@4pm/cli 1.4.12 → 1.4.20

package/dist/index.js

@@ -28312,7 +28312,10 @@ function defaultProfileConfig() {
     aiFailoverMode: "remember",
     autoUpdate: true,
     commandHistoryUploadMinutes: 10,
-    autoClearIdleMinutes: 10
+    autoClearIdleMinutes: 10,
+    // Terminate a single AI run after 5 min by default (ADR-0243) so a hung/looping AI CLI
+    // (e.g. a heavy spec review/compose) can't spin the dispatcher forever; 0 = no limit.
+    aiRunTimeoutSec: 300
   };
 }
 function ensureProfileConfig(dir2) {
@@ -28615,6 +28618,9 @@ function readInstalledVersion() {
   }
 }
 function updateViaNpm(version) {
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version)) {
+    throw new Error(`Refusing to update: invalid version string "${version}".`);
+  }
   execSync2(`npm i -g @4pm/cli@${version}`, { stdio: "inherit" });
 }
 async function updateViaDownload(tarballUrl, checksum, signature) {
@@ -33973,7 +33979,8 @@ var UpdateScheduler = class {
 
 // src/core/executor.ts
 import { spawn as spawn2 } from "child_process";
-async function runCommand(dispatch, emit) {
+var KILL_GRACE_MS = 5e3;
+async function runCommand(dispatch, emit, opts) {
   let seq = 0;
   const child = spawn2(dispatch.cmd, dispatch.args ?? [], {
     cwd: dispatch.path,
@@ -33981,6 +33988,27 @@ async function runCommand(dispatch, emit) {
     shell: false
   });
   child.stdin?.end();
+  const timeoutMs = opts?.timeoutMs && opts.timeoutMs > 0 ? opts.timeoutMs : 0;
+  let timedOut = false;
+  let hardKillTimer = null;
+  const timeoutTimer = timeoutMs > 0 ? setTimeout(() => {
+    timedOut = true;
+    emit({
+      commandId: dispatch.commandId,
+      seq: seq++,
+      chunk: `
+[4PM] AI run exceeded the ${Math.round(timeoutMs / 1e3)}s time limit \u2014 terminating.
+`
+    });
+    child.kill("SIGTERM");
+    hardKillTimer = setTimeout(() => child.kill("SIGKILL"), KILL_GRACE_MS);
+    hardKillTimer.unref?.();
+  }, timeoutMs) : null;
+  timeoutTimer?.unref?.();
+  const clearTimers = () => {
+    if (timeoutTimer) clearTimeout(timeoutTimer);
+    if (hardKillTimer) clearTimeout(hardKillTimer);
+  };
   const batcher = new OutputBatcher({
     onFlush: (chunk, truncated) => {
       emit({ commandId: dispatch.commandId, seq: seq++, chunk, truncated });
@@ -33999,17 +34027,21 @@ async function runCommand(dispatch, emit) {
   child.stderr?.on("data", (data) => batcher.push(data.toString("utf8")));
   await new Promise((resolve8) => {
     child.on("close", (exitCode) => {
+      clearTimers();
       batcher.flush();
       emit({
         commandId: dispatch.commandId,
         seq: seq++,
         chunk: "",
         done: true,
-        exitCode: exitCode ?? -1
+        // 124 (the conventional timeout code) when we killed it for exceeding the limit, so the
+        // server settles the command as failed and the web surfaces the note instead of spinning.
+        exitCode: timedOut ? 124 : exitCode ?? -1
       });
       resolve8();
     });
     child.on("error", (err) => {
+      clearTimers();
       emit({
         commandId: dispatch.commandId,
         seq: seq++,
@@ -34136,15 +34168,15 @@ function isSessionLimit(text) {
     text
   );
 }
-function runAttempt(commandId, cmd, args, cwd2, env3, onChunk) {
+function runAttempt(commandId, cmd, args, cwd2, env3, onChunk, timeoutMs) {
   return new Promise((resolve8) => {
     void runCommand({ commandId, cmd, args, path: cwd2, env: env3 }, (out) => {
       if (out.chunk) onChunk(out.chunk);
       if (out.done) resolve8(out.exitCode ?? -1);
-    });
+    }, timeoutMs > 0 ? { timeoutMs } : void 0);
   });
 }
-async function runAiFailover(plan, commandId, cwd2, handlers) {
+async function runAiFailover(plan, commandId, cwd2, handlers, timeoutMs = 0) {
   const total = plan.attempts.length;
   let finalExit = -1;
   let lastCmd = plan.attempts[0]?.cmd ?? "claude";
@@ -34162,7 +34194,7 @@ async function runAiFailover(plan, commandId, cwd2, handlers) {
         handlers.onChunk(text);
       }
     };
-    finalExit = await runAttempt(commandId, attempt.cmd, attempt.args, cwd2, attempt.env, emit);
+    finalExit = await runAttempt(commandId, attempt.cmd, attempt.args, cwd2, attempt.env, emit, timeoutMs);
     const tail = parser.flush();
     if (tail) {
       captured += tail;
@@ -34175,8 +34207,8 @@ async function runAiFailover(plan, commandId, cwd2, handlers) {
       reportToolResult(attempt.cmd, true);
