@astrosheep/keiyaku 4.5.7 → 4.5.9

package/build/src/git/hooks.js

@@ -1,169 +1,4 @@
-import { lstat, mkdir, readFile, unlink } from "node:fs/promises";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { replaceFileDurably } from "../coordination/durable-file.js";
-import { acquireSqliteTransactionLock } from "../coordination/sqlite-transaction-lock.js";
-import { runProcess, runProcessToExit } from "../runtime/proc/run.js";
-const MARKER_VERSION = 1;
-function object(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function exactKeys(value, keys, coordinate) {
-    const actual = Object.keys(value).sort();
-    const expected = [...keys].sort();
-    if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index])) {
-        throw new Error(`${coordinate} has invalid fields`);
-    }
-}
-function decodeCommand(value, coordinate) {
-    if (!object(value))
-        throw new Error(`${coordinate} must be an object`);
-    exactKeys(value, ["argv", "timeoutMs"], coordinate);
-    if (!Array.isArray(value.argv) || value.argv.length === 0 || !value.argv.every((item) => typeof item === "string")) {
-        throw new Error(`${coordinate}.argv must be a nonempty string array`);
-    }
-    if (value.argv[0].trim().length === 0)
-        throw new Error(`${coordinate}.argv[0] must be nonblank`);
-    if (!Number.isSafeInteger(value.timeoutMs) ||
-        value.timeoutMs < 1 ||
-        value.timeoutMs > 2_147_483_647) {
-        throw new Error(`${coordinate}.timeoutMs is invalid`);
-    }
-    return { argv: value.argv, timeoutMs: value.timeoutMs };
-}
-function decodeCommands(value, coordinate) {
-    if (!Array.isArray(value))
-        throw new Error(`${coordinate} must be an array`);
-    return value.map((item, index) => decodeCommand(item, `${coordinate}[${index}]`));
-}
-function decodeFailure(value, coordinate) {
-    if (!object(value) || typeof value.kind !== "string")
-        throw new Error(`${coordinate} is invalid`);
-    switch (value.kind) {
-        case "exit":
-            exactKeys(value, ["kind", "code", "stdout", "stderr", "truncated"], coordinate);
-            if (!Number.isInteger(value.code) ||
-                typeof value.stdout !== "string" ||
-                typeof value.stderr !== "string" ||
-                typeof value.truncated !== "boolean") {
-                throw new Error(`${coordinate} is invalid`);
-            }
-            return {
-                kind: "exit",
-                code: value.code,
-                stdout: value.stdout,
-                stderr: value.stderr,
-                truncated: value.truncated,
-            };
-        case "timeout":
-        case "unknown-exit":
-            exactKeys(value, ["kind"], coordinate);
-            return { kind: value.kind };
-        case "spawn-error":
-            exactKeys(value, ["kind", "diagnostic"], coordinate);
-            if (typeof value.diagnostic !== "string")
-                throw new Error(`${coordinate}.diagnostic must be a string`);
-            return { kind: "spawn-error", diagnostic: value.diagnostic };
-        default:
-            throw new Error(`${coordinate}.kind is invalid`);
-    }
-}
-function decodeProgress(value, commands, coordinate) {
-    if (!object(value) || typeof value.status !== "string")
-        throw new Error(`${coordinate} is invalid`);
-    if (value.status === "ok") {
-        exactKeys(value, ["status"], coordinate);
-        return { status: "ok" };
-    }
-    if (value.status === "pending") {
-        exactKeys(value, ["status", "next"], coordinate);
-        if (!Number.isInteger(value.next) || value.next < 0 || value.next > commands) {
-            throw new Error(`${coordinate}.next is invalid`);
-        }
-        return { status: "pending", next: value.next };
-    }
-    if (value.status === "failed") {
-        exactKeys(value, ["status", "command", "failure"], coordinate);
