stitchkit 0.108.1 → 0.108.2

package/CHANGELOG.md

@@ -15,6 +15,19 @@ additive**; the first breaking change landed in 0.10.0. Grep the file for
 
 ## [Unreleased]
 
+## [0.108.2] - 2026-10-09
+
+### Added
+
+- `stitchkit/process` — `runNativeCommand` takes `ownerLoss: 'terminate'`: on Linux and Darwin under
+  Bun or Node, a package-owned per-command guard binds the command's process group to a private
+  inherited kernel channel. If the JavaScript caller is killed or crashes, channel EOF makes the
+  guard KILL its own group without polling, `finally` or PID reclamation. The option requires
+  `group: 'own'`; unsupported platforms refuse with `COMMAND_UNAVAILABLE`. It is opt-in because each
+  guarded call uses one extra short-lived process and descriptor. Output, stdin, target exit status,
+  deadlines and cancellation retain the existing contract; `onLeaderStarted` reports the guard that
+  leads the owned group. → ADR 0255
+
 ## [0.108.1] - 2026-10-07
 
 ### Fixed

package/dist/entrypoints/agent-runtime/coding-tools.js

@@ -6,9 +6,9 @@ import {
   AgentCodingToolAuthorizationSchema2,
   AgentCodingToolPathAuthorizationSchema2,
   createAgentCodingTools2
-} from "../../index-e35py42g.js";
+} from "../../index-vyaehh67.js";
 import"../../index-2kbysk9s.js";
-import"../../index-epg514ys.js";
+import"../../index-k0kzhdw9.js";
 import"../../index-8ks9b85e.js";
 import"../../index-zrtrjkbf.js";
 import"../../index-636mggad.js";

package/dist/entrypoints/agent-runtime/sandbox.js

@@ -8,7 +8,7 @@ import"../../index-q6crhe1n.js";
 import"../../index-fynr93w4.js";
 import {
   createAgentCodingTools2
-} from "../../index-e35py42g.js";
+} from "../../index-vyaehh67.js";
 import"../../index-2kbysk9s.js";
 import {
   COMMAND_CLEANUP_TIMEOUT_MS,
@@ -17,7 +17,7 @@ import {
   nativeCommandOwner,
   terminateOwnedGroup,
   startNativeCommand
-} from "../../index-epg514ys.js";
+} from "../../index-k0kzhdw9.js";
 import"../../index-zrtrjkbf.js";
 import {
   MAX_TIMER_MS

package/dist/entrypoints/process.js

@@ -7,7 +7,7 @@ import {
 import {
   NativeCommandError2,
   startNativeCommand
-} from "../index-epg514ys.js";
+} from "../index-k0kzhdw9.js";
 // src/process/command.ts
 function runNativeCommand(input) {
   return startNativeCommand(input).result;

package/dist/{index-epg514ys.js → index-k0kzhdw9.js}

@@ -70,6 +70,7 @@ var NativeCommandOptionsSchema = z.strictObject({
   onLeaderStarted: z.custom((v) => typeof v === "function").optional(),
   drainTimeoutMs: z.number().int().positive().max(MAX_TIMER_MS).optional(),
   group: z.enum(["own", "caller"]).default("own"),
+  ownerLoss: z.enum(["terminate"]).optional(),
   stdio: z.enum(["pipe", "inherit"]).default("pipe"),
   stop: NativeCommandStopPolicySchema.optional(),
   descendants: z.enum(["terminate-after-leader", "leave"]).optional(),
@@ -108,6 +109,12 @@ var NativeCommandOptionsSchema = z.strictObject({
       input: ctx.value,
       message: "group: 'caller' has no group of its own, so descendants does not apply"
     });
+  if (input.group === "caller" && input.ownerLoss !== undefined)
+    ctx.issues.push({
+      code: "custom",
+      input: ctx.value,
+      message: "ownerLoss: 'terminate' requires group: 'own'"
+    });
   if (input.stdio === "inherit") {
     const piped = [
       input.capture && "capture",
@@ -399,10 +406,137 @@ import { Readable as Readable3 } from "node:stream";
 
 // src/process/owned-child.ts
 import { spawn } from "node:child_process";
+import { Duplex } from "node:stream";
 
