Design + plan: per-thread read-only reach into another project (#109)

docs/ISSUES.md

@@ -1,5 +1,6 @@
 # Issues log
 
+- 2026-08-16 - symptom: issue #88 — the prStatus freeze class was never generalized: every sync git (diff, listFiles, sync info, repo info, merge, and the same calls over ssh) ran with no timeout, so one hung filesystem or unreachable remote blocks the main process, agent streaming included | cause: worktrees.js gitOut/gitTry called execFileSync directly and only opted into a timeout at one call site (push, 30s), while ssh.js execCommand passed through whatever the caller gave it — ConnectTimeout=10 bounds the ssh connect, not the command | fix: ONE choke point — ssh.js execCommand defaults timeout to SYNC_TIMEOUT_MS (15s) and worktrees gitOut/gitTry now route through it instead of execFileSync; caller-supplied timeouts still win, and the network paths (services gitFetch/gitPull) pass 60s | remainder: 15s of blocked event loop is still a freeze, just a bounded one — the hot IPC paths (diff/listFiles) still want async spawn, which is a bigger change than a bound and was not taken here
 - 2026-08-15 - decision: `npm run dev` starts Vite AND Electron (scripts/dev.js), so dev runs the renderer against the REAL main process with HMR | root cause of issue #37: main.js has always loaded localhost:5173 when isDev, but the documented loops were `vite build` + CODER_PROD=1 (no HMR) or bare `npx vite` (devCoder), so everyone developed against the mock and entries 85/89 followed | src/devCoder.ts is now fixtures only — provider registry, setProvider validation, settle/pin/snooze rules, worktree materialization, PR state machine, workflow template validation and the buildHandoffPrefix twin are deleted, along with the 13 test/devCoder*.test.ts files (2,545 lines) that pinned the mirror in place; 3,809 → ~3,050 lines | the practice below ("check devCoder for the same branch") is retired: a fixture that enforces no rules cannot drift, and `npm run dev:browser` is for demo and trailer captures only
 - 2026-08-15 - symptom: issue #17 round 3 — a turn checkmarks "Starting agent" and "Agent working" and then produces nothing, no output and no error | evidence: the live store plus the real claude session jsonl for the one occurrence under the phantom-hold build (2026-08-15T06:53:42Z, thread 107aa530, session 374136fe): the resumed CLI first settled a queued `<task-notification>` as its own turn and answered it with an empty success result, our "continue" was accepted at 06:53:44.062, and the real turn's first token (thinking on a 21MB session) landed at 06:54:32.890 — 48s later, while the 30s phantom grace timer had already failed the run at 06:54:14 and cleared the slot, so every event of the real turn was dropped by the runId guard | cause: the grace timer treated wall-clock silence as proof the turn was over; no timeout can be both short enough to catch a dead CLI and long enough to survive a slow first token (same reasoning as the hung-stdin remainder below) | second silent path found by audit and covered by test: onExit finalized on `sawResult || gotResult`, but claude.js's gotResult is set for ANY result line including a held phantom we deliberately did not finalize on, so a phantom discarded by real content followed by a CLI crash checkmarked both steps with no message, no status change and no notification — the exact reported shape | fix: a held phantom becomes a failure only on process exit (the existing onExit path); the grace timer, PHANTOM_RESULT_GRACE_MS and CODER_PHANTOM_RESULT_GRACE_MS are gone, and onExit finalizes on `sawResult` alone | tests: "keeps waiting when the real turn is slower than any fixed grace window" (fake emits phantom, waits 400ms, then the real turn; with the old timer at 80ms it lands 'failed' instead of 'done') and "reports the exit when the CLI dies after a discarded leftover result" (times out waiting for 'failed' against the old gotResult branch) | tradeoff: a CLI that answers a phantom and then never speaks or exits now spins on "Agent working…" (unchecked, Stop available) instead of failing after 30s — the honest state, and the same gap as the hung-stdin remainder