-        if (!Number.isInteger(value.command) || value.command < 0 || value.command >= commands) {
-            throw new Error(`${coordinate}.command is invalid`);
-        }
-        return {
-            status: "failed",
-            command: value.command,
-            failure: decodeFailure(value.failure, `${coordinate}.failure`),
-        };
-    }
-    throw new Error(`${coordinate}.status is invalid`);
-}
-function decodeMarker(bytes) {
-    const value = JSON.parse(bytes);
-    if (!object(value))
-        throw new Error("worktree hook marker must be an object");
-    exactKeys(value, ["version", "commands", "create", "destroy"], "worktree hook marker");
-    if (value.version !== MARKER_VERSION)
-        throw new Error(`worktree hook marker version must be ${MARKER_VERSION}`);
-    if (!object(value.commands))
-        throw new Error("worktree hook marker commands must be an object");
-    exactKeys(value.commands, ["create", "destroy"], "worktree hook marker commands");
-    const commands = {
-        create: decodeCommands(value.commands.create, "worktree hook marker commands.create"),
-        destroy: decodeCommands(value.commands.destroy, "worktree hook marker commands.destroy"),
-    };
-    return {
-        version: MARKER_VERSION,
-        commands,
-        create: decodeProgress(value.create, commands.create.length, "worktree hook marker create"),
-        destroy: decodeProgress(value.destroy, commands.destroy.length, "worktree hook marker destroy"),
-    };
-}
-export function hookMarkerPath(administrationDirectory) {
-    return join(administrationDirectory, "keiyaku", "hooks.json");
-}
-async function readMarker(administrationDirectory) {
-    try {
-        return decodeMarker(await readFile(hookMarkerPath(administrationDirectory), "utf8"));
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return null;
-        throw error;
-    }
-}
-function hookFailureDiagnostic(phase, progress) {
-    const failure = progress.failure;
-    const detail = failure.kind === "exit"
-        ? `exit=${failure.code}`
-        : failure.kind === "spawn-error"
-            ? failure.diagnostic
-            : failure.kind;
-    return `worktree-hook-failed ${phase} command=${progress.command} ${detail}`;
-}
-/** Read the durable hook marker without executing commands or taking locks. */
-export async function observeWorktreeHookMarker(administrationDirectory) {
-    const marker = await readMarker(administrationDirectory);
-    if (marker === null)
-        return { kind: "absent" };
-    if (marker.create.status === "failed")
-        return { kind: "failed", diagnostic: hookFailureDiagnostic("create", marker.create) };
-    if (marker.destroy.status === "failed")
-        return { kind: "failed", diagnostic: hookFailureDiagnostic("destroy", marker.destroy) };
-    if (marker.create.status === "pending" || marker.destroy.status === "pending")
-        return { kind: "pending" };
-    return { kind: "ok" };
-}
-async function writeMarker(administrationDirectory, marker) {
-    const path = hookMarkerPath(administrationDirectory);
-    await mkdir(dirname(path), { recursive: true });
-    await replaceFileDurably(path, `${JSON.stringify(marker)}\n`);
-}
-function freshMarker(commands, createPending) {
-    return {
-        version: MARKER_VERSION,
-        commands,
-        create: createPending ? { status: "pending", next: 0 } : { status: "ok" },
-        destroy: { status: "pending", next: 0 },
-    };
-}
+import { runProcess } from "../runtime/proc/run.js";
 function failedOutcome(outcome) {
     if (outcome.kind === "terminal") {
         return outcome.code === 0
@@ -195,162 +30,33 @@ export async function runHookCommands(worktree, commands, signal) {
     }
     return { kind: "ok" };
 }
-function withProgress(marker, phase, progress) {
-    return { ...marker, [phase]: progress };
-}
-function hookExecutionLockPath(administrationDirectory) {
-    return join(administrationDirectory, "keiyaku", "hook-execution.sqlite");