 // src/process/bun-child.ts
 import { EventEmitter } from "node:events";
 import { Readable, Writable } from "node:stream";
+
+// src/process/owner-loss-control.ts
+import { z as z2 } from "zod";
+var MAX_GUARD_MESSAGE_BYTES = 4096;
+var OwnerLossGuardMessageSchema = z2.discriminatedUnion("kind", [
+  z2.strictObject({ kind: z2.literal("started"), pid: z2.number().int().positive() }),
+  z2.strictObject({
+    kind: z2.literal("unavailable"),
+    message: z2.string().min(1).max(1024),
+    code: z2.string().min(1).max(64).optional()
+  })
+]);
+var guards = new WeakMap;
+function abortOwnerLossLaunch(pid) {
+  if (pid === undefined)
+    return;
+  try {
+    process.kill(-pid, "SIGKILL");
+  } catch (error) {
+    if (!(error instanceof Error && ("code" in error) && error.code === "ESRCH"))
+      throw error;
+  }
+}
+function unavailable(message, cause) {
+  return new NativeCommandError2("COMMAND_UNAVAILABLE", "Command could not start", {
+    cause: cause ?? new Error(message)
+  });
+}
+function attachOwnerLossControl(child, control) {
+  const settled = Promise.withResolvers();
+  settled.promise.catch(() => {
+    return;
+  });
+  let complete = false;
+  let bytes = 0;
+  let text = "";
+  const decoder = new TextDecoder;
+  const ignoreSettledError = () => {
+    return;
+  };
+  const finish = (outcome) => {
+    if (complete)
+      return;
+    complete = true;
+    control.off("data", onData);
+    control.off("end", onMissing);
+    control.off("close", onMissing);
+    control.off("error", onError);
+    control.on("error", ignoreSettledError);
+    control.once("close", () => control.off("error", ignoreSettledError));
+    if ("pid" in outcome)
+      settled.resolve(outcome.pid);
+    else
+      settled.reject(outcome.error);
+  };
+  const onMissing = () => finish({ error: unavailable("Owner-loss guard exited before the command started") });
+  const onError = (cause) => finish({ error: unavailable("Owner-loss guard control failed", cause) });
+  const onData = (chunk) => {
+    if (complete)
+      return;
+    bytes += chunk.byteLength;
+    if (bytes > MAX_GUARD_MESSAGE_BYTES) {
+      finish({ error: unavailable("Owner-loss guard response exceeded its finite bound") });
+      return;
+    }
+    text += decoder.decode(chunk, { stream: true });
+    const newline = text.indexOf(`
+`);
+    if (newline < 0)
+      return;
+    try {
+      const message = OwnerLossGuardMessageSchema.parse(JSON.parse(text.slice(0, newline)));
+      if (message.kind === "started")
+        finish({ pid: message.pid });
+      else {
+        const cause = new Error(message.message);
+        if (message.code !== undefined)
+          Object.defineProperty(cause, "code", { value: message.code });
+        finish({ error: unavailable(message.message, cause) });
+      }
+    } catch (cause) {
+      finish({ error: unavailable("Owner-loss guard returned an invalid response", cause) });
+    }
+  };
+  control.on("data", onData);
+  control.once("end", onMissing);
+  control.once("close", onMissing);
+  control.once("error", onError);
+  child.on("exit", onMissing);
+  guards.set(child, { control, started: settled.promise });
+}
+function transferOwnerLossControl(source, target) {
+  const registration = guards.get(source);
+  if (registration !== undefined)
+    guards.set(target, registration);
+}
+async function awaitCommandStart(child) {
+  const registration = guards.get(child);
+  if (registration !== undefined)
+    await registration.started;
+  return child.pid;
+}
+
+// src/process/owner-loss-protocol.ts
+var OWNER_LOSS_GUARD_FLAG = "--stitchkit-owner-loss-guard-v1";
+function ownerLossAvailable(platform) {
+  return platform === "linux" || platform === "darwin";
+}
+function ownerLossGuardCommand(guard, executable, args) {
+  return [
+    process.execPath,
+    guard.entry,
+    OWNER_LOSS_GUARD_FLAG,
+    guard.signalTarget,
+    executable,
+    ...args
+  ];
+}
+
+// src/process/owner-loss-socket.ts
+import { connect } from "node:net";
+function connectOwnerLossSocket(fd) {
+  return Reflect.apply(connect, undefined, [{ fd }]);
+}
+
+// src/process/bun-child.ts
 function hostIsBun() {
   return typeof Bun !== "undefined";
 }
@@ -525,7 +659,15 @@ function sinkWritable(sink) {
 function spawnBunChild(input) {
   const { BunChild } = children();
   try {
-    const subprocess = Bun.spawn([input.executable, ...input.args], {
+    const ownerLoss = input.ownerLoss;
+    const guarded = ownerLoss !== undefined;
+    const command = guarded ? ownerLossGuardCommand(ownerLoss, input.executable, input.args) : [input.executable, ...input.args];
+    const subprocess = guarded ? Bun.spawn(command, {
+      cwd: input.cwd,
+      env: input.env,
+      detached: input.group,
+      stdio: ["pipe", "pipe", "pipe", "socket-fd"]
+    }) : Bun.spawn(command, {
       cwd: input.cwd,
       env: input.env,
       detached: input.group,
@@ -535,6 +677,14 @@ function spawnBunChild(input) {
     });
     const child = new BunChild(sinkWritable(subprocess.stdin), readableOf(subprocess.stdout), readableOf(subprocess.stderr));
     child.watch(subprocess);
+    if (guarded) {
+      const fd = subprocess.stdio[3];
+      if (typeof fd !== "number") {
+        abortOwnerLossLaunch(subprocess.pid);
+        throw new Error("Owner-loss guard supplied no control socket");
+      }
+      attachOwnerLossControl(child, connectOwnerLossSocket(fd));
+    }
     return child;
   } catch (cause) {
     if (!reportedSpawnFailure(cause))
@@ -548,14 +698,31 @@ function spawnBunInheritedChild(input) {
   const { BunProcess } = children();
   const child = new BunProcess([]);
   try {
-    child.watch(Bun.spawn([input.executable, ...input.args], {
+    const ownerLoss = input.ownerLoss;
+    const guarded = ownerLoss !== undefined;
+    const command = guarded ? ownerLossGuardCommand(ownerLoss, input.executable, input.args) : [input.executable, ...input.args];
+    const subprocess = guarded ? Bun.spawn(command, {
+      cwd: input.cwd,
+      env: input.env,
+      detached: input.group,
+      stdio: ["inherit", "inherit", "inherit", "socket-fd"]
+    }) : Bun.spawn(command, {
       cwd: input.cwd,
       env: input.env,
       detached: input.group,
       stdin: "inherit",
       stdout: "inherit",
       stderr: "inherit"
-    }));
+    });
+    child.watch(subprocess);
+    if (guarded) {
+      const fd = subprocess.stdio[3];
+      if (typeof fd !== "number") {
+        abortOwnerLossLaunch(subprocess.pid);
+        throw new Error("Owner-loss guard supplied no control socket");
+      }
+      attachOwnerLossControl(child, connectOwnerLossSocket(fd));
+    }
   } catch (cause) {
     if (!reportedSpawnFailure(cause))
       throw cause;
@@ -563,6 +730,13 @@ function spawnBunInheritedChild(input) {
   }
   return child;
 }
+function spawnBunGuardTarget(executable, args) {
+  return Bun.spawn([executable, ...args], {
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit"
+  });
+}
 
 // src/process/owned-child.ts
 var groups = new WeakSet;
@@ -573,12 +747,27 @@ function spawnOwnedCommand(input) {
   return child;
 }
 function nodeChild(input) {
-  return spawn(input.executable, [...input.args], {
+  if (input.ownerLoss === undefined)
+    return spawn(input.executable, [...input.args], {
+      cwd: input.cwd,
+      env: input.env,
+      detached: input.group,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+  const [executable, ...args] = ownerLossGuardCommand(input.ownerLoss, input.executable, input.args);
+  const child = spawn(executable, args, {
     cwd: input.cwd,
     env: input.env,
     detached: input.group,
-    stdio: ["pipe", "pipe", "pipe"]
+    stdio: ["pipe", "pipe", "pipe", "pipe"]
   });
+  const control = child.stdio[3];
+  if (!(control instanceof Duplex)) {
+    abortOwnerLossLaunch(child.pid);
+    throw new Error("Owner-loss guard supplied no control pipe");
+  }
+  attachOwnerLossControl(child, control);
+  return child;
 }
 var INHERITED_OUTPUT = {
   destroyed: true,
@@ -614,12 +803,31 @@ class InheritedChild {
   }
 }
 function spawnInheritedCommand(input) {
-  const child = new InheritedChild(hostIsBun() ? spawnBunInheritedChild(input) : spawn(input.executable, [...input.args], {
-    cwd: input.cwd,
-    env: input.env,
-    detached: input.group,
-    stdio: "inherit"
-  }));
+  const observable = hostIsBun() ? spawnBunInheritedChild(input) : (() => {
+    if (input.ownerLoss === undefined)
+      return spawn(input.executable, [...input.args], {
+        cwd: input.cwd,
+        env: input.env,
+        detached: input.group,
+        stdio: "inherit"
+      });
+    const [executable, ...args] = ownerLossGuardCommand(input.ownerLoss, input.executable, input.args);
+    const spawned = spawn(executable, args, {
+      cwd: input.cwd,
+      env: input.env,
+      detached: input.group,
+      stdio: ["inherit", "inherit", "inherit", "pipe"]
+    });
+    const control = spawned.stdio[3];
+    if (!(control instanceof Duplex)) {
+      abortOwnerLossLaunch(spawned.pid);
+      throw new Error("Owner-loss guard supplied no control pipe");
+    }
+    attachOwnerLossControl(spawned, control);
+    return spawned;
+  })();
+  const child = new InheritedChild(observable);
+  transferOwnerLossControl(observable, child);
   if (input.group)
     groups.add(child);
   return child;
@@ -628,6 +836,151 @@ function ownsCommandGroup(child) {
   return groups.has(child);
 }
 
