rea-agents 6.0.0 → 6.2.0

package/dist/native/NativeUiObservation.js

@@ -17,8 +17,8 @@ const responseSchema = z.discriminatedUnion("ok", [
     }),
 ]);
 /** Capture a selected existing app window and run explicitly selected scenarios. */
-export const observeNativeUi = async (target, operation, parameters, options = {}) => {
-    const runtime = createNativeUiHelperRuntime();
+export const observeNativeUi = async (target, operation, parameters, options) => {
+    const runtime = createNativeUiHelperRuntime(options.environment);
     try {
         return await observeWithHelper(target, operation, parameters, {
             ...options,

package/dist/native/SignatureTargetBinding.js

@@ -0,0 +1,155 @@
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, mkdtemp, open, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, join } from "node:path";
+import { AnalysisError } from "../domain/analysisErrorBase.js";
+import { AnalysisAccessDeniedError, AnalysisArtifactChangedError, AnalysisCancelledError, AnalysisResourceConstraintError, } from "../domain/analysisErrorCore.js";
+import { ProviderAdapterError } from "../domain/providerAdapterError.js";
+import { err, ok } from "../domain/result.js";
+import { NATIVE_MACOS_PROVIDER_IDENTITY } from "./NativeMacOSProviderMetadata.js";
+const identity = (stat) => [stat.dev, stat.ino, stat.size, stat.mtimeNs, stat.ctimeNs].join(":");
+const changedTarget = (target, reason) => err(new AnalysisArtifactChangedError("inspect_signature", target.path, reason));
+const signatureReadFailure = (target, cause) => {
+    if (cause instanceof AnalysisError)
+        return cause;
+    const code = cause instanceof Error && "code" in cause ? cause.code : undefined;
+    if (code === "EACCES" || code === "EPERM")
+        return new AnalysisAccessDeniedError("inspect_signature", target.path, code, { cause });
+    if (code === "ENOENT" || code === "ENOTDIR" || code === "ELOOP")
+        return new AnalysisArtifactChangedError("inspect_signature", target.path, `Registered signature target is no longer readable (${code}): ${target.path}`, { cause });
+    return new ProviderAdapterError(NATIVE_MACOS_PROVIDER_IDENTITY.id, "inspect_signature", {
+        cause,
+        diagnostics: {
+            path: target.path,
+            phase: "target-version-binding",
+            system_code: typeof code === "string" ? code : null,
+            reason: cause instanceof Error ? cause.message : String(cause),
+        },
+    });
+};
+/** Inspect a digest-verified private copy, releasing it on every exit path. */
+export const withSignatureTarget = async (target, inspect, signal) => {
+    let directory;
+    try {
+        signal?.throwIfAborted();
+        directory = await mkdtemp(join(tmpdir(), "rea-signature-"));
+    }
+    catch (cause) {
+        return err(signal?.aborted
+            ? new AnalysisCancelledError("inspect_signature")
+            : snapshotFailure(target, "create", cause));
+    }
+    let result;
+    let cleanup;
+    try {
+        const binding = await bindSignatureTarget(target, join(directory, basename(target.path)), signal);
+        result = binding.ok ? await inspect(binding.value) : binding;
+    }
+    finally {
+        try {
+            await rm(directory, { recursive: true, force: true });
+            cleanup = ok(undefined);
+        }
+        catch (cause) {
+            cleanup = err(snapshotFailure(target, "cleanup", cause));
+        }
+    }
+    // Cleanup cannot replace the operation's original actionable failure.
+    return result.ok && !cleanup.ok ? cleanup : result;
+};
+const snapshotFailure = (target, phase, cause) => new ProviderAdapterError(NATIVE_MACOS_PROVIDER_IDENTITY.id, "inspect_signature", {
+    cause,
+    diagnostics: {
+        path: target.path,
+        phase: `signature-snapshot-${phase}`,
+        reason: cause instanceof Error ? cause.message : String(cause),
+    },
+});
+const snapshotIO = async (target, phase, operation) => {
+    try {
+        return await operation();
+    }
+    catch (cause) {
+        throw snapshotFailure(target, phase, cause);
