@geonosis/release 2.5.0 → 2.5.1

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # @geonosis/release
 
+## 2.5.1
+
+### Patch Changes
+
+- 7f24da6: `geonosis-release smoke baseline`/`smoke run --rc-dir` now write, beside the tarballs `packRc`
+  makes, a `candidate/` scratch package pinned to the candidate's own `@geonosis/cli` tarball (an
+  override for every packed name, in `package.json` and — pnpm actually reads it from —
+  `pnpm-workspace.yaml`), and print `candidate CLI: (cd <dir>/candidate && pnpm install
+  --ignore-scripts && pnpm exec geonosis update --registry <dir> --to <version> …)` (#389). A
+  consumer at 2.4.3 cannot run `update --registry <dir>` at all (it parses the directory as a URL),
+  and a bare tarball install cannot resolve its own siblings either (#387) — the adoption story had
+  no first step. `docs/releasing.md`'s RC section carries the line as that first step.
+- 7f24da6: A machine-wide heavy budget, two slots, held by every tool that spends one (#385): measured load 48
+  with during.day's Stop-hook tier, this kit's Stop-hook tier, its ratchet and an engineer's suite all
+  running at once — nothing held the two-slot budget across the two repos, and three kit tests read
+  red under it that were green alone. `@geonosis/ratchet` ships `takeSlot`/`heavySlotDir` (a lock
+  directory under `os.tmpdir()/geonosis-heavy`, two slot files each holding `{ pid, command, cwd,
+  startedAt }`, a dead holder reaped on the next take, a taker that finds both held waiting once
+  before refusing naming them); `geonosis-verify` (each tier run) and `geonosis-ratchet` (the run, not
+  `--prove`'s inner unit) take a slot for the run's duration. `@geonosis/release`'s `smoke
+  baseline`/`smoke run` take one too, from their own copy (this layer imports nothing, same posture as
+  `envelope.ts`). The plugin's Stop hook reads a fresh green `gate-report.<tier>.json` — its own
+  recorded commit equal to the current `HEAD` with a clean tree — and reports PASS without re-running;
+  otherwise it peeks the same two slots (never claims one itself, or the verify child it is about to
+  spawn would be racing against its own reservation) and blocks naming both holders rather than
+  running a third tier.
+- 7f24da6: The smoke's run copy sits where nothing is above it (#373's true root): it used to land at
+  `<root>/.geonosis/consumer-snapshots/<name>/run`, an ancestor of which (`<root>` itself) carries
+  this kit's own `node_modules` — so a package a consumer never installed resolved to the kit's own
+  workspace copy, two directories up, and every tool run inside the copy (the doctor included) read
+  it as theirs. The copy now lands under the OS temp directory instead, as `packages/verify`'s prove
+  copy does; its path is printed as `run copy: <path>` and it is removed on a passing run and kept
+  (for reading) on a failing one.
+- 7f24da6: The smoke runner owns its child's lifetime (#368): two `pnpm install` processes from a 2026-09-03
+  smoke were still alive two days later, holding pnpm's store lock every other install on the machine
+  then waits on. Every install and phase now spawns in its own process group with a timeout (default
+  20 minutes, `release.smoke.timeoutMs` overrides it) and is killed by the WHOLE group — SIGTERM, then
+  SIGKILL after a grace period — on timeout; a timed-out phase is recorded as a fail with the tail
+  `timed out after <n> ms — killed`.
+
 ## 2.5.0
 
 ### Patch Changes

package/bin/geonosis-release.mjs

@@ -9,11 +9,19 @@ import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 const here = dirname(fileURLToPath(import.meta.url))
-const newest = (dir) =>
+// tsup never reads a test file, so one counting as source made every bin refuse a build that had
+// not gone stale (#399).
+const NOT_SOURCE = (name) =>
+  name.endsWith('.test.ts') ||
+  name.endsWith('.test.tsx') ||
+  name === '__tests__' ||
+  name === '__fixtures__'
+const newest = (dir, skip) =>
   existsSync(dir)
     ? readdirSync(dir, { withFileTypes: true }).reduce((most, entry) => {
+        if (skip !== undefined && skip(entry.name)) return most
         const at = join(dir, entry.name)
-        return Math.max(most, entry.isDirectory() ? newest(at) : statSync(at).mtimeMs)
+        return Math.max(most, entry.isDirectory() ? newest(at, skip) : statSync(at).mtimeMs)
       }, 0)
     : 0
 const src = join(here, '..', 'src')
@@ -30,7 +38,7 @@ if (existsSync(src)) {
     )
     process.exit(2)
   }
-  if (newest(src) > built) {
+  if (newest(src, NOT_SOURCE) > built) {
     process.stderr.write(
       'geonosis-release: dist is older than src — run pnpm build before trusting this bin.\n',
     )