+// src/process/owner-loss-guard.ts
+import { spawn as spawn2 } from "node:child_process";
+import { Socket } from "node:net";
+import { fileURLToPath } from "node:url";
+var FORWARDED_SIGNALS = [
+  "SIGTERM",
+  "SIGINT",
+  "SIGHUP",
+  "SIGQUIT",
+  "SIGUSR1",
+  "SIGUSR2"
+];
+function causeMessage(cause) {
+  const message = cause instanceof Error ? cause.message : String(cause);
+  if (typeof cause === "object" && cause !== null && "code" in cause && typeof cause.code === "string")
+    return { message, code: cause.code };
+  return { message };
+}
+function guardMessage(control, message, written) {
+  control.write(`${JSON.stringify(message)}
+`, written);
+}
+function mirrorTargetExit(control, code, signal) {
+  control.destroy();
+  if (signal !== null)
+    process.kill(process.pid, signal);
+  else
+    process.exitCode = code ?? 1;
+}
+function refuseTarget(control, cause) {
+  const detail = causeMessage(cause);
+  control.end(`${JSON.stringify({ kind: "unavailable", ...detail })}
+`, () => {
+    process.exitCode = 127;
+  });
+}
+function spawnNodeTarget(executable, args, onStarted, onExit, onUnavailable) {
+  let child;
+  try {
+    child = spawn2(executable, [...args], { stdio: "inherit" });
+  } catch (cause) {
+    onUnavailable(cause);
+    return;
+  }
+  child.once("spawn", () => {
+    const pid = child.pid;
+    if (pid === undefined)
+      onUnavailable(new Error("Command started without a pid"));
+    else
+      onStarted(pid);
+  });
+  child.once("error", onUnavailable);
+  child.once("exit", onExit);
+}
+function spawnBunTarget(executable, args, onStarted, onExit, onUnavailable) {
+  let child;
+  try {
+    child = spawnBunGuardTarget(executable, args);
+  } catch (cause) {
+    onUnavailable(cause);
+    return;
+  }
+  onStarted(child.pid);
+  child.exited.then(() => onExit(child.exitCode, child.signalCode));
+}
+function runOwnerLossGuard(signalTarget, executable, args) {
+  const bun = hostIsBun();
+  const control = bun ? connectOwnerLossSocket(3) : new Socket({ fd: 3, readable: true, writable: true });
+  let armed = true;
+  const ownerLost = () => {
+    if (!armed)
+      return;
+    process.kill(-process.pid, "SIGKILL");
+  };
+  control.once("end", ownerLost);
+  control.once("close", ownerLost);
+  control.once("error", ownerLost);
+  if (signalTarget !== "group" && signalTarget !== "leader" || executable === undefined) {
+    armed = false;
+    refuseTarget(control, new Error("Owner-loss guard received an invalid invocation"));
+    return;
+  }
+  let targetPid;
+  let handshakeWritten = false;
+  let pendingTargetExit;
+  const forwarders = new Map;
+  if (signalTarget === "leader")
+    for (const signal of FORWARDED_SIGNALS) {
+      const forward = () => {
+        if (targetPid === undefined)
+          return;
+        try {
+          process.kill(targetPid, signal);
+        } catch (error) {
+          if (!(error instanceof Error && ("code" in error) && error.code === "ESRCH"))
+            throw error;
+        }
+      };
+      forwarders.set(signal, forward);
+      process.on(signal, forward);
+    }
+  const removeForwarders = () => {
+    for (const [signal, forward] of forwarders)
+      process.removeListener(signal, forward);
+    forwarders.clear();
+  };
+  const targetStarted = (pid) => {
+    targetPid = pid;
+    guardMessage(control, { kind: "started", pid }, () => {
+      handshakeWritten = true;
+      const pending = pendingTargetExit;
+      if (pending !== undefined) {
+        pendingTargetExit = undefined;
+        targetExit(pending.code, pending.signal);
+      }
+    });
+  };
+  const targetExit = (code, signal) => {
+    if (!handshakeWritten) {
+      pendingTargetExit = { code, signal };
+      return;
+    }
+    armed = false;
+    removeForwarders();
+    mirrorTargetExit(control, code, signal);
+  };
+  const targetUnavailable = (cause) => {
+    armed = false;
+    removeForwarders();
+    refuseTarget(control, cause);
+  };
+  if (!bun)
+    spawnNodeTarget(executable, args, targetStarted, targetExit, targetUnavailable);
+  else
+    spawnBunTarget(executable, args, targetStarted, targetExit, targetUnavailable);
+}
+function ownerLossGuardEntry() {
+  return fileURLToPath(import.meta.url);
+}
+if (process.argv[2] === OWNER_LOSS_GUARD_FLAG) {
+  const entry = process.argv[1];
+  if (entry !== undefined && fileURLToPath(import.meta.url) === entry)
+    runOwnerLossGuard(process.argv[3], process.argv[4], process.argv.slice(5));
+}
+
 // src/process/transport.ts
 import { Readable as Readable2, Writable as Writable2 } from "node:stream";
 function createCommandTransport(child) {
@@ -830,7 +1183,8 @@ function launchNativeCommand({
     args: options.args,
     cwd: options.cwd,
     env: options.envPolicy === "ambient" ? { ...process.env, ...options.env } : options.env ?? {},
-    group: options.group === "own" && (driver?.group ?? true)
+    group: options.group === "own" && (driver?.group ?? true),
+    ownerLoss: options.ownerLoss === "terminate" ? { entry: ownerLossGuardEntry(), signalTarget: options.stop.target } : undefined
   };
   let inherited;
   if (!launch) {
@@ -859,10 +1213,12 @@ function launchNativeCommand({
     ...transport,
     stdout: stdout.bytes,
     stderr: stderr.bytes,
-    start() {
+    async start() {
       if (native)
         onSpawn?.(native);
+      const pid = await awaitCommandStart(child);
       stdin?.end(options.stdin);
+      return pid;
     }
   };
 }
@@ -1021,6 +1377,10 @@ function startNativeCommand(input, onSpawn, driver) {
   killOn?.throwIfAborted();
   if (process.platform === "win32" && driver?.group !== false)
     throw new NativeCommandError2("COMMAND_UNAVAILABLE", "POSIX process groups are required");
+  if (options.ownerLoss === "terminate" && !ownerLossAvailable(process.platform))
+    throw new NativeCommandError2("COMMAND_UNAVAILABLE", "ownerLoss: 'terminate' is available on Linux and Darwin");
+  if (options.ownerLoss === "terminate" && (driver?.launch !== undefined || driver?.group === false))
+    throw new NativeCommandError2("COMMAND_UNAVAILABLE", "ownerLoss: 'terminate' requires the package-owned process-group launcher");
   const { cleanupTimeoutMs, timeoutMs } = nativeCommandBudgets(options, driver);
   const controller = new AbortController;
   const abort = () => controller.abort(options.signal?.reason);
@@ -1126,8 +1486,7 @@ function startNativeCommand(input, onSpawn, driver) {
   };
   const run = (async () => {
     try {
-      launched.start();
-      const pid = acquired?.child.pid;
+      const pid = await raceAbort(launched.start(), controller.signal);
       if (pid !== undefined)
         options.onLeaderStarted?.({ pid });
       const drains = Promise.all([

package/dist/{index-e35py42g.js → index-vyaehh67.js}

@@ -5,7 +5,7 @@ import {
   NativeCommandError2,
   CommandStopped,
   startNativeCommand
-} from "./index-epg514ys.js";
+} from "./index-k0kzhdw9.js";
 import {
   probeAgentProcessSandboxOutcome,
   missingSandboxRestrictions2,

