@loicngr/kobo 1.11.9 → 1.11.11

package/dist/server/routes/images.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { Hono } from 'hono';
 import * as imageService from '../services/image-service.js';
 import * as workspaceService from '../services/workspace-service.js';
+import { isPathInside } from '../utils/safe-path.js';
 /** Maximum allowed upload size for a single image (10 MB). */
 const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10 MB
 /** MIME types accepted for image uploads. */
@@ -67,7 +68,7 @@ app.get('/:id/images/file', async (c) => {
         }
         // Allowlist: only the upload storage layout is served. No symlink escape
         // either — we resolve and check containment.
-        if (!/^(\.ai\/images\/|images\/)[^/]/.test(requested) || requested.includes('..')) {
+        if (!/^\.ai\/images\/[^/]+$/.test(requested) || requested.includes('..')) {
             return c.json({ error: 'Invalid or disallowed image path' }, 400);
         }
         const worktreePath = workspace.worktreePath;
@@ -78,9 +79,23 @@ app.get('/:id/images/file', async (c) => {
         if (fullPath !== imagesRoot && !fullPath.startsWith(imagesRoot + path.sep)) {
             return c.json({ error: 'Path escapes images root' }, 400);
         }
+        if (!fs.existsSync(imagesRoot) || fs.lstatSync(imagesRoot).isSymbolicLink()) {
+            return c.json({ error: 'Invalid images root' }, 400);
+        }
+        if (!fs.existsSync(fullPath))
+            return c.json({ error: 'Image not found' }, 404);
+        const fileStat = fs.lstatSync(fullPath);
+        if (fileStat.isSymbolicLink())
+            return c.json({ error: 'Symbolic links are not allowed' }, 400);
+        const realWorktree = await fs.promises.realpath(worktreePath);
+        const realImagesRoot = await fs.promises.realpath(imagesRoot);
+        const realFile = await fs.promises.realpath(fullPath);
+        if (!isPathInside(realWorktree, realImagesRoot) || !isPathInside(realImagesRoot, realFile)) {
+            return c.json({ error: 'Path escapes images root' }, 400);
+        }
         let buffer;
         try {
-            buffer = await fs.promises.readFile(fullPath);
+            buffer = await fs.promises.readFile(realFile);
         }
         catch {
             return c.json({ error: 'Image not found' }, 404);

package/dist/server/routes/workspaces.js

@@ -48,9 +48,23 @@ const app = new Hono();
 /** Tracks workspaces currently running a setup script to prevent concurrent executions. */
 const setupScriptRunning = new Set();
 const VALID_AGENT_PERMISSION_MODES = ['plan', 'bypass', 'strict', 'interactive'];
+const VALID_WORKSPACE_STATUSES = [
+    'created',
+    'extracting',
+    'brainstorming',
+    'executing',
+    'awaiting-user',
+    'completed',
+    'idle',
+    'error',
+    'quota',
+];
 function isAgentPermissionMode(value) {
     return typeof value === 'string' && VALID_AGENT_PERMISSION_MODES.includes(value);
 }
+function isWorkspaceStatus(value) {
+    return typeof value === 'string' && VALID_WORKSPACE_STATUSES.includes(value);
+}
 async function deliverAgentPrompt(workspace, workingDir, prompt) {
     const delivery = await agentManager.sendMessageForFallback(workspace.id, prompt);
     if (delivery.status === 'sent')
@@ -780,7 +794,9 @@ app.post('/', migrationGuard, async (c) => {
             // active skill suite includes gstack, and only if the user has actually
             // installed gstack locally (the binary may be absent — skip silently).
             // Fast + idempotent; safe to run on every workspace boot.
