specrails-desktop 2.29.0 → 2.29.2

package/server/dist/chat-manager.js

@@ -54,6 +54,18 @@ class ChatManager {
     _buffers;
     _emittedProposals;
     _abortingConversations;
+    /** Permanent lifecycle gate. Project contexts are not reusable after their
+     * DB is closed, so every public/asynchronous entry point must fail closed
+     * once shutdown starts. */
+    _disposed = false;
+    _resolveDisposed;
+    _disposedSignal = new Promise((resolve) => {
+        this._resolveDisposed = resolve;
+    });
+    /** Active turn promises otherwise settle only when their child emits
+     * `close`. Shutdown must also settle them when a mocked/wedged child never
+     * closes, while late child callbacks become harmless no-ops. */
+    _pendingTurnCancellations = new Set();
     _specDraftStates;
     /** Per-conversation live-strip state for `\`\`\`spec-draft` fenced blocks. */
     _streamFilters;
@@ -65,6 +77,9 @@ class ChatManager {
     /** Persistent-stdin Explore transport (big bet #3, flag-gated default OFF).
      *  Holds long-lived claude children that survive between turns. */
     _stdinSessions = new explore_stdin_session_1.ExploreStdinSessions();
+    /** Mirror the transport's resident child handles so ChatManager can enforce
+     * its stronger process-group escalation for parked sessions too. */
+    _persistentProcesses = new Map();
     /** MED-1: per-conversation cumulative usage snapshot for the persistent-stdin
      *  transport. One long-lived child serves every turn, so claude's `result`
      *  event reports SESSION-CUMULATIVE cost/tokens/num_turns. We diff each turn
@@ -76,6 +91,10 @@ class ChatManager {
      *  tree-kill any in-flight one instead of orphaning it (BUG-CHAT-02). Each
      *  entry self-removes on its own `'close'`. */
     _auxProcesses = new Set();
+    /** Readline listeners owned by auxiliary children. Closing them at shutdown
+     * prevents buffered title output from running after the project DB closes. */
+    _auxReaders = new Map();
+    _terminationTimers = new Map();
     _cwd;
     _projectName;
     _adapter;
@@ -102,6 +121,85 @@ class ChatManager {
     get provider() {
         return this._adapter.id;
     }
+    async _awaitWhileLive(work) {
+        if (this._disposed)
+            return { disposed: true };
+        return Promise.race([
+            work.then((value) => ({ disposed: false, value })),
+            this._disposedSignal.then(() => ({ disposed: true })),
+        ]);
+    }
+    /** POSIX children get a dedicated process group so escalation can still
+     * address descendants after the root CLI has already exited/reparented them.
+     * Windows uses taskkill /T /F through tree-kill instead. */
+    _spawnOwned(binary, args, options = {}) {
+        if (process.platform === 'win32')
+            return (0, cli_prompt_1.spawnAiCli)(binary, args, options);
+        return (0, cli_prompt_1.spawnAiCli)(binary, args, { ...options, detached: true });
+    }
+    /** Terminate the complete CLI/MCP subtree, escalating when SIGTERM is
+     * ignored. Do NOT cancel escalation when the root closes: descendants remain
+     * in the dedicated POSIX process group even after their parent exits. */
+    _terminate(child) {
+        if (this._terminationTimers.has(child))
+            return;
+        try {
+            if (!child.pid) {
+                child.kill('SIGTERM');
+                return;
+            }
+            const pid = child.pid;
+            (0, tree_kill_1.default)(pid, 'SIGTERM');
+            const timer = setTimeout(() => {
+                this._terminationTimers.delete(child);
+                if (process.platform !== 'win32') {
+                    // Negative PID targets the process GROUP. It remains addressable when
+                    // the root has exited but an MCP descendant ignored SIGTERM.