package/dist/process/bun-child.d.ts

@@ -1,5 +1,6 @@
 import { EventEmitter } from 'node:events';
 import { Readable, Writable } from 'node:stream';
+import { type OwnerLossGuardInvocation } from './owner-loss-protocol.js';
 /** What a spawned command exposes to its owner: the subset of a Node child the package uses. */
 export interface OwnedChild extends EventEmitter {
     readonly pid?: number;
@@ -23,6 +24,7 @@ interface BunSpawnInput {
     cwd?: string;
     env?: NodeJS.ProcessEnv;
     group: boolean;
+    ownerLoss?: OwnerLossGuardInvocation;
 }
 /**
  * Whether the host is Bun. Bun's `node:child_process` can lose a child's `exit` event under
@@ -34,5 +36,13 @@ export declare function hostIsBun(): boolean;
 export declare function spawnBunChild(input: BunSpawnInput): OwnedChild;
 /** `spawnInheritedCommand` for Bun: a command with the caller's stdio. */
 export declare function spawnBunInheritedChild(input: BunSpawnInput): ObservableChild;
+export interface BunGuardTarget {
+    readonly pid: number;
+    readonly exitCode: number | null;
+    readonly signalCode: string | number | null;
+    readonly exited: Promise<unknown>;
+}
+/** Bun-native target observation for the standalone owner-loss guard. */
+export declare function spawnBunGuardTarget(executable: string, args: readonly string[]): BunGuardTarget;
 export {};
 //# sourceMappingURL=bun-child.d.ts.map

package/dist/process/bun-child.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bun-child.d.ts","sourceRoot":"","sources":["../../src/process/bun-child.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEjD,gGAAgG;AAChG,MAAM,WAAW,UAAW,SAAQ,YAAY;IAC9C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;CACvC;AAED,oEAAoE;AACpE,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;CACvC;AAED,UAAU,aAAa;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAoKD,+DAA+D;AAC/D,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,UAAU,CA4B9D;AAED,0EAA0E;AAC1E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,aAAa,GAAG,eAAe,CAmB5E"}
+{"version":3,"file":"bun-child.d.ts","sourceRoot":"","sources":["../../src/process/bun-child.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EAAE,KAAK,wBAAwB,EAAyB,MAAM,uBAAuB,CAAC;AAG7F,gGAAgG;AAChG,MAAM,WAAW,UAAW,SAAQ,YAAY;IAC9C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;CACvC;AAED,oEAAoE;AACpE,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;CACvC;AAED,UAAU,aAAa;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACtC;AAED;;;;GAIG;AACH,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAqKD,+DAA+D;AAC/D,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,UAAU,CAgD9D;AAED,0EAA0E;AAC1E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,aAAa,GAAG,eAAe,CAsC5E;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;CACnC;AAED,yEAAyE;AACzE,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,cAAc,CAMhB"}

package/dist/process/command-owner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-owner.d.ts","sourceRoot":"","sources":["../../src/process/command-owner.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,EAEL,KAAK,oBAAoB,EAI1B,MAAM,YAAY,CAAC;AAEpB,OAAO,EAEL,KAAK,yBAAyB,EAG/B,MAAM,UAAU,CAAC;AAOlB,wFAAwF;AACxF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,EACrC,MAAM,CAAC,EAAE,yBAAyB;;;;;;;;;;EAkKnC"}
+{"version":3,"file":"command-owner.d.ts","sourceRoot":"","sources":["../../src/process/command-owner.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,EAEL,KAAK,oBAAoB,EAI1B,MAAM,YAAY,CAAC;AAEpB,OAAO,EAEL,KAAK,yBAAyB,EAG/B,MAAM,UAAU,CAAC;AAQlB,wFAAwF;AACxF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,EACrC,MAAM,CAAC,EAAE,yBAAyB;;;;;;;;;;EA8KnC"}

package/dist/process/contract.d.ts

@@ -77,6 +77,9 @@ export declare const NativeCommandOptionsSchema: z.ZodPipe<z.ZodObject<{
         caller: "caller";
         own: "own";
     }>>;
+    ownerLoss: z.ZodOptional<z.ZodEnum<{
+        terminate: "terminate";
+    }>>;
     stdio: z.ZodDefault<z.ZodEnum<{
         inherit: "inherit";
         pipe: "pipe";
@@ -121,6 +124,7 @@ export declare const NativeCommandOptionsSchema: z.ZodPipe<z.ZodObject<{
     }) => void) | undefined;
     drainTimeoutMs?: number | undefined;
     group: "caller" | "own";
+    ownerLoss?: "terminate" | undefined;
     stdio: "inherit" | "pipe";
     cleanupTimeoutMs: number;
     stop: {
@@ -149,6 +153,7 @@ export declare const NativeCommandOptionsSchema: z.ZodPipe<z.ZodObject<{
     }) => void) | undefined;
     drainTimeoutMs?: number | undefined;
     group: "caller" | "own";
+    ownerLoss?: "terminate" | undefined;
     stdio: "inherit" | "pipe";
     stop?: {
         target: "group" | "leader";

package/dist/process/contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../src/process/contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,QAAA,MAAM,6BAA6B;;;;;;;;;;;;2BAajC,CAAC;AACH;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;GAEG;AACH,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gGAAgG;AAChG,eAAO,MAAM,yBAAyB,UAAY,CAAC;AAEnD,QAAA,MAAM,6BAA6B;;;;;;;;;;;;;;;kBAOjC,CAAC;AACH;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAiC3F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;gDAqBpB,UAAU,WACR,QAAQ,GAAG,QAAQ,UACpB,WAAW,KAChB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;uDAKX,uBAAuB,UAAU,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;uDAMrE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmF3C,CAAC;AACN;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AACrF,QAAA,MAAM,yBAAyB;;;;;;iBAU7B,CAAC;AACH;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,QAAA,MAAM,8BAA8B;;;EAAwC,CAAC;AAE7E;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;aAezB,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB;IAdnF,2GAA2G;IAC3G,SAAgB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,GAAG,SAAS,CAAC;IAEnF,YACE,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,GAAG;QAAE,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAA;KAAE,EACpF;IACF,YACE,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB,EACjE,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,GAAG;QAAE,MAAM,CAAC,EAAE,KAAK,CAAA;KAAE,EAC3C;CAgBH"}
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../src/process/contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,QAAA,MAAM,6BAA6B;;;;;;;;;;;;2BAajC,CAAC;AACH;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;GAEG;AACH,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gGAAgG;AAChG,eAAO,MAAM,yBAAyB,UAAY,CAAC;AAEnD,QAAA,MAAM,6BAA6B;;;;;;;;;;;;;;;kBAOjC,CAAC;AACH;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAiC3F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;gDAqBpB,UAAU,WACR,QAAQ,GAAG,QAAQ,UACpB,WAAW,KAChB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;uDAKX,uBAAuB,UAAU,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;uDAMrE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4F3C,CAAC;AACN;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AACrF,QAAA,MAAM,yBAAyB;;;;;;iBAU7B,CAAC;AACH;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,QAAA,MAAM,8BAA8B;;;EAAwC,CAAC;AAE7E;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;aAezB,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB;IAdnF,2GAA2G;IAC3G,SAAgB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,GAAG,SAAS,CAAC;IAEnF,YACE,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,GAAG;QAAE,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAA;KAAE,EACpF;IACF,YACE,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB,EACjE,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,GAAG;QAAE,MAAM,CAAC,EAAE,KAAK,CAAA;KAAE,EAC3C;CAgBH"}

