@saadnvd1/agent-os 0.3.464 → 0.3.466

package/lib/orchestrator/rebase.ts

@@ -19,7 +19,6 @@
  * hears one event either way.
  */
 
-import { execFile } from "child_process";
 import fs from "fs";
 import os from "os";
 import path from "path";
@@ -28,6 +27,7 @@ import { sendMessage } from "../bus";
 import { hostLink } from "../hosts/remote-api";
 import type { TaskPR } from "../tasks/state";
 import { run } from "../tasks/gh";
+import { git as runGit, gitFetch, revParse } from "../git-exec";
 import { withRestackedLine } from "../tasks/code-review";
 import { outputOf, type Runner } from "../stacks/git";
 import { restackedHeads, stackNotice } from "../stacks/restack";
@@ -145,7 +145,7 @@ export async function mergesCleanly(
   head: string
 ): Promise<boolean> {
   try {
-    await run("git", ["merge-tree", "--write-tree", base, head], repo);
+    await runGit(repo, ["merge-tree", "--write-tree", base, head]);
     return true;
   } catch (error) {
     if ((error as { code?: unknown }).code === 1) return false;
@@ -163,14 +163,11 @@ async function rebaseOne(
   const repo = repoOf(task);
   const branch = task.base_branch || "main";
   // A failed fetch throws: nothing is judged against a stale base.
-  await run(
-    "git",
-    ["fetch", "--quiet", "--", "origin", branch, task.branch_name!],
-    repo,
-    60000
-  );
+  await gitFetch(repo, ["--quiet", "--", "origin", branch, task.branch_name!], {
+    timeout: 60000,
+  });
   const onto = `origin/${branch}`;
-  const baseTip = (await run("git", ["rev-parse", onto], repo)).trim();
+  const baseTip = await revParse(repo, onto);
   const attempt = `${pr.head}:${baseTip}`;
   if (tried.get(task.id) === attempt) return;
 
@@ -344,22 +341,21 @@ async function rebaseAt(
 
 // The PR's own patch against the base, as `git patch-id` sees it.
 async function patchId(repo: string, range: string): Promise<string | null> {
-  const diff = await run(
-    "git",
-    ["diff", "--no-color", "--no-ext-diff", "--full-index", range],
-    repo
-  ).catch(() => null);
+  const diff = await runGit(repo, [
+    "diff",
+    "--no-color",
+    "--no-ext-diff",
+    "--full-index",
+    range,
+  ]).catch(() => null);
   if (!diff) return null;
-  return new Promise((resolve) => {
-    const child = execFile(
-      "git",
-      ["patch-id", "--verbatim"],
-      { cwd: repo, timeout: 30000 },
-      (error, out) => resolve(error ? null : out.split(" ")[0] || null)
-    );
-    child.stdin?.on("error", () => {});
-    child.stdin?.end(diff);
-  });
+  return runGit(repo, ["patch-id", "--verbatim"], {
+    input: diff,
+    timeout: 30000,
+  }).then(
+    (out) => out.split(" ")[0] || null,
+    () => null
+  );
 }
 
 // The review of the head before the rebase, carried to the new head when

package/lib/orchestrator/repo-slug.ts

@@ -4,7 +4,7 @@
 // of its projects'.
 
 import type { Project } from "../db";
-import { run } from "../tasks/gh";
+import { git } from "../git-exec";
 import { expandHome } from "../tasks/session";
 import { workspaceProjects } from "./brief";
 
@@ -24,12 +24,9 @@ const slugs = new Map<string, { at: number; slug: string | null }>();
 export async function repoSlug(dir: string): Promise<string | null> {
   const hit = slugs.get(dir);
   if (hit && Date.now() - hit.at < SLUG_TTL_MS) return hit.slug;
-  const url = await run(
-    "git",
-    ["config", "--get", "remote.origin.url"],
-    dir,
-    10000
-  ).catch(() => "");
+  const url = await git(dir, ["config", "--get", "remote.origin.url"], {
+    timeout: 10000,
+  }).catch(() => "");
   const slug = slugOfRemote(url);
   slugs.set(dir, { at: Date.now(), slug });
   return slug;

