aidevops 3.13.77 → 3.13.79

package/VERSION

@@ -1 +1 @@
-3.13.77
+3.13.79

package/aidevops.sh

@@ -5,7 +5,7 @@
 # AI DevOps Framework CLI
 # Usage: aidevops <command> [options]
 #
-# Version: 3.13.77
+# Version: 3.13.79
 
 set -euo pipefail
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aidevops",
-  "version": "3.13.77",
+  "version": "3.13.79",
   "description": "AI DevOps Framework - AI-assisted development workflows, code quality, and deployment automation",
   "type": "module",
   "bin": {

package/setup-modules/agent-deploy.sh

@@ -163,6 +163,23 @@ _deploy_agents_copy() {
 	return 1
 }
 
+# _is_reserved_agent_namespace namespace
+# Returns 0 when a plugin namespace collides with a core aidevops agents
+# directory. Such namespaces must never be passed as rsync/tar excludes because
+# excluding scripts/ from the canonical source can deploy an agents tree that
+# passes the copy step but fails the post-swap scripts/ invariant.
+_is_reserved_agent_namespace() {
+	local namespace="$1"
+
+	case "$namespace" in
+		AGENTS.md|VERSION|advisories|commands|configs|custom|draft|hooks|plugins|prompts|reference|scripts|services|tools|workflows)
+			return 0
+			;;
+	esac
+
+	return 1
+}
+
 # _inject_plan_reminder target_dir
 # Injects the extracted OpenCode plan-reminder into Plan+ if the placeholder is present.
 _inject_plan_reminder() {
@@ -691,6 +708,10 @@ deploy_aidevops_agents() {
 		local ns safe_ns
 		while IFS= read -r ns; do
 			if [[ -n "$ns" ]] && safe_ns=$(sanitize_plugin_namespace "$ns" 2>/dev/null); then
+				if _is_reserved_agent_namespace "$safe_ns"; then
+					print_warning "Skipping plugin namespace that collides with core agents directory: $safe_ns"
+					continue
+				fi
 				plugin_namespaces+=("$safe_ns")
 			fi
 		done < <(jq -r '.plugins[].namespace // empty' "$plugins_file" 2>/dev/null)

package/setup.sh

@@ -12,7 +12,7 @@ shopt -s inherit_errexit 2>/dev/null || true
 # AI Assistant Server Access Framework Setup Script
 # Helps developers set up the framework for their infrastructure
 #
-# Version: 3.13.77
+# Version: 3.13.79
 #
 # Quick Install:
 #   npm install -g aidevops && aidevops update          (recommended)
@@ -1234,15 +1234,46 @@ _setup_register_child_pid() {
 	return 0
 }
 
+_setup_collect_child_pids() {
+	local parent_pid="$1"
+	local child_pid=""
+	local child_pids=""
+	local current_pid="${BASHPID:-$$}"
+	child_pids=$(pgrep -P "$parent_pid" 2>/dev/null || true)
+	for child_pid in $child_pids; do
+		[[ -n "$child_pid" && "$child_pid" != "$current_pid" ]] || continue
+		printf '%s\n' "$child_pid"
+		_setup_collect_child_pids "$child_pid"
+	done
+	return 0
+}
+
+_setup_kill_pid_tree() {
+	local signal_name="$1"
+	local root_pid="$2"
+	local child_pid=""
+	local current_pid="${BASHPID:-$$}"
+	[[ -n "$root_pid" && "$root_pid" != "$current_pid" ]] || return 0
+	for child_pid in $(_setup_collect_child_pids "$root_pid"); do
+		kill "-${signal_name}" "$child_pid" 2>/dev/null || true
+	done
+	kill "-${signal_name}" "$root_pid" 2>/dev/null || true
+	return 0
+}
+
 _setup_cleanup_noninteractive_children() {
 	local pid=""
+	local current_pid="${BASHPID:-$$}"
 	local grace_s="${AIDEVOPS_SETUP_CHILD_TERM_GRACE_S:-2}"
 	local has_live_child=false
 	[[ "$grace_s" =~ ^[0-9]+$ ]] || grace_s=2
+	for pid in $(_setup_collect_child_pids "$current_pid"); do
+		_setup_register_child_pid "$pid"
+	done
 	for pid in ${SETUP_NONINTERACTIVE_CHILD_PIDS:-}; do
 		if _setup_lock_pid_alive "$pid"; then
 			has_live_child=true
-			kill -TERM "$pid" 2>/dev/null || true
+			_setup_kill_pid_tree TERM "$pid"
 		fi
 	done
 	if [[ "$has_live_child" == "true" && "$grace_s" -gt 0 ]]; then
@@ -1250,7 +1281,7 @@ _setup_cleanup_noninteractive_children() {
 	fi
 	for pid in ${SETUP_NONINTERACTIVE_CHILD_PIDS:-}; do
 		if _setup_lock_pid_alive "$pid"; then
-			kill -KILL "$pid" 2>/dev/null || true
+			_setup_kill_pid_tree KILL "$pid"
 		fi
 	done
 	for pid in ${SETUP_NONINTERACTIVE_CHILD_PIDS:-}; do
@@ -1259,6 +1290,32 @@ _setup_cleanup_noninteractive_children() {
 	return 0
 }
 