package/dist/{chunk-NNGZ47I5.js → chunk-RQOZEZSB.js}

@@ -97,7 +97,7 @@ var parseSchema = (value2) => {
     sessionVariables: strings(value2["sessionVariables"], "release.schema.sessionVariables")
   };
 };
-var SMOKE_KEYS = "expected { exclude?, snapshots? }";
+var SMOKE_KEYS = "expected { exclude?, snapshots?, timeoutMs? }";
 var SNAPSHOT_KEYS = "expected { commands?, install?, name }";
 var SMOKE_PHASES = PHASES;
 var parseCommands = (value2, at) => {
@@ -146,10 +146,11 @@ var oneSnapshot = (value2, index) => {
     name
   };
 };
+var KNOWN_SMOKE_KEYS = /* @__PURE__ */ new Set(["exclude", "snapshots", "timeoutMs"]);
 var parseSmoke = (value2) => {
   if (value2 === void 0) return { exclude: [], snapshots: [] };
   if (!isRecord(value2)) throw new CannotRun(`release.smoke must be an object \u2014 ${SMOKE_KEYS}`);
-  const unknown = Object.keys(value2).find((key) => key !== "exclude" && key !== "snapshots");
+  const unknown = Object.keys(value2).find((key) => !KNOWN_SMOKE_KEYS.has(key));
   if (unknown !== void 0) {
     throw new CannotRun(`release.smoke.${unknown} is not a key it reads \u2014 ${SMOKE_KEYS}`);
   }
@@ -157,9 +158,14 @@ var parseSmoke = (value2) => {
   if (snapshots !== void 0 && !Array.isArray(snapshots)) {
     throw new CannotRun(`release.smoke.snapshots must be a list \u2014 ${SNAPSHOT_KEYS}, per entry`);
   }
+  const timeoutMs = value2["timeoutMs"];
+  if (timeoutMs !== void 0 && (typeof timeoutMs !== "number" || timeoutMs <= 0)) {
+    throw new CannotRun("release.smoke.timeoutMs must be a positive number of milliseconds");
+  }
   return {
     exclude: strings(value2["exclude"], "release.smoke.exclude"),
-    snapshots: (snapshots ?? []).map(oneSnapshot)
+    snapshots: (snapshots ?? []).map(oneSnapshot),
+    ...timeoutMs === void 0 ? {} : { timeoutMs }
   };
 };
 var parseReleaseConfig = (raw) => {
@@ -366,9 +372,18 @@ var askRegistry = async ({
 };
 
 // src/published.ts
-import { readdirSync, readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
+
+// src/manifests.ts
+import { readdirSync } from "fs";
 import { join as join2, relative, sep } from "path";
-var NEVER_WALKED = /* @__PURE__ */ new Set(["build", "coverage", "dist", "node_modules", "storybook-static"]);
+var NEVER_WALKED = /* @__PURE__ */ new Set([
+  "build",
+  "coverage",
+  "dist",
+  "node_modules",
+  "storybook-static"
+]);
 var pathOf = (root, path) => relative(root, path).split(sep).join("/");
 var manifestsUnder = (root) => {
   const found = [];
@@ -391,6 +406,8 @@ var manifestsUnder = (root) => {
   walk(root);
   return found;
 };
+
+// src/published.ts
 var censusOf = (root) => {
   const excused = [];
   const locals = [];
@@ -1178,16 +1195,16 @@ var declaredIn = (config) => {
     routes: listed.map((route) => isRecord3(route) ? route["pattern"] : route).filter((pattern) => typeof pattern === "string").toSorted()
   };
 };
-var readWrangler = (root, relative6, env) => {
-  const path = resolve4(root, relative6);
+var readWrangler = (root, relative4, env) => {
+  const path = resolve4(root, relative4);
   let parsed;
   try {
     const source = readFileSync6(path, "utf8");
-    parsed = relative6.endsWith(".toml") ? parseToml(source) : parseJsonc(source);
+    parsed = relative4.endsWith(".toml") ? parseToml(source) : parseJsonc(source);
   } catch (error) {
-    throw new CannotRun(`${relative6} could not be read: ${error.message}`);
+    throw new CannotRun(`${relative4} could not be read: ${error.message}`);
   }
-  if (!isRecord3(parsed)) throw new CannotRun(`${relative6} is not a wrangler configuration`);
+  if (!isRecord3(parsed)) throw new CannotRun(`${relative4} is not a wrangler configuration`);
   const environments = parsed["env"];
   const block = env !== void 0 && isRecord3(environments) && isRecord3(environments[env]) ? environments[env] : parsed;
   return declaredIn(block);
@@ -1987,9 +2004,18 @@ var formatSchema = (report) => {
 };
 