+    }
+};
+const copySignatureBytes = async (target, source, snapshot, signal) => {
+    const size = Number(source.stat.size);
+    if (!Number.isSafeInteger(size))
+        throw new AnalysisResourceConstraintError("inspect_signature", "file-size", `Signature target size is not exactly representable: ${target.path}`, null);
+    const hash = createHash("sha256");
+    const chunk = Buffer.alloc(64 * 1024);
+    let position = 0;
+    while (position < size) {
+        signal?.throwIfAborted();
+        const { bytesRead } = await source.file.read(chunk, 0, Math.min(chunk.length, size - position), position);
+        signal?.throwIfAborted();
+        if (bytesRead === 0)
+            throw new AnalysisArtifactChangedError("inspect_signature", target.path, `Signature target was truncated while hashing: ${target.path}`);
+        const bytes = chunk.subarray(0, bytesRead);
+        hash.update(bytes);
+        // writeFile retries short writes; memory remains bounded to this chunk.
+        await snapshotIO(target, "write", () => snapshot.writeFile(bytes));
+        position += bytesRead;
+    }
+    return hash.digest("hex");
+};
+/** Hash and copy the same descriptor bytes, without reopening the mutable path. */
+const bindSignatureTarget = async (target, snapshotPath, signal) => {
+    try {
+        signal?.throwIfAborted();
+        const before = await lstat(target.path, { bigint: true });
+        signal?.throwIfAborted();
+        if (!before.isFile() || before.isSymbolicLink())
+            return changedTarget(target, `Signature target is no longer a regular file: ${target.path}`);
+        const file = await open(target.path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const opened = await file.stat({ bigint: true });
+            signal?.throwIfAborted();
+            if (identity(opened) !== identity(before))
+                return changedTarget(target, `Signature target changed before open: ${target.path}`);
+            const snapshot = await snapshotIO(target, "create-file", () => open(snapshotPath, "wx", 0o600));
+            try {
+                const observed = await copySignatureBytes(target, { file, stat: opened }, snapshot, signal);
+                if (observed !== target.sha256)
+                    return changedTarget(target, `Signature target digest changed: ${target.path}; expected ${target.sha256}, observed ${observed}`);
+                const after = await file.stat({ bigint: true });
+                const current = await lstat(target.path, { bigint: true });
+                signal?.throwIfAborted();
+                if (identity(after) !== identity(opened) ||
+                    identity(current) !== identity(opened))
+                    return changedTarget(target, `Signature target changed while establishing its version: ${target.path}`);
+                await snapshotIO(target, "seal", () => snapshot.chmod(0o400));
+                return ok({ identity: identity(opened), snapshotPath });
+            }
+            finally {
+                await snapshotIO(target, "close", () => snapshot.close());
+            }
+        }
+        finally {
+            await file.close();
+        }
+    }
+    catch (cause) {
+        return err(signal?.aborted
+            ? new AnalysisCancelledError("inspect_signature")
+            : signatureReadFailure(target, cause));
+    }
+};
+/** Reject target drift across signature command captures. */
+export const verifySignatureTarget = async (target, binding, signal) => {
+    try {
+        signal?.throwIfAborted();
+        const current = await lstat(target.path, { bigint: true });
+        signal?.throwIfAborted();
+        return current.isFile() && identity(current) === binding.identity
+            ? ok(undefined)
+            : changedTarget(target, `Signature target changed during inspection: ${target.path}`);
+    }
+    catch (cause) {
+        return err(signal?.aborted
+            ? new AnalysisCancelledError("inspect_signature")
+            : signatureReadFailure(target, cause));
+    }
+};

