@scalequality/check 0.5.1 → 0.5.3

package/README.md

@@ -87,15 +87,15 @@ source, coverage, and a bounded durability report (at most 1 MiB); it never uplo
 the raw `.git` object database. Years of old binary history therefore do not add
 to the archive size. It does not truncate or change your repository.
 
-Use a complete checkout for that measurement. Shallow history is reported as
-unavailable; it is not treated as a full 90-day measurement.
+Use a complete checkout for that measurement. A shallow or incomplete checkout
+is rejected locally before upload; it is not treated as a full 90-day measurement.
 
 ```yaml
 # GitHub Actions
 - uses: actions/checkout@v4
   with:
     fetch-depth: 0
-- run: npx @scalequality/check@0.5.1 --project <projectId>
+- run: npx @scalequality/check@0.5.3 --project <projectId>
   env:
     SQ_TOKEN: ${{ secrets.SQ_TOKEN }}
 ```
@@ -109,8 +109,8 @@ clone:
 
 The current-code scanners still run on the server. Historical secret scanning and
 commit-convention analysis are not included in this report; the result shows those
-limits and identifies durability as reported by CI. CPU, time, malformed Git or
-report-size limits yield unavailable history, never a fabricated clean result.
+limits and identifies durability as reported by CI. A failed Git collection or
+invalid report stops the CLI before upload, without submitting a replacement score.
 
 Version 0.5.0 needs the compatible ScaleQuality server release. The CLI checks the
 server's acknowledgement of this exact report before declaring a passing gate.
@@ -126,7 +126,7 @@ that you expect to measure.
 
 ```bash
 # Local verification; does not need a token and sends nothing to ScaleQuality.
-npx @scalequality/check@0.5.1 --dry-run
+npx @scalequality/check@0.5.3 --dry-run
 ```
 
 The CLI checks compressed size before allocating the upload buffer or sending a
@@ -158,8 +158,8 @@ blame output without increasing the worker's memory or time budgets.
 Archive exclusions, including `--exclude`, do not change Git durability's tracked
 file scope. A tracked dependency can still contribute to the historical metric.
 Changing that methodology requires a separate coordinated version; this patch
-does not silently rewrite prior scores. Missing coverage or history is still
-reported as unavailable.
+does not silently rewrite prior scores. Coverage may remain absent when the job
+does not generate it; Git collection failures stop the check before upload.
 
 Track-only completion now says `measurement completed (track only; no cutoff
 configured)`. Its exit code remains zero; completion does not certify that every
@@ -168,3 +168,36 @@ dimension was measured or that a maturity threshold was passed.
 The 60 MiB compressed-source limit still applies. A checkout with more than that
 amount of first-party source or ambiguous generated assets is rejected locally;
 this release does not truncate source to force a successful upload.
+
+
+## 0.5.2: complete Git collection before submitting a score
+
+The complete HEAD object inventory now streams through the same bounded reader
+as blame. Large old histories no longer have to fit into a 16 MiB output buffer
+for that check. Missing objects remain errors. The 90-day window, 14-day settlement,
+scoring calculations and archive limit are unchanged.
+
+Unexpected Git command failures stop collection; they cannot become zero surviving
+lines or an upload with durability omitted. A temporary OS `EAGAIN` failure to
+start Git gets one automatic retry within the existing measurement deadline.
+Timeouts, missing or corrupt history, and resource-limit failures do not trigger
+unbounded retries. A technical failure exits with code 2 and sends no new score.
+
+Tracked blob names are preserved exactly, including Git-quoted characters.
+Submodule gitlinks are not source blobs and are not sent to blame; ordinary files,
+symlinks and binary blobs retain their existing measurement treatment.
+
+A valid report with zero settled or AI-attributed lines still proceeds. It does
+not invent 100% AI survival. Missing coverage alone does not block submission.
+A completed check below a configured maturity cutoff still exits with code 1;
+track-only completion still exits with code 0.
+
+## 0.5.3: complete coverage report collection
+
+Coverage discovery and staging now process all matching reports incrementally,
+including deep modules and individual reports larger than 25 MiB. Report bytes
+and paths are preserved; the CLI no longer silently stops after 40 reports.
+A file that changes or cannot be copied stops submission before any upload.
+The existing 60 MiB compressed upload limit, Git durability calculation and
+maturity gates are unchanged. This release requires the matching server reader
+that accepts the complete staged report index.

