@a2f0/agent-tool 0.1.46 → 0.1.48

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@a2f0/agent-tool",
-  "version": "0.1.46",
+  "version": "0.1.48",
   "packageManager": "bun@1.4.4",
   "type": "module",
   "description": "Portable cross-agent review, PR workflows, and shared skills",

package/src/cli.ts

@@ -1,4 +1,3 @@
-import { execFileSync } from "node:child_process";
 import { readFileSync, writeFileSync, writeSync } from "node:fs";
 import path from "node:path";
 import { DEFAULT_CONFIG, loadConfig } from "./config";
@@ -28,6 +27,7 @@ import { hooksCommand } from "./workflows/hooks";
 import { repoCommand, policyCommand, toolchainCommand } from "./workflows/repository";
 import { prWorkflowCommand } from "./workflows/pr";
 import { releaseCommand } from "./release/commands";
+import { checkoutRoot } from "./workflows/core";
 import { procCommand, teardownCommand } from "./processes/commands";
 
 export const HELP = `agent-tool ${metadata.version}
@@ -96,9 +96,7 @@ returned; inspect VERDICT before shipping. Skill install previews unless --apply
 
 function output(value: unknown): void { writeSync(1, `${JSON.stringify(value, null, 2)}\n`); }
 function usage(condition: boolean, message: string): void { if (!condition) throw new Error(message); }
-function gitRoot(): string {
-  return execFileSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
-}
+function gitRoot(): string { return checkoutRoot(); }
 
 export function main(argv = process.argv.slice(2)): number | Promise<number> {
   const args = [...argv];

package/src/git/prContext.ts

@@ -1,5 +1,6 @@
 import { gitEnvironment } from "./environment";
-import { execFileSync, spawnSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
+import { boundedExecFileSync } from "../system/boundedCalls";
 import { randomUUID } from "node:crypto";
 
 import { viewCurrentBranchPr } from "./currentBranchPr";
@@ -30,7 +31,7 @@ interface SpawnResult {
 export const MAX_BUFFER_BYTES = 512 * 1024 * 1024;
 
 export function run(command: string, args: string[]): string {
-  return execFileSync(command, args, {
+  return boundedExecFileSync(command, args, {
     env: gitEnvironment(),
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],

package/src/release/commands.ts

@@ -5,6 +5,7 @@ import { decidePublish, readRegistryState } from "./npm";
 import { assert, flag, json, oid, option, output, poll, repository, timeoutOptions } from "../workflows/core";
 
 function packageName(name: unknown): asserts name is string { assert(typeof name === "string" && /^(?:@[a-z0-9._-]+\/)?[a-z0-9][a-z0-9._-]*$/.test(name), "Invalid npm package name."); }
+export const RELEASE_TIMEOUT_SECONDS = 3600;
 export interface ReleaseRun { databaseId: number; status: string; conclusion: string; headSha: string; url: string }
 /**
  * Downloads and checks the published tarball. Resolves null only when the
@@ -64,7 +65,8 @@ export async function releaseCommand(args: string[]): Promise<number> {
     output({ name: manifest.name, version: manifest.version, privateSource: manifest.private === true, ...decision }); return 0;
   }
   const workflow = option(args, "--workflow");
-  const options = timeoutOptions(args);
+  // Publishing runs commonly take 35-45 minutes before npm propagation, so wait an hour unless told otherwise.
+  const options = timeoutOptions(args, RELEASE_TIMEOUT_SECONDS);
   assert(action === "verify" && args.length === 3 && workflow, "Usage: release verify <package> <version> <merge-oid> --workflow <name> [--timeout seconds] [--interval seconds]");
   const [name, version, commit] = args as [string, string, string];
   packageName(name); oid(commit);

package/src/system/boundedCalls.ts

@@ -0,0 +1,44 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { execFileSync, type ExecFileSyncOptionsWithStringEncoding } from "node:child_process";
+
+/**
+ * Bounds for each external command a wait runs. A poll checks its deadline only
+ * between inspections, so one hung `gh` or `git ls-remote` would otherwise keep
+ * the wait running forever. Each call may take the time left before the
+ * deadline, but at least `minMs` so the last inspection can still finish, and
+ * never more than `maxMs`. Mutable for tests.
+ */
+export const CALL_LIMITS = { minMs: 15_000, maxMs: 120_000 };
+
+// Scoped per async context, so overlapping waits never see each other's deadline.
+const deadlines = new AsyncLocalStorage<number>();
+
+/** Run `inspect` with every bounded call limited by `until`, the wait's deadline. */
+export async function withCallDeadline<T>(until: number, inspect: () => T | Promise<T>): Promise<T> {
+  return await deadlines.run(until, inspect);
+}
+
+function currentLimit(): number | undefined {
+  const deadline = deadlines.getStore();
+  if (deadline === undefined) return undefined;
+  return Math.min(CALL_LIMITS.maxMs, Math.max(CALL_LIMITS.minMs, deadline - Date.now()));
+}
+
+/**
+ * `execFileSync` that, inside a wait, is killed and fails once its call limit
+ * passes. Bun returns as soon as the command itself is killed, even when a
+ * descendant such as ssh still holds its output pipes; that descendant is left
+ * to exit on its own, as it would after an interrupted command.
+ */
+export function boundedExecFileSync(command: string, args: string[], options: ExecFileSyncOptionsWithStringEncoding): string {
+  const timeout = currentLimit();
+  try {
+    return execFileSync(command, args, timeout === undefined ? options : { ...options, timeout, killSignal: "SIGKILL" });
+  } catch (error) {
+    const failure = error as NodeJS.ErrnoException;
+    if (timeout !== undefined && failure.code === "ETIMEDOUT") {
+      throw new Error(`${[command, ...args.slice(0, 2)].join(" ")} did not finish within ${Math.ceil(timeout / 1000)} seconds; stopped it.`);
+    }
+    throw error;
+  }
+}

