@loicngr/kobo 1.11.27 → 1.11.28

package/dist/server/services/agent/orchestrator.js

@@ -6,6 +6,7 @@ import * as autoLoopService from '../auto-loop-service.js';
 import * as cleanupScriptService from '../cleanup-script-service.js';
 import * as cronService from '../cron-service.js';
 import { resolveForge } from '../forge/resolve.js';
+import * as lifecycleHookService from '../lifecycle-hook-service.js';
 import * as quotaBackoffService from '../quota-backoff-service.js';
 import { getEffectiveSettings, getGlobalSettings } from '../settings-service.js';
 import { refreshNow } from '../usage/poller.js';
@@ -268,6 +269,9 @@ function runWatchdog() {
         if (controllers.get(workspaceId) === ctrl)
             controllers.delete(workspaceId);
         retryCounts.delete(workspaceId);
+        // This end never goes through handleEvent → onSessionEnded, so the user's
+        // hook would otherwise miss precisely the case it is most useful for.
+        fireSessionEndedHook(workspaceId, ctrl.agentSessionId, 'killed', null, ctrl);
         try {
             const db = getDb();
             db.prepare('UPDATE agent_sessions SET status = ?, ended_at = ? WHERE id = ?').run('error', new Date().toISOString(), ctrl.agentSessionId);
@@ -413,6 +417,9 @@ function readEffectiveSettingsSafe(projectPath) {
             cleanupScriptOnlyOnChanges: false,
             archiveScript: '',
             changeSourceBranchScript: '',
+            sessionEndedScript: '',
+            prMergedScript: '',
+            autoLoopDisabledScript: '',
             notionStatusProperty: '',
             notionInProgressStatus: '',
         };
@@ -856,6 +863,9 @@ function handleEvent(workspaceId, agentSessionId, sourceController, ev) {
         // a mid-loop session (never cleans) or a standalone one.
         const wasAutoLoop = autoLoopService.getStatus(workspaceId).auto_loop;
         autoLoopService.onSessionEnded(workspaceId, effectiveReason, progressDelta);
+        // A slot just freed. Any auto-loop workspace parked on the concurrency
+        // limit has no session of its own to bring it back; this one does it.
+        autoLoopService.resumeWaitingWorkspaces();
         cleanupScriptService.onSessionEnded(workspaceId, effectiveReason, { wasAutoLoop });
     }
     if (ev.kind === 'session:user-input-requested' && !sourceControllerIsStopping) {
@@ -913,11 +923,43 @@ function handleEvent(workspaceId, agentSessionId, sourceController, ev) {
         }
     }
 }
+/**
+ * Sessions whose session-ended hook already ran. Two paths can report the
+ * same end — the watchdog's dead-engine sweep, then the engine's own late
+ * `session:ended` — and the user's script must run once per session, not
+ * once per report. Bounded: cleared past a size no single process reaches.
+ */
+const sessionEndedHookFired = new Set();
+function fireSessionEndedHook(workspaceId, agentSessionId, reason, exitCode, controller) {
+    if (sessionEndedHookFired.has(agentSessionId))
+        return;
+    if (sessionEndedHookFired.size > 10_000)
+        sessionEndedHookFired.clear();
+    sessionEndedHookFired.add(agentSessionId);
+    // The worktree is about to be removed by the very operation that stopped
+    // this session; a script spawned in it would lose its cwd mid-run.
+    const cause = controller?.stopCause;
+    if (cause === 'delete' || cause === 'purge')
+        return;
+    void lifecycleHookService.onSessionEnded(workspaceId, {
+        sessionId: agentSessionId,
+        reason,
+        exitCode,
+        stopCause: controller?.status === 'stopping' ? (cause ?? 'user') : '',
+        // Read BEFORE auto-loop reacts to this end (which may disable it): the
+        // hook wants to know whether the next iteration is about to start.
