stitchkit 0.108.0 → 0.108.2

package/dist/process/bun-child.d.ts

@@ -0,0 +1,48 @@
+import { EventEmitter } from 'node:events';
+import { Readable, Writable } from 'node:stream';
+import { type OwnerLossGuardInvocation } from './owner-loss-protocol.js';
+/** What a spawned command exposes to its owner: the subset of a Node child the package uses. */
+export interface OwnedChild extends EventEmitter {
+    readonly pid?: number;
+    readonly exitCode: number | null;
+    readonly signalCode: NodeJS.Signals | null;
+    readonly stdin: Writable;
+    readonly stdout: Readable;
+    readonly stderr: Readable;
+    kill(signal: NodeJS.Signals): boolean;
+}
+/** A child spawned with the caller's stdio: it carries no pipes. */
+export interface ObservableChild extends EventEmitter {
+    readonly pid?: number;
+    readonly exitCode: number | null;
+    readonly signalCode: NodeJS.Signals | null;
+    kill(signal: NodeJS.Signals): boolean;
+}
+interface BunSpawnInput {
+    executable: string;
+    args: readonly string[];
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    group: boolean;
+    ownerLoss?: OwnerLossGuardInvocation;
+}
+/**
+ * Whether the host is Bun. Bun's `node:child_process` can lose a child's `exit` event under
+ * host load inside `bun test`; `Bun.spawn` observes the same exit reliably, so under Bun a
+ * command is launched through it and presented with the Node child's events and streams.
+ */
+export declare function hostIsBun(): boolean;
+/** `spawnOwnedCommand` for Bun: a command with piped stdio. */
+export declare function spawnBunChild(input: BunSpawnInput): OwnedChild;
+/** `spawnInheritedCommand` for Bun: a command with the caller's stdio. */
+export declare function spawnBunInheritedChild(input: BunSpawnInput): ObservableChild;
+export interface BunGuardTarget {
+    readonly pid: number;
+    readonly exitCode: number | null;
+    readonly signalCode: string | number | null;
+    readonly exited: Promise<unknown>;
+}
+/** Bun-native target observation for the standalone owner-loss guard. */
+export declare function spawnBunGuardTarget(executable: string, args: readonly string[]): BunGuardTarget;
+export {};
+//# sourceMappingURL=bun-child.d.ts.map

package/dist/process/bun-child.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bun-child.d.ts","sourceRoot":"","sources":["../../src/process/bun-child.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EAAE,KAAK,wBAAwB,EAAyB,MAAM,uBAAuB,CAAC;AAG7F,gGAAgG;AAChG,MAAM,WAAW,UAAW,SAAQ,YAAY;IAC9C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;CACvC;AAED,oEAAoE;AACpE,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;CACvC;AAED,UAAU,aAAa;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACtC;AAED;;;;GAIG;AACH,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAqKD,+DAA+D;AAC/D,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,UAAU,CAgD9D;AAED,0EAA0E;AAC1E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,aAAa,GAAG,eAAe,CAsC5E;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;CACnC;AAED,yEAAyE;AACzE,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,cAAc,CAMhB"}

package/dist/process/command-owner.d.ts

@@ -1,8 +1,8 @@
-import type { ChildProcessWithoutNullStreams } from 'node:child_process';
+import type { OwnedChild } from './bun-child.js';
 import { type NativeCommandOptions } from './contract.js';
 import { type NativeCommandLaunchDriver } from './launch.js';
 /** One-shot native execution; sandbox policy/admission is composed above this owner. */
-export declare function startNativeCommand(input: NativeCommandOptions, onSpawn?: (child: ChildProcessWithoutNullStreams) => void, driver?: NativeCommandLaunchDriver): {
+export declare function startNativeCommand(input: NativeCommandOptions, onSpawn?: (child: OwnedChild) => void, driver?: NativeCommandLaunchDriver): {
     result: Promise<{
         exitCode: number | null;
         signal: string | null;

package/dist/process/command-owner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-owner.d.ts","sourceRoot":"","sources":["../../src/process/command-owner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAIzE,OAAO,EAEL,KAAK,oBAAoB,EAI1B,MAAM,YAAY,CAAC;AAEpB,OAAO,EAEL,KAAK,yBAAyB,EAG/B,MAAM,UAAU,CAAC;AAOlB,wFAAwF;AACxF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,IAAI,EACzD,MAAM,CAAC,EAAE,yBAAyB;;;;;;;;;;EAkKnC"}
+{"version":3,"file":"command-owner.d.ts","sourceRoot":"","sources":["../../src/process/command-owner.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,EAEL,KAAK,oBAAoB,EAI1B,MAAM,YAAY,CAAC;AAEpB,OAAO,EAEL,KAAK,yBAAyB,EAG/B,MAAM,UAAU,CAAC;AAQlB,wFAAwF;AACxF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,EACrC,MAAM,CAAC,EAAE,yBAAyB;;;;;;;;;;EA8KnC"}