package/bin/check.mjs

@@ -4,12 +4,11 @@
 // non-zero when maturity is below the configured cutoff, so a CI step can fail the
 // build. Pure Node 18+ (global fetch/FormData/Blob), no npm dependencies.
 
-import { tmpdir } from "node:os"
-import { join, dirname, relative, sep } from "node:path"
 import { spawnSync } from "node:child_process"
-import { readFileSync, writeFileSync, statSync, rmSync, readdirSync, mkdirSync, mkdtempSync, copyFileSync } from "node:fs"
+import { readFileSync } from "node:fs"
 import { prepareCheckoutArchive, normalizeExcludes } from "./archive.mjs"
 import { measureDurability } from "./durability.mjs"
+import { stageCoverageReports } from "./coverage.mjs"
 
 const args = process.argv.slice(2)
 const flag = (name) => {
@@ -128,95 +127,12 @@ function slimReport(stdout, ref) {
   return json
 }
 
-// Coverage reports live in exactly the directories the archive excludes: JaCoCo
-// writes to target/ and build/, Istanbul to coverage/. So the one moment where a
-// REAL coverage number is sitting on disk — right after this job ran the tests —
-// was also the one moment we threw it away, and every Maven project came back
-// with no measured coverage even with a green suite behind it.
-//
-// The reports are copied into .sqreports/ under FLAT, indexed names, with an
-// index.json holding each one's original path. Mirroring the original directory
-// tree looked tidier and did not work: bsdtar does not anchor `--exclude=./target`
-// to the root, so a staged copy at `.scalequality/coverage/target/...` was dropped
-// on macOS while surviving under GNU tar. Measured, not assumed — and a layout
-// whose behaviour depends on which tar the runner ships is not a layout.
-// Every staged name here is `<n>-<basename>`, which no exclude pattern can match.
-const COVERAGE_NAMES = [
-  { re: /^jacoco(TestReport)?\.xml$/i, format: "jacoco" },
-  { re: /^lcov\.info$/i, format: "lcov" },
-  { re: /^coverage-summary\.json$/i, format: "istanbul" },
-  { re: /^coverage\.cobertura\.xml$/i, format: "cobertura" },
-  { re: /^cobertura(-coverage)?\.xml$/i, format: "cobertura" },
-  { re: /^coverage\.xml$/i, format: "cobertura" },
-  { re: /^clover\.xml$/i, format: "clover" },
-  { re: /^(coverage|cover)\.out$/i, format: "go" },
-]
-const COVERAGE_SKIP = new Set(["node_modules", ".git", ".venv", "venv", "vendor", "__pycache__", ".sqreports"])
-const COVERAGE_STAGE = ".sqreports"
-const MAX_REPORT_BYTES = 25 * 1024 * 1024
-const MAX_REPORTS = 40
-
-function stageCoverageReports() {
-  const root = process.cwd()
-  const stagingRoot = mkdtempSync(join(tmpdir(), "sq-coverage-"))
-  const stage = join(stagingRoot, COVERAGE_STAGE)
-  // The staged copies must not outlive this process under ANY exit path. A
-  // cancelled job or a network failure that left them behind would show up as
