@astrosheep/keiyaku 2.9.8 → 2.9.10

package/build/flow-error.js

@@ -64,6 +64,8 @@ export function resolveFlowErrorHints(code, context, facts) {
             return [`Next: open an arc with \`${context.arcToolName}\`, then use \`${context.renewToolName}\` when delivery must follow the current base, or \`${context.closeToolName}\` to settle it.`];
         case "CONTRACT_AMBIGUOUS":
             return ["Address a specific contract workspace, or use `call --bare` to run without contract attachment."];
+        case "TASK_AMBIGUOUS":
+            return ["Pass one complete task coordinate from the listed candidates."];
         case "UNKNOWN_COMMAND":
             return ["Run `keiyaku --help` to inspect available commands."];
         case "EMPTY_PARAM":
@@ -77,13 +79,11 @@ export function resolveFlowErrorHints(code, context, facts) {
         case "MISSING_PROTOCOL_FILES":
             return ["Required protocol file is missing (`KEIYAKU.md`)."];
         case "CLOSE_MERGE_CONFLICT":
-            return [`Open a Keiyaku recovery session with \`keiyaku ${context.renewToolName} --resolve\`.`];
+            return [];
         case "RENEW_COORDINATE_DRIFT":
             return [`Restore the delivery to its ledger-recorded history with Git reflog, then retry \`keiyaku ${context.renewToolName}\`.`];
-        case "RENEW_SESSION_OPEN":
-            return [`Continue the owned rewrite with \`keiyaku ${context.renewToolName} --continue\`, or restore it with \`keiyaku ${context.renewToolName} --abort\`.`];
-        case "RENEW_SESSION_NOT_FOUND":
-            return [`No recovery session is open; run \`keiyaku ${context.renewToolName}\` normally.`];
+        case "RENEW_SCRATCH_NOT_FOUND":
+            return [`No renew conflict scratch is open; run \`keiyaku ${context.renewToolName}\` normally.`];
         case "CLOSE_QUALITY_GATE_FAILED":
             return [`CLAIM denied: a configured verification command failed. Use \`${context.arcToolName}\` after addressing the failure before petitioning again.`];
         case "INVALID_BRANCH_TITLE":
@@ -95,9 +95,9 @@ export function resolveFlowErrorHints(code, context, facts) {
         case "FROM_DRAFT_NOT_FOUND":
             return ["The path in `from_draft` does not exist. `from_draft` must reference an existing file path (absolute or relative to `cwd`)."];
         case "INVALID_KEIYAKU_DRAFT":
-            return ["Invalid draft/input. Use a `# <title>` heading with non-empty `## Objective` and `## Scope` sections (or the equivalent shape in `from_draft`)."];
+            return ["Invalid draft/input. Use a `# <title>` heading with non-empty `## Context`, `## Objective`, `## Design`, `## Scope`, `## Criteria`, and `## Verification` sections (or the equivalent shape in `from_draft`)."];
         case "BIND_TASK_INCOMPLETE":
-            return ["Task supplies name/objective defaults; pipe only the missing sections as partial contract Markdown on stdin."];
+            return ["Task supplies title/objective defaults; pipe only the missing sections as partial contract Markdown on stdin."];
         case "KEIYAKU_FILE_EXISTS":
             return [`\`${context.bindToolName}\` requires a clean slate. \`KEIYAKU.md\` must be removed before starting.`];
         case "DETACHED_HEAD":

package/build/generated/version.js

@@ -1,3 +1,3 @@
 // Generated into build output by scripts/build.mjs
-export const VERSION = "2.9.8";
-export const GIT_HASH = "c9cfce1";
+export const VERSION = "2.9.10";
+export const GIT_HASH = "b4c38cc";

package/build/git/core.js

@@ -4,6 +4,28 @@ import { normalizeFilesystemCoordinate } from "../fs/path-coordinate.js";
 import { getConfig } from "../config/env.js";
 import { appendDebugBlock } from "../telemetry/debug-log.js";
 const GIT_ERROR_COMPACT_MAX_CHARS = 4000;
+export const GIT_ABORT_FORCE_KILL_MS = 250;
+/** Terminate one non-detached Git child and wait until Node drains its stdio close. */
+export async function terminateGitChild(child, closed, graceMs = GIT_ABORT_FORCE_KILL_MS) {
+    if (child.exitCode === null && child.signalCode === null)
+        child.kill("SIGTERM");
+    let grace;
+    const exited = await Promise.race([
+        closed.then(() => true),
+        new Promise((resolve) => {
+            grace = setTimeout(() => resolve(false), graceMs);
+            grace.unref();
+        }),
+    ]);
+    if (grace)
+        clearTimeout(grace);
+    // Only the close event proves process exit and stdio drain. `killed` and
+    // `signalCode` merely report signal delivery and can be set while a handler
+    // keeps the child alive.
