(sql, params as never);
+      // Through `prep`, like `get`/`all`: `Database.run` does not cache its
+      // query (it prepares and finalizes per call), which cost every INSERT /
+      // UPDATE / DELETE a compile — measured 0.881 µs/op against 0.627 µs/op
+      // for the cached statement.
+      const result = prep(sql).run(...(params as never[]));
       return { changes: result.changes, lastID: Number(result.lastInsertRowid) };
     },
     async exec(sql: string) {

package/src/server/lib/fs/git-diff.ts

@@ -2,20 +2,32 @@ import path from 'path';
 import type { FileDiffData } from '@/shared/types/git';
 import { runShell, shellOk } from '@/server/lib/fs/shell';
 
+/**
+ * Context lines requested when the reader wants the whole file rather than the
+ * hunks. `--unified` takes any count, so this is a cap on the FILE, not on the
+ * change: git emits every line it can reach around the edits.
+ */
+const FULL_CONTEXT = 1000000;
+
 /** Runs one git diff probe and returns its stdout ('' on failure). */
-async function gitOut(command: string, cwd: string, timeout: number): Promise<string> {
-  const result = await runShell(command, { cwd, timeout, maxBuffer: 1024 * 1024 * 2 });
+async function gitOut(command: string, cwd: string, timeout: number, maxBuffer: number = 1024 * 1024 * 2): Promise<string> {
+  const result = await runShell(command, { cwd, timeout, maxBuffer });
   return shellOk(result) ? result.stdout : '';
 }
 
 /**
  * Fetch git diff for a specific file in the working directory or index.
+ *
+ * `fullContext` asks git for the entire file rather than the surrounding hunks,
+ * which is what the panel's "Full Code" mode renders — the diff comes back in
+ * the same unified format, so no second rendering path exists.
  */
 export async function fetchWorkingFileDiff(
   targetDir: string,
   file: string,
   staged: boolean = false,
-  requestedStatus?: string
+  requestedStatus?: string,
+  fullContext: boolean = false
 ): Promise<FileDiffData> {
   const cleanFile = file.replace(/^[./\\]+/, '').replace(/\\/g, '/');
   const fullPath = path.join(targetDir, cleanFile);
@@ -45,21 +57,33 @@ export async function fetchWorkingFileDiff(
     oldContent = await gitOut(`git show HEAD:"${cleanFile}"`, targetDir, 5000)
       || await gitOut(`git show :0:"${cleanFile}"`, targetDir, 5000);
 
