@adhdev/daemon-core 0.9.82-rc.31 → 0.9.82-rc.310

package/src/git/git-diff.ts

@@ -10,6 +10,20 @@ export interface GitDiffOptions {
   timeoutMs?: number;
   maxFiles?: number;
   maxBytes?: number;
+  /**
+   * When set, diff `<baseRef>...HEAD` (merge-base range — "what this branch
+   * adds on top of base") instead of the working tree. Staged/untracked
+   * sections do not apply in this mode.
+   */
+  baseRef?: string;
+}
+
+function validateBaseRef(ref: string): string {
+  const trimmed = ref.trim();
+  if (!trimmed || trimmed.startsWith('-') || trimmed.includes('..') || !/^[A-Za-z0-9][A-Za-z0-9._/@-]*$/.test(trimmed)) {
+    throw new GitCommandError('invalid_args', `Invalid base ref: ${ref}`);
+  }
+  return trimmed;
 }
 
 export interface GitFileDiffResult {
@@ -44,6 +58,30 @@ export async function getGitDiffSummary(
   try {
     const repo = await resolveGitRepository(workspace, options);
     const repoRoot = repo.repoRoot!;
+
+    if (options.baseRef) {
+      const range = `${validateBaseRef(options.baseRef)}...HEAD`;
+      const [nameStatus, numstat] = await Promise.all([
+        runGit(repo, ['diff', '--no-ext-diff', '--name-status', range, '--'], { ...options, cwd: repoRoot }),
+        runGit(repo, ['diff', '--no-ext-diff', '--numstat', range, '--'], { ...options, cwd: repoRoot }),
+      ]);
+      const outputBytes = byteLength(nameStatus.stdout + numstat.stdout);
+      const changes = combineDiffEntries(nameStatus.stdout, numstat.stdout, false);
+      const maxFiles = normalizePositiveInteger(options.maxFiles, DEFAULT_MAX_FILES);
+      const maxBytes = normalizePositiveInteger(options.maxBytes, DEFAULT_MAX_BYTES);
+      const files = changes.slice(0, maxFiles);
+      return {
+        workspace: repo.workspace,
+        repoRoot,
+        isGitRepo: true,
+        files,
+        totalInsertions: files.reduce((sum, file) => sum + file.insertions, 0),
+        totalDeletions: files.reduce((sum, file) => sum + file.deletions, 0),
+        truncated: changes.length > files.length || outputBytes > maxBytes,
+        lastCheckedAt,
+      };
+    }
+
     const [unstagedNameStatus, unstagedNumstat, stagedNameStatus, stagedNumstat, untracked] = await Promise.all([
       runGit(repo, ['diff', '--no-ext-diff', '--name-status'], { ...options, cwd: repoRoot }),
       runGit(repo, ['diff', '--no-ext-diff', '--numstat'], { ...options, cwd: repoRoot }),
@@ -106,6 +144,21 @@ export async function getGitFileDiff(
   const selected = await resolveRepoFilePath(repoRoot, filePath);
   const maxBytes = normalizePositiveInteger(options.maxBytes, DEFAULT_MAX_BYTES);
 
+  if (options.baseRef) {
+    const range = `${validateBaseRef(options.baseRef)}...HEAD`;
+    const result = await runGit(repo, ['diff', '--no-ext-diff', range, '--', selected.relativePath], { ...options, cwd: repoRoot });
+    const bounded = truncateText(result.stdout, maxBytes);
+    return {
+      workspace: repo.workspace,
+      repoRoot,
+      isGitRepo: true,
+      path: selected.relativePath,
+      diff: bounded.text,
+      truncated: bounded.truncated,
+      lastCheckedAt,
+    };
+  }
+
   const [unstaged, staged] = await Promise.all([
     runGit(repo, ['diff', '--no-ext-diff', '--', selected.relativePath], { ...options, cwd: repoRoot }),
     runGit(repo, ['diff', '--cached', '--no-ext-diff', '--', selected.relativePath], { ...options, cwd: repoRoot }),

package/src/git/git-executor.ts

@@ -10,6 +10,18 @@ const execFileAsync = promisify(execFile);
 const DEFAULT_TIMEOUT_MS = 5_000;
 const DEFAULT_MAX_BUFFER = 1024 * 1024;
 
