Module subprocess 

Spawning and reaping the detached agent and MCP children the supervisor owns.

Spawning

spawn_supervised is the only sanctioned way to start a child. It runs every spawn on one dedicated thread and, where the platform offers it, asks the kernel to SIGTERM the child if this process dies, so a crash, panic, or SIGKILL of the supervisor cannot strand an agent holding a port. The spawner thread is started lazily; a failure to start it is returned to the caller and retried on the next spawn rather than cached for the life of the process.

Identity

The environment markers and the pure parsers that read them back live in systemprompt_models::subprocess; the platform probes here (live_pid_is_subprocess, is_zombie) are what execute them against /proc or sysctl.

Platform support

The two halves of supervision have different reach, and conflating them is what stranded ports on macOS:

• Identity and reap checks (live_pid_is_subprocess, is_zombie) work on Linux, via /proc, and on macOS, via sysctl(KERN_PROCARGS2) and proc_pidinfo. Report the platform’s coverage with identity_verification_supported; where it is absent the checks are fail-closed stubs that never confirm an identity, so no process is ever signalled on a guess.
• Parent-death prevention is prctl(PR_SET_PDEATHSIG) and therefore Linux-only. macOS has no equivalent that survives execve, and the kqueue and pipe-EOF alternatives all require cooperation from the child binary — which is an arbitrary MCP server or agent executable here. A SIGKILLed supervisor on macOS therefore leaves its children reparented to launchd and still holding their ports; the identity check above is what lets the next start reclaim them instead of erroring out.

Copyright (c) systemprompt.io — Business Source License 1.1. See https://systemprompt.io for licensing details.

Functions

is_zombie

live_pid_is_subprocess

place_in_own_process_group

spawn_owned_supervised

spawn_supervised