package/dist/process/contract.d.ts

@@ -77,6 +77,9 @@ export declare const NativeCommandOptionsSchema: z.ZodPipe<z.ZodObject<{
         caller: "caller";
         own: "own";
     }>>;
+    ownerLoss: z.ZodOptional<z.ZodEnum<{
+        terminate: "terminate";
+    }>>;
     stdio: z.ZodDefault<z.ZodEnum<{
         inherit: "inherit";
         pipe: "pipe";
@@ -121,6 +124,7 @@ export declare const NativeCommandOptionsSchema: z.ZodPipe<z.ZodObject<{
     }) => void) | undefined;
     drainTimeoutMs?: number | undefined;
     group: "caller" | "own";
+    ownerLoss?: "terminate" | undefined;
     stdio: "inherit" | "pipe";
     cleanupTimeoutMs: number;
     stop: {
@@ -149,6 +153,7 @@ export declare const NativeCommandOptionsSchema: z.ZodPipe<z.ZodObject<{
     }) => void) | undefined;
     drainTimeoutMs?: number | undefined;
     group: "caller" | "own";
+    ownerLoss?: "terminate" | undefined;
     stdio: "inherit" | "pipe";
     stop?: {
         target: "group" | "leader";

package/dist/process/contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../src/process/contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,QAAA,MAAM,6BAA6B;;;;;;;;;;;;2BAajC,CAAC;AACH;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;GAEG;AACH,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gGAAgG;AAChG,eAAO,MAAM,yBAAyB,UAAY,CAAC;AAEnD,QAAA,MAAM,6BAA6B;;;;;;;;;;;;;;;kBAOjC,CAAC;AACH;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAiC3F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;gDAqBpB,UAAU,WACR,QAAQ,GAAG,QAAQ,UACpB,WAAW,KAChB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;uDAKX,uBAAuB,UAAU,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;uDAMrE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmF3C,CAAC;AACN;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AACrF,QAAA,MAAM,yBAAyB;;;;;;iBAU7B,CAAC;AACH;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,QAAA,MAAM,8BAA8B;;;EAAwC,CAAC;AAE7E;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;aAezB,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB;IAdnF,2GAA2G;IAC3G,SAAgB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,GAAG,SAAS,CAAC;IAEnF,YACE,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,GAAG;QAAE,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAA;KAAE,EACpF;IACF,YACE,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB,EACjE,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,GAAG;QAAE,MAAM,CAAC,EAAE,KAAK,CAAA;KAAE,EAC3C;CAgBH"}
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../src/process/contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,QAAA,MAAM,6BAA6B;;;;;;;;;;;;2BAajC,CAAC;AACH;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;GAEG;AACH,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gGAAgG;AAChG,eAAO,MAAM,yBAAyB,UAAY,CAAC;AAEnD,QAAA,MAAM,6BAA6B;;;;;;;;;;;;;;;kBAOjC,CAAC;AACH;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAiC3F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;gDAqBpB,UAAU,WACR,QAAQ,GAAG,QAAQ,UACpB,WAAW,KAChB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;uDAKX,uBAAuB,UAAU,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;uDAMrE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4F3C,CAAC;AACN;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AACrF,QAAA,MAAM,yBAAyB;;;;;;iBAU7B,CAAC;AACH;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,QAAA,MAAM,8BAA8B;;;EAAwC,CAAC;AAE7E;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;aAezB,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB;IAdnF,2GAA2G;IAC3G,SAAgB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,GAAG,SAAS,CAAC;IAEnF,YACE,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,GAAG;QAAE,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAA;KAAE,EACpF;IACF,YACE,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB,EACjE,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,GAAG;QAAE,MAAM,CAAC,EAAE,KAAK,CAAA;KAAE,EAC3C;CAgBH"}

package/dist/process/launch.d.ts

@@ -1,5 +1,5 @@
-import type { ChildProcessWithoutNullStreams } from 'node:child_process';
 import { Readable } from 'node:stream';
+import type { OwnedChild } from './bun-child.js';
 import { type ParsedNativeCommandOptions } from './contract.js';
 import { type NativeCommandTransport } from './transport.js';
 /** A structural host launcher may supply pipes without importing Node ambient types. */
@@ -46,7 +46,7 @@ export declare function launchNativeCommand({ options, driver, onSpawn, onFailur
     options: ParsedNativeCommandOptions;
     driver: NativeCommandLaunchDriver | undefined;
     /** Called once the real child exists, when the command starts. */
-    onSpawn?: (child: ChildProcessWithoutNullStreams) => void;
+    onSpawn?: (child: OwnedChild) => void;
     /** The process failed to start or reported an error. */
     onFailure: (error: Error) => void;
     /** Writing stdin failed for a reason other than a closed pipe. */
@@ -56,7 +56,7 @@ export declare function launchNativeCommand({ options, driver, onSpawn, onFailur
 }): {
     stdout: AsyncIterable<Uint8Array<ArrayBufferLike>>;
     stderr: AsyncIterable<Uint8Array<ArrayBufferLike>>;
-    start(): void;
+    start(): Promise<number | undefined>;
     child: NativeCommandLaunchedProcess;
     leader: Promise<{
         kind: "exit";