-  // untracked files in the customer's checkout, and a pipeline that runs
-  // `git diff --exit-code` after the gate would fail because of us.
-  const clean = () => { try { rmSync(stagingRoot, { recursive: true, force: true }) } catch { /* best effort */ } }
-  process.on("exit", clean)
-  for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) {
-    process.on(sig, () => { clean(); process.exit(130) })
-  }
-
-  const index = []
-  let bytes = 0
-  const walk = (dir, depth) => {
-    if (depth > 7 || index.length >= MAX_REPORTS || bytes >= MAX_REPORT_BYTES) return
-    let entries
-    try { entries = readdirSync(dir, { withFileTypes: true }) } catch { return }
-    for (const e of entries) {
-      if (index.length >= MAX_REPORTS || bytes >= MAX_REPORT_BYTES) return
-      const abs = join(dir, e.name)
-      if (e.isDirectory()) {
-        if (!COVERAGE_SKIP.has(e.name)) walk(abs, depth + 1)
-        continue
-      }
-      if (!e.isFile()) continue
-      const hit = COVERAGE_NAMES.find((c) => c.re.test(e.name))
-      if (!hit) continue
-      let size = 0
-      try { size = statSync(abs).size } catch { continue }
-      if (size === 0 || bytes + size > MAX_REPORT_BYTES) continue
-      const staged = `${index.length}-${e.name}`
-      try {
-        mkdirSync(stage, { recursive: true })
-        copyFileSync(abs, join(stage, staged))
-      } catch { continue }
-      bytes += size
-      index.push({ file: staged, path: relative(root, abs).split(sep).join("/"), format: hit.format })
-    }
-  }
-  walk(root, 0)
-
-  if (index.length) {
-    try {
-      writeFileSync(join(stage, "index.json"), JSON.stringify({ version: 1, reports: index }))
-    } catch { /* the archive just goes without them */ }
-    const shown = index.slice(0, 3).map((r) => r.path).join(", ")
-    log(`ScaleQuality: found ${index.length} coverage report(s) — ${shown}${index.length > 3 ? " …" : ""}`)
-  } else {
-    log("ScaleQuality: no coverage report found in this job. Run your tests with coverage before this step to get a measured %.")
-  }
-  return { stage, root: stagingRoot, count: index.length, cleanup: clean }
-}
-
 async function main() {
   const auth = { Authorization: `Bearer ${token}` }
   const excludes = normalizeExcludes(args.flatMap((arg, i) => arg === "--exclude" ? [args[i + 1]] : []))
   const durabilityReport = await measureDurability({ root: process.cwd(), log: jsonOut ? (message) => console.error(message) : log })
-  const coverage = stageCoverageReports()
+  if (!durabilityReport) fail("Git durability collection failed. No upload was sent and no new score was submitted. Resolve the Git error above before rerunning this step.")
+  const coverage = await stageCoverageReports({ log })
   let packed, buf
   try {
     packed = prepareCheckoutArchive({ root: process.cwd(), coverageRoot: coverage.root, durabilityReport, excludes, log })

