Dispose exec children once on every TUI exit path

[TheGreatAxios]

Summary

• TUI and exec teardown share a once-only dispose owner; the toolset is disposed inside that path so live shell-guard children are killed and reaped.
• Crash, signal, and quit await shutdown. Quit aborts before waiting on a hung session-op tail. Teardown failure on a done session exits 1; signals stay 128+n.
• Leftover children after the reap window fail dispose. Shutdown errors are logged, not swallowed.

Verification

• bun run typecheck, bun run build, and bun run test pass
• bun run check passes

Fixes CL-7534
Changelog: bug

[linear-code]

CL-7534

[TheGreatAxios]

independent critic found no blocking orphans on primary TUI/exec run_shell paths. Once-only dispose holds. Follow-ups already in: quit shuts down before hung tail, reap timeout fails teardown, shutdown errors logged. Remaining should-fix being addressed: subagent dispose currently swallows posixTools.dispose rejection.

[TheGreatAxios]

re-critic of origin/main..HEAD including ed15287 found no blocking orphans on primary TUI/exec run_shell paths. Subagent posix dispose rejection is no longer swallowed on ephemeral teardown (disposeSubAgentSession awaits with no catch). Remaining file-for-later: persist close_agent still best-effort-catches dispose, so a persist worker leftover after reap can still look like success at the fleet layer.

[TheGreatAxios]

Critic · Request changes

TUI/exec teardown is once-only and leftover posix dispose can fail the close path, but live children are still SIGKILLed only after agent.close(), so a wedged close or the 2s crash/signal race orphans detached shell-guard processes.

Findings

• src/subagent/dispose.ts:113 / src/subagent/run.ts:1074 — posixTools.dispose() (the process-group kill) runs only after await agent.close() and await streamPromise. closeOnAbort no longer disposes posix tools. boundedClose then times out as success (src/subagent/run.ts:1111, src/subagent/session-store.ts:30). Sequence: persist worker with a live run_shell child; agent.close() hangs (the documented close-ordering wedge); close_agent / cancelAll hits the deadline; session is shutdown; the detached child is still alive. src/subagent/session-store.test.ts:572 locks in hung-close → shutdown success.

• src/tui/runner/shutdown.ts:44 / src/exec/runner.ts:171 / src/index.ts:123 — crash/signal Promise.race waits 2s for the whole chain (cancelAll → closeAgent → disposeToolset). Reap is the last leg. Sequence: live parent run_shell; SIGTERM while agent.close() takes >2s; awaitActiveDisposeHost logs the deadline and process.exits; detached children survive. The integration fixture uses agent: null, so it never hits this.

• src/index.ts:129 — the 2s timer is never cleared when dispose wins. The loser rejects later as unhandledRejection (handler no-ops because terminating is already true).

• src/exec/runner.ts:891 — leftover dispose after a successful exec is logger.debug plus exitCode = 1. No stderr. Operator sees a silent 1; run.json is already done.

• src/tui/runner/exit.ts:544 — shutdown now precedes awaitTail, but the tail is still unbounded. A hung session-op still prevents run.json, telemetry, and the teardownFailed exit 1. src/tui/runner/exit.test.ts:56 documents the hang.

• src/tui/runner/shutdown.ts:18 — completion starts as Promise.resolve(). A signal that re-enters after started = true and before completion = (async () => …)() (window is disposeHost() + starting cancelWorkers) observes a finished dummy and can process.exit before reap.

Notes

• Once-only plugin dispose, leftover throw from reapLiveChildren, and TUI teardownFailed → exit 1 are fine when close actually returns in time.
• Permanent tests to keep: hung agent.close() with a live tracked child must kill or fail close, not report shutdown; signal path with slow closeAgent must still reap; successful exec + throwing toolset dispose must be exit 1 and visible.

[TheGreatAxios]

re-critic of origin/main..HEAD at 1f6c66c found no remaining blocking leftover-as-success swallow on TUI quit, disposeExecRuntime, persist close_agent, or parent toolset dispose. cancelAll now awaits retained close; leftover posix dispose rejects. Remaining should-fix, not blocking: exec runExec maps that reject to exitCode 1 with status still "done" and a debug-only log (no stderr); createAgentToolset.dispose stops the fleet walk after the first leftover and skips parent posixTools.dispose.

[TheGreatAxios]

re-critic of origin/main..HEAD at 7a2ab30 found both remaining should-fixes closed. Leftover exec dispose now fails the ExecResult (exit 1, status failed, error + stderr). Parent toolset dispose finishes remaining closeOne and posix teardown before rethrowing. No blocking leftover-as-success swallow remains on TUI quit, disposeExecRuntime, persist close_agent, or runExec. File-for-later only: on-disk persist("done") / TUI run.json still record a completed send when teardown later fails.