+    // `-U<n>` on every probe: the full-code mode asks for the whole file, and
+    // the diff-only mode keeps git's own default by passing no flag at all.
+    const ctx = fullContext ? ` -U${FULL_CONTEXT}` : '';
+    // Full-context output is the file, not the change, so a fixed buffer would
+    // truncate a large file's diff — and a killed process is not a success, so
+    // `gitOut` reports it as no diff at all and the synthesized whole-file
+    // rewrite below takes over silently. Sized off the content already read, so
+    // it cannot exceed roughly twice the file.
+    const buf = fullContext
+      ? Math.max(1024 * 1024 * 16, (oldContent.length + newContent.length) * 2 + 1024 * 1024)
+      : 1024 * 1024 * 2;
+
     if (staged) {
       // 1. Try staged diff (index vs HEAD), 2. HEAD diff, 3. unstaged diff
-      diff = await gitOut(`git diff --cached -- "${cleanFile}"`, targetDir, 10000)
-        || await gitOut(`git diff HEAD -- "${cleanFile}"`, targetDir, 10000)
-        || await gitOut(`git diff -- "${cleanFile}"`, targetDir, 10000);
+      diff = await gitOut(`git diff${ctx} --cached -- "${cleanFile}"`, targetDir, 10000, buf)
+        || await gitOut(`git diff${ctx} HEAD -- "${cleanFile}"`, targetDir, 10000, buf)
+        || await gitOut(`git diff${ctx} -- "${cleanFile}"`, targetDir, 10000, buf);
     } else if (status === '??' || status === 'U' || status === '?') {
       // Untracked file: --no-index exits 1 when a diff exists, so read stdout
       // directly instead of relying on the exit code.
-      const untracked = await runShell(`git diff --no-index /dev/null "${cleanFile}"`, { cwd: targetDir, timeout: 10000, maxBuffer: 1024 * 1024 * 2 });
+      const untracked = await runShell(`git diff${ctx} --no-index /dev/null "${cleanFile}"`, { cwd: targetDir, timeout: 10000, maxBuffer: buf });
       diff = untracked.stdout.trim() ? untracked.stdout : '';
     } else {
       // 1. Working tree diff, 2. cached diff, 3. HEAD diff
-      diff = await gitOut(`git diff -- "${cleanFile}"`, targetDir, 10000)
-        || await gitOut(`git diff --cached -- "${cleanFile}"`, targetDir, 10000)
-        || await gitOut(`git diff HEAD -- "${cleanFile}"`, targetDir, 10000);
+      diff = await gitOut(`git diff${ctx} -- "${cleanFile}"`, targetDir, 10000, buf)
+        || await gitOut(`git diff${ctx} --cached -- "${cleanFile}"`, targetDir, 10000, buf)
+        || await gitOut(`git diff${ctx} HEAD -- "${cleanFile}"`, targetDir, 10000, buf);
     }
 
     // 4. If git diff is still empty but new content exists:

package/src/server/lib/fs/git-repos.ts

@@ -0,0 +1,81 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Nested-repository discovery for the right-panel repo picker.
+ *
+ * A workspace is often a folder OF repositories (`projects/<name>/<sub>/.git`),
+ * so the picker lists every repo under the scoped root. The walk is expensive
+ * on a deep tree, so it runs in the BACKGROUND after the loader has already
+ * answered with the root's own status; the client polls until `pending` clears.
+ * Results are cached per scoped root for the life of the process.
+ *
+ * The `find` prunes `node_modules` (the one directory guaranteed to hold
+ * unrelated `.git` directories, and the one that makes the walk unbounded).
+ */
+
+import { runShell } from '@/server/lib/fs/shell';
+
+const MAX_GIT_DEPTH = 8;
+
+async function getRepos(rootDir: string): Promise<string[]> {
+  try {
+    // Search deep enough to discover nested/child git repos inside a monorepo
+    // workspace (e.g. projects/<name>/<sub>/.git) while pruning node_modules.
+    const result = await runShell(
+      `find . -maxdepth ${MAX_GIT_DEPTH} -name node_modules -prune -o -name .git -type d -print`,
+      { cwd: rootDir, timeout: 12000, maxBuffer: 1024 * 1024 }
+    );
+    const discovered = result.stdout
+      .trim()
+      .split('\n')
+      .filter(Boolean)
+      .map(line => {
+        const cleaned = line.replace(/^\.\//, '').replace(/\/\.git$/, '');
+        return cleaned === '.git' || !cleaned ? '.' : cleaned;
+      });
+
+    const uniqueRepos = Array.from(new Set(discovered));
+    if (uniqueRepos.includes('.')) {
+      return ['.', ...uniqueRepos.filter(r => r !== '.')];
+    }
+    return uniqueRepos.length ? uniqueRepos : ['.'];
+  } catch {
+    return ['.'];
+  }
+}
+
+interface RepoDiscovery {
+  repos: string[];
+  done: boolean;
+}
+
+const repoDiscovery = new Map<string, RepoDiscovery>();
+
+/** Begin the background walk for `rootDir`; a no-op once one has started. */
+export function startRepoScan(rootDir: string): void {
+  if (repoDiscovery.has(rootDir)) return;
+  const d: RepoDiscovery = { repos: ['.'], done: false };
+  repoDiscovery.set(rootDir, d);
+  void getRepos(rootDir)
+    .then(repos => { d.repos = repos; d.done = true; })
+    .catch(() => { d.repos = ['.']; d.done = true; });
+}
+
+/**
+ * Drop the cached result for `rootDir` and start a fresh walk. Used by the
+ * repo-switcher's refresh button, which must not serve the previous answer.
+ */
+export function rescanRepos(rootDir: string): void {
+  repoDiscovery.delete(rootDir);
+  startRepoScan(rootDir);
+}
+
+/** The discovered repos for `rootDir`, and whether the walk is still running. */
+export function discoveredRepos(rootDir: string): { repos: string[]; pending: boolean } {
+  const d = repoDiscovery.get(rootDir);
+  if (!d) return { repos: ['.'], pending: false };
+  return { repos: d.done ? d.repos : ['.'], pending: !d.done };
+}

