@hienlh/ppm 0.23.11 → 0.23.13

package/src/services/git-workflow/git-workflow.service.ts

@@ -0,0 +1,198 @@
+/**
+ * The commands behind Source Control's buttons that PPM had no route for:
+ * undo the last commit, publish a branch, pull with rebase, and the stash.
+ */
+import type { GitOperationKind, StashEntry } from "../../shared/git-changes.ts";
+import { gitChangesService } from "../git-changes/git-changes.service.ts";
+import { runGit, toDisplay } from "../git-hunks/git-hunks.service.ts";
+import { createLogger } from "../logger.ts";
+
+const log = createLogger("git");
+
+async function git(cwd: string, args: string[], env?: Record<string, string>): Promise<string> {
+  const res = await runGit(cwd, args, { env });
+  if (res.exitCode !== 0) throw new Error(res.stderr.trim() || `git ${args[0]} exited with ${res.exitCode}`);
+  return toDisplay(res.stdout);
+}
+
+/** The commit-message parts of a stash subject: "On main: wip" / "WIP on main: abc1234 Subject". */
+export function parseStashSubject(subject: string): { branch: string | null; message: string } {
+  const named = /^On ([^:]+): (.*)$/s.exec(subject);
+  if (named) return { branch: named[1]!, message: named[2]! };
+  const auto = /^WIP on ([^:]+): (?:[0-9a-f]+ )?(.*)$/s.exec(subject);
+  if (auto) return { branch: auto[1]!, message: auto[2]! };
+  return { branch: null, message: subject };
+}
+
+/**
+ * The configuration already says how a pull reconciles: `pull.rebase`, the
+ * branch's own `branch.<name>.rebase`, or `pull.ff` — which `--no-rebase` on
+ * the command line would override, letting `ff = only` merge after all.
+ */
+async function pullStrategyConfigured(cwd: string): Promise<boolean> {
+  const head = await runGit(cwd, ["symbolic-ref", "--short", "-q", "HEAD"]);
+  const branch = head.exitCode === 0 ? toDisplay(head.stdout).trim() : "";
+  for (const key of ["pull.rebase", "pull.ff", ...(branch ? [`branch.${branch}.rebase`] : [])]) {
+    const res = await runGit(cwd, ["config", "--get", key]);
+    if (res.exitCode === 0 && res.stdout.trim()) return true;
+  }
+  return false;
+}
+
+export const gitWorkflowService = {
+  /**
+   * Take the last commit back into the index, as if it had never been made,
+   * and hand back its message so it can go back into the message box.
+   *
+   * `hash` is the commit the user means — the one the toast or the box named.
+   * Only that one is taken back, and only while it is still the last commit:
+   * by the time Undo is clicked, a commit from a terminal or a pull may have
+   * landed on top, and "the last commit" would then be one they never saw.
+   *
+   * Refused also once the commit is on a remote (undoing it would rewrite
+   * history someone may have), for the root commit (a soft reset needs a
+   * parent), and while a merge or rebase is under way (HEAD is not the commit
+   * the user thinks it is).
+   */
+  async undoLastCommit(cwd: string, hash: string): Promise<{ hash: string; message: string }> {
+    // At least 40 hex digits: that is what `/commit` answers with, in a
+    // SHA-256 repository too, where it is the first 40 of 64.
+    if (!/^[0-9a-f]{40,64}$/.test(hash)) throw new Error("Invalid commit id.");
+    gitChangesService.invalidate(cwd);
+    const changes = await gitChangesService.getChanges(cwd);
+    const last = changes.lastCommit;
+    if (!last) throw new Error("There is no commit to undo.");
+    if (!last.hash.startsWith(hash)) {
+      throw new Error(`The last commit is no longer ${hash.slice(0, 7)}, so nothing was undone.`);
+    }
