Merge main (97ca7eba) into fix/glob-mount-prefixed-patterns, and a **/ after a brace group

.github/PULL_REQUEST_TEMPLATE.md

@@ -21,8 +21,9 @@
 
 ---
 
-- [ ] Changelog fragment added — `changelog.d/<slug>.<breaking|added|changed|fixed>.md`
-      (see `changelog.d/README.md`) — or this change is internal-only /
+- [ ] Changelog fragment added or a pending one edited —
+      `changelog.d/<slug>.<breaking|added|changed|fixed>.md` (see
+      `changelog.d/README.md`) — or this change is internal-only /
       test-only / docs-only (apply the `no-changelog` label).
 
 <!-- AI-assisted contributions are welcome and normal here — see

.github/workflows/changelog.yml

@@ -23,15 +23,16 @@ jobs:
           base="${{ github.event.pull_request.base.sha }}"
           head="${{ github.event.pull_request.head.sha }}"
           changed=$(git diff --name-only "$base...$head")
-          # Fragments must be *added* — a deleted or renamed fragment also
+          # Fragments must be added or edited: a change may land its entry by
+          # editing a pending fragment. A deleted or renamed fragment also
           # appears in --name-only and must not satisfy the check.
-          added=$(git diff --name-only --diff-filter=A "$base...$head")
+          added_or_edited=$(git diff --name-only --diff-filter=AM "$base...$head")
           echo "Changed files:"
           echo "$changed"
           if echo "$changed" | grep -q '^src/' \
-             && ! echo "$added" | grep -Eq '^changelog\.d/[^/]+\.(breaking|added|changed|fixed)\.md$' \
+             && ! echo "$added_or_edited" | grep -Eq '^changelog\.d/[^/]+\.(breaking|added|changed|fixed)\.md$' \
              && ! echo "$changed" | grep -qx 'CHANGELOG.md'; then
-            echo "::error::This PR touches src/ but carries no changelog entry. Add a fragment changelog.d/<slug>.<breaking|added|changed|fixed>.md (see CONTRIBUTING.md), or apply the 'no-changelog' label if the change is internal-only."
+            echo "::error::This PR touches src/ but carries no changelog entry. Add a fragment changelog.d/<slug>.<breaking|added|changed|fixed>.md or edit a pending one (see CONTRIBUTING.md), or apply the 'no-changelog' label if the change is internal-only."
             exit 1
           fi
           echo "OK"

.github/workflows/ci.yml

@@ -13,6 +13,11 @@ jobs:
   build-and-test:
     name: Build & Test (${{ matrix.os }}, node ${{ matrix.node }})
     runs-on: ${{ matrix.os }}
+    # Without a limit, a step that hangs leaves the check pending until
+    # GitHub's six-hour limit. Passing runs take under seven minutes. A
+    # test file stuck under Node 20, or a test stuck under Node 24, fails
+    # sooner and by name, through npm test's --test-timeout.
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       # Both platforms: a package-lock.json regenerated over an existing
@@ -36,7 +41,8 @@ jobs:
           node-version: ${{ matrix.node }}
 
       # Root lockfiles are deliberately gitignored in this repo, so plain
-      # npm install (matching publish.yml). No lock to guard here.
+      # npm install, as publish.yml's build-and-test job does. No lock to
+      # guard here.
       - name: Install dependencies
         run: npm install
 
@@ -54,9 +60,11 @@ jobs:
       # npm test runs with --test-force-exit, which hides async work a test
       # leaves running, such as a late arrival after stop() ("Queue is
       # closed"). These files run unforced so that class fails here, not in a
-      # later PR's qualification.
+      # later PR's qualification. They get npm test's --test-timeout too:
+      # under Node 20 it fails a file whose leftover work keeps it alive, by
+      # name, and under Node 24 the job's limit ends such a file.
       - name: Test unforced (work in flight at stop)
-        run: node --test dist/test/stop-with-work-in-flight.test.js dist/test/stop-with-host-operations.test.js dist/test/conversation-routing.test.js
+        run: node --test --test-timeout=600000 dist/test/stop-with-work-in-flight.test.js dist/test/stop-with-host-operations.test.js dist/test/conversation-routing.test.js
 
