v0.9.2

Added

• Error::Stdin { program, source } — a non-broken-pipe stdin-writer failure surfaced on an
• StdioMode enum (Piped / Inherit / Null) + Command::stdout(mode) /
• OutputEvent enum (Stdout(String) / Stderr(String)) and OutputEvents stream —
• OverflowMode::Error variant and OutputBufferPolicy::fail_loud(n) builder — a
• Error::OutputTooLarge { program, limit, total_lines } — produced by the fail-loud
• Command::stdout_tee<W: Write + Send>(writer) / Command::stderr_tee<W>(writer) —
• Error::NotFound { program, searched } — a bare program name (no path separators)
• Command::envs([(key, val), …]) — set multiple environment variables in one call.
• Error::Signalled { program, signal } — a process terminated by a signal now surfaces
• StreamedFinish { outcome, stderr } — the named return of
• Reply::signalled(Option<i32>) on the test-double seam — script a signal-killed reply

Changed

• Breaking: Outcome::Signalled now carries the Unix signal number as
• Breaking: RunningProcess::wait(), wait_any(), and wait_all() now return the
• Breaking: RunningProcess::finish_streamed() returns `StreamedFinish { outcome,
• Command::current_dir doc now explicitly calls out that a relative-path program

Changed (Phase I — design block)

• ProcessGroup::spawn now takes its tokio::process::Command by value (D8) instead of
• Command::to_tokio_command is now #[doc(hidden)] (D8) — it remains public and callable as
• Invocation::cwd is now Option<PathBuf> instead of Option<OsString> (D9) — a working
• The bulk capture verbs (output_string/output_bytes) now error loudly when stdout was
• OutputBufferPolicy::Error overflow on an unbounded buffer is no longer a silent no-op (D9c):
• Supervisor now defaults to a bounded-tail capture per incarnation (D3) instead of the
• OutputEvents (the merged stdout+stderr stream) now alternates which stream it polls first (D9d),
• Command::first_line's predicate now requires F: Send (D6) — it delegates through the new

Added (Phase I — design block)

• RunningProcess::kills_tree_on_drop() (D10) — reports whether dropping the handle tears down
• ProcessRunnerExt::first_line (D6) — the streaming first-matching-line search, routed through
• Supervisor::capture(policy) (D3) — override the per-incarnation output-capture policy (the
• Documented the deliberate design choices the block confirmed: ProcessRunner::start stays a

Fixed (Phase H — stdin)

• A stdin-writer failure is no longer silently swallowed: a non-broken-pipe error feeding the
• Stdin::write_to now releases the one-shot source mutex before the copy/stream (B17), so a
• wait_any / wait_all now close an untaken keep_stdin_open pipe (L5), matching the bulk
• Doc fixes (L12): run / run_unit document that ok_codes widens the accepted exit set;

Security (Phase G — security / hygiene)

• Command, CliClient, and Invocation now have a redacted Debug: it surfaces the
• Error now has a manual Debug (was derived): the Exit variant's captured streams are
• Cassette (RecordReplayRunner) hardening: the file is written owner-only (0600) on Unix;
• Documented the cassette's lossy-key limitation: two distinct non-UTF-8 invocations that

Fixed (Phase F — group / limits / sys layer)

• Linux cgroup resource limits (B13): made the cgroup.subtree_control controller-enable
• Documented the Linux max_processes cross-platform divergence (B14): the kernel checks
• Documented the POSIX process-group graceful-shutdown zombie caveat (B16): on the
• ProcessGroup::shutdown with escalate_to_kill(false) now actually preserves survivors:
• Fixed a provenance UB in the Windows job_member_pids helper: the flexible-array
• ProcessGroupStats::total_cpu_time doc now explains the semantic divergence: the Windows
• POSIX process-group exists() probe no longer permanently prunes a just-spawned pid

Fixed

• ProcessResult::combined() now inserts a \n separator between stdout and stderr when
• Pipeline pipefail attribution now honors per-stage ok_codes: an inner stage that
• Pipeline pipefail now attributes to the first non-SIGPIPE checked failure rather
• Pipeline pipefail now preserves the real exit code of an unchecked() last stage
• Error::NotFound Display no longer includes the raw PATH environment value
• When a bare program name is on PATH but the OS cannot execute it directly (e.g. a
• is_bare_name("git/") now correctly returns false; a trailing path separator makes
• Windows command_line() display: a path argument ending with a backslash (e.g.
• A signal-killed process is no longer reported as a generic `Error::Io("terminated by
• finish_streamed and finish_events previously drained an untaken stdout pipe into an
• wait and profile previously accumulated all output in the user-configured buffer even
• output_string / output_bytes called after stdout_lines previously returned empty
• Calling stdout_lines or output_events a second time on the same RunningProcess now
• A second output_events call no longer shares the same stderr SharedLines as the first;
• Pump task handles previously held in a frame-local Vec were leaked (left as detached

v0.9.1

Added

• Command::ok_codes([..]) — treat the given exit codes (not just 0) as success for
• ProcessResult::duration() — the run's wall-clock time (spawn → exit/kill), carried
• ProcessResult::truncated() — whether a bounded OutputBufferPolicy dropped captured
• Command::command_line() — render the command as a single shell-quoted line for
• A current_dir that does not exist now fails with a clear *"working directory does
• Command::timeout_grace(Duration) + Command::timeout_signal(Signal) — a **graceful

Changed

• Breaking: RestartPolicy, OverflowMode, OutputBufferPolicy, ResourceLimits,
• ProcessGroupOptions::shutdown_timeout(Duration) / escalate_to_kill(bool) builders —