-            if (globalSettings.skillSuite === 'gstack' || globalSettings.skillSuite === 'superpowers+gstack') {
+            if (globalSettings.skillSuite === 'gstack' ||
+                globalSettings.skillSuite === 'superpowers+gstack' ||
+                globalSettings.skillSuite === 'superpowers+gstack+ecc') {
                 brainstormPrompt += `\n\nIMPORTANT (gstack): Before brainstorming, check whether \`~/.claude/skills/gstack/bin/gstack-brain-sync\` exists. If it does, run it with \`--once\` to load gstack learnings (project-specific patterns, pitfalls, and preferences from prior sessions) into memory. If the binary is missing (gstack not installed in this environment), skip silently and continue — do NOT install anything and do NOT mention the absence. Fast and idempotent when present.`;
             }
             if (body.autoLoop === true) {
@@ -1650,29 +1666,19 @@ app.get('/:id/session-metrics', (c) => {
             session.id,
             { sessionId: session.id, toolCalls: 0, errors: 0, inputTokens: 0, outputTokens: 0 },
         ]));
-        const events = db
-            .prepare("SELECT session_id, payload FROM ws_events WHERE workspace_id = ? AND type = 'agent:event' AND session_id IS NOT NULL")
+        const rows = db
+            .prepare(`SELECT session_id, tool_calls, errors, input_tokens, output_tokens
+         FROM session_event_metrics
+         WHERE workspace_id = ?`)
             .all(id);
-        for (const row of events) {
+        for (const row of rows) {
             const metric = metrics.get(row.session_id);
             if (!metric)
                 continue;
-            try {
-                const event = JSON.parse(row.payload);
-                if (event.kind === 'tool:call')
-                    metric.toolCalls++;
-                if (event.kind === 'error' || (event.kind === 'tool:result' && event.isError === true))
-                    metric.errors++;
-                if (event.kind === 'usage') {
-                    if (typeof event.inputTokens === 'number')
-                        metric.inputTokens = Math.max(metric.inputTokens, event.inputTokens);
-                    if (typeof event.outputTokens === 'number')
-                        metric.outputTokens = Math.max(metric.outputTokens, event.outputTokens);
-                }
-            }
-            catch {
-                // Corrupt historical events are intentionally ignored in diagnostics.
-            }
+            metric.toolCalls = row.tool_calls;
+            metric.errors = row.errors;
+            metric.inputTokens = row.input_tokens;
+            metric.outputTokens = row.output_tokens;
         }
         return c.json({ sessions, metrics: [...metrics.values()] });
     }
@@ -1719,7 +1725,8 @@ app.get('/:id/events', (c) => {
         // optional: scope to a session view. Session views also include
         // workspace-level rows where session_id IS NULL (legacy/pre-session items).
         const session = c.req.query('session');
-        const limit = Math.min(parseInt(c.req.query('limit') ?? '100', 10) || 100, 500);
+        const parsedLimit = parseInt(c.req.query('limit') ?? '100', 10);
+        const limit = Math.max(1, Math.min(Number.isFinite(parsedLimit) ? parsedLimit : 100, 500));
         const db = getDb();
         let rows;
         if (around) {
@@ -1758,12 +1765,12 @@ app.get('/:id/events', (c) => {
                     .prepare('SELECT * FROM ws_events WHERE workspace_id = ? AND (session_id = ? OR session_id IS NULL) ORDER BY rowid DESC LIMIT ?')
                     .all(id, session, limit)
                 : db
-                    .prepare('SELECT * FROM ws_events WHERE workspace_id = ? ORDER BY rowid ASC LIMIT ?')
+                    .prepare('SELECT * FROM ws_events WHERE workspace_id = ? ORDER BY rowid DESC LIMIT ?')
                     .all(id, limit);
         }
         // Reverse to chronological order (we queried DESC for "before" pagination,
         // or for the "session + no cursor" case where we fetched the newest first).
