git-watchtower 2.1.10 → 2.1.12

package/bin/git-watchtower.js

@@ -397,8 +397,6 @@ const MAX_SERVER_LOG_LINES = 500;
 const FORCE_KILL_GRACE_MS = 3000;
 /** Additional grace period added to a command's timeout before SIGKILL. */
 const SIGKILL_GRACE_AFTER_TIMEOUT_MS = 5000;
-/** Delay between stopping and restarting the dev server. */
-const SERVER_RESTART_DELAY_MS = 500;
 /** How long a transient flash message stays on screen. */
 const FLASH_MESSAGE_DURATION_MS = 3000;
 /** Debounce window for file watcher events before notifying clients. */
@@ -826,13 +824,19 @@ function stopServerProcess() {
   return Promise.race([closedPromise, hardCap]);
 }
 
-function restartServerProcess() {
+async function restartServerProcess() {
   addLog('Restarting server...', 'update');
-  stopServerProcess();
-  setTimeout(() => {
-    startServerProcess();
-    render();
-  }, SERVER_RESTART_DELAY_MS);
+  // Await actual exit before respawning. The previous fire-and-forget
+  // stopServerProcess() + 500 ms setTimeout was shorter than the
+  // FORCE_KILL_GRACE_MS (3 s) SIGKILL escalation, so a dev server with
+  // a slow SIGTERM handler would yield EADDRINUSE on the respawn — the
+  // new process tried to bind a port the old one still held.
+  try {
+    await stopServerProcess();
+  } catch (_) { /* stopServerProcess never rejects in practice; best-effort */ }
+  if (isShuttingDown) return;
+  startServerProcess();
+  render();
 }
 
 // Network and polling state

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-watchtower",
-  "version": "2.1.10",
+  "version": "2.1.12",
   "description": "Terminal-based Git branch monitor with activity sparklines and optional dev server with live reload",
   "main": "bin/git-watchtower.js",
   "bin": {

package/src/server/coordinator.js

@@ -34,6 +34,18 @@ const WATCHTOWER_DIR = path.join(os.homedir(), '.watchtower');
  */
 const MAX_IPC_BUFFER = 1024 * 1024;
 
+/**
+ * Maximum number of concurrent worker connections the coordinator will
+ * accept. The legitimate ceiling is "one git-watchtower instance per
+ * project the user is actively working on" — a generous double-digit
+ * limit covers any real workflow. The cap exists so a buggy or
+ * malicious local process running as the same user can't open thousands
+ * of sockets and exhaust the coordinator's file descriptors. Beyond
+ * this limit, Node's net.Server closes incoming connections after
+ * accept() rather than handing them to the request listener.
+ */
+const MAX_WORKER_CONNECTIONS = 64;
+
 /**
  * How long a worker waits for a `registered` ACK from the coordinator
  * after the TCP connection completes and the `register` frame is written.
@@ -255,6 +267,12 @@ class Coordinator {
         this._handleWorkerConnection(socket);
       });
 
+      // Cap concurrent connections so a buggy/malicious local peer can't
+      // exhaust our FDs by opening thousands of sockets. Node's net.Server
+      // honours this by closing the accepted socket immediately when the
+      // count exceeds the limit — request listener never runs.
+      this.ipcServer.maxConnections = MAX_WORKER_CONNECTIONS;
+
       this.ipcServer.on('error', (err) => {
         reject(err);
       });
@@ -722,4 +740,5 @@ module.exports = {
   LOCK_FILE,
   SOCKET_PATH,
   MAX_IPC_BUFFER,
+  MAX_WORKER_CONNECTIONS,
 };