+    if (changes.operation) throw new Error(`Finish or abort the ${changes.operation.kind} first.`);
+    if (!last.hasParent) throw new Error("The first commit of a repository cannot be undone this way.");
+    if (last.pushed) throw new Error("This commit is already on the remote, so undoing it would rewrite pushed history.");
+
+    const message = (await git(cwd, ["log", "-1", "--format=%B", last.hash])).replace(/\n+$/, "");
+    // A soft reset, moving HEAD only while it is still that commit: `update-ref`
+    // with the old value refuses once anything moved it since it was read, where
+    // `reset --soft <hash>~1` would take back whatever had landed on top as well.
+    await git(cwd, ["update-ref", "-m", `undo commit ${last.hash.slice(0, 7)}`, "HEAD", `${last.hash}~1`, last.hash]);
+    log.info(`undid commit ${last.hash.slice(0, 7)} in ${cwd} (soft reset)`);
+    return { hash: last.hash, message };
+  },
+
+  /** Push a branch that has no upstream yet, and make the remote branch its upstream. */
+  async publish(cwd: string): Promise<{ remote: string; branch: string }> {
+    const branch = (await runGit(cwd, ["symbolic-ref", "--short", "-q", "HEAD"])).stdout.trim();
+    if (!branch) throw new Error("HEAD is detached: check out a branch to publish it.");
+    const remotes = (await git(cwd, ["remote"])).split("\n").map((r) => r.trim()).filter(Boolean);
+    const remote = remotes.includes("origin") ? "origin" : remotes[0];
+    if (!remote) throw new Error("This repository has no remote to publish to.");
+    await git(cwd, ["push", "-u", remote, toDisplay(branch)]);
+    log.info(`published ${toDisplay(branch)} to ${remote} in ${cwd}`);
+    return { remote, branch: toDisplay(branch) };
+  },
+
+  /**
+   * Abort or continue the merge, rebase, cherry-pick, revert or `git am` that
+   * stopped part way. Continue commits with the message git prepared:
+   * `GIT_EDITOR=:` is git's own "no editor" value, so nothing is launched and
+   * the command cannot sit waiting for a terminal that is not there.
+   */
+  async operation(cwd: string, action: "abort" | "continue"): Promise<GitOperationKind> {
+    gitChangesService.invalidate(cwd);
+    const { operation, files } = await gitChangesService.getChanges(cwd);
+    if (!operation) throw new Error(`There is no merge, rebase or cherry-pick to ${action}.`);
+    if (action === "continue" && files.some((f) => f.conflict)) {
+      throw new Error("Resolve every conflict and stage the result first.");
+    }
+    await git(cwd, [operation.kind, `--${action}`], { GIT_EDITOR: ":" });
+    log.info(`${operation.kind} --${action} in ${cwd}`);
+    return operation.kind;
+  },
+
+  /**
+   * `git pull` refuses a branch that has diverged from its upstream (git ≥ 2.33)
+   * until the configuration says how to reconcile the two — and Sync is offered
+   * exactly when it has. With nothing configured this merges, which is what
+   * every git did before it started asking; a configured choice is left to git.
+   */
+  async pull(cwd: string, options: { rebase?: boolean } = {}): Promise<void> {
+    const started = performance.now();
+    const configured = !options.rebase && await pullStrategyConfigured(cwd);
+    await git(cwd, options.rebase ? ["pull", "--rebase"] : configured ? ["pull"] : ["pull", "--no-rebase"]);
+    const how = options.rebase ? "--rebase" : configured ? "the configured strategy" : "--no-rebase";
+    log.info(`pulled in ${cwd} (${how}) in ${Math.round(performance.now() - started)} ms`);
+  },
+
+  async listStashes(cwd: string): Promise<StashEntry[]> {
+    const res = await runGit(cwd, ["stash", "list", "-z", "--format=%H%x1f%P%x1f%gs%x1f%cI"]);