package/lib/orchestrator/repo.ts

@@ -8,7 +8,7 @@ import path from "path";
 import type { Session } from "../db";
 import { SKILL_DIRS } from "../agents/skill-dirs";
 import { getProject } from "../projects";
-import { run } from "../tasks/gh";
+import { git, gitFetch, gitOk, worktreeAdd, worktreeRemove } from "../git-exec";
 import { expandHome } from "../tasks/session";
 
 export function repoOf(task: Session): string {
@@ -23,26 +23,21 @@ export async function fetchRefs(
   task: Pick<Session, "base_branch" | "branch_name">
 ): Promise<string> {
   const base = task.base_branch || "main";
-  await run(
-    "git",
-    ["fetch", "--quiet", "--", "origin", base, task.branch_name ?? base],
-    repo
-  ).catch(() => {});
+  await gitFetch(repo, [
+    "--quiet",
+    "--",
+    "origin",
+    base,
+    task.branch_name ?? base,
+  ]).catch(() => {});
   const remote = `origin/${base}`;
-  const has = await run(
-    "git",
-    ["rev-parse", "--verify", "--quiet", remote],
-    repo
-  ).then(
-    () => true,
-    () => false
-  );
+  const has = await gitOk(repo, ["rev-parse", "--verify", "--quiet", remote]);
   return has ? remote : base;
 }
 
 // When the commit was made, in seconds.
 export async function commitTime(repo: string, sha: string): Promise<number> {
-  const out = await run("git", ["show", "-s", "--format=%ct", sha], repo);
+  const out = await git(repo, ["show", "-s", "--format=%ct", sha]);
   return Number(out.trim()) || 0;
 }
 
@@ -61,25 +56,21 @@ export async function baseReviewSkill(
   repo: string,
   base: string
 ): Promise<{ path: string; text: string } | null> {
-  const listed = await run(
-    "git",
-    [
-      "ls-tree",
-      "-r",
-      "--name-only",
-      base,
-      "--",
-      ".claude/agents",
-      ...SKILL_DIRS,
-    ],
-    repo
-  ).catch(() => "");
+  const listed = await git(repo, [
+    "ls-tree",
+    "-r",
+    "--name-only",
+    base,
+    "--",
+    ".claude/agents",
+    ...SKILL_DIRS,
+  ]).catch(() => "");
   const files = listed.split("\n").map((f) => f.trim());
   const agents = files.filter((f) => AGENT_RULES.test(f));
   if (agents.length) {
     const parts = await Promise.all(
       agents.map(async (f) => {
-        const text = await run("git", ["show", `${base}:${f}`], repo);
+        const text = await git(repo, ["show", `${base}:${f}`]);
         return `## ${f.slice(".claude/agents/".length, -3)}\n${rulesOf(text)}`;
       })
     );
@@ -94,7 +85,7 @@ export async function baseReviewSkill(
       /(^|\/)[^/]*review[^/]*(\/SKILL\.md|\.md)$/i.test(f)
   );
   if (!file) return null;
-  const text = await run("git", ["show", `${base}:${file}`], repo);
+  const text = await git(repo, ["show", `${base}:${file}`]);
   return { path: file, text: text.slice(0, 20000) };
 }
 
@@ -113,8 +104,8 @@ export async function checkout(repo: string, sha: string): Promise<string> {
   const dir = fs.realpathSync(
     fs.mkdtempSync(path.join(os.tmpdir(), "aos-review-"))
   );
-  await run("git", ["worktree", "add", "--detach", dir, sha], repo);
-  const staged = await run("git", ["ls-files", "-s"], dir);
+  await worktreeAdd(repo, ["--detach", dir, sha]);
+  const staged = await git(dir, ["ls-files", "-s"]);
   for (const line of staged.split("\n"))
     if (line.startsWith("120000 "))
       fs.rmSync(path.join(dir, line.split("\t")[1]), { force: true });
@@ -122,8 +113,6 @@ export async function checkout(repo: string, sha: string): Promise<string> {
 }
 
 export async function removeCheckout(repo: string, dir: string) {
-  await run("git", ["worktree", "remove", "--force", dir], repo).catch(
-    () => {}
-  );
+  await worktreeRemove(repo, dir).catch(() => {});
   fs.rmSync(dir, { recursive: true, force: true });
 }

package/lib/pr-generation.ts

@@ -1,4 +1,5 @@
 import { execFile } from "child_process";
+import { git as runGit } from "./git-exec";
 import { run } from "./tasks/gh";
 import { UNTRUSTED_RULE, untrusted } from "./orchestrator/untrusted";
 
