@wjarka/cezarion 0.14.2 → 0.14.3

package/dist/runs/agent-tmpdir.js

@@ -1,5 +1,5 @@
 /**
- * Task-scoped temp directory for spawned agents (#785).
+ * Task-scoped temp directory for spawned agents (#785, length-capped by #387).
  *
  * Every agent used to inherit the host's `TMPDIR`/`TEMP`/`TMP` verbatim — they
  * ride in on `buildChildEnv`'s base allowlist — so every run on the machine
@@ -12,7 +12,7 @@
  * the agent reads back an empty result with a bogus exit status. Nothing in the
  * cockpit says anything is wrong.
  *
- * Two properties fix that, and this module owns both:
+ * Three properties fix that, and this module owns all of them:
  *
  *   1. **Isolation** — each run gets `<dataDir>/tmp/<runId>`, on the same disk
  *      as the run's own state rather than a shared tmpfs, reaped when the run
@@ -21,15 +21,28 @@
  *   2. **Fail loud** — the directory is write-probed before the backend spawns.
  *      A run that cannot get a working temp directory fails immediately with a
  *      named, actionable error instead of spawning an agent that will run blind.
+ *   3. **Short enough to bind** (#387) — tools bind *named* unix sockets under
+ *      `TMPDIR` (tsx's IPC server lays down `<tmpdir>/tsx-<uid>/<pid>.pipe`,
+ *      Chrome a `SingletonSocket`), and the kernel caps a socket path at
+ *      `sun_path` — 108 bytes on Linux, 104 on macOS, NUL included. A checkout
+ *      deep enough (Cezar's own nested task worktrees land past 100 chars)
+ *      pushed every such bind past the cap and broke `npm install` and
+ *      typechecking inside the run. A directory that would land too deep
+ *      resolves instead to a short digest-named directory under the OS temp
+ *      root — still per-run, still probed, still reaped. A repo whose own path
+ *      already fits keeps today's directory, byte for byte.
  *
- * `CEZ_AGENT_TMPDIR=0` opts out of BOTH — cezar keeps its hands off the temp
- * directory entirely and the pre-#785 behaviour is back, byte for byte. That is
- * deliberate: an escape hatch that still imposed the preflight would be a hatch
- * you cannot actually escape through, and this repo's graceful-degradation rule
- * says a new check must never become the only way to run.
+ * `CEZ_AGENT_TMPDIR=0` opts out of ALL THREE — cezar keeps its hands off the
+ * temp directory entirely and the pre-#785 behaviour is back, byte for byte.
+ * That is deliberate: an escape hatch that still imposed the preflight would be
+ * a hatch you cannot actually escape through, and this repo's
+ * graceful-degradation rule says a new check must never become the only way to
+ * run.
  */
-import { existsSync, mkdirSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, join } from 'node:path';
 /** Run ids are uuids; anything else must never reach a recursive `rmSync`.
  *
  *  `.` and `..` are excluded explicitly, not as pedantry: they match the
@@ -48,6 +61,103 @@ export function agentTmpDir(dataDir, runId) {
 function agentTmpRoot(dataDir) {
     return join(dataDir, 'tmp');
 }
+/**
+ * The longest a per-run temp directory may be so that tools binding named
+ * unix sockets under it still work (#387), measured in UTF-8 bytes — the
+ * kernel bounds the encoded path, not the JavaScript character count.
+ * `sockaddr_un.sun_path` holds 108 bytes on Linux and 104 on macOS, NUL
+ * included; the longest name a known tool lays down under TMPDIR is tsx's IPC
+ * socket, `<tmpdir>/tsx-<uid>/<pid>.pipe`, ~22 bytes (Chrome's
+ * `SingletonSocket` is 16). A 78-byte ceiling leaves ≥25 bytes of headroom on
+ * the tighter platform — past anything these tools generate — while keeping
+ * ordinary checkouts on their repo-local scratch: only a genuinely deep path,
+ * like the 100-character directories #387 reports, moves to the fallback.
