agent-dealer 1.2.8 → 1.2.10

package/bundle/server/dist/adapters/github.js

@@ -25,6 +25,10 @@ export function parsePrView(json) {
     };
 }
 export const PR_VIEW_FIELDS = "number,url,baseRefName,headRefName,headRefOid,isDraft";
+/** Normalizes `gh pr view --json mergeable` output; anything unrecognized is UNKNOWN. */
+export function parsePrMergeableState(raw) {
+    return raw === "CONFLICTING" || raw === "MERGEABLE" ? raw : "UNKNOWN";
+}
 const FAILURE_STATES = new Set([
     "failure",
     "error",
@@ -386,6 +390,23 @@ export function createGithubAdapter(exec = defaultExec) {
                 return null;
             }
         },
+        async hasPullRequestWorkflow({ cwd, baseRef }) {
+            try {
+                return await baseRefHasPullRequestWorkflow(cwd, baseRef);
+            }
+            catch {
+                return null;
+            }
+        },
+        async prMergeableState({ cwd, number }) {
+            try {
+                const raw = await ghPrView(exec, cwd, "mergeable", String(number));
+                return parsePrMergeableState(raw?.mergeable);
+            }
+            catch {
+                return "UNKNOWN";
+            }
+        },
         async publishReview({ cwd, number, event, bodyFilePath }) {
             const result = await runReview(exec, cwd, number, event, bodyFilePath);
             if (result.ok || event === "COMMENT" || !OWN_PR_REVIEW_PATTERN.test(result.reason)) {
@@ -491,6 +512,64 @@ export async function fetchChecksFailureEvidence(exec, opts) {
         details,
     };
 }
+/**
+ * NOT-311: does `origin/<baseRef>` contain a workflow triggered by `pull_request`?
+ * False when the tree has no workflow files at all; null when the tree itself cannot
+ * be read (unknown base ref, unparsable git output) so the caller waits fail-closed.
+ */
+export async function baseRefHasPullRequestWorkflow(cwd, baseRef) {
+    let listing;
+    try {
+        // `-r`: without it ls-tree prints the workflows *directory* entry itself rather
+        // than the files under it, so the scan would never see a workflow (NOT-311).
+        listing = (await run("git", ["ls-tree", "-r", `origin/${baseRef}`, "--name-only", ".github/workflows"], { cwd })).stdout;
+    }
+    catch {
+        return null;
+    }
+    const files = listing
+        .split("\n")
+        .map((s) => s.trim())
+        .filter((f) => f && /\.(ya?ml)$/i.test(f));
+    if (files.length === 0)
+        return false;
+    for (const file of files) {
+        let content;
+        try {
+            content = (await run("git", ["show", `origin/${baseRef}:${file}`], { cwd })).stdout;
+        }
+        catch {
+            return null;
+        }
+        if (workflowHasPullRequestTrigger(content))
+            return true;
+    }
+    return false;
+}
+/**
+ * Heuristic `on:` trigger scan: matches inline (`on: pull_request`,
+ * `on: [push, pull_request]`) and block forms. Stops at the next top-level key so a
+ * later `pull_request` mention outside `on:` (a job name, a comment) cannot qualify.
+ * Leans toward waiting — a false positive only costs CI-wait backoff, while a false
+ * negative would send an unverified PR to review.
+ */
+export function workflowHasPullRequestTrigger(content) {
+    const lines = content.split("\n");
+    const onIdx = lines.findIndex((l) => /^\s*on\s*:/.test(l));
+    if (onIdx < 0)
+        return false;
+    const onLine = lines[onIdx];
+    if (/\bpull_request\b/.test(onLine.slice(onLine.indexOf("on") + 2)))
+        return true;
+    for (let i = onIdx + 1; i < lines.length; i++) {
+        const line = lines[i];
+        if (/^\S/.test(line))
+            break;
+        if (/\bpull_request\b/.test(line.replace(/#.*$/, "")))
+            return true;
+    }
+    return false;
+}
 export const realGithubAdapter = createGithubAdapter();
 const REVIEW_FLAG = {
     APPROVE: "--approve",
@@ -531,24 +610,34 @@ export async function pollPrChecks(
 // NOT-310: narrowed to what the poll actually calls — the merge-conflict sync
 // passes only a checks reader, and full adapters still satisfy this shape.
