Struct ContainedProcessGroup 

pub struct ContainedProcessGroup { /* private fields */ }

A logical group of spawned processes that share an originator label.

Each ContainedProcessGroup::spawn call builds its own OS-level containment (Job Object on Windows, process-group on Unix), so the group itself is just metadata.

Implementations

impl ContainedProcessGroup

pub fn new() -> Result<Self, Error>

Create a new process group without an originator.

pub fn with_originator(originator: &str) -> Result<Self, Error>

Create a new process group with an originator name.

pub fn originator(&self) -> Option<&str>

Returns the originator name, if set.

pub fn originator_value(&self) -> Option<String>

Returns the full originator env var value (TOOL:PID), if set.

pub fn spawn( &self, command: &mut Command, stdio: SpawnStdio<'_>, ) -> Result<SpawnedChild, Error>

Spawn a contained child process. The child is contained by its own Job Object on Windows / process group on Unix and is killed when the returned SpawnedChild is dropped.

pub fn spawn_daemon(&self, command: &mut Command) -> Result<DaemonChild, Error>

Spawn a detached daemon child. The child has NUL stdio, a sanitized handle list, and survives the returned DaemonChild being dropped. To terminate, call DaemonChild::kill.

The originator env var is deliberately stripped, never injected.

A daemon outlives the process that happened to start it — that is the entire point of spawning one. Tagging it TOOL:<spawner pid> makes it indistinguishable from an abandoned descendant, so as soon as the spawner exits, any originator-based reaper sees a live process whose originator is dead and kills it. Build-cache daemons (zccache, sccache) are the common casualty: they are started lazily by whichever compiler invocation happens to run first, inherit that session’s tag, and get reaped when it ends — taking the warm cache down with them.

This also restores the intent of the daemon environment policy. crate::EnvironmentPolicy::Auto resolves to UserBaseline for daemons, which rebuilds the environment from the user’s login identity and drops process-local variables. Explicit command.env(...) entries are applied last, so injecting here silently defeated that policy for this one variable.