@zq-silk/yui 2.23.0 → 2.25.0

package/dist/repository/gitWorktreeInventory.js

@@ -1,16 +1,12 @@
-import { execFile } from "node:child_process";
 import { lstat, readFile, readdir, realpath } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
-import { promisify } from "node:util";
 import { gitOutputLine, supportedGit } from "./gitCompatibility.js";
-const execute = promisify(execFile);
-async function run(args) {
-    return (await execute(supportedGit().path, args, {
-        encoding: "utf8", timeout: 10_000, maxBuffer: 1024 * 1024
-    })).stdout;
+import { executeGitCommand } from "./gitCommand.js";
+async function run(args, budget) {
+    return (await executeGitCommand(supportedGit(budget?.totalMs).path, args, { budget })).stdout.toString("utf8");
 }
-export async function gitPath(cwd, args) {
-    return resolve(cwd, gitOutputLine(await run(["-C", cwd, "rev-parse", ...args])));
+export async function gitPath(cwd, args, budget) {
+    return resolve(cwd, gitOutputLine(await run(["-C", cwd, "rev-parse", ...args], budget)));
 }
 async function exists(path) {
     try {
@@ -29,13 +25,13 @@ async function exists(path) {
  * never write/prune them, and never infer ownership merely from a directory.
  * Mutating consumers still check the recorded owner and ask Git to remove it.
  */
-export async function readGitWorktrees(cwd) {
-    const common = await realpath(await gitPath(cwd, ["--git-common-dir"]));
+export async function readGitWorktrees(cwd, budget) {
+    const common = await realpath(await gitPath(cwd, ["--git-common-dir"], budget));
     const result = [];
     // This is also Git's own main-worktree listing convention (including bare
     // and separate-git-dir repositories), not a claim of managed ownership.
     const main = basename(common) === ".git" ? dirname(common) : common;
-    result.push(await inspect(common, main, false));
+    result.push(await inspect(common, main, false, budget));
     const directory = join(common, "worktrees");
     let entries;
     try {
@@ -59,27 +55,27 @@ export async function readGitWorktrees(cwd) {
         const path = dirname(resolve(admin, pointer));
         const adminCommon = await realpath(resolve(cwd, gitOutputLine(await run([
             "-C", cwd, `--git-dir=${admin}`, "rev-parse", "--git-common-dir"
-        ]))));
+        ], budget))));
         if (adminCommon !== common)
             throw new Error(`Git worktree common directory mismatch: ${admin}; retained.`);
         if (await exists(path)) {
-            const actual = await realpath(await gitPath(path, ["--git-dir"]));
+            const actual = await realpath(await gitPath(path, ["--git-dir"], budget));
             if (actual !== admin)
                 throw new Error(`Git worktree back-pointer mismatch: ${path}; retained.`);
         }
-        result.push(await inspect(admin, path, true));
+        result.push(await inspect(admin, path, true, budget));
     }
     if (new Set(result.map(entry => entry.path)).size !== result.length) {
         throw new Error("Duplicate Git worktree registrations; retained.");
     }
     return result;
 }
-async function inspect(admin, path, linked) {
+async function inspect(admin, path, linked, budget) {
     // Ask Git rather than parsing HEAD: Git owns ref storage (including newer
     // backends), symbolic resolution and per-worktree pseudorefs.
     let branch;
     try {
-        branch = gitOutputLine(await run([`--git-dir=${admin}`, "symbolic-ref", "--quiet", "HEAD"]));
+        branch = gitOutputLine(await run([`--git-dir=${admin}`, "symbolic-ref", "--quiet", "HEAD"], budget));
     }
     catch (error) {
         if (error.code !== 1)
@@ -90,7 +86,7 @@ async function inspect(admin, path, linked) {
     }
     let head;
     try {
-        head = gitOutputLine(await run([`--git-dir=${admin}`, "rev-parse", "--verify", "HEAD"]));
+        head = gitOutputLine(await run([`--git-dir=${admin}`, "rev-parse", "--verify", "HEAD"], budget));
         if (!/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/iu.test(head))
             throw new Error("Invalid Git HEAD");
     }
@@ -99,7 +95,7 @@ async function inspect(admin, path, linked) {
         if (branch === undefined)
             throw error;
         try {
-            await run([`--git-dir=${admin}`, "show-ref", "--verify", "--quiet", branch]);
+            await run([`--git-dir=${admin}`, "show-ref", "--verify", "--quiet", branch], budget);
         }
         catch (missing) {
             if (missing.code === 1) {

