@adhdev/daemon-core 0.9.82-rc.32 → 0.9.82-rc.320

package/src/git/git-status.ts

@@ -1,8 +1,31 @@
-import type { GitRepoStatus, GitSubmoduleStatus, GitUpstreamFreshness } from './git-types.js';
-import { GitCommandError, resolveGitRepository, runGit } from './git-executor.js';
+import type { DaemonBuildBehind, GitRepoStatus, GitSubmoduleStatus, GitUpstreamFreshness } from './git-types.js';
+import { GIT_STATUS_TIMEOUT_MS, GitCommandError, resolveGitRepository, runGit } from './git-executor.js';
+import { getDaemonBuildInfo, type DaemonBuildInfo } from '../build-info.js';
 
 type ResolvedGitRepo = { workspace: string; repoRoot: string | null; isGitRepo: boolean };
 
+/**
+ * Last successfully-collected status per workspace, used to survive a transient git
+ * failure (timeout, slow Windows spawn under load, a momentary lock) WITHOUT dropping
+ * the node out of the mesh graph. A genuine "not a git repository" answer is NOT a
+ * transient failure — it never populates this cache and always reports isGitRepo:false.
+ */
+const lastKnownGoodStatus = new Map<string, GitRepoStatus>();
+
+/** Test seam: clear the last-known-good status cache between cases. */
+export function __resetGitStatusCacheForTests(): void {
+  lastKnownGoodStatus.clear();
+}
+
+/**
+ * git failure reasons that are transient/environmental rather than a real statement
+ * that the workspace is not a repo. On these we prefer the last-known-good status so a
+ * single slow git call cannot make a healthy node vanish from the graph.
+ */
+function isTransientGitFailure(error: GitCommandError): boolean {
+  return error.reason === 'timeout' || error.reason === 'git_command_failed';
+}
+
 export interface GitStatusOptions {
   timeoutMs?: number;
   /** When true, include submodule status in the result. Defaults to true. */
@@ -14,6 +37,12 @@ export interface GitStatusOptions {
    * Callers should opt into this only for convergence-critical surfaces.
    */
   refreshUpstream?: boolean;
+  /**
+   * Test/override seam for the daemon build stamp used by the stale-build
+   * detector. Production callers omit this so the real baked-in build commit
+   * (getDaemonBuildInfo) is used.
+   */
+  daemonBuildInfo?: DaemonBuildInfo;
 }
 
 interface GitUpstreamProbe {
@@ -28,9 +57,50 @@ export async function getGitRepoStatus(
 ): Promise<GitRepoStatus> {
   const lastCheckedAt = Date.now();
   const includeSubmodules = options.includeSubmodules !== false;
+  // Status collection fans out into several git subprocesses (status, head, stash,
+  // submodule, optionally fetch). On Windows the per-spawn cost alone can exceed the
+  // 5s default, so unless the caller pinned a timeout, give the whole collection path
+  // the larger status budget. A caller that explicitly sets timeoutMs (e.g. a test
+  // injecting 1ms to exercise the transient-failure path) is respected.
+  const effectiveOptions: GitStatusOptions =
+    options.timeoutMs === undefined ? { ...options, timeoutMs: GIT_STATUS_TIMEOUT_MS } : options;
 
   try {
-    const repo = await resolveGitRepository(workspace, options);
+    const repo = await resolveGitRepository(workspace, effectiveOptions);
+    const status = await collectGitRepoStatus(repo, includeSubmodules, lastCheckedAt, effectiveOptions);
+    lastKnownGoodStatus.set(workspace, status);
+    return status;
+  } catch (error) {
+    const gitError = error instanceof GitCommandError
+      ? error
+      : new GitCommandError('git_command_failed', 'Failed to read Git status', { cause: error });
+
+    // A transient/environmental failure (timeout, slow-spawn-under-load) must NOT make
+    // a healthy node lose its repo identity and drop out of the mesh graph. Prefer the
+    // last status we successfully collected for this workspace, re-stamped as stale.
+    if (isTransientGitFailure(gitError)) {
+      const cached = lastKnownGoodStatus.get(workspace);
+      if (cached) {
+        return {
+          ...cached,
+          lastCheckedAt,
+          upstreamStatus: 'unavailable',
+          error: gitError.stderr || gitError.message,
+          reason: gitError.reason,
+        };
+      }
+    }
+
+    return emptyStatus(workspace, lastCheckedAt, gitError);
+  }
+}
+
+async function collectGitRepoStatus(
+  repo: ResolvedGitRepo,
+  includeSubmodules: boolean,
+  lastCheckedAt: number,
+  options: GitStatusOptions,
+): Promise<GitRepoStatus> {
     let parsed = await readPorcelainStatus(repo, options);
     let upstreamProbe: GitUpstreamProbe = getInitialUpstreamProbe(parsed);
 
