@tea-agent/loop-agent 0.33.6-beta.0 → 0.33.6

package/dist/commands/init.js

@@ -1414,6 +1414,70 @@ async function readExistingSurfaceState(repoRoot) {
         return undefined;
     return parsed;
 }
+/** The IDE schema reference remains a structural update signal. */
+const HARNESS_STRUCTURAL_VALUE_KEYS = new Set(["$schema"]);
+const PI_MODEL_ROUTING_KEYS = new Set(["LOW", "MED", "HIGH", "defaultModel"]);
+function isPiModelRoutingPath(path) {
+    return path.length === 2 && path[0] === "executors" && path[1] === "pi";
+}
+/**
+ * Attribute-set iteration comparison for harness.json: object key shapes must
+ * agree at every level, except that the Pi model-routing fields are opaque
+ * project-owned configuration. Scalars and array contents may otherwise differ
+ * freely unless the key is structurally sensitive.
+ */
+function harnessJsonShapeMatches(current, desired, path = []) {
+    if (isRecord(current) || isRecord(desired)) {
+        if (!isRecord(current) || !isRecord(desired))
+            return false;
+        const filterKeys = (value) => Object.keys(value)
+            .filter((key) => !isPiModelRoutingPath(path) || !PI_MODEL_ROUTING_KEYS.has(key))
+            .sort();
+        const currentKeys = filterKeys(current);
+        const desiredKeys = filterKeys(desired);
+        if (currentKeys.length !== desiredKeys.length)
+            return false;
+        for (let index = 0; index < currentKeys.length; index += 1) {
+            const key = currentKeys[index];
+            if (key !== desiredKeys[index])
+                return false;
+            if (HARNESS_STRUCTURAL_VALUE_KEYS.has(key)) {
+                if (!isDeepStrictEqual(current[key], desired[key]))
+                    return false;
+                continue;
+            }
+            if (!harnessJsonShapeMatches(current[key], desired[key], [...path, key])) {
+                return false;
+            }
+        }
+        return true;
+    }
+    return true;
+}
+/**
+ * Stable package/source anchor for generated desired content: sha256 of the
+ * desired content re-rendered through buildDesiredSurfaceContent with fixed
+ * sentinel identity values (PROJECT_NAME_TOKEN / GOVERNANCE_ROOT_TOKEN). The
+ * anchor is therefore deterministic and invariant to the real project name and
+ * governance root: a project rename or governance-root change never invalidates
+ * a previously accepted semantic merge, while package/template content changes
+ * still do. Rendering with sentinels (instead of reverse split/join replacement
+ * on already-rendered bytes) avoids false drift when a real project name is a
+ * common substring such as `init` or `docs`.
+ */
+async function stableDesiredSourceAnchor(input) {
+    const manifestPath = targetPathToManifestPath(input.entry.path, input.governanceRoot);
+    const sentinel = await buildDesiredSurfaceContent({
+        assetRoot: input.assetRoot,
+        repoRoot: input.repoRoot,
+        projectName: PROJECT_NAME_TOKEN,
+        governanceRoot: GOVERNANCE_ROOT_TOKEN,
+        entry: { ...input.entry, path: manifestPath },
+    });
+    return sentinel.content === undefined
+        ? undefined
+        : sha256Text(sentinel.content);
+}
 /**
  * Lightweight read-only preflight for the post-upgrade init surface notifier.
  *
@@ -1458,10 +1522,20 @@ async function buildCurrentSurfaceState(input) {
             entry: manifestEntry,
         });
         const sourceSha256 = desired.content === undefined ? undefined : sha256Text(desired.content);
+        const sourceAnchorSha256 = entry.mode !== "generated" || desired.content === undefined
+            ? undefined
+            : await stableDesiredSourceAnchor({
+                assetRoot,
+                repoRoot: input.repoRoot,
+                projectName: input.projectName,
+                governanceRoot: input.governanceRoot,
+                entry,
+            });
         const base = {
             status: targetStat ? "present" : "missing",
             relationship: "missing-from-target",
             sourceSha256,
+            sourceAnchorSha256,
             sourcePath: desired.sourcePath
                 ? repoRelative(assetRoot, desired.sourcePath)
                 : undefined,
@@ -1510,7 +1584,7 @@ async function buildCurrentSurfaceState(input) {
         if (targetRelativePath === "harness.json" &&
             desired.content !== undefined) {
             try {
-                semanticallyMatchesGeneratedJson = isDeepStrictEqual(JSON.parse(current.toString("utf-8")), JSON.parse(desired.content));
+                semanticallyMatchesGeneratedJson = harnessJsonShapeMatches(JSON.parse(current.toString("utf-8")), JSON.parse(desired.content));
             }
             catch {
                 // Invalid JSON remains local-existing-unknown for model merge / doctor.
