@@ -69,99 +69,32 @@ jobs:
 
   update-aur:
     needs: release
-    if: always() && needs.release.result == 'success'
-    continue-on-error: true
     runs-on: ubuntu-latest
-    container:
-      image: archlinux
-      options: --privileged
-    permissions:
-      contents: write
 
     steps:
-      - name: Install dependencies
-        run: pacman -Sy --noconfirm git curl openssh
-
-      - uses: actions/checkout@v4
+      - name: Checkout AUR repo
+        uses: actions/checkout@v4
         with:
-          ref: main
-          fetch-depth: 0
+          repository: originsec/praxis-aur
+          token: ${{ secrets.AUR_REPO_TOKEN }}
 
-      - name: Update AUR files
+      - name: Update version
         run: |
           VERSION="${GITHUB_REF_NAME#v}"
           SHA256=$(curl -sL "https://github.com/originsec/praxis/archive/${GITHUB_REF_NAME}.tar.gz" | sha256sum | cut -d' ' -f1)
 
-          cd pkg/aur/praxis
           sed -i "s/^pkgver=.*/pkgver=${VERSION}/" PKGBUILD
           sed -i "0,/^    '[a-f0-9]\{64\}'/{s/^    '[a-f0-9]\{64\}'/    '${SHA256}'/}" PKGBUILD
+
           sed -i "s/pkgver = .*/pkgver = ${VERSION}/" .SRCINFO
           sed -i "s|source = praxis-.*\.tar\.gz::.*|source = praxis-${VERSION}.tar.gz::https://github.com/originsec/praxis/archive/v${VERSION}.tar.gz|" .SRCINFO
           sed -i "0,/sha256sums = [a-f0-9]\{64\}/{s/sha256sums = [a-f0-9]\{64\}/sha256sums = ${SHA256}/}" .SRCINFO
 
-      - name: Commit to praxis repo
-        run: |
-          VERSION="${GITHUB_REF_NAME#v}"
-          git config --global --add safe.directory "$PWD"
-          git config user.name "David Kaplan"
-          git config user.email "davkaplan@gmail.com"
-          git add pkg/aur/praxis/PKGBUILD pkg/aur/praxis/.SRCINFO
-          if git diff --cached --quiet; then
-            echo "No changes to commit"
-          else
-            git commit -m "Update AUR package to v${VERSION}"
-            git push
-          fi
-
-      - name: Configure SSH for AUR
-        env:
-          AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
-        run: |
-          mkdir -p /github/home/.ssh /root/.ssh
-          printf '%s\n' "${AUR_SSH_KEY}" > /github/home/.ssh/aur
-          chmod 600 /github/home/.ssh/aur
-          ssh-keyscan -t ed25519,rsa aur.archlinux.org > /github/home/.ssh/known_hosts 2>/dev/null
-          chmod 600 /github/home/.ssh/known_hosts
-          cat > /github/home/.ssh/config <<'EOF'
-          Host aur.archlinux.org
-            User aur
-            IdentityFile /github/home/.ssh/aur
-            IdentitiesOnly yes
-            StrictHostKeyChecking yes
-            UserKnownHostsFile /github/home/.ssh/known_hosts
-            GlobalKnownHostsFile /dev/null
-            ConnectTimeout 20
-            ServerAliveInterval 15
-            ServerAliveCountMax 3
-          EOF
-          chmod 600 /github/home/.ssh/config
-          cp /github/home/.ssh/known_hosts /root/.ssh/known_hosts
-          cp /github/home/.ssh/config /root/.ssh/config
-          chmod 600 /root/.ssh/known_hosts /root/.ssh/config
-
-      - name: Push to AUR
+      - name: Commit and push
         run: |
-          git config --global user.name "David Kaplan"
-          git config --global user.email "davkaplan@gmail.com"
-          git config --global --add safe.directory "$PWD"
-
-          export GIT_SSH_COMMAND="ssh -F /github/home/.ssh/config -vvv"
-
-          git clone ssh://aur@aur.archlinux.org/praxis.git /tmp/aur-push
-          cp pkg/aur/praxis/PKGBUILD pkg/aur/praxis/.SRCINFO /tmp/aur-push/
-          cp pkg/aur/praxis/*.service pkg/aur/praxis/*.conf /tmp/aur-push/
-          cp pkg/aur/praxis/*.env pkg/aur/praxis/*.install /tmp/aur-push/
-          cd /tmp/aur-push
-          git add -A
-          if git diff --cached --quiet; then
-            echo "AUR already up to date"
-            exit 0
-          fi
           VERSION="${GITHUB_REF_NAME#v}"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add PKGBUILD .SRCINFO
           git commit -m "Update to v${VERSION}"
-          for i in 1 2 3 4 5; do
-            git push && echo "Pushed to AUR" && exit 0
-            echo "AUR push failed, retry $i"
-            sleep $((i * 15))
-          done
-          exit 1
+          git push
@@ -88,4 +88,4 @@
 3. **Squash merge**: Squash-merge the PR into `main`.
 4. **GitHub release**: Create a GitHub release on `main` with an excellent changelog covering all notable changes, new features, fixes, and breaking changes.
 5. **Tag and push**: Create a version tag matching the version number set on the `prerelease` branch (e.g., `v0.10.0`), push the tag, and push the release.
-6. **AUR package**: Handled automatically. The release workflow computes the sha256 of the release tarball (which only exists after the tag is pushed), updates `pkg/aur/praxis/PKGBUILD` and `pkg/aur/praxis/.SRCINFO`, commits to `main`, and pushes to the AUR. Do **not** manually update `pkg/aur/praxis/` version or sha256 — the automation handles this. The "Update AUR Package" workflow can also be triggered manually to re-push the current repo state to AUR.
+6. **AUR package**: Handled automatically — a GitHub Action updates the `originsec/praxis-aur` repo on each release.
@@ -3,7 +3,7 @@ resolver = "3"
 members = ["cli", "common", "node", "semantic_parser", "service", "web"]
 