package/dist/native/parsers/lipo.js

@@ -3,6 +3,9 @@ const architectureSchema = z.object({
     name: z.string().min(1),
     cpu_type: z.string().nullable(),
     cpu_subtype: z.string().nullable(),
+    cpu_type_code: z.number().int().nonnegative().nullable(),
+    cpu_subtype_code: z.number().int().nonnegative().nullable(),
+    capabilities: z.string().nullable(),
     file_offset: z.number().int().min(0).nullable(),
     size: z.number().int().min(0).nullable(),
     alignment: z.number().int().min(0).nullable(),
@@ -18,6 +21,9 @@ export const parseLipoArchitectures = (output) => {
                 name: thinArchitecture,
                 cpu_type: null,
                 cpu_subtype: null,
+                cpu_type_code: null,
+                cpu_subtype_code: null,
+                capabilities: null,
                 file_offset: null,
                 size: null,
                 alignment: null,
@@ -36,6 +42,9 @@ export const parseLipoArchitectures = (output) => {
                     : name,
                 cpu_type: current.cputype ?? null,
                 cpu_subtype: current.cpusubtype ?? null,
+                cpu_type_code: cpuTypeCode(current.cputype),
+                cpu_subtype_code: cpuSubtypeCode(current.cpusubtype, current.capabilities),
+                capabilities: current.capabilities ?? null,
                 file_offset: integer(current.offset),
                 size: integer(current.size),
                 alignment: alignment(current.align),
@@ -54,7 +63,7 @@ export const parseLipoArchitectures = (output) => {
             current = { architecture: line.slice("architecture ".length).trim() };
             continue;
         }
-        const match = /^(cputype|cpusubtype|offset|size|align)\s+(.+)$/u.exec(line);
+        const match = /^(cputype|cpusubtype|capabilities|offset|size|align)\s+(.+)$/u.exec(line);
         if (match?.[1] !== undefined && match[2] !== undefined) {
             current ??= {};
             current[match[1]] = match[2].trim();
@@ -71,6 +80,67 @@ const integer = (value) => {
     const parsed = Number.parseInt(value, 10);
     return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : null;
 };
+const CPU_TYPES = {
+    CPU_TYPE_X86: 7,
+    CPU_TYPE_X86_64: 0x01000007,
+    CPU_TYPE_ARM: 12,
+    CPU_TYPE_ARM64: 0x0100000c,
+    CPU_TYPE_ARM64_32: 0x0200000c,
+    CPU_TYPE_POWERPC: 18,
+    CPU_TYPE_POWERPC64: 0x01000012,
+};
+const CPU_SUBTYPES = {
+    CPU_SUBTYPE_X86_ALL: 3,
+    CPU_SUBTYPE_X86_64_ALL: 3,
+    CPU_SUBTYPE_X86_64_H: 8,
+    CPU_SUBTYPE_ARM64_ALL: 0,
+    CPU_SUBTYPE_ARM64_V8: 1,
+    CPU_SUBTYPE_ARM64E: 2,
+    CPU_SUBTYPE_ARM64_32_ALL: 0,
+    CPU_SUBTYPE_ARM64_32_V8: 1,
+    CPU_SUBTYPE_ARM_V7: 9,
+    CPU_SUBTYPE_ARM_V7S: 11,
+    CPU_SUBTYPE_ARM_V7K: 12,
+    CPU_SUBTYPE_POWERPC_ALL: 0,
+    CPU_SUBTYPE_POWERPC_970: 100,
+};
+/** Normalize known lipo names while retaining the producer's original text. */
+const cpuTypeCode = (value) => {
+    if (value === undefined)
+        return null;
+    const numeric = unsigned32(value);
+    return numeric ?? CPU_TYPES[value] ?? null;
+};
+/** Normalize the subtype and its separately printed ptrauth capability bits. */
+const cpuSubtypeCode = (value, capabilities) => {
+    if (value === undefined)
+        return null;
+    const numeric = unsigned32(value);
+    if (numeric !== null)
+        return numeric;
+    const subtype = CPU_SUBTYPES[value];
+    if (subtype === undefined)
+        return null;
+    if (value !== "CPU_SUBTYPE_ARM64E")
+        return subtype;
+    const version = /PTR_AUTH_VERSION\s+USERSPACE\s+(\d+)/u.exec(capabilities ?? "")?.[1];
+    if (version === undefined)
+        return null;
+    const parsedVersion = Number(version);
+    if (!Number.isInteger(parsedVersion) ||
+        parsedVersion < 0 ||
+        parsedVersion > 15)
+        return null;
+    return (0x80000000 | (parsedVersion << 24) | subtype) >>> 0;
+};
+const unsigned32 = (value) => {
+    if (!/^(?:\d+|0x[\da-f]+)$/iu.test(value))
+        return null;
+    const parsed = Number(value);
+    return Number.isInteger(parsed) && parsed >= 0 && parsed <= 0xffffffff
+        ? parsed >>> 0
+        : null;
+};
 const alignment = (value) => {
     if (value === undefined)
         return null;

