@signalridge/pi-worktree 1.4.4 → 1.4.5

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 1.4.5
+### Patch Changes
+
+- c2fd867: Bound stdin Git cancellation and timeout cleanup with owned TERM-to-KILL escalation and a final confirmation deadline. Retain every concurrent unconfirmed handle per cwd/argv key and refuse equivalent replacements while any failed owner remains live; one late exit cannot release another owner's lease. Release retained handle leases on late actual exit without requiring a retry, and preserve captured output and signal-failure diagnostics through GitWorktreeError wrapping.
+- Updated dependencies [c2fd867]
+  - @signalridge/pi-ui@1.4.0
+
 ## 1.4.4
 ### Patch Changes
 

package/README.md

@@ -23,6 +23,8 @@ This package is the full interactive worktree manager. It is publishable and sta
 - Always previews stale metadata before pruning it and revalidates the preview after confirmation.
 - Runs Git through argv-based subprocess calls, without interpolating user input into shell commands.
 
+Stdin Git cancellation and timeout use bounded TERM/KILL escalation on the captured process handle. If termination remains unconfirmed, equivalent cwd/argv invocations are blocked until every failed live handle exits, including when multiple invocations were already concurrent. A late exit releases only its own handle; no saved PID is adopted or signaled. Captured output and signal failure diagnostics remain available for recovery.
+
 ## Install
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@signalridge/pi-worktree",
-  "version": "1.4.4",
+  "version": "1.4.5",
   "description": "Pi extension for safe interactive Git worktree management and workspace switching.",
   "type": "module",
   "license": "MIT",
@@ -60,7 +60,7 @@
   },
   "dependencies": {
     "@narumitw/pi-tui-kit": "^0.54.0",
-    "@signalridge/pi-ui": "^1.3.3",
+    "@signalridge/pi-ui": "^1.4.0",
     "proper-lockfile": "^4.1.2"
   }
 }

