aidevops 3.13.42 → 3.13.43

package/VERSION

@@ -1 +1 @@
-3.13.42
+3.13.43

package/aidevops.sh

@@ -5,7 +5,7 @@
 # AI DevOps Framework CLI
 # Usage: aidevops <command> [options]
 #
-# Version: 3.13.42
+# Version: 3.13.43
 
 set -euo pipefail
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aidevops",
-  "version": "3.13.42",
+  "version": "3.13.43",
   "description": "AI DevOps Framework - AI-assisted development workflows, code quality, and deployment automation",
   "type": "module",
   "bin": {

package/setup-modules/agent-deploy.sh

@@ -391,11 +391,34 @@ _atomic_stage_and_deploy_agents() {
 		fi
 	done
 
-	# Atomic swap: mv is atomic on the same filesystem (POSIX rename())
+	# Atomic swap: mv is atomic on the same filesystem (POSIX rename()).
+	# IMPORTANT: explicit error checks are REQUIRED here because this function
+	# is called via `|| return 1` which disables set -e inside the function
+	# body (bash set -e semantics: disabled in any function called as part of
+	# a compound list such as `fn || ...`). Without these checks, a failed mv
+	# falls through silently, the backup is deleted, and the function returns
+	# 0 with $target_dir absent — the root cause of GH#22014 where worktree
+	# setup left ~/.aidevops/agents missing while reporting [SETUP_COMPLETE].
 	if [[ -d "$target_dir" ]]; then
-		mv "$target_dir" "$old_dir"
+		if ! mv "$target_dir" "$old_dir"; then
+			print_error "Failed to move live agents to backup ($old_dir) — agents directory preserved"
+			rm -rf "$staging_dir"
+			return 1
+		fi
+	fi
+	if ! mv "$staging_dir" "$target_dir"; then
+		print_error "Failed to move staging to live agents directory — attempting rollback"
+		# Restore the previous agents dir from backup so the system stays functional.
+		if [[ -d "$old_dir" ]]; then
+			if mv "$old_dir" "$target_dir"; then
+				print_info "Rollback successful — previous agents directory restored"
+			else
+				print_error "Rollback failed — agents directory is missing! Previous state preserved in $old_dir"
+			fi
+		fi
+		rm -rf "$staging_dir"
+		return 1
 	fi
-	mv "$staging_dir" "$target_dir"
 	rm -rf "$old_dir"
 	return 0
 }
@@ -503,6 +526,9 @@ _deploy_agents_post_copy() {
 # (those edits are overwritten by every deploy). Emits a warning listing drifted
 # files and the canonical source path to edit instead.
 # Non-fatal: always returns 0 so deployment proceeds.
+#
+# Performance: uses a single rsync --checksum --dry-run call instead of one
+# diff -q subprocess per script (was 783 calls → now 1 call; t3221).
 _warn_deployed_script_drift() {
 	local source_dir="$1"
 	local target_dir="$2"
@@ -512,20 +538,35 @@ _warn_deployed_script_drift() {
 	if [[ ! -d "$source_scripts" || ! -d "$target_scripts" ]]; then
 		return 0
 	fi
-	if ! command -v diff &>/dev/null; then
-		return 0
-	fi
 
