@codyswann/lisa 4.4.5 → 4.4.7

package/plugins/lisa-harper-fabric/hooks/enforce-config-extensions.mjs

@@ -59,6 +59,44 @@ const gitEnv = () =>
     Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_"))
   );
 
+/**
+ * Milliseconds before the baseline read is presumed hung.
+ *
+ * A hang detector, not a budget. `git` reached through PATH on macOS goes via
+ * Apple's `xcrun` shim, measured over 20 seconds under load against 11ms for a
+ * real binary (CodySwannGT/lisa#2887), so a tighter deadline would make this
+ * hook's own timeout the ordinary outcome on a busy machine.
+ */
+const GIT_BUDGET_MS = 30_000;
+
+/** The baseline could not be read at all, as distinct from "there is none". */
+const UNREADABLE = Symbol("unreadable");
+
+/**
+ * The config as HEAD holds it: its text, `null` when HEAD has no such file, or
+ * `UNREADABLE` when git could not be asked.
+ *
+ * THE THREE ANSWERS ARE DELIBERATELY THREE. This used to be
+ * `result.status === 0 ? result.stdout : null`, and `status === 0` is false for
+ * a file that does not exist at HEAD **and** for a child killed at its
+ * deadline — so both became `null`, and the caller reads `null` as "no baseline
+ * to compare against, allow the edit". A busy machine therefore let through
+ * exactly the extension removal this hook exists to block, and nothing anywhere
+ * said the word "time".
+ *
+ * A deadline alone does not fix that. `spawnSync` does not throw when it kills
+ * a child; it returns `{ status: null, stdout: "" }`, which takes the same
+ * branch it always did. The discrimination has to be written, not scheduled —
+ * which is why this call site needed more than the `timeout:` its siblings did.
+ *
+ * `ETIMEDOUT` is set by Node itself, so this is a platform fact rather than a
+ * convention invented here; the shared `bounded-child.mjs` reads the same field,
+ * and this hook writes it out inline because a plugin payload materialized as a
+ * hook has no module to import from.
+ * @param {string} repoRoot Repository root.
+ * @returns {string|null|symbol} The text, `null` when absent, `UNREADABLE` when
+ *   the child was killed.
+ */
 const readGitBlob = repoRoot => {
   const result = spawnSync(
     "git",
@@ -66,8 +104,11 @@ const readGitBlob = repoRoot => {
     {
       encoding: "utf8",
       env: gitEnv(),
+      killSignal: "SIGKILL",
+      timeout: GIT_BUDGET_MS,
     }
   );
+  if (result.error?.code === "ETIMEDOUT") return UNREADABLE;
   return result.status === 0 ? result.stdout : null;
 };
 
@@ -104,6 +145,20 @@ const main = () => {
   }
 
   const previousText = readGitBlob(repoRoot);
+  // FAIL CLOSED on "could not ask", ALLOW on "there is nothing to compare".
+  // Those are different findings and only the second is safe to permit: a
+  // config with no baseline at HEAD is a new file, while a baseline nobody
+  // could read is an unanswered question, and a guard that permits an edit
+  // because it was too busy to check has not checked.
+  if (previousText === UNREADABLE) {
+    process.stderr.write(
+      `Blocked: could not read HEAD:${CONFIG_PATH} — git was killed after ` +
+        `${String(GIT_BUDGET_MS)}ms without finishing, so the previous ` +
+        `extensions are unknown. This is a timeout, not a finding: nothing ` +
+        `about the edit was measured. Re-run when the machine is quieter.\n`
+    );
+    return BLOCKED;
+  }
   if (previousText === null) return ALLOWED;
 
   const previousExtensions = topLevelExtensionKeys(previousText);

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/hooks/enforce-config-extensions.mjs

@@ -59,6 +59,44 @@ const gitEnv = () =>
     Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_"))
   );
 