 adapter, opts) {
+    return (await pollPrChecksDetailed(adapter, opts)).result;
+}
+/**
+ * NOT-311: same bounded poll as {@link pollPrChecks}, but reporting what was last
+ * seen and whether an abort cut the wait short. `pollPrChecks` keeps the collapsed
+ * contract for callers that only branch on the result.
+ */
+export async function pollPrChecksDetailed(adapter, opts) {
     const deadline = Date.now() + opts.timeoutMs;
     let noneStreak = 0;
+    let lastSnapshot = null;
     for (;;) {
         if (opts.signal?.aborted)
-            return "timeout";
+            return { result: "timeout", lastSnapshot, aborted: true };
         const snapshot = await adapter.checksSnapshot({ cwd: opts.cwd, number: opts.number, branch: opts.branch });
+        lastSnapshot = snapshot;
         if (snapshot === "failure" || snapshot === "success")
-            return snapshot;
+            return { result: snapshot, lastSnapshot, aborted: false };
         if (snapshot === "none") {
             noneStreak++;
             if (noneStreak >= NONE_STREAK_REQUIRED)
-                return "none";
+                return { result: "none", lastSnapshot, aborted: false };
         }
         else {
             noneStreak = 0;
         }
         if (Date.now() >= deadline)
-            return "timeout";
+            return { result: "timeout", lastSnapshot, aborted: false };
         await new Promise((resolve) => setTimeout(resolve, Math.min(opts.intervalMs, deadline - Date.now())));
     }
 }

package/bundle/server/dist/adapters/github.test.js

@@ -1,7 +1,7 @@
 // packages/server/src/adapters/github.test.ts
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { parsePrView, summarizeChecks, pollPrChecks, createGithubAdapter, fetchChecksFailureEvidence, sanitizeCiText, sanitizeUrl, extractActionsRunId, buildFailureExcerpt, formatChecksFailureDetails, CHECKS_EVIDENCE_MAX_EXCERPT_CHARS, CHECKS_EVIDENCE_MAX_EXCERPT_LINES, CHECKS_EVIDENCE_MAX_RAW_LOG_CHARS_PER_RUN, CHECKS_EVIDENCE_GH_LOG_MAX_BUFFER, CHECKS_FAILURE_GENERIC_REASON, PR_VIEW_FIELDS, } from "./github.js";
+import { parsePrView, summarizeChecks, pollPrChecks, pollPrChecksDetailed, baseRefHasPullRequestWorkflow, workflowHasPullRequestTrigger, createGithubAdapter, fetchChecksFailureEvidence, sanitizeCiText, sanitizeUrl, extractActionsRunId, buildFailureExcerpt, formatChecksFailureDetails, CHECKS_EVIDENCE_MAX_EXCERPT_CHARS, CHECKS_EVIDENCE_MAX_EXCERPT_LINES, CHECKS_EVIDENCE_MAX_RAW_LOG_CHARS_PER_RUN, CHECKS_EVIDENCE_GH_LOG_MAX_BUFFER, CHECKS_FAILURE_GENERIC_REASON, PR_VIEW_FIELDS, } from "./github.js";
 test("parsePrView extracts the ground-truth handoff fields, including draft status", () => {
     const view = parsePrView(JSON.stringify({
         number: 7,
@@ -114,6 +114,19 @@ test("viewPr: a retry can find the already-created PR by explicit branch even wi
     const view = await createGithubAdapter(exec).viewPr({ cwd: "/repo", branch: "issue-4e5eb611" });
     assert.equal(view?.number, 42);
 });
+test("NOT-354: prMergeableState reads `mergeable` by PR number; unknown values and failures are UNKNOWN", async () => {
+    const conflicting = queuedExec([{ stdout: JSON.stringify({ mergeable: "CONFLICTING" }) }]);
+    assert.equal(await createGithubAdapter(conflicting.exec).prMergeableState({ cwd: "/repo", number: 42 }), "CONFLICTING");
+    assert.deepEqual(conflicting.calls[0], ["pr", "view", "42", "--json", "mergeable"]);