package/dist/repository/projectRefresh.js

@@ -41,7 +41,7 @@ export async function refreshRegisteredProject(store, id, options = {}) {
     try {
         const current = check();
         options.beforeRefresh?.();
-        const refreshed = await (options.git ?? new NodeGitWorkspace()).refresh({
+        const refreshed = await (options.git ?? new NodeGitWorkspace(() => store.getConfig())).refresh({
             repositoryPath: current.path, remoteUrl: current.remoteUrl, stableRef: current.stableBranch
         });
         return { project: current, ...refreshed };

package/dist/repository/taskBaseFreshness.js

@@ -59,7 +59,7 @@ export function recordTaskBaseProvenanceEvents(tx, taskId, provenance, now) {
 }
 export async function inspectTaskBaseFreshness(taskId, store, options = {}) {
     const task = requireTask(store, taskId);
-    const git = options.git ?? newGitWorkspace();
+    const git = options.git ?? new NodeGitWorkspace(() => store.getConfig());
     const workspace = store.getTaskWorkspace(taskId);
     // Collect active AgentRun workspace snapshots once so every Project entry can
     // report whether a live AgentRun is pinned to a different commit.
@@ -169,9 +169,6 @@ export function renderTaskBaseFreshnessReport(report) {
     }
     return lines.join("\n").concat("\n");
 }
-function newGitWorkspace() {
-    return new NodeGitWorkspace();
-}
 function requireTask(store, taskId) {
     const task = store.getTask(taskId);
     if (task === null)

package/dist/repository/taskWorkspacePreparer.js

@@ -67,7 +67,7 @@ export class FileTaskWorkspacePreparer {
     git;
     now;
     maintenanceLockOptions;
-    constructor(home, store, git = new NodeGitWorkspace(), now = () => new Date(), maintenanceLockOptions = {}) {
+    constructor(home, store, git = new NodeGitWorkspace(() => store.getConfig()), now = () => new Date(), maintenanceLockOptions = {}) {
         this.home = home;
         this.store = store;
         this.git = git;

package/dist/runtime/nativeExecutable.js

@@ -1,9 +1,12 @@
 import { fileURLToPath } from "node:url";
+import { unsupportedPlatformMessage } from "./platform.js";
 /** Native binaries are shipped together; never execute another platform's helper. */
 export function nativeExecutable(name, platform = process.platform, architecture = process.arch) {
     const target = `${platform}-${architecture}`;
-    if (!["linux-x64", "darwin-x64", "darwin-arm64"].includes(target)
-        || (name === "process-identity" && platform !== "darwin")) {
+    const failure = unsupportedPlatformMessage(platform, architecture);
+    if (failure !== undefined)
+        throw new Error(failure);
+    if (name === "process-identity" && platform !== "darwin") {
         throw new Error(`Unsupported native runtime: ${target}/${name}.`);
     }
     return fileURLToPath(new URL(`./native/${target}/${name}`, import.meta.url));

package/dist/runtime/platform.js

@@ -0,0 +1,11 @@
+/** Check the Node runtime's exact OS/architecture before loading the control plane. */
+export function unsupportedPlatformMessage(platform = process.platform, architecture = process.arch) {
+    const target = `${platform}-${architecture}`;
+    if (target === "linux-x64" || target === "darwin-arm64")
+        return undefined;
+    return `Unsupported Yui runtime: ${target}. `
+        + "Yui supports Linux x64 (glibc) and macOS Apple Silicon with native arm64 Node.js."
+        + (target === "darwin-x64"
+            ? " macOS Intel is no longer supported; Intel Macs must remain on Yui 2.23.0."
+            : "");
+}

package/dist/storage/sqliteSchema.js

@@ -315,6 +315,16 @@ const MINOR_UPGRADES = Object.freeze([{
         // Additive exact-identity intent/confirmation files under runtime/native-titles.
         // Never invent native ownership or replay history during migration.
         sql: ""
+    }, {
+        fromVersion: "1.28",
+        toVersion: "1.29",
+        name: "git-command-budgets",
+        introducedIn: "2.24.0",
+        sourceChecksum: CURRENT_SCHEMA_CHECKSUM,
+        targetChecksum: CURRENT_SCHEMA_CHECKSUM,
+        // Optional local/remote Git budgets in config. Absence uses runtime defaults;
+        // preserve every existing payload byte rather than persisting defaults.
+        sql: ""
     }]);
 export function storageMinorUpgradePlan(from) {
     if (from === CURRENT_STORAGE_VERSION)

package/dist/storage/storageVersions.js

@@ -1,4 +1,4 @@
-export const CURRENT_STORAGE_VERSION = "1.28";
+export const CURRENT_STORAGE_VERSION = "1.29";
 export const MIN_SUPPORTED_STORAGE_VERSION = "1.0";
 export const STORAGE_FORMAT = "yui-home";
 export function isStorageVersion(value) {