+                    try {
+                        process.kill(-pid, 'SIGKILL');
+                    }
+                    catch { /* group already gone */ }
+                }
+                else {
+                    try {
+                        (0, tree_kill_1.default)(pid, 'SIGKILL', () => { });
+                    }
+                    catch { /* gone */ }
+                }
+            }, 2000);
+            timer.unref?.();
+            this._terminationTimers.set(child, timer);
+        }
+        catch {
+            /* already gone */
+        }
+    }
+    _closeChildIo(child) {
+        try {
+            child.stdin?.destroy();
+        }
+        catch { /* best-effort */ }
+        try {
+            child.stdout?.destroy();
+        }
+        catch { /* best-effort */ }
+        try {
+            child.stderr?.destroy();
+        }
+        catch { /* best-effort */ }
+    }
+    _trackPersistentProcess(conversationId, child) {
+        if (this._persistentProcesses.get(conversationId) === child)
+            return;
+        this._persistentProcesses.set(conversationId, child);
+        const drop = () => {
+            if (this._persistentProcesses.get(conversationId) === child) {
+                this._persistentProcesses.delete(conversationId);
+            }
+        };
+        child.once('close', drop);
+        child.once('error', drop);
+    }
     /**
      * Resolve the adapter for a conversation. A conversation may carry its own
      * `provider` (set at creation from the Add Spec AI Engine selector); when
@@ -142,6 +240,8 @@ class ChatManager {
         }
     }
     _startIdleTimer(conversationId) {
+        if (this._disposed)
+            return;
         const life = this._exploreLifecycle.get(conversationId);
         if (!life)
             return;
@@ -151,13 +251,11 @@ class ChatManager {
             return;
         this._clearIdleTimer(conversationId);
         life.idleTimer = setTimeout(() => {
-            const child = this._activeProcesses.get(conversationId);
-            if (child?.pid) {
-                try {
-                    (0, tree_kill_1.default)(child.pid, 'SIGTERM');
-                }
-                catch { /* best-effort */ }
-            }
+            if (this._disposed)
+                return;
+            const child = this._activeProcesses.get(conversationId) ?? this._persistentProcesses.get(conversationId);
+            if (child)
+                this._terminate(child);
             // Persistent-stdin children live OUTSIDE _activeProcesses between turns —
             // idle-kill must reach them too (the next turn re-spawns with --resume).
             this._stdinSessions.kill(conversationId);
@@ -169,6 +267,8 @@ class ChatManager {
      * the timer starts when the turn completes.
      */
     notifyMinimized(conversationId) {
+        if (this._disposed)
+            return;
         const life = this._getOrCreateExploreLifecycle(conversationId);
         life.isMinimized = true;
         life.lastActivityAt = Date.now();
@@ -177,6 +277,8 @@ class ChatManager {
     /** Mark an Explore conversation as restored (un-minimized). Cancels the
      *  pending idle-kill timer if any. */
     notifyRestored(conversationId) {
+        if (this._disposed)
+            return;
         const life = this._exploreLifecycle.get(conversationId);
         if (!life)
             return;
@@ -208,6 +310,8 @@ class ChatManager {
         return oldest?.id ?? null;
     }
     _drainExploreQueue() {
+        if (this._disposed)
+            return;
         // A released waiter does NOT flip its `isStreaming` flag synchronously — it
         // does so only when its awaiting sendMessage continuation runs as a later
         // microtask. So `_countStreamingExplore()` stays stale across this fully
@@ -224,6 +328,8 @@ class ChatManager {
         }
     }
     async _waitForExploreSlot(conversationId) {
+        if (this._disposed)
+            return 'disposed';
         if (this._countStreamingExplore() < exports.EXPLORE_MAX_CONCURRENCY)
             return 'ok';
         // M14: a streaming slot is freed only when a STREAMING turn ends. The old code
@@ -235,13 +341,9 @@ class ChatManager {
         // stray child) but only grant the slot if the streaming count actually dropped.
         const victim = this._findIdleExploreVictim(conversationId);
         if (victim) {
-            const child = this._activeProcesses.get(victim);
-            if (child?.pid) {
-                try {
-                    (0, tree_kill_1.default)(child.pid, 'SIGTERM');
-                }
-                catch { /* best-effort */ }
-            }
+            const child = this._activeProcesses.get(victim) ?? this._persistentProcesses.get(victim);
+            if (child)
+                this._terminate(child);
             // Reclaim the slot from a persistent-stdin child parked between turns.