@@ -48,6 +118,13 @@ export async function getGitRepoStatus(
     if (includeSubmodules) {
       submodules = await getSubmoduleStatuses(repo, options);
     }
+    const submoduleDirty = (submodules || []).some(submodule => submodule.dirty || submodule.outOfSync || !!submodule.error);
+    const dirty = parsed.staged + parsed.modified + parsed.untracked + parsed.deleted + parsed.renamed > 0
+      || parsed.conflictFiles.length > 0
+      || stashCount > 0
+      || submoduleDirty;
+
+    const daemonBuildBehind = await detectDaemonBuildBehind(repo, submodules, options);
 
     return {
       workspace: repo.workspace,
@@ -67,22 +144,201 @@ export async function getGitRepoStatus(
       untracked: parsed.untracked,
       deleted: parsed.deleted,
       renamed: parsed.renamed,
+      dirty,
       hasConflicts: parsed.conflictFiles.length > 0,
       conflictFiles: parsed.conflictFiles,
       stashCount,
       lastCheckedAt,
       submodules,
+      ...(daemonBuildBehind ? { daemonBuildBehind } : {}),
     };
-  } catch (error) {
-    if (error instanceof GitCommandError) {
-      return emptyStatus(workspace, lastCheckedAt, error);
+}
+
+/**
+ * Detect whether the running daemon's build commit is a STRICT ancestor of this
+ * workspace's HEAD (root) or any of its submodules' HEAD. This surfaces the
+ * "merged a fix to main but the live daemon still ships the old bundle" gap:
+ * once the fix is committed, the workspace HEAD advances past the daemon's
+ * baked-in build commit, but the daemon keeps the old behavior until it is
+ * rebuilt/redeployed and restarted.
+ *
+ * Conservative by construction — returns undefined unless ancestry is provable:
+ *   - build commit unknown → undefined
+ *   - build commit not an object in this repo/submodule (different repo) → skip
+ *   - build commit === HEAD (daemon is current) → undefined
+ *   - build commit NOT an ancestor of HEAD (daemon ahead / diverged) → undefined
+ * Any git error is swallowed (no warning) so a flaky probe never over-warns.
+ */
+/**
+ * Package names that, when changed, mean the daemon runtime is stale and must be
+ * rebuilt/redeployed + restarted. Everything NOT in this set (web-core,
+ * web-standalone, web-devconsole, terminal-render-web) is web-only — a daemon
+ * restart is not required for those, only a web redeploy. mcp-server runs in the
+ * same process surface as the daemon tooling, so it is classified as
+ * daemon-affecting (conservative). Unknown package → daemon-affecting.
+ */
+const DAEMON_RUNTIME_PACKAGES = new Set([
+  'daemon-core',
+  'daemon-standalone',
+  'session-host-core',
+  'session-host-daemon',
+  'terminal-mux-core',
+  'terminal-mux-control',
+  'terminal-mux-cli',
+  'ghostty-vt-node',
+  'mcp-server',
+]);
+
+const WEB_ONLY_PACKAGES = new Set([
+  'web-core',
+  'web-standalone',
+  'web-devconsole',
+  'terminal-render-web',
+]);
+
+/**
+ * Root-level (non-package) files that demonstrably cannot change what the daemon
+ * runtime executes: convergence/verify markers, documentation, and license/notice
+ * text. A root commit that moves the oss gitlink while the oss commit only touched
+ * one of these is NOT a reason to rebuild/restart the daemon — flagging it produces
+ * the staleDaemonBuild false-positive this guard exists to suppress.
+ *
+ * Deliberately conservative: anything NOT matched here (root config like
+ * package.json / tsconfig / build scripts, `.txt` fixtures, lockfiles, unknown