+    if (res.exitCode !== 0) return [];
+    return res.stdout.split("\0").filter(Boolean).map((record, index) => {
+      const [hash = "", parents = "", subject = "", date = ""] = toDisplay(record).split("\x1f");
+      const { branch, message } = parseStashSubject(subject);
+      return { index, hash, base: parents.split(" ")[0] || null, branch, message, date };
+    });
+  },
+
+  /**
+   * Stash, and answer with the stash that made — or null when git found nothing
+   * it could save. It exits 0 for that too, so the stash on top is then an older
+   * one, and an Undo that popped it would bring back work set aside long ago.
+   */
+  async stash(cwd: string, options: { message?: string; includeUntracked?: boolean } = {}): Promise<StashEntry | null> {
+    const args = ["stash", "push"];
+    if (options.includeUntracked) args.push("--include-untracked");
+    if (options.message?.trim()) args.push("-m", options.message.trim());
+    const top = async () => (await runGit(cwd, ["rev-parse", "-q", "--verify", "refs/stash"])).stdout.trim();
+    const before = await top();
+    await git(cwd, args);
+    const after = await top();
+    if (!after || after === before) {
+      log.info(`nothing to stash in ${cwd} (untracked=${!!options.includeUntracked})`);
+      return null;
+    }
+    log.info(`stashed in ${cwd} (untracked=${!!options.includeUntracked})`);
+    return (await gitWorkflowService.listStashes(cwd)).find((s) => s.hash === after) ?? null;
+  },
+
+  /**
+   * Apply, pop or drop one stash, named by index *and* commit id. Indexes shift
+   * every time a stash is added or dropped, so an index alone could act on a
+   * different stash than the one on screen.
+   *
+   * Applied with `--index`, so what was staged comes back staged: a stash is
+   * as often as not taken half way through staging block by block, and the
+   * Undo after "Stash all changes" has to be an undo. When the staged part no
+   * longer applies on its own, git refuses before touching anything, and the
+   * work is applied without it — `indexRestored: false` says so.
+   */
+  async stashAction(
+    cwd: string,
+    action: "apply" | "pop" | "drop",
+    index: number,
+    hash: string,
+  ): Promise<{ indexRestored?: boolean }> {
+    if (!Number.isInteger(index) || index < 0) throw new Error("Invalid stash index.");
+    if (!/^[0-9a-f]{40,64}$/.test(hash)) throw new Error("Invalid stash id.");
+    const ref = `stash@{${index}}`;
+    const current = (await runGit(cwd, ["rev-parse", "--verify", "-q", ref])).stdout.trim();
+    if (current !== hash) throw new Error("The stash list changed. Reload it and try again.");
+    const what = `stash ${action} ${ref} ${hash.slice(0, 7)} in ${cwd}`;
+    if (action === "drop") {
+      await git(cwd, ["stash", "drop", ref]);
+      log.info(what);
+      return {};
+    }
+    // In git's English: its stderr is how the fallback below is chosen, and it
+    // follows the locale, so a German one would make every fallback an error.
+    const withIndex = await runGit(cwd, ["stash", action, "--index", ref], { env: { LC_ALL: "C" } });
+    if (withIndex.exitCode === 0) {
+      log.info(what);
+      return { indexRestored: true };
+    }
+    if (!/conflicts in index/i.test(withIndex.stderr)) {
+      throw new Error(withIndex.stderr.trim() || `git stash ${action} exited with ${withIndex.exitCode}`);
+    }
+    await git(cwd, ["stash", action, ref]);
+    log.warn(`${what}: index not restored, applied without --index`);
+    return { indexRestored: false };
+  },
+};