-        if (before || (session && !around))
+        if (!around)
             rows.reverse();
         const events = rows.map((row) => {
             let parsedPayload;
@@ -1798,10 +1805,12 @@ app.get('/:id/events', (c) => {
                     hasMore = older.c > 0;
                 }
             }
-            else if (session) {
-                const total = db
-                    .prepare('SELECT COUNT(*) as c FROM ws_events WHERE workspace_id = ? AND (session_id = ? OR session_id IS NULL)')
-                    .get(id, session);
+            else {
+                const total = session
+                    ? db
+                        .prepare('SELECT COUNT(*) as c FROM ws_events WHERE workspace_id = ? AND (session_id = ? OR session_id IS NULL)')
+                        .get(id, session)
+                    : db.prepare('SELECT COUNT(*) as c FROM ws_events WHERE workspace_id = ?').get(id);
                 hasMore = total.c > rows.length;
             }
         }
@@ -2017,7 +2026,11 @@ app.put('/:id/tags', async (c) => {
 app.patch('/:id', migrationGuard, async (c) => {
     try {
         const id = c.req.param('id');
-        const body = await c.req.json();
+        const parsed = await c.req.json();
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            return c.json({ error: 'Request body must be a JSON object' }, 400);
+        }
+        const body = parsed;
         const workspace = workspaceService.getWorkspace(id);
         if (!workspace) {
             return c.json({ error: `Workspace '${id}' not found` }, 404);
@@ -2026,12 +2039,12 @@ app.patch('/:id', migrationGuard, async (c) => {
         if ('agent_description' in body) {
             return c.json({ error: 'agent_description must be set via the agent MCP tool, not via the API' }, 400);
         }
-        let updated = workspace;
-        if (body.model !== undefined) {
-            updated = workspaceService.updateWorkspaceModel(id, body.model);
+        if (body.model !== undefined && (typeof body.model !== 'string' || !body.model.trim())) {
+            return c.json({ error: 'model must be a non-empty string' }, 400);
         }
-        if (body.reasoningEffort !== undefined) {
-            updated = workspaceService.updateWorkspaceReasoningEffort(id, body.reasoningEffort);
+        if (body.reasoningEffort !== undefined &&
+            (typeof body.reasoningEffort !== 'string' || !body.reasoningEffort.trim())) {
+            return c.json({ error: 'reasoningEffort must be a non-empty string' }, 400);
         }
         if (body.agentPermissionMode !== undefined) {
             if (!isAgentPermissionMode(body.agentPermissionMode)) {
@@ -2048,25 +2061,25 @@ app.patch('/:id', migrationGuard, async (c) => {
                     error: `Engine '${engineId}' does not support agentPermissionMode '${body.agentPermissionMode}'. Supported: ${supported.join(', ')}`,
                 }, 400);
             }
-            updated = workspaceService.updateAgentPermissionMode(id, body.agentPermissionMode);
         }
-        if (body.status) {
+        if (body.status !== undefined) {
+            if (!isWorkspaceStatus(body.status)) {
+                return c.json({ error: `Invalid status. Must be one of: ${VALID_WORKSPACE_STATUSES.join(', ')}` }, 400);
+            }
             if (body.status === 'idle' && agentManager.hasController(id)) {
                 return c.json({ error: 'Cannot mark an active agent workspace idle; end or stop the agent session first' }, 409);
             }
-            updated = workspaceService.updateWorkspaceStatus(id, body.status);
         }
-        if (body.name !== undefined) {
-            updated = workspaceService.updateWorkspaceName(id, body.name);
+        if (body.name !== undefined && typeof body.name !== 'string') {
+            return c.json({ error: 'name must be a string' }, 400);
         }
         if ('description' in body) {
             const desc = body.description;
             if (desc !== null && typeof desc !== 'string') {
                 return c.json({ error: 'description must be a string or null' }, 400);
             }
-            updated = workspaceService.updateWorkspaceDescription(id, desc);
         }
-        if (!body.status &&
+        if (body.status === undefined &&
             body.model === undefined &&
             body.reasoningEffort === undefined &&
             body.agentPermissionMode === undefined &&
@@ -2074,7 +2087,7 @@ app.patch('/:id', migrationGuard, async (c) => {
             !('description' in body)) {
             return c.json({ error: 'Missing field: status, model, reasoningEffort, agentPermissionMode, name, or description' }, 400);
         }
-        return c.json(updated);
+        return c.json(workspaceService.updateWorkspaceFields(id, body));
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -2270,7 +2283,7 @@ app.post('/:id/run-setup-script', async (c) => {
     }
 });
 // POST /api/workspaces/:id/archive — mark workspace as archived (soft-delete)
-app.post('/:id/archive', migrationGuard, (c) => {
+app.post('/:id/archive', migrationGuard, async (c) => {
     try {
         const id = c.req.param('id');
         const workspace = workspaceService.getWorkspace(id);
@@ -2287,7 +2300,7 @@ app.post('/:id/archive', migrationGuard, (c) => {
             // Agent may not be running — ignore
         }
         try {
-            devServerService.stopDevServer(id);
+            await devServerService.stopDevServer(id);
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
@@ -2362,7 +2375,7 @@ app.post('/:id/unarchive', migrationGuard, (c) => {
 // Every side-effect is best-effort — failures are collected as warnings
 // rather than thrown, so a bulk delete never aborts mid-batch. Returns the
 // list of user-facing warning messages (empty when everything was clean).
