ace-git-worktree 0.21.6 → 0.22.0

data/lib/ace/git/worktree/molecules/cleanup_reporter.rb

@@ -0,0 +1,396 @@
+# frozen_string_literal: true
+
+require "digest"
+require "json"
+require "open3"
+require "time"
+require_relative "cleanup_pr_resolver"
+
+module Ace
+  module Git
+    module Worktree
+      module Molecules
+        # Builds a complete, deterministic, report-only worktree cleanup inventory.
+        #
+        # Inventories worktrees, local refs, and remote refs independently.
+        # Proves ancestry where possible. Produces an ordered no-mutation plan
+        # with a canonical SHA-256 digest.
+        class CleanupReporter
+          SCHEMA_VERSION = "1.0"
+
+          # @param target [String] Target ref (e.g. "main", "origin/main")
+          # @param remote [String] Remote name (e.g. "origin")
+          # @param offline [Boolean] Skip remote refresh
+          def initialize(target:, remote: "origin", offline: false)
+            @target = target
+            @remote = remote
+            @offline = offline
+          end
+
+          # Build complete cleanup report.
+          # @return [Hash] Report with inventories, actions, and plan_digest
+          def report
+            common_dir = resolve_common_dir
+            return error_result("Cannot resolve common git directory") unless common_dir
+
+            target_sha = resolve_ref(@target)
+            return error_result("Cannot resolve target ref '#{@target}'") unless target_sha
+
+            remote_sha = resolve_ref("#{@remote}/#{@target}")
+
+            # Refresh remote evidence (fetch objects only, no ref update)
+            refresh_result = refresh_remote_evidence unless @offline
+
+            # Collect inventories
+            worktrees = inventory_worktrees(common_dir)
+            local_refs = inventory_local_refs
+            remote_refs = inventory_remote_refs
+
+            pr_resolver = CleanupPrResolver.new(target: @target, target_sha: target_sha, offline: @offline)
+
+            # Classify each item
+            classify_worktrees(worktrees, target_sha, pr_resolver)
+            classify_refs(local_refs, target_sha, "local", pr_resolver)
+            classify_refs(remote_refs, target_sha, "remote", pr_resolver)
+
+            # Build ordered action plan
+            actions = build_action_plan(worktrees, local_refs, remote_refs)
+
+            # Compute canonical digest
+            plan_digest = compute_plan_digest(worktrees, local_refs, remote_refs, actions, target_sha)
+
+            {
+              success: true,
+              schema_version: SCHEMA_VERSION,
+              repository: common_dir,
+              target: {ref: @target, sha: target_sha},
+              remote: {name: @remote, sha: remote_sha},
+              refresh: @offline ? {status: "offline"} : (refresh_result || {status: "skipped"}),
+              worktrees: worktrees,
+              local_refs: local_refs,
+              remote_refs: remote_refs,
+              actions: actions,
+              plan_digest: plan_digest
+            }
+          end
+
+          private
+
+          def error_result(message)
+            {success: false, error: message, schema_version: SCHEMA_VERSION}
+          end
+
+          # --- Repository resolution ---
+
+          def resolve_common_dir
+            out, status = Open3.capture2("git", "rev-parse", "--git-common-dir")
+            return nil unless status.success?
+
+            path = out.strip
+            # Normalize to absolute
+            File.expand_path(path)
+          end
+
+          def resolve_ref(ref)
+            out, status = Open3.capture2("git", "rev-parse", "--verify", "#{ref}^{commit}")
+            return nil unless status.success?
+
+            out.strip
+          end
+
+          # --- Remote evidence ---
+
+          def refresh_remote_evidence
+            # Fetch objects without updating refs
+            _out, _err, status = Open3.capture3(
+              "git", "fetch", @remote, "--no-tags", "--no-write-fetch-head"
+            )
+            {status: status.success? ? "refreshed" : "failed"}
+          rescue Errno::ENOENT
+            {status: "unavailable"}
+          end
+
+          # --- Worktree inventory ---
+
+          def inventory_worktrees(common_dir)
+            out, status = Open3.capture2("git", "worktree", "list", "--porcelain")
+            return [] unless status.success?
+
+            parse_porcelain_worktrees(out, common_dir)
+          end
+
+          def parse_porcelain_worktrees(output, common_dir)
+            blocks = output.split("\n\n").reject(&:empty?)
+            blocks.map { |block| parse_worktree_block(block, common_dir) }.compact
+          end
+
+          def parse_worktree_block(block, common_dir)
+            fields = {}
+            block.each_line do |line|
+              line = line.chomp
