fix(service-manager): compose timeout, shell-free spawn, pinned image tags

[Copilot]

runComposeUp could hang indefinitely on a blocked docker compose up, and shell-string construction in composeCommand introduced unnecessary injection surface. Docker image tags were all floating :latest, breaking reproducibility.

Changes

Process-level timeout for runComposeUp

• Added COMPOSE_UP_TIMEOUT_MS = 300_000 (5 min) module constant
• settle() guard prevents double-resolve/reject; on expiry calls proc.kill() and rejects with structured { status: null, stdout: '', stderr: 'Process timed out after …ms' }

Shell-free spawn via ComposeCommand refactor

• composeCommand() now returns { bin: string; args: string[] } instead of a shell string
• runComposeUp switches from spawn(cmd, { shell: true }) → spawn(bin, args, { shell: false })
• stopService / status updated to execFileSync(bin, args, …); execSync import removed

// before
spawn(`docker compose -f ${profile.composeFile} up -d`, { shell: true, … })

// after
const { bin, args } = composeCommand(profile, 'up -d', profile.services);
spawn(bin, args, { shell: false, … })

Pinned docker image tags

• All 7 dockerImages entries changed from :latest → :v1.0.0 for reproducible deployments

Already-addressed duplicates (no change needed)

• wrapComposeStartError already returns CodexSynapticError
• dockerLogin already async with spawn (no shell)

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

---

Continue Tasks: ✅ 1 no changes — View all

[notion-workspace]

🧬 [PAP-17] codex-synaptic

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.