package/bin/coverage.mjs

@@ -0,0 +1,117 @@
+import { constants, rmSync } from "node:fs"
+import { open, opendir, mkdir, mkdtemp } from "node:fs/promises"
+import { tmpdir } from "node:os"
+import { join, relative, sep } from "node:path"
+
+const NAMES = [
+  { re: /^jacoco(TestReport)?\.xml$/i, format: "jacoco" },
+  { re: /^lcov\.info$/i, format: "lcov" },
+  { re: /^coverage-summary\.json$/i, format: "istanbul" },
+  { re: /^coverage\.cobertura\.xml$/i, format: "cobertura" },
+  { re: /^cobertura(-coverage)?\.xml$/i, format: "cobertura" },
+  { re: /^coverage\.xml$/i, format: "cobertura" },
+  { re: /^clover\.xml$/i, format: "clover" },
+  { re: /^(coverage|cover)\.out$/i, format: "go" },
+]
+const SKIP = new Set(["node_modules", ".git", ".venv", "venv", "vendor", "__pycache__", ".sqreports"])
+const STAGE = ".sqreports"
+
+// Copy sequentially using a fixed buffer. Report count and uncompressed bytes
+// do not determine which sources survive. The final compressed checkout still
+// has the existing upload limit, checked by archive.mjs before any HTTP request.
+async function copyReport(source, destination) {
+  let input, output
+  try {
+    input = await open(source, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK)
+    const before = await input.stat({ bigint: true })
+    if (!before.isFile() || before.size === 0n) throw new Error("report is empty or is not a regular file")
+    output = await open(destination, "wx")
+    const buffer = Buffer.allocUnsafe(64 * 1024)
+    let copied = 0n
+    while (true) {
+      const { bytesRead } = await input.read(buffer, 0, buffer.length, null)
+      if (!bytesRead) break
+      let written = 0
+      while (written < bytesRead) {
+        const { bytesWritten } = await output.write(buffer, written, bytesRead - written, null)
+        if (!bytesWritten) throw new Error("report copy made no progress")
+        written += bytesWritten
+      }
+      copied += BigInt(bytesRead)
+      if (copied > before.size) throw new Error("report changed during collection")
+    }
+    const after = await input.stat({ bigint: true })
+    if (copied !== before.size || after.size !== before.size || after.mtimeNs !== before.mtimeNs || after.ctimeNs !== before.ctimeNs) {
+      throw new Error("report changed during collection")
+    }
+  } finally {
+    await Promise.all([output?.close(), input?.close()])
+  }
+}
+
+/** Preserve every discovered original report in a flat v1 index. Flat names
+ * keep GNU/BSD tar exclusions from dropping nested build/target reports.
+ * Generated
+ * directories are scanned too: they are exactly where test runners write.
+ * No customer files are created or changed. A failed scan/copy/index never
+ * returns a partial set that could be presented as a complete measurement. */
+export async function stageCoverageReports({ root = process.cwd(), log = () => {} } = {}) {
+  const stagingRoot = await mkdtemp(join(tmpdir(), "sq-coverage-"))
+  const stage = join(stagingRoot, STAGE)
+  const remove = () => { try { rmSync(stagingRoot, { recursive: true, force: true }) } catch { /* best effort on process exit */ } }
+  const signals = ["SIGINT", "SIGTERM", "SIGHUP"]
+  const onSignal = () => { remove(); process.exit(130) }
+  process.once("exit", remove)
+  for (const signal of signals) process.once(signal, onSignal)
+  const cleanup = () => {
+    process.removeListener("exit", remove)
+    for (const signal of signals) process.removeListener(signal, onSignal)
+    remove()
+  }
+  let index
+  let count = 0
+  const shown = []
+  let current = "."
+  const walk = async (directory) => {
+    current = relative(root, directory).split(sep).join("/") || "."
+    const entries = await opendir(directory)
+    for await (const entry of entries) {
+      const absolute = join(directory, entry.name)
+      if (entry.isDirectory()) {
+        if (!SKIP.has(entry.name)) await walk(absolute)
+        continue
+      }
+      if (!entry.isFile()) continue // Never follow report or directory symlinks.
+      const match = NAMES.find(candidate => candidate.re.test(entry.name))
+      if (!match) continue
+      current = relative(root, absolute).split(sep).join("/")
+      if (!index) {
+        await mkdir(stage)
+        index = await open(join(stage, "index.json"), "wx")
+        await index.writeFile('{"version":1,"reports":[')
+      }
+      const file = `${count}-${entry.name}`
+      await copyReport(absolute, join(stage, file))
+      await index.writeFile((count ? "," : "") + JSON.stringify({ file, path: current, format: match.format }))
+      count++
+      if (shown.length < 3) shown.push(current)
+    }
+  }
+  try {
+    await walk(root)
+    if (index) {
+      await index.writeFile("]}\n")
+      await index.close()
+      index = undefined
+      log(`ScaleQuality: found ${count} coverage report(s) — ${shown.join(", ")}${count > 3 ? " …" : ""}`)
+    } else {
+      log("ScaleQuality: no coverage report found in this job. Run your tests with coverage before this step to get a measured %.")
+    }
+    return { stage, root: stagingRoot, count, cleanup }
+  } catch (error) {
+    await index?.close().catch(() => {})
+    cleanup()
+    const reason = typeof error?.code === "string" ? error.code : error?.message || "I/O error"
+    throw new Error(`Coverage collection could not finish at ${JSON.stringify(current)} (${reason}). No upload was sent and no partial coverage was submitted.`)
+  }
+}

