@loicngr/kobo 1.11.8 → 1.11.10

package/dist/server/services/dev-server-service.js

@@ -1,4 +1,4 @@
-import { execSync, spawn } from 'node:child_process';
+import { execFile, spawn } from 'node:child_process';
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 import { getProjectSettings } from './settings-service.js';
@@ -10,6 +10,16 @@ function cleanEnv() {
     const { PORT, SERVER_PORT, ...rest } = process.env;
     return rest;
 }
+function runCommand(command, args, options = {}) {
+    return new Promise((resolve, reject) => {
+        execFile(command, args, { ...options, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 }, (err, stdout) => {
+            if (err)
+                reject(err);
+            else
+                resolve(stdout);
+        });
+    });
+}
 // ── State ──────────────────────────────────────────────────────────────────────
 /** workspaceId -> spawned dev-server process */
 const trackedProcesses = new Map();
@@ -61,28 +71,32 @@ export function resolveInstance(projectPath, workingBranch) {
     for (const file of files) {
         const content = readFileSync(path.join(instancesDir, file), 'utf-8');
         const parsed = parseEnvFile(content);
-        if (parsed.INSTANCE_NAME && parsed.INSTANCE_NAME.toLowerCase() === sanitized) {
+        if (parsed.INSTANCE_NAME &&
+            parsed.INSTANCE_NAME.toLowerCase() === sanitized &&
+            parsed.PROJECT_NAME &&
+            /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(parsed.PROJECT_NAME)) {
             return {
                 instanceName: parsed.INSTANCE_NAME,
-                projectName: parsed.PROJECT_NAME ?? '',
+                projectName: parsed.PROJECT_NAME,
                 httpPort: parsed.HTTP_PORT ?? '',
             };
         }
     }
     return null;
 }
+function containerBelongsToProject(containerName, projectName) {
+    const name = containerName.toLowerCase();
+    const project = projectName.toLowerCase();
+    return name === project || name.startsWith(`${project}-`) || name.startsWith(`${project}_`);
+}
 // ── Docker helpers ─────────────────────────────────────────────────────────────
 /**
  * List all running Docker container names.
- * Note: uses execSync with shell because docker ps --format requires
- * Go template syntax with `{{}}`. Input is a static string, no injection risk.
+ * Uses execFile so Docker inspection cannot block the Node event loop.
  */
-export function listRunningContainers() {
+export async function listRunningContainers() {
     try {
-        const output = execSync('docker ps --format "{{.Names}}"', {
-            encoding: 'utf-8',
-            timeout: 10000,
-        });
+        const output = await runCommand('docker', ['ps', '--format', '{{.Names}}'], { timeout: 10_000 });
         return output
             .split('\n')
             .map((s) => s.trim())
@@ -102,7 +116,7 @@ export function listRunningContainers() {
  * in `docker ps` yet. This prevents the UI from flashing to `'stopped'` during
  * long build phases.
  */
-export function getStatus(projectPath, workingBranch, workspaceId) {
+export async function getStatus(projectPath, workingBranch, workspaceId) {
     const config = resolveInstance(projectPath, workingBranch);
     if (!config) {
         return {
@@ -114,8 +128,8 @@ export function getStatus(projectPath, workingBranch, workspaceId) {
             containers: [],
         };
     }
-    const running = listRunningContainers();
-    const matching = running.filter((name) => name.toLowerCase().includes(config.projectName.toLowerCase()));
+    const running = await listRunningContainers();
+    const matching = running.filter((name) => containerBelongsToProject(name, config.projectName));
     if (matching.length > 0) {
         return {
             status: 'running',
@@ -161,6 +175,13 @@ export function startDevServer(workspaceId) {
     if (!settings?.devServer.startCommand) {
         throw new Error('No dev-server start command configured');
     }
+    // Reject a second concurrent start for the same workspace instead of
+    // silently overwriting the tracked process — the first process would
+    // otherwise become untrackable (never killed by stopDevServer) and its
+    // exit handler could later clobber state set by the second process.
+    if (trackedProcesses.has(workspaceId)) {
+        throw new Error(`Dev server for workspace '${workspaceId}' is already starting`);
+    }
     const instanceName = sanitizeBranchName(workspace.workingBranch);
     // Execute as bash script (supports multi-line scripts)
     const worktreePath = workspace.worktreePath;
@@ -185,9 +206,14 @@ export function startDevServer(workspaceId) {