 	local -a drifted=()
-	local f bn
-	for f in "$target_scripts"/*.sh; do
-		[[ -f "$f" ]] || continue
-		bn=$(basename "$f")
-		local src="$source_scripts/$bn"
-		if [[ -f "$src" ]] && ! diff -q "$src" "$f" &>/dev/null; then
-			drifted+=("$bn")
-		fi
-	done
+	if command -v rsync &>/dev/null; then
+		# Single bulk comparison: rsync --checksum --dry-run reports changed files
+		# without transferring anything. --out-format='%f' prints only the relative
+		# path of each changed file. Filter to top-level *.sh only (no subdirs).
+		local changed_file
+		while IFS= read -r changed_file; do
+			[[ -n "$changed_file" ]] || continue
+			# Skip subdirectory scripts (only warn about top-level scripts/)
+			[[ "$changed_file" == */* ]] && continue
+			[[ "$changed_file" == *.sh ]] || continue
+			drifted+=("$changed_file")
+		done < <(rsync --checksum --dry-run \
+			--out-format='%f' \
+			--include='*.sh' --exclude='*/' --exclude='*' \
+			"$source_scripts/" "$target_scripts/" 2>/dev/null || true)
+	elif command -v diff &>/dev/null; then
+		# Fallback: one diff -q per script (slow, only reached when rsync absent)
+		local f bn
+		for f in "$target_scripts"/*.sh; do
+			[[ -f "$f" ]] || continue
+			bn=$(basename "$f")
+			local src="$source_scripts/$bn"
+			if [[ -f "$src" ]] && ! diff -q "$src" "$f" &>/dev/null; then
+				drifted+=("$bn")
+			fi
+		done
+	fi
 
 	if [[ ${#drifted[@]} -gt 0 ]]; then
 		print_warning "Deployed scripts differ from canonical source (local edits will be overwritten; backup will be created):"
@@ -577,9 +618,18 @@ deploy_aidevops_agents() {
 		_warn_deployed_script_drift "$source_dir" "$target_dir"
 	fi
 
-	# Create backup if target exists (with rotation)
+	# Create backup if target exists (with rotation).
+	# Skip when the deployed SHA matches the current HEAD — nothing changed on
+	# disk, so there is nothing worth backing up (t3221: steady-state perf).
 	if [[ -d "$target_dir" ]]; then
-		create_backup_with_rotation "$target_dir" "agents"
+		local _cur_sha _dep_sha
+		_cur_sha=$(git -C "$repo_dir" rev-parse HEAD 2>/dev/null || echo "")
+		_dep_sha=$(cat "${HOME}/.aidevops/.deployed-sha" 2>/dev/null || echo "")
+		if [[ -n "$_cur_sha" && -n "$_dep_sha" && "$_cur_sha" == "$_dep_sha" ]]; then
+			print_info "No changes since last deploy (${_cur_sha:0:8}) — skipping backup"
+		else
+			create_backup_with_rotation "$target_dir" "agents"
+		fi
 	fi
 
 	mkdir -p "$target_dir"
@@ -591,20 +641,24 @@ deploy_aidevops_agents() {
 		_atomic_stage_and_deploy_agents "$source_dir" "$target_dir" || return 1
 	fi
 
+	# Postcondition: verify the swap actually produced a functional agents dir.
+	# _atomic_stage_and_deploy_agents returns 0 on success, but a belt-and-
+	# suspenders check here catches any future regression where the function
+	# might return early without correctly populating $target_dir (GH#22014).
+	if [[ ! -d "$target_dir/scripts" ]]; then
+		print_error "Deploy verification failed: $target_dir/scripts missing after swap"
+		print_error "The agents directory was not correctly deployed — setup cannot continue"
+		return 1
+	fi
+
 	print_success "Deployed agents to $target_dir"
 	_deploy_agents_post_copy "$target_dir" "$repo_dir" "$source_dir" "$plugins_file"
 
-	# Restart pulse if running — bash processes load source files at startup
-	# and don't re-read them when files change on disk. Without a restart,
-	# fixes to pulse-*.sh, dispatch-dedup-*.sh, headless-runtime-*.sh, and
-	# other sourced scripts don't take effect until the next manual restart.
-	# This was the root cause of a multi-hour outage where deployed fixes
-	# were correct but the running pulse kept using old code in memory.
-	_restart_pulse_if_running
-
-	# Write deployed-SHA stamp so aidevops-update-check.sh can detect
-	# script drift between this deploy and future canonical-repo commits.
-	# Written AFTER pulse restart so the stamp reflects a fully-applied deploy.
+	# Write deployed-SHA stamp BEFORE the pulse restart so the stamp is
+	# available immediately for subsequent setup steps and the next run's
+	# backup-skip check (t3221). Previously written after the blocking
+	# restart wait; moving it here has no correctness impact — the deploy
+	# is already fully on disk at this point.
 	# t2156: enables auto-redeploy when local commits land between releases.
 	local deployed_sha
 	deployed_sha=$(git -C "$repo_dir" rev-parse HEAD 2>/dev/null || echo "")
@@ -614,6 +668,20 @@ deploy_aidevops_agents() {
 		printf '%s\n' "$deployed_sha" >"${aidevops_dir}/.deployed-sha"
 	fi
 