+ * dotfiles) stays daemon-affecting, because a false-negative — staying silent when
+ * the daemon really IS stale — is worse than an over-warn. Markers are the common
+ * real-world case (e.g. `.verify-patch-equiv-rc292`), so they are matched broadly;
+ * docs are matched by the `docs/` prefix or a markdown/text-doc extension at a
+ * filename we recognize as documentation (README/CHANGELOG/LICENSE/NOTICE).
+ */
+function isNonRuntimeRootFile(file: string): boolean {
+  const base = file.slice(file.lastIndexOf('/') + 1);
+  // Verify/convergence markers: dotfiles whose name signals a transient marker.
+  if (/^\.(?:verify|marker|converge|ff-verify|patch-equiv|live-verify)\b/i.test(base)) return true;
+  // Documentation living under a docs/ tree (any depth, root or nested).
+  if (/(?:^|\/)docs\//i.test(file)) return true;
+  // Recognized top-level documentation / license files.
+  if (/^(?:README|CHANGELOG|LICENSE|NOTICE|AUTHORS|CONTRIBUTING|CODEOWNERS)(?:\.[A-Za-z0-9]+)?$/i.test(base)) {
+    return true;
+  }
+  return false;
+}
+
+/**
+ * Determine whether the changes between buildCommit..HEAD touch any daemon-runtime
+ * package. Returns isDaemonAffecting:true conservatively when the changed-file set
+ * can't be obtained or any changed path is outside the known web-only package set
+ * AND is not a recognized non-runtime root file (marker/doc/license).
+ */
+async function classifyDaemonBuildChange(
+  repoPath: string,
+  buildCommit: string,
+  options: GitStatusOptions,
+): Promise<{ isDaemonAffecting: boolean; affectedPackages: string[] }> {
+  try {
+    const diff = await runGit(repoPath, ['diff', '--name-only', `${buildCommit}..HEAD`], options);
+    const files = diff.stdout
+      .split('\n')
+      .map((line) => line.trim())
+      .filter(Boolean);
+    if (files.length === 0) {
+      // No file diff (e.g. only merge metadata) — nothing actionable, but stay
+      // conservative and treat as daemon-affecting so we don't suppress a real warning.
+      return { isDaemonAffecting: true, affectedPackages: [] };
+    }
+    const pkgs = new Set<string>();
+    // A non-package path that is NOT a recognized benign root file (marker/doc).
+    // Only these force daemon-affecting; benign markers/docs are ignored so a
+    // gitlink-moving root commit over a marker-only oss commit no longer over-warns.
+    let sawRuntimeAmbiguousNonPackage = false;
+    for (const file of files) {
+      const match = file.match(/(?:^|\/)packages\/([^/]+)\//);
+      if (!match) {
+        if (!isNonRuntimeRootFile(file)) sawRuntimeAmbiguousNonPackage = true;
+        continue;
+      }
+      pkgs.add(match[1]);
+    }
+    const affectedPackages = [...pkgs].sort();
+    // Daemon-affecting if: any runtime-ambiguous non-package file changed, any
+    // unknown package changed, or any explicit daemon-runtime package changed.
+    // The daemon is unaffected only when every changed file is either a known
+    // web-only package or a recognized benign root file (and at least one such
+    // file changed) — i.e. nothing runtime-ambiguous remains.
+    const allBenign =
+      !sawRuntimeAmbiguousNonPackage &&
+      affectedPackages.every((p) => WEB_ONLY_PACKAGES.has(p) && !DAEMON_RUNTIME_PACKAGES.has(p));
+    return { isDaemonAffecting: !allBenign, affectedPackages };
+  } catch {
+    // diff probe failed → can't prove web-only; stay conservative.
+    return { isDaemonAffecting: true, affectedPackages: [] };
+  }
+}
+
+async function detectDaemonBuildBehind(