@@ -1563,6 +1637,9 @@ async function writeInitSurfaceState(input) {
             harness.acceptedMerge = {
                 currentSha256: harness.currentSha256,
                 desiredSha256: harness.sourceSha256,
+                ...(harness.sourceAnchorSha256 !== undefined
+                    ? { sourceAnchorSha256: harness.sourceAnchorSha256 }
+                    : {}),
             };
         }
     }
@@ -2729,6 +2806,7 @@ function modelMergeTaskFor(pathName, state, allPaths, recordedState) {
             baseSha256: recordedState?.files[pathName]?.currentSha256,
             currentSha256: state.currentSha256,
             desiredSha256: state.sourceSha256,
+            sourceAnchorSha256: state.sourceAnchorSha256,
         },
     };
 }
@@ -2847,8 +2925,16 @@ export async function checkInitUpdate(input) {
         if (state.relationship === "local-existing-unknown") {
             const acceptedMerge = recordedState?.files[pathName]?.acceptedMerge;
             if (acceptedMerge) {
+                // Generated acceptance is bound to the stable source anchor so that
+                // project-derived desired drift (projectName/governanceRoot changes)
+                // cannot invalidate an already accepted merge. Copied files remain
+                // byte-strict; desiredSha256 stays the audit receipt in both cases.
+                const anchorAccepted = state.mode === "generated" &&
+                    state.sourceAnchorSha256 !== undefined &&
+                    acceptedMerge.sourceAnchorSha256 === state.sourceAnchorSha256;
                 if (acceptedMerge.currentSha256 === state.currentSha256 &&
-                    acceptedMerge.desiredSha256 === state.sourceSha256) {
+                    (anchorAccepted ||
+                        acceptedMerge.desiredSha256 === state.sourceSha256)) {
                     continue;
                 }
                 // A previously accepted semantic merge is user-preserving ownership.
@@ -2906,7 +2992,12 @@ export async function checkInitUpdate(input) {
                     reason: `replace the legacy default governanceRoot docs with ${governanceRoot}`,
                 });
             }
-            if (isRecord(harness)) {
+            // A harness that already matches the current generated surface except for
+            // opaque Pi routing fields is modern, not a legacy-routing candidate.
+            // Keep the explicit migration assessment for every other harness shape.
+            if (isRecord(harness) &&
+                currentState.files["harness.json"]?.relationship !==
+                    "matches-current-generated") {
                 const modelMigration = assessHarnessModelMigration(harness);
                 if (modelMigration.kind === "safe") {
                     deterministicActions.push({

package/dist/executors/shell-write-guard.js

@@ -4,6 +4,7 @@ import { constants, createReadStream } from "node:fs";
 import { access, lstat, readlink, unlink } from "node:fs/promises";
 import path from "node:path";
 import { pathMatchesPattern } from "../shared/git-progress.js";
+import { ResilientGitCommandError, runResilientGitCommand, } from "../shared/resilient-git.js";
 async function sha256File(filePath) {
     const hash = createHash("sha256");
     for await (const chunk of createReadStream(filePath)) {
@@ -401,14 +402,31 @@ async function resolveGitExecutableCandidates(platform, env) {
     return ["git"];
 }
 export async function readGitStatusPorcelain(cwd, options = {}) {
-    return readGitStatusPorcelainWithDependencies(cwd, options, {
-        platform: process.platform,
-        resolveExecutableCandidates: () => resolveGitExecutableCandidates(process.platform, process.env),
-        runAttempt: readGitStatusPorcelainOnce,
-        sleep: async (delayMs) => new Promise((resolve) => setTimeout(resolve, delayMs)),
-        now: Date.now,
-        env: process.env,
-    });
+    try {
+        const result = await runResilientGitCommand({
+            cwd,
+            args: ["status", "--porcelain=v1", "--untracked-files=all"],
+            readOnly: true,
+            attempts: options.attempts,
+            retryDelayMs: options.retryDelayMs,
+        });
+        if (result.code === 0)
+            return result.stdout;
+        throw new Error(result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`);
+    }
+    catch (error) {
+        if (error instanceof ResilientGitCommandError) {
+            throw new GitStatusUnavailableError({
+                cwd,
+                phase: options.phase,
+                platform: error.diagnostics.platform,
+                executableCandidates: error.diagnostics.executableCandidates,
+                attempts: error.diagnostics.attempts,
+                requiredWindowsEnvironment: requiredWindowsEnvironment(process.env),
+            });
+        }
+        throw error;
+    }
 }
 export async function readGitStatusPorcelainWithDependencies(cwd, options, dependencies) {