package/src/git-input.ts

@@ -0,0 +1,178 @@
+import { type ChildProcessWithoutNullStreams, spawn } from "node:child_process";
+import type { ExecResult } from "@earendil-works/pi-coding-agent";
+
+// An unconfirmed process remains owned by its actual handle. Never signal a
+// saved PID or allow an equivalent invocation to replace it while still alive.
+const unconfirmed = new Map<string, Set<ChildProcessWithoutNullStreams>>();
+const TERM_GRACE_MS = 250;
+const CONFIRMATION_MS = 1_000;
+
+type SignalAttempt = { signal: NodeJS.Signals; accepted: boolean; error?: Error };
+
+/** Captured diagnostics without inventing an exit code for an unconfirmed process. */
+export class GitInputError extends Error {
+  readonly stdout: string;
+  readonly stderr: string;
+  readonly reason: string;
+  readonly terminationConfirmed: boolean;
+  readonly signals: readonly SignalAttempt[];
+
+  constructor(
+    message: string,
+    stdout: string,
+    stderr: string,
+    reason: string,
+    terminationConfirmed: boolean,
+    signals: readonly SignalAttempt[],
+    cause?: Error,
+  ) {
+    super(message, { cause });
+    this.name = "GitInputError";
+    this.stdout = stdout;
+    this.stderr = stderr;
+    this.reason = reason;
+    this.terminationConfirmed = terminationConfirmed;
+    this.signals = [...signals];
+  }
+}
+
+function retainUntilExit(key: string, child: ChildProcessWithoutNullStreams): void {
+  let owners = unconfirmed.get(key);
+  if (!owners) {
+    owners = new Set();
+    unconfirmed.set(key, owners);
+  }
+  owners.add(child);
+  const release = () => {
+    owners.delete(child);
+    if (owners.size === 0 && unconfirmed.get(key) === owners) unconfirmed.delete(key);
+    child.removeListener("exit", release);
+    child.removeListener("close", release);
+  };
+  child.once("exit", release);
+  child.once("close", release);
+  if (child.exitCode !== null || child.signalCode !== null) release();
+}
+
+export function runGitInput(
+  args: string[],
+  cwd: string,
+  input: string,
+  signal?: AbortSignal,
+  timeout = 15_000,
+): Promise<ExecResult> {
+  const key = JSON.stringify([cwd, args]);
+  const previous = unconfirmed.get(key);
+  if (previous) {
+    for (const child of previous) {
+      if (child.exitCode === null && child.signalCode === null) {
+        return Promise.reject(
+          new Error("Previous Git termination is unconfirmed. Check the owned Git process and retry after it exits."),
+        );
+      }
+    }
+    unconfirmed.delete(key);
+  }
+  if (signal?.aborted) return Promise.resolve({ stdout: "", stderr: "", code: 1, killed: true });
+  return new Promise((resolve, reject) => {
+    const child = spawn("git", args, { cwd, stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    let stopping = false;
+    let reason = "";
+    let failure: Error | undefined;
+    const signals: SignalAttempt[] = [];
+    const capturedFailure = (message: string, confirmed: boolean, cause?: Error) =>
+      new GitInputError(message, stdout, stderr, reason, confirmed, signals, cause);
+    let escalation: ReturnType<typeof setTimeout> | undefined;
+    let confirmation: ReturnType<typeof setTimeout> | undefined;
+    const cleanup = () => {
+      clearTimeout(deadline);
+      clearTimeout(escalation);
+      clearTimeout(confirmation);
+      signal?.removeEventListener("abort", abort);
+      child.removeListener("error", error);
+      child.removeListener("close", close);
+      child.stdin.removeListener("error", inputError);
+      child.stdout.removeListener("data", output);
+      child.stderr.removeListener("data", diagnostics);
+      child.stdin.destroy();
+      child.stdout.destroy();
+      child.stderr.destroy();
+    };
+    const finish = (result?: ExecResult, error?: Error) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      if (error) reject(error);
+      else if (result) resolve(result);
+    };
+    const sendSignal = (name: NodeJS.Signals) => {
+      try {
+        const accepted = child.kill(name);
+        signals.push({ signal: name, accepted });
+        if (!accepted) failure ??= new Error(`Git did not accept ${name}.`);
+      } catch (error) {
+        const cause = error instanceof Error ? error : new Error(String(error));
+        signals.push({ signal: name, accepted: false, error: cause });
+        failure ??= cause;
+      }
+    };
+    const stop = (why: string) => {
+      if (settled || stopping) return;
+      stopping = true;
+      reason = why;
+      clearTimeout(deadline);
+      sendSignal("SIGTERM");
+      escalation = setTimeout(() => {
+        if (settled) return;
+        sendSignal("SIGKILL");
+        confirmation = setTimeout(() => {
+          if (settled) return;
+          retainUntilExit(key, child);
+          finish(
+            undefined,
+            capturedFailure(
+              `Git termination could not be confirmed after ${reason}. Check the owned Git process before retrying.${failure ? ` ${failure.message}` : ""}`,
+              false,
+              failure,
+            ),
+          );
+        }, CONFIRMATION_MS);
+      }, TERM_GRACE_MS);
+    };
+    const abort = () => stop("cancellation");
+    const error = (value: Error) => {
+      failure = value;
+      if (child.pid === undefined) finish(undefined, capturedFailure(value.message, true, value));
+      else stop("process failure");
+    };
+    const inputError = (value: NodeJS.ErrnoException) => {
+      if (value.code !== "EPIPE") error(value);
+    };
+    const output = (chunk: string) => {
+      stdout += chunk;
+    };
+    const diagnostics = (chunk: string) => {
+      stderr += chunk;
+    };
+    const close = (code: number | null, closeSignal: NodeJS.Signals | null) => {
+      finish(
+        { stdout, stderr, code: code ?? 1, killed: stopping || closeSignal !== null },
+        failure ? capturedFailure(failure.message, true, failure) : undefined,
+      );
+    };
+    const deadline = setTimeout(() => stop(`${timeout}ms timeout`), timeout);
+    child.stdout.setEncoding("utf8");
+    child.stderr.setEncoding("utf8");
+    child.stdout.on("data", output);
+    child.stderr.on("data", diagnostics);
+    child.stdin.on("error", inputError);
+    child.once("error", error);
+    child.once("close", close);
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted) abort();
+    child.stdin.end(input);
+  });
+}