     });
     proc.on('exit', (code) => {
         trackedProcesses.delete(workspaceId);
-        const currentStatus = getStatus(workspace.projectPath, workspace.workingBranch);
-        updateDevServerStatus(workspaceId, currentStatus.status);
-        emitEphemeral(workspaceId, 'devserver:status', currentStatus);
+        void getStatus(workspace.projectPath, workspace.workingBranch)
+            .then((currentStatus) => {
+            updateDevServerStatus(workspaceId, currentStatus.status);
+            emitEphemeral(workspaceId, 'devserver:status', currentStatus);
+        })
+            .catch((err) => {
+            console.error(`[dev-server] Failed to refresh status for workspace ${workspaceId}:`, err);
+        });
         if (code !== 0) {
             console.error(`[dev-server] Process exited with code ${code} for workspace ${workspaceId}`);
         }
@@ -222,7 +248,7 @@ export function startDevServer(workspaceId) {
 /**
  * Stop the dev-server for a workspace.
  */
-export function stopDevServer(workspaceId) {
+export async function stopDevServer(workspaceId) {
     const workspace = getWorkspace(workspaceId);
     if (!workspace) {
         throw new Error(`Workspace '${workspaceId}' not found`);
@@ -249,18 +275,15 @@ export function stopDevServer(workspaceId) {
     }
     const settings = getProjectSettings(workspace.projectPath);
     if (settings?.devServer.stopCommand) {
-        // Custom stop script — run synchronously with instance context in env
         try {
-            execSync(settings.devServer.stopCommand, {
+            await runCommand('bash', ['-c', settings.devServer.stopCommand], {
                 cwd,
                 env: {
                     ...cleanEnv(),
                     INSTANCE: instanceName,
                     PROJECT_NAME: config?.projectName ?? '',
                 },
-                encoding: 'utf-8',
-                timeout: 30000,
-                shell: 'bash',
+                timeout: 30_000,
             });
         }
         catch (err) {
@@ -271,11 +294,7 @@ export function stopDevServer(workspaceId) {
     // (handles cases where custom stop command doesn't use -p flag)
     if (config?.projectName) {
         try {
-            execSync(`docker compose -p "${config.projectName}" down`, {
-                cwd: cwd,
-                encoding: 'utf-8',
-                timeout: 30000,
-            });
+            await runCommand('docker', ['compose', '-p', config.projectName, 'down'], { cwd, timeout: 30_000 });
         }
         catch {
             // May already be stopped by the custom command — ignore
@@ -296,10 +315,9 @@ export function stopDevServer(workspaceId) {
 // ── Logs ───────────────────────────────────────────────────────────────────────
 /**
  * Get logs from running dev-server containers for a workspace.
- * Note: uses execSync for `docker logs` — container names come from
- * `docker ps` output (not user input), so no injection risk.
+ * Docker log reads run concurrently without blocking the Node event loop.
  */
-export function getDevServerLogs(workspaceId, tail = 200) {
+export async function getDevServerLogs(workspaceId, tail = 200) {
     const workspace = getWorkspace(workspaceId);
     if (!workspace) {
         return 'Workspace not found';
@@ -308,24 +326,20 @@ export function getDevServerLogs(workspaceId, tail = 200) {
     if (!config) {
         return 'No dev-server instance found';
     }
-    const running = listRunningContainers();
-    const matching = running.filter((name) => name.toLowerCase().includes(config.projectName.toLowerCase()));
+    const running = await listRunningContainers();
+    const matching = running.filter((name) => containerBelongsToProject(name, config.projectName));
     if (matching.length === 0) {
         return 'No running containers found';
     }
-    const outputs = [];
-    for (const container of matching) {
+    const outputs = await Promise.all(matching.map(async (container) => {
         try {
-            const logs = execSync(`docker logs --tail ${tail} ${container}`, {
-                encoding: 'utf-8',
-                timeout: 10000,
-            });
-            outputs.push(`=== ${container} ===\n${logs}`);
+            const logs = await runCommand('docker', ['logs', '--tail', String(tail), container], { timeout: 10_000 });
+            return `=== ${container} ===\n${logs}`;
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
-            outputs.push(`=== ${container} ===\n[Error fetching logs: ${message}]`);
+            return `=== ${container} ===\n[Error fetching logs: ${message}]`;
         }
-    }
+    }));
     return outputs.join('\n\n');
 }