+/**
+ * Milliseconds before the baseline read is presumed hung.
+ *
+ * A hang detector, not a budget. `git` reached through PATH on macOS goes via
+ * Apple's `xcrun` shim, measured over 20 seconds under load against 11ms for a
+ * real binary (CodySwannGT/lisa#2887), so a tighter deadline would make this
+ * hook's own timeout the ordinary outcome on a busy machine.
+ */
+const GIT_BUDGET_MS = 30_000;
+
+/** The baseline could not be read at all, as distinct from "there is none". */
+const UNREADABLE = Symbol("unreadable");
+
+/**
+ * The config as HEAD holds it: its text, `null` when HEAD has no such file, or
+ * `UNREADABLE` when git could not be asked.
+ *
+ * THE THREE ANSWERS ARE DELIBERATELY THREE. This used to be
+ * `result.status === 0 ? result.stdout : null`, and `status === 0` is false for
+ * a file that does not exist at HEAD **and** for a child killed at its
+ * deadline — so both became `null`, and the caller reads `null` as "no baseline
+ * to compare against, allow the edit". A busy machine therefore let through
+ * exactly the extension removal this hook exists to block, and nothing anywhere
+ * said the word "time".
+ *
+ * A deadline alone does not fix that. `spawnSync` does not throw when it kills
+ * a child; it returns `{ status: null, stdout: "" }`, which takes the same
+ * branch it always did. The discrimination has to be written, not scheduled —
+ * which is why this call site needed more than the `timeout:` its siblings did.
+ *
+ * `ETIMEDOUT` is set by Node itself, so this is a platform fact rather than a
+ * convention invented here; the shared `bounded-child.mjs` reads the same field,
+ * and this hook writes it out inline because a plugin payload materialized as a
+ * hook has no module to import from.
+ * @param {string} repoRoot Repository root.
+ * @returns {string|null|symbol} The text, `null` when absent, `UNREADABLE` when
+ *   the child was killed.
+ */
 const readGitBlob = repoRoot => {
   const result = spawnSync(
     "git",
@@ -66,8 +104,11 @@ const readGitBlob = repoRoot => {
     {
       encoding: "utf8",
       env: gitEnv(),
+      killSignal: "SIGKILL",
+      timeout: GIT_BUDGET_MS,
     }
   );
+  if (result.error?.code === "ETIMEDOUT") return UNREADABLE;
   return result.status === 0 ? result.stdout : null;
 };
 
@@ -104,6 +145,20 @@ const main = () => {
   }
 
   const previousText = readGitBlob(repoRoot);
+  // FAIL CLOSED on "could not ask", ALLOW on "there is nothing to compare".
+  // Those are different findings and only the second is safe to permit: a
+  // config with no baseline at HEAD is a new file, while a baseline nobody
+  // could read is an unanswered question, and a guard that permits an edit
+  // because it was too busy to check has not checked.
+  if (previousText === UNREADABLE) {
+    process.stderr.write(
+      `Blocked: could not read HEAD:${CONFIG_PATH} — git was killed after ` +
+        `${String(GIT_BUDGET_MS)}ms without finishing, so the previous ` +
+        `extensions are unknown. This is a timeout, not a finding: nothing ` +
+        `about the edit was measured. Re-run when the machine is quieter.\n`
+    );
+    return BLOCKED;
+  }
   if (previousText === null) return ALLOWED;
 
   const previousExtensions = topLevelExtensionKeys(previousText);

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/hooks/enforce-config-extensions.mjs

@@ -59,6 +59,44 @@ const gitEnv = () =>
     Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_"))
   );
 
+/**
+ * Milliseconds before the baseline read is presumed hung.
+ *
+ * A hang detector, not a budget. `git` reached through PATH on macOS goes via
+ * Apple's `xcrun` shim, measured over 20 seconds under load against 11ms for a
+ * real binary (CodySwannGT/lisa#2887), so a tighter deadline would make this
+ * hook's own timeout the ordinary outcome on a busy machine.
+ */
+const GIT_BUDGET_MS = 30_000;
+
+/** The baseline could not be read at all, as distinct from "there is none". */
+const UNREADABLE = Symbol("unreadable");
+
+/**
+ * The config as HEAD holds it: its text, `null` when HEAD has no such file, or
+ * `UNREADABLE` when git could not be asked.
+ *
+ * THE THREE ANSWERS ARE DELIBERATELY THREE. This used to be
+ * `result.status === 0 ? result.stdout : null`, and `status === 0` is false for
+ * a file that does not exist at HEAD **and** for a child killed at its
+ * deadline — so both became `null`, and the caller reads `null` as "no baseline
+ * to compare against, allow the edit". A busy machine therefore let through
+ * exactly the extension removal this hook exists to block, and nothing anywhere
+ * said the word "time".
+ *
+ * A deadline alone does not fix that. `spawnSync` does not throw when it kills
+ * a child; it returns `{ status: null, stdout: "" }`, which takes the same
+ * branch it always did. The discrimination has to be written, not scheduled —
+ * which is why this call site needed more than the `timeout:` its siblings did.
+ *
+ * `ETIMEDOUT` is set by Node itself, so this is a platform fact rather than a
+ * convention invented here; the shared `bounded-child.mjs` reads the same field,
+ * and this hook writes it out inline because a plugin payload materialized as a
+ * hook has no module to import from.
+ * @param {string} repoRoot Repository root.
+ * @returns {string|null|symbol} The text, `null` when absent, `UNREADABLE` when
+ *   the child was killed.
+ */
 const readGitBlob = repoRoot => {
   const result = spawnSync(
     "git",
@@ -66,8 +104,11 @@ const readGitBlob = repoRoot => {
     {
       encoding: "utf8",
       env: gitEnv(),
+      killSignal: "SIGKILL",
+      timeout: GIT_BUDGET_MS,
     }
   );
+  if (result.error?.code === "ETIMEDOUT") return UNREADABLE;
   return result.status === 0 ? result.stdout : null;
 };
 