+    const mergeable = queuedExec([{ stdout: JSON.stringify({ mergeable: "MERGEABLE" }) }]);
+    assert.equal(await createGithubAdapter(mergeable.exec).prMergeableState({ cwd: "/repo", number: 42 }), "MERGEABLE");
+    const unknown = queuedExec([{ stdout: JSON.stringify({ mergeable: "UNKNOWN" }) }]);
+    assert.equal(await createGithubAdapter(unknown.exec).prMergeableState({ cwd: "/repo", number: 42 }), "UNKNOWN");
+    const odd = queuedExec([{ stdout: JSON.stringify({ mergeable: "something-new" }) }]);
+    assert.equal(await createGithubAdapter(odd.exec).prMergeableState({ cwd: "/repo", number: 42 }), "UNKNOWN");
+    const failing = queuedExec([{ error: "HTTP 502" }]);
+    assert.equal(await createGithubAdapter(failing.exec).prMergeableState({ cwd: "/repo", number: 42 }), "UNKNOWN");
+});
 test("checksSnapshot looks up the PR's check rollup by explicit selector (number preferred), never a bare `gh pr view`", async () => {
     const success = { stdout: JSON.stringify({ statusCheckRollup: [{ conclusion: "success" }] }) };
     const byNumber = queuedExec([success]);
@@ -205,6 +218,88 @@ test("pollPrChecks bails out as timeout immediately when the lease signal is alr
     });
     assert.equal(result, "timeout");
 });
+test("NOT-311: pollPrChecksDetailed reports the last snapshot so a timeout can tell pending from abort", async () => {
+    const pending = await pollPrChecksDetailed(fakeAdapter(["pending", "pending", "pending", "pending"]), {
+        cwd: "/x",
+        timeoutMs: 20,
+        intervalMs: 10,
+    });
+    assert.deepEqual(pending, { result: "timeout", lastSnapshot: "pending", aborted: false });
+    const controller = new AbortController();
+    controller.abort();
+    const aborted = await pollPrChecksDetailed(fakeAdapter(["pending"]), {
+        cwd: "/x",
+        timeoutMs: 1000,
+        intervalMs: 5,
+        signal: controller.signal,
+    });
+    assert.deepEqual(aborted, { result: "timeout", lastSnapshot: null, aborted: true });
+    const none = await pollPrChecksDetailed(fakeAdapter(["none", "none"]), { cwd: "/x", timeoutMs: 1000, intervalMs: 5 });
+    assert.deepEqual(none, { result: "none", lastSnapshot: "none", aborted: false });
+    const incompleteNoneStreak = await pollPrChecksDetailed(fakeAdapter(["none"]), {
+        cwd: "/x",
+        timeoutMs: 0,
+        intervalMs: 10,
+    });
+    assert.deepEqual(incompleteNoneStreak, { result: "timeout", lastSnapshot: "none", aborted: false });
+});
+test("NOT-311: workflowHasPullRequestTrigger matches inline, list, and block on: forms", () => {
+    assert.equal(workflowHasPullRequestTrigger("on: pull_request\njobs:\n  x:\n    runs-on: ubuntu-latest\n"), true);
+    assert.equal(workflowHasPullRequestTrigger("on: [push, pull_request]\n"), true);
+    assert.equal(workflowHasPullRequestTrigger("on:\n  push:\n    branches: [main]\n  pull_request:\n    branches: [main]\n"), true);
+    assert.equal(workflowHasPullRequestTrigger("on:\n  push:\n    branches: [main]\n"), false);
+    assert.equal(workflowHasPullRequestTrigger("on: push\n"), false);
+    assert.equal(workflowHasPullRequestTrigger("on:\n  schedule:\n    - cron: '0 0 * * *'\n"), false);
+    assert.equal(workflowHasPullRequestTrigger("jobs:\n  x:\n    runs-on: ubuntu-latest\n"), false);
+    // A pull_request mention outside `on:` (job name) must not qualify.