             this._stdinSessions.kill(victim);
             this._clearIdleTimer(victim);
@@ -262,7 +364,7 @@ class ChatManager {
                 enqueuedAt: Date.now(),
                 timeoutTimer,
                 onSlot: () => resolve('ok'),
-                onTimeout: () => resolve('busy'),
+                onTimeout: () => resolve(this._disposed ? 'disposed' : 'busy'),
             });
         });
     }
@@ -339,6 +441,8 @@ class ChatManager {
     }
     /** Drop the per-conversation draft state (used on conversation deletion). */
     forgetSpecDraft(conversationId) {
+        if (this._disposed)
+            return;
         this._specDraftStates.delete(conversationId);
     }
     /** Snapshot of the current spec-draft state for a conversation, or null
@@ -346,6 +450,8 @@ class ChatManager {
      *  a refresh / minimize cycle so updates Claude pushed while no shell
      *  was subscribed don't get lost. */
     getSpecDraftState(conversationId) {
+        if (this._disposed)
+            return null;
         return this._specDraftStates.get(conversationId) ?? null;
     }
     /**
@@ -454,9 +560,11 @@ class ChatManager {
         return `${scopedBase}\n\n${prefix}`;
     }
     isActive(conversationId) {
-        return this._activeProcesses.has(conversationId);
+        return !this._disposed && this._activeProcesses.has(conversationId);
     }
     async sendMessage(conversationId, userText, options) {
+        if (this._disposed)
+            return;
         if (this._activeProcesses.has(conversationId) || this._reservedTurns.has(conversationId)) {
             console.warn(`[ChatManager] conversation ${conversationId} already has an active or pending stream`);
             return;
@@ -487,6 +595,8 @@ class ChatManager {
             // Explore: enforce per-project concurrency cap before doing any work.
             if (conversation.kind === 'explore') {
                 const slot = await this._waitForExploreSlot(conversationId);
+                if (this._disposed || slot === 'disposed')
+                    return;
                 if (slot === 'busy') {
                     this._broadcast({
                         type: 'chat_error',
@@ -514,7 +624,10 @@ class ChatManager {
             let hasAttachments = false;
             if (options?.attachments && options.attachments.ids.length > 0) {
                 try {
-                    const { textBlocks } = await attachment_manager_1.attachmentManager.getClaudeArgs(options.attachments.slug, options.attachments.ticketKey, options.attachments.ids);
+                    const attachmentResult = await this._awaitWhileLive(attachment_manager_1.attachmentManager.getClaudeArgs(options.attachments.slug, options.attachments.ticketKey, options.attachments.ids));
+                    if (attachmentResult.disposed)
+                        return;
+                    const { textBlocks } = attachmentResult.value;
                     if (textBlocks.length > 0) {
                         resolvedText = `${resolvedText}\n\n## Attached Resources\n\n${textBlocks.join('\n\n')}`;
                         hasAttachments = true;
@@ -523,6 +636,10 @@ class ChatManager {
                 catch (err) {
                     console.error(`[chat-manager] attachment extraction failed (${conversationId}):`, err);
                 }
+                // Project removal may close the DB while attachment extraction is in
+                // flight. Never continue into context reads or a new spawn afterwards.
+                if (this._disposed)
+                    return;
             }
             // Build spawn args via the resolved adapter. System prompt placement
             // (--system-prompt flag vs prompt-fold) and resume vs fresh-turn are both
@@ -640,7 +757,7 @@ class ChatManager {
                     lightweight, conversationScope,
                 });
             }
-            const child = (0, cli_prompt_1.spawnAiCli)(binary, args, {
+            const child = this._spawnOwned(binary, args, {
                 env: spawnEnv,
                 stdio: ['ignore', 'pipe', 'pipe'],
                 cwd: spawnCwd,
@@ -648,6 +765,8 @@ class ChatManager {
             let stderrBuf = '';
             // Drain stderr so the pipe buffer never fills up (child process would block otherwise)
             child.stderr?.on('data', (chunk) => {
+                if (this._disposed)
+                    return;
                 const text = chunk.toString();
                 stderrBuf += text;
                 console.error(`[chat-manager] ${binary} stderr (${conversationId}):`, text.trim());
@@ -659,6 +778,8 @@ class ChatManager {
             // Surface ENOENT (e.g. claude not on PATH) instead of crashing the app.