 [workspace.package]
-version = "0.9.15"
+version = "0.9.16"
 edition = "2024"
 license = "Apache-2.0"
 repository = "https://github.com/originsec/praxis"
 
@@ -7,7 +7,7 @@ local INTERCEPT_DOMAINS = { "api.anthropic.com", "a-api.anthropic.com" }
 local INTERCEPT_URL_PATTERN = "messages"
 
 local function verify_binary(path)
-  local result = praxis.command_run({ program = path, args = { "--version" } })
+  local result = praxis.command_run({ program = path, args = { "--version" }, timeout_secs = 10 })
   if result.success then
     local version = (result.stdout or ""):match("(%d[%d%.%-a-zA-Z]*)")
     return string.lower(result.stdout or ""):find("claude") ~= nil, version
@@ -171,6 +171,7 @@ local function run_create_session(ctx)
     process_path = ctx.process_path,
     working_dir = working_dir,
     yolo_mode = ctx.yolo_mode == true,
+    prompt_timeout_secs = ctx.prompt_timeout_secs,
     external_session_id = nil,
   }
 end
@@ -210,6 +211,7 @@ local function run_session_transact(state, prompt)
     program = state.process_path,
     args = args,
     cwd = state.working_dir,
+    timeout_secs = state.prompt_timeout_secs or 1800,
   }
 
   local result = praxis.command_run_handle(spec, state.handle)
 
@@ -43,6 +43,7 @@ local function verify_binary(path)
   local result = praxis.command_run({
     program = "powershell",
     args = { "-NoProfile", "-Command", "(Get-Item '" .. path .. "').VersionInfo.ProductVersion" },
+    timeout_secs = 10,
   })
   if result.success then
     local version = (result.stdout or ""):match("(%d[%d%.%-a-zA-Z]*)")
 
@@ -4,7 +4,7 @@ local AGENT_NAME = "Codex CLI"
 local AGENT_SHORT_NAME = "codex"
 
 local function verify_binary(path)
-  local result = praxis.command_run({ program = path, args = { "--version" } })
+  local result = praxis.command_run({ program = path, args = { "--version" }, timeout_secs = 10 })
   if result.success then
     local version = (result.stdout or ""):match("(%d[%d%.%-a-zA-Z]*)")
     return string.lower(result.stdout or ""):find("codex") ~= nil, version
@@ -200,6 +200,7 @@ local function run_create_session(ctx)
     process_path = ctx.process_path,
     working_dir = working_dir,
     yolo_mode = ctx.yolo_mode == true,
+    prompt_timeout_secs = ctx.prompt_timeout_secs,
     has_first_prompt = false,
   }
 end
@@ -266,6 +267,7 @@ local function run_session_transact(state, prompt)
     program = state.process_path,
     args = args,
     stdin = prompt,
+    timeout_secs = state.prompt_timeout_secs or 1800,
   }
   if type(wd) == "string" and wd ~= "" then
     spec.cwd = wd
 