-}
-async function regularFile(path) {
-    try {
-        const value = await lstat(path);
-        if (!value.isFile() || value.isSymbolicLink())
-            throw new Error(`worktree hook custody is not a regular file: ${path}`);
-        return true;
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return false;
-        throw error;
-    }
-}
-/** Remove validated Keiyaku hook state after its worktree has been reset. */
-export async function nukeWorktreeHookResidue(administrationDirectory) {
-    const marker = hookMarkerPath(administrationDirectory);
-    const lock = hookExecutionLockPath(administrationDirectory);
-    const markerPresent = await regularFile(marker);
-    const lockPresent = await regularFile(lock);
-    if (!markerPresent && !lockPresent)
-        return;
-    const held = await acquireSqliteTransactionLock({ path: lock, mode: "immediate" });
-    try {
-        const currentMarker = await regularFile(marker);
-        if (currentMarker)
-            await readMarker(administrationDirectory);
-        if (currentMarker)
-            await unlink(marker);
-    }
-    finally {
-        held.close();
-    }
-}
-function decodeRunnerInput(encoded) {
-    const value = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
-    if (!object(value))
-        throw new Error("Hook runner input must be an object");
-    exactKeys(value, ["administrationDirectory", "worktree", "phase", "command"], "Hook runner input");
-    if (typeof value.administrationDirectory !== "string" || value.administrationDirectory.length === 0) {
-        throw new Error("Hook runner administrationDirectory must be nonempty");
-    }
-    if (typeof value.worktree !== "string" || value.worktree.length === 0) {
-        throw new Error("Hook runner worktree must be nonempty");
-    }
-    if (value.phase !== "create" && value.phase !== "destroy")
-        throw new Error("Hook runner phase is invalid");
-    if (!Number.isSafeInteger(value.command) || value.command < 0) {
-        throw new Error("Hook runner command must be a nonnegative safe integer");
-    }
-    return {
-        administrationDirectory: value.administrationDirectory,
-        worktree: value.worktree,
-        phase: value.phase,
-        command: value.command,
-    };
-}
-async function executePendingCommand(input) {
-    const held = await acquireSqliteTransactionLock({
-        path: hookExecutionLockPath(input.administrationDirectory),
-        mode: "immediate",
-    });
-    try {
-        const marker = await readMarker(input.administrationDirectory);
-        if (marker === null)
-            throw new Error("worktree hook marker disappeared before execution");
-        const progress = marker[input.phase];
-        if (progress.status !== "pending" || progress.next !== input.command)
-            return;
-        const command = marker.commands[input.phase][input.command];
-        if (command === undefined)
-            throw new Error("worktree hook marker pending index is out of range");
-        const result = await runHookCommands(input.worktree, [command]);
-        if (result.kind === "cancelled")
-            throw new Error("managed hook runner cancelled without a signal");
-        const failure = result.kind === "failed" ? result.failure : null;
-        const next = input.command + 1;
-        await writeMarker(input.administrationDirectory, withProgress(marker, input.phase, failure === null
-            ? next === marker.commands[input.phase].length
-                ? { status: "ok" }
-                : { status: "pending", next }
-            : { status: "failed", command: input.command, failure }));
-    }
-    finally {
-        held.close();
-    }
-}
-function runnerFailure(outcome) {
-    if (outcome.kind === "terminal") {
-        const detail = outcome.stderr.trim() || outcome.stdout.trim();