+  repo: ResolvedGitRepo,
+  submodules: GitSubmoduleStatus[] | undefined,
+  options: GitStatusOptions,
+): Promise<DaemonBuildBehind | undefined> {
+  const build = options.daemonBuildInfo ?? getDaemonBuildInfo();
+  if (!build.commit || build.commit === 'unknown') return undefined;
+
+  // Check the root repo first, then each submodule. The daemon build commit is
+  // baked from the daemon-core (oss submodule) HEAD, so on an adhdev
+  // superproject worktree the match is expected on the `oss` submodule, not the
+  // root — checking both keeps the helper repo-agnostic.
+  const scopes: Array<{ scope: string; repoPath: string }> = [
+    { scope: 'root', repoPath: repo.repoRoot || repo.workspace },
+  ];
+  for (const sub of submodules || []) {
+    if (sub.repoPath && !sub.error) scopes.push({ scope: sub.path, repoPath: sub.repoPath });
+  }
+
+  for (const { scope, repoPath } of scopes) {
+    try {
+      // Build commit must be a real object in THIS repo, else it's a different repo.
+      await runGit(repoPath, ['cat-file', '-e', `${build.commit}^{commit}`], options);
+      const headResult = await runGit(repoPath, ['rev-parse', 'HEAD'], options);
+      const head = headResult.stdout.trim();
+      if (!head || head === build.commit) continue;
+      // Strict ancestor: build commit is reachable from HEAD but is not HEAD.
+      await runGit(repoPath, ['merge-base', '--is-ancestor', build.commit, 'HEAD'], options);
+      // No throw → build commit IS an ancestor of HEAD → daemon is behind.
+      // Inspect WHICH packages changed in buildCommit..HEAD. A daemon rebuild/restart
+      // is only actually required when a daemon-runtime package changed; if only web /
+      // render packages changed, the daemon is unaffected and just the web deploy is
+      // pending. Conservative: any probe failure → treat as daemon-affecting.
+      const { isDaemonAffecting, affectedPackages } = await classifyDaemonBuildChange(
+        repoPath,
+        build.commit,
+        options,
+      );
+      const scopeLabel = scope === 'root' ? 'workspace' : scope;
+      const benignDetail = affectedPackages.length > 0
+        ? `only web packages changed (${affectedPackages.join(', ')})`
+        : 'only non-runtime files changed (markers/docs)';
+      const warning = isDaemonAffecting
+        ? `Live daemon was built from ${build.commitShort} which is behind ${scopeLabel} HEAD ${head.slice(0, 7)}. ` +
+          `Merged code is NOT live until the daemon is rebuilt/redeployed and restarted — a local dist rebuild alone does not update a cloud daemon.`
+        : `Live daemon was built from ${build.commitShort} which is behind ${scopeLabel} HEAD ${head.slice(0, 7)}, ` +
+          `but ${benignDetail}. ` +
+          `Daemon restart NOT required — redeploy the web app to reflect the change.`;
+      return {
+        buildCommit: build.commit,
+        buildCommitShort: build.commitShort,
+        head,
+        scope,
+        isDaemonAffecting,
+        ...(affectedPackages && affectedPackages.length > 0 ? { affectedPackages } : {}),
+        warning,
+      };
+    } catch {
+      // cat-file / merge-base non-zero exit (commit absent or not an ancestor)
+      // or any git error → not a provable staleness for this scope; try next.
+      continue;
     }
-    return emptyStatus(
-      workspace,
-      lastCheckedAt,
-      new GitCommandError('git_command_failed', 'Failed to read Git status', { cause: error }),
-    );
   }
+  return undefined;
 }
 