+ */
+export const MAX_SOCKET_SAFE_DIR_LENGTH = 78;
+/** The OS temp root, symlink-resolved: `bind(2)` bounds the path the kernel
+ *  walks, so the check must measure what the path resolves to, not what it
+ *  says (macOS hands out `/var/folders/...` through a `/private/var` symlink). */
+function osTempRoot() {
+    try {
+        return realpathSync(tmpdir());
+    }
+    catch {
+        return tmpdir();
+    }
+}
+const FALLBACK_PREFIX = 'cez-agent-';
+const FALLBACK_NAME_LENGTH = 12;
+/** The marker file inside a fallback directory naming the dataDir that minted
+ *  it. The directory name digests `dataDir:runId` and is not reversible, so
+ *  without this marker a sweep could not tell its own stale directories from
+ *  another project's live ones in the shared root — and would delete them. */
+const OWNER_FILE = '.cez-owner';
+function dataDirOwner(dataDir) {
+    return createHash('sha256').update(`cez-agent-owner:${dataDir}`).digest('hex').slice(0, 16);
+}
+/**
+ * Write the ownership marker. `'wx'` never follows an existing name: an agent
+ * that replaced a previous marker with a symlink must not turn this rewrite
+ * into an arbitrary-file write. An existing marker is verified by content —
+ * a mismatch means the directory's ownership is no longer what the digest
+ * name promises, and the spawn refuses rather than guess.
+ */
+function writeOwnerMarker(dir, dataDir) {
+    const marker = join(dir, OWNER_FILE);
+    const expected = dataDirOwner(dataDir);
+    try {
+        writeFileSync(marker, expected, { encoding: 'utf8', flag: 'wx' });
+    }
+    catch (err) {
+        if (err.code !== 'EEXIST')
+            throw err;
+        let actual = '';
+        try {
+            actual = readFileSync(marker, 'utf8').trim();
+        }
+        catch {
+            // unreadable marker (symlink to nowhere, wrong type): verify below.
+        }
+        if (actual !== expected) {
+            throw new AgentTempDirError(dir, new Error('ownership marker was replaced — remove the directory to re-mint it'));
+        }
+    }
+}
+/**
+ * Where the fallback lives for this dataDir+run pair. The name digests the
+ * dataDir in, because the OS temp root is SHARED: a name derived from the run
+ * id alone would let one repo's reap delete another repo's live scratch when
+ * two run ids happen to share their leading characters. The name alone cannot
+ * make the sweep safe — a digest is not reversible, so a sweep could not tell
+ * its own stale directories from another project's live ones — which is why
+ * every fallback directory also carries the `.cez-owner` marker.
+ */
+function fallbackTmpDir(dataDir, runId) {
+    const digest = createHash('sha256').update(`${dataDir}:${runId}`).digest('hex');
+    return join(osTempRoot(), FALLBACK_PREFIX + digest.slice(0, FALLBACK_NAME_LENGTH));
+}
+/**
+ * The temp directory this run should use: the repo-local per-run directory
+ * when it is short enough for unix-socket paths, and a short directory under
+ * the OS temp root when it is not (#387). Pure resolution — nothing is
+ * created, nothing is probed; `agentTmpEnv` owns the side effects.
+ */
+export function resolveAgentTmpDir(dataDir, runId) {
+    const local = agentTmpDir(dataDir, runId);
+    if (Buffer.byteLength(local, 'utf8') <= MAX_SOCKET_SAFE_DIR_LENGTH)
+        return local;
+    const fallback = fallbackTmpDir(dataDir, runId);
+    if (Buffer.byteLength(fallback, 'utf8') <= MAX_SOCKET_SAFE_DIR_LENGTH)
+        return fallback;
+    // Nothing fits — a host TMPDIR so long that even the OS-root candidate
+    // crosses the cap. Minting either would hand the agent a temp directory
+    // that cannot serve unix sockets: the silent failure #387 is about. Fail
+    // the spawn with the named error instead; the remedy names the escape.