package/bin/durability/GitReader.mjs

@@ -1,7 +1,27 @@
-import { runGit as git, runGitLines, isFatalGitError, GitMeasurementError } from "./runtime.mjs";
+import { runGit as git, runGitLines, GitMeasurementError } from "./runtime.mjs";
 const US = "\x1f"; // unit separator (field)
 const RS = "\x1e"; // record separator (commit)
 const CO_AUTHOR_RE = /co-authored-by:\s*(.*?)\s*<([^>]+)>/gi;
+/** `git log --numstat` C-quotes path bytes, independently of the UTF-8 source.
+ * Decode only this transport representation; leave rename/statistics semantics
+ * unchanged. `ls-tree -z` and blame both use the resulting literal pathname. */
+function decodeGitPath(path) {
+    if (!path.startsWith('"') || !path.endsWith('"')) return path;
+    const parts = [];
+    let literal = '';
+    const escapes = { a: 7, b: 8, t: 9, n: 10, v: 11, f: 12, r: 13, '\\': 92, '"': 34 };
+    for (let i = 1; i < path.length - 1; i++) {
+        if (path[i] !== '\\') { literal += path[i]; continue; }
+        parts.push(Buffer.from(literal)); literal = '';
+        const escaped = path[++i];
+        if (Object.hasOwn(escapes, escaped)) parts.push(Buffer.from([escapes[escaped]]));
+        else if (/^[0-7]{3}$/.test(path.slice(i, i + 3))) {
+            parts.push(Buffer.from([parseInt(path.slice(i, i + 3), 8)])); i += 2;
+        } else throw new GitMeasurementError('Git file path could not be parsed');
+    }
+    parts.push(Buffer.from(literal));
+    return Buffer.concat(parts).toString('utf8');
+}
 function parseCoAuthors(body) {
     const out = [];
     let m;
@@ -77,15 +97,24 @@ export async function readCommits(repoPath, sinceDays, untilDays = 0) {
             const del = Number.parseInt(cols[1], 10);
             rec.additions += Number.isFinite(add) ? add : 0;
             rec.deletions += Number.isFinite(del) ? del : 0;
-            rec.files.push(cols.slice(2).join("\t"));
+            rec.files.push(decodeGitPath(cols.slice(2).join("\t")));
         }
     }
     return [...bySha.values()];
 }
-/** Files that currently exist at HEAD (tracked). */
+/** Blameable entries currently at HEAD. Gitlinks point to another repository;
+ * native blame already contributed zero for them. Keep all blobs, including
+ * symlinks and binaries, without changing the commit/additions denominator. */
 export async function listHeadFiles(repoPath) {
-    const out = await git(repoPath, ["ls-tree", "-r", "--name-only", "HEAD"]);
-    return new Set(out.split("\n").map((l) => l.trim()).filter(Boolean));
+    const out = await git(repoPath, ["ls-tree", "-r", "-z", "HEAD"]);
+    const files = new Set();
+    for (const line of out.split("\0")) {
+        if (!line) continue;
+        const entry = /^[0-7]{6} (blob|tree|commit) [0-9a-f]{40}\t([\s\S]+)$/.exec(line);
+        if (!entry) throw new GitMeasurementError('Git tree output could not be parsed');
+        if (entry[1] === 'blob') files.add(entry[2]);
+    }
+    return files;
 }
 const BLAME_GROUP = /^([0-9a-f]{40}) [1-9][0-9]* [1-9][0-9]* ([1-9][0-9]*)$/;
 /**
@@ -93,29 +122,23 @@ const BLAME_GROUP = /^([0-9a-f]{40}) [1-9][0-9]* [1-9][0-9]* ([1-9][0-9]*)$/;
  * CURRENT lines it owns. Incremental output describes identical attribution
  * in groups, without source lines or repeated per-line commit metadata.
  * Stream those groups so large output does not require a large buffer.
- * Ordinary per-file failures return no counts; resource/history errors abort.
+ * Callers select files present at HEAD. A failed command is incomplete evidence,
+ * never proof that this file has no surviving lines.
  */
 export async function blameFile(repoPath, file) {
     const counts = new Map();
-    try {
-        await runGitLines(repoPath, [
-            "blame",
-            "--incremental",
-            "HEAD",
-            "--",
-            file,
-        ], line => {
-            const m = BLAME_GROUP.exec(line);
-            if (!m) return;
-            const total = (counts.get(m[1]) ?? 0) + Number(m[2]);
-            if (!Number.isSafeInteger(total)) throw new GitMeasurementError('Git blame line count exceeded the numeric limit');
-            counts.set(m[1], total);
-        });
-    }
-    catch (error) {
-        if (isFatalGitError(error)) throw error;
-        // deleted at HEAD / binary / unreadable → no surviving lines counted
-        counts.clear();
-    }
+    await runGitLines(repoPath, [
+        "blame",
+        "--incremental",
+        "HEAD",
+        "--",
+        file,
+    ], line => {
+        const m = BLAME_GROUP.exec(line);
+        if (!m) return;
+        const total = (counts.get(m[1]) ?? 0) + Number(m[2]);
+        if (!Number.isSafeInteger(total)) throw new GitMeasurementError('Git blame line count exceeded the numeric limit');
+        counts.set(m[1], total);
+    });
     return counts;
 }