-function deleteWorkspaceWithSideEffects(workspace, opts) {
+async function deleteWorkspaceWithSideEffects(workspace, opts) {
     // Stop agent if running (best-effort)
     try {
         agentManager.stopAgent(workspace.id);
@@ -2373,7 +2386,7 @@ function deleteWorkspaceWithSideEffects(workspace, opts) {
     // Stop dev server if it was running. The processSpawn would otherwise
     // outlive the workspace (and keep its port + docker containers alive).
     try {
-        devServerService.stopDevServer(workspace.id);
+        await devServerService.stopDevServer(workspace.id);
     }
     catch (err) {
         console.error(`[workspaces] stopDevServer during delete failed for '${workspace.name}':`, err);
@@ -2457,7 +2470,7 @@ app.delete('/archived', migrationGuard, async (c) => {
         let deleted = 0;
         for (const workspace of archived) {
             try {
-                warnings.push(...deleteWorkspaceWithSideEffects(workspace, body));
+                warnings.push(...(await deleteWorkspaceWithSideEffects(workspace, body)));
                 deleted++;
             }
             catch (err) {
@@ -2485,7 +2498,7 @@ app.delete('/:id', migrationGuard, async (c) => {
         const body = await c.req
             .json()
             .catch(() => ({}));
-        const warnings = deleteWorkspaceWithSideEffects(workspace, body);
+        const warnings = await deleteWorkspaceWithSideEffects(workspace, body);
         // When everything worked cleanly we keep the legacy 204 response so
         // existing clients aren't surprised by a JSON body. Warnings promote the
         // response to 200 so the body is readable.
@@ -2507,6 +2520,10 @@ app.post('/:id/start', migrationGuard, async (c) => {
         if (!workspace) {
             return c.json({ error: `Workspace '${id}' not found` }, 404);
         }
+        if (workspace.archivedAt)
+            return c.json({ error: `Workspace '${id}' is archived` }, 409);
+        if (workspace.worktreePurgedAt)
+            return c.json({ error: `Workspace '${id}' worktree is purged` }, 409);
         // If the workspace declares an engine, ensure it is still registered.
         // Otherwise startAgent() would throw from deep inside resolveEngine and
         // surface as an opaque 500 — better to fail fast with a clear 400.
@@ -3300,7 +3317,7 @@ app.post('/:id/merge-pr', async (c) => {
             }, 409);
         }
         const snapshot = await provider.getPrStatus(workspace.worktreePath, workspace.workingBranch);
-        if (!snapshot || snapshot.state !== 'OPEN') {
+        if (snapshot?.state !== 'OPEN') {
             return c.json({ error: 'No open PR found for this workspace', code: 'pr_not_open' }, 409);
         }
         if (!snapshot.readyToMerge) {
@@ -3654,7 +3671,7 @@ app.post('/:id/start-ci-fix', migrationGuard, async (c) => {
         if (!snapshot) {
             snapshot = getAllPrSnapshots()[id] ?? null;
         }
-        if (!snapshot || snapshot.state !== 'OPEN' || snapshot.ci.rollup !== 'FAILURE') {
+        if (snapshot?.state !== 'OPEN' || snapshot.ci.rollup !== 'FAILURE') {
             return c.json({ error: 'No failing CI detected on this workspace' }, 400);
         }
         const effective = settingsService.getEffectiveSettings(workspace.projectPath);

package/dist/server/services/agent/orchestrator.js

@@ -847,6 +847,13 @@ function onSessionEnded(workspaceId, agentSessionId, sourceController, exitCode,
  * query the controller via `_getControllers()` for tests.