+    throw new AgentTempDirError(Buffer.byteLength(fallback) < Buffer.byteLength(local) ? fallback : local, new Error(`no socket-safe temp directory exists — repo-local path is `
+        + `${Buffer.byteLength(local)} bytes and the OS temp root candidate is `
+        + `${Buffer.byteLength(fallback)} bytes, both past the `
+        + `${MAX_SOCKET_SAFE_DIR_LENGTH}-byte unix socket budget`));
+}
 /** `errno` → the phrasing a human recognises from their shell. */
 const REASONS = {
     EDQUOT: 'Disk quota exceeded',
@@ -110,20 +220,33 @@ function probeWritable(dir) {
  * directory actually accepts writes. Throws `AgentTempDirError` when it does
  * not — callers turn that into the run's error rather than spawning.
  *
+ * The directory is `resolveAgentTmpDir`'s call: repo-local when that path is
+ * short enough for unix-socket paths, a digest-named directory under the OS
+ * temp root when the checkout is too deep for one (#387). In the shared OS
+ * root the directory is created private to this user (0700); repo-local
+ * scratch already sits inside the user's own tree and keeps the default mode
+ * it always had.
+ *
  * All three spellings are set, on every platform: a tool that reads `TMP` (or
  * `TEMP`) would otherwise keep following the host value straight back to the
  * exhausted directory this exists to escape.
  *
- * Returns `{}` under the opt-out, without probing anything: the hatch turns the
- * whole feature off, preflight included, so it stays an escape someone can
+ * Returns `{}` under the opt-out, without probing anything: the hatch turns
+ * the whole feature off, preflight included, so it stays an escape someone can
  * actually take.
  */
 export function agentTmpEnv(dataDir, runId, env = process.env) {
     if (!agentTmpDirEnabled(env))
         return {};
-    const dir = agentTmpDir(dataDir, runId);
+    const local = agentTmpDir(dataDir, runId);
+    const dir = resolveAgentTmpDir(dataDir, runId);
     try {
-        mkdirSync(dir, { recursive: true });
+        mkdirSync(dir, dir === local ? { recursive: true } : { recursive: true, mode: 0o700 });
+        // In the shared OS root the directory carries its ownership marker, so a
+        // startup sweep from another project can tell it apart from stale
+        // scratch (the sweep skips anything whose marker is missing or foreign).
+        if (dir !== local)
+            writeOwnerMarker(dir, dataDir);
     }
     catch (err) {
         throw new AgentTempDirError(dir, err);
@@ -135,44 +258,99 @@ export function agentTmpEnv(dataDir, runId, env = process.env) {
  * Reap one run's directory. Scratch, not an artifact: nothing reads it once the
  * agent is gone, and a Continue re-creates it through `agentTmpEnv`. Never
  * throws — reaping must not break a terminal transition.
+ *
+ * Both locations are tried because the resolution depends on the length of
+ * `dataDir`, which a Continue or a re-base can change between mint and reap;
+ * removing a name that was never minted is a no-op, so trying both is pure
+ * safety.
  */
 export function removeAgentTmpDir(dataDir, runId) {
     if (!safeRunId(runId))
         return;
-    try {
-        rmSync(agentTmpDir(dataDir, runId), { recursive: true, force: true });
-    }
-    catch {
-        // best-effort; the startup sweep picks up whatever survives.
+    for (const dir of [agentTmpDir(dataDir, runId), fallbackTmpDir(dataDir, runId)]) {
+        try {
+            rmSync(dir, { recursive: true, force: true });
+        }
+        catch {
+            // best-effort; the startup sweep picks up whatever survives.
+        }
     }
 }
 /**
  * Remove every per-run directory that is not in `keepRunIds` — the startup
  * sweep, so a crash (which never reaches the terminal-transition reap) cannot
- * accumulate them forever. Confined to `<dataDir>/tmp`; sibling run state is
- * never enumerated, let alone touched. Returns the ids actually reaped.