package/src/workflows/core.ts

@@ -1,12 +1,14 @@
-import { execFileSync, spawnSync } from "node:child_process";
-import { writeSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { lstatSync, realpathSync, writeSync } from "node:fs";
+import path from "node:path";
 import { gitEnvironment } from "../git/environment";
+import { boundedExecFileSync, withCallDeadline } from "../system/boundedCalls";
 
 export function output(value: unknown): void { writeSync(1, `${JSON.stringify(value, null, 2)}\n`); }
 export function assert(condition: unknown, message: string): asserts condition { if (!condition) throw new Error(message); }
 export function oid(value: string): string { assert(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i.test(value), "Expected a full commit OID."); return value; }
 export function read(command: string, args: string[], cwd = process.cwd()): string {
-  return execFileSync(command, args, { cwd, env: gitEnvironment(), encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], maxBuffer: 64 * 1024 * 1024 }).trimEnd();
+  return boundedExecFileSync(command, args, { cwd, env: gitEnvironment(), encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], maxBuffer: 64 * 1024 * 1024 }).trimEnd();
 }
 export function git(args: string[], cwd = process.cwd()): string { return read("git", args, cwd); }
 export function json<T>(args: string[]): T { return JSON.parse(read("gh", args)) as T; }
@@ -23,8 +25,37 @@ export function currentBranch(): string {
   assert(branch, "Detached HEAD; supply a branch name to checks or attach a branch before mutations.");
   return branch;
 }
+/**
+ * Git skips a `.git` it cannot open (unreadable, or without HEAD while it is
+ * rewritten) and keeps searching upward, so a checkout nested inside another
+ * repository, such as a workspace's `checkouts/<name>`, would silently resolve
+ * to the outer one. Refuse that instead of acting on another repository.
+ */
+export function assertOwnCheckout(root: string, cwd = process.cwd()): void {
+  const top = realpathSync(root);
+  const relative = path.relative(top, realpathSync(cwd));
+  if (!relative || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) return;
+  let current = top;
+  for (const part of relative.split(path.sep)) {
+    current = path.join(current, part);
+    assert(!hasEntry(path.join(current, ".git")), `${current} has its own .git, but Git resolved the enclosing repository ${top}; the nested checkout's Git directory is unreadable or incomplete (mid-checkout?). Retry once it is readable.`);
+  }
+}
+/** Whether anything, even a dangling link, exists at `file`; an entry that cannot be inspected counts. */
+function hasEntry(file: string): boolean {
+  try { lstatSync(file); return true; } catch (error) { return (error as NodeJS.ErrnoException).code !== "ENOENT"; }
+}
+/** The top level of the checkout Git resolves from `cwd`, never an enclosing repository. */
+export function checkoutRoot(cwd = process.cwd()): string {
+  const root = git(["rev-parse", "--show-toplevel"], cwd);
+  assertOwnCheckout(root, cwd);
+  return root;
+}
 export interface Repository { nameWithOwner: string; defaultBranchRef: { name: string }; url: string; sshUrl: string }
 export function repository(): Repository {
+  // gh resolves the repository from the same Git discovery; outside any checkout it may still use GH_REPO.
+  const top = spawnSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], env: gitEnvironment() });
+  if (top.status === 0) assertOwnCheckout(top.stdout.trim());
   const repo = json<Repository>(["repo", "view", "--json", "nameWithOwner,defaultBranchRef,url,sshUrl"]);
   assert(/^[^/\s]+\/[^/\s]+$/.test(repo.nameWithOwner) && repo.defaultBranchRef?.name, "Could not resolve repository identity and default branch.");
   return repo;
@@ -58,9 +89,10 @@ export function timeoutOptions(args: string[], defaultSeconds = 900): { timeoutM
 export async function poll<T>(inspect: () => { done: boolean; value: T } | Promise<{ done: boolean; value: T }>, options: { timeoutMs: number; intervalMs: number }): Promise<T> {
   const deadline = Date.now() + options.timeoutMs;
   while (true) {
-    const result = await inspect();
+    // Each external call inside an inspection is bounded too, so a hung one cannot outlast the wait.
+    const result = await withCallDeadline(deadline, inspect);
     if (result.done) return result.value;
-    assert(Date.now() < deadline, `Timed out waiting: ${JSON.stringify(result.value)}`);
+    assert(Date.now() < deadline, `Timed out waiting: ${JSON.stringify(result.value)} Pass --timeout <seconds> to wait longer.`);
     await new Promise(resolve => setTimeout(resolve, Math.min(options.intervalMs, deadline - Date.now())));
   }
 }