package/dist/storage/taskStore.js

@@ -4,7 +4,7 @@ import { validateModelConnection } from "../models/modelManagementConfig.js";
 import { basename, dirname, join, resolve } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { resolveTimeZone } from "../config/timeZone.js";
-import { reconciliationIntervalMilliseconds, resolveAgentLaunchInactivityTimeoutSeconds, resolveControllerTaskConcurrency, resolveDeliveryTimeoutSeconds, resolveResourcesGcAutoQuarantine, resolveResourcesGcMode, resolveResourcesQuarantineTtlHours, resolveRuntimeHealth, resolveTelemetryEnabled, resolveTelemetryRunCap, resolveTelemetryTerminalKeep, resolveTmuxBin, resolveTmuxHistoryLimit } from "../config/yuiConfig.js";
+import { reconciliationIntervalMilliseconds, resolveAgentLaunchInactivityTimeoutSeconds, resolveControllerTaskConcurrency, resolveDeliveryTimeoutSeconds, resolveGitLocalTimeoutSeconds, resolveGitRemoteInactivityTimeoutSeconds, resolveGitRemoteTimeoutSeconds, resolveResourcesGcAutoQuarantine, resolveResourcesGcMode, resolveResourcesQuarantineTtlHours, resolveRuntimeHealth, resolveTelemetryEnabled, resolveTelemetryRunCap, resolveTelemetryTerminalKeep, resolveTmuxBin, resolveTmuxHistoryLimit } from "../config/yuiConfig.js";
 import { validateCapabilityGrant } from "../grant/capabilityGrant.js";
 import { validateReleaseWorkflow } from "../release/releaseWorkflow.js";
 import { validateReviewConfig } from "../review/reviewConfig.js";
@@ -131,6 +131,9 @@ export function validateYuiConfig(config) {
             "controllerTaskConcurrency",
             "agentLaunchInactivityTimeoutSeconds",
             "deliveryTimeoutSeconds",
+            "gitLocalTimeoutSeconds",
+            "gitRemoteInactivityTimeoutSeconds",
+            "gitRemoteTimeoutSeconds",
             "resourcesQuarantineTtlHours",
             "tmuxBin",
             "tmuxHistoryLimit",
@@ -159,6 +162,9 @@ export function validateYuiConfig(config) {
         resolveControllerTaskConcurrency(config.controllerTaskConcurrency);
         resolveAgentLaunchInactivityTimeoutSeconds(config.agentLaunchInactivityTimeoutSeconds);
         resolveDeliveryTimeoutSeconds(config.deliveryTimeoutSeconds);
+        resolveGitLocalTimeoutSeconds(config.gitLocalTimeoutSeconds);
+        resolveGitRemoteInactivityTimeoutSeconds(config.gitRemoteInactivityTimeoutSeconds);
+        resolveGitRemoteTimeoutSeconds(config.gitRemoteTimeoutSeconds);
         resolveTmuxBin(config.tmuxBin);
         resolveTmuxHistoryLimit(config.tmuxHistoryLimit);
         resolveTelemetryEnabled(config.telemetryEnabled);

package/dist/web/webConversation.js

@@ -227,7 +227,7 @@ export function createWebConversationSurface(store, surface, plan, readPage = re
             if (["completed", "cancelled", "retired", "archived"].includes(task.status)) {
                 throw new WebRequestRejected("Terminal Task materials are read-only.");
             }
-            return saveTextMaterial(store.rootDirectory(), owner.taskId, id, input);
+            return saveTextMaterial(store.rootDirectory(), owner.taskId, id, input, () => store.getConfig());
         },
         state(owner, offset = 0) {
             const set = sessions(owner);
@@ -296,7 +296,7 @@ export function createWebConversationSurface(store, surface, plan, readPage = re
                 if (owner.scope !== "task" || input.action === "interrupt")
                     throw new WebRequestRejected("Materials require Task text input.");
                 try {
-                    body = await materialInputBody(store.rootDirectory(), owner.taskId, required(body), input.materials);
+                    body = await materialInputBody(store.rootDirectory(), owner.taskId, required(body), input.materials, () => store.getConfig());
                 }
                 catch (error) {
                     throw new WebRequestRejected(error instanceof Error ? error.message : "Invalid material.");