+ * accumulate them forever. Two confined roots are swept and nothing else:
+ *
+ *   - `<dataDir>/tmp`, where entries ARE the run ids (reports the ids reaped);
+ *   - the OS temp root's `cez-agent-<12 hex>` directories (#387), where the
+ *     name digests the dataDir and is not reversible to a run id (reports the
+ *     directory names reaped). The pattern is exact — prefix, lowercase hex,
+ *     fixed length, directories only — and a directory is removed only when
+ *     its `.cez-owner` marker names THIS dataDir and none of this dataDir's
+ *     kept runs claims it, so another project's scratch in the shared root is
+ *     never touched.
  */
 export function sweepAgentTmpDirs(dataDir, keepRunIds) {
-    const root = agentTmpRoot(dataDir);
-    if (!existsSync(root))
-        return [];
     const keep = new Set(keepRunIds);
     const reaped = [];
     let entries;
+    const root = agentTmpRoot(dataDir);
+    if (existsSync(root)) {
+        try {
+            entries = readdirSync(root, { withFileTypes: true })
+                .filter((e) => e.isDirectory())
+                .map((e) => e.name);
+        }
+        catch {
+            entries = [];
+        }
+        for (const name of entries) {
+            if (keep.has(name) || !safeRunId(name))
+                continue;
+            try {
+                rmSync(join(root, name), { recursive: true, force: true });
+                reaped.push(name);
+            }
+            catch {
+                // best-effort: a locked directory is retried on the next boot.
+            }
+        }
+    }
+    // The #387 fallback location, in the shared OS temp root. Kept narrow on
+    // purpose: exact prefix, 12 lowercase-hex name, directories only, and
+    // ownership — a directory is removed only when its `.cez-owner` marker
+    // names THIS dataDir (a marker that is missing or foreign is another
+    // project's, or unknown, and is never ours to remove) and none of this
+    // dataDir's kept runs claims it.
+    const owner = dataDirOwner(dataDir);
+    const claimed = new Set([...keep].filter(safeRunId).map((id) => basename(fallbackTmpDir(dataDir, id))));
+    const osRoot = osTempRoot();
+    let fallbackEntries;
     try {
-        entries = readdirSync(root, { withFileTypes: true })
-            .filter((e) => e.isDirectory())
-            .map((e) => e.name);
+        fallbackEntries = readdirSync(osRoot, { withFileTypes: true });
     }
     catch {
-        return [];
+        return reaped;
     }
-    for (const name of entries) {
-        if (keep.has(name) || !safeRunId(name))
+    for (const entry of fallbackEntries) {
+        if (!entry.isDirectory() || !entry.name.startsWith(FALLBACK_PREFIX))
+            continue;
+        if (!/^[0-9a-f]{12}$/.test(entry.name.slice(FALLBACK_PREFIX.length)))
+            continue;
+        let entryOwner;
+        try {
+            entryOwner = readFileSync(join(osRoot, entry.name, OWNER_FILE), 'utf8').trim();
+        }
+        catch {
+            continue; // no readable marker: unknown ownership is never ours to remove.
+        }
+        if (entryOwner !== owner)
+            continue;
+        if (claimed.has(entry.name))
             continue;
         try {
-            rmSync(join(root, name), { recursive: true, force: true });
-            reaped.push(name);
+            rmSync(join(osRoot, entry.name), { recursive: true, force: true });
+            reaped.push(entry.name);
         }
         catch {
             // best-effort: a locked directory is retried on the next boot.