+    assert.equal(workflowHasPullRequestTrigger("on: push\njobs:\n  pull_request_preview:\n    runs-on: ubuntu-latest\n"), false);
+});
+test("NOT-311: baseRefHasPullRequestWorkflow reads the base ref tree, false without workflows, null on unknown ref", async () => {
+    const { execFileSync } = await import("node:child_process");
+    const fs = await import("node:fs");
+    const os = await import("node:os");
+    const path = await import("node:path");
+    const setup = (files) => {
+        const repo = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-gh-wf-repo-"));
+        const git = (...args) => execFileSync("git", args, { cwd: repo, encoding: "utf8" });
+        git("init", "-q", "-b", "main");
+        git("config", "user.email", "test@example.com");
+        git("config", "user.name", "Test");
+        for (const [rel, content] of Object.entries(files)) {
+            fs.mkdirSync(path.join(repo, path.dirname(rel)), { recursive: true });
+            fs.writeFileSync(path.join(repo, rel), content);
+        }
+        git("add", ".");
+        git("commit", "-q", "-m", "init");
+        const remote = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-gh-wf-remote-"));
+        execFileSync("git", ["init", "-q", "--bare", "-b", "main", remote]);
+        git("remote", "add", "origin", remote);
+        git("push", "-q", "origin", "main");
+        git("fetch", "-q", "origin");
+        return { repo, remote };
+    };
+    const withCi = setup({
+        "README.md": "hi\n",
+        ".github/workflows/ci.yml": "name: ci\non:\n  pull_request:\n    branches: [main]\njobs:\n  x:\n    runs-on: ubuntu-latest\n",
+    });
+    const pushOnly = setup({
+        "README.md": "hi\n",
+        ".github/workflows/nightly.yml": "name: nightly\non:\n  schedule:\n    - cron: '0 0 * * *'\njobs:\n  x:\n    runs-on: ubuntu-latest\n",
+    });
+    const bare = setup({ "README.md": "hi\n" });
+    try {
+        assert.equal(await baseRefHasPullRequestWorkflow(withCi.repo, "main"), true);
+        assert.equal(await baseRefHasPullRequestWorkflow(pushOnly.repo, "main"), false);
+        assert.equal(await baseRefHasPullRequestWorkflow(bare.repo, "main"), false);
+        assert.equal(await baseRefHasPullRequestWorkflow(bare.repo, "no-such-branch"), null);
+    }
+    finally {
+        for (const { repo, remote } of [withCi, pushOnly, bare]) {
+            fs.rmSync(repo, { recursive: true, force: true });
+            fs.rmSync(remote, { recursive: true, force: true });
+        }
+    }
+});
 // --- NOT-252: terminal checks_failed enrichment ---
 const HEAD_SHA = "abc123def456abc123def456abc123def456abcd";
 function prViewWithRollup(rollup, headSha = HEAD_SHA) {

package/bundle/server/dist/adapters/worktree-deps.js

@@ -0,0 +1,96 @@
+// packages/server/src/adapters/worktree-deps.ts
+//
+// NOT-315: provision dependencies in a fresh developer worktree before the
+// session spawns. The Muse builder sandbox has no network (restricted mode:
+// DNS and loopback listen() both fail), so an in-session `npm install` can
+// never work — the coordinator runs it here instead, outside the sandbox,
+// with network.
+//
+// Only npm is in scope: a lockfile for another package manager (or no
+// lockfile at all) skips the step with a logged reason, never a failure.