package/dist/web/webMaterials.js

@@ -16,24 +16,24 @@ const TEXT_EXTENSIONS = new Set([
 const TEXT_NAMES = new Set(["readme", "license", "dockerfile", "makefile"]);
 export const MAX_MATERIAL_BYTES = 256 * 1024;
 const PAGE_CHARACTERS = 12000;
-async function fixedImage(home, taskId, input) {
+async function fixedImage(home, taskId, input, getConfig) {
     if (input.taskId !== taskId)
         throw new WebRequestRejected("Materials must belong to the same Task.");
     const ref = validateGitArtifactRef(input);
     if (ref.relativePath.length > 512)
         throw new WebRequestRejected("Image path is too long.");
-    const file = await resolveGitArtifact(home, ref);
+    const file = await resolveGitArtifact(home, ref, getConfig);
     const metadata = rasterMetadata(file.bytes);
     return { ...ref, digest: file.digest, kind: "image", byteSize: file.bytes.length,
         ...metadata, base64: file.bytes.toString("base64") };
 }
 /** One selected immutable file, never a workspace path or a remote URL.
  * Markdown is bounded and whole so fences/tables are not split by pagination. */
-export async function readArtifactPreview(home, taskId, ref, offset = 0) {
+export async function readArtifactPreview(home, taskId, ref, offset = 0, getConfig) {
     if (ref.taskId !== taskId)
         throw new WebRequestRejected("Materials must belong to the same Task.");
     const valid = validateGitArtifactRef(ref);
-    const file = await resolveGitArtifact(home, valid);
+    const file = await resolveGitArtifact(home, valid, getConfig);
     return { ...valid, ...previewArtifactContent(file, offset) };
 }
 /** Shared data-only preview for Task and Job evidence; no path lookup or authority. */
@@ -81,12 +81,12 @@ function decodeText(bytes) {
     }
     return text;
 }
-async function fixedText(home, taskId, input) {
+async function fixedText(home, taskId, input, getConfig) {
     if (input.taskId !== taskId)
         throw new WebRequestRejected("Materials must belong to the same Task.");
     const ref = validateGitArtifactRef(input);
     textPath(ref.relativePath);
-    const file = await resolveGitArtifact(home, ref);
+    const file = await resolveGitArtifact(home, ref, getConfig);
     return { ref: { ...ref, digest: file.digest }, text: decodeText(file.bytes), bytes: file.bytes.length };
 }
 function page(text, offset = 0) {
@@ -100,26 +100,26 @@ function page(text, offset = 0) {
     return { content: text.slice(offset, end), offset, totalCharacters: text.length,
         nextOffset: end < text.length ? end : null };
 }
-export async function readTextArtifactPage(home, taskId, ref, offset = 0) {
-    const file = await fixedText(home, taskId, ref);
+export async function readTextArtifactPage(home, taskId, ref, offset = 0, getConfig) {
+    const file = await fixedText(home, taskId, ref, getConfig);
     return { ...file.ref, byteSize: file.bytes, ...page(file.text, offset) };
 }
-export async function compareTextArtifacts(home, taskId, before, after, offset = 0) {
-    const left = await fixedText(home, taskId, before);
-    const right = await fixedText(home, taskId, after);
+export async function compareTextArtifacts(home, taskId, before, after, offset = 0, getConfig) {
+    const left = await fixedText(home, taskId, before, getConfig);
+    const right = await fixedText(home, taskId, after, getConfig);
     // Blob identities avoid interpreting user paths as options or reading the
     // working tree. Neither external diff drivers nor text converters can run.
-    const repo = openTaskArtifactRepository(home, taskId);
+    const repo = openTaskArtifactRepository(home, taskId, getConfig);
     const diff = await managedGit(repo.repoPath, [
         "diff", "--no-ext-diff", "--no-textconv", "--no-color", "--unified=3",
         `${left.ref.commit}:${left.ref.relativePath}`, `${right.ref.commit}:${right.ref.relativePath}`, "--"
-    ], { maxBuffer: 20 * 1024 * 1024, timeoutMs: 5000 });
+    ], { maxBuffer: 20 * 1024 * 1024, getConfig });
     return { taskId, before: left.ref, after: right.ref, ...page(diff, offset) };
 }
 /** Saves DATA only. Sending it is a separate explicit conversation action.
  * The normal artifact repository and commit message retain origin; no second
  * storage/receipt schema is introduced. Unknown saves are inspected, not replayed. */
-export async function saveTextMaterial(home, taskId, sessionId, input) {
+export async function saveTextMaterial(home, taskId, sessionId, input, getConfig) {
     if (!/^[A-Za-z0-9_-]{1,128}$/u.test(input.requestId)
         || typeof input.name !== "string" || input.name.includes("/") || input.name.includes("\\")
         || typeof input.content !== "string")
@@ -130,7 +130,7 @@ export async function saveTextMaterial(home, taskId, sessionId, input) {
         throw new WebRequestRejected(`Material exceeds ${MAX_MATERIAL_BYTES} UTF-8 bytes or has invalid text.`);
     }
     decodeText(bytes);
-    const repo = openTaskArtifactRepository(home, taskId);
+    const repo = openTaskArtifactRepository(home, taskId, getConfig);
     await repo.ensure();
     const head = (await repo.head());
     if ((await repo.list(head)).some(entry => entry.relativePath === relativePath)) {
@@ -141,22 +141,22 @@ export async function saveTextMaterial(home, taskId, sessionId, input) {
         return { taskId, relativePath, commit: head, digest: existing.digest };
     }
     return saveArtifactFile(home, taskId, { relativePath, bytes, expectedHead: head,
-        message: `Text material from Leader Session ${sessionId}; request ${input.requestId}` });
+        message: `Text material from Leader Session ${sessionId}; request ${input.requestId}` }, getConfig);
 }
 /** Existing durable Message body carries self-contained frozen references.
  * Contents are deliberately absent: reading material cannot elevate it to an
  * instruction, execute it, or broaden the receiving Agent's Task authority. */
-export async function materialInputBody(home, taskId, body, refs) {
+export async function materialInputBody(home, taskId, body, refs, getConfig) {
     if (!Array.isArray(refs) || refs.length > 8)
         throw new WebRequestRejected("Select at most eight material references.");
     const verified = [];
     for (const ref of refs) {
         if (isRasterArtifact(ref.relativePath)) {
-            const image = await fixedImage(home, taskId, ref);
+            const image = await fixedImage(home, taskId, ref, getConfig);
             verified.push({ taskId, commit: image.commit, relativePath: image.relativePath, digest: image.digest });
         }
         else
-            verified.push((await fixedText(home, taskId, ref)).ref);
+            verified.push((await fixedText(home, taskId, ref, getConfig)).ref);
     }
     if (!verified.length)
         return body;