package/src/server/lib/lifecycle/flock.ts

@@ -0,0 +1,199 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * `flock(2)` through `bun:ffi`, for the port-handover lock.
+ *
+ * The kernel releases a flock when the holding process dies, which is exactly
+ * the property a startup lock wants — no PID readback, no stale-holder
+ * classification, and no polling loop to detect a dead holder. The previous
+ * PID-file scheme needed all three: it wrote a PID, re-read it on every retry,
+ * asked the OS whether that PID was still OMPChamber (four `sysctl` calls per
+ * question on macOS), and deleted the file to release.
+ *
+ * `flock` is exported by `libc.dylib` / `libSystem.B.dylib` / `libc.so.6`, so it
+ * is reachable the same way `lib/lifecycle/proc/darwin.ts` reaches `sysctl`.
+ * Windows has no `flock`, and a host can refuse `dlopen` or answer `ENOLCK`
+ * (some NFS mounts) — `flockAvailable()` is a real capability probe, and every
+ * caller keeps its own fallback for the false case.
+ *
+ * **The lock file is never unlinked while it may be held.** Removing it is the
+ * classic flock race: another process that already opened the path keeps a
+ * handle on the unlinked inode and acquires it successfully while a third
+ * process creates a fresh file at the same path and also succeeds. Leaving the
+ * file in place makes the inode the lock, which is what flock is for; the file
+ * is an empty marker, one per port.
+ */
+
+import fs from 'fs';
+import { dlopen, FFIType } from 'bun:ffi';
+import type { FFIFunction, Library } from 'bun:ffi';
+
+const LOCK_EX = 2;
+/** Non-blocking: fail immediately rather than waiting inside the syscall. */
+const LOCK_NB = 4;
+
+const FLOCK_SYMBOLS = {
+  flock: { args: [FFIType.i32, FFIType.i32], returns: FFIType.i32 },
+} satisfies Record<string, FFIFunction>;
+
+/** Library names to try, in the order each platform resolves them. */
+const LIBC_NAMES = ['libc.dylib', 'libSystem.B.dylib', 'libc.so.6'] as const;
+
+/**
+ * Held leases and the probe result, on `globalThis` rather than in module
+ * bindings.
+ *
+ * A `bun --hot` reload re-evaluates this module while the process (and its open
+ * descriptors) lives on. A fresh module-level Map would forget that this PID
+ * already holds the port's lock, so the reloaded server would open a second fd,
+ * find the lock taken by its own previous fd, and refuse to start.
+ */
+interface FlockHost {
+  /** `lockPath` → the fd holding it and how many acquires it backs. */
+  held: Map<string, { fd: number; refs: number }>;
+  /** Tri-state capability probe: undefined until asked, then lib-or-null. */
+  available: boolean | undefined;
+  /** The opened library, shared across reloads. */
+  lib: Library<typeof FLOCK_SYMBOLS> | null | undefined;
+}
+
+declare global {
+  // eslint-disable-next-line no-var
+  var __ompChamberFlock: FlockHost | undefined;
+}
+
+function host(): FlockHost {
+  return (globalThis.__ompChamberFlock ??= { held: new Map(), available: undefined, lib: undefined });
+}
+
+/** libc with `flock`, or null when this host has none. Cached for the process. */
+function libc(): Library<typeof FLOCK_SYMBOLS> | null {
+  const state = host();
+  if (state.lib !== undefined) return state.lib;
+  state.lib = null;
+  if (process.platform === 'win32') return state.lib;
+  for (const name of LIBC_NAMES) {
+    try {
+      state.lib = dlopen(name, FLOCK_SYMBOLS);