+        autoLoopActive: getWs(workspaceId)?.autoLoop === true,
+    });
+}
 function onSessionEnded(workspaceId, agentSessionId, sourceController, exitCode, reason, resumeFailed = false) {
     // Update the agent_sessions row
     try {
         const db = getDb();
-        db.prepare('UPDATE agent_sessions SET status = ?, ended_at = ? WHERE id = ?').run(exitCode === 0 ? 'completed' : 'error', new Date().toISOString(), agentSessionId);
+        // `status` only distinguishes completed from error, by exit code. Keep the
+        // reason too: "the watchdog force-ended it", "the user stopped it" and "it
+        // finished on its own" all landed on the same two values, so after the fact
+        // nothing could say why a session stopped.
+        db.prepare('UPDATE agent_sessions SET status = ?, ended_at = ?, end_reason = ? WHERE id = ?').run(exitCode === 0 ? 'completed' : 'error', new Date().toISOString(), reason, agentSessionId);
     }
     catch (err) {
         console.error('[orchestrator] Failed to update agent_sessions on exit:', err);
@@ -926,6 +968,10 @@ function onSessionEnded(workspaceId, agentSessionId, sourceController, exitCode,
     const isSuperseded = sourceController !== undefined && registeredController !== undefined && registeredController !== sourceController;
     if (isSuperseded)
         return false;
+    // A superseded end (above) is a session that was replaced, not one that
+    // ended; everything past this point is a real end the user may want to act
+    // on, whatever the reason — the script reads KOBO_SESSION_END_REASON.
+    fireSessionEndedHook(workspaceId, agentSessionId, reason, exitCode, sourceController);
     const currentWorkspace = getWs(workspaceId);
     const preserveQuotaBackoff = currentWorkspace?.status === 'quota';
     const wasStopping = sourceController?.status === 'stopping';
@@ -1170,7 +1216,8 @@ export function interruptAgent(workspaceId, options = {}) {
  * is untracked by anyone in this process; only the OS or the user can end it.
  */
 export const STOP_AGENT_TIMEOUT_MS = 15_000;
-async function stopController(workspaceId, ctrl) {
+async function stopController(workspaceId, ctrl, cause = 'user') {
+    ctrl.stopCause = cause;
     wakeupService.cancel(workspaceId, 'stopped');
     // Normalize the state synchronously so callers (archive, delete, manual
     // stop) see a clean workspace immediately — without waiting for the async
@@ -1256,11 +1303,13 @@ async function stopWithTimeout(ctrl, timeoutMs) {
  * switch — MUST use this: the fire-and-forget `stopAgent` returns while the
  * engine may still be writing files.
  */
-export async function stopAgentAndWait(workspaceId, timeoutMs = STOP_AGENT_TIMEOUT_MS) {
+export async function stopAgentAndWait(workspaceId, timeoutMs = STOP_AGENT_TIMEOUT_MS, 
+/** Why. `delete` and `purge` tell the session-ended hook to stand down. */
+cause = 'user') {
     const ctrl = controllers.get(workspaceId);
     if (!ctrl)
         return 'not-running';
-    const finished = await raceWithTimeout(stopController(workspaceId, ctrl).then(() => true, (err) => {
+    const finished = await raceWithTimeout(stopController(workspaceId, ctrl, cause).then(() => true, (err) => {
         console.error(`[orchestrator] controller.stop failed for '${workspaceId}':`, err);
         return true;
     }), timeoutMs, () => false);
@@ -1647,6 +1696,10 @@ export function getAgentStatus(workspaceId) {
 export function hasController(workspaceId) {
     return controllers.has(workspaceId);
 }
+/** How many agent sessions are live right now, across every workspace. */
+export function runningAgentCount() {
+    return controllers.size;
+}
 /** The agent_session_id of the active controller for the workspace, if any. */
 export function getActiveSessionId(workspaceId) {
     return controllers.get(workspaceId)?.agentSessionId;
@@ -1791,24 +1844,58 @@ async function handleQuota(workspaceId, _agentSessionId) {
         // Never silent: a refused transition here loses the backoff two lines down.
         console.warn(`[orchestrator] Could not transition workspace '${workspaceId}' to quota:`, err);
     }
-    const retryCount = retryCounts.get(workspaceId) ?? 0;
-    const autoLoopEnabled = getWs(workspaceId)?.autoLoop === true;
-    const maxRetries = autoLoopEnabled ? (getGlobalSettings().autoLoopMaxRetries ?? 5) : 5;
-    if (autoLoopEnabled && retryCount >= maxRetries) {
-        autoLoopService.disable(workspaceId, 'error');
-        try {
-            updateWorkspaceStatus(workspaceId, 'error');
-        }
-        catch {
-            // The loop is disabled even if an already-terminal status rejects this transition.
