graphite-code 0.5.2__tar.gz → 0.5.3__tar.gz

{graphite_code-0.5.2 → graphite_code-0.5.3}/CHANGELOG.md

@@ -12,6 +12,29 @@ machine-checkable identity; the version is for humans.
 
 [Keep a Changelog]: https://keepachangelog.com/en/1.1.0/
 
+## [0.5.3] — 2026-08-28
+
+### Fixed
+
+**The `git --version` probe no longer has a fixed two-second budget of its
+own** (#37). Every production caller gave its real Git command 5–300 seconds
+and then paid a fixed 2.0 seconds for the version probe that gates it -- the
+one number in that path tuned to a quiet machine, in the step that runs first
+on a loaded CI runner. A probe that outlived it was folded into
+`GitUnsupportedVersionError` and widened upstream to `git_unavailable`, which
+is how #37's single Windows sighting logged an installed, working Git as
+unavailable. The probe now runs under the budget the caller gave its command:
+`--version` is Git's cheapest command, so a budget the real command can
+survive is one the probe can survive -- a derivation, not a wider number.
+Probe and command keep separate budgets on purpose; a shared deadline would
+make the command's budget vary with probe latency, a new way to time out
+spuriously. `_GIT_VERSION_TIMEOUT_SECONDS` is gone. Recorded rather than
+fixed: `_version` is still cached per `GitRunner`, so one routing operation
+still runs the probe several times (exposure, not cause), and the 0.1 s
+reader-thread join in `_run_bounded` is a second fixed bound feeding the same
+bucket -- measured 0 of 400 runs live on a loaded 12-core box, so left alone
+on evidence.
+
 ## [0.5.2] — 2026-08-28
 
 ### Fixed

{graphite_code-0.5.2 → graphite_code-0.5.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: graphite-code
-Version: 0.5.2
+Version: 0.5.3
 Summary: Local-first, zero-LLM knowledge graph extraction for codebases.
 Project-URL: Homepage, https://github.com/jared0565/graphite
 Project-URL: Repository, https://github.com/jared0565/graphite

{graphite_code-0.5.2 → graphite_code-0.5.3}/src/graphite/__init__.py

@@ -38,4 +38,4 @@ __all__ = ["__version__"]
 #: Coarse and hand-maintained by construction. It is a release label, not
 #: evidence that a given fix is present -- to answer that, survey for the marker
 #: the fix introduced, or compare `graphite --version` fingerprints.
-__version__ = "0.5.2"
+__version__ = "0.5.3"

{graphite_code-0.5.2 → graphite_code-0.5.3}/src/graphite/git.py

@@ -12,7 +12,6 @@ from typing import Sequence
 
 DEFAULT_GIT_STDOUT_MAX_BYTES = 16 * 1024 * 1024
 _MINIMUM_GIT_VERSION = (2, 38, 0)
-_GIT_VERSION_TIMEOUT_SECONDS = 2.0
 _GIT_VERSION_STDOUT_MAX_BYTES = 256
 _READ_CHUNK_BYTES = 64 * 1024
 _PROCESS_CLEANUP_TIMEOUT_SECONDS = 0.1
@@ -124,17 +123,18 @@ class GitUnsupportedVersionError(_StepGitError):
     Three unrelated conditions land here, and the failure this class is NAMED
     for is the rarest of them. Git really being older than 2.38 is a permanent,
     obvious, one-machine fact. The other two are transient: the `--version`
-    probe timed out inside `_GIT_VERSION_TIMEOUT_SECONDS`, or it could not be
-    launched at all. Both then widen into `git_unavailable` upstream, which is
-    how graphite#37 got a CI log saying an installed, working Git was
-    unavailable.
-
-    The probe's budget is two seconds for one process spawn, and `_version` is
-    cached per RUNNER -- `collect_diff_evidence`, `create_task_worktree` and
-    `accept` each build their own -- so a single routing operation pays that
-    race several times over. On a loaded Windows runner that is a plausible
-    intermittent failure, and `reason` is what lets the next sighting say so
-    instead of blaming the Git version.
+    probe timed out, or it could not be launched at all. Both then widen into
+    `git_unavailable` upstream, which is how graphite#37 got a CI log saying an
+    installed, working Git was unavailable.
+
+    The probe runs under the budget the caller gave its command. It used to
+    have a fixed two seconds of its own -- the one number in this path tuned to
+    a quiet machine, and #37's leading mechanism on a loaded Windows runner.
+    `_version` is still cached per RUNNER -- `collect_diff_evidence`,
+    `create_task_worktree` and `accept` each build their own -- so a single
+    routing operation pays the probe several times over. `reason` is what lets
+    a sighting say which of the three conditions it was instead of blaming the
+    Git version.
     """
 
 
@@ -165,7 +165,7 @@ class GitRunner:
         """Run one bounded Git command with fixed process security controls."""
         if max_stdout_bytes <= 0:
             raise GitOutputLimitError("Git command output limit exceeded")
-        self._ensure_supported_version()
+        self._ensure_supported_version(timeout_seconds)
         command = [
             str(self.executable),
             "--no-optional-locks",
@@ -181,24 +181,31 @@ class GitRunner:
             max_stdout_bytes=max_stdout_bytes,
         )
 