+/**
+ * Timeout for status-collection git commands (status/log/submodule/stash/fetch).
+ * The default 5s is fine for porcelain status, but on Windows the `git` subprocess
+ * spawn itself is pathologically slow (measured: `submodule status` ~3.5s, cold
+ * `log -1` ~4.2s) and overlaps with refreshUpstream fetches — a single command
+ * routinely exceeds 5s, which previously collapsed the whole status to all-null and
+ * dropped the node from the mesh graph. Give the collection path a much larger
+ * budget so a slow-but-healthy repo never reads as "not a git repo". Windows gets a
+ * larger budget than POSIX because the spawn cost is OS-specific, not repo-specific.
+ */
+export const GIT_STATUS_TIMEOUT_MS = process.platform === 'win32' ? 30_000 : 20_000;
+
 export interface GitExecutorOptions {
   timeoutMs?: number;
   maxBuffer?: number;

package/src/git/git-status.ts

@@ -1,8 +1,31 @@
-import type { GitRepoStatus, GitSubmoduleStatus, GitUpstreamFreshness } from './git-types.js';
-import { GitCommandError, resolveGitRepository, runGit } from './git-executor.js';
+import type { DaemonBuildBehind, GitRepoStatus, GitSubmoduleStatus, GitUpstreamFreshness } from './git-types.js';
+import { GIT_STATUS_TIMEOUT_MS, GitCommandError, resolveGitRepository, runGit } from './git-executor.js';
+import { getDaemonBuildInfo, type DaemonBuildInfo } from '../build-info.js';
 
 type ResolvedGitRepo = { workspace: string; repoRoot: string | null; isGitRepo: boolean };
 
+/**
+ * Last successfully-collected status per workspace, used to survive a transient git
+ * failure (timeout, slow Windows spawn under load, a momentary lock) WITHOUT dropping
+ * the node out of the mesh graph. A genuine "not a git repository" answer is NOT a
+ * transient failure — it never populates this cache and always reports isGitRepo:false.
+ */
+const lastKnownGoodStatus = new Map<string, GitRepoStatus>();
+
+/** Test seam: clear the last-known-good status cache between cases. */
+export function __resetGitStatusCacheForTests(): void {
+  lastKnownGoodStatus.clear();
+}
+
+/**
+ * git failure reasons that are transient/environmental rather than a real statement
+ * that the workspace is not a repo. On these we prefer the last-known-good status so a
+ * single slow git call cannot make a healthy node vanish from the graph.
+ */
+function isTransientGitFailure(error: GitCommandError): boolean {
+  return error.reason === 'timeout' || error.reason === 'git_command_failed';
+}
+
 export interface GitStatusOptions {
   timeoutMs?: number;
   /** When true, include submodule status in the result. Defaults to true. */
@@ -14,6 +37,12 @@ export interface GitStatusOptions {
    * Callers should opt into this only for convergence-critical surfaces.
    */
   refreshUpstream?: boolean;
+  /**
+   * Test/override seam for the daemon build stamp used by the stale-build
+   * detector. Production callers omit this so the real baked-in build commit
+   * (getDaemonBuildInfo) is used.
+   */
+  daemonBuildInfo?: DaemonBuildInfo;
 }
 
 interface GitUpstreamProbe {
@@ -28,9 +57,50 @@ export async function getGitRepoStatus(
 ): Promise<GitRepoStatus> {
   const lastCheckedAt = Date.now();
   const includeSubmodules = options.includeSubmodules !== false;
+  // Status collection fans out into several git subprocesses (status, head, stash,
+  // submodule, optionally fetch). On Windows the per-spawn cost alone can exceed the
+  // 5s default, so unless the caller pinned a timeout, give the whole collection path
+  // the larger status budget. A caller that explicitly sets timeoutMs (e.g. a test
+  // injecting 1ms to exercise the transient-failure path) is respected.
+  const effectiveOptions: GitStatusOptions =
+    options.timeoutMs === undefined ? { ...options, timeoutMs: GIT_STATUS_TIMEOUT_MS } : options;
 