+// A failed or timed-out install throws — the caller turns that into a
+// visible `adapter_failure` worktree-setup failure (retryable on the existing
+// infra-retry path), never a silent skip.
+//
+// The command runner is an injectable seam so tests prove the exact argv/cwd
+// without spending network or touching a registry.
+import { execFile } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { promisify } from "node:util";
+const run = promisify(execFile);
+/** Default bound for `npm ci` in a fresh worktree (NOT-315). */
+export const DEFAULT_WORKTREE_DEPS_TIMEOUT_MS = 5 * 60_000;
+/** Bounded timeout for the install step; env override for tests/operators. */
+export function worktreeDepsTimeoutMs() {
+    const raw = Number(process.env.WORKTREE_DEPS_TIMEOUT_MS);
+    return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_WORKTREE_DEPS_TIMEOUT_MS;
+}
+/** Exact install invocation — asserted by tests, never drifted silently. */
+export const NPM_CI_ARGS = ["ci", "--prefer-offline", "--no-audit", "--no-fund"];
+/** Lockfiles that mean "another package manager owns this worktree" — npm is out of scope. */
+const NON_NPM_LOCKFILES = ["pnpm-lock.yaml", "yarn.lock", "bun.lockb", "bun.lock"];
+/** Last bytes of install output kept in the failure reason (a full log would drown routing). */
+const STDERR_TAIL_CHARS = 2000;
+const defaultRunner = async (cmd, args, opts) => run(cmd, [...args], { cwd: opts.cwd, timeout: opts.timeoutMs });
+/** Keep the failure reason actionable: the tail of what npm actually printed. */
+export function stderrTail(err) {
+    const e = err;
+    const raw = (typeof e?.stderr === "string" && e.stderr.trim() ? e.stderr : null) ??
+        (typeof e?.stdout === "string" && e.stdout.trim() ? e.stdout : null) ??
+        (typeof e?.message === "string" && e.message ? e.message : String(err));
+    const trimmed = raw.trim();
+    return trimmed.length > STDERR_TAIL_CHARS ? trimmed.slice(-STDERR_TAIL_CHARS) : trimmed;
+}
+/**
+ * Run `npm ci` in `worktreePath` when the checkout declares npm dependencies
+ * that are not installed yet. Returns whether the install ran (with its
+ * duration) or why it was skipped. Throws
+ * `dependency install failed: <stderr tail>` when the install itself fails or
+ * times out — the caller surfaces that as a worktree-setup `adapter_failure`.
+ */
+export async function ensureWorktreeDeps(worktreePath, opts = {}) {
+    const startedAt = Date.now();
+    const skipped = (reason) => ({
+        ran: false,
+        reason,
+        durationMs: Date.now() - startedAt,
+    });
+    if (fs.existsSync(path.join(worktreePath, "node_modules"))) {
+        return skipped("node_modules present");
+    }
+    if (!fs.existsSync(path.join(worktreePath, "package.json"))) {
+        return skipped("no package.json");
+    }
+    for (const lock of NON_NPM_LOCKFILES) {
+        if (fs.existsSync(path.join(worktreePath, lock))) {
+            return skipped(`non-npm lockfile ${lock} present; only npm is in scope`);
+        }
+    }
+    if (!fs.existsSync(path.join(worktreePath, "package-lock.json"))) {
+        return skipped("no lockfile");
+    }
+    const timeoutMs = opts.timeoutMs ?? worktreeDepsTimeoutMs();
+    const runner = opts.runner ?? defaultRunner;
+    try {
+        await runner("npm", NPM_CI_ARGS, { cwd: worktreePath, timeoutMs });
+    }
+    catch (err) {
+        // A failed `npm ci` (or a timeout kill mid-reify) can leave a
+        // partial/empty node_modules behind. The setup failure retries on the
+        // infra path, which reuses the leftover worktree — and a leftover
+        // node_modules would make the retry skip the install and hand the builder
+        // broken deps. Remove it so the retry reinstalls from scratch; the removal
+        // itself is best-effort and must never mask the install error.
