@webpieces/repo-workflow-core 0.4.975 → 0.4.977

package/src/command-timeouts.js

@@ -4,34 +4,89 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CommandTimeouts = void 0;
 const tslib_1 = require("tslib");
 const inversify_1 = require("inversify");
+const tooling_common_1 = require("@webpieces/tooling-common");
 /**
- * The ceiling on every external command the detached main-sync refresher runs (#1342).
+ * The ceiling on every external command the detached main-sync refresher runs (#1342), and the ONE place
+ * those commands are bounded.
  *
  * WHY EVERY ONE NEEDS A CEILING. The refresher is single-flight behind `main-sync.lock.json`, and the
  * lock is reclaimed once its holder is older than `hangTimeoutMinutes` (default 5). Reclaiming used to
- * be the whole of hang recovery, and it was not enough: no `spawnSync` here carried a `timeout`, so a
+ * be the whole of hang recovery, and it was not enough: no command here carried a deadline, so a
  * `git fetch` stuck on an ssh handshake, or a `gh pr list` stuck on the network, lived forever — and
  * after every reclaim the next refresher could stack another one beside it. A bounded command makes a
  * hung run END on its own; the reclaimer's kill (MainSyncLockService.tryAcquireMainSyncLock) is the
- * backstop for a process that is stuck somewhere no timeout reaches.
+ * backstop for a process that is stuck somewhere no deadline reaches.
  *
  * Sized so ONE network command plus a handful of local ones stays well inside the default
- * 5-minute hang window. Node sends SIGTERM on expiry (the spawnSync default), which lets git clean up
- * its own `.lock` files rather than leaving them behind as SIGKILL would.
+ * 5-minute hang window. The kill is SIGTERM (node's default), which lets git clean up its own `.lock`
+ * files rather than leaving them behind as SIGKILL would.
+ *
+ * HOW (#1381): the command goes through the process edges, and its deadline is a task scheduled on the
+ * clock edge (`TimerApi`) that aborts the run. A feature test therefore SEES each requested deadline
+ * (`MockTimerApi.getScheduledTasks()`), and fires it itself to prove the timeout path — no real time
+ * passes. The one synchronous form ({@link localGitNow}) exists for the PreToolUse guard's blocking path,
+ * whose `check()` contract is synchronous; its kill-after is passed straight to the edge.
  */
 let CommandTimeouts = class CommandTimeouts {
     static { CommandTimeouts_1 = this; }
+    git;
+    processes;
+    timer;
     /** `git fetch` and `gh` — the two calls that cross the network. */
     static NETWORK_MS = 90 * 1000;
     /** Local git (merge-base, rev-list, worktree list, status, …). Generous: a cold, large repo is slow, never hung. */
     static LOCAL_GIT_MS = 30 * 1000;
-    /** The ceiling for one captured command: `gh` talks to GitHub, everything else here is local git. */
-    forCommand(cmd) {
-        return cmd === 'gh' ? CommandTimeouts_1.NETWORK_MS : CommandTimeouts_1.LOCAL_GIT_MS;
+    // Defaulted so the non-DI call sites (the guard, the detached refresher) can `new` this, while
+    // inversify injects the container's edges — which is what a feature test rebinds.
+    constructor(git = new tooling_common_1.GitProcessClient(), processes = new tooling_common_1.NativeProcessClient(), timer = new tooling_common_1.TimerClient()) {
+        this.git = git;
+        this.processes = processes;
+        this.timer = timer;
+    }
+    /** Local git, killed after {@link LOCAL_GIT_MS}. */
+    localGit(args, cwd) {
+        return this.boundedGit(args, cwd, CommandTimeouts_1.LOCAL_GIT_MS);
+    }
+    /** Network git (`fetch`), killed after {@link NETWORK_MS}. */
+    networkGit(args, cwd) {
+        return this.boundedGit(args, cwd, CommandTimeouts_1.NETWORK_MS);
+    }
+    /** `gh`, killed after {@link NETWORK_MS}. */
+    async gh(args, cwd) {
+        const abort = new AbortController();
+        const deadline = this.deadline(CommandTimeouts_1.NETWORK_MS, `gh ${args.join(' ')}`, abort);
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            return await this.processes.run('gh', args, cwd, abort.signal);
+        }
+        finally {
+            deadline.cancel();
+        }
+    }
+    /** Local git, SYNCHRONOUSLY — the guard's blocking path only. Killed after {@link LOCAL_GIT_MS}. */
+    localGitNow(args, cwd) {
+        return this.git.runSync(args, cwd, CommandTimeouts_1.LOCAL_GIT_MS);
+    }
+    async boundedGit(args, cwd, timeoutMs) {
+        const abort = new AbortController();
+        const deadline = this.deadline(timeoutMs, `git ${args.join(' ')}`, abort);