+    if (!exited)
+        child.kill("SIGKILL");
+    await closed;
+}
 export const MISSING_GIT_CONFIG_PATTERNS = ["No such section or key"];
 export const NOT_GIT_REPOSITORY_PATTERNS = ["not a git repository"];
 export const MISSING_HEAD_PATTERNS = [
@@ -12,6 +34,10 @@ export const MISSING_HEAD_PATTERNS = [
     "unknown revision or path not in the working tree",
     "bad revision 'HEAD'",
 ];
+/** Accept only a complete object id from either supported Git object format. */
+export function isFullGitObjectId(value) {
+    return /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(value);
+}
 /** Git is an optional adapter for directory-local product surfaces. */
 export function isGitExecutableUnavailable(error) {
     const source = (error ?? {});
@@ -94,11 +120,18 @@ export function createGit(cwd) {
     const git = simpleGit(normalizeFilesystemCoordinate(cwd), {
         timeout: { block: timeoutMs, stdErr: true, stdOut: true },
     });
-    git.env("GIT_TERMINAL_PROMPT", "0");
-    git.env("GCM_INTERACTIVE", "Never");
-    git.env("GIT_MERGE_AUTOEDIT", "no");
-    git.env("LC_ALL", "C");
-    git.env("PATH", process.env.PATH ?? "");
+    // simple-git replaces its child environment when configured through env().
+    // Preserve trace controls explicitly without admitting unrelated ambient Git
+    // behavior such as a pager into command execution.
+    const traceEnvironment = Object.fromEntries(Object.entries(process.env).filter(([key]) => key.startsWith("GIT_TRACE2")));
+    git.env({
+        ...traceEnvironment,
+        GIT_TERMINAL_PROMPT: "0",
+        GCM_INTERACTIVE: "Never",
+        GIT_MERGE_AUTOEDIT: "no",
+        LC_ALL: "C",
+        PATH: process.env.PATH ?? "",
+    });
     return git;
 }
 /**
@@ -107,7 +140,8 @@ export function createGit(cwd) {
  * soft status codes or stdin (simple-git drops empty-stderr non-zero exits).
  * Long-lived multi-request stdin/stdout sessions use `openGitStreamingBatch`.
  */
-export async function runGitProcess(cwd, args, options) {
+export async function runGitProcessBytes(cwd, args, options) {
+    options?.signal?.throwIfAborted();
     const timeoutMs = resolveGitTimeoutMs();
     const env = gitProcessEnv(options?.env);
     return await new Promise((resolve) => {
@@ -121,19 +155,35 @@ export async function runGitProcess(cwd, args, options) {
         const stderrChunks = [];
         let settled = false;
         let timedOut = false;
+        let aborting = false;
+        let terminationPromise;
+        const closed = new Promise((resolveClosed) => child.once("close", () => resolveClosed()));
         const finish = (result) => {
             if (settled)
                 return;
             settled = true;
             clearTimeout(timeout);
+            options?.signal?.removeEventListener("abort", abort);
             resolve(result);
         };
+        const abort = () => {
+            if (aborting)
+                return;
+            aborting = true;
+            terminationPromise = terminateGitChild(child, closed);
+        };
+        options?.signal?.addEventListener("abort", abort, { once: true });
+        if (options?.signal?.aborted)
+            abort();
         const timeout = setTimeout(() => {
             timedOut = true;
             child.kill("SIGKILL");
         }, timeoutMs);
         if (options?.input !== undefined) {
-            child.stdin.end(options.input, "utf8");
+            if (typeof options.input === "string")
+                child.stdin.end(options.input, "utf8");
+            else
+                child.stdin.end(options.input);
         }
         else {
             child.stdin.end();
@@ -142,15 +192,17 @@ export async function runGitProcess(cwd, args, options) {
         child.stderr.on("data", (chunk) => stderrChunks.push(chunk));
         child.on("error", (error) => {
             finish({
-                stdout: Buffer.concat(stdoutChunks).toString("utf8"),
-                stderr: Buffer.concat(stderrChunks).toString("utf8"),
+                stdout: Buffer.concat(stdoutChunks),
+                stderr: Buffer.concat(stderrChunks),
                 status: null,
                 error,
             });
         });
-        child.on("close", (code, signal) => {
-            const stdout = Buffer.concat(stdoutChunks).toString("utf8");