package/dist/server/services/forge/bitbucket/provider.js

@@ -144,12 +144,13 @@ function bktEnv() {
     return process.env;
 }
 function bktOptions(repoPath) {
-    return { cwd: repoPath, encoding: 'utf-8', env: bktEnv() };
+    return { cwd: repoPath, encoding: 'utf-8', env: bktEnv(), timeout: 30_000 };
 }
 async function resolveTarget(repoPath) {
     const { stdout } = await execFileAsync('git', ['remote', 'get-url', 'origin'], {
         cwd: repoPath,
         encoding: 'utf-8',
+        timeout: 30_000,
     });
     const target = parseBitbucketRemote(stdout);
     if (!target)
@@ -158,27 +159,21 @@ async function resolveTarget(repoPath) {
     // keyring and context access, which cannot prompt from the Kobo server.
     if (bktEnv().BKT_TOKEN)
         return { ...target, context: null };
-    const { stdout: contextOutput } = await execFileAsync('bkt', ['context', 'list', '--json'], {
-        cwd: repoPath,
-        encoding: 'utf-8',
-    });
+    const { stdout: contextOutput } = await execFileAsync('bkt', ['context', 'list', '--json'], bktOptions(repoPath));
     const contexts = record(JSON.parse(contextOutput)).contexts;
     const existing = (Array.isArray(contexts) ? contexts : [])
         .map(record)
         .find((context) => string(context.workspace) === target.workspace && string(context.default_repo) === target.repo);
     if (existing && string(existing.name))
         return { ...target, context: string(existing.name) };
-    const { stdout: authOutput } = await execFileAsync('bkt', ['auth', 'status', '--json'], {
-        cwd: repoPath,
-        encoding: 'utf-8',
-    });
+    const { stdout: authOutput } = await execFileAsync('bkt', ['auth', 'status', '--json'], bktOptions(repoPath));
     const hosts = record(JSON.parse(authOutput)).hosts;
     const host = (Array.isArray(hosts) ? hosts : []).map(record).find((item) => string(item.kind) === 'cloud');
     const hostKey = string(host?.key);
     if (!hostKey)
         throw new Error('No authenticated Bitbucket Cloud host found; run bkt auth login first');
     const context = contextName(target.workspace, target.repo);
-    await execFileAsync('bkt', ['context', 'create', context, '--host', hostKey, '--workspace', target.workspace, '--repo', target.repo], { cwd: repoPath, encoding: 'utf-8' });
+    await execFileAsync('bkt', ['context', 'create', context, '--host', hostKey, '--workspace', target.workspace, '--repo', target.repo], bktOptions(repoPath));
     return { ...target, context };
 }
 function targetArgs(target) {
@@ -286,6 +281,6 @@ export const bitbucketProvider = {
         await execFileAsync('bkt', bktArgs(target, ['pr', 'merge', String(number), '--close-source=false', ...targetArgs(target)]), bktOptions(repoPath));
     },
     async deleteRemoteBranch(repoPath, branchName) {
-        await execFileAsync('git', ['push', 'origin', '--delete', branchName], { cwd: repoPath, encoding: 'utf-8' });
+        await execFileAsync('git', ['push', 'origin', '--delete', branchName], bktOptions(repoPath));
     },
 };