-        return new Error(detail.length === 0 ? `Hook runner exited ${outcome.code}` : `Hook runner exited ${outcome.code}: ${detail}`);
-    }
-    if (outcome.kind === "spawn-error")
-        return new Error(`Hook runner failed to spawn: ${outcome.diagnostic}`);
-    return new Error(`Hook runner ended with ${outcome.kind}`);
-}
-async function runPendingCommand(input) {
-    const encoded = Buffer.from(JSON.stringify(input), "utf8").toString("base64url");
-    const outcome = await runProcessToExit({
-        argv: [process.execPath, ...process.execArgv, fileURLToPath(import.meta.url), "--run-hook", encoded],
-        cwd: dirname(fileURLToPath(import.meta.url)),
-    });
-    if (outcome.kind !== "terminal" || outcome.code !== 0)
-        throw runnerFailure(outcome);
-}
-async function runPhase(worktree, administrationDirectory, hooks, phase, retryHooks) {
-    let marker = await readMarker(administrationDirectory);
-    if (marker === null) {
-        marker = freshMarker(hooks, phase === "create");
-        await writeMarker(administrationDirectory, marker);
-    }
-    let retryFailure = retryHooks && marker[phase].status === "failed";
-    for (;;) {
-        marker = await readMarker(administrationDirectory);
-        if (marker === null)
-            throw new Error("worktree hook marker disappeared during execution");
-        const progress = marker[phase];
-        if (progress.status === "ok")
-            return null;
-        if (progress.status === "failed") {
-            if (!retryFailure) {
-                return {
+async function runPhase(worktree, hooks, phase) {
+    const runs = [];
+    for (const [command, value] of hooks.entries()) {
+        const outcome = await runProcess({ argv: value.argv, timeoutMs: value.timeoutMs, cwd: worktree });
+        if (outcome.kind === "cancelled") {
+            return {
+                runs,
+                lag: {
                     kind: "worktree-hook-failed",
                     phase,
                     path: worktree,
-                    command: progress.command,
-                    failure: progress.failure,
-                };
-            }
-            retryFailure = false;
-            await writeMarker(administrationDirectory, withProgress(marker, phase, { status: "pending", next: progress.command }));
-            continue;
-        }
-        if (progress.next === marker.commands[phase].length) {
-            await writeMarker(administrationDirectory, withProgress(marker, phase, { status: "ok" }));
-            continue;
+                    command,
+                    name: value.name,
+                    failure: { kind: "unknown-exit" },
+                },
+            };
         }
-        await runPendingCommand({ administrationDirectory, worktree, phase, command: progress.next });
+        const failure = failedOutcome(outcome);
+        if (failure !== null)
+            return { runs, lag: { kind: "worktree-hook-failed", phase, path: worktree, command, name: value.name, failure } };
+        runs.push(value.name);
     }
+    return { runs, lag: null };
 }
-export function runCreateHooks(worktree, administrationDirectory, hooks, retryHooks) {
-    return runPhase(worktree, administrationDirectory, hooks, "create", retryHooks);
-}
-export function runDestroyHooks(worktree, administrationDirectory, hooks, retryHooks) {
-    return runPhase(worktree, administrationDirectory, hooks, "destroy", retryHooks);
+export function runCreateHooks(worktree, hooks) {
+    return runPhase(worktree, hooks.create, "create");
 }
-if (process.argv[1] !== undefined &&
-    fileURLToPath(import.meta.url) === process.argv[1] &&
-    process.argv[2] === "--run-hook") {
-    const encoded = process.argv[3];
-    if (encoded === undefined)
-        throw new Error("Hook runner input is missing");
-    await executePendingCommand(decodeRunnerInput(encoded));
+export function runDestroyHooks(worktree, hooks) {
+    return runPhase(worktree, hooks.destroy, "destroy");
 }