package/bin/durability/PROVENANCE.md

@@ -15,9 +15,14 @@ extensions. The engine's calculations and classifier remain unchanged. In the
 reader, replace its promisified `execFile` wrapper with `runtime.mjs`'s `runGit`.
 For blame, use `runGitLines` with `--incremental` and sum each group's line count
 instead of counting individual `--line-porcelain` headers. Attribution is unchanged;
-source text and repeated per-line metadata are not emitted or retained. Rethrow
-`isFatalGitError(error)` in the per-file blame catch. Discard partial streamed
-counts on ordinary per-file failures, retaining the native empty-map behavior.
+source text and repeated per-line metadata are not emitted or retained. Any failed
+blame aborts the report instead of returning empty or partial counts. Read the
+object type from `ls-tree -rz` and select only blobs, preserving literal names
+without trimming. Decode Git's C-quoted path bytes in `log --numstat` so tabs,
+quotes, Unicode and leading/trailing whitespace match these same blob names.
+This skips only submodule gitlinks,
+whose native blame contributed zero; binary and symlink blobs remain eligible.
+Commit statistics and the introduced-lines denominator remain unchanged.
 Recompute provenance hashes and run the
 parity and cancellation tests. The reference modules under
 `test/native-durability-reference/` preserve the original reader for small fixture
@@ -32,11 +37,15 @@ No clone, fetch, checkout or Git write is performed. Shallow or partial historie
 missing objects, changing HEAD and invalid reports produce no measurement.
 The separate worker has a 120-second total budget and 512 MiB V8 heap ceiling;
 each Git command has at most 30 seconds. Buffered commands retain at most 16 MiB
-of output. Incremental blame streams stdout, retaining one line (at most 16 MiB)
-and at most 16 MiB of stderr, rather than limiting total streamed output. The complete HEAD
-object inventory uses this same limit, so sufficiently large object inventories
-can be unavailable even when the 90-day change window is small. Limit failures
-are reported as unavailable, never converted into successful zero measurements.
+of output. Incremental blame and the complete HEAD object inventory stream stdout,
+retaining one line (at most 16 MiB) and at most 16 MiB of stderr, rather than
+limiting total streamed output. One failed OS spawn with `EAGAIN` can recover after
+100 ms, within the original total deadline; the recovery allowance is shared by
+all Git commands. Command exits, signals, timeouts, missing/incomplete history and
+deterministic resource failures are never automatically retried.
+Collection failures abort the CLI before packaging or upload and cannot submit a
+replacement score. A validated report with zero settled or AI-eligible lines is
+still a successful collection; an absent optional coverage report is permitted.
 Only the measurement worker's own process group and Git children are cleaned up
 on cancellation or parent IPC disconnection. Git command output, author details,
 credentials and customer environment tokens are not logged or sent to the worker.