   try {
-    const repo = await resolveGitRepository(workspace, options);
+    const repo = await resolveGitRepository(workspace, effectiveOptions);
+    const status = await collectGitRepoStatus(repo, includeSubmodules, lastCheckedAt, effectiveOptions);
+    lastKnownGoodStatus.set(workspace, status);
+    return status;
+  } catch (error) {
+    const gitError = error instanceof GitCommandError
+      ? error
+      : new GitCommandError('git_command_failed', 'Failed to read Git status', { cause: error });
+
+    // A transient/environmental failure (timeout, slow-spawn-under-load) must NOT make
+    // a healthy node lose its repo identity and drop out of the mesh graph. Prefer the
+    // last status we successfully collected for this workspace, re-stamped as stale.
+    if (isTransientGitFailure(gitError)) {
+      const cached = lastKnownGoodStatus.get(workspace);
+      if (cached) {
+        return {
+          ...cached,
+          lastCheckedAt,
+          upstreamStatus: 'unavailable',
+          error: gitError.stderr || gitError.message,
+          reason: gitError.reason,
+        };
+      }
+    }
+
+    return emptyStatus(workspace, lastCheckedAt, gitError);
+  }
+}
+
+async function collectGitRepoStatus(
+  repo: ResolvedGitRepo,
+  includeSubmodules: boolean,
+  lastCheckedAt: number,
+  options: GitStatusOptions,
+): Promise<GitRepoStatus> {
     let parsed = await readPorcelainStatus(repo, options);
     let upstreamProbe: GitUpstreamProbe = getInitialUpstreamProbe(parsed);
 
@@ -48,6 +118,13 @@ export async function getGitRepoStatus(
     if (includeSubmodules) {
       submodules = await getSubmoduleStatuses(repo, options);
     }
+    const submoduleDirty = (submodules || []).some(submodule => submodule.dirty || submodule.outOfSync || !!submodule.error);
+    const dirty = parsed.staged + parsed.modified + parsed.untracked + parsed.deleted + parsed.renamed > 0
+      || parsed.conflictFiles.length > 0
+      || stashCount > 0
+      || submoduleDirty;
+
+    const daemonBuildBehind = await detectDaemonBuildBehind(repo, submodules, options);
 