+	# Restart pulse in the background — bash processes load source files at
+	# startup and don't re-read them when files change on disk. Without a
+	# restart, fixes to pulse-*.sh, dispatch-dedup-*.sh, and other sourced
+	# scripts don't take effect until the next manual restart.
+	#
+	# t3221: running this asynchronously saves the 10-15s blocking wait
+	# (pkill + up to 10s die-wait + sleep 5 launchd grace period). The
+	# deploy is already complete on disk; the pulse picks up the new scripts
+	# once it restarts regardless of when that happens relative to setup.sh
+	# finishing. disown prevents SIGHUP propagation if setup.sh is sourced
+	# interactively; in script mode the orphan survives the exit anyway.
+	_restart_pulse_if_running &
+	disown
+
 	return 0
 }
 

package/setup-modules/migrations.sh

@@ -616,7 +616,16 @@ _migrate_ai_config_agent_refs() {
 # 3. .gitignore entries in user projects
 # 4. References in user's AI assistant configs
 # 5. References in ~/.aidevops/ config files
+#
+# Guarded by a sentinel file: on a converged system the function does
+# a repos.json scan and a find(1) scan of ~/Git, both of which cost
+# several seconds per run (t3221).
 migrate_agent_to_agents_folder() {
+	local _sentinel="${HOME}/.aidevops/.migrations/agent-to-agents-done"
+	if [[ -f "$_sentinel" ]]; then
+		return 0
+	fi
+
 	print_info "Checking for .agent -> .agents migration..."
 
 	local migrated=0
@@ -649,6 +658,9 @@ migrate_agent_to_agents_folder() {
 		print_info "No .agent -> .agents migration needed"
 	fi
 
+	# Write sentinel so subsequent setup runs skip the repos+find scans (t3221)
+	mkdir -p "$(dirname "$_sentinel")"
+	date -u +%Y-%m-%dT%H:%M:%SZ >"$_sentinel"
 	return 0
 }
 
@@ -782,6 +794,12 @@ _migrate_mcp_npx_to_binary() {
 
 # Remove deprecated MCP entries from opencode.json
 # These MCPs have been replaced by curl-based subagents (zero context cost)
+#
+# The one-time cleanup (remove deprecated entries + migrate npx→binary) is
+# guarded by a versioned sentinel (t3221). Bump the sentinel version when new
+# deprecated MCPs are added to _remove_deprecated_mcp_entries.
+# The recurring update_mcp_paths_in_opencode call is NOT guarded — it resolves
+# stale binary paths on every run (paths can change after package upgrades).
 cleanup_deprecated_mcps() {
 	local opencode_config
 	opencode_config=$(find_opencode_config) || return 0
@@ -794,27 +812,36 @@ cleanup_deprecated_mcps() {
 		return 0
 	fi
 
-	local cleaned=0
-	local tmp_config
-	tmp_config=$(mktemp)
-	trap 'rm -f "${tmp_config:-}"' RETURN
+	# One-time cleanup: remove deprecated MCPs and migrate npx→binary paths.
+	# Sentinel version must be bumped whenever new deprecated MCPs are added.
+	local _sentinel="${HOME}/.aidevops/.migrations/cleanup-deprecated-mcps-v1"
+	if [[ ! -f "$_sentinel" ]]; then
+		local cleaned=0
+		local tmp_config
+		tmp_config=$(mktemp)
+		trap 'rm -f "${tmp_config:-}"' RETURN
 