 // src/smoke-run.ts
-import { spawnSync as spawnSync4 } from "child_process";
-import { existsSync as existsSync7, mkdirSync as mkdirSync3, readdirSync as readdirSync5, readFileSync as readFileSync10, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join7, relative as relative4, resolve as resolve9 } from "path";
+import { spawn as spawn2, spawnSync as spawnSync4 } from "child_process";
+import {
+  existsSync as existsSync7,
+  mkdirSync as mkdirSync3,
+  mkdtempSync as mkdtempSync2,
+  readdirSync as readdirSync5,
+  readFileSync as readFileSync10,
+  rmSync as rmSync3,
+  writeFileSync as writeFileSync4
+} from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join7, resolve as resolve9 } from "path";
 var BASELINE_FILE = "baseline.json";
 var INSTALL = {
   bun: ["install"],
@@ -2098,7 +2124,7 @@ var TOP_LEVEL = /^\S/;
 var KEYED = /^\s+["']?(.+?)["']?\s*:/;
 var pinsInWorkspaceYaml = (work, pins) => {
   const at = join7(work, "pnpm-workspace.yaml");
-  const written = Object.entries(pins).map(([name, spec]) => `  '${name}': '${spec}'`);
+  const written = Object.entries(pins).filter((entry) => entry[1] !== void 0).map(([name, spec]) => `  '${name}': '${spec}'`);
   const lines2 = existsSync7(at) ? readFileSync10(at, "utf8").split("\n") : [];
   const kept = [];
   let inside = false;
@@ -2111,10 +2137,10 @@ var pinsInWorkspaceYaml = (work, pins) => {
       continue;
     }
     const key = inside ? KEYED.exec(line)?.[1] : void 0;
-    if (key !== void 0 && pins[key] !== void 0) continue;
+    if (key !== void 0 && Object.hasOwn(pins, key)) continue;
     kept.push(line);
   }
-  const body = found ? kept : [...kept, OVERRIDES, ...written, ""];
+  const body = found ? kept : written.length === 0 ? kept : [...kept, OVERRIDES, ...written, ""];
   writeFileSync4(at, body.join("\n"));
 };
 var pinsInManifest = (work, pins) => {
@@ -2122,13 +2148,42 @@ var pinsInManifest = (work, pins) => {
   if (!existsSync7(at)) return;
   const manifest = readJson(at);
   if (!isRecord5(manifest)) return;
-  manifest["overrides"] = {
-    ...isRecord5(manifest["overrides"]) ? manifest["overrides"] : {},
-    ...pins
-  };
+  const next = isRecord5(manifest["overrides"]) ? { ...manifest["overrides"] } : {};
+  for (const [name, spec] of Object.entries(pins)) {
+    if (spec === void 0) delete next[name];
+    else next[name] = spec;
+  }
+  manifest["overrides"] = next;
   writeFileSync4(at, `${JSON.stringify(manifest, void 0, 2)}
 `);
 };
+var CANDIDATE_CLI = "@geonosis/cli";
+var candidateDirIn = (into, packed) => {
+  const cli = packed.find((one) => one.name === CANDIDATE_CLI);
+  if (cli === void 0) return void 0;
+  const dir = join7(into, "candidate");
+  mkdirSync3(dir, { recursive: true });
+  const pins = Object.fromEntries(packed.map((one) => [one.name, `file:${one.tarball}`]));
+  writeFileSync4(
+    join7(dir, "package.json"),
+    `${JSON.stringify(
+      {
+        devDependencies: { [CANDIDATE_CLI]: `file:${cli.tarball}` },
+        name: "geonosis-candidate",
+        overrides: pins,
+        private: true
+      },
+      void 0,
+      2
+    )}
+`
+  );
+  pinsInWorkspaceYaml(dir, pins);
+  return {
+    line: `candidate CLI: (cd ${dir} && pnpm install --ignore-scripts && pnpm exec geonosis update --registry ${into} --to ${cli.version} \u2026)`,
+    path: dir
+  };
+};
 var overrideEveryCopy = (work, manager, packed) => {
   if (packed.length === 0) return;
   const pins = Object.fromEntries(packed.map((one) => [one.name, `file:${one.tarball}`]));
@@ -2160,9 +2215,62 @@ var rewriteManifests = (tree, manifests, packed) => {
   }
   return swapped;
 };
-var shellRun = (command, cwd, env) => {
-  const done = spawnSync4(command, { cwd, encoding: "utf8", env, shell: true });
-  return { code: done.status ?? -1, output: `${done.stdout ?? ""}${done.stderr ?? ""}` };
+var DEFAULT_PHASE_TIMEOUT_MS = 20 * 6e4;
+var KILL_GRACE_MS = 5e3;
+var groupsThisProcessOwns = /* @__PURE__ */ new Set();
+var killGroup = (pid, signal) => {
+  try {
+    process.kill(-pid, signal);
+  } catch {
+  }
+};
+var ownsItsExit = false;
+var ownEveryGroupOnExit = () => {
+  if (ownsItsExit) return;
+  ownsItsExit = true;
+  const sweep = () => {
+    for (const pid of groupsThisProcessOwns) killGroup(pid, "SIGKILL");
+  };
+  process.once("exit", sweep);
+  process.once("SIGINT", sweep);
+  process.once("SIGTERM", sweep);
+};
+var shellRun = (command, cwd, env, timeoutMs = DEFAULT_PHASE_TIMEOUT_MS) => {
+  ownEveryGroupOnExit();
+  return new Promise((settle) => {
+    const child = spawn2(command, {
+      cwd,
+      detached: true,
+      env,
+      shell: true,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const pid = child.pid;
+    if (pid !== void 0) groupsThisProcessOwns.add(pid);
+    let output = "";
+    child.stdout?.on("data", (chunk) => {
+      output += chunk.toString();
+    });
+    child.stderr?.on("data", (chunk) => {
+      output += chunk.toString();
+    });
+    let timedOut = false;
+    let graceTimer;
+    const deadline = setTimeout(() => {
+      timedOut = true;
+      if (pid === void 0) return;
+      killGroup(pid, "SIGTERM");
+      graceTimer = setTimeout(() => killGroup(pid, "SIGKILL"), KILL_GRACE_MS);
+    }, timeoutMs);
+    const finish = (code) => {
+      clearTimeout(deadline);
+      if (graceTimer !== void 0) clearTimeout(graceTimer);
+      if (pid !== void 0) groupsThisProcessOwns.delete(pid);
+      settle({ code: code ?? -1, output, timedOut });
+    };
+    child.on("error", () => finish(-1));