+_setup_run_noncritical_stage_bounded() {
+	local stage_label="$1"
+	local timeout_s="$2"
+	shift 2
+	local start_s=$SECONDS
+	local pid=""
+	local rc=0
+	[[ "$timeout_s" =~ ^[0-9]+$ ]] || timeout_s=60
+	"$@" &
+	pid=$!
+	_setup_register_child_pid "$pid"
+	while _setup_lock_pid_alive "$pid"; do
+		if (( SECONDS - start_s >= timeout_s )); then
+			_setup_kill_pid_tree TERM "$pid"
+			sleep "${AIDEVOPS_SETUP_CHILD_TERM_GRACE_S:-2}" 2>/dev/null || true
+			_setup_kill_pid_tree KILL "$pid"
+			wait "$pid" 2>/dev/null || true
+			print_warning "${stage_label} exceeded ${timeout_s}s — skipping remaining non-critical work"
+			return 0
+		fi
+		sleep 1
+	done
+	wait "$pid" 2>/dev/null || rc=$?
+	return "$rc"
+}
+
 _setup_release_noninteractive_setup_lock() {
 	local lock_dir="${SETUP_NONINTERACTIVE_LOCK_DIR:-}"
 	local owner_pid=""
@@ -1527,7 +1584,7 @@ _setup_run_non_interactive() {
 	# files does not consume the remaining postflight budget and trip the outer
 	# timeout (GH#22087). AIDEVOPS_DEPLOY_RUNTIMES_TIMEOUT controls the deadline.
 	_time_step "deploy_agents_to_runtimes" _deploy_agents_to_runtimes_bounded
-	_time_step "update_opencode_config" update_opencode_config
+	_time_step "update_opencode_config" _setup_run_noncritical_stage_bounded "OpenCode config update" "${AIDEVOPS_UPDATE_OPENCODE_CONFIG_TIMEOUT:-60}" update_opencode_config
 	_time_step "update_claude_config" update_claude_config
 	_time_step "update_codex_config" update_codex_config
 	_time_step "update_cursor_config" update_cursor_config
@@ -1535,7 +1592,7 @@ _setup_run_non_interactive() {
 	# Scaffold personal routines repo if not already present (idempotent).
 	# Creates local git repo + private GitHub remote for personal repo only.
 	# Org repos require explicit: aidevops init-routines --org <name>
-	_time_step "setup_routines" setup_routines
+	_time_step "setup_routines" _setup_run_noncritical_stage_bounded "Routine setup" "${AIDEVOPS_SETUP_ROUTINES_TIMEOUT:-60}" setup_routines
 	# Install/refresh the privacy-guard pre-push hook in every initialized
 	# repo so TODO/todo/README/ISSUE_TEMPLATE pushes to public GitHub repos
 	# are scanned for private slug leaks (t1968).
@@ -1723,7 +1780,7 @@ _setup_noninteractive_schedulers() {
 	# generic chicken-and-egg gate so the routine installs on existing systems
 	# whenever the supervisor pulse is consented.
 	if _should_setup_noninteractive_pulse_merge_routine; then
-		_time_step "setup_pulse_merge_routine" setup_pulse_merge_routine
+		_time_step "setup_pulse_merge_routine" _setup_run_noncritical_stage_bounded "Pulse merge routine setup" "${AIDEVOPS_SETUP_PULSE_MERGE_ROUTINE_TIMEOUT:-30}" setup_pulse_merge_routine
 	fi
 	# t2932 (GH#21125): peer productivity monitor — adaptive cross-runner
 	# dispatch coordination, runs every 30 min.