Fixed

• Error::Exit now carries the full captured stdout/stderr instead of truncating

v0.9.0

Added

• Error::is_not_found() / is_permission_denied() / is_transient() — io-level
• Command::groups([gid, ..]) — set the child's supplementary groups (Unix

v0.8.2

Added

• wait_all(&mut [&mut RunningProcess]) — the join companion to wait_any:
• output_all(commands, concurrency, runner) — run a batch of commands with a

v0.8.1

Fixed

• fix(readme): use direct raw.githubusercontent URL for cover so crates.io stops generating a CSP-blocked github.com/raw redirect

v0.8.0

Added

• ProcessRunner::start — the live-handle half of a run joins the seam (with
• ScriptedRunner::output now replays canned stdout/stderr through the
• ProcessRunnerExt::run_unit — run for the side effect, require a zero
• More tracing events (behind the tracing feature, processkit target):
• ProcessResult::outcome() -> Outcome — how the run ended as an explicit
• CliClient::default_cancel_on(token) (cancellation feature) — a
• Reply::pending() (cancellation feature) — a ScriptedRunner reply that
• Command::kill_on_parent_death() — opt-in hardening so an abruptly-dying
• Command::unchecked() — exempt a pipeline stage from pipefail attribution
• | operator on Command/Pipeline — a | b | c is sugar for
• Supervisor::storm_pause / failure_decay / failure_threshold — an

Changed

• A panicking line handler no longer poisons the run: the panic is caught,
• Breaking: CliClient's run helpers renamed to the crate-wide verb
• Error::Exit's Display now appends a bounded diagnostic excerpt — the
• SupervisionOutcome is now #[non_exhaustive] (it gained the

Fixed

• keep_stdin_open combined with a bulk verb (output_string/run/…)

v0.7.1

Fixed

• fix: repair main after the v0.7.0 release commit was dropped (manifest, changelog, release guard)

Added

• Add cover art to the project overview

v0.7.0

Changed

• The tree-control surface is now behind a default-on process-control
• windows-sys bumped 0.59 → 0.61 to dedup with the copy tokio/mio already
• Every public type now implements Debug (enforced by a crate lint), and
• Resource measurement (ProcessGroupStats, ProcessGroup::stats,
• ProcessGroupStats and RunProfile are now #[non_exhaustive]: they are

Fixed

• POSIX process-group liveness probes treated EPERM as "process gone": a
• output_bytes awaited an unbounded raw stdout drain: on a shared-group
• The streaming deadline/cancel watchdog tasks are now stopped as soon as the
• POSIX process-group ProcessGroup::adopt was a silent no-op for any child
• The streaming deadline/cancellation kill paths now also kill the **direct

Added

• ProcessResult::program() — the program a result is attributed to (for a
• docs/ guide set — eight cross-linked, per-topic guides (running commands,
• Record/replay cassettes (record feature, off by default, pulls optional
• Cancellation (cancellation feature, off by default, pulls optional
• Environment and privilege builders on Command: inherit_env([names])
• Shell-free pipelines: Command::pipe(next) starts a Pipeline (extend with
• Readiness probes on RunningProcess — wait until a started child is
• Supervisor — keep a child alive: restart per RestartPolicy
• Stats sampling over time (stats feature): ProcessGroup::sample_stats(every)
• Tree inspection: ProcessGroup::members() snapshots the live member pids
• Whole-tree signals and suspend/resume: ProcessGroup::signal(Signal) broadcasts
• ProcessGroupOptions resource limits (behind the new, off-by-default limits

v0.6.2

Caution

YANKED on crates.io — use 0.7.0 instead. A force-push dropped the Release v0.7.0 commit from main before this patch release ran, so this version accidentally shipped the entire 0.7.0 content under a ^0.6-compatible patch number. See CHANGELOG [0.6.2] for details.

Changed - The tree-control surface is now behind a default-on process-control - windows-sys bumped 0.59 → 0.61 to dedup with the copy tokio/mio already - Every public type now implements Debug (enforced by a crate lint), and - Resource measurement (ProcessGroupStats, ProcessGroup::stats, - ProcessGroupStats and RunProfile are now #[non_exhaustive]: they are ### Fixed - POSIX process-group liveness probes treated EPERM as "process gone": a - output_bytes awaited an unbounded raw stdout drain: on a shared-group - The streaming deadline/cancel watchdog tasks are now stopped as soon as the - POSIX process-group ProcessGroup::adopt was a silent no-op for any child - The streaming deadline/cancellation kill paths now also kill the **direct ### Added - ProcessResult::program() — the program a result is attributed to (for a - docs/ guide set — eight cross-linked, per-topic guides (running commands, - Record/replay cassettes (record feature, off by default, pulls optional - Cancellation (cancellation feature, off by default, pulls optional - Environment and privilege builders on Command: inherit_env([names]) - Shell-free pipelines: Command::pipe(next) starts a Pipeline (extend with - Readiness probes on RunningProcess — wait until a started child is - Supervisor — keep a child alive: restart per RestartPolicy - Stats sampling over time (stats feature): ProcessGroup::sample_stats(every) - Tree inspection: ProcessGroup::members() snapshots the live member pids - Whole-tree signals and suspend/resume: ProcessGroup::signal(Signal) broadcasts - ProcessGroupOptions resource limits (behind the new, off-by-default limits

v0.6.1

Changed

• Move the Testing and Releasing guides out of README.md into a dedicated