package/dist/process/launch.d.ts

@@ -56,7 +56,7 @@ export declare function launchNativeCommand({ options, driver, onSpawn, onFailur
 }): {
     stdout: AsyncIterable<Uint8Array<ArrayBufferLike>>;
     stderr: AsyncIterable<Uint8Array<ArrayBufferLike>>;
-    start(): void;
+    start(): Promise<number | undefined>;
     child: NativeCommandLaunchedProcess;
     leader: Promise<{
         kind: "exit";

package/dist/process/launch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"launch.d.ts","sourceRoot":"","sources":["../../src/process/launch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAsB,KAAK,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAEjF,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAElF,wFAAwF;AACxF,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IACjC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC;IAC9D,EAAE,CACA,KAAK,EAAE,MAAM,GAAG,OAAO,EACvB,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAC7D,OAAO,CAAC;CACZ;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC;IAClE,OAAO,IAAI,OAAO,CAAC;CACpB;AAED,iGAAiG;AACjG,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,4BAA4B,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,0BAA0B,EACnC,MAAM,EAAE,yBAAyB,GAAG,SAAS;;;EAY9C;AAED,UAAU,kBAAkB;IAC1B,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAGD,uFAAuF;AACvF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAEzF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAEhF;AAwED,yFAAyF;AACzF,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACP,MAAM,EACN,OAAO,EACP,SAAS,EACT,cAAc,EACd,UAAU,GACX,EAAE;IACD,OAAO,EAAE,0BAA0B,CAAC;IACpC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAC9C,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,wDAAwD;IACxD,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAClC,kEAAkE;IAClE,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACvC,yEAAyE;IACzE,UAAU,EAAE,CAAC,SAAS,EAAE,sBAAsB,KAAK,IAAI,CAAC;CACzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoDA"}
+{"version":3,"file":"launch.d.ts","sourceRoot":"","sources":["../../src/process/launch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAsB,KAAK,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAIjF,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAElF,wFAAwF;AACxF,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IACjC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC;IAC9D,EAAE,CACA,KAAK,EAAE,MAAM,GAAG,OAAO,EACvB,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAC7D,OAAO,CAAC;CACZ;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC;IAClE,OAAO,IAAI,OAAO,CAAC;CACpB;AAED,iGAAiG;AACjG,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,4BAA4B,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,0BAA0B,EACnC,MAAM,EAAE,yBAAyB,GAAG,SAAS;;;EAY9C;AAED,UAAU,kBAAkB;IAC1B,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAGD,uFAAuF;AACvF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAEzF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAEhF;AAwED,yFAAyF;AACzF,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACP,MAAM,EACN,OAAO,EACP,SAAS,EACT,cAAc,EACd,UAAU,GACX,EAAE;IACD,OAAO,EAAE,0BAA0B,CAAC;IACpC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAC9C,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,wDAAwD;IACxD,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAClC,kEAAkE;IAClE,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACvC,yEAAyE;IACzE,UAAU,EAAE,CAAC,SAAS,EAAE,sBAAsB,KAAK,IAAI,CAAC;CACzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0DA"}

package/dist/process/owned-child.d.ts

@@ -1,5 +1,6 @@
 import { type OwnedChild } from './bun-child.js';
 import type { NativeCommandLaunchedProcess } from './launch.js';
+import { type OwnerLossGuardInvocation } from './owner-loss-protocol.js';
 /** Only this native spawn can establish group ownership; structural PIDs cannot. */
 export declare function spawnOwnedCommand(input: {
     executable: string;
@@ -7,6 +8,7 @@ export declare function spawnOwnedCommand(input: {
     cwd?: string;
     env?: NodeJS.ProcessEnv;
     group: boolean;
+    ownerLoss?: OwnerLossGuardInvocation;
 }): OwnedChild;
 /** The same ownership rule as {@link spawnOwnedCommand}, for a child that inherits stdio. */
 export declare function spawnInheritedCommand(input: {
@@ -15,6 +17,7 @@ export declare function spawnInheritedCommand(input: {
     cwd?: string;
     env?: NodeJS.ProcessEnv;
     group: boolean;
+    ownerLoss?: OwnerLossGuardInvocation;
 }): NativeCommandLaunchedProcess;
 export declare function ownsCommandGroup(child: object): boolean;
 //# sourceMappingURL=owned-child.d.ts.map

package/dist/process/owned-child.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owned-child.d.ts","sourceRoot":"","sources":["../../src/process/owned-child.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,UAAU,EAGhB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAA+B,4BAA4B,EAAE,MAAM,UAAU,CAAC;AAI1F,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,UAAU,CAIb;AAkED,6FAA6F;AAC7F,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,4BAA4B,CAa/B;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvD"}
+{"version":3,"file":"owned-child.d.ts","sourceRoot":"","sources":["../../src/process/owned-child.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,UAAU,EAGhB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAA+B,4BAA4B,EAAE,MAAM,UAAU,CAAC;AAM1F,OAAO,EAAE,KAAK,wBAAwB,EAAyB,MAAM,uBAAuB,CAAC;AAI7F,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACtC,GAAG,UAAU,CAIb;AAsFD,6FAA6F;AAC7F,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACtC,GAAG,4BAA4B,CAkC/B;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvD"}

package/dist/process/owner-loss-control.d.ts

@@ -0,0 +1,15 @@
+import type { Duplex } from 'node:stream';
+interface GuardedChild {
+    readonly pid?: number;
+    on(event: 'exit', listener: (code: number | null, signal: string | null) => void): unknown;
+}
+/** Tear down a newly created guard group if its private control channel is unavailable. */
+export declare function abortOwnerLossLaunch(pid: number | undefined): void;
+/** Bind one private inherited control socket to the guard process that owns it. */
+export declare function attachOwnerLossControl(child: GuardedChild, control: Duplex): void;
+/** Preserve the guard registration when an inherited-stdio child gets its transport wrapper. */
+export declare function transferOwnerLossControl(source: object, target: object): void;
+/** Ordinary children are already started; guarded children first prove that their target exists. */
+export declare function awaitCommandStart(child: GuardedChild): Promise<number | undefined>;
+export {};
+//# sourceMappingURL=owner-loss-control.d.ts.map

package/dist/process/owner-loss-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-loss-control.d.ts","sourceRoot":"","sources":["../../src/process/owner-loss-control.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAe1C,UAAU,YAAY;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC;CAC5F;AASD,2FAA2F;AAC3F,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAOlE;AAQD,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAuDjF;AAED,gGAAgG;AAChG,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAG7E;AAED,oGAAoG;AACpG,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAIxF"}

package/dist/process/owner-loss-guard.d.ts

@@ -0,0 +1,3 @@
+/** The built or source module that executes the guard protocol when launched directly. */
+export declare function ownerLossGuardEntry(): string;
+//# sourceMappingURL=owner-loss-guard.d.ts.map

package/dist/process/owner-loss-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-loss-guard.d.ts","sourceRoot":"","sources":["../../src/process/owner-loss-guard.ts"],"names":[],"mappings":"AA+KA,0FAA0F;AAC1F,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C"}

package/dist/process/owner-loss-protocol.d.ts

@@ -0,0 +1,10 @@
+export declare const OWNER_LOSS_GUARD_FLAG = "--stitchkit-owner-loss-guard-v1";
+export interface OwnerLossGuardInvocation {
+    readonly entry: string;
+    readonly signalTarget: 'group' | 'leader';
+}
+/** The owner-loss guard is certified only on the two POSIX kernels exercised by release CI. */
+export declare function ownerLossAvailable(platform: NodeJS.Platform): boolean;
+/** Replace a direct command with the package-owned guard that becomes its process-group leader. */
+export declare function ownerLossGuardCommand(guard: OwnerLossGuardInvocation, executable: string, args: readonly string[]): [string, ...string[]];
+//# sourceMappingURL=owner-loss-protocol.d.ts.map

