@feigi/fleet-ctl 3.76.3 → 3.76.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.76.3",
+  "version": "3.76.4",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/fleet-dir.mjs

@@ -13,7 +13,10 @@
 // it, otherwise the common git dir itself. This module is the spawn around
 // that function — the scrubbed env, the bound, the join onto `.fleet/` — so a
 // new `.fleet/`-rooted file is one `fleetFile("name")` call rather than
-// another hand-spelled probe.
+// another hand-spelled probe. The bound is per git child, not per call: when
+// the common git dir is not named `.git`, resolveWorkspace() runs a second
+// `rev-parse` after this module's own, with a bound of its own, so one call's
+// worst case approaches twice `timeoutMs`.
 //
 // One error policy: anything that leaves no workspace THROWS
 // FleetDirUnresolvable, never a null or an empty path. What a caller does
@@ -78,8 +81,10 @@ function workspaceOf(cwd, timeoutMs, canonicalise) {
   });
   // No separate `r.status === 0` gate: every failure mode (no repository, an
   // unresolvable GIT_DIR, a permission-denied `.git`, a corrupt worktree
-  // pointer, a missing `git` binary, a timed-out probe) leaves `r.stdout`
-  // empty, which resolveWorkspace() reads as `null` on its own.
+  // pointer, a missing `git` binary, a probe timed out before it printed)
+  // leaves `r.stdout` empty, which resolveWorkspace() reads as `null` on its
+  // own. A probe that printed its answer and was THEN killed at its bound
+  // leaves that answer in `r.stdout`, so resolveWorkspace() goes on with it.
   let found;
   try {
     found = resolveWorkspace(r.stdout, cwd, { canonicalise, timeoutMs });
@@ -109,6 +114,13 @@ function workspaceOf(cwd, timeoutMs, canonicalise) {
  * it. Everyone else prints the path it resolves, and realpath would change
  * that spelling without changing which file it names.
  *
+ * `timeoutMs` (default git-env.mjs's DEFAULT_GIT_TIMEOUT_MS) bounds each git
+ * child, not the call. When the common git dir is not named `.git` (the
+ * `.bare` layout, a bare repository, a submodule, a `--separate-git-dir`
+ * clone), resolveWorkspace() runs a second probe after `--git-common-dir`,
+ * with its own full `timeoutMs`, so one call's worst case approaches twice
+ * `timeoutMs`.
+ *
  * Throws FleetDirUnresolvable for every probe that leaves no workspace — no
  * repository, an unreadable `.git`, git missing, a probe killed at
  * `timeoutMs` — with git's own reason in the message.
@@ -132,8 +144,11 @@ export function fleetFile(name, { cwd = process.cwd(), timeoutMs, canonicalise =
  * so two clones that share a name get different roots. Both come from the
  * canonical form, so a symlinked route to one workspace is not a second root.
  *
- * `home` exists for tests; it defaults to the user's home directory. Throws
- * FleetDirUnresolvable exactly as fleetFile() does.
+ * `home` exists for tests; it defaults to the user's home directory.
+ * `timeoutMs` bounds each git child exactly as in fleetFile(): two may run in
+ * sequence when the common git dir is not named `.git`, so one call's worst
+ * case approaches twice `timeoutMs`. Throws FleetDirUnresolvable exactly as
+ * fleetFile() does.
  */
 export function scratchRoot({ cwd = process.cwd(), timeoutMs, home = homedir() } = {}) {
   const { dir, gitDir } = workspaceOf(cwd, timeoutMs, true);

package/scripts/git-env.mjs

@@ -159,6 +159,11 @@ function parentGitDirNames(parent, gitDir, cwd, timeoutMs) {
  * A path that does not resolve is not a failure: the caller gets back the
  * uncanonicalised path.
  *
+ * `timeoutMs` (default DEFAULT_GIT_TIMEOUT_MS) bounds this function's own
+ * step-2 probe only, the one spawn it makes. The caller's `--git-common-dir`
+ * probe that produced `gitCommonDir` is the caller's to bound, so a caller
+ * passing the same `timeoutMs` to both can wait close to twice that in all.
+ *
  * Throws WorkspaceProbeFailed only when the step-2 probe could not run to an
  * answer.
  */

package/scripts/ledger.mjs

@@ -124,12 +124,20 @@ function cause(...candidates) {
 // ledger and only warns (a fallback that predates this budget, not
 // something the budget introduces). It also stays under the `gh` bound beside it —
 // though "dominant" overstates that relationship: a normal invocation
-// without `--file` pays this same budget TWICE in sequence, once here and
-// once more in repoCheck() below, before ever reaching `gh` at all. At
-// default settings that TIES `gh`'s own 20 s bound when both probes stall,
-// and can EXCEED it — up to GIT_TIMEOUT_MS + 20 s — when only one stalls and
-// `gh` still runs (measured). `check`'s worst case is the sum of whichever
-// of the three children actually stall, not a single fixed term.
+// without `--file` can pay this same budget TWICE in sequence, once here and
+// once more in repoCheck() below, before ever reaching `gh` at all — and
+// THREE times in layouts whose common git dir is not named `.git` (the
+// `.bare` layout, a bare repository, a submodule, a `--separate-git-dir`
+// clone), where fleetFile() runs a second probe with its own full budget:
+// fleetFile()'s bound is per git child, not per call. At default settings
+// two stalled probes TIE `gh`'s own 20 s bound and three exceed it, and even
+// one stall can EXCEED it — up to GIT_TIMEOUT_MS + 20 s — when `gh` still
+// runs (measured). `check`'s worst case is the sum of whichever of its
+// children actually stall, not a single fixed term. That is three children
+// normally; in those layouts it is three git children, and `gh` is a fourth
+// only where the ledger's repository still has a work tree (a submodule) —
+// in the `.bare`, bare and `--separate-git-dir` layouts repoCheck() fails
+// and `gh` never runs (measured).
 //
 // `LEDGER_GIT_TIMEOUT` is this script's OWN override, in seconds, and it can
 // only ever SHORTEN. The rule and the reasons for it are net_budget's, in