+    // Everything below reads the settings file, the workspace row and the
+    // backoff table. Both call sites are fire-and-forget (`void handleQuota(…)`)
+    // and the process treats an unhandled rejection as fatal, so a transient
+    // failure here must not escape: hitting a quota while the database is busy
+    // would otherwise kill Kōbō and every agent running under it.
+    try {
+        const retryCount = retryCounts.get(workspaceId) ?? 0;
+        const autoLoopEnabled = getWs(workspaceId)?.autoLoop === true;
+        const maxRetries = autoLoopEnabled ? (getGlobalSettings().autoLoopMaxRetries ?? 5) : 5;
+        if (autoLoopEnabled && retryCount >= maxRetries) {
+            autoLoopService.disable(workspaceId, 'error');
+            try {
+                updateWorkspaceStatus(workspaceId, 'error');
+            }
+            catch {
+                // The loop is disabled even if an already-terminal status rejects this transition.
+            }
+            return;
         }
-        return;
+        const { delayMs, resetsAt, source } = await computeQuotaBackoffMs(workspaceId, retryCount);
+        retryCounts.set(workspaceId, retryCount + 1);
+        // The quotaBackoffService owns the timer + the persistent row + the
+        // 'agent:quota-backoff' WS emit. Hand off everything to it.
+        quotaBackoffService.arm(workspaceId, delayMs, { resetsAt: resetsAt ?? null, source, reason: 'quota' });
+    }
+    catch (err) {
+        console.error(`[orchestrator] Could not arm the quota backoff for workspace '${workspaceId}':`, err);
+        // The status was already moved to 'quota' above, and the banner offering
+        // "resume now" only renders once a backoff row exists. Leaving it there
+        // would strand the workspace waiting on a timer nobody armed, with the
+        // console line as its only trace. 'error' has a banner of its own.
+        failVisibly(workspaceId);
+    }
+}
+/**
+ * Last resort when the retry machinery itself fails: stop the loop and move the
+ * workspace to a status the UI actually surfaces, so the user sees something to
+ * act on instead of a workspace that has quietly stopped moving.
+ */
+function failVisibly(workspaceId) {
+    try {
+        autoLoopService.disable(workspaceId, 'error');
+    }
+    catch (err) {
+        console.error(`[orchestrator] Could not disable the auto-loop for workspace '${workspaceId}':`, err);
+    }
+    try {
+        updateWorkspaceStatus(workspaceId, 'error');
+    }
+    catch {
+        // An already-terminal status refusing this transition is fine.
     }
-    const { delayMs, resetsAt, source } = await computeQuotaBackoffMs(workspaceId, retryCount);
-    retryCounts.set(workspaceId, retryCount + 1);
-    // The quotaBackoffService owns the timer + the persistent row + the
-    // 'agent:quota-backoff' WS emit. Hand off everything to it.
-    quotaBackoffService.arm(workspaceId, delayMs, { resetsAt: resetsAt ?? null, source, reason: 'quota' });
 }
 /** First retry after a transient failure (watchdog recovery, HTTP 500). The
  *  quota ladder's 15-minute floor is tuned for real quota windows — a forced
@@ -1826,22 +1913,30 @@ async function handleTransientAutoLoopFailure(workspaceId) {
     catch (err) {
         console.warn(`[orchestrator] Could not transition workspace '${workspaceId}' to quota for a transient failure:`, err);
     }
-    const retryCount = retryCounts.get(workspaceId) ?? 0;
-    const maxRetries = getGlobalSettings().autoLoopMaxRetries ?? 5;
-    if (retryCount >= maxRetries) {
-        autoLoopService.disable(workspaceId, 'error');
-        try {
-            updateWorkspaceStatus(workspaceId, 'error');
-        }
-        catch {
-            // The loop is disabled even if an already-terminal status rejects this transition.