   # The release as npm would pack it, installed on its own and loaded, as
   # the publish workflow checks before it publishes (see
@@ -66,10 +74,13 @@ jobs:
   # install resolves dependencies from the registry as it stands, so a new
   # upstream release can turn it red on a change that touched nothing it
   # installs: when it fails, rerunning it on main tells a change's own break
-  # from the registry's drift.
+  # from the registry's drift. The job stops at 40 minutes, not at GitHub's 6
+  # hours: above the check's own limits (10 minutes each for npm pack and npm
+  # install, a minute for each load), so the check names what hung.
   pack-check:
     name: Packed release installs on its own
     runs-on: ubuntu-latest
+    timeout-minutes: 40
 
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
@@ -96,5 +107,62 @@ jobs:
         with:
           bun-version: 1.3.14
 
+      # Bun's WebSocket client quotes the url as dialed in a failed dial's
+      # message, which Node's never does, so the test that the dial's error
+      # masks it runs its probe under bun. The build-and-test job has no bun
+      # and skips it; here AF_TEST_REQUIRE_BUN makes a missing bun a failure.
+      - name: WebSocket dial errors under Bun
+        env:
+          AF_TEST_REQUIRE_BUN: '1'
+        run: node --import ./dist/test/helpers/force-exit-blocking-stdout.js --test --test-force-exit --test-timeout=600000 dist/test/mcpl-ws-transport.test.js
+
       - name: Packed release installs on its own
         run: node scripts/pack-installs-alone.mjs
+
+      # create() refuses codeExecution on a Bun older than 1.4.0, reading the
+      # Bun it runs under: the settings file checks that here, under the Bun
+      # connectome-host's CI runs, which create() refuses.
+      - name: code_execution's settings under Bun 1.3.14, which create() refuses
+        run: bun test --timeout 60000 ./test/code-execution-isolate-settings.test.ts
+
+  # A Bun host runs a script's process on Bun too, from the package's source,
+  # so code_execution's files run there as well as under Node, each file in a
+  # process of its own, on both platforms, since the child's stdio and fd 3
+  # are where runtimes and platforms differ. code_execution needs Bun 1.4.0 or
+  # later (create() refuses it on an older one), so they run under 1.4.0, the
+  # oldest release it admits, and under 1.4.3.
+  code-execution-bun:
+    name: code_execution under Bun (${{ matrix.os }}, bun ${{ matrix.bun }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+        bun: [1.4.0, 1.4.3]
+
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: 24
+
+      - name: Install dependencies
+        run: npm install --ignore-scripts
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: ${{ matrix.bun }}
+
+      - name: code_execution's tests under Bun, from source
+        run: |
+          for f in test/code-execution-isolate-*.test.ts test/code-execution-engine.test.ts test/code-execution.test.ts; do
+            echo "::group::$f"
+            bun test --timeout 60000 "./$f" || exit 1
+            echo "::endgroup::"
+          done

.github/workflows/engine.yml

@@ -0,0 +1,52 @@
+name: Engine
+
+# code_execution's engine module, src/code-execution/quickjs.wasm, is committed beside what it's
+# built from: engine/build.sh, which fetches the pinned quickjs-ng release and applies the patches
+# in engine/patches, and engine/interface.c, built with a pinned toolchain. This rebuilds the
+# module and fails unless the bytes are the committed ones, so the module can't drift from its
+# sources in either direction. It runs only when one of them changes, since the toolchain is a
+# 143 MB download.
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'engine/**'
+      - 'src/code-execution/quickjs.wasm'
+      - '.github/workflows/engine.yml'
+  pull_request:
+    paths:
+      - 'engine/**'
+      - 'src/code-execution/quickjs.wasm'
+      - '.github/workflows/engine.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  rebuild:
+    name: The committed engine module is what its sources build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
+
+      # binaryen's wasm-opt comes from npm and runs under Node.
+      - name: Setup Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: 24
+
+      - name: Rebuild the module
+        run: engine/build.sh "$RUNNER_TEMP/quickjs.wasm"
+
+      - name: Compare it with the committed module
+        run: |
+          sha256sum "$RUNNER_TEMP/quickjs.wasm" src/code-execution/quickjs.wasm
+          if ! cmp -s "$RUNNER_TEMP/quickjs.wasm" src/code-execution/quickjs.wasm; then
+            echo "::error::src/code-execution/quickjs.wasm isn't what engine/build.sh builds from these sources. Rebuild it with engine/build.sh and commit it with them."
+            exit 1
+          fi