package/dist/runs/agent-tmpdir.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-tmpdir.js","sourceRoot":"","sources":["../../src/runs/agent-tmpdir.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;8EAK8E;AAC9E,SAAS,SAAS,CAAC,EAAU;IAC3B,OAAO,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC;AACnE,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,KAAa;IACxD,OAAO,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED;kFACkF;AAClF,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,kEAAkE;AAClE,MAAM,OAAO,GAAqC;IAChD,MAAM,EAAE,qBAAqB;IAC7B,MAAM,EAAE,yBAAyB;IACjC,MAAM,EAAE,mBAAmB;IAC3B,KAAK,EAAE,yBAAyB;IAChC,KAAK,EAAE,uBAAuB;CAC/B,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAS;IAEtB,YAAY,IAAY,EAAE,MAAe;QACvC,MAAM,IAAI,GAAI,MAA4C,EAAE,IAAI,CAAC;QACjE,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;eAC9B,IAAI;eACJ,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,KAAK,CACH,yCAAyC,IAAI,KAAK,GAAG,uBAAuB;cACxE,2DAA2D,CAChE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;kFACkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACrE,OAAO,GAAG,CAAC,gBAAgB,KAAK,GAAG,CAAC;AACtC,CAAC;AAED;8EAC8E;AAC9E,IAAI,QAAQ,GAAG,CAAC,CAAC;AAEjB;;;;;GAKG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,KAAa,EACb,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IACD,aAAa,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,KAAa;IAC9D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,OAAO;IAC9B,IAAI,CAAC;QACH,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,UAA4B;IAC7E,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aACjD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;aAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QACjD,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"agent-tmpdir.js","sourceRoot":"","sources":["../../src/runs/agent-tmpdir.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAChH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE3C;;;;;8EAK8E;AAC9E,SAAS,SAAS,CAAC,EAAU;IAC3B,OAAO,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC;AACnE,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,KAAa;IACxD,OAAO,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED;kFACkF;AAClF,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C;;kFAEkF;AAClF,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,eAAe,GAAG,YAAY,CAAC;AACrC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC;;;8EAG8E;AAC9E,MAAM,UAAU,GAAG,YAAY,CAAC;AAEhC,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,GAAW,EAAE,OAAe;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;QAChE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,KAAa;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,KAAa;IAC/D,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,0BAA0B;QAAE,OAAO,KAAK,CAAC;IACjF,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,0BAA0B;QAAE,OAAO,QAAQ,CAAC;IACvF,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,IAAI,iBAAiB,CACzB,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EACzE,IAAI,KAAK,CACP,4DAA4D;UACxD,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,2CAA2C;UACtE,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,wBAAwB;UACtD,GAAG,0BAA0B,0BAA0B,CAC5D,CACF,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,OAAO,GAAqC;IAChD,MAAM,EAAE,qBAAqB;IAC7B,MAAM,EAAE,yBAAyB;IACjC,MAAM,EAAE,mBAAmB;IAC3B,KAAK,EAAE,yBAAyB;IAChC,KAAK,EAAE,uBAAuB;CAC/B,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAS;IAEtB,YAAY,IAAY,EAAE,MAAe;QACvC,MAAM,IAAI,GAAI,MAA4C,EAAE,IAAI,CAAC;QACjE,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;eAC9B,IAAI;eACJ,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,KAAK,CACH,yCAAyC,IAAI,KAAK,GAAG,uBAAuB;cACxE,2DAA2D,CAChE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;kFACkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACrE,OAAO,GAAG,CAAC,gBAAgB,KAAK,GAAG,CAAC;AACtC,CAAC;AAED;8EAC8E;AAC9E,IAAI,QAAQ,GAAG,CAAC,CAAC;AAEjB;;;;;GAKG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,KAAa,EACb,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvF,yEAAyE;QACzE,kEAAkE;QAClE,yEAAyE;QACzE,IAAI,GAAG,KAAK,KAAK;YAAE,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IACD,aAAa,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,KAAa;IAC9D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,OAAO;IAC9B,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAChF,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,UAA4B;IAC7E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAiB,CAAC;IACtB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;iBACjD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;iBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAAE,SAAS;YACjD,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,iCAAiC;IACjC,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAC/E,CAAC;IACF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,eAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,eAAe,GAAG,WAAW,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,SAAS;QAC9E,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAAE,SAAS;QAC/E,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,iEAAiE;QAC7E,CAAC;QACD,IAAI,UAAU,KAAK,KAAK;YAAE,SAAS;QACnC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/server.d.ts