package/dist/process/launch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"launch.d.ts","sourceRoot":"","sources":["../../src/process/launch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAsB,KAAK,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAEjF,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAElF,wFAAwF;AACxF,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IACjC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC;IAC9D,EAAE,CACA,KAAK,EAAE,MAAM,GAAG,OAAO,EACvB,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAC7D,OAAO,CAAC;CACZ;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC;IAClE,OAAO,IAAI,OAAO,CAAC;CACpB;AAED,iGAAiG;AACjG,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,4BAA4B,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,0BAA0B,EACnC,MAAM,EAAE,yBAAyB,GAAG,SAAS;;;EAY9C;AAED,UAAU,kBAAkB;IAC1B,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAGD,uFAAuF;AACvF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAEzF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAEhF;AAwED,yFAAyF;AACzF,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACP,MAAM,EACN,OAAO,EACP,SAAS,EACT,cAAc,EACd,UAAU,GACX,EAAE;IACD,OAAO,EAAE,0BAA0B,CAAC;IACpC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAC9C,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,IAAI,CAAC;IAC1D,wDAAwD;IACxD,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAClC,kEAAkE;IAClE,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACvC,yEAAyE;IACzE,UAAU,EAAE,CAAC,SAAS,EAAE,sBAAsB,KAAK,IAAI,CAAC;CACzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoDA"}
+{"version":3,"file":"launch.d.ts","sourceRoot":"","sources":["../../src/process/launch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAsB,KAAK,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAIjF,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAElF,wFAAwF;AACxF,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IACjC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC;IAC9D,EAAE,CACA,KAAK,EAAE,MAAM,GAAG,OAAO,EACvB,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAC7D,OAAO,CAAC;CACZ;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC;IAClE,OAAO,IAAI,OAAO,CAAC;CACpB;AAED,iGAAiG;AACjG,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,4BAA4B,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,0BAA0B,EACnC,MAAM,EAAE,yBAAyB,GAAG,SAAS;;;EAY9C;AAED,UAAU,kBAAkB;IAC1B,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAGD,uFAAuF;AACvF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAEzF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAEhF;AAwED,yFAAyF;AACzF,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACP,MAAM,EACN,OAAO,EACP,SAAS,EACT,cAAc,EACd,UAAU,GACX,EAAE;IACD,OAAO,EAAE,0BAA0B,CAAC;IACpC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAC9C,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,wDAAwD;IACxD,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAClC,kEAAkE;IAClE,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACvC,yEAAyE;IACzE,UAAU,EAAE,CAAC,SAAS,EAAE,sBAAsB,KAAK,IAAI,CAAC;CACzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0DA"}

package/dist/process/owned-child.d.ts

@@ -1,4 +1,6 @@
+import { type OwnedChild } from './bun-child.js';
 import type { NativeCommandLaunchedProcess } from './launch.js';
+import { type OwnerLossGuardInvocation } from './owner-loss-protocol.js';
 /** Only this native spawn can establish group ownership; structural PIDs cannot. */
 export declare function spawnOwnedCommand(input: {
     executable: string;
@@ -6,7 +8,8 @@ export declare function spawnOwnedCommand(input: {
     cwd?: string;
     env?: NodeJS.ProcessEnv;
     group: boolean;
-}): import("node:child_process").ChildProcessWithoutNullStreams;
+    ownerLoss?: OwnerLossGuardInvocation;
+}): OwnedChild;
 /** The same ownership rule as {@link spawnOwnedCommand}, for a child that inherits stdio. */
 export declare function spawnInheritedCommand(input: {
     executable: string;
@@ -14,6 +17,7 @@ export declare function spawnInheritedCommand(input: {
     cwd?: string;
     env?: NodeJS.ProcessEnv;
     group: boolean;
+    ownerLoss?: OwnerLossGuardInvocation;
 }): NativeCommandLaunchedProcess;
 export declare function ownsCommandGroup(child: object): boolean;
 //# sourceMappingURL=owned-child.d.ts.map

package/dist/process/owned-child.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owned-child.d.ts","sourceRoot":"","sources":["../../src/process/owned-child.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAA+B,4BAA4B,EAAE,MAAM,UAAU,CAAC;AAI1F,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;CAChB,+DASA;AAmDD,6FAA6F;AAC7F,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,4BAA4B,CAW/B;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvD"}
+{"version":3,"file":"owned-child.d.ts","sourceRoot":"","sources":["../../src/process/owned-child.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,UAAU,EAGhB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAA+B,4BAA4B,EAAE,MAAM,UAAU,CAAC;AAM1F,OAAO,EAAE,KAAK,wBAAwB,EAAyB,MAAM,uBAAuB,CAAC;AAI7F,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACtC,GAAG,UAAU,CAIb;AAsFD,6FAA6F;AAC7F,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACtC,GAAG,4BAA4B,CAkC/B;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvD"}