package/dist/process/owner-loss-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-loss-protocol.d.ts","sourceRoot":"","sources":["../../src/process/owner-loss-protocol.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,oCAAoC,CAAC;AAEvE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,QAAQ,CAAC;CAC3C;AAED,+FAA+F;AAC/F,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAErE;AAED,mGAAmG;AACnG,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,wBAAwB,EAC/B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CASvB"}

package/dist/process/owner-loss-socket.d.ts

@@ -0,0 +1,4 @@
+import { type Socket } from 'node:net';
+/** Bun's runtime accepts an inherited socket fd here before its Node types expose the overload. */
+export declare function connectOwnerLossSocket(fd: number): Socket;
+//# sourceMappingURL=owner-loss-socket.d.ts.map

package/dist/process/owner-loss-socket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-loss-socket.d.ts","sourceRoot":"","sources":["../../src/process/owner-loss-socket.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAEhD,mGAAmG;AACnG,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEzD"}

package/llms/process.txt

@@ -139,6 +139,7 @@ console.log(captured.exitCode, new TextDecoder().decode(captured.stdout))
 const lifetime = new AbortController()
 await runNativeCommand({
   executable: '/usr/bin/git', args: ['status'], signal: lifetime.signal,
+  ownerLoss: 'terminate', // also stop its group if this JavaScript process is SIGKILLed
   onOutput: async (bytes, channel, outputSignal) => {
     outputSignal.throwIfAborted()
     await output.write(bytes, channel, outputSignal) // application-owned bounded sink
@@ -201,6 +202,17 @@ sink cause is kept; a cleanup failure is a `NativeCommandError` with `COMMAND_CL
 refuses with `COMMAND_UNAVAILABLE`; a descendant that has left the group on its own with `setsid` is
 outside this capability. This is one-shot execution, not a PTY, a supervisor or a daemon host.
 
+`ownerLoss: 'terminate'` binds the command group to this JavaScript process even when it cannot run
+cleanup. A package-owned guard becomes the process-group leader, starts the requested executable in
+that group and holds one end of a private inherited kernel channel. The caller holds the other end.
+`SIGKILL`, a crash or any abrupt caller exit closes that end; EOF makes the guard KILL its own group.
+There is no liveness polling and no later PID lookup. Because the guard is still the group leader
+when it signals, its PGID cannot have been reused by a neighbour. The option is available on Linux
+and Darwin under Bun and Node, requires `group: 'own'`, and other platforms refuse it with
+`COMMAND_UNAVAILABLE`. It adds one short-lived process and one descriptor per guarded command, so it
+is opt-in. `onLeaderStarted({ pid })` reports the guard/group leader with this option; output, stdin,
+exit status, deadlines, cancellation and `onLeaderSettled` retain the requested command's behaviour.
+
 ### Stopping a command: the `stop` policy
 
 A caller abort, the `timeoutMs` deadline, an exceeded output budget and a failing sink all stop the
@@ -235,13 +247,13 @@ dropped, never passed to `onOutput` and never captured, so a leader that writes
 does not meet a broken pipe. The result rejects with the abort reason once the group is gone and the
 pipes are closed, so it can take `graceMs` plus `cleanupTimeoutMs` after the abort.
 
-The grace is a timer inside the process that runs the command. If that process exits first, the
-timer is gone and the group, which is detached into its own session, keeps running: nothing in this
-package can bound it from outside. Abort `killOn` in your shutdown path, so the group is killed
-before the process exits, and let the supervisor own the case where the process dies without a
-shutdown. Under systemd, keep `KillMode=control-group` (the default) so the stop of the unit
-reaches every process in its cgroup, whatever its process group; launchd only kills the job's own
-process group, which a command's group is not.
+The grace is a timer inside the process that runs the command. Without `ownerLoss`, if that process
+exits first, the timer is gone and the group, which is detached into its own session, keeps running.
+Abort `killOn` in your shutdown path so a deliberate shutdown kills the group before exit. For an
+abrupt-exit guarantee, choose `ownerLoss: 'terminate'`; for all groups in a service, let the service
+supervisor own the wider boundary. Under systemd, keep `KillMode=control-group` (the default) so the
+stop of the unit reaches every process in its cgroup, whatever its process group; launchd only kills
+the job's own process group, which an unguarded detached command's group is not.
 
 ### Stopping a group and its descendants
 
@@ -302,7 +314,7 @@ becomes `runNativeCommand`; shell policy, command admission, logging, redaction,
 decoder and the operator sink stay with the application. Long signal-only commands stay streaming;
 bounded tar or capture commands get their own explicit limits.
 
-A child the caller holds until it exits is the same call. A guardian that forwards its own SIGTERM
+A child the caller holds until it exits is the same call. A host that forwards its own SIGTERM
 passes an abort signal and `stop: { target: 'leader', signal: 'SIGTERM', graceMs }`. It records the
 pid in `onLeaderStarted({ pid })`, which runs once right after the leader exists (a throw stops the
 command with that error), and the leader's exit code and signal in `onLeaderSettled`: `'exit'`
@@ -312,7 +324,9 @@ long the output pipes may stay open after the leader exited: a holder that left
 `setsid` keeps them open, and without the option the command waits for it until `timeoutMs` or
 the signal; with it the command ends with `COMMAND_CLEANUP` (a holder inside the group is already
 stopped by `descendants`). A worker whose whole group must stop on abort is the default
-`target: 'group'`. A command that uses the caller's terminal is the next section. Importing one leaf does not make
+`target: 'group'`. Add `ownerLoss: 'terminate'` when the worker must also die after an abrupt host
+loss; in that mode `onLeaderStarted` reports the package guard that leads the same group. A command
+that uses the caller's terminal is the next section. Importing one leaf does not make
 installing the whole npm package smaller; choose a dependency after measuring packed size and its
 dependency closure.
 
@@ -346,6 +360,7 @@ its own, so:
   because a group signal would reach the caller;
 - `descendants` does not apply and is refused: what the leader leaves behind belongs to the
   caller's group, and `descendantsStopped` is always `false`;
+- `ownerLoss` is refused: an owner-loss guard must lead a group that belongs only to the command;
 - a Ctrl-C reaches the caller too; handle `SIGINT` in the caller when it must outlive the command.
 