+      return state.lib;
+    } catch {
+      // Try the next name; a host without any of them keeps the null answer.
+    }
+  }
+  return state.lib;
+}
+
+/**
+ * True when `flock(2)` actually works here — the symbol resolving is not
+ * enough, because a filesystem can answer `ENOLCK`. Probed once, on a
+ * throwaway file, so a caller can pick its mechanism up front instead of
+ * discovering mid-wait that the syscall never works.
+ */
+export function flockAvailable(): boolean {
+  const state = host();
+  if (state.available !== undefined) return state.available;
+  state.available = false;
+  const symbols = libc();
+  if (!symbols) return false;
+  const probePath = `${process.env.TMPDIR ?? '/tmp'}/ompchamber-flock-${process.pid}`;
+  let fd: number | null = null;
+  try {
+    fd = fs.openSync(probePath, 'a');
+    const ok = symbols.symbols.flock(fd, LOCK_EX | LOCK_NB) === 0;
+    fs.closeSync(fd);
+    fd = null;
+    fs.rmSync(probePath, { force: true });
+    if (!ok) {
+      // The probe file was somehow already locked — treat the capability as
+      // unproven rather than reporting a lock we do not hold.
+      state.lib = null;
+      return false;
+    }
+    state.available = true;
+    return true;
+  } catch {
+    state.lib = null;
+    return false;
+  } finally {
+    if (fd !== null) {
+      try {
+        fs.closeSync(fd);
+      } catch {
+        // Already closed.
+      }
+    }
+  }
+}
+
+export interface FlockHandle {
+  /** Release the lease. Idempotent. */
+  release: () => void;
+}
+
+/**
+ * Take `LOCK_EX | LOCK_NB` on `lockPath`, or null when another process holds
+ * it. Returns null too when `flock` is unavailable — callers must then use
+ * their own mechanism.
+ *
+ * The fd is kept open for as long as the lease lives: closing it is what
+ * releases the lock, and the kernel does the same on process death.
+ */
+export function tryFlock(lockPath: string): FlockHandle | null {
+  const state = host();
+  const existing = state.held.get(lockPath);
+  if (existing) {
+    // Re-entrant within one process: flock is per open-file-description, so a
+    // second fd here would block against our own lock.
+    existing.refs += 1;
+    return { release: () => releaseFlock(lockPath) };
+  }
+  const symbols = libc();
+  if (!symbols) return null;
+  let fd: number;
+  try {
+    // `a` creates it when absent and never truncates; the file's content is
+    // irrelevant (the inode is the lock), but the PID is useful when a human
+    // looks at the directory.
+    fd = fs.openSync(lockPath, 'a');
+  } catch {
+    return null;
+  }
+  let acquired = false;
+  try {
+    acquired = symbols.symbols.flock(fd, LOCK_EX | LOCK_NB) === 0;
+  } catch {
+    acquired = false;
+  }
+  if (!acquired) {
+    try {
+      fs.closeSync(fd);
+    } catch {
+      // Already closed.
+    }
+    return null;
+  }
+  try {
+    fs.writeFileSync(fd, String(process.pid));
+  } catch {
+    // Informational only.
+  }
+  state.held.set(lockPath, { fd, refs: 1 });
+  return { release: () => releaseFlock(lockPath) };
+}
+
+function releaseFlock(lockPath: string): void {
+  const state = host();
+  const entry = state.held.get(lockPath);
+  if (!entry) return;
+  entry.refs -= 1;
+  if (entry.refs > 0) return;
+  state.held.delete(lockPath);
+  try {
+    fs.closeSync(entry.fd);
+  } catch {
+    // Already closed; the kernel released the lock either way.
+  }
+}