package/bin/durability/provenance.json

@@ -29,8 +29,11 @@
   "runtimeChanges": [
     "ESM relative import extensions only in engine/classifier",
     "GitReader process wrapper replaced by bounded local-only runner",
-    "GitReader blame catch rethrows resource/incomplete-history failures; ordinary per-file errors retain native handling",
-    "GitReader blame streams incremental groups and sums their line counts with exact native attribution; bounded lines and stderr preserve resource limits without capping total streamed stdout"
+    "GitReader blame aborts the report on any failed command; partial counts never become a successful measurement",
+    "GitReader selects literal blob paths from NUL-delimited ls-tree and decodes C-quoted numstat filenames; submodule gitlinks retain zero native contribution without changing introduced-line counts",
+    "GitReader blame streams incremental groups and sums their line counts with exact native attribution; bounded lines and stderr preserve resource limits without capping total streamed stdout",
+    "Worker streams the complete HEAD object inventory and rejects missing objects without buffering total output",
+    "Runtime permits one recovery from OS spawn EAGAIN within the original deadline; all other collection failures abort the CLI before upload"
   ],
   "generatedFiles": [
     {
@@ -39,7 +42,7 @@
     },
     {
       "file": "GitReader.mjs",
-      "sha256": "727cc9dd9278ac29dd18d5d482918c20ee7c7550356376614051566ca2f4abd0"
+      "sha256": "e86e2e8251f5d9e8f50f671805d8926346aeb574bd2d6a115e5cd324555858f3"
     },
     {
       "file": "OriginClassifier.mjs",

package/bin/durability/runtime.mjs

@@ -1,15 +1,17 @@
 import { execFile, spawn } from 'node:child_process'
+import { setTimeout as delay } from 'node:timers/promises'
 
 export const MAX_GIT_BUFFER = 16 * 1024 * 1024
 export const MAX_GIT_TIME_MS = 30_000
 let deadline = 0
+let spawnRecoveryUsed = false
 const children = new Set()
 
 export class GitMeasurementError extends Error {
   constructor(reason) { super(reason); this.reason = reason; this.fatalMeasurement = true }
 }
 export const isFatalGitError = (error) => error?.fatalMeasurement === true
-export function setDeadline(value) { deadline = value }
+export function setDeadline(value) { deadline = value; spawnRecoveryUsed = false }
 export function remainingTime() {
   const remaining = deadline - Date.now()
   if (remaining <= 0) throw new GitMeasurementError('time budget exceeded')
@@ -36,6 +38,13 @@ function gitArgs(repoPath, args) {
 }
 
 function gitError(error, stderr) {
+  // EAGAIN is a failed OS spawn, before Git ran or emitted any result. A child
+  // exit status, timeout or deterministic Git/resource error is not retryable.
+  if (error.code === 'EAGAIN') {
+    const failure = new GitMeasurementError('Git process could not start because system resources are temporarily unavailable')
+    failure.retryableSpawn = true
+    return failure
+  }
   if (error.code === 'ENOENT') return new GitMeasurementError('Git is unavailable')
   if (error.code === 'ERR_CHILD_PROCESS_STDIO_MAXBUFFER' || error.code === 'ENOBUFS') return new GitMeasurementError('Git output exceeded the 16 MiB resource limit')
   if (error.killed || error.signal || error.code === 'ETIMEDOUT') return new GitMeasurementError('Git command exceeded the time budget')
@@ -43,12 +52,27 @@ function gitError(error, stderr) {
     return new GitMeasurementError('Git history is incomplete or unavailable locally')
   }
   // Never propagate command output, author identities or credentials to logs.
-  const safeError = new Error('Git command failed')
+  const safeError = new GitMeasurementError('Git command failed')
   safeError.code = error.code
   return safeError
 }
 