@@ -56,7 +57,7 @@ async function getGitContext(
 
   // Names and text here come from the repository; every one is an
   // argument to git, never shell text or an option.
-  const git = (args: string[]) => run("git", args, workingDir, 10_000);
+  const git = (args: string[]) => runGit(workingDir, args, { timeout: 10_000 });
   const lines = (out: string) =>
     out
       .split("\n")

package/lib/pr.ts

@@ -1,26 +1,8 @@
-import { execFileSync } from "child_process";
+import { getDefaultBranch } from "./git";
+import { currentBranch, git, gitPush, mergeBase } from "./git-exec";
 import { run } from "./tasks/gh";
 import { GhBackoffError, isRateLimit } from "./tasks/gh-limit";
 
-/** The remote's default branch, or "main" when it has none. */
-export function remoteDefaultBranch(workingDir: string): string {
-  try {
-    return execFileSync(
-      "git",
-      ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"],
-      {
-        cwd: workingDir,
-        encoding: "utf-8",
-        stdio: ["ignore", "pipe", "ignore"],
-      }
-    )
-      .trim()
-      .replace(/^origin\//, "");
-  } catch {
-    return "main";
-  }
-}
-
 export interface PRInfo {
   number: number;
   url: string;
@@ -62,26 +44,20 @@ export async function getCommitsSinceBase(
     // Get the merge base
     // Names come from the repository (its remote's default branch): they
     // are arguments, never shell text or options.
-    const mergeBase = (
-      await run(
-        "git",
-        ["merge-base", "--end-of-options", baseBranch, "HEAD"],
-        workingDir,
-        10_000
-      )
-    ).trim();
+    const base = await mergeBase(workingDir, baseBranch, "HEAD", {
+      timeout: 10_000,
+    });
 
     // Get commits since merge base
-    const output = await run(
-      "git",
+    const output = await git(
+      workingDir,
       [
         "log",
-        `${mergeBase}..HEAD`,
+        `${base}..HEAD`,
         "--format=COMMIT_START%n%H%n%s%n%b%nCOMMIT_END",
         "--",
       ],
-      workingDir,
-      10_000
+      { timeout: 10_000 }
     );
 
     const commits: CommitInfo[] = [];
@@ -214,12 +190,9 @@ export async function createPR(
 ): Promise<PRInfo> {
   // First ensure branch is pushed
   try {
-    await run(
-      "git",
-      ["push", "-u", "origin", "--", branchName],
-      workingDir,
-      30_000
-    );
+    await gitPush(workingDir, ["-u", "origin", "--", branchName], {
+      timeout: 30_000,
+    });
   } catch {
     // Branch might already be pushed
   }
@@ -251,27 +224,13 @@ export async function createPR(
 }
 
 /**
- * Get current branch name
+ * Get current branch name, "" when HEAD is detached.
  */
 export async function getCurrentBranch(workingDir: string): Promise<string> {
-  return (
-    await run("git", ["branch", "--show-current"], workingDir, 10_000)
-  ).trim();
+  return currentBranch(workingDir, { timeout: 10_000 });
 }
 
 /**
- * Get the default base branch: the remote's, or "main" when it has none.
+ * The PR's default base: the repository's default branch.
  */
-export async function getBaseBranch(workingDir: string): Promise<string> {
-  try {
-    const ref = await run(
-      "git",
-      ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"],
-      workingDir,
-      10_000
-    );
-    return ref.trim().replace(/^origin\//, "");
-  } catch {
-    return "main";
-  }
-}
+export const getBaseBranch = getDefaultBranch;

package/lib/schedules/start.ts

@@ -139,6 +139,7 @@ async function postToOrchestrator(
       ? `${fromLabel(schedule)}, set up by "${creator.name}"`
       : fromLabel(schedule),
     origin: scheduleOrigin(schedule, creator),
+    compact: "auto",
   });
   onSession(orchestrator.id);
   return orchestrator.id;

package/lib/sessions/worktree-setup.ts

@@ -6,10 +6,9 @@
  * nothing.
  */
 
-import { execFile } from "child_process";
-import { promisify } from "util";
 import { db } from "../db";
 import { createWorktree } from "../worktrees";
+import { git as runGit } from "../git-exec";
 import { setupWorktree } from "../env-setup";
 import {
   generateBranchName,
@@ -35,8 +34,6 @@ import {
   type SetupView,
 } from "./setup-progress";
 