+        try {
+            fs.rmSync(path.join(worktreePath, "node_modules"), { recursive: true, force: true });
+        }
+        catch {
+            // keep the original install error below
+        }
+        const killed = err?.killed === true;
+        const prefix = killed ? `timed out after ${timeoutMs}ms: ` : "";
+        throw new Error(`dependency install failed: ${prefix}${stderrTail(err)}`);
+    }
+    return { ran: true, durationMs: Date.now() - startedAt };
+}

package/bundle/server/dist/adapters/worktree-deps.test.js

@@ -0,0 +1,144 @@
+// packages/server/src/adapters/worktree-deps.test.ts
+//
+// NOT-315: the pre-spawn dependency step runs `npm ci` exactly once when the
+// worktree declares npm dependencies, skips otherwise, and surfaces install
+// failures with the stderr tail — all against a fake runner, never a registry.
+import { test, after } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { ensureWorktreeDeps, NPM_CI_ARGS } from "./worktree-deps.js";
+let dirs = [];
+function makeWorktree(files) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-wt-deps-"));
+    dirs.push(dir);
+    for (const [name, content] of Object.entries(files)) {
+        fs.writeFileSync(path.join(dir, name), content);
+    }
+    return dir;
+}
+after(() => {
+    for (const dir of dirs)
+        fs.rmSync(dir, { recursive: true, force: true });
+    dirs = [];
+});
+const PKG = JSON.stringify({ name: "wt", version: "1.0.0" });
+const LOCK = JSON.stringify({ name: "wt", lockfileVersion: 3, packages: {} });
+function recordingRunner(calls) {
+    return async (cmd, args, opts) => {
+        calls.push({ cmd, args: [...args], cwd: opts.cwd, timeoutMs: opts.timeoutMs });
+        return { stdout: "", stderr: "" };
+    };
+}
+test("lockfile present and node_modules absent -> install runs once with the expected args and cwd", async () => {
+    const dir = makeWorktree({ "package.json": PKG, "package-lock.json": LOCK });
+    const calls = [];
+    const result = await ensureWorktreeDeps(dir, { runner: recordingRunner(calls), timeoutMs: 1234 });
+    assert.equal(calls.length, 1);
+    assert.equal(calls[0].cmd, "npm");
+    assert.deepEqual(calls[0].args, [...NPM_CI_ARGS]);
+    assert.deepEqual(calls[0].args, ["ci", "--prefer-offline", "--no-audit", "--no-fund"]);
+    assert.equal(calls[0].cwd, dir);
+    assert.equal(calls[0].timeoutMs, 1234);
+    assert.equal(result.ran, true);
+    if (result.ran)
+        assert.ok(typeof result.durationMs === "number" && result.durationMs >= 0);
+});
+test("node_modules present -> skipped without running anything", async () => {
+    const dir = makeWorktree({ "package.json": PKG, "package-lock.json": LOCK });
+    fs.mkdirSync(path.join(dir, "node_modules"));
+    const calls = [];
+    const result = await ensureWorktreeDeps(dir, { runner: recordingRunner(calls) });
+    assert.equal(calls.length, 0);
+    assert.equal(result.ran, false);
+    if (!result.ran)
+        assert.match(result.reason, /node_modules/);
+    assert.ok(typeof result.durationMs === "number" && result.durationMs >= 0);
+});
+test("no lockfile -> skipped without running anything", async () => {
+    const dir = makeWorktree({ "package.json": PKG });
+    const calls = [];
+    const result = await ensureWorktreeDeps(dir, { runner: recordingRunner(calls) });
+    assert.equal(calls.length, 0);
+    assert.equal(result.ran, false);
+    if (!result.ran)
+        assert.match(result.reason, /no lockfile/);
+});
+test("no package.json -> skipped without running anything", async () => {
+    const dir = makeWorktree({ "README.md": "hello\n" });
+    const calls = [];
+    const result = await ensureWorktreeDeps(dir, { runner: recordingRunner(calls) });
+    assert.equal(calls.length, 0);
+    assert.equal(result.ran, false);