@@ -406,10 +406,15 @@ export declare function createApp(deps: ServerDeps): import("hono/hono-base").Ho
                     } | {
                         role: "root";
                         wait?: {
+                            requestIds?: string[] | undefined;
                             phase: "parked" | "registered" | "wake-pending";
                         } | undefined;
                     } | {
                         role: "worker";
+                        wait?: {
+                            requestIds?: string[] | undefined;
+                            phase: "parked" | "registered" | "wake-pending";
+                        } | undefined;
                     } | undefined;
                     createdAt: string;
                     finishedAt?: string | undefined;
@@ -3957,19 +3962,6 @@ export declare function createApp(deps: ServerDeps): import("hono/hono-base").Ho
 } & {
     "/repo/commit/:sha": {
         $get: {
-            output: string;
-            outputFormat: "text";
-            status: import("hono/utils/http-status").ContentfulStatusCode;
-            input: {
-                query: {
-                    structured?: string | undefined;
-                };
-            } & {
-                param: {
-                    sha: string;
-                };
-            };
-        } | {
             output: {
                 error: string;
                 code?: "invalid_input" | undefined;
@@ -4033,6 +4025,19 @@ export declare function createApp(deps: ServerDeps): import("hono/hono-base").Ho
                     sha: string;
                 };
             };
+        } | {
+            output: string;
+            outputFormat: "text";
+            status: import("hono/utils/http-status").ContentfulStatusCode;
+            input: {
+                query: {
+                    structured?: string | undefined;
+                };
+            } & {
+                param: {
+                    sha: string;
+                };
+            };
         };
     };
 } & {
@@ -10093,20 +10098,20 @@ export declare function createApp(deps: ServerDeps): import("hono/hono-base").Ho
 } & {
     "/runs/:id/handoff": {
         $get: {
-            output: string;
-            outputFormat: "text";
-            status: 200;
+            output: {
+                error: string;
+            };
+            outputFormat: "json";
+            status: 404;
             input: {
                 param: {
                     id: string;
                 };
             };
         } | {
-            output: {
-                error: string;
-            };
-            outputFormat: "json";
-            status: 404;
+            output: string;
+            outputFormat: "text";
+            status: 200;
             input: {
                 param: {
                     id: string;
@@ -10144,20 +10149,20 @@ export declare function createApp(deps: ServerDeps): import("hono/hono-base").Ho
 } & {
     "/runs/:id/diff": {
         $get: {
-            output: string;
-            outputFormat: "text";
-            status: import("hono/utils/http-status").ContentfulStatusCode;
+            output: {
+                error: string;
+            };
+            outputFormat: "json";
+            status: 404;
             input: {
                 param: {
                     id: string;
                 };
             };
         } | {
-            output: {
-                error: string;
-            };
-            outputFormat: "json";
-            status: 404;
+            output: string;
+            outputFormat: "text";
+            status: import("hono/utils/http-status").ContentfulStatusCode;
             input: {
                 param: {
                     id: string;
@@ -12534,19 +12539,6 @@ export declare function createApp(deps: ServerDeps): import("hono/hono-base").Ho
 } & {
     "/repo/commit/:sha": {
         $get: {
-            output: string;
-            outputFormat: "text";
-            status: import("hono/utils/http-status").ContentfulStatusCode;
-            input: {
-                query: {
-                    structured?: string | undefined;
-                };
-            } & {
-                param: {
-                    sha: string;
-                };