+    // Same reasoning as handleQuota: fire-and-forget call sites plus a fatal
+    // unhandled-rejection policy mean a failure here must stay contained.
+    try {
+        const retryCount = retryCounts.get(workspaceId) ?? 0;
+        const maxRetries = getGlobalSettings().autoLoopMaxRetries ?? 5;
+        if (retryCount >= maxRetries) {
+            autoLoopService.disable(workspaceId, 'error');
+            try {
+                updateWorkspaceStatus(workspaceId, 'error');
+            }
+            catch {
+                // The loop is disabled even if an already-terminal status rejects this transition.
+            }
+            return;
         }
-        return;
+        const { delayMs, resetsAt, source } = await computeQuotaBackoffMs(workspaceId, retryCount, false);
+        const effectiveDelayMs = retryCount === 0 ? Math.min(delayMs, TRANSIENT_FIRST_RETRY_MS) : delayMs;
+        retryCounts.set(workspaceId, retryCount + 1);
+        quotaBackoffService.arm(workspaceId, effectiveDelayMs, { resetsAt: resetsAt ?? null, source, reason: 'transient' });
+    }
+    catch (err) {
+        console.error(`[orchestrator] Could not arm the transient retry for workspace '${workspaceId}':`, err);
+        failVisibly(workspaceId);
     }
-    const { delayMs, resetsAt, source } = await computeQuotaBackoffMs(workspaceId, retryCount, false);
-    const effectiveDelayMs = retryCount === 0 ? Math.min(delayMs, TRANSIENT_FIRST_RETRY_MS) : delayMs;
-    retryCounts.set(workspaceId, retryCount + 1);
-    quotaBackoffService.arm(workspaceId, effectiveDelayMs, { resetsAt: resetsAt ?? null, source, reason: 'transient' });
 }
 /** @internal test-only — re-export of `handleQuota` for direct testing. */
 export const _handleQuota = handleQuota;

package/dist/server/services/agent/session-controller.js

@@ -3,9 +3,21 @@ export class SessionController {
     agentSessionId;
     engine;
     onEvent;
+    /**
+     * Set by the orchestrator when it stops this controller on purpose. A
+     * delete or purge is about to remove the worktree, and a hook spawned in it
+     * would run in a directory being deleted — the hook path checks this.
+     */
+    stopCause;
     _engineProcess;
     _startPromise;
     _status = 'running';
+    /**
+     * Set by `stop()`. Distinct from `_status` so the check in `startEngine` is
+     * not narrowed away by the compiler: `stop()` can flip it while that method
+     * is awaiting the engine.
+     */
+    _stopRequested = false;
     /**
      * Wall-clock creation time. The watchdog needs it: `engineProcess` stays
      * undefined until `engine.start` resolves, and without a grace window any
@@ -38,6 +50,21 @@ export class SessionController {
         await this._startPromise;
     }
     async startEngine(options) {
+        // Already stopped before we got here. The orchestrator chains `start`
+        // behind a zombie eviction that can take up to STOP_AGENT_TIMEOUT_MS, and a
+        // stop landing in that window resolves immediately and reports "stopped" —
+        // so the caller (delete, purge-worktree) is already removing the worktree.
+        // Spawning into it and stopping afterwards, as the check below does, is too
+        // late; the process must never exist.
+        //
+        // Still report an end: the orchestrator already created the session row,
+        // and only session:ended closes it. Without this the row stayed `running`
+        // until the next boot — blocking deleteSession and tagging the next
+        // messages onto a ghost session.