@@ -11,7 +11,7 @@ local INTERCEPT_DOMAINS = {
 }
 
 local function verify_binary(path)
-  local result = praxis.command_run({ program = path, args = { "--version" } })
+  local result = praxis.command_run({ program = path, args = { "--version" }, timeout_secs = 10 })
   if result.success then
     local version = (result.stdout or ""):match("(%d[%d%.%-a-zA-Z]*)")
     return true, version
@@ -45,6 +45,7 @@ local function check_user_logged_in(cursor_agent_path, working_dir)
     program = cursor_agent_path,
     args = { "status" },
     cwd = working_dir,
+    timeout_secs = 10,
   })
   if result.success then
     return (result.stdout or ""):find("Logged in") ~= nil
@@ -230,6 +231,7 @@ local function run_create_session(ctx)
     process_path = pp,
     working_dir = working_dir,
     yolo_mode = ctx.yolo_mode == true,
+    prompt_timeout_secs = ctx.prompt_timeout_secs,
     chat_id = chat_id,
   }
 end
@@ -257,6 +259,7 @@ local function run_session_transact(state, prompt)
     program = state.process_path,
     args = args,
     stdin = prompt,
+    timeout_secs = state.prompt_timeout_secs or 1800,
   }
   if type(wd) == "string" and wd ~= "" then
     spec.cwd = wd
 
@@ -12,7 +12,7 @@ local INTERCEPT_DOMAINS = {
 local INTERCEPT_URL_PATTERN = nil
 
 local function verify_binary(path)
-  local result = praxis.command_run({ program = path, args = { "--version" } })
+  local result = praxis.command_run({ program = path, args = { "--version" }, timeout_secs = 10 })
   if result.success then
     local version = (result.stdout or ""):match("(%d[%d%.%-a-zA-Z]*)")
     return version ~= nil, version
@@ -133,6 +133,7 @@ local function run_create_session(ctx)
     process_path = ctx.process_path,
     working_dir = working_dir,
     yolo_mode = ctx.yolo_mode == true,
+    prompt_timeout_secs = ctx.prompt_timeout_secs,
     external_session_id = nil,
   }
 end
@@ -192,6 +193,7 @@ local function run_session_transact(state, prompt)
     program = state.process_path,
     args = args,
     cwd = state.working_dir,
+    timeout_secs = state.prompt_timeout_secs or 1800,
   }
 
   local result = praxis.command_run_handle(spec, state.handle)
 
@@ -13,7 +13,7 @@ local function is_session_file(name)
 end
 
 local function verify_binary(path)
-  local result = praxis.command_run({ program = path, args = { "--version" } })
+  local result = praxis.command_run({ program = path, args = { "--version" }, timeout_secs = 10 })
   if result.success then
     local version = (result.stdout or ""):match("(%d[%d%.%-a-zA-Z]*)")
     return true, version
@@ -271,6 +271,7 @@ local function run_create_session(ctx)
     process_path = ctx.process_path,
     working_dir = working_dir,
     yolo_mode = ctx.yolo_mode == true,
+    prompt_timeout_secs = ctx.prompt_timeout_secs,
     external_session_id = nil,
   }
 end
@@ -290,6 +291,7 @@ local function run_session_transact(state, prompt)
     args = args,
     cwd = state.working_dir,
     stdin = prompt,
+    timeout_secs = state.prompt_timeout_secs or 1800,
   }
 
   local result = praxis.command_run_handle(spec, state.handle)
@@ -316,6 +318,7 @@ local function run_session_close(state)
       program = state.process_path,
       args = { "--delete-session", state.external_session_id },
       cwd = state.working_dir,
+      timeout_secs = 10,
     }
     pcall(praxis.command_run, spec)
   end