 The two options are independent: `stdio: 'inherit'` alone keeps colour and `isatty` for a command
@@ -677,7 +692,7 @@ Native POSIX Bun/Node one-shot command execution. See [native IO](../guide/nativ
 | Export | Kind | Purpose |
 |---|---|---|
 | `runNativeCommand` | function | caller-lifetime streaming or explicitly bounded binary capture |
-| `NativeCommandOptions` | type | executable/args, env policy, signal/deadline, bytes sink, finite cleanup limits, the `stop` policy and `descendants` (`'terminate-after-leader'`, the default: stop the group after the leader exits, or `'leave'`); `stdio` (`'pipe'`, or `'inherit'` for the caller's descriptors, refusing the pipe-only options) and `group` (`'own'`, or `'caller'`: joins the caller's process group, stops only the leader, refuses `descendants` and a group stop); `onLeaderStarted({ pid })` (once, after the leader exists), `drainTimeoutMs` (bound on the pipes staying open after the leader exited, `COMMAND_CLEANUP`); an unknown key is refused by name, a removed one (`killGraceMs`) with its replacement |
+| `NativeCommandOptions` | type | executable/args, env policy, signal/deadline, bytes sink, finite cleanup limits, the `stop` policy and `descendants` (`'terminate-after-leader'`, the default: stop the group after the leader exits, or `'leave'`); `stdio` (`'pipe'`, or `'inherit'` for the caller's descriptors, refusing the pipe-only options) and `group` (`'own'`, or `'caller'`: joins the caller's process group, stops only the leader, refuses `descendants`, `ownerLoss` and a group stop); `ownerLoss: 'terminate'` (optional Linux/Darwin Bun/Node guard: kernel channel EOF after abrupt caller death KILLs its owned group, unsupported platforms refuse); `onLeaderStarted({ pid })` (once after the group leader exists; the package guard's PID under `ownerLoss`), `drainTimeoutMs` (bound on the pipes staying open after the leader exited, `COMMAND_CLEANUP`); an unknown key is refused by name, a removed one (`killGraceMs`) with its replacement |
 | `NativeCommandStopPolicy` | type | how a cancelled command stops: `target` `'group'` (signal every member) or `'leader'` (signal only the leader; its exit ends the grace), `signal` (default `SIGTERM`), `graceMs` (at most one hour) before KILL to the group, and `killOn`, an `AbortSignal` that skips the grace; default `{ target: 'group', signal: 'SIGTERM', graceMs: 100 }` |
 | `NativeCommandResult` | type | observed nullable exit code/signal, `descendantsStopped` (members left in the group after the leader exited were stopped) and captured stdout/stderr bytes |
 | `NativeCommandError` | class | COMMAND_LIMIT with machine reason `deadline` or `output-budget`; COMMAND_UNAVAILABLE / COMMAND_CLEANUP have no limit reason; COMMAND_CLEANUP means the command's resources were not proven closed, either past `cleanupTimeoutMs` after a stop or past `drainTimeoutMs` after the leader exited, and `cause` holds that bound's failure. Preserves internal cause and existing constructor; caller-created limits without supplied reason remain unclassified |

package/llms/stitchkit.txt

@@ -69,7 +69,7 @@ own, recorded as an ADR.
 | `stitchkit/cli` | server | stable | `createCli` / `createCliInvoker` — runtime and strict NodeNext declarations without MCP SDK / `ai` |
 | `stitchkit/cli/publish` | build and release tooling (Bun or Node, POSIX) | evolving | `publishCli` — commit a verified CLI distribution and move its public manifest last; see [CLI guide](cli.md#publishing-a-complete-version) |
 | `stitchkit/remote` | browser **and** server | stable | peer-free `implementRemote` for thin HTTP proxy processes |
-| `stitchkit/process` | server (Bun or Node, POSIX) | evolving | finite native commands, byte sinks, bounded capture and process-group cancellation |
+| `stitchkit/process` | server (Bun or Node, POSIX) | evolving | finite native commands, byte sinks, bounded capture, process-group cancellation and opt-in Linux/Darwin owner-loss cleanup |
 | `stitchkit/files/packaging` | build time (Bun or Node) | evolving | installed native asset graph, integrity, Bun packaging plugin and the artifact loader check; no runtime install policy |
 | `stitchkit/files` | server (Bun or Node) | stable | peer-free managed local-file boundary |
 | `stitchkit/telegram` | server (Bun or Node) | evolving | peer-free Telegram platform primitives — Mini App `initData` verification, send-failure classification, resumable broadcasts, the operator channel with dedupe, a Bot API transport that separates a request that never left from an unknown outcome, local Bot API files, webhook ownership and durable webhook update intake |

package/llms-full.txt

@@ -61,7 +61,7 @@ own, recorded as an ADR.
 | `stitchkit/cli` | server | stable | `createCli` / `createCliInvoker` — runtime and strict NodeNext declarations without MCP SDK / `ai` |
 | `stitchkit/cli/publish` | build and release tooling (Bun or Node, POSIX) | evolving | `publishCli` — commit a verified CLI distribution and move its public manifest last; see [CLI guide](cli.md#publishing-a-complete-version) |
 | `stitchkit/remote` | browser **and** server | stable | peer-free `implementRemote` for thin HTTP proxy processes |
-| `stitchkit/process` | server (Bun or Node, POSIX) | evolving | finite native commands, byte sinks, bounded capture and process-group cancellation |
+| `stitchkit/process` | server (Bun or Node, POSIX) | evolving | finite native commands, byte sinks, bounded capture, process-group cancellation and opt-in Linux/Darwin owner-loss cleanup |
 | `stitchkit/files/packaging` | build time (Bun or Node) | evolving | installed native asset graph, integrity, Bun packaging plugin and the artifact loader check; no runtime install policy |
 | `stitchkit/files` | server (Bun or Node) | stable | peer-free managed local-file boundary |
 | `stitchkit/telegram` | server (Bun or Node) | evolving | peer-free Telegram platform primitives — Mini App `initData` verification, send-failure classification, resumable broadcasts, the operator channel with dedupe, a Bot API transport that separates a request that never left from an unknown outcome, local Bot API files, webhook ownership and durable webhook update intake |
@@ -8322,6 +8322,7 @@ console.log(captured.exitCode, new TextDecoder().decode(captured.stdout))
 const lifetime = new AbortController()
 await runNativeCommand({
   executable: '/usr/bin/git', args: ['status'], signal: lifetime.signal,
+  ownerLoss: 'terminate', // also stop its group if this JavaScript process is SIGKILLed
   onOutput: async (bytes, channel, outputSignal) => {
     outputSignal.throwIfAborted()
     await output.write(bytes, channel, outputSignal) // application-owned bounded sink
@@ -8384,6 +8385,17 @@ sink cause is kept; a cleanup failure is a `NativeCommandError` with `COMMAND_CL
 refuses with `COMMAND_UNAVAILABLE`; a descendant that has left the group on its own with `setsid` is
 outside this capability. This is one-shot execution, not a PTY, a supervisor or a daemon host.
 
+`ownerLoss: 'terminate'` binds the command group to this JavaScript process even when it cannot run
+cleanup. A package-owned guard becomes the process-group leader, starts the requested executable in
+that group and holds one end of a private inherited kernel channel. The caller holds the other end.
+`SIGKILL`, a crash or any abrupt caller exit closes that end; EOF makes the guard KILL its own group.
+There is no liveness polling and no later PID lookup. Because the guard is still the group leader
+when it signals, its PGID cannot have been reused by a neighbour. The option is available on Linux
+and Darwin under Bun and Node, requires `group: 'own'`, and other platforms refuse it with
+`COMMAND_UNAVAILABLE`. It adds one short-lived process and one descriptor per guarded command, so it
+is opt-in. `onLeaderStarted({ pid })` reports the guard/group leader with this option; output, stdin,
+exit status, deadlines, cancellation and `onLeaderSettled` retain the requested command's behaviour.
+
 ### Stopping a command: the `stop` policy
 
 A caller abort, the `timeoutMs` deadline, an exceeded output budget and a failing sink all stop the
@@ -8418,13 +8430,13 @@ dropped, never passed to `onOutput` and never captured, so a leader that writes
 does not meet a broken pipe. The result rejects with the abort reason once the group is gone and the
 pipes are closed, so it can take `graceMs` plus `cleanupTimeoutMs` after the abort.
 