package/dist/process/owner-loss-control.d.ts

@@ -0,0 +1,15 @@
+import type { Duplex } from 'node:stream';
+interface GuardedChild {
+    readonly pid?: number;
+    on(event: 'exit', listener: (code: number | null, signal: string | null) => void): unknown;
+}
+/** Tear down a newly created guard group if its private control channel is unavailable. */
+export declare function abortOwnerLossLaunch(pid: number | undefined): void;
+/** Bind one private inherited control socket to the guard process that owns it. */
+export declare function attachOwnerLossControl(child: GuardedChild, control: Duplex): void;
+/** Preserve the guard registration when an inherited-stdio child gets its transport wrapper. */
+export declare function transferOwnerLossControl(source: object, target: object): void;
+/** Ordinary children are already started; guarded children first prove that their target exists. */
+export declare function awaitCommandStart(child: GuardedChild): Promise<number | undefined>;
+export {};
+//# sourceMappingURL=owner-loss-control.d.ts.map

package/dist/process/owner-loss-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-loss-control.d.ts","sourceRoot":"","sources":["../../src/process/owner-loss-control.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAe1C,UAAU,YAAY;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC;CAC5F;AASD,2FAA2F;AAC3F,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAOlE;AAQD,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAuDjF;AAED,gGAAgG;AAChG,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAG7E;AAED,oGAAoG;AACpG,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAIxF"}

package/dist/process/owner-loss-guard.d.ts

@@ -0,0 +1,3 @@
+/** The built or source module that executes the guard protocol when launched directly. */
+export declare function ownerLossGuardEntry(): string;
+//# sourceMappingURL=owner-loss-guard.d.ts.map

package/dist/process/owner-loss-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-loss-guard.d.ts","sourceRoot":"","sources":["../../src/process/owner-loss-guard.ts"],"names":[],"mappings":"AA+KA,0FAA0F;AAC1F,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C"}

package/dist/process/owner-loss-protocol.d.ts

@@ -0,0 +1,10 @@
+export declare const OWNER_LOSS_GUARD_FLAG = "--stitchkit-owner-loss-guard-v1";
+export interface OwnerLossGuardInvocation {
+    readonly entry: string;
+    readonly signalTarget: 'group' | 'leader';
+}
+/** The owner-loss guard is certified only on the two POSIX kernels exercised by release CI. */
+export declare function ownerLossAvailable(platform: NodeJS.Platform): boolean;
+/** Replace a direct command with the package-owned guard that becomes its process-group leader. */
+export declare function ownerLossGuardCommand(guard: OwnerLossGuardInvocation, executable: string, args: readonly string[]): [string, ...string[]];
+//# sourceMappingURL=owner-loss-protocol.d.ts.map

package/dist/process/owner-loss-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-loss-protocol.d.ts","sourceRoot":"","sources":["../../src/process/owner-loss-protocol.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,oCAAoC,CAAC;AAEvE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,QAAQ,CAAC;CAC3C;AAED,+FAA+F;AAC/F,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAErE;AAED,mGAAmG;AACnG,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,wBAAwB,EAC/B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CASvB"}

package/dist/process/owner-loss-socket.d.ts

@@ -0,0 +1,4 @@
+import { type Socket } from 'node:net';
+/** Bun's runtime accepts an inherited socket fd here before its Node types expose the overload. */
+export declare function connectOwnerLossSocket(fd: number): Socket;
+//# sourceMappingURL=owner-loss-socket.d.ts.map

package/dist/process/owner-loss-socket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-loss-socket.d.ts","sourceRoot":"","sources":["../../src/process/owner-loss-socket.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAEhD,mGAAmG;AACnG,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEzD"}

package/llms/process.txt

@@ -139,6 +139,7 @@ console.log(captured.exitCode, new TextDecoder().decode(captured.stdout))
 const lifetime = new AbortController()
 await runNativeCommand({
   executable: '/usr/bin/git', args: ['status'], signal: lifetime.signal,
+  ownerLoss: 'terminate', // also stop its group if this JavaScript process is SIGKILLed
   onOutput: async (bytes, channel, outputSignal) => {
     outputSignal.throwIfAborted()
     await output.write(bytes, channel, outputSignal) // application-owned bounded sink
@@ -201,6 +202,17 @@ sink cause is kept; a cleanup failure is a `NativeCommandError` with `COMMAND_CL
 refuses with `COMMAND_UNAVAILABLE`; a descendant that has left the group on its own with `setsid` is
 outside this capability. This is one-shot execution, not a PTY, a supervisor or a daemon host.
 