package/dist/web/webTaskSurface.js

@@ -136,7 +136,7 @@ export function createWebTaskSurface(store, options = {}, observations = [], hos
         artifacts: async (taskId, selectedCommit, offset = 0) => {
             if (store.getTask(taskId) === null)
                 throw new WebRequestRejected("Task not found.");
-            const repo = openTaskArtifactRepository(store.rootDirectory(), taskId);
+            const repo = openTaskArtifactRepository(store.rootDirectory(), taskId, () => store.getConfig());
             if (selectedCommit !== undefined && !repo.exists())
                 throw new WebRequestRejected("Artifact revision unavailable.");
             const commit = selectedCommit ?? await repo.head();
@@ -151,12 +151,12 @@ export function createWebTaskSurface(store, options = {}, observations = [], hos
                 throw new WebRequestRejected("Task not found.");
             // The browser always names a fixed revision. Never substitute HEAD after
             // a missing object, and never execute/render artifact HTML as an app.
-            return readArtifactPreview(store.rootDirectory(), taskId, { taskId, relativePath, commit }, offset);
+            return readArtifactPreview(store.rootDirectory(), taskId, { taskId, relativePath, commit }, offset, () => store.getConfig());
         },
         artifactDiff: async (taskId, relativePath, commit, beforeCommit, offset = 0) => {
             if (store.getTask(taskId) === null)
                 throw new WebRequestRejected("Task not found.");
-            return compareTextArtifacts(store.rootDirectory(), taskId, { taskId, relativePath, commit: beforeCommit }, { taskId, relativePath, commit }, offset);
+            return compareTextArtifacts(store.rootDirectory(), taskId, { taskId, relativePath, commit: beforeCommit }, { taskId, relativePath, commit }, offset, () => store.getConfig());
         },
         globalState: (roleName) => {
             const role = store.getGlobalRole(roleName);