package/dist/native/pwndbg/PwndbgCoreContext.js

@@ -28,7 +28,7 @@ const replySchema = z.discriminatedUnion("ok", [
     }),
 ]);
 /** Add mapping candidates from an owned core-only debugger, using the existing snapshot. */
-export const inspectPwndbgCore = async ({ environment, rootPath, diagnostics, options, launcher, }) => {
+export const inspectPwndbgCore = async ({ environment, rootPath, diagnostics, options, launcher, probePath, }) => {
     const gdb = environment.REA_PWNDBG_GDB ?? "/usr/bin/gdb";
     const entry = environment.REA_PWNDBG_GDBINIT ?? "";
     const venv = environment.REA_PWNDBG_VENV_PATH ?? "";
@@ -37,23 +37,43 @@ export const inspectPwndbgCore = async ({ environment, rootPath, diagnostics, op
         userMessage: message,
         capturedOutput: diagnostics,
     });
+    const checkCancelled = () => {
+        if (options?.signal?.aborted)
+            throw new AnalysisCancelledError(OPERATION, {
+                capturedOutput: diagnostics,
+            });
+    };
+    checkCancelled();
     for (const [key, path, kind] of [
         ["REA_PWNDBG_GDB", gdb, "file"],
         ["REA_PWNDBG_GDBINIT", entry, "file"],
         ["REA_PWNDBG_VENV_PATH", venv, "directory"],
     ]) {
         try {
+            checkCancelled();
             if (!isAbsolute(path))
                 throw new Error("Expected an absolute caller-supplied path.");
-            await access(path, key === "REA_PWNDBG_GDB" ? constants.X_OK : constants.R_OK);
-            const information = await stat(path);
-            if (kind === "file" ? !information.isFile() : !information.isDirectory())
-                throw new Error(`Expected a ${kind}.`);
+            const mode = key === "REA_PWNDBG_GDB" ? constants.X_OK : constants.R_OK;
+            if (probePath !== undefined) {
+                await probePath(path, kind, mode);
+            }
+            else {
+                await access(path, mode);
+                checkCancelled();
+                const information = await stat(path);
+                checkCancelled();
+                if (kind === "file" ? !information.isFile() : !information.isDirectory())
+                    throw new Error(`Expected a ${kind}.`);
+            }
+            checkCancelled();
         }
         catch (cause) {
+            if (options?.signal?.aborted)
+                checkCancelled();
             throw unavailable(`${key} is unavailable at ${path}: ${cause instanceof Error ? cause.message : String(cause)}. Configure the requested core-only context, or omit include_debugger_context for basic recorded evidence.`, cause);
         }
     }
+    checkCancelled();
     const stage = join(rootPath, "debugger");
     await mkdir(stage, { mode: 0o700 });
     const requestPath = join(stage, "request.json");