package/src/services/git.service.ts

@@ -2,6 +2,7 @@ import path from "node:path";
 import simpleGit, { type SimpleGit } from "simple-git";
 import { isBinaryContent } from "./binary-content.ts";
 import { FOR_EACH_REF_ARGS, parseForEachRef } from "./git-refs/for-each-ref.ts";
+import { createLogger } from "./logger.ts";
 import type {
   CheckoutMode,
   FileFullDiff,
@@ -14,6 +15,29 @@ import type {
   GitWorktree,
 } from "../types/git.ts";
 
+/**
+ * Only for what the CLI never calls. `ppm git commit`, `push`, `branch …` and `merge` reach
+ * this class too, and the CLI has no log file: a line here would print beside the CLI's own
+ * "Committed: …". Those operations are logged by their routes in `routes/git.ts` instead.
+ */
+const gitLog = createLogger("git");
+
+/**
+ * A remote for the log. A clone URL often carries `user:token@`, or a token as the user part
+ * alone (`https://ghp_…@github.com/…`), which `redactSecrets` keeps — so the whole userinfo
+ * goes. A remote's name, or an scp-style `git@host:path`, is not a URL and has no password.
+ */
+export function remoteForLog(remote: string): string {
+  try {
+    const url = new URL(remote);
+    if (!url.username && !url.password) return remote;
+    url.username = "";
+    url.password = "";
+    return url.toString();
+  } catch {
+    return remote;
+  }
+}
 
 /**
  * `filePath` resolved inside `projectPath`, or null when it escapes.
@@ -256,24 +280,37 @@ class GitService {
     return diff;
   }
 
+  /**
+   * For commands given file names: each is that file, never a pattern. A file
+   * called `[ab].txt` is otherwise a glob, and staging or discarding it also
+   * stages or discards `a.txt`.
+   */
+  private literalGit(projectPath: string): SimpleGit {
+    return this.git(projectPath).env({ ...process.env, GIT_LITERAL_PATHSPECS: "1" });
+  }
+
   async stage(projectPath: string, files: string[]): Promise<void> {
-    await this.git(projectPath).add(files);
+    // After `--`, or a file called `--all` is git's flag of that name and stages the whole tree.
+    await this.literalGit(projectPath).add(["--", ...files]);
   }
 
   async unstage(projectPath: string, files: string[]): Promise<void> {
-    await this.git(projectPath).reset(["HEAD", "--", ...files]);
+    await this.literalGit(projectPath).reset(["HEAD", "--", ...files]);
   }
 
-  async commit(projectPath: string, message: string, amend = false): Promise<string> {
+  async commit(projectPath: string, message: string, amend = false, signoff = false): Promise<string> {
     if (amend) {
       const args = ["commit", "--amend"];
       if (message?.trim()) args.push("-m", message);
       else args.push("--no-edit");
+      if (signoff) args.push("--signoff");
       await this.git(projectPath).raw(args);
       return (await this.git(projectPath).revparse(["HEAD"])).trim();
     }
-    const result = await this.git(projectPath).commit(message);
-    return result.commit;
+    const result = await this.git(projectPath).commit(message, undefined, signoff ? { "--signoff": null } : undefined);
+    // Read off git's "[main <hash>]" line, which on a detached HEAD is
+    // "[detached HEAD <hash>]" — and simple-git then answers "HEAD <hash>".
+    return result.commit.slice(result.commit.lastIndexOf(" ") + 1);
   }
 
   async push(
@@ -457,9 +494,12 @@ class GitService {
     return { commits, branches, head };
   }
 
-  async fetch(projectPath: string, remote?: string): Promise<void> {
+  async fetch(projectPath: string, remote?: string, prune = false): Promise<void> {
     const args = remote ? [remote] : ["--all"];
+    if (prune) args.push("--prune");
+    const started = performance.now();
     await this.git(projectPath).fetch(args);
+    gitLog.info(`fetched ${remote ? remoteForLog(remote) : "--all"} prune=${prune} in ${projectPath} (${Math.round(performance.now() - started)} ms)`);
   }
 
   async discardChanges(projectPath: string, files: string[]): Promise<void> {
@@ -470,20 +510,30 @@ class GitService {
     const tracked = files.filter((f) => !untrackedSet.has(f));
     const untracked = files.filter((f) => untrackedSet.has(f));
 