package/dist/workspace/workItemChangeSetManager.js

@@ -26,7 +26,7 @@ export class WorkItemChangeSetManager {
         const context = requireCapturableContext(this.store, taskId, workItemId, options.taskFinalReviewContract);
         const entries = capturableEntries(context);
         if (context.source === "task-main") {
-            const git = new NodeGitWorkspace();
+            const git = new NodeGitWorkspace(() => this.store.getConfig());
             for (const { entry, expectedHead } of entries) {
                 if (!await git.isClean(entry.path)) {
                     throw new Error(`Exact direct Candidate Task main must be clean: ${context.workItemId}/${entry.projectId}.`);
@@ -64,7 +64,7 @@ export class WorkItemChangeSetManager {
         const workspace = this.store.getWorkItemWorkspace(item.taskId, item.id);
         if (workspace === null)
             return { proof: null, checks: [] };
-        const git = new NodeGitWorkspace();
+        const git = new NodeGitWorkspace(() => this.store.getConfig());
         const projects = [];
         const checks = [];
         const sources = [`work-item:${taskId}/${workItemId}`,
@@ -189,7 +189,7 @@ export class WorkItemChangeSetManager {
         if (unresolved !== undefined) {
             throw new Error(`Task has an unresolved Integration Attempt: ${task.id}/${unresolved.id}.`);
         }
-        const git = new NodeGitWorkspace();
+        const git = new NodeGitWorkspace(() => this.store.getConfig());
         const remoteHeads = new Map();
         const findPublishedCommit = async (entry, headCommit) => {
             const project = this.store.getProject(entry.projectId);

package/docs/project-refresh.md

@@ -80,7 +80,8 @@ upstream is left untouched and carries no such promise.
 
 ## Scope of adoption
 
-This operation adds no persistent Yui schema or migration. Installing code
-that implements it does not itself refresh a real Project. A normal authorized
+Refresh bookkeeping adds no persistent Yui schema. The shared remote Git
+budget settings require storage 1.29; see [configuration](roles-and-configuration.md#git-operation-budgets).
+Installing this code does not itself refresh a real Project. A normal authorized
 refresh applies the behavior; Task completion, integration, publication and
 archive remain separate operations.

package/docs/project-refresh.zh-CN.md

@@ -63,5 +63,6 @@ upstream 保持原样，不作这一承诺。
 
 ## 采用边界
 
-本操作不新增 Yui 持久 schema 或迁移。安装实现代码不等于刷新真实 Project；
+refresh 记账不新增 Yui 持久 schema；共享远程 Git 预算配置要求存储 1.29，
+见[配置说明](roles-and-configuration.zh-CN.md#git-操作预算)。安装实现代码不等于刷新真实 Project；
 正常获授权的 refresh 才应用此行为。Task 完成、集成、发布和归档仍是独立操作。

package/docs/release-workflow.md

@@ -51,6 +51,62 @@ merely to avoid a version decision. Package versions remain distinct from protoc
 and persistent-storage contracts: their compatibility checks and required migrations
 are unchanged, and the storage rules below do not authorize a package release.
 
+### 2.25.0 compatibility and migration notes
+
+This minor release removes macOS Intel support. Supported runtimes are now
+Linux x64 (glibc) and macOS Apple Silicon with native arm64 Node.js. macOS x64,
+including x64 Node.js under Rosetta on Apple Silicon, is rejected before either
+CLI product is loaded or the Home is opened. Intel Macs must remain on 2.23.0;
+Apple Silicon users must switch to native arm64 Node.js before upgrading.
+The combined npm manifest cannot express OS/CPU pairs, so npm installation can
+still succeed on an unsupported combination. Runtime startup fails explicitly;
+no install scripts, fallback helpers or first-use downloads are added.
+The existing updater's staged-target preflight also rejects that runtime before
+Controller shutdown, global binary activation or storage migration.
+
+Native builds, package contents, Core CI and release smoke now cover only those
+two platforms. Every supported Node 20/22/24/26 install remains gated (8 rows),
+with process lifecycle coverage on Node 24 for each platform. The `v2.24.0`
+tag is retained as unpublished evidence: required Intel smoke jobs did not
+acquire hosted runners, and neither npm nor GitHub Release was published.
+2.25.0 includes its complete configurable Git budget/error-handling changes
+described below.
+
+Storage remains **1.29**; the platform removal adds no migration. Updating from
+2.23.0 still applies the declared **1.28 → 1.29** Git configuration migration.
+Back up the Home and use the normal upgrade/migration path; do not open a
+migrated Home with an older binary. Controller/Host protocols remain v1.
+Publication does not update the global CLI, migrate production data or restart
+shared services. Deterministic package/OS checks do not establish real-model
+or real remote-server behavior.
+
+### 2.24.0 unpublished tag: Git budgets and migration
+
+Git workspace and artifact operations now use a configurable local total
+budget, independent of clone, remote fetch and network `ls-remote`. Configure
+`git-local-timeout-seconds` (default 30),
+`git-remote-inactivity-timeout-seconds` (default 120), and
+`git-remote-timeout-seconds` (default 1800) under `yui config tools` or Web
+settings. Each accepts integer seconds from 1 to 86400. Changes apply to the
+next command, including Controller-owned commands; in-flight budgets do not
+change. See [Git operation budgets](roles-and-configuration.md#git-operation-budgets).
+
+Clone/fetch request progress without a terminal. Output resets only the
+inactivity clock, never the total deadline; activity is not semantic progress
+proof. Remote stderr keeps a bounded tail. Timeout errors retain their kind
+and budget, elapsed time, exit code, signal and stderr instead of reporting
+only the last progress line. Deadline termination includes the invocation's
+owned transport helpers; no automatic Git retry or rollback is introduced.
+
+Storage advances **1.28 → 1.29** through the centralized additive migration
+for the three optional settings. Existing config bytes remain unchanged and
+missing values use runtime defaults. Back up the Home and use the normal
+upgrade/migration path; do not open a migrated Home with an older binary.
+Controller/Host protocols remain v1. Exact-merge Core CI and the same runtime
+archive's fresh-install matrix gate publication. These deterministic checks
+do not establish real remote-server or real-model behavior. Publication does
+not update the global CLI, migrate production data or restart shared services.
+
 ### 2.23.0 compatibility and migration notes
 
