@mnemonik/cli 7.111.10 → 7.112.3

package/dist/runtime/releaseSource.js

@@ -501,6 +501,13 @@ var require_ignore = __commonJS({
   }
 });
 
+// packages/shared/dist/hookTimeouts.js
+var init_hookTimeouts = __esm({
+  "packages/shared/dist/hookTimeouts.js"() {
+    "use strict";
+  }
+});
+
 // packages/shared/dist/runtimeSigners.js
 import { basename, dirname as dirname2, join as join2, resolve, sep, win32 } from "node:path";
 import { createHash, createPublicKey, randomUUID, timingSafeEqual, verify as verifySignature } from "node:crypto";
@@ -648,11 +655,37 @@ var init_runtimeReader = __esm({
 });
 
 // packages/shared/dist/projectSetupHandoff.js
+var PROJECT_ENSURE_TIMEOUT_MS, SUPERVISOR, RUN_STALE_MS;
 var init_projectSetupHandoff = __esm({
   "packages/shared/dist/projectSetupHandoff.js"() {
     "use strict";
     init_runtimeSigners();
+    init_hookTimeouts();
     init_runtimeReader();
+    PROJECT_ENSURE_TIMEOUT_MS = 3e4;
+    SUPERVISOR = `
+const { execFile } = require('node:child_process');
+const { writeFileSync, renameSync } = require('node:fs');
+const [out, bin, ...args] = process.argv.slice(1);
+let input = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (chunk) => (input += chunk));
+process.stdin.on('end', () => {
+  const child = execFile(
+    process.execPath,
+    [bin, ...args],
+    { shell: false, timeout: ${PROJECT_ENSURE_TIMEOUT_MS}, killSignal: 'SIGKILL', maxBuffer: 64 * 1024, env: process.env },
+    (error, stdout) => {
+      const result = { code: error ? (typeof error.code === 'number' ? error.code : null) : 0, killed: !!(error && error.killed), stdout: String(stdout) };
+      writeFileSync(out + '.tmp', JSON.stringify(result), { mode: 0o600 });
+      renameSync(out + '.tmp', out);
+    }
+  );
+  child.stdin.on('error', () => {});
+  child.stdin.end(input);
+});
+`;
+    RUN_STALE_MS = PROJECT_ENSURE_TIMEOUT_MS + 1e4;
   }
 });
 
@@ -661,6 +694,7 @@ var init_hookRuntime = __esm({
   "packages/shared/dist/hookRuntime.js"() {
     "use strict";
     init_runtimeSigners();
+    init_hookTimeouts();
     init_repositoryRoot();
     init_runtimeReader();
     init_runtimeSigners();
@@ -2262,7 +2296,7 @@ Project work items live in tasks. A pending list requires action:"list" and stat
 
 Which tool for what:
 - memory_get: hydrates exact originals by id.
-- memory_add: saves a discrete decision or root cause.
+- memory_add: saves a decision, a user's preference, or a root cause.
 - memory_state: corrects wrong, outdated, or conflicting memory.
 - memory_info: explains confidence or origin when memory looks suspect.
 - memory_links: connects related decisions so they surface together.
@@ -2271,7 +2305,8 @@ Which tool for what:
 - policy: stores durable enforced rules or preferences, not memories.
 - tasks: creates follow-up work and closes completed work.
 - code_search: finds conceptual code when source wording differs.
-- memory_search: finds rationale, intent, decisions, and prior work.`;
+- memory_search: finds rationale, intent, decisions, and prior work.
+- memory_ingest: brings the project's docs and code comments into memory when asked.`;
 function getMcpInstructions() {
   const process2 = globalThis.process;
   if (!process2?.env) {
@@ -6433,6 +6468,9 @@ var DEFAULT_OPTIONS = {
 };
 var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
+// packages/shared/dist/index.js
+init_hookTimeouts();
+
 // packages/shared/dist/jitDeliveryAck.js
 init_runtimeSigners();
 

package/dist/runtime/selfUpdate.js

@@ -501,6 +501,13 @@ var require_ignore = __commonJS({
   }
 });
 