+    const literal = this.literalGit(projectPath);
     if (tracked.length > 0) {
-      await git.checkout(["--", ...tracked]);
+      await literal.checkout(["--", ...tracked]);
     }
     if (untracked.length > 0) {
-      await git.clean("f", ["-e", "!.*", "--", ...untracked]);
+      try {
+        await literal.clean("f", ["-e", "!.*", "--", ...untracked]);
+      } catch (e) {
+        // The tracked half is already gone by now, and the error alone does not say so.
+        if (tracked.length > 0) gitLog.error(`discarded ${tracked.length} tracked file(s) in ${projectPath}, then removing ${untracked.length} untracked failed:`, e);
+        throw e;
+      }
     }
+    gitLog.info(`discarded ${tracked.length} tracked + ${untracked.length} untracked file(s) in ${projectPath}`);
   }
 
   async cherryPick(projectPath: string, hash: string): Promise<void> {
     await this.git(projectPath).raw(["cherry-pick", hash]);
+    gitLog.info(`cherry-picked ${hash.slice(0, 7)} in ${projectPath}`);
   }
 
   async revert(projectPath: string, hash: string): Promise<void> {
     await this.git(projectPath).raw(["revert", "--no-edit", hash]);
+    gitLog.info(`reverted ${hash.slice(0, 7)} in ${projectPath}`);
   }
 
   async createTag(
@@ -494,6 +544,7 @@ class GitService {
     const args = ["tag", name];
     if (hash) args.push(hash);
     await this.git(projectPath).raw(args);
+    gitLog.info(`tagged ${name} at ${hash ? hash.slice(0, 7) : "HEAD"} in ${projectPath}`);
   }
 
   async getCreatePrUrl(
@@ -609,6 +660,7 @@ class GitService {
       args.push(opts.branch);
     }
     await this.git(projectPath).raw(args);
+    gitLog.info(`worktree added ${targetPath} (branch=${opts.branch ?? "-"}, new=${opts.newBranch ?? "-"}) in ${projectPath}`);
   }
 
   /** Remove a worktree. Pass force=true to remove even with uncommitted changes. */
@@ -617,11 +669,13 @@ class GitService {
     if (force) args.push("-f");
     args.push(targetPath);
     await this.git(projectPath).raw(args);
+    gitLog.info(`worktree removed ${targetPath} force=${force} in ${projectPath}`);
   }
 
   /** Prune stale worktree metadata from .git/worktrees/. */
   async pruneWorktrees(projectPath: string): Promise<void> {
     await this.git(projectPath).raw(["worktree", "prune"]);
+    gitLog.info(`pruned stale worktree metadata in ${projectPath}`);
   }
 
   /** Clone a git repo into targetDir/repoName. Returns the full cloned path. */
@@ -629,7 +683,9 @@ class GitService {
     const repoName = name || this.parseRepoNameFromUrl(url);
     if (!repoName) throw new Error("Cannot determine repo name from URL");
     const fullPath = path.resolve(targetDir, repoName);
+    const started = performance.now();
     await simpleGit().clone(url, fullPath);
+    gitLog.info(`cloned ${remoteForLog(url)} into ${fullPath} in ${Math.round(performance.now() - started)} ms`);
     return fullPath;
   }
 

package/src/services/group-chat/group-chat.service.ts

@@ -21,6 +21,9 @@ import type {
   TurnEngineDeps,
 } from "../../types/group-chat.ts";
 import type { GroupChatServerMessage } from "../../types/group-chat-ws.ts";
+import { createLogger } from "../logger.ts";
+
+const log = createLogger("group-chat");
 
 type WsClient = { send: (data: string) => void };
 