       return { exitCode: 0, workedDir: attempt.dir, workedKey: attempt.key, workedCmd: attempt.cmd, usage };
     }
-    const reason = isAuthFailure(captured) ? "auth" : isSessionLimit(captured) ? "limit" : null;
-    if (!reason || i === total - 1) break;
+    const reason = isAuthFailure(captured) ? "auth" : isSessionLimit(captured) ? "limit" : "other";
+    if (i === total - 1) break;
     handlers.onAttemptFail(attempt.label, reason);
   }
   reportToolResult(lastCmd, false, summarizeAiFailure(lastCaptured, finalExit));
@@ -35075,7 +35107,7 @@ async function runClaudeWithFailover(prompt, ai) {
     if (code === 0 && out.trim()) return { text: out.trim(), usage };
     const combined = err || out;
     lastReason = `exited ${code}: ${combined.slice(0, 500)}`;
-    if (!isAuthFailure(combined) && !isSessionLimit(combined) || i === attempts.length - 1) break;
+    if (i === attempts.length - 1) break;
   }
   throw new Error(`claude ${lastReason}`);
 }
@@ -35174,7 +35206,7 @@ async function runKnowledgeCompose(req, ai, physicRoot) {
       }
       const combined = err || out;
       lastReason = `exited ${code}: ${combined.slice(0, 500)}`;
-      if (!isAuthFailure(combined) && !isSessionLimit(combined) || i === attempts.length - 1) break;
+      if (i === attempts.length - 1) break;
     } catch (e) {
       lastReason = String(e);
       break;
@@ -36177,6 +36209,9 @@ async function ragQuery(root, queryText, k = 8) {
   }
 }
 async function ragInstall(root, model) {
+  if (!/^[A-Za-z0-9._/-]+$/.test(model)) {
+    return { ok: false, started: false, error: "invalid model name" };
+  }
   const py = await detectPython();
   if (!py.found) return { ok: false, started: false, error: "python3 not found on the worker" };
   if (existsSync10(join20(root, RAG_REL, ".installing"))) return { ok: true, started: true };
@@ -36590,7 +36625,14 @@ async function addProject(payload, profileDir2, onProgress) {
 // src/core/config-sync.ts
 import { existsSync as existsSync11, readFileSync as readFileSync15 } from "fs";
 import { join as join23 } from "path";
-var SERVER_MANAGED_KEYS = ["physicPath", "sessionSwitchPct", "perPromptTokenLimit"];
+var SERVER_MANAGED_KEYS = [
+  "physicPath",
+  "sessionSwitchPct",
+  "perPromptTokenLimit",
+  // Project AI-run timeout override mirror (ADR-0243) — the ws_token refreshes it; a Worker-config
+  // edit must not fight it. NOTE: the machine-user's own `aiRunTimeoutSec` is NOT here (operator-editable).
+  "projectAiRunTimeoutSec"
+];
 function readConfigText(profileDir2) {
   const path = join23(profileDir2, "config.json");
   if (existsSync11(path)) {
@@ -37015,7 +37057,9 @@ var WsClient = class {
         }
         writeProfileConfig(this.context.profileDir, {
           sessionSwitchPct: token.projectTokens?.sessionSwitchPct ?? 0,
-          perPromptTokenLimit: token.projectTokens?.perPromptTokenLimit ?? 0
+          perPromptTokenLimit: token.projectTokens?.perPromptTokenLimit ?? 0,
+          // Project AI-run timeout override (ADR-0243) — 0 ⇒ inherit the machine-user setting.
+          projectAiRunTimeoutSec: token.projectTokens?.aiRunTimeoutSec ?? 0
         });
         this.outboundReviewEnabled = token.outboundReview?.enabled === true;
         this.restrictToFolder = token.aiRestrictToFolder === true;
@@ -37636,6 +37680,10 @@ var WsClient = class {
    */
   async runAiPrompt(prompt, commandId, origin) {
     const config = readProfileConfig(this.context.profileDir);
+    const projectTimeoutSec = config.projectAiRunTimeoutSec ?? 0;
+    const machineTimeoutSec = config.aiRunTimeoutSec ?? 0;
+    const timeoutSec = projectTimeoutSec > 0 ? projectTimeoutSec : machineTimeoutSec;
+    const aiRunTimeoutMs = timeoutSec > 0 ? timeoutSec * 1e3 : 0;
     const perPromptLimit = config.perPromptTokenLimit ?? 0;
     if (perPromptLimit > 0) {
       const estimated = estimateTokens(prompt);
@@ -37754,7 +37802,7 @@ var WsClient = class {
         this.send(WsChannels.COMMAND_OUTPUT, { commandId, seq: seq++, chunk: `${text}
 `, log: true });
       }
-    });
+    }, aiRunTimeoutMs);
     this.bus.endBusy(plan.cmd);
     const profileLabel = result.workedDir ? profileDisplayLabel(result.workedDir) : null;
     if (result.workedDir) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4pm/cli",
-  "version": "1.4.12",
+  "version": "1.4.20",
   "private": false,
   "description": "4PM CLI — drives Claude/Codex CLIs on AI worker machines (Node + TypeScript)",
   "license": "LicenseRef-4PM-Source-Available",