 Host upgrades use explicit lifecycle signals and safe drain/reattachment
@@ -766,7 +822,7 @@ protection and valid exact-identity caches remain normal runtime behavior.
 
 Stable releases use npm `latest`; prereleases use `next`, never the stable
 default. The release workflow builds one runtime archive, verifies it across
-supported Node versions on Linux x64, macOS x64 and macOS arm64, publishes that exact archive to npm, then creates the
+supported Node versions on Linux x64 and macOS arm64, publishes that exact archive to npm, then creates the
 matching GitHub Release. Every release carries the runtime archive, checksum and
 provenance. A stable tag becomes GitHub latest; a prerelease does not.
 
@@ -1091,7 +1147,7 @@ It reuses the exact commit that passed core CI and adds only artifact assembly,
 fresh installation, and provenance checks required to publish.
 
 Business contracts and full Jobs/Schedules wiring run once in Core CI on Linux
-Node 24. Release still installs the same checksummed archive on all three
+Node 24. Release still installs the same checksummed archive on both supported
 platforms × Node 20/22/24/26: every install checks CLI/setup/native helpers,
 Doctor/PTY and real SQLite SQL/GC. Node 24 additionally checks real process
 lifecycle on each platform. See the [coverage table](testing/verification-levels.md#ci-and-release).

package/docs/release-workflow.zh-CN.md

@@ -36,6 +36,50 @@ Agent 选择一个预先声明的计划，设施从持久状态驱动该计划
 不能将不兼容冒称为兼容，也不为回避版本选择新增历史兼容机制。包版本与协议、
 持久存储契约仍然独立：兼容性检查和必要迁移要求不变，下文存储规则不授予发版权限。
 
+### 2.25.0 兼容性及迁移说明
+
+本次 minor 版本移除 macOS Intel 支持。仅支持 Linux x64（glibc）和使用原生
+arm64 Node.js 的 macOS Apple Silicon。macOS x64（包括 Apple Silicon 上通过
+Rosetta 运行的 x64 Node.js）会在加载任一 CLI 产品或打开 Home 前明确拒绝。
+Intel Mac 用户须停留在 2.23.0；Apple Silicon 用户须先切换到原生 arm64 Node.js。
+合并 npm 包的 OS/CPU 字段不能表达平台配对，因此不支持的组合仍可能安装成功，
+但启动时会明确失败；不新增安装脚本、备用 helper 或首次使用下载。
+既有 updater 的目标包预检也会在停止 Controller、替换全局二进制或迁移存储前拒绝。
+
+原生构建、包内容、Core CI 和发布冒烟同步收敛到上述两个平台。
+保留全部受支持 Node 20/22/24/26 的全新安装门禁（8 组），各平台 Node 24
+仍验证真实进程生命周期。保留 `v2.24.0` tag 作为未发布证据：
+必需的 Intel 冒烟作业未能获得 hosted runner，npm 和 GitHub Release 均未发布。
+2.25.0 包含下文完整的 Git 预算配置及错误保真变更。
+
+存储仍为 **1.29**，移除平台本身不新增迁移；从 2.23.0 升级仍执行已声明的
+Git 配置 **1.28 → 1.29** 迁移。升级前备份 Home，使用正常升级／迁移路径，
+不要用旧二进制打开已迁移的 Home。Controller/Host 协议仍为 v1。
+发布本身不更新全局 CLI、不迁移生产数据，也不重启共享服务。
+确定性安装包及 OS 检查不证明真实模型或真实远端服务器行为。
+
+### 2.24.0 未发布 tag：Git 预算及迁移
+
+Git 工作区和产物操作使用可配置的本地总耗时预算，与 clone、远程 fetch 和需要连接
+远端的 `ls-remote` 分离。在 `yui config tools` 或 Web 设置中配置
+`git-local-timeout-seconds`（默认 30）、
+`git-remote-inactivity-timeout-seconds`（默认 120）及
+`git-remote-timeout-seconds`（默认 1800）；三项均接受 1–86400 的整数秒。
+保存后下一条命令生效，包含 Controller 发起的命令，已启动命令保持原预算。
+参见 [Git 操作预算](roles-and-configuration.zh-CN.md#git-操作预算)。
+
+clone/fetch 无终端时也请求进度。输出只重置无进展计时，不延长总耗时上限；
+有输出不等于传输实际推进。远程 stderr 保留有界尾部。错误保留超时类型和预算、
+实际耗时、退出码、信号及 stderr，不再只显示最后一行进度。预算耗尽时终止本次调用
+自己的传输 helper；不引入自动 Git 重试或回滚。
+
+存储通过集中式增量迁移从 **1.28 → 1.29**，声明三项可选配置。
+既有配置逐字节保留，缺失字段采用运行时默认值。升级前备份 Home，使用正常升级／迁移
+路径，不要用旧二进制打开已迁移的 Home。Controller/Host 协议仍为 v1。
+发布前要求确切合并提交的 Core CI 及同一 runtime 包的全新安装矩阵通过；
+确定性检查不证明真实远端服务器或真实模型行为。发布本身不更新全局 CLI、
+不迁移生产数据，也不重启共享服务。
+
 ### 2.23.0 兼容性及迁移说明
 