     return {
       workspace: repo.workspace,
@@ -67,24 +144,203 @@ export async function getGitRepoStatus(
       untracked: parsed.untracked,
       deleted: parsed.deleted,
       renamed: parsed.renamed,
+      dirty,
       hasConflicts: parsed.conflictFiles.length > 0,
       conflictFiles: parsed.conflictFiles,
       stashCount,
       lastCheckedAt,
       submodules,
+      ...(daemonBuildBehind ? { daemonBuildBehind } : {}),
     };
-  } catch (error) {
-    if (error instanceof GitCommandError) {
-      return emptyStatus(workspace, lastCheckedAt, error);
+}
+
+/**
+ * Detect whether the running daemon's build commit is a STRICT ancestor of this
+ * workspace's HEAD (root) or any of its submodules' HEAD. This surfaces the
+ * "merged a fix to main but the live daemon still ships the old bundle" gap:
+ * once the fix is committed, the workspace HEAD advances past the daemon's
+ * baked-in build commit, but the daemon keeps the old behavior until it is
+ * rebuilt/redeployed and restarted.
+ *
+ * Conservative by construction — returns undefined unless ancestry is provable:
+ *   - build commit unknown → undefined
+ *   - build commit not an object in this repo/submodule (different repo) → skip
+ *   - build commit === HEAD (daemon is current) → undefined
+ *   - build commit NOT an ancestor of HEAD (daemon ahead / diverged) → undefined
+ * Any git error is swallowed (no warning) so a flaky probe never over-warns.
+ */
+/**
+ * Package names that, when changed, mean the daemon runtime is stale and must be
+ * rebuilt/redeployed + restarted. Everything NOT in this set (web-core,
+ * web-standalone, web-devconsole, terminal-render-web) is web-only — a daemon
+ * restart is not required for those, only a web redeploy. mcp-server runs in the
+ * same process surface as the daemon tooling, so it is classified as
+ * daemon-affecting (conservative). Unknown package → daemon-affecting.
+ */
+const DAEMON_RUNTIME_PACKAGES = new Set([
+  'daemon-core',
+  'daemon-standalone',
+  'session-host-core',
+  'session-host-daemon',
+  'terminal-mux-core',
+  'terminal-mux-control',
+  'terminal-mux-cli',
+  'ghostty-vt-node',
+  'mcp-server',
+]);
+
+const WEB_ONLY_PACKAGES = new Set([
+  'web-core',
+  'web-standalone',
+  'web-devconsole',
+  'terminal-render-web',
+]);
+
+/**
+ * Root-level (non-package) files that demonstrably cannot change what the daemon
+ * runtime executes: convergence/verify markers, documentation, and license/notice
+ * text. A root commit that moves the oss gitlink while the oss commit only touched
+ * one of these is NOT a reason to rebuild/restart the daemon — flagging it produces
+ * the staleDaemonBuild false-positive this guard exists to suppress.
+ *
+ * Deliberately conservative: anything NOT matched here (root config like
+ * package.json / tsconfig / build scripts, `.txt` fixtures, lockfiles, unknown
+ * dotfiles) stays daemon-affecting, because a false-negative — staying silent when
+ * the daemon really IS stale — is worse than an over-warn. Markers are the common
+ * real-world case (e.g. `.verify-patch-equiv-rc292`), so they are matched broadly;
+ * docs are matched by the `docs/` prefix or a markdown/text-doc extension at a
+ * filename we recognize as documentation (README/CHANGELOG/LICENSE/NOTICE).
+ */
+function isNonRuntimeRootFile(file: string): boolean {
+  const base = file.slice(file.lastIndexOf('/') + 1);
+  // Verify/convergence markers: dotfiles whose name signals a transient marker.
+  if (/^\.(?:verify|marker|converge|ff-verify|patch-equiv|live-verify)\b/i.test(base)) return true;
+  // Documentation living under a docs/ tree (any depth, root or nested).
+  if (/(?:^|\/)docs\//i.test(file)) return true;
+  // Recognized top-level documentation / license files.
+  if (/^(?:README|CHANGELOG|LICENSE|NOTICE|AUTHORS|CONTRIBUTING|CODEOWNERS)(?:\.[A-Za-z0-9]+)?$/i.test(base)) {
+    return true;
+  }
+  return false;
+}
+
+/**
+ * Determine whether the changes between buildCommit..HEAD touch any daemon-runtime
+ * package. Returns isDaemonAffecting:true conservatively when the changed-file set
+ * can't be obtained or any changed path is outside the known web-only package set
+ * AND is not a recognized non-runtime root file (marker/doc/license).
+ */
+async function classifyDaemonBuildChange(
+  repoPath: string,
+  buildCommit: string,
+  options: GitStatusOptions,
+): Promise<{ isDaemonAffecting: boolean; affectedPackages: string[] }> {
+  try {
+    const diff = await runGit(repoPath, ['diff', '--name-only', `${buildCommit}..HEAD`], options);
+    const files = diff.stdout
+      .split('\n')
+      .map((line) => line.trim())
+      .filter(Boolean);
+    if (files.length === 0) {
+      // No file diff (e.g. only merge metadata) — nothing actionable, but stay
+      // conservative and treat as daemon-affecting so we don't suppress a real warning.
+      return { isDaemonAffecting: true, affectedPackages: [] };
     }
-    return emptyStatus(
-      workspace,
-      lastCheckedAt,
-      new GitCommandError('git_command_failed', 'Failed to read Git status', { cause: error }),
-    );
+    const pkgs = new Set<string>();
+    // A non-package path that is NOT a recognized benign root file (marker/doc).
+    // Only these force daemon-affecting; benign markers/docs are ignored so a
+    // gitlink-moving root commit over a marker-only oss commit no longer over-warns.
+    let sawRuntimeAmbiguousNonPackage = false;
+    for (const file of files) {
+      const match = file.match(/(?:^|\/)packages\/([^/]+)\//);
+      if (!match) {
+        if (!isNonRuntimeRootFile(file)) sawRuntimeAmbiguousNonPackage = true;
+        continue;
+      }
+      pkgs.add(match[1]);
+    }
+    const affectedPackages = [...pkgs].sort();
+    // Daemon-affecting if: any runtime-ambiguous non-package file changed, any
+    // unknown package changed, or any explicit daemon-runtime package changed.
+    // The daemon is unaffected only when every changed file is either a known
+    // web-only package or a recognized benign root file (and at least one such
+    // file changed) — i.e. nothing runtime-ambiguous remains.
+    const allBenign =
+      !sawRuntimeAmbiguousNonPackage &&
+      affectedPackages.every((p) => WEB_ONLY_PACKAGES.has(p) && !DAEMON_RUNTIME_PACKAGES.has(p));
+    return { isDaemonAffecting: !allBenign, affectedPackages };
+  } catch {
+    // diff probe failed → can't prove web-only; stay conservative.
+    return { isDaemonAffecting: true, affectedPackages: [] };
   }
 }
 