package/src/server/lib/lifecycle/identity.ts

@@ -37,7 +37,11 @@ export type ProcessState = 'dead' | 'matched' | 'mismatched' | 'unknown';
  */
 export function isProcessAlive(pid: number): boolean {
   if (!Number.isFinite(pid) || pid <= 0) return false;
-  return processProbe.isAlive(pid) && !processProbe.isZombie(pid);
+  const liveness = processProbe.liveness(pid);
+  // A zombie is NOT alive: it holds no port and will never run again. An
+  // `unknown` (a probe that could not answer) keeps the previous bias and
+  // counts as alive, so a sandboxed host cannot make a live server look dead.
+  return liveness === 'alive' || liveness === 'unknown';
 }
 
 /**

package/src/server/lib/lifecycle/port-guard.ts

@@ -22,6 +22,7 @@
 
 import fs from 'fs';
 
+import { flockAvailable, tryFlock } from '@/server/lib/lifecycle/flock';
 import { getProcessState } from '@/server/lib/lifecycle/identity';
 import { describeOccupant, findOccupant } from '@/server/lib/lifecycle/occupant';
 import { getLockPath } from '@/server/lib/lifecycle/paths';
@@ -48,13 +49,27 @@ export interface PortLock {
  * Two starters racing on one free port would each probe it as free and then
  * fight over the bind, with the loser reporting a bare `EADDRINUSE` against a
  * process it cannot identify yet. Holding the lock across probe-and-bind makes
- * the loser fail with a message that names the actual situation. A lock whose
- * holder is dead (or is not OMPChamber, i.e. a recycled PID) is reclaimed.
+ * the loser fail with a message that names the actual situation.
  *
- * Returns null when another starter holds the lock through the wait window.
+ * The mechanism is `flock(2)` when the host has it (see `flock.ts`): the kernel
+ * releases it on process death, so there is no stale-holder case to detect and
+ * no polling loop. The PID-file path below stays as the fallback for a host
+ * without `flock` (Windows, a filesystem answering `ENOLCK`); it needs the
+ * extra machinery — PID readback, `getProcessState` classification, and
+ * reclaiming a lock whose holder died or whose PID was recycled.
  */
 export async function acquirePortLock(port: number, waitMs = LOCK_WAIT_MS): Promise<PortLock | null> {
   const lockPath = getLockPath(port);
+  if (flockAvailable()) {
+    const deadline = Date.now() + waitMs;
+    for (;;) {
+      const handle = tryFlock(lockPath);
+      if (handle) return handle;
+      if (Date.now() >= deadline) return null;
+      await Bun.sleep(150);
+    }
+  }
+
   const deadline = Date.now() + waitMs;
   for (;;) {
     try {

package/src/server/lib/lifecycle/proc/darwin.ts

@@ -28,7 +28,7 @@
 import { dlopen, FFIType, ptr } from 'bun:ffi';
 import type { FFIFunction, Library } from 'bun:ffi';
 
-import type { ProcessProbe } from '@/server/lib/lifecycle/proc/types';
+import type { ProcessLiveness, ProcessProbe } from '@/server/lib/lifecycle/proc/types';
 
 /** `sysctl` MIB pieces. */
 const CTL_KERN = 1;
@@ -45,8 +45,21 @@ const KINFO_PROC_BYTES = 648;
 const P_STAT_OFFSET = 36;
 /** Darwin `p_stat` values. */
 const SZOMB = 5;
+/** `p_stat` values that mean "exited but not yet reaped". */
 const SZOMB_LIKE = new Set([SZOMB, 6 /* SDEAD */]);
 