-export async function runGit(repoPath, args, { allowMissingConfig = false } = {}) {
+async function withSpawnRecovery(operation) {
+  try { return await operation() } catch (error) {
+    if (!error?.retryableSpawn || spawnRecoveryUsed) throw error
+    spawnRecoveryUsed = true
+    remainingTime()
+    await delay(Math.min(100, remainingTime()))
+    remainingTime()
+    return operation()
+  }
+}
+
+export async function runGit(repoPath, args, options = {}) {
+  return withSpawnRecovery(() => runGitOnce(repoPath, args, options))
+}
+
+function runGitOnce(repoPath, args, { allowMissingConfig = false } = {}) {
   const timeout = Math.min(MAX_GIT_TIME_MS, remainingTime())
   return new Promise((resolve, reject) => {
     const child = execFile('git', gitArgs(repoPath, args), { encoding: 'utf8', maxBuffer: MAX_GIT_BUFFER, timeout, killSignal: 'SIGKILL', windowsHide: true, env: localGitEnvironment() }, (error, stdout, stderr) => {
@@ -63,6 +87,10 @@ export async function runGit(repoPath, args, { allowMissingConfig = false } = {}
 
 /** Consume stdout a line at a time; retain at most one bounded line, not the full output. */
 export async function runGitLines(repoPath, args, onLine) {
+  return withSpawnRecovery(() => runGitLinesOnce(repoPath, args, onLine))
+}
+
+function runGitLinesOnce(repoPath, args, onLine) {
   const timeout = Math.min(MAX_GIT_TIME_MS, remainingTime())
   return new Promise((resolve, reject) => {
     let pending = ''

package/bin/durability/worker.mjs

@@ -1,7 +1,7 @@
 import { realpath } from 'node:fs/promises'
 import { analyzeDurability } from './GitDurabilityEngine.mjs'
 import { ENGINE_COMMIT, validateReport } from './validate.mjs'
-import { runGit, setDeadline, remainingTime, stopGitChildren, GitMeasurementError } from './runtime.mjs'
+import { runGit, runGitLines, setDeadline, remainingTime, stopGitChildren, GitMeasurementError } from './runtime.mjs'
 
 process.on('SIGTERM', () => { stopGitChildren(); process.exit(2) })
 let completed = false
@@ -20,8 +20,9 @@ process.once('message', async ({ root, deadline }) => {
     if (partial.split('\n').some(line => /^extensions\.partialclone\s+\S/i.test(line) || /^remote\..*\.promisor\s+(true|yes|on|1)\s*$/i.test(line))) throw new GitMeasurementError('partial Git history cannot be measured without fetching objects')
     const headSha = (await runGit(root, ['rev-parse', '--verify', 'HEAD'])).trim()
     if (!/^[0-9a-f]{40}$/.test(headSha)) throw new GitMeasurementError('a valid SHA-1 Git HEAD is required')
-    const objects = await runGit(root, ['rev-list', '--objects', '--no-object-names', '--missing=print', 'HEAD'])
-    if (objects.split('\n').some(line => /^\?[0-9a-f]+$/.test(line))) throw new GitMeasurementError('Git history is missing local objects')
+    await runGitLines(root, ['rev-list', '--objects', '--no-object-names', '--missing=print', 'HEAD'], line => {
+      if (/^\?[0-9a-f]+$/.test(line)) throw new GitMeasurementError('Git history is missing local objects')
+    })
     const measuredAt = new Date().toISOString()
     const result = await analyzeDurability(root, {
       windowDays: 90, settleDays: 14,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalequality/check",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "ScaleQuality continuous code-maturity check for CI. Re-measures your repo on every build and fails the pipeline below your maturity line.",
   "type": "module",
   "bin": {