package/dist/native/pwntools/PwntoolsDecoder.js

@@ -16,6 +16,7 @@ import { OwnedCommandFailure } from "../../process/OwnedCommand.js";
 import { pwntoolsResourceLimitsSchema, readPwntoolsFailureEvidence, } from "./PwntoolsResourceLimits.js";
 import { PrivateRuntimeRoot } from "../../process/PrivateRuntimeRoot.js";
 import { PWNTOOLS_PROVIDER_IDENTITY, PWNTOOLS_LIMITS, } from "./PwntoolsRelease.js";
+const HOST_REQUIREMENT = "The initial real-verified pwntools artifact profile supports Linux x64 only.";
 /** Thin owned-process adapter; all ELF parsing and heuristics come from unchanged upstream code. */
 export class PwntoolsDecoder {
     profile;
@@ -64,7 +65,7 @@ export class PwntoolsDecoder {
             if (options?.signal?.aborted)
                 throw new AnalysisCancelledError(OPERATION);
             if (process.platform !== "linux" || process.arch !== "x64")
-                throw new AnalysisCapabilityUnavailableError(this.identity.id, OPERATION, "The initial real-verified pwntools artifact profile supports Linux x64 only.");
+                throw new AnalysisCapabilityUnavailableError(this.identity.id, OPERATION, HOST_REQUIREMENT, { userMessage: HOST_REQUIREMENT });
             if (!isAbsolute(selectedPath))
                 throw pwntoolsUnavailable("Set REA_PWNTOOLS_PYTHON to an absolute caller-supplied Python executable with pwntools 4.15.0, pyelftools 0.33 and Unicorn 2.1.2; REA never installs Python or packages.", selectedPath, undefined, undefined, context);
             await access(selectedPath, constants.X_OK);

package/dist/native/pwntools/RecordedCrashStructureBindings.js

@@ -60,6 +60,8 @@ export function validateRecordedCrashStructure(report, snapshot, diagnostics) {
     if (!header
         .subarray(0, 6)
         .equals(Buffer.from([0x7f, 0x45, 0x4c, 0x46, 2, 1])) ||
+        header[6] !== 1 ||
+        header.readUInt32LE(20) !== 1 ||
         ![0, 3].includes(header[7] ?? -1) ||
         header[8] !== 0 ||
         header.readUInt16LE(16) !== 4 ||

package/dist/process/DarwinProcessRunTokenReader.js

@@ -1,4 +1,4 @@
-import { mkdtemp, rm } from "node:fs/promises";
+import { mkdir, mkdtemp, rm } from "node:fs/promises";
 import { rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -42,6 +42,12 @@ const sourceFiles = [
     fileURLToPath(new URL("../../bridge/process/ProcessRunTokenReader.swift", import.meta.url)),
     fileURLToPath(new URL("../../bridge/process/ProcessRunTokenReaderMain.swift", import.meta.url)),
 ];
+/**
+ * swift-driver runs each frontend job in its own process group. On SIGINT it
+ * stops those jobs and deletes their objects before exiting; on SIGTERM it
+ * exits while a job can still write objects under TMPDIR.
+ */
+export const SWIFTC_INTERRUPT = "SIGINT";
 /** The native Darwin process-ownership reader could not be prepared. */
 export class DarwinProcessOwnershipInspectionError extends Error {
     constructor(message, options) {
@@ -114,18 +120,23 @@ export const createDarwinProcessRunTokenReader = (options = {}) => {
             if (signal.aborted || closed)
                 throw abortReason(signal);
             const output = join(operationRoot, "reader");
+            // swiftc keeps intermediate objects under TMPDIR, so keep them inside
+            // the root that cleanup removes.
+            const compilerTemporary = join(operationRoot, "tmp");
+            await mkdir(compilerTemporary);
+            const compilerEnvironment = {
+                ...process.env,
+                TMPDIR: compilerTemporary,
+            };
+            // Use Swift's reusable default cache for REA's internal helper compilation.
+            delete compilerEnvironment.CLANG_MODULE_CACHE_PATH;
             try {
-                await execFileOutput(options.xcrun ?? "/usr/bin/xcrun", [
-                    "swiftc",
-                    "-module-cache-path",
-                    join(operationRoot, "modules"),
-                    ...sourceFiles,
-                    "-o",
-                    output,
-                ], {
+                await execFileOutput(options.xcrun ?? "/usr/bin/xcrun", ["swiftc", ...sourceFiles, "-o", output], {
                     timeout: 60_000,
                     maxBuffer: 1024 * 1024,
                     signal,
+                    stopSignal: SWIFTC_INTERRUPT,
+                    env: compilerEnvironment,
                 });
             }
             catch (cause) {
@@ -134,7 +145,9 @@ export const createDarwinProcessRunTokenReader = (options = {}) => {
                 const code = cause instanceof Error && "code" in cause
                     ? String(cause.code)
                     : "unknown";
-                throw new DarwinProcessOwnershipInspectionError(`macOS process ownership inspection requires the Apple Swift compiler via xcrun (compiler result: ${code})`, { cause });
+                throw new DarwinProcessOwnershipInspectionError(code === "ENOENT"
+                    ? `macOS process ownership inspection requires the Apple Swift compiler via xcrun (compiler result: ${code})`
+                    : `macOS process ownership helper compilation failed via xcrun (compiler result: ${code}): ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
             }
             if (signal.aborted || closed)
                 throw abortReason(signal);

