@a2f0/agent-tool 0.1.47 → 0.1.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@a2f0/agent-tool",
-  "version": "0.1.47",
+  "version": "0.1.49",
   "packageManager": "bun@1.4.4",
   "type": "module",
   "description": "Portable cross-agent review, PR workflows, and shared skills",

package/src/cli.ts

@@ -16,7 +16,6 @@ import { bumpVersions, checkVersions, planVersions } from "./version/bumpVersion
 import { prepareVersions } from "./version/prepareVersions";
 import { resolveVersionConflicts } from "./version/resolveVersionConflicts";
 import { openPr } from "./pr/openPr";
-import { squashMerge } from "./pr/squashMerge";
 import metadata from "../package.json";
 import { runCommand } from "./commands/run";
 import { inspectLog } from "./commands/output";
@@ -25,7 +24,7 @@ import { branchCommand } from "./workflows/branch";
 import { commitsCommand, binariesCommand, gateCommand } from "./workflows/checks";
 import { hooksCommand } from "./workflows/hooks";
 import { repoCommand, policyCommand, toolchainCommand } from "./workflows/repository";
-import { prWorkflowCommand } from "./workflows/pr";
+import { mergeReviewedHead, prWorkflowCommand } from "./workflows/pr";
 import { releaseCommand } from "./release/commands";
 import { checkoutRoot } from "./workflows/core";
 import { procCommand, teardownCommand } from "./processes/commands";
@@ -251,7 +250,7 @@ export function main(argv = process.argv.slice(2)): number | Promise<number> {
     }
     usage(action === "merge" && args.length === 3, "Usage: agent-tool pr merge <subject-or-empty> <reviewed-head-oid> <base-branch>");
     usage(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i.test(args[1]!), "Merge requires a full reviewed HEAD OID.");
-    return squashMerge(root, args[0], args[1], args[2]);
+    return mergeReviewedHead(root, args[0], args[1], args[2]);
   }
   if (command === "versions") {
     const action = args.shift();

package/src/git/prContext.ts

@@ -1,5 +1,6 @@
 import { gitEnvironment } from "./environment";
-import { execFileSync, spawnSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
+import { boundedExecFileSync } from "../system/boundedCalls";
 import { randomUUID } from "node:crypto";
 
 import { viewCurrentBranchPr } from "./currentBranchPr";
@@ -30,7 +31,7 @@ interface SpawnResult {
 export const MAX_BUFFER_BYTES = 512 * 1024 * 1024;
 
 export function run(command: string, args: string[]): string {
-  return execFileSync(command, args, {
+  return boundedExecFileSync(command, args, {
     env: gitEnvironment(),
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],

package/src/release/commands.ts

@@ -5,6 +5,7 @@ import { decidePublish, readRegistryState } from "./npm";
 import { assert, flag, json, oid, option, output, poll, repository, timeoutOptions } from "../workflows/core";
 
 function packageName(name: unknown): asserts name is string { assert(typeof name === "string" && /^(?:@[a-z0-9._-]+\/)?[a-z0-9][a-z0-9._-]*$/.test(name), "Invalid npm package name."); }
+export const RELEASE_TIMEOUT_SECONDS = 3600;
 export interface ReleaseRun { databaseId: number; status: string; conclusion: string; headSha: string; url: string }
 /**
  * Downloads and checks the published tarball. Resolves null only when the
@@ -64,7 +65,8 @@ export async function releaseCommand(args: string[]): Promise<number> {
     output({ name: manifest.name, version: manifest.version, privateSource: manifest.private === true, ...decision }); return 0;
   }
   const workflow = option(args, "--workflow");
-  const options = timeoutOptions(args);
+  // Publishing runs commonly take 35-45 minutes before npm propagation, so wait an hour unless told otherwise.
+  const options = timeoutOptions(args, RELEASE_TIMEOUT_SECONDS);
   assert(action === "verify" && args.length === 3 && workflow, "Usage: release verify <package> <version> <merge-oid> --workflow <name> [--timeout seconds] [--interval seconds]");
   const [name, version, commit] = args as [string, string, string];
   packageName(name); oid(commit);