-            const stderr = Buffer.concat(stderrChunks).toString("utf8");
+        child.on("close", async (code, signal) => {
+            if (terminationPromise)
+                await terminationPromise;
+            const stdout = Buffer.concat(stdoutChunks);
+            const stderr = Buffer.concat(stderrChunks);
             if (timedOut) {
                 finish({
                     stdout,
@@ -165,7 +217,9 @@ export async function runGitProcess(cwd, args, options) {
                     stdout,
                     stderr,
                     status: null,
-                    error: new Error(`git exited from signal ${signal}`),
+                    error: options?.signal?.aborted
+                        ? options.signal.reason instanceof Error ? options.signal.reason : new DOMException("The operation was aborted", "AbortError")
+                        : new Error(`git exited from signal ${signal}`),
                 });
                 return;
             }
@@ -173,3 +227,12 @@ export async function runGitProcess(cwd, args, options) {
         });
     });
 }
+export async function runGitProcess(cwd, args, options) {
+    const result = await runGitProcessBytes(cwd, args, options);
+    return {
+        stdout: result.stdout.toString("utf8"),
+        stderr: result.stderr.toString("utf8"),
+        status: result.status,
+        ...(result.error ? { error: result.error } : {}),
+    };
+}

package/build/git/refs.js

@@ -1,11 +1,22 @@
-import { createGit, errorContainsAnyPattern, MISSING_HEAD_PATTERNS, runGitProcess, wrapGitError, } from "./core.js";
-const ZERO_OBJECT_ID = "0000000000000000000000000000000000000000";
+import { isFullGitObjectId, runGitProcess, wrapGitError, } from "./core.js";
 /** Normalize a configured branch to the sole local-branch ref spelling. */
 export function normalizeLocalBranchRef(branch) {
     return branch.startsWith("refs/heads/") ? branch : `refs/heads/${branch}`;
 }
+export const REF_TRANSACTION_CAS_MISMATCH = "REF_TRANSACTION_CAS_MISMATCH";
+export const REF_TRANSACTION_NOT_COMMITTED = "REF_TRANSACTION_NOT_COMMITTED";
+export const REF_TRANSACTION_INDETERMINATE = "REF_TRANSACTION_INDETERMINATE";
+export class RefTransactionError extends Error {
+    code = "REF_TRANSACTION_FAILED";
+    constructor(message, options) {
+        super(message, options);
+        this.name = "RefTransactionError";
+    }
+}
 function isMissingExactRef(result) {
-    return result.status === 1 && result.stdout === "";
+    return !result.error
+        && result.stdout === ""
+        && result.status === 1;
 }
 function parseShowRefRows(output) {
     const lines = output.split(/\r?\n/);
@@ -15,14 +26,18 @@ function parseShowRefRows(output) {
         return null;
     const rows = [];
     for (const line of lines) {
-        const match = /^(?<objectId>[0-9a-fA-F]{40}|[0-9a-fA-F]{64}) (?<ref>refs\/\S+)$/.exec(line);
-        if (!match?.groups)
+        const separator = line.indexOf(" ");
+        const objectId = separator < 0 ? "" : line.slice(0, separator);
+        const ref = separator < 0 ? "" : line.slice(separator + 1);
+        if (!isFullGitObjectId(objectId) || !/^refs\/\S+$/.test(ref))
             return null;
-        rows.push({ objectId: match.groups.objectId, ref: match.groups.ref });
+        rows.push({ objectId, ref });
     }
     return rows;
 }
 function throwGitProcessFailure(commandLabel, result, cwd) {
+    if (result.error?.name === "AbortError")
+        throw result.error;
     const failure = result.error ?? Object.assign(new Error(result.stderr || `git ${commandLabel} exited ${result.status}`), {
         stderr: result.stderr,
         stdout: result.stdout,
@@ -46,58 +61,165 @@ export async function resolveLocalBranchHead(cwd, branch, run = runGitProcess) {
     }
     return throwGitProcessFailure(`show-ref ${ref}`, result, cwd);
 }
-async function resolveRefOrNull(cwd, ref) {
-    const git = createGit(cwd);
-    try {
-        return (await git.raw(["rev-parse", "--verify", ref])).trim();
+async function validateTransactionOperation(cwd, operation, objectIdLength) {
+    const refCheck = await runGitProcess(cwd, ["check-ref-format", operation.ref]);
+    if (refCheck.status !== 0 || refCheck.error) {
+        throw new RefTransactionError(`invalid transaction ref ${JSON.stringify(operation.ref)}`, { cause: refCheck.error });
     }
-    catch (error) {