 interface ParsedPorcelainStatus {
@@ -285,6 +541,7 @@ function emptyStatus(workspace: string, lastCheckedAt: number, error: GitCommand
     untracked: 0,
     deleted: 0,
     renamed: 0,
+    dirty: false,
     hasConflicts: false,
     conflictFiles: [],
     stashCount: 0,
@@ -303,44 +560,152 @@ async function getSubmoduleStatuses(
   if (!repo.repoRoot) return [];
 
   try {
-    const result = await runGit(repo, ['submodule', 'status', '--recursive'], options);
-    return parseSubmoduleStatusOutput(result.stdout, repo.repoRoot, options.submoduleIgnorePaths);
+    // Do NOT shell out to `git submodule status`. That porcelain wrapper is a
+    // shell script (`git-submodule`) that, per submodule, spawns several child
+    // `git` processes; on Windows the wrapper + per-spawn cost alone measured
+    // 6.9–62.4s under AV, which dominated the whole collectGitRepoStatus budget
+    // and stalled the mesh graph cold-open. The information it gives us — the
+    // gitlink sync state (path / recorded SHA / +/-/U prefix) — is fully
+    // derivable from plumbing commands that don't go through the shell wrapper:
+    //   • paths           ← `.gitmodules` (git config --file, plumbing)
+    //   • expected SHA     ← `git ls-tree HEAD <path>` (the gitlink the super-
+    //                        project's HEAD tree records)
+    //   • actual SHA       ← `git -C <sub> rev-parse HEAD` (already paid below by
+    //                        enrichSubmoduleWorktreeStatus for the dirty check)
+    // Comparing expected vs actual reproduces `+` (out of sync); a checked-out
+    // submodule whose worktree is absent/uninitialized reproduces `-`. The `U`
+    // (conflict) prefix is surfaced separately via the superproject porcelain
+    // status that the caller already parses, and a conflicted submodule's own
+    // status read here also flags it dirty — so no row is lost.
+    const submodules = await deriveSubmoduleGitlinkStatuses(repo, options);
+    await Promise.all(submodules.map(submodule => enrichSubmoduleWorktreeStatus(repo, submodule, options)));
+    return submodules;
   } catch {
     return [];
   }
 }
 
-function parseSubmoduleStatusOutput(
-  output: string,
-  repoRoot: string,
-  ignorePaths?: string[],
-): GitSubmoduleStatus[] {
-  const submodules: GitSubmoduleStatus[] = [];
-  const ignoreSet = new Set(ignorePaths || []);
+/**
+ * Enumerate the superproject's submodules and their gitlink sync state without the
+ * slow `git submodule status` shell wrapper. Pure plumbing: read paths from
+ * `.gitmodules`, the expected (recorded) gitlink SHA from `ls-tree HEAD`, and the
+ * actual checked-out SHA from the submodule's own `rev-parse HEAD`.
+ */
+async function deriveSubmoduleGitlinkStatuses(
+  repo: ResolvedGitRepo,
+  options: GitStatusOptions,
+): Promise<GitSubmoduleStatus[]> {
+  if (!repo.repoRoot) return [];
+  const paths = await readSubmodulePaths(repo, options);
+  const ignoreSet = new Set(options.submoduleIgnorePaths || []);
+  const lastCheckedAt = Date.now();
 
-  for (const line of output.split('\n')) {
-    if (!line.trim()) continue;
-
-    // Format: [+- ]<commit> <path> (<branch>)
-    // - = out of sync, + = dirty, ' ' = clean
-    const match = line.match(/^([\-+\s])([0-9a-f]{40})\s+(\S+)(?:\s+\(([^)]+)\))?/);
-    if (!match) continue;
-
-    const prefix = match[1];
-    const commit = match[2];
-    const path = match[3];
-
-    if (ignoreSet.has(path)) continue;
-
-    submodules.push({
-      path,
-      commit,
-      repoPath: repoRoot + '/' + path,
-      dirty: prefix === '+',
-      outOfSync: prefix === '-',
-      lastCheckedAt: Date.now(),
-    });
+  const entries = await Promise.all(
+    paths
+      .filter(path => !ignoreSet.has(path))
+      .map(async (path): Promise<GitSubmoduleStatus> => {
+        const repoPath = repo.repoRoot + '/' + path;
+        const expected = await readGitlinkExpectedSha(repo, path, options);
+        const actual = await readSubmoduleHeadSha(repo, repoPath, options);
+        // Uninitialized / no checked-out HEAD reproduces `git submodule status`'s
+        // `-` prefix; a present-but-divergent HEAD reproduces the `+` prefix.
+        const outOfSync = actual === null
+          ? true
+          : expected !== null && expected !== actual;
+        return {
+          path,
+          // Prefer the recorded gitlink SHA (matches the legacy column); fall back
+          // to the checked-out SHA so the field is never empty when both are known.
+          commit: expected ?? actual ?? '',
+          repoPath,
+          dirty: false,
+          outOfSync,
+          lastCheckedAt,
+        };
+      }),
+  );
+  return entries;
+}
+
+/** Read submodule paths from `.gitmodules` via plumbing (no shell wrapper). */
+async function readSubmodulePaths(repo: ResolvedGitRepo, options: GitStatusOptions): Promise<string[]> {
+  if (!repo.repoRoot) return [];
+  const gitmodulesPath = repo.repoRoot + '/.gitmodules';
+  try {
+    const result = await runGit(
+      repo,
+      ['config', '--file', gitmodulesPath, '--get-regexp', '^submodule\\..*\\.path$'],
+      options,
+    );
+    const paths: string[] = [];
+    for (const line of result.stdout.split('\n')) {
+      // Each line: `submodule.<name>.path <path>`
+      const spaceIdx = line.indexOf(' ');
+      if (spaceIdx < 0) continue;
+      const value = line.slice(spaceIdx + 1).trim();
+      if (value) paths.push(value);
+    }
+    return paths;
+  } catch {
+    // No .gitmodules (not a superproject) or unreadable → no submodules.
+    return [];
   }
+}
 