-const execFileAsync = promisify(execFile);
-
 export interface WorktreeSetupInput {
   sessionId: string;
   projectPath: string;
@@ -50,7 +47,18 @@ export interface WorktreeSetupInput {
 }
 
 const git = (cwd: string, args: string[], timeout = 60_000) =>
-  execFileAsync("git", ["-C", cwd, ...args], { timeout });
+  runGit(cwd, args, { timeout });
+
+// git's own last line says it best ("not a git repository ..."), without
+// the "git fetch failed: " a GitError puts before a one-line stderr (or
+// createWorktree's "Failed to create worktree: " before that).
+const lastLine = (message: string) =>
+  (message.trim().split("\n").pop() ?? "")
+    .replace(
+      /^(?:Failed to create worktree: )?git [\w-]+(?: [\w-]+)? failed: /,
+      ""
+    )
+    .replace(/^fatal: /, "");
 
 // No remote: nothing to fetch. A fetch that fails fails the setup: a
 // worktree cut from an old base would start the agent on stale code.
@@ -64,9 +72,7 @@ async function fetchBase(view: SetupView, cwd: string, base: string) {
   try {
     await git(cwd, ["fetch", "origin", "--", base]);
   } catch (error) {
-    const why = (
-      (error as Error).message.trim().split("\n").pop() ?? ""
-    ).replace(/^fatal: /, "");
+    const why = lastLine((error as Error).message);
     throw new Error(`Fetching ${base} failed: ${why}`);
   }
 }
@@ -140,11 +146,9 @@ export async function setUpWorktree(input: WorktreeSetupInput): Promise<void> {
     // No worktree: the agent doesn't start. Its message stays queued, and
     // the session falls back to the project's folder if sent anyway.
     // git's own last line says it best ("not a git repository ...").
-    const message = (error instanceof Error ? error.message : String(error))
-      .trim()
-      .split("\n")
-      .pop()!
-      .replace(/^fatal: /, "");
+    const message = lastLine(
+      error instanceof Error ? error.message : String(error)
+    );
     db.prepare(`UPDATE sessions SET working_directory = ? WHERE id = ?`).run(
       projectPath,
       sessionId

package/lib/stacks/start.ts

@@ -13,10 +13,10 @@ import { getProject } from "../projects";
 import { requireClient } from "../lumifyhub/connection";
 import { promptFromCard } from "../lumifyhub/task-cards";
 import { createTask } from "../tasks";
-import { run } from "../tasks/gh";
 import { expandHome } from "../tasks/session";
 import { itemName } from "./guard";
 import { outputOf } from "./git";
+import { gitFetch, revParse } from "../git-exec";
 
 async function stackedBase(
   parent: StackItemRow,
@@ -31,16 +31,12 @@ async function stackedBase(
   if (!branch) throw new Error(`${itemName(parent)} has no branch to stack on`);
   // The branch must be on ORIGIN: the PR's base is the remote branch, and a
   // child cut from unpushed commits opens a PR whose diff includes them.
-  await run("git", ["fetch", "origin", branch], repo).catch(
-    (error: unknown) => {
-      throw new Error(
-        `${branch} is not on origin: ${outputOf(error).slice(0, 200)}`
-      );
-    }
-  );
-  const tip = (
-    await run("git", ["rev-parse", `origin/${branch}`], repo)
-  ).trim();
+  await gitFetch(repo, ["origin", branch]).catch((error: unknown) => {
+    throw new Error(
+      `${branch} is not on origin: ${outputOf(error).slice(0, 200)}`
+    );
+  });
+  const tip = await revParse(repo, `origin/${branch}`);
   const also = itemIds(item.also_item_ids)
     .map((id) => items.find((i) => i.id === id))
     .filter((i): i is StackItemRow => !!i && i.status !== "merged")

package/lib/tasks/branch-worktree.ts

@@ -8,10 +8,11 @@ import fs from "fs";
 import path from "path";
 import { getRepoName, slugify } from "../git";
 import { WORKTREES_DIR } from "../worktrees";
-import { run } from "./gh";
+import { git as runGit } from "../git-exec";
 import { pushedRef } from "./move";
 