-        if (errorContainsAnyPattern(error, MISSING_HEAD_PATTERNS))
-            return null;
-        throw wrapGitError(`rev-parse ${ref}`, error, cwd);
+    const objectIds = operation.kind === "update"
+        ? [["new", operation.newOid], ["old", operation.expectedOldOid]]
+        : [["old", operation.expectedOldOid]];
+    for (const [label, oid] of objectIds) {
+        if (oid !== null && (oid.length !== objectIdLength || !isFullGitObjectId(oid))) {
+            throw new RefTransactionError(`invalid ${label} object ID for ${operation.ref}`);
+        }
     }
 }
-/** Create an immutable recovery ref, accepting an earlier identical attempt. */
-export async function createRecoveryRef(cwd, ref, objectId) {
-    const existing = await resolveRefOrNull(cwd, ref);
-    if (existing === objectId)
-        return;
-    if (existing !== null) {
-        throw new Error(`recovery ref ${ref} already resolves to ${existing}, not ${objectId}`);
-    }
-    const git = createGit(cwd);
+function formatTransactionOperation(operation, zero) {
+    if (operation.kind === "delete")
+        return `delete ${operation.ref} ${operation.expectedOldOid}`;
+    if (operation.kind === "verify")
+        return `verify ${operation.ref} ${operation.expectedOldOid ?? zero}`;
+    return `update ${operation.ref} ${operation.newOid} ${operation.expectedOldOid ?? zero}`;
+}
+function isUnambiguousCasRefusal(result) {
+    if (result.status === null || result.status === 0 || result.error)
+        return false;
+    return /cannot lock ref '[^']+': (?:is at [0-9a-f]+ but expected [0-9a-f]+|reference already exists|reference is missing but expected [0-9a-f]+)/i.test(result.stderr);
+}
+function isUnableToResolveReference(result) {
+    return result.status !== null
+        && result.status !== 0
+        && !result.error
+        && /cannot lock ref '[^']+': unable to resolve reference/i.test(result.stderr);
+}
+function hasConclusiveMissingExpectedReference(observations) {
+    return observations.some((observation) => (observation.expectedOldOid !== null
+        && observation.observed.status === "absent"));
+}
+function transactionFailureCause(result) {
+    return result.stderr.trim() || result.error?.message || `exit ${String(result.status)}`;
+}
+function requestedNewOid(operation) {
+    if (operation.kind === "update")
+        return operation.newOid;
+    if (operation.kind === "delete")
+        return null;
+    return operation.expectedOldOid;
+}
+function observationMatches(observation, expectedOid) {
+    if (observation.observed.status === "unknown")
+        return false;
+    if (expectedOid === null)
+        return observation.observed.status === "absent";
+    return observation.observed.status === "present" && observation.observed.objectId === expectedOid;
+}
+async function observeExactRef(cwd, ref) {
     try {
-        await git.raw(["update-ref", ref, objectId, ZERO_OBJECT_ID]);
+        const symbolic = await runGitProcess(cwd, ["symbolic-ref", "--quiet", ref]);
+        if (symbolic.status === 0 && !symbolic.error) {
+            const target = symbolic.stdout.trim();
+            return { status: "unknown", cause: `symbolic ref targets ${target || "an unreported ref"}` };
+        }
+        if (symbolic.error || (symbolic.status !== 1 && symbolic.status !== 0)) {
+            const cause = symbolic.stderr.trim() || symbolic.error?.message || `symbolic-ref exited ${String(symbolic.status)}`;
+            return { status: "unknown", cause };
+        }
+        const exact = await runGitProcess(cwd, ["show-ref", ref]);
+        if (exact.status === 0 && !exact.error) {
+            const exactRows = parseShowRefRows(exact.stdout)?.filter((row) => row.ref === ref);
+            if (exactRows?.length === 1) {
+                return { status: "present", objectId: exactRows[0].objectId };
+            }
+            return { status: "unknown", cause: `show-ref returned an invalid exact value for ${ref}` };
+        }
+        if (!exact.error && exact.status === 1 && exact.stdout === "")
+            return { status: "absent" };
+        const cause = exact.stderr.trim() || exact.error?.message || `show-ref exited ${String(exact.status)}`;
+        return { status: "unknown", cause };
     }
     catch (error) {
-        // Another identical attempt may have won the create race.