+async function detectDaemonBuildBehind(
+  repo: ResolvedGitRepo,
+  submodules: GitSubmoduleStatus[] | undefined,
+  options: GitStatusOptions,
+): Promise<DaemonBuildBehind | undefined> {
+  const build = options.daemonBuildInfo ?? getDaemonBuildInfo();
+  if (!build.commit || build.commit === 'unknown') return undefined;
+
+  // Check the root repo first, then each submodule. The daemon build commit is
+  // baked from the daemon-core (oss submodule) HEAD, so on an adhdev
+  // superproject worktree the match is expected on the `oss` submodule, not the
+  // root — checking both keeps the helper repo-agnostic.
+  const scopes: Array<{ scope: string; repoPath: string }> = [
+    { scope: 'root', repoPath: repo.repoRoot || repo.workspace },
+  ];
+  for (const sub of submodules || []) {
+    if (sub.repoPath && !sub.error) scopes.push({ scope: sub.path, repoPath: sub.repoPath });
+  }
+
+  for (const { scope, repoPath } of scopes) {
+    try {
+      // Build commit must be a real object in THIS repo, else it's a different repo.
+      await runGit(repoPath, ['cat-file', '-e', `${build.commit}^{commit}`], options);
+      const headResult = await runGit(repoPath, ['rev-parse', 'HEAD'], options);
+      const head = headResult.stdout.trim();
+      if (!head || head === build.commit) continue;
+      // Strict ancestor: build commit is reachable from HEAD but is not HEAD.
+      await runGit(repoPath, ['merge-base', '--is-ancestor', build.commit, 'HEAD'], options);
+      // No throw → build commit IS an ancestor of HEAD → daemon is behind.
+      // Inspect WHICH packages changed in buildCommit..HEAD. A daemon rebuild/restart
+      // is only actually required when a daemon-runtime package changed; if only web /
+      // render packages changed, the daemon is unaffected and just the web deploy is
+      // pending. Conservative: any probe failure → treat as daemon-affecting.
+      const { isDaemonAffecting, affectedPackages } = await classifyDaemonBuildChange(
+        repoPath,
+        build.commit,
+        options,
+      );
+      const scopeLabel = scope === 'root' ? 'workspace' : scope;
+      const benignDetail = affectedPackages.length > 0
+        ? `only web packages changed (${affectedPackages.join(', ')})`
+        : 'only non-runtime files changed (markers/docs)';
+      const warning = isDaemonAffecting
+        ? `Live daemon was built from ${build.commitShort} which is behind ${scopeLabel} HEAD ${head.slice(0, 7)}. ` +
+          `Merged code is NOT live until the daemon is rebuilt/redeployed and restarted — a local dist rebuild alone does not update a cloud daemon.`
+        : `Live daemon was built from ${build.commitShort} which is behind ${scopeLabel} HEAD ${head.slice(0, 7)}, ` +
+          `but ${benignDetail}. ` +
+          `Daemon restart NOT required — redeploy the web app to reflect the change.`;
+      return {
+        buildCommit: build.commit,
+        buildCommitShort: build.commitShort,
+        head,
+        scope,
+        isDaemonAffecting,
+        ...(affectedPackages && affectedPackages.length > 0 ? { affectedPackages } : {}),
+        warning,
+      };
+    } catch {
+      // cat-file / merge-base non-zero exit (commit absent or not an ancestor)
+      // or any git error → not a provable staleness for this scope; try next.
+      continue;
+    }
+  }
+  return undefined;
+}
+
 interface ParsedPorcelainStatus {
   branch: string | null;
   upstream: string | null;
@@ -285,6 +541,7 @@ function emptyStatus(workspace: string, lastCheckedAt: number, error: GitCommand
     untracked: 0,
     deleted: 0,
     renamed: 0,
+    dirty: false,
     hasConflicts: false,
     conflictFiles: [],
     stashCount: 0,
@@ -303,13 +560,40 @@ async function getSubmoduleStatuses(
   if (!repo.repoRoot) return [];
 
