@seanyao/roll 2026.601.3 → 2026.601.4

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## v2026.601.4
+
+### 稳定性
+
+- **从 `.roll/` 子目录跑 `roll` 不再误报"老结构"(FIX-156)** — `.roll/` 是嵌套 roll-meta git repo,从那里跑 `roll loop status` 等命令时 `git rev-parse` 会返回 `.roll/` 自己当 root,然后旧的"新结构存在?"检查找 `.roll/.roll` 找不到,又看到 `.roll/` 里满地 Roll 内容,就误报"老结构、要 migrate";现在检查会向上找直到 `.roll/` 的父目录,认出"这就是该 Roll 项目的私有过程仓",不再误报 `[loop]`
+- **peer review 死等终结(FIX-150c)** — 此前 peer 调用挂了就是无限挂,等不到 verdict cycle 就跟着挂;现在 wall-clock 超 `peer_call_timeout`(默认 3min)直接 SIGTERM/SIGKILL 干掉跑挂的 agent,tmux 内的也送 Ctrl-C 中断,设全局标志 `_PEER_LAST_TIMED_OUT` 让上层落 ledger 用,绝不无限等 `[loop]`
+
 ## v2026.601.3
 
 ### 可见性

package/bin/roll

@@ -4,7 +4,7 @@ set -euo pipefail
 # Roll — AI Agent Convention Manager
 # Single source of truth for how all AI coding agents behave.
 
-VERSION="2026.601.3"
+VERSION="2026.601.4"
 ROLL_HOME="${ROLL_HOME:-${HOME}/.roll}"
 ROLL_CONFIG="${ROLL_HOME}/config.yaml"
 ROLL_GLOBAL="${ROLL_HOME}/conventions/global"
@@ -3879,7 +3879,18 @@ _peer_dispatch_in_tmux() {
     sleep 1
     elapsed=$((elapsed + 1))
   done
+  # FIX-150c: if we hit the wall clock without the done marker, the agent
+  # is still running inside the tmux session. Send Ctrl-C to interrupt it
+  # so the cycle doesn't hang on a peer that's no longer being awaited.
+  # Return 1 (timed out) vs 0 (completed within budget); _peer_call lifts
+  # this into the global _PEER_LAST_TIMED_OUT flag.
+  local _timed_out=0
+  if [[ ! -f "$done_file" ]]; then
+    tmux send-keys -t "${session}:0" C-c 2>/dev/null || true
+    _timed_out=1
+  fi
   rm -f "$done_file"
+  return "$_timed_out"
 }
 
 _peer_call() {
@@ -3892,6 +3903,11 @@ _peer_call() {
   local call_timeout
   call_timeout="$(config_get "peer_call_timeout" "180")"
 
+  # FIX-150c: signal back to caller whether this call hit the wall-clock
+  # limit. Caller (_peer_*_state, ledger writer) records "timeout" verdict.
+  # Reset per call so callers reading the previous result don't mis-attribute.
+  _PEER_LAST_TIMED_OUT=0
+
   info "$(msg status.peer_call_timeout_s_peer ${call_timeout})"
 