+`ownerLoss: 'terminate'` binds the command group to this JavaScript process even when it cannot run
+cleanup. A package-owned guard becomes the process-group leader, starts the requested executable in
+that group and holds one end of a private inherited kernel channel. The caller holds the other end.
+`SIGKILL`, a crash or any abrupt caller exit closes that end; EOF makes the guard KILL its own group.
+There is no liveness polling and no later PID lookup. Because the guard is still the group leader
+when it signals, its PGID cannot have been reused by a neighbour. The option is available on Linux
+and Darwin under Bun and Node, requires `group: 'own'`, and other platforms refuse it with
+`COMMAND_UNAVAILABLE`. It adds one short-lived process and one descriptor per guarded command, so it
+is opt-in. `onLeaderStarted({ pid })` reports the guard/group leader with this option; output, stdin,
+exit status, deadlines, cancellation and `onLeaderSettled` retain the requested command's behaviour.
+
 ### Stopping a command: the `stop` policy
 
 A caller abort, the `timeoutMs` deadline, an exceeded output budget and a failing sink all stop the
@@ -235,13 +247,13 @@ dropped, never passed to `onOutput` and never captured, so a leader that writes
 does not meet a broken pipe. The result rejects with the abort reason once the group is gone and the
 pipes are closed, so it can take `graceMs` plus `cleanupTimeoutMs` after the abort.
 
-The grace is a timer inside the process that runs the command. If that process exits first, the
-timer is gone and the group, which is detached into its own session, keeps running: nothing in this
-package can bound it from outside. Abort `killOn` in your shutdown path, so the group is killed
-before the process exits, and let the supervisor own the case where the process dies without a
-shutdown. Under systemd, keep `KillMode=control-group` (the default) so the stop of the unit
-reaches every process in its cgroup, whatever its process group; launchd only kills the job's own
-process group, which a command's group is not.
+The grace is a timer inside the process that runs the command. Without `ownerLoss`, if that process
+exits first, the timer is gone and the group, which is detached into its own session, keeps running.
+Abort `killOn` in your shutdown path so a deliberate shutdown kills the group before exit. For an
+abrupt-exit guarantee, choose `ownerLoss: 'terminate'`; for all groups in a service, let the service
+supervisor own the wider boundary. Under systemd, keep `KillMode=control-group` (the default) so the
+stop of the unit reaches every process in its cgroup, whatever its process group; launchd only kills
+the job's own process group, which an unguarded detached command's group is not.
 
 ### Stopping a group and its descendants
 
@@ -302,7 +314,7 @@ becomes `runNativeCommand`; shell policy, command admission, logging, redaction,
 decoder and the operator sink stay with the application. Long signal-only commands stay streaming;
 bounded tar or capture commands get their own explicit limits.
 
-A child the caller holds until it exits is the same call. A guardian that forwards its own SIGTERM
+A child the caller holds until it exits is the same call. A host that forwards its own SIGTERM
 passes an abort signal and `stop: { target: 'leader', signal: 'SIGTERM', graceMs }`. It records the
 pid in `onLeaderStarted({ pid })`, which runs once right after the leader exists (a throw stops the
 command with that error), and the leader's exit code and signal in `onLeaderSettled`: `'exit'`
@@ -312,7 +324,9 @@ long the output pipes may stay open after the leader exited: a holder that left
 `setsid` keeps them open, and without the option the command waits for it until `timeoutMs` or
 the signal; with it the command ends with `COMMAND_CLEANUP` (a holder inside the group is already
 stopped by `descendants`). A worker whose whole group must stop on abort is the default
-`target: 'group'`. A command that uses the caller's terminal is the next section. Importing one leaf does not make
+`target: 'group'`. Add `ownerLoss: 'terminate'` when the worker must also die after an abrupt host
+loss; in that mode `onLeaderStarted` reports the package guard that leads the same group. A command
+that uses the caller's terminal is the next section. Importing one leaf does not make
 installing the whole npm package smaller; choose a dependency after measuring packed size and its
 dependency closure.
 
@@ -346,6 +360,7 @@ its own, so:
   because a group signal would reach the caller;
 - `descendants` does not apply and is refused: what the leader leaves behind belongs to the
   caller's group, and `descendantsStopped` is always `false`;
+- `ownerLoss` is refused: an owner-loss guard must lead a group that belongs only to the command;
 - a Ctrl-C reaches the caller too; handle `SIGINT` in the caller when it must outlive the command.
 