package/src/runAgentToolAction.ts

@@ -1,10 +1,10 @@
 import { openPr } from "./pr/openPr";
-import { squashMerge } from "./pr/squashMerge";
 import { solicitClaudeCodeReview } from "./review/solicitClaudeCodeReview";
 import { solicitCodexReview } from "./review/solicitCodexReview";
 import { solicitOpencodeReview } from "./review/solicitOpencodeReview";
 import { bumpVersions, checkVersions } from "./version/bumpVersions";
 import { resolveVersionConflicts } from "./version/resolveVersionConflicts";
+import { mergeReviewedHead } from "./workflows/pr";
 
 const AGENT_TOOL_USAGE =
   "Usage: agent-tool <solicitClaudeCodeReview|solicitCodexReview|solicitOpencodeReview|openPr|squashMerge|bumpVersions|checkVersions|resolveVersionConflicts> [args]\n";
@@ -36,7 +36,8 @@ const defaultActions: AgentToolActions = {
   solicitClaudeCodeReview,
   solicitCodexReview,
   solicitOpencodeReview,
-  squashMerge,
+  // A reviewed HEAD merges only after every preflight gate passes.
+  squashMerge: mergeReviewedHead,
 };
 
 function assertMaximumPositionals(

package/src/system/boundedCalls.ts

@@ -0,0 +1,44 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { execFileSync, type ExecFileSyncOptionsWithStringEncoding } from "node:child_process";
+
+/**
+ * Bounds for each external command a wait runs. A poll checks its deadline only
+ * between inspections, so one hung `gh` or `git ls-remote` would otherwise keep
+ * the wait running forever. Each call may take the time left before the
+ * deadline, but at least `minMs` so the last inspection can still finish, and
+ * never more than `maxMs`. Mutable for tests.
+ */
+export const CALL_LIMITS = { minMs: 15_000, maxMs: 120_000 };
+
+// Scoped per async context, so overlapping waits never see each other's deadline.
+const deadlines = new AsyncLocalStorage<number>();
+
+/** Run `inspect` with every bounded call limited by `until`, the wait's deadline. */
+export async function withCallDeadline<T>(until: number, inspect: () => T | Promise<T>): Promise<T> {
+  return await deadlines.run(until, inspect);
+}
+
+function currentLimit(): number | undefined {
+  const deadline = deadlines.getStore();
+  if (deadline === undefined) return undefined;
+  return Math.min(CALL_LIMITS.maxMs, Math.max(CALL_LIMITS.minMs, deadline - Date.now()));
+}
+
+/**
+ * `execFileSync` that, inside a wait, is killed and fails once its call limit
+ * passes. Bun returns as soon as the command itself is killed, even when a
+ * descendant such as ssh still holds its output pipes; that descendant is left
+ * to exit on its own, as it would after an interrupted command.
+ */
+export function boundedExecFileSync(command: string, args: string[], options: ExecFileSyncOptionsWithStringEncoding): string {
+  const timeout = currentLimit();
+  try {
+    return execFileSync(command, args, timeout === undefined ? options : { ...options, timeout, killSignal: "SIGKILL" });
+  } catch (error) {
+    const failure = error as NodeJS.ErrnoException;
+    if (timeout !== undefined && failure.code === "ETIMEDOUT") {
+      throw new Error(`${[command, ...args.slice(0, 2)].join(" ")} did not finish within ${Math.ceil(timeout / 1000)} seconds; stopped it.`);
+    }
+    throw error;
+  }
+}

package/src/workflows/core.ts

@@ -1,13 +1,14 @@
-import { execFileSync, spawnSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
 import { lstatSync, realpathSync, writeSync } from "node:fs";
 import path from "node:path";
 import { gitEnvironment } from "../git/environment";
+import { boundedExecFileSync, withCallDeadline } from "../system/boundedCalls";
 