+    child.on("close", (code) => finish(code));
+  });
 };
 var INTERESTING = /\b(error|Error|ERROR|FAIL|failed|refused|✗|✘)\b/;
 var quotable = (output) => {
@@ -2175,14 +2283,23 @@ var GIT_REFUSAL = /fatal: not a git repository|Command failed: git |git .+ faile
 var looksLikeAGitRefusal = (output) => output.split("\n").some((line) => GIT_REFUSAL.test(line));
 var hasNoCommit = (dir) => spawnSync4("git", ["-C", dir, "rev-parse", "--verify", "-q", "HEAD"], { encoding: "utf8" }).status !== 0;
 var NOT_MEASURED_REASON = "this gate asks git and a snapshot has none";
-var runPhase = (phase, command, cwd, manager) => {
+var runPhase = async (phase, command, cwd, manager, timeoutMs = DEFAULT_PHASE_TIMEOUT_MS) => {
   if ("why" in command) return { phase, why: command.why };
   const line = commandLine(command, manager);
   const env = {
     ...process.env,
     PATH: `${join7(cwd, "node_modules/.bin")}:${process.env["PATH"] ?? ""}`
   };
-  const { code, output } = shellRun(line, cwd, env);
+  const { code, output, timedOut } = await shellRun(line, cwd, env, timeoutMs);
+  if (timedOut) {
+    return {
+      code: 124,
+      command: line,
+      lines: [...quotable(output), `timed out after ${timeoutMs} ms \u2014 killed`],
+      ok: false,
+      phase
+    };
+  }
   if (code !== 0 && looksLikeAGitRefusal(output) && hasNoCommit(cwd)) {
     return { command: line, phase, unmeasurable: NOT_MEASURED_REASON };
   }
@@ -2194,53 +2311,70 @@ var commandsToRun = (record, declared) => Object.fromEntries(
     return [phase, named === void 0 ? record.commands[phase] : { exec: named }];
   })
 );
-var smokeOver = (input) => {
+var smokeOver = async (input) => {
+  const timeoutMs = readReleaseConfig(input.root).smoke?.timeoutMs ?? DEFAULT_PHASE_TIMEOUT_MS;
   const record = readSnapshot(input.root, input.name);
   const at = snapshotDir(input.root, input.name);
-  const work = join7(at, "run");
-  rmSync3(work, { force: true, recursive: true });
-  copyInto(join7(at, "tree"), work, new Set(EXCLUDED_DIRS));
-  ownRepository(work);
-  const packed = input.rc === void 0 ? [] : packRc(resolve9(input.rc), join7(at, "rc"));
-  const findings = input.rc === void 0 ? [] : promisedButNotPacked(resolve9(input.rc), packed);
-  const swapped = rewriteManifests(
-    work,
-    record.manifests.map((one) => one.path),
-    packed
-  );
-  if (input.rc !== void 0 && swapped.length === 0) {
-    throw new CannotRun(
-      `no manifest in "${input.name}" depends on anything ${input.rc} packs \u2014 this run would have installed the published versions and called them the release candidate`
+  const work = mkdtempSync2(join7(tmpdir2(), "geonosis-smoke-"));
+  try {
+    copyInto(join7(at, "tree"), work, new Set(EXCLUDED_DIRS));
+    ownRepository(work);
+    const rcDir = join7(at, "rc");
+    const packed = input.rc === void 0 ? [] : packRc(resolve9(input.rc), rcDir);
+    const candidate = input.rc === void 0 ? void 0 : candidateDirIn(rcDir, packed)?.line;
+    const findings = input.rc === void 0 ? [] : promisedButNotPacked(resolve9(input.rc), packed);
+    const swapped = rewriteManifests(
+      work,
+      record.manifests.map((one) => one.path),
+      packed
     );
-  }
-  overrideEveryCopy(work, record.manager, packed);
-  const frozen = input.rc === void 0;
-  const install = input.install ?? defaultInstallLine(record.manager, frozen);
-  const configBefore = configBytesOf(work);
-  const installed = shellRun(install, work, process.env);
-  if (installed.code !== 0) {
-    if (frozen) {
+    if (input.rc !== void 0 && swapped.length === 0) {
       throw new CannotRun(
-        `\`${install}\` exited ${installed.code} in the snapshot \u2014 the baseline is the consumer's own tree and their lockfile does not describe it \u2014 record it after they install:
+        `no manifest in "${input.name}" depends on anything ${input.rc} packs \u2014 this run would have installed the published versions and called them the release candidate`
+      );
+    }
+    overrideEveryCopy(work, record.manager, packed);
+    const frozen = input.rc === void 0;
+    const install = input.install ?? defaultInstallLine(record.manager, frozen);
+    const configBefore = configBytesOf(work);
+    const installed = await shellRun(install, work, process.env, timeoutMs);
+    if (installed.timedOut) {
+      throw new CannotRun(
+        `\`${install}\` timed out after ${timeoutMs} ms in the snapshot and was killed \u2014 nothing below it was measured:
 ${quotable(installed.output).join("\n")}`
       );
     }
-    throw new CannotRun(
-      `\`${install}\` exited ${installed.code} in the snapshot \u2014 the release was never installed, so nothing below it was measured:
+    if (installed.code !== 0) {
+      if (frozen) {
+        throw new CannotRun(
+          `\`${install}\` exited ${installed.code} in the snapshot \u2014 the baseline is the consumer's own tree and their lockfile does not describe it \u2014 record it after they install:
 ${quotable(installed.output).join("\n")}`
-    );
-  }
-  for (const file of editedByInstall(configBefore, configBytesOf(work))) {
-    findings.push(
-      `\`${install}\` rewrote ${file} in the copy \u2014 every phase below ran against a tree that is no longer byte-for-byte "${input.name}", and the same install in their own tree would edit theirs`
-    );
+        );
+      }
+      throw new CannotRun(
+        `\`${install}\` exited ${installed.code} in the snapshot \u2014 the release was never installed, so nothing below it was measured:
+${quotable(installed.output).join("\n")}`
+      );
+    }
+    for (const file of editedByInstall(configBefore, configBytesOf(work))) {
+      findings.push(
+        `\`${install}\` rewrote ${file} in the copy \u2014 every phase below ran against a tree that is no longer byte-for-byte "${input.name}", and the same install in their own tree would edit theirs`
+      );
+    }
+    const commands = commandsToRun(record, input.commands ?? {});
+    const outcomes = [];
+    for (const phase of PHASES) {
+      outcomes.push(await runPhase(phase, commands[phase], work, record.manager, timeoutMs));
+    }
+    if (outcomes.every((one) => !("ok" in one) || one.ok)) {
+      rmSync3(work, { force: true, recursive: true });
+    }
+    return { ...candidate === void 0 ? {} : { candidate }, findings, outcomes, packed, work };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new CannotRun(`${message}
+run copy: ${work}`);
   }
-  const commands = commandsToRun(record, input.commands ?? {});
-  return {
-    findings,
-    outcomes: PHASES.map((phase) => runPhase(phase, commands[phase], work, record.manager)),
-    packed
-  };
 };
 var ownRepository = (work) => {
   const done = spawnSync4("git", ["init", "-q"], { cwd: work });
@@ -2251,13 +2385,15 @@ var ownRepository = (work) => {
   }
 };
 var baselinePath = (root, name) => join7(snapshotDir(root, name), BASELINE_FILE);
-var recordBaseline = (input) => {
-  const { outcomes, packed } = smokeOver(input);
+var recordBaseline = async (input) => {
+  const { candidate, outcomes, packed, work } = await smokeOver(input);
   const baseline = {
     at: (/* @__PURE__ */ new Date()).toISOString(),
+    ...candidate === void 0 ? {} : { candidate },
     packed: packed.map((one) => ({ name: one.name, version: one.version })),
     phases: outcomes,
-    rc: input.rc === void 0 ? "the versions the tree names" : resolve9(input.rc)
+    rc: input.rc === void 0 ? "the versions the tree names" : resolve9(input.rc),
+    ...existsSync7(work) ? { runCopy: work } : {}
   };
   writeFileSync4(baselinePath(input.root, input.name), `${JSON.stringify(baseline, void 0, 2)}
 `);
@@ -2315,10 +2451,14 @@ var compareToBaseline = (name, baseline, outcomes, findings) => {
     refused
   };
 };
-var runSmoke = (input) => {
+var runSmoke = async (input) => {
   const baseline = readBaseline(input.root, input.name);
-  const { findings, outcomes } = smokeOver(input);
-  return compareToBaseline(input.name, baseline, outcomes, findings);
+  const { candidate, findings, outcomes, work } = await smokeOver(input);
+  return {
+    ...compareToBaseline(input.name, baseline, outcomes, findings),
+    ...candidate === void 0 ? {} : { candidate },
+    ...existsSync7(work) ? { runCopy: work } : {}
+  };
 };
 var CONSUMER_TREES_FILE = ".geonosis/consumer-trees.local.json";
 var localTrees = (root) => {
@@ -2356,28 +2496,31 @@ var dating = (root, name) => {
   if (!("sha" in now) || now.sha === commit.sha) return void 0;
   return { stale: `STALE ${name}: recorded at ${commit.sha}, the tree is at ${now.sha}` };
 };
-var sweepSmoke = (input) => {
+var sweepSmoke = async (input) => {
   const absent = input.absent ?? [];
   if (input.skipMissing) {
     const owed = unrecordedButHere(input.root, input.wanted, absent);
     if (owed.length > 0) throw new CannotRun(owed.join("\n"));
   }
-  const entries = input.wanted.map((one) => {
+  const entries = [];
+  for (const one of input.wanted) {
     if (absent.includes(one.name)) {
-      return {
+      entries.push({
         name: one.name,
         why: "--absent named it, so this release was not read against it"
-      };
+      });
+      continue;
     }
     if (input.skipMissing && !recordedAlready(input.root, one.name)) {
-      return {
+      entries.push({
         name: one.name,
         why: `no snapshot of it here \u2014 record one with: geonosis-release smoke snapshot ${one.name} --from <their tree>`
-      };
+      });
+      continue;
     }
     const note = dating(input.root, one.name);
-    return {
-      comparison: runSmoke({
+    entries.push({
+      comparison: await runSmoke({
         ...one.commands === void 0 ? {} : { commands: one.commands },
         ...one.install === void 0 ? {} : { install: one.install },
         name: one.name,
@@ -2386,8 +2529,8 @@ var sweepSmoke = (input) => {
       }),
       name: one.name,
       ...note === void 0 ? {} : { note }
-    };
-  });
+    });
+  }
   return { entries };
 };
 var comparisonsIn = (sweep) => sweep.entries.flatMap((one) => "comparison" in one ? [one.comparison] : []);
@@ -2468,6 +2611,10 @@ var headline = (comparison) => {
 };
 var formatSmoke = (comparison) => [
   headline(comparison),
+  ...comparison.candidate === void 0 ? [] : [`  ${comparison.candidate}
+`],
+  ...comparison.runCopy === void 0 ? [] : [`  run copy: ${comparison.runCopy}
+`],
   ...comparison.outcomes.map(outcomeLine),
   ...comparison.broken.flatMap((one) => [
     `  ${one.phase} passed at the versions they are on and fails under this release:
@@ -2491,6 +2638,10 @@ var formatSmoke = (comparison) => [
 var formatBaseline = (name, baseline) => [
   `OK    baseline ${name}: recorded against ${baseline.rc}
 `,
+  ...baseline.candidate === void 0 ? [] : [`  ${baseline.candidate}
+`],
+  ...baseline.runCopy === void 0 ? [] : [`  run copy: ${baseline.runCopy}
+`],
   ...baseline.phases.map(outcomeLine)
 ].join("");
 var SMOKE_TOOL = "release-smoke";
@@ -2519,8 +2670,8 @@ var smokeEnvelope = (comparison, durationMs) => {
 };
 