 The two options are independent: `stdio: 'inherit'` alone keeps colour and `isatty` for a command
@@ -677,7 +692,7 @@ Native POSIX Bun/Node one-shot command execution. See [native IO](../guide/nativ
 | Export | Kind | Purpose |
 |---|---|---|
 | `runNativeCommand` | function | caller-lifetime streaming or explicitly bounded binary capture |
-| `NativeCommandOptions` | type | executable/args, env policy, signal/deadline, bytes sink, finite cleanup limits, the `stop` policy and `descendants` (`'terminate-after-leader'`, the default: stop the group after the leader exits, or `'leave'`); `stdio` (`'pipe'`, or `'inherit'` for the caller's descriptors, refusing the pipe-only options) and `group` (`'own'`, or `'caller'`: joins the caller's process group, stops only the leader, refuses `descendants` and a group stop); `onLeaderStarted({ pid })` (once, after the leader exists), `drainTimeoutMs` (bound on the pipes staying open after the leader exited, `COMMAND_CLEANUP`); an unknown key is refused by name, a removed one (`killGraceMs`) with its replacement |
+| `NativeCommandOptions` | type | executable/args, env policy, signal/deadline, bytes sink, finite cleanup limits, the `stop` policy and `descendants` (`'terminate-after-leader'`, the default: stop the group after the leader exits, or `'leave'`); `stdio` (`'pipe'`, or `'inherit'` for the caller's descriptors, refusing the pipe-only options) and `group` (`'own'`, or `'caller'`: joins the caller's process group, stops only the leader, refuses `descendants`, `ownerLoss` and a group stop); `ownerLoss: 'terminate'` (optional Linux/Darwin Bun/Node guard: kernel channel EOF after abrupt caller death KILLs its owned group, unsupported platforms refuse); `onLeaderStarted({ pid })` (once after the group leader exists; the package guard's PID under `ownerLoss`), `drainTimeoutMs` (bound on the pipes staying open after the leader exited, `COMMAND_CLEANUP`); an unknown key is refused by name, a removed one (`killGraceMs`) with its replacement |
 | `NativeCommandStopPolicy` | type | how a cancelled command stops: `target` `'group'` (signal every member) or `'leader'` (signal only the leader; its exit ends the grace), `signal` (default `SIGTERM`), `graceMs` (at most one hour) before KILL to the group, and `killOn`, an `AbortSignal` that skips the grace; default `{ target: 'group', signal: 'SIGTERM', graceMs: 100 }` |
 | `NativeCommandResult` | type | observed nullable exit code/signal, `descendantsStopped` (members left in the group after the leader exited were stopped) and captured stdout/stderr bytes |
 | `NativeCommandError` | class | COMMAND_LIMIT with machine reason `deadline` or `output-budget`; COMMAND_UNAVAILABLE / COMMAND_CLEANUP have no limit reason; COMMAND_CLEANUP means the command's resources were not proven closed, either past `cleanupTimeoutMs` after a stop or past `drainTimeoutMs` after the leader exited, and `cause` holds that bound's failure. Preserves internal cause and existing constructor; caller-created limits without supplied reason remain unclassified |

package/llms/stitchkit.txt

@@ -69,7 +69,7 @@ own, recorded as an ADR.
 | `stitchkit/cli` | server | stable | `createCli` / `createCliInvoker` — runtime and strict NodeNext declarations without MCP SDK / `ai` |
 | `stitchkit/cli/publish` | build and release tooling (Bun or Node, POSIX) | evolving | `publishCli` — commit a verified CLI distribution and move its public manifest last; see [CLI guide](cli.md#publishing-a-complete-version) |
 | `stitchkit/remote` | browser **and** server | stable | peer-free `implementRemote` for thin HTTP proxy processes |
-| `stitchkit/process` | server (Bun or Node, POSIX) | evolving | finite native commands, byte sinks, bounded capture and process-group cancellation |
+| `stitchkit/process` | server (Bun or Node, POSIX) | evolving | finite native commands, byte sinks, bounded capture, process-group cancellation and opt-in Linux/Darwin owner-loss cleanup |
 | `stitchkit/files/packaging` | build time (Bun or Node) | evolving | installed native asset graph, integrity, Bun packaging plugin and the artifact loader check; no runtime install policy |
 | `stitchkit/files` | server (Bun or Node) | stable | peer-free managed local-file boundary |
 | `stitchkit/telegram` | server (Bun or Node) | evolving | peer-free Telegram platform primitives — Mini App `initData` verification, send-failure classification, resumable broadcasts, the operator channel with dedupe, a Bot API transport that separates a request that never left from an unknown outcome, local Bot API files, webhook ownership and durable webhook update intake |