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            return await this.git.run(args, cwd, abort.signal);
+        }
+        finally {
+            deadline.cancel();
+        }
+    }
+    deadline(timeoutMs, command, abort) {
+        return this.timer.schedule(timeoutMs, new tooling_common_1.TaskDto(`deadline for \`${command}\``, () => abort.abort()));
     }
 };
 exports.CommandTimeouts = CommandTimeouts;
 exports.CommandTimeouts = CommandTimeouts = CommandTimeouts_1 = tslib_1.__decorate([
-    (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton)
+    (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton),
+    tslib_1.__metadata("design:paramtypes", [tooling_common_1.GitProcessApi,
+        tooling_common_1.NativeProcessApi,
+        tooling_common_1.TimerApi])
 ], CommandTimeouts);
 //# sourceMappingURL=command-timeouts.js.map

package/src/command-timeouts.js.map

@@ -1 +1 @@
-{"version":3,"file":"command-timeouts.js","sourceRoot":"","sources":["../../../../../packages/tooling/repo-workflow-core/src/command-timeouts.ts"],"names":[],"mappings":";;;;;AAAA,yCAA2D;AAE3D;;;;;;;;;;;;;;GAcG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAe;;IACxB,mEAAmE;IACnE,MAAM,CAAU,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC;IACvC,oHAAoH;IACpH,MAAM,CAAU,YAAY,GAAG,EAAE,GAAG,IAAI,CAAC;IAEzC,qGAAqG;IACrG,UAAU,CAAC,GAAW;QAClB,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAe,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAe,CAAC,YAAY,CAAC;IACpF,CAAC;;AATQ,0CAAe;0BAAf,eAAe;IAD3B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;GAC5B,eAAe,CAU3B","sourcesContent":["import { injectable, bindingScopeValues } from 'inversify';\n\n/**\n * The ceiling on every external command the detached main-sync refresher runs (#1342).\n *\n * WHY EVERY ONE NEEDS A CEILING. The refresher is single-flight behind `main-sync.lock.json`, and the\n * lock is reclaimed once its holder is older than `hangTimeoutMinutes` (default 5). Reclaiming used to\n * be the whole of hang recovery, and it was not enough: no `spawnSync` here carried a `timeout`, so a\n * `git fetch` stuck on an ssh handshake, or a `gh pr list` stuck on the network, lived forever — and\n * after every reclaim the next refresher could stack another one beside it. A bounded command makes a\n * hung run END on its own; the reclaimer's kill (MainSyncLockService.tryAcquireMainSyncLock) is the\n * backstop for a process that is stuck somewhere no timeout reaches.\n *\n * Sized so ONE network command plus a handful of local ones stays well inside the default\n * 5-minute hang window. Node sends SIGTERM on expiry (the spawnSync default), which lets git clean up\n * its own `.lock` files rather than leaving them behind as SIGKILL would.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class CommandTimeouts {\n    /** `git fetch` and `gh` — the two calls that cross the network. */\n    static readonly NETWORK_MS = 90 * 1000;\n    /** Local git (merge-base, rev-list, worktree list, status, …). Generous: a cold, large repo is slow, never hung. */\n    static readonly LOCAL_GIT_MS = 30 * 1000;\n\n    /** The ceiling for one captured command: `gh` talks to GitHub, everything else here is local git. */\n    forCommand(cmd: string): number {\n        return cmd === 'gh' ? CommandTimeouts.NETWORK_MS : CommandTimeouts.LOCAL_GIT_MS;\n    }\n}\n"]}
+{"version":3,"file":"command-timeouts.js","sourceRoot":"","sources":["../../../../../packages/tooling/repo-workflow-core/src/command-timeouts.ts"],"names":[],"mappings":";;;;;AAAA,yCAA2D;AAC3D,8DAWmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAe;;IASH;IACA;IACA;IAVrB,mEAAmE;IACnE,MAAM,CAAU,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC;IACvC,oHAAoH;IACpH,MAAM,CAAU,YAAY,GAAG,EAAE,GAAG,IAAI,CAAC;IAEzC,+FAA+F;IAC/F,kFAAkF;IAClF,YACqB,MAAqB,IAAI,iCAAgB,EAAE,EAC3C,YAA8B,IAAI,oCAAmB,EAAE,EACvD,QAAkB,IAAI,4BAAW,EAAE;QAFnC,QAAG,GAAH,GAAG,CAAwC;QAC3C,cAAS,GAAT,SAAS,CAA8C;QACvD,UAAK,GAAL,KAAK,CAA8B;IACrD,CAAC;IAEJ,oDAAoD;IACpD,QAAQ,CAAC,IAAc,EAAE,GAAW;QAChC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,iBAAe,CAAC,YAAY,CAAC,CAAC;IACpE,CAAC;IAED,8DAA8D;IAC9D,UAAU,CAAC,IAAc,EAAE,GAAW;QAClC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,iBAAe,CAAC,UAAU,CAAC,CAAC;IAClE,CAAC;IAED,6CAA6C;IAC7C,KAAK,CAAC,EAAE,CAAC,IAAc,EAAE,GAAW;QAChC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,iBAAe,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1F,8DAA8D;QAC9D,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACnE,CAAC;gBAAS,CAAC;YACP,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtB,CAAC;IACL,CAAC;IAED,oGAAoG;IACpG,WAAW,CAAC,IAAc,EAAE,GAAW;QACnC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,iBAAe,CAAC,YAAY,CAAC,CAAC;IACrE,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAc,EAAE,GAAW,EAAE,SAAiB;QACnE,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1E,8DAA8D;QAC9D,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;gBAAS,CAAC;YACP,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtB,CAAC;IACL,CAAC;IAEO,QAAQ,CAAC,SAAiB,EAAE,OAAe,EAAE,KAAsB;QACvE,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,wBAAO,CAAC,kBAAkB,OAAO,IAAI,EAAE,GAAS,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjH,CAAC;;AAtDQ,0CAAe;0BAAf,eAAe;IAD3B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAUX,8BAAa;QACP,iCAAgB;QACpB,yBAAQ;GAX3B,eAAe,CAuD3B","sourcesContent":["import { injectable, bindingScopeValues } from 'inversify';\nimport {\n    GitProcessApi,\n    GitProcessClient,\n    GitResultDto,\n    NativeProcessApi,\n    NativeProcessClient,\n    ProcessResultDto,\n    ScheduledTaskDto,\n    TaskDto,\n    TimerApi,\n    TimerClient,\n} from '@webpieces/tooling-common';\n\n/**\n * The ceiling on every external command the detached main-sync refresher runs (#1342), and the ONE place\n * those commands are bounded.\n *\n * WHY EVERY ONE NEEDS A CEILING. The refresher is single-flight behind `main-sync.lock.json`, and the\n * lock is reclaimed once its holder is older than `hangTimeoutMinutes` (default 5). Reclaiming used to\n * be the whole of hang recovery, and it was not enough: no command here carried a deadline, so a\n * `git fetch` stuck on an ssh handshake, or a `gh pr list` stuck on the network, lived forever — and\n * after every reclaim the next refresher could stack another one beside it. A bounded command makes a\n * hung run END on its own; the reclaimer's kill (MainSyncLockService.tryAcquireMainSyncLock) is the\n * backstop for a process that is stuck somewhere no deadline reaches.\n *\n * Sized so ONE network command plus a handful of local ones stays well inside the default\n * 5-minute hang window. The kill is SIGTERM (node's default), which lets git clean up its own `.lock`\n * files rather than leaving them behind as SIGKILL would.\n *\n * HOW (#1381): the command goes through the process edges, and its deadline is a task scheduled on the\n * clock edge (`TimerApi`) that aborts the run. A feature test therefore SEES each requested deadline\n * (`MockTimerApi.getScheduledTasks()`), and fires it itself to prove the timeout path — no real time\n * passes. The one synchronous form ({@link localGitNow}) exists for the PreToolUse guard's blocking path,\n * whose `check()` contract is synchronous; its kill-after is passed straight to the edge.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class CommandTimeouts {\n    /** `git fetch` and `gh` — the two calls that cross the network. */\n    static readonly NETWORK_MS = 90 * 1000;\n    /** Local git (merge-base, rev-list, worktree list, status, …). Generous: a cold, large repo is slow, never hung. */\n    static readonly LOCAL_GIT_MS = 30 * 1000;\n\n    // Defaulted so the non-DI call sites (the guard, the detached refresher) can `new` this, while\n    // inversify injects the container's edges — which is what a feature test rebinds.\n    constructor(\n        private readonly git: GitProcessApi = new GitProcessClient(),\n        private readonly processes: NativeProcessApi = new NativeProcessClient(),\n        private readonly timer: TimerApi = new TimerClient(),\n    ) {}\n\n    /** Local git, killed after {@link LOCAL_GIT_MS}. */\n    localGit(args: string[], cwd: string): Promise<GitResultDto> {\n        return this.boundedGit(args, cwd, CommandTimeouts.LOCAL_GIT_MS);\n    }\n\n    /** Network git (`fetch`), killed after {@link NETWORK_MS}. */\n    networkGit(args: string[], cwd: string): Promise<GitResultDto> {\n        return this.boundedGit(args, cwd, CommandTimeouts.NETWORK_MS);\n    }\n\n    /** `gh`, killed after {@link NETWORK_MS}. */\n    async gh(args: string[], cwd: string): Promise<ProcessResultDto> {\n        const abort = new AbortController();\n        const deadline = this.deadline(CommandTimeouts.NETWORK_MS, `gh ${args.join(' ')}`, abort);\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            return await this.processes.run('gh', args, cwd, abort.signal);\n        } finally {\n            deadline.cancel();\n        }\n    }\n\n    /** Local git, SYNCHRONOUSLY — the guard's blocking path only. Killed after {@link LOCAL_GIT_MS}. */\n    localGitNow(args: string[], cwd: string): GitResultDto {\n        return this.git.runSync(args, cwd, CommandTimeouts.LOCAL_GIT_MS);\n    }\n\n    private async boundedGit(args: string[], cwd: string, timeoutMs: number): Promise<GitResultDto> {\n        const abort = new AbortController();\n        const deadline = this.deadline(timeoutMs, `git ${args.join(' ')}`, abort);\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            return await this.git.run(args, cwd, abort.signal);\n        } finally {\n            deadline.cancel();\n        }\n    }\n\n    private deadline(timeoutMs: number, command: string, abort: AbortController): ScheduledTaskDto {\n        return this.timer.schedule(timeoutMs, new TaskDto(`deadline for \\`${command}\\``, (): void => abort.abort()));\n    }\n}\n"]}