 // src/changelog.ts
-import { existsSync as existsSync8, readdirSync as readdirSync6, readFileSync as readFileSync11 } from "fs";
-import { join as join8, relative as relative5, resolve as resolve10, sep as sep4 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync11 } from "fs";
+import { dirname as dirname3, join as join8, resolve as resolve10 } from "path";
 var CHANGELOG = "CHANGELOG.md";
 var VERSION_HEADING = /^##\s+v?(\d+\.\d+\.\d+.*)$/;
 var emptyHeadingsIn = (body, at) => {
@@ -2569,35 +2720,18 @@ var formatChangelogs = (report) => [
   ),
   report.empty.length === 0 ? `changelog PASS \u2014 ${report.versions} version heading(s) over ${report.read} file(s), every one of them says something` : `changelog FAIL \u2014 ${report.empty.length} of ${report.versions} version heading(s) over ${report.read} file(s) are empty`
 ].join("\n");
-var NEVER_WALKED3 = /* @__PURE__ */ new Set(["build", "coverage", "dist", "node_modules", "storybook-static"]);
 var publishableDirs = (root) => {
   const found = [];
-  const walk = (dir) => {
-    let entries;
+  for (const path of manifestsUnder(root)) {
+    let manifest;
     try {
-      entries = readdirSync6(dir, { withFileTypes: true });
+      manifest = JSON.parse(readFileSync11(path, "utf8"));
     } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (entry.isDirectory()) {
-        if (!entry.name.startsWith(".") && !NEVER_WALKED3.has(entry.name)) {
-          walk(join8(dir, entry.name));
-        }
-        continue;
-      }
-      if (entry.name !== "package.json") continue;
-      let manifest;
-      try {
-        manifest = JSON.parse(readFileSync11(join8(dir, entry.name), "utf8"));
-      } catch {
-        continue;
-      }
-      if (manifest.private === true || typeof manifest.name !== "string") continue;
-      found.push(relative5(root, dir).split(sep4).join("/"));
+      continue;
     }
-  };
-  walk(root);
+    if (manifest.private === true || typeof manifest.name !== "string") continue;
+    found.push(pathOf(root, dirname3(path)));
+  }
   return found.filter((one) => one !== "").toSorted();
 };
 