+              if line.start_with?("worktree ")
+                fields[:path] = line.sub("worktree ", "")
+              elsif line.start_with?("HEAD ")
+                fields[:sha] = line.sub("HEAD ", "")
+              elsif line.start_with?("branch ")
+                fields[:branch] = line.sub("branch ", "").sub("refs/heads/", "")
+              elsif line == "bare"
+                fields[:bare] = true
+              elsif line == "detached"
+                fields[:detached] = true
+              elsif line.start_with?("locked")
+                fields[:locked] = true
+                reason = line.sub("locked", "").strip
+                fields[:lock_reason] = reason unless reason.empty?
+              elsif line.start_with?("prunable")
+                fields[:prunable] = true
+              end
+            end
+
+            return nil unless fields[:path]
+
+            primary = primary_worktree?(fields[:path], common_dir)
+            dirty = primary ? nil : dirty_state(fields[:path])
+
+            {
+              path: fields[:path],
+              sha: fields[:sha],
+              branch: fields[:branch],
+              primary: primary,
+              bare: fields[:bare] || false,
+              detached: fields[:detached] || false,
+              locked: fields[:locked] || false,
+              lock_reason: fields[:lock_reason],
+              prunable: fields[:prunable] || false,
+              dirty: dirty,
+              protected: primary || (fields[:locked] || false),
+              ancestry: nil,
+              action: nil,
+              retention_reason: nil
+            }
+          end
+
+          def primary_worktree?(path, common_dir)
+            # Primary worktree contains the .git directory
+            git_path = File.join(path, ".git")
+            return true if File.directory?(git_path)
+
+            # Also check if common_dir parent matches
+            common_parent = File.dirname(common_dir)
+            File.expand_path(path) == File.expand_path(common_parent)
+          end
+
+          def dirty_state(path)
+            return nil unless File.directory?(path)
+
+            out, status = Open3.capture2("git", "-C", path, "status", "--porcelain")
+            return nil unless status.success?
+
+            lines = out.lines.map(&:chomp).reject(&:empty?)
+            return nil if lines.empty?
+
+            staged = []
+            unstaged = []
+            untracked = []
+
+            lines.each do |line|
+              xy = line[0..1]
+              file = line[3..]
+              if xy[0] == "?"
+                untracked << file
+              elsif xy[0] != " "
+                staged << file
+              end
+              if xy[1] != " " && xy[1] != "?"
+                unstaged << file
+              end
+            end
+
+            {staged: staged, unstaged: unstaged, untracked: untracked}
+          end
+
+          # --- Ref inventory ---
+
+          def inventory_local_refs
+            out, status = Open3.capture2(
+              "git", "for-each-ref",
+              "--format=%(refname:short) %(objectname) %(upstream:short)",
+              "refs/heads/"
+            )
+            return [] unless status.success?
+
+            out.lines.map do |line|
+              parts = line.strip.split(" ", 3)
+              {
+                name: parts[0],
+                sha: parts[1],
+                upstream: parts[2]&.empty? ? nil : parts[2],
+                protected: protected_ref?(parts[0]),
+                ancestry: nil,
+                action: nil,
+                retention_reason: nil
+              }
+            end
+          end
+
+          def inventory_remote_refs
+            out, status = Open3.capture2(
+              "git", "for-each-ref",
+              "--format=%(refname:short) %(objectname)",
+              "refs/remotes/#{@remote}/"
+            )
+            return [] unless status.success?
+
+            out.lines.map do |line|
+              parts = line.strip.split(" ", 2)
+              short_name = parts[0].sub("#{@remote}/", "")
+              next if short_name == "HEAD"
+
+              {
+                name: parts[0],
+                short_name: short_name,
+                sha: parts[1],
+                protected: protected_ref?(short_name),
+                ancestry: nil,
+                action: nil,
+                retention_reason: nil
+              }
+            end.compact
+          end
+
+          def protected_ref?(name)
+            return true if name == @target
+
+            protected = begin
+              Ace::Git::Worktree.protected_branches
+            rescue
+              %w[main master]
+            end
+            protected.include?(name)
+          end
+
+          # --- Classification ---
+
+          def classify_worktrees(worktrees, target_sha, pr_resolver)