-const git = (cwd: string, ...args: string[]) => run("git", args, cwd, 120000);
+const git = (cwd: string, ...args: string[]) =>
+  runGit(cwd, args, { timeout: 120000 });
 
 /** The worktree that has this branch checked out, if one does. */
 export function worktreeOnBranch(

package/lib/tasks/finish.ts

@@ -12,6 +12,7 @@ import { itemName, liveChildren, signOffRefusal } from "../stacks/guard";
 import { resolveMergedTaskAsks } from "../orchestrator/ask-settle";
 import { stopChat } from "../chat/runner";
 import { run } from "./gh";
+import { gitFetch, gitPush } from "../git-exec";
 import {
   mergePolicy,
   type MergeMethod,
@@ -61,13 +62,11 @@ async function cleanup(
     !keepRemoteBranch &&
     !PROTECTED_BRANCHES.has(session.branch_name)
   ) {
-    await run(
-      "git",
-      ["push", "origin", "--delete", session.branch_name],
-      repo
-    ).catch(() => {});
+    await gitPush(repo, ["origin", "--delete", session.branch_name]).catch(
+      () => {}
+    );
   }
-  await run("git", ["fetch", "--prune", "--quiet"], repo).catch(() => {});
+  await gitFetch(repo, ["--prune", "--quiet"]).catch(() => {});
   forgetPR(session.id);
 }
 

package/lib/tasks/gh.ts

@@ -1,5 +1,6 @@
 import { execFile } from "child_process";
 import { promisify } from "util";
+import { git } from "../git-exec";
 import { parseCodeReview } from "./code-review";
 import { parseScopeChange } from "./scope-change";
 import { assertGhAllowed, noteGhFailure, noteGhSuccess } from "./gh-limit";
@@ -16,12 +17,16 @@ import {
 
 const execFileAsync = promisify(execFile);
 
+// Runs gh (or another CLI) and resolves stdout. git goes through
+// lib/git-exec, so an injected runner (stacks, the orchestrator's rebase)
+// gets the same git as everything else.
 export async function run(
   cmd: string,
   args: string[],
   cwd: string,
   timeout = 60000
 ): Promise<string> {
+  if (cmd === "git") return git(cwd, args, { timeout });
   if (cmd === "gh") assertGhAllowed(args);
   try {
     const { stdout } = await execFileAsync(cmd, args, {

package/lib/tasks/move-testing.ts

@@ -5,16 +5,16 @@
 import fs from "fs";
 import os from "os";
 import path from "path";
-import { execFileSync } from "child_process";
 import { randomUUID } from "crypto";
 import { db, type Session } from "../db";
 import { createProject } from "../projects";
 import { writeTranscript } from "./transcript";
+import { gitSync } from "../git-exec";
 
 export const CLAUDE_ID = "11111111-2222-3333-4444-555555555555";
 
 export const git = (cwd: string, ...args: string[]) =>
-  execFileSync("git", args, { cwd, encoding: "utf8" }).trim();
+  gitSync(cwd, args).trim();
 
 export const row = (id: string) =>
   db.prepare(`SELECT * FROM sessions WHERE id = ?`).get(id) as Session;

package/lib/tasks/move.ts

@@ -13,7 +13,7 @@ import { db, type Session } from "../db";
 import { getProject } from "../projects";
 import { launchClaude } from "../agents/launch";
 import { buildTaskBrief } from "./brief";
-import { run } from "./gh";
+import { git as runGit } from "../git-exec";
 import { getTaskSession } from "./session";
 import { projectRef } from "./project-ref";
 import { moveRefusal } from "./move-guard";
@@ -32,7 +32,8 @@ import {
 export * from "./move-bundle";
 
 const execFileAsync = promisify(execFile);
-const git = (cwd: string, ...args: string[]) => run("git", args, cwd, 120000);
+const git = (cwd: string, ...args: string[]) =>
+  runGit(cwd, args, { timeout: 120000 });
 