  */
 export function startAgent(workspaceId, workingDir, prompt, model, resume = false, agentPermissionMode, existingSessionId, reasoningEffort) {
+    const workspace = getWs(workspaceId);
+    if (!workspace)
+        throw new Error(`Workspace '${workspaceId}' not found`);
+    if (workspace.archivedAt)
+        throw new Error(`Workspace '${workspaceId}' is archived`);
+    if (workspace.worktreePurgedAt)
+        throw new Error(`Workspace '${workspaceId}' worktree is purged`);
     // "For this turn" never survives a new agent session.
     permissionPolicyService.clearTurnPermissions(workspaceId);
     // Zombie detection: an SDK iterator hung on a never-resolved canUseTool
@@ -1317,7 +1324,7 @@ export function _getPendingDeferred() {
     const out = new Map();
     for (const [wid, arr] of pendingQueue) {
         const head = arr[0];
-        if (!head || head.kind !== 'question')
+        if (head?.kind !== 'question')
             continue;
         out.set(wid, {
             toolCallId: head.toolCallId,

package/dist/server/services/auto-loop-service.js

@@ -78,7 +78,7 @@ export function enable(workspaceId) {
  */
 export function disable(workspaceId, reason) {
     const row = getRow(workspaceId);
-    if (!row || row.auto_loop !== 1)
+    if (row?.auto_loop !== 1)
         return;
     const db = getDb();
     db.prepare('UPDATE workspaces SET auto_loop = 0 WHERE id = ?').run(workspaceId);

package/dist/server/services/dev-server-service.js

@@ -1,4 +1,4 @@
-import { execSync, spawn } from 'node:child_process';
+import { execFile, spawn } from 'node:child_process';
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 import { getProjectSettings } from './settings-service.js';
@@ -10,6 +10,16 @@ function cleanEnv() {
     const { PORT, SERVER_PORT, ...rest } = process.env;
     return rest;
 }
+function runCommand(command, args, options = {}) {
+    return new Promise((resolve, reject) => {
+        execFile(command, args, { ...options, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 }, (err, stdout) => {
+            if (err)
+                reject(err);
+            else
+                resolve(stdout);
+        });
+    });
+}
 // ── State ──────────────────────────────────────────────────────────────────────
 /** workspaceId -> spawned dev-server process */
 const trackedProcesses = new Map();
@@ -61,28 +71,32 @@ export function resolveInstance(projectPath, workingBranch) {
     for (const file of files) {
         const content = readFileSync(path.join(instancesDir, file), 'utf-8');
         const parsed = parseEnvFile(content);
-        if (parsed.INSTANCE_NAME && parsed.INSTANCE_NAME.toLowerCase() === sanitized) {
+        if (parsed.INSTANCE_NAME &&
+            parsed.INSTANCE_NAME.toLowerCase() === sanitized &&
+            parsed.PROJECT_NAME &&
+            /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(parsed.PROJECT_NAME)) {
             return {
                 instanceName: parsed.INSTANCE_NAME,
-                projectName: parsed.PROJECT_NAME ?? '',
+                projectName: parsed.PROJECT_NAME,
                 httpPort: parsed.HTTP_PORT ?? '',
             };
         }
     }
     return null;
 }
+function containerBelongsToProject(containerName, projectName) {
+    const name = containerName.toLowerCase();
+    const project = projectName.toLowerCase();
+    return name === project || name.startsWith(`${project}-`) || name.startsWith(`${project}_`);
+}
 // ── Docker helpers ─────────────────────────────────────────────────────────────
 /**
  * List all running Docker container names.
- * Note: uses execSync with shell because docker ps --format requires
- * Go template syntax with `{{}}`. Input is a static string, no injection risk.
+ * Uses execFile so Docker inspection cannot block the Node event loop.