package/src/git.ts

@@ -1,10 +1,10 @@
-import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync } from "node:fs";
 import { lstat, readdir, rename, rmdir, unlink } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import type { ExecResult, ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import lockfile from "proper-lockfile";
+import { GitInputError, runGitInput } from "./git-input.ts";
 
 const GIT_TIMEOUT_MS = 15_000;
 const GIT_MUTATION_TIMEOUT_MS = 60_000;
@@ -63,9 +63,15 @@ interface GitExecOptions {
 
 export class GitWorktreeError extends Error {
   readonly args?: readonly string[];
-
-  constructor(message: string, args?: readonly string[]) {
-    super(message);
+  readonly stdout?: string;
+  readonly stderr?: string;
+
+  constructor(message: string, args?: readonly string[], cause?: unknown) {
+    super(message, { cause });
+    if (cause instanceof GitInputError) {
+      this.stdout = cause.stdout;
+      this.stderr = cause.stderr;
+    }
     this.name = "GitWorktreeError";
     this.args = args;
   }
@@ -1221,65 +1227,13 @@ function runGitWithInputAllowFailure(
   if (signal?.aborted) {
     return Promise.resolve({ stdout: "", stderr: "", code: 1, killed: true });
   }
-  return new Promise((resolveResult, reject) => {
-    // ExtensionAPI.exec has no stdin channel, so this read-only check uses an argv-only child.
-    const child = spawn("git", args, {
-      cwd,
-      stdio: ["pipe", "pipe", "pipe"],
-      windowsHide: true,
-    });
-    let stdout = "";
-    let stderr = "";
-    let killed = false;
-    let settled = false;
-    const finish = (result: ExecResult) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timeoutHandle);
-      signal?.removeEventListener("abort", stop);
-      resolveResult(result);
-    };
-    const fail = (error: unknown) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timeoutHandle);
-      signal?.removeEventListener("abort", stop);
-      child.kill();
-      const message = formatError(error);
-      reject(
-        /\bENOENT\b|not found/i.test(message)
-          ? new GitWorktreeError("Git executable was not found. Install Git and retry.", args)
-          : new GitWorktreeError(`Could not start git ${args.slice(0, 2).join(" ")}: ${message}`, args),
-      );
-    };
-    const stop = () => {
-      killed = true;
-      child.kill();
-    };
-    const timeoutHandle = setTimeout(stop, timeout);
-    child.stdout.setEncoding("utf8");
-    child.stderr.setEncoding("utf8");
-    child.stdout.on("data", (chunk: string) => {
-      stdout += chunk;
-    });
-    child.stderr.on("data", (chunk: string) => {
-      stderr += chunk;
-    });
-    child.stdin.on("error", (error) => {
-      if (!isNodeError(error) || error.code !== "EPIPE") fail(error);
-    });
-    child.once("error", fail);
-    child.once("close", (code, closeSignal) => {
-      finish({
-        stdout,
-        stderr,
-        code: code ?? 1,
-        killed: killed || closeSignal !== null,
-      });
-    });
-    signal?.addEventListener("abort", stop, { once: true });
-    if (signal?.aborted) stop();
-    child.stdin.end(input);
+  // ExtensionAPI.exec has no stdin channel. This local argv-only owner bounds
+  // both cancellation and timeout cleanup without changing native Git settings.
+  return runGitInput(args, cwd, input, signal, timeout).catch((error: unknown) => {
+    const message = formatError(error);
+    throw /\bENOENT\b|not found/i.test(message)
+      ? new GitWorktreeError("Git executable was not found. Install Git and retry.", args, error)
+      : new GitWorktreeError(`git ${args.slice(0, 2).join(" ")}: ${message}`, args, error);
   });
 }