+// packages/shared/dist/hookTimeouts.js
+var init_hookTimeouts = __esm({
+  "packages/shared/dist/hookTimeouts.js"() {
+    "use strict";
+  }
+});
+
 // packages/shared/dist/runtimeSigners.js
 import { basename, dirname as dirname2, join as join2, resolve, sep, win32 } from "node:path";
 import { execFile, execFileSync } from "node:child_process";
@@ -618,11 +625,37 @@ var init_runtimeReader = __esm({
 });
 
 // packages/shared/dist/projectSetupHandoff.js
+var PROJECT_ENSURE_TIMEOUT_MS, SUPERVISOR, RUN_STALE_MS;
 var init_projectSetupHandoff = __esm({
   "packages/shared/dist/projectSetupHandoff.js"() {
     "use strict";
     init_runtimeSigners();
+    init_hookTimeouts();
     init_runtimeReader();
+    PROJECT_ENSURE_TIMEOUT_MS = 3e4;
+    SUPERVISOR = `
+const { execFile } = require('node:child_process');
+const { writeFileSync, renameSync } = require('node:fs');
+const [out, bin, ...args] = process.argv.slice(1);
+let input = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (chunk) => (input += chunk));
+process.stdin.on('end', () => {
+  const child = execFile(
+    process.execPath,
+    [bin, ...args],
+    { shell: false, timeout: ${PROJECT_ENSURE_TIMEOUT_MS}, killSignal: 'SIGKILL', maxBuffer: 64 * 1024, env: process.env },
+    (error, stdout) => {
+      const result = { code: error ? (typeof error.code === 'number' ? error.code : null) : 0, killed: !!(error && error.killed), stdout: String(stdout) };
+      writeFileSync(out + '.tmp', JSON.stringify(result), { mode: 0o600 });
+      renameSync(out + '.tmp', out);
+    }
+  );
+  child.stdin.on('error', () => {});
+  child.stdin.end(input);
+});
+`;
+    RUN_STALE_MS = PROJECT_ENSURE_TIMEOUT_MS + 1e4;
   }
 });
 
@@ -631,6 +664,7 @@ var init_hookRuntime = __esm({
   "packages/shared/dist/hookRuntime.js"() {
     "use strict";
     init_runtimeSigners();
+    init_hookTimeouts();
     init_repositoryRoot();
     init_runtimeReader();
     init_runtimeSigners();
@@ -2231,7 +2265,7 @@ Project work items live in tasks. A pending list requires action:"list" and stat
 
 Which tool for what:
 - memory_get: hydrates exact originals by id.
-- memory_add: saves a discrete decision or root cause.
+- memory_add: saves a decision, a user's preference, or a root cause.
 - memory_state: corrects wrong, outdated, or conflicting memory.
 - memory_info: explains confidence or origin when memory looks suspect.
 - memory_links: connects related decisions so they surface together.
@@ -2240,7 +2274,8 @@ Which tool for what:
 - policy: stores durable enforced rules or preferences, not memories.
 - tasks: creates follow-up work and closes completed work.
 - code_search: finds conceptual code when source wording differs.
-- memory_search: finds rationale, intent, decisions, and prior work.`;
+- memory_search: finds rationale, intent, decisions, and prior work.
+- memory_ingest: brings the project's docs and code comments into memory when asked.`;
 function getMcpInstructions() {
   const process2 = globalThis.process;
   if (!process2?.env) {
@@ -6402,6 +6437,9 @@ var DEFAULT_OPTIONS = {
 };
 var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
+// packages/shared/dist/index.js
+init_hookTimeouts();
+
 // packages/shared/dist/jitDeliveryAck.js
 init_runtimeSigners();
 

package/dist/runtime/signers.js

@@ -519,6 +519,26 @@ var init_runtimeSigners = __esm({
   }
 });
 