@@ -143,6 +146,8 @@ class GroupChatService {
     };
     this.runtimes.set(group.id, runtime);
     setGroupStatus(group.id, "active");
+    const startedAt = Date.now();
+    log.info(`group=${group.id} burst started members=${members.length} provider=${providerId}`);
     // Emit the user's message now that the runtime exists (so it lands in the reconnect
     // buffer); persistent clients receive it live regardless of runtime lifetime.
     if (initialMessage) {
@@ -186,6 +191,7 @@ class GroupChatService {
       return runReplyBurst(group, members, deps, { cap: group.maxTurns });
     })()
       .then((res) => {
+        log.info(`group=${group.id} burst done reason=${res.reason} turns=${res.turns} costUsd=${res.costUsd} durationMs=${Date.now() - startedAt}`);
         this.emit(group.id, { type: "group_done", reason: res.reason, turns: res.turns, costUsd: res.costUsd });
         // A user-requested stop keeps the group paused for a later resume;
         // a natural burst end returns the group to idle to wait for the next message.
@@ -193,6 +199,8 @@ class GroupChatService {
         return res;
       })
       .catch((e) => {
+        // Detached: the error otherwise reaches only the sockets open on this group.
+        log.error(`group=${group.id} burst failed after ${Date.now() - startedAt}ms: ${String((e as Error)?.message ?? e).slice(0, 300)}`);
         this.emit(group.id, { type: "error", message: (e as Error).message });
         setGroupStatus(group.id, "idle");
         return { reason: "stopped", turns: 0, costUsd: 0 } as BurstResult;
@@ -206,7 +214,9 @@ class GroupChatService {
         const queued = this.pendingMessage.get(group.id);
         if (queued) {
           this.pendingMessage.delete(group.id);
-          void this.runBurst(group, members, providerId);
+          this.runBurst(group, members, providerId).catch((e) => {
+            log.error(`group=${group.id} queued burst failed to start: ${(e as Error)?.message ?? e}`);
+          });
         }
       });
     runtime.loop = loop;
@@ -267,7 +277,7 @@ class GroupChatService {
       }
       // Not alive this run (new member / post-restart): archive any orphaned old file,
       // then create a fresh session so we never create-with-an-existing-id.
-      if (m.sessionId) await archiveAndDelete(m.sessionId, group.name).catch(() => {});
+      if (m.sessionId) await this.archiveSession(m.sessionId, group.name);
       const session = await backend.createSession({
         projectPath: group.projectPath,
         projectName: group.projectName,
@@ -284,7 +294,7 @@ class GroupChatService {
   private async archiveMembers(group: Group, members: GroupMember[]): Promise<void> {
     for (const m of members) {
       if (m.sessionId) {
-        await archiveAndDelete(m.sessionId, group.name).catch(() => {});
+        await this.archiveSession(m.sessionId, group.name);
         this.aliveSessions.delete(m.sessionId);
       }
     }
@@ -303,16 +313,32 @@ class GroupChatService {
   /** Archive + forget a single member's session (on member removal). */
   async archiveMemberSession(groupName: string, sessionId: string | null): Promise<void> {
     if (!sessionId || this.spawnStub) return;
-    await archiveAndDelete(sessionId, groupName).catch(() => {});
+    await this.archiveSession(sessionId, groupName);
     this.aliveSessions.delete(sessionId);
   }
 
+  /** Best-effort, as before — but a transcript that could not be archived is now on record. */
+  private async archiveSession(sessionId: string, groupName: string): Promise<void> {
+    try {
+      const r = await archiveAndDelete(sessionId, groupName);
+      if (r.archived) return;
+      // No transcript at all is normal for a member that never spoke.
+      if (r.reason === "raw JSONL not found") log.debug(`no transcript to archive session=${sessionId}`);
+      else log.warn(`archive failed session=${sessionId} reason=${r.reason}`);
+    } catch (e) {
+      log.warn(`archive failed session=${sessionId} reason=${(e as Error)?.message ?? e}`);
+    }
+  }
+
   /** Delete the ephemeral router session (no archive — its transcript is throwaway). */
   private async deleteRouterSession(providerId: string, sessionId: string): Promise<void> {
     try {
       const { chatService } = await import("../chat.service.ts");
       await chatService.deleteSession(providerId, sessionId);
-    } catch { /* best-effort cleanup */ }
+    } catch (e) {
+      // Best-effort, but a router session left behind shows up in the session list.
+      log.warn(`router session cleanup failed session=${sessionId}: ${(e as Error)?.message ?? e}`);
+    }
   }
 
   private backendCache: ChatBackend | null = null;
@@ -327,7 +353,7 @@ class GroupChatService {
       // consumer-side signal guard halts the turn, so only permissionMode is
       // forwarded here.
       sendMessage: (pid, sid, prompt, opts) =>
-        chatService.sendMessage(pid, sid, prompt, { permissionMode: opts?.permissionMode, model: opts?.model, oneMContext: opts?.oneMContext }),
+        chatService.sendMessage(pid, sid, prompt, { permissionMode: opts?.permissionMode, model: opts?.model, oneMContext: opts?.oneMContext, origin: "group-chat" }),
     };
     return this.backendCache;
   }