  */
-export function listRunningContainers() {
+export async function listRunningContainers() {
     try {
-        const output = execSync('docker ps --format "{{.Names}}"', {
-            encoding: 'utf-8',
-            timeout: 10000,
-        });
+        const output = await runCommand('docker', ['ps', '--format', '{{.Names}}'], { timeout: 10_000 });
         return output
             .split('\n')
             .map((s) => s.trim())
@@ -102,7 +116,7 @@ export function listRunningContainers() {
  * in `docker ps` yet. This prevents the UI from flashing to `'stopped'` during
  * long build phases.
  */
-export function getStatus(projectPath, workingBranch, workspaceId) {
+export async function getStatus(projectPath, workingBranch, workspaceId) {
     const config = resolveInstance(projectPath, workingBranch);
     if (!config) {
         return {
@@ -114,8 +128,8 @@ export function getStatus(projectPath, workingBranch, workspaceId) {
             containers: [],
         };
     }
-    const running = listRunningContainers();
-    const matching = running.filter((name) => name.toLowerCase().includes(config.projectName.toLowerCase()));
+    const running = await listRunningContainers();
+    const matching = running.filter((name) => containerBelongsToProject(name, config.projectName));
     if (matching.length > 0) {
         return {
             status: 'running',
@@ -192,9 +206,14 @@ export function startDevServer(workspaceId) {
     });
     proc.on('exit', (code) => {
         trackedProcesses.delete(workspaceId);
-        const currentStatus = getStatus(workspace.projectPath, workspace.workingBranch);
-        updateDevServerStatus(workspaceId, currentStatus.status);
-        emitEphemeral(workspaceId, 'devserver:status', currentStatus);
+        void getStatus(workspace.projectPath, workspace.workingBranch)
+            .then((currentStatus) => {
+            updateDevServerStatus(workspaceId, currentStatus.status);
+            emitEphemeral(workspaceId, 'devserver:status', currentStatus);
+        })
+            .catch((err) => {
+            console.error(`[dev-server] Failed to refresh status for workspace ${workspaceId}:`, err);
+        });
         if (code !== 0) {
             console.error(`[dev-server] Process exited with code ${code} for workspace ${workspaceId}`);
         }
@@ -229,7 +248,7 @@ export function startDevServer(workspaceId) {
 /**
  * Stop the dev-server for a workspace.
  */
-export function stopDevServer(workspaceId) {
+export async function stopDevServer(workspaceId) {
     const workspace = getWorkspace(workspaceId);
     if (!workspace) {
         throw new Error(`Workspace '${workspaceId}' not found`);
@@ -256,18 +275,15 @@ export function stopDevServer(workspaceId) {
     }
     const settings = getProjectSettings(workspace.projectPath);
     if (settings?.devServer.stopCommand) {
-        // Custom stop script — run synchronously with instance context in env
         try {
-            execSync(settings.devServer.stopCommand, {
+            await runCommand('bash', ['-c', settings.devServer.stopCommand], {
                 cwd,
                 env: {
                     ...cleanEnv(),
                     INSTANCE: instanceName,
                     PROJECT_NAME: config?.projectName ?? '',
                 },
-                encoding: 'utf-8',
-                timeout: 30000,
-                shell: 'bash',
+                timeout: 30_000,
             });
         }
         catch (err) {
@@ -278,11 +294,7 @@ export function stopDevServer(workspaceId) {
     // (handles cases where custom stop command doesn't use -p flag)
     if (config?.projectName) {
         try {
-            execSync(`docker compose -p "${config.projectName}" down`, {
-                cwd: cwd,
-                encoding: 'utf-8',
-                timeout: 30000,
-            });
+            await runCommand('docker', ['compose', '-p', config.projectName, 'down'], { cwd, timeout: 30_000 });
         }
         catch {
             // May already be stopped by the custom command — ignore
@@ -303,10 +315,9 @@ export function stopDevServer(workspaceId) {
 // ── Logs ───────────────────────────────────────────────────────────────────────
 /**
  * Get logs from running dev-server containers for a workspace.