package/build/src/git/nuke.d.ts

@@ -1,2 +1,3 @@
 import type { WorldRoot } from "../world.js";
-export declare function nukeGit(world: WorldRoot, gitPath?: string): Promise<void>;
+import { type GitRepository } from "./process.js";
+export declare function nukeGit(world: WorldRoot, gitPath?: string, options?: Readonly<Pick<GitRepository, "onPrivateStateSeatContention">>): Promise<void>;

package/build/src/git/nuke.js

@@ -1,9 +1,9 @@
 import { access, lstat, realpath, rm } from "node:fs/promises";
 import { isAbsolute, relative, sep } from "node:path";
-import { nukeEmptyPlaceAuthority, readPlaceRegister, releaseManagedWorktrees } from "../workspace-place.js";
-import { nukeWorktreeHookResidue } from "./hooks.js";
-import { runGit } from "./process.js";
-import { CANDIDATE_PIN_REF_NAMESPACE, DELIVERY_REF_NAMESPACE, GIT_REF, MIGRATION_CANDIDATE_PIN_REF_NAMESPACE, MIGRATION_DELIVERY_REF_NAMESPACE, NoGitWorldError, readRef, registeredWorktrees, repositoryAt, worktreeGitDirectory, } from "./repository.js";
+import { nukeEmptyPlaceAuthority, readPlaceRegister, releaseManagedWorktrees, withPlaceAuthorityFence, } from "../workspace-place.js";
+import { GitPlumbingError, runGit } from "./process.js";
+import { confirmPrivateStatePublication, withPrivateStatePublicationSeat } from "./private-state-seat.js";
+import { CANDIDATE_PIN_REF_NAMESPACE, DELIVERY_REF_NAMESPACE, GIT_REF, LEGACY_CANDIDATE_PIN_REF_NAMESPACE, LEGACY_DELIVERY_REF_NAMESPACE, NoGitWorldError, readRef, registeredWorktrees, repositoryAt, worktreeGitDirectory, } from "./repository.js";
 import { worktreePath } from "./workspace.js";
 async function managedCustody(repository) {
     const register = await readPlaceRegister(repository);
@@ -66,8 +66,6 @@ async function removeUnregisteredResidue(repository, entry) {
     if (!(await unregisteredResidueBelongsToRepository(repository, entry.path))) {
         throw new Error(`managed Place path has foreign custody: ${entry.path}`);
     }
-    const administrationDirectory = await worktreeGitDirectory(repository, entry.path);
-    await nukeWorktreeHookResidue(administrationDirectory);
     await rm(entry.path, { recursive: true, force: true });
     try {
         await access(entry.path);
@@ -85,7 +83,6 @@ async function removeManagedWorktree(repository, entry) {
         return await removeUnregisteredResidue(repository, entry);
     if (registered.branch !== null)
         return false;
-    await nukeWorktreeHookResidue(await worktreeGitDirectory(repository, entry.path));
     await runGit(repository, ["worktree", "remove", "--force", entry.path]);
     if ((await registeredWorktrees(repository)).some((candidate) => candidate.path === entry.path)) {
         throw new Error(`managed Place worktree remains registered: ${entry.path}`);
@@ -103,12 +100,28 @@ async function removeManagedWorktree(repository, entry) {
 async function deleteRefAt(repository, ref, expectedOid) {
     await runGit(repository, ["update-ref", "--no-deref", "-d", ref, expectedOid]);
 }
+async function deleteObservedStateRef(repository, expectedOid, seat) {
+    try {
+        await deleteRefAt(repository, GIT_REF, expectedOid);
+        confirmPrivateStatePublication(seat);
+        return;
+    }
+    catch (error) {
+        if (!(error instanceof GitPlumbingError) || error.pid === null || error.pid <= 0 || error.status !== null)
+            throw error;
+    }
+    if ((await readRef(repository, GIT_REF)) === null) {
+        confirmPrivateStatePublication(seat);
+        return;
+    }
+    throw new Error("state-ref deletion outcome is unknown");
+}
 async function removeOwnedRefs(repository) {
     const roots = [
         DELIVERY_REF_NAMESPACE,
         CANDIDATE_PIN_REF_NAMESPACE,
-        MIGRATION_DELIVERY_REF_NAMESPACE,
-        MIGRATION_CANDIDATE_PIN_REF_NAMESPACE,
+        LEGACY_DELIVERY_REF_NAMESPACE,
+        LEGACY_CANDIDATE_PIN_REF_NAMESPACE,
     ];
     for (const root of roots) {
         const refs = (await runGit(repository, ["for-each-ref", "--format=%(refname)", root]))
@@ -122,24 +135,29 @@ async function removeOwnedRefs(repository) {
         }
     }
 }
-export async function nukeGit(world, gitPath = "git") {
+export async function nukeGit(world, gitPath = "git", options) {
     let repository;
     try {
-        repository = await repositoryAt(world, gitPath);
+        repository = { ...(await repositoryAt(world, gitPath)), ...options };
     }
     catch (error) {
         if (error instanceof NoGitWorldError)
             return;
         throw error;
     }
-    const state = await readRef(repository, GIT_REF);
-    if (state !== null)
-        await deleteRefAt(repository, GIT_REF, state);
-    const custody = await managedCustody(repository);
-    for (const entry of custody.entries) {
-        if (await removeManagedWorktree(repository, entry))
-            await releaseManagedWorktrees(repository, [entry.contract]);
-    }
-    await nukeEmptyPlaceAuthority(repository);
-    await removeOwnedRefs(repository);
+    await withPlaceAuthorityFence(repository, async (placeFence) => {
+        const custody = await managedCustody(repository);
+        await withPrivateStatePublicationSeat(repository, async (seat) => {
+            const state = await readRef(repository, GIT_REF);
+            if (state !== null)
+                await deleteObservedStateRef(repository, state, seat);
+            for (const entry of custody.entries) {
+                if (await removeManagedWorktree(repository, entry)) {
+                    await releaseManagedWorktrees(repository, [entry.contract], placeFence);
+                }
+            }
+            await nukeEmptyPlaceAuthority(repository, placeFence);
+            await removeOwnedRefs(repository);
+        });
+    });
 }

