fix: retry transient clean-room install timeouts (#70)

Author: xiaojiou176

AGENTS.md

@@ -183,8 +183,11 @@ Work in CortexPilot as a contract-first engineering agent:
   same patch; current examples include `.runtime-cache/test_output/ci/` and
   `configs/pip_audit_ignored_advisories.json`, plus the dashboard
   and desktop install-time ENOSPC recovery knobs plus the Docker daemon
-  precheck retry knobs registered in `configs/env.registry.json`; current CI
-  credential/evidence examples also include the upstream receipt refresh
+  precheck retry knobs registered in `configs/env.registry.json`, and the
+  bounded transient npm registry socket-timeout retries inside
+  `scripts/install_dashboard_deps.sh` plus
+  `scripts/install_desktop_deps.sh`; current CI credential/evidence examples
+  also include the upstream receipt refresh
   fallback to `scripts/verify_upstream_slices.py --mode smoke` and the strict
   live-provider rule that resolves process env first and `~/.codex/config.toml`
   second while keeping dotenv and shell-export fallbacks disabled on mainline;

CLAUDE.md

@@ -108,8 +108,11 @@ This file mirrors the root AI entrypoint for tools that prefer `CLAUDE.md`.
   same patch; current examples include `.runtime-cache/test_output/ci/` and
   `configs/pip_audit_ignored_advisories.json`, plus the dashboard
   and desktop install-time ENOSPC recovery knobs plus the Docker daemon
-  precheck retry knobs registered in `configs/env.registry.json`; current CI
-  credential/evidence examples also include the upstream receipt refresh
+  precheck retry knobs registered in `configs/env.registry.json`, and the
+  bounded transient npm registry socket-timeout retries inside
+  `scripts/install_dashboard_deps.sh` plus
+  `scripts/install_desktop_deps.sh`; current CI credential/evidence examples
+  also include the upstream receipt refresh
   fallback to `scripts/verify_upstream_slices.py --mode smoke` and the strict
   live-provider rule that resolves process env first and `~/.codex/config.toml`
   second while keeping dotenv and shell-export fallbacks disabled on mainline;

README.md

@@ -647,7 +647,9 @@ governance manifest refresh falls back to `scripts/verify_upstream_slices.py --m
 to regenerate the receipts instead of failing on missing files alone.
 Dashboard dependency installs now also carry an ENOSPC recovery branch that
 retries with a workspace-local pnpm store and the registered dashboard install
-env knobs when copy-heavy CI or local maintenance installs run out of disk.
+env knobs when copy-heavy CI or local maintenance installs run out of disk, and
+dashboard/desktop clean-room installs now retry bounded transient npm registry
+socket timeouts before they fail closed.
 Desktop dependency installs now mirror the same ENOSPC recovery strategy,
 including the registered desktop install env knobs that scope hardlink imports
 to the recovery attempt and move retry stores onto workspace-local temp roots.

docs/README.md

@@ -240,7 +240,10 @@ navigation set.
   same patch; the current examples are `.runtime-cache/test_output/ci/` and
   `configs/pip_audit_ignored_advisories.json`, plus the dashboard and desktop
   ENOSPC recovery knobs plus the Docker daemon precheck retry knobs registered
-  in `configs/env.registry.json`; current CI contract changes also include the
+  in `configs/env.registry.json`, together with the bounded transient npm
+  registry socket-timeout retries inside
+  `scripts/install_dashboard_deps.sh` / `scripts/install_desktop_deps.sh`;
+  current CI contract changes also include the
   upstream receipt refresh fallback to `scripts/verify_upstream_slices.py --mode smoke`
   and the strict hosted-first live-provider rule that allows
   process env first and `~/.codex/config.toml` second while keeping dotenv and

scripts/install_dashboard_deps.sh

@@ -17,6 +17,8 @@ INSTALL_SHAMEFULLY_HOIST="${CORTEXPILOT_DASHBOARD_PNPM_SHAMEFULLY_HOIST:-1}"
 BASE_INSTALL_NODE_LINKER="$INSTALL_NODE_LINKER"
 BASE_INSTALL_PACKAGE_IMPORT_METHOD="$INSTALL_PACKAGE_IMPORT_METHOD"
 BASE_INSTALL_SHAMEFULLY_HOIST="$INSTALL_SHAMEFULLY_HOIST"
+NETWORK_RETRY_ATTEMPTS=2
+NETWORK_RETRY_SLEEP_SECONDS=5
 INSTALL_LOG="$ROOT_DIR/.runtime-cache/logs/runtime/deps_install/install_dashboard_deps.log"
 LOCK_DIR="${STATE_ROOT}/install-dashboard-deps.lock"
 LOCK_OWNER_FILE="$LOCK_DIR/owner"
@@ -36,6 +38,10 @@ install_log_has_partial_bin_warning() {
   log_contains "Failed to create bin at " && log_contains "ENOENT"
 }
 