   try {
-    const result = await runGit(repo, ['submodule', 'status', '--recursive'], options);
-    return parseSubmoduleStatusOutput(result.stdout, repo.repoRoot, options.submoduleIgnorePaths);
+    // No `--recursive`: this superproject's submodules (oss, adhdev-providers) are
+    // leaf repos with no nested submodules, so `--recursive` doubles the (already
+    // slow on Windows) submodule-status spawn time for zero additional rows. If a
+    // nested submodule is ever introduced, restore --recursive WITH its own longer
+    // per-command timeout rather than reverting this wholesale.
+    const result = await runGit(repo, ['submodule', 'status'], options);
+    const submodules = parseSubmoduleStatusOutput(result.stdout, repo.repoRoot, options.submoduleIgnorePaths);
+    await Promise.all(submodules.map(submodule => enrichSubmoduleWorktreeStatus(repo, submodule, options)));
+    return submodules;
   } catch {
     return [];
   }
 }
 
+async function enrichSubmoduleWorktreeStatus(
+  repo: ResolvedGitRepo,
+  submodule: GitSubmoduleStatus,
+  options: GitStatusOptions,
+): Promise<void> {
+  try {
+    const result = await runGit(repo, ['status', '--porcelain=v2', '--branch'], {
+      ...options,
+      cwd: submodule.repoPath,
+    });
+    const parsed = parsePorcelainV2Status(result.stdout);
+    const dirty = parsed.staged + parsed.modified + parsed.untracked + parsed.deleted + parsed.renamed > 0
+      || parsed.conflictFiles.length > 0;
+    submodule.dirty = submodule.dirty || dirty;
+  } catch (error) {
+    submodule.dirty = true;
+    submodule.error = formatGitError(error);
+  }
+}
+
 function parseSubmoduleStatusOutput(
   output: string,
   repoRoot: string,
@@ -321,9 +605,9 @@ function parseSubmoduleStatusOutput(
   for (const line of output.split('\n')) {
     if (!line.trim()) continue;
 
-    // Format: [+- ]<commit> <path> (<branch>)
-    // - = out of sync, + = dirty, ' ' = clean
-    const match = line.match(/^([\-+\s])([0-9a-f]{40})\s+(\S+)(?:\s+\(([^)]+)\))?/);
+    // Format: [+-U ]<commit> <path> (<branch>)
+    // - = not initialized, + = gitlink out of sync, U = conflict, ' ' = aligned.
+    const match = line.match(/^([\-+U\s])([0-9a-f]{40})\s+(\S+)(?:\s+\(([^)]+)\))?/);
     if (!match) continue;
 
     const prefix = match[1];
@@ -336,8 +620,8 @@ function parseSubmoduleStatusOutput(
       path,
       commit,
       repoPath: repoRoot + '/' + path,
-      dirty: prefix === '+',
-      outOfSync: prefix === '-',
+      dirty: prefix === 'U',
+      outOfSync: prefix === '-' || prefix === '+',
       lastCheckedAt: Date.now(),
     });
   }

package/src/git/git-types.ts

@@ -6,69 +6,21 @@
  * infer these values from agent transcripts in frontend code.
  */
 