+/**
+ * Scratch for the `sysctl(KERN_PROC_PID)` call below, at module scope.
+ *
+ * One `isProcessAlive` asks this question twice (liveness then zombie), and
+ * `getProcessState` asks it twice more — so the buffers are reused rather than
+ * reallocated per call, the same reasoning as `bsdInfo` further down. Safe
+ * because the whole probe is synchronous: no `await` can interleave a caller.
+ */
+const procMib = new Int32Array([CTL_KERN, KERN_PROC, KERN_PROC_PID, 0]);
+const procSize = new BigUint64Array([BigInt(KINFO_PROC_BYTES)]);
+const procBuffer = new Uint8Array(KINFO_PROC_BYTES);
+
 /** Upper bound on a command line block; the kernel truncates instead. */
 const ARGV_BUFFER_BYTES = 262_144;
 const PATH_BUFFER_BYTES = 4096;
@@ -106,24 +119,27 @@ const BSDINFO_PID_OFFSET = 12;
 const BSDINFO_TPGID_OFFSET = 112;
 
 /**
- * `p_stat` for a live PID, or null when the PID does not exist.
+ * `p_stat` for a PID, `'absent'` when the kernel says no such process, or null
+ * when the call itself failed.
  *
- * A zero-length result is the kernel saying "no such process"; the call itself
- * failing (rc !== 0) is reported as null too, and callers then fall back.
+ * The two failure modes are NOT the same question and callers must not merge
+ * them: `sysctl(KERN_PROC_PID)` answers rc=0 with a zero-length reply for a PID
+ * that does not exist (verified: 999999 → rc 0, size 0), while a sandbox denies
+ * the call with a non-zero rc. Reading the second as "dead" would let a sandbox
+ * report a live server as gone.
  */
-function procStatus(pid: number): number | null {
+function procStatus(pid: number): number | 'absent' | null {
   const bound = bindLibs();
   if (bound === null) return null;
-  const mib = new Int32Array([CTL_KERN, KERN_PROC, KERN_PROC_PID, pid]);
-  const size = new BigUint64Array([BigInt(KINFO_PROC_BYTES)]);
-  const buffer = new Uint8Array(KINFO_PROC_BYTES);
+  procMib[3] = pid;
+  procSize[0] = BigInt(KINFO_PROC_BYTES);
   try {
-    if (bound.libc.symbols.sysctl(ptr(mib), 4, ptr(buffer), ptr(size), null, 0) !== 0) return null;
+    if (bound.libc.symbols.sysctl(ptr(procMib), 4, ptr(procBuffer), ptr(procSize), null, 0) !== 0) return null;
   } catch {
     return null;
   }
-  if (Number(size[0]) === 0) return null;
-  return buffer[P_STAT_OFFSET];
+  if (Number(procSize[0]) === 0) return 'absent';
+  return procBuffer[P_STAT_OFFSET];
 }
 