+// packages/shared/dist/hookTimeouts.js
+function hookDeadlineMs(host) {
+  return HOST_HOOK_TIMEOUT_MS[host] - HOOK_TIMEOUT_MARGIN_MS - HOOK_STDIN_TIMEOUT_MS;
+}
+var HOST_HOOK_TIMEOUT_MS, HOOK_TIMEOUT_MARGIN_MS, HOOK_STDIN_TIMEOUT_MS;
+var init_hookTimeouts = __esm({
+  "packages/shared/dist/hookTimeouts.js"() {
+    "use strict";
+    HOST_HOOK_TIMEOUT_MS = {
+      claude_code: 5e3,
+      copilot: 5e3,
+      codex: 5e3,
+      grok: 5e3,
+      cursor: 3e4
+    };
+    HOOK_TIMEOUT_MARGIN_MS = 500;
+    HOOK_STDIN_TIMEOUT_MS = 500;
+  }
+});
+
 // packages/shared/dist/projectIdentityFile.js
 import { lstat, readFile as readFile2 } from "node:fs/promises";
 import { join as join2 } from "node:path";
@@ -585,7 +605,7 @@ async function readIdentityFile(dir, options = {}) {
     if (options.selectedRoot) {
       try {
         const value = JSON.parse(text);
-        if (value && typeof value === "object" && !Array.isArray(value) && !("projectId" in value))
+        if (value && typeof value === "object" && !Array.isArray(value) && !("projectId" in value) && (!("schemaVersion" in value) || value.schemaVersion === 1))
           return { kind: "absent" };
       } catch {
       }
@@ -1191,11 +1211,12 @@ var init_runtimeReader = __esm({
 });
 