package/dist/server/services/forge/github/provider.js

@@ -3,6 +3,10 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { deriveReadyToMerge } from '../types.js';
 const execFileAsync = promisify(execFile);
+const CLI_TIMEOUT_MS = 30_000;
+function cliOptions(repoPath) {
+    return { cwd: repoPath, encoding: 'utf-8', timeout: CLI_TIMEOUT_MS };
+}
 // NOTE: `reviewThreads` is intentionally NOT in this list.
 // `gh pr view --json reviewThreads` is rejected with `Unknown JSON field`
 // — there is no stable `gh` version that exposes it. Until upstream adds it,
@@ -101,7 +105,7 @@ export const githubProvider = {
     },
     async isAvailable(repoPath) {
         try {
-            await execFileAsync('gh', ['auth', 'status'], { cwd: repoPath, encoding: 'utf-8' });
+            await execFileAsync('gh', ['auth', 'status'], cliOptions(repoPath));
             return { available: true };
         }
         catch (err) {
@@ -110,10 +114,7 @@ export const githubProvider = {
     },
     async getPrStatus(repoPath, branch) {
         try {
-            const { stdout } = await execFileAsync('gh', ['pr', 'view', branch, '--json', GH_PR_FIELDS], {
-                cwd: repoPath,
-                encoding: 'utf-8',
-            });
+            const { stdout } = await execFileAsync('gh', ['pr', 'view', branch, '--json', GH_PR_FIELDS], cliOptions(repoPath));
             const raw = stdout.trim();
             if (!raw)
                 return null;
@@ -124,19 +125,19 @@ export const githubProvider = {
         }
     },
     async createPr(repoPath, opts) {
-        const { stdout } = await execFileAsync('gh', ['pr', 'create', '--base', opts.base, '--head', opts.head, '--title', opts.title, '--body', opts.body], { cwd: repoPath, encoding: 'utf-8' });
+        const { stdout } = await execFileAsync('gh', ['pr', 'create', '--base', opts.base, '--head', opts.head, '--title', opts.title, '--body', opts.body], cliOptions(repoPath));
         const match = stdout.match(/https:\/\/github\.com\/[^\s]+\/pull\/(\d+)/);
         if (!match)
             throw new Error('Could not parse PR URL from gh output');
         return { url: match[0], number: Number.parseInt(match[1], 10) };
     },
     async changePrBase(repoPath, base) {
-        await execFileAsync('gh', ['pr', 'edit', '--base', base], { cwd: repoPath, encoding: 'utf-8' });
+        await execFileAsync('gh', ['pr', 'edit', '--base', base], cliOptions(repoPath));
     },
     async mergeRequest(repoPath, number) {
-        await execFileAsync('gh', ['pr', 'merge', String(number), '--merge'], { cwd: repoPath, encoding: 'utf-8' });
+        await execFileAsync('gh', ['pr', 'merge', String(number), '--merge'], cliOptions(repoPath));
     },
     async deleteRemoteBranch(repoPath, branch) {
-        await execFileAsync('git', ['push', 'origin', '--delete', branch], { cwd: repoPath, encoding: 'utf-8' });
+        await execFileAsync('git', ['push', 'origin', '--delete', branch], cliOptions(repoPath));
     },
 };