.github/workflows/greptile-label.yml

@@ -3,28 +3,48 @@ name: Greptile label
 # Greptile reviews only pull requests labelled `greptile` (.greptile/config.json).
 # Every 30 minutes this job adds the label to each open, non-draft pull
 # request with more than 400 additions plus deletions that carries neither
-# `greptile` nor `no-greptile`, so a smaller one gets a Greptile review only
-# if someone adds the label by hand. Greptile's reference lists a pull
-# request being given a trigger label among the openings it reviews, and a
-# label added after a pull request opened starts its review then: within
-# about half an hour of a pull request opening, passing 400 lines or being
-# marked ready, and later when GitHub's scheduler is busy.
+# `greptile` nor `no-greptile` and hasn't been updated in the last two
+# minutes, so a smaller one gets a Greptile review only if someone adds the
+# label by hand. Greptile's reference lists a pull request being given a
+# trigger label among the openings it reviews, so its review starts when this
+# job's label lands: within about half an hour of a pull request opening,
+# passing 400 lines or being marked ready, and later when GitHub's scheduler
+# is busy.
 #
-# Each run lists every open pull request, up to the list call's 500, so the
-# next run catches up on one that was missed or delayed. A draft past the
-# line is labelled once it's marked ready. The label is only ever added: a
+# A run labels a pull request only once two minutes have passed since its
+# last update, so one updated less than two minutes before a run waits for a
+# later run, usually the next, about half an hour later. On Oct 19, a label
+# added seven seconds after opening started no review on either of the two
+# pull requests it happened to, while on Oct 18 labels added 35 to 105 seconds
+# after opening started a review on each of seven. The two minutes are a
+# margin over those cases, since the boundary between seven and 35 seconds
+# hasn't been measured. The wait counts from any update, not only from the
+# openings Greptile's reference names (opened, reopened, ready for review),
+# because a label Greptile drops stays on the pull request, so no later run
+# adds it again, while waiting delays the label by a run each time the pull
+# request is updated in the two minutes before one. A pull request's update
+# time is when it opened or later, and comments, reviews, labels and marking
+# it ready move it. Reopening it and pushing to it are expected to move it as
+# well, though that hasn't been checked. A pull request whose update time
+# doesn't parse gets no wait, and a warning in the run's log names it if it's
+# past 400 lines or has no line counts.
+#
+# Each run lists every open pull request, up to the list call's 500, so a
+# later run catches up on one that was missed or delayed. A draft past the
+# line is labelled after it's marked ready. The label is only ever added: a
 # pull request that later shrinks keeps it, and removing it from one past the
-# line doesn't skip the review, since the next run adds it back.
-# `no-greptile` is the way to skip a review.
+# line doesn't skip the review, since a later run adds it back. `no-greptile`
+# is the way to skip a review.
 #
 # A schedule rather than pull_request_target, which GitHub's default event
 # policy for public repositories blocks once it's enforced, from November 2,
 # 2026. A scheduled run uses this file as the default branch has it, reads
-# pull request numbers, line counts, draft flags and labels through the API,
-# and checks nothing out. GitHub disables a public repository's scheduled
-# workflows after 60 days without activity (enable this one again from the
-# Actions tab), and sends a scheduled workflow's notifications to whoever last
-# changed its cron line. workflow_dispatch runs it on demand.
+# pull request numbers, line counts, draft flags, labels and update times
+# through the API, and checks nothing out. GitHub disables a public
+# repository's scheduled workflows after 60 days without activity (enable this
+# one again from the Actions tab), and sends a scheduled workflow's
+# notifications to whoever last changed its cron line. workflow_dispatch runs
+# it on demand.
 on:
   schedule:
     # Away from the start of the hour, which GitHub names as a time of high
@@ -49,21 +69,36 @@ jobs:
         # names compare case-insensitively, as Greptile's own filters do. jq