@@ -104,6 +145,20 @@ const main = () => {
   }
 
   const previousText = readGitBlob(repoRoot);
+  // FAIL CLOSED on "could not ask", ALLOW on "there is nothing to compare".
+  // Those are different findings and only the second is safe to permit: a
+  // config with no baseline at HEAD is a new file, while a baseline nobody
+  // could read is an unanswered question, and a guard that permits an edit
+  // because it was too busy to check has not checked.
+  if (previousText === UNREADABLE) {
+    process.stderr.write(
+      `Blocked: could not read HEAD:${CONFIG_PATH} — git was killed after ` +
+        `${String(GIT_BUDGET_MS)}ms without finishing, so the previous ` +
+        `extensions are unknown. This is a timeout, not a finding: nothing ` +
+        `about the edit was measured. Re-run when the machine is quieter.\n`
+    );
+    return BLOCKED;
+  }
   if (previousText === null) return ALLOWED;
 
   const previousExtensions = topLevelExtensionKeys(previousText);

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/scripts/diff-guard.mjs

@@ -16,9 +16,10 @@
  * Usage: node diff-guard.mjs --allow <glob> [--allow <glob>...] [--base <ref>]
  * Exit 0 = all changes within allowed globs, 1 = out-of-bounds change (or git error).
  */
-import { execFileSync } from "node:child_process";
 import { globToRegExp } from "./_wiki-lib.mjs";
 
+import { boundedChildOutput } from "./lib/bounded-child.mjs";
+
 function fail(msg) {
   console.error(`✗ ${msg}`);
   process.exit(1);
@@ -51,7 +52,7 @@ if (allows.length === 0) {
 }
 
 function git(args) {
-  return execFileSync("git", args, { encoding: "utf8" });
+  return boundedChildOutput("git", args, { encoding: "utf8" });
 }
 
 let repoRoot;

package/plugins/lisa-wiki/scripts/ensure-wiki.mjs

@@ -49,7 +49,8 @@
  */
 import fs from "node:fs";
 import path from "node:path";
-import { execFileSync } from "node:child_process";
+
+import { boundedChildOutput } from "./lib/bounded-child.mjs";
 
 const GITIGNORE_BEGIN = "# BEGIN: AI GUARDRAILS WIKI MIRROR";
 const GITIGNORE_END = "# END: AI GUARDRAILS WIKI MIRROR";
@@ -71,7 +72,7 @@ function readJsonSafe(file) {
   }
 }
 function git(args, cwd) {
-  return execFileSync("git", args, {
+  return boundedChildOutput("git", args, {
     cwd,
     stdio: ["ignore", "pipe", "pipe"],
     encoding: "utf8",

package/plugins/lisa-wiki/scripts/ingest-git.mjs

@@ -14,9 +14,13 @@
  */
 import fs from "node:fs";
 import path from "node:path";
-import { execFileSync } from "node:child_process";
 import { readJsonSafe, writeSanitizedSourceNote } from "./_wiki-lib.mjs";
 
+import {
+  boundedChildOutput,
+  rethrowIfChildTimeout,
+} from "./lib/bounded-child.mjs";
+
 const argv = process.argv.slice(2);
 const opt = (n, d) => {
   const i = argv.indexOf(n);
@@ -35,7 +39,7 @@ const fail = m => {
   process.exit(1);
 };
 const git = args =>
-  execFileSync("git", ["-C", repo, ...args], { encoding: "utf8" }).trim();
+  boundedChildOutput("git", ["-C", repo, ...args], { encoding: "utf8" }).trim();
 const tryGit = args => {
   try {
     return git(args);
@@ -45,11 +49,13 @@ const tryGit = args => {
 };
 const commitExists = c => {
   try {
-    execFileSync("git", ["-C", repo, "cat-file", "-e", `${c}^{commit}`], {
+    boundedChildOutput("git", ["-C", repo, "cat-file", "-e", `${c}^{commit}`], {
       stdio: "ignore",
     });
     return true;
-  } catch {
+  } catch (error) {
+    // `false` is a verdict of "absent", not an admission of ignorance.
+    rethrowIfChildTimeout(error);
     return false;
   }
 };
@@ -87,7 +93,7 @@ let prSummary = "(no GitHub repo resolved — PR history skipped)";
 let ghRepo = githubRepo;
 if (!ghRepo) {
   try {
-    ghRepo = execFileSync(
+    ghRepo = boundedChildOutput(
       "gh",
       ["repo", "view", "--json", "nameWithOwner", "-q", ".nameWithOwner"],
       { cwd: repo, encoding: "utf8" }
@@ -99,7 +105,7 @@ if (!ghRepo) {
 if (ghRepo) {
   try {
     const prs = JSON.parse(
-      execFileSync(
+      boundedChildOutput(
         "gh",
         [
           "pr",