+        if (this._stopRequested) {
+            this.handle({ kind: 'session:ended', reason: 'killed', exitCode: null });
+            return;
+        }
         const process = await this.engine.start(options, (ev) => this.handle(ev));
         this._engineProcess = process;
         if (this._status === 'stopping') {
@@ -63,6 +90,7 @@ export class SessionController {
         this._engineProcess.interrupt();
     }
     async stop() {
+        this._stopRequested = true;
         this._status = 'stopping';
         // `startEngine` may still be in flight: `_engineProcess` stays undefined
         // until `engine.start` resolves, so without this wait `stop()` would

package/dist/server/services/auto-loop-service.js

@@ -5,6 +5,7 @@ import { slugifyProjectName } from '../utils/project-slug.js';
 import { resolveWorkspaceWorktreePath } from '../utils/worktree-paths.js';
 import * as orchestrator from './agent/orchestrator.js';
 import * as cleanupScriptService from './cleanup-script-service.js';
+import * as lifecycleHookService from './lifecycle-hook-service.js';
 import * as settingsService from './settings-service.js';
 import { getSuitePrompts } from './skill-suite-prompts.js';
 import { emit, emitEphemeral } from './websocket-service.js';
@@ -91,6 +92,13 @@ export function disable(workspaceId, reason) {
     console.info(`[auto-loop] disabled workspace '${workspaceId}' reason=${reason}` +
         ` pending=${diagnostic.tasksPending} streak=${diagnostic.noProgressStreak} status=${diagnostic.status}`);
     emitEphemeral(workspaceId, 'autoloop:disabled', diagnostic);
+    // The user's own hook, if they wrote one. Deliberately fired for EVERY
+    // reason, not only 'completed' like the cleanup script below: a loop that
+    // stalled is precisely the case worth being told about.
+    void lifecycleHookService.onAutoLoopDisabled(workspaceId, {
+        reason,
+        tasksPending: diagnostic.tasksPending,
+    });
     // The loop finished every task — run the project's cleanup script. Other
     // disable reasons (stall / error / user-action) leave tasks unfinished, so
     // they intentionally skip the cleanup.
@@ -262,6 +270,51 @@ function computeIterationNumber(workspaceId) {
  * Worktree-missing edge: if the worktree directory has been deleted on disk,
  * `orchestrator.startAgent` throws during engine.start — caught below.
  */
+/**
+ * Whether another unattended session may start right now. `0` — the default —
+ * means no limit. Only the auto-loop consults this: a session the user starts
+ * by hand always goes through.
+ */
+function hasFreeAgentSlot() {
+    const limit = settingsService.getGlobalSettings().maxConcurrentAgents;
+    if (!limit || limit <= 0)
+        return true;
+    return orchestrator.runningAgentCount() < limit;
+}
+/**
+ * Give every auto-loop workspace parked on "waiting for a free agent slot"
+ * another chance. Called by the orchestrator after ANY session ends: a parked
+ * workspace has no session of its own to end, so nothing else would ever ask
+ * spawnNextIteration on its behalf again.
+ *
+ * Stops as soon as the slots are full again, so with three parked and one
+ * free, exactly one starts and the other two keep waiting rather than each
+ * re-announcing that they wait.
+ */
+export function resumeWaitingWorkspaces() {
+    const db = getDb();
+    const rows = db
+        .prepare(`SELECT id, status FROM workspaces
+        WHERE auto_loop = 1 AND auto_loop_ready = 1 AND archived_at IS NULL
+        ORDER BY updated_at ASC`)
+        .all();
+    for (const row of rows) {
+        if (!hasFreeAgentSlot())
+            return;
+        if (orchestrator.hasController(row.id))
+            continue;
+        // Same guards as spawnNextIteration's own callers: a quota backoff or a
+        // pending question owns the next start of that workspace.
+        if (row.status === 'awaiting-user' || row.status === 'quota')
+            continue;
+        try {
+            spawnNextIteration(row.id);
+        }
+        catch (err) {
+            console.error(`[auto-loop] resume after slot freed failed for workspace '${row.id}':`, err);
+        }
+    }
+}
 function spawnNextIteration(workspaceId, opts = {}) {
     const row = getRow(workspaceId);
     if (!row)
@@ -274,6 +327,18 @@ function spawnNextIteration(workspaceId, opts = {}) {
         disable(workspaceId, 'completed');
         return;
     }
+    // Hold off rather than pile on. Ten auto-loop workspaces waking together
+    // hammer the same rate limit and each land in their own backoff, so nobody
+    // gets through. The loop stays enabled: the next session to end anywhere
+    // calls back in here, and by then a slot has freed.