package/src/main-sync-status.d.ts

@@ -14,8 +14,8 @@ export declare class MainSyncStatusService {
     private readonly atomicFile;
     private readonly store;
     private readonly worktrees;
-    private readonly timeouts;
-    constructor(dotDir?: DotWebpieces, atomicFile?: AtomicFile, store?: MainSyncFileStore, worktrees?: WorktreeService, timeouts?: CommandTimeouts);
+    private readonly commands;
+    constructor(dotDir?: DotWebpieces, atomicFile?: AtomicFile, store?: MainSyncFileStore, worktrees?: WorktreeService, commands?: CommandTimeouts);
     /**
      * SHARED scope: `<primary>/.webpieces/main-sync-status.json`, one per repo.
      *
@@ -71,7 +71,7 @@ export declare class MainSyncStatusService {
      * own `gh` query, so it is the right entry point for a single-worktree caller and for tests.
      * The refresher uses computeAllMainSyncStatuses instead — see there for why.
      */
-    computeMainSyncStatus(repoRoot: string): MainSyncStatus;
+    computeMainSyncStatus(repoRoot: string): Promise<MainSyncStatus>;
     /**
      * The SLOW path for EVERY branch this repo has checked out — what the detached refresher runs.
      *
@@ -87,7 +87,7 @@ export declare class MainSyncStatusService {
      * The map is rebuilt from the LIVE worktree set every refresh, so a deleted branch or removed
      * worktree simply stops appearing. No pruning pass, no unbounded growth.
      */
-    computeAllMainSyncStatuses(repoRoot: string): MainSyncStatusFile;
+    computeAllMainSyncStatuses(repoRoot: string): Promise<MainSyncStatusFile>;
     private hasBranch;
     /**
      * One branch's status, computed in `worktreePath` (the tree that has it checked out — the
@@ -105,7 +105,7 @@ export declare class MainSyncStatusService {
      * goes through writeMainSyncStatus, which MERGES its entry into the existing map; writing a whole
      * document from here would wipe every other worktree's entry.
      */
-    stampCleanMainSyncStatus(repoRoot: string): void;
+    stampCleanMainSyncStatus(repoRoot: string): Promise<void>;
     /**
      * Refresh `origin/main` WITHOUT writing `.git/FETCH_HEAD`.
      *
@@ -123,7 +123,7 @@ export declare class MainSyncStatusService {
      */
     private fetchOriginMain;
     private isUnknownGitOption;
-    private capture;
+    private git;
     private gitBranch;
     private localMainHash;
     private commitDistance;
@@ -149,7 +149,4 @@ export declare function readMainSyncStatus(repoRoot: string, branch: string): Ma
 export declare function readMainSyncStatusFile(repoRoot: string): MainSyncStatusFile | null;
 export declare function writeMainSyncStatus(repoRoot: string, status: MainSyncStatus): void;
 export declare function writeMainSyncStatusFile(repoRoot: string, file: MainSyncStatusFile): void;
-export declare function computeMainSyncStatus(repoRoot: string): MainSyncStatus;
-export declare function computeAllMainSyncStatuses(repoRoot: string): MainSyncStatusFile;
 export declare function squashRecoverySteps(currentBranch: string): string[];
-export declare function stampCleanMainSyncStatus(repoRoot: string): void;

package/src/main-sync-status.js

@@ -6,12 +6,8 @@ exports.readMainSyncStatus = readMainSyncStatus;
 exports.readMainSyncStatusFile = readMainSyncStatusFile;
 exports.writeMainSyncStatus = writeMainSyncStatus;
 exports.writeMainSyncStatusFile = writeMainSyncStatusFile;
-exports.computeMainSyncStatus = computeMainSyncStatus;
-exports.computeAllMainSyncStatuses = computeAllMainSyncStatuses;
 exports.squashRecoverySteps = squashRecoverySteps;
-exports.stampCleanMainSyncStatus = stampCleanMainSyncStatus;
 const tslib_1 = require("tslib");
-const child_process_1 = require("child_process");
 const inversify_1 = require("inversify");
 const tooling_common_1 = require("@webpieces/tooling-common");
 const main_sync_file_1 = require("./main-sync-file");
@@ -32,6 +28,15 @@ const command_timeouts_1 = require("./command-timeouts");
 // and reclaims the lock (see MainSyncLockService).