package/dist/server/services/forge/gitlab/provider.js

@@ -3,6 +3,10 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { deriveReadyToMerge } from '../types.js';
 const execFileAsync = promisify(execFile);
+const CLI_TIMEOUT_MS = 30_000;
+function cliOptions(repoPath) {
+    return { cwd: repoPath, encoding: 'utf-8', timeout: CLI_TIMEOUT_MS };
+}
 /** Map GitLab MR state to the normalised PrSnapshot state. */
 function mapState(state) {
     if (state === 'merged')
@@ -100,10 +104,7 @@ function mapGlabJobToCheck(job) {
  */
 async function fetchGlabCi(repoPath, branch) {
     try {
-        const { stdout } = await execFileAsync('glab', ['ci', 'get', '-b', branch, '-F', 'json'], {
-            cwd: repoPath,
-            encoding: 'utf-8',
-        });
+        const { stdout } = await execFileAsync('glab', ['ci', 'get', '-b', branch, '-F', 'json'], cliOptions(repoPath));
         const raw = stdout.trim();
         if (!raw)
             return { rollup: null, checks: [] };
@@ -138,7 +139,7 @@ export const gitlabProvider = {
     },
     async isAvailable(repoPath) {
         try {
-            await execFileAsync('glab', ['auth', 'status'], { cwd: repoPath, encoding: 'utf-8' });
+            await execFileAsync('glab', ['auth', 'status'], cliOptions(repoPath));
             return { available: true };
         }
         catch (err) {
@@ -147,10 +148,7 @@ export const gitlabProvider = {
     },
     async getPrStatus(repoPath, branch) {
         try {
-            const { stdout } = await execFileAsync('glab', ['mr', 'view', branch, '--output', 'json'], {
-                cwd: repoPath,
-                encoding: 'utf-8',
-            });
+            const { stdout } = await execFileAsync('glab', ['mr', 'view', branch, '--output', 'json'], cliOptions(repoPath));
             const raw = stdout.trim();
             if (!raw)
                 return null;
@@ -176,19 +174,19 @@ export const gitlabProvider = {
             '--description',
             opts.body,
             '--yes',
-        ], { cwd: repoPath, encoding: 'utf-8' });
+        ], cliOptions(repoPath));
         const match = stdout.match(/https?:\/\/[^\s]+\/-\/merge_requests\/(\d+)/);
         if (!match)
             throw new Error('Could not parse MR URL from glab output');
         return { url: match[0], number: Number.parseInt(match[1], 10) };
     },
     async changePrBase(repoPath, base) {
-        await execFileAsync('glab', ['mr', 'update', '--target-branch', base], { cwd: repoPath, encoding: 'utf-8' });
+        await execFileAsync('glab', ['mr', 'update', '--target-branch', base], cliOptions(repoPath));
     },
     async mergeRequest(repoPath, number) {
-        await execFileAsync('glab', ['mr', 'merge', String(number), '--yes'], { cwd: repoPath, encoding: 'utf-8' });
+        await execFileAsync('glab', ['mr', 'merge', String(number), '--yes'], cliOptions(repoPath));
     },
     async deleteRemoteBranch(repoPath, branch) {
-        await execFileAsync('git', ['push', 'origin', '--delete', branch], { cwd: repoPath, encoding: 'utf-8' });
+        await execFileAsync('git', ['push', 'origin', '--delete', branch], cliOptions(repoPath));
     },
 };