     const candidates = await dependencies.resolveExecutableCandidates();

package/dist/shared/operator/capabilities.js

@@ -699,6 +699,36 @@ export function buildOperatorCapabilitiesDocument() {
             modelCallable: "always",
             humanConfirmation: "none",
         },
+        {
+            action: "prepareDagExecution",
+            cli: "console aggregate execution receipt (server-side G2 assessment)",
+            kind: "read",
+            inputSchemaVersion: 1,
+            resultSchemaVersion: 1,
+            envelopeSchemaVersion: 1,
+            requiredErrorCodes: [
+                "INVALID_INPUT",
+                "BINDING_DRIFT",
+                "HUMAN_CONFIRMATION_REQUIRED",
+            ],
+            description: "Issue a session-bound single-use execution receipt after server-side G2 assessment (bounded writeSet ⊆ allowedPaths, no forbidden overlap, no broad/destructive risk, structured verification). The model never passes a raw DAG path.",
+            inputParams: [
+                {
+                    name: "taskId",
+                    type: "string",
+                    required: true,
+                    description: "task id",
+                },
+                {
+                    name: "profile",
+                    type: "string",
+                    required: false,
+                    description: "DAG profile (defaults to auto)",
+                },
+            ],
+            modelCallable: "always",
+            humanConfirmation: "none",
+        },
         {
             action: "confirmDagConfirmation",
             cli: "console aggregate confirmation human challenge (server-side)",
@@ -901,7 +931,7 @@ export function buildOperatorCapabilitiesDocument() {
         },
         {
             action: "runDag",
-            cli: "loop-agent task advance <taskId> --approve-gate <id:digest> --json | dag execute --dag <path>",
+            cli: "loop-agent task advance <taskId> --approve-gate <id:digest> --json | dag execute --dag <staged-path>",
             kind: "long-running",
             inputSchemaVersion: 1,
             resultSchemaVersion: 1,
@@ -911,19 +941,20 @@ export function buildOperatorCapabilitiesDocument() {
                 "CONTROLLER_MISMATCH",
                 "INVALID_INPUT",
             ],
-            description: "Execute reviewed DAG after human confirmation (prefer task advance --approve-gate when gate token present).",
+            description: "Consume a single-use execution receipt and execute the reviewed DAG (prefer task advance --approve-gate when gate token present). accepted/queued/running/operationId are NOT completion — supervise via operationGet/status/dagReport/dagDoctor.",
             inputParams: [
                 {
-                    name: "confirmationId",
+                    name: "executionId",
                     type: "string",
                     required: true,
-                    description: "confirmation id (from prepareDagConfirmation) — raw dag path is never accepted from the model",
+                    description: "execution id (from prepareDagExecution) — raw dag path is never accepted from the model",
                 },
             ],
-            // prepare-only: the model can invoke runDag but it MUST carry a
-            // confirmationId that was consumed by a human-origin confirm (M0-B).
-            modelCallable: "prepare-only",
-            humanConfirmation: "required",
+            // always: the model can invoke runDag with a server-issued executionId.
+            // The server re-validates staged bytes/hash + bindings at consume time
+            // (2026-08-11 autonomous DAG supervision; receipt replaces browser gate).
+            modelCallable: "always",
+            humanConfirmation: "none",
         },
         {
             action: "dagRerunPlan",
@@ -963,7 +994,7 @@ export function buildOperatorCapabilitiesDocument() {
                 "BINDING_DRIFT",
                 "INVALID_INPUT",
             ],
-            description: "Execute R1 continuation from effective node. Requires planHash from a fresh dagRerunPlan (eligible=true). Prefer this over new task / standaloneTaskRerun for provider flake and safe downstream failures. Human Gate required.",
+            description: "Execute R1 continuation from effective node. Requires planHash from a fresh dagRerunPlan (eligible=true). Prefer this over new task / standaloneTaskRerun for provider flake and safe downstream failures. Server enforces planHash/binding/fingerprint freshness.",
             inputParams: [
                 {
                     name: "runId",
@@ -990,8 +1021,11 @@ export function buildOperatorCapabilitiesDocument() {
                     description: "why continue from this node (e.g. provider flake; resume from review-pi)",
                 },
             ],
-            modelCallable: "prepare-only",
-            humanConfirmation: "required",
+            // always: fresh eligible dagRerun plans are model-callable (2026-08-11).