package/build/src/git/private-state-seat.d.ts

@@ -0,0 +1,12 @@
+import type { GitRepository } from "./process.js";
+declare const privateStateSeat: unique symbol;
+/** Proves an admission's private-root observation was made while the shared seat was held. */
+export type PrivateStatePublicationSeat = Readonly<{
+    readonly [privateStateSeat]: true;
+}>;
+/** Record a known or exact-read-back-proven private-root publication. */
+export declare function confirmPrivateStatePublication(seat: PrivateStatePublicationSeat): void;
+export declare function privateStatePublicationSeatPath(repository: GitRepository): string;
+/** Serialize cooperating writers of the one private Git state root. */
+export declare function withPrivateStatePublicationSeat<T>(repository: GitRepository, action: (seat: PrivateStatePublicationSeat) => T | Promise<T>): Promise<T>;
+export {};

package/build/src/git/private-state-seat.js

@@ -0,0 +1,39 @@
+import { join } from "node:path";
+import { acquireSqliteTransactionLock } from "../coordination/sqlite-transaction-lock.js";
+const PRIVATE_STATE_SEAT = "private-state.sqlite";
+const privateStateSeat = Symbol("private-state-seat");
+const confirmedPublications = new WeakSet();
+/** Record a known or exact-read-back-proven private-root publication. */
+export function confirmPrivateStatePublication(seat) {
+    confirmedPublications.add(seat);
+}
+export function privateStatePublicationSeatPath(repository) {
+    return join(repository.commonDirectory, "keiyaku", "locks", PRIVATE_STATE_SEAT);
+}
+/** Serialize cooperating writers of the one private Git state root. */
+export async function withPrivateStatePublicationSeat(repository, action) {
+    const held = await acquireSqliteTransactionLock({
+        path: privateStatePublicationSeatPath(repository),
+        mode: "immediate",
+        ...(repository.signal === undefined ? {} : { signal: repository.signal }),
+        ...(repository.onPrivateStateSeatContention === undefined
+            ? {}
+            : { onContended: repository.onPrivateStateSeatContention }),
+    });
+    const seat = { [privateStateSeat]: true };
+    let completed = false;
+    try {
+        const result = await action(seat);
+        completed = true;
+        return result;
+    }
+    finally {
+        try {
+            held.close();
+        }
+        catch (error) {
+            if (!(completed && confirmedPublications.has(seat)))
+                throw error;
+        }
+    }
+}