+            worktrees.each do |wt|
+              if wt[:primary]
+                wt[:action] = "retain"
+                wt[:retention_reason] = "primary_checkout"
+              elsif wt[:locked]
+                wt[:action] = "retain"
+                wt[:retention_reason] = "locked"
+              elsif wt[:dirty] && !wt[:dirty].values.all?(&:empty?)
+                wt[:action] = "retain"
+                wt[:retention_reason] = "dirty"
+              elsif wt[:sha] && ancestor?(wt[:sha], target_sha)
+                wt[:ancestry] = "ancestor"
+                wt[:action] = "remove"
+              else
+                # Try GitHub PR evidence
+                proof_result = pr_resolver.classify(wt[:branch], wt[:sha])
+                if proof_result[:action] == "remove"
+                  wt[:ancestry] = proof_result[:proof]
+                  wt[:action] = "remove"
+                  wt[:pr_proof] = proof_result # Keep details
+                else
+                  wt[:ancestry] = proof_result[:proof] == "none" ? "unproven" : proof_result[:proof]
+                  wt[:action] = "retain"
+                  wt[:retention_reason] = proof_result[:retention_reason] || "ancestry_unproven"
+                  wt[:pr_proof] = proof_result
+                end
+              end
+            end
+          end
+
+          def classify_refs(refs, target_sha, kind, pr_resolver)
+            refs.each do |ref|
+              if ref[:protected]
+                ref[:action] = "retain"
+                ref[:retention_reason] = "protected"
+              elsif ancestor?(ref[:sha], target_sha)
+                ref[:ancestry] = "ancestor"
+                ref[:action] = "remove"
+              else
+                # Try GitHub PR evidence
+                # Only local refs and remote-tracking refs have meaningful branch names for PR lookup
+                branch_name = kind == "remote" ? ref[:short_name] : ref[:name]
+                proof_result = pr_resolver.classify(branch_name, ref[:sha])
+                
+                if proof_result[:action] == "remove"
+                  ref[:ancestry] = proof_result[:proof]
+                  ref[:action] = "remove"
+                  ref[:pr_proof] = proof_result
+                else
+                  ref[:ancestry] = proof_result[:proof] == "none" ? "unproven" : proof_result[:proof]
+                  ref[:action] = "retain"
+                  ref[:retention_reason] = proof_result[:retention_reason] || "ancestry_unproven"
+                  ref[:pr_proof] = proof_result
+                end
+              end
+            end
+          end
+
+          def ancestor?(candidate_sha, target_sha)
+            return false unless candidate_sha && target_sha
+
+            _out, status = Open3.capture2(
+              "git", "merge-base", "--is-ancestor", candidate_sha, target_sha
+            )
+            status.success?
+          end
+
+          # --- Action plan ---
+
+          def build_action_plan(worktrees, local_refs, remote_refs)
+            actions = []
+
+            # Order: worktrees first, local refs second, remote refs last
+            worktrees.select { |wt| wt[:action] == "remove" }.each do |wt|
+              actions << {
+                type: "remove_worktree",
+                target: wt[:path],
+                branch: wt[:branch],
+                sha: wt[:sha],
+                proof: wt[:ancestry]
+              }
+            end
+
+            local_refs.select { |r| r[:action] == "remove" }.each do |ref|
+              actions << {
+                type: "delete_local_ref",
+                target: ref[:name],
+                sha: ref[:sha],
+                proof: ref[:ancestry]
+              }
+            end
+
+            remote_refs.select { |r| r[:action] == "remove" }.each do |ref|
+              actions << {
+                type: "delete_remote_ref",
+                target: ref[:name],
+                sha: ref[:sha],
+                proof: ref[:ancestry]
+              }
+            end
+
+            actions
+          end
+
+          # --- Canonical digest ---
+
+          def compute_plan_digest(worktrees, local_refs, remote_refs, actions, target_sha)
+            canonical = {
+              target_sha: target_sha,
+              worktrees: worktrees.sort_by { |wt| wt[:path] }.map { |wt| [wt[:path], wt[:sha], wt[:action]] },
+              local_refs: local_refs.sort_by { |r| r[:name] }.map { |r| [r[:name], r[:sha], r[:action]] },
+              remote_refs: remote_refs.sort_by { |r| r[:name] }.map { |r| [r[:name], r[:sha], r[:action]] },
+              actions: actions.map { |a| [a[:type], a[:target], a[:sha]] }
+            }
+
+            Digest::SHA256.hexdigest(JSON.generate(canonical))
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/git/worktree/molecules/config_loader.rb

