Bound checkpoint git subprocesses to their context deadline

[computermode]

https://entire.io/gh/entireio/cli/trails/440

Problem

A git push/git fetch over a custom transport (e.g. entire://) can hang the pre-push hook for ~an hour despite a 2-minute timeout. A doctor trace of a stuck checkpoint push:

push_checkpoints_branch        3,502,176ms
  ├─ fetch_and_rebase             13,695ms
  │  └─ git_fetch                 12,612ms
  ├─ git_push                      1,163ms  x
  └─ git_push~1                3,487,316ms  x   ← ~58 min

The context deadline SIGKILLs the git process, but the spawned remote-helper grandchild (e.g. git-remote-entire) keeps the output pipe open, so cmd.CombinedOutput() blocks until that helper finally exits.

Fix

Harden every git subprocess built by newCommand (push / fetch / fetch-pack / ls-remote / cat-file):

• WaitDelay backstop (all platforms): after the process is killed, Go force-closes the pipes instead of waiting on a pipe-holding descendant.
• Process-group kill (unix): the child runs in its own process group and the whole group is SIGKILLed on cancellation, so the remote helper is terminated too rather than orphaned. Windows relies on the WaitDelay backstop (reliable process-tree kill there needs a Job Object, out of scope).

Turns "stuck forever" into a bounded failure: checkpoints stay saved locally and the user's own push proceeds.

Testing

• Unit tests assert newCommand sets WaitDelay + a group-kill Cancel (unix Setpgid).
• A behavioral test reproduces the failure shape — a backgrounded grandchild holding the pipe — and confirms the group-kill terminates it promptly.
• Existing remote, strategy push/fetch/rebase, and integration remote tests pass.

Notes

• The transport itself still hangs on the retry upload — that's the entiredb / git-remote-entire side; this PR just stops it from hanging the hook.
• The per-phase perf spans that produced the trace above are in a separate branch (hooks-slow-push-db-mirror).

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes how all checkpoint remote git invocations terminate on timeout/cancel; incorrect group kill could affect child processes, though scope is limited to the checkpoint remote package and is well-tested on Unix.

Overview
Checkpoint git subprocesses built by newCommand (push, fetch, fetch-pack, ls-remote, cat-file) are hardened so context timeouts are not defeated by orphaned transport helpers.

Every such command gets a 10s WaitDelay so CombinedOutput/Wait cannot block indefinitely on pipe-holding descendants after the parent is killed. On Unix, children run in their own process group with a custom Cancel that SIGKILLs the whole group, so helpers like git-remote-entire are torn down instead of keeping stdout open for tens of minutes. Windows only gets the WaitDelay backstop (process-tree kill deferred).

Unit and behavioral tests cover WaitDelay, group kill on Unix, and the pipe-holding grandchild scenario.

^{Reviewed by Cursor Bugbot for commit 36085bb. Configure here.}

[Copilot]

Pull request overview

This PR hardens checkpoint-remote git subprocess execution so context timeouts/cancellation reliably terminate hung git push/git fetch operations (especially when custom transports spawn helper descendants that keep stdout/stderr pipes open).

Changes:

• Apply subprocess hardening in newCommand for all checkpoint-remote git invocations.
• Introduce cross-platform WaitDelay backstop plus Unix-only process-group kill on cancellation.
• Add unit and behavioral tests validating WaitDelay and process-group termination behavior.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
cmd/entire/cli/checkpoint/remote/git.go	Ensures all checkpoint-remote git commands created via newCommand are hardened against hangs.
cmd/entire/cli/checkpoint/remote/command_harden.go	Adds shared hardening logic (WaitDelay + platform hook).
cmd/entire/cli/checkpoint/remote/command_harden_windows.go	Implements Windows no-op for process-group kill (relies on WaitDelay + default cancellation).
cmd/entire/cli/checkpoint/remote/command_harden_unix.go	Implements Unix process-group isolation (Setpgid) and group-wide SIGKILL on cancel.
cmd/entire/cli/checkpoint/remote/command_harden_unix_test.go	Adds Unix tests validating process-group kill behavior and pipe-holding descendant scenario.
cmd/entire/cli/checkpoint/remote/command_harden_test.go	Adds cross-platform tests validating newCommand/hardenSubprocess set WaitDelay and cancellation behavior.