             /* c8 ignore start -- spawn-failure path; exercised manually, not in CI */
             child.on('error', (err) => {
+                if (this._disposed)
+                    return;
                 console.error(`[chat-manager] spawn failed for ${conversationId}: ${err.message}`);
                 this._activeProcesses.delete(conversationId);
                 this._buffers.delete(conversationId);
@@ -684,6 +805,8 @@ class ChatManager {
             const turnStartedAt = new Date().toISOString();
             const stdoutReader = (0, readline_1.createInterface)({ input: child.stdout, crlfDelay: Infinity });
             const emitDelta = (newText) => {
+                if (this._disposed)
+                    return;
                 const prev = this._buffers.get(conversationId) ?? '';
                 const updated = prev + newText;
                 this._buffers.set(conversationId, updated);
@@ -718,6 +841,8 @@ class ChatManager {
                 }
             };
             const readerHandler = (line) => {
+                if (this._disposed)
+                    return;
                 const ev = adapter.parseStreamLine(line);
                 if (!ev)
                     return;
@@ -760,7 +885,42 @@ class ChatManager {
             let currentChild = child;
             void currentChild; // keep reference live for crash respawn
             return new Promise((resolve) => {
+                let settled = false;
+                const readers = new Set([stdoutReader]);
+                const closeChildren = new Set([child]);
+                const complete = () => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    this._pendingTurnCancellations.delete(cancelForShutdown);
+                    resolve();
+                };
+                const cancelForShutdown = () => {
+                    if (settled)
+                        return;
+                    for (const reader of readers) {
+                        try {
+                            reader.close();
+                        }
+                        catch { /* best-effort */ }
+                    }
+                    for (const ownedChild of closeChildren) {
+                        ownedChild.removeListener('close', onClose);
+                    }
+                    this._activeProcesses.delete(conversationId);
+                    this._buffers.delete(conversationId);
+                    this._emittedProposals.delete(conversationId);
+                    this._abortingConversations.delete(conversationId);
+                    this._streamFilters.delete(conversationId);
+                    complete();
+                };
                 const onClose = (code) => {
+                    if (settled)
+                        return;
+                    if (this._disposed) {
+                        cancelForShutdown();
+                        return;
+                    }
                     console.log(`[chat-manager] ${adapter.id} exited code=${code} conv=${conversationId}`);
                     const fullText = this._buffers.get(conversationId) ?? '';
                     const wasAborting = this._abortingConversations.has(conversationId);
@@ -797,12 +957,13 @@ class ChatManager {
                                 : args;
                             console.warn(`[chat-manager] explore crash respawn for ${conversationId}`);
                             try {
-                                const newChild = (0, cli_prompt_1.spawnAiCli)(binary, respawnArgs, {
+                                const newChild = this._spawnOwned(binary, respawnArgs, {
                                     env: process.env,
                                     stdio: ['ignore', 'pipe', 'pipe'],
                                     cwd: spawnCwd,
                                 });
                                 currentChild = newChild;
+                                closeChildren.add(newChild);
                                 args = respawnArgs;
                                 // MED-2: the crashed spawn already burned tokens (tool-call rounds
                                 // before the crash). Its usage was aggregated into adapterEvents by
@@ -829,6 +990,8 @@ class ChatManager {
                                 adapterEvents.length = 0;
                                 this._activeProcesses.set(conversationId, newChild);
                                 newChild.stderr?.on('data', (chunk) => {
+                                    if (this._disposed)
+                                        return;
                                     const text = chunk.toString();
                                     stderrBuf += text;
                                     console.error(`[chat-manager] ${binary} stderr (${conversationId}):`, text.trim());
@@ -840,6 +1003,10 @@ class ChatManager {
                                 // event and crash the entire app. Mirror the original handler.
                                 /* c8 ignore start -- respawn spawn-failure path; exercised manually, not in CI */
                                 newChild.on('error', (err) => {
+                                    if (this._disposed) {
+                                        cancelForShutdown();
+                                        return;
+                                    }
                                     console.error(`[chat-manager] explore crash-respawn spawn failed for ${conversationId}: ${err.message}`);
                                     // MED-2: the respawn never streamed a result event, so the normal
                                     // close-path recording is bypassed. Record whatever usage the
@@ -873,10 +1040,11 @@ class ChatManager {
                                         error: `Failed to launch ${binary}: ${err.message}`,
                                         timestamp: new Date().toISOString(),
                                     });
-                                    resolve();
+                                    complete();
                                 });
                                 /* c8 ignore stop */
                                 const newReader = (0, readline_1.createInterface)({ input: newChild.stdout, crlfDelay: Infinity });
+                                readers.add(newReader);
                                 newReader.on('line', readerHandler);
                                 newChild.on('close', onClose);
                                 return;
@@ -925,7 +1093,7 @@ class ChatManager {
                     });
                     if (wasAborting) {
                         // abort already emitted chat_error
-                        resolve();
+                        complete();
                         return;
                     }
                     if (code === 0) {
@@ -986,8 +1154,9 @@ class ChatManager {
                             timestamp: new Date().toISOString(),
                         });
                     }
-                    resolve();
+                    complete();
                 };
+                this._pendingTurnCancellations.add(cancelForShutdown);
                 child.on('close', onClose);
             });
         }
@@ -1009,6 +1178,8 @@ class ChatManager {
      * `--resume`. Only reached when the flag is on; the legacy path is untouched.