package/dist/index.d.ts

@@ -197,6 +197,8 @@ type SmokeSnapshotConfig = {
 type SmokeConfig = {
     exclude?: string[];
     snapshots?: SmokeSnapshotConfig[];
+    /** How long an install or a phase may run before the runner kills its whole process group (#368). */
+    timeoutMs?: number;
 };
 /**
  * Law 6: every directory, dialect, secret name and worker is an OPTION. The defaults are empty, and
@@ -540,18 +542,24 @@ type Packed = {
 };
 type SmokeBaseline = {
     at: string;
+    /** The candidate's first step (#389) — absent when this run packed no `@geonosis/cli`. */
+    candidate?: string;
     packed: {
         name: string;
         version: string;
     }[];
     phases: PhaseOutcome[];
     rc: string;
+    /** Where a phase that failed left its copy — absent when every phase that ran passed. */
+    runCopy?: string;
 };
 type SmokeComparison = {
     broken: {
         lines: string[];
         phase: SmokePhase;
     }[];
+    /** The candidate's first step (#389) — absent when this run packed no `@geonosis/cli`. */
+    candidate?: string;
     findings: string[];
     known: SmokePhase[];
     mended: SmokePhase[];
@@ -562,6 +570,8 @@ type SmokeComparison = {
         phase: SmokePhase;
         why: string;
     }[];
+    /** Where a phase that failed left its copy — absent when every phase that ran passed. */
+    runCopy?: string;
 };
 declare const BASELINE_FILE = "baseline.json";
 /**
@@ -591,10 +601,10 @@ type RunInput = {
     rc?: string;
     root: string;
 };
-declare const recordBaseline: (input: RunInput) => SmokeBaseline;
+declare const recordBaseline: (input: RunInput) => Promise<SmokeBaseline>;
 declare const readBaseline: (root: string, name: string) => SmokeBaseline;
 declare const compareToBaseline: (name: string, baseline: SmokeBaseline, outcomes: PhaseOutcome[], findings: string[]) => SmokeComparison;
-declare const runSmoke: (input: RunInput) => SmokeComparison;
+declare const runSmoke: (input: RunInput) => Promise<SmokeComparison>;
 /**
  * What the sweep can say about WHEN a recording was taken: that its source has moved on, or that
  * the question cannot be asked of it at all.
@@ -649,7 +659,7 @@ declare const sweepSmoke: (input: {
      */
     skipMissing: boolean;
     wanted: WantedSnapshot[];
-}) => SmokeSweep;
+}) => Promise<SmokeSweep>;
 declare const comparisonsIn: (sweep: SmokeSweep) => SmokeComparison[];
 declare const formatSweep: (sweep: SmokeSweep) => string;
 declare const sweepEnvelope: (sweep: SmokeSweep, durationMs: number) => ReportEnvelope;

package/dist/index.js

@@ -74,7 +74,7 @@ import {
   statementsOf,
   sweepEnvelope,
   sweepSmoke
-} from "./chunk-NNGZ47I5.js";
+} from "./chunk-RQOZEZSB.js";
 export {
   ADOPTION_NEXT,
   ADOPTION_TOOL,

package/dist/release-cli.js

@@ -40,11 +40,111 @@ import {
   sweepEnvelope,
   sweepSmoke,
   writeEnvelope
-} from "./chunk-NNGZ47I5.js";
+} from "./chunk-RQOZEZSB.js";
 
 // src/release-cli.ts
 import { existsSync } from "fs";
-import { join, resolve } from "path";
+import { join as join2, resolve } from "path";
+
+// src/heavy-slot.ts
+import { randomUUID } from "crypto";
+import { linkSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { dirname, join } from "path";
+var HEAVY_SLOTS = 2;
+var DEFAULT_WAIT_MS = 20 * 6e4;
+var heavySlotDir = () => {
+  const named = process.env.GEONOSIS_HEAVY_SLOT_DIR;
+  if (named !== void 0 && named !== "") return named;
+  return join(tmpdir(), "geonosis-heavy");
+};
+var slotPath = (dir, at) => join(dir, `slot-${at}.json`);
+var alive = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+};
+var holderOf = (path) => {
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    return typeof parsed.pid === "number" ? {
+      command: parsed.command ?? "unknown",
+      cwd: parsed.cwd ?? "somewhere",
+      pid: parsed.pid,
+      startedAt: parsed.startedAt ?? "unknown"
+    } : void 0;
+  } catch {
+    return void 0;
+  }
+};
+var reapIfDead = (path) => {
+  const holder = holderOf(path);
+  if (holder !== void 0 && !alive(holder.pid)) rmSync(path, { force: true });
+};
+var claim = (path, holder) => {
+  mkdirSync(dirname(path), { recursive: true });
+  const staging = `${path}.${holder.pid}.${randomUUID()}`;
+  try {
+    writeFileSync(staging, JSON.stringify(holder));
+    linkSync(staging, path);
+    return true;
+  } catch (error) {
+    if (error.code === "EEXIST") return false;
+    throw error;
+  } finally {
+    rmSync(staging, { force: true });
+  }
+};
+var sleep = (ms) => new Promise((done) => setTimeout(done, ms));
+var namedHolders = (dir) => Array.from({ length: HEAVY_SLOTS }, (_unused, at) => holderOf(slotPath(dir, at))).filter(
+  (holder) => holder !== void 0
+);
+var describeHolders = (holders) => holders.map((one) => `${one.pid} ${one.command} since ${one.startedAt}`).join(", ");
+var HeavySlotTimeout = class extends Error {
+};
+var takeSlot = async ({
+  command,
+  cwd = process.cwd(),
+  dir = heavySlotDir(),
+  pollMs = 250,
+  say = (line) => process.stderr.write(`${line}
+`),
+  waitMs = Number(process.env.GEONOSIS_HEAVY_WAIT_MS ?? "") || DEFAULT_WAIT_MS
+}) => {
+  const until = Date.now() + waitMs;
+  let told = false;
+  for (; ; ) {
+    for (let at = 0; at < HEAVY_SLOTS; at += 1) {
+      const path = slotPath(dir, at);
+      reapIfDead(path);
+      const mine = {
+        command,
+        cwd,
+        pid: process.pid,
+        startedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      if (claim(path, mine)) {
+        return () => {
+          if (holderOf(path)?.pid === process.pid) rmSync(path, { force: true });
+        };
+      }
+    }
+    const holders = namedHolders(dir);
+    if (!told) {
+      told = true;
+      say(`waiting for a heavy slot: ${holders.length} held \u2014 ${describeHolders(holders)}`);
+    }
+    if (Date.now() >= until) {
+      throw new HeavySlotTimeout(
+        `waited ${waitMs} ms for a heavy slot: ${holders.length} held \u2014 ${describeHolders(holders)}`
+      );
+    }
+    await sleep(pollMs);
+  }
+};
 