package/llms-full.txt

@@ -61,7 +61,7 @@ own, recorded as an ADR.
 | `stitchkit/cli` | server | stable | `createCli` / `createCliInvoker` — runtime and strict NodeNext declarations without MCP SDK / `ai` |
 | `stitchkit/cli/publish` | build and release tooling (Bun or Node, POSIX) | evolving | `publishCli` — commit a verified CLI distribution and move its public manifest last; see [CLI guide](cli.md#publishing-a-complete-version) |
 | `stitchkit/remote` | browser **and** server | stable | peer-free `implementRemote` for thin HTTP proxy processes |
-| `stitchkit/process` | server (Bun or Node, POSIX) | evolving | finite native commands, byte sinks, bounded capture and process-group cancellation |
+| `stitchkit/process` | server (Bun or Node, POSIX) | evolving | finite native commands, byte sinks, bounded capture, process-group cancellation and opt-in Linux/Darwin owner-loss cleanup |
 | `stitchkit/files/packaging` | build time (Bun or Node) | evolving | installed native asset graph, integrity, Bun packaging plugin and the artifact loader check; no runtime install policy |
 | `stitchkit/files` | server (Bun or Node) | stable | peer-free managed local-file boundary |
 | `stitchkit/telegram` | server (Bun or Node) | evolving | peer-free Telegram platform primitives — Mini App `initData` verification, send-failure classification, resumable broadcasts, the operator channel with dedupe, a Bot API transport that separates a request that never left from an unknown outcome, local Bot API files, webhook ownership and durable webhook update intake |
@@ -8322,6 +8322,7 @@ console.log(captured.exitCode, new TextDecoder().decode(captured.stdout))
 const lifetime = new AbortController()
 await runNativeCommand({
   executable: '/usr/bin/git', args: ['status'], signal: lifetime.signal,
+  ownerLoss: 'terminate', // also stop its group if this JavaScript process is SIGKILLed
   onOutput: async (bytes, channel, outputSignal) => {
     outputSignal.throwIfAborted()
     await output.write(bytes, channel, outputSignal) // application-owned bounded sink
@@ -8384,6 +8385,17 @@ sink cause is kept; a cleanup failure is a `NativeCommandError` with `COMMAND_CL
 refuses with `COMMAND_UNAVAILABLE`; a descendant that has left the group on its own with `setsid` is
 outside this capability. This is one-shot execution, not a PTY, a supervisor or a daemon host.
 
+`ownerLoss: 'terminate'` binds the command group to this JavaScript process even when it cannot run
+cleanup. A package-owned guard becomes the process-group leader, starts the requested executable in
+that group and holds one end of a private inherited kernel channel. The caller holds the other end.
+`SIGKILL`, a crash or any abrupt caller exit closes that end; EOF makes the guard KILL its own group.
+There is no liveness polling and no later PID lookup. Because the guard is still the group leader
+when it signals, its PGID cannot have been reused by a neighbour. The option is available on Linux
+and Darwin under Bun and Node, requires `group: 'own'`, and other platforms refuse it with
+`COMMAND_UNAVAILABLE`. It adds one short-lived process and one descriptor per guarded command, so it
+is opt-in. `onLeaderStarted({ pid })` reports the guard/group leader with this option; output, stdin,
+exit status, deadlines, cancellation and `onLeaderSettled` retain the requested command's behaviour.
+
 ### Stopping a command: the `stop` policy
 
 A caller abort, the `timeoutMs` deadline, an exceeded output budget and a failing sink all stop the
@@ -8418,13 +8430,13 @@ dropped, never passed to `onOutput` and never captured, so a leader that writes
 does not meet a broken pipe. The result rejects with the abort reason once the group is gone and the
 pipes are closed, so it can take `graceMs` plus `cleanupTimeoutMs` after the abort.
 
-The grace is a timer inside the process that runs the command. If that process exits first, the
-timer is gone and the group, which is detached into its own session, keeps running: nothing in this
-package can bound it from outside. Abort `killOn` in your shutdown path, so the group is killed
-before the process exits, and let the supervisor own the case where the process dies without a
-shutdown. Under systemd, keep `KillMode=control-group` (the default) so the stop of the unit
-reaches every process in its cgroup, whatever its process group; launchd only kills the job's own
-process group, which a command's group is not.
+The grace is a timer inside the process that runs the command. Without `ownerLoss`, if that process
+exits first, the timer is gone and the group, which is detached into its own session, keeps running.
+Abort `killOn` in your shutdown path so a deliberate shutdown kills the group before exit. For an
+abrupt-exit guarantee, choose `ownerLoss: 'terminate'`; for all groups in a service, let the service
+supervisor own the wider boundary. Under systemd, keep `KillMode=control-group` (the default) so the
+stop of the unit reaches every process in its cgroup, whatever its process group; launchd only kills
+the job's own process group, which an unguarded detached command's group is not.
 
 ### Stopping a group and its descendants
 
@@ -8485,7 +8497,7 @@ becomes `runNativeCommand`; shell policy, command admission, logging, redaction,
 decoder and the operator sink stay with the application. Long signal-only commands stay streaming;
 bounded tar or capture commands get their own explicit limits.
 
-A child the caller holds until it exits is the same call. A guardian that forwards its own SIGTERM
+A child the caller holds until it exits is the same call. A host that forwards its own SIGTERM
 passes an abort signal and `stop: { target: 'leader', signal: 'SIGTERM', graceMs }`. It records the
 pid in `onLeaderStarted({ pid })`, which runs once right after the leader exists (a throw stops the
 command with that error), and the leader's exit code and signal in `onLeaderSettled`: `'exit'`
@@ -8495,7 +8507,9 @@ long the output pipes may stay open after the leader exited: a holder that left
 `setsid` keeps them open, and without the option the command waits for it until `timeoutMs` or
 the signal; with it the command ends with `COMMAND_CLEANUP` (a holder inside the group is already
 stopped by `descendants`). A worker whose whole group must stop on abort is the default
-`target: 'group'`. A command that uses the caller's terminal is the next section. Importing one leaf does not make
+`target: 'group'`. Add `ownerLoss: 'terminate'` when the worker must also die after an abrupt host
+loss; in that mode `onLeaderStarted` reports the package guard that leads the same group. A command
+that uses the caller's terminal is the next section. Importing one leaf does not make
 installing the whole npm package smaller; choose a dependency after measuring packed size and its
 dependency closure.
 