+            // The CLI keeps enforcing parent lifecycle, fromNode, planHash,
+            // binding/fingerprint and request idempotency.
+            modelCallable: "always",
+            humanConfirmation: "none",
         },
         {
             action: "prepareMutationGate",
@@ -1001,13 +1035,13 @@ export function buildOperatorCapabilitiesDocument() {
             resultSchemaVersion: 1,
             envelopeSchemaVersion: 1,
             requiredErrorCodes: ["INVALID_INPUT", "NOT_FOUND"],
-            description: "Prepare a one-shot Human Gate receipt for standaloneTaskRerun / workerTaskRetry / Night Scheduler mutations. Model may prepare; only the browser mutation gate may consume.",
+            description: "Prepare a one-shot Human Gate receipt for Night Scheduler mutations. Model may prepare; only the browser mutation gate may consume.",
             inputParams: [
                 {
                     name: "action",
                     type: "string",
                     required: true,
-                    description: "target action: standaloneTaskRerun | workerTaskRetry | workerAdmissionPrepare | workerSchedulerAdd | workerSchedulerCancel | workerSchedulerHarvest | workerSchedulerDiscard",
+                    description: "target action: workerAdmissionPrepare | workerSchedulerAdd | workerSchedulerCancel | workerSchedulerHarvest | workerSchedulerDiscard",
                 },
                 {
                     name: "actionParams",
@@ -1259,7 +1293,7 @@ export function buildOperatorCapabilitiesDocument() {
                 "INVALID_INPUT",
                 "HUMAN_CONFIRMATION_REQUIRED",
             ],
-            description: "Full standalone task regenerate → validate → execute with parent lineage.",
+            description: "Full standalone task regenerate → validate → execute with parent lineage. Only when node rerun plan is ineligible or primaryRecovery recommends rerun-task; the server checks read-only run facts before accepting.",
             inputParams: [
                 {
                     name: "runId",
@@ -1274,20 +1308,22 @@ export function buildOperatorCapabilitiesDocument() {
                     description: "rerun reason",
                 },
                 {
-                    name: "confirmationId",
+                    name: "profile",
                     type: "string",
-                    required: true,
-                    description: "mutation-gate receipt id from prepareMutationGate",
+                    required: false,
+                    description: "DAG profile (defaults to auto)",
                 },
                 {
-                    name: "humanGateToken",
-                    type: "object",
-                    required: true,
-                    description: "server-signed human-gate token from prepareMutationGate",
+                    name: "taskId",
+                    type: "string",
+                    required: false,
+                    description: "original task id (must match the run's task binding; never invent a new task-id)",
                 },
             ],
-            modelCallable: "prepare-only",
-            humanConfirmation: "required",
+            // always: the server gate is the read-only run-facts check (2026-08-11);
+            // no browser Human Gate token is required for safe same-task rerun.
+            modelCallable: "always",
+            humanConfirmation: "none",
         },
         {
             action: "workerTaskRetry",
@@ -1301,7 +1337,7 @@ export function buildOperatorCapabilitiesDocument() {
                 "INVALID_INPUT",
                 "HUMAN_CONFIRMATION_REQUIRED",
             ],
-            description: "Requeue failed Task Pool task (Failed → Ready) via in-package pool store.",
+            description: "Requeue failed Task Pool task (Failed → Ready) via in-package pool store. Only when read-only validation confirms the task exists in Failed state; the server checks this before accepting.",
             inputParams: [
                 {
                     name: "taskId",
@@ -1321,21 +1357,11 @@ export function buildOperatorCapabilitiesDocument() {
                     required: true,
                     description: "retry reason",
                 },
-                {
-                    name: "confirmationId",
-                    type: "string",
-                    required: true,
-                    description: "mutation-gate receipt id from prepareMutationGate",
-                },
-                {
-                    name: "humanGateToken",
-                    type: "object",
-                    required: true,
-                    description: "server-signed human-gate token from prepareMutationGate",
-                },
             ],
-            modelCallable: "prepare-only",
-            humanConfirmation: "required",
+            // always: the server gate is the read-only worker task facts check
+            // (2026-08-11); no browser Human Gate token is required.