         # reads a missing count as null, and null plus a number as that
         # number, so a candidate whose counts aren't both numbers is named and
-        # fails the step rather than passing unlabelled. A label that fails for
-        # one pull request doesn't stop the others.
+        # fails the step rather than passing unlabelled, once two minutes have
+        # passed since its last update (at once if that time doesn't parse). A
+        # label that fails for one pull request doesn't stop the others.
         run: |
           prs=$(gh pr list --repo "$REPO" --state open --limit 500 \
-            --json number,additions,deletions,isDraft,labels)
+            --json number,additions,deletions,isDraft,labels,updatedAt)
           open=$(jq length <<< "$prs")
           echo "Open pull requests: $open."
           candidates=$(jq '[.[] | select(.isDraft | not)
             | select(any(.labels[]; (.name | ascii_downcase) == "greptile" or (.name | ascii_downcase) == "no-greptile") | not)]' <<< "$prs")
-          uncounted=$(jq -r '[.[] | select((.additions | type) != "number" or (.deletions | type) != "number")
+          # A pull request updated in the last two minutes waits for a later
+          # run, whether or not it has line counts yet. One whose updatedAt
+          # doesn't parse gets no wait, as before this rule, and the warning
+          # names it if it's past 400 lines or has no line counts.
+          now=$(date -u +%s)
+          untimed=$(jq -r '[.[] | select(((.updatedAt | fromdateiso8601?) // null) == null)
+            | select((.additions | type) != "number" or (.deletions | type) != "number" or .additions + .deletions > 400)
+            | "#\(.number)"] | join(" ")' <<< "$candidates")
+          settled=$(jq --argjson now "$now" '[.[]
+            | select(((.updatedAt | fromdateiso8601?) // 0) <= $now - 120)]' <<< "$candidates")
+          young=$(jq -r --argjson now "$now" '[.[]
+            | select(((.updatedAt | fromdateiso8601?) // 0) > $now - 120)
+            | select((.additions | type) != "number" or (.deletions | type) != "number" or .additions + .deletions > 400)
             | "#\(.number)"] | join(" ")' <<< "$candidates")
+          uncounted=$(jq -r '[.[] | select((.additions | type) != "number" or (.deletions | type) != "number")
+            | "#\(.number)"] | join(" ")' <<< "$settled")
           todo=$(jq -r '.[]
             | select((.additions | type) == "number" and (.deletions | type) == "number")
             | select(.additions + .deletions > 400)
-            | "\(.number) \(.additions + .deletions)"' <<< "$candidates")
+            | "\(.number) \(.additions + .deletions)"' <<< "$settled")
           labelled=0
           failed=""
           while read -r number changed; do
@@ -77,11 +112,17 @@ jobs:
             fi
           done <<< "$todo"
           echo "Labelled $labelled."
+          if [ -n "$young" ]; then
+            echo "Left for a later run, updated less than two minutes ago: $young."
+          fi
+          if [ -n "$untimed" ]; then
+            echo "::warning::GitHub gave no readable update time for these, so they got no two-minute wait: $untimed."
+          fi
           if [ -n "$uncounted" ]; then
             echo "::error::GitHub gave no line counts for these, so they weren't labelled: $uncounted. To have Greptile review one, add the greptile label to it by hand, or add no-greptile to skip its review; either ends this failure for it."
           fi
           if [ -n "$failed" ]; then
-            echo "::error::Labelling failed for these:$failed. GitHub's answer for each is above its 'Labelling #N failed' line, and every later run tries again. To have Greptile review one now, add the greptile label to it by hand, creating the label from the repository's Labels page if it isn't there, or add no-greptile to skip its review; either ends this failure for it."
+            echo "::error::Labelling failed for these:$failed. GitHub's answer for each is above its 'Labelling #N failed' line, and later runs try again. To have Greptile review one now, add the greptile label to it by hand, creating the label from the repository's Labels page if it isn't there, or add no-greptile to skip its review; either ends this failure for it."
           fi
           if [ -n "$uncounted$failed" ]; then
             exit 1