 exports.DEFAULT_HANG_TIMEOUT_MINUTES = 5;
 const MAIN_SYNC_STATUS_FILE = 'main-sync-status.json';
+// Internal: one bounded command's verdict and trimmed stdout. Data only.
+class CapturedOutput {
+    ok;
+    out;
+    constructor(ok, out) {
+        this.ok = ok;
+        this.out = out;
+    }
+}
 /**
  * Reads/writes the main-sync cache and computes the slow "is my branch healthy vs origin/main?"
  * status. `@injectable(bindingScopeValues.Singleton)` so it's injectable and drawn in consumers’ DI designs.
@@ -41,13 +46,13 @@ let MainSyncStatusService = class MainSyncStatusService {
     atomicFile;
     store;
     worktrees;
-    timeouts;
-    constructor(dotDir = tooling_common_2.dotWebpieces, atomicFile = new tooling_common_1.AtomicFile(), store = new main_sync_file_1.MainSyncFileStore(atomicFile), worktrees = new worktrees_1.WorktreeService(), timeouts = new command_timeouts_1.CommandTimeouts()) {
+    commands;
+    constructor(dotDir = tooling_common_2.dotWebpieces, atomicFile = new tooling_common_1.AtomicFile(), store = new main_sync_file_1.MainSyncFileStore(atomicFile), worktrees = new worktrees_1.WorktreeService(), commands = new command_timeouts_1.CommandTimeouts()) {
         this.dotDir = dotDir;
         this.atomicFile = atomicFile;
         this.store = store;
         this.worktrees = worktrees;
-        this.timeouts = timeouts;
+        this.commands = commands;
     }
     /**
      * SHARED scope: `<primary>/.webpieces/main-sync-status.json`, one per repo.
@@ -117,10 +122,10 @@ let MainSyncStatusService = class MainSyncStatusService {
      * own `gh` query, so it is the right entry point for a single-worktree caller and for tests.
      * The refresher uses computeAllMainSyncStatuses instead — see there for why.
      */
-    computeMainSyncStatus(repoRoot) {
+    async computeMainSyncStatus(repoRoot) {
         // Best-effort network refresh; offline just means we evaluate against the last-fetched ref.
-        this.fetchOriginMain(repoRoot);
-        return this.computeBranchStatus(repoRoot, this.gitBranch(repoRoot), this.loadPullRequestIndex(repoRoot));
+        await this.fetchOriginMain(repoRoot);
+        return this.computeBranchStatus(repoRoot, this.gitBranch(repoRoot), await this.loadPullRequestIndex(repoRoot));
     }
     /**
      * The SLOW path for EVERY branch this repo has checked out — what the detached refresher runs.
@@ -137,21 +142,21 @@ let MainSyncStatusService = class MainSyncStatusService {
      * The map is rebuilt from the LIVE worktree set every refresh, so a deleted branch or removed
      * worktree simply stops appearing. No pruning pass, no unbounded growth.
      */
-    computeAllMainSyncStatuses(repoRoot) {
-        this.fetchOriginMain(repoRoot);
-        const index = this.loadPullRequestIndex(repoRoot);
+    async computeAllMainSyncStatuses(repoRoot) {
+        await this.fetchOriginMain(repoRoot);
+        const index = await this.loadPullRequestIndex(repoRoot);
         const branches = {};
         for (const tree of this.worktrees.listWorktrees(repoRoot)) {
             // Detached HEAD (and a bare worktree) has no branch to key an entry on. Skipping it must
             // not stop the others being recorded, which is why this is a `continue`, not a bail-out.
             if (tree.branch === '' || this.hasBranch(branches, tree.branch))
                 continue;
-            branches[tree.branch] = this.computeBranchStatus(tree.path, tree.branch, index);
+            branches[tree.branch] = await this.computeBranchStatus(tree.path, tree.branch, index);
         }
         // `main` always present, even with no worktree on it: read-stale-guard's state A looks itself
         // up under 'main', and an absent entry there would silently disarm the stale-main block.
         if (!this.hasBranch(branches, 'main'))
-            branches['main'] = this.mainOnlyStatus(repoRoot);
+            branches['main'] = await this.mainOnlyStatus(repoRoot);
         return new main_sync_file_1.MainSyncStatusFile(main_sync_file_1.MAIN_SYNC_STATUS_VERSION, new Date().toISOString(), branches);
     }
     hasBranch(branches, branch) {
@@ -163,8 +168,8 @@ let MainSyncStatusService = class MainSyncStatusService {
      * `gh`: both are done once per refresh by the caller.
