@agentuity/cli 1.0.11 → 1.0.13

package/src/cmd/upgrade/npm-availability.test.ts

@@ -0,0 +1,57 @@
+import { test, expect, beforeAll, afterAll } from 'bun:test';
+import { spawnWithTimeout } from './npm-availability';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+// bun info requires a package.json in its cwd, and isVersionAvailableOnNpm
+// uses tmpdir() as cwd. Ensure a minimal package.json exists there for tests.
+const tmpPackageJson = join(tmpdir(), 'package.json');
+let createdPackageJson = false;
+
+beforeAll(async () => {
+	const file = Bun.file(tmpPackageJson);
+	if (!(await file.exists())) {
+		await Bun.write(file, '{}');
+		createdPackageJson = true;
+	}
+});
+
+afterAll(async () => {
+	if (createdPackageJson) {
+		const { unlink } = await import('node:fs/promises');
+		await unlink(tmpPackageJson).catch(() => {});
+	}
+});
+
+test('spawnWithTimeout kills process on timeout', async () => {
+	// spawn a command that hangs with a short timeout (500ms)
+	await expect(
+		spawnWithTimeout(['bun', '-e', 'setTimeout(()=>{},60000)'], { timeout: 500 })
+	).rejects.toThrow(/timed out/);
+});
+
+test('spawnWithTimeout returns result when command completes in time', async () => {
+	const result = await spawnWithTimeout(['bun', '-e', "console.log('hello')"], {
+		timeout: 5_000,
+	});
+	expect(result.exitCode).toBe(0);
+	expect(result.stdout.toString().trim()).toBe('hello');
+});
+
+test('spawnWithTimeout returns non-zero exit code without throwing', async () => {
+	const result = await spawnWithTimeout(['bun', '-e', 'process.exit(1)'], { timeout: 5_000 });
+	expect(result.exitCode).not.toBe(0);
+});
+
+test('isVersionAvailableOnNpm returns true for a known version', async () => {
+	const { isVersionAvailableOnNpm } = await import('./npm-availability');
+	// Use a known-good old version that definitely exists
+	const result = await isVersionAvailableOnNpm('1.0.10');
+	expect(result).toBe(true);
+}, 15_000); // generous test timeout but the function itself has 10s subprocess timeout
+
+test('isVersionAvailableOnNpm returns false for non-existent version', async () => {
+	const { isVersionAvailableOnNpm } = await import('./npm-availability');
+	const result = await isVersionAvailableOnNpm('999.999.999');
+	expect(result).toBe(false);
+}, 15_000);

package/src/cmd/upgrade/npm-availability.ts

@@ -3,11 +3,91 @@
  * Used to verify a version is available via bun's resolver before attempting upgrade.
  */
 
-import { $ } from 'bun';
 import { tmpdir } from 'node:os';
 
 const PACKAGE_SPEC = '@agentuity/cli';
 