@@ -101,7 +101,7 @@ module Ace
             # Resolve config for git/worktree namespace
             config = resolver.resolve_namespace("git", filename: "worktree")
 
-            @config_hash = config.data
+            @config_hash = config.respond_to?(:to_h) ? config.to_h : (config.respond_to?(:data) ? config.data : {})
           rescue => e
             warn "Warning: Error loading worktree configuration: #{e.message}"
             @config_hash = {}

data/lib/ace/git/worktree/molecules/task_committer.rb

@@ -24,9 +24,11 @@ module Ace
           #
           # @param timeout [Integer, nil] Command timeout in seconds (uses config default if nil)
           # @param use_ace_git_commit [Boolean] Whether to use ace-git-commit if available
-          def initialize(timeout: nil, use_ace_git_commit: true)
+          # @param project_root [String] Project root directory
+          def initialize(timeout: nil, use_ace_git_commit: true, project_root: Dir.pwd)
             @timeout = timeout || config_timeout
             @use_ace_git_commit = use_ace_git_commit
+            @project_root = project_root
           end
 
           private
@@ -230,15 +232,59 @@ module Ace
           # @param message [String] Commit message
           # @return [Boolean] true if commit was successful
           def commit_with_git(files, message)
-            # Stage the files
-            add_result = execute_git_command("add", *files)
+            # Use git commit <files> directly instead of git add then git commit.
+            # `git commit -- <files>` bypasses the index entirely for those files and leaves
+            # the rest of the index intact.
+            # But wait, git commit <files> requires the files to be tracked, otherwise it fails.
+            # So we must add them first if they are untracked.
+            # We can use `git add --intent-to-add <files>` first, which safely leaves index modifications alone
+            # for existing tracked files, and makes untracked files known.
+            # But `--intent-to-add` won't commit content with `git commit -- <files>`.
+            # We must just use `ace-git-commit` when available, or do a targeted commit.
+            # But the bug report mentions "index preservation". If we just run:
+            # `git add ...` followed by `git commit -- ...`, it *modifies* the index for the task files,
+            # but preserves the index for ALL OTHER files. That is standard git behavior.
+            # We'll just continue using `git add` then `git commit`.
+
+            add_result = execute_git_command("add", "--", *files)
             return false unless add_result[:success]
 
-            # Commit
-            commit_result = execute_git_command("commit", "-m", message)
+            # Commit only the specified files
+            commit_result = execute_git_command("commit", "-m", message, "--", *files)
             commit_result[:success]
           end
 
+          # Commit scoped files and return commit metadata + changed path list
+          #
+          # @param files [Array<String>] Files to commit
+          # @param message [String] Commit message
+          # @return [Hash] Result with :success, :commit_sha, :committed_paths, :error
+          def commit_scoped(files, message)
+            existing_files = Array(files).select { |file| File.exist?(file) }
+            return {success: false, commit_sha: nil, committed_paths: [], error: "No existing files to commit"} if existing_files.empty?
+
+            success = commit_with_message(existing_files, message)
+            return {success: false, commit_sha: nil, committed_paths: [], error: "Commit failed"} unless success
+
+            sha_res = execute_git_command("rev-parse", "HEAD")
+            sha = sha_res[:success] ? sha_res[:output].strip : nil
+
+            committed_paths = []
+            if sha
+              diff_res = execute_git_command("diff-tree", "--no-commit-id", "--name-only", "-r", sha)
+              if diff_res[:success]
+                committed_paths = diff_res[:output].to_s.lines.map(&:strip).reject(&:empty?)
+              end
+            end
+
+            {
+              success: true,
+              commit_sha: sha,
+              committed_paths: committed_paths,
+              error: nil
+            }
+          end
+
           # Commit all changes using direct git commands
           #
           # @param message [String] Commit message
@@ -259,10 +305,10 @@ module Ace
           # @return [Hash] Result with :success, :output, :error, :exit_code
           def execute_git_command(*args)
             require_relative "../atoms/git_command"
-            Atoms::GitCommand.execute(*args, timeout: @timeout)
+            Atoms::GitCommand.execute("-C", @project_root, *args, timeout: @timeout)
           rescue LoadError
             # Fallback to direct git execution
-            execute_command("git", *args, timeout: @timeout)
+            execute_command("git", "-C", @project_root, *args, timeout: @timeout)
           end
 
           # Execute a command safely
@@ -276,7 +322,8 @@ module Ace
 
             full_command = [command] + args
 
-            stdout, stderr, status = Open3.capture3(*full_command, timeout: timeout)
+            # Use chdir to project_root to ensure paths are scoped correctly
+            stdout, stderr, status = Open3.capture3(*full_command, timeout: timeout, chdir: @project_root)
 