+    if (!hasFreeAgentSlot()) {
+        console.log(`[auto-loop] workspace '${workspaceId}' is waiting for a free agent slot`);
+        emitEphemeral(workspaceId, 'autoloop:waiting-for-slot', {
+            running: orchestrator.runningAgentCount(),
+            limit: settingsService.getGlobalSettings().maxConcurrentAgents,
+        });
+        return;
+    }
     const iterationNumber = computeIterationNumber(workspaceId);
     // Override block: replaces the standard iteration prompt body when the task
     // title carries a recognized prefix (case-sensitive, trailing space required).

package/dist/server/services/awaiting-user-reminder-service.js

@@ -0,0 +1,115 @@
+import { getDb } from '../db/index.js';
+import { getGlobalSettings } from './settings-service.js';
+import { broadcastAll } from './websocket-service.js';
+/** How often the reminder loop looks at the clock. */
+const TICK_INTERVAL_MS = 60_000;
+/**
+ * Which waiting workspaces are owed a reminder now.
+ *
+ * `state` is updated in place: entries appear when a workspace starts waiting
+ * and disappear when it stops, so answering a question resets its clock.
+ *
+ * Pure apart from that mutation, which is what makes the interval arithmetic
+ * — the part that is easy to get wrong — testable without a timer or a DB.
+ */
+export function computeDueReminders(params) {
+    const { awaiting, now, intervalMs, state } = params;
+    // Disabled. Clear the state too: re-enabling later should start from now,
+    // not from a clock that kept running while the feature was off.
+    if (intervalMs <= 0) {
+        state.clear();
+        return [];
+    }
+    const stillWaiting = new Set(awaiting.map((w) => w.id));
+    for (const id of state.keys()) {
+        if (!stillWaiting.has(id))
+            state.delete(id);
+    }
+    const due = [];
+    for (const workspace of awaiting) {
+        const existing = state.get(workspace.id);
+        if (!existing) {
+            // First sight. The question was just asked, so nothing is overdue yet.
+            state.set(workspace.id, { firstSeenAt: now, lastRemindedAt: null, remindersSent: 0 });
+            continue;
+        }
+        // Measured from the LAST reminder (or the first sighting), not as a
+        // multiple of the interval since the start: that way a change of interval
+        // applies from the next reminder, and a laptop waking from sleep owing
+        // four reminders sends one, not four, for the same unanswered question.
+        const since = existing.lastRemindedAt ?? existing.firstSeenAt;
+        if (now - since < intervalMs)
+            continue;
+        existing.lastRemindedAt = now;
+        existing.remindersSent += 1;
+        due.push({
+            id: workspace.id,
+            name: workspace.name,
+            waitingMs: now - existing.firstSeenAt,
+            reminderNumber: existing.remindersSent,
+        });
+    }
+    return due;
+}
+const reminderState = new Map();
+let timer = null;
+function listAwaitingWorkspaces() {
+    return getDb()
+        .prepare(`SELECT id, name FROM workspaces WHERE status = 'awaiting-user' AND archived_at IS NULL`)
+        .all();
+}
+/**
+ * One pass of the reminder loop. Broadcast rather than emitted to the
+ * workspace's subscribers: the whole point is to reach the user who is looking
+ * at something else, or at nothing.
+ *
+ * Never throws — it runs on a timer nobody is watching, and an exception here
+ * would silently end the loop for the rest of the process's life.
+ */
+export function runReminderTick(now = Date.now()) {
+    try {
+        const minutes = getGlobalSettings().awaitingUserReminderMinutes;
+        // The API refuses more than a day; a hand-edited settings.json gets the
+        // same ceiling here rather than a reminder that fires next week.