-	cp "$opencode_config" "$tmp_config"
+		cp "$opencode_config" "$tmp_config"
 
-	# Remove deprecated MCP and tool entries
-	_remove_deprecated_mcp_entries "$tmp_config"
-	cleaned=$((cleaned + _cleanup_count))
+		# Remove deprecated MCP and tool entries
+		_remove_deprecated_mcp_entries "$tmp_config"
+		cleaned=$((cleaned + _cleanup_count))
 
-	# Migrate npx/pipx commands to full binary paths (faster startup, PATH-independent)
-	_migrate_mcp_npx_to_binary "$tmp_config"
-	cleaned=$((cleaned + _cleanup_count))
+		# Migrate npx/pipx commands to full binary paths (faster startup, PATH-independent)
+		_migrate_mcp_npx_to_binary "$tmp_config"
+		cleaned=$((cleaned + _cleanup_count))
 
-	if [[ $cleaned -gt 0 ]]; then
-		create_backup_with_rotation "$opencode_config" "opencode"
-		mv "$tmp_config" "$opencode_config"
-		print_info "Updated $cleaned MCP entry/entries in opencode.json (using full binary paths)"
-	else
-		rm -f "$tmp_config"
+		if [[ $cleaned -gt 0 ]]; then
+			create_backup_with_rotation "$opencode_config" "opencode"
+			mv "$tmp_config" "$opencode_config"
+			print_info "Updated $cleaned MCP entry/entries in opencode.json (using full binary paths)"
+		else
+			rm -f "$tmp_config"
+		fi
+
+		# Write sentinel
+		mkdir -p "$(dirname "$_sentinel")"
+		date -u +%Y-%m-%dT%H:%M:%SZ >"$_sentinel"
 	fi
 
 	# Always resolve bare binary names to full paths (fixes PATH-dependent startup)
@@ -1127,7 +1154,15 @@ migrate_old_backups() {
 # Migrate loop state from .claude/ to .agents/loop-state/ in user projects
 # Also migrates from legacy .agents/loop-state/ to .agents/loop-state/
 # The migration is non-destructive: moves files, doesn't delete originals until confirmed
+#
+# Guarded by a sentinel file: on a converged system the function does a
+# find(1) scan of ~/Git which costs several seconds per run (t3221).
 migrate_loop_state_directories() {
+	local _sentinel="${HOME}/.aidevops/.migrations/loop-state-dirs-migrated"
+	if [[ -f "$_sentinel" ]]; then
+		return 0
+	fi
+
 	print_info "Checking for legacy loop state directories..."
 
 	local migrated=0
@@ -1218,6 +1253,9 @@ migrate_loop_state_directories() {
 		print_info "No legacy loop state directories found"
 	fi
 
+	# Write sentinel so subsequent setup runs skip the find scan (t3221)
+	mkdir -p "$(dirname "$_sentinel")"
+	date -u +%Y-%m-%dT%H:%M:%SZ >"$_sentinel"
 	return 0
 }
 

package/setup.sh

@@ -12,7 +12,7 @@ shopt -s inherit_errexit 2>/dev/null || true
 # AI Assistant Server Access Framework Setup Script
 # Helps developers set up the framework for their infrastructure
 #
-# Version: 3.13.42
+# Version: 3.13.43
 #
 # Quick Install:
 #   npm install -g aidevops && aidevops update          (recommended)
@@ -152,6 +152,13 @@ _cron_escape() {
 _time_step() {
 	local _ts_stage="$1"
 	shift
+	# GH#22012: In non-interactive mode, emit the stage name before running so
+	# an operator watching setup.sh output can identify which step is blocking.
+	# The TSV log entry below is written AFTER the step returns — it provides no
+	# signal during a hang. This print is the only in-flight indicator.
+	if [[ "${NON_INTERACTIVE:-false}" == "true" ]]; then
+		printf '[SETUP] stage: %s\n' "$_ts_stage"
+	fi
 	local _ts_start _ts_end _ts_duration _ts_exit
 	_ts_start=$(date +%s.%N 2>/dev/null || date +%s)
 	_ts_exit=0
@@ -1355,70 +1362,74 @@ _setup_run_interactive() {
 _setup_noninteractive_schedulers() {
 	local os="$1"
 