-        if (await resolveRefOrNull(cwd, ref) === objectId)
-            return;
-        throw wrapGitError(`update-ref ${ref}`, error, cwd);
+        return { status: "unknown", cause: error instanceof Error ? error.message : String(error) };
     }
 }
-/** Remove only the exact attempt ref, returning truthful non-fatal cleanup facts. */
-export async function deleteRecoveryRef(cwd, ref, objectId) {
+async function observeTransactionRefs(cwd, operations) {
+    return await Promise.all(operations.map(async (operation) => ({
+        ref: operation.ref,
+        expectedOldOid: operation.expectedOldOid,
+        requestedNewOid: requestedNewOid(operation),
+        observed: await observeExactRef(cwd, operation.ref),
+    })));
+}
+/**
+ * Atomically apply a closed set of ref operations. Every old-OID assertion is
+ * submitted inside the same update-ref transaction as its operation; no
+ * preflight read is used as authority.
+ */
+export async function commitRefTransaction(cwd, operations, objectIdLength, options = {}) {
+    if (operations.length === 0)
+        throw new RefTransactionError("a ref transaction requires at least one operation");
+    const seen = new Set();
+    for (const operation of operations) {
+        await validateTransactionOperation(cwd, operation, objectIdLength);
+        if (seen.has(operation.ref))
+            throw new RefTransactionError(`duplicate transaction ref ${operation.ref}`);
+        seen.add(operation.ref);
+    }
+    const zero = "0".repeat(objectIdLength);
+    const input = [
+        "start",
+        ...operations.map((operation) => formatTransactionOperation(operation, zero)),
+        "prepare",
+        "commit",
+        "",
+    ].join("\n");
+    let result;
     try {
-        const existing = await resolveRefOrNull(cwd, ref);
-        if (existing === null)
-            return { ref, status: "already-absent" };
-        if (existing !== objectId) {
-            return {
-                ref,
-                status: "retained",
-                diagnostic: `ref resolves to ${existing}, not expected object ${objectId}`,
-            };
-        }
-        const git = createGit(cwd);
-        await git.raw(["update-ref", "-d", ref, objectId]);
-        return { ref, status: "removed" };
+        result = await (options.run ?? runGitProcess)(cwd, ["update-ref", "--no-deref", "--stdin"], { input });
     }
     catch (error) {
+        result = {
+            stdout: "",
+            stderr: "",
+            status: null,
+            error: error instanceof Error ? error : new Error(String(error)),
+        };
+    }
+    if (result.status === 0 && !result.error) {
+        return { status: "committed", proof: "process-success", operations, observations: [] };
+    }
+    const observations = await observeTransactionRefs(cwd, operations);
+    const allPre = observations.every((observation) => observationMatches(observation, observation.expectedOldOid));
+    const allPost = observations.every((observation) => observationMatches(observation, observation.requestedNewOid));
+    const changesAuthority = operations.some((operation) => requestedNewOid(operation) !== operation.expectedOldOid);
+    const cause = transactionFailureCause(result);
+    if (allPost && changesAuthority) {
+        return { status: "committed", proof: "observed-post-state", operations, observations };
+    }
+    if (isUnambiguousCasRefusal(result)
+        || (isUnableToResolveReference(result) && hasConclusiveMissingExpectedReference(observations))) {
+        return {
+            status: "refused",
+            code: REF_TRANSACTION_CAS_MISMATCH,
+            operations,
+            observations,
+            cause,
+        };
+    }
+    if (allPre && changesAuthority) {
         return {
-            ref,
-            status: "retained",
-            diagnostic: wrapGitError(`update-ref -d ${ref}`, error, cwd).message,
+            status: "refused",
+            code: REF_TRANSACTION_NOT_COMMITTED,
+            operations,
+            observations,