 /**
@@ -197,21 +213,40 @@ function signalAlive(pid: number): boolean {
   }
 }
 
+/**
+ * Liveness in one lookup, for both the probe and its own `isAlive`/`isZombie`
+ * shims. A method calling `this` would break the moment a caller destructured
+ * the probe, and the session registry does pass probes around by reference.
+ */
+function darwinLiveness(pid: number): ProcessLiveness {
+  const status = procStatus(pid);
+  if (status === 'absent') return 'dead';
+  if (status !== null) return SZOMB_LIKE.has(status) ? 'zombie' : 'alive';
+  // The syscall itself failed (sandbox). A path or a signal still separates
+  // "exists" from "gone" — a path read answers for root-owned PIDs, and signal
+  // 0 answers for the rest — so only a PID that fails both is reported dead.
+  // Anything else is `unknown`, which callers treat as alive-but-unverified.
+  if (executablePath(pid) !== null || signalAlive(pid)) return 'alive';
+  return 'unknown';
+}
+
 export const darwinProbe: ProcessProbe = {
   commandLine(pid) {
     const args = argvOf(pid);
     if (args && args.length > 0) return args.join(' ');
     return executablePath(pid);
   },
+  liveness: darwinLiveness,
   isAlive(pid) {
-    const status = procStatus(pid);
-    if (status !== null) return !SZOMB_LIKE.has(status);
-    // The syscall itself failed (sandbox) — liveness alone is all that is left.
-    return executablePath(pid) !== null || signalAlive(pid);
+    // `procStatus` already reports a zombie as not-alive, so the old
+    // `isAlive && !isZombie` pair asked it twice for one answer.
+    const liveness = darwinLiveness(pid);
+    // `unknown` keeps the previous fallback's bias: a sandboxed host must not
+    // make a live server look dead.
+    return liveness === 'alive' || liveness === 'unknown';
   },
   isZombie(pid) {
-    const status = procStatus(pid);
-    return status !== null && SZOMB_LIKE.has(status);
+    return darwinLiveness(pid) === 'zombie';
   },
   /**
    * `e_tpgid` — the field `ps -o tpgid=` prints. `proc_pidinfo` is the cheap

package/src/server/lib/lifecycle/proc/linux.ts

@@ -49,6 +49,20 @@ function statTail(pid: number): string[] | null {
  */
 const TPGID_FIELD = 5;
 
+/**
+ * `{ state, tpgid }` from ONE `/proc/<pid>/stat` read.
+ *
+ * `isZombie` and `foregroundGroup` both need this file, and the terminal cap
+ * asks both about the same shell; reading it once per question instead of twice
+ * is why the two are resolved together.
+ */
+function procStat(pid: number): { state: string; tpgid: number } | null {
+  const fields = statTail(pid);
+  if (fields === null) return null;
+  const tpgid = Number(fields[TPGID_FIELD]);
+  return { state: fields[STATE_FIELD], tpgid: Number.isFinite(tpgid) ? tpgid : 0 };
+}
+
 export const linuxProbe: ProcessProbe = {
   commandLine(pid) {
     const raw = readFile(`/proc/${pid}/cmdline`);
@@ -59,22 +73,30 @@ export const linuxProbe: ProcessProbe = {
     // Kernel threads have no argv — `comm` is all the identity there is.
     return readFile(`/proc/${pid}/comm`)?.trim() || null;
   },
+  liveness(pid) {
+    // A `/proc` entry exists for a zombie too, so the state field is what
+    // separates a corpse from a running process.
+    const stat = procStat(pid);
+    if (stat === null) {
+      // No `stat` file: either the PID is gone or the read failed. `existsSync`
+      // keeps the previous answer for a process with no readable stat.
+      return fs.existsSync(`/proc/${pid}`) ? 'unknown' : 'dead';
+    }
+    return ZOMBIE_STATES.has(stat.state) ? 'zombie' : 'alive';
+  },
   isAlive(pid) {
     // A `/proc` entry exists for a zombie too, so liveness is "the directory is
     // there"; `isZombie` is what separates a corpse from a running process.
     return fs.existsSync(`/proc/${pid}`);
   },
   isZombie(pid) {
-    const fields = statTail(pid);
-    if (fields === null) return false;
-    return ZOMBIE_STATES.has(fields[STATE_FIELD]);
+    const stat = procStat(pid);
+    return stat !== null && ZOMBIE_STATES.has(stat.state);
   },
   foregroundGroup(pid) {
     // Already read for `isZombie` on the same question, so this costs no extra
     // syscall beyond the file read itself.
-    const fields = statTail(pid);
-    if (fields === null) return null;
-    const tpgid = Number(fields[TPGID_FIELD]);
-    return Number.isFinite(tpgid) ? tpgid : null;
+    const stat = procStat(pid);
+    return stat === null ? null : stat.tpgid;
   },
 };