 Host 升级使用明确的生命周期信号及安全排空／重新挂接边界，不重放业务输入、
@@ -821,7 +865,7 @@ yui task grant revoke task-15 capability-grant-1
 确切 commit，只增加发布所需的产物装配、全新安装和 provenance 检查。
 
 业务契约与完整 Jobs/Schedules 链路仅在 Core CI 的 Linux Node 24 执行一次。
-发布仍在三平台 × Node 20/22/24/26 全部安装同一个已校验 tarball：每组都验证
+发布仍在两个受支持平台 × Node 20/22/24/26 全部安装同一个已校验 tarball：每组都验证
 CLI/setup/原生 helper、Doctor/PTY 和真实 SQLite SQL/GC；各平台 Node 24 额外验证
 真实进程生命周期。参见[分层覆盖表](testing/verification-levels.zh-CN.md#ci-与发布)。
 依赖安装不再隐含构建，每个源码作业只构建一次，再验证原生依赖；smoke 输出分段耗时。

package/docs/roles-and-configuration.md

@@ -18,6 +18,40 @@ requiring a same-named global Role. A global Role is a creation template only
 when the requested Task Role does not exist. Availability, producer separation
 and the frozen review candidate still apply.
 
+## Git operation budgets
+
+All three Git timeout budgets have durable settings. Local commands (including
+local ref copies and artifact repositories) have a total limit; clone, remote
+fetch and network `ls-remote` have independent inactivity and total limits:
+
+```sh
+yui config tools show
+yui config tools set git-local-timeout-seconds 30
+yui config tools set git-remote-inactivity-timeout-seconds 120
+yui config tools set git-remote-timeout-seconds 1800
+yui config tools clear git-local-timeout-seconds
+yui config tools clear git-remote-inactivity-timeout-seconds
+yui config tools clear git-remote-timeout-seconds
+```
+
+All three accept integer seconds from 1 to 86400. Defaults are 30 seconds total
+per local command, 120 seconds without stdout/stderr output and 1800 seconds
+total per remote command.
+They apply to the next command, including Controller-owned Project refresh
+and Task preparation, without a restart; an in-flight command keeps its budgets.
+Clone/fetch explicitly request progress even without a terminal. Each output
+chunk resets only the silence timer, not the total deadline. Output is evidence
+of activity, not proof that a transfer is advancing; the total limit still wins.
+Remote stderr retains its last 64 KiB so progress cannot exhaust the output
+buffer; stdout and local command output retain their existing buffer limits.
+
+At either hard deadline Yui kills that invocation's process group, including
+transport helpers, and waits for process/pipe closure. Errors preserve the
+timeout kind/budget, elapsed time, exit code, signal and stderr where available.
+No Git operation is automatically retried, and a failure is not rollback proof.
+Storage 1.28 → 1.29 admits these optional configuration fields without
+rewriting historical configuration or persisting default values.
+
 ## Optional instance codes and Session titles
 
 Each Role can independently set a display-only instance code. For example,