+            cause,
         };
     }
+    return {
+        status: "indeterminate",
+        code: REF_TRANSACTION_INDETERMINATE,
+        operations,
+        observations,
+        cause,
+    };
 }

package/build/git/streaming-batch.js

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
+import { isFullGitObjectId } from "./core.js";
 import { normalizeFilesystemCoordinate } from "../fs/path-coordinate.js";
-import { gitProcessEnv, resolveGitTimeoutMs, } from "./core.js";
+import { gitProcessEnv, resolveGitTimeoutMs, terminateGitChild, } from "./core.js";
 /** Default long-lived batch argv. One-shot calls must not use this gate. */
 export const GIT_STREAMING_BATCH_DEFAULT_ARGS = ["cat-file", "--batch"];
 /** Safety cap for a single response header line before the body frame. */
@@ -15,10 +16,12 @@ export class GitStreamingBatchResponseEndedError extends Error {
 }
 class BufferedReader {
     #iterator;
+    #onProgress;
     #buffer = Buffer.alloc(0);
     #ended = false;
-    constructor(stream) {
+    constructor(stream, onProgress) {
         this.#iterator = stream[Symbol.asyncIterator]();
+        this.#onProgress = onProgress;
     }
     async #fill() {
         if (this.#ended) {
@@ -30,6 +33,7 @@ class BufferedReader {
             throw new GitStreamingBatchResponseEndedError("git streaming batch response ended unexpectedly");
         }
         const chunk = Buffer.isBuffer(next.value) ? next.value : Buffer.from(next.value);
+        this.#onProgress();
         this.#buffer = this.#buffer.length === 0 ? chunk : Buffer.concat([this.#buffer, chunk]);
     }
     async readLine(maxBytes) {
@@ -84,20 +88,36 @@ export class GitStreamingBatchSession {
     #child;
     #reader;
     #stderr = [];
-    #timeout;
+    #timeoutMs;
     #closed;
     #maxHeaderBytes;
+    #signal;
+    #abortListener;
+    #timeout = null;
     #state = { kind: "open" };
     #timedOut = false;
     #aborted = false;
     #inputError = null;
     #requestInFlight = false;
+    #requestDone = null;
+    #finishRequest = null;
+    #requestTimeoutOwner = null;
     #closePromise = null;
-    constructor(cwd, child, timeoutMs, maxHeaderBytes) {
+    #terminationPromise = null;
+    constructor(cwd, child, timeoutMs, maxHeaderBytes, signal) {
         this.cwd = cwd;
         this.#child = child;
-        this.#reader = new BufferedReader(this.#child.stdout);
+        this.#timeoutMs = timeoutMs;
+        this.#reader = new BufferedReader(this.#child.stdout, () => {
+            if (this.#requestTimeoutOwner)
+                this.#armTimeout(this.#requestTimeoutOwner);
+        });
         this.#maxHeaderBytes = maxHeaderBytes;
+        this.#signal = signal;
+        this.#abortListener = () => this.abort();
+        signal?.addEventListener("abort", this.#abortListener, { once: true });
+        if (signal?.aborted)
+            this.abort();
         this.#child.stderr.on("data", (chunk) => this.#stderr.push(chunk));
         this.#child.stdin.on("error", (error) => {
             this.#inputError = error;
@@ -110,10 +130,27 @@ export class GitStreamingBatchSession {
                 resolve({ code, signal });
             });
         });
-        this.#timeout = setTimeout(() => {
+    }
+    #armTimeout(owner) {
+        this.#clearTimeout();
+        const handle = setTimeout(() => {
+            if (this.#timeout?.owner !== owner)
+                return;
+            this.#timeout = null;
             this.#timedOut = true;
+            if (this.#state.kind === "open")
+                this.#state = { kind: "closing" };
             this.#child.kill("SIGKILL");
-        }, timeoutMs);
+        }, this.#timeoutMs);
+        this.#timeout = { owner, handle };
+    }
+    #clearTimeout(owner) {
+        if (this.#timeout === null)
+            return;
+        if (owner !== undefined && this.#timeout.owner !== owner)
+            return;
+        clearTimeout(this.#timeout.handle);
+        this.#timeout = null;
     }
     /**
      * Open the sole long-lived Git batch process for `cwd`.