-export type GitFailureReason =
-  | 'not_git_repo'
-  | 'git_not_installed'
-  | 'timeout'
-  | 'path_outside_repo'
-  | 'dirty_index_required'
-  | 'conflict'
-  | 'invalid_args'
-  | 'nothing_to_commit'
-  | 'git_command_failed';
+// Pure shape types now live in @adhdev/mesh-shared so the cloud (web-core) and
+// standalone (daemon-core) transports share ONE definition instead of hand-syncing
+// two. Re-exported here so existing `from './git-types'` / package imports keep
+// working unchanged. Daemon-specific types (GitSnapshot, GitCommandName, …) stay
+// local below and consume these re-exports.
+export type {
+  GitFailureReason,
+  GitRepoIdentity,
+  GitSubmoduleStatus,
+  GitUpstreamFreshness,
+  GitRepoStatus,
+  DaemonBuildBehind,
+} from '@adhdev/mesh-shared';
 
-export interface GitRepoIdentity {
-  workspace: string;
-  repoRoot: string | null;
-  isGitRepo: boolean;
-}
-
-export interface GitSubmoduleStatus {
-  /** Submodule path relative to repo root */
-  path: string;
-  /** Current commit SHA the submodule is at */
-  commit: string;
-  /** Path to the submodule repo (absolute) */
-  repoPath: string;
-  /** Whether the submodule has uncommitted changes */
-  dirty: boolean;
-  /** Whether the submodule commit differs from what the parent repo expects */
-  outOfSync: boolean;
-  /** Last checked timestamp */
-  lastCheckedAt: number;
-  /** Error message if submodule status could not be read */
-  error?: string;
-}
-
-export type GitUpstreamFreshness = 'fresh' | 'unchecked' | 'stale' | 'no_upstream' | 'unavailable';
-
-export interface GitRepoStatus extends GitRepoIdentity {
-  branch: string | null;
-  headCommit: string | null;
-  headMessage: string | null;
-  upstream: string | null;
-  /** Whether ahead/behind was verified against a freshly fetched upstream ref. */
-  upstreamStatus: GitUpstreamFreshness;
-  /** Timestamp for the fetch that refreshed upstream refs when upstreamStatus === 'fresh'. */
-  upstreamFetchedAt?: number;
-  /** Error from the last refresh attempt when upstreamStatus === 'stale'. */
-  upstreamFetchError?: string;
-  ahead: number;
-  behind: number;
-  staged: number;
-  modified: number;
-  untracked: number;
-  deleted: number;
-  renamed: number;
-  hasConflicts: boolean;
-  conflictFiles: string[];
-  stashCount: number;
-  lastCheckedAt: number;
-  /** Submodule statuses when auto-discover is enabled */
-  submodules?: GitSubmoduleStatus[];
-  error?: string;
-  reason?: GitFailureReason;
-}
+import type { GitRepoIdentity, GitRepoStatus, GitFailureReason, GitUpstreamFreshness } from '@adhdev/mesh-shared';
 
 export type GitFileChangeStatus =
   | 'added'

package/src/git/git-worktree.ts

@@ -116,8 +116,11 @@ export async function createWorktree(opts: WorktreeCreateOptions): Promise<Workt
         });
     } catch (error: any) {
         const stderr = typeof error.stderr === 'string' ? error.stderr : '';
-        // Clean error messages for common failures
         if (/already exists/i.test(stderr)) {
+            // Distinguish directory-collision (TOCTOU race) from branch-already-exists
+            if (existsSync(targetDir)) {
+                throw new Error(`Worktree target directory was created concurrently: ${targetDir}`);
+            }
             throw new Error(`Branch '${branch}' already exists or is checked out in another worktree`);
         }
         throw new Error(`git worktree add failed: ${stderr.trim() || error.message}`);
@@ -170,6 +173,10 @@ export async function removeWorktree(repoRoot: string, worktreePath: string, opt
         const stdout = typeof error.stdout === 'string' ? error.stdout : '';
         const detail = `${stderr}\n${stdout}\n${error.message || ''}`;
         if (opts.allowSubmoduleForceFallback && SUBMODULE_WORKTREE_REMOVE_RE.test(detail)) {
+            process.stderr.write(
+                `[adhdev-mesh] WARNING: git worktree remove --force fallback for submodule worktree '${worktreePath}'. `
+                + `Any uncommitted changes inside submodules will be lost.\n`,
+            );
             try {
                 await execFileAsync('git', ['worktree', 'remove', '--force', worktreePath], {
                     cwd: repoRoot,