      */
     async _streamPersistentExploreTurn(p) {
+        if (this._disposed)
+            return;
         const { conversationId, conversation, adapter, binary, model, systemPrompt, scopeFlags, spawnCwd, promptForAdapter, isFirstTurn, userText, lightweight, conversationScope, } = p;
         const sessionArgs = adapter.buildArgs('chat-stream', {
             prompt: '',
@@ -1019,8 +1190,9 @@ class ChatManager {
             loadUserEnv: adapter.id === 'claude' && !!conversationScope?.userMcp,
         });
         const { child, isNew } = this._stdinSessions.getOrSpawn(conversationId, {
-            binary, args: sessionArgs, cwd: spawnCwd, env: process.env,
+            binary, args: sessionArgs, cwd: spawnCwd, env: process.env, spawn: this._spawnOwned.bind(this),
         });
+        this._trackPersistentProcess(conversationId, child);
         // MED-1: a fresh child restarts claude's session-cumulative counters at 0,
         // so drop any stale baseline. The next turn diffs against zero.
         if (isNew)
@@ -1034,6 +1206,8 @@ class ChatManager {
         let stderrBuf = '';
         const turnStartedAt = new Date().toISOString();
         const emitDelta = (newText) => {
+            if (this._disposed)
+                return;
             const prev = this._buffers.get(conversationId) ?? '';
             this._buffers.set(conversationId, prev + newText);
             const filter = this._streamFilters.get(conversationId);
@@ -1063,6 +1237,8 @@ class ChatManager {
             }
         };
         const recordInv = (status) => {
+            if (this._disposed)
+                return;
             if (!this._projectId)
                 return;
             try {
@@ -1134,6 +1310,8 @@ class ChatManager {
             this._streamFilters.delete(conversationId);
         };
         const markStreamingEnded = (success) => {
+            if (this._disposed)
+                return;
             const life = this._exploreLifecycle.get(conversationId);
             if (life) {
                 life.isStreaming = false;
@@ -1147,6 +1325,19 @@ class ChatManager {
         };
         return new Promise((resolve) => {
             let settled = false;
+            const complete = () => {
+                this._pendingTurnCancellations.delete(cancelForShutdown);
+                resolve();
+            };
+            const cancelForShutdown = () => {
+                if (settled)
+                    return;
+                settled = true;
+                this._stdinSessions.clearHandlers(conversationId);
+                cleanupTurnState();
+                this._abortingConversations.delete(conversationId);
+                complete();
+            };
             // LOW-7: the persistent transport ends the turn on the `result` event even
             // when that event reports a failure (is_error / an `error_*` subtype, e.g.
             // error_max_turns). Recording those as status='success' misreports the
@@ -1156,6 +1347,10 @@ class ChatManager {
             const finishTurn = () => {
                 if (settled)
                     return;
+                if (this._disposed) {
+                    cancelForShutdown();
+                    return;
+                }
                 settled = true;
                 this._stdinSessions.clearHandlers(conversationId);
                 const fullText = this._buffers.get(conversationId) ?? '';
@@ -1168,7 +1363,7 @@ class ChatManager {
                 // user-cancelled — do NOT persist the partial assistant message, update
                 // the session, or broadcast chat_done (mirrors the legacy close handler).