   if [[ -n "$session" ]] && command -v tmux >/dev/null 2>&1 && tmux has-session -t "$session" 2>/dev/null; then
@@ -3903,14 +3919,50 @@ _peer_call() {
       return 1
     }
     _peer_dispatch_in_tmux "$session" "$cmd_str" "$out_file" "$stderr_log" "$call_timeout"
+    local _dispatch_rc=$?
     output="$(cat "$out_file" 2>/dev/null || true)"
     rm -f "$out_file"
+    if [[ "$_dispatch_rc" -ne 0 ]]; then
+      _PEER_LAST_TIMED_OUT=1
+      warn "$(msg status.peer_call_timeout_killed "$to" "$call_timeout")"
+    fi
   else
     _agent_argv "$to" peer "$prompt" || {
       err "$(msg status.unsupported_peer_2 $to)"
       return 1
     }
-    output="$("${_AGENT_ARGV[@]}" 2>"$stderr_log" || true)"
+    # FIX-150c: hard timeout for non-tmux path. macOS has no `timeout`(1),
+    # so use a background watchdog that SIGTERMs (then SIGKILLs after 2 s
+    # grace) the agent process when it overruns. Output captured via tmp
+    # file because we can't keep it in $output while juggling pids.
+    # `wait` returns the agent's exit code; with `set -e` enabled by the
+    # caller (loops, hooks, bats), a non-zero from the killed agent would
+    # short-circuit out before we can read it — `|| _peer_exit=$?` keeps
+    # the value flowing into the timeout check.
+    local _out _peer_exit=0 _peer_pid _watchdog_pid
+    _out=$(mktemp)
+    "${_AGENT_ARGV[@]}" >"$_out" 2>"$stderr_log" &
+    _peer_pid=$!
+    (
+      sleep "$call_timeout"
+      kill -TERM "$_peer_pid" 2>/dev/null && {
+        sleep 2
+        kill -KILL "$_peer_pid" 2>/dev/null
+      }
+    ) &
+    _watchdog_pid=$!
+    wait "$_peer_pid" 2>/dev/null || _peer_exit=$?
+    # Cancel watchdog if agent finished on time.
+    kill "$_watchdog_pid" 2>/dev/null || true
+    wait "$_watchdog_pid" 2>/dev/null || true
+    output="$(cat "$_out" 2>/dev/null || true)"
+    rm -f "$_out"
+    # SIGTERM kill → 143, SIGKILL → 137. Either means we tripped the
+    # timeout watchdog (agent itself doesn't normally exit with those).
+    if [[ "$_peer_exit" -eq 143 || "$_peer_exit" -eq 137 ]]; then
+      _PEER_LAST_TIMED_OUT=1
+      warn "$(msg status.peer_call_timeout_killed "$to" "$call_timeout")"
+    fi
   fi
 
   printf '%s\n' "$output"
@@ -15053,6 +15105,21 @@ _check_structure() {
   # If new structure exists, allow
   [[ -d "$root/.roll" ]] && return 0
 
+  # FIX-156: nested-repo escape — when cwd is inside `.roll/` (a Roll project's
+  # nested private roll-meta worktree), git rev-parse returns `.roll/` itself
+  # instead of the outer Roll project, so the check above misses the outer
+  # `.roll/` and trips the legacy warning on the project's own roll-meta files
+  # (which contain BACKLOG.md / etc by definition). Walk up from $root and
+  # allow when any ancestor directory has a `.roll/` sibling — that is the
+  # outer Roll project, and the user is operating on it from a sub-checkout.
+  local _probe; _probe="$(dirname "$root")"
+  while [[ "$_probe" != "/" && "$_probe" != "." && -n "$_probe" ]]; do
+    if [[ -d "$_probe/.roll" ]]; then return 0; fi
+    local _parent; _parent="$(dirname "$_probe")"
+    [[ "$_parent" == "$_probe" ]] && break  # reached fs root
+    _probe="$_parent"
+  done
+
   # US-ONBOARD-019: only treat the directory as a legacy *Roll* project when an
   # old-path marker is present AND a Roll-specific content signature confirms
   # the project was actually onboarded with Roll. Otherwise we'd block any

package/lib/i18n/status.sh

@@ -13,6 +13,8 @@ _i18n_set en status.in_sync "  %s=%s %s: %s (in sync /"
 _i18n_set zh status.in_sync "已同步)"
 _i18n_set en status.peer_call_timeout_s_peer "Peer call timeout: %ss  Peer"
 _i18n_set zh status.peer_call_timeout_s_peer "调用超时: %ss"
+_i18n_set en status.peer_call_timeout_killed "Peer %s killed after %ss wall-clock budget (FIX-150c)"
+_i18n_set zh status.peer_call_timeout_killed "Peer %s 超过 %ss 上限,已强制终止 (FIX-150c)"
 _i18n_set en status.unsupported_peer "Unsupported peer: %s"
 _i18n_set zh status.unsupported_peer "不支持的 peer: %s"
 _i18n_set en status.unsupported_peer_2 "Unsupported peer: %s"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seanyao/roll",
-  "version": "2026.601.3",
+  "version": "2026.601.4",
   "description": "Roll — Roll out features with AI agents",
   "scripts": {
     "test": "bash tests/run.sh"