[rodboev]

Windows callers can cancel Git network operations without leaving HTTP helpers connected, fixing the cancellation failure in run 101.

Terminate descendants through Windows process APIs so taskkill's one-second timeout cannot fall back to killing only Git. Keep the existing cancellation and pipe-drain deadlines.

[roborev-ci]

roborev: Combined Review (a8cabeb)

Verdict: Changes require fixes for 2 findings.

High

• git/cmd/gitcmd_windows.go:44: The creation-time cutoff is recorded after the process snapshot. A snapshotted child can exit and its PID can be reused before the cutoff is recorded, allowing an unrelated replacement process to pass the timestamp checks and be terminated.

  Fix: Record the creation-time cutoff before creating the process snapshot, or independently verify the opened process's identity and parentage before terminating it.

Medium

• git/cmd/gitcmd_windows.go:72: If an intermediate helper exits after the snapshot and cannot be opened, the early return skips its entire captured subtree. Live grandchildren can survive cancellation, retaining connections or inherited pipes and continuing work.

  Fix: Continue traversing snapshotted descendants when an intermediate process has exited, while preserving identity checks before terminating each live process. Add a regression test for an intermediate helper exiting while its descendant remains alive.

---

Reviewers: 3x codex, codex (security), codex (test-value) | Synthesis: codex, 10s | Total: 6m6s

[roborev-ci]

roborev: Combined Review (ac7ef27)

Verdict: No findings at or above medium severity.

---

Reviewers: 3x codex, codex (security), codex (test-value) | Synthesis: codex | Total: 3m57s

[roborev-ci]

roborev: Combined Review (3db9811)

Verdict: No findings at or above medium severity.

---

Reviewers: 3x codex, codex (security), codex (test-value) | Synthesis: codex | Total: 3m6s