                 if (wasAborting) {
-                    resolve();
+                    complete();
                     return;
                 }
                 const parsed = (0, spec_draft_parser_1.parseSpecDraftBlocks)(fullText);
@@ -1202,7 +1397,7 @@ class ChatManager {
                 if (isFirstTurn && fullText && !lightweight) {
                     this._autoTitle(conversationId, userText, fullText);
                 }
-                resolve();
+                complete();
             };
             const onClose = (code) => {
                 // The persistent child died (crash / idle-kill / shutdown). If the turn
@@ -1211,6 +1406,10 @@ class ChatManager {
                 // `--resume`, so no persisted state is lost.
                 if (settled)
                     return;
+                if (this._disposed) {
+                    cancelForShutdown();
+                    return;
+                }
                 settled = true;
                 this._stdinSessions.clearHandlers(conversationId);
                 const wasAborting = this._abortingConversations.has(conversationId);
@@ -1219,7 +1418,7 @@ class ChatManager {
                 markStreamingEnded(false);
                 recordInv(wasAborting ? 'aborted' : 'failed');
                 if (wasAborting) {
-                    resolve();
+                    complete();
                     return;
                 }
                 const stderrTail = stderrBuf.trim().slice(-500);
@@ -1231,9 +1430,11 @@ class ChatManager {
                         : `Process exited with code ${code ?? 'unknown'}`,
                     timestamp: new Date().toISOString(),
                 });
-                resolve();
+                complete();
             };
             const onLine = (line) => {
+                if (this._disposed || settled)
+                    return;
                 const ev = adapter.parseStreamLine(line);
                 if (!ev)
                     return;
@@ -1264,11 +1465,14 @@ class ChatManager {
             this._stdinSessions.setHandlers(conversationId, {
                 onLine,
                 onStderr: (s) => {
+                    if (this._disposed || settled)
+                        return;
                     stderrBuf += s;
                     console.error(`[chat-manager] ${binary} stderr (${conversationId}):`, s.trim());
                 },
                 onClose,
             });
+            this._pendingTurnCancellations.add(cancelForShutdown);
             if (!this._stdinSessions.writeTurn(conversationId, promptForAdapter)) {
                 // stdin already gone (child died between spawn and write) — fail the turn.
                 onClose(null);
@@ -1276,11 +1480,13 @@ class ChatManager {
         });
     }
     abort(conversationId) {
+        if (this._disposed)
+            return;
         const child = this._activeProcesses.get(conversationId);
         if (!child || !child.pid)
             return;
         this._abortingConversations.add(conversationId);
-        (0, tree_kill_1.default)(child.pid, 'SIGTERM');
+        this._terminate(child);
         this._broadcast({
             type: 'chat_error',
             conversationId,
@@ -1296,12 +1502,20 @@ class ChatManager {
      * armed timers) don't accumulate for the lifetime of the project.
      */
     forgetExploreLifecycle(conversationId) {
+        if (this._disposed)
+            return;
         this._clearIdleTimer(conversationId);
         const idx = this._exploreQueue.findIndex((q) => q.conversationId === conversationId);
         if (idx >= 0) {
             clearTimeout(this._exploreQueue[idx].timeoutTimer);
             this._exploreQueue.splice(idx, 1);
         }
+        const persistentChild = this._persistentProcesses.get(conversationId);
+        if (persistentChild) {
+            this._terminate(persistentChild);
+            this._closeChildIo(persistentChild);
+            this._persistentProcesses.delete(conversationId);
+        }
         this._stdinSessions.kill(conversationId);
         this._stdinCumulative.delete(conversationId);
         this._exploreLifecycle.delete(conversationId);
@@ -1314,42 +1528,62 @@ class ChatManager {
      * app exits and keep consuming API quota/CPU. Idempotent.
      */
     shutdown() {
-        for (const child of this._activeProcesses.values()) {
-            if (child?.pid) {
-                try {
-                    (0, tree_kill_1.default)(child.pid, 'SIGTERM');
-                }
-                catch { /* best-effort */ }
-            }
+        if (this._disposed)
+            return;
+        this._disposed = true;
+        this._resolveDisposed();
+        // Snapshot before cancellation callbacks remove ownership from the maps.
+        const ownedChildren = new Set([
+            ...this._activeProcesses.values(),
+            ...this._persistentProcesses.values(),
+        ]);
+        const auxChildren = Array.from(this._auxProcesses);
+        // Settle every queued capacity waiter and every spawned-turn promise now;
+        // do not rely on a killed/wedged child eventually emitting `close`.