package/dist/server/services/git-stats-service.js

@@ -10,13 +10,15 @@ import { resolveForge } from './forge/resolve.js';
  */
 export async function computeGitStats(workspace, prSnapshot) {
     const { worktreePath, sourceBranch, workingBranch, projectPath } = workspace;
-    const commitCount = gitOps.getCommitCount(worktreePath, sourceBranch, workingBranch);
-    const behindCount = gitOps.getCommitsBehind(worktreePath, sourceBranch, workingBranch);
-    const diffStats = gitOps.getStructuredDiffStatsBetween(worktreePath, sourceBranch, workingBranch);
-    const unpushedCount = await gitOps.getUnpushedCountAsync(worktreePath, workingBranch);
-    const workingTree = gitOps.getWorkingTreeStatus(worktreePath);
     const forgeProvider = getForgeProvider(resolveForge(projectPath));
-    const availability = await forgeProvider.isAvailable(worktreePath);
+    const [commitCount, behindCount, diffStats, unpushedCount, workingTree, availability] = await Promise.all([
+        gitOps.getCommitCountAsync(worktreePath, sourceBranch, workingBranch),
+        gitOps.getCommitsBehindAsync(worktreePath, sourceBranch, workingBranch),
+        gitOps.getStructuredDiffStatsBetweenAsync(worktreePath, sourceBranch, workingBranch),
+        gitOps.getUnpushedCountAsync(worktreePath, workingBranch),
+        gitOps.getWorkingTreeStatusAsync(worktreePath),
+        forgeProvider.isAvailable(worktreePath),
+    ]);
     return {
         commitCount,
         behindCount,

package/dist/server/services/image-service.js

@@ -6,6 +6,29 @@ const IMAGES_DIR = '.ai/images';
 const INDEX_FILE = 'index.json';
 // Per-worktree lock to serialize index.json writes
 const locks = new Map();
+function ensureRealImagesDirectory(worktreePath) {
+    const realWorktree = fs.realpathSync(worktreePath);
+    let current = worktreePath;
+    for (const segment of ['.ai', 'images']) {
+        current = path.join(current, segment);
+        if (fs.existsSync(current)) {
+            const stat = fs.lstatSync(current);
+            if (stat.isSymbolicLink())
+                throw new Error(`Symbolic links are not allowed in image storage: ${current}`);
+            if (!stat.isDirectory())
+                throw new Error(`Image storage path is not a directory: ${current}`);
+        }
+        else {
+            fs.mkdirSync(current);
+        }
+        const realCurrent = fs.realpathSync(current);
+        const relative = path.relative(realWorktree, realCurrent);
+        if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+            throw new Error('Image storage path escapes the worktree');
+        }
+    }
+    return fs.realpathSync(current);
+}
 function withLock(worktreePath, fn) {
     const prev = locks.get(worktreePath) ?? Promise.resolve();
     // The second argument to .then() means: even if the previous operation in the
@@ -18,6 +41,8 @@ function readIndex(imagesDir) {
     const indexPath = path.join(imagesDir, INDEX_FILE);
     if (!fs.existsSync(indexPath))
         return [];
+    if (fs.lstatSync(indexPath).isSymbolicLink())
+        throw new Error('Symbolic links are not allowed for image index');
     try {
         return JSON.parse(fs.readFileSync(indexPath, 'utf-8'));
     }
@@ -27,7 +52,13 @@ function readIndex(imagesDir) {
     }
 }
 function writeIndex(imagesDir, entries) {
-    fs.writeFileSync(path.join(imagesDir, INDEX_FILE), JSON.stringify(entries, null, 2));
+    const indexPath = path.join(imagesDir, INDEX_FILE);
+    if (fs.existsSync(indexPath) && fs.lstatSync(indexPath).isSymbolicLink()) {
+        throw new Error('Symbolic links are not allowed for image index');
+    }
+    const tempPath = path.join(imagesDir, `.index-${process.pid}.tmp`);
+    fs.writeFileSync(tempPath, JSON.stringify(entries, null, 2));
+    fs.renameSync(tempPath, indexPath);
 }
 /** Save an image buffer to `.ai/images/` and update the index. Returns the UID and relative path. */
 export async function saveImage(worktreePath, fileBuffer, originalName) {
@@ -39,9 +70,7 @@ export async function saveImage(worktreePath, fileBuffer, originalName) {
         throw new Error(`Unsupported image extension: '${ext}'. Allowed: ${[...ALLOWED_EXTENSIONS].join(', ')}`);
     }
     const uid = nanoid(10);
-    const imagesDir = path.join(worktreePath, IMAGES_DIR);
-    // mkdirSync is idempotent — safe to call outside the lock
-    fs.mkdirSync(imagesDir, { recursive: true });
+    const imagesDir = ensureRealImagesDirectory(worktreePath);
     const filename = `${uid}.${ext}`;
     await withLock(worktreePath, () => {
         // Write the image file inside the lock so both the file write and index
@@ -55,7 +84,7 @@ export async function saveImage(worktreePath, fileBuffer, originalName) {
 }
 /** Delete an image by UID from disk and the index. */
 export async function deleteImage(worktreePath, uid) {
-    const imagesDir = path.join(worktreePath, IMAGES_DIR);
+    const imagesDir = ensureRealImagesDirectory(worktreePath);
     await withLock(worktreePath, () => {
         const entries = readIndex(imagesDir);
         const idx = entries.findIndex((e) => e.uid === uid);