-    def _ensure_supported_version(self) -> None:
+    def _ensure_supported_version(self, timeout_seconds: float) -> None:
         if self._version is not None:
             return
         with self._version_lock:
             if self._version is not None:
                 return
             try:
+                # The probe runs under the caller's own budget, not a fixed one
+                # of its own. `--version` is Git's cheapest command, so a budget
+                # the caller's real command can survive is one the probe can
+                # survive -- a derivation, where the old two seconds was a
+                # number tuned to a quiet machine (graphite#37). The two budgets
+                # stay separate on purpose: sharing one deadline would make the
+                # command's budget vary with probe latency.
                 result = self._run_bounded(
                     [str(self.executable), "--version"],
-                    timeout_seconds=_GIT_VERSION_TIMEOUT_SECONDS,
+                    timeout_seconds=timeout_seconds,
                     max_stdout_bytes=_GIT_VERSION_STDOUT_MAX_BYTES,
                 )
             except (GitTimeoutError, GitLaunchError, GitOutputLimitError) as exc:
                 # The probe never returned a version, so nothing here is
                 # evidence about Git's version -- carry what actually happened.
                 # `os_error` rides along when the inner failure had one; the
-                # class name alone cannot separate "spawn took longer than two
-                # seconds" from "spawn was refused".
+                # class name alone cannot separate "spawn outlived its budget"
+                # from "spawn was refused".
                 probe_reason = f"probe_{type(exc).__name__}"
                 raise GitUnsupportedVersionError(
                     git_version_failure_message(probe_reason),

{graphite_code-0.5.2 → graphite_code-0.5.3}/tests/test_git_security.py

@@ -810,15 +810,16 @@ def _trusted_repository(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path
 def test_a_version_probe_that_timed_out_does_not_read_as_an_old_git(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    """The likeliest reading of graphite#37, and today it is unfalsifiable.
+    """The likeliest reading of graphite#37, and before this it was unfalsifiable.
 
-    `_ensure_supported_version` spends at most `_GIT_VERSION_TIMEOUT_SECONDS`
-    (2.0) on `git --version`, and folds GitTimeoutError, GitLaunchError and
-    GitOutputLimitError into `GitUnsupportedVersionError` -- which `_run_git`
-    then buckets into `git_unavailable`. So "this runner was too slow to spawn a
-    process for two seconds" and "this machine has Git 2.20" arrive as the same
-    string, and the first is exactly what a loaded Windows CI runner produces
-    intermittently while every earlier Git call in the same test succeeded.
+    `_ensure_supported_version` runs `git --version` under a budget (once a
+    fixed 2.0 seconds of its own; now the caller's) and folds GitTimeoutError,
+    GitLaunchError and GitOutputLimitError into `GitUnsupportedVersionError`
+    -- which `_run_git` then buckets into `git_unavailable`. So "this runner was
+    too slow to spawn a process inside the budget" and "this machine has Git
+    2.20" arrived as the same string, and the first is exactly what a loaded
+    Windows CI runner produces intermittently while every earlier Git call in
+    the same test succeeded.
 
     Naming the inner cause is what makes the next sighting decide between them
     instead of restating the bucket.
@@ -927,3 +928,35 @@ def test_a_genuinely_old_git_stays_distinguishable_from_a_slow_one(
     diagnostic = error.value.diagnostic()
     assert "GitTimeoutError" not in diagnostic, "an old Git must not report a timeout"
     assert "too_old" in diagnostic
+
+
+@pytest.mark.parametrize("budget", [7.5, 1.0])
+def test_the_version_probe_runs_under_the_budget_the_caller_gave_its_command(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, budget: float
+) -> None:
+    """graphite#37: the probe had a fixed two-second budget of its own.
+
+    Every production caller gives its real command 5-300 seconds and then paid
+    a fixed 2.0 seconds for the `git --version` that gates it -- a number tuned
+    to a quiet machine, in the one path that runs first on a loaded CI runner.
+    `--version` is Git's cheapest command, so a budget the caller's own command
+    can survive is one the probe can survive: derive it, and the number goes.
+
+    Both parameters carry weight. 7.5 shows the caller's budget reaches the
+    probe; 1.0 shows no floor was smuggled back in under the derivation.
+    """
+    version_process = _FakeProcess(b"git version 2.38.0\n")
+    process = _FakeProcess(b"tracked.py\0")
+    runner, _calls = _runner_with_fake_process(
+        tmp_path, monkeypatch, process, version_process=version_process
+    )
+
+    runner.run(["ls-files", "-z"], timeout_seconds=budget)
+
+    assert version_process.wait_calls == [budget], (
+        "the version probe must run under the budget the caller gave its command"
+    )
+    # Falsifiability control: the command keeps its own, full budget. A shared
+    # deadline would make the command's budget vary with probe latency, which
+    # is a new way to time out spuriously, not a fix for one.
+    assert process.wait_calls == [budget]