+        for (const q of this._exploreQueue) {
+            clearTimeout(q.timeoutTimer);
+            q.onTimeout();
+        }
+        this._exploreQueue = [];
+        for (const cancel of Array.from(this._pendingTurnCancellations))
+            cancel();
+        this._pendingTurnCancellations.clear();
+        for (const child of ownedChildren) {
+            // ChatManager's process-group timer remains authoritative even for
+            // persistent children: the transport's legacy root-PID escalation cannot
+            // reach a resistant MCP after the root exits.
+            this._terminate(child);
+            this._closeChildIo(child);
         }
         // Persistent-stdin children outlive individual turns — tear them down too.
         this._stdinSessions.killAll();
+        this._persistentProcesses.clear();
         this._stdinCumulative.clear();
         // Fire-and-forget auxiliary children (auto-title) are not keyed by
         // conversation; tree-kill any in-flight one so it isn't orphaned on
         // shutdown / project removal (BUG-CHAT-02).
-        for (const child of this._auxProcesses) {
-            if (child?.pid) {
-                try {
-                    (0, tree_kill_1.default)(child.pid, 'SIGTERM');
-                }
-                catch { /* best-effort */ }
+        for (const child of auxChildren) {
+            const reader = this._auxReaders.get(child);
+            try {
+                reader?.close();
             }
+            catch { /* best-effort */ }
+            this._terminate(child);
+            this._closeChildIo(child);
         }
+        this._auxReaders.clear();
         this._auxProcesses.clear();
         for (const id of this._exploreLifecycle.keys()) {
             this._clearIdleTimer(id);
         }
-        for (const q of this._exploreQueue) {
-            clearTimeout(q.timeoutTimer);
-        }
-        this._exploreQueue = [];
         this._activeProcesses.clear();
+        this._reservedTurns.clear();
         this._buffers.clear();
         this._emittedProposals.clear();
         this._abortingConversations.clear();
         this._streamFilters.clear();
         this._exploreLifecycle.clear();
+        this._specDraftStates.clear();
     }
     /**
      * Record an ai_invocations row for a chat turn (explore or sidebar).
@@ -1368,6 +1602,8 @@ class ChatManager {
      * native cost — so kill/crash paths still record a priced row.
      */
     _recordChatInvocation(opts) {
+        if (this._disposed)
+            return;
         if (!this._projectId)
             return;
         if (opts.kind !== 'explore' && opts.kind !== 'sidebar')
@@ -1397,6 +1633,8 @@ class ChatManager {
         }
     }
     _autoTitle(conversationId, firstUserMsg, firstResponse) {
+        if (this._disposed)
+            return;
         try {
             // Title generation runs on the conversation's own provider.
             const conv = (0, db_1.getConversation)(this._db, conversationId);
@@ -1407,7 +1645,7 @@ class ChatManager {
                 prompt: titlePrompt,
                 model: adapter.defaultModel(),
             });
-            const child = (0, cli_prompt_1.spawnAiCli)(adapter.binary, args, {
+            const child = this._spawnOwned(adapter.binary, args, {
                 env: process.env,
                 stdio: ['ignore', 'pipe', 'pipe'],
                 cwd: this._cwd,
@@ -1424,7 +1662,10 @@ class ChatManager {
             const titleEvents = [];
             const titleStartedAt = new Date().toISOString();
             const reader = (0, readline_1.createInterface)({ input: child.stdout, crlfDelay: Infinity });
+            this._auxReaders.set(child, reader);
             reader.on('line', (line) => {
+                if (this._disposed)
+                    return;
                 const ev = adapter.parseStreamLine(line);
                 if (!ev)
                     return;
@@ -1436,8 +1677,23 @@ class ChatManager {
                         titleText = trimmed;
                 }
             });
+            child.on('error', () => {
+                this._auxProcesses.delete(child);
+                this._auxReaders.delete(child);
+                try {
+                    reader.close();
+                }
+                catch { /* best-effort */ }
+            });
             child.on('close', (code) => {
                 this._auxProcesses.delete(child);
+                this._auxReaders.delete(child);
+                try {
+                    reader.close();
+                }
+                catch { /* best-effort */ }
+                if (this._disposed)
+                    return;
                 this._recordChatInvocation({
                     conversationId,
                     kind: conv?.kind,