although i really need to make some changes in events related code in osquery core. But i thought it would be good to start with extension first. Is there any reason these changes are not in the core ? just curious.

I don’t there’s a reason. Most likely an oversight when refactoring build code. We should fix this, mind submitting a pull request? The waitThenShutdown change is intentional. We changed the shutdown logic and wanted to rename the function so that folks would look/read about the changes.