+            modelCallable: "always",
+            humanConfirmation: "none",
         },
         ...OFFICIAL_ACTIONS,
     ];
@@ -1411,9 +1437,10 @@ export const OPERATOR_COMMAND_COVERAGE = Object.freeze([
     },
     {
         command: "loop-agent dag execute",
-        coverage: "human-gated-required",
+        coverage: "model-callable",
         action: "runDag",
         source: "loop-agent",
+        note: "runDag consumes a server-issued single-use execution receipt (prepareDagExecution); browser Human Gate no longer required for bounded DAGs (2026-08-11).",
     },
     {
         command: "loop-agent cursor-prompt",
@@ -1829,15 +1856,17 @@ export const OPERATOR_COMMAND_COVERAGE = Object.freeze([
     },
     {
         command: "loop-agent dag rerun",
-        coverage: "human-gated-required",
+        coverage: "model-callable",
         action: "dagRerun",
         source: "loop-agent",
+        note: "fresh eligible dagRerunPlan (planHash) is model-callable; the CLI still enforces plan/binding/fingerprint freshness (2026-08-11).",
     },
     {
         command: "loop-agent dag rerun-task",
-        coverage: "human-gated-required",
+        coverage: "model-callable",
         action: "standaloneTaskRerun",
         source: "loop-agent",
+        note: "server-side read-only run-facts check (ineligible plan / explicit rerun-task recommendation) replaces the browser Human Gate (2026-08-11).",
     },
     {
         command: "loop-agent dag reconcile-tasks",
@@ -2069,9 +2098,10 @@ export const OPERATOR_COMMAND_COVERAGE = Object.freeze([
     },
     {
         command: "agent-worker task retry",
-        coverage: "human-gated-required",
+        coverage: "model-callable",
         action: "workerTaskRetry",
         source: "agent-worker",
+        note: "server-side read-only pool doctor facts check (Failed state) replaces the browser Human Gate (2026-08-11).",
     },
     {
         command: "agent-worker task draft-followup",

package/dist/shared/resilient-git.js

@@ -0,0 +1,133 @@
+import { spawn } from "node:child_process";
+import { access, constants } from "node:fs/promises";
+import path from "node:path";
+/** Thrown only for spawn/infrastructure failures or exhausted eligible startup retries. */
+export class ResilientGitCommandError extends Error {
+    diagnostics;
+    constructor(input) {
+        const last = input.attempts.at(-1);
+        super(`git ${input.command} unavailable after ${input.attempts.length} attempts (exit code=${last?.exitCode ?? "unavailable"}, exit code hex=${last?.exitCodeHex ?? "unavailable"}, signal=${last?.signal ?? "unavailable"}, cwd=${path.resolve(input.cwd)}): ${last?.detail ?? "unknown infrastructure error"}`);
+        this.name = "ResilientGitCommandError";
+        this.diagnostics = { schemaVersion: 1, ...input };
+    }
+}
+export function isResilientGitCommandError(error) {
+    return error instanceof ResilientGitCommandError;
+}
+export function formatWindowsExitCode(exitCode) {
+    return exitCode === undefined
+        ? undefined
+        : `0x${(exitCode >>> 0).toString(16).padStart(8, "0").toUpperCase()}`;
+}
+export function isWindowsDllInitializationFailure(platform, exitCode) {
+    return platform === "win32" && exitCode !== undefined && (exitCode >>> 0) === 0xc0000142;
+}
+/** Only returns the original executable and its sibling within the same Git installation. */
+export function deriveSameInstallationGitCandidates(primary) {
+    const normalized = path.win32.normalize(primary);
+    const lower = normalized.toLowerCase();
+    let sibling;
+    if (lower.endsWith("\\mingw64\\bin\\git.exe")) {
+        const root = path.win32.resolve(path.win32.dirname(normalized), "..", "..");
+        sibling = path.win32.join(root, "cmd", "git.exe");
+    }
+    else if (lower.endsWith("\\cmd\\git.exe")) {
+        const root = path.win32.resolve(path.win32.dirname(normalized), "..");
+        sibling = path.win32.join(root, "mingw64", "bin", "git.exe");
+    }
+    return [...new Set([normalized, ...(sibling ? [sibling] : [])])];
+}
+const windowsCandidateCache = new Map();
+export async function resolveGitExecutableCandidates(platform, env) {
+    if (platform !== "win32")
+        return ["git"];
+    const pathValue = env.PATH ?? env.Path ?? "";
+    const cached = windowsCandidateCache.get(pathValue);
+    if (cached)
+        return cached;
+    const resolved = resolveWindowsGitExecutableCandidates(pathValue);
+    windowsCandidateCache.set(pathValue, resolved);
+    return resolved;
+}
+async function resolveWindowsGitExecutableCandidates(pathValue) {
+    for (const raw of pathValue.split(path.delimiter)) {
+        const entry = raw.trim().replace(/^"|"$/g, "");
+        if (!entry)
+            continue;
+        const candidate = path.win32.join(entry, "git.exe");
+        try {
+            await access(candidate, constants.X_OK);
+            const candidates = [];
+            for (const executable of deriveSameInstallationGitCandidates(candidate)) {
+                try {
+                    await access(executable, constants.X_OK);
+                    candidates.push(executable);
+                }
+                catch { /* optional sibling */ }
+            }
+            if (candidates.length)
+                return candidates;
+        }
+        catch { /* continue PATH search */ }
+    }
+    return ["git"];
+}
+const DEFAULT_MAX_BUFFER = 16 * 1024 * 1024;
+const bounded = (text) => text.length <= 1000 ? text : `${text.slice(0, 1000)}...[truncated]`;
+/**
+ * Execute a read-only Git command with bounded recovery for Windows startup failures.