+	# GH#22012: Wrap every scheduler step with _time_step so the stage-timing
+	# log ($HOME/.aidevops/logs/setup-stage-timings.log) covers post-deploy
+	# scheduler setup — the same visibility _setup_run_non_interactive has.
+
 	# Auto-update handles non-interactive internally (systemd detection fixed in GH#17861)
-	setup_auto_update
+	_time_step "setup_auto_update" setup_auto_update
 	if _should_setup_noninteractive_supervisor_pulse; then
-		setup_supervisor_pulse "$os"
+		_time_step "setup_supervisor_pulse" setup_supervisor_pulse "$os"
 	fi
 	# t2939: pulse-watchdog (independent revival mechanism). Always installed
 	# alongside the pulse — it is a no-op when pulse is disabled. Skipping the
 	# `_should_setup_noninteractive_*` guard intentionally: this is layered
 	# defense, the cost of installing it is one plist file, and the user opts
 	# in by enabling the pulse itself.
-	setup_pulse_watchdog "${PULSE_ENABLED:-}"
+	_time_step "setup_pulse_watchdog" setup_pulse_watchdog "${PULSE_ENABLED:-}"
 	# Regenerate other schedulers if already installed (GH#17695 Finding B).
 	# Stats wrapper is a pulse dependency — also install on first run when
 	# the supervisor pulse is consented (t2418, GH#20016).
 	if _should_setup_noninteractive_stats_wrapper; then
-		setup_stats_wrapper "${PULSE_ENABLED:-}"
+		_time_step "setup_stats_wrapper" setup_stats_wrapper "${PULSE_ENABLED:-}"
 	fi
 	if _should_setup_noninteractive_scheduler "Failure miner" "sh.aidevops.routine-gh-failure-miner" "aidevops: gh-failure-miner" "aidevops-gh-failure-miner"; then
-		setup_failure_miner "${PULSE_ENABLED:-}"
+		_time_step "setup_failure_miner" setup_failure_miner "${PULSE_ENABLED:-}"
 	fi
 	if _should_setup_noninteractive_scheduler "Process guard" "sh.aidevops.process-guard" "aidevops: process-guard" "aidevops-process-guard"; then
-		setup_process_guard
+		_time_step "setup_process_guard" setup_process_guard
 	fi
 	if _should_setup_noninteractive_scheduler "Memory pressure" "sh.aidevops.memory-pressure-monitor" "aidevops: memory-pressure-monitor" "aidevops-memory-pressure-monitor"; then
-		setup_memory_pressure_monitor
+		_time_step "setup_memory_pressure_monitor" setup_memory_pressure_monitor
 	fi
 	if _should_setup_noninteractive_scheduler "Screen time" "sh.aidevops.screen-time-snapshot" "aidevops: screen-time-snapshot" "aidevops-screen-time-snapshot"; then
-		setup_screen_time_snapshot
+		_time_step "setup_screen_time_snapshot" setup_screen_time_snapshot
 	fi
 	if _should_setup_noninteractive_scheduler "Contribution watch" "sh.aidevops.contribution-watch" "aidevops: contribution-watch" "aidevops-contribution-watch"; then
-		setup_contribution_watch
+		_time_step "setup_contribution_watch" setup_contribution_watch
 	fi
 	# t2903 (#21049): complexity scan — extracted from pulse dispatch preflight
 	if _should_setup_noninteractive_scheduler "Complexity scan" "sh.aidevops.complexity-scan" "aidevops: complexity-scan" "aidevops-complexity-scan"; then
-		setup_complexity_scan
+		_time_step "setup_complexity_scan" setup_complexity_scan
 	fi
 	# t2862 (GH#20919): pulse merge routine — fast 120s standalone merge pass.