package/dist/server/services/notion-service.js

@@ -266,7 +266,15 @@ export async function extractNotionPage(notionUrl) {
     }
     finally {
         mcpProcess.stdin?.end();
-        mcpProcess.kill();
+        try {
+            if (mcpProcess.pid)
+                process.kill(-mcpProcess.pid, 'SIGTERM');
+            else
+                mcpProcess.kill();
+        }
+        catch {
+            mcpProcess.kill();
+        }
     }
 }
 /** Lightweight MCP/auth smoke test; does not read a user page or mutate Notion. */
@@ -285,7 +293,15 @@ export async function testNotionConnection() {
     }
     finally {
         mcpProcess.stdin?.end();
-        mcpProcess.kill();
+        try {
+            if (mcpProcess.pid)
+                process.kill(-mcpProcess.pid, 'SIGTERM');
+            else
+                mcpProcess.kill();
+        }
+        catch {
+            mcpProcess.kill();
+        }
     }
 }
 export async function listNotionUsers() {
@@ -339,7 +355,15 @@ export async function listNotionUsers() {
     }
     finally {
         mcpProcess.stdin?.end();
-        mcpProcess.kill();
+        try {
+            if (mcpProcess.pid)
+                process.kill(-mcpProcess.pid, 'SIGTERM');
+            else
+                mcpProcess.kill();
+        }
+        catch {
+            mcpProcess.kill();
+        }
     }
 }
 export async function assignNotionPageToSelf(notionUrl, propertyName) {
@@ -398,7 +422,15 @@ export async function assignNotionPageToSelf(notionUrl, propertyName) {
     }
     finally {
         mcpProcess.stdin?.end();
-        mcpProcess.kill();
+        try {
+            if (mcpProcess.pid)
+                process.kill(-mcpProcess.pid, 'SIGTERM');
+            else
+                mcpProcess.kill();
+        }
+        catch {
+            mcpProcess.kill();
+        }
     }
 }
 /** Update a status property on a Notion page. Best-effort, does not throw. */
@@ -433,6 +465,14 @@ export async function updateNotionStatus(notionUrl, propertyName, statusValue) {
     }
     finally {
         mcpProcess.stdin?.end();
-        mcpProcess.kill();
+        try {
+            if (mcpProcess.pid)
+                process.kill(-mcpProcess.pid, 'SIGTERM');
+            else
+                mcpProcess.kill();
+        }
+        catch {
+            mcpProcess.kill();
+        }
     }
 }