 // Moves in flight in this process; the row's 'moving' outlives a restart.
 const g = globalThis as unknown as { __agentosExporting?: Set<string> };

package/lib/tasks/project-ref.ts

@@ -7,12 +7,10 @@
 import fs from "fs";
 import os from "os";
 import path from "path";
-import { execFile } from "child_process";
-import { promisify } from "util";
 import { createProject, getAllProjects } from "../projects";
 import { isRemoteHost } from "../hosts";
 import type { Project } from "../db";
-import { run } from "./gh";
+import { git, gitOk } from "../git-exec";
 import { expandHome } from "./session";
 
 export interface ProjectRef {
@@ -23,8 +21,6 @@ export interface ProjectRef {
   remote: string | null;
 }
 
-const execFileAsync = promisify(execFile);
-
 /** A ref as another machine sent it: its shape, before anything reads it. */
 export function isProjectRef(v: unknown): v is ProjectRef {
   const r = v as ProjectRef | null;
@@ -65,9 +61,7 @@ export function repoIdentity(remote: string | null): string | null {
 }
 
 export async function originOf(dir: string): Promise<string | null> {
-  const url = await run("git", ["remote", "get-url", "origin"], dir).catch(
-    () => ""
-  );
+  const url = await git(dir, ["remote", "get-url", "origin"]).catch(() => "");
   return url.trim() || null;
 }
 
@@ -122,7 +116,9 @@ export async function ensureProject(ref: ProjectRef): Promise<Project> {
     if (!ref.remote || !REMOTE_URL.test(ref.remote))
       throw new Error(`${ref.name} isn't here and has no remote to clone`);
     fs.mkdirSync(path.dirname(dir), { recursive: true });
-    await run("git", ["clone", "--", ref.remote, dir], os.homedir(), 600000);
+    await git(os.homedir(), ["clone", "--", ref.remote, dir], {
+      timeout: 600000,
+    });
   }
   return createProject({
     name: ref.name || path.basename(dir),
@@ -148,18 +144,15 @@ export async function whyNotHere(ref: ProjectRef): Promise<string | null> {
   const remote = withoutCredentials(ref.remote);
   if (!remote || !REMOTE_URL.test(remote))
     return "Not there, and no remote to clone";
-  try {
-    await execFileAsync("git", ["ls-remote", "--heads", "--", remote], {
-      cwd: os.homedir(),
+  const reachable = await gitOk(
+    os.homedir(),
+    ["ls-remote", "--heads", "--", remote],
+    {
       timeout: 15000,
       env: {
-        ...process.env,
-        GIT_TERMINAL_PROMPT: "0",
         GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND ?? "ssh -o BatchMode=yes",
       },
-    });
-    return null;
-  } catch {
-    return "Can't clone it there";
-  }
+    }
+  );
+  return reachable ? null : "Can't clone it there";
 }

package/lib/tasks/session.ts

@@ -3,7 +3,8 @@ import os from "os";
 import { db, queries, type Session } from "../db";
 import { isBranchName } from "../git";
 import { getProject } from "../projects";
-import { findPRStrict, run } from "./gh";
+import { findPRStrict } from "./gh";
+import { currentBranch, git } from "../git-exec";
 import { lookupPR } from "./pr-poll";
 import type { TaskPR } from "./state";
 
@@ -43,15 +44,14 @@ async function worktreeBranch(session: Session): Promise<string | null> {
   const dir = localWorktree(session);
   if (!dir) return null;
   try {
-    const out = await run("git", ["branch", "--show-current"], dir, 5000);
-    return out.trim() || null;
+    return (await currentBranch(dir, { timeout: 5000 })) || null;
   } catch {
     return null;
   }
 }
 
 const hasRef = (dir: string, ref: string) =>
-  run("git", ["rev-parse", "--verify", "--quiet", ref], dir, 5000).then(
+  git(dir, ["rev-parse", "--verify", "--quiet", ref], { timeout: 5000 }).then(
     () => true,
     // Exit 1 is "no such branch"; a timeout or a lock isn't an answer.
     (e: { code?: unknown }) => e?.code !== 1
@@ -94,7 +94,7 @@ function moveBranch(session: Session, branch: string): void {
 
 // git merge-base --is-ancestor: exit 0 yes, 1 no, anything else can't say.
 const isAncestor = (dir: string, sha: string, ref: string) =>
-  run("git", ["merge-base", "--is-ancestor", sha, ref], dir, 5000).then(
+  git(dir, ["merge-base", "--is-ancestor", sha, ref], { timeout: 5000 }).then(
     () => true as const,
     (e: { code?: unknown }) => (e?.code === 1 ? (false as const) : null)
   );