 export function output(value: unknown): void { writeSync(1, `${JSON.stringify(value, null, 2)}\n`); }
 export function assert(condition: unknown, message: string): asserts condition { if (!condition) throw new Error(message); }
 export function oid(value: string): string { assert(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i.test(value), "Expected a full commit OID."); return value; }
 export function read(command: string, args: string[], cwd = process.cwd()): string {
-  return execFileSync(command, args, { cwd, env: gitEnvironment(), encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], maxBuffer: 64 * 1024 * 1024 }).trimEnd();
+  return boundedExecFileSync(command, args, { cwd, env: gitEnvironment(), encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], maxBuffer: 64 * 1024 * 1024 }).trimEnd();
 }
 export function git(args: string[], cwd = process.cwd()): string { return read("git", args, cwd); }
 export function json<T>(args: string[]): T { return JSON.parse(read("gh", args)) as T; }
@@ -88,9 +89,10 @@ export function timeoutOptions(args: string[], defaultSeconds = 900): { timeoutM
 export async function poll<T>(inspect: () => { done: boolean; value: T } | Promise<{ done: boolean; value: T }>, options: { timeoutMs: number; intervalMs: number }): Promise<T> {
   const deadline = Date.now() + options.timeoutMs;
   while (true) {
-    const result = await inspect();
+    // Each external call inside an inspection is bounded too, so a hung one cannot outlast the wait.
+    const result = await withCallDeadline(deadline, inspect);
     if (result.done) return result.value;
-    assert(Date.now() < deadline, `Timed out waiting: ${JSON.stringify(result.value)}`);
+    assert(Date.now() < deadline, `Timed out waiting: ${JSON.stringify(result.value)} Pass --timeout <seconds> to wait longer.`);
     await new Promise(resolve => setTimeout(resolve, Math.min(options.intervalMs, deadline - Date.now())));
   }
 }

package/src/workflows/pr.ts

@@ -4,11 +4,11 @@ import { closeSync, readFileSync } from "node:fs";
 import { createLog } from "../commands/logFile";
 import { DEFAULT_LIMITS, logTail, outputLimit } from "../commands/output";
 import { loadConfig } from "../config";
-import { remoteBranchHead, resolvePr, resolveRepositoryGitUrl } from "../git/prContext";
+import { remoteBranchHead, resolveFreshBaseRef, resolvePr, resolveRepositoryGitUrl } from "../git/prContext";
 import { assertMergeChecks } from "../pr/mergeChecks";
 import { assertStrictBaseFreshness } from "../pr/baseFreshness";
 import { baseFreshness, behindReason, cancelRuns } from "./prFreshness";
-import { resolvePullRequestMergeTarget } from "../pr/squashMerge";
+import { resolvePullRequestMergeTarget, squashMerge } from "../pr/squashMerge";
 import { planVersions } from "../version/bumpVersions";
 import { assert, clean, currentBranch, git, head, json, oid, option, flag, output, poll, timeoutOptions } from "./core";
 
@@ -86,6 +86,23 @@ export function preflight(expectedHead: string, baseBranch: string, baseOid: str
   return { ok: true, repo: identity.repo, pr: pr.number, url: pr.url, headOid: expectedHead, baseBranch, baseOid, checks: checks.checks };
 }
 
+/**
+ * Merge a reviewed HEAD only after every preflight gate passes against the
+ * freshly fetched live base: a skipped, failed, or stale preflight run never
+ * leads to a merge. Without a reviewed HEAD (legacy manual form) only the
+ * merge helper's own checks apply.
+ */
+export function mergeReviewedHead(rootDir: string, subject?: string, expectedHead?: string, baseBranch?: string): number {
+  if (!expectedHead) return squashMerge(rootDir, subject, expectedHead, baseBranch);
+  const identity = resolvePr();
+  const branch = baseBranch ?? resolvePullRequestMergeTarget(identity).baseRefName;
+  const baseOid = resolveFreshBaseRef(identity.repo, branch);
+  try { preflight(expectedHead, branch, baseOid); }
+  catch (error) { throw new Error(`Refusing to merge: preflight failed against live ${branch} ${baseOid}: ${(error as Error).message}`); }
+  // Bind the merge to the branch that passed preflight, inferred or given, so a retarget in between is refused.
+  return squashMerge(rootDir, subject, expectedHead, branch);
+}
+
 interface Comment { id: string; databaseId: number; body: string; url: string; author: { login: string } | null }
 interface Page<T> { nodes: T[]; pageInfo: { hasNextPage: boolean; endCursor: string | null } }
 interface Thread { id: string; isResolved: boolean; isOutdated: boolean; path: string; line: number | null; comments: Page<Comment> }