package/build/src/git/process.d.ts

@@ -9,7 +9,13 @@ export type GitRepository = Readonly<{
     readonly primaryWorktree: string;
     /** The canonical common Git directory pinned when this capability is created. */
     readonly commonDirectory: string;
+    /** A caller-owned cancellation boundary for this capability view. */
+    readonly signal?: AbortSignal;
+    /** Test-only observation that this capability is waiting for the private-state seat. */
+    readonly onPrivateStateSeatContention?: () => void;
 }>;
+/** Give one caller's Git capability view its cancellation boundary. */
+export declare function withGitAbortSignal(repository: GitRepository, signal: AbortSignal | undefined): GitRepository;
 export declare class GitPlumbingError extends Error {
     readonly stdout: Buffer;
     readonly stderr: Buffer;

package/build/src/git/process.js

@@ -1,5 +1,8 @@
-import { spawn } from "node:child_process";
-import { consumeProcessStdout } from "../runtime/proc/run.js";
+import { consumeProcessStdout, spawnCancellableProcess } from "../runtime/proc/run.js";
+/** Give one caller's Git capability view its cancellation boundary. */
+export function withGitAbortSignal(repository, signal) {
+    return signal === undefined ? repository : { ...repository, signal };
+}
 export class GitPlumbingError extends Error {
     stdout;
     stderr;
@@ -29,16 +32,20 @@ function commandError(command, error) {
     });
 }
 async function executeGit(repository, args, input, environment) {
+    if (repository.signal?.aborted === true) {
+        throw commandError(args, { message: "git process cancelled", status: null });
+    }
     const stdout = [];
     const stderr = [];
     let stderrBytes = 0;
     let inputError;
-    const child = spawn(repository.gitPath, [...args], {
+    const owned = spawnCancellableProcess({
+        argv: [repository.gitPath, ...args],
         cwd: repository.effectiveCwd,
         ...(environment === undefined ? {} : { env: { ...process.env, ...environment } }),
-        stdio: ["pipe", "pipe", "pipe"],
-        windowsHide: true,
+        ...(repository.signal === undefined ? {} : { signal: repository.signal }),
     });
+    const child = owned.child;
     child.stdout.on("data", (chunk) => stdout.push(chunk));
     child.stderr.on("data", (chunk) => {
         if (stderrBytes >= GIT_STDERR_BYTES)
@@ -51,15 +58,22 @@ async function executeGit(repository, args, input, environment) {
         inputError = error;
     });
     child.stdin.end(input);
-    const terminal = await new Promise((resolveTerminal) => {
-        child.once("error", (error) => resolveTerminal({ code: null, error }));
-        child.once("close", (code) => resolveTerminal({ code }));
-    });
+    const terminal = await Promise.race([
+        new Promise((resolveTerminal) => {
+            child.once("error", (error) => resolveTerminal({ code: null, error }));
+            child.once("close", (code) => resolveTerminal({ code }));
+        }),
+        owned.terminationFailure,
+    ]);
+    await owned.waitTermination();
     const output = Buffer.concat(stdout);
-    if (terminal.code === 0 && inputError === undefined)
+    if (!owned.cancelled() && terminal.code === 0 && inputError === undefined)
         return output;
     throw commandError(args, {
-        message: terminal.error?.message ?? inputError?.message ?? `git exited with status ${terminal.code ?? "unknown"}`,
+        message: (owned.cancelled() ? "git process cancelled" : undefined) ??
+            terminal.error?.message ??
+            inputError?.message ??
+            `git exited with status ${terminal.code ?? "unknown"}`,
         stdout: output,
         stderr: Buffer.concat(stderr),
         status: terminal.code,
@@ -73,6 +87,7 @@ export async function consumeGitStdout(repository, args, consume) {
     const result = await consumeProcessStdout({
         argv: [repository.gitPath, ...args],
         cwd: repository.effectiveCwd,
+        ...(repository.signal === undefined ? {} : { signal: repository.signal }),
     }, consume);
     const { outcome } = result;
     if (outcome.kind === "terminal" && outcome.code === 0)