package/dist/process/ExecFileOutput.js

@@ -1,17 +1,119 @@
 import { execFile, } from "node:child_process";
+/** How long a stopped process may take to exit before it is killed. */
+const STOP_GRACE_MS = 5_000;
+const abortError = (signal) => {
+    const error = new Error("The operation was aborted", {
+        cause: signal.reason,
+    });
+    error.name = "AbortError";
+    Reflect.set(error, "code", "ABORT_ERR");
+    return error;
+};
+/**
+ * A command stopped at its timeout can still exit cleanly, so the timeout is
+ * the failure. Like Node's execFile timeout, it reports `killed: true`.
+ */
+const timeoutError = (command, timeout, exit) => {
+    const error = new Error(`Command timed out after ${String(timeout)} ms: ${command}`, exit === null ? undefined : { cause: exit });
+    Reflect.set(error, "code", "ETIMEDOUT");
+    Reflect.set(error, "killed", true);
+    Reflect.set(error, "signal", exit === null ? null : (Reflect.get(exit, "signal") ?? null));
+    return error;
+};
+/**
+ * The `timeout` contract for both modes, checked before spawning. A stoppable
+ * command keeps its own deadline, so execFile never validates it. Node 26's
+ * execFile also caps it at Number.MAX_SAFE_INTEGER; Node 22 and 24 accept
+ * larger integers, which their timers then clamp to 1 ms.
+ */
+const invalidTimeout = (timeout) => {
+    if (Number.isSafeInteger(timeout) && timeout >= 0)
+        return undefined;
+    const error = new RangeError(`The value of "timeout" is out of range. It must be an unsigned integer. Received ${String(timeout)}`);
+    Reflect.set(error, "code", "ERR_OUT_OF_RANGE");
+    return error;
+};
+/** Read captured output metadata from a failed execFileOutput invocation. */
+export const execFileOutputFailure = (cause) => {
+    if (!(cause instanceof Error))
+        return undefined;
+    const stdout = Reflect.get(cause, "stdout");
+    const stderr = Reflect.get(cause, "stderr");
+    const code = Reflect.get(cause, "code");
+    const signal = Reflect.get(cause, "signal");
+    const killed = Reflect.get(cause, "killed");
+    if (typeof stdout !== "string" || typeof stderr !== "string")
+        return undefined;
+    return {
+        stdout,
+        stderr,
+        code: typeof code === "string" || typeof code === "number" ? code : null,
+        signal: typeof signal === "string" ? signal : null,
+        killed: killed === true,
+        outputTruncated: code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER",
+    };
+};
 /** Run a shell-free command while capturing its complete UTF-8 output. */
 export const execFileOutput = (command, arguments_, options = {}) => new Promise((resolve, reject) => {
-    execFile(command, [...arguments_], {
-        ...options,
+    const { stopSignal, signal, timeout, ...execOptions } = options;
+    const invalid = timeout === undefined ? undefined : invalidTimeout(timeout);
+    if (invalid !== undefined) {
+        reject(invalid);
+        return;
+    }
+    if (stopSignal !== undefined && signal?.aborted === true) {
+        reject(abortError(signal));
+        return;
+    }
+    let stopped;
+    let deadline;
+    let grace;
+    const child = execFile(command, [...arguments_], {
+        ...execOptions,
+        // A stoppable command's abort and timeout are handled below, because
+        // execFile neither waits for the exit on abort nor kills a process
+        // that ignores its timeout signal.
+        ...(stopSignal === undefined
+            ? {
+                ...(signal === undefined ? {} : { signal }),
+                ...(timeout === undefined ? {} : { timeout }),
+            }
+            : { killSignal: stopSignal }),
         encoding: "utf8",
         maxBuffer: options.maxBuffer ?? Number.POSITIVE_INFINITY,
     }, (error, stdout, stderr) => {
-        if (error !== null) {
-            Reflect.set(error, "stdout", stdout);
-            Reflect.set(error, "stderr", stderr);
-            reject(error);
+        signal?.removeEventListener("abort", onAbort);
+        clearTimeout(deadline);
+        clearTimeout(grace);
+        const failure = stopped === "abort" && signal !== undefined
+            ? abortError(signal)
+            : stopped === "timeout" && timeout !== undefined
+                ? timeoutError(command, timeout, error)
+                : error;
+        if (failure !== null) {
+            Reflect.set(failure, "stdout", stdout);
+            Reflect.set(failure, "stderr", stderr);
+            reject(failure);
             return;
         }
         resolve({ stdout, stderr });
     });
+    // The first stop request names the failure; a later one is not resent.
+    const stop = (reason) => {
+        if (stopped !== undefined)
+            return;
+        stopped = reason;
+        child.kill(stopSignal);
+        grace = setTimeout(() => child.kill("SIGKILL"), STOP_GRACE_MS);
+    };
+    const onAbort = () => {
+        stop("abort");
+    };
+    if (stopSignal === undefined)
+        return;
+    signal?.addEventListener("abort", onAbort, { once: true });
+    if (timeout !== undefined && timeout > 0)
+        deadline = setTimeout(() => {
+            stop("timeout");
+        }, timeout);
 });