+install_log_has_socket_timeout() {
+  log_contains "ERR_SOCKET_TIMEOUT" || log_contains "Socket timeout"
+}
+
 print_install_log_tail() {
   local lines="${1:-80}"
   [[ -f "$INSTALL_LOG" ]] || return 0
@@ -225,6 +231,29 @@ run_install() {
   )
 }
 
+run_install_with_network_retry() {
+  local context="$1"
+  local attempt=0
+  while true; do
+    if run_install; then
+      return 0
+    fi
+    if ! install_log_has_socket_timeout; then
+      return 1
+    fi
+    if (( attempt >= NETWORK_RETRY_ATTEMPTS )); then
+      return 1
+    fi
+    attempt=$((attempt + 1))
+    echo "⚠️ [install-dashboard-deps] ${context}; transient npm registry socket timeout detected; retrying install (${attempt}/${NETWORK_RETRY_ATTEMPTS})" >&2
+    sleep "$NETWORK_RETRY_SLEEP_SECONDS"
+    if ! reset_app_node_modules; then
+      print_install_log_tail 80
+      exit 1
+    fi
+  done
+}
+
 reset_app_node_modules() {
   local target="$APP_DIR/node_modules"
   [[ -d "$target" ]] || return 0
@@ -306,10 +335,15 @@ recover_with_workspace_store() {
     print_install_log_tail 80
     exit 1
   fi
-  if ! run_install; then
+  if ! run_install_with_network_retry "workspace-local recovery install"; then
     INSTALL_PACKAGE_IMPORT_METHOD="$previous_import_method"
     INSTALL_NODE_LINKER="$previous_node_linker"
     INSTALL_SHAMEFULLY_HOIST="$previous_shamefully_hoist"
+    if install_log_has_socket_timeout; then
+      echo "❌ [install-dashboard-deps] workspace-local recovery exhausted transient npm registry retries; tail follows" >&2
+      print_install_log_tail 80
+      exit 1
+    fi
     echo "❌ [install-dashboard-deps] pnpm install failed after workspace-local recovery; tail follows" >&2
     print_install_log_tail 80
     exit 1
@@ -319,18 +353,22 @@ recover_with_workspace_store() {
   INSTALL_SHAMEFULLY_HOIST="$previous_shamefully_hoist"
 }
 
-if ! run_install; then
+if ! run_install_with_network_retry "initial install"; then
   if log_contains "ERR_PNPM_ENOENT"; then
     recover_with_fresh_store "detected pnpm store ENOENT"
   elif log_contains "ERR_PNPM_ENOSPC" || log_contains "no space left on device"; then
     recover_with_workspace_store "detected pnpm ENOSPC"
+  elif install_log_has_socket_timeout; then
+    echo "❌ [install-dashboard-deps] pnpm install failed after transient npm registry retries; tail follows" >&2
+    print_install_log_tail 80
+    exit 1
   elif log_contains "ERR_PNPM_ENOTDIR"; then
     echo "⚠️ [install-dashboard-deps] detected app-local node_modules ENOTDIR; resetting dashboard node_modules and retrying once" >&2
     if ! reset_app_node_modules; then
       print_install_log_tail 80
       exit 1
     fi
-    if ! run_install; then
+    if ! run_install_with_network_retry "node_modules reset retry"; then
       echo "❌ [install-dashboard-deps] pnpm install failed after node_modules reset; tail follows" >&2
       print_install_log_tail 80
       exit 1

scripts/install_desktop_deps.sh

@@ -12,6 +12,8 @@ INSTALL_PACKAGE_IMPORT_METHOD="${CORTEXPILOT_DESKTOP_PNPM_IMPORT_METHOD:-copy}"
 INSTALL_SHAMEFULLY_HOIST="${CORTEXPILOT_DESKTOP_PNPM_SHAMEFULLY_HOIST:-1}"
 BASE_INSTALL_NODE_LINKER="$INSTALL_NODE_LINKER"
 BASE_INSTALL_SHAMEFULLY_HOIST="$INSTALL_SHAMEFULLY_HOIST"
+NETWORK_RETRY_ATTEMPTS=2
+NETWORK_RETRY_SLEEP_SECONDS=5
 INSTALL_LOG="$ROOT_DIR/.runtime-cache/logs/runtime/deps_install/install_desktop_deps.log"
 LOCK_DIR="$ROOT_DIR/.runtime-cache/cortexpilot/locks/install-desktop-deps.lock"
 LOCK_OWNER_FILE="$LOCK_DIR/owner"
@@ -159,6 +161,36 @@ run_install() {
   )
 }
 