package/src/services/group-chat/responder-router.ts

@@ -1,5 +1,8 @@
 import type { GroupMember, GroupMessage } from "../../types/group-chat.ts";
 import { buildContextWindow, renderWindow, DEFAULT_WINDOW } from "./context-window.ts";
+import { createLogger } from "../logger.ts";
+
+const log = createLogger("group-chat");
 
 /** Cheapest/fastest model for the lightweight next-speaker classification. */
 export const ROUTER_MODEL = "claude-haiku-4-5";
@@ -92,6 +95,15 @@ export function makeResponderRouter(
   opts: { model?: string } = {},
 ): (ctx: { history: GroupMessage[]; members: GroupMember[]; isUserTurn: boolean }) => Promise<string[]> {
   const model = opts.model ?? ROUTER_MODEL;
+  // One router per burst, asked before every turn: a router that cannot run fails every
+  // time, so only its first failure in the burst is a WARN.
+  let failures = 0;
+  const fallingBack = (err: unknown): string[] => {
+    (failures++ === 0 ? log.warn : log.debug)(
+      `router failed session=${sessionId}: ${String((err as Error)?.message ?? err).slice(0, 200)} — falling back`,
+    );
+    return [];
+  };
   return async ({ history, members, isUserTurn }) => {
     try {
       const prompt = buildRouterPrompt(history, members, isUserTurn);
@@ -99,12 +111,12 @@ export function makeResponderRouter(
       // oneMContext:false — the cheap router model needs no 1M window and may not support it.
       for await (const ev of backend.sendMessage(providerId, sessionId, prompt, { model, permissionMode: "bypassPermissions", oneMContext: false })) {
         if (ev.type === "text") text += ev.content ?? "";
-        else if (ev.type === "error") return [];
+        else if (ev.type === "error") return fallingBack(ev.message ?? "error event");
         else if (ev.type === "done") break;
       }
       return parseResponders(text, members);
-    } catch {
-      return [];
+    } catch (e) {
+      return fallingBack(e);
     }
   };
 }

package/src/services/host-info/host-info.service.ts

@@ -17,6 +17,9 @@ import { getKnownFolders } from "./host-known-folders.ts";
 import { getWindowsQuickAccessPinned } from "./pinned-windows-quick-access.ts";
 import { getLinuxPinned } from "./pinned-linux-bookmarks.ts";
 import { getMacosFinderFavoritesPinned } from "./pinned-macos-finder-favorites.ts";
+import { createLogger } from "../logger.ts";
+
+const log = createLogger("host-info");
 
 const CACHE_TTL_MS = 60_000;
 const PROVIDER_TIMEOUT_MS = 5_000;
@@ -30,6 +33,9 @@ let lastBuildAt = 0;
 /** Shared by all callers while a build is running — concurrent calls (refresh or not)
  *  await the same build instead of each starting their own. */
 let inFlight: Promise<HostInfo> | null = null;
+/** The warnings the last log line reported, so a rebuild that hits the same ones again
+ *  (every minute, on a host with no GTK bookmarks file) says nothing new. */
+let lastLoggedWarnings = "";
 
 async function getPinnedByPlatform(
   platform: NodeJS.Platform,
@@ -155,6 +161,16 @@ export async function getHostInfo(
       const info = await buildHostInfo(process.platform, osHomedir(), osHostname(), overrides);
       lastBuildAt = Date.now();
       cached = { info, expiresAt: lastBuildAt + CACHE_TTL_MS };
+      // The response carries these to the browser and nowhere else: a provider that threw
+      // or timed out would otherwise leave no trace on the server.
+      // Sorted: the providers run at once, so the same warnings can arrive in another order.
+      const warningsKey = [...info.warnings].sort().join("\n");
+      if (warningsKey !== lastLoggedWarnings) {
+        lastLoggedWarnings = warningsKey;
+        if (info.warnings.length > 0) {
+          log.warn(`host info built with ${info.warnings.length} warnings: ${info.warnings.slice(0, 3).join("; ")}`);
+        }
+      }
       return info;
     } finally {
       inFlight = null;