 // packages/shared/dist/projectSetupHandoff.js
-import { execFile as execFile3 } from "node:child_process";
+import { spawn } from "node:child_process";
 import { constants as constants2 } from "node:fs";
 import { lstat as lstat4, mkdir, open as open2, readdir as readdir2, realpath, rename, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { dirname as dirname4, join as join5, relative } from "node:path";
+import { basename as basename2, dirname as dirname4, join as join5, relative } from "node:path";
+import { performance as performance2 } from "node:perf_hooks";
 import { randomUUID as randomUUID2 } from "node:crypto";
 function projectSetupActions(value) {
   return Array.isArray(value) ? value.slice(0, 20).map(words).join(", ") : "retry, cancel";
@@ -1260,6 +1281,115 @@ async function writeDiagnostic(path, value) {
     await rm(temp, { force: true });
   }
 }
+async function readResult(path) {
+  let raw;
+  try {
+    raw = await readPrivate(path);
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return void 0;
+    throw error;
+  }
+  const result = JSON.parse(raw);
+  if (result.killed || result.code !== 0 && result.code !== 3)
+    throw new Error("helper_failed");
+  try {
+    return JSON.parse(String(result.stdout));
+  } catch {
+    throw new Error("helper_invalid_json");
+  }
+}
+async function waitForResult(path, waitMs) {
+  const deadline = Date.now() + waitMs;
+  for (; ; ) {
+    const result = await readResult(path);
+    if (result !== void 0)
+      return result;
+    if (Date.now() >= deadline)
+      return RUNNING;
+    await new Promise((resolve4) => setTimeout(resolve4, Math.min(50, deadline - Date.now())));
+  }
+}
+async function runEnsure(options) {
+  await privateDirectory(dirname4(options.directory), options.directory);
+  await privateDirectory(options.directory, options.directory);
+  const runFile = join5(options.directory, "project-setup-run.json");
+  let previous;
+  try {
+    previous = JSON.parse(await readPrivate(runFile));
+  } catch {
+    previous = void 0;
+  }
+  if (previous && previous.root === options.root && typeof previous.result === "string") {
+    const result2 = join5(options.directory, basename2(previous.result));
+    const finished = await readResult(result2).catch(() => ({ status: "failed" }));
+    if (finished === void 0 && Date.now() - previous.startedAt < RUN_STALE_MS) {
+      const outcome2 = await waitForResult(result2, options.waitMs);
+      if (outcome2 !== RUNNING)
+        await rm(runFile, { force: true });
+      return outcome2;
+    }
+    await rm(runFile, { force: true });
+    await rm(result2, { force: true });
+    if (record(finished) && finished.status === "done")
+      return finished;
+  }
+  const result = join5(options.directory, `project-setup-${randomUUID2()}.result.json`);
+  const run = {
+    requestId: options.requestId,
+    root: options.root,
+    result: basename2(result),
+    startedAt: Date.now()
+  };
+  await writeFileAtomic(runFile, JSON.stringify(run));
+  const child = spawn(process.execPath, ["-e", SUPERVISOR, result, options.bin, "project", "ensure", "--agent", "--json"], {
+    cwd: options.root,
+    shell: false,
+    detached: true,
+    windowsHide: true,
+    stdio: ["pipe", "ignore", "ignore"],
+    // Runtime injection variables and repository/PATH executables are not inherited.
+    env: Object.fromEntries([
+      "HOME",
+      "USERPROFILE",
+      "LOCALAPPDATA",
+      "XDG_STATE_HOME",
+      "MNEMONIK_STATE_DIR",
+      "MNEMONIK_SERVER",
+      "MNEMONIK_API_RESOURCE",
+      "MNEMONIK_OAUTH_ISSUER",
+      "SYSTEMROOT",
+      "TEMP",
+      "TMP",
+      "TMPDIR"
+    ].flatMap((key) => process.env[key] === void 0 ? [] : [[key, process.env[key]]]))
+  });
+  const spawnFailed = new Promise((_, reject2) => child.once("error", () => reject2(new Error("helper_failed"))));
+  child.stdin?.on("error", () => {
+  });
+  child.stdin?.end(JSON.stringify({ requestId: options.requestId }));
+  child.unref();
+  const outcome = await Promise.race([waitForResult(result, options.waitMs), spawnFailed]);
+  if (outcome !== RUNNING) {
+    await rm(runFile, { force: true });
+    await rm(result, { force: true });
+  }
+  return outcome;
+}
+async function writeFileAtomic(path, data) {
+  const temp = `${path}.${randomUUID2()}`;
+  try {
+    const file = await open2(temp, "wx", 384);
+    try {