      */
     // webpieces-disable max-lines-new-methods -- one cohesive slow-path computation
-    computeBranchStatus(repoRoot, branch, index) {
-        return this.stampForge(this.computeBranchStatusInner(repoRoot, branch, index), index);
+    async computeBranchStatus(repoRoot, branch, index) {
+        return this.stampForge(await this.computeBranchStatusInner(repoRoot, branch, index), index);
     }
     // Every return path of the computation below has to carry the forge flag, and threading it through
     // four constructions is how one of them would end up missing it. One wrapper, one assignment.
@@ -173,12 +178,12 @@ let MainSyncStatusService = class MainSyncStatusService {
         return status;
     }
     // webpieces-disable max-lines-new-methods -- one cohesive slow-path computation
-    computeBranchStatusInner(repoRoot, branch, index) {
+    async computeBranchStatusInner(repoRoot, branch, index) {
         const mergedPr = index.mergedFor(branch);
         const openPr = index.openFor(branch);
-        const head = this.capture(repoRoot, 'git', ['rev-parse', 'HEAD']);
-        const originMain = this.capture(repoRoot, 'git', ['rev-parse', 'origin/main']);
-        const localMain = this.localMainHash(repoRoot);
+        const head = await this.git(repoRoot, ['rev-parse', 'HEAD']);
+        const originMain = await this.git(repoRoot, ['rev-parse', 'origin/main']);
+        const localMain = await this.localMainHash(repoRoot);
         const featureHead = head.ok ? head.out : '';
         if (!head.ok || !originMain.ok) {
             const status = this.benignStatus(branch, featureHead);
@@ -186,24 +191,24 @@ let MainSyncStatusService = class MainSyncStatusService {
             status.mergedPr = mergedPr;
             status.openPr = openPr;
             status.localMain = localMain;
-            status.commitsBehind = this.commitDistance(repoRoot, localMain, originMain.ok ? originMain.out : '');
+            status.commitsBehind = await this.commitDistance(repoRoot, localMain, originMain.ok ? originMain.out : '');
             return status;
         }
-        const forkPoint = this.capture(repoRoot, 'git', ['merge-base', 'origin/main', 'HEAD']);
+        const forkPoint = await this.git(repoRoot, ['merge-base', 'origin/main', 'HEAD']);
         if (!forkPoint.ok || forkPoint.out === '') {
             const noFork = new main_sync_file_1.MainSyncStatus(branch, mergedPr !== '', mergedPr, false, null, originMain.out, featureHead, false, [], new Date().toISOString());
             noFork.openPr = openPr;
             noFork.localMain = localMain;
-            noFork.commitsBehind = this.commitDistance(repoRoot, localMain, originMain.out);
+            noFork.commitsBehind = await this.commitDistance(repoRoot, localMain, originMain.out);
             return noFork;
         }
-        const featureFiles = new Set(this.featureChangedFiles(repoRoot, forkPoint.out));
-        const mainFiles = this.changedFiles(repoRoot, forkPoint.out, 'origin/main');
+        const featureFiles = new Set(await this.featureChangedFiles(repoRoot, forkPoint.out));
+        const mainFiles = await this.changedFiles(repoRoot, forkPoint.out, 'origin/main');
         const conflictFiles = mainFiles.filter((file) => featureFiles.has(file));
         const status = new main_sync_file_1.MainSyncStatus(branch, mergedPr !== '', mergedPr, true, forkPoint.out, originMain.out, featureHead, conflictFiles.length > 0, conflictFiles, new Date().toISOString());
         status.openPr = openPr;
         status.localMain = localMain;
-        status.commitsBehind = this.commitDistance(repoRoot, localMain, originMain.out);
+        status.commitsBehind = await this.commitDistance(repoRoot, localMain, originMain.out);
         return status;
     }
     // The recovery steps when there is no fork point with origin/main (a bad merge of main into branch).
@@ -229,16 +234,16 @@ let MainSyncStatusService = class MainSyncStatusService {
      * goes through writeMainSyncStatus, which MERGES its entry into the existing map; writing a whole
      * document from here would wipe every other worktree's entry.