 	# t3036 (GH#21616): use the pulse-dependency escape hatch instead of the
 	# generic chicken-and-egg gate so the routine installs on existing systems
 	# whenever the supervisor pulse is consented.
 	if _should_setup_noninteractive_pulse_merge_routine; then
-		setup_pulse_merge_routine
+		_time_step "setup_pulse_merge_routine" setup_pulse_merge_routine
 	fi
 	# t2932 (GH#21125): peer productivity monitor — adaptive cross-runner
 	# dispatch coordination, runs every 30 min.
 	if _should_setup_noninteractive_scheduler "Peer productivity monitor" "sh.aidevops.peer-productivity-monitor" "aidevops: peer-productivity-monitor" "aidevops-peer-productivity-monitor"; then
-		setup_peer_productivity_monitor
+		_time_step "setup_peer_productivity_monitor" setup_peer_productivity_monitor
 	fi
 	# Repo sync handles non-interactive mode internally (systemd detection fixed in GH#17861)
-	setup_repo_sync
+	_time_step "setup_repo_sync" setup_repo_sync
 	# r914 repo-aidevops-health — daily drift keeper (t2366)
-	setup_repo_aidevops_health
+	_time_step "setup_repo_aidevops_health" setup_repo_aidevops_health
 	if _should_setup_noninteractive_scheduler "Profile README" "sh.aidevops.profile-readme-update" "aidevops: profile-readme-update" "aidevops-profile-readme-update"; then
-		setup_profile_readme
+		_time_step "setup_profile_readme" setup_profile_readme
 	fi
 	if _should_setup_noninteractive_scheduler "OAuth token refresh" "sh.aidevops.token-refresh" "aidevops: token-refresh" "aidevops-token-refresh"; then
-		setup_oauth_token_refresh
+		_time_step "setup_oauth_token_refresh" setup_oauth_token_refresh
 	fi
 	# opencode DB maintenance (r913, t2183). Helper self-noops on missing
 	# DB — safe to install unconditionally in non-interactive mode too.
-	setup_opencode_db_maintenance
+	_time_step "setup_opencode_db_maintenance" setup_opencode_db_maintenance
 	# Migrate cron entries to systemd after schedulers are installed (GH#17695 Finding D)
-	migrate_cron_to_systemd
-	setup_tabby
+	_time_step "migrate_cron_to_systemd" migrate_cron_to_systemd
+	_time_step "setup_tabby" setup_tabby
 	return 0
 }
 
@@ -1551,9 +1562,17 @@ main() {
 	# No-op if pulse is not running, or if AIDEVOPS_SKIP_PULSE_RESTART=1.
 	# Uses the deployed helper (not the repo-local one) so the restart runs
 	# against the agents directory setup.sh just populated.
+	# GH#22012: bounded 120 s timeout prevents setup.sh hanging here when the
+	# pulse helper takes unusually long to stop a stalled instance. Falls back
+	# to an unbounded call on platforms without timeout(1) (old macOS w/o
+	# coreutils, embedded shells).
 	local _pulse_helper="${HOME}/.aidevops/agents/scripts/pulse-lifecycle-helper.sh"
 	if [[ -x "$_pulse_helper" ]]; then
-		"$_pulse_helper" restart-if-running || print_warning "Pulse restart failed (non-fatal)"
+		if command -v timeout >/dev/null 2>&1; then
+			timeout 120 "$_pulse_helper" restart-if-running || print_warning "Pulse restart failed (non-fatal)"
+		else
+			"$_pulse_helper" restart-if-running || print_warning "Pulse restart failed (non-fatal)"
+		fi
 	fi
 
 	# GH#18492 / t2026: completion sentinel. Must be the last output of a