-            };
-        } | {
             output: {
                 error: string;
                 code?: "invalid_input" | undefined;
@@ -12610,6 +12602,19 @@ export declare function createApp(deps: ServerDeps): import("hono/hono-base").Ho
                     sha: string;
                 };
             };
+        } | {
+            output: string;
+            outputFormat: "text";
+            status: import("hono/utils/http-status").ContentfulStatusCode;
+            input: {
+                query: {
+                    structured?: string | undefined;
+                };
+            } & {
+                param: {
+                    sha: string;
+                };
+            };
         };
     };
 } & {
@@ -18670,20 +18675,20 @@ export declare function createApp(deps: ServerDeps): import("hono/hono-base").Ho
 } & {
     "/runs/:id/handoff": {
         $get: {
-            output: string;
-            outputFormat: "text";
-            status: 200;
+            output: {
+                error: string;
+            };
+            outputFormat: "json";
+            status: 404;
             input: {
                 param: {
                     id: string;
                 };
             };
         } | {
-            output: {
-                error: string;
-            };
-            outputFormat: "json";
-            status: 404;
+            output: string;
+            outputFormat: "text";
+            status: 200;
             input: {
                 param: {
                     id: string;
@@ -18721,20 +18726,20 @@ export declare function createApp(deps: ServerDeps): import("hono/hono-base").Ho
 } & {
     "/runs/:id/diff": {
         $get: {
-            output: string;
-            outputFormat: "text";
-            status: import("hono/utils/http-status").ContentfulStatusCode;
+            output: {
+                error: string;
+            };
+            outputFormat: "json";
+            status: 404;
             input: {
                 param: {
                     id: string;
                 };
             };
         } | {
-            output: {
-                error: string;
-            };
-            outputFormat: "json";
-            status: 404;
+            output: string;
+            outputFormat: "text";
+            status: import("hono/utils/http-status").ContentfulStatusCode;
             input: {
                 param: {
                     id: string;

package/dist/workflows/run.d.ts

@@ -282,6 +282,10 @@ export declare class RunManager {
      *  `active`, which is why the timer cannot live on an `ActiveRun` like the monitoring one. */
     private readonly autoResumeTimers;
     private pumping;
+    /** The scheduler only needs repo presence, stable for this manager's lifetime.
+     * Cache the promise (including null) so every sweep doesn't spawn Git (#364).
+     * execute() still reads fresh branch/remote metadata for each run. */
+    private pumpRepoInfo?;
     /** A pump that arrived while one was in flight — replayed by `pump()`'s own
      *  loop so a slot freed mid-sweep is never a lost wakeup. */
     private pumpAgain;

package/dist/workflows/run.js

@@ -606,6 +606,10 @@ export class RunManager {
      *  `active`, which is why the timer cannot live on an `ActiveRun` like the monitoring one. */
     autoResumeTimers = new Map();
     pumping = false;
+    /** The scheduler only needs repo presence, stable for this manager's lifetime.
+     * Cache the promise (including null) so every sweep doesn't spawn Git (#364).
+     * execute() still reads fresh branch/remote metadata for each run. */
+    pumpRepoInfo;
     /** A pump that arrived while one was in flight — replayed by `pump()`'s own
      *  loop so a slot freed mid-sweep is never a lost wakeup. */
     pumpAgain = false;
@@ -1077,7 +1081,7 @@ export class RunManager {
         try {
             do {
                 this.pumpAgain = false;
-                const repo = await getRepoInfo(this.repoRoot);
+                const repo = await (this.pumpRepoInfo ??= getRepoInfo(this.repoRoot));
                 const maxParallel = this.semaphore.maxParallel();
                 // Per-project ceiling (spec 2026-07-22-per-project-concurrency): this
                 // project never runs more than its own configured `maxParallel`; absent
@@ -3461,6 +3465,9 @@ export class RunManager {
                 finishedAt: undefined,
                 currentStepId: undefined,
             });
+            // Enqueueing must wake the scheduler even if the previous execution's
+            // slot-release sweep has already finished (#364).
+            void this.pump();
             return { ok: true };
         }
         this.starting.add(runId);