- * Note: uses execSync for `docker logs` — container names come from
- * `docker ps` output (not user input), so no injection risk.
+ * Docker log reads run concurrently without blocking the Node event loop.
  */
-export function getDevServerLogs(workspaceId, tail = 200) {
+export async function getDevServerLogs(workspaceId, tail = 200) {
     const workspace = getWorkspace(workspaceId);
     if (!workspace) {
         return 'Workspace not found';
@@ -315,24 +326,20 @@ export function getDevServerLogs(workspaceId, tail = 200) {
     if (!config) {
         return 'No dev-server instance found';
     }
-    const running = listRunningContainers();
-    const matching = running.filter((name) => name.toLowerCase().includes(config.projectName.toLowerCase()));
+    const running = await listRunningContainers();
+    const matching = running.filter((name) => containerBelongsToProject(name, config.projectName));
     if (matching.length === 0) {
         return 'No running containers found';
     }
-    const outputs = [];
-    for (const container of matching) {
+    const outputs = await Promise.all(matching.map(async (container) => {
         try {
-            const logs = execSync(`docker logs --tail ${tail} ${container}`, {
-                encoding: 'utf-8',
-                timeout: 10000,
-            });
-            outputs.push(`=== ${container} ===\n${logs}`);
+            const logs = await runCommand('docker', ['logs', '--tail', String(tail), container], { timeout: 10_000 });
+            return `=== ${container} ===\n${logs}`;
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
-            outputs.push(`=== ${container} ===\n[Error fetching logs: ${message}]`);
+            return `=== ${container} ===\n[Error fetching logs: ${message}]`;
         }
-    }
+    }));
     return outputs.join('\n\n');
 }

package/dist/server/services/forge/bitbucket/provider.js

@@ -144,12 +144,13 @@ function bktEnv() {
     return process.env;
 }
 function bktOptions(repoPath) {
-    return { cwd: repoPath, encoding: 'utf-8', env: bktEnv() };
+    return { cwd: repoPath, encoding: 'utf-8', env: bktEnv(), timeout: 30_000 };
 }
 async function resolveTarget(repoPath) {
     const { stdout } = await execFileAsync('git', ['remote', 'get-url', 'origin'], {
         cwd: repoPath,
         encoding: 'utf-8',
+        timeout: 30_000,
     });
     const target = parseBitbucketRemote(stdout);
     if (!target)
@@ -158,27 +159,21 @@ async function resolveTarget(repoPath) {
     // keyring and context access, which cannot prompt from the Kobo server.
     if (bktEnv().BKT_TOKEN)
         return { ...target, context: null };
-    const { stdout: contextOutput } = await execFileAsync('bkt', ['context', 'list', '--json'], {
-        cwd: repoPath,
-        encoding: 'utf-8',
-    });
+    const { stdout: contextOutput } = await execFileAsync('bkt', ['context', 'list', '--json'], bktOptions(repoPath));
     const contexts = record(JSON.parse(contextOutput)).contexts;
     const existing = (Array.isArray(contexts) ? contexts : [])
         .map(record)
         .find((context) => string(context.workspace) === target.workspace && string(context.default_repo) === target.repo);
     if (existing && string(existing.name))
         return { ...target, context: string(existing.name) };
-    const { stdout: authOutput } = await execFileAsync('bkt', ['auth', 'status', '--json'], {
-        cwd: repoPath,
-        encoding: 'utf-8',
-    });
+    const { stdout: authOutput } = await execFileAsync('bkt', ['auth', 'status', '--json'], bktOptions(repoPath));
     const hosts = record(JSON.parse(authOutput)).hosts;
     const host = (Array.isArray(hosts) ? hosts : []).map(record).find((item) => string(item.kind) === 'cloud');
     const hostKey = string(host?.key);
     if (!hostKey)
         throw new Error('No authenticated Bitbucket Cloud host found; run bkt auth login first');
     const context = contextName(target.workspace, target.repo);