package/dist/server/services/pr-watcher-service.js

@@ -18,8 +18,19 @@ import { purgeWorktree } from './worktree-purge-service.js';
 // it is recorded but NOT acted upon — prevents re-archiving manually
 // unarchived workspaces.
 const POLL_INTERVAL_MS = 30 * 1000; // 30 seconds
+const WORKSPACE_CHECK_CONCURRENCY = 4;
 let timer = null;
 let checking = false;
+async function runBounded(items, concurrency, worker) {
+    let nextIndex = 0;
+    const workers = Array.from({ length: Math.min(concurrency, items.length) }, async () => {
+        while (nextIndex < items.length) {
+            const item = items[nextIndex++];
+            await worker(item);
+        }
+    });
+    await Promise.all(workers);
+}
 /** Tracks the last known PR snapshot per workspace, used to detect transitions
  *  (state, base, reviewDecision). */
 const lastKnownPr = new Map();
@@ -110,11 +121,11 @@ export async function checkPrStatuses() {
             lastKnownGitStats.delete(id);
         }
     }
-    for (const ws of workspaces) {
+    await runBounded(workspaces, WORKSPACE_CHECK_CONCURRENCY, async (ws) => {
         // Without this guard, every git/forge spawn below fails with ENOENT and
         // floods the logs when a worktree was deleted externally.
         if (!fs.existsSync(ws.worktreePath))
-            continue;
+            return;
         try {
             // Opt-out: skip the forge call entirely for a workspace with PR-watch
             // disabled — no PR-status fetch, no auto-archive/purge, no PR-derived
@@ -143,7 +154,7 @@ export async function checkPrStatuses() {
                         console.error(`[pr-watcher] updateWorkspaceSourceBranch failed for '${ws.name}':`, err instanceof Error ? err.message : err);
                         // Leave the cache untouched so the next tick retries — and skip
                         // stats too, since they'd be computed against the stale base.
-                        continue;
+                        return;
                     }
                 }
             }
@@ -158,7 +169,7 @@ export async function checkPrStatuses() {
                 console.error(`[pr-watcher] computeGitStats failed for '${ws.name}':`, err instanceof Error ? err.message : err);
             }
             if (!pr)
-                continue;
+                return;
             const prev = lastKnownPr.get(ws.id);
             // We delay updating `lastKnownPr` until after the actions succeed.
             // Setting it eagerly would poison the cache: if updateWorkspaceSourceBranch
@@ -179,13 +190,13 @@ export async function checkPrStatuses() {
                     // (The defensive base preservation from the no-base branch doesn't apply here
                     // because we ARE in the OPEN→MERGED/CLOSED branch which always has a base.)
                     lastKnownPr.set(ws.id, pr);
-                    continue;
+                    return;
                 }
                 console.log(`[pr-watcher] PR ${pr.state.toLowerCase()} for workspace '${ws.name}' — archiving`);
                 // Best-effort cleanup (same as manual archive): stop dev server + terminal.
                 // Agent is already not running here (guarded above).
                 try {
-                    stopDevServer(ws.id);
+                    await stopDevServer(ws.id);
                 }
                 catch (err) {
                     console.error(`[pr-watcher] stopDevServer failed for '${ws.name}':`, err instanceof Error ? err.message : err);
@@ -217,7 +228,7 @@ export async function checkPrStatuses() {
                         console.error(`[pr-watcher] auto-purge guard failed for '${ws.name}':`, err instanceof Error ? err.message : err);
                     }
                 }
-                continue; // do not run base-change detection on a workspace we just archived
+                return; // do not run base-change detection on a workspace we just archived
             }
             // Review, CI, mergeability, and readiness transitions (only on OPEN PRs;
             // first-sight is silent). Each check is independent so simultaneous
@@ -254,7 +265,7 @@ export async function checkPrStatuses() {
             if (pr.state !== 'OPEN' || !pr.base) {
                 const next = pr.base ? pr : { ...pr, base: prev?.base ?? pr.base };
                 lastKnownPr.set(ws.id, next);
-                continue;
+                return;
             }
             lastKnownPr.set(ws.id, pr);
             // Emit the base-change event AFTER the snapshot is committed so a
@@ -272,7 +283,7 @@ export async function checkPrStatuses() {
         catch (err) {
             console.error(`[pr-watcher] Failed to check PR for workspace '${ws.name}':`, err instanceof Error ? err.message : err);
         }
-    }
+    });
 }
 /**
  * On-demand refresh of a single workspace's PR snapshot. Bypasses the 30s tick.