+      await file.writeFile(data);
+    } finally {
+      await file.close();
+    }
+    await rename(temp, path);
+  } finally {
+    await rm(temp, { force: true });
+  }
+}
 async function handoffProjectSetup(input) {
   const response = setupResponse(input.response);
   if (!response)
@@ -1289,41 +1419,17 @@ async function handoffProjectSetup(input) {
     const bin = join5(dirname4(runtime.entry), "bin.js");
     if (!runtime.manifest.files[relative(runtime.directory, bin).replaceAll("\\", "/")])
       throw new Error("verified_cli_bin_missing");
-    const result = await new Promise((resolve4, reject2) => {
-      const child = execFile3(process.execPath, [bin, "project", "ensure", "--agent", "--json"], {
-        cwd: root,
-        shell: false,
-        timeout: 3e4,
-        killSignal: "SIGKILL",
-        maxBuffer: 64 * 1024,
-        // Runtime injection variables and repository/PATH executables are not inherited.
-        env: Object.fromEntries([
-          "HOME",
-          "USERPROFILE",
-          "LOCALAPPDATA",
-          "XDG_STATE_HOME",
-          "MNEMONIK_STATE_DIR",
-          "MNEMONIK_SERVER",
-          "MNEMONIK_API_RESOURCE",
-          "MNEMONIK_OAUTH_ISSUER",
-          "SYSTEMROOT",
-          "TEMP",
-          "TMP",
-          "TMPDIR"
-        ].flatMap((key) => process.env[key] === void 0 ? [] : [[key, process.env[key]]]))
-      }, (error, stdout2) => {
-        if (error && (error.killed || error.code !== 3))
-          return reject2(new Error("helper_failed"));
-        try {
-          resolve4(JSON.parse(stdout2));
-        } catch {
-          reject2(new Error("helper_invalid_json"));
-        }
-      });
-      child.stdin?.on("error", () => {
-      });
-      child.stdin?.end(JSON.stringify({ requestId }));
+    const result = await runEnsure({
+      bin,
+      root,
+      requestId,
+      directory: dirname4(input.stateFile),
+      waitMs: input.waitMs ?? Math.max(0, hookDeadlineMs(input.host) - performance2.now())
     });
+    if (result === RUNNING) {
+      return PROJECT_SETUP_RUNNING;
+    }
+    (await Promise.resolve().then(() => (init_hookRuntime(), hookRuntime_exports))).clearProjectIdentityCache();
     if (!record(result))
       throw new Error("helper_invalid_json");
     if (result.status === "done") {
@@ -1384,15 +1490,42 @@ async function pendingProjectSetup(root) {
   results.sort((a, b) => Date.parse(b.time) - Date.parse(a.time));
   return results[0]?.outcome === "done" ? [] : results.slice(0, 1);
 }
-var PROJECT_SETUP_MANUAL, words, record;
+var PROJECT_SETUP_MANUAL, words, record, PROJECT_SETUP_RUNNING, PROJECT_ENSURE_TIMEOUT_MS, RUNNING, SUPERVISOR, RUN_STALE_MS;
 var init_projectSetupHandoff = __esm({
   "packages/shared/dist/projectSetupHandoff.js"() {
     "use strict";
     init_runtimeSigners();
+    init_hookTimeouts();
     init_runtimeReader();
     PROJECT_SETUP_MANUAL = "Mnemonik project setup needs attention; ask the person to run `mnemonik project init` in this folder.";
     words = (value) => typeof value === "string" && /^[a-z][a-z0-9_]{0,79}$/.test(value) ? value.replaceAll("_", " ") : "needs attention";
     record = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+    PROJECT_SETUP_RUNNING = "Mnemonik project setup is still running; call session_bootstrap again in a few seconds.";
+    PROJECT_ENSURE_TIMEOUT_MS = 3e4;
+    RUNNING = /* @__PURE__ */ Symbol("running");
+    SUPERVISOR = `
+const { execFile } = require('node:child_process');
+const { writeFileSync, renameSync } = require('node:fs');
+const [out, bin, ...args] = process.argv.slice(1);
+let input = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (chunk) => (input += chunk));
+process.stdin.on('end', () => {
+  const child = execFile(
+    process.execPath,
+    [bin, ...args],
+    { shell: false, timeout: ${PROJECT_ENSURE_TIMEOUT_MS}, killSignal: 'SIGKILL', maxBuffer: 64 * 1024, env: process.env },
+    (error, stdout) => {
+      const result = { code: error ? (typeof error.code === 'number' ? error.code : null) : 0, killed: !!(error && error.killed), stdout: String(stdout) };
+      writeFileSync(out + '.tmp', JSON.stringify(result), { mode: 0o600 });
+      renameSync(out + '.tmp', out);
+    }
+  );
+  child.stdin.on('error', () => {});
+  child.stdin.end(input);
+});
+`;
+    RUN_STALE_MS = PROJECT_ENSURE_TIMEOUT_MS + 1e4;
   }
 });
 