-The grace is a timer inside the process that runs the command. If that process exits first, the
-timer is gone and the group, which is detached into its own session, keeps running: nothing in this
-package can bound it from outside. Abort `killOn` in your shutdown path, so the group is killed
-before the process exits, and let the supervisor own the case where the process dies without a
-shutdown. Under systemd, keep `KillMode=control-group` (the default) so the stop of the unit
-reaches every process in its cgroup, whatever its process group; launchd only kills the job's own
-process group, which a command's group is not.
+The grace is a timer inside the process that runs the command. Without `ownerLoss`, if that process
+exits first, the timer is gone and the group, which is detached into its own session, keeps running.
+Abort `killOn` in your shutdown path so a deliberate shutdown kills the group before exit. For an
+abrupt-exit guarantee, choose `ownerLoss: 'terminate'`; for all groups in a service, let the service
+supervisor own the wider boundary. Under systemd, keep `KillMode=control-group` (the default) so the
+stop of the unit reaches every process in its cgroup, whatever its process group; launchd only kills
+the job's own process group, which an unguarded detached command's group is not.
 
 ### Stopping a group and its descendants
 
@@ -8485,7 +8497,7 @@ becomes `runNativeCommand`; shell policy, command admission, logging, redaction,
 decoder and the operator sink stay with the application. Long signal-only commands stay streaming;
 bounded tar or capture commands get their own explicit limits.
 
-A child the caller holds until it exits is the same call. A guardian that forwards its own SIGTERM
+A child the caller holds until it exits is the same call. A host that forwards its own SIGTERM
 passes an abort signal and `stop: { target: 'leader', signal: 'SIGTERM', graceMs }`. It records the
 pid in `onLeaderStarted({ pid })`, which runs once right after the leader exists (a throw stops the
 command with that error), and the leader's exit code and signal in `onLeaderSettled`: `'exit'`
@@ -8495,7 +8507,9 @@ long the output pipes may stay open after the leader exited: a holder that left
 `setsid` keeps them open, and without the option the command waits for it until `timeoutMs` or
 the signal; with it the command ends with `COMMAND_CLEANUP` (a holder inside the group is already
 stopped by `descendants`). A worker whose whole group must stop on abort is the default
-`target: 'group'`. A command that uses the caller's terminal is the next section. Importing one leaf does not make
+`target: 'group'`. Add `ownerLoss: 'terminate'` when the worker must also die after an abrupt host
+loss; in that mode `onLeaderStarted` reports the package guard that leads the same group. A command
+that uses the caller's terminal is the next section. Importing one leaf does not make
 installing the whole npm package smaller; choose a dependency after measuring packed size and its
 dependency closure.
 
@@ -8529,6 +8543,7 @@ its own, so:
   because a group signal would reach the caller;
 - `descendants` does not apply and is refused: what the leader leaves behind belongs to the
   caller's group, and `descendantsStopped` is always `false`;
+- `ownerLoss` is refused: an owner-loss guard must lead a group that belongs only to the command;
 - a Ctrl-C reaches the caller too; handle `SIGINT` in the caller when it must outlive the command.
 
 The two options are independent: `stdio: 'inherit'` alone keeps colour and `isatty` for a command
@@ -23044,7 +23059,7 @@ Native POSIX Bun/Node one-shot command execution. See [native IO](../guide/nativ
 | Export | Kind | Purpose |
 |---|---|---|
 | `runNativeCommand` | function | caller-lifetime streaming or explicitly bounded binary capture |
-| `NativeCommandOptions` | type | executable/args, env policy, signal/deadline, bytes sink, finite cleanup limits, the `stop` policy and `descendants` (`'terminate-after-leader'`, the default: stop the group after the leader exits, or `'leave'`); `stdio` (`'pipe'`, or `'inherit'` for the caller's descriptors, refusing the pipe-only options) and `group` (`'own'`, or `'caller'`: joins the caller's process group, stops only the leader, refuses `descendants` and a group stop); `onLeaderStarted({ pid })` (once, after the leader exists), `drainTimeoutMs` (bound on the pipes staying open after the leader exited, `COMMAND_CLEANUP`); an unknown key is refused by name, a removed one (`killGraceMs`) with its replacement |
+| `NativeCommandOptions` | type | executable/args, env policy, signal/deadline, bytes sink, finite cleanup limits, the `stop` policy and `descendants` (`'terminate-after-leader'`, the default: stop the group after the leader exits, or `'leave'`); `stdio` (`'pipe'`, or `'inherit'` for the caller's descriptors, refusing the pipe-only options) and `group` (`'own'`, or `'caller'`: joins the caller's process group, stops only the leader, refuses `descendants`, `ownerLoss` and a group stop); `ownerLoss: 'terminate'` (optional Linux/Darwin Bun/Node guard: kernel channel EOF after abrupt caller death KILLs its owned group, unsupported platforms refuse); `onLeaderStarted({ pid })` (once after the group leader exists; the package guard's PID under `ownerLoss`), `drainTimeoutMs` (bound on the pipes staying open after the leader exited, `COMMAND_CLEANUP`); an unknown key is refused by name, a removed one (`killGraceMs`) with its replacement |
 | `NativeCommandStopPolicy` | type | how a cancelled command stops: `target` `'group'` (signal every member) or `'leader'` (signal only the leader; its exit ends the grace), `signal` (default `SIGTERM`), `graceMs` (at most one hour) before KILL to the group, and `killOn`, an `AbortSignal` that skips the grace; default `{ target: 'group', signal: 'SIGTERM', graceMs: 100 }` |
 | `NativeCommandResult` | type | observed nullable exit code/signal, `descendantsStopped` (members left in the group after the leader exited were stopped) and captured stdout/stderr bytes |
 | `NativeCommandError` | class | COMMAND_LIMIT with machine reason `deadline` or `output-budget`; COMMAND_UNAVAILABLE / COMMAND_CLEANUP have no limit reason; COMMAND_CLEANUP means the command's resources were not proven closed, either past `cleanupTimeoutMs` after a stop or past `drainTimeoutMs` after the leader exited, and `cause` holds that bound's failure. Preserves internal cause and existing constructor; caller-created limits without supplied reason remain unclassified |

package/llms.txt

@@ -56,7 +56,7 @@ Load the slice for each entrypoint your code imports — `import … from 'stitc
 - **stitchkit/node**: [llms/node.txt](llms/node.txt) 3.1 KB
 - **stitchkit/agent-runtime/react**: [llms/agent-runtime-react.txt](llms/agent-runtime-react.txt) 1.0 KB
 - **stitchkit/agent-runtime/realtime**: [llms/agent-runtime-realtime.txt](llms/agent-runtime-realtime.txt) 2.6 KB
-- **stitchkit/process**: [llms/process.txt](llms/process.txt) 43.3 KB
+- **stitchkit/process**: [llms/process.txt](llms/process.txt) 44.9 KB
 - **stitchkit/files/packaging**: [llms/files-packaging.txt](llms/files-packaging.txt) 3.5 KB
 
 ## Upgrading slices

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stitchkit",
-  "version": "0.108.1",
+  "version": "0.108.2",
   "description": "Contract-first backend framework — one defineContract() into an HTTP API, MCP tools, AI-agent tools and a typed client. Bun and Node.",
   "keywords": [
     "bun",