Module process 

Worker-only child ownership. Cancellation signals a private Unix process group promptly; only its owner may revoke the capability and reap the PID.

Structs

CapturePolicy

Bounds and stdin handling for one capture.

CommandOutput

OwnedProcess

Owns both the child and the cancellation capability. Never put this in editor state: Drop may wait, so it belongs exclusively to a worker stack.

StreamOutput

One streamed run’s outcome: everything except stdout, which the consumer already saw chunk by chunk.

StreamPolicy

Bounds for one streamed run. Stdout has no retention limit by construction: the consumer, not the pipe, decides what to keep.

Enums

CaptureError

Why a capture did not produce output. capture folds these back into the historical Failure spellings; richer callers (remote exec) match on them directly.

StdinPolicy

What capture does with the child’s stdin.

StreamError

Why a streamed run did not complete. Mirrors CaptureError; StreamError::Consumer carries the consumer’s own error type so a parse/shape failure surfaces typed, never flattened to a message.

Functions

capture

At most 64 KiB per pipe, 30 seconds, stdin from /dev/null. No terminal input/output is inherited.

capture_with

Run one command to completion under explicit bounds. The child runs in its own process group owned by OwnedProcess; cancellation SIGKILLs it, the deadline kills it, and both pipes are drained concurrently with bounded retention.

stream_with

Run one command to completion while its stdout streams through consume. Supervision is identical to capture_with: own process group, cancellation SIGKILLs it, the deadline kills it, stderr is drained concurrently with bounded retention, stdin is /dev/null. Stdout is never retained — a bounded number of chunks is in flight between the reader thread and consume, so memory stays bounded by what the consumer keeps. A consumer error kills the child and surfaces as StreamError::Consumer.