+        const intervalMs = typeof minutes === 'number' && minutes > 0 ? Math.min(minutes, 1440) * 60_000 : 0;
+        if (intervalMs <= 0) {
+            reminderState.clear();
+            return;
+        }
+        for (const reminder of computeDueReminders({
+            awaiting: listAwaitingWorkspaces(),
+            now,
+            intervalMs,
+            state: reminderState,
+        })) {
+            broadcastAll('workspace:awaiting-reminder', {
+                workspaceId: reminder.id,
+                workspaceName: reminder.name,
+                waitingMinutes: Math.round(reminder.waitingMs / 60_000),
+                reminderNumber: reminder.reminderNumber,
+            });
+        }
+    }
+    catch (err) {
+        console.error('[awaiting-user-reminder] tick failed:', err);
+    }
+}
+/** Start the reminder loop. Idempotent. */
+export function startAwaitingUserReminder() {
+    if (timer)
+        return;
+    timer = setInterval(() => runReminderTick(), TICK_INTERVAL_MS);
+    timer.unref?.();
+}
+/** Stop the reminder loop. */
+export function stopAwaitingUserReminder() {
+    if (timer) {
+        clearInterval(timer);
+        timer = null;
+    }
+}
+/** @internal */
+export function _resetForTest() {
+    stopAwaitingUserReminder();
+    reminderState.clear();
+}

package/dist/server/services/change-source-branch-service.js

@@ -109,7 +109,7 @@ async function runBuiltInStrategy(workspaceId, worktreePath, workingBranch, proj
     // the branchExists check below is the authoritative gate for the new base
     // (it throws a clean error, mapped to a 400, rather than a raw fetch error).
     try {
-        gitOps.fetchAllBranches(worktreePath);
+        await gitOps.fetchAllBranchesAsync(worktreePath);
     }
     catch {
         // offline / no remote — proceed with local refs

package/dist/server/services/forge/resolve.js

@@ -18,12 +18,30 @@ function readRemoteUrl(projectPath) {
         return execFileSync('git', ['remote', 'get-url', 'origin'], {
             cwd: projectPath,
             encoding: 'utf-8',
+            // Without a bound, a git hanging on a network filesystem blocks the whole
+            // event loop: this runs synchronously, and the pr-watcher calls it for
+            // every workspace on every tick.
+            timeout: 5_000,
         }).trim();
     }
     catch {
         return '';
     }
 }
+/**
+ * Auto-detected forge per project path. The remote of a checkout does not
+ * change while Kōbō runs, and resolving it costs a synchronous subprocess that
+ * the pr-watcher would otherwise pay per workspace, per 30 s tick, twice.
+ * Bounded by TTL so a remote that is added or repointed is picked up without a
+ * restart, and only the `auto` path is cached — an explicit setting is already
+ * free to read.
+ */
+const autoForgeCache = new Map();
+const AUTO_FORGE_TTL_MS = 5 * 60_000;
+/** Drop the cached auto-detection. Exported for tests. */
+export function _clearForgeCache() {
+    autoForgeCache.clear();
+}
 /**
  * Resolve the forge for a project: the explicit per-project setting wins;
  * `auto` (the default) classifies the origin remote URL.
@@ -33,5 +51,15 @@ export function resolveForge(projectPath) {
     if (setting === 'github' || setting === 'gitlab' || setting === 'bitbucket-community' || setting === 'none') {
         return setting;
     }
-    return forgeFromRemoteUrl(readRemoteUrl(projectPath));
+    const cached = autoForgeCache.get(projectPath);
+    if (cached && Date.now() - cached.readAt < AUTO_FORGE_TTL_MS)
+        return cached.forge;
+    const remoteUrl = readRemoteUrl(projectPath);
+    const forge = forgeFromRemoteUrl(remoteUrl);
+    // A read that failed (git timing out on a network mount, a transient lock)
+    // is not knowledge: caching it would disable PR actions for five minutes on
+    // a project that has a perfectly good remote.
+    if (remoteUrl)
+        autoForgeCache.set(projectPath, { forge, readAt: Date.now() });
+    return forge;
 }