@@ -125,11 +162,11 @@ export class GitStreamingBatchSession {
         const maxHeaderBytes = options?.maxHeaderBytes ?? GIT_STREAMING_BATCH_MAX_HEADER_BYTES;
         const child = spawn("git", [...args], {
             cwd: normalizeFilesystemCoordinate(cwd),
-            env: gitProcessEnv(),
+            env: gitProcessEnv(options?.env),
             shell: false,
             stdio: ["pipe", "pipe", "pipe"],
         });
-        return new GitStreamingBatchSession(cwd, child, timeoutMs, maxHeaderBytes);
+        return new GitStreamingBatchSession(cwd, child, timeoutMs, maxHeaderBytes, options?.signal);
     }
     /**
      * Write one request line and read one framed response record.
@@ -142,7 +179,13 @@ export class GitStreamingBatchSession {
         if (this.#requestInFlight) {
             throw new Error("git streaming batch rejects concurrent requests");
         }
+        const timeoutOwner = Symbol("git-streaming-batch-request");
         this.#requestInFlight = true;
+        this.#requestTimeoutOwner = timeoutOwner;
+        this.#requestDone = new Promise((resolve) => {
+            this.#finishRequest = resolve;
+        });
+        this.#armTimeout(timeoutOwner);
         try {
             if (this.#inputError)
                 throw this.#inputError;
@@ -168,7 +211,8 @@ export class GitStreamingBatchSession {
             catch (error) {
                 if (error instanceof GitStreamingBatchFramingError
                     || error instanceof GitStreamingBatchResponseEndedError) {
-                    this.abort();
+                    if (!this.#timedOut)
+                        this.abort();
                 }
                 throw error;
             }
@@ -183,7 +227,7 @@ export class GitStreamingBatchSession {
             const size = Number(sizeText);
             if (unexpected.length > 0
                 || !oid
-                || !/^[0-9a-f]{40,64}$/.test(oid)
+                || !isFullGitObjectId(oid)
                 || !type
                 || !Number.isSafeInteger(size)
                 || size < 0) {
@@ -221,7 +265,13 @@ export class GitStreamingBatchSession {
             };
         }
         finally {
+            this.#clearTimeout(timeoutOwner);
+            this.#requestTimeoutOwner = null;
             this.#requestInFlight = false;
+            const finishRequest = this.#finishRequest;
+            this.#finishRequest = null;
+            this.#requestDone = null;
+            finishRequest?.();
         }
     }
     /**
@@ -232,11 +282,12 @@ export class GitStreamingBatchSession {
         if (this.#aborted)
             return;
         this.#aborted = true;
+        this.#clearTimeout();
         if (this.#state.kind === "open") {
             this.#state = { kind: "closing" };
         }
         this.#child.stdin.destroy();
-        this.#child.kill("SIGKILL");
+        this.#terminationPromise ??= terminateGitChild(this.#child, this.#closed);
     }
     /**
      * End stdin, await process exit, and return structured close facts.
@@ -263,7 +314,15 @@ export class GitStreamingBatchSession {
         return this.#closePromise;
     }
     async #closeOnce() {
+        const pendingRequest = this.#requestDone;
+        if (pendingRequest)
+            await pendingRequest;
+        if (this.#terminationPromise)
+            await this.#terminationPromise;
+        const timeoutOwner = Symbol("git-streaming-batch-close");
         if (!this.#aborted && this.#child.stdin?.writable) {
+            if (!this.#timedOut)
+                this.#armTimeout(timeoutOwner);
             this.#child.stdin.end();
         }
         let exit;
@@ -271,8 +330,9 @@ export class GitStreamingBatchSession {
             exit = await this.#closed;
         }
         finally {
-            clearTimeout(this.#timeout);
+            this.#clearTimeout(timeoutOwner);
         }
+        this.#signal?.removeEventListener("abort", this.#abortListener);
         if (exit.processError && !this.#aborted) {
             const fact = {
                 code: null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrosheep/keiyaku",
-  "version": "2.9.8",
+  "version": "2.9.10",
   "description": "CLI for running iterative keiyaku workflows with Codex subagents.",
   "license": "MIT",
   "type": "module",