fix(browse): isProcessAlive uses signal-0 on every platform — no more tasklist probe (#1952)

Replace the Windows tasklist shell-out in isProcessAlive with
process.kill(pid, 0), unifying all platforms on the POSIX idiom. Node maps
signal-0 to an OpenProcess existence check on Windows — and the Windows
daemon runs under Node (dist/server-node.mjs + bun-polyfill, the documented
oven-sh/bun#4253 fallback) — so the probe is portable.

Why the shell-out had to go, beyond the cosmetic conhost flash the watchdog
blinked into the foreground every 60s (#1952): a Bun.spawnSync that hits
its timeout still RETURNS with partial stdout, so the `.includes()` PID
match answered "dead" for LIVE processes under load — the false-negative
half of the #2414/#2295 leak chain. Signal 0 spawns nothing, cannot time
out, and is ~5 orders of magnitude faster (measurements in #2414). EPERM
still reports alive (process exists, we just can't signal it).

Layered on the post-#2414-absorb shape: test 3 in
process-liveness-windows.test.ts now asserts the probe is subprocess-free
on ANY platform (win32 exemption dropped), test 4's static tripwire loses
its error-handling.ts exemption (a `tasklist … PID eq` existence probe
anywhere in src/ now fails CI), and windows-spawn-hide.test.ts drops its
tasklist-in-error-handling needle (nothing spawns, which is stronger than
hiding the window).

Tests: process-liveness-windows + windows-spawn-hide + error-handling —
17 pass, 0 fail.

Fixes #1952.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

browse/test/process-liveness-windows.test.ts

@@ -54,16 +54,15 @@ describe('process liveness probe (Windows terminal-agent leak)', () => {
     expect(isProcessAlive(2147483646)).toBe(false);
   });
 
-  test('3. isProcessAlive spawns NO subprocess on POSIX (signal-0 path)', () => {
+  test('3. isProcessAlive spawns NO subprocess on ANY platform (signal-0, #1952)', () => {
     // The heart of the bug: a liveness probe that forks is slow enough to
     // time out, and a timed-out probe silently answers "dead". Signal 0
-    // cannot time out because it never leaves the process.
-    //
-    // Merged design note: on win32 the helper DOES keep a single hardened
-    // tasklist probe (windowsHide, bounded timeout, quoted-CSV PID match)
-    // because Bun's process.kill(pid, 0) throws ESRCH for live Windows PIDs
-    // in compiled binaries. The POSIX path stays subprocess-free.
-    if (process.platform === 'win32') return;
+    // cannot time out because it never leaves the process. Node maps
+    // process.kill(pid, 0) to an OpenProcess existence check on Windows —
+    // and the Windows daemon runs under Node (server-node.mjs +
+    // bun-polyfill), so the POSIX idiom is portable and the win32 tasklist
+    // branch is GONE (it caused both the false negatives above and the
+    // per-tick console flash of #1952).
     const origSpawn = (Bun as any).spawn;
     const origSpawnSync = (Bun as any).spawnSync;
     const spawns: string[] = [];
@@ -79,16 +78,14 @@ describe('process liveness probe (Windows terminal-agent leak)', () => {
     }
   });
 
-  test('4. no source file probes liveness via tasklist outside the central helper', () => {
-    // Static tripwire: ad-hoc tasklist existence checks scattered across src/
-    // resurrect the false-negative class (each call site re-invents the
-    // timeout/parse handling and gets it subtly wrong). The ONE sanctioned
-    // site is error-handling.ts's isProcessAlive win32 branch — centralized,
-    // windowsHide, bounded timeout, quoted-CSV `"${pid}"` match. Every other
-    // file must route through the helper.
+  test('4. no source file probes liveness via tasklist — signal-0 is the only probe (#1952)', () => {
+    // Static tripwire: a tasklist existence check ANYWHERE in src/
+    // resurrects both the false-negative class (#2414: a timed-out spawnSync
+    // still returns, with partial stdout, so a live process reads as dead)
+    // and the per-tick console flash (#1952). isProcessAlive uses
+    // process.kill(pid, 0) on every platform; nothing gets an exemption.
     const offenders: string[] = [];
     for (const { file, content } of readAllSourceFiles()) {
-      if (file === 'error-handling.ts') continue; // the canonical helper
       const code = stripComments(content);
       // `PID eq` is the existence-probe form specifically. Other tasklist
       // uses (e.g. IMAGENAME filters for browser detection) are unaffected.

browse/test/windows-spawn-hide.test.ts

@@ -39,8 +39,9 @@ describe('windowsHide on Windows-reachable spawns (#1835)', () => {
   });
 
   test('Windows-only process probes pass windowsHide', () => {
-    // tasklist in isProcessAlive — runs in polling loops.
-    expectHideNearEvery(SRC('error-handling.ts'), "'tasklist'");
+    // isProcessAlive no longer spawns anything (signal-0 on every platform,
+    // #1952) — process-liveness-windows.test.ts pins that it stays
+    // subprocess-free, which is stronger than hiding a window.
     // powershell DPAPI + tasklist in cookie import.
     const cookie = SRC('cookie-import-browser.ts');
     expectHideNearEvery(cookie, "'powershell'");