-    await execFileAsync('bkt', ['context', 'create', context, '--host', hostKey, '--workspace', target.workspace, '--repo', target.repo], { cwd: repoPath, encoding: 'utf-8' });
+    await execFileAsync('bkt', ['context', 'create', context, '--host', hostKey, '--workspace', target.workspace, '--repo', target.repo], bktOptions(repoPath));
     return { ...target, context };
 }
 function targetArgs(target) {
@@ -286,6 +281,6 @@ export const bitbucketProvider = {
         await execFileAsync('bkt', bktArgs(target, ['pr', 'merge', String(number), '--close-source=false', ...targetArgs(target)]), bktOptions(repoPath));
     },
     async deleteRemoteBranch(repoPath, branchName) {
-        await execFileAsync('git', ['push', 'origin', '--delete', branchName], { cwd: repoPath, encoding: 'utf-8' });
+        await execFileAsync('git', ['push', 'origin', '--delete', branchName], bktOptions(repoPath));
     },
 };

package/dist/server/services/forge/github/provider.js

@@ -3,6 +3,10 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { deriveReadyToMerge } from '../types.js';
 const execFileAsync = promisify(execFile);
+const CLI_TIMEOUT_MS = 30_000;
+function cliOptions(repoPath) {
+    return { cwd: repoPath, encoding: 'utf-8', timeout: CLI_TIMEOUT_MS };
+}
 // NOTE: `reviewThreads` is intentionally NOT in this list.
 // `gh pr view --json reviewThreads` is rejected with `Unknown JSON field`
 // — there is no stable `gh` version that exposes it. Until upstream adds it,
@@ -101,7 +105,7 @@ export const githubProvider = {
     },
     async isAvailable(repoPath) {
         try {
-            await execFileAsync('gh', ['auth', 'status'], { cwd: repoPath, encoding: 'utf-8' });
+            await execFileAsync('gh', ['auth', 'status'], cliOptions(repoPath));
             return { available: true };
         }
         catch (err) {
@@ -110,10 +114,7 @@ export const githubProvider = {
     },
     async getPrStatus(repoPath, branch) {
         try {
-            const { stdout } = await execFileAsync('gh', ['pr', 'view', branch, '--json', GH_PR_FIELDS], {
-                cwd: repoPath,
-                encoding: 'utf-8',
-            });
+            const { stdout } = await execFileAsync('gh', ['pr', 'view', branch, '--json', GH_PR_FIELDS], cliOptions(repoPath));
             const raw = stdout.trim();
             if (!raw)
                 return null;
@@ -124,19 +125,19 @@ export const githubProvider = {
         }
     },
     async createPr(repoPath, opts) {
-        const { stdout } = await execFileAsync('gh', ['pr', 'create', '--base', opts.base, '--head', opts.head, '--title', opts.title, '--body', opts.body], { cwd: repoPath, encoding: 'utf-8' });
+        const { stdout } = await execFileAsync('gh', ['pr', 'create', '--base', opts.base, '--head', opts.head, '--title', opts.title, '--body', opts.body], cliOptions(repoPath));
         const match = stdout.match(/https:\/\/github\.com\/[^\s]+\/pull\/(\d+)/);
         if (!match)
             throw new Error('Could not parse PR URL from gh output');
         return { url: match[0], number: Number.parseInt(match[1], 10) };
     },
     async changePrBase(repoPath, base) {
-        await execFileAsync('gh', ['pr', 'edit', '--base', base], { cwd: repoPath, encoding: 'utf-8' });
+        await execFileAsync('gh', ['pr', 'edit', '--base', base], cliOptions(repoPath));
     },
     async mergeRequest(repoPath, number) {
-        await execFileAsync('gh', ['pr', 'merge', String(number), '--merge'], { cwd: repoPath, encoding: 'utf-8' });
+        await execFileAsync('gh', ['pr', 'merge', String(number), '--merge'], cliOptions(repoPath));
     },
     async deleteRemoteBranch(repoPath, branch) {
-        await execFileAsync('git', ['push', 'origin', '--delete', branch], { cwd: repoPath, encoding: 'utf-8' });
+        await execFileAsync('git', ['push', 'origin', '--delete', branch], cliOptions(repoPath));
     },
 };