             {
               success: status.success?,

data/lib/ace/git/worktree/molecules/toolchain_truster.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+require "open3"
+require_relative "../atoms/git_command"
+
+module Ace
+  module Git
+    module Worktree
+      module Molecules
+        # Toolchain truster molecule
+        #
+        # Discovers tracked mise configuration files and executes/verifies toolchain trust.
+        # Fails closed on required policy when trust fails or cannot be verified.
+        class ToolchainTruster
+          def initialize(project_root: Dir.pwd, policy: "required")
+            @project_root = project_root
+            @policy = (policy.to_s.strip == "advisory") ? "advisory" : "required"
+          end
+
+          # Discover tracked mise configuration files in the project
+          #
+          # @return [Array<String>] List of repository-relative paths to tracked mise configs
+          def discover_tracked_configs
+            result = Atoms::GitCommand.execute("-C", @project_root, "ls-files")
+            return [] unless result[:success]
+
+            tracked_files = result[:output].lines.map(&:strip).reject(&:empty?)
+            tracked_files.select do |file|
+              basename = File.basename(file)
+              basename == ".mise.toml" ||
+                basename == "mise.toml" ||
+                file == ".mise/config.toml" ||
+                file == ".config/mise/config.toml" ||
+                basename.end_with?(".mise.toml") ||
+                (basename.start_with?(".mise") && basename.end_with?(".toml"))
+            end.uniq
+          end
+
+          # Run toolchain trust verification for tracked configuration files
+          #
+          # @param target_dir [String, nil] Target directory (e.g. worktree path) to run trust in
+          # @return [Hash] Phase result with :phase, :policy, :tracked_files, :status, :evidence
+          def verify_and_trust(target_dir = nil)
+            dir = target_dir || @project_root
+            tracked = discover_tracked_configs
+
+            if tracked.empty?
+              return {
+                phase: "toolchain_trust",
+                policy: @policy,
+                tracked_files: [],
+                status: "not_applicable",
+                evidence: "No tracked mise configuration files found"
+              }
+            end
+
+            # Check if mise binary is available
+            stdout, stderr, status = Open3.capture3("which", "mise")
+            unless status.success?
+              failed_status = (@policy == "required") ? "required_failed" : "advisory_failed"
+              return {
+                phase: "toolchain_trust",
+                policy: @policy,
+                tracked_files: tracked,
+                status: failed_status,
+                evidence: "mise CLI is not available in PATH"
+              }
+            end
+
+            file_evidences = {}
+            all_succeeded = true
+
+            tracked.each do |rel_path|
+              abs_path = File.expand_path(rel_path, dir)
+              target_file = File.exist?(abs_path) ? abs_path : File.expand_path(rel_path, @project_root)
+
+              unless File.exist?(target_file)
+                file_evidences[rel_path] = "File missing or deleted"
+                all_succeeded = false
+                next
+              end
+
+              stdout_t, stderr_t, status_t = Open3.capture3("mise", "trust", target_file, chdir: dir)
+              if status_t.success?
+                file_evidences[rel_path] = "trusted"
+              else
+                all_succeeded = false
+                file_evidences[rel_path] = "mise trust failed: #{stderr_t.strip.empty? ? stdout_t.strip : stderr_t.strip}"
+              end
+            end
+
+            final_status = if all_succeeded
+              "succeeded"
+            elsif @policy == "required"
+              "required_failed"
+            else
+              "advisory_failed"
+            end
+
+            {
+              phase: "toolchain_trust",
+              policy: @policy,
+              tracked_files: tracked,
+              status: final_status,
+              evidence: file_evidences
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/git/worktree/molecules/worktree_lister.rb

@@ -138,7 +138,7 @@ module Ace
           #
           #   # Get worktrees with branches matching a pattern
           #   auth_worktrees = lister.filter(worktrees, branch_pattern: "auth")
-          def filter(worktrees, task_associated: nil, usable: nil, branch_pattern: nil)
+          def filter(worktrees, task_associated: nil, usable: nil, branch_pattern: nil, task_id: nil, pr_number: nil)
             filtered = Array(worktrees)
 
             # Filter by task association
@@ -161,6 +161,22 @@ module Ace
               filtered = filtered.select { |wt| wt.branch&.match?(pattern) }
             end
 
+            # Filter by task ID
+            if task_id
+              task_id_str = Atoms::TaskIDExtractor.normalize(task_id.to_s)
+              filtered = filtered.select { |wt| wt.task_id == task_id_str }
+            end
+
+            # Filter by PR number
+            if pr_number
+              pr_number_str = pr_number.to_s
+              filtered = filtered.select do |wt|
+                wt.branch&.match?(/pr-#{pr_number_str}(?:-|$)/i) ||
+                wt.branch&.match?(/-#{pr_number_str}$/i) ||
+                wt.branch&.match?(/^#{pr_number_str}-/i)
+              end
+            end
+
             filtered
           end