@@ -1557,13 +1690,17 @@ var init_repositoryFingerprint = __esm({
 // packages/shared/dist/hookRuntime.js
 var hookRuntime_exports = {};
 __export(hookRuntime_exports, {
+  HOOK_STDIN_MAX_BYTES: () => HOOK_STDIN_MAX_BYTES,
+  PROJECT_ENSURE_TIMEOUT_MS: () => PROJECT_ENSURE_TIMEOUT_MS,
   PROJECT_SETUP_MANUAL: () => PROJECT_SETUP_MANUAL,
+  PROJECT_SETUP_RUNNING: () => PROJECT_SETUP_RUNNING,
   RELEASE_MINISIGN_PUBLIC_KEY: () => RELEASE_MINISIGN_PUBLIC_KEY,
   RuntimeError: () => RuntimeError,
   RuntimeReader: () => RuntimeReader,
   aclRecords: () => aclRecords,
   auditWindowsPermissions: () => auditWindowsPermissions,
   bindHookContext: () => bindHookContext,
+  clearProjectIdentityCache: () => clearProjectIdentityCache,
   ensureWindowsPrivateDirectorySync: () => ensureWindowsPrivateDirectorySync,
   execute: () => execute,
   findProjectIdentity: () => findProjectIdentity,
@@ -1577,6 +1714,7 @@ __export(hookRuntime_exports, {
   prepareWindowsAclDirectory: () => prepareWindowsAclDirectory,
   projectSetupActions: () => projectSetupActions,
   protectWindowsDirectory: () => protectWindowsDirectory,
+  readHookStdin: () => readHookStdin,
   safePath: () => safePath,
   setupResponse: () => setupResponse,
   validHookSessionId: () => validHookSessionId,
@@ -1588,22 +1726,68 @@ __export(hookRuntime_exports, {
   versionName: () => versionName,
   windowsCurrentAccountSync: () => windowsCurrentAccountSync
 });
-import { stderr } from "node:process";
+import { stderr, stdin } from "node:process";
+function clearProjectIdentityCache() {
+  identityCache.clear();
+}
 async function findProjectIdentity(startCwd, options = {}) {
   if (!startCwd)
     return null;
-  const result = await findProjectIdentityDetailed(startCwd, options);
-  if (result.kind !== "ok")
-    return null;
-  return {
-    projectId: result.identity.projectId,
-    projectName: result.identity.projectName,
-    projectRoot: result.root
-  };
+  const key = JSON.stringify([
+    startCwd,
+    options.allowNestedInherit ?? null,
+    options.maxDepth ?? null
+  ]);
+  let pending = identityCache.get(key);
+  if (!pending) {
+    pending = findProjectIdentityDetailed(startCwd, options).then((result) => result.kind === "ok" ? {
+      projectId: result.identity.projectId,
+      projectName: result.identity.projectName,
+      projectRoot: result.root
+    } : null);
+    identityCache.set(key, pending);
+    pending.catch(() => identityCache.delete(key));
+  }
+  return pending;
 }
 async function findProjectIdentityDetailed(startCwd, options = {}) {
   return resolveProjectIdentity(startCwd, options);
 }
+function readHookStdin(options = {}) {
+  const stream = options.stream ?? stdin;
+  const maxBytes = options.maxBytes ?? HOOK_STDIN_MAX_BYTES;
+  return new Promise((resolve4) => {
+    const chunks = [];
+    let bytes = 0;
+    let settled = false;
+    const text = () => Buffer.concat(chunks).toString("utf8").replace(/^\uFEFF/, "");
+    const finish = (value, release) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      stream.removeListener("data", onData);
+      stream.removeListener("end", onEnd);
+      if (release) {
+        stream.pause();
+        stream.destroy?.();
+      }
+      resolve4(value);
+    };
+    const onData = (chunk) => {
+      const buffer = typeof chunk === "string" ? Buffer.from(chunk, "utf8") : chunk;
+      bytes += buffer.length;
+      if (bytes > maxBytes)
+        return finish(null, true);
+      chunks.push(buffer);
+    };
+    const onEnd = () => finish(text(), false);
+    const timer = setTimeout(() => finish(text(), true), options.timeoutMs ?? HOOK_STDIN_TIMEOUT_MS);
+    stream.on("data", onData);
+    stream.on("end", onEnd);
+    stream.on("error", () => finish(null, false));
+  });
+}
 async function parseHookResponse(response) {
   const body = await response.json();
   const result = body;
@@ -1626,7 +1810,7 @@ async function postHookBoundJson(server, path, token, body) {
   return { status: response.status, body: await response.json() };
 }
 async function bindHookContext(input, familyId, hmac, post, options = {}) {
-  const { execFile: execFile4 } = await import("node:child_process");
+  const { execFile: execFile3 } = await import("node:child_process");
   const { constants: constants3 } = await import("node:fs");
   const { lstat: lstat5, mkdir: mkdir2, open: open3, realpath: realpath2 } = await import("node:fs/promises");
   const { dirname: dirname5 } = await import("node:path");
@@ -1641,7 +1825,7 @@ async function bindHookContext(input, familyId, hmac, post, options = {}) {
     if (process.env[key2] !== void 0)
       gitEnv[key2] = process.env[key2];
   const git = (args) => new Promise((resolve4) => {
-    execFile4("git", args, { cwd: root, env: gitEnv, timeout: 2e3, encoding: "utf8" }, (error, stdout2) => resolve4(error ? [] : stdout2.trim().split(/\r?\n/).filter(Boolean)));
+    execFile3("git", args, { cwd: root, env: gitEnv, timeout: 2e3, encoding: "utf8" }, (error, stdout2) => resolve4(error ? [] : stdout2.trim().split(/\r?\n/).filter(Boolean)));
   });
   const remotes = identity.repository.kind === "git" ? await git(["remote"]) : [];
   const selection = selectRemote2(await Promise.all(remotes.map(async (name) => ({
@@ -1706,15 +1890,18 @@ async function bindHookContext(input, familyId, hmac, post, options = {}) {
     await file.close();
   }
 }
-var mismatchEmitted;
+var identityCache, HOOK_STDIN_MAX_BYTES, mismatchEmitted;
 var init_hookRuntime = __esm({
   "packages/shared/dist/hookRuntime.js"() {
     "use strict";
     init_runtimeSigners();
+    init_hookTimeouts();
     init_repositoryRoot();
     init_runtimeReader();
     init_runtimeSigners();
     init_projectSetupHandoff();
+    identityCache = /* @__PURE__ */ new Map();
+    HOOK_STDIN_MAX_BYTES = 1048576;
     mismatchEmitted = false;
   }
 });
@@ -1722,13 +1909,17 @@ var init_hookRuntime = __esm({
 // packages/cli/src/runtime/signers.ts
 init_hookRuntime();
 export {
+  HOOK_STDIN_MAX_BYTES,
+  PROJECT_ENSURE_TIMEOUT_MS,
   PROJECT_SETUP_MANUAL,
+  PROJECT_SETUP_RUNNING,
   RELEASE_MINISIGN_PUBLIC_KEY,
   RuntimeError,
   RuntimeReader,
   aclRecords,
   auditWindowsPermissions,
   bindHookContext,
+  clearProjectIdentityCache,
   ensureWindowsPrivateDirectorySync,
   execute,
   findProjectIdentity,
@@ -1742,6 +1933,7 @@ export {
   prepareWindowsAclDirectory,
   projectSetupActions,
   protectWindowsDirectory,
+  readHookStdin,
   safePath,
   setupResponse,
   validHookSessionId,

