[Shinomix]

Problem

Generated Python components can miss cancellation: the runtime signals the entrypoint shell, but Python remains its child and never runs its signal handler or finally cleanup. An optional dependency-install shell adds another wrapper.

Current upstream master contains both non-exec handoffs. This fix addresses signal delivery; it is not an assertion that a recent upgrade introduced the issue.

Change

• exec Python after writing the generated program, and exec the next command after successful dependency installation. Neither shell has any subsequent work to preserve.
• Cover inline, bundle and bundle-bz2 generation with/without dependencies using real subprocesses. Send SIGTERM only to the entrypoint PID, verify Python cleanup and PID identity, and bound waits/clean up the process group on failure.
• Preserve success/failure exit codes, quoted/multiline arguments, stdout and stderr; update generated YAML snapshots. Only pip installation is stubbed, avoiding network access in tests.

Validation

• Red before: three dependency-wrapped SIGTERM cases failed locally; the other 15 cases passed (macOS sh already optimizes the bare final command). Green after: all 18 process cases pass.
• Full suite: 2452 passed on Python 3.12, 2452 passed on Python 3.13 (local macOS; only existing TLS/deprecation warnings).
• uv lock --check, touched-Python Ruff, and git diff --check pass.
• Local automated review completed with no findings on committed head 1848474.
• Linux CI run is awaiting maintainer approval for the fork workflow (action_required, zero jobs executed). Linux CI has not yet run.

Rollout boundary

No version bump, release, deployment or downstream dependency change. Versioning/publication remains with the maintainers. Consumers must adopt the released fix and regenerate their component definitions; already-generated definitions do not change automatically.