+/** Default timeout for `bun info` subprocess calls (10 seconds) */
+const BUN_INFO_TIMEOUT_MS = 10_000;
+
+/** Default timeout for install (`bun add -g`) subprocess calls (30 seconds) */
+const INSTALL_TIMEOUT_MS = 30_000;
+
+/**
+ * Run a command via Bun.spawn with a timeout that kills the process.
+ * Returns { exitCode, stdout, stderr } similar to Bun's $ shell result.
+ */
+export async function spawnWithTimeout(
+	cmd: string[],
+	options: { cwd?: string; timeout: number }
+): Promise<{ exitCode: number; stdout: Buffer; stderr: Buffer }> {
+	const proc = Bun.spawn(cmd, {
+		cwd: options.cwd,
+		stdout: 'pipe',
+		stderr: 'pipe',
+	});
+
+	let timedOut = false;
+	const timer = setTimeout(() => {
+		timedOut = true;
+		proc.kill();
+	}, options.timeout);
+
+	try {
+		const [exitCode, stdoutBytes, stderrBytes] = await Promise.all([
+			proc.exited,
+			new Response(proc.stdout).arrayBuffer(),
+			new Response(proc.stderr).arrayBuffer(),
+		]);
+
+		if (timedOut) {
+			throw new Error(`Command timed out after ${options.timeout}ms: ${cmd.join(' ')}`);
+		}
+
+		return {
+			exitCode,
+			stdout: Buffer.from(stdoutBytes),
+			stderr: Buffer.from(stderrBytes),
+		};
+	} finally {
+		clearTimeout(timer);
+	}
+}
+
+/**
+ * Sentinel error thrown exclusively by withTimeout so the retry loop can
+ * distinguish a genuine timeout from other failures (e.g. permission errors).
+ */
+class TimeoutError extends Error {
+	constructor(description: string, timeoutMs: number) {
+		super(`${description} timed out after ${timeoutMs}ms`);
+		this.name = 'TimeoutError';
+	}
+}
+
+/**
+ * Race a promise against a timeout. Unlike spawnWithTimeout (which kills a process),
+ * this is a generic wrapper for any async operation (e.g. the installFn callback).
+ *
+ * Throws a {@link TimeoutError} (not a plain Error) so callers can tell
+ * timeouts apart from other exceptions.
+ */
+async function withTimeout<T>(
+	promise: Promise<T>,
+	timeoutMs: number,
+	description: string
+): Promise<T> {
+	let timer: ReturnType<typeof setTimeout>;
+	const timeoutPromise = new Promise<never>((_, reject) => {
+		timer = setTimeout(() => reject(new TimeoutError(description, timeoutMs)), timeoutMs);
+	});
+	try {
+		return await Promise.race([promise, timeoutPromise]);
+	} finally {
+		clearTimeout(timer!);
+	}
+}
+
 /**
  * Check if a specific version of @agentuity/cli is resolvable by bun.
  * Uses `bun info` to verify bun's own resolver/CDN can see the version,
@@ -20,10 +100,10 @@ const PACKAGE_SPEC = '@agentuity/cli';
 export async function isVersionAvailableOnNpm(version: string): Promise<boolean> {
 	const normalizedVersion = version.replace(/^v/, '');
 	try {
-		const result = await $`bun info ${PACKAGE_SPEC}@${normalizedVersion} --json`
-			.cwd(tmpdir())
-			.quiet()
-			.nothrow();
+		const result = await spawnWithTimeout(
+			['bun', 'info', `${PACKAGE_SPEC}@${normalizedVersion}`, '--json'],
+			{ cwd: tmpdir(), timeout: BUN_INFO_TIMEOUT_MS }
+		);
 		if (result.exitCode !== 0) {
 			return false;
 		}
@@ -147,7 +227,22 @@ export async function installWithRetry(
 	let delay = initialDelayMs;
 
 	for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-		const result = await installFn();
+		let result: { exitCode: number; stderr: Buffer };
+		try {
+			result = await withTimeout(installFn(), INSTALL_TIMEOUT_MS, 'Install command');
+		} catch (error) {
+			// Only retry on timeouts — non-timeout errors (permissions, disk, etc.) are fatal
+			if (!(error instanceof TimeoutError)) {
+				throw error;
+			}
+			if (attempt === maxAttempts) {
+				throw error;
+			}
+			onRetry?.(attempt, delay);
+			await new Promise((resolve) => setTimeout(resolve, delay));
+			delay = Math.min(Math.round(delay * multiplier), maxDelayMs);
+			continue;
+		}
 
 		if (result.exitCode === 0) {
 			return result;

package/src/version-check.ts

@@ -4,7 +4,6 @@ import { fetchLatestVersion } from './cmd/upgrade';
 import { getVersion, getCompareUrl, getReleaseUrl, toTag } from './version';
 import * as tui from './tui';
 import { saveConfig } from './config';
-import { $ } from 'bun';
 import { tmpdir } from 'node:os';
 import { getExecutingAgent } from './agent-detection';
 
@@ -174,13 +173,14 @@ async function performUpgrade(logger: Logger, targetVersion: string): Promise<vo
 
 		// Use bun to install the specific version globally with retry for CDN propagation delays
 		// Run from tmpdir to avoid interference from any local package.json/node_modules
-		const { installWithRetry } = await import('./cmd/upgrade/npm-availability');
+		const { installWithRetry, spawnWithTimeout } = await import('./cmd/upgrade/npm-availability');
 		await installWithRetry(
 			async () => {
-				const result = await $`bun add -g @agentuity/cli@${npmVersion}`
-					.cwd(tmpdir())
-					.quiet()
-					.nothrow();
+				// spawnWithTimeout kills the process if it exceeds 30s
+				const result = await spawnWithTimeout(
+					['bun', 'add', '-g', `@agentuity/cli@${npmVersion}`],
+					{ cwd: tmpdir(), timeout: 30_000 }
+				);
 				return { exitCode: result.exitCode, stderr: result.stderr };
 			},
 			{