package/dist/process/OwnedCommand.js

@@ -83,9 +83,14 @@ const collectOwnedCommand = async (spawn, limits, launcher, deadline, callerSign
                 : "Command deadline elapsed.", snapshot);
         if (exceeded)
             throw new OwnedCommandFailure("output-limit", "Command diagnostic output exceeded its complete-output budget.", snapshot);
+        const acceptedNonzeroExit = limits.acceptNonZeroExit === true &&
+            snapshot.exitCode !== null &&
+            snapshot.exitCode !== undefined &&
+            snapshot.exitCode !== 0 &&
+            snapshot.signal === null;
         if (processFailure !== undefined ||
-            snapshot.exitCode !== 0 ||
-            snapshot.signal !== null)
+            ((snapshot.exitCode !== 0 || snapshot.signal !== null) &&
+                !acceptedNonzeroExit))
             throw new OwnedCommandFailure("process", processFailure ??
                 "Command failed; inspect its exit status and diagnostics.", snapshot);
     }

package/dist/process/PrivateRuntimeRoot.js

@@ -50,12 +50,17 @@ export class PrivateRuntimeRoot {
             throw cause;
         }
     }
-    /** Remove the runtime root; concurrent and repeated callers share cleanup. */
+    /**
+     * Remove the runtime root; concurrent callers share one attempt. A failed
+     * attempt is not cached, so a later close retries the removal.
+     */
     close() {
-        this.#closePromise ??=
-            this.windowsRuntime === undefined
-                ? rm(this.path, { recursive: true, force: true })
-                : Promise.resolve().then(() => this.windowsRuntime?.close());
+        this.#closePromise ??= (this.windowsRuntime === undefined
+            ? rm(this.path, { recursive: true, force: true })
+            : Promise.resolve().then(() => this.windowsRuntime?.close())).catch((cause) => {
+            this.#closePromise = undefined;
+            throw cause;
+        });
         return this.#closePromise;
     }
 }