+install_log_has_socket_timeout() {
+  [[ -f "$INSTALL_LOG" ]] || return 1
+  local content=""
+  content="$(<"$INSTALL_LOG")"
+  [[ "$content" == *"ERR_SOCKET_TIMEOUT"* || "$content" == *"Socket timeout"* ]]
+}
+
+run_install_with_network_retry() {
+  local context="$1"
+  local attempt=0
+  while true; do
+    if run_install; then
+      return 0
+    fi
+    if ! install_log_has_socket_timeout; then
+      return 1
+    fi
+    if (( attempt >= NETWORK_RETRY_ATTEMPTS )); then
+      return 1
+    fi
+    attempt=$((attempt + 1))
+    echo "⚠️ [install-desktop-deps] ${context}; transient npm registry socket timeout detected; retrying install (${attempt}/${NETWORK_RETRY_ATTEMPTS})" >&2
+    sleep "$NETWORK_RETRY_SLEEP_SECONDS"
+    if ! reset_app_node_modules; then
+      tail -n 80 "$INSTALL_LOG" >&2 || true
+      exit 1
+    fi
+  done
+}
+
 verify_typescript_toolchain() {
   (
     cd "$APP_DIR"
@@ -175,12 +207,17 @@ recover_with_fresh_store() {
     tail -n 80 "$INSTALL_LOG" >&2 || true
     exit 1
   fi
-  if ! run_install; then
+  if ! run_install_with_network_retry "fresh-store recovery install"; then
     if grep -q "ERR_PNPM_ENOENT" "$INSTALL_LOG"; then
       echo "⚠️ [install-desktop-deps] fresh-store recovery hit another ERR_PNPM_ENOENT; escalating to workspace-local pnpm store recovery" >&2
       recover_with_workspace_store "fresh-store ERR_PNPM_ENOENT persisted after desktop retry"
       return 0
     fi
+    if install_log_has_socket_timeout; then
+      echo "❌ [install-desktop-deps] fresh-store recovery exhausted transient npm registry retries; tail follows" >&2
+      tail -n 80 "$INSTALL_LOG" >&2 || true
+      exit 1
+    fi
     echo "❌ [install-desktop-deps] pnpm install failed after fresh-store recovery; tail follows" >&2
     tail -n 80 "$INSTALL_LOG" >&2 || true
     exit 1
@@ -206,10 +243,15 @@ recover_with_workspace_store() {
     tail -n 80 "$INSTALL_LOG" >&2 || true
     exit 1
   fi
-  if ! run_install; then
+  if ! run_install_with_network_retry "workspace-local recovery install"; then
     INSTALL_PACKAGE_IMPORT_METHOD="$previous_import_method"
     INSTALL_NODE_LINKER="$previous_node_linker"
     INSTALL_SHAMEFULLY_HOIST="$previous_shamefully_hoist"
+    if install_log_has_socket_timeout; then
+      echo "❌ [install-desktop-deps] workspace-local recovery exhausted transient npm registry retries; tail follows" >&2
+      tail -n 80 "$INSTALL_LOG" >&2 || true
+      exit 1
+    fi
     echo "❌ [install-desktop-deps] pnpm install failed after workspace-local recovery; tail follows" >&2
     tail -n 80 "$INSTALL_LOG" >&2 || true
     exit 1
@@ -238,18 +280,22 @@ reset_app_node_modules() {
   return 1
 }
 
-if ! run_install; then
+if ! run_install_with_network_retry "initial install"; then
   if grep -q "ERR_PNPM_ENOENT" "$INSTALL_LOG"; then
     recover_with_fresh_store "detected pnpm store ENOENT"
   elif grep -q "ERR_PNPM_ENOSPC" "$INSTALL_LOG" || grep -qi "no space left on device" "$INSTALL_LOG"; then
     recover_with_workspace_store "detected pnpm ENOSPC"
+  elif install_log_has_socket_timeout; then
+    echo "❌ [install-desktop-deps] pnpm install failed after transient npm registry retries; tail follows" >&2
+    tail -n 80 "$INSTALL_LOG" >&2 || true
+    exit 1
   elif grep -q "ERR_PNPM_ENOTDIR" "$INSTALL_LOG"; then
     echo "⚠️ [install-desktop-deps] detected app-local node_modules ENOTDIR; resetting desktop node_modules and retrying once" >&2
     if ! reset_app_node_modules; then
       tail -n 80 "$INSTALL_LOG" >&2 || true
       exit 1
     fi
-    if ! run_install; then
+    if ! run_install_with_network_retry "node_modules reset retry"; then
       echo "❌ [install-desktop-deps] pnpm install failed after node_modules reset; tail follows" >&2
       tail -n 80 "$INSTALL_LOG" >&2 || true
       exit 1