fix(cli): bound engine, daemon and registry waits so a hung dependency cannot freeze the CLI

Merged
BN
6d ago
+1719-279

Integration PR for the bound-* stack. PR #689 was merged into fix/bound-tls-leftovers (merge bb38882f8), whose base was this branch, so this PR delivers #689 plus the remaining TLS/secrets deadline work into fix/bound-shared.

  • Carries the CLI deadline work from #689: engine client connect/idle/total budgets, cosign, AgentENV probes, launchctl/docker/podman, release/GitHub clients, git push credential-path neutralisation, and bounded preloop store migrate.
  • Carries the TLS/secrets leftovers already on this branch.
  • Merged fix/bound-shared @ 906bb4b79 (main @ 5fdbde3e7, #687, #691); only conflict was CHANGELOG.md, resolved by keeping both the Postgres and CLI entries.

Verification is the PR check suite (rust shards, property-tests-fast, Server/Runner light conformance, rust-lint).

Summary by cubic

Binds the CLI's waits on the engine, daemon, and registry so a hung dependency fails the command instead of freezing it.

Previously every outbound call the CLI made had no deadline in some path: an engine that accepted the TCP connection and never answered held preloop status, run, logs, push, and the rest open indefinitely. The engine client now has a 10-second connect deadline, a 10-minute idle-read bound (above the engine's own 5-minute liveness window, so a quiet long job is never cut), and per-call totals of 30 seconds for one-shot control calls, 5 minutes for durable log fetches, and 15 minutes for git-bundle uploads. Streaming paths (logs --follow, the run event feed) deliberately keep no total.

Bounded external calls

  • cosign verification, AgentENV egress sudo/systemctl, and debug guest probes now run under deadlines.
  • launchctl in server install, docker/podman build operations in init, the release and manifest GitHub clients, and smolvm/systemctl in update are bounded.
  • git push runs non-interactively under a deadline without breaking the developer's keychain credentials.
  • store migrate bounds its Postgres connect across the whole session-setup sequence and replaces the indefinite pg_advisory_lock wait with a bounded pg_try_advisory_lock retry.
  • Shared TLS roots are installed on the OTLP exporter, GitHub and lint clients verify against in-process roots, and transient push errors are classified by walking the error chain for typed deadline expiry so retries stay bounded.