@biffo/cli 0.296.16 → 0.296.17

package/dist/index.js

@@ -4287,11 +4287,39 @@ async function refreshInstanceLockfiles(cwd, applied, deps) {
   for (const message of describeFailures(outcomes)) log.warn(message);
   return outcomes;
 }
+var runCommandTimeoutMs = () => {
+  const raw = process.env.BIFFO_RUN_TIMEOUT_MS;
+  const parsed = raw === void 0 ? Number.NaN : Number(raw);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 6e5;
+};
 var defaultRunCommand = async (command, cwd) => {
   const [bin, ...args] = command;
   if (!bin) return { ok: false, error: "empty command" };
   try {
-    await execa3(bin, args, { cwd });
+    await execa3(bin, args, {
+      cwd,
+      // TWO REASONS THIS HUNG FOR 29 HOURS, AND THE FIX NEEDS BOTH.
+      //
+      // Measured 2026-08-22: `biffo core upgrade --apply` on tabsii-platform sat for
+      // 29 hours on `pnpm install` having done NOTHING -- node_modules untouched since
+      // two days earlier, git tree clean, no network connections, main thread idle in
+      // ep_poll. It was waiting on stdin for input that could never arrive.
+      //
+      // 1. `stdin: 'ignore'`. execa 9 gives the child a PIPE for stdin by default
+      //    (verified directly: the child reports `socket:[...]`, not the parent's fd).
+      //    This process's own stdin was /dev/null -- it runs headless -- so had the pipe
+      //    not been created the child would have read EOF at once and either carried on
+      //    or failed fast. Instead pnpm got a live socket nothing would ever write to.
+      //    Closing it turns a silent forever-wait into an immediate, legible outcome.
+      //
+      // 2. `timeout`. Nothing bounded the wait: 0 of 38 execa call sites in this CLI
+      //    passed one. A subprocess that blocks blocks the whole upgrade, unattended and
+      //    unreported -- the same class as wait-for-checks outliving its caller. Ten
+      //    minutes is generous for a cold `pnpm install` and still finite; override with
+      //    BIFFO_RUN_TIMEOUT_MS where an instance genuinely needs longer.
+      stdin: "ignore",
+      timeout: runCommandTimeoutMs()
+    });
     return { ok: true };
   } catch (err) {
     const cause = err;
@@ -10152,7 +10180,30 @@ var defaultRunCommand2 = async (command, cwd) => {
   const [bin, ...args] = command;
   if (!bin) return { ok: false, error: "empty command" };
   try {
-    await execa7(bin, args, { cwd });
+    await execa7(bin, args, {
+      cwd,
+      // TWO REASONS THIS HUNG FOR 29 HOURS, AND THE FIX NEEDS BOTH.
+      //
+      // Measured 2026-08-22: `biffo core upgrade --apply` on tabsii-platform sat for
+      // 29 hours on `pnpm install` having done NOTHING -- node_modules untouched since
+      // two days earlier, git tree clean, no network connections, main thread idle in
+      // ep_poll. It was waiting on stdin for input that could never arrive.
+      //
+      // 1. `stdin: 'ignore'`. execa 9 gives the child a PIPE for stdin by default
+      //    (verified directly: the child reports `socket:[...]`, not the parent's fd).
+      //    This process's own stdin was /dev/null -- it runs headless -- so had the pipe
+      //    not been created the child would have read EOF at once and either carried on
+      //    or failed fast. Instead pnpm got a live socket nothing would ever write to.
+      //    Closing it turns a silent forever-wait into an immediate, legible outcome.
+      //
+      // 2. `timeout`. Nothing bounded the wait: 0 of 38 execa call sites in this CLI
+      //    passed one. A subprocess that blocks blocks the whole upgrade, unattended and
+      //    unreported -- the same class as wait-for-checks outliving its caller. Ten
+      //    minutes is generous for a cold `pnpm install` and still finite; override with
+      //    BIFFO_RUN_TIMEOUT_MS where an instance genuinely needs longer.
+      stdin: "ignore",
+      timeout: runCommandTimeoutMs()
+    });
     return { ok: true };
   } catch (err) {
     const cause = err;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.296.16",
+  "version": "0.296.17",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",