fix(tools): shell job retention, output deltas, and child process lifetimes

[Hmbown]

No-Issue: verified bug-hunt findings

Long-running shell jobs now remain available after they finish, output polling returns new bytes without repeating retained text, non-interactive commands receive EOF, and cancellation/timeout owns child-process cleanup. Original commits 5cf67ed, d314fa4 and 48267b5 and their authorship are retained; main was merged without rewriting the PR.

• Measure finished-job retention and eviction order from finish time, including undelivered completions. Retain a useful terminal output tail and count omitted bytes correctly. Bounded shell deltas identify skipped bytes and their spill file.
• Close stdin for foreground pipe commands and synchronous commands with no input. TTY/background interaction keeps its existing contract; a foreground command moved to jobs keeps its closed stdin.
• Reuse one contained process owner for JavaScript, Python, plugin tools, gate commands, run_tests, and the equivalent Runtime Git and git_history paths. Plugin input is fed while output drains in the same future. Stop/drop kills owned descendants; timed stops retain partial output. Clean exits can leave deliberately detached, redirected daemons running. Unix signal-exit cleanup includes active groups.
• Require process-tree attachment to succeed. Attachment errors are now returned immediately while direct-child kill-on-drop remains active. A deterministic failure test launches a real child, injects PermissionDenied, and checks both the original error and child cleanup.
• Preserve both sets of tests in the Git merge conflict: process cleanup and main's literal-path/effective-remote validation. Import the shared configuration/plugin fixture corrections and limit concurrent extension-host fixtures in nextest; production deadlines and retries are unchanged.

Recovered-branch local evidence:

• Governed focused Rust tests: 32 passed / 0 failed. Includes process-tree lifetime/output behavior, actual Python/plugin/Git cancellation, GitHistory, real in-flight run_tests timeout, and the merged Git validation cases.
• The attachment negative control compiled and failed at runtime, 0 passed / 1 failed: the old swallowed error ran until the enclosing timeout. Child cleanup passed before that assertion. Fixed source was restored byte-for-byte; the final governed check passed both the attachment regression and imported typed-host fixture (2/0), plus all four changed configuration fixtures (4/0).
• Full npm test: 740 passed / 0 failed (68 wrapper + 16 SDK + 54 extension-host + 602 web). check:web passed separately. Scoped formatting and diff checks passed.
• Earlier author receipts remain tied to their original heads: 48267b5 reported 108 focused passes and four failing call-site reversions; d314fa4 reported 233 touched-module passes plus 1501 broader filtered passes. These were not repeated or presented as fresh recovery results.

Limits: process groups and Windows jobs are lifetime controls, not a security sandbox. Tokio children are assigned after spawn on Windows, so descendants may start before assignment. Parent SIGKILL/crash is not covered. The synchronous hardened Git precondition reader remains uncancellable. run_tests has its existing 30-minute ceiling; the existing pre-cancel test is not in-flight token-cancellation proof. Concurrent waiters still share one job cursor. Local macOS results do not replace hosted Windows/current-head CI or release qualification.

PTY fixture follow-up:

The Ubuntu run at 507686df6c450824ea639037509f21c7a87ec7b2 finished with 17,558 passed / 1 failed. The automation editor fixture waited for the substring deleted, which was already present in the open review text Nothing was deleted. It could therefore assert before the queued confirmation completed. The fixture now waits within its existing deadline for file absence, the deletion receipt, and closure of the armed review. All confirmation, cancellation, and final file-absence assertions remain. Production code is unchanged by this follow-up.

The corrected real-terminal test passed 1/0 in 78.44 seconds, covering all five sizes: 40×12, 60×16, 80×24, 100×32, and 140×40. This run used combined candidate 9791f0ffc139b83da228b700ceca8e5ba9bd7cac, not a fresh build of this PR branch. Its TUI binary SHA-256 is 1bd9f79e76351dc3b9fd221d8d012c7b29658b113cf7c6ac25131ce2b502a4a8. The test, automation manager, routing, panel, views/editor, automation tool, harness, and English automation strings were compared and match exactly. This is scoped PTY evidence; updated-head whole-branch CI remains required. The earlier npm 740/0 and web pass receipts above remain tied to the prior recovery source; no additional npm or Cargo run was performed for this test-only follow-up.

Native macOS child-reaper follow-up (Codex, 2026-09-30):

Original CI36674931118 attempt1 macOS finished 17565 passed / 1 failed / 27 skipped. Only in_flight_contained_run_is_listed_for_signal_exit failed: its synchronous 5s cleanup probe starved the same current-thread Tokio runtime that reaps the dropped child. The probe now uses the existing neighboring spawn_blocking convention. Production ownership, cancellation and deadlines are unchanged.

Frozen source63dd0340d8fb5f89f2a42d4c253136eeba1068c1/treef22a19e6c99dd5ae21a4f74ab8b1cba062f1250a: native process-tree focused7/0 in.73s; original-probe negative0/1 FAILED in5.14s; exact fixed bytes restored, regression1/0 in.03s; CI-policy all-target/all-feature locked TUI clippy passed2m19s. Fresh npm740/0 and check:web passed at the same source. This native regression/control proof is separate from older branch and PTY receipts above. Exact new-head three-OS hosted tests/doctests and all required checks remain required before merge; no native Windows/release/provider claim.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}