package/dist/runtime/store.js

@@ -405,6 +405,13 @@ var init_runtimeSigners = __esm({
   }
 });
 
+// packages/shared/dist/hookTimeouts.js
+var init_hookTimeouts = __esm({
+  "packages/shared/dist/hookTimeouts.js"() {
+    "use strict";
+  }
+});
+
 // packages/shared/dist/projectIdentityFile.js
 var init_projectIdentityFile = __esm({
   "packages/shared/dist/projectIdentityFile.js"() {
@@ -783,11 +790,37 @@ var init_runtimeReader = __esm({
 });
 
 // packages/shared/dist/projectSetupHandoff.js
+var PROJECT_ENSURE_TIMEOUT_MS, SUPERVISOR, RUN_STALE_MS;
 var init_projectSetupHandoff = __esm({
   "packages/shared/dist/projectSetupHandoff.js"() {
     "use strict";
     init_runtimeSigners();
+    init_hookTimeouts();
     init_runtimeReader();
+    PROJECT_ENSURE_TIMEOUT_MS = 3e4;
+    SUPERVISOR = `
+const { execFile } = require('node:child_process');
+const { writeFileSync, renameSync } = require('node:fs');
+const [out, bin, ...args] = process.argv.slice(1);
+let input = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (chunk) => (input += chunk));
+process.stdin.on('end', () => {
+  const child = execFile(
+    process.execPath,
+    [bin, ...args],
+    { shell: false, timeout: ${PROJECT_ENSURE_TIMEOUT_MS}, killSignal: 'SIGKILL', maxBuffer: 64 * 1024, env: process.env },
+    (error, stdout) => {
+      const result = { code: error ? (typeof error.code === 'number' ? error.code : null) : 0, killed: !!(error && error.killed), stdout: String(stdout) };
+      writeFileSync(out + '.tmp', JSON.stringify(result), { mode: 0o600 });
+      renameSync(out + '.tmp', out);
+    }
+  );
+  child.stdin.on('error', () => {});
+  child.stdin.end(input);
+});
+`;
+    RUN_STALE_MS = PROJECT_ENSURE_TIMEOUT_MS + 1e4;
   }
 });
 
@@ -796,6 +829,7 @@ var init_hookRuntime = __esm({
   "packages/shared/dist/hookRuntime.js"() {
     "use strict";
     init_runtimeSigners();
+    init_hookTimeouts();
     init_repositoryRoot();
     init_runtimeReader();
     init_runtimeSigners();