      */
-    stampCleanMainSyncStatus(repoRoot) {
+    async stampCleanMainSyncStatus(repoRoot) {
         // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
         try {
             const branch = this.gitBranch(repoRoot);
-            const originMain = this.capture(repoRoot, 'git', ['rev-parse', 'origin/main']);
-            const featureHead = this.capture(repoRoot, 'git', ['rev-parse', 'HEAD']);
+            const originMain = await this.git(repoRoot, ['rev-parse', 'origin/main']);
+            const featureHead = await this.git(repoRoot, ['rev-parse', 'HEAD']);
             if (!originMain.ok || !featureHead.ok)
                 return;
             const status = new main_sync_file_1.MainSyncStatus(branch, false, '', true, originMain.out, originMain.out, featureHead.out, false, [], new Date().toISOString());
-            status.localMain = this.localMainHash(repoRoot);
+            status.localMain = await this.localMainHash(repoRoot);
             status.commitsBehind = 0;
             this.writeMainSyncStatus(repoRoot, status);
         }
@@ -262,27 +267,23 @@ let MainSyncStatusService = class MainSyncStatusService {
      * Older git rejects the flag; only then do we retry the plain form, accepting the old behaviour
      * rather than losing the refresh entirely on a pre-2020 git.
      */
-    fetchOriginMain(repoRoot) {
-        const safe = (0, child_process_1.spawnSync)('git', ['fetch', '--no-write-fetch-head', 'origin', 'main'], {
-            cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'ignore', 'pipe'], timeout: command_timeouts_1.CommandTimeouts.NETWORK_MS,
-        });
-        if (safe.status === 0)
+    async fetchOriginMain(repoRoot) {
+        const safe = await this.commands.networkGit(['fetch', '--no-write-fetch-head', 'origin', 'main'], repoRoot);
+        if (safe.ok)
             return;
         if (!this.isUnknownGitOption(safe.stderr))
             return; // a real failure (offline, auth) — not our business
-        (0, child_process_1.spawnSync)('git', ['fetch', 'origin', 'main'], { cwd: repoRoot, stdio: 'ignore', timeout: command_timeouts_1.CommandTimeouts.NETWORK_MS });
+        await this.commands.networkGit(['fetch', 'origin', 'main'], repoRoot);
     }
     // Did git reject the flag itself (too old), as opposed to failing the network refresh?
     isUnknownGitOption(stderr) {
-        const text = (stderr ?? '').toLowerCase();
+        const text = stderr.toLowerCase();
         return text.includes('unknown option') || text.includes('unknown switch') || text.includes('unrecognized option');
     }
-    // Run a command capturing trimmed stdout; ok=false on spawn failure or non-zero exit.
-    capture(repoRoot, cmd, args) {
-        const result = (0, child_process_1.spawnSync)(cmd, args, { cwd: repoRoot, encoding: 'utf8', timeout: this.timeouts.forCommand(cmd) });
-        if (result.status !== 0 || typeof result.stdout !== 'string')
-            return { ok: false, out: '' };
-        return { ok: true, out: result.stdout.trim() };
+    // Local git, bounded (CommandTimeouts), stdout trimmed; ok=false on a non-zero exit, a kill or a failed start.
+    async git(repoRoot, args) {
+        const result = await this.commands.localGit(args, repoRoot);
+        return new CapturedOutput(result.ok, result.ok ? result.stdout.trim() : '');
     }
     // The actual checked-out branch in repoRoot — cwd-correct so the cache's `branch` label matches.
     gitBranch(repoRoot) {
@@ -290,31 +291,31 @@ let MainSyncStatusService = class MainSyncStatusService {
     }
     // The LOCAL main hash. `refs/heads/main` (not the bare name) so it can never resolve to a remote
     // ref or a tag. '' when main does not exist locally — which the guard treats as fail-open.
-    localMainHash(repoRoot) {
-        const result = this.capture(repoRoot, 'git', ['rev-parse', 'refs/heads/main']);
+    async localMainHash(repoRoot) {
+        const result = await this.git(repoRoot, ['rev-parse', 'refs/heads/main']);
         return result.ok ? result.out : '';
     }
     // Slow-path only: the detached refresher calls this after fetching. Guards never count commits.
-    commitDistance(repoRoot, localMain, originMain) {
+    async commitDistance(repoRoot, localMain, originMain) {
         if (localMain === '' || originMain === '')
             return null;
-        const result = this.capture(repoRoot, 'git', ['rev-list', '--count', `${localMain}..${originMain}`]);
+        const result = await this.git(repoRoot, ['rev-list', '--count', `${localMain}..${originMain}`]);
         if (!result.ok || !/^\d+$/.test(result.out))
             return null;
         return Number(result.out);
     }
-    changedFiles(repoRoot, base, head) {
-        const result = this.capture(repoRoot, 'git', ['diff', '--name-only', base, head]);
+    async changedFiles(repoRoot, base, head) {
+        const result = await this.git(repoRoot, ['diff', '--name-only', base, head]);
         if (!result.ok || result.out === '')
             return [];
         return result.out.split('\n').map((line) => line.trim()).filter((line) => line.length > 0);
     }
     // Every file this feature branch has touched since the fork point — committed AND still in the
     // working tree (staged / unstaged / untracked), so a conflict is visible WHILE editing.