-  return submodules;
+/** Expected gitlink SHA recorded in the superproject HEAD tree for this submodule path. */
+async function readGitlinkExpectedSha(
+  repo: ResolvedGitRepo,
+  submodulePath: string,
+  options: GitStatusOptions,
+): Promise<string | null> {
+  try {
+    // `ls-tree HEAD <path>` prints: `<mode> commit <sha>\t<path>` for a gitlink.
+    const result = await runGit(repo, ['ls-tree', 'HEAD', submodulePath], options);
+    const line = result.stdout.split('\n').find(l => l.trim().length > 0);
+    if (!line) return null;
+    const match = line.match(/^\s*\d+\s+commit\s+([0-9a-f]{40})\b/);
+    return match ? match[1] : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Actual checked-out HEAD SHA of a submodule, or null if uninitialized/unreadable. */
+async function readSubmoduleHeadSha(
+  repo: ResolvedGitRepo,
+  repoPath: string,
+  options: GitStatusOptions,
+): Promise<string | null> {
+  try {
+    // Run in the submodule worktree via cwd (inside the superproject root, so the
+    // executor's path-inside-repo guard is satisfied) rather than resolving the
+    // submodule as a fresh repo — that would cost an extra `rev-parse --show-toplevel`
+    // spawn per submodule, which is exactly the Windows spawn cost this fix removes.
+    const result = await runGit(repo, ['rev-parse', 'HEAD'], { ...options, cwd: repoPath });
+    const sha = result.stdout.trim();
+    return /^[0-9a-f]{40}$/.test(sha) ? sha : null;
+  } catch {
+    return null;
+  }
 }
+
+async function enrichSubmoduleWorktreeStatus(
+  repo: ResolvedGitRepo,
+  submodule: GitSubmoduleStatus,
+  options: GitStatusOptions,
+): Promise<void> {
+  try {
+    const result = await runGit(repo, ['status', '--porcelain=v2', '--branch'], {
+      ...options,
+      cwd: submodule.repoPath,
+    });
+    const parsed = parsePorcelainV2Status(result.stdout);
+    const dirty = parsed.staged + parsed.modified + parsed.untracked + parsed.deleted + parsed.renamed > 0
+      || parsed.conflictFiles.length > 0;
+    submodule.dirty = submodule.dirty || dirty;
+  } catch (error) {
+    submodule.dirty = true;
+    submodule.error = formatGitError(error);
+  }
+}
+

package/src/git/git-types.ts

@@ -6,69 +6,21 @@
  * infer these values from agent transcripts in frontend code.
  */
 