 // src/since.ts
 var MEANS = {
@@ -416,32 +516,37 @@ var wantedSnapshots = (parsed, root) => {
 var rcOf = (parsed, root, cwd) => {
   const named = parsed.read["--rc-dir"];
   if (named !== void 0) return resolve(cwd, named);
-  if (existsSync(join(root, "package.json"))) return root;
+  if (existsSync(join2(root, "package.json"))) return root;
   throw new CannotRun(
     "nothing here is a release candidate \u2014 pass --rc-dir <the workspace whose packages this release publishes>, because a smoke with nothing packed compares a tree to itself"
   );
 };
-var baseline = (parsed, root, cwd) => {
+var baseline = async (parsed, root, cwd) => {
   const wanted = wantedSnapshots(parsed, root);
   const one = wanted[0];
   if (parsed.read["--snapshot"] === void 0 || one === void 0) {
     throw new CannotRun("smoke baseline needs --snapshot <name>");
   }
-  const rc = parsed.read["--rc-dir"];
-  const recorded = recordBaseline({
-    ...one.commands === void 0 ? {} : { commands: one.commands },
-    ...one.install === void 0 ? {} : { install: one.install },
-    name: one.name,
-    ...rc === void 0 ? {} : { rc: resolve(cwd, rc) },
-    root
-  });
-  process.stdout.write(
-    parsed.json ? `${JSON.stringify(recorded, void 0, 2)}
+  const releaseSlot = await takeSlot({ command: "geonosis-release smoke baseline", cwd: root });
+  try {
+    const rc = parsed.read["--rc-dir"];
+    const recorded = await recordBaseline({
+      ...one.commands === void 0 ? {} : { commands: one.commands },
+      ...one.install === void 0 ? {} : { install: one.install },
+      name: one.name,
+      ...rc === void 0 ? {} : { rc: resolve(cwd, rc) },
+      root
+    });
+    process.stdout.write(
+      parsed.json ? `${JSON.stringify(recorded, void 0, 2)}
 ` : formatBaseline(one.name, recorded)
-  );
-  return 0;
+    );
+    return 0;
+  } finally {
+    releaseSlot();
+  }
 };
-var smokeRun = (parsed, root, cwd) => {
+var smokeRun = async (parsed, root, cwd) => {
   const startedAt = Date.now();
   const wanted = wantedSnapshots(parsed, root);
   if (wanted.length === 0) {
@@ -449,13 +554,19 @@ var smokeRun = (parsed, root, cwd) => {
       "nothing here names a consumer to read this release against \u2014 geonosis.json \u2192 release.smoke.snapshots names them, or pass --snapshot <name>. A release check over zero consumers is not a green release check."
     );
   }
-  const swept = sweepSmoke({
-    absent: parsed.many["--absent"] ?? [],
-    rc: rcOf(parsed, root, cwd),
-    root,
-    skipMissing: parsed.read["--snapshot"] === void 0,
-    wanted
-  });
+  const releaseSlot = await takeSlot({ command: "geonosis-release smoke run", cwd: root });
+  let swept;
+  try {
+    swept = await sweepSmoke({
+      absent: parsed.many["--absent"] ?? [],
+      rc: rcOf(parsed, root, cwd),
+      root,
+      skipMissing: parsed.read["--snapshot"] === void 0,
+      wanted
+    });
+  } finally {
+    releaseSlot();
+  }
   process.stdout.write(
     parsed.json ? `${JSON.stringify(swept, void 0, 2)}
 ` : formatSweep(swept)
@@ -481,7 +592,7 @@ var smokeRun = (parsed, root, cwd) => {
   }
   return comparisons.every((one) => one.ok) ? 0 : 1;
 };
-var smoke = (parsed, cwd) => {
+var smoke = async (parsed, cwd) => {
   const root = rootOf(parsed, cwd);
   const verb = parsed.rest[0];
   if (verb === "snapshot") return snapshot(parsed, root);
@@ -507,6 +618,8 @@ geonosis.json \u2192 "release"      every key optional; a repo that configured n
                                 that tree is installed with when the manager's default is not it,
                                 and { doctor?, lint?, typecheck? } when their gates are not the
                                 scripts of those names
+      timeoutMs number?         how long an install or a phase may run before the runner kills its
+                                whole process group (default 1200000 \u2014 20 minutes)
   secrets       string[]?       the secret names a deployment carries
   steps         string[]?       the release steps
   workers       string[]?       the workers it deploys

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geonosis/release",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "types": "./dist/index.d.ts",
   "description": "The release contract with its proofs: an expand-only migration gate over three dialects, a smoke that must name the version that answered it, and declared ≠ deployed.",
   "keywords": [
@@ -46,7 +46,7 @@
   },
   "devDependencies": {
     "squawk-cli": "2.63.0",
-    "@geonosis/ratchet": "2.5.0"
+    "@geonosis/ratchet": "2.5.1"
   },
   "engines": {
     "node": ">=22"