-    featureChangedFiles(repoRoot, forkPoint) {
+    async featureChangedFiles(repoRoot, forkPoint) {
         const out = new Set();
-        const add = (args) => {
-            const r = this.capture(repoRoot, 'git', args);
+        const add = async (args) => {
+            const r = await this.git(repoRoot, args);
             if (!r.ok || r.out === '')
                 return;
             for (const line of r.out.split('\n')) {
@@ -323,10 +324,10 @@ let MainSyncStatusService = class MainSyncStatusService {
                     out.add(f);
             }
         };
-        add(['diff', '--name-only', forkPoint, 'HEAD']); // committed since the fork point
-        add(['diff', '--name-only', 'HEAD']); // unstaged working-tree edits
-        add(['diff', '--name-only', '--cached', 'HEAD']); // staged edits
-        add(['ls-files', '--others', '--exclude-standard']); // untracked new files (respects .gitignore)
+        await add(['diff', '--name-only', forkPoint, 'HEAD']); // committed since the fork point
+        await add(['diff', '--name-only', 'HEAD']); // unstaged working-tree edits
+        await add(['diff', '--name-only', '--cached', 'HEAD']); // staged edits
+        await add(['ls-files', '--others', '--exclude-standard']); // untracked new files (respects .gitignore)
         return [...out];
     }
     /**
@@ -335,10 +336,11 @@ let MainSyncStatusService = class MainSyncStatusService {
      * falls out of the index and reads as "no PR", which is the fail-OPEN direction (no merged PR =
      * no block), the same way a missing `gh` or an offline machine already degraded.
      */
-    loadPullRequestIndex(repoRoot) {
-        const result = this.capture(repoRoot, 'gh', [
+    async loadPullRequestIndex(repoRoot) {
+        const gh = await this.commands.gh([
             'pr', 'list', '--state', 'all', '--json', 'number,headRefName,state', '--limit', '200',
-        ]);
+        ], repoRoot);
+        const result = new CapturedOutput(gh.ok, gh.ok ? gh.stdout.trim() : '');
         // `gh` could not be run, or exited non-zero (missing, unauthenticated, rate-limited, offline).
         // An EMPTY index is the same fail-open answer as before — but it is now labelled UNREACHABLE, so
         // the guards can report an abstention rather than an approval. Empty STDOUT on a zero exit is a
@@ -354,12 +356,12 @@ let MainSyncStatusService = class MainSyncStatusService {
      * read-stale-guard / stale-main-bash-guard actually compare (originMain vs the live tree's
      * ancestry) — never merged, never conflicting, so it can only ever produce the stale-main verdict.
      */
-    mainOnlyStatus(repoRoot) {
-        const originMain = this.capture(repoRoot, 'git', ['rev-parse', 'origin/main']);
-        const localMain = this.localMainHash(repoRoot);
+    async mainOnlyStatus(repoRoot) {
+        const originMain = await this.git(repoRoot, ['rev-parse', 'origin/main']);
+        const localMain = await this.localMainHash(repoRoot);
         const status = new main_sync_file_1.MainSyncStatus('main', false, '', true, localMain === '' ? null : localMain, originMain.ok ? originMain.out : '', localMain, false, [], new Date().toISOString());
         status.localMain = localMain;
-        status.commitsBehind = this.commitDistance(repoRoot, localMain, originMain.ok ? originMain.out : '');
+        status.commitsBehind = await this.commitDistance(repoRoot, localMain, originMain.ok ? originMain.out : '');
         return status;
     }
     // A benign status that never blocks — used when origin/main can't be resolved.
@@ -389,11 +391,5 @@ function writeMainSyncStatus(repoRoot, status) { mainSyncSvc.writeMainSyncStatus
 // webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
 function writeMainSyncStatusFile(repoRoot, file) { mainSyncSvc.writeMainSyncStatusFile(repoRoot, file); }
 // webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
-function computeMainSyncStatus(repoRoot) { return mainSyncSvc.computeMainSyncStatus(repoRoot); }
-// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
-function computeAllMainSyncStatuses(repoRoot) { return mainSyncSvc.computeAllMainSyncStatuses(repoRoot); }
-// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
 function squashRecoverySteps(currentBranch) { return mainSyncSvc.squashRecoverySteps(currentBranch); }
-// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
-function stampCleanMainSyncStatus(repoRoot) { mainSyncSvc.stampCleanMainSyncStatus(repoRoot); }
 //# sourceMappingURL=main-sync-status.js.map