+});
+test("another package manager's lockfile -> skipped without running anything", async () => {
+    for (const lock of ["pnpm-lock.yaml", "yarn.lock", "bun.lockb"]) {
+        const dir = makeWorktree({ "package.json": PKG, [lock]: "lock\n" });
+        const calls = [];
+        const result = await ensureWorktreeDeps(dir, { runner: recordingRunner(calls) });
+        assert.equal(calls.length, 0, `${lock} must not trigger npm`);
+        assert.equal(result.ran, false);
+        if (!result.ran)
+            assert.match(result.reason, /non-npm lockfile/);
+    }
+});
+test("a failing install throws with the stderr tail", async () => {
+    const dir = makeWorktree({ "package.json": PKG, "package-lock.json": LOCK });
+    const failing = async () => {
+        const err = new Error("npm ci exited");
+        err.stderr = "npm error code E500\nnpm error registry exploded on line 42\n";
+        throw err;
+    };
+    await assert.rejects(() => ensureWorktreeDeps(dir, { runner: failing }), (err) => {
+        assert.match(err.message, /^dependency install failed: /);
+        assert.match(err.message, /registry exploded on line 42/);
+        return true;
+    });
+});
+test("a timed-out install throws with the same dependency-install prefix", async () => {
+    const dir = makeWorktree({ "package.json": PKG, "package-lock.json": LOCK });
+    const timingOut = async () => {
+        throw new Error("npm ci timed out after 300000ms — network or registry may be down");
+    };
+    await assert.rejects(() => ensureWorktreeDeps(dir, { runner: timingOut }), (err) => {
+        assert.match(err.message, /^dependency install failed: /);
+        assert.match(err.message, /timed out/);
+        return true;
+    });
+});
+test("a failing install removes a leftover node_modules so an infra retry reinstalls", async () => {
+    // npm ci that dies mid-reify (or is SIGTERM-killed by the execFile timeout)
+    // can leave a partial node_modules behind; the retry reuses the leftover
+    // worktree, so the husk must be gone or the retry would skip the install.
+    const dir = makeWorktree({ "package.json": PKG, "package-lock.json": LOCK });
+    const failing = async (_cmd, _args, opts) => {
+        fs.mkdirSync(path.join(opts.cwd, "node_modules", "half-written-pkg"), { recursive: true });
+        fs.writeFileSync(path.join(opts.cwd, "node_modules", "half-written-pkg", "index.js"), "partial\n");
+        const err = new Error("npm ci exited");
+        err.stderr = "npm error code E500\nnpm error registry exploded on line 42\n";
+        throw err;
+    };
+    await assert.rejects(() => ensureWorktreeDeps(dir, { runner: failing }), (err) => {
+        assert.match(err.message, /^dependency install failed: /);
+        assert.match(err.message, /registry exploded on line 42/);
+        return true;
+    });
+    assert.equal(fs.existsSync(path.join(dir, "node_modules")), false, "partial node_modules must be removed");
+});
+test("a killed (timed-out) install names the timeout in the reason", async () => {
+    const dir = makeWorktree({ "package.json": PKG, "package-lock.json": LOCK });
+    const killed = async () => {
+        // Shape of a real execFile timeout: killed by SIGTERM with little stderr.
+        const err = new Error("Command failed: npm ci --prefer-offline --no-audit --no-fund");
+        err.killed = true;
+        err.signal = "SIGTERM";
+        throw err;
+    };
+    await assert.rejects(() => ensureWorktreeDeps(dir, { runner: killed, timeoutMs: 4321 }), (err) => {
+        assert.match(err.message, /^dependency install failed: /);
+        assert.match(err.message, /timed out after 4321ms/);
+        return true;
+    });
+    assert.equal(fs.existsSync(path.join(dir, "node_modules")), false);
+});