-export type GitFailureReason =
-  | 'not_git_repo'
-  | 'git_not_installed'
-  | 'timeout'
-  | 'path_outside_repo'
-  | 'dirty_index_required'
-  | 'conflict'
-  | 'invalid_args'
-  | 'nothing_to_commit'
-  | 'git_command_failed';
+// Pure shape types now live in @adhdev/mesh-shared so the cloud (web-core) and
+// standalone (daemon-core) transports share ONE definition instead of hand-syncing
+// two. Re-exported here so existing `from './git-types'` / package imports keep
+// working unchanged. Daemon-specific types (GitSnapshot, GitCommandName, …) stay
+// local below and consume these re-exports.
+export type {
+  GitFailureReason,
+  GitRepoIdentity,
+  GitSubmoduleStatus,
+  GitUpstreamFreshness,
+  GitRepoStatus,
+  DaemonBuildBehind,
+} from '@adhdev/mesh-shared';
 
-export interface GitRepoIdentity {
-  workspace: string;
-  repoRoot: string | null;
-  isGitRepo: boolean;
-}
-
-export interface GitSubmoduleStatus {
-  /** Submodule path relative to repo root */
-  path: string;
-  /** Current commit SHA the submodule is at */
-  commit: string;
-  /** Path to the submodule repo (absolute) */
-  repoPath: string;
-  /** Whether the submodule has uncommitted changes */
-  dirty: boolean;
-  /** Whether the submodule commit differs from what the parent repo expects */
-  outOfSync: boolean;
-  /** Last checked timestamp */
-  lastCheckedAt: number;
-  /** Error message if submodule status could not be read */
-  error?: string;
-}
-
-export type GitUpstreamFreshness = 'fresh' | 'unchecked' | 'stale' | 'no_upstream' | 'unavailable';
-
-export interface GitRepoStatus extends GitRepoIdentity {
-  branch: string | null;
-  headCommit: string | null;
-  headMessage: string | null;
-  upstream: string | null;
-  /** Whether ahead/behind was verified against a freshly fetched upstream ref. */
-  upstreamStatus: GitUpstreamFreshness;
-  /** Timestamp for the fetch that refreshed upstream refs when upstreamStatus === 'fresh'. */
-  upstreamFetchedAt?: number;
-  /** Error from the last refresh attempt when upstreamStatus === 'stale'. */
-  upstreamFetchError?: string;
-  ahead: number;
-  behind: number;
-  staged: number;
-  modified: number;
-  untracked: number;
-  deleted: number;
-  renamed: number;
-  hasConflicts: boolean;
-  conflictFiles: string[];
-  stashCount: number;
-  lastCheckedAt: number;
-  /** Submodule statuses when auto-discover is enabled */
-  submodules?: GitSubmoduleStatus[];
-  error?: string;
-  reason?: GitFailureReason;
-}
+import type { GitRepoIdentity, GitRepoStatus, GitFailureReason, GitUpstreamFreshness } from '@adhdev/mesh-shared';
 
 export type GitFileChangeStatus =
   | 'added'

package/src/git/git-worktree.ts

@@ -116,8 +116,11 @@ export async function createWorktree(opts: WorktreeCreateOptions): Promise<Workt
         });
     } catch (error: any) {
         const stderr = typeof error.stderr === 'string' ? error.stderr : '';
-        // Clean error messages for common failures
         if (/already exists/i.test(stderr)) {
+            // Distinguish directory-collision (TOCTOU race) from branch-already-exists
+            if (existsSync(targetDir)) {
+                throw new Error(`Worktree target directory was created concurrently: ${targetDir}`);
+            }
             throw new Error(`Branch '${branch}' already exists or is checked out in another worktree`);
         }
         throw new Error(`git worktree add failed: ${stderr.trim() || error.message}`);
@@ -170,6 +173,10 @@ export async function removeWorktree(repoRoot: string, worktreePath: string, opt
         const stdout = typeof error.stdout === 'string' ? error.stdout : '';
         const detail = `${stderr}\n${stdout}\n${error.message || ''}`;
         if (opts.allowSubmoduleForceFallback && SUBMODULE_WORKTREE_REMOVE_RE.test(detail)) {
+            process.stderr.write(
+                `[adhdev-mesh] WARNING: git worktree remove --force fallback for submodule worktree '${worktreePath}'. `
+                + `Any uncommitted changes inside submodules will be lost.\n`,
+            );
             try {
                 await execFileAsync('git', ['worktree', 'remove', '--force', worktreePath], {
                     cwd: repoRoot,