package/src/services/host-info/spawn-runner.ts

@@ -1,6 +1,10 @@
 /** Shared argv-array shell-out for host-info providers. Every provider that
  *  needs PowerShell/plutil/findmnt/xdg-user-dir injects a `Runner` so unit
  *  tests never spawn a real process — only `defaultRunner` touches `Bun.spawn`. */
+import { createLogger } from "../logger.ts";
+
+const log = createLogger("spawn");
+
 export interface RunResult {
   stdout: string;
   stderr: string;
@@ -13,6 +17,26 @@ export type Runner = (argv: string[], timeoutMs?: number) => Promise<RunResult>;
 
 const DEFAULT_TIMEOUT_MS = 5000;
 
+/** A tool that hangs tends to hang on every poll, so each binary's timeout is a WARN at
+ *  most once a minute and a DEBUG line otherwise. Keyed by binary name: the arguments
+ *  are never logged, since a caller's argv is its own business. */
+const TIMEOUT_REPORT_EVERY_MS = 60_000;
+const timeoutReports = new Map<string, { at: number; suppressed: number }>();
+
+function reportTimeout(argv0: string | undefined, timeoutMs: number): void {
+  const bin = argv0?.split(/[\\/]/).pop() || "?";
+  const now = Date.now();
+  const last = timeoutReports.get(bin);
+  if (last && now - last.at < TIMEOUT_REPORT_EVERY_MS) {
+    last.suppressed++;
+    log.debug(`${bin} timed out after ${timeoutMs} ms; killed`);
+    return;
+  }
+  const more = last?.suppressed ? ` (+${last.suppressed} more since the last one logged)` : "";
+  timeoutReports.set(bin, { at: now, suppressed: 0 });
+  log.warn(`${bin} timed out after ${timeoutMs} ms; killed${more}`);
+}
+
 /** Real implementation: argv array only (never string-interpolated into a shell), bounded by timeoutMs.
  *
  *  `Bun.spawn` **throws synchronously** when the binary is not on `PATH`
@@ -46,6 +70,7 @@ export const defaultRunner: Runner = async (argv, timeoutMs = DEFAULT_TIMEOUT_MS
   const abandoned = new Promise<void>((resolve) => { giveUp = resolve; });
   const killTimer = setTimeout(() => {
     timedOut = true;
+    reportTimeout(argv[0], timeoutMs);
     try {
       proc.kill();
     } catch {

package/src/services/jira-config.service.ts

@@ -1,6 +1,12 @@
 import { getDb } from "./db.service.ts";
 import { encrypt, decrypt } from "../lib/account-crypto.ts";
 import type { JiraConfigRow, JiraConfig, JiraCredentials } from "../types/jira.ts";
+import { createLogger } from "./logger.ts";
+
+const log = createLogger("jira");
+
+/** Configs whose token failed to decrypt — every poll asks again, so it is said once per config. */
+const undecryptable = new Set<number>();
 
 // ── Row → API mapper ──────────────────────────────────────────────────
 
@@ -75,9 +81,15 @@ export function getDecryptedCredentials(configId: number): JiraCredentials | nul
   if (!row) return null;
   try {
     const token = decrypt(row.api_token_encrypted);
+    undecryptable.delete(configId);
     return { baseUrl: row.base_url, email: row.email, token };
   } catch (e) {
-    console.warn(`[jira] Failed to decrypt token for config ${configId}:`, (e as Error).message);
+    const line = `Failed to decrypt token for config ${configId}: ${(e as Error).message}`;
+    if (undecryptable.has(configId)) log.debug(line);
+    else {
+      undecryptable.add(configId);
+      log.warn(`${line} — its watchers cannot poll until the token is saved again`);
+    }
     return null;
   }
 }