@@ -8529,6 +8543,7 @@ its own, so:
   because a group signal would reach the caller;
 - `descendants` does not apply and is refused: what the leader leaves behind belongs to the
   caller's group, and `descendantsStopped` is always `false`;
+- `ownerLoss` is refused: an owner-loss guard must lead a group that belongs only to the command;
 - a Ctrl-C reaches the caller too; handle `SIGINT` in the caller when it must outlive the command.
 
 The two options are independent: `stdio: 'inherit'` alone keeps colour and `isatty` for a command
@@ -23044,7 +23059,7 @@ Native POSIX Bun/Node one-shot command execution. See [native IO](../guide/nativ
 | Export | Kind | Purpose |
 |---|---|---|
 | `runNativeCommand` | function | caller-lifetime streaming or explicitly bounded binary capture |
-| `NativeCommandOptions` | type | executable/args, env policy, signal/deadline, bytes sink, finite cleanup limits, the `stop` policy and `descendants` (`'terminate-after-leader'`, the default: stop the group after the leader exits, or `'leave'`); `stdio` (`'pipe'`, or `'inherit'` for the caller's descriptors, refusing the pipe-only options) and `group` (`'own'`, or `'caller'`: joins the caller's process group, stops only the leader, refuses `descendants` and a group stop); `onLeaderStarted({ pid })` (once, after the leader exists), `drainTimeoutMs` (bound on the pipes staying open after the leader exited, `COMMAND_CLEANUP`); an unknown key is refused by name, a removed one (`killGraceMs`) with its replacement |
+| `NativeCommandOptions` | type | executable/args, env policy, signal/deadline, bytes sink, finite cleanup limits, the `stop` policy and `descendants` (`'terminate-after-leader'`, the default: stop the group after the leader exits, or `'leave'`); `stdio` (`'pipe'`, or `'inherit'` for the caller's descriptors, refusing the pipe-only options) and `group` (`'own'`, or `'caller'`: joins the caller's process group, stops only the leader, refuses `descendants`, `ownerLoss` and a group stop); `ownerLoss: 'terminate'` (optional Linux/Darwin Bun/Node guard: kernel channel EOF after abrupt caller death KILLs its owned group, unsupported platforms refuse); `onLeaderStarted({ pid })` (once after the group leader exists; the package guard's PID under `ownerLoss`), `drainTimeoutMs` (bound on the pipes staying open after the leader exited, `COMMAND_CLEANUP`); an unknown key is refused by name, a removed one (`killGraceMs`) with its replacement |
 | `NativeCommandStopPolicy` | type | how a cancelled command stops: `target` `'group'` (signal every member) or `'leader'` (signal only the leader; its exit ends the grace), `signal` (default `SIGTERM`), `graceMs` (at most one hour) before KILL to the group, and `killOn`, an `AbortSignal` that skips the grace; default `{ target: 'group', signal: 'SIGTERM', graceMs: 100 }` |
 | `NativeCommandResult` | type | observed nullable exit code/signal, `descendantsStopped` (members left in the group after the leader exited were stopped) and captured stdout/stderr bytes |
 | `NativeCommandError` | class | COMMAND_LIMIT with machine reason `deadline` or `output-budget`; COMMAND_UNAVAILABLE / COMMAND_CLEANUP have no limit reason; COMMAND_CLEANUP means the command's resources were not proven closed, either past `cleanupTimeoutMs` after a stop or past `drainTimeoutMs` after the leader exited, and `cause` holds that bound's failure. Preserves internal cause and existing constructor; caller-created limits without supplied reason remain unclassified |

package/llms.txt

@@ -56,7 +56,7 @@ Load the slice for each entrypoint your code imports — `import … from 'stitc
 - **stitchkit/node**: [llms/node.txt](llms/node.txt) 3.1 KB
 - **stitchkit/agent-runtime/react**: [llms/agent-runtime-react.txt](llms/agent-runtime-react.txt) 1.0 KB
 - **stitchkit/agent-runtime/realtime**: [llms/agent-runtime-realtime.txt](llms/agent-runtime-realtime.txt) 2.6 KB
-- **stitchkit/process**: [llms/process.txt](llms/process.txt) 43.3 KB
+- **stitchkit/process**: [llms/process.txt](llms/process.txt) 44.9 KB
 - **stitchkit/files/packaging**: [llms/files-packaging.txt](llms/files-packaging.txt) 3.5 KB
 
 ## Upgrading slices

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stitchkit",
-  "version": "0.108.0",
+  "version": "0.108.2",
   "description": "Contract-first backend framework — one defineContract() into an HTTP API, MCP tools, AI-agent tools and a typed client. Bun and Node.",
   "keywords": [
     "bun",