+ * Completed non-zero commands are deliberately returned to preserve caller semantics.
+ */
+export async function runResilientGitCommand(options, dependencies = {}) {
+    const platform = dependencies.platform ?? process.platform;
+    const env = { ...(dependencies.env ?? process.env), GIT_OPTIONAL_LOCKS: "0" };
+    const candidates = await (dependencies.resolveExecutableCandidates ?? resolveGitExecutableCandidates)(platform, env);
+    const executables = candidates.length ? candidates : ["git"];
+    const maxAttempts = Math.max(1, options.attempts ?? 3);
+    const delay = Math.max(0, options.retryDelayMs ?? 250);
+    const execute = dependencies.runAttempt ?? spawnGitAttempt;
+    const sleep = dependencies.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const now = dependencies.now ?? Date.now;
+    const attemptDiagnostics = [];
+    for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+        const executable = executables[(attempt - 1) % executables.length];
+        const startedAt = now();
+        try {
+            const result = await execute({ executable, args: options.args, cwd: options.cwd, env, windowsHide: true, maxBuffer: options.maxBuffer ?? DEFAULT_MAX_BUFFER });
+            if (result.code === 0)
+                return result;
+            const dllFailure = isWindowsDllInitializationFailure(platform, result.code);
+            const emptyStartupFailure = result.stdout.length === 0 && result.stderr.length === 0;
+            const eligible = platform === "win32" && (dllFailure || emptyStartupFailure);
+            if (!eligible)
+                return result;
+            attemptDiagnostics.push({
+                attempt, executable, exitCode: result.code, ...(formatWindowsExitCode(result.code) ? { exitCodeHex: formatWindowsExitCode(result.code) } : {}), signal: result.signal,
+                durationMs: Math.max(0, now() - startedAt), detail: bounded("no stdout/stderr"),
+                transientKind: dllFailure ? "windows-dll-init-failed" : "empty-output-startup-failure",
+            });
+        }
+        catch (error) {
+            const detail = bounded(error instanceof Error ? error.message : String(error));
+            attemptDiagnostics.push({ attempt, executable, signal: null, durationMs: Math.max(0, now() - startedAt), detail });
+        }
+        if (attempt < maxAttempts && delay > 0)
+            await sleep(Math.min(4_000, delay * 2 ** (attempt - 1)));
+    }
+    throw new ResilientGitCommandError({ cwd: options.cwd, command: options.args.join(" "), platform, executableCandidates: executables, attempts: attemptDiagnostics });
+}
+function spawnGitAttempt(input) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(input.executable, input.args, { cwd: input.cwd, env: input.env, windowsHide: input.windowsHide, stdio: ["ignore", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        const append = (current, chunk) => {
+            const next = current + String(chunk);
+            return next.length > input.maxBuffer ? next.slice(0, input.maxBuffer) : next;
+        };
+        child.stdout.on("data", (chunk) => { stdout = append(stdout, chunk); });
+        child.stderr.on("data", (chunk) => { stderr = append(stderr, chunk); });
+        child.on("error", reject);
+        child.on("close", (code, signal) => resolve({ code: code ?? 1, signal, stdout, stderr }));
+    });
+}